@remnic/core 1.1.11 → 1.1.13

package/dist/chunk-FIT6DMX6.js

@@ -0,0 +1,310 @@
+// src/network/webdav.ts
+import { createReadStream } from "fs";
+import { mkdir, readdir, realpath, stat } from "fs/promises";
+import { createServer } from "http";
+import { timingSafeEqual } from "crypto";
+import path from "path";
+import { pipeline } from "stream/promises";
+import { URL } from "url";
+function hostToUrlAuthority(host) {
+  if (host.includes(":") && !host.startsWith("[") && !host.endsWith("]")) {
+    return `[${host}]`;
+  }
+  return host;
+}
+var WebDavServer = class _WebDavServer {
+  options;
+  allowedRoots;
+  server = null;
+  boundPort;
+  constructor(options, allowedRoots) {
+    this.options = options;
+    this.allowedRoots = allowedRoots;
+    this.boundPort = options.port;
+  }
+  static async create(input) {
+    const options = {
+      enabled: input.enabled ?? false,
+      host: input.host ?? "127.0.0.1",
+      port: input.port,
+      allowlistDirs: input.allowlistDirs,
+      auth: input.auth
+    };
+    if (!Array.isArray(options.allowlistDirs) || options.allowlistDirs.length === 0) {
+      throw new Error("webdav allowlistDirs must include at least one directory");
+    }
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65535) {
+      throw new Error(`invalid webdav port: ${options.port}`);
+    }
+    const allowedRoots = [];
+    const aliasSet = /* @__PURE__ */ new Set();
+    for (const dir of options.allowlistDirs) {
+      const resolved = path.resolve(dir);
+      await mkdir(resolved, { recursive: true });
+      const canonical = await realpath(resolved);
+      const alias = path.basename(canonical) || "root";
+      if (aliasSet.has(alias)) {
+        throw new Error(`duplicate webdav allowlist alias: ${alias}`);
+      }
+      aliasSet.add(alias);
+      allowedRoots.push({ absolute: canonical, name: alias });
+    }
+    return new _WebDavServer(options, allowedRoots);
+  }
+  async start() {
+    if (!this.options.enabled) {
+      throw new Error("webdav server is disabled; set enabled=true to start");
+    }
+    if (this.server) {
+      return this.status();
+    }
+    const server = createServer((req, res) => {
+      this.handle(req, res).catch((err) => {
+        if (res.headersSent) {
+          res.destroy(err);
+          return;
+        }
+        res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("webdav error");
+      });
+    });
+    this.server = server;
+    try {
+      await new Promise((resolve, reject) => {
+        const onError = (err) => {
+          server.removeListener("listening", onListening);
+          reject(err);
+        };
+        const onListening = () => {
+          server.removeListener("error", onError);
+          resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(this.options.port, this.options.host);
+      });
+    } catch (err) {
+      this.server = null;
+      server.close();
+      throw err;
+    }
+    const address = server.address();
+    if (address && typeof address !== "string") {
+      this.boundPort = address.port;
+    }
+    return this.status();
+  }
+  async stop() {
+    if (!this.server) return;
+    const server = this.server;
+    this.server = null;
+    this.boundPort = this.options.port;
+    await new Promise((resolve, reject) => {
+      server.close((err) => err ? reject(err) : resolve());
+    });
+  }
+  status() {
+    return {
+      running: this.server !== null,
+      host: this.options.host,
+      port: this.boundPort,
+      rootCount: this.allowedRoots.length
+    };
+  }
+  async handle(req, res) {
+    if (!this.isAuthorized(req)) {
+      res.writeHead(401, {
+        "WWW-Authenticate": 'Basic realm="Engram WebDAV"',
+        "Content-Type": "text/plain; charset=utf-8"
+      });
+      res.end("authentication required");
+      return;
+    }
+    const method = (req.method ?? "GET").toUpperCase();
+    if (method === "OPTIONS") {
+      res.writeHead(204, {
+        Allow: "OPTIONS, PROPFIND, GET, HEAD",
+        DAV: "1"
+      });
+      res.end();
+      return;
+    }
+    const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.options.host)}`);
+    const resolved = await this.resolvePath(parsed.pathname);
+    if (!resolved.ok) {
+      res.writeHead(resolved.code, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(resolved.message);
+      return;
+    }
+    if (method === "PROPFIND") {
+      await this.handlePropfind(resolved.absolutePath, resolved.displayPath, res);
+      return;
+    }
+    if (method === "GET" || method === "HEAD") {
+      await this.handleRead(method, resolved.absolutePath, res);
+      return;
+    }
+    res.writeHead(405, {
+      Allow: "OPTIONS, PROPFIND, GET, HEAD",
+      "Content-Type": "text/plain; charset=utf-8"
+    });
+    res.end("method not allowed");
+  }
+  isAuthorized(req) {
+    if (!this.options.auth) return true;
+    const raw = req.headers.authorization;
+    if (!raw) return false;
+    const separator = raw.indexOf(" ");
+    if (separator <= 0) return false;
+    const scheme = raw.slice(0, separator).toLowerCase();
+    if (scheme !== "basic") return false;
+    const encodedPart = raw.slice(separator + 1).trim();
+    if (!encodedPart) return false;
+    try {
+      const decoded = Buffer.from(encodedPart, "base64").toString("utf-8");
+      const credentialSeparator = decoded.indexOf(":");
+      if (credentialSeparator < 0) return false;
+      const username = decoded.slice(0, credentialSeparator);
+      const password = decoded.slice(credentialSeparator + 1);
+      const usernameOk = this.timingSafeStringEqual(username, this.options.auth.username);
+      const passwordOk = this.timingSafeStringEqual(password, this.options.auth.password);
+      return Boolean((usernameOk ? 1 : 0) & (passwordOk ? 1 : 0));
+    } catch {
+      return false;
+    }
+  }
+  timingSafeStringEqual(a, b) {
+    const left = this.encodeAuthField(a);
+    const right = this.encodeAuthField(b);
+    if (!left || !right) return false;
+    return timingSafeEqual(left, right);
+  }
+  encodeAuthField(value) {
+    const maxBytes = 512;
+    const encoded = Buffer.from(value, "utf-8");
+    if (encoded.length > maxBytes) return null;
+    const out = Buffer.alloc(2 + maxBytes);
+    out.writeUInt16BE(encoded.length, 0);
+    encoded.copy(out, 2);
+    return out;
+  }
+  async resolvePath(requestPathname) {
+    let decodedPath;
+    try {
+      decodedPath = decodeURIComponent(requestPathname || "/");
+    } catch {
+      return { ok: false, code: 400, message: "invalid path encoding" };
+    }
+    if (decodedPath.includes("\0")) {
+      return { ok: false, code: 400, message: "invalid path" };
+    }
+    const normalized = path.posix.normalize(decodedPath);
+    const segments = normalized.split("/").filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+      return { ok: false, code: 403, message: "root listing is not allowed" };
+    }
+    const rootName = segments[0];
+    const root = this.allowedRoots.find((entry) => entry.name === rootName);
+    if (!root) {
+      return { ok: false, code: 403, message: "path is outside allowlist" };
+    }
+    const relative = segments.slice(1);
+    if (relative.some((segment) => segment === ".." || segment.includes("\\"))) {
+      return { ok: false, code: 403, message: "path traversal is not allowed" };
+    }
+    const candidate = path.resolve(root.absolute, ...relative);
+    if (!this.isPathInside(root.absolute, candidate)) {
+      return { ok: false, code: 403, message: "path escaped allowlist" };
+    }
+    try {
+      const canonicalCandidate = await realpath(candidate);
+      if (!this.isPathInside(root.absolute, canonicalCandidate)) {
+        return { ok: false, code: 403, message: "path escaped allowlist via symlink" };
+      }
+      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join("/")}` };
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") {
+        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join("/")}` };
+      }
+      if (code === "ENOTDIR" || code === "ELOOP") {
+        return { ok: false, code: 400, message: "invalid path" };
+      }
+      throw err;
+    }
+  }
+  async handleRead(method, absolutePath, res) {
+    let info;
+    try {
+      info = await stat(absolutePath);
+    } catch {
+      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("not found");
+      return;
+    }
+    if (!info.isFile()) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("path is not a file");
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Length": String(info.size),
+      "Content-Type": "application/octet-stream"
+    });
+    if (method === "HEAD") {
+      res.end();
+      return;
+    }
+    await pipeline(createReadStream(absolutePath), res);
+  }
+  async handlePropfind(absolutePath, displayPath, res) {
+    let info;
+    try {
+      info = await stat(absolutePath);
+    } catch {
+      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("not found");
+      return;
+    }
+    const entries = [];
+    if (info.isDirectory()) {
+      const children = await readdir(absolutePath, { withFileTypes: true });
+      for (const child of children) {
+        const childHref = toEncodedHref(`${displayPath.replace(/\/$/, "")}/${child.name}`);
+        entries.push(`
+  <d:response>
+    <d:href>${xmlEscape(childHref)}</d:href>
+    <d:propstat><d:prop><d:resourcetype>${child.isDirectory() ? "<d:collection/>" : ""}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>`);
+      }
+    }
+    const xml = `<?xml version="1.0" encoding="utf-8"?>
+<d:multistatus xmlns:d="DAV:">
+  <d:response>
+    <d:href>${xmlEscape(toEncodedHref(displayPath))}</d:href>
+    <d:propstat><d:prop><d:resourcetype>${info.isDirectory() ? "<d:collection/>" : ""}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>
+  </d:response>${entries.join("")}
+</d:multistatus>`;
+    res.writeHead(207, { "Content-Type": "application/xml; charset=utf-8" });
+    res.end(xml);
+  }
+  isPathInside(root, target) {
+    if (target === root) return true;
+    if (root === path.parse(root).root) {
+      return target.startsWith(root);
+    }
+    return target.startsWith(`${root}${path.sep}`);
+  }
+};
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function toEncodedHref(pathname) {
+  return pathname.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+
+export {
+  hostToUrlAuthority,
+  WebDavServer
+};
+//# sourceMappingURL=chunk-FIT6DMX6.js.map

package/dist/chunk-FIT6DMX6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/network/webdav.ts"],"sourcesContent":["import { createReadStream } from \"node:fs\";\nimport { mkdir, readdir, realpath, stat } from \"node:fs/promises\";\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { timingSafeEqual } from \"node:crypto\";\nimport path from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport { URL } from \"node:url\";\n\nexport function hostToUrlAuthority(host: string): string {\n  if (host.includes(\":\") && !host.startsWith(\"[\") && !host.endsWith(\"]\")) {\n    return `[${host}]`;\n  }\n  return host;\n}\n\nexport interface WebDavAuth {\n  username: string;\n  password: string;\n}\n\nexport interface WebDavServerOptions {\n  enabled?: boolean;\n  host?: string;\n  port: number;\n  allowlistDirs: string[];\n  auth?: WebDavAuth;\n}\n\nexport interface WebDavServerStatus {\n  running: boolean;\n  host: string;\n  port: number;\n  rootCount: number;\n}\n\ninterface AllowedRoot {\n  absolute: string;\n  name: string;\n}\n\nexport class WebDavServer {\n  private readonly options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\">;\n  private readonly allowedRoots: AllowedRoot[];\n  private server: Server | null = null;\n  private boundPort: number;\n\n  private constructor(\n    options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\">,\n    allowedRoots: AllowedRoot[],\n  ) {\n    this.options = options;\n    this.allowedRoots = allowedRoots;\n    this.boundPort = options.port;\n  }\n\n  static async create(input: WebDavServerOptions): Promise<WebDavServer> {\n    const options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\"> = {\n      enabled: input.enabled ?? false,\n      host: input.host ?? \"127.0.0.1\",\n      port: input.port,\n      allowlistDirs: input.allowlistDirs,\n      auth: input.auth,\n    };\n\n    if (!Array.isArray(options.allowlistDirs) || options.allowlistDirs.length === 0) {\n      throw new Error(\"webdav allowlistDirs must include at least one directory\");\n    }\n    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65535) {\n      throw new Error(`invalid webdav port: ${options.port}`);\n    }\n\n    const allowedRoots: AllowedRoot[] = [];\n    const aliasSet = new Set<string>();\n    for (const dir of options.allowlistDirs) {\n      const resolved = path.resolve(dir);\n      await mkdir(resolved, { recursive: true });\n      const canonical = await realpath(resolved);\n      const alias = path.basename(canonical) || \"root\";\n      if (aliasSet.has(alias)) {\n        throw new Error(`duplicate webdav allowlist alias: ${alias}`);\n      }\n      aliasSet.add(alias);\n      allowedRoots.push({ absolute: canonical, name: alias });\n    }\n\n    return new WebDavServer(options, allowedRoots);\n  }\n\n  async start(): Promise<WebDavServerStatus> {\n    if (!this.options.enabled) {\n      throw new Error(\"webdav server is disabled; set enabled=true to start\");\n    }\n    if (this.server) {\n      return this.status();\n    }\n\n    const server = createServer((req, res) => {\n      this.handle(req, res).catch((err) => {\n        if (res.headersSent) {\n          res.destroy(err as Error);\n          return;\n        }\n        res.writeHead(500, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n        res.end(\"webdav error\");\n      });\n    });\n    this.server = server;\n\n    try {\n      await new Promise<void>((resolve, reject) => {\n        const onError = (err: Error) => {\n          server.removeListener(\"listening\", onListening);\n          reject(err);\n        };\n        const onListening = () => {\n          server.removeListener(\"error\", onError);\n          resolve();\n        };\n        server.once(\"error\", onError);\n        server.once(\"listening\", onListening);\n        server.listen(this.options.port, this.options.host);\n      });\n    } catch (err) {\n      this.server = null;\n      server.close();\n      throw err;\n    }\n\n    const address = server.address();\n    if (address && typeof address !== \"string\") {\n      this.boundPort = address.port;\n    }\n\n    return this.status();\n  }\n\n  async stop(): Promise<void> {\n    if (!this.server) return;\n    const server = this.server;\n    this.server = null;\n    this.boundPort = this.options.port;\n    await new Promise<void>((resolve, reject) => {\n      server.close((err) => (err ? reject(err) : resolve()));\n    });\n  }\n\n  status(): WebDavServerStatus {\n    return {\n      running: this.server !== null,\n      host: this.options.host,\n      port: this.boundPort,\n      rootCount: this.allowedRoots.length,\n    };\n  }\n\n  private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    if (!this.isAuthorized(req)) {\n      res.writeHead(401, {\n        \"WWW-Authenticate\": 'Basic realm=\"Engram WebDAV\"',\n        \"Content-Type\": \"text/plain; charset=utf-8\",\n      });\n      res.end(\"authentication required\");\n      return;\n    }\n\n    const method = (req.method ?? \"GET\").toUpperCase();\n    if (method === \"OPTIONS\") {\n      res.writeHead(204, {\n        Allow: \"OPTIONS, PROPFIND, GET, HEAD\",\n        DAV: \"1\",\n      });\n      res.end();\n      return;\n    }\n\n    const parsed = new URL(req.url ?? \"/\", `http://${hostToUrlAuthority(this.options.host)}`);\n    const resolved = await this.resolvePath(parsed.pathname);\n    if (!resolved.ok) {\n      res.writeHead(resolved.code, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(resolved.message);\n      return;\n    }\n\n    if (method === \"PROPFIND\") {\n      await this.handlePropfind(resolved.absolutePath, resolved.displayPath, res);\n      return;\n    }\n\n    if (method === \"GET\" || method === \"HEAD\") {\n      await this.handleRead(method, resolved.absolutePath, res);\n      return;\n    }\n\n    res.writeHead(405, {\n      Allow: \"OPTIONS, PROPFIND, GET, HEAD\",\n      \"Content-Type\": \"text/plain; charset=utf-8\",\n    });\n    res.end(\"method not allowed\");\n  }\n\n  private isAuthorized(req: IncomingMessage): boolean {\n    if (!this.options.auth) return true;\n    const raw = req.headers.authorization;\n    if (!raw) return false;\n    const separator = raw.indexOf(\" \");\n    if (separator <= 0) return false;\n    const scheme = raw.slice(0, separator).toLowerCase();\n    if (scheme !== \"basic\") return false;\n    const encodedPart = raw.slice(separator + 1).trim();\n    if (!encodedPart) return false;\n\n    try {\n      const decoded = Buffer.from(encodedPart, \"base64\").toString(\"utf-8\");\n      const credentialSeparator = decoded.indexOf(\":\");\n      if (credentialSeparator < 0) return false;\n      const username = decoded.slice(0, credentialSeparator);\n      const password = decoded.slice(credentialSeparator + 1);\n      const usernameOk = this.timingSafeStringEqual(username, this.options.auth.username);\n      const passwordOk = this.timingSafeStringEqual(password, this.options.auth.password);\n      return Boolean((usernameOk ? 1 : 0) & (passwordOk ? 1 : 0));\n    } catch {\n      return false;\n    }\n  }\n\n  private timingSafeStringEqual(a: string, b: string): boolean {\n    const left = this.encodeAuthField(a);\n    const right = this.encodeAuthField(b);\n    if (!left || !right) return false;\n    return timingSafeEqual(left, right);\n  }\n\n  private encodeAuthField(value: string): Buffer | null {\n    const maxBytes = 512;\n    const encoded = Buffer.from(value, \"utf-8\");\n    if (encoded.length > maxBytes) return null;\n    const out = Buffer.alloc(2 + maxBytes);\n    out.writeUInt16BE(encoded.length, 0);\n    encoded.copy(out, 2);\n    return out;\n  }\n\n  private async resolvePath(requestPathname: string): Promise<\n    | { ok: true; absolutePath: string; displayPath: string }\n    | { ok: false; code: number; message: string }\n  > {\n    let decodedPath: string;\n    try {\n      decodedPath = decodeURIComponent(requestPathname || \"/\");\n    } catch {\n      return { ok: false, code: 400, message: \"invalid path encoding\" };\n    }\n    if (decodedPath.includes(\"\\0\")) {\n      return { ok: false, code: 400, message: \"invalid path\" };\n    }\n\n    const normalized = path.posix.normalize(decodedPath);\n    const segments = normalized.split(\"/\").filter((segment) => segment.length > 0);\n\n    if (segments.length === 0) {\n      return { ok: false, code: 403, message: \"root listing is not allowed\" };\n    }\n\n    const rootName = segments[0];\n    const root = this.allowedRoots.find((entry) => entry.name === rootName);\n    if (!root) {\n      return { ok: false, code: 403, message: \"path is outside allowlist\" };\n    }\n\n    const relative = segments.slice(1);\n    if (relative.some((segment) => segment === \"..\" || segment.includes(\"\\\\\"))) {\n      return { ok: false, code: 403, message: \"path traversal is not allowed\" };\n    }\n\n    const candidate = path.resolve(root.absolute, ...relative);\n    if (!this.isPathInside(root.absolute, candidate)) {\n      return { ok: false, code: 403, message: \"path escaped allowlist\" };\n    }\n\n    try {\n      const canonicalCandidate = await realpath(candidate);\n      if (!this.isPathInside(root.absolute, canonicalCandidate)) {\n        return { ok: false, code: 403, message: \"path escaped allowlist via symlink\" };\n      }\n      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join(\"/\")}` };\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === \"ENOENT\") {\n        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join(\"/\")}` };\n      }\n      if (code === \"ENOTDIR\" || code === \"ELOOP\") {\n        return { ok: false, code: 400, message: \"invalid path\" };\n      }\n      throw err;\n    }\n  }\n\n  private async handleRead(method: \"GET\" | \"HEAD\", absolutePath: string, res: ServerResponse): Promise<void> {\n    let info;\n    try {\n      info = await stat(absolutePath);\n    } catch {\n      res.writeHead(404, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"not found\");\n      return;\n    }\n\n    if (!info.isFile()) {\n      res.writeHead(403, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"path is not a file\");\n      return;\n    }\n\n    res.writeHead(200, {\n      \"Content-Length\": String(info.size),\n      \"Content-Type\": \"application/octet-stream\",\n    });\n\n    if (method === \"HEAD\") {\n      res.end();\n      return;\n    }\n\n    await pipeline(createReadStream(absolutePath), res);\n  }\n\n  private async handlePropfind(absolutePath: string, displayPath: string, res: ServerResponse): Promise<void> {\n    let info;\n    try {\n      info = await stat(absolutePath);\n    } catch {\n      res.writeHead(404, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"not found\");\n      return;\n    }\n\n    const entries: string[] = [];\n    if (info.isDirectory()) {\n      const children = await readdir(absolutePath, { withFileTypes: true });\n      for (const child of children) {\n        const childHref = toEncodedHref(`${displayPath.replace(/\\/$/, \"\")}/${child.name}`);\n        entries.push(`\n  <d:response>\n    <d:href>${xmlEscape(childHref)}</d:href>\n    <d:propstat><d:prop><d:resourcetype>${child.isDirectory() ? \"<d:collection/>\" : \"\"}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>\n  </d:response>`);\n      }\n    }\n\n    const xml = `<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<d:multistatus xmlns:d=\"DAV:\">\n  <d:response>\n    <d:href>${xmlEscape(toEncodedHref(displayPath))}</d:href>\n    <d:propstat><d:prop><d:resourcetype>${info.isDirectory() ? \"<d:collection/>\" : \"\"}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>\n  </d:response>${entries.join(\"\")}\n</d:multistatus>`;\n\n    res.writeHead(207, { \"Content-Type\": \"application/xml; charset=utf-8\" });\n    res.end(xml);\n  }\n\n  private isPathInside(root: string, target: string): boolean {\n    if (target === root) return true;\n    if (root === path.parse(root).root) {\n      return target.startsWith(root);\n    }\n    return target.startsWith(`${root}${path.sep}`);\n  }\n}\n\nfunction xmlEscape(value: string): string {\n  return value\n    .replaceAll(\"&\", \"&amp;\")\n    .replaceAll(\"<\", \"&lt;\")\n    .replaceAll(\">\", \"&gt;\")\n    .replaceAll('\"', \"&quot;\")\n    .replaceAll(\"'\", \"&apos;\");\n}\n\nfunction toEncodedHref(pathname: string): string {\n  return pathname\n    .split(\"/\")\n    .map((segment) => encodeURIComponent(segment))\n    .join(\"/\");\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC,SAAS,OAAO,SAAS,UAAU,YAAY;AAC/C,SAAS,oBAA4E;AACrF,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,gBAAgB;AACzB,SAAS,WAAW;AAEb,SAAS,mBAAmB,MAAsB;AACvD,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;AACtE,WAAO,IAAI,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AA2BO,IAAM,eAAN,MAAM,cAAa;AAAA,EACP;AAAA,EACA;AAAA,EACT,SAAwB;AAAA,EACxB;AAAA,EAEA,YACN,SACA,cACA;AACA,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA,EAEA,aAAa,OAAO,OAAmD;AACrE,UAAM,UAA2F;AAAA,MAC/F,SAAS,MAAM,WAAW;AAAA,MAC1B,MAAM,MAAM,QAAQ;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,eAAe,MAAM;AAAA,MACrB,MAAM,MAAM;AAAA,IACd;AAEA,QAAI,CAAC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,cAAc,WAAW,GAAG;AAC/E,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,CAAC,OAAO,UAAU,QAAQ,IAAI,KAAK,QAAQ,OAAO,KAAK,QAAQ,OAAO,OAAO;AAC/E,YAAM,IAAI,MAAM,wBAAwB,QAAQ,IAAI,EAAE;AAAA,IACxD;AAEA,UAAM,eAA8B,CAAC;AACrC,UAAM,WAAW,oBAAI,IAAY;AACjC,eAAW,OAAO,QAAQ,eAAe;AACvC,YAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,YAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;AACzC,YAAM,YAAY,MAAM,SAAS,QAAQ;AACzC,YAAM,QAAQ,KAAK,SAAS,SAAS,KAAK;AAC1C,UAAI,SAAS,IAAI,KAAK,GAAG;AACvB,cAAM,IAAI,MAAM,qCAAqC,KAAK,EAAE;AAAA,MAC9D;AACA,eAAS,IAAI,KAAK;AAClB,mBAAa,KAAK,EAAE,UAAU,WAAW,MAAM,MAAM,CAAC;AAAA,IACxD;AAEA,WAAO,IAAI,cAAa,SAAS,YAAY;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAqC;AACzC,QAAI,CAAC,KAAK,QAAQ,SAAS;AACzB,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,QAAI,KAAK,QAAQ;AACf,aAAO,KAAK,OAAO;AAAA,IACrB;AAEA,UAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,WAAK,OAAO,KAAK,GAAG,EAAE,MAAM,CAAC,QAAQ;AACnC,YAAI,IAAI,aAAa;AACnB,cAAI,QAAQ,GAAY;AACxB;AAAA,QACF;AACA,YAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,YAAI,IAAI,cAAc;AAAA,MACxB,CAAC;AAAA,IACH,CAAC;AACD,SAAK,SAAS;AAEd,QAAI;AACF,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAM,UAAU,CAAC,QAAe;AAC9B,iBAAO,eAAe,aAAa,WAAW;AAC9C,iBAAO,GAAG;AAAA,QACZ;AACA,cAAM,cAAc,MAAM;AACxB,iBAAO,eAAe,SAAS,OAAO;AACtC,kBAAQ;AAAA,QACV;AACA,eAAO,KAAK,SAAS,OAAO;AAC5B,eAAO,KAAK,aAAa,WAAW;AACpC,eAAO,OAAO,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,SAAS;AACd,aAAO,MAAM;AACb,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,OAAO,QAAQ;AAC/B,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,WAAK,YAAY,QAAQ;AAAA,IAC3B;AAEA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,SAAS,KAAK;AACpB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK,QAAQ;AAC9B,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACH;AAAA,EAEA,SAA6B;AAC3B,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,aAAa;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAsB,KAAoC;AAC7E,QAAI,CAAC,KAAK,aAAa,GAAG,GAAG;AAC3B,UAAI,UAAU,KAAK;AAAA,QACjB,oBAAoB;AAAA,QACpB,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,IAAI,yBAAyB;AACjC;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAI,WAAW,WAAW;AACxB,UAAI,UAAU,KAAK;AAAA,QACjB,OAAO;AAAA,QACP,KAAK;AAAA,MACP,CAAC;AACD,UAAI,IAAI;AACR;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,mBAAmB,KAAK,QAAQ,IAAI,CAAC,EAAE;AACxF,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO,QAAQ;AACvD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,UAAU,SAAS,MAAM,EAAE,gBAAgB,4BAA4B,CAAC;AAC5E,UAAI,IAAI,SAAS,OAAO;AACxB;AAAA,IACF;AAEA,QAAI,WAAW,YAAY;AACzB,YAAM,KAAK,eAAe,SAAS,cAAc,SAAS,aAAa,GAAG;AAC1E;AAAA,IACF;AAEA,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,KAAK,WAAW,QAAQ,SAAS,cAAc,GAAG;AACxD;AAAA,IACF;AAEA,QAAI,UAAU,KAAK;AAAA,MACjB,OAAO;AAAA,MACP,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,IAAI,oBAAoB;AAAA,EAC9B;AAAA,EAEQ,aAAa,KAA+B;AAClD,QAAI,CAAC,KAAK,QAAQ,KAAM,QAAO;AAC/B,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,YAAY,IAAI,QAAQ,GAAG;AACjC,QAAI,aAAa,EAAG,QAAO;AAC3B,UAAM,SAAS,IAAI,MAAM,GAAG,SAAS,EAAE,YAAY;AACnD,QAAI,WAAW,QAAS,QAAO;AAC/B,UAAM,cAAc,IAAI,MAAM,YAAY,CAAC,EAAE,KAAK;AAClD,QAAI,CAAC,YAAa,QAAO;AAEzB,QAAI;AACF,YAAM,UAAU,OAAO,KAAK,aAAa,QAAQ,EAAE,SAAS,OAAO;AACnE,YAAM,sBAAsB,QAAQ,QAAQ,GAAG;AAC/C,UAAI,sBAAsB,EAAG,QAAO;AACpC,YAAM,WAAW,QAAQ,MAAM,GAAG,mBAAmB;AACrD,YAAM,WAAW,QAAQ,MAAM,sBAAsB,CAAC;AACtD,YAAM,aAAa,KAAK,sBAAsB,UAAU,KAAK,QAAQ,KAAK,QAAQ;AAClF,YAAM,aAAa,KAAK,sBAAsB,UAAU,KAAK,QAAQ,KAAK,QAAQ;AAClF,aAAO,SAAS,aAAa,IAAI,MAAM,aAAa,IAAI,EAAE;AAAA,IAC5D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,sBAAsB,GAAW,GAAoB;AAC3D,UAAM,OAAO,KAAK,gBAAgB,CAAC;AACnC,UAAM,QAAQ,KAAK,gBAAgB,CAAC;AACpC,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO;AAC5B,WAAO,gBAAgB,MAAM,KAAK;AAAA,EACpC;AAAA,EAEQ,gBAAgB,OAA8B;AACpD,UAAM,WAAW;AACjB,UAAM,UAAU,OAAO,KAAK,OAAO,OAAO;AAC1C,QAAI,QAAQ,SAAS,SAAU,QAAO;AACtC,UAAM,MAAM,OAAO,MAAM,IAAI,QAAQ;AACrC,QAAI,cAAc,QAAQ,QAAQ,CAAC;AACnC,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,YAAY,iBAGxB;AACA,QAAI;AACJ,QAAI;AACF,oBAAc,mBAAmB,mBAAmB,GAAG;AAAA,IACzD,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,wBAAwB;AAAA,IAClE;AACA,QAAI,YAAY,SAAS,IAAI,GAAG;AAC9B,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,eAAe;AAAA,IACzD;AAEA,UAAM,aAAa,KAAK,MAAM,UAAU,WAAW;AACnD,UAAM,WAAW,WAAW,MAAM,GAAG,EAAE,OAAO,CAAC,YAAY,QAAQ,SAAS,CAAC;AAE7E,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,8BAA8B;AAAA,IACxE;AAEA,UAAM,WAAW,SAAS,CAAC;AAC3B,UAAM,OAAO,KAAK,aAAa,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ;AACtE,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,4BAA4B;AAAA,IACtE;AAEA,UAAM,WAAW,SAAS,MAAM,CAAC;AACjC,QAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,QAAQ,SAAS,IAAI,CAAC,GAAG;AAC1E,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,gCAAgC;AAAA,IAC1E;AAEA,UAAM,YAAY,KAAK,QAAQ,KAAK,UAAU,GAAG,QAAQ;AACzD,QAAI,CAAC,KAAK,aAAa,KAAK,UAAU,SAAS,GAAG;AAChD,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,yBAAyB;AAAA,IACnE;AAEA,QAAI;AACF,YAAM,qBAAqB,MAAM,SAAS,SAAS;AACnD,UAAI,CAAC,KAAK,aAAa,KAAK,UAAU,kBAAkB,GAAG;AACzD,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,qCAAqC;AAAA,MAC/E;AACA,aAAO,EAAE,IAAI,MAAM,cAAc,oBAAoB,aAAa,IAAI,SAAS,KAAK,GAAG,CAAC,GAAG;AAAA,IAC7F,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,UAAU;AACrB,eAAO,EAAE,IAAI,MAAM,cAAc,WAAW,aAAa,IAAI,SAAS,KAAK,GAAG,CAAC,GAAG;AAAA,MACpF;AACA,UAAI,SAAS,aAAa,SAAS,SAAS;AAC1C,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,eAAe;AAAA,MACzD;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,QAAwB,cAAsB,KAAoC;AACzG,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,IAChC,QAAQ;AACN,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,OAAO,GAAG;AAClB,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,oBAAoB;AAC5B;AAAA,IACF;AAEA,QAAI,UAAU,KAAK;AAAA,MACjB,kBAAkB,OAAO,KAAK,IAAI;AAAA,MAClC,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI;AACR;AAAA,IACF;AAEA,UAAM,SAAS,iBAAiB,YAAY,GAAG,GAAG;AAAA,EACpD;AAAA,EAEA,MAAc,eAAe,cAAsB,aAAqB,KAAoC;AAC1G,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,IAChC,QAAQ;AACN,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,UAAoB,CAAC;AAC3B,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,WAAW,MAAM,QAAQ,cAAc,EAAE,eAAe,KAAK,CAAC;AACpE,iBAAW,SAAS,UAAU;AAC5B,cAAM,YAAY,cAAc,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,IAAI,MAAM,IAAI,EAAE;AACjF,gBAAQ,KAAK;AAAA;AAAA,cAEP,UAAU,SAAS,CAAC;AAAA,0CACQ,MAAM,YAAY,IAAI,oBAAoB,EAAE;AAAA,gBACtE;AAAA,MACV;AAAA,IACF;AAEA,UAAM,MAAM;AAAA;AAAA;AAAA,cAGF,UAAU,cAAc,WAAW,CAAC,CAAC;AAAA,0CACT,KAAK,YAAY,IAAI,oBAAoB,EAAE;AAAA,iBACpE,QAAQ,KAAK,EAAE,CAAC;AAAA;AAG7B,QAAI,UAAU,KAAK,EAAE,gBAAgB,iCAAiC,CAAC;AACvE,QAAI,IAAI,GAAG;AAAA,EACb;AAAA,EAEQ,aAAa,MAAc,QAAyB;AAC1D,QAAI,WAAW,KAAM,QAAO;AAC5B,QAAI,SAAS,KAAK,MAAM,IAAI,EAAE,MAAM;AAClC,aAAO,OAAO,WAAW,IAAI;AAAA,IAC/B;AACA,WAAO,OAAO,WAAW,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE;AAAA,EAC/C;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,QAAQ,EACxB,WAAW,KAAK,QAAQ;AAC7B;AAEA,SAAS,cAAc,UAA0B;AAC/C,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,mBAAmB,OAAO,CAAC,EAC5C,KAAK,GAAG;AACb;","names":[]}

package/dist/chunk-FJ43PRLT.js

@@ -0,0 +1,272 @@
+import {
+  launchProcess
+} from "./chunk-NNVTUXEB.js";
+import {
+  log
+} from "./chunk-2ODBA7MQ.js";
+
+// src/conversation-index/faiss-adapter.ts
+import { fileURLToPath } from "url";
+import path from "path";
+var FaissAdapterError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "FaissAdapterError";
+  }
+  code;
+};
+function parseSidecarManifest(result) {
+  const manifest = result.manifest;
+  if (!manifest || typeof manifest.version !== "number" || typeof manifest.modelId !== "string" || typeof manifest.normalizedModelId !== "string" || typeof manifest.dimension !== "number" || typeof manifest.chunkCount !== "number" || typeof manifest.updatedAt !== "string" || typeof manifest.lastSuccessfulRebuildAt !== "string") {
+    return void 0;
+  }
+  return {
+    version: manifest.version,
+    modelId: manifest.modelId,
+    normalizedModelId: manifest.normalizedModelId,
+    dimension: manifest.dimension,
+    chunkCount: manifest.chunkCount,
+    updatedAt: manifest.updatedAt,
+    lastSuccessfulRebuildAt: manifest.lastSuccessfulRebuildAt
+  };
+}
+function resolveDefaultFaissScriptPath(fromModuleUrl = import.meta.url) {
+  const currentFile = fileURLToPath(fromModuleUrl);
+  const moduleDir = path.dirname(currentFile);
+  if (moduleDir.endsWith(`${path.sep}conversation-index`)) {
+    return path.resolve(moduleDir, "..", "..", "scripts", "faiss_index.py");
+  }
+  return path.resolve(moduleDir, "..", "scripts", "faiss_index.py");
+}
+var FaissConversationIndexAdapter = class {
+  constructor(config) {
+    this.config = config;
+    this.pythonBin = config.pythonBin && config.pythonBin.trim().length > 0 ? config.pythonBin.trim() : "python3";
+    this.scriptPath = config.scriptPath && config.scriptPath.trim().length > 0 ? config.scriptPath.trim() : resolveDefaultFaissScriptPath();
+    this.indexPath = path.isAbsolute(config.indexDir) ? config.indexDir : path.join(config.memoryDir, config.indexDir);
+    this.spawnFn = config.spawnFn ?? launchProcess;
+  }
+  config;
+  pythonBin;
+  scriptPath;
+  indexPath;
+  spawnFn;
+  async upsertChunks(chunks) {
+    if (this.config.maxBatchSize <= 0) return 0;
+    let totalUpserted = 0;
+    for (let offset = 0; offset < chunks.length; offset += this.config.maxBatchSize) {
+      const batch = chunks.slice(offset, offset + this.config.maxBatchSize);
+      if (batch.length === 0) continue;
+      const payload = {
+        modelId: this.config.modelId,
+        indexPath: this.indexPath,
+        chunks: batch.map((chunk) => ({
+          id: chunk.id,
+          sessionKey: chunk.sessionKey,
+          text: chunk.text,
+          startTs: chunk.startTs,
+          endTs: chunk.endTs
+        }))
+      };
+      const result = await this.runCommand("upsert", payload, this.config.upsertTimeoutMs);
+      const upserted = result.upserted;
+      if (typeof upserted !== "number" || !Number.isFinite(upserted)) {
+        throw new FaissAdapterError("FAISS sidecar produced malformed upsert response", "malformed_output");
+      }
+      totalUpserted += Math.max(0, Math.floor(upserted));
+    }
+    return totalUpserted;
+  }
+  async searchChunks(query, topK) {
+    const requestedTopK = Number.isFinite(topK) ? Math.floor(topK) : 0;
+    const boundedTopK = this.config.maxSearchK > 0 ? Math.max(0, Math.min(requestedTopK, this.config.maxSearchK)) : 0;
+    if (boundedTopK <= 0 || query.trim().length === 0) return [];
+    const payload = {
+      modelId: this.config.modelId,
+      indexPath: this.indexPath,
+      query,
+      topK: boundedTopK
+    };
+    const result = await this.runCommand("search", payload, this.config.searchTimeoutMs);
+    if (!Array.isArray(result.results)) {
+      throw new FaissAdapterError("FAISS sidecar produced malformed search response", "malformed_output");
+    }
+    const rows = result.results;
+    return rows.filter(
+      (row) => row && typeof row.path === "string" && typeof row.snippet === "string" && typeof row.score === "number"
+    ).map((row) => ({ path: row.path, snippet: row.snippet, score: row.score }));
+  }
+  async health() {
+    const payload = {
+      modelId: this.config.modelId,
+      indexPath: this.indexPath
+    };
+    const result = await this.runCommand("health", payload, this.config.healthTimeoutMs);
+    if (result.status !== "ok" && result.status !== "degraded" && result.status !== "error") {
+      throw new FaissAdapterError("FAISS sidecar produced malformed health response", "malformed_output");
+    }
+    return {
+      ok: result.ok === true,
+      status: result.status,
+      indexPath: this.indexPath,
+      message: typeof result.error === "string" && result.error.length > 0 ? result.error : void 0,
+      manifest: parseSidecarManifest(result)
+    };
+  }
+  async inspect() {
+    const payload = {
+      modelId: this.config.modelId,
+      indexPath: this.indexPath
+    };
+    const result = await this.runCommand("inspect", payload, this.config.healthTimeoutMs);
+    if (result.status !== "ok" && result.status !== "degraded" && result.status !== "error") {
+      throw new FaissAdapterError("FAISS sidecar produced malformed inspect response", "malformed_output");
+    }
+    return {
+      ok: result.ok === true,
+      status: result.status,
+      indexPath: this.indexPath,
+      message: typeof result.error === "string" && result.error.length > 0 ? result.error : void 0,
+      manifest: parseSidecarManifest(result),
+      metadata: {
+        chunkCount: result.metadata && typeof result.metadata.chunkCount === "number" ? result.metadata.chunkCount : 0,
+        hasIndex: result.metadata?.hasIndex === true,
+        hasMetadata: result.metadata?.hasMetadata === true,
+        hasManifest: result.metadata?.hasManifest === true
+      }
+    };
+  }
+  async rebuildChunks(chunks) {
+    if (this.config.maxBatchSize <= 0) return 0;
+    const firstBatch = chunks.slice(0, this.config.maxBatchSize);
+    const rebuildPayload = {
+      modelId: this.config.modelId,
+      indexPath: this.indexPath,
+      chunks: firstBatch.map((chunk) => ({
+        id: chunk.id,
+        sessionKey: chunk.sessionKey,
+        text: chunk.text,
+        startTs: chunk.startTs,
+        endTs: chunk.endTs
+      }))
+    };
+    const result = await this.runCommand("rebuild", rebuildPayload, this.config.upsertTimeoutMs);
+    const rebuilt = result.rebuilt;
+    if (typeof rebuilt !== "number" || !Number.isFinite(rebuilt)) {
+      throw new FaissAdapterError("FAISS sidecar produced malformed rebuild response", "malformed_output");
+    }
+    const rebuildCount = Math.max(0, Math.floor(rebuilt));
+    const remaining = chunks.slice(firstBatch.length);
+    if (remaining.length === 0) return rebuildCount;
+    const upserted = await this.upsertChunks(remaining);
+    return rebuildCount + upserted;
+  }
+  async runCommand(command, payload, timeoutMs) {
+    const args = [this.scriptPath, command];
+    const child = this.spawnFn(this.pythonBin, args, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (!child.stdin || !child.stdout || !child.stderr) {
+      throw new FaissAdapterError(
+        `FAISS sidecar missing stdio pipes (${command})`,
+        "non_zero_exit"
+      );
+    }
+    const stdinPipe = child.stdin;
+    const stdoutPipe = child.stdout;
+    const stderrPipe = child.stderr;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let timedOut = false;
+    const timer = timeoutMs > 0 ? setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs) : void 0;
+    stdoutPipe.on("data", (chunk) => {
+      stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    stderrPipe.on("data", (chunk) => {
+      stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    let code;
+    try {
+      stdinPipe.write(JSON.stringify(payload));
+      stdinPipe.end();
+      code = await new Promise((resolve, reject) => {
+        const rejectAsProcessError = (err) => {
+          const msg = err instanceof Error ? err.message : String(err);
+          reject(new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, "non_zero_exit"));
+        };
+        child.once("error", rejectAsProcessError);
+        stdinPipe.once("error", rejectAsProcessError);
+        child.once("close", (exitCode) => resolve(exitCode));
+      });
+    } catch (err) {
+      if (err instanceof FaissAdapterError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, "non_zero_exit");
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    const stdout = Buffer.concat(stdoutChunks).toString("utf-8").trim();
+    const stderr = Buffer.concat(stderrChunks).toString("utf-8").trim();
+    if (timedOut) {
+      throw new FaissAdapterError(
+        `FAISS sidecar command timed out (${command}, ${timeoutMs}ms)`,
+        "timeout"
+      );
+    }
+    if (code !== 0) {
+      throw new FaissAdapterError(
+        `FAISS sidecar exited non-zero (${command}, code=${code ?? "null"})${stderr ? `: ${stderr}` : ""}`,
+        "non_zero_exit"
+      );
+    }
+    if (stdout.length === 0) {
+      throw new FaissAdapterError(
+        `FAISS sidecar produced empty output (${command})`,
+        "malformed_output"
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(stdout);
+    } catch {
+      throw new FaissAdapterError(
+        `FAISS sidecar produced malformed JSON (${command})`,
+        "malformed_output"
+      );
+    }
+    if (parsed.ok === false) {
+      const message = typeof parsed.error === "string" && parsed.error.length > 0 ? parsed.error : `FAISS sidecar command failed (${command})`;
+      throw new FaissAdapterError(message, "non_zero_exit");
+    }
+    if (parsed.ok !== true) {
+      throw new FaissAdapterError(
+        `FAISS sidecar produced malformed success envelope (${command})`,
+        "malformed_output"
+      );
+    }
+    return parsed;
+  }
+};
+async function failOpenFaissHealth(adapter) {
+  if (!adapter) {
+    return { ok: false, status: "error", indexPath: "", message: "adapter-unavailable" };
+  }
+  try {
+    return await adapter.health();
+  } catch (err) {
+    log.debug(`faiss adapter health failed (fail-open): ${err}`);
+    return { ok: false, status: "error", indexPath: "", message: "adapter-error" };
+  }
+}
+
+export {
+  FaissAdapterError,
+  resolveDefaultFaissScriptPath,
+  FaissConversationIndexAdapter,
+  failOpenFaissHealth
+};
+//# sourceMappingURL=chunk-FJ43PRLT.js.map