@remnic/core 10.0.91 → 10.0.93

package/dist/{chunk-XYTQJD7F.js → chunk-LMJVP5CM.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-QDW3E4RD.js";
 import {
   gatewayTaskChainOptions
-} from "./chunk-ZU5JDLOH.js";
+} from "./chunk-MMRTPH3J.js";
 import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
@@ -496,4 +496,4 @@ export {
   createVerdictCache,
   createDeferCountMap
 };
-//# sourceMappingURL=chunk-XYTQJD7F.js.map
+//# sourceMappingURL=chunk-LMJVP5CM.js.map

package/dist/{chunk-JC36FPQ5.js → chunk-LPV72KRQ.js}

@@ -1,6 +1,6 @@
 import {
   defineOperation
-} from "./chunk-STSLB4HT.js";
+} from "./chunk-JTSSSR4L.js";
 import {
   EngramAccessInputError
 } from "./chunk-CJCTKL6Y.js";
@@ -71,4 +71,4 @@ defineOperation({
     })
   })
 });
-//# sourceMappingURL=chunk-JC36FPQ5.js.map
+//# sourceMappingURL=chunk-LPV72KRQ.js.map

package/dist/{chunk-2LCRG2YV.js → chunk-M2XR6B6V.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-7RJUVTVF.js";
 import {
   ContentHashIndex
-} from "./chunk-UDKWFDV2.js";
+} from "./chunk-HLUHEMN4.js";
 import {
   computeLegacyContentHash,
   normalizeLegacyContent
@@ -348,4 +348,4 @@ export {
   buildReconcileManifest,
   collapseActiveFactDuplicates
 };
-//# sourceMappingURL=chunk-2LCRG2YV.js.map
+//# sourceMappingURL=chunk-M2XR6B6V.js.map

package/dist/{chunk-GGRRF4PZ.js → chunk-MDPT6QFK.js}

@@ -606,4 +606,4 @@ export {
   _refreshConnectorLockForTest,
   _releaseConnectorLockForTest
 };
-//# sourceMappingURL=chunk-GGRRF4PZ.js.map
+//# sourceMappingURL=chunk-MDPT6QFK.js.map

package/dist/{chunk-GGRRF4PZ.js.map → chunk-MDPT6QFK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/connectors/live/state-store.ts","../src/connectors/live/framework.ts"],"sourcesContent":["/**\n * @remnic/core — Live Connectors State Store (issue #683 PR 1/N)\n *\n * Persists per-connector cursor + sync metadata to\n *   `<memoryDir>/state/connectors/<id>.json`\n *\n * Reasons this lives next to memory data, not in user config:\n *   - cursors are *operational* state that should travel with the memory\n *     directory when a user moves it across machines;\n *   - it keeps memory + ingest provenance co-located so tooling that backs up\n *     the memory directory captures cursor state too.\n *\n * Atomic-write contract (CLAUDE.md gotcha #54):\n *   - We NEVER `rmSync(target)` before `renameSync(tmp, target)`.\n *   - Writes go to a sibling tmp file and `rename()` swaps it in.\n *   - On error, the tmp file is best-effort cleaned up; the previous good\n *     state file is left untouched.\n *\n * Privacy: cursors are opaque connector-defined strings. We do not log them\n * and do not surface them through user-visible APIs. Document content NEVER\n * touches this module.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport path from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\n\nimport { expandTildePath } from \"../../utils/path.js\";\n\nimport { type ConnectorCursor, isValidConnectorId } from \"./framework.js\";\n\n/**\n * Status of the most recent sync attempt for a connector.\n *\n * `\"never\"` is distinct from `\"success\"` so callers can detect\n * \"registered but never run\" without inspecting timestamps. Per CLAUDE.md\n * gotcha #34, we deliberately distinguish empty/unknown from failure states.\n */\nexport type ConnectorSyncStatus = \"success\" | \"error\" | \"never\";\n\n/**\n * Persisted per-connector state.\n *\n * Stored as pretty-printed JSON for human inspection — the file is small\n * (one record per connector) and operators may need to debug stuck cursors\n * by hand.\n */\nexport interface ConnectorState {\n  /** Connector id. Matches the filename stem. */\n  readonly id: string;\n  /** Last persisted cursor, or `null` if the connector has never synced. */\n  readonly cursor: ConnectorCursor | null;\n  /** ISO 8601 timestamp of the last completed sync attempt, or `null`. */\n  readonly lastSyncAt: string | null;\n  /** Status of the last completed sync attempt. */\n  readonly lastSyncStatus: ConnectorSyncStatus;\n  /** Optional error message from the last failed sync. Truncated to 1 KB. */\n  readonly lastSyncError?: string;\n  /** Cumulative count of documents successfully imported across all syncs. */\n  readonly totalDocsImported: number;\n  /** ISO 8601 timestamp of when this state record was last written. */\n  readonly updatedAt: string;\n}\n\nconst STATE_DIR_NAME = \"state\";\nconst CONNECTORS_DIR_NAME = \"connectors\";\nconst CONNECTOR_LOCKS_DIR_NAME = \"connector-locks\";\nconst MAX_ERROR_LENGTH = 1024;\nconst CONNECTOR_LOCK_STALE_MS = 10 * 60 * 1000;\nconst CONNECTOR_LOCK_HEARTBEAT_MS = Math.max(1_000, Math.floor(CONNECTOR_LOCK_STALE_MS / 4));\nconst CONNECTOR_LOCK_TIMEOUT_MS = 60 * 1000;\nconst CONNECTOR_LOCK_RETRY_MS = 50;\nconst VALID_SYNC_STATUSES: ReadonlySet<ConnectorSyncStatus> = new Set([\"success\", \"error\", \"never\"]);\n\n/**\n * Internal error thrown when a state file's JSON is unparseable or its shape\n * doesn't match `ConnectorState`. Used by `listConnectorStates` to distinguish\n * \"skip this corrupt file\" cases from genuine I/O failures (`EACCES`, `EIO`)\n * that the caller must see.\n */\nclass ConnectorStateCorruptionError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConnectorStateCorruptionError\";\n  }\n}\n\nexport class ConnectorStateLockLostError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConnectorStateLockLostError\";\n  }\n}\n\ninterface ConnectorLockLease {\n  readonly path: string;\n  readonly token: string;\n}\n\ninterface ConnectorLockMetadata {\n  readonly pid: number;\n  readonly token: string;\n  readonly createdAt: string;\n  readonly refreshedAt: string;\n}\n\ninterface ConnectorStateLockOptions {\n  readonly heartbeatMs?: number;\n  readonly unrefHeartbeat?: boolean;\n}\n\n/**\n * Resolve `<memoryDir>/state/connectors/`, expanding `~` per CLAUDE.md #17.\n */\nfunction resolveConnectorsDir(memoryDir: string): string {\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new TypeError(\"memoryDir must be a non-empty string\");\n  }\n  return path.join(expandTildePath(memoryDir), STATE_DIR_NAME, CONNECTORS_DIR_NAME);\n}\n\nfunction resolveConnectorLocksDir(memoryDir: string): string {\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new TypeError(\"memoryDir must be a non-empty string\");\n  }\n  return path.join(expandTildePath(memoryDir), STATE_DIR_NAME, CONNECTOR_LOCKS_DIR_NAME);\n}\n\n/**\n * Resolve the state file path for a single connector. Throws on invalid id\n * to prevent path traversal via crafted ids.\n */\nfunction resolveConnectorStatePath(memoryDir: string, id: string): string {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  return path.join(resolveConnectorsDir(memoryDir), `${id}.json`);\n}\n\nfunction resolveConnectorLockPath(memoryDir: string, id: string): string {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  return path.join(resolveConnectorLocksDir(memoryDir), `${id}.lock`);\n}\n\n/**\n * Type guard for parsed state records. Validates the on-disk shape so a\n * corrupted/edited file produces a clear error rather than crashing later.\n *\n * Per CLAUDE.md gotcha #18, JSON.parse('null') yields `null` which would\n * pass a naive truthy check. We explicitly require an object.\n */\nfunction isConnectorStateShape(value: unknown): value is ConnectorState {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  if (typeof v.id !== \"string\") return false;\n  if (typeof v.lastSyncStatus !== \"string\") return false;\n  if (![\"success\", \"error\", \"never\"].includes(v.lastSyncStatus)) return false;\n  // totalDocsImported is a cumulative count — fractional values would corrupt\n  // metrics on later increments. Mirror the boundary check in writeConnectorState.\n  if (typeof v.totalDocsImported !== \"number\" || !Number.isInteger(v.totalDocsImported)) return false;\n  if (v.totalDocsImported < 0) return false;\n  if (typeof v.updatedAt !== \"string\") return false;\n  if (v.lastSyncAt !== null && typeof v.lastSyncAt !== \"string\") return false;\n  if (v.cursor !== null) {\n    if (typeof v.cursor !== \"object\" || v.cursor === null) return false;\n    const c = v.cursor as Record<string, unknown>;\n    if (typeof c.kind !== \"string\" || typeof c.value !== \"string\" || typeof c.updatedAt !== \"string\") {\n      return false;\n    }\n  }\n  if (v.lastSyncError !== undefined && typeof v.lastSyncError !== \"string\") return false;\n  return true;\n}\n\nfunction isConnectorLockMetadata(value: unknown): value is ConnectorLockMetadata {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  return (\n    typeof v.pid === \"number\" &&\n    Number.isInteger(v.pid) &&\n    v.pid > 0 &&\n    typeof v.token === \"string\" &&\n    v.token.length > 0 &&\n    typeof v.createdAt === \"string\" &&\n    typeof v.refreshedAt === \"string\"\n  );\n}\n\nfunction connectorLockMetadata(token: string, createdAt = new Date().toISOString()): ConnectorLockMetadata {\n  return {\n    pid: process.pid,\n    token,\n    createdAt,\n    refreshedAt: new Date().toISOString(),\n  };\n}\n\nasync function readConnectorLockMetadata(lockPath: string): Promise<ConnectorLockMetadata | null> {\n  let raw: string;\n  try {\n    raw = await fs.readFile(lockPath, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    const parsed = JSON.parse(raw) as unknown;\n    return isConnectorLockMetadata(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseConnectorLockMetadata(raw: string): ConnectorLockMetadata | null {\n  try {\n    const parsed = JSON.parse(raw) as unknown;\n    return isConnectorLockMetadata(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isSameFileIdentity(left: import(\"node:fs\").Stats, right: import(\"node:fs\").Stats): boolean {\n  return left.dev === right.dev && left.ino === right.ino;\n}\n\n/**\n * Reject any path component along `<memoryDir>/state/connectors/<id>.json`\n * that is a symlink. Without this guard, a symlink in any of those\n * components would let `fs.readFile` escape the memory root and consume an\n * arbitrary outside file as cursor state — silently poisoning sync state and\n * violating the project-wide rule against symlink traversal.\n *\n * `lstat` is used (not `stat`) so we observe the link itself rather than its\n * target. Missing components are tolerated — the caller's `readFile` /\n * `mkdir` will surface ENOENT in its normal way.\n *\n * (PR #724 review.)\n */\nasync function assertNoSymlinkOnPath(memoryDir: string, filePath: string): Promise<void> {\n  const expandedRoot = expandTildePath(memoryDir);\n  // Normalize so `..` segments can't bypass the prefix check below.\n  const root = path.resolve(expandedRoot);\n  const target = path.resolve(filePath);\n  const rel = path.relative(root, target);\n  // path.relative() yields a \"../...\" prefix when target escapes root.\n  if (rel.startsWith(\"..\") || path.isAbsolute(rel)) {\n    throw new Error(`connector state path ${target} escapes memory root ${root}`);\n  }\n  // Walk every component from root to target (inclusive) and lstat each.\n  const segments = rel.length === 0 ? [] : rel.split(path.sep);\n  let current = root;\n  const componentsToCheck = [current];\n  for (const seg of segments) {\n    current = path.join(current, seg);\n    componentsToCheck.push(current);\n  }\n  for (const component of componentsToCheck) {\n    let stat: import(\"node:fs\").Stats;\n    try {\n      stat = await fs.lstat(component);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        // Not yet created — that's fine; caller's readFile/mkdir handles it.\n        continue;\n      }\n      throw err;\n    }\n    if (stat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${component} is a symlink; refusing to follow`);\n    }\n  }\n}\n\nasync function tryAcquireConnectorLock(memoryDir: string, id: string): Promise<ConnectorLockLease | null> {\n  const dir = resolveConnectorLocksDir(memoryDir);\n  const lockPath = resolveConnectorLockPath(memoryDir, id);\n  await assertNoSymlinkOnPath(memoryDir, lockPath);\n  await fs.mkdir(dir, { recursive: true });\n  let handle: Awaited<ReturnType<typeof fs.open>> | null = null;\n  let acquiredLockFile = false;\n  const token = randomUUID();\n  try {\n    handle = await fs.open(lockPath, \"wx\", 0o600);\n    acquiredLockFile = true;\n    await handle.writeFile(`${JSON.stringify(connectorLockMetadata(token))}\\n`, \"utf8\");\n    await handle.close();\n    handle = null;\n    return { path: lockPath, token };\n  } catch (err) {\n    if (acquiredLockFile) {\n      if (handle !== null) {\n        try {\n          await handle.close();\n        } catch {\n          // The original write/close failure is more actionable.\n        }\n      }\n      try {\n        await fs.unlink(lockPath);\n      } catch (cleanupErr) {\n        if ((cleanupErr as NodeJS.ErrnoException).code !== \"ENOENT\") {\n          throw new AggregateError(\n            [err, cleanupErr],\n            `failed to initialize connector state lock at ${lockPath}; cleanup also failed`\n          );\n        }\n      }\n      throw err;\n    }\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") {\n      throw err;\n    }\n    let stat: import(\"node:fs\").Stats;\n    try {\n      stat = await fs.lstat(lockPath);\n    } catch (statErr) {\n      if ((statErr as NodeJS.ErrnoException).code === \"ENOENT\") {\n        return null;\n      }\n      throw statErr;\n    }\n    if (stat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lockPath} is a symlink; refusing to follow`);\n    }\n    if (Date.now() - stat.mtimeMs > CONNECTOR_LOCK_STALE_MS) {\n      await unlinkStaleConnectorLock(lockPath);\n      return null;\n    }\n    return null;\n  }\n}\n\nasync function shouldUnlinkStaleConnectorLock(lockPath: string, stat: import(\"node:fs\").Stats): Promise<boolean> {\n  if (Date.now() - stat.mtimeMs <= CONNECTOR_LOCK_STALE_MS) return false;\n  const metadata = await readConnectorLockMetadata(lockPath);\n  if (metadata === null) return true;\n  const refreshedAtMs = Date.parse(metadata.refreshedAt);\n  if (!Number.isFinite(refreshedAtMs)) return true;\n  return Date.now() - refreshedAtMs > CONNECTOR_LOCK_STALE_MS;\n}\n\nasync function unlinkStaleConnectorLock(lockPath: string): Promise<void> {\n  const reclaimHandle = await openConnectorReclaimLock(lockPath);\n  if (!reclaimHandle) return;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    await unlinkStaleConnectorLockWhileReclaimHeld(lockPath);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lockPath)).catch(() => undefined);\n  }\n}\n\nasync function unlinkStaleConnectorLockWhileReclaimHeld(lockPath: string): Promise<void> {\n  let stat: import(\"node:fs\").Stats;\n  try {\n    stat = await fs.lstat(lockPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  }\n  if (stat.isSymbolicLink()) {\n    throw new Error(`connector state path component ${lockPath} is a symlink; refusing to follow`);\n  }\n  if (!(await shouldUnlinkStaleConnectorLock(lockPath, stat))) return;\n  try {\n    await fs.unlink(lockPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n  }\n}\n\nfunction connectorReclaimLockPath(lockPath: string): string {\n  return `${lockPath}.reclaim`;\n}\n\nasync function openConnectorReclaimLock(lockPath: string): Promise<Awaited<ReturnType<typeof fs.open>> | null> {\n  const reclaimPath = connectorReclaimLockPath(lockPath);\n  try {\n    return await fs.open(reclaimPath, \"wx\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n  }\n\n  let reclaimStat: import(\"node:fs\").Stats;\n  try {\n    reclaimStat = await fs.lstat(reclaimPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  if (reclaimStat.isSymbolicLink()) {\n    throw new Error(`connector state path component ${reclaimPath} is a symlink; refusing to follow`);\n  }\n  if (Date.now() - reclaimStat.mtimeMs <= CONNECTOR_LOCK_STALE_MS) return null;\n  await fs.unlink(reclaimPath);\n\n  try {\n    return await fs.open(reclaimPath, \"wx\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") return null;\n    throw err;\n  }\n}\n\nasync function refreshConnectorLock(lease: ConnectorLockLease): Promise<boolean> {\n  const reclaimHandle = await openConnectorReclaimLock(lease.path);\n  if (!reclaimHandle) return false;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    return await refreshConnectorLockWhileReclaimHeld(lease);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lease.path)).catch(() => undefined);\n  }\n}\n\nasync function refreshConnectorLockWhileReclaimHeld(lease: ConnectorLockLease): Promise<boolean> {\n  let handle: Awaited<ReturnType<typeof fs.open>>;\n  try {\n    handle = await fs.open(lease.path, \"r+\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n  try {\n    const openedStat = await handle.stat();\n    const metadata = parseConnectorLockMetadata(await handle.readFile(\"utf8\"));\n    if (metadata?.token !== lease.token) return false;\n    const body = `${JSON.stringify(connectorLockMetadata(lease.token, metadata.createdAt))}\\n`;\n    await handle.truncate(0);\n    await handle.write(body, 0, \"utf8\");\n    let pathStat: import(\"node:fs\").Stats;\n    try {\n      pathStat = await fs.lstat(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw err;\n    }\n    if (pathStat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lease.path} is a symlink; refusing to follow`);\n    }\n    return isSameFileIdentity(openedStat, pathStat);\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function releaseConnectorLock(lease: ConnectorLockLease): Promise<void> {\n  const reclaimHandle = await openConnectorReclaimLock(lease.path);\n  if (!reclaimHandle) return;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    await releaseConnectorLockWhileReclaimHeld(lease);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lease.path)).catch(() => undefined);\n  }\n}\n\nasync function releaseConnectorLockWhileReclaimHeld(lease: ConnectorLockLease): Promise<void> {\n  let handle: Awaited<ReturnType<typeof fs.open>>;\n  try {\n    handle = await fs.open(lease.path, \"r\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  }\n  try {\n    const openedStat = await handle.stat();\n    const metadata = parseConnectorLockMetadata(await handle.readFile(\"utf8\"));\n    if (metadata?.token !== lease.token) return;\n    let pathStat: import(\"node:fs\").Stats;\n    try {\n      pathStat = await fs.lstat(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n      throw err;\n    }\n    if (pathStat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lease.path} is a symlink; refusing to follow`);\n    }\n    if (!isSameFileIdentity(openedStat, pathStat)) return;\n    try {\n      await fs.unlink(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n        throw err;\n      }\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function withConnectorStateLockInternal<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>,\n  options: ConnectorStateLockOptions = {}\n): Promise<T> {\n  const deadline = Date.now() + CONNECTOR_LOCK_TIMEOUT_MS;\n  let lease: ConnectorLockLease | null = null;\n  while (lease === null) {\n    lease = await tryAcquireConnectorLock(memoryDir, id);\n    if (lease !== null) break;\n    if (Date.now() >= deadline) {\n      throw new Error(`timed out waiting for connector \"${id}\" state lock`);\n    }\n    await delay(CONNECTOR_LOCK_RETRY_MS);\n  }\n  const abortController = new AbortController();\n  let rejectLockLost!: (err: Error) => void;\n  let lockLost = false;\n  const lockLostPromise = new Promise<never>((_resolve, reject) => {\n    rejectLockLost = reject;\n  });\n  const failLostLock = (message: string): void => {\n    if (lockLost) return;\n    lockLost = true;\n    const err = new ConnectorStateLockLostError(message);\n    abortController.abort(err);\n    rejectLockLost(err);\n  };\n  const heartbeat = setInterval(() => {\n    void refreshConnectorLock(lease)\n      .then((refreshed) => {\n        if (!refreshed) {\n          failLostLock(`lost connector \"${id}\" state lock`);\n        }\n      })\n      .catch((err) => {\n        const message = err instanceof Error ? err.message : String(err);\n        failLostLock(`lost connector \"${id}\" state lock: ${message}`);\n      });\n  }, options.heartbeatMs ?? CONNECTOR_LOCK_HEARTBEAT_MS);\n  if (options.unrefHeartbeat !== false) {\n    heartbeat.unref?.();\n  }\n  const runPromise = run(abortController.signal);\n  try {\n    return await Promise.race([runPromise, lockLostPromise]);\n  } catch (err) {\n    if (err instanceof ConnectorStateLockLostError) {\n      await runPromise.catch(() => undefined);\n    }\n    throw err;\n  } finally {\n    clearInterval(heartbeat);\n    await releaseConnectorLock(lease);\n  }\n}\n\nexport async function withConnectorStateLock<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>\n): Promise<T> {\n  return withConnectorStateLockInternal(memoryDir, id, run);\n}\n\nexport async function _withConnectorStateLockForTest<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>,\n  options: ConnectorStateLockOptions\n): Promise<T> {\n  return withConnectorStateLockInternal(memoryDir, id, run, options);\n}\n\n/**\n * Read the persisted state for a single connector.\n *\n * Returns `null` if the file does not exist (ENOENT). Throws on any other\n * I/O error or on shape mismatch — operators should see corruption loudly.\n *\n * Rejects symlinks anywhere on the path so a planted symlink can't redirect\n * reads outside the memory root. (PR #724 review.)\n */\nexport async function readConnectorState(memoryDir: string, id: string): Promise<ConnectorState | null> {\n  const filePath = resolveConnectorStatePath(memoryDir, id);\n  await assertNoSymlinkOnPath(memoryDir, filePath);\n  let raw: string;\n  try {\n    raw = await fs.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} is not valid JSON: ${(err as Error).message}`\n    );\n  }\n  if (!isConnectorStateShape(parsed)) {\n    throw new ConnectorStateCorruptionError(`connector state at ${filePath} does not match ConnectorState shape`);\n  }\n  if (parsed.id !== id) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} has mismatched id ${JSON.stringify(parsed.id)}; expected ${JSON.stringify(id)}`\n    );\n  }\n  return parsed;\n}\n\n/**\n * Write state atomically: create-tmp + rename. Never destroys the previous\n * file before the new one is in place — see CLAUDE.md gotcha #54.\n *\n * We accept `Omit<ConnectorState, \"updatedAt\">` and stamp `updatedAt`\n * ourselves so callers can't accidentally persist a stale timestamp.\n */\nexport async function writeConnectorState(\n  memoryDir: string,\n  id: string,\n  state: Omit<ConnectorState, \"updatedAt\">\n): Promise<ConnectorState> {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  if (state.id !== id) {\n    throw new Error(\n      `writeConnectorState(): state.id ${JSON.stringify(state.id)} does not match id argument ${JSON.stringify(id)}`\n    );\n  }\n  // Full boundary validation. Persisting an out-of-shape record would brick\n  // the connector's cursor file: subsequent `readConnectorState` calls would\n  // throw `ConnectorStateCorruptionError` until manual repair. JS callers\n  // bypassing TS types must be rejected here, not later. (PR #724 review.)\n  if (!VALID_SYNC_STATUSES.has(state.lastSyncStatus as ConnectorSyncStatus)) {\n    throw new Error(\n      `writeConnectorState(): lastSyncStatus must be one of ${[...VALID_SYNC_STATUSES].join(\", \")}, got ${JSON.stringify(state.lastSyncStatus)}`\n    );\n  }\n  if (state.lastSyncAt !== null && typeof state.lastSyncAt !== \"string\") {\n    throw new Error(`writeConnectorState(): lastSyncAt must be a string or null, got ${typeof state.lastSyncAt}`);\n  }\n  if (state.cursor !== null) {\n    if (typeof state.cursor !== \"object\") {\n      throw new Error(`writeConnectorState(): cursor must be an object or null`);\n    }\n    if (\n      typeof state.cursor.kind !== \"string\" ||\n      typeof state.cursor.value !== \"string\" ||\n      typeof state.cursor.updatedAt !== \"string\"\n    ) {\n      throw new Error(`writeConnectorState(): cursor must have string kind, value, and updatedAt`);\n    }\n  }\n  if (\n    typeof state.totalDocsImported !== \"number\" ||\n    !Number.isInteger(state.totalDocsImported) ||\n    state.totalDocsImported < 0\n  ) {\n    throw new Error(`writeConnectorState(): totalDocsImported must be a non-negative integer`);\n  }\n  if (state.lastSyncError !== undefined && typeof state.lastSyncError !== \"string\") {\n    throw new Error(`writeConnectorState(): lastSyncError must be a string when provided`);\n  }\n  const truncatedError =\n    state.lastSyncError !== undefined && state.lastSyncError.length > MAX_ERROR_LENGTH\n      ? state.lastSyncError.slice(0, MAX_ERROR_LENGTH)\n      : state.lastSyncError;\n\n  const finalState: ConnectorState = {\n    id: state.id,\n    cursor: state.cursor,\n    lastSyncAt: state.lastSyncAt,\n    lastSyncStatus: state.lastSyncStatus,\n    ...(truncatedError !== undefined ? { lastSyncError: truncatedError } : {}),\n    totalDocsImported: state.totalDocsImported,\n    updatedAt: new Date().toISOString(),\n  };\n\n  const dir = resolveConnectorsDir(memoryDir);\n  const targetPath = path.join(dir, `${id}.json`);\n  // Reject planted symlinks before mkdir/write so a redirected target can't\n  // overwrite an arbitrary file outside the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const tmpPath = `${targetPath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n\n  const body = `${JSON.stringify(finalState, null, 2)}\\n`;\n  try {\n    await fs.writeFile(tmpPath, body, { encoding: \"utf-8\", mode: 0o600 });\n    await fs.rename(tmpPath, targetPath);\n  } catch (err) {\n    // Best-effort cleanup of the tmp file. Never touch `targetPath` — the\n    // previous good state must remain readable on failure.\n    try {\n      await fs.unlink(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n  return finalState;\n}\n\n/**\n * Enumerate every persisted connector state. Returns an empty array when\n * the directory does not exist yet (clean install, no syncs ever run).\n *\n * Files that do not match the `<id>.json` naming rule are skipped — this\n * keeps stray editor backups (`.json~`, `.swp`) from breaking enumeration.\n *\n * Corruption (unparseable JSON, shape mismatch, id mismatch) is also\n * skipped so one bad file doesn't take down the listing. Operators\n * inspecting `state/connectors/` can still see the offending file by hand.\n *\n * **Genuine I/O failures (`EACCES`, `EIO`, etc.) are NOT swallowed** —\n * silently returning an incomplete state set would make active connectors\n * appear missing and trigger duplicate ingestion on the next scheduler tick.\n * (PR #724 review.)\n */\nexport async function listConnectorStates(memoryDir: string): Promise<ConnectorState[]> {\n  const dir = resolveConnectorsDir(memoryDir);\n  // Refuse to enumerate through a symlinked state directory — a planted\n  // symlink at <memoryDir>/state or <memoryDir>/state/connectors would\n  // otherwise let reads escape the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, dir);\n  let entries: string[];\n  try {\n    entries = await fs.readdir(dir);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw err;\n  }\n  const out: ConnectorState[] = [];\n  for (const entry of entries) {\n    if (!entry.endsWith(\".json\")) continue;\n    const id = entry.slice(0, -\".json\".length);\n    if (!isValidConnectorId(id)) continue;\n    try {\n      const state = await readConnectorState(memoryDir, id);\n      if (state !== null) out.push(state);\n    } catch (err) {\n      if (err instanceof ConnectorStateCorruptionError) {\n        // Skip corrupt files; preserve availability of the rest.\n        continue;\n      }\n      // Anything else (EACCES, EIO, ENOTDIR, ...) is a real operational\n      // failure. Fail loudly so the scheduler / CLI can surface it.\n      throw err;\n    }\n  }\n  out.sort((a, b) => a.id.localeCompare(b.id));\n  return out;\n}\n\n/**\n * Test-only helper: resolve where a given connector's state lives. Exported\n * so tests can assert the on-disk layout without duplicating the path math.\n * Not part of the stable public API.\n *\n * @internal\n */\nexport function _connectorStatePathForTest(memoryDir: string, id: string): string {\n  return resolveConnectorStatePath(memoryDir, id);\n}\n\nexport const _unlinkStaleConnectorLockForTest = unlinkStaleConnectorLock;\nexport const _tryAcquireConnectorLockForTest = tryAcquireConnectorLock;\nexport const _refreshConnectorLockForTest = refreshConnectorLock;\nexport const _releaseConnectorLockForTest = releaseConnectorLock;\n","/**\n * @remnic/core — Live Connectors Framework (issue #683 PR 1/N)\n *\n * Defines the contract that every \"live\" connector (Drive, Notion, Gmail,\n * GitHub, ...) must satisfy. A live connector is **continuous**: it runs on a\n * schedule, persists a cursor to disk, and ingests *new* documents since the\n * last sync. This is distinct from one-shot importers in\n * `packages/remnic-core/src/importers/` which transform an entire export file\n * in a single pass.\n *\n * This module is intentionally pure types + interfaces. No I/O. No schedule\n * wiring. Concrete connectors (PRs 2–5), the maintenance scheduler hookup\n * (separate PR), and the CLI surface (PR 6) are deferred.\n *\n * Naming caveat: `packages/remnic-core/src/connectors/` is already scoped to\n * the Codex marketplace integration. The live-connector framework lives under\n * the `live/` subdirectory to avoid collision. Do not import Codex symbols\n * from here, and do not import live-connector symbols from the Codex code.\n */\n\n/**\n * Free-form connector configuration. Validated by each connector's\n * `validateConfig` implementation and passed to `syncIncremental` for runtime\n * use. MUST be JSON-serializable: no functions, no class instances, no\n * circular references.\n *\n * Runtime configs may contain hydrated credentials. Do not persist a runtime\n * config directly. Any code that needs to store connector settings must call\n * `persistableConnectorConfig()` so credentials are stripped or replaced by\n * connector-owned references.\n */\nexport type ConnectorConfig = Record<string, unknown>;\n\nconst DEFAULT_SECRET_KEY_PARTS = [\n  \"token\",\n  \"secret\",\n  \"password\",\n  \"credential\",\n  \"apikey\",\n  \"accesskey\",\n  \"privatekey\",\n  \"authorization\",\n  \"authheader\",\n  \"cookie\",\n] as const;\n\n/**\n * Redact secret-looking keys from a JSON-serializable connector config.\n * Built-in connectors provide explicit projections, but this default keeps\n * third-party connectors from accidentally persisting obvious credentials.\n */\nexport function redactConnectorConfigSecrets(config: ConnectorConfig): ConnectorConfig {\n  return redactConnectorConfigValue(config) as ConnectorConfig;\n}\n\nfunction redactConnectorConfigValue(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => redactConnectorConfigValue(item));\n  }\n  if (typeof value !== \"object\" || value === null) {\n    return value;\n  }\n  const out: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {\n    if (isConnectorSecretConfigKey(key)) {\n      continue;\n    }\n    out[key] = redactConnectorConfigValue(nested);\n  }\n  return out;\n}\n\nfunction isConnectorSecretConfigKey(key: string): boolean {\n  const normalized = key.replace(/[^a-z0-9]/giu, \"\").toLowerCase();\n  return DEFAULT_SECRET_KEY_PARTS.some((part) => normalized.includes(part));\n}\n\n/**\n * Opaque cursor describing \"where the last sync left off\". Each connector\n * defines what `kind` and `value` mean (e.g. Drive: `{kind: \"pageToken\",\n * value: \"...\"}`, Gmail: `{kind: \"historyId\", value: \"...\"}`). The orchestrator\n * treats it as opaque and only round-trips it through the state store.\n *\n * `updatedAt` is an ISO 8601 timestamp set by the framework when the cursor is\n * written. It is informational — connectors MUST NOT use it to decide\n * monotonicity. They own the `value` semantics.\n */\nexport interface ConnectorCursor {\n  /** Connector-defined cursor kind (e.g. `\"pageToken\"`, `\"historyId\"`, `\"sinceTs\"`). */\n  readonly kind: string;\n  /** Connector-defined opaque cursor value. */\n  readonly value: string;\n  /** ISO 8601 timestamp of when this cursor was last written. */\n  readonly updatedAt: string;\n}\n\n/**\n * Provenance for a connector-ingested document. Required so downstream recall\n * can attribute facts back to their origin and avoid re-ingesting on the next\n * incremental pass.\n */\nexport interface ConnectorDocumentSource {\n  /** Stable connector id (matches `LiveConnector.id`). */\n  readonly connector: string;\n  /** Source-system identifier (Drive file id, Notion page id, Gmail msg id, ...). */\n  readonly externalId: string;\n  /** Optional source-system revision/version (etag, page version, history id). */\n  readonly externalRevision?: string;\n  /** Optional canonical URL pointing back at the source document. */\n  readonly externalUrl?: string;\n  /** ISO 8601 timestamp of when the connector fetched this document. */\n  readonly fetchedAt: string;\n}\n\n/**\n * A single document yielded by an incremental sync. Connectors are responsible\n * for chunking large source documents themselves if needed; the orchestrator\n * ingests `content` as a unit.\n */\nexport interface ConnectorDocument {\n  /** Connector-local stable id for this document. SHOULD match `source.externalId`. */\n  readonly id: string;\n  /** Optional human-readable title. */\n  readonly title?: string;\n  /** Body content. Plaintext or Markdown — connectors document their format. */\n  readonly content: string;\n  /** Provenance. Required. */\n  readonly source: ConnectorDocumentSource;\n}\n\n/**\n * Arguments passed to `syncIncremental`. The framework owns cursor/config\n * lifecycle; connectors only read these and return the next cursor.\n */\nexport interface SyncIncrementalArgs {\n  /** Last persisted cursor, or `null` on the first ever sync. */\n  readonly cursor: ConnectorCursor | null;\n  /** Validated connector config (already passed through `validateConfig`). */\n  readonly config: ConnectorConfig;\n  /** Optional abort signal. Connectors SHOULD honor it for cooperative cancellation. */\n  readonly abortSignal?: AbortSignal;\n}\n\n/**\n * Result of a single incremental sync pass.\n *\n * `newDocs` MAY be empty (no new documents since the last cursor). `nextCursor`\n * MUST always be returned — even on no-op syncs the framework persists it so\n * `updatedAt` reflects the most recent attempt.\n */\nexport interface SyncIncrementalResult {\n  readonly newDocs: ConnectorDocument[];\n  readonly nextCursor: ConnectorCursor;\n}\n\n/**\n * The contract every live connector implements.\n *\n * Connectors MUST be:\n *   - **Idempotent**: re-running with the same cursor MUST NOT duplicate\n *     documents. The `source.externalId` + `source.externalRevision` pair is\n *     used downstream for dedup.\n *   - **Read-only on the source**: live connectors never mutate the upstream\n *     system (no marking emails read, no editing Notion pages).\n *   - **Cancellable**: long-running syncs SHOULD periodically check\n *     `abortSignal.aborted` and bail cleanly.\n *   - **Privacy-aware**: connectors MUST NOT log document content. Logging\n *     metadata (counts, ids, timings) is fine.\n */\nexport interface LiveConnector {\n  /**\n   * Stable connector id. MUST match `CONNECTOR_ID_PATTERN` — lowercase\n   * alphanumeric plus dash, 1–64 chars, must start AND end with alphanumeric\n   * (no leading or trailing dash). The registry enforces this.\n   */\n  readonly id: string;\n  /** Short human-readable name shown in CLI / status output. */\n  readonly displayName: string;\n  /** Optional longer description. */\n  readonly description?: string;\n\n  /**\n   * Validate raw user-supplied config. MUST throw on malformed input — never\n   * silently default. The returned object is the runtime config passed back to\n   * `syncIncremental`; it may contain hydrated credentials and MUST NOT be\n   * persisted directly. Connectors SHOULD strip unknown fields.\n   */\n  validateConfig(raw: unknown): ConnectorConfig;\n\n  /**\n   * Return the subset of validated config that may be written to disk. Use this\n   * for state/config persistence instead of `validateConfig()`. Connectors that\n   * need credentials should omit the raw values here and store only non-secret\n   * scope/schedule fields plus any connector-owned secret references.\n   */\n  persistConfig?(validated: ConnectorConfig): ConnectorConfig;\n\n  /**\n   * Run one incremental sync pass. See `SyncIncrementalArgs` /\n   * `SyncIncrementalResult` for the contract.\n   */\n  syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult>;\n}\n\nexport function persistableConnectorConfig(\n  connector: Pick<LiveConnector, \"persistConfig\">,\n  validated: ConnectorConfig,\n): ConnectorConfig {\n  if (typeof connector.persistConfig === \"function\") {\n    return connector.persistConfig(validated);\n  }\n  return redactConnectorConfigSecrets(validated);\n}\n\n/**\n * Regex enforcing the connector-id naming rule. Exported so connectors and\n * tests can validate ids consistently with the registry.\n *\n * Rule: lowercase alphanumeric + dash, 1..64 chars, must start AND end with\n * alphanumeric (no leading or trailing dash). Single-char ids are allowed.\n */\nexport const CONNECTOR_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;\n\n/**\n * Returns `true` if `id` is a syntactically valid connector id.\n */\nexport function isValidConnectorId(id: unknown): id is string {\n  return typeof id === \"string\" && CONNECTOR_ID_PATTERN.test(id);\n}\n"],"mappings":";;;;;AAuBA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,cAAc,aAAa;;;ACOpC,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,SAAS,6BAA6B,QAA0C;AACrF,SAAO,2BAA2B,MAAM;AAC1C;AAEA,SAAS,2BAA2B,OAAyB;AAC3D,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,2BAA2B,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC5E,QAAI,2BAA2B,GAAG,GAAG;AACnC;AAAA,IACF;AACA,QAAI,GAAG,IAAI,2BAA2B,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,KAAsB;AACxD,QAAM,aAAa,IAAI,QAAQ,gBAAgB,EAAE,EAAE,YAAY;AAC/D,SAAO,yBAAyB,KAAK,CAAC,SAAS,WAAW,SAAS,IAAI,CAAC;AAC1E;AAiIO,SAAS,2BACd,WACA,WACiB;AACjB,MAAI,OAAO,UAAU,kBAAkB,YAAY;AACjD,WAAO,UAAU,cAAc,SAAS;AAAA,EAC1C;AACA,SAAO,6BAA6B,SAAS;AAC/C;AASO,IAAM,uBAAuB;AAK7B,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,OAAO,OAAO,YAAY,qBAAqB,KAAK,EAAE;AAC/D;;;ADnKA,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,mBAAmB;AACzB,IAAM,0BAA0B,KAAK,KAAK;AAC1C,IAAM,8BAA8B,KAAK,IAAI,KAAO,KAAK,MAAM,0BAA0B,CAAC,CAAC;AAC3F,IAAM,4BAA4B,KAAK;AACvC,IAAM,0BAA0B;AAChC,IAAM,sBAAwD,oBAAI,IAAI,CAAC,WAAW,SAAS,OAAO,CAAC;AAQnG,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAsBA,SAAS,qBAAqB,WAA2B;AACvD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO,KAAK,KAAK,gBAAgB,SAAS,GAAG,gBAAgB,mBAAmB;AAClF;AAEA,SAAS,yBAAyB,WAA2B;AAC3D,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO,KAAK,KAAK,gBAAgB,SAAS,GAAG,gBAAgB,wBAAwB;AACvF;AAMA,SAAS,0BAA0B,WAAmB,IAAoB;AACxE,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK,KAAK,qBAAqB,SAAS,GAAG,GAAG,EAAE,OAAO;AAChE;AAEA,SAAS,yBAAyB,WAAmB,IAAoB;AACvE,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK,KAAK,yBAAyB,SAAS,GAAG,GAAG,EAAE,OAAO;AACpE;AASA,SAAS,sBAAsB,OAAyC;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,OAAO,SAAU,QAAO;AACrC,MAAI,OAAO,EAAE,mBAAmB,SAAU,QAAO;AACjD,MAAI,CAAC,CAAC,WAAW,SAAS,OAAO,EAAE,SAAS,EAAE,cAAc,EAAG,QAAO;AAGtE,MAAI,OAAO,EAAE,sBAAsB,YAAY,CAAC,OAAO,UAAU,EAAE,iBAAiB,EAAG,QAAO;AAC9F,MAAI,EAAE,oBAAoB,EAAG,QAAO;AACpC,MAAI,OAAO,EAAE,cAAc,SAAU,QAAO;AAC5C,MAAI,EAAE,eAAe,QAAQ,OAAO,EAAE,eAAe,SAAU,QAAO;AACtE,MAAI,EAAE,WAAW,MAAM;AACrB,QAAI,OAAO,EAAE,WAAW,YAAY,EAAE,WAAW,KAAM,QAAO;AAC9D,UAAM,IAAI,EAAE;AACZ,QAAI,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,cAAc,UAAU;AAChG,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,EAAE,kBAAkB,UAAa,OAAO,EAAE,kBAAkB,SAAU,QAAO;AACjF,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAgD;AAC/E,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,QAAQ,YACjB,OAAO,UAAU,EAAE,GAAG,KACtB,EAAE,MAAM,KACR,OAAO,EAAE,UAAU,YACnB,EAAE,MAAM,SAAS,KACjB,OAAO,EAAE,cAAc,YACvB,OAAO,EAAE,gBAAgB;AAE7B;AAEA,SAAS,sBAAsB,OAAe,aAAY,oBAAI,KAAK,GAAE,YAAY,GAA0B;AACzG,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;AAEA,eAAe,0BAA0B,UAAyD;AAChG,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,UAAU,MAAM;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,wBAAwB,MAAM,IAAI,SAAS;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAA2B,KAA2C;AAC7E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,wBAAwB,MAAM,IAAI,SAAS;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAA+B,OAAyC;AAClG,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,QAAQ,MAAM;AACtD;AAeA,eAAe,sBAAsB,WAAmB,UAAiC;AACvF,QAAM,eAAe,gBAAgB,SAAS;AAE9C,QAAM,OAAO,KAAK,QAAQ,YAAY;AACtC,QAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,QAAM,MAAM,KAAK,SAAS,MAAM,MAAM;AAEtC,MAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG;AAChD,UAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB,IAAI,EAAE;AAAA,EAC9E;AAEA,QAAM,WAAW,IAAI,WAAW,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,MAAI,UAAU;AACd,QAAM,oBAAoB,CAAC,OAAO;AAClC,aAAW,OAAO,UAAU;AAC1B,cAAU,KAAK,KAAK,SAAS,GAAG;AAChC,sBAAkB,KAAK,OAAO;AAAA,EAChC;AACA,aAAW,aAAa,mBAAmB;AACzC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,MAAM,SAAS;AAAA,IACjC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AAEpD;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI,MAAM,kCAAkC,SAAS,mCAAmC;AAAA,IAChG;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,WAAmB,IAAgD;AACxG,QAAM,MAAM,yBAAyB,SAAS;AAC9C,QAAM,WAAW,yBAAyB,WAAW,EAAE;AACvD,QAAM,sBAAsB,WAAW,QAAQ;AAC/C,QAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,MAAI,SAAqD;AACzD,MAAI,mBAAmB;AACvB,QAAM,QAAQ,WAAW;AACzB,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,UAAU,MAAM,GAAK;AAC5C,uBAAmB;AACnB,UAAM,OAAO,UAAU,GAAG,KAAK,UAAU,sBAAsB,KAAK,CAAC,CAAC;AAAA,GAAM,MAAM;AAClF,UAAM,OAAO,MAAM;AACnB,aAAS;AACT,WAAO,EAAE,MAAM,UAAU,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,kBAAkB;AACpB,UAAI,WAAW,MAAM;AACnB,YAAI;AACF,gBAAM,OAAO,MAAM;AAAA,QACrB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI;AACF,cAAM,GAAG,OAAO,QAAQ;AAAA,MAC1B,SAAS,YAAY;AACnB,YAAK,WAAqC,SAAS,UAAU;AAC3D,gBAAM,IAAI;AAAA,YACR,CAAC,KAAK,UAAU;AAAA,YAChB,gDAAgD,QAAQ;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM;AAAA,IACR;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,MAAM,QAAQ;AAAA,IAChC,SAAS,SAAS;AAChB,UAAK,QAAkC,SAAS,UAAU;AACxD,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI,MAAM,kCAAkC,QAAQ,mCAAmC;AAAA,IAC/F;AACA,QAAI,KAAK,IAAI,IAAI,KAAK,UAAU,yBAAyB;AACvD,YAAM,yBAAyB,QAAQ;AACvC,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAe,+BAA+B,UAAkB,MAAiD;AAC/G,MAAI,KAAK,IAAI,IAAI,KAAK,WAAW,wBAAyB,QAAO;AACjE,QAAM,WAAW,MAAM,0BAA0B,QAAQ;AACzD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,gBAAgB,KAAK,MAAM,SAAS,WAAW;AACrD,MAAI,CAAC,OAAO,SAAS,aAAa,EAAG,QAAO;AAC5C,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAEA,eAAe,yBAAyB,UAAiC;AACvE,QAAM,gBAAgB,MAAM,yBAAyB,QAAQ;AAC7D,MAAI,CAAC,cAAe;AACpB,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,UAAM,yCAAyC,QAAQ;AAAA,EACzD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,QAAQ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC3E;AACF;AAEA,eAAe,yCAAyC,UAAiC;AACvF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,MAAM,QAAQ;AAAA,EAChC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR;AACA,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,kCAAkC,QAAQ,mCAAmC;AAAA,EAC/F;AACA,MAAI,CAAE,MAAM,+BAA+B,UAAU,IAAI,EAAI;AAC7D,MAAI;AACF,UAAM,GAAG,OAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAA0B;AAC1D,SAAO,GAAG,QAAQ;AACpB;AAEA,eAAe,yBAAyB,UAAuE;AAC7G,QAAM,cAAc,yBAAyB,QAAQ;AACrD,MAAI;AACF,WAAO,MAAM,GAAG,KAAK,aAAa,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,EAC9D;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,GAAG,MAAM,WAAW;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI,YAAY,eAAe,GAAG;AAChC,UAAM,IAAI,MAAM,kCAAkC,WAAW,mCAAmC;AAAA,EAClG;AACA,MAAI,KAAK,IAAI,IAAI,YAAY,WAAW,wBAAyB,QAAO;AACxE,QAAM,GAAG,OAAO,WAAW;AAE3B,MAAI;AACF,WAAO,MAAM,GAAG,KAAK,aAAa,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qBAAqB,OAA6C;AAC/E,QAAM,gBAAgB,MAAM,yBAAyB,MAAM,IAAI;AAC/D,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,WAAO,MAAM,qCAAqC,KAAK;AAAA,EACzD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,MAAM,IAAI,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7E;AACF;AAEA,eAAe,qCAAqC,OAA6C;AAC/F,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,MAAM,MAAM,IAAI;AAAA,EACzC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,UAAM,WAAW,2BAA2B,MAAM,OAAO,SAAS,MAAM,CAAC;AACzE,QAAI,UAAU,UAAU,MAAM,MAAO,QAAO;AAC5C,UAAM,OAAO,GAAG,KAAK,UAAU,sBAAsB,MAAM,OAAO,SAAS,SAAS,CAAC,CAAC;AAAA;AACtF,UAAM,OAAO,SAAS,CAAC;AACvB,UAAM,OAAO,MAAM,MAAM,GAAG,MAAM;AAClC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,GAAG,MAAM,MAAM,IAAI;AAAA,IACtC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,YAAM;AAAA,IACR;AACA,QAAI,SAAS,eAAe,GAAG;AAC7B,YAAM,IAAI,MAAM,kCAAkC,MAAM,IAAI,mCAAmC;AAAA,IACjG;AACA,WAAO,mBAAmB,YAAY,QAAQ;AAAA,EAChD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,qBAAqB,OAA0C;AAC5E,QAAM,gBAAgB,MAAM,yBAAyB,MAAM,IAAI;AAC/D,MAAI,CAAC,cAAe;AACpB,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,UAAM,qCAAqC,KAAK;AAAA,EAClD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,MAAM,IAAI,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7E;AACF;AAEA,eAAe,qCAAqC,OAA0C;AAC5F,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,MAAM,MAAM,GAAG;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,UAAM,WAAW,2BAA2B,MAAM,OAAO,SAAS,MAAM,CAAC;AACzE,QAAI,UAAU,UAAU,MAAM,MAAO;AACrC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,GAAG,MAAM,MAAM,IAAI;AAAA,IACtC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU;AACtD,YAAM;AAAA,IACR;AACA,QAAI,SAAS,eAAe,GAAG;AAC7B,YAAM,IAAI,MAAM,kCAAkC,MAAM,IAAI,mCAAmC;AAAA,IACjG;AACA,QAAI,CAAC,mBAAmB,YAAY,QAAQ,EAAG;AAC/C,QAAI;AACF,YAAM,GAAG,OAAO,MAAM,IAAI;AAAA,IAC5B,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AACpD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,+BACb,WACA,IACA,KACA,UAAqC,CAAC,GAC1B;AACZ,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,QAAmC;AACvC,SAAO,UAAU,MAAM;AACrB,YAAQ,MAAM,wBAAwB,WAAW,EAAE;AACnD,QAAI,UAAU,KAAM;AACpB,QAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,YAAM,IAAI,MAAM,oCAAoC,EAAE,cAAc;AAAA,IACtE;AACA,UAAM,MAAM,uBAAuB;AAAA,EACrC;AACA,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI;AACJ,MAAI,WAAW;AACf,QAAM,kBAAkB,IAAI,QAAe,CAAC,UAAU,WAAW;AAC/D,qBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,eAAe,CAAC,YAA0B;AAC9C,QAAI,SAAU;AACd,eAAW;AACX,UAAM,MAAM,IAAI,4BAA4B,OAAO;AACnD,oBAAgB,MAAM,GAAG;AACzB,mBAAe,GAAG;AAAA,EACpB;AACA,QAAM,YAAY,YAAY,MAAM;AAClC,SAAK,qBAAqB,KAAK,EAC5B,KAAK,CAAC,cAAc;AACnB,UAAI,CAAC,WAAW;AACd,qBAAa,mBAAmB,EAAE,cAAc;AAAA,MAClD;AAAA,IACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,mBAAa,mBAAmB,EAAE,iBAAiB,OAAO,EAAE;AAAA,IAC9D,CAAC;AAAA,EACL,GAAG,QAAQ,eAAe,2BAA2B;AACrD,MAAI,QAAQ,mBAAmB,OAAO;AACpC,cAAU,QAAQ;AAAA,EACpB;AACA,QAAM,aAAa,IAAI,gBAAgB,MAAM;AAC7C,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,YAAY,eAAe,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,YAAM,WAAW,MAAM,MAAM,MAAS;AAAA,IACxC;AACA,UAAM;AAAA,EACR,UAAE;AACA,kBAAc,SAAS;AACvB,UAAM,qBAAqB,KAAK;AAAA,EAClC;AACF;AAEA,eAAsB,uBACpB,WACA,IACA,KACY;AACZ,SAAO,+BAA+B,WAAW,IAAI,GAAG;AAC1D;AAEA,eAAsB,+BACpB,WACA,IACA,KACA,SACY;AACZ,SAAO,+BAA+B,WAAW,IAAI,KAAK,OAAO;AACnE;AAWA,eAAsB,mBAAmB,WAAmB,IAA4C;AACtG,QAAM,WAAW,0BAA0B,WAAW,EAAE;AACxD,QAAM,sBAAsB,WAAW,QAAQ;AAC/C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,UAAU,OAAO;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,uBAAwB,IAAc,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,MAAM,GAAG;AAClC,UAAM,IAAI,8BAA8B,sBAAsB,QAAQ,sCAAsC;AAAA,EAC9G;AACA,MAAI,OAAO,OAAO,IAAI;AACpB,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,sBAAsB,KAAK,UAAU,OAAO,EAAE,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;AAAA,IAC/G;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,oBACpB,WACA,IACA,OACyB;AACzB,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,MAAM,OAAO,IAAI;AACnB,UAAM,IAAI;AAAA,MACR,mCAAmC,KAAK,UAAU,MAAM,EAAE,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;AAAA,IAC9G;AAAA,EACF;AAKA,MAAI,CAAC,oBAAoB,IAAI,MAAM,cAAqC,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,wDAAwD,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC,SAAS,KAAK,UAAU,MAAM,cAAc,CAAC;AAAA,IAC1I;AAAA,EACF;AACA,MAAI,MAAM,eAAe,QAAQ,OAAO,MAAM,eAAe,UAAU;AACrE,UAAM,IAAI,MAAM,mEAAmE,OAAO,MAAM,UAAU,EAAE;AAAA,EAC9G;AACA,MAAI,MAAM,WAAW,MAAM;AACzB,QAAI,OAAO,MAAM,WAAW,UAAU;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QACE,OAAO,MAAM,OAAO,SAAS,YAC7B,OAAO,MAAM,OAAO,UAAU,YAC9B,OAAO,MAAM,OAAO,cAAc,UAClC;AACA,YAAM,IAAI,MAAM,2EAA2E;AAAA,IAC7F;AAAA,EACF;AACA,MACE,OAAO,MAAM,sBAAsB,YACnC,CAAC,OAAO,UAAU,MAAM,iBAAiB,KACzC,MAAM,oBAAoB,GAC1B;AACA,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,iBACJ,MAAM,kBAAkB,UAAa,MAAM,cAAc,SAAS,mBAC9D,MAAM,cAAc,MAAM,GAAG,gBAAgB,IAC7C,MAAM;AAEZ,QAAM,aAA6B;AAAA,IACjC,IAAI,MAAM;AAAA,IACV,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,gBAAgB,MAAM;AAAA,IACtB,GAAI,mBAAmB,SAAY,EAAE,eAAe,eAAe,IAAI,CAAC;AAAA,IACxE,mBAAmB,MAAM;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAM,aAAa,KAAK,KAAK,KAAK,GAAG,EAAE,OAAO;AAG9C,QAAM,sBAAsB,WAAW,UAAU;AACjD,QAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,GAAG,UAAU,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAExG,QAAM,OAAO,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AACnD,MAAI;AACF,UAAM,GAAG,UAAU,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AACpE,UAAM,GAAG,OAAO,SAAS,UAAU;AAAA,EACrC,SAAS,KAAK;AAGZ,QAAI;AACF,YAAM,GAAG,OAAO,OAAO;AAAA,IACzB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAkBA,eAAsB,oBAAoB,WAA8C;AACtF,QAAM,MAAM,qBAAqB,SAAS;AAI1C,QAAM,sBAAsB,WAAW,GAAG;AAC1C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,GAAG,QAAQ,GAAG;AAAA,EAChC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM;AAAA,EACR;AACA,QAAM,MAAwB,CAAC;AAC/B,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,SAAS,OAAO,EAAG;AAC9B,UAAM,KAAK,MAAM,MAAM,GAAG,CAAC,QAAQ,MAAM;AACzC,QAAI,CAAC,mBAAmB,EAAE,EAAG;AAC7B,QAAI;AACF,YAAM,QAAQ,MAAM,mBAAmB,WAAW,EAAE;AACpD,UAAI,UAAU,KAAM,KAAI,KAAK,KAAK;AAAA,IACpC,SAAS,KAAK;AACZ,UAAI,eAAe,+BAA+B;AAEhD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC3C,SAAO;AACT;AASO,SAAS,2BAA2B,WAAmB,IAAoB;AAChF,SAAO,0BAA0B,WAAW,EAAE;AAChD;AAEO,IAAM,mCAAmC;AACzC,IAAM,kCAAkC;AACxC,IAAM,+BAA+B;AACrC,IAAM,+BAA+B;","names":[]}
+{"version":3,"sources":["../src/connectors/live/state-store.ts","../src/connectors/live/framework.ts"],"sourcesContent":["/**\n * @remnic/core — Live Connectors State Store (issue #683 PR 1/N)\n *\n * Persists per-connector cursor + sync metadata to\n *   `<memoryDir>/state/connectors/<id>.json`\n *\n * Reasons this lives next to memory data, not in user config:\n *   - cursors are *operational* state that should travel with the memory\n *     directory when a user moves it across machines;\n *   - it keeps memory + ingest provenance co-located so tooling that backs up\n *     the memory directory captures cursor state too.\n *\n * Atomic-write contract (CLAUDE.md gotcha #54):\n *   - We NEVER `rmSync(target)` before `renameSync(tmp, target)`.\n *   - Writes go to a sibling tmp file and `rename()` swaps it in.\n *   - On error, the tmp file is best-effort cleaned up; the previous good\n *     state file is left untouched.\n *\n * Privacy: cursors are opaque connector-defined strings. We do not log them\n * and do not surface them through user-visible APIs. Document content NEVER\n * touches this module.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport path from \"node:path\";\nimport { setTimeout as delay } from \"node:timers/promises\";\n\nimport { expandTildePath } from \"../../utils/path.js\";\n\nimport { type ConnectorCursor, isValidConnectorId } from \"./framework.js\";\n\n/**\n * Status of the most recent sync attempt for a connector.\n *\n * `\"never\"` is distinct from `\"success\"` so callers can detect\n * \"registered but never run\" without inspecting timestamps. Per CLAUDE.md\n * gotcha #34, we deliberately distinguish empty/unknown from failure states.\n */\nexport type ConnectorSyncStatus = \"success\" | \"error\" | \"never\";\n\n/**\n * Persisted per-connector state.\n *\n * Stored as pretty-printed JSON for human inspection — the file is small\n * (one record per connector) and operators may need to debug stuck cursors\n * by hand.\n */\nexport interface ConnectorState {\n  /** Connector id. Matches the filename stem. */\n  readonly id: string;\n  /** Last persisted cursor, or `null` if the connector has never synced. */\n  readonly cursor: ConnectorCursor | null;\n  /** ISO 8601 timestamp of the last completed sync attempt, or `null`. */\n  readonly lastSyncAt: string | null;\n  /** Status of the last completed sync attempt. */\n  readonly lastSyncStatus: ConnectorSyncStatus;\n  /** Optional error message from the last failed sync. Truncated to 1 KB. */\n  readonly lastSyncError?: string;\n  /** Cumulative count of documents successfully imported across all syncs. */\n  readonly totalDocsImported: number;\n  /** ISO 8601 timestamp of when this state record was last written. */\n  readonly updatedAt: string;\n}\n\nconst STATE_DIR_NAME = \"state\";\nconst CONNECTORS_DIR_NAME = \"connectors\";\nconst CONNECTOR_LOCKS_DIR_NAME = \"connector-locks\";\nconst MAX_ERROR_LENGTH = 1024;\nconst CONNECTOR_LOCK_STALE_MS = 10 * 60 * 1000;\nconst CONNECTOR_LOCK_HEARTBEAT_MS = Math.max(1_000, Math.floor(CONNECTOR_LOCK_STALE_MS / 4));\nconst CONNECTOR_LOCK_TIMEOUT_MS = 60 * 1000;\nconst CONNECTOR_LOCK_RETRY_MS = 50;\nconst VALID_SYNC_STATUSES: ReadonlySet<ConnectorSyncStatus> = new Set([\"success\", \"error\", \"never\"]);\n\n/**\n * Internal error thrown when a state file's JSON is unparseable or its shape\n * doesn't match `ConnectorState`. Used by `listConnectorStates` to distinguish\n * \"skip this corrupt file\" cases from genuine I/O failures (`EACCES`, `EIO`)\n * that the caller must see.\n */\nclass ConnectorStateCorruptionError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConnectorStateCorruptionError\";\n  }\n}\n\nexport class ConnectorStateLockLostError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConnectorStateLockLostError\";\n  }\n}\n\ninterface ConnectorLockLease {\n  readonly path: string;\n  readonly token: string;\n}\n\ninterface ConnectorLockMetadata {\n  readonly pid: number;\n  readonly token: string;\n  readonly createdAt: string;\n  readonly refreshedAt: string;\n}\n\ninterface ConnectorStateLockOptions {\n  readonly heartbeatMs?: number;\n  readonly unrefHeartbeat?: boolean;\n}\n\n/**\n * Resolve `<memoryDir>/state/connectors/`, expanding `~` per CLAUDE.md #17.\n */\nfunction resolveConnectorsDir(memoryDir: string): string {\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new TypeError(\"memoryDir must be a non-empty string\");\n  }\n  return path.join(expandTildePath(memoryDir), STATE_DIR_NAME, CONNECTORS_DIR_NAME);\n}\n\nfunction resolveConnectorLocksDir(memoryDir: string): string {\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new TypeError(\"memoryDir must be a non-empty string\");\n  }\n  return path.join(expandTildePath(memoryDir), STATE_DIR_NAME, CONNECTOR_LOCKS_DIR_NAME);\n}\n\n/**\n * Resolve the state file path for a single connector. Throws on invalid id\n * to prevent path traversal via crafted ids.\n */\nfunction resolveConnectorStatePath(memoryDir: string, id: string): string {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  return path.join(resolveConnectorsDir(memoryDir), `${id}.json`);\n}\n\nfunction resolveConnectorLockPath(memoryDir: string, id: string): string {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  return path.join(resolveConnectorLocksDir(memoryDir), `${id}.lock`);\n}\n\n/**\n * Type guard for parsed state records. Validates the on-disk shape so a\n * corrupted/edited file produces a clear error rather than crashing later.\n *\n * Per CLAUDE.md gotcha #18, JSON.parse('null') yields `null` which would\n * pass a naive truthy check. We explicitly require an object.\n */\nfunction isConnectorStateShape(value: unknown): value is ConnectorState {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  if (typeof v.id !== \"string\") return false;\n  if (typeof v.lastSyncStatus !== \"string\") return false;\n  if (![\"success\", \"error\", \"never\"].includes(v.lastSyncStatus)) return false;\n  // totalDocsImported is a cumulative count — fractional values would corrupt\n  // metrics on later increments. Mirror the boundary check in writeConnectorState.\n  if (typeof v.totalDocsImported !== \"number\" || !Number.isInteger(v.totalDocsImported)) return false;\n  if (v.totalDocsImported < 0) return false;\n  if (typeof v.updatedAt !== \"string\") return false;\n  if (v.lastSyncAt !== null && typeof v.lastSyncAt !== \"string\") return false;\n  if (v.cursor !== null) {\n    if (typeof v.cursor !== \"object\" || v.cursor === null) return false;\n    const c = v.cursor as Record<string, unknown>;\n    if (typeof c.kind !== \"string\" || typeof c.value !== \"string\" || typeof c.updatedAt !== \"string\") {\n      return false;\n    }\n  }\n  if (v.lastSyncError !== undefined && typeof v.lastSyncError !== \"string\") return false;\n  return true;\n}\n\nfunction isConnectorLockMetadata(value: unknown): value is ConnectorLockMetadata {\n  if (typeof value !== \"object\" || value === null) return false;\n  const v = value as Record<string, unknown>;\n  return (\n    typeof v.pid === \"number\" &&\n    Number.isInteger(v.pid) &&\n    v.pid > 0 &&\n    typeof v.token === \"string\" &&\n    v.token.length > 0 &&\n    typeof v.createdAt === \"string\" &&\n    typeof v.refreshedAt === \"string\"\n  );\n}\n\nfunction connectorLockMetadata(token: string, createdAt = new Date().toISOString()): ConnectorLockMetadata {\n  return {\n    pid: process.pid,\n    token,\n    createdAt,\n    refreshedAt: new Date().toISOString(),\n  };\n}\n\nasync function readConnectorLockMetadata(lockPath: string): Promise<ConnectorLockMetadata | null> {\n  let raw: string;\n  try {\n    raw = await fs.readFile(lockPath, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    const parsed = JSON.parse(raw) as unknown;\n    return isConnectorLockMetadata(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction parseConnectorLockMetadata(raw: string): ConnectorLockMetadata | null {\n  try {\n    const parsed = JSON.parse(raw) as unknown;\n    return isConnectorLockMetadata(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isSameFileIdentity(left: import(\"node:fs\").Stats, right: import(\"node:fs\").Stats): boolean {\n  return left.dev === right.dev && left.ino === right.ino;\n}\n\n/**\n * Reject any path component along `<memoryDir>/state/connectors/<id>.json`\n * that is a symlink. Without this guard, a symlink in any of those\n * components would let `fs.readFile` escape the memory root and consume an\n * arbitrary outside file as cursor state — silently poisoning sync state and\n * violating the project-wide rule against symlink traversal.\n *\n * `lstat` is used (not `stat`) so we observe the link itself rather than its\n * target. Missing components are tolerated — the caller's `readFile` /\n * `mkdir` will surface ENOENT in its normal way.\n *\n * (PR #724 review.)\n */\nasync function assertNoSymlinkOnPath(memoryDir: string, filePath: string): Promise<void> {\n  const expandedRoot = expandTildePath(memoryDir);\n  // Normalize so `..` segments can't bypass the prefix check below.\n  const root = path.resolve(expandedRoot);\n  const target = path.resolve(filePath);\n  const rel = path.relative(root, target);\n  // path.relative() yields a \"../...\" prefix when target escapes root.\n  if (rel.startsWith(\"..\") || path.isAbsolute(rel)) {\n    throw new Error(`connector state path ${target} escapes memory root ${root}`);\n  }\n  // Walk every component from root to target (inclusive) and lstat each.\n  const segments = rel.length === 0 ? [] : rel.split(path.sep);\n  let current = root;\n  const componentsToCheck = [current];\n  for (const seg of segments) {\n    current = path.join(current, seg);\n    componentsToCheck.push(current);\n  }\n  for (const component of componentsToCheck) {\n    let stat: import(\"node:fs\").Stats;\n    try {\n      stat = await fs.lstat(component);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        // Not yet created — that's fine; caller's readFile/mkdir handles it.\n        continue;\n      }\n      throw err;\n    }\n    if (stat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${component} is a symlink; refusing to follow`);\n    }\n  }\n}\n\nasync function tryAcquireConnectorLock(memoryDir: string, id: string): Promise<ConnectorLockLease | null> {\n  const dir = resolveConnectorLocksDir(memoryDir);\n  const lockPath = resolveConnectorLockPath(memoryDir, id);\n  await assertNoSymlinkOnPath(memoryDir, lockPath);\n  await fs.mkdir(dir, { recursive: true });\n  let handle: Awaited<ReturnType<typeof fs.open>> | null = null;\n  let acquiredLockFile = false;\n  const token = randomUUID();\n  try {\n    handle = await fs.open(lockPath, \"wx\", 0o600);\n    acquiredLockFile = true;\n    await handle.writeFile(`${JSON.stringify(connectorLockMetadata(token))}\\n`, \"utf8\");\n    await handle.close();\n    handle = null;\n    return { path: lockPath, token };\n  } catch (err) {\n    if (acquiredLockFile) {\n      if (handle !== null) {\n        try {\n          await handle.close();\n        } catch {\n          // The original write/close failure is more actionable.\n        }\n      }\n      try {\n        await fs.unlink(lockPath);\n      } catch (cleanupErr) {\n        if ((cleanupErr as NodeJS.ErrnoException).code !== \"ENOENT\") {\n          throw new AggregateError(\n            [err, cleanupErr],\n            `failed to initialize connector state lock at ${lockPath}; cleanup also failed`\n          );\n        }\n      }\n      throw err;\n    }\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") {\n      throw err;\n    }\n    let stat: import(\"node:fs\").Stats;\n    try {\n      stat = await fs.lstat(lockPath);\n    } catch (statErr) {\n      if ((statErr as NodeJS.ErrnoException).code === \"ENOENT\") {\n        return null;\n      }\n      throw statErr;\n    }\n    if (stat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lockPath} is a symlink; refusing to follow`);\n    }\n    if (Date.now() - stat.mtimeMs > CONNECTOR_LOCK_STALE_MS) {\n      await unlinkStaleConnectorLock(lockPath);\n      return null;\n    }\n    return null;\n  }\n}\n\nasync function shouldUnlinkStaleConnectorLock(lockPath: string, stat: import(\"node:fs\").Stats): Promise<boolean> {\n  if (Date.now() - stat.mtimeMs <= CONNECTOR_LOCK_STALE_MS) return false;\n  const metadata = await readConnectorLockMetadata(lockPath);\n  if (metadata === null) return true;\n  const refreshedAtMs = Date.parse(metadata.refreshedAt);\n  if (!Number.isFinite(refreshedAtMs)) return true;\n  return Date.now() - refreshedAtMs > CONNECTOR_LOCK_STALE_MS;\n}\n\nasync function unlinkStaleConnectorLock(lockPath: string): Promise<void> {\n  const reclaimHandle = await openConnectorReclaimLock(lockPath);\n  if (!reclaimHandle) return;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    await unlinkStaleConnectorLockWhileReclaimHeld(lockPath);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lockPath)).catch(() => undefined);\n  }\n}\n\nasync function unlinkStaleConnectorLockWhileReclaimHeld(lockPath: string): Promise<void> {\n  let stat: import(\"node:fs\").Stats;\n  try {\n    stat = await fs.lstat(lockPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  }\n  if (stat.isSymbolicLink()) {\n    throw new Error(`connector state path component ${lockPath} is a symlink; refusing to follow`);\n  }\n  if (!(await shouldUnlinkStaleConnectorLock(lockPath, stat))) return;\n  try {\n    await fs.unlink(lockPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n  }\n}\n\nfunction connectorReclaimLockPath(lockPath: string): string {\n  return `${lockPath}.reclaim`;\n}\n\nasync function openConnectorReclaimLock(lockPath: string): Promise<Awaited<ReturnType<typeof fs.open>> | null> {\n  const reclaimPath = connectorReclaimLockPath(lockPath);\n  try {\n    return await fs.open(reclaimPath, \"wx\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n  }\n\n  let reclaimStat: import(\"node:fs\").Stats;\n  try {\n    reclaimStat = await fs.lstat(reclaimPath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  if (reclaimStat.isSymbolicLink()) {\n    throw new Error(`connector state path component ${reclaimPath} is a symlink; refusing to follow`);\n  }\n  if (Date.now() - reclaimStat.mtimeMs <= CONNECTOR_LOCK_STALE_MS) return null;\n  await fs.unlink(reclaimPath);\n\n  try {\n    return await fs.open(reclaimPath, \"wx\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") return null;\n    throw err;\n  }\n}\n\nasync function refreshConnectorLock(lease: ConnectorLockLease): Promise<boolean> {\n  const reclaimHandle = await openConnectorReclaimLock(lease.path);\n  if (!reclaimHandle) return false;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    return await refreshConnectorLockWhileReclaimHeld(lease);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lease.path)).catch(() => undefined);\n  }\n}\n\nasync function refreshConnectorLockWhileReclaimHeld(lease: ConnectorLockLease): Promise<boolean> {\n  let handle: Awaited<ReturnType<typeof fs.open>>;\n  try {\n    handle = await fs.open(lease.path, \"r+\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n  try {\n    const openedStat = await handle.stat();\n    const metadata = parseConnectorLockMetadata(await handle.readFile(\"utf8\"));\n    if (metadata?.token !== lease.token) return false;\n    const body = `${JSON.stringify(connectorLockMetadata(lease.token, metadata.createdAt))}\\n`;\n    await handle.truncate(0);\n    await handle.write(body, 0, \"utf8\");\n    let pathStat: import(\"node:fs\").Stats;\n    try {\n      pathStat = await fs.lstat(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw err;\n    }\n    if (pathStat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lease.path} is a symlink; refusing to follow`);\n    }\n    return isSameFileIdentity(openedStat, pathStat);\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function releaseConnectorLock(lease: ConnectorLockLease): Promise<void> {\n  const reclaimHandle = await openConnectorReclaimLock(lease.path);\n  if (!reclaimHandle) return;\n  try {\n    await reclaimHandle.writeFile(`${process.pid}:${new Date().toISOString()}`, \"utf8\");\n    await releaseConnectorLockWhileReclaimHeld(lease);\n  } finally {\n    await reclaimHandle.close().catch(() => undefined);\n    await fs.unlink(connectorReclaimLockPath(lease.path)).catch(() => undefined);\n  }\n}\n\nasync function releaseConnectorLockWhileReclaimHeld(lease: ConnectorLockLease): Promise<void> {\n  let handle: Awaited<ReturnType<typeof fs.open>>;\n  try {\n    handle = await fs.open(lease.path, \"r\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  }\n  try {\n    const openedStat = await handle.stat();\n    const metadata = parseConnectorLockMetadata(await handle.readFile(\"utf8\"));\n    if (metadata?.token !== lease.token) return;\n    let pathStat: import(\"node:fs\").Stats;\n    try {\n      pathStat = await fs.lstat(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n      throw err;\n    }\n    if (pathStat.isSymbolicLink()) {\n      throw new Error(`connector state path component ${lease.path} is a symlink; refusing to follow`);\n    }\n    if (!isSameFileIdentity(openedStat, pathStat)) return;\n    try {\n      await fs.unlink(lease.path);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n        throw err;\n      }\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function withConnectorStateLockInternal<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>,\n  options: ConnectorStateLockOptions = {}\n): Promise<T> {\n  const deadline = Date.now() + CONNECTOR_LOCK_TIMEOUT_MS;\n  let lease: ConnectorLockLease | null = null;\n  while (lease === null) {\n    lease = await tryAcquireConnectorLock(memoryDir, id);\n    if (lease !== null) break;\n    if (Date.now() >= deadline) {\n      throw new Error(`timed out waiting for connector \"${id}\" state lock`);\n    }\n    await delay(CONNECTOR_LOCK_RETRY_MS);\n  }\n  const abortController = new AbortController();\n  let rejectLockLost!: (err: Error) => void;\n  let lockLost = false;\n  const lockLostPromise = new Promise<never>((_resolve, reject) => {\n    rejectLockLost = reject;\n  });\n  const failLostLock = (message: string): void => {\n    if (lockLost) return;\n    lockLost = true;\n    const err = new ConnectorStateLockLostError(message);\n    abortController.abort(err);\n    rejectLockLost(err);\n  };\n  const heartbeat = setInterval(() => {\n    void refreshConnectorLock(lease)\n      .then((refreshed) => {\n        if (!refreshed) {\n          failLostLock(`lost connector \"${id}\" state lock`);\n        }\n      })\n      .catch((err) => {\n        const message = err instanceof Error ? err.message : String(err);\n        failLostLock(`lost connector \"${id}\" state lock: ${message}`);\n      });\n  }, options.heartbeatMs ?? CONNECTOR_LOCK_HEARTBEAT_MS);\n  if (options.unrefHeartbeat !== false) {\n    heartbeat.unref?.();\n  }\n  const runPromise = run(abortController.signal);\n  try {\n    return await Promise.race([runPromise, lockLostPromise]);\n  } catch (err) {\n    if (err instanceof ConnectorStateLockLostError) {\n      await runPromise.catch(() => undefined);\n    }\n    throw err;\n  } finally {\n    clearInterval(heartbeat);\n    await releaseConnectorLock(lease);\n  }\n}\n\nexport async function withConnectorStateLock<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>\n): Promise<T> {\n  return withConnectorStateLockInternal(memoryDir, id, run);\n}\n\nexport async function _withConnectorStateLockForTest<T>(\n  memoryDir: string,\n  id: string,\n  run: (abortSignal: AbortSignal) => Promise<T>,\n  options: ConnectorStateLockOptions\n): Promise<T> {\n  return withConnectorStateLockInternal(memoryDir, id, run, options);\n}\n\n/**\n * Read the persisted state for a single connector.\n *\n * Returns `null` if the file does not exist (ENOENT). Throws on any other\n * I/O error or on shape mismatch — operators should see corruption loudly.\n *\n * Rejects symlinks anywhere on the path so a planted symlink can't redirect\n * reads outside the memory root. (PR #724 review.)\n */\nexport async function readConnectorState(memoryDir: string, id: string): Promise<ConnectorState | null> {\n  const filePath = resolveConnectorStatePath(memoryDir, id);\n  await assertNoSymlinkOnPath(memoryDir, filePath);\n  let raw: string;\n  try {\n    raw = await fs.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} is not valid JSON: ${(err as Error).message}`\n    );\n  }\n  if (!isConnectorStateShape(parsed)) {\n    throw new ConnectorStateCorruptionError(`connector state at ${filePath} does not match ConnectorState shape`);\n  }\n  if (parsed.id !== id) {\n    throw new ConnectorStateCorruptionError(\n      `connector state at ${filePath} has mismatched id ${JSON.stringify(parsed.id)}; expected ${JSON.stringify(id)}`\n    );\n  }\n  return parsed;\n}\n\n/**\n * Write state atomically: create-tmp + rename. Never destroys the previous\n * file before the new one is in place — see CLAUDE.md gotcha #54.\n *\n * We accept `Omit<ConnectorState, \"updatedAt\">` and stamp `updatedAt`\n * ourselves so callers can't accidentally persist a stale timestamp.\n */\nexport async function writeConnectorState(\n  memoryDir: string,\n  id: string,\n  state: Omit<ConnectorState, \"updatedAt\">\n): Promise<ConnectorState> {\n  if (!isValidConnectorId(id)) {\n    throw new TypeError(\n      `invalid connector id ${JSON.stringify(id)} — must match /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/`\n    );\n  }\n  if (state.id !== id) {\n    throw new Error(\n      `writeConnectorState(): state.id ${JSON.stringify(state.id)} does not match id argument ${JSON.stringify(id)}`\n    );\n  }\n  // Full boundary validation. Persisting an out-of-shape record would brick\n  // the connector's cursor file: subsequent `readConnectorState` calls would\n  // throw `ConnectorStateCorruptionError` until manual repair. JS callers\n  // bypassing TS types must be rejected here, not later. (PR #724 review.)\n  if (!VALID_SYNC_STATUSES.has(state.lastSyncStatus as ConnectorSyncStatus)) {\n    throw new Error(\n      `writeConnectorState(): lastSyncStatus must be one of ${[...VALID_SYNC_STATUSES].join(\", \")}, got ${JSON.stringify(state.lastSyncStatus)}`\n    );\n  }\n  if (state.lastSyncAt !== null && typeof state.lastSyncAt !== \"string\") {\n    throw new Error(`writeConnectorState(): lastSyncAt must be a string or null, got ${typeof state.lastSyncAt}`);\n  }\n  if (state.cursor !== null) {\n    if (typeof state.cursor !== \"object\") {\n      throw new Error(`writeConnectorState(): cursor must be an object or null`);\n    }\n    if (\n      typeof state.cursor.kind !== \"string\" ||\n      typeof state.cursor.value !== \"string\" ||\n      typeof state.cursor.updatedAt !== \"string\"\n    ) {\n      throw new Error(`writeConnectorState(): cursor must have string kind, value, and updatedAt`);\n    }\n  }\n  if (\n    typeof state.totalDocsImported !== \"number\" ||\n    !Number.isInteger(state.totalDocsImported) ||\n    state.totalDocsImported < 0\n  ) {\n    throw new Error(`writeConnectorState(): totalDocsImported must be a non-negative integer`);\n  }\n  if (state.lastSyncError !== undefined && typeof state.lastSyncError !== \"string\") {\n    throw new Error(`writeConnectorState(): lastSyncError must be a string when provided`);\n  }\n  const truncatedError =\n    state.lastSyncError !== undefined && state.lastSyncError.length > MAX_ERROR_LENGTH\n      ? state.lastSyncError.slice(0, MAX_ERROR_LENGTH)\n      : state.lastSyncError;\n\n  const finalState: ConnectorState = {\n    id: state.id,\n    cursor: state.cursor,\n    lastSyncAt: state.lastSyncAt,\n    lastSyncStatus: state.lastSyncStatus,\n    ...(truncatedError !== undefined ? { lastSyncError: truncatedError } : {}),\n    totalDocsImported: state.totalDocsImported,\n    updatedAt: new Date().toISOString(),\n  };\n\n  const dir = resolveConnectorsDir(memoryDir);\n  const targetPath = path.join(dir, `${id}.json`);\n  // Reject planted symlinks before mkdir/write so a redirected target can't\n  // overwrite an arbitrary file outside the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, targetPath);\n  await fs.mkdir(dir, { recursive: true });\n  const tmpPath = `${targetPath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n\n  const body = `${JSON.stringify(finalState, null, 2)}\\n`;\n  try {\n    await fs.writeFile(tmpPath, body, { encoding: \"utf-8\", mode: 0o600 });\n    await fs.rename(tmpPath, targetPath);\n  } catch (err) {\n    // Best-effort cleanup of the tmp file. Never touch `targetPath` — the\n    // previous good state must remain readable on failure.\n    try {\n      await fs.unlink(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n  return finalState;\n}\n\n/**\n * Enumerate every persisted connector state. Returns an empty array when\n * the directory does not exist yet (clean install, no syncs ever run).\n *\n * Files that do not match the `<id>.json` naming rule are skipped — this\n * keeps stray editor backups (`.json~`, `.swp`) from breaking enumeration.\n *\n * Corruption (unparseable JSON, shape mismatch, id mismatch) is also\n * skipped so one bad file doesn't take down the listing. Operators\n * inspecting `state/connectors/` can still see the offending file by hand.\n *\n * **Genuine I/O failures (`EACCES`, `EIO`, etc.) are NOT swallowed** —\n * silently returning an incomplete state set would make active connectors\n * appear missing and trigger duplicate ingestion on the next scheduler tick.\n * (PR #724 review.)\n */\nexport async function listConnectorStates(memoryDir: string): Promise<ConnectorState[]> {\n  const dir = resolveConnectorsDir(memoryDir);\n  // Refuse to enumerate through a symlinked state directory — a planted\n  // symlink at <memoryDir>/state or <memoryDir>/state/connectors would\n  // otherwise let reads escape the memory root. (PR #724 review.)\n  await assertNoSymlinkOnPath(memoryDir, dir);\n  let entries: string[];\n  try {\n    entries = await fs.readdir(dir);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw err;\n  }\n  const out: ConnectorState[] = [];\n  for (const entry of entries) {\n    if (!entry.endsWith(\".json\")) continue;\n    const id = entry.slice(0, -\".json\".length);\n    if (!isValidConnectorId(id)) continue;\n    try {\n      const state = await readConnectorState(memoryDir, id);\n      if (state !== null) out.push(state);\n    } catch (err) {\n      if (err instanceof ConnectorStateCorruptionError) {\n        // Skip corrupt files; preserve availability of the rest.\n        continue;\n      }\n      // Anything else (EACCES, EIO, ENOTDIR, ...) is a real operational\n      // failure. Fail loudly so the scheduler / CLI can surface it.\n      throw err;\n    }\n  }\n  out.sort((a, b) => a.id.localeCompare(b.id));\n  return out;\n}\n\n/**\n * Test-only helper: resolve where a given connector's state lives. Exported\n * so tests can assert the on-disk layout without duplicating the path math.\n * Not part of the stable public API.\n *\n * @internal\n */\nexport function _connectorStatePathForTest(memoryDir: string, id: string): string {\n  return resolveConnectorStatePath(memoryDir, id);\n}\n\nexport const _unlinkStaleConnectorLockForTest = unlinkStaleConnectorLock;\nexport const _tryAcquireConnectorLockForTest = tryAcquireConnectorLock;\nexport const _refreshConnectorLockForTest = refreshConnectorLock;\nexport const _releaseConnectorLockForTest = releaseConnectorLock;\n","import type { ResolveSecretRefFn } from \"../../resolve-auth-token.js\";\n\n/**\n * @remnic/core — Live Connectors Framework (issue #683 PR 1/N)\n *\n * Defines the contract that every \"live\" connector (Drive, Notion, Gmail,\n * GitHub, ...) must satisfy. A live connector is **continuous**: it runs on a\n * schedule, persists a cursor to disk, and ingests *new* documents since the\n * last sync. This is distinct from one-shot importers in\n * `packages/remnic-core/src/importers/` which transform an entire export file\n * in a single pass.\n *\n * This module is intentionally pure types + interfaces. No I/O. No schedule\n * wiring. Concrete connectors (PRs 2–5), the maintenance scheduler hookup\n * (separate PR), and the CLI surface (PR 6) are deferred.\n *\n * Naming caveat: `packages/remnic-core/src/connectors/` is already scoped to\n * the Codex marketplace integration. The live-connector framework lives under\n * the `live/` subdirectory to avoid collision. Do not import Codex symbols\n * from here, and do not import live-connector symbols from the Codex code.\n */\n\n/**\n * Free-form connector configuration. Validated by each connector's\n * `validateConfig` implementation and passed to `syncIncremental` for runtime\n * use. MUST be JSON-serializable: no functions, no class instances, no\n * circular references.\n *\n * Runtime configs may contain hydrated credentials. Do not persist a runtime\n * config directly. Any code that needs to store connector settings must call\n * `persistableConnectorConfig()` so credentials are stripped or replaced by\n * connector-owned references.\n */\nexport type ConnectorConfig = Record<string, unknown>;\n\nconst DEFAULT_SECRET_KEY_PARTS = [\n  \"token\",\n  \"secret\",\n  \"password\",\n  \"credential\",\n  \"apikey\",\n  \"accesskey\",\n  \"privatekey\",\n  \"authorization\",\n  \"authheader\",\n  \"cookie\",\n] as const;\n\n/**\n * Redact secret-looking keys from a JSON-serializable connector config.\n * Built-in connectors provide explicit projections, but this default keeps\n * third-party connectors from accidentally persisting obvious credentials.\n */\nexport function redactConnectorConfigSecrets(config: ConnectorConfig): ConnectorConfig {\n  return redactConnectorConfigValue(config) as ConnectorConfig;\n}\n\nfunction redactConnectorConfigValue(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => redactConnectorConfigValue(item));\n  }\n  if (typeof value !== \"object\" || value === null) {\n    return value;\n  }\n  const out: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {\n    if (isConnectorSecretConfigKey(key)) {\n      continue;\n    }\n    out[key] = redactConnectorConfigValue(nested);\n  }\n  return out;\n}\n\nfunction isConnectorSecretConfigKey(key: string): boolean {\n  const normalized = key.replace(/[^a-z0-9]/giu, \"\").toLowerCase();\n  return DEFAULT_SECRET_KEY_PARTS.some((part) => normalized.includes(part));\n}\n\n/**\n * Opaque cursor describing \"where the last sync left off\". Each connector\n * defines what `kind` and `value` mean (e.g. Drive: `{kind: \"pageToken\",\n * value: \"...\"}`, Gmail: `{kind: \"historyId\", value: \"...\"}`). The orchestrator\n * treats it as opaque and only round-trips it through the state store.\n *\n * `updatedAt` is an ISO 8601 timestamp set by the framework when the cursor is\n * written. It is informational — connectors MUST NOT use it to decide\n * monotonicity. They own the `value` semantics.\n */\nexport interface ConnectorCursor {\n  /** Connector-defined cursor kind (e.g. `\"pageToken\"`, `\"historyId\"`, `\"sinceTs\"`). */\n  readonly kind: string;\n  /** Connector-defined opaque cursor value. */\n  readonly value: string;\n  /** ISO 8601 timestamp of when this cursor was last written. */\n  readonly updatedAt: string;\n}\n\n/**\n * Provenance for a connector-ingested document. Required so downstream recall\n * can attribute facts back to their origin and avoid re-ingesting on the next\n * incremental pass.\n */\nexport interface ConnectorDocumentSource {\n  /** Stable connector id (matches `LiveConnector.id`). */\n  readonly connector: string;\n  /** Source-system identifier (Drive file id, Notion page id, Gmail msg id, ...). */\n  readonly externalId: string;\n  /** Optional source-system revision/version (etag, page version, history id). */\n  readonly externalRevision?: string;\n  /** Optional canonical URL pointing back at the source document. */\n  readonly externalUrl?: string;\n  /** ISO 8601 timestamp of when the connector fetched this document. */\n  readonly fetchedAt: string;\n}\n\n/**\n * A single document yielded by an incremental sync. Connectors are responsible\n * for chunking large source documents themselves if needed; the orchestrator\n * ingests `content` as a unit.\n */\nexport interface ConnectorDocument {\n  /** Connector-local stable id for this document. SHOULD match `source.externalId`. */\n  readonly id: string;\n  /** Optional human-readable title. */\n  readonly title?: string;\n  /** Body content. Plaintext or Markdown — connectors document their format. */\n  readonly content: string;\n  /** Provenance. Required. */\n  readonly source: ConnectorDocumentSource;\n}\n\n/**\n * Arguments passed to `syncIncremental`. The framework owns cursor/config\n * lifecycle; connectors only read these and return the next cursor.\n */\nexport interface SyncIncrementalArgs {\n  /** Last persisted cursor, or `null` on the first ever sync. */\n  readonly cursor: ConnectorCursor | null;\n  /** Validated connector config (already passed through `validateConfig`). */\n  readonly config: ConnectorConfig;\n  /** Optional abort signal. Connectors SHOULD honor it for cooperative cancellation. */\n  readonly abortSignal?: AbortSignal;\n  /**\n   * Host resolver for credential fields that hold a SecretRef. A connector\n   * resolves those at poll time. Absent a resolver, a plain string still works\n   * and a SecretRef fails that connector only.\n   */\n  readonly resolveSecretRef?: ResolveSecretRefFn | null;\n}\n\n/**\n * Result of a single incremental sync pass.\n *\n * `newDocs` MAY be empty (no new documents since the last cursor). `nextCursor`\n * MUST always be returned — even on no-op syncs the framework persists it so\n * `updatedAt` reflects the most recent attempt.\n */\nexport interface SyncIncrementalResult {\n  readonly newDocs: ConnectorDocument[];\n  readonly nextCursor: ConnectorCursor;\n}\n\n/**\n * The contract every live connector implements.\n *\n * Connectors MUST be:\n *   - **Idempotent**: re-running with the same cursor MUST NOT duplicate\n *     documents. The `source.externalId` + `source.externalRevision` pair is\n *     used downstream for dedup.\n *   - **Read-only on the source**: live connectors never mutate the upstream\n *     system (no marking emails read, no editing Notion pages).\n *   - **Cancellable**: long-running syncs SHOULD periodically check\n *     `abortSignal.aborted` and bail cleanly.\n *   - **Privacy-aware**: connectors MUST NOT log document content. Logging\n *     metadata (counts, ids, timings) is fine.\n */\nexport interface LiveConnector {\n  /**\n   * Stable connector id. MUST match `CONNECTOR_ID_PATTERN` — lowercase\n   * alphanumeric plus dash, 1–64 chars, must start AND end with alphanumeric\n   * (no leading or trailing dash). The registry enforces this.\n   */\n  readonly id: string;\n  /** Short human-readable name shown in CLI / status output. */\n  readonly displayName: string;\n  /** Optional longer description. */\n  readonly description?: string;\n\n  /**\n   * Validate raw user-supplied config. MUST throw on malformed input — never\n   * silently default. The returned object is the runtime config passed back to\n   * `syncIncremental`; it may contain hydrated credentials and MUST NOT be\n   * persisted directly. Connectors SHOULD strip unknown fields.\n   */\n  validateConfig(raw: unknown): ConnectorConfig;\n\n  /**\n   * Return the subset of validated config that may be written to disk. Use this\n   * for state/config persistence instead of `validateConfig()`. Connectors that\n   * need credentials should omit the raw values here and store only non-secret\n   * scope/schedule fields plus any connector-owned secret references.\n   */\n  persistConfig?(validated: ConnectorConfig): ConnectorConfig;\n\n  /**\n   * Run one incremental sync pass. See `SyncIncrementalArgs` /\n   * `SyncIncrementalResult` for the contract.\n   */\n  syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult>;\n}\n\nexport function persistableConnectorConfig(\n  connector: Pick<LiveConnector, \"persistConfig\">,\n  validated: ConnectorConfig,\n): ConnectorConfig {\n  if (typeof connector.persistConfig === \"function\") {\n    return connector.persistConfig(validated);\n  }\n  return redactConnectorConfigSecrets(validated);\n}\n\n/**\n * Regex enforcing the connector-id naming rule. Exported so connectors and\n * tests can validate ids consistently with the registry.\n *\n * Rule: lowercase alphanumeric + dash, 1..64 chars, must start AND end with\n * alphanumeric (no leading or trailing dash). Single-char ids are allowed.\n */\nexport const CONNECTOR_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;\n\n/**\n * Returns `true` if `id` is a syntactically valid connector id.\n */\nexport function isValidConnectorId(id: unknown): id is string {\n  return typeof id === \"string\" && CONNECTOR_ID_PATTERN.test(id);\n}\n"],"mappings":";;;;;AAuBA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,cAAc,aAAa;;;ACSpC,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,SAAS,6BAA6B,QAA0C;AACrF,SAAO,2BAA2B,MAAM;AAC1C;AAEA,SAAS,2BAA2B,OAAyB;AAC3D,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,2BAA2B,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC5E,QAAI,2BAA2B,GAAG,GAAG;AACnC;AAAA,IACF;AACA,QAAI,GAAG,IAAI,2BAA2B,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,2BAA2B,KAAsB;AACxD,QAAM,aAAa,IAAI,QAAQ,gBAAgB,EAAE,EAAE,YAAY;AAC/D,SAAO,yBAAyB,KAAK,CAAC,SAAS,WAAW,SAAS,IAAI,CAAC;AAC1E;AAuIO,SAAS,2BACd,WACA,WACiB;AACjB,MAAI,OAAO,UAAU,kBAAkB,YAAY;AACjD,WAAO,UAAU,cAAc,SAAS;AAAA,EAC1C;AACA,SAAO,6BAA6B,SAAS;AAC/C;AASO,IAAM,uBAAuB;AAK7B,SAAS,mBAAmB,IAA2B;AAC5D,SAAO,OAAO,OAAO,YAAY,qBAAqB,KAAK,EAAE;AAC/D;;;AD3KA,IAAM,iBAAiB;AACvB,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,mBAAmB;AACzB,IAAM,0BAA0B,KAAK,KAAK;AAC1C,IAAM,8BAA8B,KAAK,IAAI,KAAO,KAAK,MAAM,0BAA0B,CAAC,CAAC;AAC3F,IAAM,4BAA4B,KAAK;AACvC,IAAM,0BAA0B;AAChC,IAAM,sBAAwD,oBAAI,IAAI,CAAC,WAAW,SAAS,OAAO,CAAC;AAQnG,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAsBA,SAAS,qBAAqB,WAA2B;AACvD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO,KAAK,KAAK,gBAAgB,SAAS,GAAG,gBAAgB,mBAAmB;AAClF;AAEA,SAAS,yBAAyB,WAA2B;AAC3D,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO,KAAK,KAAK,gBAAgB,SAAS,GAAG,gBAAgB,wBAAwB;AACvF;AAMA,SAAS,0BAA0B,WAAmB,IAAoB;AACxE,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK,KAAK,qBAAqB,SAAS,GAAG,GAAG,EAAE,OAAO;AAChE;AAEA,SAAS,yBAAyB,WAAmB,IAAoB;AACvE,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK,KAAK,yBAAyB,SAAS,GAAG,GAAG,EAAE,OAAO;AACpE;AASA,SAAS,sBAAsB,OAAyC;AACtE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,OAAO,SAAU,QAAO;AACrC,MAAI,OAAO,EAAE,mBAAmB,SAAU,QAAO;AACjD,MAAI,CAAC,CAAC,WAAW,SAAS,OAAO,EAAE,SAAS,EAAE,cAAc,EAAG,QAAO;AAGtE,MAAI,OAAO,EAAE,sBAAsB,YAAY,CAAC,OAAO,UAAU,EAAE,iBAAiB,EAAG,QAAO;AAC9F,MAAI,EAAE,oBAAoB,EAAG,QAAO;AACpC,MAAI,OAAO,EAAE,cAAc,SAAU,QAAO;AAC5C,MAAI,EAAE,eAAe,QAAQ,OAAO,EAAE,eAAe,SAAU,QAAO;AACtE,MAAI,EAAE,WAAW,MAAM;AACrB,QAAI,OAAO,EAAE,WAAW,YAAY,EAAE,WAAW,KAAM,QAAO;AAC9D,UAAM,IAAI,EAAE;AACZ,QAAI,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,cAAc,UAAU;AAChG,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,EAAE,kBAAkB,UAAa,OAAO,EAAE,kBAAkB,SAAU,QAAO;AACjF,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAgD;AAC/E,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,QAAQ,YACjB,OAAO,UAAU,EAAE,GAAG,KACtB,EAAE,MAAM,KACR,OAAO,EAAE,UAAU,YACnB,EAAE,MAAM,SAAS,KACjB,OAAO,EAAE,cAAc,YACvB,OAAO,EAAE,gBAAgB;AAE7B;AAEA,SAAS,sBAAsB,OAAe,aAAY,oBAAI,KAAK,GAAE,YAAY,GAA0B;AACzG,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;AAEA,eAAe,0BAA0B,UAAyD;AAChG,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,UAAU,MAAM;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,wBAAwB,MAAM,IAAI,SAAS;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAA2B,KAA2C;AAC7E,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,WAAO,wBAAwB,MAAM,IAAI,SAAS;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAA+B,OAAyC;AAClG,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,QAAQ,MAAM;AACtD;AAeA,eAAe,sBAAsB,WAAmB,UAAiC;AACvF,QAAM,eAAe,gBAAgB,SAAS;AAE9C,QAAM,OAAO,KAAK,QAAQ,YAAY;AACtC,QAAM,SAAS,KAAK,QAAQ,QAAQ;AACpC,QAAM,MAAM,KAAK,SAAS,MAAM,MAAM;AAEtC,MAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG;AAChD,UAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB,IAAI,EAAE;AAAA,EAC9E;AAEA,QAAM,WAAW,IAAI,WAAW,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,GAAG;AAC3D,MAAI,UAAU;AACd,QAAM,oBAAoB,CAAC,OAAO;AAClC,aAAW,OAAO,UAAU;AAC1B,cAAU,KAAK,KAAK,SAAS,GAAG;AAChC,sBAAkB,KAAK,OAAO;AAAA,EAChC;AACA,aAAW,aAAa,mBAAmB;AACzC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,MAAM,SAAS;AAAA,IACjC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AAEpD;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI,MAAM,kCAAkC,SAAS,mCAAmC;AAAA,IAChG;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,WAAmB,IAAgD;AACxG,QAAM,MAAM,yBAAyB,SAAS;AAC9C,QAAM,WAAW,yBAAyB,WAAW,EAAE;AACvD,QAAM,sBAAsB,WAAW,QAAQ;AAC/C,QAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,MAAI,SAAqD;AACzD,MAAI,mBAAmB;AACvB,QAAM,QAAQ,WAAW;AACzB,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,UAAU,MAAM,GAAK;AAC5C,uBAAmB;AACnB,UAAM,OAAO,UAAU,GAAG,KAAK,UAAU,sBAAsB,KAAK,CAAC,CAAC;AAAA,GAAM,MAAM;AAClF,UAAM,OAAO,MAAM;AACnB,aAAS;AACT,WAAO,EAAE,MAAM,UAAU,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,QAAI,kBAAkB;AACpB,UAAI,WAAW,MAAM;AACnB,YAAI;AACF,gBAAM,OAAO,MAAM;AAAA,QACrB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI;AACF,cAAM,GAAG,OAAO,QAAQ;AAAA,MAC1B,SAAS,YAAY;AACnB,YAAK,WAAqC,SAAS,UAAU;AAC3D,gBAAM,IAAI;AAAA,YACR,CAAC,KAAK,UAAU;AAAA,YAChB,gDAAgD,QAAQ;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM;AAAA,IACR;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,MAAM,QAAQ;AAAA,IAChC,SAAS,SAAS;AAChB,UAAK,QAAkC,SAAS,UAAU;AACxD,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AACA,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI,MAAM,kCAAkC,QAAQ,mCAAmC;AAAA,IAC/F;AACA,QAAI,KAAK,IAAI,IAAI,KAAK,UAAU,yBAAyB;AACvD,YAAM,yBAAyB,QAAQ;AACvC,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAe,+BAA+B,UAAkB,MAAiD;AAC/G,MAAI,KAAK,IAAI,IAAI,KAAK,WAAW,wBAAyB,QAAO;AACjE,QAAM,WAAW,MAAM,0BAA0B,QAAQ;AACzD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,gBAAgB,KAAK,MAAM,SAAS,WAAW;AACrD,MAAI,CAAC,OAAO,SAAS,aAAa,EAAG,QAAO;AAC5C,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAEA,eAAe,yBAAyB,UAAiC;AACvE,QAAM,gBAAgB,MAAM,yBAAyB,QAAQ;AAC7D,MAAI,CAAC,cAAe;AACpB,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,UAAM,yCAAyC,QAAQ;AAAA,EACzD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,QAAQ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC3E;AACF;AAEA,eAAe,yCAAyC,UAAiC;AACvF,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,MAAM,QAAQ;AAAA,EAChC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR;AACA,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,kCAAkC,QAAQ,mCAAmC;AAAA,EAC/F;AACA,MAAI,CAAE,MAAM,+BAA+B,UAAU,IAAI,EAAI;AAC7D,MAAI;AACF,UAAM,GAAG,OAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAA0B;AAC1D,SAAO,GAAG,QAAQ;AACpB;AAEA,eAAe,yBAAyB,UAAuE;AAC7G,QAAM,cAAc,yBAAyB,QAAQ;AACrD,MAAI;AACF,WAAO,MAAM,GAAG,KAAK,aAAa,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,EAC9D;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,GAAG,MAAM,WAAW;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI,YAAY,eAAe,GAAG;AAChC,UAAM,IAAI,MAAM,kCAAkC,WAAW,mCAAmC;AAAA,EAClG;AACA,MAAI,KAAK,IAAI,IAAI,YAAY,WAAW,wBAAyB,QAAO;AACxE,QAAM,GAAG,OAAO,WAAW;AAE3B,MAAI;AACF,WAAO,MAAM,GAAG,KAAK,aAAa,IAAI;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qBAAqB,OAA6C;AAC/E,QAAM,gBAAgB,MAAM,yBAAyB,MAAM,IAAI;AAC/D,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,WAAO,MAAM,qCAAqC,KAAK;AAAA,EACzD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,MAAM,IAAI,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7E;AACF;AAEA,eAAe,qCAAqC,OAA6C;AAC/F,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,MAAM,MAAM,IAAI;AAAA,EACzC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,UAAM,WAAW,2BAA2B,MAAM,OAAO,SAAS,MAAM,CAAC;AACzE,QAAI,UAAU,UAAU,MAAM,MAAO,QAAO;AAC5C,UAAM,OAAO,GAAG,KAAK,UAAU,sBAAsB,MAAM,OAAO,SAAS,SAAS,CAAC,CAAC;AAAA;AACtF,UAAM,OAAO,SAAS,CAAC;AACvB,UAAM,OAAO,MAAM,MAAM,GAAG,MAAM;AAClC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,GAAG,MAAM,MAAM,IAAI;AAAA,IACtC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,YAAM;AAAA,IACR;AACA,QAAI,SAAS,eAAe,GAAG;AAC7B,YAAM,IAAI,MAAM,kCAAkC,MAAM,IAAI,mCAAmC;AAAA,IACjG;AACA,WAAO,mBAAmB,YAAY,QAAQ;AAAA,EAChD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,qBAAqB,OAA0C;AAC5E,QAAM,gBAAgB,MAAM,yBAAyB,MAAM,IAAI;AAC/D,MAAI,CAAC,cAAe;AACpB,MAAI;AACF,UAAM,cAAc,UAAU,GAAG,QAAQ,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,MAAM;AAClF,UAAM,qCAAqC,KAAK;AAAA,EAClD,UAAE;AACA,UAAM,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AACjD,UAAM,GAAG,OAAO,yBAAyB,MAAM,IAAI,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7E;AACF;AAEA,eAAe,qCAAqC,OAA0C;AAC5F,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,KAAK,MAAM,MAAM,GAAG;AAAA,EACxC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR;AACA,MAAI;AACF,UAAM,aAAa,MAAM,OAAO,KAAK;AACrC,UAAM,WAAW,2BAA2B,MAAM,OAAO,SAAS,MAAM,CAAC;AACzE,QAAI,UAAU,UAAU,MAAM,MAAO;AACrC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,GAAG,MAAM,MAAM,IAAI;AAAA,IACtC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU;AACtD,YAAM;AAAA,IACR;AACA,QAAI,SAAS,eAAe,GAAG;AAC7B,YAAM,IAAI,MAAM,kCAAkC,MAAM,IAAI,mCAAmC;AAAA,IACjG;AACA,QAAI,CAAC,mBAAmB,YAAY,QAAQ,EAAG;AAC/C,QAAI;AACF,YAAM,GAAG,OAAO,MAAM,IAAI;AAAA,IAC5B,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AACpD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,+BACb,WACA,IACA,KACA,UAAqC,CAAC,GAC1B;AACZ,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,QAAmC;AACvC,SAAO,UAAU,MAAM;AACrB,YAAQ,MAAM,wBAAwB,WAAW,EAAE;AACnD,QAAI,UAAU,KAAM;AACpB,QAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,YAAM,IAAI,MAAM,oCAAoC,EAAE,cAAc;AAAA,IACtE;AACA,UAAM,MAAM,uBAAuB;AAAA,EACrC;AACA,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI;AACJ,MAAI,WAAW;AACf,QAAM,kBAAkB,IAAI,QAAe,CAAC,UAAU,WAAW;AAC/D,qBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,eAAe,CAAC,YAA0B;AAC9C,QAAI,SAAU;AACd,eAAW;AACX,UAAM,MAAM,IAAI,4BAA4B,OAAO;AACnD,oBAAgB,MAAM,GAAG;AACzB,mBAAe,GAAG;AAAA,EACpB;AACA,QAAM,YAAY,YAAY,MAAM;AAClC,SAAK,qBAAqB,KAAK,EAC5B,KAAK,CAAC,cAAc;AACnB,UAAI,CAAC,WAAW;AACd,qBAAa,mBAAmB,EAAE,cAAc;AAAA,MAClD;AAAA,IACF,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,mBAAa,mBAAmB,EAAE,iBAAiB,OAAO,EAAE;AAAA,IAC9D,CAAC;AAAA,EACL,GAAG,QAAQ,eAAe,2BAA2B;AACrD,MAAI,QAAQ,mBAAmB,OAAO;AACpC,cAAU,QAAQ;AAAA,EACpB;AACA,QAAM,aAAa,IAAI,gBAAgB,MAAM;AAC7C,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,YAAY,eAAe,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,YAAM,WAAW,MAAM,MAAM,MAAS;AAAA,IACxC;AACA,UAAM;AAAA,EACR,UAAE;AACA,kBAAc,SAAS;AACvB,UAAM,qBAAqB,KAAK;AAAA,EAClC;AACF;AAEA,eAAsB,uBACpB,WACA,IACA,KACY;AACZ,SAAO,+BAA+B,WAAW,IAAI,GAAG;AAC1D;AAEA,eAAsB,+BACpB,WACA,IACA,KACA,SACY;AACZ,SAAO,+BAA+B,WAAW,IAAI,KAAK,OAAO;AACnE;AAWA,eAAsB,mBAAmB,WAAmB,IAA4C;AACtG,QAAM,WAAW,0BAA0B,WAAW,EAAE;AACxD,QAAM,sBAAsB,WAAW,QAAQ;AAC/C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,UAAU,OAAO;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,uBAAwB,IAAc,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,CAAC,sBAAsB,MAAM,GAAG;AAClC,UAAM,IAAI,8BAA8B,sBAAsB,QAAQ,sCAAsC;AAAA,EAC9G;AACA,MAAI,OAAO,OAAO,IAAI;AACpB,UAAM,IAAI;AAAA,MACR,sBAAsB,QAAQ,sBAAsB,KAAK,UAAU,OAAO,EAAE,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;AAAA,IAC/G;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,oBACpB,WACA,IACA,OACyB;AACzB,MAAI,CAAC,mBAAmB,EAAE,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,EAAE,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,MAAM,OAAO,IAAI;AACnB,UAAM,IAAI;AAAA,MACR,mCAAmC,KAAK,UAAU,MAAM,EAAE,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;AAAA,IAC9G;AAAA,EACF;AAKA,MAAI,CAAC,oBAAoB,IAAI,MAAM,cAAqC,GAAG;AACzE,UAAM,IAAI;AAAA,MACR,wDAAwD,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC,SAAS,KAAK,UAAU,MAAM,cAAc,CAAC;AAAA,IAC1I;AAAA,EACF;AACA,MAAI,MAAM,eAAe,QAAQ,OAAO,MAAM,eAAe,UAAU;AACrE,UAAM,IAAI,MAAM,mEAAmE,OAAO,MAAM,UAAU,EAAE;AAAA,EAC9G;AACA,MAAI,MAAM,WAAW,MAAM;AACzB,QAAI,OAAO,MAAM,WAAW,UAAU;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QACE,OAAO,MAAM,OAAO,SAAS,YAC7B,OAAO,MAAM,OAAO,UAAU,YAC9B,OAAO,MAAM,OAAO,cAAc,UAClC;AACA,YAAM,IAAI,MAAM,2EAA2E;AAAA,IAC7F;AAAA,EACF;AACA,MACE,OAAO,MAAM,sBAAsB,YACnC,CAAC,OAAO,UAAU,MAAM,iBAAiB,KACzC,MAAM,oBAAoB,GAC1B;AACA,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,iBACJ,MAAM,kBAAkB,UAAa,MAAM,cAAc,SAAS,mBAC9D,MAAM,cAAc,MAAM,GAAG,gBAAgB,IAC7C,MAAM;AAEZ,QAAM,aAA6B;AAAA,IACjC,IAAI,MAAM;AAAA,IACV,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,gBAAgB,MAAM;AAAA,IACtB,GAAI,mBAAmB,SAAY,EAAE,eAAe,eAAe,IAAI,CAAC;AAAA,IACxE,mBAAmB,MAAM;AAAA,IACzB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,MAAM,qBAAqB,SAAS;AAC1C,QAAM,aAAa,KAAK,KAAK,KAAK,GAAG,EAAE,OAAO;AAG9C,QAAM,sBAAsB,WAAW,UAAU;AACjD,QAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,GAAG,UAAU,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAExG,QAAM,OAAO,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AACnD,MAAI;AACF,UAAM,GAAG,UAAU,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AACpE,UAAM,GAAG,OAAO,SAAS,UAAU;AAAA,EACrC,SAAS,KAAK;AAGZ,QAAI;AACF,YAAM,GAAG,OAAO,OAAO;AAAA,IACzB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAkBA,eAAsB,oBAAoB,WAA8C;AACtF,QAAM,MAAM,qBAAqB,SAAS;AAI1C,QAAM,sBAAsB,WAAW,GAAG;AAC1C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,GAAG,QAAQ,GAAG;AAAA,EAChC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM;AAAA,EACR;AACA,QAAM,MAAwB,CAAC;AAC/B,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,SAAS,OAAO,EAAG;AAC9B,UAAM,KAAK,MAAM,MAAM,GAAG,CAAC,QAAQ,MAAM;AACzC,QAAI,CAAC,mBAAmB,EAAE,EAAG;AAC7B,QAAI;AACF,YAAM,QAAQ,MAAM,mBAAmB,WAAW,EAAE;AACpD,UAAI,UAAU,KAAM,KAAI,KAAK,KAAK;AAAA,IACpC,SAAS,KAAK;AACZ,UAAI,eAAe,+BAA+B;AAEhD;AAAA,MACF;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC3C,SAAO;AACT;AASO,SAAS,2BAA2B,WAAmB,IAAoB;AAChF,SAAO,0BAA0B,WAAW,EAAE;AAChD;AAEO,IAAM,mCAAmC;AACzC,IAAM,kCAAkC;AACxC,IAAM,+BAA+B;AACrC,IAAM,+BAA+B;","names":[]}

package/dist/{chunk-VPQFK63H.js → chunk-MH632KPO.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-WWK6J6SE.js";
+} from "./chunk-WQURALGV.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-VPQFK63H.js.map
+//# sourceMappingURL=chunk-MH632KPO.js.map

package/dist/{chunk-EQ4U73UH.js → chunk-MLAMXQAW.js}

@@ -123,6 +123,10 @@ function negatedScope(clause) {
   const match = NEGATOR_PATTERN.exec(clause.replace(/[\u2018\u2019]/gu, "'"));
   return match ? clause.slice(match.index + match[0].length) : clause;
 }
+function textBeforeNegator(clause) {
+  const match = NEGATOR_PATTERN.exec(clause.replace(/[\u2018\u2019]/gu, "'"));
+  return match ? clause.slice(0, match.index) : "";
+}
 function misstatesQuote(content, quote) {
   const claimClauses = splitClaimClauses(content);
   return (quote.match(CLAUSE_PATTERN) ?? []).some((quoteClause) => {
@@ -135,8 +139,16 @@ function misstatesQuote(content, quote) {
     const clausesSharing = (tokens) => claimClauses.filter((claimClause) => clauseOverlap(tokens, claimClause).shared > 0);
     if (needsNegation) {
       const scopeTokens = [...tokenize(negatedScope(quoteClause))];
+      const subjectTokens = [...tokenize(textBeforeNegator(quoteClause))];
+      const scopeHas = new Set(scopeTokens);
       const related = clausesSharing(scopeTokens.length > 0 ? scopeTokens : clauseTokens);
-      if (!related.some((text) => hasNegation(text) || EXCLUSION_PATTERN.test(text))) return true;
+      const keepsDenial = related.some((text) => {
+        if (!hasNegation(text) && !EXCLUSION_PATTERN.test(text)) return false;
+        if (subjectTokens.length === 0 || clauseOverlap(subjectTokens, text).shared > 0) return true;
+        const ownSubject = [...tokenize(textBeforeNegator(text))].filter((token) => !scopeHas.has(token));
+        return ownSubject.length === 0;
+      });
+      if (!keepsDenial) return true;
     }
     return needsReporting && !clausesSharing(clauseTokens).some((text) => hasNonAssertiveReporting(text) || text.trim().endsWith("?"));
   });
@@ -202,4 +214,4 @@ export {
   quoteAnchoredEntitySupport,
   isQuoteAnchoredRelationship
 };
-//# sourceMappingURL=chunk-EQ4U73UH.js.map
+//# sourceMappingURL=chunk-MLAMXQAW.js.map

package/dist/chunk-MLAMXQAW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/extraction-quote-grounding.ts"],"sourcesContent":["/**\n * Quote-anchored source grounding.\n *\n * An extracted fact carries the exact words that support it in `quote`. A quote\n * that is a verbatim substring of the source (whitespace-normalized) is real\n * evidence: the claim only has to be supported by the text around that span,\n * not by word overlap against the whole conversation. Items without such a\n * quote never get an anchor here and stay on the whole-source rules.\n */\n\nimport type { ExtractionResult } from \"./types.js\";\nimport {\n  GROUNDING_MIN_SHARED_TOKENS,\n  areGroundingTokensCompatible,\n  entityNameStart,\n  hasDenialReporting,\n  hasNonAssertiveReporting,\n  isGroundedEntityName,\n  normalizedEntityIdentifierTokens,\n  sourceSentences,\n  tokenize,\n} from \"./extraction-source-grounding-helpers.js\";\n\n/** Shortest normalized quote that counts as evidence; \"the\" or \"I\" prove nothing. */\nexport const QUOTE_ANCHOR_MIN_CHARS = 12;\n/** Characters of context kept on each side of the quote inside its turn. */\nexport const QUOTE_ANCHOR_CONTEXT_CHARS = 400;\n/** Share of a claim's content words that must occur in the quote's window. */\nexport const QUOTE_ANCHOR_MIN_WINDOW_COVERAGE = 0.35;\n/** Share of a claim's content words that must occur anywhere in the source; the rest is invented. */\nexport const QUOTE_ANCHOR_MIN_SOURCE_COVERAGE = 0.75;\nconst QUOTE_ANCHOR_MAX_OCCURRENCES = 8;\nconst TURN_SEPARATOR = \"\\n\\n\";\nconst NEGATOR_PATTERN = /\\b(?:not|no|never|cannot|without|neither|nor)\\b|n't\\b/iu;\nconst EXCLUSION_PATTERN =\n  /\\b(?:exclu\\w*|avoid\\w*|omit\\w*|skip\\w*|ignor\\w*|forbid\\w*|prohibit\\w*|disallow\\w*|prevent\\w*|reject\\w*|refus\\w*|insufficient|instead|rather|unless|except)\\b/iu;\n\n/** A verbatim quote and the text around it inside its turn. */\nexport interface QuoteAnchor {\n  /** Whitespace-normalized quote, exactly as it appears in the source. */\n  quote: string;\n  /** `quote` with its turn-local context; `;` inside the quote is rewritten to `,`. */\n  window: string;\n}\n\nexport type TokenPool = (token: string) => boolean;\n\ntype Entity = ExtractionResult[\"entities\"][number];\ntype Relationship = NonNullable<ExtractionResult[\"relationships\"]>[number];\n\nfunction normalizeWhitespaceWithMap(source: string): { text: string; originalIndex: number[] } {\n  const chars: string[] = [];\n  const originalIndex: number[] = [];\n  let inSpace = false;\n  for (let index = 0; index < source.length; index += 1) {\n    const char = source[index]!;\n    if (/\\s/u.test(char)) {\n      if (inSpace) continue;\n      inSpace = true;\n      chars.push(\" \");\n    } else {\n      inSpace = false;\n      chars.push(char);\n    }\n    originalIndex.push(index);\n  }\n  return { text: chars.join(\"\"), originalIndex };\n}\n\nfunction turnStartOffsets(source: string, turns: readonly string[]): readonly number[] | undefined {\n  const offsets: number[] = [];\n  let at = 0;\n  for (const turn of turns) {\n    if (!source.startsWith(turn, at)) return undefined;\n    offsets.push(at);\n    at += turn.length + TURN_SEPARATOR.length;\n  }\n  return at - TURN_SEPARATOR.length === source.length ? offsets : undefined;\n}\n\nfunction findQuoteAnchors(quote: string, source: string, bounds?: readonly number[]): QuoteAnchor[] {\n  const needle = quote.replace(/\\s+/gu, \" \").trim();\n  if (needle.length < QUOTE_ANCHOR_MIN_CHARS) return [];\n  const normalized = normalizeWhitespaceWithMap(source);\n  const anchors: QuoteAnchor[] = [];\n  let from = 0;\n  while (anchors.length < QUOTE_ANCHOR_MAX_OCCURRENCES) {\n    const at = normalized.text.indexOf(needle, from);\n    if (at < 0) break;\n    from = at + 1;\n    const start = normalized.originalIndex[at]!;\n    const end = normalized.originalIndex[at + needle.length - 1]! + 1;\n\n    let before: string;\n    let after: string;\n    if (bounds === undefined) {\n      if (source.slice(start, end).includes(TURN_SEPARATOR)) continue;\n      before = source.slice(Math.max(0, start - QUOTE_ANCHOR_CONTEXT_CHARS), start);\n      const sepBefore = before.lastIndexOf(TURN_SEPARATOR);\n      if (sepBefore >= 0) before = before.slice(sepBefore + TURN_SEPARATOR.length);\n      else if (start > QUOTE_ANCHOR_CONTEXT_CHARS) before = before.replace(/^\\S+/u, \"\");\n      after = source.slice(end, end + QUOTE_ANCHOR_CONTEXT_CHARS);\n      const sepAfter = after.indexOf(TURN_SEPARATOR);\n      if (sepAfter >= 0) after = after.slice(0, sepAfter);\n      else if (source.length - end > QUOTE_ANCHOR_CONTEXT_CHARS) after = after.replace(/\\S+$/u, \"\");\n    } else {\n      let turnStart = 0;\n      let turnEnd = source.length;\n      for (const bound of bounds) {\n        if (bound <= start) turnStart = bound;\n        else {\n          turnEnd = bound - TURN_SEPARATOR.length;\n          break;\n        }\n      }\n      if (turnEnd < end) continue;\n      before = source.slice(Math.max(turnStart, start - QUOTE_ANCHOR_CONTEXT_CHARS), start);\n      if (start - QUOTE_ANCHOR_CONTEXT_CHARS > turnStart) before = before.replace(/^\\S+/u, \"\");\n      const contextEnd = Math.min(turnEnd, end + QUOTE_ANCHOR_CONTEXT_CHARS);\n      after = source.slice(end, contextEnd);\n      if (end + QUOTE_ANCHOR_CONTEXT_CHARS < turnEnd) after = after.replace(/\\S+$/u, \"\");\n    }\n\n    anchors.push({ quote: needle, window: `${before}${needle.replace(/;/gu, \",\")}${after}` });\n  }\n  return anchors;\n}\n\n/**\n * Returns one anchor per place `quote` occurs verbatim in `source`, or [] when\n * the quote is absent, too short, or not an exact substring. A quote that\n * spans a turn separator is not one turn's words and yields no anchor; windows\n * never extend past their turn.\n *\n * The quote is one evidence unit: a `;` inside it is rewritten to `,` in the\n * window so sentence splitting cannot cut it, or a claim that merges two of\n * its clauses could never be grounded in a single sentence.\n *\n * `source` may have been rewritten before grounding (temporal anchoring,\n * pronoun resolution) while the model quoted the original words. When the raw\n * quote is not found, `transformQuote` applies the same rewrite to the quote.\n *\n * `turns` are the texts `source` was joined from; when they tile `source`\n * exactly, quotes and windows cut at real turn boundaries instead of any\n * blank line. Without them, every `TURN_SEPARATOR` run is a boundary.\n */\nexport function quoteAnchors(\n  quote: string | undefined,\n  source: string,\n  transformQuote?: (quote: string) => string,\n  turns?: readonly string[],\n): QuoteAnchor[] {\n  if (typeof quote !== \"string\") return [];\n  const bounds = turns === undefined ? undefined : turnStartOffsets(source, turns);\n  const exact = findQuoteAnchors(quote, source, bounds);\n  if (exact.length > 0 || transformQuote === undefined) return exact;\n  return findQuoteAnchors(transformQuote(quote), source, bounds);\n}\n\nexport function tokenPool(tokens: ReadonlySet<string>): TokenPool {\n  const list = [...tokens];\n  return (token) => tokens.has(token) || list.some((poolToken) => areGroundingTokensCompatible(token, poolToken));\n}\n\nfunction hasNegation(text: string): boolean {\n  return NEGATOR_PATTERN.test(text.replace(/[\\u2018\\u2019]/gu, \"'\")) || hasDenialReporting(text);\n}\n\nconst CLAUSE_PATTERN = /[^;.!?\\n]+[;.!?]*/gu;\n/** Split \"X, and Y\" claim coordination without touching list commas. */\nconst CLAIM_COORD_SPLIT = /,\\s{1,8}(?:and|but|or|nor)\\s{1,8}/iu;\n\nfunction splitClaimClauses(content: string): string[] {\n  return (content.match(CLAUSE_PATTERN) ?? [content]).flatMap((clause) => {\n    const parts = clause\n      .split(CLAIM_COORD_SPLIT)\n      .map((part) => part.trim())\n      .filter((part) => part.length > 0);\n    return parts.length > 0 ? parts : [clause];\n  });\n}\n\nfunction clauseOverlap(clauseTokens: readonly string[], target: string) {\n  const has = tokenPool(tokenize(target));\n  const shared = clauseTokens.filter(has).length;\n  return { shared, ratio: clauseTokens.length === 0 ? 0 : shared / clauseTokens.length };\n}\n\n/** What a quote clause's first negator governs: the words after it. */\nfunction negatedScope(clause: string): string {\n  const match = NEGATOR_PATTERN.exec(clause.replace(/[\\u2018\\u2019]/gu, \"'\"));\n  return match ? clause.slice(match.index + match[0].length) : clause;\n}\n\n/** The words before a clause's first negator, empty when it has none. */\nfunction textBeforeNegator(clause: string): string {\n  const match = NEGATOR_PATTERN.exec(clause.replace(/[\\u2018\\u2019]/gu, \"'\"));\n  return match ? clause.slice(0, match.index) : \"\";\n}\n\n/**\n * True when the claim asserts what a quote clause denies or does not assert.\n * A quote denial is kept only by a claim clause that shares what the negator\n * governs and does not name a different subject, so a negator about Bob does\n * not keep a denial about Alice. A clause that names no subject of its own\n * still counts, which keeps a pronoun clause and a subject-less passive. A\n * quote clause with no subject of its own keeps the clause-level check.\n */\nfunction misstatesQuote(content: string, quote: string): boolean {\n  const claimClauses = splitClaimClauses(content);\n  return (quote.match(CLAUSE_PATTERN) ?? []).some((quoteClause) => {\n    const needsNegation = hasNegation(quoteClause);\n    const needsReporting = quoteClause.trim().endsWith(\"?\") || hasNonAssertiveReporting(quoteClause);\n    if (!needsNegation && !needsReporting) return false;\n    const clauseTokens = [...tokenize(quoteClause)];\n    const whole = clauseOverlap(clauseTokens, content);\n    if (whole.shared < GROUNDING_MIN_SHARED_TOKENS || whole.ratio < 0.5) return false;\n    const clausesSharing = (tokens: readonly string[]) =>\n      claimClauses.filter((claimClause) => clauseOverlap(tokens, claimClause).shared > 0);\n    if (needsNegation) {\n      const scopeTokens = [...tokenize(negatedScope(quoteClause))];\n      const subjectTokens = [...tokenize(textBeforeNegator(quoteClause))];\n      const scopeHas = new Set(scopeTokens);\n      const related = clausesSharing(scopeTokens.length > 0 ? scopeTokens : clauseTokens);\n      const keepsDenial = related.some((text) => {\n        if (!hasNegation(text) && !EXCLUSION_PATTERN.test(text)) return false;\n        if (subjectTokens.length === 0 || clauseOverlap(subjectTokens, text).shared > 0) return true;\n        const ownSubject = [...tokenize(textBeforeNegator(text))].filter((token) => !scopeHas.has(token));\n        return ownSubject.length === 0;\n      });\n      if (!keepsDenial) return true;\n    }\n    return needsReporting\n      && !clausesSharing(clauseTokens).some((text) => hasNonAssertiveReporting(text) || text.trim().endsWith(\"?\"));\n  });\n}\n\n/**\n * A claim is supported by a verbatim quote when it shares at least\n * GROUNDING_MIN_SHARED_TOKENS content words with the quote, a good part of its\n * words sit in the text around the quote, nearly all of them occur in the\n * source at all, and it does not invert a negated clause of the quote. Reworded\n * and lightly elaborated claims pass; claims that bring words the conversation\n * never used, or that have nothing to do with the quote, do not.\n */\nexport function isQuoteAnchoredClaim(content: string, anchor: QuoteAnchor, sourceHas: TokenPool): boolean {\n  const contentTokens = [...tokenize(content)];\n  if (contentTokens.length === 0) return false;\n  const quoteHas = tokenPool(tokenize(anchor.quote));\n  if (contentTokens.filter(quoteHas).length < GROUNDING_MIN_SHARED_TOKENS) return false;\n  const windowHas = tokenPool(tokenize(anchor.window));\n  if (contentTokens.filter(windowHas).length / contentTokens.length < QUOTE_ANCHOR_MIN_WINDOW_COVERAGE) {\n    return false;\n  }\n  return contentTokens.filter(sourceHas).length / contentTokens.length >= QUOTE_ANCHOR_MIN_SOURCE_COVERAGE\n    && !misstatesQuote(content, anchor.quote);\n}\n\n/** Keeps the entity facts (flat and sectioned) `isSupported` accepts; undefined when none remain. */\nexport function filterEntityFacts(entity: Entity, isSupported: (fact: string) => boolean): Entity | undefined {\n  const facts = entity.facts.filter(isSupported);\n  const structuredSections = entity.structuredSections?.flatMap((section) => {\n    const groundedFacts = section.facts.filter(isSupported);\n    return groundedFacts.length > 0 ? [{ ...section, facts: groundedFacts }] : [];\n  });\n  if (facts.length === 0 && (structuredSections === undefined || structuredSections.length === 0)) {\n    return undefined;\n  }\n  const { structuredSections: _structuredSections, ...entityWithoutSections } = entity;\n  return {\n    ...entityWithoutSections,\n    facts,\n    ...(structuredSections && structuredSections.length > 0 ? { structuredSections } : {}),\n  };\n}\n\n/**\n * Entities carry no quote of their own; the anchors of facts that kept support\n * them. Returns a fact predicate, or undefined when no anchor window names the entity.\n */\nexport function quoteAnchoredEntitySupport(\n  entity: Entity,\n  anchors: readonly QuoteAnchor[],\n  sourceHas: TokenPool,\n): ((fact: string) => boolean) | undefined {\n  const nameAnchors = anchors.filter((anchor) => isGroundedEntityName(entity.name, anchor.window));\n  if (nameAnchors.length === 0) return undefined;\n  return (fact) => nameAnchors.some((anchor) => isQuoteAnchoredClaim(fact, anchor, sourceHas));\n}\n\n/**\n * The label words and both names must sit in one anchor-window sentence, source\n * before target, so an invented label or a reversed edge never passes.\n */\nexport function isQuoteAnchoredRelationship(\n  relationship: Relationship,\n  anchors: readonly QuoteAnchor[],\n  sourceHas: TokenPool,\n): boolean {\n  const labelTokens = [...tokenize(relationship.label)];\n  if (labelTokens.length === 0) return false;\n  const relationText = [\n    normalizedEntityIdentifierTokens(relationship.source).join(\" \"),\n    relationship.label,\n    normalizedEntityIdentifierTokens(relationship.target).join(\" \"),\n  ].join(\" \");\n  return anchors.some((anchor) => {\n    const windowHas = tokenPool(tokenize(anchor.window));\n    return labelTokens.every(windowHas)\n      && sourceSentences(anchor.window).some((sentence) => {\n        const sourceStart = entityNameStart(relationship.source, sentence);\n        return sourceStart >= 0 && entityNameStart(relationship.target, sentence) > sourceStart;\n      })\n      && isQuoteAnchoredClaim(relationText, anchor, sourceHas);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAwBO,IAAM,yBAAyB;AAE/B,IAAM,6BAA6B;AAEnC,IAAM,mCAAmC;AAEzC,IAAM,mCAAmC;AAChD,IAAM,+BAA+B;AACrC,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,oBACJ;AAeF,SAAS,2BAA2B,QAA2D;AAC7F,QAAM,QAAkB,CAAC;AACzB,QAAM,gBAA0B,CAAC;AACjC,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACrD,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,MAAM,KAAK,IAAI,GAAG;AACpB,UAAI,QAAS;AACb,gBAAU;AACV,YAAM,KAAK,GAAG;AAAA,IAChB,OAAO;AACL,gBAAU;AACV,YAAM,KAAK,IAAI;AAAA,IACjB;AACA,kBAAc,KAAK,KAAK;AAAA,EAC1B;AACA,SAAO,EAAE,MAAM,MAAM,KAAK,EAAE,GAAG,cAAc;AAC/C;AAEA,SAAS,iBAAiB,QAAgB,OAAyD;AACjG,QAAM,UAAoB,CAAC;AAC3B,MAAI,KAAK;AACT,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,OAAO,WAAW,MAAM,EAAE,EAAG,QAAO;AACzC,YAAQ,KAAK,EAAE;AACf,UAAM,KAAK,SAAS,eAAe;AAAA,EACrC;AACA,SAAO,KAAK,eAAe,WAAW,OAAO,SAAS,UAAU;AAClE;AAEA,SAAS,iBAAiB,OAAe,QAAgB,QAA2C;AAClG,QAAM,SAAS,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AAChD,MAAI,OAAO,SAAS,uBAAwB,QAAO,CAAC;AACpD,QAAM,aAAa,2BAA2B,MAAM;AACpD,QAAM,UAAyB,CAAC;AAChC,MAAI,OAAO;AACX,SAAO,QAAQ,SAAS,8BAA8B;AACpD,UAAM,KAAK,WAAW,KAAK,QAAQ,QAAQ,IAAI;AAC/C,QAAI,KAAK,EAAG;AACZ,WAAO,KAAK;AACZ,UAAM,QAAQ,WAAW,cAAc,EAAE;AACzC,UAAM,MAAM,WAAW,cAAc,KAAK,OAAO,SAAS,CAAC,IAAK;AAEhE,QAAI;AACJ,QAAI;AACJ,QAAI,WAAW,QAAW;AACxB,UAAI,OAAO,MAAM,OAAO,GAAG,EAAE,SAAS,cAAc,EAAG;AACvD,eAAS,OAAO,MAAM,KAAK,IAAI,GAAG,QAAQ,0BAA0B,GAAG,KAAK;AAC5E,YAAM,YAAY,OAAO,YAAY,cAAc;AACnD,UAAI,aAAa,EAAG,UAAS,OAAO,MAAM,YAAY,eAAe,MAAM;AAAA,eAClE,QAAQ,2BAA4B,UAAS,OAAO,QAAQ,SAAS,EAAE;AAChF,cAAQ,OAAO,MAAM,KAAK,MAAM,0BAA0B;AAC1D,YAAM,WAAW,MAAM,QAAQ,cAAc;AAC7C,UAAI,YAAY,EAAG,SAAQ,MAAM,MAAM,GAAG,QAAQ;AAAA,eACzC,OAAO,SAAS,MAAM,2BAA4B,SAAQ,MAAM,QAAQ,SAAS,EAAE;AAAA,IAC9F,OAAO;AACL,UAAI,YAAY;AAChB,UAAI,UAAU,OAAO;AACrB,iBAAW,SAAS,QAAQ;AAC1B,YAAI,SAAS,MAAO,aAAY;AAAA,aAC3B;AACH,oBAAU,QAAQ,eAAe;AACjC;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,IAAK;AACnB,eAAS,OAAO,MAAM,KAAK,IAAI,WAAW,QAAQ,0BAA0B,GAAG,KAAK;AACpF,UAAI,QAAQ,6BAA6B,UAAW,UAAS,OAAO,QAAQ,SAAS,EAAE;AACvF,YAAM,aAAa,KAAK,IAAI,SAAS,MAAM,0BAA0B;AACrE,cAAQ,OAAO,MAAM,KAAK,UAAU;AACpC,UAAI,MAAM,6BAA6B,QAAS,SAAQ,MAAM,QAAQ,SAAS,EAAE;AAAA,IACnF;AAEA,YAAQ,KAAK,EAAE,OAAO,QAAQ,QAAQ,GAAG,MAAM,GAAG,OAAO,QAAQ,OAAO,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAoBO,SAAS,aACd,OACA,QACA,gBACA,OACe;AACf,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,SAAS,UAAU,SAAY,SAAY,iBAAiB,QAAQ,KAAK;AAC/E,QAAM,QAAQ,iBAAiB,OAAO,QAAQ,MAAM;AACpD,MAAI,MAAM,SAAS,KAAK,mBAAmB,OAAW,QAAO;AAC7D,SAAO,iBAAiB,eAAe,KAAK,GAAG,QAAQ,MAAM;AAC/D;AAEO,SAAS,UAAU,QAAwC;AAChE,QAAM,OAAO,CAAC,GAAG,MAAM;AACvB,SAAO,CAAC,UAAU,OAAO,IAAI,KAAK,KAAK,KAAK,KAAK,CAAC,cAAc,6BAA6B,OAAO,SAAS,CAAC;AAChH;AAEA,SAAS,YAAY,MAAuB;AAC1C,SAAO,gBAAgB,KAAK,KAAK,QAAQ,oBAAoB,GAAG,CAAC,KAAK,mBAAmB,IAAI;AAC/F;AAEA,IAAM,iBAAiB;AAEvB,IAAM,oBAAoB;AAE1B,SAAS,kBAAkB,SAA2B;AACpD,UAAQ,QAAQ,MAAM,cAAc,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,WAAW;AACtE,UAAM,QAAQ,OACX,MAAM,iBAAiB,EACvB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACnC,WAAO,MAAM,SAAS,IAAI,QAAQ,CAAC,MAAM;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,cAAc,cAAiC,QAAgB;AACtE,QAAM,MAAM,UAAU,SAAS,MAAM,CAAC;AACtC,QAAM,SAAS,aAAa,OAAO,GAAG,EAAE;AACxC,SAAO,EAAE,QAAQ,OAAO,aAAa,WAAW,IAAI,IAAI,SAAS,aAAa,OAAO;AACvF;AAGA,SAAS,aAAa,QAAwB;AAC5C,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,oBAAoB,GAAG,CAAC;AAC1E,SAAO,QAAQ,OAAO,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE,MAAM,IAAI;AAC/D;AAGA,SAAS,kBAAkB,QAAwB;AACjD,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,oBAAoB,GAAG,CAAC;AAC1E,SAAO,QAAQ,OAAO,MAAM,GAAG,MAAM,KAAK,IAAI;AAChD;AAUA,SAAS,eAAe,SAAiB,OAAwB;AAC/D,QAAM,eAAe,kBAAkB,OAAO;AAC9C,UAAQ,MAAM,MAAM,cAAc,KAAK,CAAC,GAAG,KAAK,CAAC,gBAAgB;AAC/D,UAAM,gBAAgB,YAAY,WAAW;AAC7C,UAAM,iBAAiB,YAAY,KAAK,EAAE,SAAS,GAAG,KAAK,yBAAyB,WAAW;AAC/F,QAAI,CAAC,iBAAiB,CAAC,eAAgB,QAAO;AAC9C,UAAM,eAAe,CAAC,GAAG,SAAS,WAAW,CAAC;AAC9C,UAAM,QAAQ,cAAc,cAAc,OAAO;AACjD,QAAI,MAAM,SAAS,+BAA+B,MAAM,QAAQ,IAAK,QAAO;AAC5E,UAAM,iBAAiB,CAAC,WACtB,aAAa,OAAO,CAAC,gBAAgB,cAAc,QAAQ,WAAW,EAAE,SAAS,CAAC;AACpF,QAAI,eAAe;AACjB,YAAM,cAAc,CAAC,GAAG,SAAS,aAAa,WAAW,CAAC,CAAC;AAC3D,YAAM,gBAAgB,CAAC,GAAG,SAAS,kBAAkB,WAAW,CAAC,CAAC;AAClE,YAAM,WAAW,IAAI,IAAI,WAAW;AACpC,YAAM,UAAU,eAAe,YAAY,SAAS,IAAI,cAAc,YAAY;AAClF,YAAM,cAAc,QAAQ,KAAK,CAAC,SAAS;AACzC,YAAI,CAAC,YAAY,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAG,QAAO;AAChE,YAAI,cAAc,WAAW,KAAK,cAAc,eAAe,IAAI,EAAE,SAAS,EAAG,QAAO;AACxF,cAAM,aAAa,CAAC,GAAG,SAAS,kBAAkB,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;AAChG,eAAO,WAAW,WAAW;AAAA,MAC/B,CAAC;AACD,UAAI,CAAC,YAAa,QAAO;AAAA,IAC3B;AACA,WAAO,kBACF,CAAC,eAAe,YAAY,EAAE,KAAK,CAAC,SAAS,yBAAyB,IAAI,KAAK,KAAK,KAAK,EAAE,SAAS,GAAG,CAAC;AAAA,EAC/G,CAAC;AACH;AAUO,SAAS,qBAAqB,SAAiB,QAAqB,WAA+B;AACxG,QAAM,gBAAgB,CAAC,GAAG,SAAS,OAAO,CAAC;AAC3C,MAAI,cAAc,WAAW,EAAG,QAAO;AACvC,QAAM,WAAW,UAAU,SAAS,OAAO,KAAK,CAAC;AACjD,MAAI,cAAc,OAAO,QAAQ,EAAE,SAAS,4BAA6B,QAAO;AAChF,QAAM,YAAY,UAAU,SAAS,OAAO,MAAM,CAAC;AACnD,MAAI,cAAc,OAAO,SAAS,EAAE,SAAS,cAAc,SAAS,kCAAkC;AACpG,WAAO;AAAA,EACT;AACA,SAAO,cAAc,OAAO,SAAS,EAAE,SAAS,cAAc,UAAU,oCACnE,CAAC,eAAe,SAAS,OAAO,KAAK;AAC5C;AAGO,SAAS,kBAAkB,QAAgB,aAA4D;AAC5G,QAAM,QAAQ,OAAO,MAAM,OAAO,WAAW;AAC7C,QAAM,qBAAqB,OAAO,oBAAoB,QAAQ,CAAC,YAAY;AACzE,UAAM,gBAAgB,QAAQ,MAAM,OAAO,WAAW;AACtD,WAAO,cAAc,SAAS,IAAI,CAAC,EAAE,GAAG,SAAS,OAAO,cAAc,CAAC,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,MAAM,WAAW,MAAM,uBAAuB,UAAa,mBAAmB,WAAW,IAAI;AAC/F,WAAO;AAAA,EACT;AACA,QAAM,EAAE,oBAAoB,qBAAqB,GAAG,sBAAsB,IAAI;AAC9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,sBAAsB,mBAAmB,SAAS,IAAI,EAAE,mBAAmB,IAAI,CAAC;AAAA,EACtF;AACF;AAMO,SAAS,2BACd,QACA,SACA,WACyC;AACzC,QAAM,cAAc,QAAQ,OAAO,CAAC,WAAW,qBAAqB,OAAO,MAAM,OAAO,MAAM,CAAC;AAC/F,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,SAAO,CAAC,SAAS,YAAY,KAAK,CAAC,WAAW,qBAAqB,MAAM,QAAQ,SAAS,CAAC;AAC7F;AAMO,SAAS,4BACd,cACA,SACA,WACS;AACT,QAAM,cAAc,CAAC,GAAG,SAAS,aAAa,KAAK,CAAC;AACpD,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,eAAe;AAAA,IACnB,iCAAiC,aAAa,MAAM,EAAE,KAAK,GAAG;AAAA,IAC9D,aAAa;AAAA,IACb,iCAAiC,aAAa,MAAM,EAAE,KAAK,GAAG;AAAA,EAChE,EAAE,KAAK,GAAG;AACV,SAAO,QAAQ,KAAK,CAAC,WAAW;AAC9B,UAAM,YAAY,UAAU,SAAS,OAAO,MAAM,CAAC;AACnD,WAAO,YAAY,MAAM,SAAS,KAC7B,gBAAgB,OAAO,MAAM,EAAE,KAAK,CAAC,aAAa;AACnD,YAAM,cAAc,gBAAgB,aAAa,QAAQ,QAAQ;AACjE,aAAO,eAAe,KAAK,gBAAgB,aAAa,QAAQ,QAAQ,IAAI;AAAA,IAC9E,CAAC,KACE,qBAAqB,cAAc,QAAQ,SAAS;AAAA,EAC3D,CAAC;AACH;","names":[]}

package/dist/{chunk-ZU5JDLOH.js → chunk-MMRTPH3J.js}

@@ -26,7 +26,7 @@ import {
   readGatewayWorkspaceDir,
   tryCodexSubscriptionProvider,
   withCodexRuntimeShutdown
-} from "./chunk-ZU3NJNO7.js";
+} from "./chunk-QSF5SJAM.js";
 import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
@@ -843,4 +843,4 @@ export {
   gatewayTaskChainOptions,
   FallbackLlmClient
 };
-//# sourceMappingURL=chunk-ZU5JDLOH.js.map
+//# sourceMappingURL=chunk-MMRTPH3J.js.map

package/dist/{chunk-ZZ67UTQX.js → chunk-MUX7IL77.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-WWK6J6SE.js";
+} from "./chunk-WQURALGV.js";
 import {
   OKF_PROFILE_TYPE,
   okfTypeForMemory
@@ -272,4 +272,4 @@ export {
   exportOkfBundle,
   firstHeading
 };
-//# sourceMappingURL=chunk-ZZ67UTQX.js.map
+//# sourceMappingURL=chunk-MUX7IL77.js.map

package/dist/{chunk-RYWROSL5.js → chunk-NAQ4A5IX.js}

@@ -1,16 +1,16 @@
 import {
   toBackupStamp
 } from "./chunk-KJTKLXTH.js";
-import {
-  loadPersistedNativeKnowledgeChunks
-} from "./chunk-2DQ2XREU.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-LJQFJF4J.js";
+} from "./chunk-RM2YUFH6.js";
+import {
+  loadPersistedNativeKnowledgeChunks
+} from "./chunk-2DQ2XREU.js";
 import {
   StorageManager
-} from "./chunk-WWK6J6SE.js";
+} from "./chunk-WQURALGV.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -45,7 +45,7 @@ import {
 } from "./chunk-RL6NEVXT.js";
 import {
   isSupportPassportPrivateMemory
-} from "./chunk-YCNIGRRF.js";
+} from "./chunk-NS7U4ZYU.js";
 import {
   commitPreparedFileAtomically
 } from "./chunk-BTNNL7ZW.js";
@@ -1156,4 +1156,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-RYWROSL5.js.map
+//# sourceMappingURL=chunk-NAQ4A5IX.js.map

package/dist/{chunk-TVIVY7KU.js → chunk-NED7IR7B.js}

@@ -5,13 +5,13 @@ import {
 import {
   unifiedDedupeAndRank
 } from "./chunk-LUPVCGYK.js";
-import {
-  buildEvidencePack
-} from "./chunk-DGFU5MSX.js";
 import {
   lcmArchiveRowId,
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
+import {
+  buildEvidencePack
+} from "./chunk-DGFU5MSX.js";
 
 // src/explicit-cue-recall.ts
 var DEFAULT_MAX_CHARS = 2400;
@@ -4258,4 +4258,4 @@ export {
   collectStructuredPlanCues,
   collectTemporalLexicalCues
 };
-//# sourceMappingURL=chunk-TVIVY7KU.js.map
+//# sourceMappingURL=chunk-NED7IR7B.js.map

package/dist/{chunk-ADYP7HXE.js → chunk-NHVAX7MH.js}

@@ -1,10 +1,10 @@
 import {
   parseXrayFormat
-} from "./chunk-EWJZZDRG.js";
+} from "./chunk-R4BBGPI2.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-V4XE263I.js";
+} from "./chunk-43AA5FVD.js";
 
 // src/recall-xray-cli.ts
 function parseXrayDisclosureFlag(value) {
@@ -50,4 +50,4 @@ export {
   parseXrayBudgetFlag,
   parseXrayCliOptions
 };
-//# sourceMappingURL=chunk-ADYP7HXE.js.map
+//# sourceMappingURL=chunk-NHVAX7MH.js.map

package/dist/{chunk-TG3R2SID.js → chunk-NMGHGTVR.js}

@@ -3,10 +3,7 @@ import {
 } from "./chunk-QV2VZKD5.js";
 import {
   createVersion
-} from "./chunk-ER7XANP3.js";
-import {
-  bumpMemoryCorpusVersionForDir
-} from "./chunk-M5GVCJSJ.js";
+} from "./chunk-SQ3GEIEL.js";
 import {
   HistoricalEntityCanonicalIdCache,
   canonicalizeEntityRefFrontmatter,
@@ -16,6 +13,9 @@ import {
   requestEntityCanonicalIdReconcile,
   withRawEntityPageMutation
 } from "./chunk-IAYUTGF2.js";
+import {
+  bumpMemoryCorpusVersionForDir
+} from "./chunk-M5GVCJSJ.js";
 import {
   parseExportBundle
 } from "./chunk-WEHSQBFR.js";
@@ -296,4 +296,4 @@ function mintForkId(capsuleId, originalId, now) {
 export {
   importCapsule
 };
-//# sourceMappingURL=chunk-TG3R2SID.js.map
+//# sourceMappingURL=chunk-NMGHGTVR.js.map