@remnic/core 1.1.31 → 9.3.516

package/dist/chunk-LPMVBPA3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/connectors/live/state-store.ts","../src/connectors/live/framework.ts"],"sourcesContent":["/**\n * @remnic/core — Live Connectors State Store (issue #683 PR 1/N)\n *\n * Persists per-connector cursor + sync metadata to\n *   `<memoryDir>/state/connectors/<id>.json`\n *\n * Reasons this lives next to memory data, not in user config:\n *   - cursors are *operational* state that should travel with the memory\n *     directory when a user moves it across machines;\n *   - it keeps memory + ingest provenance co-located so tooling that backs up\n *     the memory directory captures cursor state too.\n *\n * Atomic-write contract (CLAUDE.md gotcha #54):\n *   - We NEVER `rmSync(target)` before `renameSync(tmp, target)`.\n *   - Writes go to a sibling tmp file and `rename()` swaps it in.\n *   - On error, the tmp file is best-effort cleaned up; the previous good\n *     state file is left untouched.\n *\n * Privacy: cursors are opaque connector-defined strings. We do not log them\n * and do not surface them through user-visible APIs. Document content NEVER\n * touches this module.\n */\n\nimport { promises as fs } from \"node:fs\";\nimport path from \"node:path\";\n\nimport { expandTildePath } from \"../../utils/path.js\";\n\nimport {\n  isValidConnectorId,\n  type ConnectorCursor,\n} from \"./framework.js\";\n\n/**\n * Status of the most recent sync attempt for a connector.\n *\n * `\"never\"` is distinct from `\"success\"` so callers can detect\n * \"registered but never run\" without inspecting timestamps. Per CLAUDE.md\n * gotcha #34, we deliberately distinguish empty/unknown from failure states.\n */\nexport type ConnectorSyncStatus = \"success\" | \"error\" | \"never\";\n\n/**\n * Persisted per-connector state.\n *\n * Stored as pretty-printed JSON for human inspection — the file is small\n * (one record per connector) and operators may need to debug stuck cursors\n * by hand.\n */\nexport interface ConnectorState {\n  /** Connector id. Matches the filename stem. */\n  readonly id: string;\n  /** Last persisted cursor, or `null` if the connector has never synced. */\n  readonly cursor: ConnectorCursor | null;\n  /** ISO 8601 timestamp of the last completed sync attempt, or `null`. */\n  readonly lastSyncAt: string | null;\n  /** Status of the last completed sync attempt. */\n  readonly lastSyncStatus: ConnectorSyncStatus;\n  /** Optional error message from the last failed sync. Truncated to 1 KB. */\n  readonly lastSyncError?: string;\n  /** Cumulative count of documents successfully imported across all syncs. */\n  readonly totalDocsImported: number;\n  /** ISO 8601 timestamp of when this state record was last written. */\n  readonly updatedAt: string;\n}\n\nconst STATE_DIR_NAME = \"state\";\nconst CONNECTORS_DIR_NAME = \"connectors\";\nconst MAX_ERROR_LENGTH = 1024;\nconst VALID_SYNC_STATUSES: ReadonlySet<ConnectorSyncStatus> = new Set([\n  \"success\",\n  \"error\",\n  \"never\",\n]);\n\n/**\n * Internal error thrown when a state file's JSON is unparseable or its shape\n * doesn't match `ConnectorState`. Used by `listConnectorStates` to distinguish\n * \"skip this corrupt file\" cases from genuine I/O failures (`EACCES`, `EIO`)\n * that the caller must see.\n */\nclass ConnectorStateCorruptionError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConnectorStateCorruptionError\";\n  }\n}\n\n/**\n * Resolve `<memoryDir>/state/connectors/`, expanding `~` per CLAUDE.md #17.\n */\nfunction resolveConnectorsDir(memoryDir: string): string {\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new TypeError(\"memoryDir must be a non-empty string\");\n  }\n  return path.join(expandTildePath(memoryDir), STATE_DIR_NAME, CONNECTORS_DIR_NAME);\n}\n\n/**\n * Resolve the state file path for a single connector. Throws on invalid id\n * to prevent path traversal via crafted ids.\n */\nfunction resolveConnectorStatePath(memoryDir: string, id: string): string {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`,\n    );\n  }\n  return path.join(resolveConnectorsDir(memoryDir), `${id}.json`);\n}\n\n/**\n * Type guard for parsed state records. Validates the on-disk shape so a\n * corrupted/edited file produces a clear error rather than crashing later.\n *\n * Per CLAUDE.md gotcha #18, JSON.parse('null') yields `null` which would\n * pass a naive truthy check. We explicitly require an object.\n */\nfunction isConnectorStateShape(value: unknown): value is ConnectorState {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  if (typeof v.id !== \"string\") return false;\n  if (typeof v.lastSyncStatus !== \"string\") return false;\n  if (![\"success\", \"error\", \"never\"].includes(v.lastSyncStatus)) return false;\n  // totalDocsImported is a cumulative count — fractional values would corrupt\n  // metrics on later increments. Mirror the boundary check in writeConnectorState.\n  if (typeof v.totalDocsImported !== \"number\" || !Number.isInteger(v.totalDocsImported)) return false;\n  if (v.totalDocsImported < 0) return false;\n  if (typeof v.updatedAt !== \"string\") return false;\n  if (v.lastSyncAt !== null && typeof v.lastSyncAt !== \"string\") return false;\n  if (v.cursor !== null) {\n    if (typeof v.cursor !== \"object\" || v.cursor === null) return false;\n    const c = v.cursor as Record<string, unknown>;\n    if (typeof c.kind !== \"string\" || typeof c.value !== \"string\" || typeof c.updatedAt !== \"string\") {\n      return false;\n    }\n  }\n  if (v.lastSyncError !== undefined && typeof v.lastSyncError !== \"string\") return false;\n  return true;\n}\n\n/**\n * Reject any path component along `<memoryDir>/state/connectors/<id>.json`\n * that is a symlink. Without this guard, a symlink in any of those\n * components would let `fs.readFile` escape the memory root and consume an\n * arbitrary outside file as cursor state — silently poisoning sync state and\n * violating the project-wide rule against symlink traversal.\n *\n * `lstat` is used (not `stat`) so we observe the link itself rather than its\n * target. Missing components are tolerated — the caller's `readFile` /\n * `mkdir` will surface ENOENT in its normal way.\n *\n * (PR #724 review.)\n */\nasync function assertNoSymlinkOnPath(memoryDir: string, filePath: string): Promise<void> {\n  const expandedRoot = expandTildePath(memoryDir);\n  // Normalize so `..` segments can't bypass the prefix check below.\n  const root = path.resolve(expandedRoot);\n  const target = path.resolve(filePath);\n  const rel = path.relative(root, target);\n  // path.relative() yields a \"../...\" prefix when target escapes root.\n  if (rel.startsWith(\"..\") || path.isAbsolute(rel)) {\n    throw new Error(\n      `connector state path ${target} escapes memory root ${root}`,\n    );\n  }\n  // Walk every component from root to target (inclusive) and lstat each.\n  const segments = rel.length === 0 ? [] : rel.split(path.sep);\n  let current = root;\n  const componentsToCheck = [current];\n  for (const seg of segments) {\n    current = path.join(current, seg);\n    componentsToCheck.push(current);\n  }\n  for (const component of componentsToCheck) {\n    let stat: import(\"node:fs\").Stats;\n    try {\n      stat = await fs.lstat(component);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        // Not yet created — that's fine; caller's readFile/mkdir handles it.\n        continue;\n      }\n      throw err;\n    }\n    if (stat.isSymbolicLink()) {\n      throw new Error(\n        `connector state path component ${component} is a symlink; refusing to follow`,\n      );\n    }\n  }\n}\n\n/**\n * Read the persisted state for a single connector.\n *\n * Returns `null` if the file does not exist (ENOENT). Throws on any other\n * I/O error or on shape mismatch — operators should see corruption loudly.\n *\n * Rejects symlinks anywhere on the path so a planted symlink can't redirect\n * reads outside the memory root. (PR #724 review.)\n */\nexport async function readConnectorState(\n  memoryDir: string,\n  id: string,\n): Promise<ConnectorState | null> {\n  const filePath = resolveConnectorStatePath(memoryDir, id);\n  await assertNoSymlinkOnPath(memoryDir, filePath);\n  let raw: string;\n  try {\n    raw = await fs.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} is not valid JSON: ${(err as Error).message}`,\n    );\n  }\n  if (!isConnectorStateShape(parsed)) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} does not match ConnectorState shape`,\n    );\n  }\n  if (parsed.id !== id) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} has mismatched id ${JSON.stringify(parsed.id)}; expected ${JSON.stringify(id)}`,\n    );\n  }\n  return parsed;\n}\n\n/**\n * Write state atomically: create-tmp + rename. Never destroys the previous\n * file before the new one is in place — see CLAUDE.md gotcha #54.\n *\n * We accept `Omit<ConnectorState, \"updatedAt\">` and stamp `updatedAt`\n * ourselves so callers can't accidentally persist a stale timestamp.\n */\nexport async function writeConnectorState(\n  memoryDir: string,\n  id: string,\n  state: Omit<ConnectorState, \"updatedAt\">,\n): Promise<ConnectorState> {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`,\n    );\n  }\n  if (state.id !== id) {\n    throw new Error(\n      `writeConnectorState(): state.id ${JSON.stringify(state.id)} does not match id argument ${JSON.stringify(id)}`,\n    );\n  }\n  // Full boundary validation. Persisting an out-of-shape record would brick\n  // the connector's cursor file: subsequent `readConnectorState` calls would\n  // throw `ConnectorStateCorruptionError` until manual repair. JS callers\n  // bypassing TS types must be rejected here, not later. (PR #724 review.)\n  if (!VALID_SYNC_STATUSES.has(state.lastSyncStatus as ConnectorSyncStatus)) {\n    throw new Error(\n      `writeConnectorState(): lastSyncStatus must be one of ${[...VALID_SYNC_STATUSES].join(\", \")}, got ${JSON.stringify(state.lastSyncStatus)}`,\n    );\n  }\n  if (state.lastSyncAt !== null && typeof state.lastSyncAt !== \"string\") {\n    throw new Error(\n      `writeConnectorState(): lastSyncAt must be a string or null, got ${typeof state.lastSyncAt}`,\n    );\n  }\n  if (state.cursor !== null) {\n    if (typeof state.cursor !== \"object\") {\n      throw new Error(`writeConnectorState(): cursor must be an object or null`);\n    }\n    if (\n      typeof state.cursor.kind !== \"string\" ||\n      typeof state.cursor.value !== \"string\" ||\n      typeof state.cursor.updatedAt !== \"string\"\n    ) {\n      throw new Error(\n        `writeConnectorState(): cursor must have string kind, value, and updatedAt`,\n      );\n    }\n  }\n  if (\n    typeof state.totalDocsImported !== \"number\" ||\n    !Number.isInteger(state.totalDocsImported) ||\n    state.totalDocsImported < 0\n  ) {\n    throw new Error(\n      `writeConnectorState(): totalDocsImported must be a non-negative integer`,\n    );\n  }\n  if (state.lastSyncError !== undefined && typeof state.lastSyncError !== \"string\") {\n    throw new Error(`writeConnectorState(): lastSyncError must be a string when provided`);\n  }\n  const truncatedError =\n    state.lastSyncError !== undefined && state.lastSyncError.length > MAX_ERROR_LENGTH\n      ? state.lastSyncError.slice(0, MAX_ERROR_LENGTH)\n      : state.lastSyncError;\n\n  const finalState: ConnectorState = {\n    id: state.id,\n    cursor: state.cursor,\n    lastSyncAt: state.lastSyncAt,\n    lastSyncStatus: state.lastSyncStatus,\n    ...(truncatedError !== undefined ? { lastSyncError: truncatedError } : {}),\n    totalDocsImported: state.totalDocsImported,\n    updatedAt: new Date().toISOString(),\n  };\n\n  const dir = resolveConnectorsDir(memoryDir);\n  const targetPath = path.join(dir, `${id}.json`);\n  // Reject planted symlinks before mkdir/write so a redirected target can't\n  // overwrite an arbitrary file outside the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const tmpPath = `${targetPath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n\n  const body = `${JSON.stringify(finalState, null, 2)}\\n`;\n  try {\n    await fs.writeFile(tmpPath, body, { encoding: \"utf-8\", mode: 0o600 });\n    await fs.rename(tmpPath, targetPath);\n  } catch (err) {\n    // Best-effort cleanup of the tmp file. Never touch `targetPath` — the\n    // previous good state must remain readable on failure.\n    try {\n      await fs.unlink(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n  return finalState;\n}\n\n/**\n * Enumerate every persisted connector state. Returns an empty array when\n * the directory does not exist yet (clean install, no syncs ever run).\n *\n * Files that do not match the `<id>.json` naming rule are skipped — this\n * keeps stray editor backups (`.json~`, `.swp`) from breaking enumeration.\n *\n * Corruption (unparseable JSON, shape mismatch, id mismatch) is also\n * skipped so one bad file doesn't take down the listing. Operators\n * inspecting `state/connectors/` can still see the offending file by hand.\n *\n * **Genuine I/O failures (`EACCES`, `EIO`, etc.) are NOT swallowed** —\n * silently returning an incomplete state set would make active connectors\n * appear missing and trigger duplicate ingestion on the next scheduler tick.\n * (PR #724 review.)\n */\nexport async function listConnectorStates(memoryDir: string): Promise<ConnectorState[]> {\n  const dir = resolveConnectorsDir(memoryDir);\n  // Refuse to enumerate through a symlinked state directory — a planted\n  // symlink at <memoryDir>/state or <memoryDir>/state/connectors would\n  // otherwise let reads escape the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, dir);\n  let entries: string[];\n  try {\n    entries = await fs.readdir(dir);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw err;\n  }\n  const out: ConnectorState[] = [];\n  for (const entry of entries) {\n    if (!entry.endsWith(\".json\")) continue;\n    const id = entry.slice(0, -\".json\".length);\n    if (!isValidConnectorId(id)) continue;\n    try {\n      const state = await readConnectorState(memoryDir, id);\n      if (state !== null) out.push(state);\n    } catch (err) {\n      if (err instanceof ConnectorStateCorruptionError) {\n        // Skip corrupt files; preserve availability of the rest.\n        continue;\n      }\n      // Anything else (EACCES, EIO, ENOTDIR, ...) is a real operational\n      // failure. Fail loudly so the scheduler / CLI can surface it.\n      throw err;\n    }\n  }\n  out.sort((a, b) => a.id.localeCompare(b.id));\n  return out;\n}\n\n/**\n * Test-only helper: resolve where a given connector's state lives. Exported\n * so tests can assert the on-disk layout without duplicating the path math.\n * Not part of the stable public API.\n *\n * @internal\n */\nexport function _connectorStatePathForTest(memoryDir: string, id: string): string {\n  return resolveConnectorStatePath(memoryDir, id);\n}\n","/**\n * @remnic/core — Live Connectors Framework (issue #683 PR 1/N)\n *\n * Defines the contract that every \"live\" connector (Drive, Notion, Gmail,\n * GitHub, ...) must satisfy. A live connector is **continuous**: it runs on a\n * schedule, persists a cursor to disk, and ingests *new* documents since the\n * last sync. This is distinct from one-shot importers in\n * `packages/remnic-core/src/importers/` which transform an entire export file\n * in a single pass.\n *\n * This module is intentionally pure types + interfaces. No I/O. No schedule\n * wiring. Concrete connectors (PRs 2–5), the maintenance scheduler hookup\n * (separate PR), and the CLI surface (PR 6) are deferred.\n *\n * Naming caveat: `packages/remnic-core/src/connectors/` is already scoped to\n * the Codex marketplace integration. The live-connector framework lives under\n * the `live/` subdirectory to avoid collision. Do not import Codex symbols\n * from here, and do not import live-connector symbols from the Codex code.\n */\n\n/**\n * Free-form connector configuration. Validated by each connector's\n * `validateConfig` implementation. Stored alongside the cursor in the state\n * store. MUST be JSON-serializable: no functions, no class instances, no\n * circular references.\n *\n * Connectors MUST NOT persist secrets here — credentials belong in OS keychain\n * / OAuth token storage (PR 2 design).\n */\nexport type ConnectorConfig = Record<string, unknown>;\n\n/**\n * Opaque cursor describing \"where the last sync left off\". Each connector\n * defines what `kind` and `value` mean (e.g. Drive: `{kind: \"pageToken\",\n * value: \"...\"}`, Gmail: `{kind: \"historyId\", value: \"...\"}`). The orchestrator\n * treats it as opaque and only round-trips it through the state store.\n *\n * `updatedAt` is an ISO 8601 timestamp set by the framework when the cursor is\n * written. It is informational — connectors MUST NOT use it to decide\n * monotonicity. They own the `value` semantics.\n */\nexport interface ConnectorCursor {\n  /** Connector-defined cursor kind (e.g. `\"pageToken\"`, `\"historyId\"`, `\"sinceTs\"`). */\n  readonly kind: string;\n  /** Connector-defined opaque cursor value. */\n  readonly value: string;\n  /** ISO 8601 timestamp of when this cursor was last written. */\n  readonly updatedAt: string;\n}\n\n/**\n * Provenance for a connector-ingested document. Required so downstream recall\n * can attribute facts back to their origin and avoid re-ingesting on the next\n * incremental pass.\n */\nexport interface ConnectorDocumentSource {\n  /** Stable connector id (matches `LiveConnector.id`). */\n  readonly connector: string;\n  /** Source-system identifier (Drive file id, Notion page id, Gmail msg id, ...). */\n  readonly externalId: string;\n  /** Optional source-system revision/version (etag, page version, history id). */\n  readonly externalRevision?: string;\n  /** Optional canonical URL pointing back at the source document. */\n  readonly externalUrl?: string;\n  /** ISO 8601 timestamp of when the connector fetched this document. */\n  readonly fetchedAt: string;\n}\n\n/**\n * A single document yielded by an incremental sync. Connectors are responsible\n * for chunking large source documents themselves if needed; the orchestrator\n * ingests `content` as a unit.\n */\nexport interface ConnectorDocument {\n  /** Connector-local stable id for this document. SHOULD match `source.externalId`. */\n  readonly id: string;\n  /** Optional human-readable title. */\n  readonly title?: string;\n  /** Body content. Plaintext or Markdown — connectors document their format. */\n  readonly content: string;\n  /** Provenance. Required. */\n  readonly source: ConnectorDocumentSource;\n}\n\n/**\n * Arguments passed to `syncIncremental`. The framework owns cursor/config\n * lifecycle; connectors only read these and return the next cursor.\n */\nexport interface SyncIncrementalArgs {\n  /** Last persisted cursor, or `null` on the first ever sync. */\n  readonly cursor: ConnectorCursor | null;\n  /** Validated connector config (already passed through `validateConfig`). */\n  readonly config: ConnectorConfig;\n  /** Optional abort signal. Connectors SHOULD honor it for cooperative cancellation. */\n  readonly abortSignal?: AbortSignal;\n}\n\n/**\n * Result of a single incremental sync pass.\n *\n * `newDocs` MAY be empty (no new documents since the last cursor). `nextCursor`\n * MUST always be returned — even on no-op syncs the framework persists it so\n * `updatedAt` reflects the most recent attempt.\n */\nexport interface SyncIncrementalResult {\n  readonly newDocs: ConnectorDocument[];\n  readonly nextCursor: ConnectorCursor;\n}\n\n/**\n * The contract every live connector implements.\n *\n * Connectors MUST be:\n *   - **Idempotent**: re-running with the same cursor MUST NOT duplicate\n *     documents. The `source.externalId` + `source.externalRevision` pair is\n *     used downstream for dedup.\n *   - **Read-only on the source**: live connectors never mutate the upstream\n *     system (no marking emails read, no editing Notion pages).\n *   - **Cancellable**: long-running syncs SHOULD periodically check\n *     `abortSignal.aborted` and bail cleanly.\n *   - **Privacy-aware**: connectors MUST NOT log document content. Logging\n *     metadata (counts, ids, timings) is fine.\n */\nexport interface LiveConnector {\n  /**\n   * Stable connector id. MUST match `CONNECTOR_ID_PATTERN` — lowercase\n   * alphanumeric plus dash, 1–64 chars, must start AND end with alphanumeric\n   * (no leading or trailing dash). The registry enforces this.\n   */\n  readonly id: string;\n  /** Short human-readable name shown in CLI / status output. */\n  readonly displayName: string;\n  /** Optional longer description. */\n  readonly description?: string;\n\n  /**\n   * Validate raw user-supplied config. MUST throw on malformed input — never\n   * silently default. The returned object is what gets persisted and passed\n   * back to `syncIncremental`. Connectors SHOULD strip unknown fields.\n   */\n  validateConfig(raw: unknown): ConnectorConfig;\n\n  /**\n   * Run one incremental sync pass. See `SyncIncrementalArgs` /\n   * `SyncIncrementalResult` for the contract.\n   */\n  syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult>;\n}\n\n/**\n * Regex enforcing the connector-id naming rule. Exported so connectors and\n * tests can validate ids consistently with the registry.\n *\n * Rule: lowercase alphanumeric + dash, 1..64 chars, must start AND end with\n * alphanumeric (no leading or trailing dash). Single-char ids are allowed.\n */\nexport const CONNECTOR_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;\n\n/**\n * Returns `true` if `id` is a syntactically valid connector id.\n */\nexport function isValidConnectorId(id: unknown): id is string {\n  return typeof id === \"string\" && CONNECTOR_ID_PATTERN.test(id);\n}\n"],"mappings":";;;;;AAuBA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;;;ACoIV,IAAM,uBAAuB;AAK7B,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,OAAO,OAAO,YAAY,qBAAqB,KAAK,EAAE;AAC/D;;;ADjGA,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,sBAAwD,oBAAI,IAAI;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQD,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAKA,SAAS,qBAAqB,WAA2B;AACvD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO,KAAK,KAAK,gBAAgB,SAAS,GAAG,gBAAgB,mBAAmB;AAClF;AAMA,SAAS,0BAA0B,WAAmB,IAAoB;AACxE,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK,KAAK,qBAAqB,SAAS,GAAG,GAAG,EAAE,OAAO;AAChE;AASA,SAAS,sBAAsB,OAAyC;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,OAAO,SAAU,QAAO;AACrC,MAAI,OAAO,EAAE,mBAAmB,SAAU,QAAO;AACjD,MAAI,CAAC,CAAC,WAAW,SAAS,OAAO,EAAE,SAAS,EAAE,cAAc,EAAG,QAAO;AAGtE,MAAI,OAAO,EAAE,sBAAsB,YAAY,CAAC,OAAO,UAAU,EAAE,iBAAiB,EAAG,QAAO;AAC9F,MAAI,EAAE,oBAAoB,EAAG,QAAO;AACpC,MAAI,OAAO,EAAE,cAAc,SAAU,QAAO;AAC5C,MAAI,EAAE,eAAe,QAAQ,OAAO,EAAE,eAAe,SAAU,QAAO;AACtE,MAAI,EAAE,WAAW,MAAM;AACrB,QAAI,OAAO,EAAE,WAAW,YAAY,EAAE,WAAW,KAAM,QAAO;AAC9D,UAAM,IAAI,EAAE;AACZ,QAAI,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,cAAc,UAAU;AAChG,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,EAAE,kBAAkB,UAAa,OAAO,EAAE,kBAAkB,SAAU,QAAO;AACjF,SAAO;AACT;AAeA,eAAe,sBAAsB,WAAmB,UAAiC;AACvF,QAAM,eAAe,gBAAgB,SAAS;AAE9C,QAAM,OAAO,KAAK,QAAQ,YAAY;AACtC,QAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,QAAM,MAAM,KAAK,SAAS,MAAM,MAAM;AAEtC,MAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG;AAChD,UAAM,IAAI;AAAA,MACR,wBAAwB,MAAM,wBAAwB,IAAI;AAAA,IAC5D;AAAA,EACF;AAEA,QAAM,WAAW,IAAI,WAAW,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,MAAI,UAAU;AACd,QAAM,oBAAoB,CAAC,OAAO;AAClC,aAAW,OAAO,UAAU;AAC1B,cAAU,KAAK,KAAK,SAAS,GAAG;AAChC,sBAAkB,KAAK,OAAO;AAAA,EAChC;AACA,aAAW,aAAa,mBAAmB;AACzC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,MAAM,SAAS;AAAA,IACjC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AAEpD;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI;AAAA,QACR,kCAAkC,SAAS;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;AAWA,eAAsB,mBACpB,WACA,IACgC;AAChC,QAAM,WAAW,0BAA0B,WAAW,EAAE;AACxD,QAAM,sBAAsB,WAAW,QAAQ;AAC/C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,UAAU,OAAO;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,uBAAwB,IAAc,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,MAAM,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ;AAAA,IAChC;AAAA,EACF;AACA,MAAI,OAAO,OAAO,IAAI;AACpB,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,sBAAsB,KAAK,UAAU,OAAO,EAAE,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;AAAA,IAC/G;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,oBACpB,WACA,IACA,OACyB;AACzB,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,MAAM,OAAO,IAAI;AACnB,UAAM,IAAI;AAAA,MACR,mCAAmC,KAAK,UAAU,MAAM,EAAE,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;AAAA,IAC9G;AAAA,EACF;AAKA,MAAI,CAAC,oBAAoB,IAAI,MAAM,cAAqC,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,wDAAwD,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC,SAAS,KAAK,UAAU,MAAM,cAAc,CAAC;AAAA,IAC1I;AAAA,EACF;AACA,MAAI,MAAM,eAAe,QAAQ,OAAO,MAAM,eAAe,UAAU;AACrE,UAAM,IAAI;AAAA,MACR,mEAAmE,OAAO,MAAM,UAAU;AAAA,IAC5F;AAAA,EACF;AACA,MAAI,MAAM,WAAW,MAAM;AACzB,QAAI,OAAO,MAAM,WAAW,UAAU;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QACE,OAAO,MAAM,OAAO,SAAS,YAC7B,OAAO,MAAM,OAAO,UAAU,YAC9B,OAAO,MAAM,OAAO,cAAc,UAClC;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,MAAM,sBAAsB,YACnC,CAAC,OAAO,UAAU,MAAM,iBAAiB,KACzC,MAAM,oBAAoB,GAC1B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,iBACJ,MAAM,kBAAkB,UAAa,MAAM,cAAc,SAAS,mBAC9D,MAAM,cAAc,MAAM,GAAG,gBAAgB,IAC7C,MAAM;AAEZ,QAAM,aAA6B;AAAA,IACjC,IAAI,MAAM;AAAA,IACV,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,gBAAgB,MAAM;AAAA,IACtB,GAAI,mBAAmB,SAAY,EAAE,eAAe,eAAe,IAAI,CAAC;AAAA,IACxE,mBAAmB,MAAM;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAM,aAAa,KAAK,KAAK,KAAK,GAAG,EAAE,OAAO;AAG9C,QAAM,sBAAsB,WAAW,UAAU;AACjD,QAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,GAAG,UAAU,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAExG,QAAM,OAAO,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AACnD,MAAI;AACF,UAAM,GAAG,UAAU,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AACpE,UAAM,GAAG,OAAO,SAAS,UAAU;AAAA,EACrC,SAAS,KAAK;AAGZ,QAAI;AACF,YAAM,GAAG,OAAO,OAAO;AAAA,IACzB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAkBA,eAAsB,oBAAoB,WAA8C;AACtF,QAAM,MAAM,qBAAqB,SAAS;AAI1C,QAAM,sBAAsB,WAAW,GAAG;AAC1C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,GAAG,QAAQ,GAAG;AAAA,EAChC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM;AAAA,EACR;AACA,QAAM,MAAwB,CAAC;AAC/B,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,SAAS,OAAO,EAAG;AAC9B,UAAM,KAAK,MAAM,MAAM,GAAG,CAAC,QAAQ,MAAM;AACzC,QAAI,CAAC,mBAAmB,EAAE,EAAG;AAC7B,QAAI;AACF,YAAM,QAAQ,MAAM,mBAAmB,WAAW,EAAE;AACpD,UAAI,UAAU,KAAM,KAAI,KAAK,KAAK;AAAA,IACpC,SAAS,KAAK;AACZ,UAAI,eAAe,+BAA+B;AAEhD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC3C,SAAO;AACT;AASO,SAAS,2BAA2B,WAAmB,IAAoB;AAChF,SAAO,0BAA0B,WAAW,EAAE;AAChD;","names":[]}

package/dist/chunk-LT3NLYSI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/maintenance/observation-ledger-utils.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\n\ninterface LedgerWriteOptions<T extends object> {\n  memoryDir: string;\n  outputPath: string;\n  rows: T[];\n  now: Date;\n}\n\nexport function toHourBucketIso(timestamp: string): string | null {\n  const normalized = /(?:Z|[+-]\\d{2}:\\d{2})$/u.test(timestamp) ? timestamp : `${timestamp}Z`;\n  const ms = Date.parse(normalized);\n  if (!Number.isFinite(ms)) return null;\n  const d = new Date(ms);\n  d.setUTCMinutes(0, 0, 0);\n  return d.toISOString();\n}\n\nexport async function backupAndWriteRebuiltObservations<T extends object>(\n  options: LedgerWriteOptions<T>,\n): Promise<string | undefined> {\n  const stamp = options.now.toISOString().replace(/[-:]/g, \"\").replace(/\\.\\d{3}Z$/, \"Z\");\n  const archiveRoot = path.join(options.memoryDir, \"archive\", \"observations\", stamp);\n  let backupPath: string | undefined = path.join(\n    archiveRoot,\n    \"state\",\n    \"observation-ledger\",\n    \"rebuilt-observations.jsonl\",\n  );\n  try {\n    const existing = await readFile(options.outputPath, \"utf-8\");\n    await mkdir(path.dirname(backupPath), { recursive: true });\n    await writeFile(backupPath, existing, \"utf-8\");\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (code && code === \"ENOENT\") {\n      backupPath = undefined;\n    } else {\n      throw err;\n    }\n  }\n\n  const rebuiltAt = options.now.toISOString();\n  const lines = options.rows.map((row) =>\n    JSON.stringify({\n      ...row,\n      rebuiltAt,\n    }),\n  );\n  await mkdir(path.dirname(options.outputPath), { recursive: true });\n  await writeFile(options.outputPath, lines.length > 0 ? `${lines.join(\"\\n\")}\\n` : \"\", \"utf-8\");\n  return backupPath;\n}\n"],"mappings":";AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,UAAU,iBAAiB;AASpC,SAAS,gBAAgB,WAAkC;AAChE,QAAM,aAAa,0BAA0B,KAAK,SAAS,IAAI,YAAY,GAAG,SAAS;AACvF,QAAM,KAAK,KAAK,MAAM,UAAU;AAChC,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,QAAM,IAAI,IAAI,KAAK,EAAE;AACrB,IAAE,cAAc,GAAG,GAAG,CAAC;AACvB,SAAO,EAAE,YAAY;AACvB;AAEA,eAAsB,kCACpB,SAC6B;AAC7B,QAAM,QAAQ,QAAQ,IAAI,YAAY,EAAE,QAAQ,SAAS,EAAE,EAAE,QAAQ,aAAa,GAAG;AACrF,QAAM,cAAc,KAAK,KAAK,QAAQ,WAAW,WAAW,gBAAgB,KAAK;AACjF,MAAI,aAAiC,KAAK;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACF,UAAM,WAAW,MAAM,SAAS,QAAQ,YAAY,OAAO;AAC3D,UAAM,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,UAAM,UAAU,YAAY,UAAU,OAAO;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAC5C,QAAI,QAAQ,SAAS,UAAU;AAC7B,mBAAa;AAAA,IACf,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,IAAI,YAAY;AAC1C,QAAM,QAAQ,QAAQ,KAAK;AAAA,IAAI,CAAC,QAC9B,KAAK,UAAU;AAAA,MACb,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,MAAM,KAAK,QAAQ,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACjE,QAAM,UAAU,QAAQ,YAAY,MAAM,SAAS,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,IAAO,IAAI,OAAO;AAC5F,SAAO;AACT;","names":[]}

package/dist/chunk-LUDTDZLK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routing/store.ts"],"sourcesContent":["import { lstat, mkdir, readFile, realpath, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport { log } from \"../logger.js\";\nimport { validateRouteTarget, type RouteRule, type RoutingEngineOptions } from \"./engine.js\";\n\ntype RoutingRulesState = {\n  version: 1;\n  updatedAt: string;\n  rules: RouteRule[];\n};\n\nfunction defaultState(): RoutingRulesState {\n  return {\n    version: 1,\n    updatedAt: new Date(0).toISOString(),\n    rules: [],\n  };\n}\n\nfunction stableRuleId(rule: Pick<RouteRule, \"patternType\" | \"pattern\" | \"priority\" | \"target\">): string {\n  const seed = JSON.stringify({\n    patternType: rule.patternType,\n    pattern: rule.pattern.trim(),\n    priority: rule.priority,\n    target: rule.target,\n  });\n  return `route-${createHash(\"sha256\").update(seed).digest(\"hex\").slice(0, 12)}`;\n}\n\nfunction resolveStatePath(memoryDir: string, stateFile: string): string {\n  const root = path.resolve(memoryDir);\n  const defaultPath = path.join(root, \"state\", \"routing-rules.json\");\n  if (path.isAbsolute(stateFile)) {\n    const absolute = path.resolve(stateFile);\n    return absolute.startsWith(root + path.sep) ? absolute : defaultPath;\n  }\n  const resolved = path.resolve(root, stateFile);\n  return resolved.startsWith(root + path.sep) ? resolved : defaultPath;\n}\n\nfunction normalizeRule(rule: RouteRule, options?: RoutingEngineOptions): RouteRule | null {\n  if (!rule || typeof rule !== \"object\") return null;\n  if (rule.enabled === false) return null;\n  if (rule.patternType !== \"keyword\" && rule.patternType !== \"regex\") return null;\n  if (typeof rule.pattern !== \"string\" || rule.pattern.trim().length === 0) return null;\n  if (typeof rule.priority !== \"number\" || !Number.isFinite(rule.priority)) return null;\n\n  const targetValidation = validateRouteTarget(rule.target, options);\n  if (!targetValidation.ok || !targetValidation.target) return null;\n\n  const normalizedPriority = Math.trunc(rule.priority);\n  const normalizedTarget = targetValidation.target;\n  const id = typeof rule.id === \"string\" && rule.id.trim().length > 0\n    ? rule.id.trim()\n    : stableRuleId({\n      patternType: rule.patternType,\n      pattern: rule.pattern.trim(),\n      priority: normalizedPriority,\n      target: normalizedTarget,\n    });\n  return {\n    id,\n    patternType: rule.patternType,\n    pattern: rule.pattern.trim(),\n    priority: normalizedPriority,\n    target: normalizedTarget,\n    enabled: true,\n  };\n}\n\nfunction isEnoent(err: unknown): boolean {\n  return err instanceof Error && \"code\" in err && (err as NodeJS.ErrnoException).code === \"ENOENT\";\n}\n\nexport class RoutingRulesStore {\n  private readonly memoryRoot: string;\n  private readonly statePath: string;\n  private readonly lockPath: string;\n  private writeQueue: Promise<void> = Promise.resolve();\n\n  constructor(memoryDir: string, stateFile = \"state/routing-rules.json\") {\n    this.memoryRoot = path.resolve(memoryDir);\n    this.statePath = resolveStatePath(memoryDir, stateFile);\n    this.lockPath = `${this.statePath}.lock`;\n  }\n\n  async read(options?: RoutingEngineOptions): Promise<RouteRule[]> {\n    try {\n      const persisted = await this.readPersistedRules();\n      return persisted\n        .map((rule) => normalizeRule(rule, options))\n        .filter((rule): rule is RouteRule => rule !== null);\n    } catch {\n      return [];\n    }\n  }\n\n  async write(rules: RouteRule[], options?: RoutingEngineOptions): Promise<RouteRule[]> {\n    return this.withWriteLock(async () => {\n      await this.readPersistedRules();\n      return this.writeNormalized(rules, options);\n    });\n  }\n\n  async upsert(rule: RouteRule, options?: RoutingEngineOptions): Promise<RouteRule[]> {\n    return this.withWriteLock(async () => {\n      const existing = await this.readPersistedRules();\n      const normalized = normalizeRule(rule, options);\n      if (!normalized) return existing;\n\n      const next = existing.filter((entry) => entry.id !== normalized.id);\n      next.push(normalized);\n      return this.writeNormalized(next);\n    });\n  }\n\n  async removeByPattern(pattern: string): Promise<RouteRule[]> {\n    return this.withWriteLock(async () => {\n      const trimmed = pattern.trim();\n      const existing = await this.readPersistedRules();\n      const next = existing.filter((entry) => entry.pattern !== trimmed);\n      if (next.length === existing.length) return existing;\n      return this.writeNormalized(next);\n    });\n  }\n\n  async reset(): Promise<void> {\n    await this.withWriteLock(async () => {\n      await this.writeState(defaultState());\n    });\n  }\n\n  private dedupeById(rules: RouteRule[]): RouteRule[] {\n    const byId = new Map<string, RouteRule>();\n    for (const rule of rules) {\n      byId.set(rule.id, rule);\n    }\n    return Array.from(byId.values());\n  }\n\n  private async readPersistedRules(): Promise<RouteRule[]> {\n    await this.assertStatePathScoped();\n    let raw: string;\n    try {\n      raw = await readFile(this.statePath, \"utf-8\");\n    } catch (err) {\n      if (isEnoent(err)) {\n        return [];\n      }\n      throw err;\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch (err) {\n      throw new Error(\n        `failed to parse routing rules state at ${this.statePath}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n      throw new Error(`invalid routing rules state at ${this.statePath}: expected object`);\n    }\n    const state = parsed as Partial<RoutingRulesState>;\n    if (!Array.isArray(state.rules)) {\n      throw new Error(`invalid routing rules state at ${this.statePath}: rules must be an array`);\n    }\n    const normalized = state.rules\n      .map((rule) => normalizeRule(rule))\n      .filter((rule): rule is RouteRule => rule !== null);\n    return this.dedupeById(normalized);\n  }\n\n  private async writeNormalized(rules: RouteRule[], options?: RoutingEngineOptions): Promise<RouteRule[]> {\n    const normalized = this.dedupeById(\n      rules\n        .map((rule) => normalizeRule(rule, options))\n        .filter((rule): rule is RouteRule => rule !== null),\n    );\n\n    const payload: RoutingRulesState = {\n      version: 1,\n      updatedAt: new Date().toISOString(),\n      rules: normalized,\n    };\n\n    await this.writeState(payload);\n\n    return normalized;\n  }\n\n  private async writeState(payload: RoutingRulesState): Promise<void> {\n    const tmpPath = `${this.statePath}.tmp-${process.pid}-${Date.now()}`;\n    try {\n      await this.assertStatePathScoped();\n      await writeFile(tmpPath, JSON.stringify(payload, null, 2), \"utf-8\");\n      await rename(tmpPath, this.statePath);\n    } catch (err) {\n      log.debug(`routing rules write failed: ${err}`);\n      throw err;\n    } finally {\n      await rm(tmpPath, { force: true }).catch(() => {});\n    }\n  }\n\n  private async withWriteLock<T>(op: () => Promise<T>): Promise<T> {\n    const previous = this.writeQueue;\n    let release: () => void = () => {};\n    this.writeQueue = new Promise<void>((resolve) => {\n      release = resolve;\n    });\n    await previous;\n    let unlock: (() => Promise<void>) | null = null;\n    try {\n      unlock = await this.acquireFileLock();\n      return await op();\n    } finally {\n      if (unlock) await unlock();\n      release();\n    }\n  }\n\n  private async acquireFileLock(): Promise<() => Promise<void>> {\n    const start = Date.now();\n    const staleMs = 30_000;\n    const timeoutMs = 5_000;\n    let unexpectedLockError: unknown = null;\n    await this.assertStatePathScoped();\n    await mkdir(path.dirname(this.lockPath), { recursive: true });\n\n    while (Date.now() - start < timeoutMs) {\n      try {\n        await mkdir(this.lockPath);\n        return async () => {\n          try {\n            await rm(this.lockPath, { recursive: true, force: true });\n          } catch {\n            // Fail-open: lock cleanup should not fail writes.\n          }\n        };\n      } catch (err) {\n        const code = (err as NodeJS.ErrnoException).code;\n        if (code !== \"EEXIST\") {\n          unexpectedLockError = err;\n          break;\n        }\n        try {\n          const lockStat = await stat(this.lockPath);\n          if (Date.now() - lockStat.mtimeMs > staleMs) {\n            await rm(this.lockPath, { recursive: true, force: true });\n            continue;\n          }\n        } catch {\n          // Lock may have been released between stat/rm attempts.\n        }\n        await new Promise((resolve) => setTimeout(resolve, 25));\n      }\n    }\n\n    if (unexpectedLockError) {\n      throw unexpectedLockError;\n    }\n    throw new Error(`routing rules lock acquisition timed out after ${timeoutMs}ms`);\n  }\n\n  private async assertStatePathScoped(): Promise<void> {\n    await mkdir(this.memoryRoot, { recursive: true });\n    const canonicalRoot = await realpath(this.memoryRoot);\n    const canonicalParent = await this.canonicalizePathWithoutCreating(path.dirname(this.statePath));\n    const canonicalStatePath = path.join(canonicalParent, path.basename(this.statePath));\n    if (!this.isPathInside(canonicalRoot, canonicalStatePath)) {\n      throw new Error(`routing rules state path escaped memoryDir: ${canonicalStatePath}`);\n    }\n    await mkdir(path.dirname(this.statePath), { recursive: true });\n    try {\n      const stateStats = await lstat(this.statePath);\n      if (stateStats.isSymbolicLink()) {\n        throw new Error(`routing rules state path must not be a symlink: ${this.statePath}`);\n      }\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code !== \"ENOENT\") {\n        throw err;\n      }\n    }\n  }\n\n  private isPathInside(root: string, candidate: string): boolean {\n    const normalizedRoot = path.resolve(root);\n    const normalizedCandidate = path.resolve(candidate);\n    if (normalizedCandidate === normalizedRoot) return true;\n    if (normalizedRoot === path.parse(normalizedRoot).root) {\n      return normalizedCandidate.startsWith(normalizedRoot);\n    }\n    return normalizedCandidate.startsWith(`${normalizedRoot}${path.sep}`);\n  }\n\n  private async canonicalizePathWithoutCreating(targetPath: string): Promise<string> {\n    const absoluteTarget = path.resolve(targetPath);\n    let probe = absoluteTarget;\n    while (true) {\n      try {\n        const canonicalProbe = await realpath(probe);\n        const remainder = path.relative(probe, absoluteTarget);\n        return path.resolve(canonicalProbe, remainder);\n      } catch (err) {\n        const code = (err as NodeJS.ErrnoException).code;\n        if (code !== \"ENOENT\") {\n          throw err;\n        }\n        const parent = path.dirname(probe);\n        if (parent === probe) {\n          return absoluteTarget;\n        }\n        probe = parent;\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,OAAO,OAAO,UAAU,UAAU,QAAQ,IAAI,MAAM,iBAAiB;AAC9E,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAU3B,SAAS,eAAkC;AACzC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IACnC,OAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,aAAa,MAAkF;AACtG,QAAM,OAAO,KAAK,UAAU;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK,QAAQ,KAAK;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,EACf,CAAC;AACD,SAAO,SAAS,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E;AAEA,SAAS,iBAAiB,WAAmB,WAA2B;AACtE,QAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,QAAM,cAAc,KAAK,KAAK,MAAM,SAAS,oBAAoB;AACjE,MAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,UAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,WAAO,SAAS,WAAW,OAAO,KAAK,GAAG,IAAI,WAAW;AAAA,EAC3D;AACA,QAAM,WAAW,KAAK,QAAQ,MAAM,SAAS;AAC7C,SAAO,SAAS,WAAW,OAAO,KAAK,GAAG,IAAI,WAAW;AAC3D;AAEA,SAAS,cAAc,MAAiB,SAAkD;AACxF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,YAAY,MAAO,QAAO;AACnC,MAAI,KAAK,gBAAgB,aAAa,KAAK,gBAAgB,QAAS,QAAO;AAC3E,MAAI,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,EAAE,WAAW,EAAG,QAAO;AACjF,MAAI,OAAO,KAAK,aAAa,YAAY,CAAC,OAAO,SAAS,KAAK,QAAQ,EAAG,QAAO;AAEjF,QAAM,mBAAmB,oBAAoB,KAAK,QAAQ,OAAO;AACjE,MAAI,CAAC,iBAAiB,MAAM,CAAC,iBAAiB,OAAQ,QAAO;AAE7D,QAAM,qBAAqB,KAAK,MAAM,KAAK,QAAQ;AACnD,QAAM,mBAAmB,iBAAiB;AAC1C,QAAM,KAAK,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,KAAK,EAAE,SAAS,IAC9D,KAAK,GAAG,KAAK,IACb,aAAa;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK,QAAQ,KAAK;AAAA,IAC3B,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AACH,SAAO;AAAA,IACL;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,SAAS,KAAK,QAAQ,KAAK;AAAA,IAC3B,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAEA,SAAS,SAAS,KAAuB;AACvC,SAAO,eAAe,SAAS,UAAU,OAAQ,IAA8B,SAAS;AAC1F;AAEO,IAAM,oBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACT,aAA4B,QAAQ,QAAQ;AAAA,EAEpD,YAAY,WAAmB,YAAY,4BAA4B;AACrE,SAAK,aAAa,KAAK,QAAQ,SAAS;AACxC,SAAK,YAAY,iBAAiB,WAAW,SAAS;AACtD,SAAK,WAAW,GAAG,KAAK,SAAS;AAAA,EACnC;AAAA,EAEA,MAAM,KAAK,SAAsD;AAC/D,QAAI;AACF,YAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,aAAO,UACJ,IAAI,CAAC,SAAS,cAAc,MAAM,OAAO,CAAC,EAC1C,OAAO,CAAC,SAA4B,SAAS,IAAI;AAAA,IACtD,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,OAAoB,SAAsD;AACpF,WAAO,KAAK,cAAc,YAAY;AACpC,YAAM,KAAK,mBAAmB;AAC9B,aAAO,KAAK,gBAAgB,OAAO,OAAO;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,MAAiB,SAAsD;AAClF,WAAO,KAAK,cAAc,YAAY;AACpC,YAAM,WAAW,MAAM,KAAK,mBAAmB;AAC/C,YAAM,aAAa,cAAc,MAAM,OAAO;AAC9C,UAAI,CAAC,WAAY,QAAO;AAExB,YAAM,OAAO,SAAS,OAAO,CAAC,UAAU,MAAM,OAAO,WAAW,EAAE;AAClE,WAAK,KAAK,UAAU;AACpB,aAAO,KAAK,gBAAgB,IAAI;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gBAAgB,SAAuC;AAC3D,WAAO,KAAK,cAAc,YAAY;AACpC,YAAM,UAAU,QAAQ,KAAK;AAC7B,YAAM,WAAW,MAAM,KAAK,mBAAmB;AAC/C,YAAM,OAAO,SAAS,OAAO,CAAC,UAAU,MAAM,YAAY,OAAO;AACjE,UAAI,KAAK,WAAW,SAAS,OAAQ,QAAO;AAC5C,aAAO,KAAK,gBAAgB,IAAI;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,cAAc,YAAY;AACnC,YAAM,KAAK,WAAW,aAAa,CAAC;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEQ,WAAW,OAAiC;AAClD,UAAM,OAAO,oBAAI,IAAuB;AACxC,eAAW,QAAQ,OAAO;AACxB,WAAK,IAAI,KAAK,IAAI,IAAI;AAAA,IACxB;AACA,WAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AAAA,EACjC;AAAA,EAEA,MAAc,qBAA2C;AACvD,UAAM,KAAK,sBAAsB;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,SAAS,KAAK,WAAW,OAAO;AAAA,IAC9C,SAAS,KAAK;AACZ,UAAI,SAAS,GAAG,GAAG;AACjB,eAAO,CAAC;AAAA,MACV;AACA,YAAM;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,SAAS,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAC/G;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,YAAM,IAAI,MAAM,kCAAkC,KAAK,SAAS,mBAAmB;AAAA,IACrF;AACA,UAAM,QAAQ;AACd,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,GAAG;AAC/B,YAAM,IAAI,MAAM,kCAAkC,KAAK,SAAS,0BAA0B;AAAA,IAC5F;AACA,UAAM,aAAa,MAAM,MACtB,IAAI,CAAC,SAAS,cAAc,IAAI,CAAC,EACjC,OAAO,CAAC,SAA4B,SAAS,IAAI;AACpD,WAAO,KAAK,WAAW,UAAU;AAAA,EACnC;AAAA,EAEA,MAAc,gBAAgB,OAAoB,SAAsD;AACtG,UAAM,aAAa,KAAK;AAAA,MACtB,MACG,IAAI,CAAC,SAAS,cAAc,MAAM,OAAO,CAAC,EAC1C,OAAO,CAAC,SAA4B,SAAS,IAAI;AAAA,IACtD;AAEA,UAAM,UAA6B;AAAA,MACjC,SAAS;AAAA,MACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,OAAO;AAAA,IACT;AAEA,UAAM,KAAK,WAAW,OAAO;AAE7B,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,SAA2C;AAClE,UAAM,UAAU,GAAG,KAAK,SAAS,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAClE,QAAI;AACF,YAAM,KAAK,sBAAsB;AACjC,YAAM,UAAU,SAAS,KAAK,UAAU,SAAS,MAAM,CAAC,GAAG,OAAO;AAClE,YAAM,OAAO,SAAS,KAAK,SAAS;AAAA,IACtC,SAAS,KAAK;AACZ,UAAI,MAAM,+BAA+B,GAAG,EAAE;AAC9C,YAAM;AAAA,IACR,UAAE;AACA,YAAM,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAc,cAAiB,IAAkC;AAC/D,UAAM,WAAW,KAAK;AACtB,QAAI,UAAsB,MAAM;AAAA,IAAC;AACjC,SAAK,aAAa,IAAI,QAAc,CAAC,YAAY;AAC/C,gBAAU;AAAA,IACZ,CAAC;AACD,UAAM;AACN,QAAI,SAAuC;AAC3C,QAAI;AACF,eAAS,MAAM,KAAK,gBAAgB;AACpC,aAAO,MAAM,GAAG;AAAA,IAClB,UAAE;AACA,UAAI,OAAQ,OAAM,OAAO;AACzB,cAAQ;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAc,kBAAgD;AAC5D,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,UAAU;AAChB,UAAM,YAAY;AAClB,QAAI,sBAA+B;AACnC,UAAM,KAAK,sBAAsB;AACjC,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAE5D,WAAO,KAAK,IAAI,IAAI,QAAQ,WAAW;AACrC,UAAI;AACF,cAAM,MAAM,KAAK,QAAQ;AACzB,eAAO,YAAY;AACjB,cAAI;AACF,kBAAM,GAAG,KAAK,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,UAC1D,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,OAAQ,IAA8B;AAC5C,YAAI,SAAS,UAAU;AACrB,gCAAsB;AACtB;AAAA,QACF;AACA,YAAI;AACF,gBAAM,WAAW,MAAM,KAAK,KAAK,QAAQ;AACzC,cAAI,KAAK,IAAI,IAAI,SAAS,UAAU,SAAS;AAC3C,kBAAM,GAAG,KAAK,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACxD;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AACA,cAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,MACxD;AAAA,IACF;AAEA,QAAI,qBAAqB;AACvB,YAAM;AAAA,IACR;AACA,UAAM,IAAI,MAAM,kDAAkD,SAAS,IAAI;AAAA,EACjF;AAAA,EAEA,MAAc,wBAAuC;AACnD,UAAM,MAAM,KAAK,YAAY,EAAE,WAAW,KAAK,CAAC;AAChD,UAAM,gBAAgB,MAAM,SAAS,KAAK,UAAU;AACpD,UAAM,kBAAkB,MAAM,KAAK,gCAAgC,KAAK,QAAQ,KAAK,SAAS,CAAC;AAC/F,UAAM,qBAAqB,KAAK,KAAK,iBAAiB,KAAK,SAAS,KAAK,SAAS,CAAC;AACnF,QAAI,CAAC,KAAK,aAAa,eAAe,kBAAkB,GAAG;AACzD,YAAM,IAAI,MAAM,+CAA+C,kBAAkB,EAAE;AAAA,IACrF;AACA,UAAM,MAAM,KAAK,QAAQ,KAAK,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,QAAI;AACF,YAAM,aAAa,MAAM,MAAM,KAAK,SAAS;AAC7C,UAAI,WAAW,eAAe,GAAG;AAC/B,cAAM,IAAI,MAAM,mDAAmD,KAAK,SAAS,EAAE;AAAA,MACrF;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,UAAU;AACrB,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,MAAc,WAA4B;AAC7D,UAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,UAAM,sBAAsB,KAAK,QAAQ,SAAS;AAClD,QAAI,wBAAwB,eAAgB,QAAO;AACnD,QAAI,mBAAmB,KAAK,MAAM,cAAc,EAAE,MAAM;AACtD,aAAO,oBAAoB,WAAW,cAAc;AAAA,IACtD;AACA,WAAO,oBAAoB,WAAW,GAAG,cAAc,GAAG,KAAK,GAAG,EAAE;AAAA,EACtE;AAAA,EAEA,MAAc,gCAAgC,YAAqC;AACjF,UAAM,iBAAiB,KAAK,QAAQ,UAAU;AAC9C,QAAI,QAAQ;AACZ,WAAO,MAAM;AACX,UAAI;AACF,cAAM,iBAAiB,MAAM,SAAS,KAAK;AAC3C,cAAM,YAAY,KAAK,SAAS,OAAO,cAAc;AACrD,eAAO,KAAK,QAAQ,gBAAgB,SAAS;AAAA,MAC/C,SAAS,KAAK;AACZ,cAAM,OAAQ,IAA8B;AAC5C,YAAI,SAAS,UAAU;AACrB,gBAAM;AAAA,QACR;AACA,cAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,YAAI,WAAW,OAAO;AACpB,iBAAO;AAAA,QACT;AACA,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-MJFNCJXV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/search/document-scanner.ts"],"sourcesContent":["import path from \"node:path\";\nimport { readdir, readFile } from \"node:fs/promises\";\n\nexport interface IndexableDocument {\n  /** Memory ID from frontmatter or filename stem */\n  docid: string;\n  /** Absolute file path */\n  path: string;\n  /** Markdown body (no YAML frontmatter) */\n  content: string;\n  /** First ~200 chars for display */\n  snippet: string;\n}\n\n/**\n * Parse YAML frontmatter from a markdown string.\n * Returns the frontmatter key-value pairs and body, or null if no frontmatter block.\n */\nfunction parseFrontmatter(raw: string): { data: Record<string, string>; body: string } | null {\n  // Support both LF and CRLF line endings\n  const normalized = raw.replace(/\\r\\n/g, \"\\n\");\n  const match = normalized.match(/^---\\n([\\s\\S]*?)\\n---\\n?([\\s\\S]*)$/);\n  if (!match) return null;\n\n  const fmBlock = match[1];\n  const body = (match[2] ?? \"\").trim();\n  const data: Record<string, string> = {};\n\n  for (const line of fmBlock.split(\"\\n\")) {\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx === -1) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n    data[key] = value;\n  }\n\n  return { data, body };\n}\n\n/**\n * Recursively scan a directory for `.md` files and return IndexableDocuments.\n */\nasync function scanDir(dir: string): Promise<IndexableDocument[]> {\n  const docs: IndexableDocument[] = [];\n  try {\n    const entries = await readdir(dir, { withFileTypes: true });\n    for (const entry of entries) {\n      const fullPath = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        const sub = await scanDir(fullPath);\n        docs.push(...sub);\n      } else if (entry.name.endsWith(\".md\")) {\n        try {\n          const raw = await readFile(fullPath, \"utf-8\");\n          const parsed = parseFrontmatter(raw);\n          const body = parsed ? parsed.body : raw.trim();\n          const docid = parsed?.data.id || path.basename(entry.name, \".md\");\n          docs.push({\n            docid,\n            path: fullPath,\n            content: body,\n            snippet: body.slice(0, 200),\n          });\n        } catch {\n          // Skip unreadable files\n        }\n      }\n    }\n  } catch {\n    // Directory doesn't exist yet — not an error\n  }\n  return docs;\n}\n\n/**\n * Scan `facts/`, `corrections/`, `procedures/`, and `reasoning-traces/`\n * subdirs of memoryDir for indexable markdown documents.\n *\n * Note: reasoning-traces live under their own subtree (issue #564 PR 3).\n * Non-QMD backends (Orama / Meilisearch / LanceDB) build their index\n * through this helper, so any new category subtree must be listed here\n * or those backends silently stop seeing the new memories.\n */\nexport async function scanMemoryDir(memoryDir: string): Promise<IndexableDocument[]> {\n  const factsDir = path.join(memoryDir, \"facts\");\n  const correctionsDir = path.join(memoryDir, \"corrections\");\n  const proceduresDir = path.join(memoryDir, \"procedures\");\n  const reasoningTracesDir = path.join(memoryDir, \"reasoning-traces\");\n  const [facts, corrections, procedures, reasoningTraces] = await Promise.all([\n    scanDir(factsDir),\n    scanDir(correctionsDir),\n    scanDir(proceduresDir),\n    scanDir(reasoningTracesDir),\n  ]);\n  return [...facts, ...corrections, ...procedures, ...reasoningTraces];\n}\n"],"mappings":";AAAA,OAAO,UAAU;AACjB,SAAS,SAAS,gBAAgB;AAiBlC,SAAS,iBAAiB,KAAoE;AAE5F,QAAM,aAAa,IAAI,QAAQ,SAAS,IAAI;AAC5C,QAAM,QAAQ,WAAW,MAAM,oCAAoC;AACnE,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,CAAC;AACvB,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,KAAK;AACnC,QAAM,OAA+B,CAAC;AAEtC,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,aAAa,GAAI;AACrB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAC5C,SAAK,GAAG,IAAI;AAAA,EACd;AAEA,SAAO,EAAE,MAAM,KAAK;AACtB;AAKA,eAAe,QAAQ,KAA2C;AAChE,QAAM,OAA4B,CAAC;AACnC,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;AAC1C,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,MAAM,MAAM,QAAQ,QAAQ;AAClC,aAAK,KAAK,GAAG,GAAG;AAAA,MAClB,WAAW,MAAM,KAAK,SAAS,KAAK,GAAG;AACrC,YAAI;AACF,gBAAM,MAAM,MAAM,SAAS,UAAU,OAAO;AAC5C,gBAAM,SAAS,iBAAiB,GAAG;AACnC,gBAAM,OAAO,SAAS,OAAO,OAAO,IAAI,KAAK;AAC7C,gBAAM,QAAQ,QAAQ,KAAK,MAAM,KAAK,SAAS,MAAM,MAAM,KAAK;AAChE,eAAK,KAAK;AAAA,YACR;AAAA,YACA,MAAM;AAAA,YACN,SAAS;AAAA,YACT,SAAS,KAAK,MAAM,GAAG,GAAG;AAAA,UAC5B,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAWA,eAAsB,cAAc,WAAiD;AACnF,QAAM,WAAW,KAAK,KAAK,WAAW,OAAO;AAC7C,QAAM,iBAAiB,KAAK,KAAK,WAAW,aAAa;AACzD,QAAM,gBAAgB,KAAK,KAAK,WAAW,YAAY;AACvD,QAAM,qBAAqB,KAAK,KAAK,WAAW,kBAAkB;AAClE,QAAM,CAAC,OAAO,aAAa,YAAY,eAAe,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1E,QAAQ,QAAQ;AAAA,IAChB,QAAQ,cAAc;AAAA,IACtB,QAAQ,aAAa;AAAA,IACrB,QAAQ,kBAAkB;AAAA,EAC5B,CAAC;AACD,SAAO,CAAC,GAAG,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe;AACrE;","names":[]}

package/dist/chunk-MSWG7JI6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/tokens.ts"],"sourcesContent":["/**\n * Token management for Remnic multi-connector auth.\n *\n * Manages per-connector tokens in ~/.remnic/tokens.json.\n * Each connector gets a unique token with a recognizable prefix.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\nimport { resolveHomeDir } from \"./runtime/env.js\";\n\nexport interface TokenEntry {\n  token: string;\n  connector: string;\n  createdAt: string;\n}\n\nexport interface TokenStore {\n  tokens: TokenEntry[];\n}\n\nconst TOKEN_PREFIXES: Record<string, string> = {\n  \"openclaw\": \"remnic_oc_\",\n  \"claude-code\": \"remnic_cc_\",\n  \"codex-cli\": \"remnic_cx_\",\n  \"codex\": \"remnic_cx_\",\n  \"hermes\": \"remnic_hm_\",\n  \"pi\": \"remnic_pi_\",\n  \"replit\": \"remnic_rl_\",\n  \"cursor\": \"remnic_cu_\",\n  \"cline\": \"remnic_cl_\",\n  \"github-copilot\": \"remnic_gh_\",\n  \"roo-code\": \"remnic_rc_\",\n  \"windsurf\": \"remnic_ws_\",\n  \"amp\": \"remnic_am_\",\n  \"generic-mcp\": \"remnic_gm_\",\n};\n\nfunction defaultTokensPath(): string {\n  return path.join(resolveHomeDir(), \".remnic\", \"tokens.json\");\n}\n\nfunction legacyTokensPath(): string {\n  return path.join(resolveHomeDir(), \".engram\", \"tokens.json\");\n}\n\nfunction resolveReadPath(tokensPath?: string): string {\n  const primary = tokensPath ?? defaultTokensPath();\n  if (tokensPath) return primary;\n  if (fs.existsSync(primary)) return primary;\n  const legacy = legacyTokensPath();\n  return fs.existsSync(legacy) ? legacy : primary;\n}\n\nfunction ensureDir(filePath: string): void {\n  const dir = path.dirname(filePath);\n  fs.mkdirSync(dir, { recursive: true });\n}\n\nfunction isEnoent(error: unknown): boolean {\n  return error instanceof Error && \"code\" in error && (error as NodeJS.ErrnoException).code === \"ENOENT\";\n}\n\nfunction validateTokenEntry(raw: unknown, index: number): TokenEntry {\n  if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n    throw new Error(`invalid token entry at index ${index}: expected object`);\n  }\n  const entry = raw as Record<string, unknown>;\n  if (typeof entry.token !== \"string\" || entry.token.length === 0) {\n    throw new Error(`invalid token entry at index ${index}: token must be a non-empty string`);\n  }\n  if (typeof entry.connector !== \"string\" || entry.connector.length === 0) {\n    throw new Error(`invalid token entry at index ${index}: connector must be a non-empty string`);\n  }\n  return {\n    token: entry.token,\n    connector: entry.connector,\n    createdAt:\n      typeof entry.createdAt === \"string\" && entry.createdAt.length > 0\n        ? entry.createdAt\n        : new Date(0).toISOString(),\n  };\n}\n\nfunction parseTokenStore(rawText: string, filePath: string): { store: TokenStore; migratedLegacy: boolean } {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(rawText);\n  } catch (error) {\n    throw new Error(\n      `failed to parse token store at ${filePath}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n\n  if (typeof raw === \"object\" && raw !== null && !Array.isArray(raw)) {\n    const record = raw as Record<string, unknown>;\n    if (record.tokens !== undefined) {\n      if (!Array.isArray(record.tokens)) {\n        throw new Error(`invalid token store at ${filePath}: tokens must be an array`);\n      }\n      return {\n        store: {\n          tokens: record.tokens.map((entry, index) => validateTokenEntry(entry, index)),\n        },\n        migratedLegacy: false,\n      };\n    }\n\n    // Migrate legacy flat-map format: { \"connector\": \"token_value\", ... }\n    const migrated: TokenEntry[] = [];\n    for (const [key, value] of Object.entries(record)) {\n      if (typeof value === \"string\" && value.length > 0) {\n        migrated.push(\n          validateTokenEntry(\n            { token: value, connector: key, createdAt: new Date().toISOString() },\n            migrated.length,\n          ),\n        );\n      }\n    }\n    if (migrated.length > 0) {\n      return { store: { tokens: migrated }, migratedLegacy: true };\n    }\n  }\n\n  throw new Error(`invalid token store at ${filePath}: expected token array or legacy connector map`);\n}\n\nexport function loadTokenStore(tokensPath?: string): TokenStore {\n  const p = resolveReadPath(tokensPath);\n  try {\n    const rawText = fs.readFileSync(p, \"utf8\");\n    const { store, migratedLegacy } = parseTokenStore(rawText, p);\n    if (migratedLegacy) {\n      // Auto-migrate legacy flat-map stores in new format. This is best-effort:\n      // a migration write failure must not hide the successfully parsed tokens.\n      try {\n        saveTokenStore(store, tokensPath);\n      } catch {\n        // Migration write failed (e.g., read-only fs) — still return parsed tokens.\n      }\n    }\n    return store;\n  } catch (error) {\n    if (isEnoent(error)) {\n      return { tokens: [] };\n    }\n    throw error;\n  }\n}\n\nfunction fsyncDirectoryBestEffort(dirPath: string): void {\n  let dirFd: number | null = null;\n  try {\n    dirFd = fs.openSync(dirPath, \"r\");\n    fs.fsyncSync(dirFd);\n  } catch {\n    // Directory fsync is not supported on every platform/filesystem.\n  } finally {\n    if (dirFd !== null) {\n      try { fs.closeSync(dirFd); } catch { /* ignore */ }\n    }\n  }\n}\n\nexport function saveTokenStore(store: TokenStore, tokensPath?: string): void {\n  const p = tokensPath ?? defaultTokensPath();\n  ensureDir(p);\n  const validated: TokenStore = {\n    tokens: store.tokens.map((entry, index) => validateTokenEntry(entry, index)),\n  };\n  const dir = path.dirname(p);\n  const tmpPath = path.join(dir, `.${path.basename(p)}.${process.pid}.${randomUUID()}.tmp`);\n  let fd: number | null = null;\n  try {\n    fd = fs.openSync(tmpPath, \"w\", 0o600);\n    fs.writeFileSync(fd, JSON.stringify(validated, null, 2) + \"\\n\", \"utf8\");\n    fs.fsyncSync(fd);\n    fs.closeSync(fd);\n    fd = null;\n    fs.renameSync(tmpPath, p);\n    // Tighten permissions on pre-existing files after atomic replacement.\n    try { fs.chmodSync(p, 0o600); } catch { /* ignore on platforms without chmod */ }\n    fsyncDirectoryBestEffort(dir);\n  } catch (error) {\n    if (fd !== null) {\n      try { fs.closeSync(fd); } catch { /* ignore */ }\n    }\n    try { fs.rmSync(tmpPath, { force: true }); } catch { /* ignore cleanup failure */ }\n    throw error;\n  }\n}\n\n/**\n * Build a TokenEntry candidate WITHOUT saving it to the store.\n * Callers use this when they need to defer the save until after a\n * dependent write (e.g. Hermes config.yaml) succeeds — see\n * commitTokenEntry() to persist the candidate.\n */\nexport function buildTokenEntry(connector: string): TokenEntry {\n  const prefix = TOKEN_PREFIXES[connector] ?? \"remnic_xx_\";\n  const token = prefix + randomBytes(24).toString(\"hex\");\n  return {\n    token,\n    connector,\n    createdAt: new Date().toISOString(),\n  };\n}\n\n/**\n * Persist a pre-built TokenEntry into the store, replacing any existing\n * entry for the same connector. Used together with buildTokenEntry() when\n * the caller wants to defer the save until after a dependent write succeeds.\n *\n * For transactional rollback, callers should snapshot the full store via\n * loadTokenStore() BEFORE calling commitTokenEntry() and restore it with\n * saveTokenStore() on failure. A full-store snapshot handles partial writes\n * of tokens.json atomically — single-entry restore via the return value is\n * insufficient because if this function throws during saveTokenStore, the\n * return statement never executes (UXJI/UXJT fix).\n */\nexport function commitTokenEntry(entry: TokenEntry, tokensPath?: string): void {\n  const store = loadTokenStore(tokensPath);\n  store.tokens = store.tokens.filter((t) => t.connector !== entry.connector);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n}\n\nexport function generateToken(connector: string, tokensPath?: string): TokenEntry {\n  const store = loadTokenStore(tokensPath);\n\n  // Remove existing token for this connector\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n\n  const entry = buildTokenEntry(connector);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n  return entry;\n}\n\nexport function listTokens(tokensPath?: string): TokenEntry[] {\n  return loadTokenStore(tokensPath).tokens;\n}\n\nexport function revokeToken(connector: string, tokensPath?: string): boolean {\n  const store = loadTokenStore(tokensPath);\n  const before = store.tokens.length;\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n  if (store.tokens.length < before) {\n    saveTokenStore(store, tokensPath);\n    return true;\n  }\n  return false;\n}\n\nexport function getAllValidTokens(tokensPath?: string): string[] {\n  return loadTokenStore(tokensPath).tokens.map((t) => t.token);\n}\n\n// Cached token loader to avoid synchronous disk I/O on every HTTP request.\n// Re-reads tokens.json at most once per TTL interval (default 5s).\nconst TOKEN_CACHE_TTL_MS = 5_000;\nlet _cachedTokens: string[] = [];\nlet _cachedAt = 0;\nlet _cachedPath: string | undefined;\n\nexport function getAllValidTokensCached(tokensPath?: string): string[] {\n  const now = Date.now();\n  if (now - _cachedAt < TOKEN_CACHE_TTL_MS && tokensPath === _cachedPath) return _cachedTokens;\n  _cachedTokens = getAllValidTokens(tokensPath);\n  _cachedAt = now;\n  _cachedPath = tokensPath;\n  return _cachedTokens;\n}\n\nexport function resolveConnectorFromToken(token: string, tokensPath?: string): string | undefined {\n  return loadTokenStore(tokensPath).tokens.find((t) => t.token === token)?.connector;\n}\n"],"mappings":";;;;;AAOA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,aAAa,kBAAkB;AAaxC,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,eAAe;AACjB;AAEA,SAAS,oBAA4B;AACnC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,mBAA2B;AAClC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,gBAAgB,YAA6B;AACpD,QAAM,UAAU,cAAc,kBAAkB;AAChD,MAAI,WAAY,QAAO;AACvB,MAAI,GAAG,WAAW,OAAO,EAAG,QAAO;AACnC,QAAM,SAAS,iBAAiB;AAChC,SAAO,GAAG,WAAW,MAAM,IAAI,SAAS;AAC1C;AAEA,SAAS,UAAU,UAAwB;AACzC,QAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,KAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC;AAEA,SAAS,SAAS,OAAyB;AACzC,SAAO,iBAAiB,SAAS,UAAU,SAAU,MAAgC,SAAS;AAChG;AAEA,SAAS,mBAAmB,KAAc,OAA2B;AACnE,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gCAAgC,KAAK,mBAAmB;AAAA,EAC1E;AACA,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,gCAAgC,KAAK,oCAAoC;AAAA,EAC3F;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,UAAM,IAAI,MAAM,gCAAgC,KAAK,wCAAwC;AAAA,EAC/F;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,WACE,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAC5D,MAAM,aACN,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,EAChC;AACF;AAEA,SAAS,gBAAgB,SAAiB,UAAkE;AAC1G,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kCAAkC,QAAQ,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACvG;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClE,UAAM,SAAS;AACf,QAAI,OAAO,WAAW,QAAW;AAC/B,UAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,cAAM,IAAI,MAAM,0BAA0B,QAAQ,2BAA2B;AAAA,MAC/E;AACA,aAAO;AAAA,QACL,OAAO;AAAA,UACL,QAAQ,OAAO,OAAO,IAAI,CAAC,OAAO,UAAU,mBAAmB,OAAO,KAAK,CAAC;AAAA,QAC9E;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,IACF;AAGA,UAAM,WAAyB,CAAC;AAChC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,iBAAS;AAAA,UACP;AAAA,YACE,EAAE,OAAO,OAAO,WAAW,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACpE,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,aAAO,EAAE,OAAO,EAAE,QAAQ,SAAS,GAAG,gBAAgB,KAAK;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,0BAA0B,QAAQ,gDAAgD;AACpG;AAEO,SAAS,eAAe,YAAiC;AAC9D,QAAM,IAAI,gBAAgB,UAAU;AACpC,MAAI;AACF,UAAM,UAAU,GAAG,aAAa,GAAG,MAAM;AACzC,UAAM,EAAE,OAAO,eAAe,IAAI,gBAAgB,SAAS,CAAC;AAC5D,QAAI,gBAAgB;AAGlB,UAAI;AACF,uBAAe,OAAO,UAAU;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,GAAG;AACnB,aAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,IACtB;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,yBAAyB,SAAuB;AACvD,MAAI,QAAuB;AAC3B,MAAI;AACF,YAAQ,GAAG,SAAS,SAAS,GAAG;AAChC,OAAG,UAAU,KAAK;AAAA,EACpB,QAAQ;AAAA,EAER,UAAE;AACA,QAAI,UAAU,MAAM;AAClB,UAAI;AAAE,WAAG,UAAU,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,eAAe,OAAmB,YAA2B;AAC3E,QAAM,IAAI,cAAc,kBAAkB;AAC1C,YAAU,CAAC;AACX,QAAM,YAAwB;AAAA,IAC5B,QAAQ,MAAM,OAAO,IAAI,CAAC,OAAO,UAAU,mBAAmB,OAAO,KAAK,CAAC;AAAA,EAC7E;AACA,QAAM,MAAM,KAAK,QAAQ,CAAC;AAC1B,QAAM,UAAU,KAAK,KAAK,KAAK,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM;AACxF,MAAI,KAAoB;AACxB,MAAI;AACF,SAAK,GAAG,SAAS,SAAS,KAAK,GAAK;AACpC,OAAG,cAAc,IAAI,KAAK,UAAU,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM;AACtE,OAAG,UAAU,EAAE;AACf,OAAG,UAAU,EAAE;AACf,SAAK;AACL,OAAG,WAAW,SAAS,CAAC;AAExB,QAAI;AAAE,SAAG,UAAU,GAAG,GAAK;AAAA,IAAG,QAAQ;AAAA,IAA0C;AAChF,6BAAyB,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,OAAO,MAAM;AACf,UAAI;AAAE,WAAG,UAAU,EAAE;AAAA,MAAG,QAAQ;AAAA,MAAe;AAAA,IACjD;AACA,QAAI;AAAE,SAAG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,IAAG,QAAQ;AAAA,IAA+B;AAClF,UAAM;AAAA,EACR;AACF;AAQO,SAAS,gBAAgB,WAA+B;AAC7D,QAAM,SAAS,eAAe,SAAS,KAAK;AAC5C,QAAM,QAAQ,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACF;AAcO,SAAS,iBAAiB,OAAmB,YAA2B;AAC7E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,MAAM,SAAS;AACzE,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAClC;AAEO,SAAS,cAAc,WAAmB,YAAiC;AAChF,QAAM,QAAQ,eAAe,UAAU;AAGvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AAEnE,QAAM,QAAQ,gBAAgB,SAAS;AACvC,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAChC,SAAO;AACT;AAEO,SAAS,WAAW,YAAmC;AAC5D,SAAO,eAAe,UAAU,EAAE;AACpC;AAEO,SAAS,YAAY,WAAmB,YAA8B;AAC3E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO;AAC5B,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AACnE,MAAI,MAAM,OAAO,SAAS,QAAQ;AAChC,mBAAe,OAAO,UAAU;AAChC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,YAA+B;AAC/D,SAAO,eAAe,UAAU,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC7D;AAIA,IAAM,qBAAqB;AAC3B,IAAI,gBAA0B,CAAC;AAC/B,IAAI,YAAY;AAChB,IAAI;AAEG,SAAS,wBAAwB,YAA+B;AACrE,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,MAAM,YAAY,sBAAsB,eAAe,YAAa,QAAO;AAC/E,kBAAgB,kBAAkB,UAAU;AAC5C,cAAY;AACZ,gBAAc;AACd,SAAO;AACT;AAEO,SAAS,0BAA0B,OAAe,YAAyC;AAChG,SAAO,eAAe,UAAU,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC3E;","names":[]}

package/dist/chunk-MXC3AP5I.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/resolve-auth-token.ts"],"sourcesContent":["import type { AgentAccessAuthToken, SecretRef } from \"./types.js\";\n\n/**\n * Resolve `agentAccessHttp.authToken` (issue #757).\n *\n * Two shapes are accepted:\n *\n *   1. Plain string — returned unchanged. This is the only shape supported\n *      in standalone Remnic; it preserves backward compatibility with every\n *      pre-#757 config.\n *\n *   2. SecretRef-like object (`{source, provider?, id?, command?, ...}`) —\n *      resolved only through a resolver supplied by the host adapter. Core\n *      stays host-agnostic and never scans OpenClaw, Hermes, or any other\n *      runtime directly.\n *\n * Resolution flow for SecretRef objects:\n *\n *   - Plain strings short-circuit before any host work.\n *   - Host adapters pass their native SecretRef resolver in `options`.\n *   - If no resolver is provided, throw a clear, actionable error rather\n *     than silently leaving the bridge open or starting with no auth.\n *\n * Lessons baked in from PRs #316–#319:\n *\n *   - Successful resolutions are cached for the process lifetime; failures\n *     are not cached so transient issues (Keychain unlocked late, agent\n *     restarts) recover automatically.\n */\n\nexport type ResolveSecretRefFn = (\n  ref: SecretRef,\n  context?: unknown,\n) => Promise<string | undefined> | string | undefined;\n\ntype ResolveAgentAccessAuthTokenOptions = {\n  resolveSecretRef?: ResolveSecretRefFn | null;\n};\n\nconst resolvedCache = new Map<string, string>();\n\n/**\n * SecretRef objects are stable per (source, provider, id, command) tuple.\n * Sort keys before serializing so semantically-identical refs hit the same\n * cache slot regardless of authoring order (Lesson 38 in CLAUDE.md).\n */\nfunction cacheKeyForSecretRef(ref: SecretRef): string {\n  const sortedKeys = Object.keys(ref).sort();\n  const stable: Record<string, unknown> = {};\n  for (const key of sortedKeys) {\n    stable[key] = ref[key];\n  }\n  return JSON.stringify(stable);\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Resolve an `agentAccessHttp.authToken` value to a literal bearer string.\n *\n * @returns the resolved string, or `undefined` if input was undefined/empty.\n * @throws if the input is a SecretRef and no resolver is provided, if the\n *         resolver returns no value, or if the input shape is malformed.\n */\nexport async function resolveAgentAccessAuthToken(\n  value: AgentAccessAuthToken | undefined,\n  options: ResolveAgentAccessAuthTokenOptions = {},\n): Promise<string | undefined> {\n  if (value === undefined || value === null) return undefined;\n\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (!isPlainObject(value)) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"expected a string or an object with a `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const ref = value as SecretRef;\n  if (typeof ref.source !== \"string\" || ref.source.trim().length === 0) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"missing required `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const cacheKey = cacheKeyForSecretRef(ref);\n  const cached = resolvedCache.get(cacheKey);\n  if (cached !== undefined) return cached;\n\n  const resolver = options.resolveSecretRef ?? null;\n  if (!resolver) {\n    throw new Error(\n      `cannot resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\") — ` +\n        \"a SecretRef resolver was not provided. Use a literal string or \" +\n        \"${ENV_VAR} expansion in standalone Remnic, or have the host adapter \" +\n        \"resolve SecretRef objects through its native secret resolver \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757).\",\n    );\n  }\n\n  let resolved: string | undefined;\n  try {\n    const out = await resolver(ref);\n    if (typeof out === \"string\") {\n      const trimmed = out.trim();\n      if (trimmed.length > 0) resolved = trimmed;\n    }\n  } catch (err) {\n    throw new Error(\n      `failed to resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\"): ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    );\n  }\n\n  if (!resolved) {\n    throw new Error(\n      `agentAccessHttp.authToken SecretRef resolved to empty value (source=\"${ref.source}\", provider=\"${\n        ref.provider ?? \"\"\n      }\") — refusing to start the HTTP bridge with an empty bearer token.`,\n    );\n  }\n\n  resolvedCache.set(cacheKey, resolved);\n  return resolved;\n}\n\n/**\n * Returns true if the value is a SecretRef object (issue #757). Useful for\n * surfaces (CLI flags, doctor checks) that want to render a redacted\n * placeholder instead of leaking the unresolved object shape.\n */\nexport function isAgentAccessSecretRef(value: unknown): value is SecretRef {\n  if (!isPlainObject(value)) return false;\n  const ref = value as Record<string, unknown>;\n  return typeof ref.source === \"string\" && ref.source.trim().length > 0;\n}\n\n/** Test/operations hook: drop the cache and force resolver rediscovery. */\nexport function clearAuthTokenSecretCache(): void {\n  resolvedCache.clear();\n}\n"],"mappings":";AAuCA,IAAM,gBAAgB,oBAAI,IAAoB;AAO9C,SAAS,qBAAqB,KAAwB;AACpD,QAAM,aAAa,OAAO,KAAK,GAAG,EAAE,KAAK;AACzC,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,YAAY;AAC5B,WAAO,GAAG,IAAI,IAAI,GAAG;AAAA,EACvB;AACA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AASA,eAAsB,4BACpB,OACA,UAA8C,CAAC,GAClB;AAC7B,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAElD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,WAAW,qBAAqB,GAAG;AACzC,QAAM,SAAS,cAAc,IAAI,QAAQ;AACzC,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,WAAW,QAAQ,oBAAoB;AAC7C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,+DAA+D,IAAI,MAAM;AAAA,IAK3E;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,GAAG;AAC9B,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,QAAQ,SAAS,EAAG,YAAW;AAAA,IACrC;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kEAAkE,IAAI,MAAM,OAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,wEAAwE,IAAI,MAAM,gBAChF,IAAI,YAAY,EAClB;AAAA,IACF;AAAA,EACF;AAEA,gBAAc,IAAI,UAAU,QAAQ;AACpC,SAAO;AACT;AAOO,SAAS,uBAAuB,OAAoC;AACzE,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,QAAM,MAAM;AACZ,SAAO,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,SAAS;AACtE;AAGO,SAAS,4BAAkC;AAChD,gBAAc,MAAM;AACtB;","names":[]}

package/dist/chunk-MXFBBHJU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { createCipheriv, randomBytes } from \"node:crypto\";\nimport { lstat, mkdir, open as openFile, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  AUTH_TAG_LENGTH,\n  ENVELOPE_HEADER_SIZE,\n  ENVELOPE_LAYOUT,\n  ENVELOPE_SALT_LENGTH,\n  ENVELOPE_VERSION,\n  IV_LENGTH,\n  generateSalt,\n  open as openEnvelope,\n  seal,\n} from \"./cipher.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`,\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  try {\n    return openEnvelope(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(\n      `secure-store decryption failed: ${msg}`,\n    );\n  }\n}\n\nfunction buildHeaderAad(salt: Uint8Array): Buffer {\n  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);\n  out.writeUInt8(ENVELOPE_VERSION, 0);\n  Buffer.from(salt).copy(out, 1);\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFileBuffer(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<Buffer> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain file — legacy or unencrypted store.\n    return buf;\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. ` +\n        \"Run `remnic secure-store unlock` to decrypt.\",\n    );\n  }\n  const aad = filePathAad(filePath, memoryDir);\n  return decryptFileBody(buf, key, aad);\n}\n\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<string> {\n  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a `.tmp-<pid>-<ts>` file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string | Buffer,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\nexport async function writeMaybeEncryptedFileFromChunks(\n  filePath: string,\n  chunks: AsyncIterable<Buffer>,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n  const writePath = atomic ? `${filePath}.tmp-${process.pid}-${Date.now()}` : filePath;\n  let completed = false;\n  try {\n    const handle = await openFile(writePath, \"w\", mode);\n    try {\n      if (key !== null) {\n        const salt = generateSalt();\n        const iv = randomBytes(IV_LENGTH);\n        const header = Buffer.alloc(MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);\n        MAGIC_BYTES.copy(header, 0);\n        header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n        header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n        const envelopeOffset = MAGIC_HEADER_SIZE;\n        header.writeUInt8(ENVELOPE_VERSION, envelopeOffset + ENVELOPE_LAYOUT.version);\n        salt.copy(header, envelopeOffset + ENVELOPE_LAYOUT.salt);\n        iv.copy(header, envelopeOffset + ENVELOPE_LAYOUT.iv);\n        await handle.write(header);\n\n        const cipher = createCipheriv(\"aes-256-gcm\", key, iv, { authTagLength: AUTH_TAG_LENGTH });\n        const aad = filePathAad(filePath, memoryDir);\n        cipher.setAAD(Buffer.concat([buildHeaderAad(salt), aad]));\n        for await (const chunk of chunks) {\n          if (chunk.length === 0) continue;\n          const encrypted = cipher.update(chunk);\n          if (encrypted.length > 0) await handle.write(encrypted);\n        }\n        const final = cipher.final();\n        if (final.length > 0) await handle.write(final);\n        const authTag = cipher.getAuthTag();\n        await handle.write(\n          authTag,\n          0,\n          authTag.length,\n          MAGIC_HEADER_SIZE + ENVELOPE_LAYOUT.authTag,\n        );\n      } else {\n        for await (const chunk of chunks) {\n          if (chunk.length > 0) await handle.write(chunk);\n        }\n      }\n    } finally {\n      await handle.close();\n    }\n    if (atomic) {\n      await rename(writePath, filePath);\n    }\n    completed = true;\n  } finally {\n    if (!completed && atomic) {\n      await unlink(writePath).catch(() => {});\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>,\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = `${filePath}.enc-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(\n  dir: string,\n  key: Buffer,\n): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const plaintext = decryptFileBody(buf, key, aad);\n      const tempPath = `${filePath}.dec-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir,\n): Promise<string[]> {\n  const results: string[] = [];\n  let names: string[];\n  try {\n    names = await readdir(dir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(dir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, rootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, rootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\nfunction storageAadRootForFile(filePath: string, rootDir: string): string {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return rootDir;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(rootDir, \"namespaces\", parts[1]);\n  }\n  return rootDir;\n}\n\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set([\n  \"facts\",\n  \"corrections\",\n  \"procedures\",\n  \"reasoning-traces\",\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\n  \"state\",\n  \"indexes\",\n  \"index\",\n  \"provenance\",\n]);\n"],"mappings":";;;;;;;;;;;;;AA6CA,SAAS,gBAAgB,mBAAmB;AAC5C,SAAS,OAAO,OAAO,QAAQ,UAAU,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC7F,OAAO,UAAU;AAuBV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAU/C,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,MAAI;AACF,WAAO,KAAa,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAA0B;AAChD,QAAM,MAAM,OAAO,MAAM,IAAI,oBAAoB;AACjD,MAAI,WAAW,kBAAkB,CAAC;AAClC,SAAO,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAC7B,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,6BACpB,UACA,KACA,WACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IAEpE;AAAA,EACF;AACA,QAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,SAAO,gBAAgB,KAAK,KAAK,GAAG;AACtC;AAEA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,UAAQ,MAAM,6BAA6B,UAAU,KAAK,SAAS,GAAG,SAAS,MAAM;AACvF;AAyBA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC7D,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AAEA,eAAsB,kCACpB,UACA,QACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,YAAY,SAAS,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK;AAC5E,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,WAAW,KAAK,IAAI;AAClD,QAAI;AACF,UAAI,QAAQ,MAAM;AAChB,cAAM,OAAO,aAAa;AAC1B,cAAM,KAAK,YAAY,SAAS;AAChC,cAAM,SAAS,OAAO,MAAM,oBAAoB,oBAAoB;AACpE,oBAAY,KAAK,QAAQ,CAAC;AAC1B,eAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,eAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAC3D,cAAM,iBAAiB;AACvB,eAAO,WAAW,kBAAkB,iBAAiB,gBAAgB,OAAO;AAC5E,aAAK,KAAK,QAAQ,iBAAiB,gBAAgB,IAAI;AACvD,WAAG,KAAK,QAAQ,iBAAiB,gBAAgB,EAAE;AACnD,cAAM,OAAO,MAAM,MAAM;AAEzB,cAAM,SAAS,eAAe,eAAe,KAAK,IAAI,EAAE,eAAe,gBAAgB,CAAC;AACxF,cAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,eAAO,OAAO,OAAO,OAAO,CAAC,eAAe,IAAI,GAAG,GAAG,CAAC,CAAC;AACxD,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,WAAW,EAAG;AACxB,gBAAM,YAAY,OAAO,OAAO,KAAK;AACrC,cAAI,UAAU,SAAS,EAAG,OAAM,OAAO,MAAM,SAAS;AAAA,QACxD;AACA,cAAM,QAAQ,OAAO,MAAM;AAC3B,YAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAC9C,cAAM,UAAU,OAAO,WAAW;AAClC,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,oBAAoB,gBAAgB;AAAA,QACtC;AAAA,MACF,OAAO;AACL,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAAA,QAChD;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,QAAI,QAAQ;AACV,YAAM,OAAO,WAAW,QAAQ;AAAA,IAClC;AACA,gBAAY;AAAA,EACd,UAAE;AACA,QAAI,CAAC,aAAa,QAAQ;AACxB,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAA,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BACpB,KACA,KACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,KAAK,KAAK,GAAG;AAC/C,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAWA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,EAAE,UAAU,OAAO,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,KAAK,IAAI;AAChC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,OAAO;AACvE,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,OAAO,GAAG;AAC/C,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,SAAyB;AACxE,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,SAAS,cAAc,MAAM,CAAC,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":["unlink"]}