@remnic/core 10.0.84 → 10.0.86

package/dist/chunk-HWHNQVRV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access-schema.ts"],"sourcesContent":["// Request/response schema validation for the Remnic HTTP API.\n// Uses zod for runtime validation — returns structured 400 errors with\n// field-level detail so consumers get clear feedback on malformed requests.\n\nimport { z } from \"zod\";\n\nimport type { MemoryCategory } from \"./types.js\";\nimport {\n  ACTION_CONFIDENCE_CONTEXT_READINESS,\n  ACTION_CONFIDENCE_RISK_CATEGORIES,\n  ACTION_CONFIDENCE_RULE_KINDS,\n} from \"./action-confidence.js\";\nimport { isValidCapsuleSince } from \"./transfer/capsule-export.js\";\nimport { validateArchiveRelativePath } from \"./transfer/fs-utils.js\";\nimport { CAPSULE_ID_PATTERN } from \"./transfer/types.js\";\nimport {\n  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,\n  OFFLINE_SYNC_MAX_MTIME_MS,\n} from \"./offline-sync.js\";\n\n// ---------------------------------------------------------------------------\n// Error formatting\n// ---------------------------------------------------------------------------\n\nexport interface SchemaValidationError {\n  error: string;\n  code: \"validation_error\";\n  details: Array<{ field: string; message: string }>;\n}\n\nexport function formatZodError(error: z.ZodError): SchemaValidationError {\n  return {\n    error: \"request validation failed\",\n    code: \"validation_error\",\n    details: error.issues.map((issue) => ({\n      field: issue.path.join(\".\") || \"(root)\",\n      message: issue.message,\n    })),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Shared fields\n// ---------------------------------------------------------------------------\n\nconst namespaceSchema = z.string().trim().max(256).optional();\nconst sessionKeySchema = z.string().trim().min(1).max(512).optional();\nconst idempotencyKeySchema = z.string().trim().min(1).max(256).optional();\nconst cwdSchema = z.string().trim().min(1, \"cwd must be non-empty when provided\").max(2048).optional();\nconst projectTagSchema = z\n  .string()\n  .trim()\n  .min(1, \"projectTag must be non-empty when provided\")\n  .max(256)\n  .optional();\nconst deadlineMsSchema = z.number().finite().min(0).max(Number.MAX_SAFE_INTEGER).optional();\nconst dryRunSchema = z.boolean().optional();\nconst schemaVersionSchema = z.number().int().optional();\nconst timeZoneSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine((value) => {\n    try {\n      Intl.DateTimeFormat(undefined, { timeZone: value });\n      return true;\n    } catch {\n      return false;\n    }\n  }, \"must be a valid IANA timezone\");\n\n// ---------------------------------------------------------------------------\n// Recall\n// ---------------------------------------------------------------------------\n\n/**\n * Coding-agent context (issue #569). Optional payload that connectors may\n * ship with a recall request so the project/branch namespace overlay\n * applies to that recall. All fields are validated per CLAUDE.md #51 —\n * empty-string projectId / rootPath is rejected, not silently accepted.\n */\nexport const codingContextSchema = z\n  .object({\n    projectId: z.string().trim().min(1, \"codingContext.projectId is required\").max(128),\n    branch: z.string().trim().max(256).nullable(),\n    rootPath: z.string().trim().min(1, \"codingContext.rootPath is required\").max(1024),\n    defaultBranch: z.string().trim().max(256).nullable(),\n  })\n  .nullable();\n\n/**\n * Recall disclosure depth (issue #677).  Mirrors the `RecallDisclosure`\n * type in `types.ts` — keep these in sync.  Default-application happens\n * inside `EngramAccessService.recall()`; the schema only accepts/rejects.\n * Invalid values throw a structured 400 instead of silently defaulting,\n * per CLAUDE.md rule 51.\n */\nexport const recallDisclosureSchema = z.enum([\"chunk\", \"section\", \"raw\"]);\n\n/**\n * Tag-match semantics (issue #689). `any` (default when `tags` is provided\n * and `tagMatch` is omitted) admits a result when it carries at least one\n * of the filter tags. `all` requires every filter tag to be present.\n * Schema rejects unknown values up front — never silently defaults\n * (CLAUDE.md rule 51).\n */\nexport const tagMatchSchema = z.enum([\"any\", \"all\"]);\n\nexport const recallRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  topK: z.number().int().min(0).max(200).optional(),\n  mode: z.enum([\"auto\", \"no_recall\", \"minimal\", \"full\", \"graph_mode\"]).optional(),\n  includeDebug: z.boolean().optional(),\n  idempotencyKey: idempotencyKeySchema,\n  disclosure: recallDisclosureSchema.optional(),\n  codingContext: codingContextSchema.optional(),\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: cwdSchema,\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: projectTagSchema,\n  /**\n   * Historical recall pin (issue #680).  ISO 8601 timestamp.  The\n   * schema only enforces the basic shape; the access service runs\n   * `Date.parse` and emits a structured 400 on malformed input\n   * (CLAUDE.md rule 51).\n   */\n  asOf: z.string().trim().min(1, \"asOf must be a non-empty ISO 8601 timestamp\").max(64).optional(),\n  /**\n   * Free-form recall tag filter (issue #689). When provided, recall results\n   * whose frontmatter `tags` do not match the filter are removed before the\n   * response is returned. Comparison is case-sensitive exact match.\n   */\n  tags: z.array(z.string().trim().min(1).max(256)).max(50).optional(),\n  /**\n   * Match mode for `tags` (issue #689). Defaults to `\"any\"` when `tags` is\n   * provided and `tagMatch` is omitted. Ignored when `tags` is absent.\n   */\n  tagMatch: tagMatchSchema.optional(),\n  /**\n   * Include graph edges below `graphTraversalConfidenceFloor` for diagnostic\n   * recall traversal (issue #681). Defaults to false.\n   */\n  includeLowConfidence: z.boolean().optional(),\n  /**\n   * #1952 — per-call opt-in to state-aware recall views for this recall.\n   * ORs with the `recallStateViews` config flag; a change-intent query\n   * (e.g. \"when did\", \"used to\", \"switched\") is still required for any\n   * effect, so this can never perturb ordinary recalls.\n   */\n  stateView: z.boolean().optional(),\n});\n\nexport const recallExplainRequestSchema = z.object({\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n});\n\n/**\n * Standalone \"set coding context\" request. Used by the HTTP endpoint\n * `POST /engram/v1/coding-context` and the MCP `remnic.set_coding_context`\n * tool (PR 7). `codingContext: null` clears the attached context.\n */\nexport const setCodingContextRequestSchema = z\n  .object({\n    sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n    codingContext: codingContextSchema.optional(),\n    /**\n     * Project tag shorthand for non-git-based project scoping. When\n     * `codingContext` is omitted, this becomes\n     * `{ projectId: \"tag:<projectTag>\", branch: null, rootPath: \"tag:<projectTag>\", defaultBranch: null }`.\n     */\n    projectTag: z.string().trim().min(1, \"projectTag must be non-empty when provided\").max(256).optional(),\n  })\n  .superRefine((value, ctx) => {\n    if (value.codingContext === undefined && value.projectTag === undefined) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"codingContext or projectTag is required\",\n        path: [\"codingContext\"],\n      });\n    }\n  });\n\n// ---------------------------------------------------------------------------\n// Observe\n// ---------------------------------------------------------------------------\n\nconst messageSchema = z.object({\n  role: z.enum([\"user\", \"assistant\"]),\n  content: z.string().min(1, \"message content must be non-empty\"),\n  sourceFormat: z\n    .enum([\"openai\", \"anthropic\", \"openclaw\", \"pi\", \"lossless-claw\", \"remnic\"])\n    .nullable()\n    .optional(),\n  rawContent: z.unknown().nullable().optional(),\n  parts: z\n    .array(\n      z.object({\n        ordinal: z.number().int().min(0).nullable().optional(),\n        kind: z.enum([\n          \"text\",\n          \"tool_call\",\n          \"tool_result\",\n          \"patch\",\n          \"file_read\",\n          \"file_write\",\n          \"step_start\",\n          \"step_finish\",\n          \"snapshot\",\n          \"retry\",\n        ]),\n        payload: z.record(z.string(), z.unknown()),\n        toolName: z.string().nullable().optional(),\n        tool_name: z.string().nullable().optional(),\n        filePath: z.string().nullable().optional(),\n        file_path: z.string().nullable().optional(),\n        createdAt: z.string().nullable().optional(),\n        created_at: z.string().nullable().optional(),\n      }),\n    )\n    .nullable()\n    .optional(),\n});\n\nexport const observeRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  messages: z.array(messageSchema).min(1, \"messages must be a non-empty array\"),\n  namespace: namespaceSchema,\n  skipExtraction: z.boolean().optional(),\n  /**\n   * Optional idempotency key for server-side dedup of retried observe POSTs\n   * (issue #1649). A retry that reaches the daemon after the first attempt\n   * already processed is replayed from cache instead of re-ingested. When the\n   * key is reused with a DIFFERENT payload the request is rejected as a\n   * conflict (same contract as memory_store/suggestion_submit).\n   */\n  idempotencyKey: idempotencyKeySchema,\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: cwdSchema,\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: projectTagSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Deep recall (issue #2332)\n// ---------------------------------------------------------------------------\n\nexport const deepRecallRequestSchema = z.object({\n  query: z.string().trim().min(1, \"query is required\").max(2000),\n  /** Optional policy-step ceiling; validated against the configured maximum in the service. */\n  maxSteps: z.union([z.number().int().min(0), z.string()]).optional(),\n  namespace: namespaceSchema,\n  sessionKey: z.string().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Memory store / suggestion submit\n// ---------------------------------------------------------------------------\n\nconst writeContentSchema = z.string().min(1, \"content is required\").max(50000);\n// ---------------------------------------------------------------------------\n// Category wire contract (issue #2829): truthful input/output modeling.\n// ---------------------------------------------------------------------------\n\n/** Canonical input spellings — exactly the `MemoryCategory` union. */\nconst MEMORY_CATEGORY_CANONICAL_INPUT = [\n  \"fact\", \"preference\", \"correction\", \"entity\", \"decision\",\n  \"relationship\", \"principle\", \"commitment\", \"moment\", \"skill\", \"rule\", \"procedure\",\n  \"reasoning_trace\",\n] as const satisfies readonly MemoryCategory[];\n\n/**\n * Compatibility alias spellings admitted on input. The four project-shaped\n * categories fleet telemetry actually shows do not exist in the taxonomy;\n * they parse to the canonical \"fact\". Exact match only — no trimming, no\n * case folding, so near-misses like `projection` or `Project_State` reject\n * like any other invalid category, with the full valid list in the error.\n */\nconst MEMORY_CATEGORY_ALIAS_INPUT = [\n  \"project\",\n  \"project_state\",\n  \"project-state\",\n  \"project_update\",\n] as const;\n\nexport type MemoryCategoryAlias = (typeof MEMORY_CATEGORY_ALIAS_INPUT)[number];\n\nconst MEMORY_CATEGORY_ALIAS_TO_CANONICAL: Readonly<\n  Record<MemoryCategoryAlias, Extract<MemoryCategory, \"fact\">>\n> = {\n  project: \"fact\",\n  project_state: \"fact\",\n  \"project-state\": \"fact\",\n  project_update: \"fact\",\n};\n\nexport function isMemoryCategoryAlias(value: string): value is MemoryCategoryAlias {\n  return Object.prototype.hasOwnProperty.call(MEMORY_CATEGORY_ALIAS_TO_CANONICAL, value);\n}\n\n/**\n * Canonical category for an accepted alias spelling; undefined for anything\n * else (canonical spellings and near-misses map to nothing). Service-boundary\n * consumers that receive `category` without a prior wire parse use this to\n * match the transport contract (#2962).\n */\nexport function canonicalCategoryForAlias(value: string): \"fact\" | undefined {\n  return isMemoryCategoryAlias(value) ? MEMORY_CATEGORY_ALIAS_TO_CANONICAL[value] : undefined;\n}\n\n/** Coercion diagnostic for a write whose input category was a compat alias. */\nexport interface CategoryAliasCoercion {\n  from: MemoryCategoryAlias;\n  to: \"fact\";\n}\n\n/** Boundary-derived coercion note for a retained raw spelling. */\nexport function categoryAliasCoercion(rawCategory: string | undefined): CategoryAliasCoercion | undefined {\n  return rawCategory !== undefined && isMemoryCategoryAlias(rawCategory)\n    ? { from: rawCategory, to: \"fact\" }\n    : undefined;\n}\n\n/**\n * Recover the retained alias spelling from a pre-parse raw envelope: the\n * `rawCategory` minted by a previous parse of the same schema (the HTTP/MCP\n * validate-then-dispatch double pass), or — for single-parse callers like the\n * CLI store command — the as-yet-untransformed alias still sitting on\n * `category` (issue #2889). A minted `rawCategory` always wins: it names the\n * spelling the transform actually canonicalized.\n */\nexport function retainedCategoryAlias(rawInput: unknown): MemoryCategoryAlias | undefined {\n  if (!rawInput || typeof rawInput !== \"object\") return undefined;\n  const envelope = rawInput as Record<string, unknown>;\n  const minted = envelope.rawCategory;\n  if (typeof minted === \"string\" && isMemoryCategoryAlias(minted)) return minted;\n  const category = envelope.category;\n  return typeof category === \"string\" && isMemoryCategoryAlias(category) ? category : undefined;\n}\n\n/**\n * An idempotent replay returns the FIRST request's stored response, whose\n * coercion note names that request's spelling. Rewrite the note from the\n * CURRENT request's retained spelling so every response identifies what its\n * caller actually sent; the stored idempotent result is reused untouched.\n */\nexport function reapplyCategoryCoercion<T extends object>(\n  response: T,\n  categoryCoercion: CategoryAliasCoercion | undefined,\n): T & { categoryCoercion?: CategoryAliasCoercion } {\n  const restamped: T & { categoryCoercion?: CategoryAliasCoercion } = { ...response };\n  if (categoryCoercion !== undefined) {\n    restamped.categoryCoercion = categoryCoercion;\n  } else {\n    delete restamped.categoryCoercion;\n  }\n  return restamped;\n}\n\nconst categoryWireSchema = z.enum(\n  [...MEMORY_CATEGORY_CANONICAL_INPUT, ...MEMORY_CATEGORY_ALIAS_INPUT],\n  {\n    error: `category must be one of: ${[...MEMORY_CATEGORY_CANONICAL_INPUT, ...MEMORY_CATEGORY_ALIAS_INPUT].join(\", \")}; for project state/facts use \"fact\"`,\n  },\n);\n\nconst confidenceSchema = z.number().min(0).max(1).optional();\nconst tagsSchema = z.array(z.string().max(256)).max(50).optional();\nconst entityRefSchema = z.string().trim().max(512).optional();\nconst ttlSchema = z.string().trim().max(128).optional();\nconst sourceReasonSchema = z.string().trim().max(2000).optional();\n\nconst memoryStoreRequestShape = z.object({\n  schemaVersion: schemaVersionSchema,\n  idempotencyKey: idempotencyKeySchema,\n  dryRun: dryRunSchema,\n  sessionKey: sessionKeySchema,\n  content: writeContentSchema,\n  category: categoryWireSchema.optional(),\n  confidence: confidenceSchema,\n  namespace: namespaceSchema,\n  tags: tagsSchema,\n  entityRef: entityRefSchema,\n  ttl: ttlSchema,\n  sourceReason: sourceReasonSchema,\n  // Git/project context for project-scoped writes (#1434). When no explicit\n  // `namespace` is given, these route the write to the same project namespace\n  // recall/observe resolve from `cwd`/`projectTag` (issue #569, rule 42). Also\n  // lets MCP clients that auto-inject `cwd` (e.g. Pi MCPorter) call write tools.\n  cwd: cwdSchema,\n  projectTag: projectTagSchema,\n});\n\n/**\n * Parsed memory-store request (issue #2829): the category transform maps\n * compat aliases to the canonical \"fact\" DURING parsing, so the output type\n * stays the finite `MemoryCategory` union — never an alias spelling. The raw\n * spelling travels separately on `rawCategory`, minted only by the transform\n * (zod strips it from client bodies), for the write surface's coercion note\n * and idempotent-replay rebuild.\n */\nexport type MemoryStoreParsedRequest = Omit<z.infer<typeof memoryStoreRequestShape>, \"category\"> & {\n  category?: MemoryCategory;\n  rawCategory?: MemoryCategoryAlias;\n};\n\nexport const memoryStoreRequestSchema = memoryStoreRequestShape.transform(\n  (request): MemoryStoreParsedRequest => {\n    if (request.category === undefined || !isMemoryCategoryAlias(request.category)) {\n      // Spread so the narrowed canonical category, not the wide wire union,\n      // becomes the output type.\n      return { ...request, category: request.category };\n    }\n    return {\n      ...request,\n      category: MEMORY_CATEGORY_ALIAS_TO_CANONICAL[request.category],\n      rawCategory: request.category,\n    };\n  },\n);\n\nexport const suggestionSubmitRequestSchema = memoryStoreRequestSchema;\n\n// ---------------------------------------------------------------------------\n// Review disposition\n// ---------------------------------------------------------------------------\n\nexport const reviewDispositionRequestSchema = z.object({\n  memoryId: z.string().trim().min(1, \"memoryId is required\"),\n  status: z.enum([\n    \"active\", \"pending_review\", \"quarantined\", \"rejected\", \"superseded\", \"archived\",\n  ]),\n  reasonCode: z.string().trim().min(1, \"reasonCode is required\"),\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone promote\n// ---------------------------------------------------------------------------\n\nexport const trustZonePromoteRequestSchema = z.object({\n  recordId: z.string().trim().min(1, \"recordId is required\"),\n  targetZone: z.enum([\"working\", \"trusted\"], {\n    error: \"targetZone must be 'working' or 'trusted'\",\n  }),\n  promotionReason: z.string().trim().min(1, \"promotionReason is required\"),\n  recordedAt: z.string().trim().optional(),\n  summary: z.string().trim().max(5000).optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone demo-seed\n// ---------------------------------------------------------------------------\n\nexport const trustZoneDemoSeedRequestSchema = z.object({\n  scenario: z.string().trim().max(256).optional(),\n  recordedAt: z.string().trim().optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// LCM search\n// ---------------------------------------------------------------------------\n\nexport const lcmSearchRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  sessionPrefix: z.string().trim().min(1).max(512).optional(),\n  namespace: namespaceSchema,\n  limit: z.number().int().min(1).max(100).optional(),\n});\n\nexport const lcmCompactionFlushRequestSchema = z\n  .object({\n    sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n    namespace: namespaceSchema,\n    cwd: cwdSchema,\n    projectTag: projectTagSchema,\n    /**\n     * Optional multi-namespace flush used by delegate lifecycle replay. The\n     * server handles the whole list as one quota-counted write.\n     */\n    namespaces: z.array(z.string().trim().max(256)).min(1).max(64).optional(),\n  })\n  .superRefine((value, ctx) => {\n    if (value.namespace !== undefined && value.namespaces !== undefined) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"namespace and namespaces are mutually exclusive\",\n        path: [\"namespaces\"],\n      });\n    }\n    if (\n      value.namespaces !== undefined &&\n      new Set(value.namespaces).size !== value.namespaces.length\n    ) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"namespaces must not contain duplicates\",\n        path: [\"namespaces\"],\n      });\n    }\n  });\n\nexport const extractionForceFlushRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n  cwd: cwdSchema,\n  projectTag: projectTagSchema,\n  deadlineMs: deadlineMsSchema,\n});\n\nexport const lcmCompactionRecordRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n  tokensBefore: z.number().int().min(0, \"tokensBefore must be a non-negative integer\"),\n  tokensAfter: z.number().int().min(0, \"tokensAfter must be a non-negative integer\"),\n});\n\n// ---------------------------------------------------------------------------\n// Day summary\n// ---------------------------------------------------------------------------\n\nexport const daySummaryRequestSchema = z.object({\n  memories: z.string().max(100000).optional(),\n  includeLocation: z.boolean().optional(),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  timeZone: timeZoneSchema.optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Capsule export\n// ---------------------------------------------------------------------------\n\nconst capsuleTopLevelSegmentSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine(\n    (value) => !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a top-level directory name without path separators\",\n  );\n\nconst capsulePeerIdSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(256)\n  .refine(\n    (value) => value !== \".\" && value !== \"..\" && !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a plain peer id without path separators\",\n  );\n\nconst capsuleIsoSinceSchema = z\n  .string()\n  .trim()\n  .min(1, \"since must be a non-empty ISO 8601 timestamp\")\n  .max(128)\n  .refine(\n    isValidCapsuleSince,\n    \"since must be a valid ISO 8601 timestamp with no calendar overflow\",\n  );\n\nexport const capsuleExportRequestSchema = z\n  .object({\n    name: z\n      .string()\n      .trim()\n      .min(1, \"name is required\")\n      .max(64, \"name must be 64 characters or fewer\")\n      .regex(\n        CAPSULE_ID_PATTERN,\n        \"name must be alphanumeric with single dashes (no spaces, no leading/trailing dashes)\",\n      ),\n    namespace: namespaceSchema,\n    since: capsuleIsoSinceSchema.optional(),\n    includeKinds: z.array(capsuleTopLevelSegmentSchema).max(50).optional(),\n    peerIds: z.array(capsulePeerIdSchema).max(100).optional(),\n    includeTranscripts: z.boolean().optional(),\n    encrypt: z.boolean().optional(),\n  });\n\nexport const capsuleImportRequestSchema = z\n  .object({\n    archivePath: z.string().trim().min(1, \"archivePath is required\").max(4096),\n    namespace: namespaceSchema,\n    mode: z.enum([\"skip\", \"overwrite\", \"fork\"]).optional(),\n    passphrase: z.string().min(1, \"passphrase must not be empty\").max(4096).optional(),\n  });\n\nexport const capsuleListRequestSchema = z\n  .object({\n    namespace: namespaceSchema,\n    sessionKey: sessionKeySchema,\n  });\n\n// ---------------------------------------------------------------------------\n// Offline sync\n// ---------------------------------------------------------------------------\n\nfunction isValidOfflineSyncPath(value: string): boolean {\n  try {\n    validateArchiveRelativePath(value, \"path\");\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nconst offlineSyncPathSchema = z\n  .string()\n  .trim()\n  .min(1, \"path must be non-empty\")\n  .max(4096)\n  .refine(\n    isValidOfflineSyncPath,\n    \"path must be a POSIX relative path without unsafe segments\",\n  );\n\nconst offlineSyncFileStateSchema = z.object({\n  path: offlineSyncPathSchema,\n  sha256: z.string().regex(/^[a-f0-9]{64}$/i, \"sha256 must be a 64-character hex digest\"),\n  bytes: z.number().int().min(0),\n  mtimeMs: z.number().finite().min(0).max(OFFLINE_SYNC_MAX_MTIME_MS),\n});\n\nconst offlineSyncBaseCapturedAtSchema = z\n  .string()\n  .trim()\n  .min(1, \"baseCapturedAt must be non-empty when provided\")\n  .max(64)\n  .refine((value) => Number.isFinite(Date.parse(value)), {\n    message: \"baseCapturedAt must be a valid ISO 8601 timestamp\",\n  });\n\nexport const offlineSyncSnapshotRequestSchema = z.object({\n  namespace: namespaceSchema,\n  includeTranscripts: z.boolean().optional(),\n  includeContent: z.boolean().optional(),\n  baseCapturedAt: offlineSyncBaseCapturedAtSchema.optional(),\n  baseFiles: z\n    .array(offlineSyncFileStateSchema)\n    .max(300_000, \"baseFiles must contain 300000 or fewer entries\")\n    .optional(),\n});\n\nexport const offlineSyncApplyRequestSchema = z.object({\n  namespace: namespaceSchema,\n  // zod 4: refine messages cannot override its synthesized nonoptional check,\n  // so presence is enforced on the field itself.\n  changeset: z.custom<unknown>((value) => value !== undefined && value !== null, \"changeset is required\"),\n  returnCurrentFiles: z.boolean().optional(),\n});\n\nexport const offlineSyncFilesRequestSchema = z.object({\n  namespace: namespaceSchema,\n  includeTranscripts: z.boolean().optional(),\n  paths: z\n    .array(offlineSyncPathSchema)\n    .max(5000, \"paths must contain 5000 or fewer entries\"),\n});\n\nexport const offlineSyncFileContentRequestSchema = z.object({\n  namespace: namespaceSchema,\n  includeTranscripts: z.boolean().optional(),\n  path: offlineSyncPathSchema,\n  offset: z.number().int().min(0).optional(),\n  length: z.number().int().min(1).max(OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Action confidence\n// ---------------------------------------------------------------------------\n\n// Outer .optional() keeps the inferred property optional: a transform-typed\n// property becomes required-with-undefined under zod 4 inference, breaking\n// object literals that legitimately omit the key.\nconst nullableOptional = <T extends z.ZodTypeAny>(schema: T) =>\n  schema.nullable().transform((value) => value ?? undefined).optional();\n\nconst actionConfidenceRuleSchema = z\n  .object({\n    kind: z.enum(ACTION_CONFIDENCE_RULE_KINDS),\n    description: nullableOptional(z.string().trim().min(1).max(2000)),\n    matched: nullableOptional(z.boolean()),\n  })\n  .strict();\n\nconst actionConfidenceMemorySchema = z\n  .object({\n    source: nullableOptional(z.string().trim().min(1).max(256)),\n    created: nullableOptional(z.string().trim().min(1).max(128)),\n    updated: nullableOptional(z.string().trim().min(1).max(128)),\n    scope: nullableOptional(z.string().trim().min(1).max(512)),\n    userContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    retrievalReason: nullableOptional(z.string().trim().min(1).max(2000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    stale: nullableOptional(z.boolean()),\n    corrected: nullableOptional(z.boolean()),\n    correctionState: nullableOptional(z.enum([\"none\", \"correction\", \"superseded\", \"disputed\", \"forgotten\"])),\n    safeToUse: nullableOptional(z.boolean()),\n    safety: nullableOptional(z.enum([\"safe\", \"requires-review\", \"blocked\"])),\n    safetyReasons: nullableOptional(z.array(z.string().trim().min(1).max(1000)).max(50)),\n  })\n  .strict();\n\nexport const actionConfidenceRequestSchema = z\n  .object({\n    intendedAction: nullableOptional(z.string().trim().min(1).max(1000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    risk: nullableOptional(z.enum(ACTION_CONFIDENCE_RISK_CATEGORIES)),\n    contextReadiness: nullableOptional(z.enum(ACTION_CONFIDENCE_CONTEXT_READINESS)),\n    currentContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    userRules: nullableOptional(z.array(actionConfidenceRuleSchema).max(100)),\n    retrievedMemories: nullableOptional(z.array(actionConfidenceMemorySchema).max(200)),\n  })\n  .strict();\n\n// ---------------------------------------------------------------------------\n// Inferred types\n// ---------------------------------------------------------------------------\n\nexport type RecallRequest = z.infer<typeof recallRequestSchema>;\nexport type RecallExplainRequest = z.infer<typeof recallExplainRequestSchema>;\nexport type SetCodingContextRequest = z.infer<typeof setCodingContextRequestSchema>;\nexport type ObserveRequest = z.infer<typeof observeRequestSchema>;\nexport type MemoryStoreRequest = z.infer<typeof memoryStoreRequestSchema>;\nexport type SuggestionSubmitRequest = z.infer<typeof suggestionSubmitRequestSchema>;\nexport type ReviewDispositionRequest = z.infer<typeof reviewDispositionRequestSchema>;\nexport type TrustZonePromoteRequest = z.infer<typeof trustZonePromoteRequestSchema>;\nexport type TrustZoneDemoSeedRequest = z.infer<typeof trustZoneDemoSeedRequestSchema>;\nexport type LcmSearchRequest = z.infer<typeof lcmSearchRequestSchema>;\nexport type LcmCompactionFlushRequest = z.infer<typeof lcmCompactionFlushRequestSchema>;\nexport type ExtractionForceFlushRequest = z.infer<typeof extractionForceFlushRequestSchema>;\nexport type LcmCompactionRecordRequest = z.infer<typeof lcmCompactionRecordRequestSchema>;\nexport type DaySummaryRequest = z.infer<typeof daySummaryRequestSchema>;\nexport type CapsuleExportRequest = z.infer<typeof capsuleExportRequestSchema>;\nexport type CapsuleImportRequest = z.infer<typeof capsuleImportRequestSchema>;\nexport type CapsuleListRequest = z.infer<typeof capsuleListRequestSchema>;\nexport type OfflineSyncApplyRequest = z.infer<typeof offlineSyncApplyRequestSchema>;\nexport type OfflineSyncSnapshotRequest = z.infer<typeof offlineSyncSnapshotRequestSchema>;\nexport type OfflineSyncFilesRequest = z.infer<typeof offlineSyncFilesRequestSchema>;\nexport type OfflineSyncFileContentRequest = z.infer<typeof offlineSyncFileContentRequestSchema>;\nexport type ActionConfidenceRequest = z.infer<typeof actionConfidenceRequestSchema>;\n\n// ---------------------------------------------------------------------------\n// Validation helper\n// ---------------------------------------------------------------------------\n\nexport type SchemaName =\n  | \"recall\"\n  | \"recallExplain\"\n  | \"setCodingContext\"\n  | \"observe\"\n  | \"memoryStore\"\n  | \"suggestionSubmit\"\n  | \"reviewDisposition\"\n  | \"trustZonePromote\"\n  | \"trustZoneDemoSeed\"\n  | \"lcmSearch\"\n  | \"lcmCompactionFlush\"\n  | \"extractionForceFlush\"\n  | \"lcmCompactionRecord\"\n  | \"daySummary\"\n  | \"capsuleExport\"\n  | \"capsuleImport\"\n  | \"capsuleList\"\n  | \"offlineSyncSnapshot\"\n  | \"offlineSyncFiles\"\n  | \"offlineSyncFileContent\"\n  | \"offlineSyncApply\"\n  | \"actionConfidence\";\n\nexport type SchemaTypeFor<N extends SchemaName> =\n  N extends \"recall\" ? RecallRequest\n  : N extends \"recallExplain\" ? RecallExplainRequest\n  : N extends \"setCodingContext\" ? SetCodingContextRequest\n  : N extends \"observe\" ? ObserveRequest\n  : N extends \"memoryStore\" ? MemoryStoreRequest\n  : N extends \"suggestionSubmit\" ? SuggestionSubmitRequest\n  : N extends \"reviewDisposition\" ? ReviewDispositionRequest\n  : N extends \"trustZonePromote\" ? TrustZonePromoteRequest\n  : N extends \"trustZoneDemoSeed\" ? TrustZoneDemoSeedRequest\n  : N extends \"lcmSearch\" ? LcmSearchRequest\n  : N extends \"lcmCompactionFlush\" ? LcmCompactionFlushRequest\n  : N extends \"extractionForceFlush\" ? ExtractionForceFlushRequest\n  : N extends \"lcmCompactionRecord\" ? LcmCompactionRecordRequest\n  : N extends \"daySummary\" ? DaySummaryRequest\n  : N extends \"capsuleExport\" ? CapsuleExportRequest\n  : N extends \"capsuleImport\" ? CapsuleImportRequest\n  : N extends \"capsuleList\" ? CapsuleListRequest\n  : N extends \"offlineSyncSnapshot\" ? OfflineSyncSnapshotRequest\n  : N extends \"offlineSyncFiles\" ? OfflineSyncFilesRequest\n  : N extends \"offlineSyncFileContent\" ? OfflineSyncFileContentRequest\n  : N extends \"offlineSyncApply\" ? OfflineSyncApplyRequest\n  : N extends \"actionConfidence\" ? ActionConfidenceRequest\n  : never;\n\nconst schemas: Record<SchemaName, z.ZodTypeAny> = {\n  recall: recallRequestSchema,\n  recallExplain: recallExplainRequestSchema,\n  setCodingContext: setCodingContextRequestSchema,\n  observe: observeRequestSchema,\n  memoryStore: memoryStoreRequestSchema,\n  suggestionSubmit: suggestionSubmitRequestSchema,\n  reviewDisposition: reviewDispositionRequestSchema,\n  trustZonePromote: trustZonePromoteRequestSchema,\n  trustZoneDemoSeed: trustZoneDemoSeedRequestSchema,\n  lcmSearch: lcmSearchRequestSchema,\n  lcmCompactionFlush: lcmCompactionFlushRequestSchema,\n  extractionForceFlush: extractionForceFlushRequestSchema,\n  lcmCompactionRecord: lcmCompactionRecordRequestSchema,\n  daySummary: daySummaryRequestSchema,\n  capsuleExport: capsuleExportRequestSchema,\n  capsuleImport: capsuleImportRequestSchema,\n  capsuleList: capsuleListRequestSchema,\n  offlineSyncSnapshot: offlineSyncSnapshotRequestSchema,\n  offlineSyncFiles: offlineSyncFilesRequestSchema,\n  offlineSyncFileContent: offlineSyncFileContentRequestSchema,\n  offlineSyncApply: offlineSyncApplyRequestSchema,\n  actionConfidence: actionConfidenceRequestSchema,\n};\n\n/**\n * Validate a request body against the named schema.\n * Returns `{ success: true, data }` on pass or\n * `{ success: false, error }` on failure with field-level detail.\n */\nexport function validateRequest<T = unknown>(\n  schemaName: SchemaName,\n  body: unknown,\n): { success: true; data: T } | { success: false; error: SchemaValidationError } {\n  const schema = schemas[schemaName];\n  if (!schema) {\n    return {\n      success: false,\n      error: {\n        error: `unknown schema: ${schemaName}`,\n        code: \"validation_error\",\n        details: [],\n      },\n    };\n  }\n  const result = schema.safeParse(stripNullsExceptCodingContext(body));\n  if (result.success) {\n    return { success: true, data: result.data as T };\n  }\n  return { success: false, error: formatZodError(result.error) };\n}\n\nfunction stripNullsExceptCodingContext(data: unknown): unknown {\n  if (!data || typeof data !== \"object\" || Array.isArray(data)) return data;\n  const cleaned: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(data as Record<string, unknown>)) {\n    if (value === null && key !== \"codingContext\") continue;\n    cleaned[key] = value;\n  }\n  return cleaned;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAIA,SAAS,SAAS;AA0BX,SAAS,eAAe,OAA0C;AACvE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpC,OAAO,MAAM,KAAK,KAAK,GAAG,KAAK;AAAA,MAC/B,SAAS,MAAM;AAAA,IACjB,EAAE;AAAA,EACJ;AACF;AAMA,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpE,IAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACxE,IAAM,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,IAAI,EAAE,SAAS;AACrG,IAAM,mBAAmB,EACtB,OAAO,EACP,KAAK,EACL,IAAI,GAAG,4CAA4C,EACnD,IAAI,GAAG,EACP,SAAS;AACZ,IAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,OAAO,gBAAgB,EAAE,SAAS;AAC1F,IAAM,eAAe,EAAE,QAAQ,EAAE,SAAS;AAC1C,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtD,IAAM,iBAAiB,EACpB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,OAAO,CAAC,UAAU;AACjB,MAAI;AACF,SAAK,eAAe,QAAW,EAAE,UAAU,MAAM,CAAC;AAClD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAAG,+BAA+B;AAY7B,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,GAAG;AAAA,EAClF,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oCAAoC,EAAE,IAAI,IAAI;AAAA,EACjF,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACrD,CAAC,EACA,SAAS;AASL,IAAM,yBAAyB,EAAE,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC;AASjE,IAAM,iBAAiB,EAAE,KAAK,CAAC,OAAO,KAAK,CAAC;AAE5C,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,WAAW,QAAQ,YAAY,CAAC,EAAE,SAAS;AAAA,EAC9E,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,gBAAgB;AAAA,EAChB,YAAY,uBAAuB,SAAS;AAAA,EAC5C,eAAe,oBAAoB,SAAS;AAAA;AAAA,EAE5C,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKL,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOZ,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6CAA6C,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlE,UAAU,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAOM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,eAAe,oBAAoB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,4CAA4C,EAAE,IAAI,GAAG,EAAE,SAAS;AACvG,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,kBAAkB,UAAa,MAAM,eAAe,QAAW;AACvE,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,eAAe;AAAA,IACxB,CAAC;AAAA,EACH;AACF,CAAC;AAMH,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,mCAAmC;AAAA,EAC9D,cAAc,EACX,KAAK,CAAC,UAAU,aAAa,YAAY,MAAM,iBAAiB,QAAQ,CAAC,EACzE,SAAS,EACT,SAAS;AAAA,EACZ,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAO,EACJ;AAAA,IACC,EAAE,OAAO;AAAA,MACP,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,MACrD,MAAM,EAAE,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,MACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,EACC,SAAS,EACT,SAAS;AACd,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,UAAU,EAAE,MAAM,aAAa,EAAE,IAAI,GAAG,oCAAoC;AAAA,EAC5E,WAAW;AAAA,EACX,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrC,gBAAgB;AAAA;AAAA,EAEhB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKL,YAAY;AACd,CAAC;AAMM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,mBAAmB,EAAE,IAAI,GAAI;AAAA;AAAA,EAE7D,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,EAClE,WAAW;AAAA,EACX,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAMD,IAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,GAAK;AAM7E,IAAM,kCAAkC;AAAA,EACtC;AAAA,EAAQ;AAAA,EAAc;AAAA,EAAc;AAAA,EAAU;AAAA,EAC9C;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAc;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EACtE;AACF;AASA,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,qCAEF;AAAA,EACF,SAAS;AAAA,EACT,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,gBAAgB;AAClB;AAEO,SAAS,sBAAsB,OAA6C;AACjF,SAAO,OAAO,UAAU,eAAe,KAAK,oCAAoC,KAAK;AACvF;AAQO,SAAS,0BAA0B,OAAmC;AAC3E,SAAO,sBAAsB,KAAK,IAAI,mCAAmC,KAAK,IAAI;AACpF;AASO,SAAS,sBAAsB,aAAoE;AACxG,SAAO,gBAAgB,UAAa,sBAAsB,WAAW,IACjE,EAAE,MAAM,aAAa,IAAI,OAAO,IAChC;AACN;AAUO,SAAS,sBAAsB,UAAoD;AACxF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,QAAM,WAAW;AACjB,QAAM,SAAS,SAAS;AACxB,MAAI,OAAO,WAAW,YAAY,sBAAsB,MAAM,EAAG,QAAO;AACxE,QAAM,WAAW,SAAS;AAC1B,SAAO,OAAO,aAAa,YAAY,sBAAsB,QAAQ,IAAI,WAAW;AACtF;AAQO,SAAS,wBACd,UACA,kBACkD;AAClD,QAAM,YAA8D,EAAE,GAAG,SAAS;AAClF,MAAI,qBAAqB,QAAW;AAClC,cAAU,mBAAmB;AAAA,EAC/B,OAAO;AACL,WAAO,UAAU;AAAA,EACnB;AACA,SAAO;AACT;AAEA,IAAM,qBAAqB,EAAE;AAAA,EAC3B,CAAC,GAAG,iCAAiC,GAAG,2BAA2B;AAAA,EACnE;AAAA,IACE,OAAO,4BAA4B,CAAC,GAAG,iCAAiC,GAAG,2BAA2B,EAAE,KAAK,IAAI,CAAC;AAAA,EACpH;AACF;AAEA,IAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3D,IAAM,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACjE,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,IAAM,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAEhE,IAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU,mBAAmB,SAAS;AAAA,EACtC,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AAAA,EACX,KAAK;AAAA,EACL,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,EAKd,KAAK;AAAA,EACL,YAAY;AACd,CAAC;AAeM,IAAM,2BAA2B,wBAAwB;AAAA,EAC9D,CAAC,YAAsC;AACrC,QAAI,QAAQ,aAAa,UAAa,CAAC,sBAAsB,QAAQ,QAAQ,GAAG;AAG9E,aAAO,EAAE,GAAG,SAAS,UAAU,QAAQ,SAAS;AAAA,IAClD;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,UAAU,mCAAmC,QAAQ,QAAQ;AAAA,MAC7D,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,gCAAgC;AAMtC,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,QAAQ,EAAE,KAAK;AAAA,IACb;AAAA,IAAU;AAAA,IAAkB;AAAA,IAAe;AAAA,IAAY;AAAA,IAAc;AAAA,EACvE,CAAC;AAAA,EACD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB;AAAA,EAC7D,WAAW;AACb,CAAC;AAMM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,YAAY,EAAE,KAAK,CAAC,WAAW,SAAS,GAAG;AAAA,IACzC,OAAO;AAAA,EACT,CAAC;AAAA,EACD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6BAA6B;AAAA,EACvE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC9C,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,WAAW;AAAA,EACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AAAA,EACX,KAAK;AAAA,EACL,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAC1E,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,cAAc,UAAa,MAAM,eAAe,QAAW;AACnE,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,YAAY;AAAA,IACrB,CAAC;AAAA,EACH;AACA,MACE,MAAM,eAAe,UACrB,IAAI,IAAI,MAAM,UAAU,EAAE,SAAS,MAAM,WAAW,QACpD;AACA,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,YAAY;AAAA,IACrB,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AAAA,EACX,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,YAAY;AACd,CAAC;AAEM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AAAA,EACX,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,6CAA6C;AAAA,EACnF,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,4CAA4C;AACnF,CAAC;AAMM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,eAAe,SAAS;AACpC,CAAC;AAMD,IAAM,+BAA+B,EAClC,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EACvD;AACF;AAEF,IAAM,sBAAsB,EACzB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,UAAU,OAAO,UAAU,QAAQ,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EAC1F;AACF;AAEF,IAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL,IAAI,GAAG,8CAA8C,EACrD,IAAI,GAAG,EACP;AAAA,EACC;AAAA,EACA;AACF;AAEK,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,MAAM,EACH,OAAO,EACP,KAAK,EACL,IAAI,GAAG,kBAAkB,EACzB,IAAI,IAAI,qCAAqC,EAC7C;AAAA,IACC;AAAA,IACA;AAAA,EACF;AAAA,EACF,WAAW;AAAA,EACX,OAAO,sBAAsB,SAAS;AAAA,EACtC,cAAc,EAAE,MAAM,4BAA4B,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACrE,SAAS,EAAE,MAAM,mBAAmB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAEI,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,yBAAyB,EAAE,IAAI,IAAI;AAAA,EACzE,WAAW;AAAA,EACX,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,MAAM,CAAC,EAAE,SAAS;AAAA,EACrD,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,8BAA8B,EAAE,IAAI,IAAI,EAAE,SAAS;AACnF,CAAC;AAEI,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,WAAW;AAAA,EACX,YAAY;AACd,CAAC;AAMH,SAAS,uBAAuB,OAAwB;AACtD,MAAI;AACF,gCAA4B,OAAO,MAAM;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL,IAAI,GAAG,wBAAwB,EAC/B,IAAI,IAAI,EACR;AAAA,EACC;AAAA,EACA;AACF;AAEF,IAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,0CAA0C;AAAA,EACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,yBAAyB;AACnE,CAAC;AAED,IAAM,kCAAkC,EACrC,OAAO,EACP,KAAK,EACL,IAAI,GAAG,gDAAgD,EACvD,IAAI,EAAE,EACN,OAAO,CAAC,UAAU,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,EACrD,SAAS;AACX,CAAC;AAEI,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,WAAW;AAAA,EACX,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACrC,gBAAgB,gCAAgC,SAAS;AAAA,EACzD,WAAW,EACR,MAAM,0BAA0B,EAChC,IAAI,KAAS,gDAAgD,EAC7D,SAAS;AACd,CAAC;AAEM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,WAAW;AAAA;AAAA;AAAA,EAGX,WAAW,EAAE,OAAgB,CAAC,UAAU,UAAU,UAAa,UAAU,MAAM,uBAAuB;AAAA,EACtG,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAC3C,CAAC;AAEM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,WAAW;AAAA,EACX,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,OAAO,EACJ,MAAM,qBAAqB,EAC3B,IAAI,KAAM,0CAA0C;AACzD,CAAC;AAEM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,WAAW;AAAA,EACX,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,MAAM;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,yCAAyC,EAAE,SAAS;AAC1F,CAAC;AASD,IAAM,mBAAmB,CAAyB,WAChD,OAAO,SAAS,EAAE,UAAU,CAAC,UAAU,SAAS,MAAS,EAAE,SAAS;AAEtE,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,MAAM,EAAE,KAAK,4BAA4B;AAAA,EACzC,aAAa,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EAChE,SAAS,iBAAiB,EAAE,QAAQ,CAAC;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,+BAA+B,EAClC,OAAO;AAAA,EACN,QAAQ,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC1D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,OAAO,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EACzD,mBAAmB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACtF,iBAAiB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACpE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,OAAO,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACnC,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,iBAAiB,iBAAiB,EAAE,KAAK,CAAC,QAAQ,cAAc,cAAc,YAAY,WAAW,CAAC,CAAC;AAAA,EACvG,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,QAAQ,iBAAiB,EAAE,KAAK,CAAC,QAAQ,mBAAmB,SAAS,CAAC,CAAC;AAAA,EACvE,eAAe,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACrF,CAAC,EACA,OAAO;AAEH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACnE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,MAAM,iBAAiB,EAAE,KAAK,iCAAiC,CAAC;AAAA,EAChE,kBAAkB,iBAAiB,EAAE,KAAK,mCAAmC,CAAC;AAAA,EAC9E,sBAAsB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACzF,WAAW,iBAAiB,EAAE,MAAM,0BAA0B,EAAE,IAAI,GAAG,CAAC;AAAA,EACxE,mBAAmB,iBAAiB,EAAE,MAAM,4BAA4B,EAAE,IAAI,GAAG,CAAC;AACpF,CAAC,EACA,OAAO;AAkFV,IAAM,UAA4C;AAAA,EAChD,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,SAAS;AAAA,EACT,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,eAAe;AAAA,EACf,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,kBAAkB;AAAA,EAClB,kBAAkB;AACpB;AAOO,SAAS,gBACd,YACA,MAC+E;AAC/E,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,OAAO,mBAAmB,UAAU;AAAA,QACpC,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,8BAA8B,IAAI,CAAC;AACnE,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,SAAS,MAAM,MAAM,OAAO,KAAU;AAAA,EACjD;AACA,SAAO,EAAE,SAAS,OAAO,OAAO,eAAe,OAAO,KAAK,EAAE;AAC/D;AAEA,SAAS,8BAA8B,MAAwB;AAC7D,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,QAAM,UAAmC,CAAC;AAC1C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC1E,QAAI,UAAU,QAAQ,QAAQ,gBAAiB;AAC/C,YAAQ,GAAG,IAAI;AAAA,EACjB;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-KASJJGRG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/buffer-eviction.ts"],"sourcesContent":["import type { BufferEntryState } from \"./types.js\";\n\nconst EMPTY_ENTRY: BufferEntryState = { turns: [], lastExtractionAt: null, extractionCount: 0 };\n\nexport interface BufferEvictionHooks {\n  /** Last activity time (ms) of an entry; older entries are evicted first. */\n  activityAt(entry: BufferEntryState): number;\n  /** Accepted captures exit via refusal/backpressure, never eviction (#3251). */\n  holdsAcceptedCapture(entry: BufferEntryState | undefined): boolean;\n}\n\n/**\n * Pick the keys to evict so `entries` returns to `maxCount`: the oldest empty\n * sessions first; retained failed extractions (#1908) keep their turns, so if\n * empty entries alone cannot reach the cap the oldest NON-empty sessions go\n * too rather than growing unboundedly. \"default\", the retained keys and\n * entries holding an accepted capture are never chosen.\n */\nexport function selectEvictedBufferKeys(\n  entries: Readonly<Record<string, BufferEntryState>>,\n  retainKeys: readonly string[],\n  maxCount: number,\n  hooks: BufferEvictionHooks,\n): string[] {\n  const keys = Object.keys(entries);\n  if (keys.length <= maxCount) return [];\n\n  const insertionOrder = new Map(keys.map((key, index) => [key, index]));\n  const byOldestActivity = (left: string, right: string): number => {\n    const leftAt = hooks.activityAt(entries[left] ?? EMPTY_ENTRY);\n    const rightAt = hooks.activityAt(entries[right] ?? EMPTY_ENTRY);\n    if (leftAt !== rightAt) return leftAt - rightAt;\n    return (insertionOrder.get(left) ?? 0) - (insertionOrder.get(right) ?? 0);\n  };\n  const candidates = keys.filter(\n    (key) => key !== \"default\" && !retainKeys.includes(key) && !hooks.holdsAcceptedCapture(entries[key]),\n  );\n  const emptyRemovable = candidates\n    .filter((key) => (entries[key]?.turns.length ?? 0) === 0)\n    .sort(byOldestActivity);\n\n  const removableCount = Math.max(0, keys.length - maxCount);\n  const evicted = emptyRemovable.slice(0, removableCount);\n  if (evicted.length < removableCount) {\n    const nonEmptyRemovable = candidates\n      .filter((key) => (entries[key]?.turns.length ?? 0) > 0)\n      .sort(byOldestActivity);\n    return evicted.concat(nonEmptyRemovable.slice(0, removableCount - evicted.length));\n  }\n  return evicted;\n}\n"],"mappings":";AAEA,IAAM,cAAgC,EAAE,OAAO,CAAC,GAAG,kBAAkB,MAAM,iBAAiB,EAAE;AAgBvF,SAAS,wBACd,SACA,YACA,UACA,OACU;AACV,QAAM,OAAO,OAAO,KAAK,OAAO;AAChC,MAAI,KAAK,UAAU,SAAU,QAAO,CAAC;AAErC,QAAM,iBAAiB,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC;AACrE,QAAM,mBAAmB,CAAC,MAAc,UAA0B;AAChE,UAAM,SAAS,MAAM,WAAW,QAAQ,IAAI,KAAK,WAAW;AAC5D,UAAM,UAAU,MAAM,WAAW,QAAQ,KAAK,KAAK,WAAW;AAC9D,QAAI,WAAW,QAAS,QAAO,SAAS;AACxC,YAAQ,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,EACzE;AACA,QAAM,aAAa,KAAK;AAAA,IACtB,CAAC,QAAQ,QAAQ,aAAa,CAAC,WAAW,SAAS,GAAG,KAAK,CAAC,MAAM,qBAAqB,QAAQ,GAAG,CAAC;AAAA,EACrG;AACA,QAAM,iBAAiB,WACpB,OAAO,CAAC,SAAS,QAAQ,GAAG,GAAG,MAAM,UAAU,OAAO,CAAC,EACvD,KAAK,gBAAgB;AAExB,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,SAAS,QAAQ;AACzD,QAAM,UAAU,eAAe,MAAM,GAAG,cAAc;AACtD,MAAI,QAAQ,SAAS,gBAAgB;AACnC,UAAM,oBAAoB,WACvB,OAAO,CAAC,SAAS,QAAQ,GAAG,GAAG,MAAM,UAAU,KAAK,CAAC,EACrD,KAAK,gBAAgB;AACxB,WAAO,QAAQ,OAAO,kBAAkB,MAAM,GAAG,iBAAiB,QAAQ,MAAM,CAAC;AAAA,EACnF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-KQUSP6LB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/storage/content-hash-index.ts"],"sourcesContent":["// Content-hash dedup index for facts, extracted from storage.ts (issue #1909 /\n// PR #2016 write-hot-paths). Self-contained: cross-process locked reconcile /\n// rebuild saves plus the deferred durable-retry machinery. storage.ts imports\n// these back and re-exports the class + companion types that were previously\n// part of its public API.\nimport { mkdir, stat } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { computeContentHash, normalizeContent } from \"../content-hash.js\";\nimport { log } from \"../logger.js\";\nimport { SecureStoreLockedError, readMaybeEncryptedFile, writeMaybeEncryptedFile } from \"../secure-store/secure-fs.js\";\nimport { isErrnoCode } from \"../utils/errno.js\";\nimport { withHeldFileLock } from \"../utils/serialize-mutations.js\";\n\n/**\n * Stale threshold (ms) for the per-file advisory lock guarding a fact-hash\n * index merge-save (issue #1909 review round 7). The critical section is a\n * single read+atomic-rewrite of one index file (≤ a few MB), so a holder older\n * than this is treated as crashed. Generous to tolerate slow/encrypted disks\n * without breaking a legitimately in-progress publish.\n */\nconst CONTENT_HASH_INDEX_LOCK_STALE_MS = 30_000;\n/** Version marker for the normalized Unicode hash index format. */\nconst CONTENT_HASH_INDEX_FORMAT_HEADER = \"# remnic-content-hash-index:v2\";\n\nfunction parseHashIndex(raw: string): { versioned: boolean; hashes: Set<string> } {\n  const lines = raw\n    .split(\"\\n\")\n    .map((line) => line.trim())\n    .filter((line) => line.length > 0);\n  if (lines[0] !== CONTENT_HASH_INDEX_FORMAT_HEADER) {\n    return { versioned: false, hashes: new Set() };\n  }\n  return { versioned: true, hashes: new Set(lines.slice(1)) };\n}\n\nfunction serializeHashIndex(hashes: Set<string>): string {\n  return `${CONTENT_HASH_INDEX_FORMAT_HEADER}\\n${[...hashes].join(\"\\n\")}\\n`;\n}\n\n/**\n * Durable-retry policy for a deferred content-hash reconcile save whose\n * cross-process lock acquire timed out (issue #1909 / PR #2016). When the lock\n * is contended past `withHeldFileLock`'s bounded wait, the added hashes are held\n * only in this process's memory; relying on \"some later batch save\" is not\n * durable (the run may be the last before idle/shutdown), and a long-lived peer\n * that already built its authoritative in-memory index will not see the write.\n * So we schedule a bounded, exponentially-backed-off background retry that keeps\n * re-attempting the locked publish until it lands. Bounded because the durable\n * fact `.md` is already on disk and a process restart rebuilds the index from\n * the corpus regardless — exhausting retries degrades to that rebuild safety\n * net, never to data loss or a fatal append failure.\n */\nconst CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS = 5;\n/** Base backoff (ms) before the first deferred reconcile-save retry; doubles each attempt. */\nconst CONTENT_HASH_INDEX_RETRY_BASE_MS = 500;\n/** Ceiling (ms) for the exponential reconcile-save retry backoff. */\nexport const CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS = 5_000;\n\n/**\n * Tuning for {@link ContentHashIndex} cross-process lock waits and the\n * deferred reconcile-save durable retry (issue #1909 / PR #2016). All optional;\n * production uses the module defaults. Tests inject small values so the\n * lock-timeout + retry path is exercised deterministically without real\n * multi-second waits.\n */\nexport interface ContentHashIndexLockOptions {\n  /** Bounded wait to acquire the per-file advisory lock; passed to `withHeldFileLock` (default 5000ms). */\n  readonly maxWaitMs?: number;\n  /** Poll interval while waiting for a busy lock (default 50ms). */\n  readonly pollMs?: number;\n  /** Base backoff before the first deferred-save retry (default 500ms). */\n  readonly retryBaseMs?: number;\n  /** Max deferred-save retries before falling back to the corpus-rebuild safety net (default 5). */\n  readonly retryMaxAttempts?: number;\n  /**\n   * Tombstone-blocked capture write-lock backoff (COS-392). These do not\n   * change the fact-hash index lock. Omitted fields use the 50ms / 2s / 60s\n   * defaults. Converge copies its config here before replicating a file.\n   */\n  readonly captureWriteLockInitialDelayMs?: number;\n  readonly captureWriteLockMaxDelayMs?: number;\n  readonly captureWriteLockDeadlineMs?: number;\n  /** Apply abort signal. Checked before each probe, during backoff, and before the write. */\n  readonly captureWriteLockSignal?: AbortSignal;\n}\n\n/**\n * Thrown when the fact-hash index cannot be made authoritative — the\n * cross-process rebuild lock could not be acquired within the bounded retry\n * budget (PR #2016). Callers that require an authoritative dedup answer surface\n * this instead of silently trusting a stale loaded snapshot.\n */\nexport class FactHashIndexNotAuthoritativeError extends Error {\n  constructor(stateDir: string) {\n    super(\n      `fact-hash index is not authoritative: the cross-process rebuild lock for ${stateDir} could not be acquired within the bounded retry budget`\n    );\n    this.name = \"FactHashIndexNotAuthoritativeError\";\n  }\n}\n\ntype DiskFingerprint = {\n  mtimeMs: number;\n  size: number;\n  dev: number;\n  ino: number;\n  ctimeMs: number;\n  birthtimeMs: number;\n};\nexport interface ContentHashPathEntry {\n  readonly path: string;\n  readonly contentHash: string;\n}\n\n/**\n * Content-hash dedup index for facts.\n * Normalizes content (lowercase, strip punctuation, collapse whitespace),\n * computes SHA-256, and stores hashes in a line-delimited file.\n * Prevents writing semantically identical facts.\n */\nexport class ContentHashIndex {\n  private hashes: Set<string> = new Set();\n  /**\n   * Fact-ONLY hash partition (issue #2474). `hashes` above is category-blind\n   * (every write category registers there); this subset carries only\n   * `category === \"fact\"` hashes so fact-only membership checks\n   * (`hasFact*`) can never be satisfied by an unrelated decision/preference\n   * sharing the same normalized body. In-memory only — never serialized to\n   * fact-hashes.txt; `clear()` drops it and every authoritative rebuild\n   * repopulates it via `addFactByHash`. Subset invariant: `factHashes ⊆\n   * hashes` — `addFact*` registers in both, and the removal sites that drop\n   * a shared hash also drop the partition entry (removal stays caller-paired\n   * because shared-index removal is category-blind: archiving a non-fact\n   * must not evict an active fact's fact-only membership).\n   */\n  private factHashes: Set<string> = new Set();\n  private dirty = false;\n  /** True when load() found the pre-Unicode, markerless on-disk format. */\n  private formatMigrationRequired = false;\n  /**\n   * Hashes explicitly removed since the last successful save (issue #1909 review\n   * round 8 thread 3). Tracked separately so `saveMergingWithDisk` can be\n   * removal-AWARE: under the file lock it reads the latest on-disk set, DROPS\n   * these, then unions our additions — so a removal batch cannot resurrect a\n   * hash (union alone would) and cannot clobber a concurrent extraction's\n   * appended hash (blind overwrite would). Consumed + cleared by every save.\n   */\n  private removed: Set<string> = new Set();\n  /**\n   * Hashes added by THIS instance since the last successful save (issue #1909\n   * review round 9 finding 3). Tracked separately from the loaded snapshot so a\n   * reconciling save publishes `(on-disk \\ removed) ∪ added` — it re-applies only\n   * OUR additions, never the stale loaded entries. Without this, seeding the\n   * merge from `this.hashes` (loaded ∪ added) would resurrect a hash a peer\n   * removed on disk while this instance held a stale snapshot.\n   */\n  private added: Set<string> = new Set();\n  private readonly filePath: string;\n  private readonly secureStoreKeyProvider: () => Buffer | null;\n  private readonly secureStoreWriteKeyProvider: () => Buffer | null;\n  private readonly memoryDir: string;\n  private readonly lockOptions: ContentHashIndexLockOptions;\n  /**\n   * Deferred reconcile-save durable-retry state (issue #1909 / PR #2016). At\n   * most ONE retry is ever armed (`reconcileRetryTimer` is the reentrancy guard)\n   * so successive timed-out saves cannot stack duplicate/parallel retries.\n   * `reconcileRetryBarrier` resolves when the chain settles (published or gave\n   * up) — awaited by tests and any caller wanting the eventual result.\n   */\n  private reconcileRetryTimer: NodeJS.Timeout | null = null;\n  private reconcileRetryAttempts = 0;\n  private reconcileRetryBarrier: Promise<void> | null = null;\n  private reconcileRetryResolve: (() => void) | null = null;\n  /**\n   * On-disk fingerprint captured at the last point THIS instance's in-memory\n   * set matched disk — after `load()`, `save()`, or a reconcile publish. A peer\n   * process that advances the durable index changes its file generation even\n   * when byte size and mtime collide, so the freshness check remains safe\n   * without an O(file-size) read on the hot path.\n   */\n  private lastSyncedFingerprint: DiskFingerprint | null = null;\n  constructor(\n    stateDir: string,\n    secureStoreKeyProvider: () => Buffer | null = () => null,\n    secureStoreWriteKeyProvider: () => Buffer | null = secureStoreKeyProvider,\n    memoryDir: string = path.dirname(stateDir),\n    lockOptions: ContentHashIndexLockOptions = {}\n  ) {\n    this.filePath = path.join(stateDir, \"fact-hashes.txt\");\n    this.secureStoreKeyProvider = secureStoreKeyProvider;\n    this.secureStoreWriteKeyProvider = secureStoreWriteKeyProvider;\n    this.memoryDir = memoryDir;\n    this.lockOptions = lockOptions;\n  }\n  /** Whether a caller with an authoritative corpus must rebuild this legacy index. */\n  get requiresFormatMigration(): boolean {\n    return this.formatMigrationRequired;\n  }\n\n  /** Load existing hashes from disk. Safe to call multiple times. */\n  async load(): Promise<void> {\n    try {\n      const raw = await readMaybeEncryptedFile(this.filePath, this.secureStoreKeyProvider(), this.memoryDir);\n      const parsed = parseHashIndex(raw);\n      this.formatMigrationRequired = !parsed.versioned;\n      if (!parsed.versioned) {\n        // Hashes from the pre-NFC format are unsafe after normalization changes.\n        // Ignore them until an authoritative corpus rebuild publishes v2.\n        this.hashes.clear();\n        log.warn(`content-hash index: ignored legacy unversioned index at ${this.filePath}`);\n      } else {\n        for (const hash of parsed.hashes) this.hashes.add(hash);\n      }\n      log.debug(`content-hash index: loaded ${this.hashes.size} hashes`);\n    } catch (err) {\n      if (err instanceof SecureStoreLockedError) throw err;\n      if (!isErrnoCode(err, \"ENOENT\")) throw err;\n      log.debug(\"content-hash index: no existing index — starting fresh\");\n    }\n    // The loaded set now reflects the on-disk file — baseline the fingerprint so\n    // a later peer write is detectable (PR #2016 review).\n    await this.captureSyncedFingerprint();\n  }\n\n  /** Cheap `stat` of the durable index file; null when it does not exist yet. */\n  private async statIndexFile(): Promise<DiskFingerprint | null> {\n    try {\n      const s = await stat(this.filePath);\n      return {\n        mtimeMs: s.mtimeMs,\n        size: s.size,\n        dev: s.dev,\n        ino: s.ino,\n        ctimeMs: s.ctimeMs,\n        birthtimeMs: s.birthtimeMs,\n      };\n    } catch (err) {\n      if (isErrnoCode(err, \"ENOENT\")) return null;\n      throw err;\n    }\n  }\n\n  /** Record the current on-disk fingerprint as this instance's synced baseline. */\n  private async captureSyncedFingerprint(): Promise<void> {\n    try {\n      this.lastSyncedFingerprint = await this.statIndexFile();\n    } catch (err) {\n      // A stat failure other than ENOENT leaves no baseline; the next freshness\n      // check reports non-current and the caller confirms against the corpus.\n      this.lastSyncedFingerprint = null;\n      log.debug(`content-hash index: could not fingerprint ${this.filePath}: ${err}`);\n    }\n  }\n\n  /**\n   * True when the durable index file is unchanged since this instance last\n   * synced it (load / save / reconcile). False when a peer advanced it, when\n   * the file appeared or vanished, or when freshness cannot be established\n   * (stat error) — the caller then treats the in-memory snapshot as\n   * non-authoritative and confirms a dedup miss against the durable corpus.\n   * The stat includes file identity and generation metadata so same-size,\n   * same-mtime atomic replacements are detected without reading the file body.\n   */\n  async isDiskFingerprintCurrent(): Promise<boolean> {\n    let current: DiskFingerprint | null;\n    try {\n      current = await this.statIndexFile();\n    } catch {\n      return false;\n    }\n    const last = this.lastSyncedFingerprint;\n    if (last === null || current === null) {\n      return last === null && current === null;\n    }\n    return (\n      current.mtimeMs === last.mtimeMs &&\n      current.size === last.size &&\n      current.dev === last.dev &&\n      current.ino === last.ino &&\n      current.ctimeMs === last.ctimeMs &&\n      current.birthtimeMs === last.birthtimeMs\n    );\n  }\n\n  /** Check if content already exists in the index. */\n  has(content: string): boolean {\n    return this.hashes.has(ContentHashIndex.computeHash(content));\n  }\n\n  /** Add content hash to the index. */\n  add(content: string): void {\n    const hash = ContentHashIndex.computeHash(content);\n    // A re-add supersedes a pending removal of the same hash (round 8 thread 3).\n    this.removed.delete(hash);\n    // Record OUR durable delta even when the local snapshot already holds the\n    // hash (PR #2016 thread SD-nG): local membership can be STALE — a peer\n    // removed this hash on disk while this instance kept it in memory. Skipping\n    // `added`/`dirty` on that path let the reconciling save compute\n    // (on-disk \\ removed) ∪ added and silently drop the reintroduced hash, so\n    // the peer never saw it again. Set semantics keep this idempotent (no\n    // duplicate entries) and the `removed.delete` above preserves remove/add\n    // ordering.\n    this.hashes.add(hash);\n    this.added.add(hash);\n    this.dirty = true;\n  }\n\n  get size(): number {\n    return this.hashes.size;\n  }\n\n  /** Clear all loaded hashes so the next save rewrites the index from scratch. */\n  clear(): void {\n    if (this.hashes.size > 0) {\n      this.hashes.clear();\n    }\n    // The fact-only partition is rebuilt with the shared set on every\n    // authoritative corpus rebuild, so it clears here too (issue #2474).\n    this.factHashes.clear();\n    // A full clear is always paired with a plain overwrite save() (rebuild);\n    // pending per-hash add/remove deltas are subsumed by writing the rebuilt set.\n    // Cancel any armed deferred-reconcile retry (PR #2016) so it cannot fire in\n    // the clear→rebuild→save window and union the pre-clear on-disk rows back.\n    this.added.clear();\n    this.removed.clear();\n    this.cancelReconcileRetry();\n    this.dirty = true;\n  }\n\n  /** Persist index to disk if changed (plain whole-file overwrite). */\n  async save(): Promise<void> {\n    if (!this.dirty) return;\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    // Snapshot the deltas + overwrite body THIS save publishes BEFORE the write\n    // yields the event loop. `writeMaybeEncryptedFile` materializes `serialized`\n    // eagerly, then the disk await lets a concurrent same-process add()/remove()\n    // land a late delta (PR #2016 thread PRRT_kwDORJXyws6SEBri). Clearing the\n    // LIVE added/removed sets afterward — as the previous unconditional\n    // clear()+`dirty = false` did — would drop that late hash from the index AND\n    // leave no retry, so peers never see it until a corpus rebuild. Consume only\n    // what we published; late deltas stay pending. Mirrors saveMergingWithDisk.\n    const publishedAdded = new Set<string>(this.added);\n    const publishedRemoved = new Set<string>(this.removed);\n    const serialized = serializeHashIndex(this.hashes);\n    await writeMaybeEncryptedFile(this.filePath, serialized, this.secureStoreWriteKeyProvider(), {}, this.memoryDir);\n    this.formatMigrationRequired = false;\n    // Consume ONLY the deltas this overwrite published; anything that arrived\n    // during the awaits above remains pending for the next save.\n    for (const h of publishedAdded) this.added.delete(h);\n    for (const h of publishedRemoved) this.removed.delete(h);\n    // Honest dirty state: true iff late deltas remain unpersisted.\n    this.dirty = this.added.size > 0 || this.removed.size > 0;\n    // This overwrite is now the on-disk state — re-baseline the freshness\n    // fingerprint so our own write is not later mistaken for a peer's (PR #2016).\n    await this.captureSyncedFingerprint();\n    if (this.dirty) {\n      // Late deltas landed mid-save: arm a bounded durable retry so they reach\n      // disk even without a further batch save — never a silent in-memory-only\n      // hash. The locked reconcile republishes only OUR delta onto the overwrite.\n      this.scheduleReconcileRetry();\n    } else {\n      // Clean overwrite supersedes any pending deferred reconcile work.\n      this.cancelReconcileRetry();\n    }\n    log.debug(`content-hash index: saved ${this.hashes.size} hashes`);\n  }\n\n  /**\n   * Persist the index by RECONCILING with the latest on-disk state under a\n   * cross-process lock (issue #1909). Used by the extraction-persist batch save\n   * for BOTH append and removal batches, so appends and removals to the same\n   * index serialize against each other:\n   *   final = (on-disk \\ this.removed) ∪ this.added\n   * Note it re-applies only OUR local additions (`added`), NOT the loaded\n   * snapshot (review round 9 finding 3): seeding from `this.hashes` would\n   * resurrect a hash a peer removed on disk while we held a stale snapshot. This\n   * preserves a concurrent writer's appended hashes (a blind overwrite would\n   * drop them), never resurrects a removed hash, and never loses our additions.\n   *\n   * Hardening:\n   *  - Dirty short-circuit (round 7 finding 3): when this instance neither added\n   *    nor removed anything this run, skip the O(file) read+rewrite entirely.\n   *  - Cross-process lock (round 7 finding 2): serialize the read→reconcile→write\n   *    window on a per-file advisory lock. If the lock is NOT acquired (timeout),\n   *    do NOT publish (round 9 finding 2): keep `dirty` set AND schedule a bounded\n   *    durable background retry (PR #2016) that keeps re-attempting the locked\n   *    publish until the deferred additions land — never an unlocked write that\n   *    could clobber a peer, and never a silent \"batch save complete\" that leaves\n   *    the addition in this process's memory only.\n   */\n  async saveMergingWithDisk(): Promise<void> {\n    if (!this.dirty) return;\n    // The advisory lock file lives beside the index — ensure the dir exists\n    // before acquiring it (the index dir may not exist on a first write).\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    const publish = async (): Promise<void> => {\n      // Snapshot the deltas this publish is responsible for. The read+rewrite\n      // below yields the event loop, so a concurrent add()/remove() can land\n      // new deltas while we await disk (PR #2016 thread SD7Tj). Consuming the\n      // LIVE sets afterward would drop those late deltas AND clear `dirty`,\n      // stranding them in no save at all. We consume only what we published;\n      // anything that arrived meanwhile stays pending for the next save.\n      const publishedAdded = new Set<string>(this.added);\n      const publishedRemoved = new Set<string>(this.removed);\n      const merged = new Set<string>(publishedAdded);\n      try {\n        const raw = await readMaybeEncryptedFile(this.filePath, this.secureStoreKeyProvider(), this.memoryDir);\n        const parsed = parseHashIndex(raw);\n        if (parsed.versioned) {\n          for (const hash of parsed.hashes) {\n            // Keep prior/concurrent on-disk hashes EXCEPT the ones we removed.\n            if (!publishedRemoved.has(hash)) merged.add(hash);\n          }\n        } else {\n          // Do not carry hashes from the pre-NFC format into a v2 write.\n          log.warn(`content-hash index: discarded legacy unversioned entries from ${this.filePath}`);\n        }\n      } catch (err) {\n        if (err instanceof SecureStoreLockedError) throw err;\n        if (!isErrnoCode(err, \"ENOENT\")) throw err;\n        // ENOENT → no on-disk index yet; write our additions as-is.\n      }\n      await mkdir(path.dirname(this.filePath), { recursive: true });\n      await writeMaybeEncryptedFile(\n        this.filePath,\n        serializeHashIndex(merged),\n        this.secureStoreWriteKeyProvider(),\n        {},\n        this.memoryDir\n      );\n      this.formatMigrationRequired = false;\n      // Consume ONLY the deltas we just published; deltas that arrived during\n      // the awaits above remain pending.\n      for (const h of publishedAdded) this.added.delete(h);\n      for (const h of publishedRemoved) this.removed.delete(h);\n      // Fold any still-pending deltas onto the reconciled set so the in-memory\n      // view stays consistent with what the next save will publish.\n      for (const h of this.added) merged.add(h);\n      for (const h of this.removed) merged.delete(h);\n      this.hashes = merged;\n      // Honest dirty state: true iff late deltas remain to be persisted. A\n      // subsequent batch save or the shutdown flush drains them.\n      this.dirty = this.added.size > 0 || this.removed.size > 0;\n      // The reconciled set is now the on-disk state — re-baseline the freshness\n      // fingerprint (captured under the held lock) so our own publish is not\n      // later mistaken for a peer's advance (PR #2016 review).\n      await this.captureSyncedFingerprint();\n    };\n    await withHeldFileLock(\n      `${this.filePath}.lock`,\n      {\n        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,\n        ...(this.lockOptions.maxWaitMs !== undefined ? { maxWaitMs: this.lockOptions.maxWaitMs } : {}),\n        ...(this.lockOptions.pollMs !== undefined ? { pollMs: this.lockOptions.pollMs } : {}),\n      },\n      async (acquired) => {\n        if (!acquired) {\n          // Never publish unlocked (round 9 finding 2): keep dirty AND schedule a\n          // durable background retry (PR #2016). Relying on an unguaranteed later\n          // batch save silently left the addition in this process's memory only;\n          // the retry keeps re-attempting the locked publish until the addition\n          // lands on disk.\n          log.warn(\n            `content-hash index: lock not acquired for ${this.filePath}; deferring reconcile save (dirty retained, scheduling durable retry)`\n          );\n          this.scheduleReconcileRetry();\n          return;\n        }\n        await publish();\n        if (this.dirty) {\n          // A concurrent add()/remove() landed during publish's disk awaits, so\n          // deltas remain unpersisted (PR #2016 thread SD7Tj). Arm a bounded\n          // durable retry so they reach disk even if no further batch save comes\n          // — never leave a settled barrier over pending work.\n          this.scheduleReconcileRetry();\n        } else {\n          // Published cleanly: any pending deferred retry is now satisfied.\n          this.cancelReconcileRetry();\n        }\n      }\n    );\n    log.debug(`content-hash index: reconcile-saved ${this.hashes.size} hashes`);\n  }\n\n  /**\n   * Rebuild-and-publish the index from an authoritative source (the durable\n   * corpus) under the SAME per-file cross-process lock the reconciling\n   * append/removal saves (`saveMergingWithDisk`) use (issue #1909 / PR #2016).\n   * The `populate` callback runs WHILE the lock is held and MUST repopulate this\n   * index from the corpus (`clear()` then `addByHash(...)` for every corpus\n   * hash); the rebuilt set is then published with a plain overwrite that is now\n   * serialized against every locked writer.\n   *\n   * This closes the finding where the previous unlocked clear→scan→save() could\n   * overwrite a peer's newer lock-merged or deferred additions: a locked writer\n   * that committed BEFORE the rebuild acquired the lock has its memory `.md` on\n   * disk and is re-scanned; one that commits AFTER the rebuild releases\n   * reconciles its additions on top of the freshly-published set. No union with\n   * the raw on-disk file is performed, so the rebuild keeps its\n   * garbage-collection property (orphaned hashes for deleted memories drop).\n   *\n   * Lock-acquisition failure is explicit and non-destructive: `populate` is NOT\n   * run and nothing is written (never an unlocked overwrite). Returns true when\n   * the rebuild was published under the lock, false when the lock timed out —\n   * the caller keeps the index non-authoritative and retries on next use. Uses\n   * the same non-reentrant file lock as the reconcile path, so it can never\n   * deadlock with the deferred reconcile-retry: a concurrent locked writer (or a\n   * fired retry) simply yields `acquired=false` after the bounded wait.\n   */\n  async rebuildUnderLock(populate: () => Promise<void>): Promise<boolean> {\n    // The advisory lock file lives beside the index — ensure the dir exists\n    // before acquiring it (the index dir may not exist on a first rebuild).\n    await mkdir(path.dirname(this.filePath), { recursive: true });\n    let published = false;\n    await withHeldFileLock(\n      `${this.filePath}.lock`,\n      {\n        staleMs: CONTENT_HASH_INDEX_LOCK_STALE_MS,\n        ...(this.lockOptions.maxWaitMs !== undefined ? { maxWaitMs: this.lockOptions.maxWaitMs } : {}),\n        ...(this.lockOptions.pollMs !== undefined ? { pollMs: this.lockOptions.pollMs } : {}),\n      },\n      async (acquired) => {\n        if (!acquired) {\n          // Never publish unlocked: a concurrent locked writer holds the lock,\n          // so overwriting now could clobber its addition. Leave the index as-is\n          // and let the caller retry the authoritative rebuild on next use.\n          log.warn(\n            `content-hash index: lock not acquired for ${this.filePath}; deferring authoritative rebuild (index left non-authoritative, retried on next use)`\n          );\n          return;\n        }\n        await populate();\n        // Publish under the held lock. save() takes no lock (no re-entrancy) and\n        // is a full overwrite that supersedes any pending add/remove deltas.\n        await this.save();\n        published = true;\n      }\n    );\n    return published;\n  }\n\n  /**\n   * True while a background durable reconcile-save retry is armed (PR #2016).\n   * Test/introspection hook.\n   */\n  get hasPendingReconcileRetry(): boolean {\n    return this.reconcileRetryTimer !== null;\n  }\n\n  /** True while this index has in-memory changes not yet published to disk. */\n  get hasPendingChanges(): boolean {\n    return this.dirty;\n  }\n\n  /**\n   * Resolve once any armed background reconcile-save retry chain has settled —\n   * either it published the deferred additions, or it exhausted its bounded\n   * attempts and fell back to the corpus-rebuild safety net. Resolves\n   * immediately when nothing is armed. Lets a caller (or a test) await the\n   * eventual durability outcome of a lock-timed-out save.\n   */\n  async whenReconcileRetrySettled(): Promise<void> {\n    await (this.reconcileRetryBarrier ?? Promise.resolve());\n  }\n\n  /**\n   * Drive any deferred lock-timeout reconcile save to completion INLINE at a\n   * lifecycle boundary (PR #2016 finding 3). The background retry timer is\n   * `unref`'d so it never keeps a long-lived daemon alive — but a short-lived\n   * writer (a one-shot CLI) can exit before it fires, leaving a durable fact\n   * `.md` whose hash never reached `fact-hashes.txt` for peers that already\n   * built their in-memory index. `orchestrator.destroy()` calls this so the\n   * addition publishes before the process exits; long-lived hosts only reach it\n   * at their own shutdown, so their in-flight retries keep running in the\n   * background until then. Bounded by the same attempt ceiling as the background\n   * retry; a permanently contended lock falls back to the corpus-rebuild-on-\n   * restart safety net (the fact `.md` is already durable). No deadlock: each\n   * attempt is the same non-reentrant, bounded-wait file lock.\n   */\n  async flushReconcileRetry(): Promise<void> {\n    if (!this.dirty) return;\n    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;\n    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;\n    for (let attempt = 0; this.dirty && attempt < maxAttempts; attempt += 1) {\n      // Cancel the unref'd background timer — we drive the locked publish inline.\n      if (this.reconcileRetryTimer) {\n        clearTimeout(this.reconcileRetryTimer);\n        this.reconcileRetryTimer = null;\n      }\n      await this.saveMergingWithDisk();\n      if (!this.dirty) break;\n      if (attempt < maxAttempts - 1) {\n        const wait = Math.min(baseMs * 2 ** attempt, CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);\n        await new Promise<void>((resolve) => setTimeout(resolve, wait));\n      }\n    }\n    // Clear any timer the final saveMergingWithDisk armed and settle the barrier\n    // so awaiters unblock — the bounded inline drain has done its best.\n    if (this.reconcileRetryTimer) {\n      clearTimeout(this.reconcileRetryTimer);\n      this.reconcileRetryTimer = null;\n    }\n    this.reconcileRetryAttempts = 0;\n    this.settleReconcileRetry();\n  }\n\n  /**\n   * Schedule ONE bounded, exponentially-backed-off background retry of the\n   * deferred reconcile save (PR #2016). Reentrant-safe: an already-armed timer\n   * short-circuits, so successive timed-out saves never stack duplicate retries.\n   * When attempts are exhausted the chain settles without publishing — the\n   * durable fact `.md` is on disk and a process restart rebuilds the index from\n   * the corpus, so this degrades to that safety net, never a fatal failure.\n   */\n  private scheduleReconcileRetry(): void {\n    if (this.reconcileRetryTimer) return; // one retry in flight — no duplicate/reentrant retries\n    const maxAttempts = this.lockOptions.retryMaxAttempts ?? CONTENT_HASH_INDEX_RETRY_MAX_ATTEMPTS;\n    if (this.reconcileRetryAttempts >= maxAttempts) {\n      log.warn(\n        `content-hash index: exhausted ${maxAttempts} deferred reconcile-save retries for ${this.filePath}; ` +\n          `${this.added.size} addition(s) remain dirty in-memory (a process restart rebuilds the index from the durable corpus)`\n      );\n      this.reconcileRetryAttempts = 0;\n      this.settleReconcileRetry();\n      return;\n    }\n    if (!this.reconcileRetryBarrier) {\n      this.reconcileRetryBarrier = new Promise<void>((resolve) => {\n        this.reconcileRetryResolve = resolve;\n      });\n    }\n    const attempt = this.reconcileRetryAttempts + 1;\n    const baseMs = this.lockOptions.retryBaseMs ?? CONTENT_HASH_INDEX_RETRY_BASE_MS;\n    const delay = Math.min(baseMs * 2 ** (attempt - 1), CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS);\n    this.reconcileRetryTimer = setTimeout(() => {\n      this.reconcileRetryTimer = null;\n      this.reconcileRetryAttempts = attempt;\n      void this.saveMergingWithDisk()\n        .catch((err) => {\n          // A publish-time I/O/encryption error (not a lock timeout) is best-effort:\n          // log and let the corpus-rebuild safety net cover it rather than loop.\n          log.warn(`content-hash index: deferred reconcile-save retry failed for ${this.filePath}: ${err}`);\n        })\n        .finally(() => {\n          // If the attempt neither published (dirty cleared → cancelReconcileRetry)\n          // nor re-armed a further retry, the chain has ended — settle the barrier.\n          if (this.dirty && !this.reconcileRetryTimer) this.settleReconcileRetry();\n        });\n    }, delay);\n    this.reconcileRetryTimer.unref?.();\n  }\n\n  /** Cancel any armed reconcile-save retry and settle the barrier (a publish landed). */\n  private cancelReconcileRetry(): void {\n    if (this.reconcileRetryTimer) {\n      clearTimeout(this.reconcileRetryTimer);\n      this.reconcileRetryTimer = null;\n    }\n    this.reconcileRetryAttempts = 0;\n    this.settleReconcileRetry();\n  }\n\n  /** Resolve and clear the retry barrier if one is outstanding. */\n  private settleReconcileRetry(): void {\n    const resolve = this.reconcileRetryResolve;\n    this.reconcileRetryBarrier = null;\n    this.reconcileRetryResolve = null;\n    resolve?.();\n  }\n\n  /** Remove a hash from the index (used when archiving/deleting). */\n  remove(content: string): void {\n    const hash = ContentHashIndex.computeHash(content);\n    // Record the removal (round 8 thread 3) even when the hash is not in our\n    // in-memory set — a reconciling save must still drop it from the latest\n    // on-disk state. A removal supersedes a pending add. Always mark dirty.\n    this.added.delete(hash);\n    this.removed.add(hash);\n    this.hashes.delete(hash);\n    this.dirty = true;\n  }\n\n  /**\n   * Remove a pre-computed SHA-256 hash directly from the index without\n   * re-hashing.  Use this when the caller already holds the stored hash\n   * (e.g. `memory.frontmatter.contentHash`) to avoid the double-hash bug\n   * where `remove(hash)` would compute `hash(hash)` and never match the\n   * entry.\n   */\n  removeByHash(hash: string): void {\n    this.added.delete(hash);\n    this.removed.add(hash);\n    this.hashes.delete(hash);\n    this.dirty = true;\n  }\n\n  /**\n   * Add a pre-computed SHA-256 hash directly to the index without re-hashing.\n   * Use this when the caller already holds the stored hash\n   * (e.g. `memory.frontmatter.contentHash`) so that the index records the raw\n   * content hash rather than re-hashing the citation-annotated body.\n   *\n   * @internal Only called from `StorageManager.ensureFactHashIndexAuthoritative`.\n   * Not part of the public API — prefer `add(content)` for external callers.\n   */\n  addByHash(hash: string): void {\n    // A re-add supersedes a pending removal of the same hash.\n    this.removed.delete(hash);\n    // Record OUR durable delta even when the local snapshot already holds the\n    // hash (PR #2016 thread PRRT_kwDORJXyws6SEHve). Outside a rebuild\n    // (StorageManager.addActiveFactContentHash on reactivation) local\n    // membership can be STALE: a peer removed this hash on disk while this\n    // instance kept it in memory. Skipping added/dirty on that path let the\n    // reconciling save compute (on-disk \\ removed) ∪ added and silently drop\n    // the reintroduced hash, so the peer never saw it again. Set semantics keep\n    // this idempotent (no duplicate entries) and the removed.delete above\n    // preserves remove/add ordering. Mirrors add().\n    this.hashes.add(hash);\n    this.added.add(hash);\n    this.dirty = true;\n  }\n\n  // ── Fact-only partition (issue #2474) ─────────────────────────────────\n  // Folded here from StorageManager's parallel `factOnlyHashes` set, which had\n  // to be kept in lockstep by hand on every add/remove/rebuild site. The\n  // partition lives on the index instance, so every path that mutates the\n  // shared set and needs fact-only truth mutates it in the same breath.\n\n  /** Register fact content in BOTH the shared index and the fact-only partition. */\n  addFact(content: string): void {\n    this.addFactByHash(ContentHashIndex.computeHash(content));\n  }\n\n  /** Register a pre-computed fact hash in both the shared index and the fact-only partition. */\n  addFactByHash(hash: string): void {\n    this.addByHash(hash);\n    this.factHashes.add(hash);\n  }\n\n  /** Fact-ONLY membership: has this content been registered as a fact? */\n  hasFact(content: string): boolean {\n    return this.factHashes.has(ContentHashIndex.computeHash(content));\n  }\n\n  /** Fact-ONLY membership for a pre-computed SHA-256 hash. */\n  hasFactByHash(hash: string): boolean {\n    return this.factHashes.has(hash);\n  }\n\n  /**\n   * Drop fact-only partition membership WITHOUT touching the shared index.\n   * The shared removal stays caller-owned: a shared hash is dropped only when\n   * no other active memory holds it, while fact-only membership follows the\n   * fact's own lifecycle (supersede/archive/promotion).\n   */\n  removeFactByHash(hash: string): void {\n    this.factHashes.delete(hash);\n  }\n\n  /**\n   * Resolve a pre-computed semantic hash to one deterministic corpus path.\n   *\n   * This lookup is separate from durable hash membership: `this.hashes` stays\n   * one hash per line and `has(content)` keeps its existing raw-content contract.\n   * Reconciliation supplies short-lived manifest rows where hash and path coexist.\n   */\n  static resolvePathByHash(hash: string, entries: Iterable<ContentHashPathEntry>): string | undefined {\n    const canonicalHash = hash.toLowerCase();\n    if (!/^[a-f0-9]{64}$/.test(canonicalHash)) return undefined;\n    let canonicalPath: string | undefined;\n    for (const entry of entries) {\n      if (entry.contentHash.toLowerCase() !== canonicalHash || entry.path.length === 0) continue;\n      if (canonicalPath === undefined || entry.path < canonicalPath) canonicalPath = entry.path;\n    }\n    return canonicalPath;\n  }\n\n  /** Normalize content (delegates to content-hash.ts for a single source of truth). */\n  static normalizeContent(content: string): string {\n    return normalizeContent(content);\n  }\n\n  /** Compute SHA-256 hash (delegates to content-hash.ts for a single source of truth). */\n  static computeHash(content: string): string {\n    return computeContentHash(content);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA,SAAS,OAAO,YAAY;AAC5B,OAAO,UAAU;AAcjB,IAAM,mCAAmC;AAEzC,IAAM,mCAAmC;AAEzC,SAAS,eAAe,KAA0D;AAChF,QAAM,QAAQ,IACX,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,MAAI,MAAM,CAAC,MAAM,kCAAkC;AACjD,WAAO,EAAE,WAAW,OAAO,QAAQ,oBAAI,IAAI,EAAE;AAAA,EAC/C;AACA,SAAO,EAAE,WAAW,MAAM,QAAQ,IAAI,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE;AAC5D;AAEA,SAAS,mBAAmB,QAA6B;AACvD,SAAO,GAAG,gCAAgC;AAAA,EAAK,CAAC,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA;AACvE;AAeA,IAAM,wCAAwC;AAE9C,IAAM,mCAAmC;AAElC,IAAM,wCAAwC;AAoC9C,IAAM,qCAAN,cAAiD,MAAM;AAAA,EAC5D,YAAY,UAAkB;AAC5B;AAAA,MACE,4EAA4E,QAAQ;AAAA,IACtF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAqBO,IAAM,mBAAN,MAAM,kBAAiB;AAAA,EACpB,SAAsB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAc9B,aAA0B,oBAAI,IAAI;AAAA,EAClC,QAAQ;AAAA;AAAA,EAER,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS1B,UAAuB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/B,QAAqB,oBAAI,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,sBAA6C;AAAA,EAC7C,yBAAyB;AAAA,EACzB,wBAA8C;AAAA,EAC9C,wBAA6C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,wBAAgD;AAAA,EACxD,YACE,UACA,yBAA8C,MAAM,MACpD,8BAAmD,wBACnD,YAAoB,KAAK,QAAQ,QAAQ,GACzC,cAA2C,CAAC,GAC5C;AACA,SAAK,WAAW,KAAK,KAAK,UAAU,iBAAiB;AACrD,SAAK,yBAAyB;AAC9B,SAAK,8BAA8B;AACnC,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA,EAEA,IAAI,0BAAmC;AACrC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,uBAAuB,KAAK,UAAU,KAAK,uBAAuB,GAAG,KAAK,SAAS;AACrG,YAAM,SAAS,eAAe,GAAG;AACjC,WAAK,0BAA0B,CAAC,OAAO;AACvC,UAAI,CAAC,OAAO,WAAW;AAGrB,aAAK,OAAO,MAAM;AAClB,YAAI,KAAK,2DAA2D,KAAK,QAAQ,EAAE;AAAA,MACrF,OAAO;AACL,mBAAW,QAAQ,OAAO,OAAQ,MAAK,OAAO,IAAI,IAAI;AAAA,MACxD;AACA,UAAI,MAAM,8BAA8B,KAAK,OAAO,IAAI,SAAS;AAAA,IACnE,SAAS,KAAK;AACZ,UAAI,eAAe,uBAAwB,OAAM;AACjD,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AACvC,UAAI,MAAM,6DAAwD;AAAA,IACpE;AAGA,UAAM,KAAK,yBAAyB;AAAA,EACtC;AAAA;AAAA,EAGA,MAAc,gBAAiD;AAC7D,QAAI;AACF,YAAM,IAAI,MAAM,KAAK,KAAK,QAAQ;AAClC,aAAO;AAAA,QACL,SAAS,EAAE;AAAA,QACX,MAAM,EAAE;AAAA,QACR,KAAK,EAAE;AAAA,QACP,KAAK,EAAE;AAAA,QACP,SAAS,EAAE;AAAA,QACX,aAAa,EAAE;AAAA,MACjB;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,YAAY,KAAK,QAAQ,EAAG,QAAO;AACvC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA0C;AACtD,QAAI;AACF,WAAK,wBAAwB,MAAM,KAAK,cAAc;AAAA,IACxD,SAAS,KAAK;AAGZ,WAAK,wBAAwB;AAC7B,UAAI,MAAM,6CAA6C,KAAK,QAAQ,KAAK,GAAG,EAAE;AAAA,IAChF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,2BAA6C;AACjD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,cAAc;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,SAAS,QAAQ,YAAY,MAAM;AACrC,aAAO,SAAS,QAAQ,YAAY;AAAA,IACtC;AACA,WACE,QAAQ,YAAY,KAAK,WACzB,QAAQ,SAAS,KAAK,QACtB,QAAQ,QAAQ,KAAK,OACrB,QAAQ,QAAQ,KAAK,OACrB,QAAQ,YAAY,KAAK,WACzB,QAAQ,gBAAgB,KAAK;AAAA,EAEjC;AAAA;AAAA,EAGA,IAAI,SAA0B;AAC5B,WAAO,KAAK,OAAO,IAAI,kBAAiB,YAAY,OAAO,CAAC;AAAA,EAC9D;AAAA;AAAA,EAGA,IAAI,SAAuB;AACzB,UAAM,OAAO,kBAAiB,YAAY,OAAO;AAEjD,SAAK,QAAQ,OAAO,IAAI;AASxB,SAAK,OAAO,IAAI,IAAI;AACpB,SAAK,MAAM,IAAI,IAAI;AACnB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,KAAK,OAAO,OAAO,GAAG;AACxB,WAAK,OAAO,MAAM;AAAA,IACpB;AAGA,SAAK,WAAW,MAAM;AAKtB,SAAK,MAAM,MAAM;AACjB,SAAK,QAAQ,MAAM;AACnB,SAAK,qBAAqB;AAC1B,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAS5D,UAAM,iBAAiB,IAAI,IAAY,KAAK,KAAK;AACjD,UAAM,mBAAmB,IAAI,IAAY,KAAK,OAAO;AACrD,UAAM,aAAa,mBAAmB,KAAK,MAAM;AACjD,UAAM,wBAAwB,KAAK,UAAU,YAAY,KAAK,4BAA4B,GAAG,CAAC,GAAG,KAAK,SAAS;AAC/G,SAAK,0BAA0B;AAG/B,eAAW,KAAK,eAAgB,MAAK,MAAM,OAAO,CAAC;AACnD,eAAW,KAAK,iBAAkB,MAAK,QAAQ,OAAO,CAAC;AAEvD,SAAK,QAAQ,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,OAAO;AAGxD,UAAM,KAAK,yBAAyB;AACpC,QAAI,KAAK,OAAO;AAId,WAAK,uBAAuB;AAAA,IAC9B,OAAO;AAEL,WAAK,qBAAqB;AAAA,IAC5B;AACA,QAAI,MAAM,6BAA6B,KAAK,OAAO,IAAI,SAAS;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAM,sBAAqC;AACzC,QAAI,CAAC,KAAK,MAAO;AAGjB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,UAAM,UAAU,YAA2B;AAOzC,YAAM,iBAAiB,IAAI,IAAY,KAAK,KAAK;AACjD,YAAM,mBAAmB,IAAI,IAAY,KAAK,OAAO;AACrD,YAAM,SAAS,IAAI,IAAY,cAAc;AAC7C,UAAI;AACF,cAAM,MAAM,MAAM,uBAAuB,KAAK,UAAU,KAAK,uBAAuB,GAAG,KAAK,SAAS;AACrG,cAAM,SAAS,eAAe,GAAG;AACjC,YAAI,OAAO,WAAW;AACpB,qBAAW,QAAQ,OAAO,QAAQ;AAEhC,gBAAI,CAAC,iBAAiB,IAAI,IAAI,EAAG,QAAO,IAAI,IAAI;AAAA,UAClD;AAAA,QACF,OAAO;AAEL,cAAI,KAAK,iEAAiE,KAAK,QAAQ,EAAE;AAAA,QAC3F;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,uBAAwB,OAAM;AACjD,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,OAAM;AAAA,MAEzC;AACA,YAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,mBAAmB,MAAM;AAAA,QACzB,KAAK,4BAA4B;AAAA,QACjC,CAAC;AAAA,QACD,KAAK;AAAA,MACP;AACA,WAAK,0BAA0B;AAG/B,iBAAW,KAAK,eAAgB,MAAK,MAAM,OAAO,CAAC;AACnD,iBAAW,KAAK,iBAAkB,MAAK,QAAQ,OAAO,CAAC;AAGvD,iBAAW,KAAK,KAAK,MAAO,QAAO,IAAI,CAAC;AACxC,iBAAW,KAAK,KAAK,QAAS,QAAO,OAAO,CAAC;AAC7C,WAAK,SAAS;AAGd,WAAK,QAAQ,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,OAAO;AAIxD,YAAM,KAAK,yBAAyB;AAAA,IACtC;AACA,UAAM;AAAA,MACJ,GAAG,KAAK,QAAQ;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,GAAI,KAAK,YAAY,cAAc,SAAY,EAAE,WAAW,KAAK,YAAY,UAAU,IAAI,CAAC;AAAA,QAC5F,GAAI,KAAK,YAAY,WAAW,SAAY,EAAE,QAAQ,KAAK,YAAY,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,OAAO,aAAa;AAClB,YAAI,CAAC,UAAU;AAMb,cAAI;AAAA,YACF,6CAA6C,KAAK,QAAQ;AAAA,UAC5D;AACA,eAAK,uBAAuB;AAC5B;AAAA,QACF;AACA,cAAM,QAAQ;AACd,YAAI,KAAK,OAAO;AAKd,eAAK,uBAAuB;AAAA,QAC9B,OAAO;AAEL,eAAK,qBAAqB;AAAA,QAC5B;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,uCAAuC,KAAK,OAAO,IAAI,SAAS;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,MAAM,iBAAiB,UAAiD;AAGtE,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,QAAI,YAAY;AAChB,UAAM;AAAA,MACJ,GAAG,KAAK,QAAQ;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,GAAI,KAAK,YAAY,cAAc,SAAY,EAAE,WAAW,KAAK,YAAY,UAAU,IAAI,CAAC;AAAA,QAC5F,GAAI,KAAK,YAAY,WAAW,SAAY,EAAE,QAAQ,KAAK,YAAY,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,OAAO,aAAa;AAClB,YAAI,CAAC,UAAU;AAIb,cAAI;AAAA,YACF,6CAA6C,KAAK,QAAQ;AAAA,UAC5D;AACA;AAAA,QACF;AACA,cAAM,SAAS;AAGf,cAAM,KAAK,KAAK;AAChB,oBAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,2BAAoC;AACtC,WAAO,KAAK,wBAAwB;AAAA,EACtC;AAAA;AAAA,EAGA,IAAI,oBAA6B;AAC/B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,4BAA2C;AAC/C,WAAO,KAAK,yBAAyB,QAAQ,QAAQ;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,sBAAqC;AACzC,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,cAAc,KAAK,YAAY,oBAAoB;AACzD,UAAM,SAAS,KAAK,YAAY,eAAe;AAC/C,aAAS,UAAU,GAAG,KAAK,SAAS,UAAU,aAAa,WAAW,GAAG;AAEvE,UAAI,KAAK,qBAAqB;AAC5B,qBAAa,KAAK,mBAAmB;AACrC,aAAK,sBAAsB;AAAA,MAC7B;AACA,YAAM,KAAK,oBAAoB;AAC/B,UAAI,CAAC,KAAK,MAAO;AACjB,UAAI,UAAU,cAAc,GAAG;AAC7B,cAAM,OAAO,KAAK,IAAI,SAAS,KAAK,SAAS,qCAAqC;AAClF,cAAM,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB;AAC5B,mBAAa,KAAK,mBAAmB;AACrC,WAAK,sBAAsB;AAAA,IAC7B;AACA,SAAK,yBAAyB;AAC9B,SAAK,qBAAqB;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,yBAA+B;AACrC,QAAI,KAAK,oBAAqB;AAC9B,UAAM,cAAc,KAAK,YAAY,oBAAoB;AACzD,QAAI,KAAK,0BAA0B,aAAa;AAC9C,UAAI;AAAA,QACF,iCAAiC,WAAW,wCAAwC,KAAK,QAAQ,KAC5F,KAAK,MAAM,IAAI;AAAA,MACtB;AACA,WAAK,yBAAyB;AAC9B,WAAK,qBAAqB;AAC1B;AAAA,IACF;AACA,QAAI,CAAC,KAAK,uBAAuB;AAC/B,WAAK,wBAAwB,IAAI,QAAc,CAAC,YAAY;AAC1D,aAAK,wBAAwB;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,UAAM,UAAU,KAAK,yBAAyB;AAC9C,UAAM,SAAS,KAAK,YAAY,eAAe;AAC/C,UAAM,QAAQ,KAAK,IAAI,SAAS,MAAM,UAAU,IAAI,qCAAqC;AACzF,SAAK,sBAAsB,WAAW,MAAM;AAC1C,WAAK,sBAAsB;AAC3B,WAAK,yBAAyB;AAC9B,WAAK,KAAK,oBAAoB,EAC3B,MAAM,CAAC,QAAQ;AAGd,YAAI,KAAK,gEAAgE,KAAK,QAAQ,KAAK,GAAG,EAAE;AAAA,MAClG,CAAC,EACA,QAAQ,MAAM;AAGb,YAAI,KAAK,SAAS,CAAC,KAAK,oBAAqB,MAAK,qBAAqB;AAAA,MACzE,CAAC;AAAA,IACL,GAAG,KAAK;AACR,SAAK,oBAAoB,QAAQ;AAAA,EACnC;AAAA;AAAA,EAGQ,uBAA6B;AACnC,QAAI,KAAK,qBAAqB;AAC5B,mBAAa,KAAK,mBAAmB;AACrC,WAAK,sBAAsB;AAAA,IAC7B;AACA,SAAK,yBAAyB;AAC9B,SAAK,qBAAqB;AAAA,EAC5B;AAAA;AAAA,EAGQ,uBAA6B;AACnC,UAAM,UAAU,KAAK;AACrB,SAAK,wBAAwB;AAC7B,SAAK,wBAAwB;AAC7B,cAAU;AAAA,EACZ;AAAA;AAAA,EAGA,OAAO,SAAuB;AAC5B,UAAM,OAAO,kBAAiB,YAAY,OAAO;AAIjD,SAAK,MAAM,OAAO,IAAI;AACtB,SAAK,QAAQ,IAAI,IAAI;AACrB,SAAK,OAAO,OAAO,IAAI;AACvB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,MAAoB;AAC/B,SAAK,MAAM,OAAO,IAAI;AACtB,SAAK,QAAQ,IAAI,IAAI;AACrB,SAAK,OAAO,OAAO,IAAI;AACvB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,UAAU,MAAoB;AAE5B,SAAK,QAAQ,OAAO,IAAI;AAUxB,SAAK,OAAO,IAAI,IAAI;AACpB,SAAK,MAAM,IAAI,IAAI;AACnB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,QAAQ,SAAuB;AAC7B,SAAK,cAAc,kBAAiB,YAAY,OAAO,CAAC;AAAA,EAC1D;AAAA;AAAA,EAGA,cAAc,MAAoB;AAChC,SAAK,UAAU,IAAI;AACnB,SAAK,WAAW,IAAI,IAAI;AAAA,EAC1B;AAAA;AAAA,EAGA,QAAQ,SAA0B;AAChC,WAAO,KAAK,WAAW,IAAI,kBAAiB,YAAY,OAAO,CAAC;AAAA,EAClE;AAAA;AAAA,EAGA,cAAc,MAAuB;AACnC,WAAO,KAAK,WAAW,IAAI,IAAI;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,iBAAiB,MAAoB;AACnC,SAAK,WAAW,OAAO,IAAI;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,kBAAkB,MAAc,SAA6D;AAClG,UAAM,gBAAgB,KAAK,YAAY;AACvC,QAAI,CAAC,iBAAiB,KAAK,aAAa,EAAG,QAAO;AAClD,QAAI;AACJ,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,YAAY,YAAY,MAAM,iBAAiB,MAAM,KAAK,WAAW,EAAG;AAClF,UAAI,kBAAkB,UAAa,MAAM,OAAO,cAAe,iBAAgB,MAAM;AAAA,IACvF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAO,iBAAiB,SAAyB;AAC/C,WAAO,iBAAiB,OAAO;AAAA,EACjC;AAAA;AAAA,EAGA,OAAO,YAAY,SAAyB;AAC1C,WAAO,mBAAmB,OAAO;AAAA,EACnC;AACF;","names":[]}

package/dist/chunk-LGEH473S.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access-errors.ts"],"sourcesContent":["/**\n * Tool-surface error enrichment: nearest-tool suggestions and arg-shape hints.\n *\n * Each function is a pure message builder — it returns a better error string\n * without changing semantics, status codes, or rejection behavior.\n *\n * @module access-errors\n */\n\nimport type { ZodError } from \"zod\";\n\n// ─── Existing error classes (restored from pre-#3042) ─────────────────────\n\n/** Authenticated caller lacks the required authorization (HTTP 403). */\nexport class EngramAccessForbiddenError extends Error {}\n\n/** Invalid caller input (HTTP 400). */\nexport class EngramAccessInputError extends Error {}\n\n/**\n * A write rejected by the namespace write-ACL (issue #1888). Subclasses\n * EngramAccessInputError so every existing catch/HTTP-400 mapping still\n * applies, but carries the attempted namespace + principal so the observe/\n * write surfaces can dead-letter the payload before re-throwing (fail-closed\n * placement is unchanged; only the destroyed-payload behavior is fixed).\n */\nexport class NamespaceNotWritableError extends EngramAccessInputError {\n  constructor(\n    readonly attemptedNamespace: string,\n    readonly principal: string | undefined,\n    message?: string,\n  ) {\n    super(message ?? `namespace is not writable: ${attemptedNamespace}`);\n    this.name = \"NamespaceNotWritableError\";\n  }\n}\n\n// ─── Levenshtein distance ─────────────────────────────────────────────────\n\n/**\n * Standard Levenshtein edit distance. O(n*m) over bounded inputs.\n * Exported so the test can verify it without importing private helpers.\n */\nexport function levenshtein(a: string, b: string): number {\n  const an = a.length;\n  const bn = b.length;\n  // Fast paths for empty strings.\n  if (an === 0) return bn;\n  if (bn === 0) return an;\n\n  // Use two rows to keep memory O(min(n,m)).\n  let prev: number[] = [];\n  let curr: number[] = [];\n\n  // Align loops to the shorter string.\n  const [shorter, longer, sn, ln] =\n    an < bn ? [a, b, an, bn] : [b, a, bn, an];\n\n  for (let i = 0; i <= sn; i++) prev[i] = i;\n\n  for (let j = 1; j <= ln; j++) {\n    curr[0] = j;\n    for (let i = 1; i <= sn; i++) {\n      const cost = shorter[i - 1] === longer[j - 1] ? 0 : 1;\n      curr[i] = Math.min(\n        prev[i] + 1,       // deletion\n        curr[i - 1] + 1,   // insertion\n        prev[i - 1] + cost, // substitution\n      );\n    }\n    [prev, curr] = [curr, prev];\n  }\n  return prev[sn];\n}\n\n// ─── Similar-name helpers ─────────────────────────────────────────────────\n\nconst SUGGESTION_DISTANCE_CAP = 3;\n/**\n * Upper bound on the requested tool name. Anything longer is rejected before\n * the O(n*m) Levenshtein pass (#3042 review, P2): a 128 KB request over ~30\n * tools would otherwise run hundreds of millions of comparisons and block\n * the server event loop. The repo documents 64 chars as the tool-name shape;\n * this matches the limit enforced by every published surface.\n */\nexport const SUGGESTION_REQUEST_MAX_LEN = 64;\n\nexport interface SuggestionCandidate {\n  name: string;\n  distance: number;\n}\n\n/**\n * Find the nearest registered tool names by Levenshtein distance.\n * Results are sorted by distance ascending then name ascending (deterministic).\n * Only names with distance <= {@link SUGGESTION_DISTANCE_CAP} are returned;\n * when no name is that close the caller falls back to listing the full set.\n */\nexport function nearestSuggestions(\n  requested: string,\n  registeredNames: readonly string[],\n): SuggestionCandidate[] {\n  // Defense in depth: the entry point already caps; this guards any direct\n  // caller of the helper from an unbounded Levenshtein pass (issue #3042).\n  if (requested.length > SUGGESTION_REQUEST_MAX_LEN) return [];\n  const candidates: SuggestionCandidate[] = [];\n  for (const name of registeredNames) {\n    const distance = levenshtein(requested.toLowerCase(), name.toLowerCase());\n    if (distance <= SUGGESTION_DISTANCE_CAP) {\n      candidates.push({ name, distance });\n    }\n  }\n  // Total comparator: distance asc, then name asc.\n  candidates.sort((a, b) => {\n    if (a.distance !== b.distance) return a.distance < b.distance ? -1 : 1;\n    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;\n  });\n  return candidates;\n}\n\n/**\n * Build a human-readable \"did you mean?\" suggestion string.\n * When no close match is found, returns a fallback listing.\n */\nfunction buildSuggestion(\n  requested: string,\n  registeredNames: readonly string[],\n): string {\n  const suggestions = nearestSuggestions(requested, registeredNames);\n  if (suggestions.length === 0) {\n    return `Registered tools: ${registeredNames.join(\", \")}`;\n  }\n  return `Did you mean ${suggestions.map((s) => s.name).join(\", \")}?`;\n}\n\n/**\n * Read a Zod type tag without asserting a shape.\n *\n * Zod keeps its discriminant at `_def.typeName`. Both hops are narrowed with\n * `in`/`typeof` rather than an inline cast, so a non-Zod object yields\n * `undefined` instead of a fabricated read.\n */\nfunction zodTypeName(schema: unknown): string | undefined {\n  // zod 4: schema internals live on `_zod.def.type` (v3 read `_def.typeName`).\n  if (!(schema instanceof Object) || !(\"_zod\" in schema)) return undefined;\n  // SAFETY: the guard above established `_zod` exists; its `.def` carries the\n  // discriminator string under `type`.\n  const def = (schema as { _zod?: { def?: { type?: unknown } } })._zod?.def;\n  // SAFETY: zod's `_zod.def.type` discriminator is always a string literal.\n  const discriminator = def?.type;\n  return discriminator === undefined ? undefined : String(discriminator);\n}\n\n/**\n * A zod schema node this module reflects over — any object the library\n * exposes as a schema (v4 marks them with `_zod`).\n */\n/** Structural marker: every zod schema carries `_zod`. */\ntype ZodSchemaLike = { _zod?: unknown };\n\n/**\n * A synthetic example value derived from a schema: a placeholder the SAME\n * schema accepts, so the error message can show a valid argument shape.\n */\ntype SchemaExample = string | number | boolean | null | readonly SchemaExample[] | { [key: string]: SchemaExample };\n\n/**\n * Reverse-engineer ONE synthetic example value from a Zod schema type.\n * Returns a deterministic placeholder intended to round-trip through parse().\n */\nfunction exampleFromSchema(schema: ZodSchemaLike): SchemaExample | undefined {\n  switch (zodTypeName(schema)) {\n    case \"string\":\n      return \"<string>\";\n    case \"number\":\n      return 42;\n    case \"boolean\":\n      return true;\n    case \"nullable\":\n      return null;\n    case \"array\":\n      return [];\n    case \"optional\":\n      // Optional fields are omitted from the example rather than sent as null.\n      return undefined;\n    case \"enum\": {\n      // v4 exposes accepted values as the public `.enum` record.\n      if (!(schema instanceof Object) || !(\"enum\" in schema)) return \"<value>\";\n      // SAFETY: the guard established `.enum`; zod types it as a value record.\n      const values = Object.values((schema as { enum: Record<string, string> }).enum);\n      return values.length > 0 ? values[0] : \"<value>\";\n    }\n    case \"object\": {\n      // v4 exposes `.shape` as a plain property on the object schema.\n      if (!(schema instanceof Object) || !(\"shape\" in schema)) return {};\n      // SAFETY: object schemas expose their field schemas keyed by name.\n      const fieldsByName = (schema as { shape: { [field: string]: ZodSchemaLike } }).shape;\n      if (!(fieldsByName instanceof Object)) return {};\n      const result: { [key: string]: SchemaExample } = {};\n      for (const field of Object.getOwnPropertyNames(fieldsByName)) {\n        if (!Object.hasOwn(fieldsByName, field)) continue;\n        const schemaNode = fieldsByName[field];\n        const value = exampleFromSchema(schemaNode);\n        if (value !== undefined) result[field] = value;\n      }\n      return result;\n    }\n    default:\n      return undefined;\n  }\n}\n/**\n * Build an enriched \"unknown tool\" error message.\n *\n * @param requested - the tool name the caller used\n * @param registeredNames - ALL registered tool names (including aliases)\n */\nexport function unknownToolError(\n  requested: string,\n  registeredNames: readonly string[],\n): string {\n  // Cap the request before the suggestion pass: a 128 KB name would otherwise\n  // pay O(n*m) per registered tool (issue #3042 review, P2). The cap matches\n  // the documented tool-name shape; an over-long request is rejected with a\n  // teaching message rather than a silent truncate.\n  if (requested.length > SUGGESTION_REQUEST_MAX_LEN) {\n    return `Unknown tool: name exceeds ${SUGGESTION_REQUEST_MAX_LEN} characters (got ${requested.length}).`;\n  }\n  const suggestion = buildSuggestion(requested, registeredNames);\n  return `Unknown tool: ${requested}. ${suggestion}`;\n}\n\n/**\n * Build an enriched \"invalid arguments\" error message.\n *\n * The example is generated from the schema (never hand-written, so it cannot\n * drift) and is shown ONLY when it round-trips through that same schema. It\n * carries schema-derived fields only: injecting the tool name would add an\n * unrecognized property and fail a `.strict()` object (#3035 review finding).\n *\n * @param tool - the tool name that received the invalid args\n * @param zodError - the ZodError from parse()\n * @param schema - the original Zod schema, used to generate the example\n */\nexport function invalidArgsError(\n  tool: string,\n  zodError: ZodError,\n  schema?: unknown,\n): string {\n  const issues = zodError.issues.map((issue) => {\n    const path = issue.path.length > 0 ? issue.path.join(\".\") : \"(root)\";\n    // `expected` exists only on the invalid_type / invalid_literal variants of\n    // ZodIssue, so it is read through a presence check rather than assumed.\n    const expected = \"expected\" in issue ? issue.expected : undefined;\n    return expected === undefined\n      ? `${path}: ${issue.message}`\n      : `${path}: ${issue.message} (expected ${String(expected)})`;\n  });\n  let message = `Invalid arguments for \"${tool}\": ${issues.join(\"; \")}`;\n  if (!schema) return message;\n\n  const example = exampleFromSchema(schema);\n  if (!example || typeof example !== \"object\" || Object.keys(example).length === 0) {\n    return message;\n  }\n\n  // Withhold an example that cannot parse against its own schema: a\n  // non-round-tripping example is misinformation, worse than none. Narrowed\n  // with `in`/`typeof` rather than an inline cast so the shape is checked.\n  let roundTrips = false;\n  if (typeof schema === \"object\" && \"safeParse\" in schema) {\n    const parser = schema.safeParse;\n    if (typeof parser === \"function\") {\n      try {\n        const parsed: unknown = parser.call(schema, example);\n        roundTrips =\n          typeof parsed === \"object\"\n          && parsed !== null\n          && \"success\" in parsed\n          && parsed.success === true;\n      } catch {\n        roundTrips = false;\n      }\n    }\n  }\n\n  return roundTrips ? `${message}. Example arguments: ${JSON.stringify(example)}` : message;\n}\n"],"mappings":";AAcO,IAAM,6BAAN,cAAyC,MAAM;AAAC;AAGhD,IAAM,yBAAN,cAAqC,MAAM;AAAC;AAS5C,IAAM,4BAAN,cAAwC,uBAAuB;AAAA,EACpE,YACW,oBACA,WACT,SACA;AACA,UAAM,WAAW,8BAA8B,kBAAkB,EAAE;AAJ1D;AACA;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAAA,EACA;AAMb;AAQO,SAAS,YAAY,GAAW,GAAmB;AACxD,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,EAAE;AAEb,MAAI,OAAO,EAAG,QAAO;AACrB,MAAI,OAAO,EAAG,QAAO;AAGrB,MAAI,OAAiB,CAAC;AACtB,MAAI,OAAiB,CAAC;AAGtB,QAAM,CAAC,SAAS,QAAQ,IAAI,EAAE,IAC5B,KAAK,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE;AAE1C,WAAS,IAAI,GAAG,KAAK,IAAI,IAAK,MAAK,CAAC,IAAI;AAExC,WAAS,IAAI,GAAG,KAAK,IAAI,KAAK;AAC5B,SAAK,CAAC,IAAI;AACV,aAAS,IAAI,GAAG,KAAK,IAAI,KAAK;AAC5B,YAAM,OAAO,QAAQ,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,IAAI,IAAI;AACpD,WAAK,CAAC,IAAI,KAAK;AAAA,QACb,KAAK,CAAC,IAAI;AAAA;AAAA,QACV,KAAK,IAAI,CAAC,IAAI;AAAA;AAAA,QACd,KAAK,IAAI,CAAC,IAAI;AAAA;AAAA,MAChB;AAAA,IACF;AACA,KAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI;AAAA,EAC5B;AACA,SAAO,KAAK,EAAE;AAChB;AAIA,IAAM,0BAA0B;AAQzB,IAAM,6BAA6B;AAanC,SAAS,mBACd,WACA,iBACuB;AAGvB,MAAI,UAAU,SAAS,2BAA4B,QAAO,CAAC;AAC3D,QAAM,aAAoC,CAAC;AAC3C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,WAAW,YAAY,UAAU,YAAY,GAAG,KAAK,YAAY,CAAC;AACxE,QAAI,YAAY,yBAAyB;AACvC,iBAAW,KAAK,EAAE,MAAM,SAAS,CAAC;AAAA,IACpC;AAAA,EACF;AAEA,aAAW,KAAK,CAAC,GAAG,MAAM;AACxB,QAAI,EAAE,aAAa,EAAE,SAAU,QAAO,EAAE,WAAW,EAAE,WAAW,KAAK;AACrE,WAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI;AAAA,EACtD,CAAC;AACD,SAAO;AACT;AAMA,SAAS,gBACP,WACA,iBACQ;AACR,QAAM,cAAc,mBAAmB,WAAW,eAAe;AACjE,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO,qBAAqB,gBAAgB,KAAK,IAAI,CAAC;AAAA,EACxD;AACA,SAAO,gBAAgB,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAClE;AASA,SAAS,YAAY,QAAqC;AAExD,MAAI,EAAE,kBAAkB,WAAW,EAAE,UAAU,QAAS,QAAO;AAG/D,QAAM,MAAO,OAAmD,MAAM;AAEtE,QAAM,gBAAgB,KAAK;AAC3B,SAAO,kBAAkB,SAAY,SAAY,OAAO,aAAa;AACvE;AAmBA,SAAS,kBAAkB,QAAkD;AAC3E,UAAQ,YAAY,MAAM,GAAG;AAAA,IAC3B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,CAAC;AAAA,IACV,KAAK;AAEH,aAAO;AAAA,IACT,KAAK,QAAQ;AAEX,UAAI,EAAE,kBAAkB,WAAW,EAAE,UAAU,QAAS,QAAO;AAE/D,YAAM,SAAS,OAAO,OAAQ,OAA4C,IAAI;AAC9E,aAAO,OAAO,SAAS,IAAI,OAAO,CAAC,IAAI;AAAA,IACzC;AAAA,IACA,KAAK,UAAU;AAEb,UAAI,EAAE,kBAAkB,WAAW,EAAE,WAAW,QAAS,QAAO,CAAC;AAEjE,YAAM,eAAgB,OAAyD;AAC/E,UAAI,EAAE,wBAAwB,QAAS,QAAO,CAAC;AAC/C,YAAM,SAA2C,CAAC;AAClD,iBAAW,SAAS,OAAO,oBAAoB,YAAY,GAAG;AAC5D,YAAI,CAAC,OAAO,OAAO,cAAc,KAAK,EAAG;AACzC,cAAM,aAAa,aAAa,KAAK;AACrC,cAAM,QAAQ,kBAAkB,UAAU;AAC1C,YAAI,UAAU,OAAW,QAAO,KAAK,IAAI;AAAA,MAC3C;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAOO,SAAS,iBACd,WACA,iBACQ;AAKR,MAAI,UAAU,SAAS,4BAA4B;AACjD,WAAO,8BAA8B,0BAA0B,oBAAoB,UAAU,MAAM;AAAA,EACrG;AACA,QAAM,aAAa,gBAAgB,WAAW,eAAe;AAC7D,SAAO,iBAAiB,SAAS,KAAK,UAAU;AAClD;AAcO,SAAS,iBACd,MACA,UACA,QACQ;AACR,QAAM,SAAS,SAAS,OAAO,IAAI,CAAC,UAAU;AAC5C,UAAM,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AAG5D,UAAM,WAAW,cAAc,QAAQ,MAAM,WAAW;AACxD,WAAO,aAAa,SAChB,GAAG,IAAI,KAAK,MAAM,OAAO,KACzB,GAAG,IAAI,KAAK,MAAM,OAAO,cAAc,OAAO,QAAQ,CAAC;AAAA,EAC7D,CAAC;AACD,MAAI,UAAU,0BAA0B,IAAI,MAAM,OAAO,KAAK,IAAI,CAAC;AACnE,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,UAAU,kBAAkB,MAAM;AACxC,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AAChF,WAAO;AAAA,EACT;AAKA,MAAI,aAAa;AACjB,MAAI,OAAO,WAAW,YAAY,eAAe,QAAQ;AACvD,UAAM,SAAS,OAAO;AACtB,QAAI,OAAO,WAAW,YAAY;AAChC,UAAI;AACF,cAAM,SAAkB,OAAO,KAAK,QAAQ,OAAO;AACnD,qBACE,OAAO,WAAW,YACf,WAAW,QACX,aAAa,UACb,OAAO,YAAY;AAAA,MAC1B,QAAQ;AACN,qBAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,GAAG,OAAO,wBAAwB,KAAK,UAAU,OAAO,CAAC,KAAK;AACpF;","names":[]}

package/dist/chunk-LU66I56Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/namespaces/search.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"../capabilities.js\";\nimport path from \"node:path\";\nimport { realpathSync } from \"node:fs\";\nimport type { PluginConfig, QmdSearchResult } from \"../types.js\";\nimport type {\n  SearchBackend,\n  SearchExecutionOptions,\n  SearchQueryOptions,\n} from \"../search/port.js\";\nimport { createSearchBackend } from \"../search/factory.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\n\nconst NESTED_NAMESPACE_FILTER_OVERFETCH_FACTOR = 4;\nconst NESTED_NAMESPACE_FILTER_OVERFETCH_MIN = 50;\n\nexport function namespaceCollectionName(\n  baseCollection: string,\n  namespace: string,\n  options?: {\n    defaultNamespace?: string;\n    useLegacyDefaultCollection?: boolean;\n  },\n): string {\n  const trimmed = normalizeNamespaceIdentity(namespace);\n  const defaultNamespace = normalizeNamespaceIdentity(options?.defaultNamespace ?? \"\") || \"default\";\n  if (\n    options?.useLegacyDefaultCollection === true &&\n    trimmed === defaultNamespace\n  ) {\n    return baseCollection;\n  }\n\n  return `${baseCollection}--${namespaceIdentityToken(trimmed || defaultNamespace)}`;\n}\n\ntype StorageRouterLike = {\n  storageFor(namespace: string): Promise<{ dir: string }>;\n};\n\ntype NamespaceBackendRecord = {\n  backend: SearchBackend;\n  collection: string;\n  memoryDir: string;\n  available: boolean;\n  collectionState: CollectionState;\n  filtersNestedNamespaces: boolean;\n  disposed: boolean;\n};\n\nexport interface NamespaceUpdateResult {\n  backendCount: number;\n  eligibleNamespaces: string[];\n}\n\nexport type CollectionState = \"present\" | \"missing\" | \"unknown\" | \"skipped\";\n\nexport interface NamespaceSearchHealth {\n  collection: string;\n  memoryDir: string;\n  available: boolean;\n  collectionState: CollectionState;\n  debugStatus: string;\n  installedVersion: string | null;\n  supportedVersion: string | null;\n  supported: boolean | null;\n  upgradeAvailable: boolean | null;\n  doctorAvailable: boolean | null;\n  daemonMode: boolean | null;\n  pendingEmbeddings: number | null;\n  oldestPendingAgeMs: number | null;\n  embeddingBacklogThreshold: number;\n}\n\ntype NamespaceScopedSearchConfig = PluginConfig & {\n  hostEmbeddingProviderScope?: string;\n};\n\ntype BackendRecordOptions = {\n  autoCreateCollection: boolean;\n  abortAsUnavailable: boolean;\n  failOpenMissingGuardedCollection: boolean;\n};\n\nexport class NamespaceSearchRouter {\n  private readonly cache = new Map<string, Promise<NamespaceBackendRecord>>();\n  private readonly pendingDisposals = new Set<Promise<void>>();\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly storageRouter: StorageRouterLike,\n    private readonly createBackend: (config: PluginConfig) => SearchBackend = createSearchBackend,\n  ) {}\n\n  async collectionForNamespace(namespace: string): Promise<string> {\n    return (await this.backendRecordFor(namespace)).collection;\n  }\n\n  /**\n   * Resolve the search backend for a namespace (#2019). Returns `unknown` so\n   * callers (e.g. the prioritized-embed path) duck-type for capability like\n   * `embedFiles` rather than depending on a concrete QMD shape. Reuses the\n   * cached backend record, so this never re-creates a backend. Returns `null`\n   * when the namespace backend is unavailable.\n   */\n  async backendForNamespace(namespace: string): Promise<unknown> {\n    const record = await this.backendRecordFor(namespace);\n    return record.available ? record.backend : null;\n  }\n\n  async searchAcrossNamespaces(options: {\n    query: string;\n    namespaces: string[];\n    maxResults?: number;\n    mode?: \"search\" | \"hybrid\" | \"bm25\" | \"vector\";\n    searchOptions?: SearchQueryOptions;\n    execution?: SearchExecutionOptions;\n  }): Promise<QmdSearchResult[]> {\n    const query = options.query.trim();\n    if (!query) return [];\n    const maxResults = Math.max(0, Math.floor(options.maxResults ?? this.config.qmdMaxResults));\n    if (maxResults === 0) return [];\n\n    const method = options.mode ?? \"search\";\n    const namespaces = Array.from(new Set(options.namespaces.map((value) => value.trim()).filter(Boolean)));\n    if (namespaces.length === 0) return [];\n\n    const resultsByNamespace = await Promise.all(\n      namespaces.map(async (namespace) => {\n        const record = await this.backendRecordFor(namespace);\n        if (!record.available || record.collectionState === \"missing\") {\n          // A per-namespace backend that is unavailable (or missing its\n          // collection) must report like any other QMD skip (#1536): its\n          // empty contribution is otherwise indistinguishable from a true\n          // no-matches for that namespace (codex round-5 review on #1544).\n          try {\n            options.execution?.onDegradation?.({\n              backend: \"qmd\",\n              code: \"backend_unavailable\",\n              detail:\n                record.collectionState === \"missing\"\n                  ? `namespace collection missing: ${namespace}`\n                  : `namespace backend unavailable: ${namespace}`,\n            });\n          } catch {\n            // Observers must never break search.\n          }\n          return { namespace, results: [] as QmdSearchResult[] };\n        }\n        const backendLimit = backendSearchLimit(record, maxResults);\n        let results: QmdSearchResult[];\n        switch (method) {\n          case \"hybrid\":\n            results = await record.backend.hybridSearch(\n              query,\n              record.collection,\n              backendLimit,\n              options.execution,\n            );\n            break;\n          case \"bm25\":\n            results = await record.backend.bm25Search(\n              query,\n              record.collection,\n              backendLimit,\n              options.execution,\n            );\n            break;\n          case \"vector\":\n            results = await record.backend.vectorSearch(\n              query,\n              record.collection,\n              backendLimit,\n              options.execution,\n            );\n            break;\n          default:\n            results = await record.backend.search(\n              query,\n              record.collection,\n              backendLimit,\n              options.searchOptions,\n              options.execution,\n            );\n            break;\n        }\n        results = filterNamespaceSubtreeResults(record, results)\n          .map((result) => ({\n            ...result,\n            namespace,\n            // Resolve to an absolute path so the (namespace, path) identity is\n            // globally unique — same-relative-path hits from different namespaces\n            // stay distinct across every downstream consumer with no special\n            // handling. Display/citation surfaces relativize for portability (#2020).\n            path: resolveNamespaceResultPath(record.memoryDir, record.collection, result.path),\n          }))\n          // Reject hits whose resolved path escapes the queried namespace's\n          // storage root (#2077). A stale/corrupt per-namespace collection can\n          // return a path owned by another namespace; stamping it would let\n          // downstream scope checks (which trust the stamped namespace) and\n          // absolute-path resolution surface a foreign-namespace memory.\n          .filter((result) => resolvedPathIsInsideNamespaceRoot(record.memoryDir, result.path));\n        return { namespace, results };\n      }),\n    );\n\n    return mergeNamespaceSearchResults(resultsByNamespace, maxResults);\n  }\n\n  /**\n   * Update all namespace backends.\n   * Returns the number of backends for which an update was attempted\n   * (i.e., available and collection present).  Callers can treat 0 as a\n   * signal that no backend was eligible — useful for success-verification in\n   * startup-sync when namespacesEnabled is true.\n   */\n  async updateNamespaces(\n    namespaces: string[],\n    execution?: SearchExecutionOptions,\n    options?: { strict?: boolean; force?: boolean },\n  ): Promise<number> {\n    return (await this.updateNamespacesDetailed(namespaces, execution, options)).backendCount;\n  }\n\n  async updateNamespacesDetailed(\n    namespaces: string[],\n    execution?: SearchExecutionOptions,\n    options?: { strict?: boolean; force?: boolean },\n  ): Promise<NamespaceUpdateResult> {\n    const unique = Array.from(new Set(namespaces.map((value) => value.trim()).filter(Boolean)));\n    const eligible = (await Promise.all(\n      unique.map(async (namespace) => {\n        const record = await this.backendRecordFor(namespace);\n        return record.available && record.collectionState !== \"missing\"\n          ? { namespace, record }\n          : null;\n      }),\n    )).filter((entry): entry is { namespace: string; record: NamespaceBackendRecord } => entry !== null);\n\n    const globalEntry = eligible.find(({ record }) => record.backend.updatesAllCollections?.() === true);\n    const scopedEntries = globalEntry\n      ? eligible.filter(({ record }) => record.backend.updatesAllCollections?.() !== true)\n      : eligible;\n\n    await Promise.all([\n      globalEntry\n        ? updateBackendRecord(globalEntry.record, execution, options)\n        : Promise.resolve(),\n      ...scopedEntries.map(({ record }) => updateBackendRecord(record, execution, options)),\n    ]);\n\n    return {\n      backendCount: (globalEntry ? 1 : 0) + scopedEntries.length,\n      eligibleNamespaces: eligible.map(({ namespace }) => namespace),\n    };\n  }\n\n  async embedNamespaces(namespaces: string[], options?: { strict?: boolean }): Promise<void> {\n    const unique = Array.from(new Set(namespaces.map((value) => value.trim()).filter(Boolean)));\n    await Promise.all(\n      unique.map(async (namespace) => {\n        const record = await this.backendRecordFor(namespace);\n        if (!record.available || record.collectionState === \"missing\") return;\n        await embedBackendRecord(record, options);\n      }),\n    );\n  }\n\n  async ensureNamespaceCollection(\n    namespace: string,\n    execution?: SearchExecutionOptions,\n  ): Promise<\"present\" | \"missing\" | \"unknown\" | \"skipped\"> {\n    const record = await this.backendRecordFor(namespace, execution);\n    return record.collectionState;\n  }\n\n  async healthForNamespace(\n    namespace: string,\n    execution?: SearchExecutionOptions,\n  ): Promise<NamespaceSearchHealth> {\n    const key = namespace.trim() || this.config.defaultNamespace;\n    const record = await this.createBackendRecordFor(\n      key,\n      execution,\n      {\n        autoCreateCollection: false,\n        abortAsUnavailable: true,\n        failOpenMissingGuardedCollection: false,\n      },\n    );\n    try {\n      const liveRecord = await this.liveCachedRecordForHealth(key, record, execution);\n      const diagnosticBackend = liveRecord?.backend ?? record.backend;\n      const versionStatus =\n        \"getVersionStatus\" in diagnosticBackend &&\n        typeof diagnosticBackend.getVersionStatus === \"function\"\n          ? diagnosticBackend.getVersionStatus()\n          : null;\n      const daemonMode = daemonModeForBackend(diagnosticBackend);\n      const backendStatus =\n        \"status\" in diagnosticBackend &&\n        typeof diagnosticBackend.status === \"function\"\n          ? await Promise.race([\n              diagnosticBackend.status().catch(() => null),\n              new Promise<null>((resolve) => setTimeout(() => resolve(null), 5_000).unref?.()),\n            ])\n          : null;\n      const collectionState =\n        liveRecord?.collectionState === \"missing\"\n          ? \"missing\"\n          : record.collectionState;\n\n      return {\n        collection: record.collection,\n        memoryDir: record.memoryDir,\n        available: liveRecord?.available ?? record.available,\n        collectionState,\n        debugStatus: diagnosticBackend.debugStatus(),\n        installedVersion: versionStatus?.installedVersion ?? null,\n        supportedVersion: versionStatus?.supportedVersion ?? null,\n        supported: versionStatus?.supported ?? null,\n        upgradeAvailable: versionStatus?.upgradeAvailable ?? null,\n        doctorAvailable: versionStatus?.capabilities?.doctor ?? null,\n        daemonMode,\n        pendingEmbeddings: backendStatus?.pendingEmbeddings ?? null,\n        oldestPendingAgeMs: backendStatus?.oldestPendingAgeMs ?? null,\n        embeddingBacklogThreshold: this.config.qmdEmbeddingBacklogThreshold,\n      };\n    } finally {\n      const dispose = (record.backend as { dispose?: () => void | Promise<void> }).dispose;\n      await dispose?.call(record.backend);\n    }\n  }\n\n  private async liveCachedRecordForHealth(\n    key: string,\n    disposableRecord: NamespaceBackendRecord,\n    execution?: SearchExecutionOptions,\n  ): Promise<NamespaceBackendRecord | null> {\n    const pending = this.cache.get(key);\n    if (!pending) return null;\n    const cachedRecord = await awaitWithAbort(pending, execution?.signal).catch(() => null);\n    if (!cachedRecord) return null;\n    if (cachedRecord.collection !== disposableRecord.collection) return null;\n    if (cachedRecord.memoryDir !== disposableRecord.memoryDir) return null;\n    return cachedRecord;\n  }\n\n  private trackDisposal(promise: Promise<void>): void {\n    this.pendingDisposals.add(promise);\n    void promise.finally(() => this.pendingDisposals.delete(promise));\n  }\n\n  private async drainPendingDisposals(): Promise<void> {\n    if (this.pendingDisposals.size === 0) return;\n    await Promise.allSettled(this.pendingDisposals);\n  }\n\n  /** Clear cached backend records so the next access re-probes availability. */\n  clearCache(): void {\n    const pendingRecords = Array.from(this.cache.values());\n    this.cache.clear();\n    const disposal = Promise.allSettled(pendingRecords).then(async (settled) => {\n      await Promise.allSettled(\n        settled.flatMap((entry) =>\n          entry.status === \"fulfilled\" ? [this.disposeRecord(entry.value)] : []),\n      );\n    });\n    this.trackDisposal(disposal);\n  }\n\n  private async disposeRecord(record: NamespaceBackendRecord): Promise<void> {\n    if (record.disposed) return;\n    record.disposed = true;\n    const dispose = (record.backend as { dispose?: () => void | Promise<void> }).dispose;\n    await dispose?.call(record.backend);\n  }\n\n  /** Release any per-namespace backend handles held by cached records. */\n  async dispose(): Promise<void> {\n    await this.drainPendingDisposals();\n    const pendingRecords = Array.from(this.cache.values());\n    this.cache.clear();\n    const settled = await Promise.allSettled(pendingRecords);\n    await Promise.allSettled(\n      settled.flatMap((entry) =>\n        entry.status === \"fulfilled\" ? [this.disposeRecord(entry.value)] : []),\n    );\n  }\n\n  /**\n   * Disable namespace search for this runtime while retaining the resolved\n   * records as unavailable/missing. This releases concrete QMD/daemon handles\n   * without letting later reads recreate a search backend after the root path\n   * has been switched to NoopSearchBackend for a missing collection.\n   */\n  async disableSearchBackends(): Promise<void> {\n    const settled = await Promise.allSettled(this.cache.values());\n    await Promise.allSettled(\n      settled.flatMap((entry) => {\n        if (entry.status !== \"fulfilled\") return [];\n        entry.value.available = false;\n        entry.value.collectionState = \"missing\";\n        return [this.disposeRecord(entry.value)];\n      }),\n    );\n  }\n\n  private async backendRecordFor(\n    namespace: string,\n    execution?: SearchExecutionOptions,\n  ): Promise<NamespaceBackendRecord> {\n    await this.drainPendingDisposals();\n    const key = namespace.trim() || this.config.defaultNamespace;\n    const existing = this.cache.get(key);\n    if (existing) return await existing;\n\n    const pending = this.createBackendRecordFor(key, execution, {\n      autoCreateCollection: true,\n      abortAsUnavailable: false,\n      failOpenMissingGuardedCollection: true,\n    }).catch((error) => {\n      this.cache.delete(key);\n      throw error;\n    });\n\n    this.cache.set(key, pending);\n    return await pending;\n  }\n\n  private async createBackendRecordFor(\n    namespace: string,\n    execution: SearchExecutionOptions | undefined,\n    options: BackendRecordOptions,\n  ): Promise<NamespaceBackendRecord> {\n    const key = namespace.trim() || this.config.defaultNamespace;\n    const storage = await this.storageRouter.storageFor(key);\n    const useLegacyDefaultCollection =\n      key === this.config.defaultNamespace && storage.dir === this.config.memoryDir;\n    const filtersNestedNamespaces =\n      resolveNamespaceCapabilities(this.config).namespaces === true && useLegacyDefaultCollection;\n    const rootHostEmbeddingScope =\n      (this.config as NamespaceScopedSearchConfig).hostEmbeddingProviderScope ??\n      this.config.memoryDir;\n    const scopedConfig: NamespaceScopedSearchConfig = {\n      ...this.config,\n      memoryDir: storage.dir,\n      hostEmbeddingProviderScope: rootHostEmbeddingScope,\n      qmdCollection: namespaceCollectionName(this.config.qmdCollection, key, {\n        defaultNamespace: this.config.defaultNamespace,\n        useLegacyDefaultCollection,\n      }),\n    };\n\n    const backend = this.createBackend(scopedConfig);\n    try {\n      const availabilityProbe =\n        options.autoCreateCollection || typeof backend.checkAvailability !== \"function\"\n          ? backend.probe(execution)\n          : backend.checkAvailability({ signal: execution?.signal });\n      const available = await awaitWithAbort(availabilityProbe, execution?.signal).catch((error) => {\n        if (error instanceof NamespaceSearchAbortError && !options.abortAsUnavailable) {\n          throw error;\n        }\n        return false;\n      });\n      const collectionState = available\n        ? await awaitWithAbort(\n          // The legacy default namespace at the flat root (`filtersNestedNamespaces`)\n          // shares its `memoryDir` with the `namespaces/` container, so its base\n          // collection is a \"broad root\" that also indexes nested-namespace files.\n          // We STILL auto-create it (issue #1929): the search side already targets\n          // this exact base collection and `filterNamespaceSubtreeResults` strips\n          // the nested `namespaces/` subtree out of its results, so index and\n          // search stay symmetric. Skipping creation left a configured default\n          // namespace (e.g. `geek`) with maintenance \"ran\" but no collection and 0\n          // recall results. `ensureCollection` is a no-op when the collection is\n          // already present, so legacy installs that pre-created the broad root are\n          // unaffected.\n          this.collectionStateForBackend(backend, storage.dir, scopedConfig.qmdCollection, {\n            autoCreate: options.autoCreateCollection,\n            failOpenMissingGuardedCollection: options.failOpenMissingGuardedCollection,\n            execution,\n          }),\n          execution?.signal,\n        ).catch((error) => {\n          if (error instanceof NamespaceSearchAbortError && !options.abortAsUnavailable) {\n            throw error;\n          }\n          return \"unknown\" as const;\n        })\n        : \"unknown\";\n      return {\n        backend,\n        collection: scopedConfig.qmdCollection,\n        memoryDir: storage.dir,\n        available,\n        collectionState,\n        filtersNestedNamespaces,\n        disposed: false,\n      };\n    } catch (error) {\n      const dispose = (backend as { dispose?: () => void | Promise<void> }).dispose;\n      if (dispose) {\n        await Promise.resolve(dispose.call(backend)).catch(() => {});\n      }\n      throw error;\n    }\n  }\n\n  private async collectionStateForBackend(\n    backend: SearchBackend,\n    memoryDir: string,\n    collection: string,\n    options: {\n      autoCreate: boolean;\n      failOpenMissingGuardedCollection: boolean;\n      execution?: SearchExecutionOptions;\n    },\n  ): Promise<CollectionState> {\n    if (!options.autoCreate) {\n      if (!backend.checkCollection) return \"unknown\";\n      const collectionState = await backend\n        .checkCollection(collection, options.execution)\n        .catch(() => \"unknown\" as const);\n      return options.failOpenMissingGuardedCollection && collectionState === \"missing\"\n        ? \"unknown\"\n        : collectionState;\n    }\n    return await backend.ensureCollection(memoryDir, collection, options.execution).catch(() => \"unknown\" as const);\n  }\n}\n\nclass NamespaceSearchAbortError extends Error {\n  constructor() {\n    super(\"operation aborted\");\n  }\n}\n\nfunction awaitWithAbort<T>(operation: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return operation;\n  if (signal.aborted) return Promise.reject(new NamespaceSearchAbortError());\n\n  return new Promise<T>((resolve, reject) => {\n    const onAbort = () => {\n      signal.removeEventListener(\"abort\", onAbort);\n      reject(new NamespaceSearchAbortError());\n    };\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    operation.then(resolve, reject).finally(() => {\n      signal.removeEventListener(\"abort\", onAbort);\n    });\n  });\n}\n\nfunction filterNamespaceSubtreeResults(\n  record: NamespaceBackendRecord,\n  results: QmdSearchResult[],\n): QmdSearchResult[] {\n  if (!record.filtersNestedNamespaces) return results;\n  return results.filter((result) =>\n    !pathIsInsideNamespaceSubtree(record.memoryDir, record.collection, result.path)\n  );\n}\n\nfunction backendSearchLimit(\n  record: NamespaceBackendRecord,\n  maxResults: number,\n): number {\n  if (!record.filtersNestedNamespaces) return maxResults;\n  return Math.max(\n    maxResults,\n    maxResults * NESTED_NAMESPACE_FILTER_OVERFETCH_FACTOR,\n    NESTED_NAMESPACE_FILTER_OVERFETCH_MIN,\n  );\n}\n\nasync function updateBackendRecord(\n  record: NamespaceBackendRecord,\n  execution?: SearchExecutionOptions,\n  options?: { strict?: boolean; force?: boolean },\n): Promise<void> {\n  if (options?.strict === true) {\n    if (\n      // Forced refreshes must skip the throttled all-collections update: its\n      // success has to prove the current writes are indexed, which a throttle\n      // skip cannot.\n      options.force !== true &&\n      record.backend.updatesAllCollections?.() === true &&\n      typeof record.backend.updateStrict === \"function\"\n    ) {\n      await record.backend.updateStrict(execution);\n      return;\n    }\n    if (typeof record.backend.updateCollectionStrict === \"function\") {\n      await record.backend.updateCollectionStrict(record.collection, execution);\n      return;\n    }\n    // Backends with no strict variant (Orama, LanceDB, Meilisearch, remote) have a fail-open\n    // update(): it resolves when it returned early or failed. Their updateCompleted() says\n    // whether the refresh ran, so strict callers get a failure instead of a fake success.\n    const completed = await record.backend.updateCompleted?.(execution);\n    if (completed !== undefined) {\n      if (!completed) throw new Error(\"search backend update did not complete\");\n      return;\n    }\n  }\n  await record.backend.update(execution);\n}\n\nasync function embedBackendRecord(\n  record: NamespaceBackendRecord,\n  options?: { strict?: boolean },\n): Promise<void> {\n  if (options?.strict === true) {\n    if (typeof record.backend.embedCollectionStrict === \"function\") {\n      await record.backend.embedCollectionStrict(record.collection);\n      return;\n    }\n    if (typeof record.backend.embedStrict === \"function\") {\n      await record.backend.embedStrict();\n      return;\n    }\n  }\n  if (typeof record.backend.embedCollection === \"function\") {\n    await record.backend.embedCollection(record.collection);\n    return;\n  }\n  await record.backend.embed();\n}\n\nfunction daemonModeForBackend(backend: SearchBackend): boolean | null {\n  return \"isDaemonMode\" in backend && typeof backend.isDaemonMode === \"function\"\n    ? backend.isDaemonMode() === true\n    : null;\n}\n\nfunction isContainedPath(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return (\n    relative === \"\" ||\n    (relative !== \"..\" && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative))\n  );\n}\n\nfunction pathIsInsideNamespaceSubtree(\n  memoryDir: string,\n  collection: string,\n  resultPath: string | undefined,\n): boolean {\n  if (!resultPath) return false;\n  const normalizedResultPath = normalizeQmdResultPath(resultPath, collection);\n  const memoryRoot = path.resolve(memoryDir);\n  const namespacesRoot = path.join(memoryRoot, \"namespaces\");\n  const candidate = path.isAbsolute(normalizedResultPath)\n    ? path.normalize(normalizedResultPath)\n    : path.resolve(memoryRoot, normalizedResultPath);\n  return isContainedPath(namespacesRoot, candidate);\n}\n\n/**\n * Reject a QMD hit whose resolved path escapes the queried namespace's storage\n * root (#2077). `resolvedPath` is the already-resolved value produced by\n * `resolveNamespaceResultPath`; a stale/corrupt per-namespace collection can\n * yield an absolute path owned by another namespace, and stamping it with the\n * queried namespace would surface a foreign-namespace memory downstream.\n *\n * Lexical containment runs first — it is cheap and the only check possible when\n * the file is not yet on disk (a stale collection may cite a since-deleted\n * path). When both root and candidate exist, their filesystem realpaths are\n * canonicalized and re-checked so a symlink planted inside the namespace root\n * cannot resolve into another namespace or outside storage. An unresolved path\n * (ENOENT) keeps the lexical result rather than rejecting the stale-collection\n * case this guard targets.\n */\nfunction resolvedPathIsInsideNamespaceRoot(memoryDir: string, resolvedPath: string): boolean {\n  const root = path.resolve(memoryDir);\n  const candidate = path.isAbsolute(resolvedPath)\n    ? path.normalize(resolvedPath)\n    : path.resolve(root, resolvedPath);\n  if (!isContainedPath(root, candidate)) return false;\n  try {\n    return isContainedPath(realpathSync.native(root), realpathSync.native(candidate));\n  } catch {\n    return true;\n  }\n}\nexport function normalizeQmdResultPath(resultPath: string, collection: string): string {\n  let value = resultPath.trim();\n  if (value.startsWith(\"qmd://\")) {\n    try {\n      const parsed = new URL(value);\n      if (parsed.protocol === \"qmd:\" && parsed.hostname === collection) {\n        value = decodeURIComponent(parsed.pathname.replace(/^\\/+/, \"\"));\n      }\n    } catch {\n      const remainder = value.slice(\"qmd://\".length);\n      const slashIndex = remainder.indexOf(\"/\");\n      if (slashIndex !== -1) {\n        value = remainder.slice(slashIndex + 1);\n      }\n    }\n  }\n\n  // Only strip a genuine QMD collection prefix — never when the collection name\n  // collides with a memory category dir (e.g. qmdCollection == \"facts\"), or a\n  // bare \"facts/<id>.md\" hit would be corrupted to \"<id>.md\" and fail namespace\n  // reads/access tracking (#2020).\n  const collectionPrefix = `${collection}/`;\n  if (value.startsWith(collectionPrefix) && !ALL_CATEGORY_DIRS.includes(collection)) {\n    value = value.slice(collectionPrefix.length);\n  }\n  return value;\n}\nexport function resolveNamespaceResultPath(\n  memoryDir: string,\n  collection: string,\n  resultPath: string,\n): string {\n  const normalized = normalizeQmdResultPath(resultPath, collection);\n  if (path.isAbsolute(normalized)) return normalized;\n  const root = path.resolve(memoryDir);\n  const resolved = path.resolve(root, normalized);\n  const relative = path.relative(root, resolved);\n  if (relative === \"\" || relative.startsWith(\"..\") || path.isAbsolute(relative)) {\n    return resultPath;\n  }\n  return resolved;\n}\nfunction mergeNamespaceSearchResults(\n  lists: Array<{ namespace: string; results: QmdSearchResult[] }>,\n  maxResults: number,\n): QmdSearchResult[] {\n  const merged = new Map<string, QmdSearchResult>();\n\n  for (const { namespace, results } of lists) {\n    for (const result of results) {\n      const key = `${namespace}\\0${result.path || result.docid}`;\n      const existing = merged.get(key);\n      if (!existing) {\n        merged.set(key, { ...result, namespace });\n        continue;\n      }\n      if (result.score > existing.score) {\n        merged.set(key, {\n          ...result,\n          namespace,\n          snippet: existing.snippet || result.snippet || \"\",\n        });\n      }\n    }\n  }\n\n  return [...merged.values()]\n    .sort((a, b) => b.score - a.score)\n    .slice(0, maxResults);\n}\n"],"mappings":";;;;;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,oBAAoB;AAW7B,IAAM,2CAA2C;AACjD,IAAM,wCAAwC;AAEvC,SAAS,wBACd,gBACA,WACA,SAIQ;AACR,QAAM,UAAU,2BAA2B,SAAS;AACpD,QAAM,mBAAmB,2BAA2B,SAAS,oBAAoB,EAAE,KAAK;AACxF,MACE,SAAS,+BAA+B,QACxC,YAAY,kBACZ;AACA,WAAO;AAAA,EACT;AAEA,SAAO,GAAG,cAAc,KAAK,uBAAuB,WAAW,gBAAgB,CAAC;AAClF;AAkDO,IAAM,wBAAN,MAA4B;AAAA,EAIjC,YACmB,QACA,eACA,gBAAyD,qBAC1E;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EANF,QAAQ,oBAAI,IAA6C;AAAA,EACzD,mBAAmB,oBAAI,IAAmB;AAAA,EAQ3D,MAAM,uBAAuB,WAAoC;AAC/D,YAAQ,MAAM,KAAK,iBAAiB,SAAS,GAAG;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,oBAAoB,WAAqC;AAC7D,UAAM,SAAS,MAAM,KAAK,iBAAiB,SAAS;AACpD,WAAO,OAAO,YAAY,OAAO,UAAU;AAAA,EAC7C;AAAA,EAEA,MAAM,uBAAuB,SAOE;AAC7B,UAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,cAAc,KAAK,OAAO,aAAa,CAAC;AAC1F,QAAI,eAAe,EAAG,QAAO,CAAC;AAE9B,UAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,QAAQ,WAAW,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACtG,QAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AAErC,UAAM,qBAAqB,MAAM,QAAQ;AAAA,MACvC,WAAW,IAAI,OAAO,cAAc;AAClC,cAAM,SAAS,MAAM,KAAK,iBAAiB,SAAS;AACpD,YAAI,CAAC,OAAO,aAAa,OAAO,oBAAoB,WAAW;AAK7D,cAAI;AACF,oBAAQ,WAAW,gBAAgB;AAAA,cACjC,SAAS;AAAA,cACT,MAAM;AAAA,cACN,QACE,OAAO,oBAAoB,YACvB,iCAAiC,SAAS,KAC1C,kCAAkC,SAAS;AAAA,YACnD,CAAC;AAAA,UACH,QAAQ;AAAA,UAER;AACA,iBAAO,EAAE,WAAW,SAAS,CAAC,EAAuB;AAAA,QACvD;AACA,cAAM,eAAe,mBAAmB,QAAQ,UAAU;AAC1D,YAAI;AACJ,gBAAQ,QAAQ;AAAA,UACd,KAAK;AACH,sBAAU,MAAM,OAAO,QAAQ;AAAA,cAC7B;AAAA,cACA,OAAO;AAAA,cACP;AAAA,cACA,QAAQ;AAAA,YACV;AACA;AAAA,UACF,KAAK;AACH,sBAAU,MAAM,OAAO,QAAQ;AAAA,cAC7B;AAAA,cACA,OAAO;AAAA,cACP;AAAA,cACA,QAAQ;AAAA,YACV;AACA;AAAA,UACF,KAAK;AACH,sBAAU,MAAM,OAAO,QAAQ;AAAA,cAC7B;AAAA,cACA,OAAO;AAAA,cACP;AAAA,cACA,QAAQ;AAAA,YACV;AACA;AAAA,UACF;AACE,sBAAU,MAAM,OAAO,QAAQ;AAAA,cAC7B;AAAA,cACA,OAAO;AAAA,cACP;AAAA,cACA,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AACA;AAAA,QACJ;AACA,kBAAU,8BAA8B,QAAQ,OAAO,EACpD,IAAI,CAAC,YAAY;AAAA,UAChB,GAAG;AAAA,UACH;AAAA;AAAA;AAAA;AAAA;AAAA,UAKA,MAAM,2BAA2B,OAAO,WAAW,OAAO,YAAY,OAAO,IAAI;AAAA,QACnF,EAAE,EAMD,OAAO,CAAC,WAAW,kCAAkC,OAAO,WAAW,OAAO,IAAI,CAAC;AACtF,eAAO,EAAE,WAAW,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAEA,WAAO,4BAA4B,oBAAoB,UAAU;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBACJ,YACA,WACA,SACiB;AACjB,YAAQ,MAAM,KAAK,yBAAyB,YAAY,WAAW,OAAO,GAAG;AAAA,EAC/E;AAAA,EAEA,MAAM,yBACJ,YACA,WACA,SACgC;AAChC,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,IAAI,OAAO,cAAc;AAC9B,cAAM,SAAS,MAAM,KAAK,iBAAiB,SAAS;AACpD,eAAO,OAAO,aAAa,OAAO,oBAAoB,YAClD,EAAE,WAAW,OAAO,IACpB;AAAA,MACN,CAAC;AAAA,IACH,GAAG,OAAO,CAAC,UAA0E,UAAU,IAAI;AAEnG,UAAM,cAAc,SAAS,KAAK,CAAC,EAAE,OAAO,MAAM,OAAO,QAAQ,wBAAwB,MAAM,IAAI;AACnG,UAAM,gBAAgB,cAClB,SAAS,OAAO,CAAC,EAAE,OAAO,MAAM,OAAO,QAAQ,wBAAwB,MAAM,IAAI,IACjF;AAEJ,UAAM,QAAQ,IAAI;AAAA,MAChB,cACI,oBAAoB,YAAY,QAAQ,WAAW,OAAO,IAC1D,QAAQ,QAAQ;AAAA,MACpB,GAAG,cAAc,IAAI,CAAC,EAAE,OAAO,MAAM,oBAAoB,QAAQ,WAAW,OAAO,CAAC;AAAA,IACtF,CAAC;AAED,WAAO;AAAA,MACL,eAAe,cAAc,IAAI,KAAK,cAAc;AAAA,MACpD,oBAAoB,SAAS,IAAI,CAAC,EAAE,UAAU,MAAM,SAAS;AAAA,IAC/D;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,YAAsB,SAA+C;AACzF,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,UAAM,QAAQ;AAAA,MACZ,OAAO,IAAI,OAAO,cAAc;AAC9B,cAAM,SAAS,MAAM,KAAK,iBAAiB,SAAS;AACpD,YAAI,CAAC,OAAO,aAAa,OAAO,oBAAoB,UAAW;AAC/D,cAAM,mBAAmB,QAAQ,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,0BACJ,WACA,WACwD;AACxD,UAAM,SAAS,MAAM,KAAK,iBAAiB,WAAW,SAAS;AAC/D,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,MAAM,mBACJ,WACA,WACgC;AAChC,UAAM,MAAM,UAAU,KAAK,KAAK,KAAK,OAAO;AAC5C,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,QACE,sBAAsB;AAAA,QACtB,oBAAoB;AAAA,QACpB,kCAAkC;AAAA,MACpC;AAAA,IACF;AACA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,0BAA0B,KAAK,QAAQ,SAAS;AAC9E,YAAM,oBAAoB,YAAY,WAAW,OAAO;AACxD,YAAM,gBACJ,sBAAsB,qBACtB,OAAO,kBAAkB,qBAAqB,aAC1C,kBAAkB,iBAAiB,IACnC;AACN,YAAM,aAAa,qBAAqB,iBAAiB;AACzD,YAAM,gBACJ,YAAY,qBACZ,OAAO,kBAAkB,WAAW,aAChC,MAAM,QAAQ,KAAK;AAAA,QACjB,kBAAkB,OAAO,EAAE,MAAM,MAAM,IAAI;AAAA,QAC3C,IAAI,QAAc,CAAC,YAAY,WAAW,MAAM,QAAQ,IAAI,GAAG,GAAK,EAAE,QAAQ,CAAC;AAAA,MACjF,CAAC,IACD;AACN,YAAM,kBACJ,YAAY,oBAAoB,YAC5B,YACA,OAAO;AAEb,aAAO;AAAA,QACL,YAAY,OAAO;AAAA,QACnB,WAAW,OAAO;AAAA,QAClB,WAAW,YAAY,aAAa,OAAO;AAAA,QAC3C;AAAA,QACA,aAAa,kBAAkB,YAAY;AAAA,QAC3C,kBAAkB,eAAe,oBAAoB;AAAA,QACrD,kBAAkB,eAAe,oBAAoB;AAAA,QACrD,WAAW,eAAe,aAAa;AAAA,QACvC,kBAAkB,eAAe,oBAAoB;AAAA,QACrD,iBAAiB,eAAe,cAAc,UAAU;AAAA,QACxD;AAAA,QACA,mBAAmB,eAAe,qBAAqB;AAAA,QACvD,oBAAoB,eAAe,sBAAsB;AAAA,QACzD,2BAA2B,KAAK,OAAO;AAAA,MACzC;AAAA,IACF,UAAE;AACA,YAAM,UAAW,OAAO,QAAqD;AAC7E,YAAM,SAAS,KAAK,OAAO,OAAO;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,MAAc,0BACZ,KACA,kBACA,WACwC;AACxC,UAAM,UAAU,KAAK,MAAM,IAAI,GAAG;AAClC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,eAAe,MAAM,eAAe,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,IAAI;AACtF,QAAI,CAAC,aAAc,QAAO;AAC1B,QAAI,aAAa,eAAe,iBAAiB,WAAY,QAAO;AACpE,QAAI,aAAa,cAAc,iBAAiB,UAAW,QAAO;AAClE,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,SAA8B;AAClD,SAAK,iBAAiB,IAAI,OAAO;AACjC,SAAK,QAAQ,QAAQ,MAAM,KAAK,iBAAiB,OAAO,OAAO,CAAC;AAAA,EAClE;AAAA,EAEA,MAAc,wBAAuC;AACnD,QAAI,KAAK,iBAAiB,SAAS,EAAG;AACtC,UAAM,QAAQ,WAAW,KAAK,gBAAgB;AAAA,EAChD;AAAA;AAAA,EAGA,aAAmB;AACjB,UAAM,iBAAiB,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC;AACrD,SAAK,MAAM,MAAM;AACjB,UAAM,WAAW,QAAQ,WAAW,cAAc,EAAE,KAAK,OAAO,YAAY;AAC1E,YAAM,QAAQ;AAAA,QACZ,QAAQ,QAAQ,CAAC,UACf,MAAM,WAAW,cAAc,CAAC,KAAK,cAAc,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;AAAA,MACzE;AAAA,IACF,CAAC;AACD,SAAK,cAAc,QAAQ;AAAA,EAC7B;AAAA,EAEA,MAAc,cAAc,QAA+C;AACzE,QAAI,OAAO,SAAU;AACrB,WAAO,WAAW;AAClB,UAAM,UAAW,OAAO,QAAqD;AAC7E,UAAM,SAAS,KAAK,OAAO,OAAO;AAAA,EACpC;AAAA;AAAA,EAGA,MAAM,UAAyB;AAC7B,UAAM,KAAK,sBAAsB;AACjC,UAAM,iBAAiB,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC;AACrD,SAAK,MAAM,MAAM;AACjB,UAAM,UAAU,MAAM,QAAQ,WAAW,cAAc;AACvD,UAAM,QAAQ;AAAA,MACZ,QAAQ,QAAQ,CAAC,UACf,MAAM,WAAW,cAAc,CAAC,KAAK,cAAc,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,wBAAuC;AAC3C,UAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,MAAM,OAAO,CAAC;AAC5D,UAAM,QAAQ;AAAA,MACZ,QAAQ,QAAQ,CAAC,UAAU;AACzB,YAAI,MAAM,WAAW,YAAa,QAAO,CAAC;AAC1C,cAAM,MAAM,YAAY;AACxB,cAAM,MAAM,kBAAkB;AAC9B,eAAO,CAAC,KAAK,cAAc,MAAM,KAAK,CAAC;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,iBACZ,WACA,WACiC;AACjC,UAAM,KAAK,sBAAsB;AACjC,UAAM,MAAM,UAAU,KAAK,KAAK,KAAK,OAAO;AAC5C,UAAM,WAAW,KAAK,MAAM,IAAI,GAAG;AACnC,QAAI,SAAU,QAAO,MAAM;AAE3B,UAAM,UAAU,KAAK,uBAAuB,KAAK,WAAW;AAAA,MAC1D,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,kCAAkC;AAAA,IACpC,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,WAAK,MAAM,OAAO,GAAG;AACrB,YAAM;AAAA,IACR,CAAC;AAED,SAAK,MAAM,IAAI,KAAK,OAAO;AAC3B,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,MAAc,uBACZ,WACA,WACA,SACiC;AACjC,UAAM,MAAM,UAAU,KAAK,KAAK,KAAK,OAAO;AAC5C,UAAM,UAAU,MAAM,KAAK,cAAc,WAAW,GAAG;AACvD,UAAM,6BACJ,QAAQ,KAAK,OAAO,oBAAoB,QAAQ,QAAQ,KAAK,OAAO;AACtE,UAAM,0BACJ,6BAA6B,KAAK,MAAM,EAAE,eAAe,QAAQ;AACnE,UAAM,yBACH,KAAK,OAAuC,8BAC7C,KAAK,OAAO;AACd,UAAM,eAA4C;AAAA,MAChD,GAAG,KAAK;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,4BAA4B;AAAA,MAC5B,eAAe,wBAAwB,KAAK,OAAO,eAAe,KAAK;AAAA,QACrE,kBAAkB,KAAK,OAAO;AAAA,QAC9B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,cAAc,YAAY;AAC/C,QAAI;AACF,YAAM,oBACJ,QAAQ,wBAAwB,OAAO,QAAQ,sBAAsB,aACjE,QAAQ,MAAM,SAAS,IACvB,QAAQ,kBAAkB,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC7D,YAAM,YAAY,MAAM,eAAe,mBAAmB,WAAW,MAAM,EAAE,MAAM,CAAC,UAAU;AAC5F,YAAI,iBAAiB,6BAA6B,CAAC,QAAQ,oBAAoB;AAC7E,gBAAM;AAAA,QACR;AACA,eAAO;AAAA,MACT,CAAC;AACD,YAAM,kBAAkB,YACpB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYN,KAAK,0BAA0B,SAAS,QAAQ,KAAK,aAAa,eAAe;AAAA,UAC/E,YAAY,QAAQ;AAAA,UACpB,kCAAkC,QAAQ;AAAA,UAC1C;AAAA,QACF,CAAC;AAAA,QACD,WAAW;AAAA,MACb,EAAE,MAAM,CAAC,UAAU;AACjB,YAAI,iBAAiB,6BAA6B,CAAC,QAAQ,oBAAoB;AAC7E,gBAAM;AAAA,QACR;AACA,eAAO;AAAA,MACT,CAAC,IACC;AACJ,aAAO;AAAA,QACL;AAAA,QACA,YAAY,aAAa;AAAA,QACzB,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,IACF,SAAS,OAAO;AACd,YAAM,UAAW,QAAqD;AACtE,UAAI,SAAS;AACX,cAAM,QAAQ,QAAQ,QAAQ,KAAK,OAAO,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAC7D;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,0BACZ,SACA,WACA,YACA,SAK0B;AAC1B,QAAI,CAAC,QAAQ,YAAY;AACvB,UAAI,CAAC,QAAQ,gBAAiB,QAAO;AACrC,YAAM,kBAAkB,MAAM,QAC3B,gBAAgB,YAAY,QAAQ,SAAS,EAC7C,MAAM,MAAM,SAAkB;AACjC,aAAO,QAAQ,oCAAoC,oBAAoB,YACnE,YACA;AAAA,IACN;AACA,WAAO,MAAM,QAAQ,iBAAiB,WAAW,YAAY,QAAQ,SAAS,EAAE,MAAM,MAAM,SAAkB;AAAA,EAChH;AACF;AAEA,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC5C,cAAc;AACZ,UAAM,mBAAmB;AAAA,EAC3B;AACF;AAEA,SAAS,eAAkB,WAAuB,QAAkC;AAClF,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,QAAS,QAAO,QAAQ,OAAO,IAAI,0BAA0B,CAAC;AAEzE,SAAO,IAAI,QAAW,CAAC,SAAS,WAAW;AACzC,UAAM,UAAU,MAAM;AACpB,aAAO,oBAAoB,SAAS,OAAO;AAC3C,aAAO,IAAI,0BAA0B,CAAC;AAAA,IACxC;AACA,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,cAAU,KAAK,SAAS,MAAM,EAAE,QAAQ,MAAM;AAC5C,aAAO,oBAAoB,SAAS,OAAO;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,8BACP,QACA,SACmB;AACnB,MAAI,CAAC,OAAO,wBAAyB,QAAO;AAC5C,SAAO,QAAQ;AAAA,IAAO,CAAC,WACrB,CAAC,6BAA6B,OAAO,WAAW,OAAO,YAAY,OAAO,IAAI;AAAA,EAChF;AACF;AAEA,SAAS,mBACP,QACA,YACQ;AACR,MAAI,CAAC,OAAO,wBAAyB,QAAO;AAC5C,SAAO,KAAK;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,EACF;AACF;AAEA,eAAe,oBACb,QACA,WACA,SACe;AACf,MAAI,SAAS,WAAW,MAAM;AAC5B;AAAA;AAAA;AAAA;AAAA,MAIE,QAAQ,UAAU,QAClB,OAAO,QAAQ,wBAAwB,MAAM,QAC7C,OAAO,OAAO,QAAQ,iBAAiB;AAAA,MACvC;AACA,YAAM,OAAO,QAAQ,aAAa,SAAS;AAC3C;AAAA,IACF;AACA,QAAI,OAAO,OAAO,QAAQ,2BAA2B,YAAY;AAC/D,YAAM,OAAO,QAAQ,uBAAuB,OAAO,YAAY,SAAS;AACxE;AAAA,IACF;AAIA,UAAM,YAAY,MAAM,OAAO,QAAQ,kBAAkB,SAAS;AAClE,QAAI,cAAc,QAAW;AAC3B,UAAI,CAAC,UAAW,OAAM,IAAI,MAAM,wCAAwC;AACxE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,OAAO,SAAS;AACvC;AAEA,eAAe,mBACb,QACA,SACe;AACf,MAAI,SAAS,WAAW,MAAM;AAC5B,QAAI,OAAO,OAAO,QAAQ,0BAA0B,YAAY;AAC9D,YAAM,OAAO,QAAQ,sBAAsB,OAAO,UAAU;AAC5D;AAAA,IACF;AACA,QAAI,OAAO,OAAO,QAAQ,gBAAgB,YAAY;AACpD,YAAM,OAAO,QAAQ,YAAY;AACjC;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,OAAO,QAAQ,oBAAoB,YAAY;AACxD,UAAM,OAAO,QAAQ,gBAAgB,OAAO,UAAU;AACtD;AAAA,EACF;AACA,QAAM,OAAO,QAAQ,MAAM;AAC7B;AAEA,SAAS,qBAAqB,SAAwC;AACpE,SAAO,kBAAkB,WAAW,OAAO,QAAQ,iBAAiB,aAChE,QAAQ,aAAa,MAAM,OAC3B;AACN;AAEA,SAAS,gBAAgB,MAAc,WAA4B;AACjE,QAAM,WAAW,KAAK,SAAS,MAAM,SAAS;AAC9C,SACE,aAAa,MACZ,aAAa,QAAQ,CAAC,SAAS,WAAW,KAAK,KAAK,GAAG,EAAE,KAAK,CAAC,KAAK,WAAW,QAAQ;AAE5F;AAEA,SAAS,6BACP,WACA,YACA,YACS;AACT,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,uBAAuB,uBAAuB,YAAY,UAAU;AAC1E,QAAM,aAAa,KAAK,QAAQ,SAAS;AACzC,QAAM,iBAAiB,KAAK,KAAK,YAAY,YAAY;AACzD,QAAM,YAAY,KAAK,WAAW,oBAAoB,IAClD,KAAK,UAAU,oBAAoB,IACnC,KAAK,QAAQ,YAAY,oBAAoB;AACjD,SAAO,gBAAgB,gBAAgB,SAAS;AAClD;AAiBA,SAAS,kCAAkC,WAAmB,cAA+B;AAC3F,QAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,QAAM,YAAY,KAAK,WAAW,YAAY,IAC1C,KAAK,UAAU,YAAY,IAC3B,KAAK,QAAQ,MAAM,YAAY;AACnC,MAAI,CAAC,gBAAgB,MAAM,SAAS,EAAG,QAAO;AAC9C,MAAI;AACF,WAAO,gBAAgB,aAAa,OAAO,IAAI,GAAG,aAAa,OAAO,SAAS,CAAC;AAAA,EAClF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACO,SAAS,uBAAuB,YAAoB,YAA4B;AACrF,MAAI,QAAQ,WAAW,KAAK;AAC5B,MAAI,MAAM,WAAW,QAAQ,GAAG;AAC9B,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,UAAI,OAAO,aAAa,UAAU,OAAO,aAAa,YAAY;AAChE,gBAAQ,mBAAmB,OAAO,SAAS,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAChE;AAAA,IACF,QAAQ;AACN,YAAM,YAAY,MAAM,MAAM,SAAS,MAAM;AAC7C,YAAM,aAAa,UAAU,QAAQ,GAAG;AACxC,UAAI,eAAe,IAAI;AACrB,gBAAQ,UAAU,MAAM,aAAa,CAAC;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAMA,QAAM,mBAAmB,GAAG,UAAU;AACtC,MAAI,MAAM,WAAW,gBAAgB,KAAK,CAAC,kBAAkB,SAAS,UAAU,GAAG;AACjF,YAAQ,MAAM,MAAM,iBAAiB,MAAM;AAAA,EAC7C;AACA,SAAO;AACT;AACO,SAAS,2BACd,WACA,YACA,YACQ;AACR,QAAM,aAAa,uBAAuB,YAAY,UAAU;AAChE,MAAI,KAAK,WAAW,UAAU,EAAG,QAAO;AACxC,QAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,QAAM,WAAW,KAAK,QAAQ,MAAM,UAAU;AAC9C,QAAM,WAAW,KAAK,SAAS,MAAM,QAAQ;AAC7C,MAAI,aAAa,MAAM,SAAS,WAAW,IAAI,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AACA,SAAS,4BACP,OACA,YACmB;AACnB,QAAM,SAAS,oBAAI,IAA6B;AAEhD,aAAW,EAAE,WAAW,QAAQ,KAAK,OAAO;AAC1C,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,GAAG,SAAS,KAAK,OAAO,QAAQ,OAAO,KAAK;AACxD,YAAM,WAAW,OAAO,IAAI,GAAG;AAC/B,UAAI,CAAC,UAAU;AACb,eAAO,IAAI,KAAK,EAAE,GAAG,QAAQ,UAAU,CAAC;AACxC;AAAA,MACF;AACA,UAAI,OAAO,QAAQ,SAAS,OAAO;AACjC,eAAO,IAAI,KAAK;AAAA,UACd,GAAG;AAAA,UACH;AAAA,UACA,SAAS,SAAS,WAAW,OAAO,WAAW;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC,EACvB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,MAAM,GAAG,UAAU;AACxB;","names":[]}

package/dist/chunk-MPDLLLOG.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/buffer-persistence.ts"],"sourcesContent":["import type { BufferEntryState, BufferState, BufferSurpriseEvent, BufferTurn } from \"./types.js\";\nimport type { BufferSessionSaveOutcome } from \"./storage/buffer-drain-claims.js\";\n\n/**\n * The buffer persistence surface SmartBuffer depends on.\n *\n * `saveBufferSession` / `deleteBufferSession` are the per-session incremental\n * writes (one file per session); when a storage backend does not provide\n * them, the buffer falls back to the whole-state `saveBuffer`. Both are\n * optional in the type so a storage double only has to implement what it\n * actually supports.\n */\nexport interface BufferStorage {\n  loadBuffer(): Promise<BufferState>;\n  saveBuffer(state: BufferState): Promise<void>;\n  /** Reports \"handed_over\" when the session is claimed by `remnic buffer drain` and the entry moved into the claim instead of a session file. Legacy doubles may return void (treated as \"saved\"). */\n  saveBufferSession?(key: string, entry: BufferEntryState): Promise<BufferSessionSaveOutcome | void>;\n  deleteBufferSession?(key: string): Promise<void>;\n  /** Sync claim check for the extraction gate; omitted when the backend has no drain-claim store. */\n  isBufferSessionClaimed?(key: string): boolean;\n  /** Optional surprise-telemetry sink; older storage and test doubles omit it. */\n  appendBufferSurpriseEvents?(events: BufferSurpriseEvent[]): Promise<number>;\n}\n\n/** What one persist pass changed beyond plain writes. */\nexport interface BufferPersistOutcome {\n  /** Sessions whose in-memory entry moved into a drain claim: the caller must evict them (a claimed session no longer lives in this process). */\n  handedOver: string[];\n  /** Per session, the turns a drain already extracted: the caller subtracts them from its in-memory copy. */\n  drainedTurns: Map<string, BufferTurn[]>;\n}\n\n/**\n * Tracks which sessions' persisted files are stale and writes only those.\n *\n * Marks are cleared only after a durable write of that session. All calls\n * happen under SmartBuffer's serialized mutation chain: one writer.\n */\nexport class BufferSessionPersistence {\n  private readonly dirty = new Set<string>();\n  private readonly deleted = new Set<string>();\n\n  markDirty(key: string): void {\n    this.dirty.add(key);\n    this.deleted.delete(key);\n  }\n\n  markDeleted(key: string): void {\n    this.deleted.add(key);\n    this.dirty.delete(key);\n  }\n\n  /** Eviction removed `key` from memory: its session file must go, any pending write is moot. */\n  markEvicted(keys: readonly string[]): void {\n    for (const key of keys) this.markDeleted(key);\n  }\n\n  hasPending(): boolean {\n    return this.dirty.size > 0 || this.deleted.size > 0;\n  }\n\n  /**\n   * Persist buffer state. On session-capable storage this writes ONLY the\n   * sessions whose state changed since the last successful persist and\n   * deletes files for evicted/reset sessions, so the observe path never\n   * re-serializes other sessions' turns. On legacy storage it falls back to\n   * the whole-state saveBuffer. Files are deleted before dirty writes: a\n   * crash mid-persist can then only resurrect already-evicted data (the same\n   * exposure as a whole-file rewrite), never drop sessions the state says\n   * exist.\n   */\n  async persist(\n    storage: BufferStorage,\n    state: BufferState,\n    peekEntry: (key: string) => BufferEntryState | undefined,\n  ): Promise<BufferPersistOutcome> {\n    const saveSession = storage.saveBufferSession?.bind(storage);\n    const deleteSession = storage.deleteBufferSession?.bind(storage);\n    if (!saveSession || !deleteSession) {\n      await storage.saveBuffer(state);\n      this.dirty.clear();\n      this.deleted.clear();\n      return { handedOver: [], drainedTurns: new Map() };\n    }\n    const handedOver: string[] = [];\n    const drainedTurns = new Map<string, BufferTurn[]>();\n    for (const key of [...this.deleted]) {\n      await deleteSession(key);\n      this.deleted.delete(key);\n    }\n    for (const key of [...this.dirty]) {\n      const entry = peekEntry(key);\n      if (!entry) {\n        // A dirty key without state must not be written from a fabricated\n        // empty entry: treat it as a deletion instead.\n        this.markDeleted(key);\n        continue;\n      }\n      const outcome = await saveSession(key, entry);\n      this.dirty.delete(key);\n      // \"handed_over\": the entry moved into a drain claim. Content is durable\n      // in the claim, so this key's pending state is settled — the caller\n      // evicts the in-memory entry on its side.\n      if (outcome?.status === \"handed_over\") handedOver.push(key);\n      // A drain tombstone: the turns it extracted must leave this process's\n      // copy too, or the owner would extract them a second time.\n      if (outcome?.drainedTurns && outcome.drainedTurns.length > 0) drainedTurns.set(key, outcome.drainedTurns);\n    }\n    return { handedOver, drainedTurns };\n  }\n}\n"],"mappings":";AAsCO,IAAM,2BAAN,MAA+B;AAAA,EACnB,QAAQ,oBAAI,IAAY;AAAA,EACxB,UAAU,oBAAI,IAAY;AAAA,EAE3C,UAAU,KAAmB;AAC3B,SAAK,MAAM,IAAI,GAAG;AAClB,SAAK,QAAQ,OAAO,GAAG;AAAA,EACzB;AAAA,EAEA,YAAY,KAAmB;AAC7B,SAAK,QAAQ,IAAI,GAAG;AACpB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA;AAAA,EAGA,YAAY,MAA+B;AACzC,eAAW,OAAO,KAAM,MAAK,YAAY,GAAG;AAAA,EAC9C;AAAA,EAEA,aAAsB;AACpB,WAAO,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,OAAO;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QACJ,SACA,OACA,WAC+B;AAC/B,UAAM,cAAc,QAAQ,mBAAmB,KAAK,OAAO;AAC3D,UAAM,gBAAgB,QAAQ,qBAAqB,KAAK,OAAO;AAC/D,QAAI,CAAC,eAAe,CAAC,eAAe;AAClC,YAAM,QAAQ,WAAW,KAAK;AAC9B,WAAK,MAAM,MAAM;AACjB,WAAK,QAAQ,MAAM;AACnB,aAAO,EAAE,YAAY,CAAC,GAAG,cAAc,oBAAI,IAAI,EAAE;AAAA,IACnD;AACA,UAAM,aAAuB,CAAC;AAC9B,UAAM,eAAe,oBAAI,IAA0B;AACnD,eAAW,OAAO,CAAC,GAAG,KAAK,OAAO,GAAG;AACnC,YAAM,cAAc,GAAG;AACvB,WAAK,QAAQ,OAAO,GAAG;AAAA,IACzB;AACA,eAAW,OAAO,CAAC,GAAG,KAAK,KAAK,GAAG;AACjC,YAAM,QAAQ,UAAU,GAAG;AAC3B,UAAI,CAAC,OAAO;AAGV,aAAK,YAAY,GAAG;AACpB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,YAAY,KAAK,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AAIrB,UAAI,SAAS,WAAW,cAAe,YAAW,KAAK,GAAG;AAG1D,UAAI,SAAS,gBAAgB,QAAQ,aAAa,SAAS,EAAG,cAAa,IAAI,KAAK,QAAQ,YAAY;AAAA,IAC1G;AACA,WAAO,EAAE,YAAY,aAAa;AAAA,EACpC;AACF;","names":[]}

package/dist/chunk-MPGLM2VU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/recall-navigation-operations.ts"],"sourcesContent":["/**\n * Recall-navigation boundary operations (issue #1956).\n *\n * `memory_expand` / `memory_traverse` route MCP, HTTP, and CLI dispatch\n * through the shared validation + error-mapping layer (access-boundary.ts)\n * to the single `EngramAccessService.recallNavigate` implementation.\n * Sibling module so access-operations-batch.ts stays at its ceiling seam\n * (same layout as deep-recall's extraction).\n */\n\nimport { z } from \"zod\";\n\nimport { defineOperation } from \"./access-boundary.js\";\nimport { EngramAccessInputError } from \"./access-errors.js\";\n\nfunction stripNulls(data: unknown): unknown {\n  if (data !== null && typeof data === \"object\" && !Array.isArray(data)) {\n    const obj = data as Record<string, unknown>;\n    const cleaned: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(obj)) {\n      if (value !== null) cleaned[key] = value;\n    }\n    return cleaned;\n  }\n  return data;\n}\n\nfunction strictSchema<T extends z.ZodRawShape>(shape: T): z.ZodType<Record<string, unknown>> {\n  return z.preprocess(stripNulls, z.object(shape).passthrough()) as unknown as z.ZodType<Record<string, unknown>>;\n}\n\nconst str = z.string().optional();\n\nfunction optStr(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\n\nfunction optInt(value: unknown): number | undefined {\n  if (typeof value === \"number\") return value;\n  if (typeof value === \"string\" && Number.isFinite(Number(value))) return Number(value);\n  return undefined;\n}\n\nfunction reqStr(value: unknown, field: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw new EngramAccessInputError(`${field} is required`);\n  }\n  return value;\n}\n\nconst baseShape = {\n  memoryId: z.string(),\n  sessionKey: z.string(),\n  namespace: str,\n};\n\ndefineOperation({\n  name: \"memory_expand\",\n  description: \"Re-render one already-served recall result at a deeper disclosure level (chunk → section → raw).\",\n  schema: strictSchema({ ...baseShape, disclosure: z.enum([\"chunk\", \"section\", \"raw\"]).optional() }),\n  handler: async (input, ctx) => {\n    const disclosure = optStr(input.disclosure);\n    return {\n      result: await ctx.service.recallNavigate({\n        action: \"expand\",\n        memoryId: reqStr(input.memoryId, \"memoryId\"),\n        sessionKey: reqStr(input.sessionKey, \"sessionKey\"),\n        ...(disclosure === \"chunk\" || disclosure === \"section\" || disclosure === \"raw\" ? { disclosure } : {}),\n        namespace: optStr(input.namespace),\n        authenticatedPrincipal: ctx.authenticatedPrincipal,\n      }),\n    };\n  },\n});\n\ndefineOperation({\n  name: \"memory_traverse\",\n  description:\n    \"Follow typed frontmatter links from an already-served recall result; neighbors return as chunk-level summaries.\",\n  schema: strictSchema({\n    ...baseShape,\n    relation: z\n      .enum([\n        \"supports\",\n        \"contradicts\",\n        \"elaborates\",\n        \"causes\",\n        \"caused_by\",\n        \"supersedes\",\n        \"follows\",\n        \"references\",\n        \"related\",\n      ])\n      .optional(),\n    limit: z.union([z.number(), z.string()]).optional(),\n  }),\n  handler: async (input, ctx) => {\n    const relation = optStr(input.relation);\n    return {\n      result: await ctx.service.recallNavigate({\n        action: \"traverse\",\n        memoryId: reqStr(input.memoryId, \"memoryId\"),\n        sessionKey: reqStr(input.sessionKey, \"sessionKey\"),\n        ...(relation !== undefined ? { relation } : {}),\n        limit: optInt(input.limit),\n        namespace: optStr(input.namespace),\n        authenticatedPrincipal: ctx.authenticatedPrincipal,\n      }),\n    };\n  },\n});\n"],"mappings":";;;;;;;;AAUA,SAAS,SAAS;AAKlB,SAAS,WAAW,MAAwB;AAC1C,MAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,UAAM,MAAM;AACZ,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,UAAI,UAAU,KAAM,SAAQ,GAAG,IAAI;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,aAAsC,OAA8C;AAC3F,SAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,EAAE,YAAY,CAAC;AAC/D;AAEA,IAAM,MAAM,EAAE,OAAO,EAAE,SAAS;AAEhC,SAAS,OAAO,OAAoC;AAClD,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,OAAO,OAAoC;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,OAAO,KAAK,CAAC,EAAG,QAAO,OAAO,KAAK;AACpF,SAAO;AACT;AAEA,SAAS,OAAO,OAAgB,OAAuB;AACrD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,UAAM,IAAI,uBAAuB,GAAG,KAAK,cAAc;AAAA,EACzD;AACA,SAAO;AACT;AAEA,IAAM,YAAY;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AAAA,EACrB,WAAW;AACb;AAEA,gBAAgB;AAAA,EACd,MAAM;AAAA,EACN,aAAa;AAAA,EACb,QAAQ,aAAa,EAAE,GAAG,WAAW,YAAY,EAAE,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,EACjG,SAAS,OAAO,OAAO,QAAQ;AAC7B,UAAM,aAAa,OAAO,MAAM,UAAU;AAC1C,WAAO;AAAA,MACL,QAAQ,MAAM,IAAI,QAAQ,eAAe;AAAA,QACvC,QAAQ;AAAA,QACR,UAAU,OAAO,MAAM,UAAU,UAAU;AAAA,QAC3C,YAAY,OAAO,MAAM,YAAY,YAAY;AAAA,QACjD,GAAI,eAAe,WAAW,eAAe,aAAa,eAAe,QAAQ,EAAE,WAAW,IAAI,CAAC;AAAA,QACnG,WAAW,OAAO,MAAM,SAAS;AAAA,QACjC,wBAAwB,IAAI;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,gBAAgB;AAAA,EACd,MAAM;AAAA,EACN,aACE;AAAA,EACF,QAAQ,aAAa;AAAA,IACnB,GAAG;AAAA,IACH,UAAU,EACP,KAAK;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,SAAS;AAAA,IACZ,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,EACpD,CAAC;AAAA,EACD,SAAS,OAAO,OAAO,QAAQ;AAC7B,UAAM,WAAW,OAAO,MAAM,QAAQ;AACtC,WAAO;AAAA,MACL,QAAQ,MAAM,IAAI,QAAQ,eAAe;AAAA,QACvC,QAAQ;AAAA,QACR,UAAU,OAAO,MAAM,UAAU,UAAU;AAAA,QAC3C,YAAY,OAAO,MAAM,YAAY,YAAY;AAAA,QACjD,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,QAC7C,OAAO,OAAO,MAAM,KAAK;AAAA,QACzB,WAAW,OAAO,MAAM,SAAS;AAAA,QACjC,wBAAwB,IAAI;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;","names":[]}

package/dist/chunk-QZBTIYKD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/source-agent-qualifier.ts"],"sourcesContent":["/**\n * Source-agent qualifier helpers for extraction (#2183).\n *\n * Pure leaf module: imports only types and sibling leaf/orchestration helpers,\n * never `extraction.ts`, so it introduces no cycle (extraction-run.ts only\n * type-imports extraction.ts).\n */\nimport { resolvePipelineProcessingCapabilities } from \"./capabilities.js\";\nimport { applyExtractionSourceGrounding } from \"./extraction-source-grounding.js\";\nimport type { ExtractionGroundingRoleSources } from \"./extraction-source-grounding.js\";\nimport { isValidConnectorId } from \"./connectors/index.js\";\nimport { CONNECTOR_LABEL_MAX_LENGTH, knownConnectorIds } from \"./connectors/label.js\";\nimport { deriveSourceConnector } from \"./orchestration/extraction-run.js\";\nimport type { BufferTurn, ExtractionResult, PluginConfig } from \"./types.js\";\n\n\nexport function resolveSourceConnector(turns: readonly BufferTurn[]): string | undefined {\n  const contributing = turns.filter((turn) => turn.extractionContextOnly !== true);\n  const derived = deriveSourceConnector(contributing);\n  if (derived === undefined || !isValidConnectorId(derived)) return undefined;\n  return /[\\u0000-\\u001F\\u007F]/.test(derived) ? undefined : derived;\n}\n\n// Same bound as the recall renderer (CONNECTOR_LABEL_MAX_LENGTH) but a DIFFERENT\n// policy: recall TRUNCATES past the bound (a truncated display label cannot\n// mislead), while the prompt SUPPRESSES (a truncated id could collide with a\n// different connector). Do not \"fix\" this inconsistency — it is deliberate.\nexport function headerConnector(connector: string | undefined): string | undefined {\n  return connector !== undefined && connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : undefined;\n}\n\nexport function renderExtractionConversation(\n  boundedTurns: readonly BufferTurn[],\n  sourceConnector: string | undefined,\n): { conversation: string; renderedConversation: string } {\n  const renderedConversation = boundedTurns\n    .map((t) => `[${t.extractionContextOnly === true ? `context ${t.role}` : t.role}] ${t.content}`)\n    .join(\"\\n\\n\");\n  const conversation = sourceConnector === undefined\n    ? renderedConversation\n    : `Source agent: ${sourceConnector}\\n\\nTool and command instructions in this conversation apply to the ${sourceConnector} agent unless they are clearly universal.\\n\\n${renderedConversation}`;\n  return { conversation, renderedConversation };\n}\n\nexport interface ExtractionGroundingContext {\n  groundingSource: string;\n  assertionSource: string;\n  roleAssertionSources?: ExtractionGroundingRoleSources;\n  messageTimestamp: Date | undefined;\n  sourceConnector?: string;\n  /** Input came from an always-on recorder (issue #2294); the proactive\n   *  second pass reads it so its prompts carry the same media warning. */\n  ambientCapture?: boolean;\n  scopeClassificationEnabled?: boolean;\n}\n\nexport function applyGroundingWithConnector(\n  config: PluginConfig,\n  result: ExtractionResult,\n  ctx: ExtractionGroundingContext,\n): ExtractionResult {\n  const caps = resolvePipelineProcessingCapabilities(config);\n  const options = {\n    sourceGrounding: caps.sourceGrounding,\n    anchorTemporalExpressions: caps.delinearize,\n    spanMode: config.extraction?.spanMode ?? \"off\",\n  };\n  const known = buildKnownConnectors(ctx.sourceConnector);\n  // Scope-forcing is decoupled from strip/restore (runs without a trusted\n  // connector) but gated on the capability: flag off = byte-identical pre-#2183.\n  const scoped = ctx.scopeClassificationEnabled === false\n    ? result\n    : forceProjectScopeOnAnyQualifier(result, known);\n  if (ctx.sourceConnector === undefined) {\n    return applyExtractionSourceGrounding(scoped, ctx.groundingSource, ctx.assertionSource, ctx.roleAssertionSources, ctx.messageTimestamp, options);\n  }\n  const prepared = prepareTrustedConnectorQualifier(scoped, ctx.sourceConnector, known);\n  const grounded = applyExtractionSourceGrounding(prepared.result, ctx.groundingSource, ctx.assertionSource, ctx.roleAssertionSources, ctx.messageTimestamp, options);\n  return restoreTrustedConnectorQualifier(grounded);\n}\n\nfunction buildKnownConnectors(trusted: string | undefined): Set<string> {\n  const known = new Set<string>();\n  for (const id of knownConnectorIds()) known.add(id.toLowerCase());\n  if (trusted !== undefined) known.add(trusted.toLowerCase());\n  return known;\n}\n\n/**\n * Parse a leading agent qualifier from fact text. ONE parser, ONE boundary\n * rule, ONE case policy (case-insensitive), ONE definition of \"agent\" (the name\n * must be a known connector ID). Returns the matched agent and the remaining\n * text, or undefined. Both scope-forcing and strip/restore consume this single\n * result so they can never disagree (#2183 round-11).\n */\nfunction parseLeadingQualifier(content: string, known: ReadonlySet<string>): { agent: string; rest: string } | undefined {\n  const lower = content.toLowerCase();\n  for (const lead of [\"in \", \"for \"]) {\n    if (!lower.startsWith(lead)) continue;\n    const m = lower.slice(lead.length).match(/^([a-z0-9][a-z0-9._-]*)\\s*,/u);\n    if (m && known.has(m[1])) {\n      const consumed = lead.length + m[0].length;\n      return { agent: m[1], rest: content.slice(consumed).replace(/^[\\s,.;:]+/u, \"\") };\n    }\n  }\n  const pm = lower.match(/^([a-z0-9][a-z0-9._-]*)'s(?![\\p{L}\\p{N}])/u);\n  if (pm && known.has(pm[1])) {\n    return { agent: pm[1], rest: content.slice(pm[0].length).replace(/^[\\s,.;:]+/u, \"\") };\n  }\n  return undefined;\n}\n\n/**\n * Force \"project\" scope on any fact whose content starts with a recognised\n * agent qualifier (a known connector name). A qualifier is evidence the fact is\n * agent-tied; which connector it names does not matter.\n */\nfunction forceProjectScopeOnAnyQualifier(result: ExtractionResult, known: ReadonlySet<string>): ExtractionResult {\n  let any = false;\n  const facts = result.facts.map((fact) => {\n    if (fact.scope === \"project\") return fact;\n    if (parseLeadingQualifier(fact.content, known) === undefined) return fact;\n    any = true;\n    return { ...fact, scope: \"project\" as const };\n  });\n  return any ? { ...result, facts } : result;\n}\n\nconst RESTORE_KEY = \"_qo\";\n\n/**\n * Strip the TRUSTED connector's qualifier for the grounding pass. Uses the same\n * parseLeadingQualifier as scope-forcing, but only strips when the matched agent\n * IS the trusted connector. Each stripped fact carries its original content\n * positionally for collision-free restore.\n */\nfunction prepareTrustedConnectorQualifier(\n  result: ExtractionResult,\n  trustedConnector: string,\n  known: ReadonlySet<string>,\n): { result: ExtractionResult } {\n  const trusted = trustedConnector.toLowerCase();\n  const facts = result.facts.map((fact) => {\n    const parsed = parseLeadingQualifier(fact.content, known);\n    if (parsed === undefined || parsed.agent !== trusted) return fact;\n    return { ...fact, content: parsed.rest, [RESTORE_KEY]: fact.content };\n  }) as ExtractionResult[\"facts\"];\n  return { result: { ...result, facts } };\n}\n\nfunction restoreTrustedConnectorQualifier(grounded: ExtractionResult): ExtractionResult {\n  let touched = false;\n  const facts = grounded.facts.map((fact) => {\n    const record = fact as unknown as Record<string, unknown>;\n    const original = record[RESTORE_KEY];\n    if (typeof original !== \"string\") return fact;\n    touched = true;\n    const rest = { ...record };\n    delete rest[RESTORE_KEY];\n    return { ...rest, content: original } as ExtractionResult[\"facts\"][number];\n  });\n  return touched ? { ...grounded, facts } : grounded;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBO,SAAS,uBAAuB,OAAkD;AACvF,QAAM,eAAe,MAAM,OAAO,CAAC,SAAS,KAAK,0BAA0B,IAAI;AAC/E,QAAM,UAAU,sBAAsB,YAAY;AAClD,MAAI,YAAY,UAAa,CAAC,mBAAmB,OAAO,EAAG,QAAO;AAClE,SAAO,wBAAwB,KAAK,OAAO,IAAI,SAAY;AAC7D;AAMO,SAAS,gBAAgB,WAAmD;AACjF,SAAO,cAAc,UAAa,UAAU,UAAU,6BAA6B,YAAY;AACjG;AAEO,SAAS,6BACd,cACA,iBACwD;AACxD,QAAM,uBAAuB,aAC1B,IAAI,CAAC,MAAM,IAAI,EAAE,0BAA0B,OAAO,WAAW,EAAE,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE,EAC9F,KAAK,MAAM;AACd,QAAM,eAAe,oBAAoB,SACrC,uBACA,iBAAiB,eAAe;AAAA;AAAA,kEAAuE,eAAe;AAAA;AAAA,EAAgD,oBAAoB;AAC9L,SAAO,EAAE,cAAc,qBAAqB;AAC9C;AAcO,SAAS,4BACd,QACA,QACA,KACkB;AAClB,QAAM,OAAO,sCAAsC,MAAM;AACzD,QAAM,UAAU;AAAA,IACd,iBAAiB,KAAK;AAAA,IACtB,2BAA2B,KAAK;AAAA,IAChC,UAAU,OAAO,YAAY,YAAY;AAAA,EAC3C;AACA,QAAM,QAAQ,qBAAqB,IAAI,eAAe;AAGtD,QAAM,SAAS,IAAI,+BAA+B,QAC9C,SACA,gCAAgC,QAAQ,KAAK;AACjD,MAAI,IAAI,oBAAoB,QAAW;AACrC,WAAO,+BAA+B,QAAQ,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,sBAAsB,IAAI,kBAAkB,OAAO;AAAA,EACjJ;AACA,QAAM,WAAW,iCAAiC,QAAQ,IAAI,iBAAiB,KAAK;AACpF,QAAM,WAAW,+BAA+B,SAAS,QAAQ,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,sBAAsB,IAAI,kBAAkB,OAAO;AAClK,SAAO,iCAAiC,QAAQ;AAClD;AAEA,SAAS,qBAAqB,SAA0C;AACtE,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,MAAM,kBAAkB,EAAG,OAAM,IAAI,GAAG,YAAY,CAAC;AAChE,MAAI,YAAY,OAAW,OAAM,IAAI,QAAQ,YAAY,CAAC;AAC1D,SAAO;AACT;AASA,SAAS,sBAAsB,SAAiB,OAAyE;AACvH,QAAM,QAAQ,QAAQ,YAAY;AAClC,aAAW,QAAQ,CAAC,OAAO,MAAM,GAAG;AAClC,QAAI,CAAC,MAAM,WAAW,IAAI,EAAG;AAC7B,UAAM,IAAI,MAAM,MAAM,KAAK,MAAM,EAAE,MAAM,8BAA8B;AACvE,QAAI,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG;AACxB,YAAM,WAAW,KAAK,SAAS,EAAE,CAAC,EAAE;AACpC,aAAO,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,QAAQ,MAAM,QAAQ,EAAE,QAAQ,eAAe,EAAE,EAAE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,KAAK,MAAM,MAAM,4CAA4C;AACnE,MAAI,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG;AAC1B,WAAO,EAAE,OAAO,GAAG,CAAC,GAAG,MAAM,QAAQ,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,eAAe,EAAE,EAAE;AAAA,EACtF;AACA,SAAO;AACT;AAOA,SAAS,gCAAgC,QAA0B,OAA8C;AAC/G,MAAI,MAAM;AACV,QAAM,QAAQ,OAAO,MAAM,IAAI,CAAC,SAAS;AACvC,QAAI,KAAK,UAAU,UAAW,QAAO;AACrC,QAAI,sBAAsB,KAAK,SAAS,KAAK,MAAM,OAAW,QAAO;AACrE,UAAM;AACN,WAAO,EAAE,GAAG,MAAM,OAAO,UAAmB;AAAA,EAC9C,CAAC;AACD,SAAO,MAAM,EAAE,GAAG,QAAQ,MAAM,IAAI;AACtC;AAEA,IAAM,cAAc;AAQpB,SAAS,iCACP,QACA,kBACA,OAC8B;AAC9B,QAAM,UAAU,iBAAiB,YAAY;AAC7C,QAAM,QAAQ,OAAO,MAAM,IAAI,CAAC,SAAS;AACvC,UAAM,SAAS,sBAAsB,KAAK,SAAS,KAAK;AACxD,QAAI,WAAW,UAAa,OAAO,UAAU,QAAS,QAAO;AAC7D,WAAO,EAAE,GAAG,MAAM,SAAS,OAAO,MAAM,CAAC,WAAW,GAAG,KAAK,QAAQ;AAAA,EACtE,CAAC;AACD,SAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE;AACxC;AAEA,SAAS,iCAAiC,UAA8C;AACtF,MAAI,UAAU;AACd,QAAM,QAAQ,SAAS,MAAM,IAAI,CAAC,SAAS;AACzC,UAAM,SAAS;AACf,UAAM,WAAW,OAAO,WAAW;AACnC,QAAI,OAAO,aAAa,SAAU,QAAO;AACzC,cAAU;AACV,UAAM,OAAO,EAAE,GAAG,OAAO;AACzB,WAAO,KAAK,WAAW;AACvB,WAAO,EAAE,GAAG,MAAM,SAAS,SAAS;AAAA,EACtC,CAAC;AACD,SAAO,UAAU,EAAE,GAAG,UAAU,MAAM,IAAI;AAC5C;","names":[]}