@remnic/core 10.0.59 → 10.0.60

package/src/corpus-scan.ts

@@ -0,0 +1,215 @@
+/**
+ * Corpus maintenance scans (the pure, read-only filesystem work the daemon
+ * runs periodically).
+ *
+ * Three scans live here, all of them corpus-sized:
+ *   - the recall-corpus path walk (hot + cold tiers);
+ *   - the entity-entry fingerprint the canonical-id migration reads on every
+ *     entity unlock;
+ *   - the watermark's freshness stat over the newest hot partition.
+ *
+ * They are plain functions over plain inputs so the corpus-scan worker can run
+ * them off the main event loop: `src/corpus-scan-worker.entry.ts` is bundled
+ * into a plain-JavaScript worker entry (`src/corpus-scan-worker.entry.mjs`,
+ * generated — see scripts/sync-corpus-scan-worker.mjs) and the host falls back
+ * to these functions inline when a worker cannot start. One implementation,
+ * two execution sites, identical results.
+ */
+
+import type { Dirent, Stats } from "node:fs";
+import { createHash } from "node:crypto";
+import { lstat, readdir, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { isErrnoCode } from "./utils/errno.js";
+import { isMacOsReplicationJunkBasename } from "./utils/macos-replication-junk.js";
+
+/** An errno-carrying filesystem failure. */
+export type ErrnoFailure = NodeJS.ErrnoException;
+
+/**
+ * A backend READ failure worth propagating from a strict (census) scan: an
+ * errno-coded fs error that is NOT `ENOENT`. `ENOENT` (an absent dir) and
+ * code-less rejections are expected and skipped; `EACCES`/`EIO`/… mean the
+ * corpus is unreadable and a divergence census must fail loud rather than
+ * silently publish a partial count (issue #2156 round-5). Non-strict (recall)
+ * callers ignore this and degrade to a best-effort partial scan.
+ */
+export function isPropagatableReadError(error: ErrnoFailure): boolean {
+  return error.code !== undefined && error.code !== "ENOENT";
+}
+
+export interface CorpusScanWalkOptions {
+  /** Memory root the walk is contained in. */
+  baseDir: string;
+  /** Directories to walk (category roots, cold root, archive root). */
+  startDirs: readonly string[];
+  /** Strict mode: backend read failures propagate instead of being skipped. */
+  propagateReadErrors?: boolean;
+  /**
+   * Cancellation check at every directory/entry boundary. The inline reader
+   * passes the corpus-read abort check; the worker passes its cancel flag.
+   */
+  checkCancelled?(): void;
+}
+
+/**
+ * Recursively collect `*.md` paths under `startDirs`. Paths only — no
+ * frontmatter parse. Never throws for a missing root (an empty result), and
+ * throws in strict mode when a backend read failure makes the corpus
+ * unreadable.
+ *
+ * Containment is established once, not per file: the memory root is resolved
+ * with a single `realpath`, every directory the walk enters is `lstat`ed (a
+ * symlinked or non-directory entry is never followed), and the entry TYPE
+ * comes from `readdir(withFileTypes)` — so a symlinked entry, file or
+ * directory, is skipped without a per-entry `realpath`. Reads refuse
+ * symlinked files at open time with `O_NOFOLLOW`, so a path swapped to a
+ * symlink mid-scan is refused rather than followed.
+ */
+export async function collectContainedMarkdownPaths(options: CorpusScanWalkOptions): Promise<string[]> {
+  const { baseDir, startDirs, propagateReadErrors = false, checkCancelled } = options;
+  const filePaths: string[] = [];
+
+  // Resolve the memory root once: a missing root is an empty corpus and an
+  // unreadable root is a backend failure the strict census must surface.
+  try {
+    await realpath(baseDir);
+  } catch (error) {
+    // SAFETY: node:fs/promises rejects with an Error; the errno `code` is
+    // optional on that type, so this adds no unchecked claim.
+    const failure = error as ErrnoFailure;
+    // ENOENT: a not-yet-created root ⇒ empty. Any other errno is a backend
+    // read failure — propagate for strict census callers (never publish an
+    // unreadable corpus as empty); non-strict (recall) callers degrade.
+    if (propagateReadErrors && isPropagatableReadError(failure)) throw error;
+    return filePaths;
+  }
+
+  const collectPaths = async (dir: string): Promise<void> => {
+    checkCancelled?.();
+    // Directory-level guard, isolated from per-entry handling: skip symlinked
+    // or non-directory category dirs. A failure here means the whole subtree
+    // does not exist or escaped the store — fail closed by skipping it.
+    let dirStat: Stats;
+    try {
+      dirStat = await lstat(dir);
+    } catch (error) {
+      // SAFETY: node:fs/promises rejects with an Error; `code` is optional.
+      const failure = error as ErrnoFailure;
+      // ENOENT (absent category dir) is expected; a backend read error
+      // (EACCES/EIO/…) propagates in strict census mode.
+      if (propagateReadErrors && isPropagatableReadError(failure)) throw error;
+      return;
+    }
+    if (dirStat.isSymbolicLink()) return; // never follow symlinks out of the store (both modes)
+    if (!dirStat.isDirectory()) {
+      // A category root that EXISTS but is not a directory (e.g. `facts/`
+      // replaced by a regular file) is a layout/backend failure: a strict
+      // census must not silently publish the remaining categories as healthy.
+      // Non-strict (recall) stays best-effort and skips it (issue #2156 round-10).
+      if (propagateReadErrors) {
+        throw new Error(`corpus scan: expected a directory but found a non-directory at ${dir}`);
+      }
+      return;
+    }
+    let entries: Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch (error) {
+      // SAFETY: node:fs/promises rejects with an Error; `code` is optional.
+      const failure = error as ErrnoFailure;
+      // A backend read error (EACCES …) propagates in strict census mode so a
+      // partial subtree is not silently counted. ENOENT (vanished mid-scan)
+      // and other non-propagatable failures skip the directory.
+      if (propagateReadErrors && isPropagatableReadError(failure)) throw error;
+      return;
+    }
+
+    const subdirs: string[] = [];
+    for (const entry of entries) {
+      // Outside the per-entry handling below, which deliberately swallows
+      // non-propagatable errors — a cancellation must never be swallowed with
+      // them (issue #2307).
+      checkCancelled?.();
+      // Never follow symlinked entries out of the store.
+      if (entry.isSymbolicLink()) continue;
+      if (isMacOsReplicationJunkBasename(entry.name)) continue;
+      const fullPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        subdirs.push(fullPath);
+      } else if (entry.name.endsWith(".md")) {
+        filePaths.push(fullPath);
+      }
+    }
+    // Recurse into real subdirectories regardless of any single poisoned entry
+    // above, so valid nested in-store memories are never dropped.
+    for (const subdir of subdirs) {
+      await collectPaths(subdir);
+    }
+  };
+
+  for (const dir of startDirs) {
+    await collectPaths(dir);
+  }
+  // A signal that fired during the last directory read would otherwise return a
+  // truncated path list as if it were the whole corpus (issue #2307 review).
+  checkCancelled?.();
+  return filePaths;
+}
+
+/**
+ * Fingerprint of the entity entries a migration's completion verdict depends
+ * on: the sorted entry names plus each entry's identity and timestamps. Two
+ * runs over the same entries produce the same string, and an in-place edit of
+ * an entity file changes it.
+ */
+export async function fingerprintEntityEntries(entitiesDir: string): Promise<string> {
+  let names: string[];
+  try {
+    names = (await readdir(entitiesDir))
+      .filter((name) => path.extname(name) === ".md" && !isMacOsReplicationJunkBasename(name))
+      .sort();
+  } catch (error) {
+    if (isErrnoCode(error, "ENOENT")) return "missing";
+    throw error;
+  }
+  const hash = createHash("sha256");
+  for (const name of names) {
+    hash.update(`${name.length}:${name}:`);
+    try {
+      const entry = await lstat(path.join(entitiesDir, name), { bigint: true });
+      hash.update(`${entry.dev}:${entry.ino}:${entry.size}:${entry.mtimeNs}:${entry.ctimeNs}`);
+    } catch (error) {
+      if (!isErrnoCode(error, "ENOENT")) throw error;
+      hash.update("missing");
+    }
+    hash.update("\n");
+  }
+  return hash.digest("hex");
+}
+
+/**
+ * Stat a batch of files and return their mtimes, `null` for files that
+ * vanished (ENOENT). A backend read failure (EACCES/EIO/…) throws with its
+ * errno code intact so the caller can omit an unreadable corpus instead of
+ * publishing a stale freshness value.
+ */
+export async function statMtimes(paths: readonly string[]): Promise<Array<number | null>> {
+  const results: Array<number | null> = new Array(paths.length).fill(null);
+  // Fixed-size batches: an unbounded Promise.all submits one libuv operation
+  // per file at once, and the worker and main thread share that threadpool, so
+  // a large bulk import would delay every other filesystem operation.
+  const STAT_BATCH_SIZE = 256;
+  for (let start = 0; start < paths.length; start += STAT_BATCH_SIZE) {
+    await Promise.all(paths.slice(start, start + STAT_BATCH_SIZE).map(async (filePath, offset) => {
+      try {
+        const entry = await stat(filePath);
+        results[start + offset] = entry.mtimeMs;
+      } catch (error) {
+        if (isErrnoCode(error, "ENOENT")) return;
+        throw error;
+      }
+    }));
+  }
+  return results;
+}

package/src/corpus-watermark.ts

@@ -37,10 +37,11 @@
  */
 
 import { createHash } from "node:crypto";
-import { stat } from "node:fs/promises";
 import path from "node:path";
+import { setImmediate as yieldToEventLoop } from "node:timers/promises";
 import { capabilityAllowsNamespace, type TokenCapabilities } from "./access-token-capabilities.js";
 import { listNamespaces } from "./namespaces/migrate.js";
+import { corpusScanWorker } from "./corpus-scan-worker-host.js";
 import type { PluginConfig } from "./types.js";
 
 export interface CorpusWatermark {
@@ -67,6 +68,9 @@ export const UNPARTITIONED_BUCKET = "unpartitioned";
 /** Storage tier a memory file lives in. */
 export type CorpusTier = "hot" | "cold";
 
+/** Paths parsed between event-loop yields while building a census. */
+const CENSUS_YIELD_EVERY = 4_096;
+
 const DAY_PARTITION_RE = /^\d{4}-\d{2}-\d{2}$/;
 /** Cold-tier root segment (relative to a namespace base dir): `<baseDir>/cold/...`. */
 const COLD_TIER_DIR = "cold";
@@ -155,7 +159,17 @@ export async function computeCorpusWatermark(input: {
   const census = new Map<string, number>();
   let newestPartition: string | null = null;
   const parsedByPath: ParsedPath[] = [];
+  let sinceYield = 0;
   for (const filePath of paths) {
+    // Parsing one path is cheap, but a census covers the whole corpus (100k+
+    // paths): one uninterrupted pass holds the main thread for hundreds of
+    // milliseconds. Yield to the event loop every CENSUS_YIELD_EVERY paths so
+    // observe/recall interleave; the result is order-independent and identical.
+    if (sinceYield >= CENSUS_YIELD_EVERY) {
+      sinceYield = 0;
+      await yieldToEventLoop();
+    }
+    sinceYield += 1;
     const parsed = parsePartition(baseDir, filePath);
     parsedByPath.push(parsed);
     census.set(parsed.bucket, (census.get(parsed.bucket) ?? 0) + 1);
@@ -171,19 +185,21 @@ export async function computeCorpusWatermark(input: {
 
   let newestWriteAt: string | null = null;
   if (newestPartition !== null) {
-    let maxMtimeMs = Number.NEGATIVE_INFINITY;
+    const newestPaths: string[] = [];
     for (let i = 0; i < paths.length; i += 1) {
       if (parsedByPath[i].tier !== "hot" || parsedByPath[i].date !== newestPartition) continue;
-      try {
-        const st = await stat(paths[i]);
-        if (st.mtimeMs > maxMtimeMs) maxMtimeMs = st.mtimeMs;
-      } catch (err) {
-        // A file vanishing between scan and stat (ENOENT) is an expected race —
-        // skip it. A backend read failure (EACCES/EIO/…) means the corpus is
-        // unreadable: propagate so the namespace is omitted, not published with
-        // a stale/null freshness (issue #2156 round-6).
-        if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
-      }
+      newestPaths.push(paths[i]);
+    }
+    // The freshness sweep is one stat per file in the newest hot partition; it
+    // runs in the corpus-scan worker so the periodic census does not spend
+    // main-thread time on a per-file syscall sweep. A file that vanished
+    // (ENOENT) reports null; a backend read failure (EACCES/EIO/…) propagates
+    // with its errno code so the namespace is omitted, not published with a
+    // stale/null freshness (issue #2156 round-6).
+    const mtimes = await corpusScanWorker.request({ kind: "stat-mtimes", paths: newestPaths });
+    let maxMtimeMs = Number.NEGATIVE_INFINITY;
+    for (const mtimeMs of mtimes) {
+      if (mtimeMs !== null && mtimeMs > maxMtimeMs) maxMtimeMs = mtimeMs;
     }
     if (maxMtimeMs > Number.NEGATIVE_INFINITY) {
       newestWriteAt = new Date(maxMtimeMs).toISOString();

package/src/storage/entity-canonical-id-migration.ts

@@ -13,6 +13,7 @@ import {
 import path from "node:path";
 import { lstatSync, readFileSync } from "node:fs";
 import { z } from "zod";
+import { corpusScanWorker } from "../corpus-scan-worker-host.js";
 import { computeSupersessionKey, normalizeSupersessionKey } from "../temporal-supersession.js";
 import type { EntityFile, MemoryFile } from "../types.js";
 import { log } from "../logger.js";
@@ -102,31 +103,6 @@ async function fingerprintPath(filePath: string): Promise<string> {
     : "missing";
 }
 
-async function fingerprintEntityEntries(entitiesDir: string): Promise<string> {
-  let names: string[];
-  try {
-    names = (await readdir(entitiesDir))
-      .filter((name) => path.extname(name) === ".md" && !isMacOsReplicationJunkBasename(name))
-      .sort();
-  } catch (error) {
-    if (isErrnoCode(error, "ENOENT")) return "missing";
-    throw error;
-  }
-  const hash = createHash("sha256");
-  for (const name of names) {
-    hash.update(`${name.length}:${name}:`);
-    try {
-      const entry = await lstat(path.join(entitiesDir, name), { bigint: true });
-      hash.update(`${entry.dev}:${entry.ino}:${entry.size}:${entry.mtimeNs}:${entry.ctimeNs}`);
-    } catch (error) {
-      if (!isErrnoCode(error, "ENOENT")) throw error;
-      hash.update("missing");
-    }
-    hash.update("\n");
-  }
-  return hash.digest("hex");
-}
-
 /**
  * Completion fingerprint for migration inputs only. Entity entry identities
  * catch same-path edits that do not change the directory inode; the cooperative
@@ -146,7 +122,9 @@ export async function getFingerprint(
     consumingFingerprint,
   ] = await Promise.all([
     fingerprintPath(entitiesDir),
-    fingerprintEntityEntries(entitiesDir),
+    // The entry enumeration is one lstat per entity file — a corpus-sized
+    // syscall storm on the main thread. It runs in the corpus-scan worker.
+    corpusScanWorker.request({ kind: "entity-entries-fingerprint", entitiesDir }),
     fingerprintPath(path.join(baseDir, "config", "aliases.json")),
     fingerprintPath(path.join(baseDir, "state", ENTITY_CANONICAL_ID_RECONCILE_MARKER)),
     fingerprintPath(path.join(baseDir, "state", ENTITY_CANONICAL_ID_RECONCILE_CONSUMING_MARKER)),

package/src/storage/memory-read-store.ts

@@ -10,7 +10,7 @@
  */
 
 import type { Dirent, Stats } from "node:fs";
-import { lstat, readdir, realpath, stat } from "node:fs/promises";
+import { lstat, readdir, stat } from "node:fs/promises";
 import path from "node:path";
 import { toMemoryPathRel } from "../memory-lifecycle-ledger-utils.js";
 import { SecureStoreLockedError, readMaybeEncryptedFile } from "../secure-store/secure-fs.js";
@@ -30,6 +30,7 @@ import {
   StorageManager,
 } from "../storage.js";
 import { rememberRawFrontmatter } from "./memory-frontmatter-metadata.js";
+import { corpusScanWorker } from "../corpus-scan-worker-host.js";
 
 export interface MemoryReadStoreDeps {
   /** Live class object of the host instance — shared static caches (see storage.ts storageManagerClass). */
@@ -85,19 +86,6 @@ export interface MemoryReadStoreDeps {
   readonly wearablesDir: string;
 }
 
-/**
- * A backend READ failure worth propagating from a strict (census) scan: an
- * errno-coded fs error that is NOT `ENOENT`. `ENOENT` (an absent dir) and
- * code-less rejections are expected and skipped; `EACCES`/`EIO`/… mean the
- * corpus is unreadable and a divergence census must fail loud rather than
- * silently publish a partial count (issue #2156 round-5). Non-strict (recall)
- * callers ignore this and degrade to a best-effort partial scan.
- */
-function isPropagatableReadError(err: unknown): boolean {
-  const code = (err as NodeJS.ErrnoException).code;
-  return typeof code === "string" && code !== "ENOENT";
-}
-
 /**
  * Markdown under this store's `entities/` directory. The first relative
  * segment must be `entities`; a memory root whose absolute path contains
@@ -233,15 +221,11 @@ export class MemoryReadStore {
    * escape: a category dir symlinked outside memoryDir (e.g. decisions/ -> an
    * external dir) must NOT pull out-of-store files into a scan (info leak).
    *
-   * Containment is established once, not per file: the memory root is resolved
-   * with a single `realpath`, every directory the walk enters is `lstat`ed (a
-   * symlinked or non-directory entry is never followed), and the entry TYPE
-   * comes from `readdir(withFileTypes)` — so a symlinked entry, file or
-   * directory, is skipped without a per-entry `realpath`. The old per-entry
-   * `realpath` cost one syscall per markdown file (hundreds of thousands per
-   * corpus scan) to re-derive a fact the directory-level checks already
-   * establish; reads refuse symlinked files at open time with `O_NOFOLLOW`, so
-   * a path swapped to a symlink mid-scan is refused rather than followed.
+   * The walk runs in the corpus-scan worker: it is one `readdir` + `lstat` per
+   * directory over the whole corpus, and on the main event loop that starves
+   * observe, recall and the extraction queue behind it. The implementation is
+   * shared (src/corpus-scan.ts) and the host runs it inline when no worker
+   * can start, so the collected path set is the same either way.
    * Paths only — no frontmatter parse.
    */
   private async collectContainedMarkdownPaths(
@@ -249,82 +233,16 @@ export class MemoryReadStore {
     propagateReadErrors = false,
     options?: CorpusReadOptions,
   ): Promise<string[]> {
-        const filePaths: string[] = [];
-
-    // Resolve the memory root once: a missing root is an empty corpus and an
-    // unreadable root is a backend failure the strict census must surface.
-    try {
-      await realpath(this.deps.baseDir);
-    } catch (err) {
-      // ENOENT: a not-yet-created root ⇒ empty. Any other errno is a backend
-      // read failure — propagate for strict census callers (never publish an
-      // unreadable corpus as empty); non-strict (recall) callers degrade.
-      if (propagateReadErrors && isPropagatableReadError(err)) throw err;
-      return filePaths;
-    }
-
-    const collectPaths = async (dir: string): Promise<void> => {
-      checkCorpusReadAbort(options);
-      // Directory-level guard, isolated from per-entry handling: skip symlinked
-      // or non-directory category dirs. A failure here means the whole subtree
-      // does not exist or escaped the store — fail closed by skipping it.
-      let dirStat: Stats;
-      try {
-        dirStat = await lstat(dir);
-      } catch (err) {
-        // ENOENT (absent category dir) is expected; a backend read error
-        // (EACCES/EIO/…) propagates in strict census mode.
-        if (propagateReadErrors && isPropagatableReadError(err)) throw err;
-        return;
-      }
-      if (dirStat.isSymbolicLink()) return; // never follow symlinks out of the store (both modes)
-      if (!dirStat.isDirectory()) {
-        // A category root that EXISTS but is not a directory (e.g. `facts/`
-        // replaced by a regular file) is a layout/backend failure: a strict
-        // census must not silently publish the remaining categories as healthy.
-        // Non-strict (recall) stays best-effort and skips it (issue #2156 round-10).
-        if (propagateReadErrors) {
-          throw new Error(`corpus scan: expected a directory but found a non-directory at ${dir}`);
-        }
-        return;
-      }
-      let entries: Dirent[];
-      try {
-        entries = await readdir(dir, { withFileTypes: true });
-      } catch (err) {
-        // A backend read error (EACCES …) propagates in strict census mode so a
-        // partial subtree is not silently counted. ENOENT (vanished mid-scan)
-        // and other non-propagatable failures skip the directory.
-        if (propagateReadErrors && isPropagatableReadError(err)) throw err;
-        return;
-      }
-
-      const subdirs: string[] = [];
-      for (const entry of entries) {
-        // Outside the per-entry handling below, which deliberately swallows
-        // non-propagatable errors — a cancellation must never be swallowed with
-        // them (issue #2307).
-        checkCorpusReadAbort(options);
-        // Never follow symlinked entries out of the store.
-        if (entry.isSymbolicLink()) continue;
-        if (isMacOsReplicationJunkBasename(entry.name)) continue;
-        const fullPath = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-          subdirs.push(fullPath);
-        } else if (entry.name.endsWith(".md")) {
-          filePaths.push(fullPath);
-        }
-      }
-      // Recurse into real subdirectories regardless of any single poisoned entry
-      // above, so valid nested in-store memories are never dropped.
-      for (const subdir of subdirs) {
-        await collectPaths(subdir);
-      }
-    };
-
-    for (const dir of startDirs) {
-      await collectPaths(dir);
-    }
+    checkCorpusReadAbort(options);
+    const filePaths = await corpusScanWorker.request(
+      {
+        kind: "walk",
+        baseDir: this.deps.baseDir,
+        startDirs: [...startDirs],
+        propagateReadErrors,
+      },
+      options?.abortSignal,
+    );
     // A signal that fired during the last directory read would otherwise return a
     // truncated path list as if it were the whole corpus (issue #2307 review).
     checkCorpusReadAbort(options);

package/dist/chunk-5U2BBF7E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/corpus-watermark.ts"],"sourcesContent":["/**\n * Corpus watermark (issue #2149) — a cheap, comparable fingerprint of a\n * daemon's active-memory corpus.\n *\n * Deployment shape this addresses: two daemons behind an active/backup VIP,\n * each owning its own memory directory. Nothing compared the two corpora, so a\n * pair could diverge for months (e.g. one holding ~190k files, its backup\n * ~340k with different histories) with no signal until a manual audit. This\n * module ships the WATERMARK primitive and the read surfaces that expose it;\n * peer polling and divergence alerting are a follow-up.\n *\n * The digest is a CENSUS fingerprint (per day-partition file counts), NOT a\n * content hash — two daemons that agree on how many memory FILES live in\n * each `<tier>:<category>/<day>` partition produce the same digest, so a\n * differing digest is a cheap divergence signal without reading or hashing file\n * bodies. Buckets are tier-aware (`hot:` / `cold:`): demoted memories stay\n * reachable via cold recall, so the census counts BOTH tiers and a hot/cold\n * split shows in the digest rather than being silently folded together (issue\n * #2156 finding D). `newestWriteAt` stays scoped to the newest HOT partition\n * only, so the freshness probe stays O(one day's active files) even on a 100k+\n * corpus.\n *\n * Robustness (issue #2156 review rounds):\n * - `/health` and `remnic doctor` resolve their namespace set through the ONE\n *   {@link resolveCorpusNamespaceRoots} helper — config-driven enumeration\n *   unioned with the PERSISTED namespace catalog read from config — so both\n *   surfaces enumerate the same tenants and cannot drift.\n * - The `/health` builder serves through a stale-while-revalidate\n *   {@link CorpusWatermarkCache}, so a probe NEVER awaits the recursive corpus\n *   scan (it returns the cached/stale value and refreshes in the background).\n * - Each namespace's census brackets its hot+cold walk with a corpus-mutation\n *   sentinel and retries when a tier migration races it, so a transient\n *   double-count/miss is never cached as a false divergence.\n * - An unreadable corpus root (EACCES) is OMITTED, not published as a false\n *   empty; a missing root (ENOENT — a not-yet-created namespace) is a genuine\n *   empty corpus.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { stat } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { capabilityAllowsNamespace, type TokenCapabilities } from \"./access-token-capabilities.js\";\nimport { listNamespaces } from \"./namespaces/migrate.js\";\nimport type { PluginConfig } from \"./types.js\";\n\nexport interface CorpusWatermark {\n  namespace: string;\n  /**\n   * Count of memory files under the census scan roots (hot + cold). This is a\n   * FILE census, not a status-filtered active count: reading each file's\n   * frontmatter status would defeat the cheap-probe design, so an in-place\n   * status change (e.g. archived-in-place) is not reflected here.\n   */\n  memoryFileCount: number;\n  /** Newest `YYYY-MM-DD` day-partition seen in the HOT tier, or null when none is dated. */\n  newestPartition: string | null;\n  /** ISO max mtime within the newest HOT partition, or null when it has no files. */\n  newestWriteAt: string | null;\n  /** sha256 hex over the deterministic per-partition census. */\n  digest: string;\n  computedAt: string;\n}\n\n/** Explicit bucket for paths that do not match the `<category>/<day>` shape. */\nexport const UNPARTITIONED_BUCKET = \"unpartitioned\";\n\n/** Storage tier a memory file lives in. */\nexport type CorpusTier = \"hot\" | \"cold\";\n\nconst DAY_PARTITION_RE = /^\\d{4}-\\d{2}-\\d{2}$/;\n/** Cold-tier root segment (relative to a namespace base dir): `<baseDir>/cold/...`. */\nconst COLD_TIER_DIR = \"cold\";\n\n/**\n * True when `token` is not just `YYYY-MM-DD`-shaped but a REAL calendar day.\n * The regex alone accepts impossible dates (e.g. `2026-99-99`) that would then\n * sort lexically above every valid partition and corrupt `newestPartition`\n * (issue #2156 round-6); round-tripping through a UTC Date rejects month/day\n * overflow. A malformed dir falls back to the unpartitioned bucket.\n */\nfunction isRealCalendarDay(token: string): boolean {\n  if (!DAY_PARTITION_RE.test(token)) return false;\n  const [year, month, day] = token.split(\"-\").map(Number);\n  const date = new Date(Date.UTC(year, month - 1, day));\n  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;\n}\n\ninterface ParsedPath {\n  readonly bucket: string;\n  readonly date: string | null;\n  readonly tier: CorpusTier;\n}\n\nfunction parsePartition(baseDir: string, filePath: string): ParsedPath {\n  const rel = path.relative(baseDir, filePath).split(path.sep).join(\"/\");\n  const parts = rel.split(\"/\");\n  // Cold-tier files live under `<baseDir>/cold/<category>/<day>/...`; hot files\n  // sit directly under `<baseDir>/<category>/<day>/...`. Strip the leading\n  // `cold/` segment so the category/day parse is tier-agnostic, then prefix the\n  // bucket with the tier so a hot and cold partition of the same day never\n  // collide (they must diverge the digest, not fold together).\n  const tier: CorpusTier = parts[0] === COLD_TIER_DIR ? \"cold\" : \"hot\";\n  const categoryParts = tier === \"cold\" ? parts.slice(1) : parts;\n  if (categoryParts.length >= 2 && isRealCalendarDay(categoryParts[1])) {\n    return { bucket: `${tier}:${categoryParts[0]}/${categoryParts[1]}`, date: categoryParts[1], tier };\n  }\n  return { bucket: `${tier}:${UNPARTITIONED_BUCKET}`, date: null, tier };\n}\n\n/**\n * Build the per-partition census: bucket key -> file count. Bucket keys are\n * tier-aware (`hot:`/`cold:`). Paths not matching a day-partition land in the\n * explicit tier {@link UNPARTITIONED_BUCKET}; they are never silently dropped.\n * Pure — no filesystem access.\n */\nexport function buildPartitionCensus(paths: readonly string[], baseDir: string): Map<string, number> {\n  const census = new Map<string, number>();\n  for (const filePath of paths) {\n    const { bucket } = parsePartition(baseDir, filePath);\n    census.set(bucket, (census.get(bucket) ?? 0) + 1);\n  }\n  return census;\n}\n\n/**\n * Deterministic census -> digest. Bucket keys are SORTED before serialization\n * (AGENTS.md pattern 26: insertion order must not affect a hash), then emitted\n * as `\"<bucket>:<count>\"` lines joined by `\\n` and hashed with sha256. Pure —\n * separately exported so it can be unit-tested without a filesystem.\n */\nexport function digestPartitionCensus(census: ReadonlyMap<string, number> | Record<string, number>): string {\n  const entries = census instanceof Map ? [...census.entries()] : Object.entries(census);\n  const serialized = entries\n    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n    .map(([bucket, count]) => `${bucket}:${count}`)\n    .join(\"\\n\");\n  return createHash(\"sha256\").update(serialized).digest(\"hex\");\n}\n\n/**\n * Compute a watermark for a single namespace from an already-collected path\n * list (both tiers, under `baseDir`) plus its memory base directory. Never\n * throws on an empty list — an empty corpus yields the digest of the empty\n * census and null timestamps. Only the newest HOT partition's files are\n * `stat`-ed, so freshness stays cheap even on a 100k+ corpus.\n */\nexport async function computeCorpusWatermark(input: {\n  namespace: string;\n  paths: readonly string[];\n  baseDir: string;\n  now?: Date;\n}): Promise<CorpusWatermark> {\n  const { namespace, paths, baseDir } = input;\n\n  const census = new Map<string, number>();\n  let newestPartition: string | null = null;\n  const parsedByPath: ParsedPath[] = [];\n  for (const filePath of paths) {\n    const parsed = parsePartition(baseDir, filePath);\n    parsedByPath.push(parsed);\n    census.set(parsed.bucket, (census.get(parsed.bucket) ?? 0) + 1);\n    // Freshness is the newest ACTIVE (hot) write. Cold memories are demoted and\n    // keep their original (older) partition date, so they never advance the\n    // freshness probe and their files are never stat-ed below.\n    if (parsed.tier === \"hot\" && parsed.date !== null && (newestPartition === null || parsed.date > newestPartition)) {\n      newestPartition = parsed.date;\n    }\n  }\n\n  const digest = digestPartitionCensus(census);\n\n  let newestWriteAt: string | null = null;\n  if (newestPartition !== null) {\n    let maxMtimeMs = Number.NEGATIVE_INFINITY;\n    for (let i = 0; i < paths.length; i += 1) {\n      if (parsedByPath[i].tier !== \"hot\" || parsedByPath[i].date !== newestPartition) continue;\n      try {\n        const st = await stat(paths[i]);\n        if (st.mtimeMs > maxMtimeMs) maxMtimeMs = st.mtimeMs;\n      } catch (err) {\n        // A file vanishing between scan and stat (ENOENT) is an expected race —\n        // skip it. A backend read failure (EACCES/EIO/…) means the corpus is\n        // unreadable: propagate so the namespace is omitted, not published with\n        // a stale/null freshness (issue #2156 round-6).\n        if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n      }\n    }\n    if (maxMtimeMs > Number.NEGATIVE_INFINITY) {\n      newestWriteAt = new Date(maxMtimeMs).toISOString();\n    }\n  }\n\n  // Stamp AFTER the (possibly slow) stat loop so an age-based HA consumer never\n  // sees a timestamp earlier than when the scan actually finished (finding\n  // round-4). An explicit `now` (tests / determinism) still wins.\n  const computedAt = (input.now ?? new Date()).toISOString();\n\n  return {\n    namespace,\n    memoryFileCount: paths.length,\n    newestPartition,\n    newestWriteAt,\n    digest,\n    computedAt,\n  };\n}\n\n/** Minimal storage surface a watermark needs — satisfied by StorageManager. */\nexport interface CorpusStorage {\n  readonly dir: string;\n  /** Hot-tier active memory paths (the recall corpus). */\n  collectActiveMemoryPaths(options?: { propagateReadErrors?: boolean }): Promise<string[]>;\n  /** Cold-tier (demoted-but-reachable) memory paths (issue #2156 finding D). */\n  collectColdMemoryPaths(options?: { propagateReadErrors?: boolean }): Promise<string[]>;\n  /**\n   * Optional combined hot+cold corpus-mutation sentinel. When present, the\n   * census brackets its scan with it and retries on change so a tier migration\n   * racing the walkers is not cached as a false divergence. Absent (test fakes)\n   * ⇒ single-pass.\n   */\n  getCorpusScanVersion?(): string | Promise<string>;\n}\n\n/** Max census re-scans when a corpus mutation keeps racing the walkers. */\nconst CENSUS_RACE_MAX_ATTEMPTS = 3;\n\n/**\n * Compute one namespace's watermark from its storage, spanning BOTH tiers so a\n * cold-tier divergence is caught. Reads are STRICT: the collectors propagate a\n * backend read failure (EACCES on the root OR any nested category dir, ENOTDIR,\n * …) so an unreadable corpus is OMITTED by the caller rather than published as a\n * false empty census; a missing root (ENOENT — a not-yet-created namespace)\n * stays a genuine empty corpus. The hot+cold walk is bracketed by the\n * corpus-mutation sentinel (when the storage exposes one) and retried on change;\n * if it never stabilizes (sustained tier churn) this THROWS rather than caching\n * a transient double-count/miss as a false divergence.\n */\nasync function computeNamespaceWatermark(\n  namespace: string,\n  storage: CorpusStorage,\n  now?: Date,\n): Promise<CorpusWatermark> {\n  const readVersion = storage.getCorpusScanVersion?.bind(storage);\n  const maxAttempts = readVersion ? CENSUS_RACE_MAX_ATTEMPTS : 1;\n  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {\n    const before = readVersion ? await readVersion() : null;\n    const [hotPaths, coldPaths] = await Promise.all([\n      storage.collectActiveMemoryPaths({ propagateReadErrors: true }),\n      storage.collectColdMemoryPaths({ propagateReadErrors: true }),\n    ]);\n    const result = await computeCorpusWatermark({ namespace, paths: [...hotPaths, ...coldPaths], baseDir: storage.dir, now });\n    const after = readVersion ? await readVersion() : null;\n    if (before === after) return result;\n    // A tier write (e.g. hot→cold migration) raced the two walkers, so the\n    // count/digest may double-count or miss the in-flight memory. Retry for a\n    // consistent snapshot.\n  }\n  throw new Error(`corpus census for namespace \"${namespace}\" did not stabilize after ${maxAttempts} attempts`);\n}\n\n/**\n * Compute watermarks for a set of namespaces. A namespace whose storage is\n * unavailable (or unreadable) is skipped rather than failing the whole read, so\n * a single bad namespace never blanks the health/doctor payload.\n */\nexport async function computeCorpusWatermarks(\n  namespaces: readonly string[],\n  storageFor: (namespace: string) => CorpusStorage | Promise<CorpusStorage>,\n  now?: Date,\n): Promise<CorpusWatermark[]> {\n  const watermarks: CorpusWatermark[] = [];\n  for (const namespace of namespaces) {\n    try {\n      watermarks.push(await computeNamespaceWatermark(namespace, await storageFor(namespace), now));\n    } catch {\n      // Storage unavailable/unreadable for this namespace — degrade gracefully.\n    }\n  }\n  return watermarks;\n}\n\n/** A namespace and the memory root its corpus lives under. */\nexport interface CorpusNamespaceRoot {\n  /** Representative namespace label for this root (default wins on collapse). */\n  readonly namespace: string;\n  readonly rootDir: string;\n  /**\n   * Every configured namespace name that resolves to `rootDir` (aliases that\n   * collapsed onto one physical root, e.g. `global` + `shared` when namespaces\n   * are disabled). `/health` filters visibility against ALL of these so a token\n   * scoped to a non-representative alias still sees the shared corpus (issue\n   * #2156 round-10). Always includes `namespace`.\n   */\n  readonly namespaces: readonly string[];\n}\n\n/**\n * Resolve the namespace set the corpus census covers, shared by the `/health`\n * builder AND the `remnic doctor` corpus check (issue #2156 finding C) so the\n * two surfaces enumerate the SAME tenants — and, critically, resolve each\n * namespace's ROOT the SAME way — and cannot drift. Enumeration is purely\n * config-driven (`listNamespaces({ config })`): it discovers the default,\n * shared, policy, and on-disk `namespaces/<ns>` tenants and resolves every root\n * through the namespace storage router, exactly as the live daemon's\n * `getStorage(namespace)` does. It still works when the namespace catalog is\n * opted out. The catalog is deliberately NOT unioned in: a catalog-registered\n * tenant with no directory has an empty corpus (nothing to fingerprint), and\n * trusting `catalog.storageDir` here could make the doctor scan a different root\n * than `/health` for the same namespace (issue #2156 round-8). Deduped by\n * resolved root so a namespaces-disabled / flat-root deployment reports its\n * single shared corpus once, under the default-namespace label.\n */\nexport async function resolveCorpusNamespaceRoots(options: {\n  config: PluginConfig;\n  propagateDiscoveryErrors?: boolean;\n}): Promise<CorpusNamespaceRoot[]> {\n  const { config } = options;\n  const configDriven = await listNamespaces({\n    config,\n    propagateDiscoveryErrors: options.propagateDiscoveryErrors,\n  });\n  // Default namespace first so it wins the representative label when several\n  // configured names collapse onto one root (namespaces disabled → memoryDir).\n  const ordered = [\n    ...configDriven.filter((entry) => entry.namespace === config.defaultNamespace),\n    ...configDriven.filter((entry) => entry.namespace !== config.defaultNamespace),\n  ];\n  const seenNamespaces = new Set<string>();\n  const byRoot = new Map<string, { namespace: string; rootDir: string; namespaces: string[] }>();\n  for (const entry of ordered) {\n    if (seenNamespaces.has(entry.namespace)) continue;\n    seenNamespaces.add(entry.namespace);\n    const existing = byRoot.get(entry.rootDir);\n    if (existing) {\n      existing.namespaces.push(entry.namespace); // an alias collapsing onto a seen root\n    } else {\n      byRoot.set(entry.rootDir, { namespace: entry.namespace, rootDir: entry.rootDir, namespaces: [entry.namespace] });\n    }\n  }\n  const roots: CorpusNamespaceRoot[] = [...byRoot.values()];\n  if (roots.length === 0) {\n    roots.push({ namespace: config.defaultNamespace, rootDir: config.memoryDir, namespaces: [config.defaultNamespace] });\n  }\n  return roots;\n}\n\n/**\n * Divergence detection tolerates a watermark that is stale by up to a minute\n * (peers are compared on a slow cadence); a health/readiness probe does NOT\n * tolerate a full corpus scan (a recursive realpath-per-Markdown-file walk) on\n * every request. This TTL is that trade-off: recompute a namespace's watermark\n * at most once per window; probes in between serve the cached census (whose\n * `computedAt` shows its staleness).\n */\nexport const WATERMARK_CACHE_TTL_MS = 60_000;\n\n/**\n * Cap on concurrent background corpus scans. A probe that finds many namespaces\n * cold/expired would otherwise fan out one recursive hot/cold walk PER namespace\n * at once, a periodic unbounded filesystem-work burst that can starve recall and\n * storage (issue #2156 round-9). Excess refreshes queue and start as slots free;\n * single-flight still dedupes duplicate requests for the same namespace.\n */\nconst MAX_CONCURRENT_WATERMARK_REFRESHES = 4;\n\n/**\n * Instance-scoped (AGENTS.md pattern 5 — never a bare module global)\n * stale-while-revalidate cache in front of the per-namespace corpus scan.\n * {@link get} NEVER awaits the scan: it returns the freshest already-computed\n * watermark (stale allowed, or undefined for a cold namespace) and triggers a\n * single-flight background refresh when the entry is missing or expired. So a\n * `/health` probe is always O(1) — it never blocks on a recursive corpus walk,\n * even on the first request after startup or after a TTL expiry. Owned by the\n * long-lived access service instance.\n */\nexport class CorpusWatermarkCache {\n  private readonly entries = new Map<string, { value: CorpusWatermark; expiresAt: number }>();\n  private readonly inFlight = new Map<string, Promise<void>>();\n  private readonly ttlMs: number;\n  private readonly clock: () => number;\n  private rootsEntry: { value: CorpusNamespaceRoot[]; expiresAt: number } | undefined;\n  private rootsInFlight: Promise<void> | undefined;\n  private rootsRefreshError: unknown;\n  private readonly queued = new Map<string, () => void>();\n  private activeRefreshes = 0;\n  private readonly maxConcurrentRefreshes: number;\n\n  constructor(options: { ttlMs?: number; clock?: () => number; maxConcurrentRefreshes?: number } = {}) {\n    this.ttlMs = options.ttlMs ?? WATERMARK_CACHE_TTL_MS;\n    this.clock = options.clock ?? Date.now;\n    this.maxConcurrentRefreshes = Math.max(1, options.maxConcurrentRefreshes ?? MAX_CONCURRENT_WATERMARK_REFRESHES);\n  }\n\n  get(namespace: string, compute: () => Promise<CorpusWatermark>): CorpusWatermark | undefined {\n    const cached = this.entries.get(namespace);\n    const fresh = cached !== undefined && this.clock() < cached.expiresAt;\n    if (!fresh) this.refresh(namespace, compute);\n    return cached?.value;\n  }\n\n  private refresh(namespace: string, compute: () => Promise<CorpusWatermark>): void {\n    // Single-flight + not-already-queued: one background scan per namespace.\n    if (this.inFlight.has(namespace) || this.queued.has(namespace)) return;\n    const run = (): void => {\n      this.activeRefreshes += 1;\n      const pending = compute()\n        .then((value) => {\n          this.entries.set(namespace, { value, expiresAt: this.clock() + this.ttlMs });\n        })\n        .catch(() => {\n          // Failed/unreadable scan: never cache it; keep serving any stale value.\n        })\n        .finally(() => {\n          this.inFlight.delete(namespace);\n          this.activeRefreshes -= 1;\n          this.drainQueue();\n        });\n      this.inFlight.set(namespace, pending);\n    };\n    // Bound the concurrent fan-out: run now if a slot is free, else queue.\n    if (this.activeRefreshes < this.maxConcurrentRefreshes) {\n      run();\n    } else {\n      this.queued.set(namespace, run);\n    }\n  }\n\n  private drainQueue(): void {\n    while (this.activeRefreshes < this.maxConcurrentRefreshes && this.queued.size > 0) {\n      const next = this.queued.entries().next().value;\n      if (!next) break;\n      const [namespace, run] = next;\n      this.queued.delete(namespace);\n      run();\n    }\n  }\n\n\n  /**\n   * Stale-while-revalidate the resolved namespace roots (issue #2156 round-7).\n   * Namespace enumeration (config scan + persisted-catalog parse) is O(tenants)\n   * filesystem work; without this it ran on every probe ahead of the watermark\n   * cache. NEVER awaits: returns the cached/stale roots (or undefined when cold)\n   * and single-flights a background refresh.\n   */\n  getResolvedRoots(compute: () => Promise<CorpusNamespaceRoot[]>): CorpusNamespaceRoot[] | undefined {\n    const fresh = this.rootsEntry !== undefined && this.clock() < this.rootsEntry.expiresAt;\n    if (!fresh && this.rootsInFlight === undefined) {\n      this.rootsInFlight = compute()\n        .then((value) => {\n          this.rootsEntry = { value, expiresAt: this.clock() + this.ttlMs };\n          this.rootsRefreshError = undefined;\n        })\n        .catch((error: unknown) => {\n          this.rootsRefreshError = error;\n          // Keep serving any stale roots; callers that require completeness\n          // inspect the refresh status before trusting them.\n        })\n        .finally(() => {\n          this.rootsInFlight = undefined;\n        });\n    }\n    return this.rootsEntry?.value;\n  }\n\n  getResolvedRootsStatus(compute: () => Promise<CorpusNamespaceRoot[]>): {\n    roots: CorpusNamespaceRoot[] | undefined;\n    refreshError: unknown;\n  } {\n    const roots = this.getResolvedRoots(compute);\n    return { roots, refreshError: this.rootsRefreshError };\n  }\n  /** Await every background refresh — in-flight AND queued (issue #2156 round-9) —\n   *  plus any roots refresh (shutdown / deterministic tests). */\n  async whenIdle(): Promise<void> {\n    while (this.inFlight.size > 0 || this.rootsInFlight !== undefined || this.queued.size > 0) {\n      const pending: Promise<unknown>[] = [...this.inFlight.values()];\n      if (this.rootsInFlight) pending.push(this.rootsInFlight);\n      if (pending.length === 0) {\n        this.drainQueue(); // queued work with no running peer — start it\n        await Promise.resolve();\n        continue;\n      }\n      await Promise.all(pending);\n    }\n  }\n}\n\n/** Orchestrator surface the service watermark builder reads — satisfied by Orchestrator. */\nexport interface CorpusWatermarkHost {\n  config: PluginConfig;\n  getStorage(namespace: string): CorpusStorage | Promise<CorpusStorage>;\n}\n\nexport interface ServiceCorpusWatermarkOptions {\n  /** Stale-while-revalidate cache so probes never await the corpus scan. */\n  cache?: CorpusWatermarkCache;\n  /**\n   * Presenting token capabilities. When the token is namespace-restricted the\n   * fleet view is filtered to the namespaces it may access (issue #2156 finding\n   * B); an unrestricted/legacy token keeps the full fleet view.\n   */\n  caps?: TokenCapabilities | null;\n  now?: Date;\n}\n\n/**\n * Build the per-namespace watermark array served on `/health`. Namespaces are\n * resolved through {@link resolveCorpusNamespaceRoots} (shared with the doctor),\n * filtered to the caller's capabilities, then served through the (optional)\n * stale-while-revalidate cache so a probe never blocks on a scan. Degrades to an\n * empty array — never throws — if enumeration is unavailable; an individual\n * namespace whose scan fails is omitted, not allowed to blank the payload.\n */\nexport async function computeServiceCorpusWatermarks(\n  host: CorpusWatermarkHost,\n  options: ServiceCorpusWatermarkOptions = {},\n): Promise<CorpusWatermark[]> {\n  return (await computeServiceCorpusCensus(host, options)).watermarks;\n}\n\n/**\n * Watermarks PLUS whether every configured namespace made it into the set.\n *\n * Completeness is returned ATOMICALLY with the data rather than stashed in a\n * side channel: every early exit here (enumeration threw, roots still warming,\n * a per-namespace scan failed, a cache entry not yet populated) yields an\n * incomplete set, and a caller that certifies convergence against a partial\n * census would hide the divergence of whatever was dropped (issue #2149).\n */\nexport async function computeServiceCorpusCensus(\n  host: CorpusWatermarkHost,\n  options: ServiceCorpusWatermarkOptions = {},\n): Promise<{ watermarks: CorpusWatermark[]; complete: boolean }> {\n  let roots: CorpusNamespaceRoot[] | undefined;\n  if (options.cache) {\n    const { roots: cachedRoots, refreshError } = options.cache.getResolvedRootsStatus(() =>\n      resolveCorpusNamespaceRoots({ config: host.config, propagateDiscoveryErrors: true }),\n    );\n    if (refreshError !== undefined) return { watermarks: [], complete: false };\n    roots = cachedRoots;\n  } else {\n    try {\n      roots = await resolveCorpusNamespaceRoots({\n        config: host.config,\n        propagateDiscoveryErrors: true,\n      });\n    } catch {\n      return { watermarks: [], complete: false }; // never enumerated — not an empty corpus\n    }\n  }\n  // Enumeration still warming (cold): served on a later probe, and NOT complete.\n  if (!roots) return { watermarks: [], complete: false };\n  const visible = roots.filter((root) => root.namespaces.some((ns) => capabilityAllowsNamespace(options.caps, ns)));\n  const watermarks: CorpusWatermark[] = [];\n  let complete = true;\n  for (const { namespace } of visible) {\n    const compute = async (): Promise<CorpusWatermark> =>\n      computeNamespaceWatermark(namespace, await host.getStorage(namespace), options.now);\n    if (options.cache) {\n      const cached = options.cache.get(namespace, compute);\n      if (cached) watermarks.push(cached);\n      else complete = false; // still warming — the set is not the full census yet\n    } else {\n      try {\n        watermarks.push(await compute());\n      } catch {\n        // One tenant's storage/scan failed — omit just that namespace.\n        complete = false;\n      }\n    }\n  }\n  return { watermarks, complete };\n}\n\n\n"],"mappings":";;;;;;;;AAsCA,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,OAAO,UAAU;AAwBV,IAAM,uBAAuB;AAKpC,IAAM,mBAAmB;AAEzB,IAAM,gBAAgB;AAStB,SAAS,kBAAkB,OAAwB;AACjD,MAAI,CAAC,iBAAiB,KAAK,KAAK,EAAG,QAAO;AAC1C,QAAM,CAAC,MAAM,OAAO,GAAG,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM;AACtD,QAAM,OAAO,IAAI,KAAK,KAAK,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC;AACpD,SAAO,KAAK,eAAe,MAAM,QAAQ,KAAK,YAAY,MAAM,QAAQ,KAAK,KAAK,WAAW,MAAM;AACrG;AAQA,SAAS,eAAe,SAAiB,UAA8B;AACrE,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AACrE,QAAM,QAAQ,IAAI,MAAM,GAAG;AAM3B,QAAM,OAAmB,MAAM,CAAC,MAAM,gBAAgB,SAAS;AAC/D,QAAM,gBAAgB,SAAS,SAAS,MAAM,MAAM,CAAC,IAAI;AACzD,MAAI,cAAc,UAAU,KAAK,kBAAkB,cAAc,CAAC,CAAC,GAAG;AACpE,WAAO,EAAE,QAAQ,GAAG,IAAI,IAAI,cAAc,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,MAAM,cAAc,CAAC,GAAG,KAAK;AAAA,EACnG;AACA,SAAO,EAAE,QAAQ,GAAG,IAAI,IAAI,oBAAoB,IAAI,MAAM,MAAM,KAAK;AACvE;AAQO,SAAS,qBAAqB,OAA0B,SAAsC;AACnG,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,YAAY,OAAO;AAC5B,UAAM,EAAE,OAAO,IAAI,eAAe,SAAS,QAAQ;AACnD,WAAO,IAAI,SAAS,OAAO,IAAI,MAAM,KAAK,KAAK,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAQO,SAAS,sBAAsB,QAAsE;AAC1G,QAAM,UAAU,kBAAkB,MAAM,CAAC,GAAG,OAAO,QAAQ,CAAC,IAAI,OAAO,QAAQ,MAAM;AACrF,QAAM,aAAa,QAChB,KAAK,CAAC,GAAG,MAAO,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAE,EACvD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,GAAG,MAAM,IAAI,KAAK,EAAE,EAC7C,KAAK,IAAI;AACZ,SAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;AASA,eAAsB,uBAAuB,OAKhB;AAC3B,QAAM,EAAE,WAAW,OAAO,QAAQ,IAAI;AAEtC,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI,kBAAiC;AACrC,QAAM,eAA6B,CAAC;AACpC,aAAW,YAAY,OAAO;AAC5B,UAAM,SAAS,eAAe,SAAS,QAAQ;AAC/C,iBAAa,KAAK,MAAM;AACxB,WAAO,IAAI,OAAO,SAAS,OAAO,IAAI,OAAO,MAAM,KAAK,KAAK,CAAC;AAI9D,QAAI,OAAO,SAAS,SAAS,OAAO,SAAS,SAAS,oBAAoB,QAAQ,OAAO,OAAO,kBAAkB;AAChH,wBAAkB,OAAO;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,MAAM;AAE3C,MAAI,gBAA+B;AACnC,MAAI,oBAAoB,MAAM;AAC5B,QAAI,aAAa,OAAO;AACxB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,UAAI,aAAa,CAAC,EAAE,SAAS,SAAS,aAAa,CAAC,EAAE,SAAS,gBAAiB;AAChF,UAAI;AACF,cAAM,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC;AAC9B,YAAI,GAAG,UAAU,WAAY,cAAa,GAAG;AAAA,MAC/C,SAAS,KAAK;AAKZ,YAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,aAAa,OAAO,mBAAmB;AACzC,sBAAgB,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,IACnD;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,OAAO,oBAAI,KAAK,GAAG,YAAY;AAEzD,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAmBA,IAAM,2BAA2B;AAajC,eAAe,0BACb,WACA,SACA,KAC0B;AAC1B,QAAM,cAAc,QAAQ,sBAAsB,KAAK,OAAO;AAC9D,QAAM,cAAc,cAAc,2BAA2B;AAC7D,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW,GAAG;AACzD,UAAM,SAAS,cAAc,MAAM,YAAY,IAAI;AACnD,UAAM,CAAC,UAAU,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC9C,QAAQ,yBAAyB,EAAE,qBAAqB,KAAK,CAAC;AAAA,MAC9D,QAAQ,uBAAuB,EAAE,qBAAqB,KAAK,CAAC;AAAA,IAC9D,CAAC;AACD,UAAM,SAAS,MAAM,uBAAuB,EAAE,WAAW,OAAO,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,QAAQ,KAAK,IAAI,CAAC;AACxH,UAAM,QAAQ,cAAc,MAAM,YAAY,IAAI;AAClD,QAAI,WAAW,MAAO,QAAO;AAAA,EAI/B;AACA,QAAM,IAAI,MAAM,gCAAgC,SAAS,6BAA6B,WAAW,WAAW;AAC9G;AAOA,eAAsB,wBACpB,YACA,YACA,KAC4B;AAC5B,QAAM,aAAgC,CAAC;AACvC,aAAW,aAAa,YAAY;AAClC,QAAI;AACF,iBAAW,KAAK,MAAM,0BAA0B,WAAW,MAAM,WAAW,SAAS,GAAG,GAAG,CAAC;AAAA,IAC9F,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAiCA,eAAsB,4BAA4B,SAGf;AACjC,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,eAAe,MAAM,eAAe;AAAA,IACxC;AAAA,IACA,0BAA0B,QAAQ;AAAA,EACpC,CAAC;AAGD,QAAM,UAAU;AAAA,IACd,GAAG,aAAa,OAAO,CAAC,UAAU,MAAM,cAAc,OAAO,gBAAgB;AAAA,IAC7E,GAAG,aAAa,OAAO,CAAC,UAAU,MAAM,cAAc,OAAO,gBAAgB;AAAA,EAC/E;AACA,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,SAAS,oBAAI,IAA0E;AAC7F,aAAW,SAAS,SAAS;AAC3B,QAAI,eAAe,IAAI,MAAM,SAAS,EAAG;AACzC,mBAAe,IAAI,MAAM,SAAS;AAClC,UAAM,WAAW,OAAO,IAAI,MAAM,OAAO;AACzC,QAAI,UAAU;AACZ,eAAS,WAAW,KAAK,MAAM,SAAS;AAAA,IAC1C,OAAO;AACL,aAAO,IAAI,MAAM,SAAS,EAAE,WAAW,MAAM,WAAW,SAAS,MAAM,SAAS,YAAY,CAAC,MAAM,SAAS,EAAE,CAAC;AAAA,IACjH;AAAA,EACF;AACA,QAAM,QAA+B,CAAC,GAAG,OAAO,OAAO,CAAC;AACxD,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,KAAK,EAAE,WAAW,OAAO,kBAAkB,SAAS,OAAO,WAAW,YAAY,CAAC,OAAO,gBAAgB,EAAE,CAAC;AAAA,EACrH;AACA,SAAO;AACT;AAUO,IAAM,yBAAyB;AAStC,IAAM,qCAAqC;AAYpC,IAAM,uBAAN,MAA2B;AAAA,EACf,UAAU,oBAAI,IAA2D;AAAA,EACzE,WAAW,oBAAI,IAA2B;AAAA,EAC1C;AAAA,EACA;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACS,SAAS,oBAAI,IAAwB;AAAA,EAC9C,kBAAkB;AAAA,EACT;AAAA,EAEjB,YAAY,UAAqF,CAAC,GAAG;AACnG,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,QAAQ,QAAQ,SAAS,KAAK;AACnC,SAAK,yBAAyB,KAAK,IAAI,GAAG,QAAQ,0BAA0B,kCAAkC;AAAA,EAChH;AAAA,EAEA,IAAI,WAAmB,SAAsE;AAC3F,UAAM,SAAS,KAAK,QAAQ,IAAI,SAAS;AACzC,UAAM,QAAQ,WAAW,UAAa,KAAK,MAAM,IAAI,OAAO;AAC5D,QAAI,CAAC,MAAO,MAAK,QAAQ,WAAW,OAAO;AAC3C,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEQ,QAAQ,WAAmB,SAA+C;AAEhF,QAAI,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK,OAAO,IAAI,SAAS,EAAG;AAChE,UAAM,MAAM,MAAY;AACtB,WAAK,mBAAmB;AACxB,YAAM,UAAU,QAAQ,EACrB,KAAK,CAAC,UAAU;AACf,aAAK,QAAQ,IAAI,WAAW,EAAE,OAAO,WAAW,KAAK,MAAM,IAAI,KAAK,MAAM,CAAC;AAAA,MAC7E,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC,EACA,QAAQ,MAAM;AACb,aAAK,SAAS,OAAO,SAAS;AAC9B,aAAK,mBAAmB;AACxB,aAAK,WAAW;AAAA,MAClB,CAAC;AACH,WAAK,SAAS,IAAI,WAAW,OAAO;AAAA,IACtC;AAEA,QAAI,KAAK,kBAAkB,KAAK,wBAAwB;AACtD,UAAI;AAAA,IACN,OAAO;AACL,WAAK,OAAO,IAAI,WAAW,GAAG;AAAA,IAChC;AAAA,EACF;AAAA,EAEQ,aAAmB;AACzB,WAAO,KAAK,kBAAkB,KAAK,0BAA0B,KAAK,OAAO,OAAO,GAAG;AACjF,YAAM,OAAO,KAAK,OAAO,QAAQ,EAAE,KAAK,EAAE;AAC1C,UAAI,CAAC,KAAM;AACX,YAAM,CAAC,WAAW,GAAG,IAAI;AACzB,WAAK,OAAO,OAAO,SAAS;AAC5B,UAAI;AAAA,IACN;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,iBAAiB,SAAkF;AACjG,UAAM,QAAQ,KAAK,eAAe,UAAa,KAAK,MAAM,IAAI,KAAK,WAAW;AAC9E,QAAI,CAAC,SAAS,KAAK,kBAAkB,QAAW;AAC9C,WAAK,gBAAgB,QAAQ,EAC1B,KAAK,CAAC,UAAU;AACf,aAAK,aAAa,EAAE,OAAO,WAAW,KAAK,MAAM,IAAI,KAAK,MAAM;AAChE,aAAK,oBAAoB;AAAA,MAC3B,CAAC,EACA,MAAM,CAAC,UAAmB;AACzB,aAAK,oBAAoB;AAAA,MAG3B,CAAC,EACA,QAAQ,MAAM;AACb,aAAK,gBAAgB;AAAA,MACvB,CAAC;AAAA,IACL;AACA,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA,EAEA,uBAAuB,SAGrB;AACA,UAAM,QAAQ,KAAK,iBAAiB,OAAO;AAC3C,WAAO,EAAE,OAAO,cAAc,KAAK,kBAAkB;AAAA,EACvD;AAAA;AAAA;AAAA,EAGA,MAAM,WAA0B;AAC9B,WAAO,KAAK,SAAS,OAAO,KAAK,KAAK,kBAAkB,UAAa,KAAK,OAAO,OAAO,GAAG;AACzF,YAAM,UAA8B,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;AAC9D,UAAI,KAAK,cAAe,SAAQ,KAAK,KAAK,aAAa;AACvD,UAAI,QAAQ,WAAW,GAAG;AACxB,aAAK,WAAW;AAChB,cAAM,QAAQ,QAAQ;AACtB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;AA4BA,eAAsB,+BACpB,MACA,UAAyC,CAAC,GACd;AAC5B,UAAQ,MAAM,2BAA2B,MAAM,OAAO,GAAG;AAC3D;AAWA,eAAsB,2BACpB,MACA,UAAyC,CAAC,GACqB;AAC/D,MAAI;AACJ,MAAI,QAAQ,OAAO;AACjB,UAAM,EAAE,OAAO,aAAa,aAAa,IAAI,QAAQ,MAAM;AAAA,MAAuB,MAChF,4BAA4B,EAAE,QAAQ,KAAK,QAAQ,0BAA0B,KAAK,CAAC;AAAA,IACrF;AACA,QAAI,iBAAiB,OAAW,QAAO,EAAE,YAAY,CAAC,GAAG,UAAU,MAAM;AACzE,YAAQ;AAAA,EACV,OAAO;AACL,QAAI;AACF,cAAQ,MAAM,4BAA4B;AAAA,QACxC,QAAQ,KAAK;AAAA,QACb,0BAA0B;AAAA,MAC5B,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,YAAY,CAAC,GAAG,UAAU,MAAM;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,CAAC,MAAO,QAAO,EAAE,YAAY,CAAC,GAAG,UAAU,MAAM;AACrD,QAAM,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK,WAAW,KAAK,CAAC,OAAO,0BAA0B,QAAQ,MAAM,EAAE,CAAC,CAAC;AAChH,QAAM,aAAgC,CAAC;AACvC,MAAI,WAAW;AACf,aAAW,EAAE,UAAU,KAAK,SAAS;AACnC,UAAM,UAAU,YACd,0BAA0B,WAAW,MAAM,KAAK,WAAW,SAAS,GAAG,QAAQ,GAAG;AACpF,QAAI,QAAQ,OAAO;AACjB,YAAM,SAAS,QAAQ,MAAM,IAAI,WAAW,OAAO;AACnD,UAAI,OAAQ,YAAW,KAAK,MAAM;AAAA,UAC7B,YAAW;AAAA,IAClB,OAAO;AACL,UAAI;AACF,mBAAW,KAAK,MAAM,QAAQ,CAAC;AAAA,MACjC,QAAQ;AAEN,mBAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,YAAY,SAAS;AAChC;","names":[]}