@remnic/core 1.1.30 → 9.3.515

package/dist/chunk-FIT6DMX6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/network/webdav.ts"],"sourcesContent":["import { createReadStream } from \"node:fs\";\nimport { mkdir, readdir, realpath, stat } from \"node:fs/promises\";\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { timingSafeEqual } from \"node:crypto\";\nimport path from \"node:path\";\nimport { pipeline } from \"node:stream/promises\";\nimport { URL } from \"node:url\";\n\nexport function hostToUrlAuthority(host: string): string {\n  if (host.includes(\":\") && !host.startsWith(\"[\") && !host.endsWith(\"]\")) {\n    return `[${host}]`;\n  }\n  return host;\n}\n\nexport interface WebDavAuth {\n  username: string;\n  password: string;\n}\n\nexport interface WebDavServerOptions {\n  enabled?: boolean;\n  host?: string;\n  port: number;\n  allowlistDirs: string[];\n  auth?: WebDavAuth;\n}\n\nexport interface WebDavServerStatus {\n  running: boolean;\n  host: string;\n  port: number;\n  rootCount: number;\n}\n\ninterface AllowedRoot {\n  absolute: string;\n  name: string;\n}\n\nexport class WebDavServer {\n  private readonly options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\">;\n  private readonly allowedRoots: AllowedRoot[];\n  private server: Server | null = null;\n  private boundPort: number;\n\n  private constructor(\n    options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\">,\n    allowedRoots: AllowedRoot[],\n  ) {\n    this.options = options;\n    this.allowedRoots = allowedRoots;\n    this.boundPort = options.port;\n  }\n\n  static async create(input: WebDavServerOptions): Promise<WebDavServer> {\n    const options: Required<Omit<WebDavServerOptions, \"auth\">> & Pick<WebDavServerOptions, \"auth\"> = {\n      enabled: input.enabled ?? false,\n      host: input.host ?? \"127.0.0.1\",\n      port: input.port,\n      allowlistDirs: input.allowlistDirs,\n      auth: input.auth,\n    };\n\n    if (!Array.isArray(options.allowlistDirs) || options.allowlistDirs.length === 0) {\n      throw new Error(\"webdav allowlistDirs must include at least one directory\");\n    }\n    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65535) {\n      throw new Error(`invalid webdav port: ${options.port}`);\n    }\n\n    const allowedRoots: AllowedRoot[] = [];\n    const aliasSet = new Set<string>();\n    for (const dir of options.allowlistDirs) {\n      const resolved = path.resolve(dir);\n      await mkdir(resolved, { recursive: true });\n      const canonical = await realpath(resolved);\n      const alias = path.basename(canonical) || \"root\";\n      if (aliasSet.has(alias)) {\n        throw new Error(`duplicate webdav allowlist alias: ${alias}`);\n      }\n      aliasSet.add(alias);\n      allowedRoots.push({ absolute: canonical, name: alias });\n    }\n\n    return new WebDavServer(options, allowedRoots);\n  }\n\n  async start(): Promise<WebDavServerStatus> {\n    if (!this.options.enabled) {\n      throw new Error(\"webdav server is disabled; set enabled=true to start\");\n    }\n    if (this.server) {\n      return this.status();\n    }\n\n    const server = createServer((req, res) => {\n      this.handle(req, res).catch((err) => {\n        if (res.headersSent) {\n          res.destroy(err as Error);\n          return;\n        }\n        res.writeHead(500, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n        res.end(\"webdav error\");\n      });\n    });\n    this.server = server;\n\n    try {\n      await new Promise<void>((resolve, reject) => {\n        const onError = (err: Error) => {\n          server.removeListener(\"listening\", onListening);\n          reject(err);\n        };\n        const onListening = () => {\n          server.removeListener(\"error\", onError);\n          resolve();\n        };\n        server.once(\"error\", onError);\n        server.once(\"listening\", onListening);\n        server.listen(this.options.port, this.options.host);\n      });\n    } catch (err) {\n      this.server = null;\n      server.close();\n      throw err;\n    }\n\n    const address = server.address();\n    if (address && typeof address !== \"string\") {\n      this.boundPort = address.port;\n    }\n\n    return this.status();\n  }\n\n  async stop(): Promise<void> {\n    if (!this.server) return;\n    const server = this.server;\n    this.server = null;\n    this.boundPort = this.options.port;\n    await new Promise<void>((resolve, reject) => {\n      server.close((err) => (err ? reject(err) : resolve()));\n    });\n  }\n\n  status(): WebDavServerStatus {\n    return {\n      running: this.server !== null,\n      host: this.options.host,\n      port: this.boundPort,\n      rootCount: this.allowedRoots.length,\n    };\n  }\n\n  private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    if (!this.isAuthorized(req)) {\n      res.writeHead(401, {\n        \"WWW-Authenticate\": 'Basic realm=\"Engram WebDAV\"',\n        \"Content-Type\": \"text/plain; charset=utf-8\",\n      });\n      res.end(\"authentication required\");\n      return;\n    }\n\n    const method = (req.method ?? \"GET\").toUpperCase();\n    if (method === \"OPTIONS\") {\n      res.writeHead(204, {\n        Allow: \"OPTIONS, PROPFIND, GET, HEAD\",\n        DAV: \"1\",\n      });\n      res.end();\n      return;\n    }\n\n    const parsed = new URL(req.url ?? \"/\", `http://${hostToUrlAuthority(this.options.host)}`);\n    const resolved = await this.resolvePath(parsed.pathname);\n    if (!resolved.ok) {\n      res.writeHead(resolved.code, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(resolved.message);\n      return;\n    }\n\n    if (method === \"PROPFIND\") {\n      await this.handlePropfind(resolved.absolutePath, resolved.displayPath, res);\n      return;\n    }\n\n    if (method === \"GET\" || method === \"HEAD\") {\n      await this.handleRead(method, resolved.absolutePath, res);\n      return;\n    }\n\n    res.writeHead(405, {\n      Allow: \"OPTIONS, PROPFIND, GET, HEAD\",\n      \"Content-Type\": \"text/plain; charset=utf-8\",\n    });\n    res.end(\"method not allowed\");\n  }\n\n  private isAuthorized(req: IncomingMessage): boolean {\n    if (!this.options.auth) return true;\n    const raw = req.headers.authorization;\n    if (!raw) return false;\n    const separator = raw.indexOf(\" \");\n    if (separator <= 0) return false;\n    const scheme = raw.slice(0, separator).toLowerCase();\n    if (scheme !== \"basic\") return false;\n    const encodedPart = raw.slice(separator + 1).trim();\n    if (!encodedPart) return false;\n\n    try {\n      const decoded = Buffer.from(encodedPart, \"base64\").toString(\"utf-8\");\n      const credentialSeparator = decoded.indexOf(\":\");\n      if (credentialSeparator < 0) return false;\n      const username = decoded.slice(0, credentialSeparator);\n      const password = decoded.slice(credentialSeparator + 1);\n      const usernameOk = this.timingSafeStringEqual(username, this.options.auth.username);\n      const passwordOk = this.timingSafeStringEqual(password, this.options.auth.password);\n      return Boolean((usernameOk ? 1 : 0) & (passwordOk ? 1 : 0));\n    } catch {\n      return false;\n    }\n  }\n\n  private timingSafeStringEqual(a: string, b: string): boolean {\n    const left = this.encodeAuthField(a);\n    const right = this.encodeAuthField(b);\n    if (!left || !right) return false;\n    return timingSafeEqual(left, right);\n  }\n\n  private encodeAuthField(value: string): Buffer | null {\n    const maxBytes = 512;\n    const encoded = Buffer.from(value, \"utf-8\");\n    if (encoded.length > maxBytes) return null;\n    const out = Buffer.alloc(2 + maxBytes);\n    out.writeUInt16BE(encoded.length, 0);\n    encoded.copy(out, 2);\n    return out;\n  }\n\n  private async resolvePath(requestPathname: string): Promise<\n    | { ok: true; absolutePath: string; displayPath: string }\n    | { ok: false; code: number; message: string }\n  > {\n    let decodedPath: string;\n    try {\n      decodedPath = decodeURIComponent(requestPathname || \"/\");\n    } catch {\n      return { ok: false, code: 400, message: \"invalid path encoding\" };\n    }\n    if (decodedPath.includes(\"\\0\")) {\n      return { ok: false, code: 400, message: \"invalid path\" };\n    }\n\n    const normalized = path.posix.normalize(decodedPath);\n    const segments = normalized.split(\"/\").filter((segment) => segment.length > 0);\n\n    if (segments.length === 0) {\n      return { ok: false, code: 403, message: \"root listing is not allowed\" };\n    }\n\n    const rootName = segments[0];\n    const root = this.allowedRoots.find((entry) => entry.name === rootName);\n    if (!root) {\n      return { ok: false, code: 403, message: \"path is outside allowlist\" };\n    }\n\n    const relative = segments.slice(1);\n    if (relative.some((segment) => segment === \"..\" || segment.includes(\"\\\\\"))) {\n      return { ok: false, code: 403, message: \"path traversal is not allowed\" };\n    }\n\n    const candidate = path.resolve(root.absolute, ...relative);\n    if (!this.isPathInside(root.absolute, candidate)) {\n      return { ok: false, code: 403, message: \"path escaped allowlist\" };\n    }\n\n    try {\n      const canonicalCandidate = await realpath(candidate);\n      if (!this.isPathInside(root.absolute, canonicalCandidate)) {\n        return { ok: false, code: 403, message: \"path escaped allowlist via symlink\" };\n      }\n      return { ok: true, absolutePath: canonicalCandidate, displayPath: `/${segments.join(\"/\")}` };\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === \"ENOENT\") {\n        return { ok: true, absolutePath: candidate, displayPath: `/${segments.join(\"/\")}` };\n      }\n      if (code === \"ENOTDIR\" || code === \"ELOOP\") {\n        return { ok: false, code: 400, message: \"invalid path\" };\n      }\n      throw err;\n    }\n  }\n\n  private async handleRead(method: \"GET\" | \"HEAD\", absolutePath: string, res: ServerResponse): Promise<void> {\n    let info;\n    try {\n      info = await stat(absolutePath);\n    } catch {\n      res.writeHead(404, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"not found\");\n      return;\n    }\n\n    if (!info.isFile()) {\n      res.writeHead(403, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"path is not a file\");\n      return;\n    }\n\n    res.writeHead(200, {\n      \"Content-Length\": String(info.size),\n      \"Content-Type\": \"application/octet-stream\",\n    });\n\n    if (method === \"HEAD\") {\n      res.end();\n      return;\n    }\n\n    await pipeline(createReadStream(absolutePath), res);\n  }\n\n  private async handlePropfind(absolutePath: string, displayPath: string, res: ServerResponse): Promise<void> {\n    let info;\n    try {\n      info = await stat(absolutePath);\n    } catch {\n      res.writeHead(404, { \"Content-Type\": \"text/plain; charset=utf-8\" });\n      res.end(\"not found\");\n      return;\n    }\n\n    const entries: string[] = [];\n    if (info.isDirectory()) {\n      const children = await readdir(absolutePath, { withFileTypes: true });\n      for (const child of children) {\n        const childHref = toEncodedHref(`${displayPath.replace(/\\/$/, \"\")}/${child.name}`);\n        entries.push(`\n  <d:response>\n    <d:href>${xmlEscape(childHref)}</d:href>\n    <d:propstat><d:prop><d:resourcetype>${child.isDirectory() ? \"<d:collection/>\" : \"\"}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>\n  </d:response>`);\n      }\n    }\n\n    const xml = `<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<d:multistatus xmlns:d=\"DAV:\">\n  <d:response>\n    <d:href>${xmlEscape(toEncodedHref(displayPath))}</d:href>\n    <d:propstat><d:prop><d:resourcetype>${info.isDirectory() ? \"<d:collection/>\" : \"\"}</d:resourcetype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat>\n  </d:response>${entries.join(\"\")}\n</d:multistatus>`;\n\n    res.writeHead(207, { \"Content-Type\": \"application/xml; charset=utf-8\" });\n    res.end(xml);\n  }\n\n  private isPathInside(root: string, target: string): boolean {\n    if (target === root) return true;\n    if (root === path.parse(root).root) {\n      return target.startsWith(root);\n    }\n    return target.startsWith(`${root}${path.sep}`);\n  }\n}\n\nfunction xmlEscape(value: string): string {\n  return value\n    .replaceAll(\"&\", \"&amp;\")\n    .replaceAll(\"<\", \"&lt;\")\n    .replaceAll(\">\", \"&gt;\")\n    .replaceAll('\"', \"&quot;\")\n    .replaceAll(\"'\", \"&apos;\");\n}\n\nfunction toEncodedHref(pathname: string): string {\n  return pathname\n    .split(\"/\")\n    .map((segment) => encodeURIComponent(segment))\n    .join(\"/\");\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC,SAAS,OAAO,SAAS,UAAU,YAAY;AAC/C,SAAS,oBAA4E;AACrF,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,gBAAgB;AACzB,SAAS,WAAW;AAEb,SAAS,mBAAmB,MAAsB;AACvD,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;AACtE,WAAO,IAAI,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AA2BO,IAAM,eAAN,MAAM,cAAa;AAAA,EACP;AAAA,EACA;AAAA,EACT,SAAwB;AAAA,EACxB;AAAA,EAEA,YACN,SACA,cACA;AACA,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA,EAEA,aAAa,OAAO,OAAmD;AACrE,UAAM,UAA2F;AAAA,MAC/F,SAAS,MAAM,WAAW;AAAA,MAC1B,MAAM,MAAM,QAAQ;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,eAAe,MAAM;AAAA,MACrB,MAAM,MAAM;AAAA,IACd;AAEA,QAAI,CAAC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,cAAc,WAAW,GAAG;AAC/E,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,CAAC,OAAO,UAAU,QAAQ,IAAI,KAAK,QAAQ,OAAO,KAAK,QAAQ,OAAO,OAAO;AAC/E,YAAM,IAAI,MAAM,wBAAwB,QAAQ,IAAI,EAAE;AAAA,IACxD;AAEA,UAAM,eAA8B,CAAC;AACrC,UAAM,WAAW,oBAAI,IAAY;AACjC,eAAW,OAAO,QAAQ,eAAe;AACvC,YAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,YAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;AACzC,YAAM,YAAY,MAAM,SAAS,QAAQ;AACzC,YAAM,QAAQ,KAAK,SAAS,SAAS,KAAK;AAC1C,UAAI,SAAS,IAAI,KAAK,GAAG;AACvB,cAAM,IAAI,MAAM,qCAAqC,KAAK,EAAE;AAAA,MAC9D;AACA,eAAS,IAAI,KAAK;AAClB,mBAAa,KAAK,EAAE,UAAU,WAAW,MAAM,MAAM,CAAC;AAAA,IACxD;AAEA,WAAO,IAAI,cAAa,SAAS,YAAY;AAAA,EAC/C;AAAA,EAEA,MAAM,QAAqC;AACzC,QAAI,CAAC,KAAK,QAAQ,SAAS;AACzB,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,QAAI,KAAK,QAAQ;AACf,aAAO,KAAK,OAAO;AAAA,IACrB;AAEA,UAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,WAAK,OAAO,KAAK,GAAG,EAAE,MAAM,CAAC,QAAQ;AACnC,YAAI,IAAI,aAAa;AACnB,cAAI,QAAQ,GAAY;AACxB;AAAA,QACF;AACA,YAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,YAAI,IAAI,cAAc;AAAA,MACxB,CAAC;AAAA,IACH,CAAC;AACD,SAAK,SAAS;AAEd,QAAI;AACF,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,cAAM,UAAU,CAAC,QAAe;AAC9B,iBAAO,eAAe,aAAa,WAAW;AAC9C,iBAAO,GAAG;AAAA,QACZ;AACA,cAAM,cAAc,MAAM;AACxB,iBAAO,eAAe,SAAS,OAAO;AACtC,kBAAQ;AAAA,QACV;AACA,eAAO,KAAK,SAAS,OAAO;AAC5B,eAAO,KAAK,aAAa,WAAW;AACpC,eAAO,OAAO,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI;AAAA,MACpD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,SAAS;AACd,aAAO,MAAM;AACb,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,OAAO,QAAQ;AAC/B,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,WAAK,YAAY,QAAQ;AAAA,IAC3B;AAEA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,OAAQ;AAClB,UAAM,SAAS,KAAK;AACpB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK,QAAQ;AAC9B,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AAAA,IACvD,CAAC;AAAA,EACH;AAAA,EAEA,SAA6B;AAC3B,WAAO;AAAA,MACL,SAAS,KAAK,WAAW;AAAA,MACzB,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK;AAAA,MACX,WAAW,KAAK,aAAa;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAc,OAAO,KAAsB,KAAoC;AAC7E,QAAI,CAAC,KAAK,aAAa,GAAG,GAAG;AAC3B,UAAI,UAAU,KAAK;AAAA,QACjB,oBAAoB;AAAA,QACpB,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,IAAI,yBAAyB;AACjC;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAI,WAAW,WAAW;AACxB,UAAI,UAAU,KAAK;AAAA,QACjB,OAAO;AAAA,QACP,KAAK;AAAA,MACP,CAAC;AACD,UAAI,IAAI;AACR;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,mBAAmB,KAAK,QAAQ,IAAI,CAAC,EAAE;AACxF,UAAM,WAAW,MAAM,KAAK,YAAY,OAAO,QAAQ;AACvD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,UAAU,SAAS,MAAM,EAAE,gBAAgB,4BAA4B,CAAC;AAC5E,UAAI,IAAI,SAAS,OAAO;AACxB;AAAA,IACF;AAEA,QAAI,WAAW,YAAY;AACzB,YAAM,KAAK,eAAe,SAAS,cAAc,SAAS,aAAa,GAAG;AAC1E;AAAA,IACF;AAEA,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,KAAK,WAAW,QAAQ,SAAS,cAAc,GAAG;AACxD;AAAA,IACF;AAEA,QAAI,UAAU,KAAK;AAAA,MACjB,OAAO;AAAA,MACP,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,IAAI,oBAAoB;AAAA,EAC9B;AAAA,EAEQ,aAAa,KAA+B;AAClD,QAAI,CAAC,KAAK,QAAQ,KAAM,QAAO;AAC/B,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,YAAY,IAAI,QAAQ,GAAG;AACjC,QAAI,aAAa,EAAG,QAAO;AAC3B,UAAM,SAAS,IAAI,MAAM,GAAG,SAAS,EAAE,YAAY;AACnD,QAAI,WAAW,QAAS,QAAO;AAC/B,UAAM,cAAc,IAAI,MAAM,YAAY,CAAC,EAAE,KAAK;AAClD,QAAI,CAAC,YAAa,QAAO;AAEzB,QAAI;AACF,YAAM,UAAU,OAAO,KAAK,aAAa,QAAQ,EAAE,SAAS,OAAO;AACnE,YAAM,sBAAsB,QAAQ,QAAQ,GAAG;AAC/C,UAAI,sBAAsB,EAAG,QAAO;AACpC,YAAM,WAAW,QAAQ,MAAM,GAAG,mBAAmB;AACrD,YAAM,WAAW,QAAQ,MAAM,sBAAsB,CAAC;AACtD,YAAM,aAAa,KAAK,sBAAsB,UAAU,KAAK,QAAQ,KAAK,QAAQ;AAClF,YAAM,aAAa,KAAK,sBAAsB,UAAU,KAAK,QAAQ,KAAK,QAAQ;AAClF,aAAO,SAAS,aAAa,IAAI,MAAM,aAAa,IAAI,EAAE;AAAA,IAC5D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,sBAAsB,GAAW,GAAoB;AAC3D,UAAM,OAAO,KAAK,gBAAgB,CAAC;AACnC,UAAM,QAAQ,KAAK,gBAAgB,CAAC;AACpC,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO;AAC5B,WAAO,gBAAgB,MAAM,KAAK;AAAA,EACpC;AAAA,EAEQ,gBAAgB,OAA8B;AACpD,UAAM,WAAW;AACjB,UAAM,UAAU,OAAO,KAAK,OAAO,OAAO;AAC1C,QAAI,QAAQ,SAAS,SAAU,QAAO;AACtC,UAAM,MAAM,OAAO,MAAM,IAAI,QAAQ;AACrC,QAAI,cAAc,QAAQ,QAAQ,CAAC;AACnC,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,YAAY,iBAGxB;AACA,QAAI;AACJ,QAAI;AACF,oBAAc,mBAAmB,mBAAmB,GAAG;AAAA,IACzD,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,wBAAwB;AAAA,IAClE;AACA,QAAI,YAAY,SAAS,IAAI,GAAG;AAC9B,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,eAAe;AAAA,IACzD;AAEA,UAAM,aAAa,KAAK,MAAM,UAAU,WAAW;AACnD,UAAM,WAAW,WAAW,MAAM,GAAG,EAAE,OAAO,CAAC,YAAY,QAAQ,SAAS,CAAC;AAE7E,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,8BAA8B;AAAA,IACxE;AAEA,UAAM,WAAW,SAAS,CAAC;AAC3B,UAAM,OAAO,KAAK,aAAa,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ;AACtE,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,4BAA4B;AAAA,IACtE;AAEA,UAAM,WAAW,SAAS,MAAM,CAAC;AACjC,QAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,QAAQ,SAAS,IAAI,CAAC,GAAG;AAC1E,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,gCAAgC;AAAA,IAC1E;AAEA,UAAM,YAAY,KAAK,QAAQ,KAAK,UAAU,GAAG,QAAQ;AACzD,QAAI,CAAC,KAAK,aAAa,KAAK,UAAU,SAAS,GAAG;AAChD,aAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,yBAAyB;AAAA,IACnE;AAEA,QAAI;AACF,YAAM,qBAAqB,MAAM,SAAS,SAAS;AACnD,UAAI,CAAC,KAAK,aAAa,KAAK,UAAU,kBAAkB,GAAG;AACzD,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,qCAAqC;AAAA,MAC/E;AACA,aAAO,EAAE,IAAI,MAAM,cAAc,oBAAoB,aAAa,IAAI,SAAS,KAAK,GAAG,CAAC,GAAG;AAAA,IAC7F,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,UAAU;AACrB,eAAO,EAAE,IAAI,MAAM,cAAc,WAAW,aAAa,IAAI,SAAS,KAAK,GAAG,CAAC,GAAG;AAAA,MACpF;AACA,UAAI,SAAS,aAAa,SAAS,SAAS;AAC1C,eAAO,EAAE,IAAI,OAAO,MAAM,KAAK,SAAS,eAAe;AAAA,MACzD;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,QAAwB,cAAsB,KAAoC;AACzG,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,IAChC,QAAQ;AACN,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,OAAO,GAAG;AAClB,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,oBAAoB;AAC5B;AAAA,IACF;AAEA,QAAI,UAAU,KAAK;AAAA,MACjB,kBAAkB,OAAO,KAAK,IAAI;AAAA,MAClC,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,WAAW,QAAQ;AACrB,UAAI,IAAI;AACR;AAAA,IACF;AAEA,UAAM,SAAS,iBAAiB,YAAY,GAAG,GAAG;AAAA,EACpD;AAAA,EAEA,MAAc,eAAe,cAAsB,aAAqB,KAAoC;AAC1G,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,YAAY;AAAA,IAChC,QAAQ;AACN,UAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,UAAoB,CAAC;AAC3B,QAAI,KAAK,YAAY,GAAG;AACtB,YAAM,WAAW,MAAM,QAAQ,cAAc,EAAE,eAAe,KAAK,CAAC;AACpE,iBAAW,SAAS,UAAU;AAC5B,cAAM,YAAY,cAAc,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,IAAI,MAAM,IAAI,EAAE;AACjF,gBAAQ,KAAK;AAAA;AAAA,cAEP,UAAU,SAAS,CAAC;AAAA,0CACQ,MAAM,YAAY,IAAI,oBAAoB,EAAE;AAAA,gBACtE;AAAA,MACV;AAAA,IACF;AAEA,UAAM,MAAM;AAAA;AAAA;AAAA,cAGF,UAAU,cAAc,WAAW,CAAC,CAAC;AAAA,0CACT,KAAK,YAAY,IAAI,oBAAoB,EAAE;AAAA,iBACpE,QAAQ,KAAK,EAAE,CAAC;AAAA;AAG7B,QAAI,UAAU,KAAK,EAAE,gBAAgB,iCAAiC,CAAC;AACvE,QAAI,IAAI,GAAG;AAAA,EACb;AAAA,EAEQ,aAAa,MAAc,QAAyB;AAC1D,QAAI,WAAW,KAAM,QAAO;AAC5B,QAAI,SAAS,KAAK,MAAM,IAAI,EAAE,MAAM;AAClC,aAAO,OAAO,WAAW,IAAI;AAAA,IAC/B;AACA,WAAO,OAAO,WAAW,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE;AAAA,EAC/C;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MACJ,WAAW,KAAK,OAAO,EACvB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,MAAM,EACtB,WAAW,KAAK,QAAQ,EACxB,WAAW,KAAK,QAAQ;AAC7B;AAEA,SAAS,cAAc,UAA0B;AAC/C,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,mBAAmB,OAAO,CAAC,EAC5C,KAAK,GAAG;AACb;","names":[]}

package/dist/chunk-FJ43PRLT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/conversation-index/faiss-adapter.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport path from \"node:path\";\nimport { log } from \"../logger.js\";\nimport type { ConversationChunk } from \"./chunker.js\";\nimport type { ConversationSearchResult } from \"./search.js\";\nimport { launchProcess } from \"../runtime/child-process.js\";\n\nexport interface FaissAdapterConfig {\n  memoryDir: string;\n  scriptPath?: string;\n  pythonBin?: string;\n  modelId: string;\n  indexDir: string;\n  upsertTimeoutMs: number;\n  searchTimeoutMs: number;\n  healthTimeoutMs: number;\n  maxBatchSize: number;\n  maxSearchK: number;\n  spawnFn?: typeof launchProcess;\n}\n\nexport interface FaissHealthResult {\n  ok: boolean;\n  status: \"ok\" | \"degraded\" | \"error\";\n  indexPath: string;\n  message?: string;\n  manifest?: {\n    version: number;\n    modelId: string;\n    normalizedModelId: string;\n    dimension: number;\n    chunkCount: number;\n    updatedAt: string;\n    lastSuccessfulRebuildAt: string;\n  };\n}\n\nexport interface FaissInspectResult extends FaissHealthResult {\n  metadata: {\n    chunkCount: number;\n    hasIndex: boolean;\n    hasMetadata: boolean;\n    hasManifest: boolean;\n  };\n}\n\ntype SidecarCommand = \"upsert\" | \"search\" | \"health\" | \"inspect\" | \"rebuild\";\n\nexport class FaissAdapterError extends Error {\n  constructor(message: string, readonly code: \"timeout\" | \"non_zero_exit\" | \"malformed_output\") {\n    super(message);\n    this.name = \"FaissAdapterError\";\n  }\n}\n\ninterface SidecarResult {\n  ok?: boolean;\n  error?: string;\n  upserted?: number;\n  rebuilt?: number;\n  status?: \"ok\" | \"degraded\" | \"error\";\n  manifest?: {\n    version?: number;\n    modelId?: string;\n    normalizedModelId?: string;\n    dimension?: number;\n    chunkCount?: number;\n    updatedAt?: string;\n    lastSuccessfulRebuildAt?: string;\n  };\n  results?: Array<{\n    path: string;\n    snippet: string;\n    score: number;\n  }>;\n  metadata?: {\n    chunkCount?: number;\n    hasIndex?: boolean;\n    hasMetadata?: boolean;\n    hasManifest?: boolean;\n  };\n}\n\nfunction parseSidecarManifest(result: SidecarResult): FaissHealthResult[\"manifest\"] | undefined {\n  const manifest = result.manifest;\n  if (\n    !manifest ||\n    typeof manifest.version !== \"number\" ||\n    typeof manifest.modelId !== \"string\" ||\n    typeof manifest.normalizedModelId !== \"string\" ||\n    typeof manifest.dimension !== \"number\" ||\n    typeof manifest.chunkCount !== \"number\" ||\n    typeof manifest.updatedAt !== \"string\" ||\n    typeof manifest.lastSuccessfulRebuildAt !== \"string\"\n  ) {\n    return undefined;\n  }\n\n  return {\n    version: manifest.version,\n    modelId: manifest.modelId,\n    normalizedModelId: manifest.normalizedModelId,\n    dimension: manifest.dimension,\n    chunkCount: manifest.chunkCount,\n    updatedAt: manifest.updatedAt,\n    lastSuccessfulRebuildAt: manifest.lastSuccessfulRebuildAt,\n  };\n}\n\nexport function resolveDefaultFaissScriptPath(fromModuleUrl: string = import.meta.url): string {\n  const currentFile = fileURLToPath(fromModuleUrl);\n  const moduleDir = path.dirname(currentFile);\n\n  // Source runtime: src/conversation-index/faiss-adapter.ts\n  if (moduleDir.endsWith(`${path.sep}conversation-index`)) {\n    return path.resolve(moduleDir, \"..\", \"..\", \"scripts\", \"faiss_index.py\");\n  }\n\n  // Bundled runtime: dist/index.js (or neighboring dist chunks)\n  return path.resolve(moduleDir, \"..\", \"scripts\", \"faiss_index.py\");\n}\n\nexport class FaissConversationIndexAdapter {\n  private readonly pythonBin: string;\n  private readonly scriptPath: string;\n  private readonly indexPath: string;\n  private readonly spawnFn: typeof launchProcess;\n\n  constructor(private readonly config: FaissAdapterConfig) {\n    this.pythonBin = config.pythonBin && config.pythonBin.trim().length > 0 ? config.pythonBin.trim() : \"python3\";\n    this.scriptPath = config.scriptPath && config.scriptPath.trim().length > 0\n      ? config.scriptPath.trim()\n      : resolveDefaultFaissScriptPath();\n    this.indexPath = path.isAbsolute(config.indexDir)\n      ? config.indexDir\n      : path.join(config.memoryDir, config.indexDir);\n    this.spawnFn = config.spawnFn ?? launchProcess;\n  }\n\n  async upsertChunks(chunks: ConversationChunk[]): Promise<number> {\n    if (this.config.maxBatchSize <= 0) return 0;\n    let totalUpserted = 0;\n    for (let offset = 0; offset < chunks.length; offset += this.config.maxBatchSize) {\n      const batch = chunks.slice(offset, offset + this.config.maxBatchSize);\n      if (batch.length === 0) continue;\n      const payload = {\n        modelId: this.config.modelId,\n        indexPath: this.indexPath,\n        chunks: batch.map((chunk) => ({\n          id: chunk.id,\n          sessionKey: chunk.sessionKey,\n          text: chunk.text,\n          startTs: chunk.startTs,\n          endTs: chunk.endTs,\n        })),\n      };\n      const result = await this.runCommand(\"upsert\", payload, this.config.upsertTimeoutMs);\n      const upserted = result.upserted;\n      if (typeof upserted !== \"number\" || !Number.isFinite(upserted)) {\n        throw new FaissAdapterError(\"FAISS sidecar produced malformed upsert response\", \"malformed_output\");\n      }\n      totalUpserted += Math.max(0, Math.floor(upserted));\n    }\n    return totalUpserted;\n  }\n\n  async searchChunks(query: string, topK: number): Promise<ConversationSearchResult[]> {\n    const requestedTopK = Number.isFinite(topK) ? Math.floor(topK) : 0;\n    const boundedTopK = this.config.maxSearchK > 0\n      ? Math.max(0, Math.min(requestedTopK, this.config.maxSearchK))\n      : 0;\n    if (boundedTopK <= 0 || query.trim().length === 0) return [];\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n      query,\n      topK: boundedTopK,\n    };\n    const result = await this.runCommand(\"search\", payload, this.config.searchTimeoutMs);\n    if (!Array.isArray(result.results)) {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed search response\", \"malformed_output\");\n    }\n    const rows = result.results;\n    return rows\n      .filter((row) =>\n        row &&\n        typeof row.path === \"string\" &&\n        typeof row.snippet === \"string\" &&\n        typeof row.score === \"number\"\n      )\n      .map((row) => ({ path: row.path, snippet: row.snippet, score: row.score }));\n  }\n\n  async health(): Promise<FaissHealthResult> {\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n    };\n    const result = await this.runCommand(\"health\", payload, this.config.healthTimeoutMs);\n    if (result.status !== \"ok\" && result.status !== \"degraded\" && result.status !== \"error\") {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed health response\", \"malformed_output\");\n    }\n    return {\n      ok: result.ok === true,\n      status: result.status,\n      indexPath: this.indexPath,\n      message: typeof result.error === \"string\" && result.error.length > 0 ? result.error : undefined,\n      manifest: parseSidecarManifest(result),\n    };\n  }\n\n  async inspect(): Promise<FaissInspectResult> {\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n    };\n    const result = await this.runCommand(\"inspect\", payload, this.config.healthTimeoutMs);\n    if (result.status !== \"ok\" && result.status !== \"degraded\" && result.status !== \"error\") {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed inspect response\", \"malformed_output\");\n    }\n    return {\n      ok: result.ok === true,\n      status: result.status,\n      indexPath: this.indexPath,\n      message: typeof result.error === \"string\" && result.error.length > 0 ? result.error : undefined,\n      manifest: parseSidecarManifest(result),\n      metadata: {\n        chunkCount:\n          result.metadata && typeof result.metadata.chunkCount === \"number\"\n            ? result.metadata.chunkCount\n            : 0,\n        hasIndex: result.metadata?.hasIndex === true,\n        hasMetadata: result.metadata?.hasMetadata === true,\n        hasManifest: result.metadata?.hasManifest === true,\n      },\n    };\n  }\n\n  async rebuildChunks(chunks: ConversationChunk[]): Promise<number> {\n    if (this.config.maxBatchSize <= 0) return 0;\n\n    const firstBatch = chunks.slice(0, this.config.maxBatchSize);\n    const rebuildPayload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n      chunks: firstBatch.map((chunk) => ({\n        id: chunk.id,\n        sessionKey: chunk.sessionKey,\n        text: chunk.text,\n        startTs: chunk.startTs,\n        endTs: chunk.endTs,\n      })),\n    };\n    const result = await this.runCommand(\"rebuild\", rebuildPayload, this.config.upsertTimeoutMs);\n    const rebuilt = result.rebuilt;\n    if (typeof rebuilt !== \"number\" || !Number.isFinite(rebuilt)) {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed rebuild response\", \"malformed_output\");\n    }\n\n    const rebuildCount = Math.max(0, Math.floor(rebuilt));\n    const remaining = chunks.slice(firstBatch.length);\n    if (remaining.length === 0) return rebuildCount;\n\n    const upserted = await this.upsertChunks(remaining);\n    return rebuildCount + upserted;\n  }\n\n  private async runCommand(command: SidecarCommand, payload: object, timeoutMs: number): Promise<SidecarResult> {\n    const args = [this.scriptPath, command];\n    const child = this.spawnFn(this.pythonBin, args, {\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    if (!child.stdin || !child.stdout || !child.stderr) {\n      throw new FaissAdapterError(\n        `FAISS sidecar missing stdio pipes (${command})`,\n        \"non_zero_exit\",\n      );\n    }\n    const stdinPipe = child.stdin;\n    const stdoutPipe = child.stdout;\n    const stderrPipe = child.stderr;\n\n    const stdoutChunks: Buffer[] = [];\n    const stderrChunks: Buffer[] = [];\n    let timedOut = false;\n\n    const timer = timeoutMs > 0\n      ? setTimeout(() => {\n        timedOut = true;\n        child.kill(\"SIGKILL\");\n      }, timeoutMs)\n      : undefined;\n\n    stdoutPipe.on(\"data\", (chunk: Buffer | string) => {\n      stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    });\n    stderrPipe.on(\"data\", (chunk: Buffer | string) => {\n      stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    });\n\n    let code: number | null;\n    try {\n      stdinPipe.write(JSON.stringify(payload));\n      stdinPipe.end();\n\n      code = await new Promise<number | null>((resolve, reject) => {\n        const rejectAsProcessError = (err: unknown) => {\n          const msg = err instanceof Error ? err.message : String(err);\n          reject(new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, \"non_zero_exit\"));\n        };\n        child.once(\"error\", rejectAsProcessError);\n        stdinPipe.once(\"error\", rejectAsProcessError);\n        child.once(\"close\", (exitCode) => resolve(exitCode));\n      });\n    } catch (err) {\n      if (err instanceof FaissAdapterError) throw err;\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, \"non_zero_exit\");\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n\n    const stdout = Buffer.concat(stdoutChunks).toString(\"utf-8\").trim();\n    const stderr = Buffer.concat(stderrChunks).toString(\"utf-8\").trim();\n\n    if (timedOut) {\n      throw new FaissAdapterError(\n        `FAISS sidecar command timed out (${command}, ${timeoutMs}ms)`,\n        \"timeout\",\n      );\n    }\n    if (code !== 0) {\n      throw new FaissAdapterError(\n        `FAISS sidecar exited non-zero (${command}, code=${code ?? \"null\"})${stderr ? `: ${stderr}` : \"\"}`,\n        \"non_zero_exit\",\n      );\n    }\n    if (stdout.length === 0) {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced empty output (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    let parsed: SidecarResult;\n    try {\n      parsed = JSON.parse(stdout) as SidecarResult;\n    } catch {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced malformed JSON (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    if (parsed.ok === false) {\n      const message = typeof parsed.error === \"string\" && parsed.error.length > 0\n        ? parsed.error\n        : `FAISS sidecar command failed (${command})`;\n      throw new FaissAdapterError(message, \"non_zero_exit\");\n    }\n    if (parsed.ok !== true) {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced malformed success envelope (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    return parsed;\n  }\n}\n\nexport async function failOpenFaissHealth(\n  adapter: FaissConversationIndexAdapter | undefined,\n): Promise<FaissHealthResult> {\n  if (!adapter) {\n    return { ok: false, status: \"error\", indexPath: \"\", message: \"adapter-unavailable\" };\n  }\n  try {\n    return await adapter.health();\n  } catch (err) {\n    log.debug(`faiss adapter health failed (fail-open): ${err}`);\n    return { ok: false, status: \"error\", indexPath: \"\", message: \"adapter-error\" };\n  }\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AA+CV,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAA0B,MAAwD;AAC5F,UAAM,OAAO;AADuB;AAEpC,SAAK,OAAO;AAAA,EACd;AAAA,EAHsC;AAIxC;AA8BA,SAAS,qBAAqB,QAAkE;AAC9F,QAAM,WAAW,OAAO;AACxB,MACE,CAAC,YACD,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,sBAAsB,YACtC,OAAO,SAAS,cAAc,YAC9B,OAAO,SAAS,eAAe,YAC/B,OAAO,SAAS,cAAc,YAC9B,OAAO,SAAS,4BAA4B,UAC5C;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,SAAS,SAAS;AAAA,IAClB,mBAAmB,SAAS;AAAA,IAC5B,WAAW,SAAS;AAAA,IACpB,YAAY,SAAS;AAAA,IACrB,WAAW,SAAS;AAAA,IACpB,yBAAyB,SAAS;AAAA,EACpC;AACF;AAEO,SAAS,8BAA8B,gBAAwB,YAAY,KAAa;AAC7F,QAAM,cAAc,cAAc,aAAa;AAC/C,QAAM,YAAY,KAAK,QAAQ,WAAW;AAG1C,MAAI,UAAU,SAAS,GAAG,KAAK,GAAG,oBAAoB,GAAG;AACvD,WAAO,KAAK,QAAQ,WAAW,MAAM,MAAM,WAAW,gBAAgB;AAAA,EACxE;AAGA,SAAO,KAAK,QAAQ,WAAW,MAAM,WAAW,gBAAgB;AAClE;AAEO,IAAM,gCAAN,MAAoC;AAAA,EAMzC,YAA6B,QAA4B;AAA5B;AAC3B,SAAK,YAAY,OAAO,aAAa,OAAO,UAAU,KAAK,EAAE,SAAS,IAAI,OAAO,UAAU,KAAK,IAAI;AACpG,SAAK,aAAa,OAAO,cAAc,OAAO,WAAW,KAAK,EAAE,SAAS,IACrE,OAAO,WAAW,KAAK,IACvB,8BAA8B;AAClC,SAAK,YAAY,KAAK,WAAW,OAAO,QAAQ,IAC5C,OAAO,WACP,KAAK,KAAK,OAAO,WAAW,OAAO,QAAQ;AAC/C,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA,EAT6B;AAAA,EALZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAajB,MAAM,aAAa,QAA8C;AAC/D,QAAI,KAAK,OAAO,gBAAgB,EAAG,QAAO;AAC1C,QAAI,gBAAgB;AACpB,aAAS,SAAS,GAAG,SAAS,OAAO,QAAQ,UAAU,KAAK,OAAO,cAAc;AAC/E,YAAM,QAAQ,OAAO,MAAM,QAAQ,SAAS,KAAK,OAAO,YAAY;AACpE,UAAI,MAAM,WAAW,EAAG;AACxB,YAAM,UAAU;AAAA,QACd,SAAS,KAAK,OAAO;AAAA,QACrB,WAAW,KAAK;AAAA,QAChB,QAAQ,MAAM,IAAI,CAAC,WAAW;AAAA,UAC5B,IAAI,MAAM;AAAA,UACV,YAAY,MAAM;AAAA,UAClB,MAAM,MAAM;AAAA,UACZ,SAAS,MAAM;AAAA,UACf,OAAO,MAAM;AAAA,QACf,EAAE;AAAA,MACJ;AACA,YAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,YAAM,WAAW,OAAO;AACxB,UAAI,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG;AAC9D,cAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,MACpG;AACA,uBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAe,MAAmD;AACnF,UAAM,gBAAgB,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI;AACjE,UAAM,cAAc,KAAK,OAAO,aAAa,IACzC,KAAK,IAAI,GAAG,KAAK,IAAI,eAAe,KAAK,OAAO,UAAU,CAAC,IAC3D;AACJ,QAAI,eAAe,KAAK,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAC3D,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,GAAG;AAClC,YAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,IACpG;AACA,UAAM,OAAO,OAAO;AACpB,WAAO,KACJ;AAAA,MAAO,CAAC,QACP,OACA,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,UAAU;AAAA,IACvB,EACC,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM,EAAE;AAAA,EAC9E;AAAA,EAEA,MAAM,SAAqC;AACzC,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,IAClB;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,QAAI,OAAO,WAAW,QAAQ,OAAO,WAAW,cAAc,OAAO,WAAW,SAAS;AACvF,YAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,IACpG;AACA,WAAO;AAAA,MACL,IAAI,OAAO,OAAO;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,MACtF,UAAU,qBAAqB,MAAM;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,UAAuC;AAC3C,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,IAClB;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,SAAS,KAAK,OAAO,eAAe;AACpF,QAAI,OAAO,WAAW,QAAQ,OAAO,WAAW,cAAc,OAAO,WAAW,SAAS;AACvF,YAAM,IAAI,kBAAkB,qDAAqD,kBAAkB;AAAA,IACrG;AACA,WAAO;AAAA,MACL,IAAI,OAAO,OAAO;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,MACtF,UAAU,qBAAqB,MAAM;AAAA,MACrC,UAAU;AAAA,QACR,YACE,OAAO,YAAY,OAAO,OAAO,SAAS,eAAe,WACrD,OAAO,SAAS,aAChB;AAAA,QACN,UAAU,OAAO,UAAU,aAAa;AAAA,QACxC,aAAa,OAAO,UAAU,gBAAgB;AAAA,QAC9C,aAAa,OAAO,UAAU,gBAAgB;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,QAA8C;AAChE,QAAI,KAAK,OAAO,gBAAgB,EAAG,QAAO;AAE1C,UAAM,aAAa,OAAO,MAAM,GAAG,KAAK,OAAO,YAAY;AAC3D,UAAM,iBAAiB;AAAA,MACrB,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB,QAAQ,WAAW,IAAI,CAAC,WAAW;AAAA,QACjC,IAAI,MAAM;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf,EAAE;AAAA,IACJ;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,gBAAgB,KAAK,OAAO,eAAe;AAC3F,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,YAAY,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG;AAC5D,YAAM,IAAI,kBAAkB,qDAAqD,kBAAkB;AAAA,IACrG;AAEA,UAAM,eAAe,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC;AACpD,UAAM,YAAY,OAAO,MAAM,WAAW,MAAM;AAChD,QAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,UAAM,WAAW,MAAM,KAAK,aAAa,SAAS;AAClD,WAAO,eAAe;AAAA,EACxB;AAAA,EAEA,MAAc,WAAW,SAAyB,SAAiB,WAA2C;AAC5G,UAAM,OAAO,CAAC,KAAK,YAAY,OAAO;AACtC,UAAM,QAAQ,KAAK,QAAQ,KAAK,WAAW,MAAM;AAAA,MAC/C,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,MAAM,SAAS,CAAC,MAAM,UAAU,CAAC,MAAM,QAAQ;AAClD,YAAM,IAAI;AAAA,QACR,sCAAsC,OAAO;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,MAAM;AACxB,UAAM,aAAa,MAAM;AACzB,UAAM,aAAa,MAAM;AAEzB,UAAM,eAAyB,CAAC;AAChC,UAAM,eAAyB,CAAC;AAChC,QAAI,WAAW;AAEf,UAAM,QAAQ,YAAY,IACtB,WAAW,MAAM;AACjB,iBAAW;AACX,YAAM,KAAK,SAAS;AAAA,IACtB,GAAG,SAAS,IACV;AAEJ,eAAW,GAAG,QAAQ,CAAC,UAA2B;AAChD,mBAAa,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACvE,CAAC;AACD,eAAW,GAAG,QAAQ,CAAC,UAA2B;AAChD,mBAAa,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACvE,CAAC;AAED,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,UAAU,OAAO,CAAC;AACvC,gBAAU,IAAI;AAEd,aAAO,MAAM,IAAI,QAAuB,CAAC,SAAS,WAAW;AAC3D,cAAM,uBAAuB,CAAC,QAAiB;AAC7C,gBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,iBAAO,IAAI,kBAAkB,uCAAuC,OAAO,MAAM,GAAG,IAAI,eAAe,CAAC;AAAA,QAC1G;AACA,cAAM,KAAK,SAAS,oBAAoB;AACxC,kBAAU,KAAK,SAAS,oBAAoB;AAC5C,cAAM,KAAK,SAAS,CAAC,aAAa,QAAQ,QAAQ,CAAC;AAAA,MACrD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAmB,OAAM;AAC5C,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAM,IAAI,kBAAkB,uCAAuC,OAAO,MAAM,GAAG,IAAI,eAAe;AAAA,IACxG,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAAA,IAC/B;AAEA,UAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO,EAAE,KAAK;AAClE,UAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO,EAAE,KAAK;AAElE,QAAI,UAAU;AACZ,YAAM,IAAI;AAAA,QACR,oCAAoC,OAAO,KAAK,SAAS;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,GAAG;AACd,YAAM,IAAI;AAAA,QACR,kCAAkC,OAAO,UAAU,QAAQ,MAAM,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,wCAAwC,OAAO;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM;AAAA,IAC5B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,OAAO;AACvB,YAAM,UAAU,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IACtE,OAAO,QACP,iCAAiC,OAAO;AAC5C,YAAM,IAAI,kBAAkB,SAAS,eAAe;AAAA,IACtD;AACA,QAAI,OAAO,OAAO,MAAM;AACtB,YAAM,IAAI;AAAA,QACR,sDAAsD,OAAO;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBACpB,SAC4B;AAC5B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,WAAW,IAAI,SAAS,sBAAsB;AAAA,EACrF;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,OAAO;AAAA,EAC9B,SAAS,KAAK;AACZ,QAAI,MAAM,4CAA4C,GAAG,EAAE;AAC3D,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,WAAW,IAAI,SAAS,gBAAgB;AAAA,EAC/E;AACF;","names":[]}

package/dist/chunk-FLTNHQK6.js

@@ -1,262 +0,0 @@
-import {
-  readEnvVar
-} from "./chunk-XIG5PDM7.js";
-import {
-  log
-} from "./chunk-2ODBA7MQ.js";
-
-// src/resolve-provider-secret.ts
-import path from "path";
-import os from "os";
-var _resolveApiKeyForProvider = null;
-var _getRuntimeAuthForModel = null;
-var _resolverLoaded = false;
-var _resolverNextRetryAt = 0;
-var RESOLVER_RETRY_BACKOFF_MS = 6e4;
-var resolvedCache = /* @__PURE__ */ new Map();
-var cacheObjectIds = /* @__PURE__ */ new WeakMap();
-var nextCacheObjectId = 1;
-var NON_LITERAL_AUTH_MARKERS = /* @__PURE__ */ new Set([
-  "secretref-managed",
-  "lm-studio"
-]);
-var ENV_VAR_MARKER_RE = /^[A-Z][A-Z0-9_]*(?:_API_KEY|_ACCESS_TOKEN|_TOKEN|_SECRET|_CREDENTIALS|_CREDENTIALS_JSON)$/;
-async function getGatewayResolver() {
-  if (_resolverLoaded) {
-    return _resolveApiKeyForProvider;
-  }
-  if (_resolverNextRetryAt > 0 && Date.now() < _resolverNextRetryAt) {
-    return null;
-  }
-  try {
-    const candidates = [
-      // Try glob-matching the runtime module name (hash varies per build)
-      ...await findRuntimeModules()
-    ];
-    const { pathToFileURL } = await import("url");
-    for (const candidate of candidates) {
-      try {
-        const importUrl = pathToFileURL(candidate).href;
-        const mod = await import(importUrl);
-        if (typeof mod.resolveApiKeyForProvider === "function") {
-          _resolveApiKeyForProvider = mod.resolveApiKeyForProvider;
-          if (typeof mod.getRuntimeAuthForModel === "function") {
-            _getRuntimeAuthForModel = mod.getRuntimeAuthForModel;
-            log.debug("loaded gateway getRuntimeAuthForModel from runtime module");
-          }
-          _resolverLoaded = true;
-          log.debug("loaded gateway resolveApiKeyForProvider from runtime module");
-          return _resolveApiKeyForProvider;
-        }
-      } catch {
-      }
-    }
-  } catch {
-  }
-  _resolverNextRetryAt = Date.now() + RESOLVER_RETRY_BACKOFF_MS;
-  log.debug(`gateway resolveApiKeyForProvider not available \u2014 will retry after ${RESOLVER_RETRY_BACKOFF_MS / 1e3}s`);
-  return null;
-}
-async function findRuntimeModules() {
-  return findGatewayRuntimeModules("runtime-model-auth.runtime-");
-}
-async function findGatewayRuntimeModules(filePrefix) {
-  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import("fs");
-  const { createRequire } = await import("module");
-  const candidates = [];
-  const distDirs = [];
-  const pushDistDirs = (entryPath) => {
-    const resolvedEntryDir = path.dirname(entryPath);
-    const packageRoot = path.basename(resolvedEntryDir) === "dist" ? path.resolve(resolvedEntryDir, "..") : resolvedEntryDir;
-    const candidateDistDirs = [
-      path.join(packageRoot, "dist"),
-      path.join(packageRoot, "..", "dist")
-    ];
-    for (const candidate of candidateDistDirs) {
-      const resolved = path.resolve(candidate);
-      if (!distDirs.includes(resolved)) distDirs.push(resolved);
-    }
-  };
-  try {
-    const req = createRequire(import.meta.url);
-    const openclawMain = req.resolve("openclaw");
-    pushDistDirs(openclawMain);
-  } catch {
-  }
-  try {
-    const mainScript = process.argv[1];
-    if (mainScript) {
-      const realScript = realpathSync(mainScript);
-      if (realScript.includes("openclaw")) {
-        pushDistDirs(realScript);
-      }
-    }
-  } catch {
-  }
-  try {
-    const openclawBin = findExecutableOnPath("openclaw", accessSync, statSync, constants.X_OK);
-    if (openclawBin) {
-      pushDistDirs(realpathSync(openclawBin));
-    }
-  } catch {
-  }
-  for (const dir of distDirs) {
-    try {
-      const files = readdirSync(dir);
-      for (const f of files) {
-        if (f.startsWith(filePrefix) && f.endsWith(".js")) {
-          candidates.push(path.join(dir, f));
-        }
-      }
-    } catch {
-    }
-  }
-  return candidates;
-}
-function findExecutableOnPath(executableName, access, stat, executableMode) {
-  const pathEnv = readEnvVar("PATH");
-  if (!pathEnv) return void 0;
-  const pathExts = process.platform === "win32" ? (readEnvVar("PATHEXT") ?? ".EXE;.CMD;.BAT;.COM").split(";").filter((ext) => ext.length > 0) : [""];
-  const hasExtension = path.extname(executableName).length > 0;
-  for (const dir of pathEnv.split(path.delimiter)) {
-    if (!dir) continue;
-    const candidateNames = process.platform === "win32" && !hasExtension ? pathExts.map((ext) => `${executableName}${ext}`) : [executableName];
-    for (const candidateName of candidateNames) {
-      const candidate = path.join(dir, candidateName);
-      try {
-        access(candidate, executableMode);
-        if (!stat(candidate).isFile()) continue;
-        return candidate;
-      } catch {
-      }
-    }
-  }
-  return void 0;
-}
-var __findExecutableOnPathForTest = findExecutableOnPath;
-function isNonLiteralAuthMarker(value) {
-  return NON_LITERAL_AUTH_MARKERS.has(value) || value.endsWith("-oauth") || value.endsWith("-local") || value.startsWith("gcp-") || ENV_VAR_MARKER_RE.test(value);
-}
-function resolveFromNamedEnvVar(marker) {
-  if (!ENV_VAR_MARKER_RE.test(marker)) return void 0;
-  const value = readEnvVar(marker);
-  return value && value.trim().length > 0 ? value.trim() : void 0;
-}
-function cacheIdentity(value) {
-  if (value === null) return "null";
-  if (value === void 0) return "undefined";
-  if (typeof value === "string") return `string:${value}`;
-  if (typeof value === "number") return `number:${String(value)}`;
-  if (typeof value === "boolean") return `boolean:${String(value)}`;
-  if (typeof value === "bigint") return `bigint:${String(value)}`;
-  if (typeof value === "symbol" || typeof value === "function") return typeof value;
-  if (typeof value === "object") {
-    const existingId = cacheObjectIds.get(value);
-    if (existingId !== void 0) return `object:${existingId}`;
-    const newId = nextCacheObjectId++;
-    cacheObjectIds.set(value, newId);
-    return `object:${newId}`;
-  }
-  return String(value);
-}
-function providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig) {
-  return [
-    `provider:${providerId}`,
-    `agentDir:${resolvedAgentDir}`,
-    `apiKey:${cacheIdentity(apiKeyValue)}`,
-    `cfg:${cacheIdentity(gatewayConfig)}`
-  ].join(":");
-}
-async function resolveProviderApiKey(providerId, apiKeyValue, gatewayConfig, agentDir) {
-  const resolvedAgentDir = path.resolve(
-    agentDir ?? path.join(os.homedir(), ".openclaw", "agents", "main", "agent")
-  );
-  let resolved;
-  if (typeof apiKeyValue === "string" && apiKeyValue.trim().length > 0) {
-    const trimmedApiKeyValue = apiKeyValue.trim();
-    if (isNonLiteralAuthMarker(trimmedApiKeyValue)) {
-      const markerEnvValue = resolveFromNamedEnvVar(trimmedApiKeyValue);
-      if (markerEnvValue) {
-        return markerEnvValue;
-      }
-    } else {
-      return trimmedApiKeyValue;
-    }
-  }
-  const cacheKey = providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig);
-  if (resolvedCache.has(cacheKey)) {
-    return resolvedCache.get(cacheKey);
-  }
-  const resolver = await getGatewayResolver();
-  if (resolver) {
-    try {
-      const auth = await resolver({ provider: providerId, cfg: gatewayConfig, agentDir: resolvedAgentDir });
-      if (auth?.apiKey) {
-        resolved = auth.apiKey;
-        log.debug(`resolved API key for provider "${providerId}" via gateway auth (source: ${auth.source ?? "unknown"}, mode: ${auth.mode ?? "unknown"})`);
-        resolvedCache.set(cacheKey, resolved);
-        return resolved;
-      }
-    } catch (err) {
-      log.debug(
-        `gateway auth resolution failed for provider "${providerId}": ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  resolved = resolveFromEnv(providerId);
-  if (resolved) {
-    log.debug(`resolved API key for provider "${providerId}" from environment variable`);
-  } else {
-    log.debug(`could not resolve API key for provider "${providerId}" \u2014 skipping`);
-  }
-  if (resolved) {
-    resolvedCache.set(cacheKey, resolved);
-  }
-  return resolved;
-}
-function resolveFromEnv(providerId) {
-  const normalized = providerId.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-  const candidates = [
-    `${normalized}_API_KEY`,
-    `${normalized}_TOKEN`
-  ];
-  for (const envVar of candidates) {
-    const value = readEnvVar(envVar);
-    if (value && value.trim().length > 0) {
-      return value.trim();
-    }
-  }
-  return void 0;
-}
-async function getGatewayRuntimeAuthForModel() {
-  await getGatewayResolver();
-  return _getRuntimeAuthForModel;
-}
-function clearSecretCache() {
-  resolvedCache.clear();
-  _resolveApiKeyForProvider = null;
-  _getRuntimeAuthForModel = null;
-  _resolverLoaded = false;
-  _resolverNextRetryAt = 0;
-}
-function __setGatewayResolverForTest(resolver) {
-  _resolveApiKeyForProvider = resolver;
-  _resolverLoaded = resolver !== null;
-  _resolverNextRetryAt = 0;
-}
-function __setGatewayRuntimeAuthForModelForTest(resolver) {
-  _getRuntimeAuthForModel = resolver;
-  _resolverLoaded = resolver !== null || _resolveApiKeyForProvider !== null;
-  _resolverNextRetryAt = 0;
-}
-
-export {
-  findGatewayRuntimeModules,
-  __findExecutableOnPathForTest,
-  resolveProviderApiKey,
-  getGatewayRuntimeAuthForModel,
-  clearSecretCache,
-  __setGatewayResolverForTest,
-  __setGatewayRuntimeAuthForModelForTest
-};
-//# sourceMappingURL=chunk-FLTNHQK6.js.map

package/dist/chunk-FLTNHQK6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/resolve-provider-secret.ts"],"sourcesContent":["import { log } from \"./logger.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport path from \"node:path\";\nimport os from \"node:os\";\n\n/**\n * Resolve a provider API key using OpenClaw's own auth resolution system.\n *\n * This module delegates to the gateway's `resolveApiKeyForProvider()` function,\n * which handles all secret reference formats (SecretRef objects, auth profiles,\n * \"secretref-managed\" markers, environment variables, etc.) using the same\n * codepath the gateway uses for its own agent sessions.\n *\n * For plain-text API keys, a fast path returns them directly without\n * involving the gateway auth system.\n *\n * Results are cached per provider for the gateway process lifetime.\n */\n\ntype ResolveApiKeyFn = (params: {\n  provider: string;\n  cfg?: unknown;\n  agentDir?: string;\n}) => Promise<{ apiKey?: string; source?: string; mode?: string } | null>;\n\n/**\n * Resolve request-ready auth for a model, including provider-owned transforms\n * (e.g., OAuth token exchange, base URL override for openai-codex).\n */\nexport type GetRuntimeAuthForModelFn = (params: {\n  model: { provider: string; id: string; api?: string; baseUrl?: string };\n  cfg?: unknown;\n  workspaceDir?: string;\n}) => Promise<{\n  apiKey?: string;\n  baseUrl?: string;\n  source?: string;\n  mode?: string;\n  profileId?: string;\n} | null>;\n\nlet _resolveApiKeyForProvider: ResolveApiKeyFn | null = null;\nlet _getRuntimeAuthForModel: GetRuntimeAuthForModelFn | null = null;\nlet _resolverLoaded = false;\nlet _resolverNextRetryAt = 0;\nconst RESOLVER_RETRY_BACKOFF_MS = 60_000; // 1 minute between retries after first failure\nconst resolvedCache = new Map<string, string | undefined>();\nconst cacheObjectIds = new WeakMap<object, number>();\nlet nextCacheObjectId = 1;\nconst NON_LITERAL_AUTH_MARKERS = new Set([\n  \"secretref-managed\",\n  \"lm-studio\",\n]);\nconst ENV_VAR_MARKER_RE =\n  /^[A-Z][A-Z0-9_]*(?:_API_KEY|_ACCESS_TOKEN|_TOKEN|_SECRET|_CREDENTIALS|_CREDENTIALS_JSON)$/;\n\n/**\n * Lazily load the gateway's resolveApiKeyForProvider function.\n * Returns null if not available (e.g., running outside the gateway process).\n */\nasync function getGatewayResolver(): Promise<ResolveApiKeyFn | null> {\n  if (_resolverLoaded) {\n    return _resolveApiKeyForProvider;\n  }\n  // Backoff: don't re-scan filesystem on every call when module wasn't found.\n  // After a failure, wait RESOLVER_RETRY_BACKOFF_MS before trying again.\n  if (_resolverNextRetryAt > 0 && Date.now() < _resolverNextRetryAt) {\n    return null;\n  }\n\n  try {\n    // The gateway bundles this in a runtime chunk — import it dynamically.\n    // This import path is stable across gateway versions since it's a named runtime export.\n    const candidates = [\n      // Try glob-matching the runtime module name (hash varies per build)\n      ...await findRuntimeModules(),\n    ];\n\n    const { pathToFileURL } = await import(\"node:url\");\n    for (const candidate of candidates) {\n      try {\n        // Convert native path to file:// URL for cross-platform ESM import compatibility\n        const importUrl = pathToFileURL(candidate).href;\n        const mod = await import(importUrl);\n        if (typeof mod.resolveApiKeyForProvider === \"function\") {\n          _resolveApiKeyForProvider = mod.resolveApiKeyForProvider;\n          if (typeof mod.getRuntimeAuthForModel === \"function\") {\n            _getRuntimeAuthForModel = mod.getRuntimeAuthForModel;\n            log.debug(\"loaded gateway getRuntimeAuthForModel from runtime module\");\n          }\n          _resolverLoaded = true;\n          log.debug(\"loaded gateway resolveApiKeyForProvider from runtime module\");\n          return _resolveApiKeyForProvider;\n        }\n      } catch {\n        // Try next candidate\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  // Backoff before retrying — avoid repeated fs scanning.\n  // Retries after RESOLVER_RETRY_BACKOFF_MS so the resolver can\n  // recover if the gateway restarts or the module becomes available.\n  _resolverNextRetryAt = Date.now() + RESOLVER_RETRY_BACKOFF_MS;\n  log.debug(`gateway resolveApiKeyForProvider not available — will retry after ${RESOLVER_RETRY_BACKOFF_MS / 1000}s`);\n  return null;\n}\n\n/**\n * Find the gateway's model-auth runtime module by scanning the dist directory.\n * Uses require.resolve to find the openclaw package regardless of install method.\n */\nasync function findRuntimeModules(): Promise<string[]> {\n  return findGatewayRuntimeModules(\"runtime-model-auth.runtime-\");\n}\n\n/**\n * Discover gateway runtime module files matching the given filename prefix.\n *\n * Reused by adjacent SecretRef resolution code (`resolve-auth-token.ts`,\n * issue #757). Walks the same dist-dir candidates as the model-auth path\n * so callers don't reimplement install-method discovery.\n */\nexport async function findGatewayRuntimeModules(filePrefix: string): Promise<string[]> {\n  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import(\"node:fs\");\n  const { createRequire } = await import(\"node:module\");\n  const candidates: string[] = [];\n\n  const distDirs: string[] = [];\n  const pushDistDirs = (entryPath: string): void => {\n    const resolvedEntryDir = path.dirname(entryPath);\n    const packageRoot = path.basename(resolvedEntryDir) === \"dist\"\n      ? path.resolve(resolvedEntryDir, \"..\")\n      : resolvedEntryDir;\n    const candidateDistDirs = [\n      path.join(packageRoot, \"dist\"),\n      path.join(packageRoot, \"..\", \"dist\"),\n    ];\n    for (const candidate of candidateDistDirs) {\n      const resolved = path.resolve(candidate);\n      if (!distDirs.includes(resolved)) distDirs.push(resolved);\n    }\n  };\n\n  try {\n    const req = createRequire(import.meta.url);\n    const openclawMain = req.resolve(\"openclaw\");\n    pushDistDirs(openclawMain);\n  } catch {\n    // openclaw not resolvable from plugin context — try alternate paths\n  }\n\n  try {\n    const mainScript = process.argv[1];\n    if (mainScript) {\n      const realScript = realpathSync(mainScript);\n      if (realScript.includes(\"openclaw\")) {\n        pushDistDirs(realScript);\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  try {\n    const openclawBin = findExecutableOnPath(\"openclaw\", accessSync, statSync, constants.X_OK);\n    if (openclawBin) {\n      pushDistDirs(realpathSync(openclawBin));\n    }\n  } catch {\n    // Silent\n  }\n\n  for (const dir of distDirs) {\n    try {\n      const files = readdirSync(dir);\n      for (const f of files) {\n        if (f.startsWith(filePrefix) && f.endsWith(\".js\")) {\n          candidates.push(path.join(dir, f));\n        }\n      }\n    } catch {\n      // Directory doesn't exist — skip\n    }\n  }\n\n  return candidates;\n}\n\nfunction findExecutableOnPath(\n  executableName: string,\n  access: (path: string, mode?: number) => void,\n  stat: (path: string) => { isFile(): boolean },\n  executableMode: number,\n): string | undefined {\n  const pathEnv = readEnvVar(\"PATH\");\n  if (!pathEnv) return undefined;\n\n  const pathExts = process.platform === \"win32\"\n    ? (readEnvVar(\"PATHEXT\") ?? \".EXE;.CMD;.BAT;.COM\")\n        .split(\";\")\n        .filter((ext) => ext.length > 0)\n    : [\"\"];\n  const hasExtension = path.extname(executableName).length > 0;\n\n  for (const dir of pathEnv.split(path.delimiter)) {\n    if (!dir) continue;\n    const candidateNames = process.platform === \"win32\" && !hasExtension\n      ? pathExts.map((ext) => `${executableName}${ext}`)\n      : [executableName];\n\n    for (const candidateName of candidateNames) {\n      const candidate = path.join(dir, candidateName);\n      try {\n        access(candidate, executableMode);\n        if (!stat(candidate).isFile()) continue;\n        return candidate;\n      } catch {\n        // Try the next PATH entry.\n      }\n    }\n  }\n\n  return undefined;\n}\n\nexport const __findExecutableOnPathForTest = findExecutableOnPath;\n\nfunction isNonLiteralAuthMarker(value: string): boolean {\n  return (\n    NON_LITERAL_AUTH_MARKERS.has(value) ||\n    value.endsWith(\"-oauth\") ||\n    value.endsWith(\"-local\") ||\n    value.startsWith(\"gcp-\") ||\n    ENV_VAR_MARKER_RE.test(value)\n  );\n}\n\nfunction resolveFromNamedEnvVar(marker: string): string | undefined {\n  if (!ENV_VAR_MARKER_RE.test(marker)) return undefined;\n  const value = readEnvVar(marker);\n  return value && value.trim().length > 0 ? value.trim() : undefined;\n}\n\nfunction cacheIdentity(value: unknown): string {\n  if (value === null) return \"null\";\n  if (value === undefined) return \"undefined\";\n  if (typeof value === \"string\") return `string:${value}`;\n  if (typeof value === \"number\") return `number:${String(value)}`;\n  if (typeof value === \"boolean\") return `boolean:${String(value)}`;\n  if (typeof value === \"bigint\") return `bigint:${String(value)}`;\n  if (typeof value === \"symbol\" || typeof value === \"function\") return typeof value;\n  if (typeof value === \"object\") {\n    const existingId = cacheObjectIds.get(value);\n    if (existingId !== undefined) return `object:${existingId}`;\n    const newId = nextCacheObjectId++;\n    cacheObjectIds.set(value, newId);\n    return `object:${newId}`;\n  }\n  return String(value);\n}\n\nfunction providerSecretCacheKey(\n  providerId: string,\n  resolvedAgentDir: string,\n  apiKeyValue: unknown,\n  gatewayConfig: unknown,\n): string {\n  return [\n    `provider:${providerId}`,\n    `agentDir:${resolvedAgentDir}`,\n    `apiKey:${cacheIdentity(apiKeyValue)}`,\n    `cfg:${cacheIdentity(gatewayConfig)}`,\n  ].join(\":\");\n}\n\n/**\n * Resolve a provider API key from various OpenClaw formats.\n *\n * Resolution order:\n * 1. Plain-text string → returned immediately\n * 2. Gateway's resolveApiKeyForProvider → handles all secret ref formats\n * 3. Environment variable fallback (PROVIDER_NAME_API_KEY)\n * 4. undefined → provider is skipped in the fallback chain\n */\nexport async function resolveProviderApiKey(\n  providerId: string,\n  apiKeyValue: unknown,\n  gatewayConfig?: unknown,\n  agentDir?: string,\n): Promise<string | undefined> {\n  const resolvedAgentDir = path.resolve(\n    agentDir ?? path.join(os.homedir(), \".openclaw\", \"agents\", \"main\", \"agent\"),\n  );\n\n  let resolved: string | undefined;\n\n  // Fast path: plain-text string that looks like an actual API key\n  if (typeof apiKeyValue === \"string\" && apiKeyValue.trim().length > 0) {\n    const trimmedApiKeyValue = apiKeyValue.trim();\n    // Skip known non-API-key markers used by the gateway for auth modes,\n    // plus env-var-shaped markers such as OPENAI_API_KEY.\n    if (isNonLiteralAuthMarker(trimmedApiKeyValue)) {\n      const markerEnvValue = resolveFromNamedEnvVar(trimmedApiKeyValue);\n      if (markerEnvValue) {\n        return markerEnvValue;\n      }\n      // Fall through to gateway resolver / env var fallback\n    } else {\n      return trimmedApiKeyValue;\n    }\n  }\n\n  const cacheKey = providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig);\n  if (resolvedCache.has(cacheKey)) {\n    return resolvedCache.get(cacheKey);\n  }\n\n  // The API key is either a SecretRef object, \"secretref-managed\", or empty.\n  // Try the gateway's own auth resolution system first.\n  const resolver = await getGatewayResolver();\n  if (resolver) {\n    try {\n      const auth = await resolver({ provider: providerId, cfg: gatewayConfig, agentDir: resolvedAgentDir });\n      if (auth?.apiKey) {\n        resolved = auth.apiKey;\n        log.debug(`resolved API key for provider \"${providerId}\" via gateway auth (source: ${auth.source ?? \"unknown\"}, mode: ${auth.mode ?? \"unknown\"})`);\n        resolvedCache.set(cacheKey, resolved);\n        return resolved;\n      }\n    } catch (err) {\n      log.debug(\n        `gateway auth resolution failed for provider \"${providerId}\": ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  // Environment variable fallback\n  resolved = resolveFromEnv(providerId);\n  if (resolved) {\n    log.debug(`resolved API key for provider \"${providerId}\" from environment variable`);\n  } else {\n    log.debug(`could not resolve API key for provider \"${providerId}\" — skipping`);\n  }\n\n  // Only cache successful resolutions — failures are retried on next call\n  // so providers can recover after transient issues (e.g., 1Password agent restart)\n  if (resolved) {\n    resolvedCache.set(cacheKey, resolved);\n  }\n  return resolved;\n}\n\n/**\n * Try to resolve an API key from environment variables.\n */\nfunction resolveFromEnv(providerId: string): string | undefined {\n  const normalized = providerId.toUpperCase().replace(/[^A-Z0-9]/g, \"_\");\n  const candidates = [\n    `${normalized}_API_KEY`,\n    `${normalized}_TOKEN`,\n  ];\n  for (const envVar of candidates) {\n    const value = readEnvVar(envVar);\n    if (value && value.trim().length > 0) {\n      return value.trim();\n    }\n  }\n  return undefined;\n}\n\n/**\n * Get the gateway's getRuntimeAuthForModel function, if available.\n * This resolves request-ready auth including provider-owned transforms\n * (OAuth token exchange, base URL override for codex/copilot/etc.).\n * Must be called after at least one resolveProviderApiKey() call to\n * trigger the lazy module load.\n */\nexport async function getGatewayRuntimeAuthForModel(): Promise<GetRuntimeAuthForModelFn | null> {\n  // Ensure the runtime module has been loaded\n  await getGatewayResolver();\n  return _getRuntimeAuthForModel;\n}\n\n/**\n * Clear the resolution cache (useful for testing or key rotation).\n */\nexport function clearSecretCache(): void {\n  resolvedCache.clear();\n  _resolveApiKeyForProvider = null;\n  _getRuntimeAuthForModel = null;\n  _resolverLoaded = false;\n  _resolverNextRetryAt = 0;\n}\n\nexport function __setGatewayResolverForTest(resolver: ResolveApiKeyFn | null): void {\n  _resolveApiKeyForProvider = resolver;\n  _resolverLoaded = resolver !== null;\n  _resolverNextRetryAt = 0;\n}\n\nexport function __setGatewayRuntimeAuthForModelForTest(\n  resolver: GetRuntimeAuthForModelFn | null,\n): void {\n  _getRuntimeAuthForModel = resolver;\n  _resolverLoaded = resolver !== null || _resolveApiKeyForProvider !== null;\n  _resolverNextRetryAt = 0;\n}\n"],"mappings":";;;;;;;;AAEA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAsCf,IAAI,4BAAoD;AACxD,IAAI,0BAA2D;AAC/D,IAAI,kBAAkB;AACtB,IAAI,uBAAuB;AAC3B,IAAM,4BAA4B;AAClC,IAAM,gBAAgB,oBAAI,IAAgC;AAC1D,IAAM,iBAAiB,oBAAI,QAAwB;AACnD,IAAI,oBAAoB;AACxB,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBACJ;AAMF,eAAe,qBAAsD;AACnE,MAAI,iBAAiB;AACnB,WAAO;AAAA,EACT;AAGA,MAAI,uBAAuB,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,UAAM,aAAa;AAAA;AAAA,MAEjB,GAAG,MAAM,mBAAmB;AAAA,IAC9B;AAEA,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,KAAU;AACjD,eAAW,aAAa,YAAY;AAClC,UAAI;AAEF,cAAM,YAAY,cAAc,SAAS,EAAE;AAC3C,cAAM,MAAM,MAAM,OAAO;AACzB,YAAI,OAAO,IAAI,6BAA6B,YAAY;AACtD,sCAA4B,IAAI;AAChC,cAAI,OAAO,IAAI,2BAA2B,YAAY;AACpD,sCAA0B,IAAI;AAC9B,gBAAI,MAAM,2DAA2D;AAAA,UACvE;AACA,4BAAkB;AAClB,cAAI,MAAM,6DAA6D;AACvE,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,yBAAuB,KAAK,IAAI,IAAI;AACpC,MAAI,MAAM,0EAAqE,4BAA4B,GAAI,GAAG;AAClH,SAAO;AACT;AAMA,eAAe,qBAAwC;AACrD,SAAO,0BAA0B,6BAA6B;AAChE;AASA,eAAsB,0BAA0B,YAAuC;AACrF,QAAM,EAAE,YAAY,WAAW,aAAa,cAAc,SAAS,IAAI,MAAM,OAAO,IAAS;AAC7F,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,QAAa;AACpD,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAqB,CAAC;AAC5B,QAAM,eAAe,CAAC,cAA4B;AAChD,UAAM,mBAAmB,KAAK,QAAQ,SAAS;AAC/C,UAAM,cAAc,KAAK,SAAS,gBAAgB,MAAM,SACpD,KAAK,QAAQ,kBAAkB,IAAI,IACnC;AACJ,UAAM,oBAAoB;AAAA,MACxB,KAAK,KAAK,aAAa,MAAM;AAAA,MAC7B,KAAK,KAAK,aAAa,MAAM,MAAM;AAAA,IACrC;AACA,eAAW,aAAa,mBAAmB;AACzC,YAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,UAAI,CAAC,SAAS,SAAS,QAAQ,EAAG,UAAS,KAAK,QAAQ;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,UAAM,eAAe,IAAI,QAAQ,UAAU;AAC3C,iBAAa,YAAY;AAAA,EAC3B,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,aAAa,QAAQ,KAAK,CAAC;AACjC,QAAI,YAAY;AACd,YAAM,aAAa,aAAa,UAAU;AAC1C,UAAI,WAAW,SAAS,UAAU,GAAG;AACnC,qBAAa,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,cAAc,qBAAqB,YAAY,YAAY,UAAU,UAAU,IAAI;AACzF,QAAI,aAAa;AACf,mBAAa,aAAa,WAAW,CAAC;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,aAAW,OAAO,UAAU;AAC1B,QAAI;AACF,YAAM,QAAQ,YAAY,GAAG;AAC7B,iBAAW,KAAK,OAAO;AACrB,YAAI,EAAE,WAAW,UAAU,KAAK,EAAE,SAAS,KAAK,GAAG;AACjD,qBAAW,KAAK,KAAK,KAAK,KAAK,CAAC,CAAC;AAAA,QACnC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,qBACP,gBACA,QACA,MACA,gBACoB;AACpB,QAAM,UAAU,WAAW,MAAM;AACjC,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,WAAW,QAAQ,aAAa,WACjC,WAAW,SAAS,KAAK,uBACvB,MAAM,GAAG,EACT,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IACjC,CAAC,EAAE;AACP,QAAM,eAAe,KAAK,QAAQ,cAAc,EAAE,SAAS;AAE3D,aAAW,OAAO,QAAQ,MAAM,KAAK,SAAS,GAAG;AAC/C,QAAI,CAAC,IAAK;AACV,UAAM,iBAAiB,QAAQ,aAAa,WAAW,CAAC,eACpD,SAAS,IAAI,CAAC,QAAQ,GAAG,cAAc,GAAG,GAAG,EAAE,IAC/C,CAAC,cAAc;AAEnB,eAAW,iBAAiB,gBAAgB;AAC1C,YAAM,YAAY,KAAK,KAAK,KAAK,aAAa;AAC9C,UAAI;AACF,eAAO,WAAW,cAAc;AAChC,YAAI,CAAC,KAAK,SAAS,EAAE,OAAO,EAAG;AAC/B,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,IAAM,gCAAgC;AAE7C,SAAS,uBAAuB,OAAwB;AACtD,SACE,yBAAyB,IAAI,KAAK,KAClC,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,QAAQ,KACvB,MAAM,WAAW,MAAM,KACvB,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,uBAAuB,QAAoC;AAClE,MAAI,CAAC,kBAAkB,KAAK,MAAM,EAAG,QAAO;AAC5C,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC3D;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,KAAK;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,OAAO,KAAK,CAAC;AAC7D,MAAI,OAAO,UAAU,UAAW,QAAO,WAAW,OAAO,KAAK,CAAC;AAC/D,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,OAAO,KAAK,CAAC;AAC7D,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAY,QAAO,OAAO;AAC5E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,aAAa,eAAe,IAAI,KAAK;AAC3C,QAAI,eAAe,OAAW,QAAO,UAAU,UAAU;AACzD,UAAM,QAAQ;AACd,mBAAe,IAAI,OAAO,KAAK;AAC/B,WAAO,UAAU,KAAK;AAAA,EACxB;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,uBACP,YACA,kBACA,aACA,eACQ;AACR,SAAO;AAAA,IACL,YAAY,UAAU;AAAA,IACtB,YAAY,gBAAgB;AAAA,IAC5B,UAAU,cAAc,WAAW,CAAC;AAAA,IACpC,OAAO,cAAc,aAAa,CAAC;AAAA,EACrC,EAAE,KAAK,GAAG;AACZ;AAWA,eAAsB,sBACpB,YACA,aACA,eACA,UAC6B;AAC7B,QAAM,mBAAmB,KAAK;AAAA,IAC5B,YAAY,KAAK,KAAK,GAAG,QAAQ,GAAG,aAAa,UAAU,QAAQ,OAAO;AAAA,EAC5E;AAEA,MAAI;AAGJ,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,UAAM,qBAAqB,YAAY,KAAK;AAG5C,QAAI,uBAAuB,kBAAkB,GAAG;AAC9C,YAAM,iBAAiB,uBAAuB,kBAAkB;AAChE,UAAI,gBAAgB;AAClB,eAAO;AAAA,MACT;AAAA,IAEF,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,uBAAuB,YAAY,kBAAkB,aAAa,aAAa;AAChG,MAAI,cAAc,IAAI,QAAQ,GAAG;AAC/B,WAAO,cAAc,IAAI,QAAQ;AAAA,EACnC;AAIA,QAAM,WAAW,MAAM,mBAAmB;AAC1C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,EAAE,UAAU,YAAY,KAAK,eAAe,UAAU,iBAAiB,CAAC;AACpG,UAAI,MAAM,QAAQ;AAChB,mBAAW,KAAK;AAChB,YAAI,MAAM,kCAAkC,UAAU,+BAA+B,KAAK,UAAU,SAAS,WAAW,KAAK,QAAQ,SAAS,GAAG;AACjJ,sBAAc,IAAI,UAAU,QAAQ;AACpC,eAAO;AAAA,MACT;AAAA,IACF,SAAS,KAAK;AACZ,UAAI;AAAA,QACF,gDAAgD,UAAU,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,eAAe,UAAU;AACpC,MAAI,UAAU;AACZ,QAAI,MAAM,kCAAkC,UAAU,6BAA6B;AAAA,EACrF,OAAO;AACL,QAAI,MAAM,2CAA2C,UAAU,mBAAc;AAAA,EAC/E;AAIA,MAAI,UAAU;AACZ,kBAAc,IAAI,UAAU,QAAQ;AAAA,EACtC;AACA,SAAO;AACT;AAKA,SAAS,eAAe,YAAwC;AAC9D,QAAM,aAAa,WAAW,YAAY,EAAE,QAAQ,cAAc,GAAG;AACrE,QAAM,aAAa;AAAA,IACjB,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACf;AACA,aAAW,UAAU,YAAY;AAC/B,UAAM,QAAQ,WAAW,MAAM;AAC/B,QAAI,SAAS,MAAM,KAAK,EAAE,SAAS,GAAG;AACpC,aAAO,MAAM,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,gCAA0E;AAE9F,QAAM,mBAAmB;AACzB,SAAO;AACT;AAKO,SAAS,mBAAyB;AACvC,gBAAc,MAAM;AACpB,8BAA4B;AAC5B,4BAA0B;AAC1B,oBAAkB;AAClB,yBAAuB;AACzB;AAEO,SAAS,4BAA4B,UAAwC;AAClF,8BAA4B;AAC5B,oBAAkB,aAAa;AAC/B,yBAAuB;AACzB;AAEO,SAAS,uCACd,UACM;AACN,4BAA0B;AAC1B,oBAAkB,aAAa,QAAQ,8BAA8B;AACrE,yBAAuB;AACzB;","names":[]}

package/dist/chunk-GDFS42HT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cross-namespace-budget.ts"],"sourcesContent":["/**\n * Per-principal cross-namespace query-budget limiter (issue #565 PR 4/5).\n *\n * Detects and throttles bursts of recall-type operations that a principal\n * issues against namespaces *other than their own*. Thresholds come from the\n * memory-extraction threat model (`docs/security/memory-extraction-threat-model.md`\n * §6.2) and the ADAM baseline report (`docs/security/adam-baseline-2026-04.md`):\n * a T2-class same-namespace attacker plateaus at 61 queries in the published\n * baseline, so the default window is set well below that to force any\n * adaptive loop to noticeably slow down.\n *\n * Shape:\n * - Pure, in-process, per-principal sliding window. No persistence.\n * - Only cross-namespace reads count: a principal hitting only their own\n *   namespace is never throttled.\n * - The limiter is behind the `recallCrossNamespaceBudgetEnabled` feature\n *   flag (defaults to `false`) and is a no-op when disabled. This mirrors\n *   the canonical \"new filter/transform needs an enabled check\" pattern\n *   (see CLAUDE.md gotcha #30).\n *\n * The module has no side effects beyond incrementing its own counters, and\n * it does NOT take a clock dependency — callers pass the current epoch ms\n * (or let the default `Date.now()` do it) so tests can step time\n * deterministically.\n */\n\nexport interface CrossNamespaceBudgetConfig {\n  /** Feature flag. Defaults to false — a disabled limiter is always allow. */\n  enabled?: boolean;\n  /**\n   * Rolling window size in milliseconds. Counts decay out of the window\n   * as the clock advances. Default: 60_000 (1 minute).\n   */\n  windowMs?: number;\n  /**\n   * Soft cap. Once a principal has `softLimit` cross-namespace reads in the\n   * window, the limiter *records* a warning on the decision but still\n   * allows the call. Used by PR 5's anomaly detector to surface flags\n   * without blocking. Default: 10.\n   */\n  softLimit?: number;\n  /**\n   * Hard cap. Once `hardLimit` is reached, the limiter denies the call.\n   * Default: 30 — picked to be well below the T2 baseline of ~60 queries\n   * at half-plateau, so an ADAM-style adaptive loop is throttled before it\n   * meaningfully leaks.\n   */\n  hardLimit?: number;\n}\n\nexport const DEFAULT_CROSS_NAMESPACE_BUDGET: Required<CrossNamespaceBudgetConfig> =\n  Object.freeze({\n    enabled: false,\n    windowMs: 60_000,\n    softLimit: 10,\n    hardLimit: 30,\n  });\n\n/**\n * Why a call was denied / warned. Stable strings so callers can key log\n * lines and metrics on them.\n */\nexport type BudgetDecisionReason =\n  | \"allowed-same-namespace\"\n  | \"allowed-no-limit\"\n  | \"allowed-under-soft\"\n  | \"warn-over-soft\"\n  | \"deny-over-hard\";\n\nexport interface BudgetDecision {\n  allowed: boolean;\n  reason: BudgetDecisionReason;\n  /** Cross-namespace reads by this principal currently in the window. */\n  count: number;\n  /** Active config snapshot at decision time. */\n  limit: {\n    softLimit: number;\n    hardLimit: number;\n    windowMs: number;\n  };\n}\n\ninterface PrincipalBucket {\n  /** Epoch-ms timestamps of cross-namespace reads in the active window. */\n  timestamps: number[];\n}\n\n/**\n * Normalize the provided config against the defaults and reject clearly\n * invalid shapes (non-positive windows, inverted limits). Never throws —\n * returns a safe effective config the limiter can use.\n */\nfunction effectiveConfig(\n  raw: CrossNamespaceBudgetConfig | undefined,\n): Required<CrossNamespaceBudgetConfig> {\n  const base = { ...DEFAULT_CROSS_NAMESPACE_BUDGET };\n  if (!raw) return base;\n  const out = { ...base };\n  if (typeof raw.enabled === \"boolean\") out.enabled = raw.enabled;\n  if (\n    typeof raw.windowMs === \"number\" &&\n    Number.isFinite(raw.windowMs) &&\n    raw.windowMs > 0\n  ) {\n    out.windowMs = raw.windowMs;\n  }\n  if (\n    typeof raw.softLimit === \"number\" &&\n    Number.isFinite(raw.softLimit) &&\n    raw.softLimit >= 0\n  ) {\n    out.softLimit = Math.floor(raw.softLimit);\n  }\n  if (\n    typeof raw.hardLimit === \"number\" &&\n    Number.isFinite(raw.hardLimit) &&\n    raw.hardLimit >= 1\n  ) {\n    // Floor the value, then defensively require the floored result is\n    // still >= 1. `raw.hardLimit = 0.5` previously passed the `> 0`\n    // gate and floored to 0, turning a minor misconfiguration into a\n    // full denial of cross-namespace reads. Now we fall back to the\n    // default instead.\n    const floored = Math.floor(raw.hardLimit);\n    if (floored >= 1) out.hardLimit = floored;\n  }\n  if (out.softLimit > out.hardLimit) {\n    // Inverted limits -> treat soft = hard so we never warn past the deny\n    // threshold. Defensive, should never happen with well-formed config.\n    out.softLimit = out.hardLimit;\n  }\n  return out;\n}\n\n/**\n * In-process cross-namespace budget limiter. Instantiate once per\n * orchestrator / access-service.\n *\n * Threadsafe-by-construction: Node.js is single-threaded per process for\n * application code, and the limiter never awaits between read-modify-write\n * operations on its internal state.\n */\nexport class CrossNamespaceBudget {\n  private readonly config: Required<CrossNamespaceBudgetConfig>;\n  private readonly buckets = new Map<string, PrincipalBucket>();\n\n  constructor(config?: CrossNamespaceBudgetConfig) {\n    this.config = effectiveConfig(config);\n  }\n\n  /** Exposed for tests / audit surfaces. Never mutate the returned value. */\n  getConfig(): Required<CrossNamespaceBudgetConfig> {\n    return this.config;\n  }\n\n  /**\n   * Check whether `principal` is allowed to issue another cross-namespace\n   * read. Call site is expected to compare `principalNamespace` against\n   * `queryNamespace` and only pass through reads where they differ — the\n   * limiter treats every call as a cross-namespace event.\n   *\n   * @param principal Stable identifier for the calling principal (token\n   *   subject, session principal, etc.). Must be non-empty.\n   * @param now Epoch-ms clock read. Defaults to `Date.now()`; tests pass a\n   *   fixed value to step time deterministically.\n   */\n  record(principal: string, now: number = Date.now()): BudgetDecision {\n    const { enabled, windowMs, softLimit, hardLimit } = this.config;\n    const limit = { softLimit, hardLimit, windowMs };\n\n    if (!enabled) {\n      return {\n        allowed: true,\n        reason: \"allowed-no-limit\",\n        count: 0,\n        limit,\n      };\n    }\n\n    if (typeof principal !== \"string\" || principal.length === 0) {\n      // A missing principal means \"we can't attribute this call\". Rather\n      // than fail open, treat it as a cross-namespace event against a\n      // shared bucket — denial-of-service risk is bounded because the\n      // bucket is scoped per-process.\n      principal = \"__anonymous__\";\n    }\n\n    const bucket = this.buckets.get(principal) ?? { timestamps: [] };\n    const cutoff = now - windowMs;\n    // Drop timestamps that slid out of the window.\n    while (bucket.timestamps.length > 0 && bucket.timestamps[0]! < cutoff) {\n      bucket.timestamps.shift();\n    }\n\n    // Count the current call against the window BEFORE deciding — a call\n    // that crosses the deny threshold should itself be denied, not the\n    // next one. This is what the threat model calls \"fail at the Nth,\n    // not the (N+1)th\".\n    bucket.timestamps.push(now);\n    this.buckets.set(principal, bucket);\n    const count = bucket.timestamps.length;\n\n    if (count > hardLimit) {\n      // Denied: roll back the timestamp we just added so a repeated denied\n      // call does not push the bucket further into the future. This keeps\n      // the limiter stateless with respect to denied attempts.\n      bucket.timestamps.pop();\n      // Evict empty buckets (e.g. the first record after a long idle\n      // rolled the only timestamp out, then got denied and rolled back).\n      // Prevents unbounded map growth across many transient principals.\n      if (bucket.timestamps.length === 0) {\n        this.buckets.delete(principal);\n      }\n      return {\n        allowed: false,\n        reason: \"deny-over-hard\",\n        count: bucket.timestamps.length,\n        limit,\n      };\n    }\n\n    if (count > softLimit) {\n      return {\n        allowed: true,\n        reason: \"warn-over-soft\",\n        count,\n        limit,\n      };\n    }\n\n    return {\n      allowed: true,\n      reason: \"allowed-under-soft\",\n      count,\n      limit,\n    };\n  }\n\n  /**\n   * Read-only peek at whether a call would be allowed, WITHOUT recording a\n   * timestamp. Useful when the caller must inspect multiple namespaces before\n   * deciding to record a single event. The returned `count` reflects the\n   * current window state at call time.\n   */\n  peek(args: {\n    principal: string;\n    principalNamespace: string;\n    queryNamespace: string;\n    now?: number;\n  }): BudgetDecision {\n    const pn = args.principalNamespace;\n    const qn = args.queryNamespace;\n    const bothPresent =\n      typeof pn === \"string\" && pn.length > 0 &&\n      typeof qn === \"string\" && qn.length > 0;\n    if (bothPresent && pn === qn) {\n      return {\n        allowed: true,\n        reason: \"allowed-same-namespace\",\n        count: 0,\n        limit: {\n          softLimit: this.config.softLimit,\n          hardLimit: this.config.hardLimit,\n          windowMs: this.config.windowMs,\n        },\n      };\n    }\n    // Cross-namespace: simulate what record() would do without the push.\n    const { enabled, windowMs, softLimit, hardLimit } = this.config;\n    const limit = { softLimit, hardLimit, windowMs };\n    if (!enabled) {\n      return { allowed: true, reason: \"allowed-no-limit\", count: 0, limit };\n    }\n    let principal = args.principal;\n    if (typeof principal !== \"string\" || principal.length === 0) {\n      principal = \"__anonymous__\";\n    }\n    const now = args.now ?? Date.now();\n    const bucket = this.buckets.get(principal) ?? { timestamps: [] };\n    const cutoff = now - windowMs;\n    let liveCount = 0;\n    for (const ts of bucket.timestamps) {\n      if (ts >= cutoff) liveCount++;\n    }\n    const projected = liveCount + 1; // +1 for the current call\n    if (projected > hardLimit) {\n      return { allowed: false, reason: \"deny-over-hard\", count: liveCount, limit };\n    }\n    if (projected > softLimit) {\n      return { allowed: true, reason: \"warn-over-soft\", count: projected, limit };\n    }\n    return { allowed: true, reason: \"allowed-under-soft\", count: projected, limit };\n  }\n\n  /**\n   * Convenience guard that also skips the limiter when `principalNamespace`\n   * equals `queryNamespace` (same-namespace is never cross-namespace).\n   * Returns an `allowed-same-namespace` decision in that case.\n   */\n  check(args: {\n    principal: string;\n    principalNamespace: string;\n    queryNamespace: string;\n    now?: number;\n  }): BudgetDecision {\n    // Same-namespace short-circuit requires BOTH namespaces to be\n    // non-empty strings. Two empty/undefined namespaces at runtime\n    // would otherwise compare equal and fail-open — a critical bypass\n    // in a security-critical module. Force the limiter to engage when\n    // either side is missing so we never silently skip enforcement.\n    const pn = args.principalNamespace;\n    const qn = args.queryNamespace;\n    const bothPresent =\n      typeof pn === \"string\" && pn.length > 0 &&\n      typeof qn === \"string\" && qn.length > 0;\n    if (bothPresent && pn === qn) {\n      return {\n        allowed: true,\n        reason: \"allowed-same-namespace\",\n        count: 0,\n        limit: {\n          softLimit: this.config.softLimit,\n          hardLimit: this.config.hardLimit,\n          windowMs: this.config.windowMs,\n        },\n      };\n    }\n    return this.record(args.principal, args.now ?? Date.now());\n  }\n\n  /**\n   * Clear all state. Intended for tests and for the orchestrator's\n   * lifecycle `before_reset` hook.\n   */\n  reset(): void {\n    this.buckets.clear();\n  }\n\n  /**\n   * Evict buckets whose entire timestamp list has slid out of the\n   * active window by `now`. Intended to be called periodically by a\n   * long-lived host process (e.g. from a maintenance cron) that sees\n   * many transient principals. Safe to call at any time; returns the\n   * number of buckets evicted.\n   */\n  gc(now: number = Date.now()): number {\n    const cutoff = now - this.config.windowMs;\n    let evicted = 0;\n    for (const [principal, bucket] of this.buckets.entries()) {\n      while (bucket.timestamps.length > 0 && bucket.timestamps[0]! < cutoff) {\n        bucket.timestamps.shift();\n      }\n      if (bucket.timestamps.length === 0) {\n        this.buckets.delete(principal);\n        evicted++;\n      }\n    }\n    return evicted;\n  }\n\n  /** For tests: current number of live buckets. */\n  bucketCount(): number {\n    return this.buckets.size;\n  }\n}\n"],"mappings":";AAkDO,IAAM,iCACX,OAAO,OAAO;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,WAAW;AAAA,EACX,WAAW;AACb,CAAC;AAoCH,SAAS,gBACP,KACsC;AACtC,QAAM,OAAO,EAAE,GAAG,+BAA+B;AACjD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAM,EAAE,GAAG,KAAK;AACtB,MAAI,OAAO,IAAI,YAAY,UAAW,KAAI,UAAU,IAAI;AACxD,MACE,OAAO,IAAI,aAAa,YACxB,OAAO,SAAS,IAAI,QAAQ,KAC5B,IAAI,WAAW,GACf;AACA,QAAI,WAAW,IAAI;AAAA,EACrB;AACA,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,SAAS,IAAI,SAAS,KAC7B,IAAI,aAAa,GACjB;AACA,QAAI,YAAY,KAAK,MAAM,IAAI,SAAS;AAAA,EAC1C;AACA,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,SAAS,IAAI,SAAS,KAC7B,IAAI,aAAa,GACjB;AAMA,UAAM,UAAU,KAAK,MAAM,IAAI,SAAS;AACxC,QAAI,WAAW,EAAG,KAAI,YAAY;AAAA,EACpC;AACA,MAAI,IAAI,YAAY,IAAI,WAAW;AAGjC,QAAI,YAAY,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAUO,IAAM,uBAAN,MAA2B;AAAA,EACf;AAAA,EACA,UAAU,oBAAI,IAA6B;AAAA,EAE5D,YAAY,QAAqC;AAC/C,SAAK,SAAS,gBAAgB,MAAM;AAAA,EACtC;AAAA;AAAA,EAGA,YAAkD;AAChD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,OAAO,WAAmB,MAAc,KAAK,IAAI,GAAmB;AAClE,UAAM,EAAE,SAAS,UAAU,WAAW,UAAU,IAAI,KAAK;AACzD,UAAM,QAAQ,EAAE,WAAW,WAAW,SAAS;AAE/C,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAK3D,kBAAY;AAAA,IACd;AAEA,UAAM,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE;AAC/D,UAAM,SAAS,MAAM;AAErB,WAAO,OAAO,WAAW,SAAS,KAAK,OAAO,WAAW,CAAC,IAAK,QAAQ;AACrE,aAAO,WAAW,MAAM;AAAA,IAC1B;AAMA,WAAO,WAAW,KAAK,GAAG;AAC1B,SAAK,QAAQ,IAAI,WAAW,MAAM;AAClC,UAAM,QAAQ,OAAO,WAAW;AAEhC,QAAI,QAAQ,WAAW;AAIrB,aAAO,WAAW,IAAI;AAItB,UAAI,OAAO,WAAW,WAAW,GAAG;AAClC,aAAK,QAAQ,OAAO,SAAS;AAAA,MAC/B;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO,OAAO,WAAW;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW;AACrB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,MAKc;AACjB,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,KAAK;AAChB,UAAM,cACJ,OAAO,OAAO,YAAY,GAAG,SAAS,KACtC,OAAO,OAAO,YAAY,GAAG,SAAS;AACxC,QAAI,eAAe,OAAO,IAAI;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,UACL,WAAW,KAAK,OAAO;AAAA,UACvB,WAAW,KAAK,OAAO;AAAA,UACvB,UAAU,KAAK,OAAO;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,UAAU,WAAW,UAAU,IAAI,KAAK;AACzD,UAAM,QAAQ,EAAE,WAAW,WAAW,SAAS;AAC/C,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,SAAS,MAAM,QAAQ,oBAAoB,OAAO,GAAG,MAAM;AAAA,IACtE;AACA,QAAI,YAAY,KAAK;AACrB,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,kBAAY;AAAA,IACd;AACA,UAAM,MAAM,KAAK,OAAO,KAAK,IAAI;AACjC,UAAM,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE;AAC/D,UAAM,SAAS,MAAM;AACrB,QAAI,YAAY;AAChB,eAAW,MAAM,OAAO,YAAY;AAClC,UAAI,MAAM,OAAQ;AAAA,IACpB;AACA,UAAM,YAAY,YAAY;AAC9B,QAAI,YAAY,WAAW;AACzB,aAAO,EAAE,SAAS,OAAO,QAAQ,kBAAkB,OAAO,WAAW,MAAM;AAAA,IAC7E;AACA,QAAI,YAAY,WAAW;AACzB,aAAO,EAAE,SAAS,MAAM,QAAQ,kBAAkB,OAAO,WAAW,MAAM;AAAA,IAC5E;AACA,WAAO,EAAE,SAAS,MAAM,QAAQ,sBAAsB,OAAO,WAAW,MAAM;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAKa;AAMjB,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,KAAK;AAChB,UAAM,cACJ,OAAO,OAAO,YAAY,GAAG,SAAS,KACtC,OAAO,OAAO,YAAY,GAAG,SAAS;AACxC,QAAI,eAAe,OAAO,IAAI;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,UACL,WAAW,KAAK,OAAO;AAAA,UACvB,WAAW,KAAK,OAAO;AAAA,UACvB,UAAU,KAAK,OAAO;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK,OAAO,KAAK,WAAW,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,GAAG,MAAc,KAAK,IAAI,GAAW;AACnC,UAAM,SAAS,MAAM,KAAK,OAAO;AACjC,QAAI,UAAU;AACd,eAAW,CAAC,WAAW,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACxD,aAAO,OAAO,WAAW,SAAS,KAAK,OAAO,WAAW,CAAC,IAAK,QAAQ;AACrE,eAAO,WAAW,MAAM;AAAA,MAC1B;AACA,UAAI,OAAO,WAAW,WAAW,GAAG;AAClC,aAAK,QAAQ,OAAO,SAAS;AAC7B;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,cAAsB;AACpB,WAAO,KAAK,QAAQ;AAAA,EACtB;AACF;","names":[]}

package/dist/chunk-H3ME6L6D.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/summarizer.ts"],"sourcesContent":["import { mkdir, readFile, writeFile, readdir } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\nimport { log } from \"./logger.js\";\nimport { LocalLlmClient } from \"./local-llm.js\";\nimport { FallbackLlmClient } from \"./fallback-llm.js\";\nimport { ModelRegistry } from \"./model-registry.js\";\nimport { extractJsonCandidates } from \"./json-extract.js\";\nimport type { HourlySummary, TranscriptEntry, PluginConfig, GatewayConfig } from \"./types.js\";\nimport type { TranscriptManager } from \"./transcript.js\";\nimport { readSummarySnapshot, upsertSummarySnapshot, writeSummarySnapshot } from \"./summary-snapshot.js\";\nimport {\n  encodeStoragePathSegment,\n  encodeStoragePathSegmentWithHash,\n  isSafeLegacyPathSegment,\n  resolveSafeStoragePath,\n  storagePathHash,\n} from \"./storage-paths.js\";\n\n// Schema for LLM summary output\nconst HourlySummarySchema = z.object({\n  bullets: z\n    .array(z.string())\n    .describe(\"3-5 bullet points summarizing the hour's activity\"),\n});\n\ntype HourlySummaryResult = z.infer<typeof HourlySummarySchema>;\n\nconst HourlySummaryExtendedSchema = z.object({\n  topics: z.array(z.string()).default([]),\n  decisions: z.array(z.string()).default([]),\n  actionItems: z.array(z.string()).default([]),\n  rejected: z.array(z.string()).default([]),\n});\n\ntype HourlySummaryExtendedResult = z.infer<typeof HourlySummaryExtendedSchema>;\n\ntype HourlySummaryExtendedMeta = {\n  userTurns: number;\n  assistantTurns: number;\n  toolCalls: number;\n  toolCounts: Record<string, number>;\n};\n\nexport class HourlySummarizer {\n  private summariesDir: string;\n  private config: PluginConfig;\n  private localLlm: LocalLlmClient;\n  private fallbackLlm: FallbackLlmClient;\n  private modelRegistry: ModelRegistry;\n  private transcript?: TranscriptManager;\n\n  constructor(config: PluginConfig, gatewayConfig?: GatewayConfig, modelRegistry?: ModelRegistry, transcript?: TranscriptManager) {\n    this.config = config;\n    this.summariesDir = path.join(config.memoryDir, \"summaries\", \"hourly\");\n    this.modelRegistry = modelRegistry ?? new ModelRegistry(config.memoryDir);\n    this.transcript = transcript;\n\n    // Initialize local LLM client with shared model registry\n    this.localLlm = new LocalLlmClient(config, this.modelRegistry);\n\n    // Initialize fallback client with gateway config\n    this.fallbackLlm = new FallbackLlmClient(gatewayConfig, {\n      workspaceDir: config.workspaceDir,\n    });\n\n    if (!gatewayConfig?.agents?.defaults?.model?.primary && !config.localLlmEnabled && config.modelSource !== \"gateway\") {\n      log.warn(\"no gateway default AI and local LLM disabled — hourly summarization disabled\");\n    }\n  }\n\n  private get useGatewayModelSource(): boolean {\n    return this.config.modelSource === \"gateway\";\n  }\n\n  private get shouldUseLocalLlm(): boolean {\n    return this.config.localLlmEnabled && !this.useGatewayModelSource;\n  }\n\n  private withGatewayAgent(options: import(\"./fallback-llm.js\").FallbackLlmOptions): import(\"./fallback-llm.js\").FallbackLlmOptions {\n    if (!this.useGatewayModelSource) return options;\n    const agentId = this.config.gatewayAgentId || undefined;\n    return agentId ? { ...options, agentId } : options;\n  }\n\n  async initialize(): Promise<void> {\n    await mkdir(this.summariesDir, { recursive: true });\n    log.info(\"hourly summarizer initialized\");\n  }\n\n  private async summarySessionDir(sessionKey: string): Promise<string> {\n    return resolveSafeStoragePath(\n      this.summariesDir,\n      encodeStoragePathSegment(sessionKey, \"session\"),\n    );\n  }\n\n  private async legacySummarySessionDir(sessionKey: string): Promise<string | null> {\n    if (sessionKey.includes(\"\\0\")) return null;\n    try {\n      return await resolveSafeStoragePath(this.summariesDir, sessionKey);\n    } catch {\n      return null;\n    }\n  }\n\n  private summaryDateString(hour: string): string {\n    const dateStr = hour.slice(0, 10);\n    if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(dateStr)) {\n      throw new Error(`invalid hourly summary timestamp: ${hour}`);\n    }\n    return dateStr;\n  }\n\n  // Generate summary for a specific hour and session\n  async generateSummary(\n    sessionKey: string,\n    hourStart: Date,\n    entries: TranscriptEntry[]\n  ): Promise<HourlySummary | null> {\n    if (entries.length === 0) return null;\n\n    // Format entries for the LLM\n    const conversation = entries\n      .map((e) => `[${e.role}] ${e.content}`)\n      .join(\"\\n\\n\");\n\n    if (this.config.hourlySummariesExtendedEnabled) {\n      const extended = await this.generateExtended(sessionKey, hourStart, conversation, entries);\n      if (!extended) return null;\n      const meta: HourlySummaryExtendedMeta = {\n        userTurns: entries.filter((e) => e.role === \"user\").length,\n        assistantTurns: entries.filter((e) => e.role === \"assistant\").length,\n        toolCalls: extended._meta.toolCalls,\n        toolCounts: extended._meta.toolCounts,\n      };\n      // Keep HourlySummary surface stable; encode \"topics\" as bullets for recall injection.\n      const base: HourlySummary = {\n        hour: hourStart.toISOString(),\n        sessionKey,\n        bullets: extended.topics.length > 0 ? extended.topics.slice(0, 5) : [\"(summary generated)\"],\n        turnCount: entries.length,\n        generatedAt: new Date().toISOString(),\n      };\n      const withExtras = base as any;\n      withExtras._extended = extended;\n      withExtras._extendedMeta = meta;\n      return base;\n    }\n\n    const hourIso = hourStart.toISOString();\n    const startTime = Date.now();\n\n    // Try local LLM first if enabled\n    if (this.shouldUseLocalLlm) {\n      try {\n        const localResult = await this.generateWithLocalLlm(conversation);\n        if (localResult) {\n          const durationMs = Date.now() - startTime;\n          log.debug(\n            `generated hourly summary for ${sessionKey} at ${hourIso} in ${durationMs}ms using local LLM`\n          );\n          return {\n            hour: hourIso,\n            sessionKey,\n            bullets: localResult.bullets,\n            turnCount: entries.length,\n            generatedAt: new Date().toISOString(),\n          };\n        }\n        // Local failed, fall back if allowed\n        if (!this.config.localLlmFallback) {\n          log.warn(\"summary generation: local LLM failed and fallback disabled\");\n          return null;\n        }\n        log.info(\"summary generation: local LLM unavailable, falling back to gateway default AI\");\n      } catch (err) {\n        if (!this.config.localLlmFallback) {\n          log.warn(\"summary generation: local LLM error and fallback disabled:\", err);\n          return null;\n        }\n        log.info(\"summary generation: local LLM error, falling back to gateway default AI:\", err);\n      }\n    }\n\n    // Fall back to gateway's default AI\n    log.info(\"summary generation: falling back to gateway default AI\");\n\n    try {\n      const messages = [\n        {\n          role: \"system\" as const,\n          content: `You are a conversation summarization system. Summarize the following conversation transcript into 3-5 concise bullet points.\n\nGuidelines:\n- Focus on what was accomplished, decided, or discussed\n- Include specific topics, projects, or entities mentioned\n- Note any significant user requests or agent actions\n- Keep bullets brief but informative (1-2 sentences each)\n- Skip trivial greetings or meta-conversation\n- Use present tense for ongoing work, past for completed items\n\nRespond with valid JSON matching this schema:\n{\n  \"bullets\": [\"bullet 1\", \"bullet 2\", \"bullet 3\"]\n}`,\n        },\n        { role: \"user\" as const, content: `Summarize this conversation:\\n\\n${conversation}` },\n      ];\n\n      const result = await this.fallbackLlm.parseWithSchema(\n        messages,\n        HourlySummarySchema,\n        this.withGatewayAgent({ temperature: 0.3, maxTokens: 8192 }),\n      );\n\n      const durationMs = Date.now() - startTime;\n\n      if (result) {\n        log.debug(\n          `generated hourly summary for ${sessionKey} at ${hourIso} in ${durationMs}ms via fallback`,\n        );\n        return {\n          hour: hourIso,\n          sessionKey,\n          bullets: result.bullets,\n          turnCount: entries.length,\n          generatedAt: new Date().toISOString(),\n        };\n      }\n\n      log.warn(\"summary generation fallback returned no parsed output\");\n      return null;\n    } catch (err) {\n      log.error(\"summary generation fallback failed\", err);\n      return null;\n    }\n  }\n\n  private async generateExtended(\n    sessionKey: string,\n    hourStart: Date,\n    conversation: string,\n    entries: TranscriptEntry[],\n  ): Promise<(HourlySummaryExtendedResult & { _meta: HourlySummaryExtendedMeta }) | null> {\n    const hourIso = hourStart.toISOString();\n    const startTime = Date.now();\n\n    const hourEnd = new Date(hourStart.getTime() + 60 * 60 * 1000);\n    let toolCounts: Record<string, number> = {};\n    if (this.config.hourlySummariesIncludeToolStats && this.transcript) {\n      const uses = await this.transcript.readToolUse(sessionKey, hourStart, hourEnd);\n      for (const u of uses) toolCounts[u.tool] = (toolCounts[u.tool] ?? 0) + 1;\n    }\n\n    const sys = `You are a conversation summarization system.\\n\\nSummarize the hour into structured sections.\\n\\nReturn valid JSON matching:\\n{\\n  \\\"topics\\\": [\\\"...\\\"],\\n  \\\"decisions\\\": [\\\"...\\\"],\\n  \\\"actionItems\\\": [\\\"...\\\"],\\n  \\\"rejected\\\": [\\\"...\\\"]\\n}\\n\\nGuidelines:\\n- Prefer concrete topics and decisions.\\n- Action items should be imperative.\\n- Rejected ideas are things that were explicitly discarded or reversed.\\n- If there are none for a section, return an empty array.\\n`;\n\n    const toolStatsLine = Object.keys(toolCounts).length > 0\n      ? `Tools used (counts): ${Object.entries(toolCounts).sort((a,b)=>b[1]-a[1]).slice(0,10).map(([k,v])=>`${k}=${v}`).join(\", \")}\\n\\n`\n      : \"\";\n    const userTurns = entries.filter((e) => e.role === \"user\").length;\n    const assistantTurns = entries.filter((e) => e.role === \"assistant\").length;\n    const toolCalls = Object.values(toolCounts).reduce((a,b)=>a+b,0);\n    const statsLine = `Stats: userTurns=${userTurns}, assistantTurns=${assistantTurns}, toolCalls=${toolCalls}\\n\\n`;\n\n    const user = `Hour: ${hourIso}\\nSession: ${sessionKey}\\n\\n${statsLine}${toolStatsLine}Conversation:\\n${conversation}\\n`;\n\n    // Try local LLM first if enabled\n    if (this.shouldUseLocalLlm) {\n      try {\n        const contextSizes = this.modelRegistry.calculateContextSizes(this.config.localLlmModel, this.config.localLlmMaxContext);\n        const truncated = user.length > contextSizes.maxInputChars ? user.slice(0, contextSizes.maxInputChars) + \"\\n\\n[truncated]\" : user;\n        const response = await this.localLlm.chatCompletion(\n          [\n            { role: \"system\", content: \"Output valid JSON only.\" },\n            { role: \"user\", content: sys + \"\\n\\n\" + truncated },\n          ],\n          {\n            temperature: 0.2,\n            maxTokens: contextSizes.maxOutputTokens,\n            operation: \"hourly_summary_extended\",\n            priority: \"background\",\n          },\n        );\n        if (response?.content) {\n          const content = response.content.trim();\n          for (const candidate of extractJsonCandidates(content)) {\n            try {\n              const parsed = JSON.parse(candidate);\n              const result = HourlySummaryExtendedSchema.parse(parsed);\n              log.debug(\n                `generated extended hourly summary for ${sessionKey} at ${hourIso} in ${Date.now() - startTime}ms (local)`,\n              );\n              return { ...result, _meta: { userTurns, assistantTurns, toolCalls, toolCounts } };\n            } catch {\n              // keep trying candidates\n            }\n          }\n        }\n      } catch (err) {\n        if (!this.config.localLlmFallback) return null;\n        log.info(\"extended summary: local failed, falling back:\", err);\n      }\n    }\n\n    try {\n      const result = await this.fallbackLlm.parseWithSchema(\n        [\n          { role: \"system\" as const, content: sys },\n          { role: \"user\" as const, content: user },\n        ],\n        HourlySummaryExtendedSchema,\n        this.withGatewayAgent({ temperature: 0.2, maxTokens: 2048 }),\n      );\n      if (result) {\n        log.debug(`generated extended hourly summary for ${sessionKey} at ${hourIso} in ${Date.now() - startTime}ms (fallback)`);\n        return { ...result, _meta: { userTurns, assistantTurns, toolCalls, toolCounts } };\n      }\n      return null;\n    } catch (err) {\n      log.error(\"extended summary generation failed\", err);\n      return null;\n    }\n  }\n\n  /**\n   * Generate summary using local LLM with JSON mode.\n   * Uses dynamic context sizing based on model capabilities.\n   */\n  private async generateWithLocalLlm(conversation: string): Promise<HourlySummaryResult | null> {\n    // Get dynamic context sizes based on model capabilities\n    const contextSizes = this.modelRegistry.calculateContextSizes(\n      this.config.localLlmModel,\n      this.config.localLlmMaxContext\n    );\n    log.debug(`Summarizer model context: ${contextSizes.description}`);\n\n    const maxConversationChars = contextSizes.maxInputChars;\n    const truncatedConversation = conversation.length > maxConversationChars\n      ? conversation.slice(0, maxConversationChars) + \"\\n\\n[truncated]\"\n      : conversation;\n\n    const instructions = `You are a conversation summarization system. Summarize the following conversation transcript into 3-5 concise bullet points.\n\nGuidelines:\n- Focus on what was accomplished, decided, or discussed\n- Include specific topics, projects, or entities mentioned\n- Note any significant user requests or agent actions\n- Keep bullets brief but informative (1-2 sentences each)\n- Skip trivial greetings or meta-conversation\n- Use present tense for ongoing work, past for completed items\n\nRespond with valid JSON matching this schema:\n{\n  \"bullets\": [\"bullet 1\", \"bullet 2\", \"bullet 3\"]\n}`;\n\n    const fullPrompt = `${instructions}\\n\\nConversation to summarize:\\n${truncatedConversation}`;\n\n    const response = await this.localLlm.chatCompletion(\n      [\n        { role: \"system\", content: \"You are a conversation summarization system. Output valid JSON only.\" },\n        { role: \"user\", content: fullPrompt },\n      ],\n      {\n        temperature: 0.3,\n        maxTokens: contextSizes.maxOutputTokens,\n        operation: \"hourly_summary\",\n        priority: \"background\",\n      },\n    );\n\n    if (!response?.content) {\n      return null;\n    }\n\n    try {\n      // Parse JSON response\n      const content = response.content.trim();\n      for (const candidate of extractJsonCandidates(content)) {\n        try {\n          const parsed = JSON.parse(candidate);\n          return {\n            bullets: Array.isArray((parsed as any).bullets) ? (parsed as any).bullets : [],\n          };\n        } catch {\n          // keep trying candidates\n        }\n      }\n      return null;\n    } catch (err) {\n      log.warn(\"local LLM summary: failed to parse JSON response:\", err);\n      return null;\n    }\n  }\n\n  // Save summary to file\n  async saveSummary(summary: HourlySummary): Promise<void> {\n    const sessionDir = await this.summarySessionDir(summary.sessionKey);\n    await mkdir(sessionDir, { recursive: true });\n\n    // Format date as YYYY-MM-DD for the filename\n    const dateStr = this.summaryDateString(summary.hour);\n    const filePath = await resolveSafeStoragePath(sessionDir, `${dateStr}.md`);\n\n    // Format hour as HH:00 for display\n    const hourStr = summary.hour.slice(11, 13);\n\n    // Build markdown content\n    const lines: string[] = [];\n\n    // Check if file exists to append or create\n    let existingContent = \"\";\n    try {\n      existingContent = await readFile(filePath, \"utf-8\");\n    } catch {\n      // File doesn't exist yet, will create new\n    }\n\n    // Check if this hour already exists (idempotent)\n    const hourHeader = `## ${hourStr}:00`;\n    if (existingContent.includes(hourHeader)) {\n      // Replace existing hour section\n      const beforeHour = existingContent.split(hourHeader)[0];\n      const afterMatch = existingContent.split(hourHeader)[1];\n      const afterHour = afterMatch ? afterMatch.split(\"\\n## \")[1] : undefined;\n\n      const newSection = this.formatHourSection(summary, hourHeader);\n\n      if (afterHour) {\n        existingContent = beforeHour + newSection + \"\\n## \" + afterHour;\n      } else {\n        existingContent = beforeHour + newSection;\n      }\n\n      await writeFile(filePath, existingContent, \"utf-8\");\n      log.debug(`updated hourly summary for ${summary.sessionKey} at ${hourStr}:00`);\n    } else {\n      // Append new hour section\n      const newSection = this.formatHourSection(summary, hourHeader);\n\n      if (existingContent) {\n        // Add to existing file\n        await writeFile(filePath, existingContent.trimEnd() + \"\\n\\n\" + newSection, \"utf-8\");\n      } else {\n        // Create new file with header\n        const header = `# Hourly Summaries — ${dateStr}\\n\\n*Session: ${summary.sessionKey}*\\n`;\n        await writeFile(filePath, header + \"\\n\" + newSection, \"utf-8\");\n      }\n      log.debug(`saved hourly summary for ${summary.sessionKey} at ${hourStr}:00`);\n    }\n    try {\n      await upsertSummarySnapshot(this.config.memoryDir, summary);\n    } catch (error) {\n      log.warn(\n        `hourly summarizer: failed to update summary snapshot for ${summary.sessionKey} (fail-open): ${String(error)}`,\n      );\n    }\n  }\n\n  private formatHourSection(summary: HourlySummary, hourHeader: string): string {\n    const ext = (summary as any)._extended as (HourlySummaryExtendedResult & { _meta?: HourlySummaryExtendedMeta }) | undefined;\n    const meta = (summary as any)._extendedMeta as HourlySummaryExtendedMeta | undefined;\n    const lines: string[] = [hourHeader, \"\"];\n\n    if (this.config.hourlySummariesExtendedEnabled && ext) {\n      lines.push(\"### Topics Discussed\");\n      for (const t of ext.topics) lines.push(`- ${t}`);\n      lines.push(\"\");\n      lines.push(\"### Decisions Made\");\n      for (const d of ext.decisions) lines.push(`- ${d}`);\n      lines.push(\"\");\n      lines.push(\"### Action Items\");\n      for (const a of ext.actionItems) lines.push(`- ${a}`);\n      lines.push(\"\");\n      lines.push(\"### Rejected Ideas / Reversals\");\n      for (const r of ext.rejected) lines.push(`- ${r}`);\n      lines.push(\"\");\n      if (meta && Object.keys(meta.toolCounts).length > 0) {\n        lines.push(\"### Tools Used\");\n        const top = Object.entries(meta.toolCounts)\n          .sort((a, b) => b[1] - a[1])\n          .slice(0, 12);\n        for (const [name, count] of top) lines.push(`- ${name}: ${count}`);\n        lines.push(\"\");\n      }\n      lines.push(\"### Stats\");\n      lines.push(`- Turns: ${summary.turnCount}`);\n      if (meta) {\n        lines.push(`- User turns: ${meta.userTurns}`);\n        lines.push(`- Assistant turns: ${meta.assistantTurns}`);\n        lines.push(`- Tool calls: ${meta.toolCalls}`);\n      }\n      lines.push(\"\");\n      return lines.join(\"\\n\");\n    }\n\n    for (const bullet of summary.bullets) lines.push(`- ${bullet}`);\n    lines.push(`  *(${summary.turnCount} turns)*`);\n    lines.push(\"\");\n    return lines.join(\"\\n\");\n  }\n\n  // Read recent summaries for recall injection\n  async readRecent(sessionKey: string, hours: number): Promise<HourlySummary[]> {\n    try {\n      const cutoffTime = Date.now() - hours * 60 * 60 * 1000;\n\n      const snapshot = await readSummarySnapshot(this.config.memoryDir, sessionKey);\n      if (snapshot) {\n        return snapshot\n          .filter((s) => new Date(s.hour).getTime() >= cutoffTime)\n          .sort((a, b) => new Date(b.hour).getTime() - new Date(a.hour).getTime());\n      }\n\n      const summaries: HourlySummary[] = [];\n      const encodedDir = await this.summarySessionDir(sessionKey);\n      const legacyDir = await this.legacySummarySessionDir(sessionKey);\n      const seenDirs = new Set<string>();\n\n      for (const sessionDir of [encodedDir, legacyDir]) {\n        if (!sessionDir || seenDirs.has(sessionDir)) continue;\n        seenDirs.add(sessionDir);\n        const parsed = await this.readSummaryDir(sessionDir, sessionKey);\n        summaries.push(...parsed);\n      }\n\n      const byHour = new Map<string, HourlySummary>();\n      for (const summary of summaries) {\n        if (!byHour.has(summary.hour)) byHour.set(summary.hour, summary);\n      }\n\n      const sortedSummaries = Array.from(byHour.values()).sort(\n        (a, b) => new Date(b.hour).getTime() - new Date(a.hour).getTime(),\n      );\n\n      // Filter to recent hours while materializing the full parsed history.\n      const recent = sortedSummaries.filter(\n        (s) => new Date(s.hour).getTime() >= cutoffTime,\n      );\n\n      if (sortedSummaries.length > 0) {\n        try {\n          await writeSummarySnapshot(\n            this.config.memoryDir,\n            sessionKey,\n            sortedSummaries,\n          );\n        } catch (error) {\n          log.warn(\n            `hourly summarizer: failed to materialize summary snapshot for ${sessionKey} (fail-open): ${String(error)}`,\n          );\n        }\n      }\n\n      return recent;\n    } catch {\n      // Directory doesn't exist or error reading\n      return [];\n    }\n  }\n\n  private async readSummaryDir(\n    sessionDir: string,\n    sessionKey: string,\n  ): Promise<HourlySummary[]> {\n    let files: string[];\n    try {\n      files = await readdir(sessionDir);\n    } catch {\n      return [];\n    }\n\n    const summaries: HourlySummary[] = [];\n    const mdFiles = files.filter((f) => f.endsWith(\".md\"));\n    for (const file of mdFiles) {\n      const filePath = await resolveSafeStoragePath(sessionDir, file).catch(() => null);\n      if (filePath === null) continue;\n\n      try {\n        const content = await readFile(filePath, \"utf-8\");\n        summaries.push(...this.parseSummaryFile(content, sessionKey, file));\n      } catch {\n        // Skip unreadable summary files.\n      }\n    }\n\n    return summaries;\n  }\n\n  private parseSummaryFile(\n    content: string,\n    sessionKey: string,\n    filename: string\n  ): HourlySummary[] {\n    const summaries: HourlySummary[] = [];\n\n    // Extract date from filename (YYYY-MM-DD.md)\n    const dateMatch = filename.match(/^(\\d{4}-\\d{2}-\\d{2})\\.md$/);\n    if (!dateMatch) return summaries;\n    const dateStr = dateMatch[1];\n\n    // Split by hour sections\n    const hourSections = content.split(/\\n## (\\d{2}):00\\n/);\n\n    // First element is the header, skip it\n    for (let i = 1; i < hourSections.length; i += 2) {\n      const hourStr = hourSections[i];\n      const sectionContent = hourSections[i + 1] || \"\";\n\n      // Parse bullets\n      const bullets: string[] = [];\n      const lines = sectionContent.split(\"\\n\");\n      let turnCount = 0;\n\n      let inTopics = false;\n      let sawExtendedTopicsHeader = false;\n      for (const line of lines) {\n        if (line.startsWith(\"### Topics\")) {\n          inTopics = true;\n          sawExtendedTopicsHeader = true;\n          continue;\n        }\n        if (line.startsWith(\"### \") && !line.startsWith(\"### Topics\")) {\n          inTopics = false;\n        }\n        const bulletMatch = line.match(/^- (.+)$/);\n        if (bulletMatch) {\n          // For extended format, only treat topic bullets as recall bullets.\n          if (!sawExtendedTopicsHeader || inTopics) bullets.push(bulletMatch[1]);\n        }\n        const turnMatch = line.match(/\\((\\d+) turns?\\)/);\n        if (turnMatch) turnCount = parseInt(turnMatch[1], 10);\n      }\n\n      if (bullets.length > 0) {\n        summaries.push({\n          hour: `${dateStr}T${hourStr}:00:00.000Z`,\n          sessionKey,\n          bullets,\n          turnCount,\n          generatedAt: \"\", // Not stored in file, not needed for recall\n        });\n      }\n    }\n\n    return summaries;\n  }\n\n  // Format summaries for recall injection\n  formatForRecall(summaries: HourlySummary[], maxCount: number): string {\n    if (summaries.length === 0) return \"\";\n\n    const limited = summaries.slice(0, maxCount);\n    const lines: string[] = [`## Recent Activity (last ${limited.length} hours)`];\n\n    for (const summary of limited) {\n      const hourStr = summary.hour.slice(11, 16); // HH:MM\n      for (const bullet of summary.bullets) {\n        lines.push(`- ${hourStr}: ${bullet}`);\n      }\n    }\n\n    return lines.join(\"\\n\");\n  }\n\n  // Main entry point for cron job\n  async runHourly(): Promise<void> {\n    log.debug(\"running hourly summary generation\");\n\n    // Get active sessions from transcript\n    const sessions = await this.getActiveSessions();\n\n    for (const sessionKey of sessions) {\n      // Calculate the hour we want to summarize (previous hour)\n      const now = new Date();\n      const hourStart = new Date(now.getTime() - 60 * 60 * 1000);\n      hourStart.setMinutes(0, 0, 0);\n      const hourEnd = new Date(hourStart.getTime() + 60 * 60 * 1000);\n\n      // Get entries for this session in the target hour\n      const entries = await this.getTranscriptEntries(sessionKey, hourStart, hourEnd);\n\n      if (entries.length === 0) {\n        log.debug(`no transcript entries for ${sessionKey} at ${hourStart.toISOString()}`);\n        continue;\n      }\n\n      // Generate and save summary\n      const summary = await this.generateSummary(sessionKey, hourStart, entries);\n      if (summary) {\n        await this.saveSummary(summary);\n        log.info(`generated hourly summary for ${sessionKey} (${entries.length} turns)`);\n      }\n    }\n  }\n\n  // Get list of active sessions from transcript directory\n  private async getActiveSessions(): Promise<string[]> {\n    const transcriptDir = await resolveSafeStoragePath(\n      this.config.memoryDir,\n      \"transcripts\",\n    ).catch(() => null);\n    if (transcriptDir === null) return [];\n\n    try {\n      const sessionKeys = new Set<string>();\n      const typeEntries = await readdir(transcriptDir, { withFileTypes: true });\n      for (const typeEnt of typeEntries) {\n        if (!typeEnt.isDirectory()) continue;\n        const typeDir = await resolveSafeStoragePath(transcriptDir, typeEnt.name).catch(() => null);\n        if (typeDir === null) continue;\n        const idEntries = await readdir(typeDir, { withFileTypes: true });\n        for (const idEnt of idEntries) {\n          if (!idEnt.isDirectory()) continue;\n          const chanDir = await resolveSafeStoragePath(typeDir, idEnt.name).catch(() => null);\n          if (chanDir === null) continue;\n          const files = (await readdir(chanDir)).filter((f) => f.endsWith(\".jsonl\")).sort();\n          for (const file of files) {\n            const transcriptPath = await resolveSafeStoragePath(chanDir, file).catch(() => null);\n            if (transcriptPath === null) continue;\n            await this.collectTranscriptSessionKeys(transcriptPath, sessionKeys);\n          }\n        }\n      }\n      return Array.from(sessionKeys);\n    } catch {\n      return [];\n    }\n  }\n\n  private async collectTranscriptSessionKeys(\n    transcriptPath: string,\n    sessionKeys: Set<string>,\n  ): Promise<void> {\n    try {\n      const raw = await readFile(transcriptPath, \"utf-8\");\n      for (const line of raw.split(\"\\n\")) {\n        if (!line.trim()) continue;\n        try {\n          const entry = JSON.parse(line) as TranscriptEntry;\n          if (typeof entry.sessionKey === \"string\" && entry.sessionKey.length > 0) {\n            sessionKeys.add(entry.sessionKey);\n          }\n        } catch {\n          // ignore malformed transcript lines\n        }\n      }\n    } catch {\n      // ignore unreadable transcript files\n    }\n  }\n\n  // Get transcript entries for a session within a time range\n  private async getTranscriptEntries(\n    sessionKey: string,\n    startTime: Date,\n    endTime: Date\n  ): Promise<TranscriptEntry[]> {\n    const parts = sessionKey.split(\":\");\n    let channelType = \"other\";\n    let channelId = \"default\";\n\n    if (parts.length >= 3) {\n      channelType = parts[2];\n      if (channelType === \"main\") {\n        channelId = \"default\";\n      } else if (channelType === \"discord\" && parts.length >= 5 && parts[3] === \"channel\") {\n        channelId = parts[4];\n      } else if (channelType === \"slack\" && parts.length >= 5 && parts[3] === \"channel\") {\n        channelId = parts[4];\n      } else if (channelType === \"cron\" && parts.length >= 4) {\n        channelId = parts[3];\n      } else if (parts.length >= 4) {\n        channelId = parts[3];\n      }\n    }\n\n    try {\n      const transcriptRoot = path.join(this.config.memoryDir, \"transcripts\");\n      const encodedDir = path.join(\n        encodeStoragePathSegment(channelType),\n        encodeStoragePathSegment(channelId),\n      );\n      const alternateDir = path.join(\n        encodeStoragePathSegmentWithHash(channelType),\n        `${encodeStoragePathSegmentWithHash(channelId)}--session-${storagePathHash(sessionKey)}`,\n      );\n      const legacyDir =\n        isSafeLegacyPathSegment(channelType) && isSafeLegacyPathSegment(channelId)\n          ? path.join(channelType, channelId)\n          : undefined;\n      const candidateDirs = new Set(\n        [encodedDir, alternateDir, legacyDir].filter(\n          (dir): dir is string => typeof dir === \"string\" && dir.length > 0,\n        ),\n      );\n      const entries: TranscriptEntry[] = [];\n\n      // Read all daily transcript files in the directory\n      for (const candidateDir of candidateDirs) {\n        const transcriptDir = await resolveSafeStoragePath(transcriptRoot, candidateDir).catch(() => null);\n        if (transcriptDir === null) continue;\n\n        const files = await readdir(transcriptDir).catch(() => []);\n        for (const file of files) {\n          if (!file.endsWith(\".jsonl\")) continue;\n\n          const transcriptPath = await resolveSafeStoragePath(transcriptDir, file).catch(() => null);\n          if (transcriptPath === null) continue;\n\n          try {\n            const content = await readFile(transcriptPath, \"utf-8\");\n            const lines = content.trim().split(\"\\n\");\n\n            for (const line of lines) {\n              if (!line.trim()) continue;\n              try {\n                const entry = JSON.parse(line) as TranscriptEntry;\n                const entryTime = new Date(entry.timestamp).getTime();\n\n                if (\n                  entry.sessionKey === sessionKey &&\n                  entryTime >= startTime.getTime() &&\n                  entryTime < endTime.getTime()\n                ) {\n                  entries.push(entry);\n                }\n              } catch {\n                // Skip malformed lines\n              }\n            }\n          } catch {\n            // Skip unreadable files\n          }\n        }\n      }\n\n      return entries;\n    } catch {\n      return [];\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,WAAW,eAAe;AACpD,OAAO,UAAU;AACjB,SAAS,SAAS;AAkBlB,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,SAAS,EACN,MAAM,EAAE,OAAO,CAAC,EAChB,SAAS,mDAAmD;AACjE,CAAC;AAID,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAWM,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAsB,eAA+B,eAA+B,YAAgC;AAC9H,SAAK,SAAS;AACd,SAAK,eAAe,KAAK,KAAK,OAAO,WAAW,aAAa,QAAQ;AACrE,SAAK,gBAAgB,iBAAiB,IAAI,cAAc,OAAO,SAAS;AACxE,SAAK,aAAa;AAGlB,SAAK,WAAW,IAAI,eAAe,QAAQ,KAAK,aAAa;AAG7D,SAAK,cAAc,IAAI,kBAAkB,eAAe;AAAA,MACtD,cAAc,OAAO;AAAA,IACvB,CAAC;AAED,QAAI,CAAC,eAAe,QAAQ,UAAU,OAAO,WAAW,CAAC,OAAO,mBAAmB,OAAO,gBAAgB,WAAW;AACnH,UAAI,KAAK,mFAA8E;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,IAAY,wBAAiC;AAC3C,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,IAAY,oBAA6B;AACvC,WAAO,KAAK,OAAO,mBAAmB,CAAC,KAAK;AAAA,EAC9C;AAAA,EAEQ,iBAAiB,SAAyG;AAChI,QAAI,CAAC,KAAK,sBAAuB,QAAO;AACxC,UAAM,UAAU,KAAK,OAAO,kBAAkB;AAC9C,WAAO,UAAU,EAAE,GAAG,SAAS,QAAQ,IAAI;AAAA,EAC7C;AAAA,EAEA,MAAM,aAA4B;AAChC,UAAM,MAAM,KAAK,cAAc,EAAE,WAAW,KAAK,CAAC;AAClD,QAAI,KAAK,+BAA+B;AAAA,EAC1C;AAAA,EAEA,MAAc,kBAAkB,YAAqC;AACnE,WAAO;AAAA,MACL,KAAK;AAAA,MACL,yBAAyB,YAAY,SAAS;AAAA,IAChD;AAAA,EACF;AAAA,EAEA,MAAc,wBAAwB,YAA4C;AAChF,QAAI,WAAW,SAAS,IAAI,EAAG,QAAO;AACtC,QAAI;AACF,aAAO,MAAM,uBAAuB,KAAK,cAAc,UAAU;AAAA,IACnE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,kBAAkB,MAAsB;AAC9C,UAAM,UAAU,KAAK,MAAM,GAAG,EAAE;AAChC,QAAI,CAAC,sBAAsB,KAAK,OAAO,GAAG;AACxC,YAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAAA,IAC7D;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,gBACJ,YACA,WACA,SAC+B;AAC/B,QAAI,QAAQ,WAAW,EAAG,QAAO;AAGjC,UAAM,eAAe,QAClB,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE,EACrC,KAAK,MAAM;AAEd,QAAI,KAAK,OAAO,gCAAgC;AAC9C,YAAM,WAAW,MAAM,KAAK,iBAAiB,YAAY,WAAW,cAAc,OAAO;AACzF,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,OAAkC;AAAA,QACtC,WAAW,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;AAAA,QACpD,gBAAgB,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE;AAAA,QAC9D,WAAW,SAAS,MAAM;AAAA,QAC1B,YAAY,SAAS,MAAM;AAAA,MAC7B;AAEA,YAAM,OAAsB;AAAA,QAC1B,MAAM,UAAU,YAAY;AAAA,QAC5B;AAAA,QACA,SAAS,SAAS,OAAO,SAAS,IAAI,SAAS,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB;AAAA,QAC1F,WAAW,QAAQ;AAAA,QACnB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACtC;AACA,YAAM,aAAa;AACnB,iBAAW,YAAY;AACvB,iBAAW,gBAAgB;AAC3B,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,UAAU,YAAY;AACtC,UAAM,YAAY,KAAK,IAAI;AAG3B,QAAI,KAAK,mBAAmB;AAC1B,UAAI;AACF,cAAM,cAAc,MAAM,KAAK,qBAAqB,YAAY;AAChE,YAAI,aAAa;AACf,gBAAM,aAAa,KAAK,IAAI,IAAI;AAChC,cAAI;AAAA,YACF,gCAAgC,UAAU,OAAO,OAAO,OAAO,UAAU;AAAA,UAC3E;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN;AAAA,YACA,SAAS,YAAY;AAAA,YACrB,WAAW,QAAQ;AAAA,YACnB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,UACtC;AAAA,QACF;AAEA,YAAI,CAAC,KAAK,OAAO,kBAAkB;AACjC,cAAI,KAAK,4DAA4D;AACrE,iBAAO;AAAA,QACT;AACA,YAAI,KAAK,+EAA+E;AAAA,MAC1F,SAAS,KAAK;AACZ,YAAI,CAAC,KAAK,OAAO,kBAAkB;AACjC,cAAI,KAAK,8DAA8D,GAAG;AAC1E,iBAAO;AAAA,QACT;AACA,YAAI,KAAK,4EAA4E,GAAG;AAAA,MAC1F;AAAA,IACF;AAGA,QAAI,KAAK,wDAAwD;AAEjE,QAAI;AACF,YAAM,WAAW;AAAA,QACf;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAcX;AAAA,QACA,EAAE,MAAM,QAAiB,SAAS;AAAA;AAAA,EAAmC,YAAY,GAAG;AAAA,MACtF;AAEA,YAAM,SAAS,MAAM,KAAK,YAAY;AAAA,QACpC;AAAA,QACA;AAAA,QACA,KAAK,iBAAiB,EAAE,aAAa,KAAK,WAAW,KAAK,CAAC;AAAA,MAC7D;AAEA,YAAM,aAAa,KAAK,IAAI,IAAI;AAEhC,UAAI,QAAQ;AACV,YAAI;AAAA,UACF,gCAAgC,UAAU,OAAO,OAAO,OAAO,UAAU;AAAA,QAC3E;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN;AAAA,UACA,SAAS,OAAO;AAAA,UAChB,WAAW,QAAQ;AAAA,UACnB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACtC;AAAA,MACF;AAEA,UAAI,KAAK,uDAAuD;AAChE,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,MAAM,sCAAsC,GAAG;AACnD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,iBACZ,YACA,WACA,cACA,SACsF;AACtF,UAAM,UAAU,UAAU,YAAY;AACtC,UAAM,YAAY,KAAK,IAAI;AAE3B,UAAM,UAAU,IAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,KAAK,GAAI;AAC7D,QAAI,aAAqC,CAAC;AAC1C,QAAI,KAAK,OAAO,mCAAmC,KAAK,YAAY;AAClE,YAAM,OAAO,MAAM,KAAK,WAAW,YAAY,YAAY,WAAW,OAAO;AAC7E,iBAAW,KAAK,KAAM,YAAW,EAAE,IAAI,KAAK,WAAW,EAAE,IAAI,KAAK,KAAK;AAAA,IACzE;AAEA,UAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEZ,UAAM,gBAAgB,OAAO,KAAK,UAAU,EAAE,SAAS,IACnD,wBAAwB,OAAO,QAAQ,UAAU,EAAE,KAAK,CAAC,GAAE,MAAI,EAAE,CAAC,IAAE,EAAE,CAAC,CAAC,EAAE,MAAM,GAAE,EAAE,EAAE,IAAI,CAAC,CAAC,GAAE,CAAC,MAAI,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IAC1H;AACJ,UAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;AAC3D,UAAM,iBAAiB,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE;AACrE,UAAM,YAAY,OAAO,OAAO,UAAU,EAAE,OAAO,CAAC,GAAE,MAAI,IAAE,GAAE,CAAC;AAC/D,UAAM,YAAY,oBAAoB,SAAS,oBAAoB,cAAc,eAAe,SAAS;AAAA;AAAA;AAEzG,UAAM,OAAO,SAAS,OAAO;AAAA,WAAc,UAAU;AAAA;AAAA,EAAO,SAAS,GAAG,aAAa;AAAA,EAAkB,YAAY;AAAA;AAGnH,QAAI,KAAK,mBAAmB;AAC1B,UAAI;AACF,cAAM,eAAe,KAAK,cAAc,sBAAsB,KAAK,OAAO,eAAe,KAAK,OAAO,kBAAkB;AACvH,cAAM,YAAY,KAAK,SAAS,aAAa,gBAAgB,KAAK,MAAM,GAAG,aAAa,aAAa,IAAI,oBAAoB;AAC7H,cAAM,WAAW,MAAM,KAAK,SAAS;AAAA,UACnC;AAAA,YACE,EAAE,MAAM,UAAU,SAAS,0BAA0B;AAAA,YACrD,EAAE,MAAM,QAAQ,SAAS,MAAM,SAAS,UAAU;AAAA,UACpD;AAAA,UACA;AAAA,YACE,aAAa;AAAA,YACb,WAAW,aAAa;AAAA,YACxB,WAAW;AAAA,YACX,UAAU;AAAA,UACZ;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,gBAAM,UAAU,SAAS,QAAQ,KAAK;AACtC,qBAAW,aAAa,sBAAsB,OAAO,GAAG;AACtD,gBAAI;AACF,oBAAM,SAAS,KAAK,MAAM,SAAS;AACnC,oBAAM,SAAS,4BAA4B,MAAM,MAAM;AACvD,kBAAI;AAAA,gBACF,yCAAyC,UAAU,OAAO,OAAO,OAAO,KAAK,IAAI,IAAI,SAAS;AAAA,cAChG;AACA,qBAAO,EAAE,GAAG,QAAQ,OAAO,EAAE,WAAW,gBAAgB,WAAW,WAAW,EAAE;AAAA,YAClF,QAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,CAAC,KAAK,OAAO,iBAAkB,QAAO;AAC1C,YAAI,KAAK,iDAAiD,GAAG;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,YAAY;AAAA,QACpC;AAAA,UACE,EAAE,MAAM,UAAmB,SAAS,IAAI;AAAA,UACxC,EAAE,MAAM,QAAiB,SAAS,KAAK;AAAA,QACzC;AAAA,QACA;AAAA,QACA,KAAK,iBAAiB,EAAE,aAAa,KAAK,WAAW,KAAK,CAAC;AAAA,MAC7D;AACA,UAAI,QAAQ;AACV,YAAI,MAAM,yCAAyC,UAAU,OAAO,OAAO,OAAO,KAAK,IAAI,IAAI,SAAS,eAAe;AACvH,eAAO,EAAE,GAAG,QAAQ,OAAO,EAAE,WAAW,gBAAgB,WAAW,WAAW,EAAE;AAAA,MAClF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,MAAM,sCAAsC,GAAG;AACnD,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,qBAAqB,cAA2D;AAE5F,UAAM,eAAe,KAAK,cAAc;AAAA,MACtC,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AACA,QAAI,MAAM,6BAA6B,aAAa,WAAW,EAAE;AAEjE,UAAM,uBAAuB,aAAa;AAC1C,UAAM,wBAAwB,aAAa,SAAS,uBAChD,aAAa,MAAM,GAAG,oBAAoB,IAAI,oBAC9C;AAEJ,UAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAerB,UAAM,aAAa,GAAG,YAAY;AAAA;AAAA;AAAA,EAAmC,qBAAqB;AAE1F,UAAM,WAAW,MAAM,KAAK,SAAS;AAAA,MACnC;AAAA,QACE,EAAE,MAAM,UAAU,SAAS,uEAAuE;AAAA,QAClG,EAAE,MAAM,QAAQ,SAAS,WAAW;AAAA,MACtC;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,WAAW,aAAa;AAAA,QACxB,WAAW;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO;AAAA,IACT;AAEA,QAAI;AAEF,YAAM,UAAU,SAAS,QAAQ,KAAK;AACtC,iBAAW,aAAa,sBAAsB,OAAO,GAAG;AACtD,YAAI;AACF,gBAAM,SAAS,KAAK,MAAM,SAAS;AACnC,iBAAO;AAAA,YACL,SAAS,MAAM,QAAS,OAAe,OAAO,IAAK,OAAe,UAAU,CAAC;AAAA,UAC/E;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,KAAK,qDAAqD,GAAG;AACjE,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAY,SAAuC;AACvD,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,UAAU;AAClE,UAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAG3C,UAAM,UAAU,KAAK,kBAAkB,QAAQ,IAAI;AACnD,UAAM,WAAW,MAAM,uBAAuB,YAAY,GAAG,OAAO,KAAK;AAGzE,UAAM,UAAU,QAAQ,KAAK,MAAM,IAAI,EAAE;AAGzC,UAAM,QAAkB,CAAC;AAGzB,QAAI,kBAAkB;AACtB,QAAI;AACF,wBAAkB,MAAM,SAAS,UAAU,OAAO;AAAA,IACpD,QAAQ;AAAA,IAER;AAGA,UAAM,aAAa,MAAM,OAAO;AAChC,QAAI,gBAAgB,SAAS,UAAU,GAAG;AAExC,YAAM,aAAa,gBAAgB,MAAM,UAAU,EAAE,CAAC;AACtD,YAAM,aAAa,gBAAgB,MAAM,UAAU,EAAE,CAAC;AACtD,YAAM,YAAY,aAAa,WAAW,MAAM,OAAO,EAAE,CAAC,IAAI;AAE9D,YAAM,aAAa,KAAK,kBAAkB,SAAS,UAAU;AAE7D,UAAI,WAAW;AACb,0BAAkB,aAAa,aAAa,UAAU;AAAA,MACxD,OAAO;AACL,0BAAkB,aAAa;AAAA,MACjC;AAEA,YAAM,UAAU,UAAU,iBAAiB,OAAO;AAClD,UAAI,MAAM,8BAA8B,QAAQ,UAAU,OAAO,OAAO,KAAK;AAAA,IAC/E,OAAO;AAEL,YAAM,aAAa,KAAK,kBAAkB,SAAS,UAAU;AAE7D,UAAI,iBAAiB;AAEnB,cAAM,UAAU,UAAU,gBAAgB,QAAQ,IAAI,SAAS,YAAY,OAAO;AAAA,MACpF,OAAO;AAEL,cAAM,SAAS,6BAAwB,OAAO;AAAA;AAAA,YAAiB,QAAQ,UAAU;AAAA;AACjF,cAAM,UAAU,UAAU,SAAS,OAAO,YAAY,OAAO;AAAA,MAC/D;AACA,UAAI,MAAM,4BAA4B,QAAQ,UAAU,OAAO,OAAO,KAAK;AAAA,IAC7E;AACA,QAAI;AACF,YAAM,sBAAsB,KAAK,OAAO,WAAW,OAAO;AAAA,IAC5D,SAAS,OAAO;AACd,UAAI;AAAA,QACF,4DAA4D,QAAQ,UAAU,iBAAiB,OAAO,KAAK,CAAC;AAAA,MAC9G;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kBAAkB,SAAwB,YAA4B;AAC5E,UAAM,MAAO,QAAgB;AAC7B,UAAM,OAAQ,QAAgB;AAC9B,UAAM,QAAkB,CAAC,YAAY,EAAE;AAEvC,QAAI,KAAK,OAAO,kCAAkC,KAAK;AACrD,YAAM,KAAK,sBAAsB;AACjC,iBAAW,KAAK,IAAI,OAAQ,OAAM,KAAK,KAAK,CAAC,EAAE;AAC/C,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,oBAAoB;AAC/B,iBAAW,KAAK,IAAI,UAAW,OAAM,KAAK,KAAK,CAAC,EAAE;AAClD,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,kBAAkB;AAC7B,iBAAW,KAAK,IAAI,YAAa,OAAM,KAAK,KAAK,CAAC,EAAE;AACpD,YAAM,KAAK,EAAE;AACb,YAAM,KAAK,gCAAgC;AAC3C,iBAAW,KAAK,IAAI,SAAU,OAAM,KAAK,KAAK,CAAC,EAAE;AACjD,YAAM,KAAK,EAAE;AACb,UAAI,QAAQ,OAAO,KAAK,KAAK,UAAU,EAAE,SAAS,GAAG;AACnD,cAAM,KAAK,gBAAgB;AAC3B,cAAM,MAAM,OAAO,QAAQ,KAAK,UAAU,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAC1B,MAAM,GAAG,EAAE;AACd,mBAAW,CAAC,MAAM,KAAK,KAAK,IAAK,OAAM,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE;AACjE,cAAM,KAAK,EAAE;AAAA,MACf;AACA,YAAM,KAAK,WAAW;AACtB,YAAM,KAAK,YAAY,QAAQ,SAAS,EAAE;AAC1C,UAAI,MAAM;AACR,cAAM,KAAK,iBAAiB,KAAK,SAAS,EAAE;AAC5C,cAAM,KAAK,sBAAsB,KAAK,cAAc,EAAE;AACtD,cAAM,KAAK,iBAAiB,KAAK,SAAS,EAAE;AAAA,MAC9C;AACA,YAAM,KAAK,EAAE;AACb,aAAO,MAAM,KAAK,IAAI;AAAA,IACxB;AAEA,eAAW,UAAU,QAAQ,QAAS,OAAM,KAAK,KAAK,MAAM,EAAE;AAC9D,UAAM,KAAK,OAAO,QAAQ,SAAS,UAAU;AAC7C,UAAM,KAAK,EAAE;AACb,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA;AAAA,EAGA,MAAM,WAAW,YAAoB,OAAyC;AAC5E,QAAI;AACF,YAAM,aAAa,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK;AAElD,YAAM,WAAW,MAAM,oBAAoB,KAAK,OAAO,WAAW,UAAU;AAC5E,UAAI,UAAU;AACZ,eAAO,SACJ,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,KAAK,UAAU,EACtD,KAAK,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;AAAA,MAC3E;AAEA,YAAM,YAA6B,CAAC;AACpC,YAAM,aAAa,MAAM,KAAK,kBAAkB,UAAU;AAC1D,YAAM,YAAY,MAAM,KAAK,wBAAwB,UAAU;AAC/D,YAAM,WAAW,oBAAI,IAAY;AAEjC,iBAAW,cAAc,CAAC,YAAY,SAAS,GAAG;AAChD,YAAI,CAAC,cAAc,SAAS,IAAI,UAAU,EAAG;AAC7C,iBAAS,IAAI,UAAU;AACvB,cAAM,SAAS,MAAM,KAAK,eAAe,YAAY,UAAU;AAC/D,kBAAU,KAAK,GAAG,MAAM;AAAA,MAC1B;AAEA,YAAM,SAAS,oBAAI,IAA2B;AAC9C,iBAAW,WAAW,WAAW;AAC/B,YAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,EAAG,QAAO,IAAI,QAAQ,MAAM,OAAO;AAAA,MACjE;AAEA,YAAM,kBAAkB,MAAM,KAAK,OAAO,OAAO,CAAC,EAAE;AAAA,QAClD,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ;AAAA,MAClE;AAGA,YAAM,SAAS,gBAAgB;AAAA,QAC7B,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,KAAK;AAAA,MACvC;AAEA,UAAI,gBAAgB,SAAS,GAAG;AAC9B,YAAI;AACF,gBAAM;AAAA,YACJ,KAAK,OAAO;AAAA,YACZ;AAAA,YACA;AAAA,UACF;AAAA,QACF,SAAS,OAAO;AACd,cAAI;AAAA,YACF,iEAAiE,UAAU,iBAAiB,OAAO,KAAK,CAAC;AAAA,UAC3G;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT,QAAQ;AAEN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,YACA,YAC0B;AAC1B,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,UAAU;AAAA,IAClC,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAA6B,CAAC;AACpC,UAAM,UAAU,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC;AACrD,eAAW,QAAQ,SAAS;AAC1B,YAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI,EAAE,MAAM,MAAM,IAAI;AAChF,UAAI,aAAa,KAAM;AAEvB,UAAI;AACF,cAAM,UAAU,MAAM,SAAS,UAAU,OAAO;AAChD,kBAAU,KAAK,GAAG,KAAK,iBAAiB,SAAS,YAAY,IAAI,CAAC;AAAA,MACpE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,iBACN,SACA,YACA,UACiB;AACjB,UAAM,YAA6B,CAAC;AAGpC,UAAM,YAAY,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,UAAU,UAAU,CAAC;AAG3B,UAAM,eAAe,QAAQ,MAAM,mBAAmB;AAGtD,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,UAAU,aAAa,CAAC;AAC9B,YAAM,iBAAiB,aAAa,IAAI,CAAC,KAAK;AAG9C,YAAM,UAAoB,CAAC;AAC3B,YAAM,QAAQ,eAAe,MAAM,IAAI;AACvC,UAAI,YAAY;AAEhB,UAAI,WAAW;AACf,UAAI,0BAA0B;AAC9B,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,WAAW,YAAY,GAAG;AACjC,qBAAW;AACX,oCAA0B;AAC1B;AAAA,QACF;AACA,YAAI,KAAK,WAAW,MAAM,KAAK,CAAC,KAAK,WAAW,YAAY,GAAG;AAC7D,qBAAW;AAAA,QACb;AACA,cAAM,cAAc,KAAK,MAAM,UAAU;AACzC,YAAI,aAAa;AAEf,cAAI,CAAC,2BAA2B,SAAU,SAAQ,KAAK,YAAY,CAAC,CAAC;AAAA,QACvE;AACA,cAAM,YAAY,KAAK,MAAM,kBAAkB;AAC/C,YAAI,UAAW,aAAY,SAAS,UAAU,CAAC,GAAG,EAAE;AAAA,MACtD;AAEA,UAAI,QAAQ,SAAS,GAAG;AACtB,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,OAAO,IAAI,OAAO;AAAA,UAC3B;AAAA,UACA;AAAA,UACA;AAAA,UACA,aAAa;AAAA;AAAA,QACf,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,gBAAgB,WAA4B,UAA0B;AACpE,QAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,UAAM,UAAU,UAAU,MAAM,GAAG,QAAQ;AAC3C,UAAM,QAAkB,CAAC,4BAA4B,QAAQ,MAAM,SAAS;AAE5E,eAAW,WAAW,SAAS;AAC7B,YAAM,UAAU,QAAQ,KAAK,MAAM,IAAI,EAAE;AACzC,iBAAW,UAAU,QAAQ,SAAS;AACpC,cAAM,KAAK,KAAK,OAAO,KAAK,MAAM,EAAE;AAAA,MACtC;AAAA,IACF;AAEA,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA;AAAA,EAGA,MAAM,YAA2B;AAC/B,QAAI,MAAM,mCAAmC;AAG7C,UAAM,WAAW,MAAM,KAAK,kBAAkB;AAE9C,eAAW,cAAc,UAAU;AAEjC,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,KAAK,GAAI;AACzD,gBAAU,WAAW,GAAG,GAAG,CAAC;AAC5B,YAAM,UAAU,IAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,KAAK,GAAI;AAG7D,YAAM,UAAU,MAAM,KAAK,qBAAqB,YAAY,WAAW,OAAO;AAE9E,UAAI,QAAQ,WAAW,GAAG;AACxB,YAAI,MAAM,6BAA6B,UAAU,OAAO,UAAU,YAAY,CAAC,EAAE;AACjF;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,KAAK,gBAAgB,YAAY,WAAW,OAAO;AACzE,UAAI,SAAS;AACX,cAAM,KAAK,YAAY,OAAO;AAC9B,YAAI,KAAK,gCAAgC,UAAU,KAAK,QAAQ,MAAM,SAAS;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,oBAAuC;AACnD,UAAM,gBAAgB,MAAM;AAAA,MAC1B,KAAK,OAAO;AAAA,MACZ;AAAA,IACF,EAAE,MAAM,MAAM,IAAI;AAClB,QAAI,kBAAkB,KAAM,QAAO,CAAC;AAEpC,QAAI;AACF,YAAM,cAAc,oBAAI,IAAY;AACpC,YAAM,cAAc,MAAM,QAAQ,eAAe,EAAE,eAAe,KAAK,CAAC;AACxE,iBAAW,WAAW,aAAa;AACjC,YAAI,CAAC,QAAQ,YAAY,EAAG;AAC5B,cAAM,UAAU,MAAM,uBAAuB,eAAe,QAAQ,IAAI,EAAE,MAAM,MAAM,IAAI;AAC1F,YAAI,YAAY,KAAM;AACtB,cAAM,YAAY,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;AAChE,mBAAW,SAAS,WAAW;AAC7B,cAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,gBAAM,UAAU,MAAM,uBAAuB,SAAS,MAAM,IAAI,EAAE,MAAM,MAAM,IAAI;AAClF,cAAI,YAAY,KAAM;AACtB,gBAAM,SAAS,MAAM,QAAQ,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,CAAC,EAAE,KAAK;AAChF,qBAAW,QAAQ,OAAO;AACxB,kBAAM,iBAAiB,MAAM,uBAAuB,SAAS,IAAI,EAAE,MAAM,MAAM,IAAI;AACnF,gBAAI,mBAAmB,KAAM;AAC7B,kBAAM,KAAK,6BAA6B,gBAAgB,WAAW;AAAA,UACrE;AAAA,QACF;AAAA,MACF;AACA,aAAO,MAAM,KAAK,WAAW;AAAA,IAC/B,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAc,6BACZ,gBACA,aACe;AACf,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,gBAAgB,OAAO;AAClD,iBAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,YAAI,CAAC,KAAK,KAAK,EAAG;AAClB,YAAI;AACF,gBAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,cAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,SAAS,GAAG;AACvE,wBAAY,IAAI,MAAM,UAAU;AAAA,UAClC;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,qBACZ,YACA,WACA,SAC4B;AAC5B,UAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,QAAI,cAAc;AAClB,QAAI,YAAY;AAEhB,QAAI,MAAM,UAAU,GAAG;AACrB,oBAAc,MAAM,CAAC;AACrB,UAAI,gBAAgB,QAAQ;AAC1B,oBAAY;AAAA,MACd,WAAW,gBAAgB,aAAa,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,WAAW;AACnF,oBAAY,MAAM,CAAC;AAAA,MACrB,WAAW,gBAAgB,WAAW,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,WAAW;AACjF,oBAAY,MAAM,CAAC;AAAA,MACrB,WAAW,gBAAgB,UAAU,MAAM,UAAU,GAAG;AACtD,oBAAY,MAAM,CAAC;AAAA,MACrB,WAAW,MAAM,UAAU,GAAG;AAC5B,oBAAY,MAAM,CAAC;AAAA,MACrB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,iBAAiB,KAAK,KAAK,KAAK,OAAO,WAAW,aAAa;AACrE,YAAM,aAAa,KAAK;AAAA,QACtB,yBAAyB,WAAW;AAAA,QACpC,yBAAyB,SAAS;AAAA,MACpC;AACA,YAAM,eAAe,KAAK;AAAA,QACxB,iCAAiC,WAAW;AAAA,QAC5C,GAAG,iCAAiC,SAAS,CAAC,aAAa,gBAAgB,UAAU,CAAC;AAAA,MACxF;AACA,YAAM,YACJ,wBAAwB,WAAW,KAAK,wBAAwB,SAAS,IACrE,KAAK,KAAK,aAAa,SAAS,IAChC;AACN,YAAM,gBAAgB,IAAI;AAAA,QACxB,CAAC,YAAY,cAAc,SAAS,EAAE;AAAA,UACpC,CAAC,QAAuB,OAAO,QAAQ,YAAY,IAAI,SAAS;AAAA,QAClE;AAAA,MACF;AACA,YAAM,UAA6B,CAAC;AAGpC,iBAAW,gBAAgB,eAAe;AACxC,cAAM,gBAAgB,MAAM,uBAAuB,gBAAgB,YAAY,EAAE,MAAM,MAAM,IAAI;AACjG,YAAI,kBAAkB,KAAM;AAE5B,cAAM,QAAQ,MAAM,QAAQ,aAAa,EAAE,MAAM,MAAM,CAAC,CAAC;AACzD,mBAAW,QAAQ,OAAO;AACxB,cAAI,CAAC,KAAK,SAAS,QAAQ,EAAG;AAE9B,gBAAM,iBAAiB,MAAM,uBAAuB,eAAe,IAAI,EAAE,MAAM,MAAM,IAAI;AACzF,cAAI,mBAAmB,KAAM;AAE7B,cAAI;AACF,kBAAM,UAAU,MAAM,SAAS,gBAAgB,OAAO;AACtD,kBAAM,QAAQ,QAAQ,KAAK,EAAE,MAAM,IAAI;AAEvC,uBAAW,QAAQ,OAAO;AACxB,kBAAI,CAAC,KAAK,KAAK,EAAG;AAClB,kBAAI;AACF,sBAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,sBAAM,YAAY,IAAI,KAAK,MAAM,SAAS,EAAE,QAAQ;AAEpD,oBACE,MAAM,eAAe,cACrB,aAAa,UAAU,QAAQ,KAC/B,YAAY,QAAQ,QAAQ,GAC5B;AACA,0BAAQ,KAAK,KAAK;AAAA,gBACpB;AAAA,cACF,QAAQ;AAAA,cAER;AAAA,YACF;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;","names":[]}