@remnic/core 10.0.27 → 10.0.29

package/src/storage/entity-store.ts

@@ -23,7 +23,7 @@ import {
 } from "../utils/macos-replication-junk.js";
 import { getCachedEntities, setCachedEntities } from "../memory-cache.js";
 import type { VersionTrigger } from "../page-versioning.js";
-import { SecureStoreLockedError } from "../secure-store/secure-fs.js";
+import { SecureStoreDecryptError, SecureStoreLockedError } from "../secure-store/secure-fs.js";
 import type {
   EntityActivityEntry,
   EntityFile,
@@ -67,6 +67,8 @@ export interface EntityStoreDeps {
   readonly entitiesDir: string;
   readonly entitySchemas: PluginConfig["entitySchemas"] | undefined;
   currentHistoricalIds(): Readonly<Record<string, string>>;
+  /** True when the entity canonical-id journal says migration completed. */
+  entityCanonicalMigrationComplete(): boolean;
   findMatchingEntity(proposedName: string, type: string): Promise<string | null>;
   getEntityCacheSecureStoreKey(): string;
   getEntityMutationVersion(): number;
@@ -373,18 +375,56 @@ export class EntityStore {
     return normalized;
   }
 
-  async readEntity(name: string): Promise<string> {
-    const filePath = this.deps.resolveEntityFilePath(name);
-    if (filePath === null) {
-      return "";
-    }
+  private async readEntityFileResolvingRename(firstPath: string, entityId: string) {
     try {
-      return await this.deps.readStorageSecureFile(filePath);
+      return { id: entityId, content: await this.deps.readStorageSecureFile(firstPath) };
     } catch (err) {
       if (err instanceof SecureStoreLockedError) throw err;
+      // ENOENT: renamed away (retry below). ELOOP: planted symlink — skip.
+      if (isErrnoCode(err, "ELOOP")) return null;
       if (!isErrnoCode(err, "ENOENT")) throw err;
+    }
+    const historicalIds = this.deps.currentHistoricalIds();
+    const canonical = resolveHistoricalEntityCanonicalId(entityId, historicalIds);
+    const candidates = new Set([canonical]);
+    for (const legacy of Object.keys(historicalIds)) {
+      if (resolveHistoricalEntityCanonicalId(legacy, historicalIds) === canonical) candidates.add(legacy);
+    }
+    candidates.delete(entityId);
+    for (const candidate of candidates) {
+      try {
+        return { id: candidate, content: await this.deps.readStorageSecureFile(
+          path.join(this.deps.entitiesDir, `${candidate}.md`),
+        ) };
+      } catch (err) {
+        if (err instanceof SecureStoreLockedError) throw err;
+        // ENOENT/ELOOP: gone or a planted symlink — try the next candidate.
+        if (isErrnoCode(err, "ENOENT") || isErrnoCode(err, "ELOOP")) continue;
+        throw err;
+      }
+    }
+    return null;
+  }
+
+  async readEntity(name: string): Promise<string> {
+    const filePath = this.deps.resolveEntityFilePath(name);
+    if (filePath === null) {
       return "";
     }
+    // Batch reads retry renames unconditionally (a listed file that ENOENTs
+    // is definitionally a race), but a DIRECT lookup of a legacy id must stop
+    // resolving once the journal says migration completed and its file is gone.
+    if (this.deps.entityCanonicalMigrationComplete()) {
+      try {
+        return await this.deps.readStorageSecureFile(filePath);
+      } catch (err) {
+        if (err instanceof SecureStoreLockedError) throw err;
+        // ENOENT: gone. ELOOP: a planted symlink the open refused to follow.
+        if (isErrnoCode(err, "ENOENT") || isErrnoCode(err, "ELOOP")) return "";
+        throw err;
+      }
+    }
+    return (await this.readEntityFileResolvingRename(filePath, name))?.content ?? "";
   }
 
   /**
@@ -434,6 +474,16 @@ export class EntityStore {
    * Symlinks, FIFOs, and devices are skipped before any read. The entities
    * root is refused separately, before the directory is listed.
    */
+  private async isMissingEntry(file: string): Promise<boolean> {
+    try {
+      await lstat(path.join(this.deps.entitiesDir, file));
+      return false;
+    } catch (err) {
+      if (isErrnoCode(err, "ENOENT")) return true;
+      throw err;
+    }
+  }
+
   private async isContainedRegularEntityFile(file: string): Promise<boolean> {
     const filePath = path.join(this.deps.entitiesDir, file);
     let entryStat;
@@ -491,23 +541,54 @@ export class EntityStore {
       const names: string[] = [];
       const batchSize = 100;
       for (let i = 0; i < mdFiles.length; i += batchSize) {
+        // Journal table snapshot once per call (per-entry reads are quadratic).
+        const historicalIds = this.deps.currentHistoricalIds();
+        const snapshotIds = new Set(mdFiles.map((file) => file.slice(0, -3)));
+        const journalComplete = this.deps.entityCanonicalMigrationComplete();
+        const resolveCanonical = (entityId: string): string => {
+          const canonical = resolveHistoricalEntityCanonicalId(entityId, historicalIds);
+          if (canonical === entityId) return entityId;
+          // Completed journal: the on-disk filename is authoritative; a
+          // late legacy file stays under its own readable name.
+          if (journalComplete) return entityId;
+          // Both claimants coexisting (copy-before-unlink) keep both names.
+          if (snapshotIds.has(canonical)) return entityId;
+          return canonical;
+        };
         const resolved = await Promise.all(mdFiles.slice(i, i + batchSize).map(async (file) => {
+          const entityId = file.slice(0, -3);
           try {
-            if (!(await this.isIndexableEntityMarkdown(file))) return null;
+            // Report the canonical id for every indexable file so legacy
+            // names surface as their canonical identity from the start.
+            if (await this.isIndexableEntityMarkdown(file)) {
+              return resolveCanonical(entityId);
+            }
           } catch (err) {
-            if (err instanceof SecureStoreLockedError) throw err;
-            return null;
+            // Lock and decrypt errors abort the listing; anything else
+            // (EACCES) fails only this entry — one unhealthy file must not
+            // empty it.
+            if (err instanceof SecureStoreLockedError || err instanceof SecureStoreDecryptError) throw err;
+          }
+          // Vanished listed entry: resolve through the journal (rename
+          // race); lstat failures stay within this entry.
+          try {
+            if (await this.isMissingEntry(file)) {
+              const canonical = resolveHistoricalEntityCanonicalId(entityId, this.deps.currentHistoricalIds());
+              if (canonical !== entityId) return canonical;
+            }
+          } catch (err) {
+            if (err instanceof SecureStoreLockedError || err instanceof SecureStoreDecryptError) throw err;
           }
-          return file.slice(0, -3);
+          return null;
         }));
-        for (const name of resolved) {
-          if (name) names.push(name);
-        }
+        names.push(...resolved.filter((name): name is string => name !== null));
       }
-      names.sort();
-      return names;
+      // The copy-before-unlink migration window can snapshot both the legacy
+      // and canonical names; the legacy fallback then resolves to the same
+      // canonical id. Deduplicate so the total stays correct.
+      return [...new Set(names)].sort();
     } catch (err) {
-      if (err instanceof SecureStoreLockedError) throw err;
+      if (err instanceof SecureStoreLockedError || err instanceof SecureStoreDecryptError) throw err;
       return [];
     }
   }
@@ -636,10 +717,22 @@ export class EntityStore {
     if (cached) return cached;
 
     try {
-      const entries = await this.readEntityDirectoryNames();
+      // A symlinked/replaced entities root has no readable entries (merged
+      // #3207 semantics): resolve empty rather than following it. Within a
+      // trusted root, readdir directly so planted entries reach the secure
+      // read instead of being swallowed by the listing guards.
+      if (!(await this.isTrustedEntitiesRoot())) return [];
+      const listed = await readdir(this.deps.entitiesDir);
+      const { kept: entries, ignored } = withoutMacOsReplicationJunk(listed, (name) => name);
+      warnIgnoredMacOsReplicationJunk(this.deps.entitiesDir, ignored, (message) => {
+        log.warn(`entity load ${message}`);
+      });
       const mdFiles = entries.filter((e) => e.endsWith(".md"));
       if (mdFiles.length === 0) return [];
 
+      const historicalIds = this.deps.currentHistoricalIds();
+      const seen = new Map<string, Set<string>>();
+
       // Read all entity files in parallel batches to avoid O(N) sequential I/O.
       // With 3000+ entity files, sequential reads can take 15-20s under load.
       // Batching at 100 keeps file-descriptor pressure manageable while staying fast.
@@ -652,19 +745,39 @@ export class EntityStore {
         const batch = mdFiles.slice(i, i + BATCH_SIZE);
         const results = await Promise.all(
           batch.map(async (entry) => {
+            const entityId = entry.slice(0, -".md".length);
+            const entryPath = path.join(this.deps.entitiesDir, entry);
             try {
-              if (!(await this.isContainedRegularEntityFile(entry))) return null;
-              return await this.deps.readStorageSecureFile(path.join(this.deps.entitiesDir, entry));
+              if (!(await this.isContainedRegularEntityFile(entry))) {
+                // A listed entry that vanished races a background migration
+                // rename: resolve through historical ids like a direct read.
+                // Still-present symlinks/dirs stay skipped.
+                if (await this.isMissingEntry(entry)) {
+                  return await this.readEntityFileResolvingRename(entryPath, entityId);
+                }
+                return null;
+              }
+              return await this.readEntityFileResolvingRename(entryPath, entityId);
             } catch (err) {
-              if (err instanceof SecureStoreLockedError) throw err;
-              if (!isErrnoCode(err, "ENOENT")) throw err;
+              // Lock and decrypt failures abort the corpus read (the store
+              // is unusable or tampered); anything else isolates to this entry.
+              if (err instanceof SecureStoreLockedError || err instanceof SecureStoreDecryptError) throw err;
+              log.warn(`entity read isolated failure for ${entry}: ${err instanceof Error ? err.message : String(err)}`);
               return null;
             }
           }),
         );
-        for (const content of results) {
-          if (content === null) continue;
-          const entity = parseEntityFile(content, this.deps.entitySchemas);
+        for (const result of results) {
+          if (result === null) continue;
+          const canonical = resolveHistoricalEntityCanonicalId(result.id, historicalIds);
+          let contents = seen.get(canonical);
+          if (contents?.has(result.content)) continue;
+          if (!contents) {
+            contents = new Set();
+            seen.set(canonical, contents);
+          }
+          contents.add(result.content);
+          const entity = parseEntityFile(result.content, this.deps.entitySchemas);
           if (!entity.name.trim() || !entity.type.trim()) continue;
           entities.push(entity);
         }

package/src/storage.ts

@@ -2323,10 +2323,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
   private _entityStore: EntityStore | undefined;
 
   private get entityStore(): EntityStore {
-    if (!this._entityStore) {
-      this._entityStore = new EntityStore(selfDeps<ConstructorParameters<typeof EntityStore>[0]>(this));
-    }
-    return this._entityStore;
+    return (this._entityStore ??= new EntityStore(selfDeps<ConstructorParameters<typeof EntityStore>[0]>(this)));
   }
 
   /** IdentityContinuityStore (storage.ts decomposition). Lazy; selfDeps live wiring. */
@@ -3537,6 +3534,16 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
   private currentHistoricalIds(): Readonly<Record<string, string>> {
     return this.historicalEntityCanonicalIds.get(this.stateDir);
   }
+
+  /** Journal completion for EntityStore's legacy-id retry gate (live view). */
+  entityCanonicalMigrationComplete = entityRefs.memoizedJournalCompletion(this.historicalEntityCanonicalIds, () => this.stateDir);
+
+  normalizeEntityName(raw: string, type: string): string {
+    return entityRefs.resolveHistoricalEntityCanonicalId(
+      this.entityStore.normalizeEntityName(raw, type),
+      this.currentHistoricalIds()
+    );
+  }
   /** Post-persist repair subsystem (issue #2213) — storage/entity-ref-repair.ts. */
   private _entityRefRepair: EntityRefRepair | undefined;
   private get entityRefRepair(): EntityRefRepair {
@@ -3561,12 +3568,6 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     () => this.runLegacyEntityCanonicalIdMigration(),
     () => entityMigration.getFingerprint(this.baseDir, this.entitiesDir, () => String(this.getEntityMutationVersion()))
   );
-  normalizeEntityName(raw: string, type: string): string {
-    return entityRefs.resolveHistoricalEntityCanonicalId(
-      this.entityStore.normalizeEntityName(raw, type),
-      this.currentHistoricalIds()
-    );
-  }
 
   /**
    * Read-only view of this store's user alias table, for call sites that
@@ -3623,7 +3624,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     return completionFingerprint;
   }
 
-  async ensureDirectories(): Promise<void> {
+  async ensureDirectories(options: { waitForEntityMigration?: boolean } = {}): Promise<void> {
     await mkdir(this.baseDir, { recursive: true });
     await entityMigration.validateRoots(this.baseDir, this.entitiesDir, this.stateDir, this.archiveDir);
     const today = new Date().toISOString().slice(0, 10);
@@ -3640,7 +3641,7 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     await mkdir(this.identityAuditsWeeklyDir, { recursive: true });
     await mkdir(this.identityAuditsMonthlyDir, { recursive: true });
     await mkdir(path.join(this.baseDir, "config"), { recursive: true });
-    await this.entityCanonicalIdMigration.ensure();
+    await this.entityCanonicalIdMigration.begin(options.waitForEntityMigration !== false, this.entitiesDir);
     // Activate the corpus sentinel at setup (issue #1902, Cursor Medium): an
     // existing corpus predating this feature has a size-0/absent sentinel, which
     // getCachedMemories treats as a miss — so a read-heavy workload would never
@@ -3654,9 +3655,9 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     if (this.hotMemoriesCacheEnabled && this.getMemoryCorpusVersion() === 0) {
       this.bumpMemoryCorpusVersion();
     }
-    await this.entityCanonicalIdMigration.markDirectoriesInitialized();
+    return this.entityCanonicalIdMigration.finishBegin(options.waitForEntityMigration !== false);
   }
-
+  drainEntityCanonicalIdMigration = (): Promise<void> => this.entityCanonicalIdMigration.drain();
   /**
    * Resolve the on-disk write path for a memory of the given category, creating
    * the target directory. Category routing goes through the shared
@@ -4079,7 +4080,6 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     await this.addActiveFactContentHash(memory);
   }
 
-
   private async syncFactHashIndexAfterRewrite(before: MemoryFile, after: MemoryFile): Promise<void> {
     if (before.frontmatter.category !== "fact" && after.frontmatter.category !== "fact") return;
 

package/src/types.ts

@@ -1654,7 +1654,7 @@ export interface PluginConfig
   localLlmRateLimitBackoffBaseMs?: number;
   /** COS-447: ceiling for rate-limit backoff; longer server hints skip the retry (ms). Default 60000. */
   localLlmRateLimitBackoffMaxMs?: number;
-  /** COS-447: process-wide cap on concurrent local LLM HTTP attempts (0 = unlimited). Default 4. */
+  /** Process-wide local LLM HTTP cap; above 1, reserves one permit for recall-critical work. 0 = unlimited. Default 4. */
   localLlmMaxConcurrency?: number;
   /** Ollama-backend thinking suppression: `reasoning_effort` value injected on
    *  `/v1/chat/completions` for THINKING_SUPPRESSED_OPERATIONS ("none" | "low" |

package/dist/chunk-3VRMUNWL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/local-llm-rate-limit.ts"],"sourcesContent":["/**\n * Process-wide rate-limit handling for the local LLM client (COS-447).\n *\n * A LiteLLM proxy in front of the local models answers `429 No deployments\n * available` (and `503`/`408`) when every deployment is busy or in cooldown.\n * Before this module the client returned on the first 429 and the caller\n * loop immediately issued the next request, so one daemon could hammer the\n * proxy with thousands of calls per hour while it was saturated.\n *\n * This module provides three pieces that the client composes:\n *\n * - classification of rate-limit responses and of the retry hint\n *   (`Retry-After` header as delta-seconds or HTTP-date, falling back to\n *   LiteLLM's `Try again in N seconds` body text);\n * - exponential backoff with full jitter;\n * - process-wide state shared by every `LocalLlmClient` instance: a\n *   concurrency semaphore for in-flight HTTP attempts and a per-endpoint\n *   \"do not call before\" deadline, so one client's 429 slows every client\n *   pointed at the same endpoint.\n *\n * State lives on `globalThis` so duplicated module copies in bundled output\n * still share one limiter.\n */\n\nexport const RATE_LIMIT_STATUSES: ReadonlySet<number> = new Set([408, 429, 503]);\n\nconst RATE_LIMIT_BODY_PATTERN = /no deployments available|cooldown_list|all deployments.*cooldown/i;\nconst TRY_AGAIN_PATTERN = /try again in (\\d+(?:\\.\\d+)?) ?(seconds?|secs?|s|milliseconds?|ms|minutes?|mins?)\\b/i;\n\n/** Upper bound on any server-provided wait we will record (sanity clamp). */\nexport const MAX_RECORDED_BACKOFF_MS = 10 * 60_000;\n\nexport const DEFAULT_RATE_LIMIT_RETRY_COUNT = 3;\nexport const DEFAULT_RATE_LIMIT_BACKOFF_BASE_MS = 1_000;\nexport const DEFAULT_RATE_LIMIT_BACKOFF_MAX_MS = 60_000;\nexport const DEFAULT_MAX_CONCURRENCY = 4;\n\nexport interface LocalLlmRateLimitSettings {\n  retryCount: number;\n  backoffBaseMs: number;\n  backoffMaxMs: number;\n  /** 0 disables the process-wide concurrency cap. */\n  maxConcurrency: number;\n}\n\nfunction nonNegativeInt(value: number | undefined, fallback: number): number {\n  if (value === undefined || !Number.isFinite(value) || value < 0) return fallback;\n  return Math.floor(value);\n}\n\nexport function resolveRateLimitSettings(config: {\n  localLlmRateLimitRetryCount?: number;\n  localLlmRateLimitBackoffBaseMs?: number;\n  localLlmRateLimitBackoffMaxMs?: number;\n  localLlmMaxConcurrency?: number;\n}): LocalLlmRateLimitSettings {\n  const backoffBaseMs = Math.max(\n    1,\n    nonNegativeInt(config.localLlmRateLimitBackoffBaseMs, DEFAULT_RATE_LIMIT_BACKOFF_BASE_MS)\n  );\n  const backoffMaxMs = Math.max(\n    backoffBaseMs,\n    nonNegativeInt(config.localLlmRateLimitBackoffMaxMs, DEFAULT_RATE_LIMIT_BACKOFF_MAX_MS)\n  );\n  return {\n    retryCount: nonNegativeInt(config.localLlmRateLimitRetryCount, DEFAULT_RATE_LIMIT_RETRY_COUNT),\n    backoffBaseMs,\n    backoffMaxMs,\n    maxConcurrency: nonNegativeInt(config.localLlmMaxConcurrency, DEFAULT_MAX_CONCURRENCY),\n  };\n}\n\n/**\n * True for responses that mean \"the endpoint is saturated, slow down\":\n * 408/429/503, or a 5xx whose body carries LiteLLM's cooldown wording.\n * 400s are never rate limits (context-window errors mention fallbacks).\n */\nexport function isRateLimitedResponse(status: number, bodyText: string): boolean {\n  if (RATE_LIMIT_STATUSES.has(status)) return true;\n  return status >= 500 && RATE_LIMIT_BODY_PATTERN.test(bodyText);\n}\n\n/**\n * Parse an HTTP `Retry-After` value (RFC 9110: delta-seconds or HTTP-date).\n * Returns milliseconds to wait, or null when absent/invalid.\n */\nexport function parseRetryAfterMs(value: string | null | undefined, nowMs: number = Date.now()): number | null {\n  if (value === null || value === undefined) return null;\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n  if (/^\\d+(\\.\\d+)?$/.test(trimmed)) {\n    return Math.min(MAX_RECORDED_BACKOFF_MS, Math.round(Number(trimmed) * 1000));\n  }\n  const dateMs = Date.parse(trimmed);\n  if (Number.isNaN(dateMs)) return null;\n  return Math.min(MAX_RECORDED_BACKOFF_MS, Math.max(0, dateMs - nowMs));\n}\n\n/** Parse LiteLLM's `Try again in N seconds` hint from an error body. */\nexport function parseTryAgainHintMs(bodyText: string): number | null {\n  const match = bodyText.match(TRY_AGAIN_PATTERN);\n  if (!match) return null;\n  const amount = Number(match[1]);\n  if (!Number.isFinite(amount)) return null;\n  const unit = match[2].toLowerCase();\n  let ms: number;\n  if (unit.startsWith(\"ms\") || unit.startsWith(\"milli\")) ms = amount;\n  else if (unit.startsWith(\"min\")) ms = amount * 60_000;\n  else ms = amount * 1000;\n  return Math.min(MAX_RECORDED_BACKOFF_MS, Math.round(ms));\n}\n\n/** Server-provided wait: `Retry-After` header first, then the body hint. */\nexport function serverRetryHintMs(\n  retryAfterHeader: string | null | undefined,\n  bodyText: string,\n  nowMs: number = Date.now()\n): number | null {\n  return parseRetryAfterMs(retryAfterHeader, nowMs) ?? parseTryAgainHintMs(bodyText);\n}\n\n/**\n * Exponential backoff with full jitter: uniform in [0, min(max, base * 2^(n-1))].\n * `attempt` is 1-based (the number of consecutive rate-limit responses).\n */\nexport function computeFullJitterBackoffMs(\n  attempt: number,\n  baseMs: number,\n  maxMs: number,\n  random: () => number = Math.random\n): number {\n  const exponent = Math.max(0, Math.min(30, attempt - 1));\n  const ceiling = Math.min(maxMs, baseMs * 2 ** exponent);\n  return Math.floor(random() * ceiling);\n}\n\n/**\n * Delay before the next attempt after a rate-limit response. A server hint\n * is a floor (never call earlier than asked); jitter is added on top of the\n * exponential term so synchronized callers spread out.\n */\nexport function computeRateLimitDelayMs(\n  attempt: number,\n  settings: Pick<LocalLlmRateLimitSettings, \"backoffBaseMs\" | \"backoffMaxMs\">,\n  serverHintMs: number | null,\n  random: () => number = Math.random\n): number {\n  const jittered = computeFullJitterBackoffMs(attempt, settings.backoffBaseMs, settings.backoffMaxMs, random);\n  return serverHintMs === null ? jittered : Math.max(serverHintMs, jittered);\n}\n\ntype Waiter = { highPriority: boolean; grant: () => void };\n\n/** FIFO counting semaphore with a high-priority lane (recall-critical first). */\nexport class LocalLlmConcurrencyLimiter {\n  private active = 0;\n  private max: number;\n  private readonly waiters: Waiter[] = [];\n\n  constructor(max: number) {\n    this.max = max;\n  }\n\n  setMax(max: number): void {\n    this.max = max;\n    this.pump();\n  }\n\n  get inFlight(): number {\n    return this.active;\n  }\n\n  get queued(): number {\n    return this.waiters.length;\n  }\n\n  /**\n   * Wait for a slot. Resolves to a release function, or null when the\n   * signal aborts first. `max <= 0` means unlimited.\n   */\n  acquire(\n    options: { highPriority?: boolean; signal?: AbortSignal; timeoutMs?: number } = {}\n  ): Promise<(() => void) | null> {\n    const { signal, timeoutMs } = options;\n    if (signal?.aborted) return Promise.resolve(null);\n    if (this.max <= 0 || (this.active < this.max && this.waiters.length === 0)) {\n      this.active += 1;\n      return Promise.resolve(this.releaser());\n    }\n    if (timeoutMs !== undefined && timeoutMs <= 0) return Promise.resolve(null);\n    return new Promise((resolve) => {\n      let timer: NodeJS.Timeout | undefined;\n      const waiter: Waiter = {\n        highPriority: options.highPriority === true,\n        grant: () => {\n          signal?.removeEventListener(\"abort\", onAbort);\n          if (timer) clearTimeout(timer);\n          resolve(this.releaser());\n        },\n      };\n      const onAbort = (): void => {\n        const index = this.waiters.indexOf(waiter);\n        if (index >= 0) this.waiters.splice(index, 1);\n        signal?.removeEventListener(\"abort\", onAbort);\n        if (timer) clearTimeout(timer);\n        resolve(null);\n      };\n      if (waiter.highPriority) {\n        const firstLow = this.waiters.findIndex((w) => !w.highPriority);\n        if (firstLow < 0) this.waiters.push(waiter);\n        else this.waiters.splice(firstLow, 0, waiter);\n      } else {\n        this.waiters.push(waiter);\n      }\n      signal?.addEventListener(\"abort\", onAbort, { once: true });\n      if (timeoutMs !== undefined) timer = setTimeout(onAbort, timeoutMs);\n    });\n  }\n\n  private releaser(): () => void {\n    let released = false;\n    return () => {\n      if (released) return;\n      released = true;\n      this.active -= 1;\n      this.pump();\n    };\n  }\n\n  private pump(): void {\n    while (this.waiters.length > 0 && (this.max <= 0 || this.active < this.max)) {\n      const next = this.waiters.shift();\n      if (!next) break;\n      this.active += 1;\n      next.grant();\n    }\n  }\n}\n\ninterface EndpointBackoffState {\n  untilMs: number;\n  consecutiveRateLimits: number;\n}\n\ninterface RateLimitGlobalState {\n  limiter: LocalLlmConcurrencyLimiter;\n  endpoints: Map<string, EndpointBackoffState>;\n}\n\ndeclare global {\n  // Shared across duplicated module copies in bundled output.\n  var __remnicLocalLlmRateLimitState: RateLimitGlobalState | undefined;\n}\n\nfunction globalState(): RateLimitGlobalState {\n  globalThis.__remnicLocalLlmRateLimitState ??= {\n    limiter: new LocalLlmConcurrencyLimiter(DEFAULT_MAX_CONCURRENCY),\n    endpoints: new Map(),\n  };\n  return globalThis.__remnicLocalLlmRateLimitState;\n}\n\n/** Process-wide limiter, resized to the caller's configured cap. */\nexport function getLocalLlmConcurrencyLimiter(maxConcurrency: number): LocalLlmConcurrencyLimiter {\n  const { limiter } = globalState();\n  limiter.setMax(maxConcurrency);\n  return limiter;\n}\n\n/** Milliseconds until `endpoint` may be called again (0 when clear). */\nexport function endpointBackoffRemainingMs(endpoint: string, nowMs: number = Date.now()): number {\n  const entry = globalState().endpoints.get(endpoint);\n  return entry ? Math.max(0, entry.untilMs - nowMs) : 0;\n}\n\n/**\n * Record a rate-limit response for `endpoint`. Returns the consecutive\n * rate-limit count (1-based) to feed the backoff exponent.\n */\nexport function noteEndpointRateLimited(endpoint: string): number {\n  const { endpoints } = globalState();\n  const entry = endpoints.get(endpoint) ?? { untilMs: 0, consecutiveRateLimits: 0 };\n  entry.consecutiveRateLimits += 1;\n  endpoints.set(endpoint, entry);\n  return entry.consecutiveRateLimits;\n}\n\n/** Push the endpoint's \"do not call before\" deadline out to at least `nowMs + delayMs`. */\nexport function extendEndpointBackoff(endpoint: string, delayMs: number, nowMs: number = Date.now()): void {\n  const { endpoints } = globalState();\n  const entry = endpoints.get(endpoint) ?? { untilMs: 0, consecutiveRateLimits: 0 };\n  const bounded = Math.min(MAX_RECORDED_BACKOFF_MS, Math.max(0, delayMs));\n  entry.untilMs = Math.max(entry.untilMs, nowMs + bounded);\n  endpoints.set(endpoint, entry);\n}\n\n/**\n * Reset the backoff exponent after a non-rate-limited response. An already\n * recorded deadline is left to expire so concurrent callers that saw the\n * 429 still wait it out.\n */\nexport function noteEndpointRecovered(endpoint: string): void {\n  const entry = globalState().endpoints.get(endpoint);\n  if (entry) entry.consecutiveRateLimits = 0;\n}\n\n/** Test seam: drop all process-wide state. */\nexport function resetLocalLlmRateLimitStateForTests(): void {\n  const state = globalState();\n  state.endpoints.clear();\n  state.limiter = new LocalLlmConcurrencyLimiter(DEFAULT_MAX_CONCURRENCY);\n}\n\nexport type RateLimitAttemptGate =\n  | { kind: \"go\"; release: () => void }\n  | { kind: \"aborted\" }\n  | { kind: \"skip\"; reason: \"backoff\" | \"queue\"; remainingMs: number };\n\nexport type RateLimitDecision =\n  | { kind: \"not-rate-limited\" }\n  | { kind: \"retry\"; delayMs: number; hintMs: number | null; consecutive: number; retry: number }\n  | { kind: \"give-up\"; delayMs: number; retries: number };\n\n/**\n * Per-request driver for the rate-limit policy. The client calls\n * `beforeAttempt` ahead of every HTTP attempt (waits out the shared endpoint\n * deadline, then takes a concurrency slot) and `onResponse` after every\n * non-ok response.\n */\nexport class LocalLlmRateLimitSession {\n  private retries = 0;\n  private readonly limiter: LocalLlmConcurrencyLimiter;\n  readonly settings: LocalLlmRateLimitSettings;\n\n  /**\n   * @param waitBudgetMs the caller's per-attempt time budget. Waiting for the\n   * endpoint backoff or a concurrency slot never exceeds it, and a backoff\n   * longer than it skips the request instead (fail open to the caller).\n   */\n  constructor(\n    private readonly endpoint: string,\n    settings: LocalLlmRateLimitSettings,\n    private readonly highPriority: boolean,\n    private readonly waitBudgetMs: number = settings.backoffMaxMs\n  ) {\n    this.settings = settings;\n    this.limiter = getLocalLlmConcurrencyLimiter(settings.maxConcurrency);\n  }\n\n  get retryCount(): number {\n    return this.retries;\n  }\n\n  async beforeAttempt(signal?: AbortSignal): Promise<RateLimitAttemptGate> {\n    const deadlineMs = Date.now() + Math.max(0, this.waitBudgetMs);\n    // Recheck the shared deadline after every async wait: another attempt may\n    // have recorded or extended a cooldown while this one slept or queued.\n    for (;;) {\n      const remainingMs = endpointBackoffRemainingMs(this.endpoint);\n      if (remainingMs > 0) {\n        if (remainingMs > Math.min(this.settings.backoffMaxMs, deadlineMs - Date.now())) {\n          return { kind: \"skip\", reason: \"backoff\", remainingMs };\n        }\n        if (!(await waitWithSignal(remainingMs, signal))) return { kind: \"aborted\" };\n        continue;\n      }\n      const release = await this.limiter.acquire({\n        highPriority: this.highPriority,\n        signal,\n        timeoutMs: deadlineMs - Date.now(),\n      });\n      if (!release) return signal?.aborted ? { kind: \"aborted\" } : { kind: \"skip\", reason: \"queue\", remainingMs: 0 };\n      if (endpointBackoffRemainingMs(this.endpoint) > 0) {\n        release();\n        continue;\n      }\n      return { kind: \"go\", release };\n    }\n  }\n\n  onSuccess(): void {\n    noteEndpointRecovered(this.endpoint);\n  }\n\n  onResponse(status: number, retryAfterHeader: string | null | undefined, bodyText: string): RateLimitDecision {\n    if (!isRateLimitedResponse(status, bodyText)) {\n      noteEndpointRecovered(this.endpoint);\n      return { kind: \"not-rate-limited\" };\n    }\n    const consecutive = noteEndpointRateLimited(this.endpoint);\n    const hintMs = serverRetryHintMs(retryAfterHeader, bodyText);\n    const delayMs = computeRateLimitDelayMs(consecutive, this.settings, hintMs);\n    extendEndpointBackoff(this.endpoint, delayMs);\n    if (this.retries >= this.settings.retryCount || delayMs > Math.min(this.settings.backoffMaxMs, this.waitBudgetMs)) {\n      return { kind: \"give-up\", delayMs, retries: this.retries };\n    }\n    this.retries += 1;\n    return { kind: \"retry\", delayMs, hintMs, consecutive, retry: this.retries };\n  }\n}\n\nfunction waitWithSignal(ms: number, signal?: AbortSignal): Promise<boolean> {\n  return new Promise((resolve) => {\n    if (signal?.aborted) {\n      resolve(false);\n      return;\n    }\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      resolve(false);\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve(true);\n    }, ms);\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n"],"mappings":";AAwBO,IAAM,sBAA2C,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AAE/E,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAGnB,IAAM,0BAA0B,KAAK;AAErC,IAAM,iCAAiC;AACvC,IAAM,qCAAqC;AAC3C,IAAM,oCAAoC;AAC1C,IAAM,0BAA0B;AAUvC,SAAS,eAAe,OAA2B,UAA0B;AAC3E,MAAI,UAAU,UAAa,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,QAAO;AACxE,SAAO,KAAK,MAAM,KAAK;AACzB;AAEO,SAAS,yBAAyB,QAKX;AAC5B,QAAM,gBAAgB,KAAK;AAAA,IACzB;AAAA,IACA,eAAe,OAAO,gCAAgC,kCAAkC;AAAA,EAC1F;AACA,QAAM,eAAe,KAAK;AAAA,IACxB;AAAA,IACA,eAAe,OAAO,+BAA+B,iCAAiC;AAAA,EACxF;AACA,SAAO;AAAA,IACL,YAAY,eAAe,OAAO,6BAA6B,8BAA8B;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,gBAAgB,eAAe,OAAO,wBAAwB,uBAAuB;AAAA,EACvF;AACF;AAOO,SAAS,sBAAsB,QAAgB,UAA2B;AAC/E,MAAI,oBAAoB,IAAI,MAAM,EAAG,QAAO;AAC5C,SAAO,UAAU,OAAO,wBAAwB,KAAK,QAAQ;AAC/D;AAMO,SAAS,kBAAkB,OAAkC,QAAgB,KAAK,IAAI,GAAkB;AAC7G,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,gBAAgB,KAAK,OAAO,GAAG;AACjC,WAAO,KAAK,IAAI,yBAAyB,KAAK,MAAM,OAAO,OAAO,IAAI,GAAI,CAAC;AAAA,EAC7E;AACA,QAAM,SAAS,KAAK,MAAM,OAAO;AACjC,MAAI,OAAO,MAAM,MAAM,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,yBAAyB,KAAK,IAAI,GAAG,SAAS,KAAK,CAAC;AACtE;AAGO,SAAS,oBAAoB,UAAiC;AACnE,QAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,MAAI,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AACrC,QAAM,OAAO,MAAM,CAAC,EAAE,YAAY;AAClC,MAAI;AACJ,MAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,OAAO,EAAG,MAAK;AAAA,WACnD,KAAK,WAAW,KAAK,EAAG,MAAK,SAAS;AAAA,MAC1C,MAAK,SAAS;AACnB,SAAO,KAAK,IAAI,yBAAyB,KAAK,MAAM,EAAE,CAAC;AACzD;AAGO,SAAS,kBACd,kBACA,UACA,QAAgB,KAAK,IAAI,GACV;AACf,SAAO,kBAAkB,kBAAkB,KAAK,KAAK,oBAAoB,QAAQ;AACnF;AAMO,SAAS,2BACd,SACA,QACA,OACA,SAAuB,KAAK,QACpB;AACR,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC;AACtD,QAAM,UAAU,KAAK,IAAI,OAAO,SAAS,KAAK,QAAQ;AACtD,SAAO,KAAK,MAAM,OAAO,IAAI,OAAO;AACtC;AAOO,SAAS,wBACd,SACA,UACA,cACA,SAAuB,KAAK,QACpB;AACR,QAAM,WAAW,2BAA2B,SAAS,SAAS,eAAe,SAAS,cAAc,MAAM;AAC1G,SAAO,iBAAiB,OAAO,WAAW,KAAK,IAAI,cAAc,QAAQ;AAC3E;AAKO,IAAM,6BAAN,MAAiC;AAAA,EAC9B,SAAS;AAAA,EACT;AAAA,EACS,UAAoB,CAAC;AAAA,EAEtC,YAAY,KAAa;AACvB,SAAK,MAAM;AAAA,EACb;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM;AACX,SAAK,KAAK;AAAA,EACZ;AAAA,EAEA,IAAI,WAAmB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,SAAiB;AACnB,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QACE,UAAgF,CAAC,GACnD;AAC9B,UAAM,EAAE,QAAQ,UAAU,IAAI;AAC9B,QAAI,QAAQ,QAAS,QAAO,QAAQ,QAAQ,IAAI;AAChD,QAAI,KAAK,OAAO,KAAM,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,WAAW,GAAI;AAC1E,WAAK,UAAU;AACf,aAAO,QAAQ,QAAQ,KAAK,SAAS,CAAC;AAAA,IACxC;AACA,QAAI,cAAc,UAAa,aAAa,EAAG,QAAO,QAAQ,QAAQ,IAAI;AAC1E,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAI;AACJ,YAAM,SAAiB;AAAA,QACrB,cAAc,QAAQ,iBAAiB;AAAA,QACvC,OAAO,MAAM;AACX,kBAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAI,MAAO,cAAa,KAAK;AAC7B,kBAAQ,KAAK,SAAS,CAAC;AAAA,QACzB;AAAA,MACF;AACA,YAAM,UAAU,MAAY;AAC1B,cAAM,QAAQ,KAAK,QAAQ,QAAQ,MAAM;AACzC,YAAI,SAAS,EAAG,MAAK,QAAQ,OAAO,OAAO,CAAC;AAC5C,gBAAQ,oBAAoB,SAAS,OAAO;AAC5C,YAAI,MAAO,cAAa,KAAK;AAC7B,gBAAQ,IAAI;AAAA,MACd;AACA,UAAI,OAAO,cAAc;AACvB,cAAM,WAAW,KAAK,QAAQ,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY;AAC9D,YAAI,WAAW,EAAG,MAAK,QAAQ,KAAK,MAAM;AAAA,YACrC,MAAK,QAAQ,OAAO,UAAU,GAAG,MAAM;AAAA,MAC9C,OAAO;AACL,aAAK,QAAQ,KAAK,MAAM;AAAA,MAC1B;AACA,cAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACzD,UAAI,cAAc,OAAW,SAAQ,WAAW,SAAS,SAAS;AAAA,IACpE,CAAC;AAAA,EACH;AAAA,EAEQ,WAAuB;AAC7B,QAAI,WAAW;AACf,WAAO,MAAM;AACX,UAAI,SAAU;AACd,iBAAW;AACX,WAAK,UAAU;AACf,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEQ,OAAa;AACnB,WAAO,KAAK,QAAQ,SAAS,MAAM,KAAK,OAAO,KAAK,KAAK,SAAS,KAAK,MAAM;AAC3E,YAAM,OAAO,KAAK,QAAQ,MAAM;AAChC,UAAI,CAAC,KAAM;AACX,WAAK,UAAU;AACf,WAAK,MAAM;AAAA,IACb;AAAA,EACF;AACF;AAiBA,SAAS,cAAoC;AAC3C,aAAW,mCAAmC;AAAA,IAC5C,SAAS,IAAI,2BAA2B,uBAAuB;AAAA,IAC/D,WAAW,oBAAI,IAAI;AAAA,EACrB;AACA,SAAO,WAAW;AACpB;AAGO,SAAS,8BAA8B,gBAAoD;AAChG,QAAM,EAAE,QAAQ,IAAI,YAAY;AAChC,UAAQ,OAAO,cAAc;AAC7B,SAAO;AACT;AAGO,SAAS,2BAA2B,UAAkB,QAAgB,KAAK,IAAI,GAAW;AAC/F,QAAM,QAAQ,YAAY,EAAE,UAAU,IAAI,QAAQ;AAClD,SAAO,QAAQ,KAAK,IAAI,GAAG,MAAM,UAAU,KAAK,IAAI;AACtD;AAMO,SAAS,wBAAwB,UAA0B;AAChE,QAAM,EAAE,UAAU,IAAI,YAAY;AAClC,QAAM,QAAQ,UAAU,IAAI,QAAQ,KAAK,EAAE,SAAS,GAAG,uBAAuB,EAAE;AAChF,QAAM,yBAAyB;AAC/B,YAAU,IAAI,UAAU,KAAK;AAC7B,SAAO,MAAM;AACf;AAGO,SAAS,sBAAsB,UAAkB,SAAiB,QAAgB,KAAK,IAAI,GAAS;AACzG,QAAM,EAAE,UAAU,IAAI,YAAY;AAClC,QAAM,QAAQ,UAAU,IAAI,QAAQ,KAAK,EAAE,SAAS,GAAG,uBAAuB,EAAE;AAChF,QAAM,UAAU,KAAK,IAAI,yBAAyB,KAAK,IAAI,GAAG,OAAO,CAAC;AACtE,QAAM,UAAU,KAAK,IAAI,MAAM,SAAS,QAAQ,OAAO;AACvD,YAAU,IAAI,UAAU,KAAK;AAC/B;AAOO,SAAS,sBAAsB,UAAwB;AAC5D,QAAM,QAAQ,YAAY,EAAE,UAAU,IAAI,QAAQ;AAClD,MAAI,MAAO,OAAM,wBAAwB;AAC3C;AAGO,SAAS,sCAA4C;AAC1D,QAAM,QAAQ,YAAY;AAC1B,QAAM,UAAU,MAAM;AACtB,QAAM,UAAU,IAAI,2BAA2B,uBAAuB;AACxE;AAkBO,IAAM,2BAAN,MAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpC,YACmB,UACjB,UACiB,cACA,eAAuB,SAAS,cACjD;AAJiB;AAEA;AACA;AAEjB,SAAK,WAAW;AAChB,SAAK,UAAU,8BAA8B,SAAS,cAAc;AAAA,EACtE;AAAA,EAPmB;AAAA,EAEA;AAAA,EACA;AAAA,EAbX,UAAU;AAAA,EACD;AAAA,EACR;AAAA,EAiBT,IAAI,aAAqB;AACvB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,cAAc,QAAqD;AACvE,UAAM,aAAa,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,YAAY;AAG7D,eAAS;AACP,YAAM,cAAc,2BAA2B,KAAK,QAAQ;AAC5D,UAAI,cAAc,GAAG;AACnB,YAAI,cAAc,KAAK,IAAI,KAAK,SAAS,cAAc,aAAa,KAAK,IAAI,CAAC,GAAG;AAC/E,iBAAO,EAAE,MAAM,QAAQ,QAAQ,WAAW,YAAY;AAAA,QACxD;AACA,YAAI,CAAE,MAAM,eAAe,aAAa,MAAM,EAAI,QAAO,EAAE,MAAM,UAAU;AAC3E;AAAA,MACF;AACA,YAAM,UAAU,MAAM,KAAK,QAAQ,QAAQ;AAAA,QACzC,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,WAAW,aAAa,KAAK,IAAI;AAAA,MACnC,CAAC;AACD,UAAI,CAAC,QAAS,QAAO,QAAQ,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,MAAM,QAAQ,QAAQ,SAAS,aAAa,EAAE;AAC7G,UAAI,2BAA2B,KAAK,QAAQ,IAAI,GAAG;AACjD,gBAAQ;AACR;AAAA,MACF;AACA,aAAO,EAAE,MAAM,MAAM,QAAQ;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,YAAkB;AAChB,0BAAsB,KAAK,QAAQ;AAAA,EACrC;AAAA,EAEA,WAAW,QAAgB,kBAA6C,UAAqC;AAC3G,QAAI,CAAC,sBAAsB,QAAQ,QAAQ,GAAG;AAC5C,4BAAsB,KAAK,QAAQ;AACnC,aAAO,EAAE,MAAM,mBAAmB;AAAA,IACpC;AACA,UAAM,cAAc,wBAAwB,KAAK,QAAQ;AACzD,UAAM,SAAS,kBAAkB,kBAAkB,QAAQ;AAC3D,UAAM,UAAU,wBAAwB,aAAa,KAAK,UAAU,MAAM;AAC1E,0BAAsB,KAAK,UAAU,OAAO;AAC5C,QAAI,KAAK,WAAW,KAAK,SAAS,cAAc,UAAU,KAAK,IAAI,KAAK,SAAS,cAAc,KAAK,YAAY,GAAG;AACjH,aAAO,EAAE,MAAM,WAAW,SAAS,SAAS,KAAK,QAAQ;AAAA,IAC3D;AACA,SAAK,WAAW;AAChB,WAAO,EAAE,MAAM,SAAS,SAAS,QAAQ,aAAa,OAAO,KAAK,QAAQ;AAAA,EAC5E;AACF;AAEA,SAAS,eAAe,IAAY,QAAwC;AAC1E,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,QAAQ,SAAS;AACnB,cAAQ,KAAK;AACb;AAAA,IACF;AACA,UAAM,UAAU,MAAY;AAC1B,mBAAa,KAAK;AAClB,cAAQ,KAAK;AAAA,IACf;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ,IAAI;AAAA,IACd,GAAG,EAAE;AACL,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,EAC3D,CAAC;AACH;","names":[]}