@remnic/core 9.69.86 → 9.69.88

package/dist/chunk-K6T33R4Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/offline-sync-embedding-generation.ts"],"sourcesContent":["// Embedding-index generation semantics for offline sync (issue #3146, PR\n// #3148). Extracted from offline-sync.ts so the god-file line-count ratchet\n// does not grow when the rules gain behavior. The snapshot walker treats\n// every `state/embeddings/` shard set — or a legacy `state/embeddings.json`\n// marker — as ONE generation, in both directions:\n//\n//   1. Atomic replacement (apply side): an incoming generation is staged\n//      complete, verified byte-for-byte, and published through the store's\n//      single backup-swap state machine. A crash or write failure can never\n//      leave a mix of the local and incoming generation on disk, and a\n//      local-only shard of a replaced generation is removed by the swap, not\n//      merged into the incoming set.\n//   2. Filter-to-omit, never filter-to-delete (push side): when an exclusion\n//      filter removes ANY member of a local generation from a push, the\n//      WHOLE generation is omitted — files and deletion metadata — and the\n//      receiver keeps its copy. A filtered generation must never look\n//      deleted, and a partially filtered snapshot must never look like a\n//      complete generation.\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { lstat, mkdir, readFile, readdir, rm, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport {\n  type EmbeddingIndexFile,\n  EmbeddingIndexFileStore,\n  type EmbeddingIndexIdentity,\n  type EmbeddingIndexStoreIo,\n  EmbeddingIndexStorageError,\n  parseEmbeddingIndexDocument,\n  serializeEmbeddingShard,\n  shardEntriesForIndex,\n  validateShardMembership,\n} from \"./embedding-index-storage.js\";\nimport {\n  assertEmbeddingGenerationLockHeld,\n  type EmbeddingGenerationFence,\n  embeddingGenerationLockPath,\n  withEmbeddingGenerationLock,\n} from \"./embedding-generation-lock.js\";\nimport type { OfflineSyncExcludeFile, OfflineSyncFileTarget } from \"./offline-sync-file-io.js\";\nimport { EMBEDDING_SHARD_FILE_PATTERN } from \"./offline-sync-runtime-state.js\";\nimport { log } from \"./logger.js\";\nimport type {\n  OfflineSyncFileDeleteTarget,\n  OfflineSyncFileStagingReadTarget,\n  OfflineSyncFileStagingWriteTarget,\n  OfflineSyncFileState,\n} from \"./offline-sync.js\";\nimport { type SafeArchiveRoot, resolveSafeArchiveTarget } from \"./transfer/fs-utils.js\";\n\nconst EMBEDDING_MARKER_BASENAME = \"embeddings.json\";\nexport const EMBEDDING_SHARD_DIR_BASENAME = \"embeddings\";\n\n/**\n * Canonical `state` dir prefix (\"state\" or \"namespaces/<ns>/state\") for a\n * path's segments, or null when the path is not canonical runtime state.\n */\nfunction canonicalStateDirPrefix(parts: string[]): string | null {\n  if (parts[0] === \"state\") return \"state\";\n  if (parts[0] === \"namespaces\" && parts.length >= 4 && parts[2] === \"state\") {\n    return `namespaces/${parts[1]}/state`;\n  }\n  return null;\n}\n\n/** The sharded-generation directory when `relPath` is one of its shards. */\nexport function embeddingShardDirOf(relPath: string): string | null {\n  const parts = relPath.split(\"/\");\n  if (parts.length < 3) return null;\n  if (!EMBEDDING_SHARD_FILE_PATTERN.test(parts[parts.length - 1] ?? \"\")) return null;\n  if (parts[parts.length - 2] !== EMBEDDING_SHARD_DIR_BASENAME) return null;\n  if (canonicalStateDirPrefix(parts) === null) return null;\n  return parts.slice(0, -1).join(\"/\");\n}\n\n/**\n * True when `dirPath` is a canonical embeddings generation dir\n * (`state/embeddings` or `namespaces/<ns>/state/embeddings`). Encodes the\n * snapshot-field shape contract without a ReDoS-shaped literal (issue #2439).\n */\nexport function isEmbeddingGenerationDirPath(dirPath: string): boolean {\n  const membership = embeddingGenerationMembership(`${dirPath}/shard-0000.json`);\n  return membership !== null && membership.shardDir === dirPath;\n}\n\n/** The state dir when `relPath` is the legacy single-file marker. */\nexport function embeddingMarkerDirOf(relPath: string): string | null {\n  const parts = relPath.split(\"/\");\n  if ((parts[parts.length - 1] ?? \"\") !== EMBEDDING_MARKER_BASENAME) return null;\n  if (canonicalStateDirPrefix(parts) === null) return null;\n  return parts.slice(0, -1).join(\"/\");\n}\n\n/**\n * Membership of `relPath` in an embedding generation: shards belong to their\n * `.../embeddings` directory, the legacy marker belongs to the sibling\n * `.../embeddings` directory of its state dir.\n */\nexport function embeddingGenerationMembership(relPath: string): { kind: \"shard\" | \"marker\"; shardDir: string } | null {\n  const shardDir = embeddingShardDirOf(relPath);\n  if (shardDir) return { kind: \"shard\", shardDir };\n  const markerDir = embeddingMarkerDirOf(relPath);\n  if (markerDir) return { kind: \"marker\", shardDir: `${markerDir}/${EMBEDDING_SHARD_DIR_BASENAME}` };\n  return null;\n}\n\nexport interface IncomingEmbeddingGenerations {\n  /** Generation dirs with at least one incoming shard. */\n  shardDirs: Set<string>;\n  /** State dirs whose incoming snapshot carries the legacy marker. */\n  legacyMarkerDirs: Set<string>;\n}\n\n/** Classify incoming snapshot paths into embedding generations. */\nexport function detectIncomingEmbeddingGenerations(incomingPaths: Iterable<string>): IncomingEmbeddingGenerations {\n  const shardDirs = new Set<string>();\n  const legacyMarkerDirs = new Set<string>();\n  for (const relPath of incomingPaths) {\n    const membership = embeddingGenerationMembership(relPath);\n    if (!membership) continue;\n    if (membership.kind === \"shard\") shardDirs.add(membership.shardDir);\n    else legacyMarkerDirs.add(membership.shardDir);\n  }\n  return { shardDirs, legacyMarkerDirs };\n}\n\nfunction shardRelPath(shardDirRel: string, shardIndex: number): string {\n  return `${shardDirRel}/shard-${String(shardIndex).padStart(4, \"0\")}.json`;\n}\n\nfunction describeIndexReadFailure(\n  read: { outcome: \"absent\" } | { outcome: \"foreign\" } | { outcome: \"unreadable\"; reason: string }\n): string {\n  if (read.outcome === \"unreadable\") return read.reason;\n  if (read.outcome === \"foreign\") return \"unrecognized index format\";\n  return \"generation document is absent\";\n}\n\nfunction sha256Hex(buffer: Buffer): string {\n  return createHash(\"sha256\").update(buffer).digest(\"hex\");\n}\n\nasync function pathExists(absPath: string): Promise<boolean> {\n  try {\n    await lstat(absPath);\n    return true;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n}\n\nexport interface EmbeddingGenerationTransactionIo {\n  /** Storage-backed local read: hydrates unchanged shards (metadata-only\n   * pulls skip their content) and decrypts secure-store files. */\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n  writeStagingFile?: (target: OfflineSyncFileStagingWriteTarget) => Promise<void>;\n  readStagingFile?: (target: OfflineSyncFileStagingReadTarget) => Promise<Buffer>;\n  deleteFile?: (target: OfflineSyncFileDeleteTarget) => Promise<void>;\n}\n\nexport interface EmbeddingGenerationTransactionInput {\n  root: SafeArchiveRoot;\n  /** The generation dir, e.g. `state/embeddings`. */\n  shardDirRel: string;\n  /** Incoming shard rel paths — the complete incoming sharded generation. */\n  incomingShardPaths: string[];\n  /** Incoming legacy marker (rel path + verified content), when the\n   * incoming generation is legacy-layout. Mutually exclusive with\n   * `incomingShardPaths`. */\n  incomingMarker: { path: string; sha256: string; buffer: Buffer | null } | null;\n  /** True when the incoming snapshot ALSO carries the legacy marker while\n   * shards form the generation (mixed remote): the per-file loop then writes\n   * the marker as the inert remote artifact, so this transaction must NOT\n   * remove a local marker. */\n  incomingMarkerPresent: boolean;\n  /** Incoming shard records (sha256 for local hydration of unchanged\n   * metadata-only pulls). */\n  incomingShardStates: ReadonlyMap<string, OfflineSyncFileState>;\n  /** Verified incoming content by rel path (absent for shards the metadata\n   * hydration skipped because the local hash already matches). */\n  incomingBuffers: ReadonlyMap<string, Buffer>;\n  /**\n   * Shared-base states (pre-census): lets the transaction re-evaluate\n   * divergence against ACTUAL disk contents while holding the mutation\n   * lock, instead of trusting the census taken before the lock\n   * (codex P1: a daemon mutation between census and lock was discarded).\n   */\n  baseStates?: ReadonlyMap<string, { sha256: string }>;\n  io: EmbeddingGenerationTransactionIo;\n  now: number;\n}\n\nexport interface EmbeddingGenerationTransactionResult {\n  shardDirRel: string;\n  upserted: number;\n  deleted: number;\n  /** nextBase states for files the transaction published. */\n  writtenStates: Map<string, OfflineSyncFileState>;\n  /** nextBase paths the transaction removed (stale shards, demoted marker). */\n  removedPaths: Set<string>;\n  /** Paths the per-file apply loop must skip — all handled here. */\n  handledPaths: Set<string>;\n  /** True when the generation was deferred (not published) because the disk\n   * diverged from the shared base while the lock was held. */\n  deferredLocalDivergence?: boolean;\n}\n\n/**\n * Content for ONE incoming generation member: the verified incoming buffer,\n * or the LOCAL file hash-verified against the incoming record (metadata-only\n * pulls skip content whose local hash already matches — the local bytes ARE\n * the incoming content). Shared by the shard and legacy-marker branches.\n */\nasync function hydratedIncomingBuffer(\n  io: EmbeddingGenerationTransactionIo,\n  root: SafeArchiveRoot,\n  relPath: string,\n  expectedSha256: string,\n  incoming: Buffer | null | undefined,\n): Promise<Buffer> {\n  if (incoming) return incoming;\n  const filePath = await resolveSafeArchiveTarget(root, relPath);\n  const local = io.readFile\n    ? await io.readFile({ root: root.abs, path: relPath, filePath })\n    : await readFile(filePath);\n  if (sha256Hex(local) !== expectedSha256) {\n    throw new EmbeddingIndexStorageError(\n      `cannot hydrate unchanged embedding index file ${relPath}: local digest does not match the incoming record; local generation preserved`,\n    );\n  }\n  return local;\n}\n\n/**\n * Apply ONE incoming embedding generation atomically (issue #3148, round 4):\n * recover an interrupted replacement, validate the complete incoming\n * generation (legacy markers are converted to the sharded layout so the\n * one-way layout is preserved), stage it, verify the staged bytes, then\n * publish through the shared backup-swap. Any failure before the swap leaves\n * the local generation untouched; a crash in the swap gap is rolled back by\n * the store's recovery on next use.\n */\n/**\n * Enumerate and hash the ACTUAL local generation on disk (legacy marker +\n * every shard) through the configured secure IO — the fresh in-lock census\n * the stale pre-lock apply census cannot be trusted for (codex P1).\n */\n/** Scope the shared vault base to this physical embedding generation. */\nfunction baseStatesForGeneration(\n  base: ReadonlyMap<string, { sha256: string }> | undefined,\n  shardDirRel: string,\n): Map<string, { sha256: string }> {\n  return new Map([...base ?? []].filter(([relPath]) => embeddingGenerationMembership(relPath)?.shardDir === shardDirRel));\n}\n\nasync function censusGenerationState(\n  io: EmbeddingGenerationTransactionIo,\n  root: SafeArchiveRoot,\n  markerRel: string,\n  markerAbs: string,\n  shardDirAbs: string,\n  shardDirRel: string,\n): Promise<Map<string, string>> {\n  const census = new Map<string, string>();\n  const readSha = async (relPath: string, filePath: string) =>\n    sha256Hex(io.readFile ? await io.readFile({ root: root.abs, path: relPath, filePath }) : await readFile(filePath));\n  if (await pathExists(markerAbs)) census.set(markerRel, await readSha(markerRel, markerAbs));\n  const names = await readdir(shardDirAbs).catch((err: NodeJS.ErrnoException) => {\n    if (err.code === \"ENOENT\") return [] as string[];\n    throw err;\n  });\n  for (const name of names.filter((candidate) => EMBEDDING_SHARD_FILE_PATTERN.test(candidate)).sort()) {\n    const relPath = `${shardDirRel}/${name}`;\n    census.set(relPath, await readSha(relPath, path.join(shardDirAbs, name)));\n  }\n  return census;\n}\n\n/** Incoming member states for the divergence helper (digests as fallback). */\nfunction incomingGenerationStates(input: EmbeddingGenerationTransactionInput): { path: string; sha256: string }[] {\n  const states = input.incomingShardPaths.map((relPath) => ({\n    path: relPath,\n    sha256: input.incomingShardStates.get(relPath)?.sha256 ?? sha256Hex(input.incomingBuffers.get(relPath) ?? Buffer.alloc(0)),\n  }));\n  if (input.incomingMarker) {\n    states.push({ path: input.incomingMarker.path, sha256: input.incomingMarker.sha256 });\n  }\n  return states;\n}\n\nexport async function applyEmbeddingGenerationTransaction(\n  input: EmbeddingGenerationTransactionInput\n): Promise<EmbeddingGenerationTransactionResult> {\n  const { root, shardDirRel, io } = input;\n  const stateDirRel = shardDirRel.slice(0, -`/${EMBEDDING_SHARD_DIR_BASENAME}`.length);\n  const stateDirAbs = await resolveSafeArchiveTarget(root, stateDirRel);\n  return await withEmbeddingGenerationLock(stateDirAbs, async (section) => {\n    const lockPath = embeddingGenerationLockPath(stateDirAbs);\n    const fence: EmbeddingGenerationFence = () => assertEmbeddingGenerationLockHeld(lockPath, section);\n    const markerRel = `${stateDirRel}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirAbs = await resolveSafeArchiveTarget(root, shardDirRel);\n    const markerAbs = await resolveSafeArchiveTarget(root, markerRel);\n    const store = new EmbeddingIndexFileStore(\n      markerAbs,\n      shardDirAbs,\n      await resolveSafeArchiveTarget(root, `${stateDirRel}/embedding-fallback-status.json`)\n    );\n\n    // 1. Close a pending rename gap (old generation restored) before staging:\n    //    the swap below must never build on a half-replaced generation. The\n    //    fixed backup path is validated first: a planted symlink (or any\n    //    escape) must fail closed instead of being renamed into the published\n    //    position or removed through. The restored target is re-resolved so a\n    //    symlinked restoration cannot slip past the subsequent IO.\n    const backupRel = `${stateDirRel}/embeddings.pre-replace.tmp`;\n    await resolveSafeArchiveTarget(root, backupRel);\n    if (await store.recoverIfInterrupted(fence)) {\n      await resolveSafeArchiveTarget(root, shardDirRel);\n    }\n\n    // Codex P1: the apply census was taken BEFORE this lock, so it may be\n    // stale. Re-enumerate and hash the ACTUAL local generation through the\n    // secure IO and defer the WHOLE generation when the disk no longer\n    // matches the shared base — a concurrent daemon mutation must never be\n    // silently discarded by the swap.\n    // No shared base (fresh catch-up) = no divergence semantics to protect.\n    const baseStates = baseStatesForGeneration(input.baseStates, shardDirRel);\n    if (baseStates.size > 0) {\n      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);\n      const baseArr = [...baseStates].map(([relPath, state]) => ({ path: relPath, sha256: state.sha256 }));\n      const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 }));\n      const deferrals = divergedEmbeddingGenerationDeferrals({\n        incomingFiles: incomingGenerationStates(input),\n        baseFiles: baseArr,\n        currentFiles: censusArr,\n      });\n      const addedOrRemovedSinceBase =\n        censusArr.some((member) => !baseStates.has(member.path)) ||\n        baseArr.some((member) => !localCensus.has(member.path));\n      if (deferrals.length > 0 || addedOrRemovedSinceBase) {\n        const handled = new Set<string>(input.incomingShardPaths);\n        if (input.incomingMarker) handled.add(input.incomingMarker.path);\n        if (input.incomingMarkerPresent) handled.add(markerRel);\n        for (const relPath of localCensus.keys()) handled.add(relPath);\n        log.warn(\n          `embedding generation ${shardDirRel} deferred: disk diverged from the shared base under the mutation lock (${deferrals.length > 0 ? deferrals.join(\", \") : \"generation membership changed since base\"}); nothing published, nothing removed`,\n        );\n        return {\n          shardDirRel,\n          upserted: 0,\n          deleted: 0,\n          writtenStates: new Map<string, OfflineSyncFileState>(),\n          removedPaths: new Set<string>(),\n          handledPaths: handled,\n          deferredLocalDivergence: true,\n        };\n      }\n    }\n\n    const published = new Map<string, Buffer>();\n    let identity: EmbeddingIndexIdentity | null = null;\n  // Divergence re-evaluation happens HERE, under the lock, against real\n  // disk bytes: the apply-side census may already be stale.\n  // 2. Build the complete incoming generation (final rel path → plaintext\n  //    bytes) and validate every document BEFORE touching local state.\n  if (input.incomingMarker) {\n    const markerBuffer = await hydratedIncomingBuffer(\n      io,\n      root,\n      input.incomingMarker.path,\n      input.incomingMarker.sha256,\n      input.incomingMarker.buffer,\n    );\n    const read = parseEmbeddingIndexDocument(markerBuffer.toString(\"utf-8\"));\n    if (read.outcome !== \"ok\") {\n      throw new EmbeddingIndexStorageError(\n        `refusing incoming embedding index generation ${markerRel}: ${describeIndexReadFailure(read)}; local generation preserved`\n      );\n    }\n    identity = { provider: read.file.provider, model: read.file.model };\n    const groups = shardEntriesForIndex(read.file);\n    for (const [shardIndex, entries] of groups) {\n      if (Object.keys(entries).length === 0) continue;\n      published.set(\n        shardRelPath(shardDirRel, shardIndex),\n        Buffer.from(serializeEmbeddingShard(read.file, shardIndex, entries), \"utf-8\")\n      );\n    }\n  } else {\n    for (const relPath of input.incomingShardPaths) {\n      // Metadata-only pulls skip content whose local hash already matches\n      // the incoming record: the LOCAL bytes ARE the incoming content, so\n      // read and hash-verify them instead of failing (codex rounds 5-6).\n      const state = input.incomingShardStates.get(relPath);\n      const buffer = await hydratedIncomingBuffer(\n        io,\n        root,\n        relPath,\n        state?.sha256 ?? \"\",\n        input.incomingBuffers.get(relPath),\n      );\n      const read = parseEmbeddingIndexDocument(buffer.toString(\"utf-8\"));\n      if (read.outcome !== \"ok\") {\n        throw new EmbeddingIndexStorageError(\n          `refusing incoming embedding index shard ${relPath}: ${describeIndexReadFailure(read)}; local generation preserved`\n        );\n      }\n      validateShardMembership(relPath.split(\"/\").pop() ?? \"\", read.file);\n      const shardIdentity = { provider: read.file.provider, model: read.file.model };\n      if (!identity) identity = shardIdentity;\n      if (identity.provider !== shardIdentity.provider || identity.model !== shardIdentity.model) {\n        throw new EmbeddingIndexStorageError(\n          `refusing mixed-identity incoming embedding index generation in ${shardDirRel}: ${relPath} is ${shardIdentity.provider}/${shardIdentity.model} but the generation is ${identity.provider}/${identity.model}; local generation preserved`\n        );\n      }\n      published.set(relPath, buffer);\n    }\n    if (published.size === 0) {\n      throw new EmbeddingIndexStorageError(\n        `incoming embedding index generation ${shardDirRel} is empty; local generation preserved`\n      );\n    }\n  }\n\n    const stagingRel = `${stateDirRel}/embeddings.staging.tmp-sync-${process.pid}-${input.now}-${randomBytes(8).toString(\"hex\")}`;\n    const stagingAbs = await resolveSafeArchiveTarget(root, stagingRel);\n    try {\n      await mkdir(stagingAbs, { recursive: true });\n\n      // 3. Stage the complete generation. With storage-backed IO the staged\n      //    ciphertext binds its FINAL canonical path (`aadRelPath`), so after\n      //    the directory swap it decrypts at the published path — a physical\n      //    staging-path AAD would make the published generation unreadable.\n      for (const [relPath, buffer] of published) {\n        const stagedRel = `${stagingRel}/${path.basename(relPath)}`;\n        const stagedAbs = await resolveSafeArchiveTarget(root, stagedRel);\n        const finalAbs = await resolveSafeArchiveTarget(root, relPath);\n        if (io.writeStagingFile) {\n          await io.writeStagingFile({\n            root: root.abs,\n            path: stagedRel,\n            filePath: stagedAbs,\n            content: buffer,\n            finalAadFilePath: finalAbs,\n          });\n        } else {\n          await writeFile(stagedAbs, buffer, { mode: 0o600 });\n        }\n      }\n\n      // 4. Verify the staged bytes against the incoming content before the\n      //    published generation is touched at all.\n      for (const [relPath, buffer] of published) {\n        const stagedRel = `${stagingRel}/${path.basename(relPath)}`;\n        const stagedAbs = await resolveSafeArchiveTarget(root, stagedRel);\n        const staged = io.readStagingFile\n          ? await io.readStagingFile({\n              root: root.abs,\n              path: stagedRel,\n              filePath: stagedAbs,\n              finalAadFilePath: await resolveSafeArchiveTarget(root, relPath),\n            })\n          : await readFile(stagedAbs);\n        if (!staged.equals(buffer)) {\n          throw new EmbeddingIndexStorageError(\n            `staged embedding index file ${stagedRel} does not match the incoming content; local generation preserved`\n          );\n        }\n      }\n\n      // 5. Publish with the ONE swap state machine shared with persist(). The\n      //    old directory moves aside wholesale, so local shards absent from\n      //    the incoming generation are removed by the swap — never merged.\n      const localShardRels = (\n        await readdir(shardDirAbs).catch((err) => {\n          if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [] as string[];\n          throw err;\n        })\n      )\n        .filter((name) => EMBEDDING_SHARD_FILE_PATTERN.test(name))\n        .map((name) => `${shardDirRel}/${name}`)\n        .sort();\n      await store.publishSwappedGeneration(stagingAbs, fence);\n\n      const writtenStates = new Map<string, OfflineSyncFileState>();\n      for (const [relPath, buffer] of published) {\n        writtenStates.set(relPath, {\n          path: relPath,\n          sha256: sha256Hex(buffer),\n          bytes: buffer.length,\n          mtimeMs: input.now,\n        });\n      }\n      const removedPaths = new Set<string>(localShardRels.filter((rel) => !published.has(rel)));\n      let deleted = removedPaths.size;\n      let markerCleanupFailed = false;\n      if ((await pathExists(markerAbs)) && !input.incomingMarker && !input.incomingMarkerPresent) {\n        // Publication is already committed. Keep its base advancement even if\n        // marker cleanup fails, retaining the marker in base for a retry.\n        try {\n          if (io.deleteFile) await io.deleteFile({ root: root.abs, path: markerRel, filePath: markerAbs });\n          else await rm(markerAbs, { force: true });\n          removedPaths.add(markerRel);\n          deleted += 1;\n        } catch (err) {\n          markerCleanupFailed = true;\n          log.warn(`embedding generation ${shardDirRel}: marker cleanup deferred after publish: ${err}`);\n        }\n      }\n      return {\n        shardDirRel,\n        upserted: published.size,\n        deleted,\n        writtenStates,\n        removedPaths,\n        handledPaths: new Set([...published.keys(), ...removedPaths, ...(markerCleanupFailed ? [markerRel] : [])]),\n      };\n    } catch (err) {\n      await rm(stagingAbs, { recursive: true, force: true }).catch(() => undefined);\n      throw err;\n    }\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Push-side whole-generation omission\n// ---------------------------------------------------------------------------\n\nexport interface EmbeddingGenerationOmissionOptions {\n  rootAbs: string;\n  userExcludeRegexps?: readonly RegExp[];\n  excludeFile?: OfflineSyncExcludeFile;\n  /** Recorded deletion-revision paths: a tombstoned member counts as a\n   * generation member for omission detection even though it is absent on\n   * disk (its exclusion must omit the WHOLE generation). */\n  tombstonedPaths?: readonly string[];\n  /**\n   * Per-path push exclusion predicate (structural + node-local defaults +\n   * user regexps). Defaults to the built-in default excludes + the supplied\n   * user regexps, matching the walk that consumes the result.\n   */\n  isExcludedRelPath?: (relPath: string) => boolean;\n}\n\nexport interface EmbeddingGenerationOmission {\n  /** Existing member paths omitted because their generation is partial. */\n  omittedPaths: Set<string>;\n  /** Generation dirs whose members are omitted (snapshot field value). */\n  omittedDirs: string[];\n}\n\n/**\n * Compute the push-side whole-generation omission set: when ANY on-disk\n * member of an embedding generation is excluded by a push filter, EVERY\n * member of that generation is omitted (issue #3148, round 4).\n */\nexport async function computeOmittedEmbeddingGenerationPaths(\n  options: EmbeddingGenerationOmissionOptions\n): Promise<EmbeddingGenerationOmission> {\n  const omittedPaths = new Set<string>();\n  const omittedDirs: string[] = [];\n  const stateDirs = [\"state\"];\n  let namespaceNames: string[] = [];\n  try {\n    namespaceNames = (await readdir(path.join(options.rootAbs, \"namespaces\"), { withFileTypes: true }))\n      .filter((entry) => entry.isDirectory())\n      .map((entry) => entry.name);\n  } catch {\n    // no namespaces\n  }\n  for (const ns of namespaceNames) stateDirs.push(`namespaces/${ns}/state`);\n  const isExcluded = options.isExcludedRelPath ??\n    ((relPath: string) =>\n      matchesOfflineSyncDefaultExclude(relPath) ||\n      Boolean(options.userExcludeRegexps?.some((re) => re.test(relPath))));\n\n  for (const stateDir of stateDirs) {\n    const markerRel = `${stateDir}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirRel = `${stateDir}/${EMBEDDING_SHARD_DIR_BASENAME}`;\n    const shardDirAbs = path.join(options.rootAbs, ...shardDirRel.split(\"/\"));\n    const memberRels: string[] = [];\n    if (await pathExists(path.join(options.rootAbs, ...markerRel.split(\"/\")))) {\n      memberRels.push(markerRel);\n    }\n    let shardNames: string[] = [];\n    try {\n      shardNames = (await readdir(shardDirAbs, { withFileTypes: true }))\n        .filter((entry) => entry.isFile() && EMBEDDING_SHARD_FILE_PATTERN.test(entry.name))\n        .map((entry) => entry.name);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n    }\n    for (const name of shardNames) memberRels.push(`${shardDirRel}/${name}`);\n    // A tombstoned member is part of the generation even though it is\n    // already absent on disk: its exclusion must omit the WHOLE generation,\n    // not just drop its revision individually (codex round 6, XkFf).\n    for (const tombstoned of options.tombstonedPaths ?? []) {\n      const membership = embeddingGenerationMembership(tombstoned);\n      if (membership?.shardDir === shardDirRel && !memberRels.includes(tombstoned)) {\n        memberRels.push(tombstoned);\n      }\n    }\n    if (memberRels.length === 0) continue;\n\n    const excludedMembers: string[] = [];\n    for (const relPath of memberRels) {\n      let excluded = isExcluded(relPath);\n      if (!excluded && options.excludeFile) {\n        excluded = await options.excludeFile({\n          root: options.rootAbs,\n          path: relPath,\n          filePath: path.join(options.rootAbs, ...relPath.split(\"/\")),\n        });\n      }\n      if (excluded) excludedMembers.push(relPath);\n    }\n    if (excludedMembers.length === 0) continue;\n    omittedDirs.push(shardDirRel);\n    omittedPaths.add(shardDirRel); // skip new shards after the omission header\n    for (const relPath of memberRels) omittedPaths.add(relPath);\n  }\n  return { omittedPaths, omittedDirs };\n}\n\n/** Reject an exclusion introduced after the snapshot header was computed. */\nexport async function assertEmbeddingGenerationStillIncluded(\n  rootAbs: string, shardDirRel: string, excludeFile: OfflineSyncExcludeFile | undefined,\n  isExcludedRelPath: (relPath: string) => boolean, tombstonedPaths: readonly string[],\n): Promise<void> {\n  const current = await computeOmittedEmbeddingGenerationPaths({ rootAbs, excludeFile, isExcludedRelPath, tombstonedPaths });\n  if (current.omittedDirs.includes(shardDirRel)) {\n    throw new EmbeddingIndexStorageError(\n      `embedding generation ${shardDirRel} became partially excluded during snapshot capture; retry with a fresh omission header`,\n    );\n  }\n}\n\n/** True when a path belongs to a generation the push omitted. */\nexport function isPathInOmittedEmbeddingGeneration(relPath: string, omittedDirs: ReadonlySet<string>): boolean {\n  const membership = embeddingGenerationMembership(relPath);\n  return membership !== null && omittedDirs.has(membership.shardDir);\n}\n\nexport type { EmbeddingIndexFile };\n\nimport { matchesOfflineSyncDefaultExclude } from \"./offline-sync-exclude-globs.js\";\nimport type { OfflineSyncDeletionRevision } from \"./offline-sync.js\";\n\nexport interface PushEmbeddingGenerationState {\n  /** Generation dirs omitted by the push filters (snapshot header value). */\n  omittedDirs: string[];\n  /** All omitted member paths (walk skip set). */\n  omittedPaths: Set<string>;\n  /** Deletions with whole-generation suppression applied. */\n  deletions: OfflineSyncDeletionRevision[];\n}\n\n/**\n * One-call push-side generation state for streaming snapshot builders: the\n * whole-generation omission set (from user regexps, excludeFile, and default\n * excludes) plus the deletion list with omitted-generation revisions\n * suppressed — including revisions for members that are already absent, so a\n * filtered generation can never be announced as deleted.\n */\nexport async function resolvePushEmbeddingGenerationState(options: {\n  rootAbs: string;\n  includeTranscripts: boolean;\n  userExcludeRegexps?: readonly RegExp[];\n  excludeFile?: OfflineSyncExcludeFile;\n  deletions: readonly OfflineSyncDeletionRevision[];\n}): Promise<PushEmbeddingGenerationState> {\n  const omission = await computeOmittedEmbeddingGenerationPaths({\n    rootAbs: options.rootAbs,\n    userExcludeRegexps: options.userExcludeRegexps,\n    excludeFile: options.excludeFile,\n    // RAW pre-filter tombstones: a deleted member's exclusion must omit the\n    // whole generation even though the member is already absent on disk.\n    tombstonedPaths: options.deletions.map((deletion) => deletion.path),\n    isExcludedRelPath: (relPath) =>\n      matchesOfflineSyncDefaultExclude(relPath) ||\n      Boolean(options.userExcludeRegexps?.some((re) => re.test(relPath))),\n  });\n  const omittedDirs = new Set(omission.omittedDirs);\n  const deletions = options.deletions.filter((deletion) => {\n    if (matchesOfflineSyncDefaultExclude(deletion.path)) return false;\n    if (options.userExcludeRegexps?.some((re) => re.test(deletion.path))) return false;\n    const membership = embeddingGenerationMembership(deletion.path);\n    if (membership && omittedDirs.has(membership.shardDir)) return false;\n    return true;\n  });\n  return { omittedDirs: omission.omittedDirs, omittedPaths: omission.omittedPaths, deletions };\n}\n\n\ninterface StorageBackedIndexIoHost {\n  readOfflineSyncFile(filePath: string, opts?: { aadFilePath?: string }): Promise<Buffer>;\n  writeOfflineSyncStagingFile(\n    filePath: string,\n    content: Buffer,\n    opts?: { aadFilePath?: string },\n  ): Promise<void>;\n}\n\n/**\n * Daemon wiring for the index store IO backed by a StorageManager:\n * canonical-path secure reads/writes, so sync-published encrypted shards\n * decrypt in the daemon and daemon-written shards decrypt on sync. Shard\n * STAGING writes bind the FINAL published path.\n */\nexport function storageBackedIndexStoreIo(storage: StorageBackedIndexIoHost): EmbeddingIndexStoreIo {\n  return {\n    readUtf8: async (filePath) => (await storage.readOfflineSyncFile(filePath)).toString(\"utf-8\"),\n    writeUtf8: (filePath, contents, opts) =>\n      storage.writeOfflineSyncStagingFile(\n        filePath,\n        Buffer.from(contents, \"utf-8\"),\n        opts?.finalAadFilePath === undefined ? undefined : { aadFilePath: opts.finalAadFilePath },\n      ),\n  };\n}\n\nexport interface EmbeddingGenerationRemovalInput {\n  root: SafeArchiveRoot;\n  /** The generation dir, e.g. `state/embeddings`. */\n  shardDirRel: string;\n  io: Pick<EmbeddingGenerationTransactionIo, \"deleteFile\" | \"readFile\">;\n  /** Incoming deletion revisions by path, threaded so each removed member's\n   * tombstone is recorded through the configured delete hook AFTER the\n   * atomic empty publication (round 6: raw removal must not lose them). */\n  deletionMtimeByPath?: ReadonlyMap<string, number>;\n  now: number;\n  /**\n   * Shared-base states: when the live generation diverged from the base\n   * (daemon indexed, added, or removed members after the census), the\n   * removal DEFERS instead of erasing the local work (codex P1).\n   */\n  baseStates?: ReadonlyMap<string, { sha256: string }>;\n}\n\n/**\n * Remove a LOCAL embedding generation atomically because the remote deleted\n * it wholesale (every member has a deletion revision): recover first, then\n * demote the published directory through the store's single swap state\n * machine and delete the backup — a crash or delete failure can never leave\n * a partial same-identity generation serving silently missing memories.\n * The local legacy marker, when present, is removed through the same delete\n * hook the per-file path uses.\n */\nexport async function applyEmbeddingGenerationRemoval(\n  input: EmbeddingGenerationRemovalInput,\n): Promise<EmbeddingGenerationTransactionResult> {\n  const { root, shardDirRel, io } = input;\n  const stateDirRel = shardDirRel.slice(0, -(`/${EMBEDDING_SHARD_DIR_BASENAME}`.length));\n  const stateDirAbs = await resolveSafeArchiveTarget(root, stateDirRel);\n  return await withEmbeddingGenerationLock(stateDirAbs, async (section) => {\n    const lockPath = embeddingGenerationLockPath(stateDirAbs);\n    const fence: EmbeddingGenerationFence = () => assertEmbeddingGenerationLockHeld(lockPath, section);\n    const markerRel = `${stateDirRel}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirAbs = await resolveSafeArchiveTarget(root, shardDirRel);\n    const markerAbs = await resolveSafeArchiveTarget(root, markerRel);\n    const store = new EmbeddingIndexFileStore(\n      markerAbs,\n      shardDirAbs,\n      await resolveSafeArchiveTarget(root, `${stateDirRel}/embedding-fallback-status.json`),\n    );\n    await store.recoverIfInterrupted(fence);\n\n    // Codex P1: the deletion census is stale by the time the lock is held.\n    // When the live generation no longer matches the shared base (daemon\n    // indexed, added, or removed members), DEFER the removal — the local\n    // work survives and a later sync re-evaluates with a fresh base.\n    // No shared base (fresh catch-up) = no divergence semantics to protect.\n    const baseStates = baseStatesForGeneration(input.baseStates, shardDirRel);\n    if (baseStates.size > 0) {\n      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);\n      const baseArr = [...baseStates].map(([relPath, state]) => ({ path: relPath, sha256: state.sha256 }));\n      const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 }));\n      const changedSinceBase =\n        censusArr.some((member) => {\n          // A MODIFIED member must also defer: removing the generation would\n          // erase the daemon's rewrite, not just the remote's stale copy.\n          const baseSha = baseStates.get(member.path)?.sha256;\n          return baseSha === undefined || baseSha !== member.sha256;\n        }) || baseArr.some((member) => !localCensus.has(member.path));\n      if (changedSinceBase) {\n        const removedPaths = new Set<string>([...localCensus.keys()]);\n        log.warn(\n          `embedding generation removal ${shardDirRel} deferred: disk diverged from the shared base under the mutation lock; local generation preserved`,\n        );\n        return {\n          shardDirRel,\n          upserted: 0,\n          deleted: 0,\n          writtenStates: new Map<string, OfflineSyncFileState>(),\n          removedPaths,\n          handledPaths: new Set(removedPaths),\n          deferredLocalDivergence: true,\n        };\n      }\n    }\n    const localShardRels = (await readdir(shardDirAbs).catch((err) => {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [] as string[];\n      throw err;\n    }))\n      .filter((name) => EMBEDDING_SHARD_FILE_PATTERN.test(name))\n      .map((name) => `${shardDirRel}/${name}`)\n      .sort();\n    await store.removePublishedGeneration(fence);\n    const removedPaths = new Set(localShardRels);\n    let deleted = removedPaths.size;\n    const markerPresent = await pathExists(markerAbs);\n    if (markerPresent) {\n      removedPaths.add(markerRel);\n      deleted += 1;\n    }\n    // Preserve the replicated tombstones through the configured hooks AFTER\n    // the atomic publication: raw removal must not lose the deletion\n    // revisions, or a downstream sync without base evidence retains stale\n    // entries. EVERY member (shards and marker) is recorded exactly ONCE with\n    // the remote revision when known, so a first hook call without a revision\n    // is never overwritten by an older replicated one. The storage hook\n    // tolerates already-absent paths.\n    let firstError: unknown = null;\n    for (const relPath of removedPaths) {\n      const memberAbs = relPath === markerRel ? markerAbs : await resolveSafeArchiveTarget(root, relPath);\n      const mtimeMs = input.deletionMtimeByPath?.get(relPath) ?? input.now;\n      if (io.deleteFile) {\n        try {\n          await io.deleteFile({\n            root: root.abs,\n            path: relPath,\n            filePath: await resolveSafeArchiveTarget(root, relPath),\n            mtimeMs,\n          });\n        } catch (err) {\n          firstError ??= err;\n          log.warn(`embedding generation removal: tombstone recording failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`);\n        }\n      } else if (relPath === markerRel && markerPresent) {\n        await rm(markerAbs, { force: true });\n      }\n    }\n    if (firstError) throw firstError;\n    return {\n      shardDirRel,\n      upserted: 0,\n      deleted,\n      writtenStates: new Map(),\n      removedPaths,\n      handledPaths: new Set(removedPaths),\n    };\n  });\n}\n\n/** Defer a whole generation when the shared remote base would erase a local change. */\nexport function divergedEmbeddingGenerationDeferrals(options: {\n  incomingFiles: readonly { path: string; sha256: string }[];\n  baseFiles: readonly { path: string; sha256: string }[];\n  currentFiles: readonly { path: string; sha256: string }[];\n}): string[] {\n  const base = new Map(options.baseFiles.map((f) => [f.path, f.sha256]));\n  const current = new Map(options.currentFiles.map((f) => [f.path, f.sha256]));\n  const incomingByPath = new Map(options.incomingFiles.map((f) => [f.path, f.sha256]));\n  const sharedDirs = new Set(options.baseFiles.map((f) => embeddingGenerationMembership(f.path)?.shardDir));\n  const conflictedDirs = new Set<string>();\n  for (const relPath of new Set([...base.keys(), ...current.keys(), ...incomingByPath.keys()])) {\n    const membership = embeddingGenerationMembership(relPath);\n    // Without a shared generation base this is an initial remote-authoritative\n    // import, not evidence of local indexing after a synchronized snapshot.\n    if (!membership || !sharedDirs.has(membership.shardDir)) continue;\n    const currentSha = current.get(relPath);\n    if (currentSha !== base.get(relPath) && currentSha !== incomingByPath.get(relPath)) {\n      conflictedDirs.add(membership.shardDir);\n    }\n  }\n  if (conflictedDirs.size === 0) return [];\n  const deferred: string[] = [];\n  // Include local/base members too: an all-absent remote generation still\n  // needs a concrete deferral so its removal cannot erase a local change.\n  for (const relPath of new Set([...base.keys(), ...current.keys(), ...incomingByPath.keys()])) {\n    const membership = embeddingGenerationMembership(relPath);\n    if (membership && conflictedDirs.has(membership.shardDir)) deferred.push(relPath);\n  }\n  return deferred.sort((left, right) => left.localeCompare(right));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,SAAS,YAAY,mBAAmB;AACxC,SAAS,OAAO,OAAO,UAAU,SAAS,IAAI,iBAAiB;AAC/D,OAAO,UAAU;AA6BjB,IAAM,4BAA4B;AAC3B,IAAM,+BAA+B;AAM5C,SAAS,wBAAwB,OAAgC;AAC/D,MAAI,MAAM,CAAC,MAAM,QAAS,QAAO;AACjC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,SAAS;AAC1E,WAAO,cAAc,MAAM,CAAC,CAAC;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,oBAAoB,SAAgC;AAClE,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI,CAAC,6BAA6B,KAAK,MAAM,MAAM,SAAS,CAAC,KAAK,EAAE,EAAG,QAAO;AAC9E,MAAI,MAAM,MAAM,SAAS,CAAC,MAAM,6BAA8B,QAAO;AACrE,MAAI,wBAAwB,KAAK,MAAM,KAAM,QAAO;AACpD,SAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACpC;AAOO,SAAS,6BAA6B,SAA0B;AACrE,QAAM,aAAa,8BAA8B,GAAG,OAAO,kBAAkB;AAC7E,SAAO,eAAe,QAAQ,WAAW,aAAa;AACxD;AAGO,SAAS,qBAAqB,SAAgC;AACnE,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,OAAK,MAAM,MAAM,SAAS,CAAC,KAAK,QAAQ,0BAA2B,QAAO;AAC1E,MAAI,wBAAwB,KAAK,MAAM,KAAM,QAAO;AACpD,SAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACpC;AAOO,SAAS,8BAA8B,SAAwE;AACpH,QAAM,WAAW,oBAAoB,OAAO;AAC5C,MAAI,SAAU,QAAO,EAAE,MAAM,SAAS,SAAS;AAC/C,QAAM,YAAY,qBAAqB,OAAO;AAC9C,MAAI,UAAW,QAAO,EAAE,MAAM,UAAU,UAAU,GAAG,SAAS,IAAI,4BAA4B,GAAG;AACjG,SAAO;AACT;AAUO,SAAS,mCAAmC,eAA+D;AAChH,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,mBAAmB,oBAAI,IAAY;AACzC,aAAW,WAAW,eAAe;AACnC,UAAM,aAAa,8BAA8B,OAAO;AACxD,QAAI,CAAC,WAAY;AACjB,QAAI,WAAW,SAAS,QAAS,WAAU,IAAI,WAAW,QAAQ;AAAA,QAC7D,kBAAiB,IAAI,WAAW,QAAQ;AAAA,EAC/C;AACA,SAAO,EAAE,WAAW,iBAAiB;AACvC;AAEA,SAAS,aAAa,aAAqB,YAA4B;AACrE,SAAO,GAAG,WAAW,UAAU,OAAO,UAAU,EAAE,SAAS,GAAG,GAAG,CAAC;AACpE;AAEA,SAAS,yBACP,MACQ;AACR,MAAI,KAAK,YAAY,aAAc,QAAO,KAAK;AAC/C,MAAI,KAAK,YAAY,UAAW,QAAO;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AACzD;AAEA,eAAe,WAAW,SAAmC;AAC3D,MAAI;AACF,UAAM,MAAM,OAAO;AACnB,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACF;AAgEA,eAAe,uBACb,IACA,MACA,SACA,gBACA,UACiB;AACjB,MAAI,SAAU,QAAO;AACrB,QAAM,WAAW,MAAM,yBAAyB,MAAM,OAAO;AAC7D,QAAM,QAAQ,GAAG,WACb,MAAM,GAAG,SAAS,EAAE,MAAM,KAAK,KAAK,MAAM,SAAS,SAAS,CAAC,IAC7D,MAAM,SAAS,QAAQ;AAC3B,MAAI,UAAU,KAAK,MAAM,gBAAgB;AACvC,UAAM,IAAI;AAAA,MACR,iDAAiD,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,wBACP,MACA,aACiC;AACjC,SAAO,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,MAAM,8BAA8B,OAAO,GAAG,aAAa,WAAW,CAAC;AACxH;AAEA,eAAe,sBACb,IACA,MACA,WACA,WACA,aACA,aAC8B;AAC9B,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,UAAU,OAAO,SAAiB,aACtC,UAAU,GAAG,WAAW,MAAM,GAAG,SAAS,EAAE,MAAM,KAAK,KAAK,MAAM,SAAS,SAAS,CAAC,IAAI,MAAM,SAAS,QAAQ,CAAC;AACnH,MAAI,MAAM,WAAW,SAAS,EAAG,QAAO,IAAI,WAAW,MAAM,QAAQ,WAAW,SAAS,CAAC;AAC1F,QAAM,QAAQ,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAA+B;AAC7E,QAAI,IAAI,SAAS,SAAU,QAAO,CAAC;AACnC,UAAM;AAAA,EACR,CAAC;AACD,aAAW,QAAQ,MAAM,OAAO,CAAC,cAAc,6BAA6B,KAAK,SAAS,CAAC,EAAE,KAAK,GAAG;AACnG,UAAM,UAAU,GAAG,WAAW,IAAI,IAAI;AACtC,WAAO,IAAI,SAAS,MAAM,QAAQ,SAAS,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC;AAAA,EAC1E;AACA,SAAO;AACT;AAGA,SAAS,yBAAyB,OAAgF;AAChH,QAAM,SAAS,MAAM,mBAAmB,IAAI,CAAC,aAAa;AAAA,IACxD,MAAM;AAAA,IACN,QAAQ,MAAM,oBAAoB,IAAI,OAAO,GAAG,UAAU,UAAU,MAAM,gBAAgB,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC;AAAA,EAC3H,EAAE;AACF,MAAI,MAAM,gBAAgB;AACxB,WAAO,KAAK,EAAE,MAAM,MAAM,eAAe,MAAM,QAAQ,MAAM,eAAe,OAAO,CAAC;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,oCACpB,OAC+C;AAC/C,QAAM,EAAE,MAAM,aAAa,GAAG,IAAI;AAClC,QAAM,cAAc,YAAY,MAAM,GAAG,CAAC,IAAI,4BAA4B,GAAG,MAAM;AACnF,QAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,SAAO,MAAM,4BAA4B,aAAa,OAAO,YAAY;AACvE,UAAM,WAAW,4BAA4B,WAAW;AACxD,UAAM,QAAkC,MAAM,kCAAkC,UAAU,OAAO;AACjG,UAAM,YAAY,GAAG,WAAW,IAAI,yBAAyB;AAC7D,UAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,UAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,UAAM,QAAQ,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,yBAAyB,MAAM,GAAG,WAAW,iCAAiC;AAAA,IACtF;AAQA,UAAM,YAAY,GAAG,WAAW;AAChC,UAAM,yBAAyB,MAAM,SAAS;AAC9C,QAAI,MAAM,MAAM,qBAAqB,KAAK,GAAG;AAC3C,YAAM,yBAAyB,MAAM,WAAW;AAAA,IAClD;AAQA,UAAM,aAAa,wBAAwB,MAAM,YAAY,WAAW;AACxE,QAAI,WAAW,OAAO,GAAG;AACvB,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,WAAW,WAAW,aAAa,WAAW;AACxG,YAAM,UAAU,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AACnG,YAAM,YAAY,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,MAAM,SAAS,OAAO,EAAE;AACzF,YAAM,YAAY,qCAAqC;AAAA,QACrD,eAAe,yBAAyB,KAAK;AAAA,QAC7C,WAAW;AAAA,QACX,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,0BACJ,UAAU,KAAK,CAAC,WAAW,CAAC,WAAW,IAAI,OAAO,IAAI,CAAC,KACvD,QAAQ,KAAK,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC;AACxD,UAAI,UAAU,SAAS,KAAK,yBAAyB;AACnD,cAAM,UAAU,IAAI,IAAY,MAAM,kBAAkB;AACxD,YAAI,MAAM,eAAgB,SAAQ,IAAI,MAAM,eAAe,IAAI;AAC/D,YAAI,MAAM,sBAAuB,SAAQ,IAAI,SAAS;AACtD,mBAAW,WAAW,YAAY,KAAK,EAAG,SAAQ,IAAI,OAAO;AAC7D,YAAI;AAAA,UACF,wBAAwB,WAAW,0EAA0E,UAAU,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,0CAA0C;AAAA,QACvM;AACA,eAAO;AAAA,UACL;AAAA,UACA,UAAU;AAAA,UACV,SAAS;AAAA,UACT,eAAe,oBAAI,IAAkC;AAAA,UACrD,cAAc,oBAAI,IAAY;AAAA,UAC9B,cAAc;AAAA,UACd,yBAAyB;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,oBAAI,IAAoB;AAC1C,QAAI,WAA0C;AAKhD,QAAI,MAAM,gBAAgB;AACxB,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,MAAM,eAAe;AAAA,QACrB,MAAM,eAAe;AAAA,QACrB,MAAM,eAAe;AAAA,MACvB;AACA,YAAM,OAAO,4BAA4B,aAAa,SAAS,OAAO,CAAC;AACvE,UAAI,KAAK,YAAY,MAAM;AACzB,cAAM,IAAI;AAAA,UACR,gDAAgD,SAAS,KAAK,yBAAyB,IAAI,CAAC;AAAA,QAC9F;AAAA,MACF;AACA,iBAAW,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAClE,YAAM,SAAS,qBAAqB,KAAK,IAAI;AAC7C,iBAAW,CAAC,YAAY,OAAO,KAAK,QAAQ;AAC1C,YAAI,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG;AACvC,kBAAU;AAAA,UACR,aAAa,aAAa,UAAU;AAAA,UACpC,OAAO,KAAK,wBAAwB,KAAK,MAAM,YAAY,OAAO,GAAG,OAAO;AAAA,QAC9E;AAAA,MACF;AAAA,IACF,OAAO;AACL,iBAAW,WAAW,MAAM,oBAAoB;AAI9C,cAAM,QAAQ,MAAM,oBAAoB,IAAI,OAAO;AACnD,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,UAAU;AAAA,UACjB,MAAM,gBAAgB,IAAI,OAAO;AAAA,QACnC;AACA,cAAM,OAAO,4BAA4B,OAAO,SAAS,OAAO,CAAC;AACjE,YAAI,KAAK,YAAY,MAAM;AACzB,gBAAM,IAAI;AAAA,YACR,2CAA2C,OAAO,KAAK,yBAAyB,IAAI,CAAC;AAAA,UACvF;AAAA,QACF;AACA,gCAAwB,QAAQ,MAAM,GAAG,EAAE,IAAI,KAAK,IAAI,KAAK,IAAI;AACjE,cAAM,gBAAgB,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAC7E,YAAI,CAAC,SAAU,YAAW;AAC1B,YAAI,SAAS,aAAa,cAAc,YAAY,SAAS,UAAU,cAAc,OAAO;AAC1F,gBAAM,IAAI;AAAA,YACR,kEAAkE,WAAW,KAAK,OAAO,OAAO,cAAc,QAAQ,IAAI,cAAc,KAAK,0BAA0B,SAAS,QAAQ,IAAI,SAAS,KAAK;AAAA,UAC5M;AAAA,QACF;AACA,kBAAU,IAAI,SAAS,MAAM;AAAA,MAC/B;AACA,UAAI,UAAU,SAAS,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,uCAAuC,WAAW;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAEE,UAAM,aAAa,GAAG,WAAW,gCAAgC,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC3H,UAAM,aAAa,MAAM,yBAAyB,MAAM,UAAU;AAClE,QAAI;AACF,YAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAM3C,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,cAAM,YAAY,GAAG,UAAU,IAAI,KAAK,SAAS,OAAO,CAAC;AACzD,cAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,cAAM,WAAW,MAAM,yBAAyB,MAAM,OAAO;AAC7D,YAAI,GAAG,kBAAkB;AACvB,gBAAM,GAAG,iBAAiB;AAAA,YACxB,MAAM,KAAK;AAAA,YACX,MAAM;AAAA,YACN,UAAU;AAAA,YACV,SAAS;AAAA,YACT,kBAAkB;AAAA,UACpB,CAAC;AAAA,QACH,OAAO;AACL,gBAAM,UAAU,WAAW,QAAQ,EAAE,MAAM,IAAM,CAAC;AAAA,QACpD;AAAA,MACF;AAIA,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,cAAM,YAAY,GAAG,UAAU,IAAI,KAAK,SAAS,OAAO,CAAC;AACzD,cAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,cAAM,SAAS,GAAG,kBACd,MAAM,GAAG,gBAAgB;AAAA,UACvB,MAAM,KAAK;AAAA,UACX,MAAM;AAAA,UACN,UAAU;AAAA,UACV,kBAAkB,MAAM,yBAAyB,MAAM,OAAO;AAAA,QAChE,CAAC,IACD,MAAM,SAAS,SAAS;AAC5B,YAAI,CAAC,OAAO,OAAO,MAAM,GAAG;AAC1B,gBAAM,IAAI;AAAA,YACR,+BAA+B,SAAS;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAKA,YAAM,kBACJ,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AACxC,YAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,cAAM;AAAA,MACR,CAAC,GAEA,OAAO,CAAC,SAAS,6BAA6B,KAAK,IAAI,CAAC,EACxD,IAAI,CAAC,SAAS,GAAG,WAAW,IAAI,IAAI,EAAE,EACtC,KAAK;AACR,YAAM,MAAM,yBAAyB,YAAY,KAAK;AAEtD,YAAM,gBAAgB,oBAAI,IAAkC;AAC5D,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,sBAAc,IAAI,SAAS;AAAA,UACzB,MAAM;AAAA,UACN,QAAQ,UAAU,MAAM;AAAA,UACxB,OAAO,OAAO;AAAA,UACd,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AACA,YAAM,eAAe,IAAI,IAAY,eAAe,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AACxF,UAAI,UAAU,aAAa;AAC3B,UAAI,sBAAsB;AAC1B,UAAK,MAAM,WAAW,SAAS,KAAM,CAAC,MAAM,kBAAkB,CAAC,MAAM,uBAAuB;AAG1F,YAAI;AACF,cAAI,GAAG,WAAY,OAAM,GAAG,WAAW,EAAE,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,UAAU,CAAC;AAAA,cAC1F,OAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AACxC,uBAAa,IAAI,SAAS;AAC1B,qBAAW;AAAA,QACb,SAAS,KAAK;AACZ,gCAAsB;AACtB,cAAI,KAAK,wBAAwB,WAAW,4CAA4C,GAAG,EAAE;AAAA,QAC/F;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,UAAU,UAAU;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,oBAAI,IAAI,CAAC,GAAG,UAAU,KAAK,GAAG,GAAG,cAAc,GAAI,sBAAsB,CAAC,SAAS,IAAI,CAAC,CAAE,CAAC;AAAA,MAC3G;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC5E,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAkCA,eAAsB,uCACpB,SACsC;AACtC,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,cAAwB,CAAC;AAC/B,QAAM,YAAY,CAAC,OAAO;AAC1B,MAAI,iBAA2B,CAAC;AAChC,MAAI;AACF,sBAAkB,MAAM,QAAQ,KAAK,KAAK,QAAQ,SAAS,YAAY,GAAG,EAAE,eAAe,KAAK,CAAC,GAC9F,OAAO,CAAC,UAAU,MAAM,YAAY,CAAC,EACrC,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EAC9B,QAAQ;AAAA,EAER;AACA,aAAW,MAAM,eAAgB,WAAU,KAAK,cAAc,EAAE,QAAQ;AACxE,QAAM,aAAa,QAAQ,sBACxB,CAAC,YACA,iCAAiC,OAAO,KACxC,QAAQ,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAEtE,aAAW,YAAY,WAAW;AAChC,UAAM,YAAY,GAAG,QAAQ,IAAI,yBAAyB;AAC1D,UAAM,cAAc,GAAG,QAAQ,IAAI,4BAA4B;AAC/D,UAAM,cAAc,KAAK,KAAK,QAAQ,SAAS,GAAG,YAAY,MAAM,GAAG,CAAC;AACxE,UAAM,aAAuB,CAAC;AAC9B,QAAI,MAAM,WAAW,KAAK,KAAK,QAAQ,SAAS,GAAG,UAAU,MAAM,GAAG,CAAC,CAAC,GAAG;AACzE,iBAAW,KAAK,SAAS;AAAA,IAC3B;AACA,QAAI,aAAuB,CAAC;AAC5B,QAAI;AACF,oBAAc,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC,GAC7D,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,6BAA6B,KAAK,MAAM,IAAI,CAAC,EACjF,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,IAC9D;AACA,eAAW,QAAQ,WAAY,YAAW,KAAK,GAAG,WAAW,IAAI,IAAI,EAAE;AAIvE,eAAW,cAAc,QAAQ,mBAAmB,CAAC,GAAG;AACtD,YAAM,aAAa,8BAA8B,UAAU;AAC3D,UAAI,YAAY,aAAa,eAAe,CAAC,WAAW,SAAS,UAAU,GAAG;AAC5E,mBAAW,KAAK,UAAU;AAAA,MAC5B;AAAA,IACF;AACA,QAAI,WAAW,WAAW,EAAG;AAE7B,UAAM,kBAA4B,CAAC;AACnC,eAAW,WAAW,YAAY;AAChC,UAAI,WAAW,WAAW,OAAO;AACjC,UAAI,CAAC,YAAY,QAAQ,aAAa;AACpC,mBAAW,MAAM,QAAQ,YAAY;AAAA,UACnC,MAAM,QAAQ;AAAA,UACd,MAAM;AAAA,UACN,UAAU,KAAK,KAAK,QAAQ,SAAS,GAAG,QAAQ,MAAM,GAAG,CAAC;AAAA,QAC5D,CAAC;AAAA,MACH;AACA,UAAI,SAAU,iBAAgB,KAAK,OAAO;AAAA,IAC5C;AACA,QAAI,gBAAgB,WAAW,EAAG;AAClC,gBAAY,KAAK,WAAW;AAC5B,iBAAa,IAAI,WAAW;AAC5B,eAAW,WAAW,WAAY,cAAa,IAAI,OAAO;AAAA,EAC5D;AACA,SAAO,EAAE,cAAc,YAAY;AACrC;AAGA,eAAsB,uCACpB,SAAiB,aAAqB,aACtC,mBAAiD,iBAClC;AACf,QAAM,UAAU,MAAM,uCAAuC,EAAE,SAAS,aAAa,mBAAmB,gBAAgB,CAAC;AACzH,MAAI,QAAQ,YAAY,SAAS,WAAW,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR,wBAAwB,WAAW;AAAA,IACrC;AAAA,EACF;AACF;AAGO,SAAS,mCAAmC,SAAiB,aAA2C;AAC7G,QAAM,aAAa,8BAA8B,OAAO;AACxD,SAAO,eAAe,QAAQ,YAAY,IAAI,WAAW,QAAQ;AACnE;AAuBA,eAAsB,oCAAoC,SAMhB;AACxC,QAAM,WAAW,MAAM,uCAAuC;AAAA,IAC5D,SAAS,QAAQ;AAAA,IACjB,oBAAoB,QAAQ;AAAA,IAC5B,aAAa,QAAQ;AAAA;AAAA;AAAA,IAGrB,iBAAiB,QAAQ,UAAU,IAAI,CAAC,aAAa,SAAS,IAAI;AAAA,IAClE,mBAAmB,CAAC,YAClB,iCAAiC,OAAO,KACxC,QAAQ,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAAA,EACtE,CAAC;AACD,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW;AAChD,QAAM,YAAY,QAAQ,UAAU,OAAO,CAAC,aAAa;AACvD,QAAI,iCAAiC,SAAS,IAAI,EAAG,QAAO;AAC5D,QAAI,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,EAAG,QAAO;AAC7E,UAAM,aAAa,8BAA8B,SAAS,IAAI;AAC9D,QAAI,cAAc,YAAY,IAAI,WAAW,QAAQ,EAAG,QAAO;AAC/D,WAAO;AAAA,EACT,CAAC;AACD,SAAO,EAAE,aAAa,SAAS,aAAa,cAAc,SAAS,cAAc,UAAU;AAC7F;AAkBO,SAAS,0BAA0B,SAA0D;AAClG,SAAO;AAAA,IACL,UAAU,OAAO,cAAc,MAAM,QAAQ,oBAAoB,QAAQ,GAAG,SAAS,OAAO;AAAA,IAC5F,WAAW,CAAC,UAAU,UAAU,SAC9B,QAAQ;AAAA,MACN;AAAA,MACA,OAAO,KAAK,UAAU,OAAO;AAAA,MAC7B,MAAM,qBAAqB,SAAY,SAAY,EAAE,aAAa,KAAK,iBAAiB;AAAA,IAC1F;AAAA,EACJ;AACF;AA6BA,eAAsB,gCACpB,OAC+C;AAC/C,QAAM,EAAE,MAAM,aAAa,GAAG,IAAI;AAClC,QAAM,cAAc,YAAY,MAAM,GAAG,CAAE,IAAI,4BAA4B,GAAG,MAAO;AACrF,QAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,SAAO,MAAM,4BAA4B,aAAa,OAAO,YAAY;AACvE,UAAM,WAAW,4BAA4B,WAAW;AACxD,UAAM,QAAkC,MAAM,kCAAkC,UAAU,OAAO;AACjG,UAAM,YAAY,GAAG,WAAW,IAAI,yBAAyB;AAC7D,UAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,UAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,UAAM,QAAQ,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,yBAAyB,MAAM,GAAG,WAAW,iCAAiC;AAAA,IACtF;AACA,UAAM,MAAM,qBAAqB,KAAK;AAOtC,UAAM,aAAa,wBAAwB,MAAM,YAAY,WAAW;AACxE,QAAI,WAAW,OAAO,GAAG;AACvB,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,WAAW,WAAW,aAAa,WAAW;AACxG,YAAM,UAAU,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AACnG,YAAM,YAAY,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,MAAM,SAAS,OAAO,EAAE;AACzF,YAAM,mBACJ,UAAU,KAAK,CAAC,WAAW;AAGzB,cAAM,UAAU,WAAW,IAAI,OAAO,IAAI,GAAG;AAC7C,eAAO,YAAY,UAAa,YAAY,OAAO;AAAA,MACrD,CAAC,KAAK,QAAQ,KAAK,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC;AAC9D,UAAI,kBAAkB;AACpB,cAAMA,gBAAe,oBAAI,IAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC;AAC5D,YAAI;AAAA,UACF,gCAAgC,WAAW;AAAA,QAC7C;AACA,eAAO;AAAA,UACL;AAAA,UACA,UAAU;AAAA,UACV,SAAS;AAAA,UACT,eAAe,oBAAI,IAAkC;AAAA,UACrD,cAAAA;AAAA,UACA,cAAc,IAAI,IAAIA,aAAY;AAAA,UAClC,yBAAyB;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AAChE,UAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,YAAM;AAAA,IACR,CAAC,GACE,OAAO,CAAC,SAAS,6BAA6B,KAAK,IAAI,CAAC,EACxD,IAAI,CAAC,SAAS,GAAG,WAAW,IAAI,IAAI,EAAE,EACtC,KAAK;AACR,UAAM,MAAM,0BAA0B,KAAK;AAC3C,UAAM,eAAe,IAAI,IAAI,cAAc;AAC3C,QAAI,UAAU,aAAa;AAC3B,UAAM,gBAAgB,MAAM,WAAW,SAAS;AAChD,QAAI,eAAe;AACjB,mBAAa,IAAI,SAAS;AAC1B,iBAAW;AAAA,IACb;AAQA,QAAI,aAAsB;AAC1B,eAAW,WAAW,cAAc;AAClC,YAAM,YAAY,YAAY,YAAY,YAAY,MAAM,yBAAyB,MAAM,OAAO;AAClG,YAAM,UAAU,MAAM,qBAAqB,IAAI,OAAO,KAAK,MAAM;AACjE,UAAI,GAAG,YAAY;AACjB,YAAI;AACF,gBAAM,GAAG,WAAW;AAAA,YAClB,MAAM,KAAK;AAAA,YACX,MAAM;AAAA,YACN,UAAU,MAAM,yBAAyB,MAAM,OAAO;AAAA,YACtD;AAAA,UACF,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,yBAAe;AACf,cAAI,KAAK,gEAAgE,OAAO,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QACzI;AAAA,MACF,WAAW,YAAY,aAAa,eAAe;AACjD,cAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,MACrC;AAAA,IACF;AACA,QAAI,WAAY,OAAM;AACtB,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,eAAe,oBAAI,IAAI;AAAA,MACvB;AAAA,MACA,cAAc,IAAI,IAAI,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAGO,SAAS,qCAAqC,SAIxC;AACX,QAAM,OAAO,IAAI,IAAI,QAAQ,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACrE,QAAM,UAAU,IAAI,IAAI,QAAQ,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC3E,QAAM,iBAAiB,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,QAAM,aAAa,IAAI,IAAI,QAAQ,UAAU,IAAI,CAAC,MAAM,8BAA8B,EAAE,IAAI,GAAG,QAAQ,CAAC;AACxG,QAAM,iBAAiB,oBAAI,IAAY;AACvC,aAAW,WAAW,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,QAAQ,KAAK,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,GAAG;AAC5F,UAAM,aAAa,8BAA8B,OAAO;AAGxD,QAAI,CAAC,cAAc,CAAC,WAAW,IAAI,WAAW,QAAQ,EAAG;AACzD,UAAM,aAAa,QAAQ,IAAI,OAAO;AACtC,QAAI,eAAe,KAAK,IAAI,OAAO,KAAK,eAAe,eAAe,IAAI,OAAO,GAAG;AAClF,qBAAe,IAAI,WAAW,QAAQ;AAAA,IACxC;AAAA,EACF;AACA,MAAI,eAAe,SAAS,EAAG,QAAO,CAAC;AACvC,QAAM,WAAqB,CAAC;AAG5B,aAAW,WAAW,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,QAAQ,KAAK,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,GAAG;AAC5F,UAAM,aAAa,8BAA8B,OAAO;AACxD,QAAI,cAAc,eAAe,IAAI,WAAW,QAAQ,EAAG,UAAS,KAAK,OAAO;AAAA,EAClF;AACA,SAAO,SAAS,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACjE;","names":["removedPaths"]}

package/dist/{chunk-2QG4SLZI.js → chunk-KF7PQ7G2.js}

@@ -1,6 +1,6 @@
 import {
   extractJsonCandidates
-} from "./chunk-RGMVMVMF.js";
+} from "./chunk-YBA52OKG.js";
 
 // src/background-generation.ts
 async function completeBackgroundGeneration(config, messages, fetchImpl = fetch) {
@@ -41,4 +41,4 @@ export {
   completeBackgroundGeneration,
   parseBackgroundGenerationJson
 };
-//# sourceMappingURL=chunk-2QG4SLZI.js.map
+//# sourceMappingURL=chunk-KF7PQ7G2.js.map

package/dist/{chunk-WIKO4SCR.js → chunk-LHRQBMJN.js}

@@ -5,7 +5,7 @@ import {
 import {
   PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS,
   isSubjectGuardMode
-} from "./chunk-VYCOJKSX.js";
+} from "./chunk-PO7NXNGC.js";
 
 // src/subject-config.ts
 function assertObjectBlock(value, key, shape) {
@@ -52,4 +52,4 @@ function parseSubjectRuntimeConfig(cfg) {
 export {
   parseSubjectRuntimeConfig
 };
-//# sourceMappingURL=chunk-WIKO4SCR.js.map
+//# sourceMappingURL=chunk-LHRQBMJN.js.map

package/dist/{chunk-IFCKHPY4.js → chunk-LO4UKPKX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-VZBW6CDG.js";
+} from "./chunk-B3O3IRZN.js";
 import {
   normalizeRecallTokens
 } from "./chunk-YCVB7X56.js";
@@ -339,4 +339,4 @@ export {
   scoreStitchCandidate,
   stitchCausalChain
 };
-//# sourceMappingURL=chunk-IFCKHPY4.js.map
+//# sourceMappingURL=chunk-LO4UKPKX.js.map

package/dist/{chunk-TEV2JGU5.js → chunk-LU7E2MXE.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-TB6CBZ5V.js";
 import {
   AdapterRegistry
-} from "./chunk-XAITGGX5.js";
+} from "./chunk-Q4AUIFUA.js";
 import {
   maybeRespondRecallNavigation
 } from "./chunk-ZSEFGDCI.js";
@@ -18,13 +18,13 @@ import {
 } from "./chunk-3HSRWJTC.js";
 import {
   respondDeepRecall
-} from "./chunk-IP5VLSLO.js";
+} from "./chunk-YJ7MW627.js";
 import {
   handleSupportPassportOwnerHttp
-} from "./chunk-HKFJ3PF3.js";
+} from "./chunk-CRXRZA3G.js";
 import {
   buildSupportPassportPublicRequestHandler
-} from "./chunk-7QK5TUTW.js";
+} from "./chunk-HLB7GKGG.js";
 import {
   handleMcpGetSse
 } from "./chunk-SRT6SHVZ.js";
@@ -37,34 +37,34 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-QB75LKQQ.js";
+} from "./chunk-IOSZHHJC.js";
 import {
   RelayMissionStoreError
-} from "./chunk-RDEUG2M2.js";
+} from "./chunk-3SGTV7RD.js";
 import {
   executeResolution,
   isValidResolutionVerb
-} from "./chunk-VTPASHTO.js";
+} from "./chunk-R3X2T2LP.js";
 import {
   handleRecallWhyHttpQuery,
   handleRecallXrayHttpQuery
-} from "./chunk-BOUFVFV2.js";
+} from "./chunk-AZSGSRIM.js";
 import {
   toDottedRemnicName
 } from "./chunk-ZQUVBZI4.js";
 import {
   respondOfflineManifestStream,
   respondOfflineSnapshotStream
-} from "./chunk-CK5KOVHW.js";
+} from "./chunk-5R627MYY.js";
 import {
   nonEmptyQueryParam,
   optionalNamespaceKindQueryParam,
   optionalQueryString,
   positiveIntQueryParam
-} from "./chunk-SQDKX4RW.js";
+} from "./chunk-GWM6T5EQ.js";
 import {
   respondBriefingHttp
-} from "./chunk-NMBX4D7P.js";
+} from "./chunk-CZJA2EQE.js";
 import {
   maybeHandleLifecycleFlush
 } from "./chunk-2BPPGNAQ.js";
@@ -75,14 +75,14 @@ import {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace,
   probeOperationAuthorization
-} from "./chunk-C7JAUNFC.js";
+} from "./chunk-4KN2JLQV.js";
 import {
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-SVZWVZ7E.js";
+} from "./chunk-QB57WIS6.js";
 import {
   handleWhoKnowsHttpQuery
-} from "./chunk-IMAP236M.js";
+} from "./chunk-6UQFJULG.js";
 import {
   isTrustZoneName
 } from "./chunk-ROBHL3GL.js";
@@ -94,10 +94,10 @@ import {
 } from "./chunk-QLK3SL7Q.js";
 import {
   validateRequest
-} from "./chunk-IBGEHKQ6.js";
+} from "./chunk-LW3HKRL7.js";
 import {
   peerManifestRevision
-} from "./chunk-S3YM4SZQ.js";
+} from "./chunk-N7QV3CMX.js";
 import {
   assertOperationAllowed,
   capabilityAllowsOp,
@@ -109,7 +109,7 @@ import {
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-WQZZDN5M.js";
+} from "./chunk-OCFXVDBZ.js";
 import {
   isDefaultReviewNamespace,
   listPairs,
@@ -2546,7 +2546,7 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
     if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
       this.enforceTokenOp("contradiction_scan_run");
       const body = await this.readJsonBody(req);
-      const { runContradictionScan } = await import("./contradiction-scan-5EJYRKD3.js");
+      const { runContradictionScan } = await import("./contradiction-scan-TAGMOUQ2.js");
       const principal = this.resolveRequestPrincipal(req);
       const result = await runContradictionScan({
         storage: this.service.storageRef,
@@ -3557,4 +3557,4 @@ export {
   resolveDefaultAdminConsolePublicDir,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-TEV2JGU5.js.map
+//# sourceMappingURL=chunk-LU7E2MXE.js.map

package/dist/{chunk-RJLV4BKR.js → chunk-LV5H6FTN.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-SLEAJ67D.js";
+} from "./chunk-4OQET73E.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
@@ -508,4 +508,4 @@ export {
   NamespaceSearchRouter,
   normalizeQmdResultPath
 };
-//# sourceMappingURL=chunk-RJLV4BKR.js.map
+//# sourceMappingURL=chunk-LV5H6FTN.js.map

package/dist/{chunk-IBGEHKQ6.js → chunk-LW3HKRL7.js}

@@ -1,6 +1,6 @@
 import {
   isValidCapsuleSince
-} from "./chunk-BUKK5SWA.js";
+} from "./chunk-VDX2J7OX.js";
 import {
   CAPSULE_ID_PATTERN
 } from "./chunk-WEHSQBFR.js";
@@ -12,7 +12,7 @@ import {
 import {
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_MAX_MTIME_MS
-} from "./chunk-WQZZDN5M.js";
+} from "./chunk-OCFXVDBZ.js";
 import {
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
@@ -563,4 +563,4 @@ export {
   actionConfidenceRequestSchema,
   validateRequest
 };
-//# sourceMappingURL=chunk-IBGEHKQ6.js.map
+//# sourceMappingURL=chunk-LW3HKRL7.js.map

package/dist/{chunk-3XQYM4RE.js → chunk-M6C7SOR6.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-5JMAGU26.js";
 import {
   runPostConsolidationMaterialize
-} from "./chunk-CK5U7JGH.js";
+} from "./chunk-QI7K7BZ5.js";
 import {
   isSemanticConsolidationLlmOperator
 } from "./chunk-G7D6GZ5J.js";
@@ -220,4 +220,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-3XQYM4RE.js.map
+//# sourceMappingURL=chunk-M6C7SOR6.js.map

package/dist/{chunk-JN72EPOE.js → chunk-MAAL6OZV.js}

@@ -120,7 +120,7 @@ function filePathAad(filePath, memoryDir) {
   }
   return Buffer.from(rel, "utf8");
 }
-async function readMaybeEncryptedFileBuffer(filePath, key, memoryDir) {
+async function readMaybeEncryptedFileBuffer(filePath, key, memoryDir, opts) {
   const buf = await readFile(filePath);
   if (!isEncryptedFile(buf)) {
     return buf;
@@ -130,17 +130,17 @@ async function readMaybeEncryptedFileBuffer(filePath, key, memoryDir) {
       `secure-store is locked \u2014 cannot read encrypted file at ${filePath}. Run \`remnic secure-store unlock\` to decrypt.`
     );
   }
-  return decryptFileBodyForPath(buf, key, filePath, memoryDir);
+  return decryptFileBodyForPath(buf, key, filePath, memoryDir, opts?.aadFilePath);
 }
 async function readMaybeEncryptedFile(filePath, key, memoryDir) {
   return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString("utf8");
 }
 async function writeMaybeEncryptedFile(filePath, content, key, options = {}, memoryDir) {
-  const { mode = 384, atomic = true } = options;
+  const { mode = 384, atomic = true, aadFilePath } = options;
   await mkdir(path.dirname(filePath), { recursive: true });
   let data;
   if (key !== null) {
-    const aad = filePathAad(filePath, memoryDir);
+    const aad = aadFilePath !== void 0 ? filePathAad(aadFilePath, memoryDir) : filePathAad(filePath, memoryDir);
     data = encryptFileBody(content, key, aad);
   } else {
     data = content;
@@ -347,8 +347,8 @@ async function decryptMemoryDirToPlaintext(dir, key) {
 function uniqueAtomicTempPath(filePath, label) {
   return `${filePath}.${label}-${process.pid}-${Date.now()}-${randomUUID()}`;
 }
-function decryptFileBodyForPath(buf, key, filePath, memoryDir) {
-  const aad = filePathAad(filePath, memoryDir);
+function decryptFileBodyForPath(buf, key, filePath, memoryDir, aadFilePath) {
+  const aad = aadFilePath !== void 0 ? filePathAad(aadFilePath, memoryDir) : filePathAad(filePath, memoryDir);
   try {
     return decryptFileBody(buf, key, aad);
   } catch (err) {
@@ -550,4 +550,4 @@ export {
   migrateMemoryDirToEncrypted,
   decryptMemoryDirToPlaintext
 };
-//# sourceMappingURL=chunk-JN72EPOE.js.map
+//# sourceMappingURL=chunk-MAAL6OZV.js.map

package/dist/chunk-MAAL6OZV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { createCipheriv, createDecipheriv, randomBytes, randomUUID } from \"node:crypto\";\nimport { lstat, mkdir, open as openFile, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  AUTH_TAG_LENGTH,\n  ENVELOPE_HEADER_SIZE,\n  ENVELOPE_LAYOUT,\n  ENVELOPE_SALT_LENGTH,\n  ENVELOPE_VERSION,\n  IV_LENGTH,\n  generateSalt,\n  open as openEnvelope,\n  parseEnvelope,\n  seal,\n} from \"./cipher.js\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\nimport { isErrnoCode } from \"../utils/errno.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n/**\n * Exact, deterministic bytes `writeMaybeEncryptedFile` adds to an encrypted\n * file beyond its plaintext body: the magic header prefix plus the fixed\n * envelope header (version + salt + IV + auth tag). AES-256-GCM ciphertext\n * matches the plaintext length and the state-file write path applies no\n * compression, so an encrypted state file is exactly `plaintext +\n * SECURE_STORE_ENVELOPE_OVERHEAD_BYTES` on disk. Compaction reserves this so an\n * encrypted ledger lands strictly below the reader's whole-file decrypt cap\n * (issue #2033).\n */\nexport const SECURE_STORE_ENVELOPE_OVERHEAD_BYTES = MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE;\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\ntype PositionedFileReader = {\n  read: (buffer: Buffer, offset: number, length: number, position: number) => Promise<{ bytesRead: number }>;\n};\n\nasync function readPositionedPrefix(handle: PositionedFileReader, buffer: Buffer): Promise<number> {\n  let bytesRead = 0;\n  while (bytesRead < buffer.length) {\n    const result = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);\n    if (result.bytesRead === 0) break;\n    bytesRead += result.bytesRead;\n  }\n  return bytesRead;\n}\n\n/**\n * True when the REGULAR file at `probePath` is encrypted at rest (its first\n * bytes are the REMNIC-ENC magic header). ENOENT resolves to false — an absent\n * file has nothing to probe. A symlink, FIFO, device, or any other non-regular\n * path is REFUSED with a throw rather than opened: opening a FIFO blocks until a\n * writer appears and a symlink would redirect the probe outside our tree. The\n * ledgers and per-event spills we manage are always regular files, so a\n * non-regular path is an anomaly the caller must treat as unsafe, never follow\n * (#2033). Shared by the CLI ledger recovery probe and the auto-compaction probe\n * so both enforce identical open safety.\n */\nexport async function probeEncryptedRegularFileHeader(probePath: string): Promise<boolean> {\n  let entryStat;\n  try {\n    entryStat = await lstat(probePath);\n  } catch (err) {\n    if (isErrnoCode(err, \"ENOENT\")) return false;\n    throw err;\n  }\n  if (!entryStat.isFile()) {\n    throw new Error(\n      `refusing to probe non-regular state path ${probePath} ` +\n        `(symlink/FIFO/device); opening it could block or escape containment (#2033)`\n    );\n  }\n  const handle = await openFile(probePath, \"r\");\n  try {\n    const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n    const bytesRead = await readPositionedPrefix(handle, header);\n    return isEncryptedFile(header.subarray(0, bytesRead));\n  } finally {\n    await handle.close();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  parseEnvelope(envelope);\n  try {\n    return openEnvelope(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(`secure-store decryption failed: ${msg}`);\n  }\n}\n\nfunction buildHeaderAad(salt: Uint8Array): Buffer {\n  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);\n  out.writeUInt8(ENVELOPE_VERSION, 0);\n  Buffer.from(salt).copy(out, 1);\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFileBuffer(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n  opts?: { aadFilePath?: string }\n): Promise<Buffer> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain file — legacy or unencrypted store.\n    return buf;\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. Run \\`remnic secure-store unlock\\` to decrypt.`\n    );\n  }\n  return decryptFileBodyForPath(buf, key, filePath, memoryDir, opts?.aadFilePath);\n}\n\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string\n): Promise<string> {\n  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n  /**\n   * ABSOLUTE final path whose canonical AAD (via {@link filePathAad})\n   * replaces the physical `filePath`'s. Used by the offline-sync generation\n   * transaction: staged ciphertext physically lives under a staging\n   * directory but must decrypt at its FINAL published path after the\n   * staging directory is swapped into place by rename. Deriving the AAD\n   * from the absolute final path through the SAME filePathAad logic as\n   * ordinary reads keeps write and read derivations identical on every\n   * platform (POSIX and Windows separators alike). (issue #3148, round 4/5)\n   */\n  aadFilePath?: string;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a unique temp file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string | Buffer,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string\n): Promise<void> {\n  const { mode = 0o600, atomic = true, aadFilePath } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = aadFilePath !== undefined ? filePathAad(aadFilePath, memoryDir) : filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = uniqueAtomicTempPath(filePath, \"tmp\");\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\nexport async function writeMaybeEncryptedFileFromChunks(\n  filePath: string,\n  chunks: AsyncIterable<Buffer>,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n  const writePath = atomic ? `${filePath}.tmp-${process.pid}-${Date.now()}` : filePath;\n  let completed = false;\n  try {\n    const handle = await openFile(writePath, \"w\", mode);\n    try {\n      if (key !== null) {\n        const salt = generateSalt();\n        const iv = randomBytes(IV_LENGTH);\n        const header = Buffer.alloc(MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);\n        MAGIC_BYTES.copy(header, 0);\n        header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n        header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n        const envelopeOffset = MAGIC_HEADER_SIZE;\n        header.writeUInt8(ENVELOPE_VERSION, envelopeOffset + ENVELOPE_LAYOUT.version);\n        salt.copy(header, envelopeOffset + ENVELOPE_LAYOUT.salt);\n        iv.copy(header, envelopeOffset + ENVELOPE_LAYOUT.iv);\n        await handle.write(header);\n\n        const cipher = createCipheriv(\"aes-256-gcm\", key, iv, { authTagLength: AUTH_TAG_LENGTH });\n        const aad = filePathAad(filePath, memoryDir);\n        cipher.setAAD(Buffer.concat([buildHeaderAad(salt), aad]));\n        for await (const chunk of chunks) {\n          if (chunk.length === 0) continue;\n          const encrypted = cipher.update(chunk);\n          if (encrypted.length > 0) await handle.write(encrypted);\n        }\n        const final = cipher.final();\n        if (final.length > 0) await handle.write(final);\n        const authTag = cipher.getAuthTag();\n        await handle.write(authTag, 0, authTag.length, MAGIC_HEADER_SIZE + ENVELOPE_LAYOUT.authTag);\n      } else {\n        for await (const chunk of chunks) {\n          if (chunk.length > 0) await handle.write(chunk);\n        }\n      }\n    } finally {\n      await handle.close();\n    }\n    if (atomic) {\n      await rename(writePath, filePath);\n    }\n    completed = true;\n  } finally {\n    if (!completed && atomic) {\n      await unlink(writePath).catch(() => {});\n    }\n  }\n}\n\n/**\n * Stream a file through the secure-store reader without buffering the whole\n * payload. Plaintext files are passed through unchanged; encrypted files are\n * authenticated and decrypted incrementally.\n */\nexport async function* readMaybeEncryptedFileFromChunks(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n  chunkSize = 64 * 1024\n): AsyncIterable<Buffer> {\n  const handle = await openFile(filePath, \"r\");\n  const headerSize = MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE;\n  try {\n    const prefix = Buffer.alloc(headerSize);\n    const prefixBytes = await readPositionedPrefix(handle, prefix);\n    const prefixView = prefix.subarray(0, prefixBytes);\n    if (!isEncryptedFile(prefixView)) {\n      if (prefixBytes > 0) yield Buffer.from(prefixView);\n      let position = prefixBytes;\n      const buffer = Buffer.alloc(chunkSize);\n      for (;;) {\n        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);\n        if (bytesRead === 0) break;\n        position += bytesRead;\n        yield Buffer.from(buffer.subarray(0, bytesRead));\n      }\n      return;\n    }\n    if (prefixBytes < headerSize) {\n      throw new Error(`encrypted file header is truncated: ${filePath}`);\n    }\n    if (key === null) {\n      throw new SecureStoreLockedError(\n        `secure-store is locked — cannot read encrypted file at ${filePath}. ` +\n          \"Run `remnic secure-store unlock` to decrypt.\"\n      );\n    }\n    const envelope = prefix.subarray(MAGIC_HEADER_SIZE);\n    const version = envelope.readUInt8(ENVELOPE_LAYOUT.version);\n    if (version !== ENVELOPE_VERSION) {\n      throw new Error(`secure-store: unsupported envelope version ${version}`);\n    }\n    const salt = envelope.subarray(ENVELOPE_LAYOUT.salt, ENVELOPE_LAYOUT.salt + ENVELOPE_SALT_LENGTH);\n    const iv = envelope.subarray(ENVELOPE_LAYOUT.iv, ENVELOPE_LAYOUT.iv + IV_LENGTH);\n    const authTag = envelope.subarray(ENVELOPE_LAYOUT.authTag, ENVELOPE_LAYOUT.authTag + AUTH_TAG_LENGTH);\n    const decipher = createDecipheriv(\"aes-256-gcm\", key, iv, { authTagLength: AUTH_TAG_LENGTH });\n    decipher.setAAD(Buffer.concat([buildHeaderAad(salt), filePathAad(filePath, memoryDir)]));\n    decipher.setAuthTag(authTag);\n    let position = headerSize;\n    const buffer = Buffer.alloc(chunkSize);\n    try {\n      for (;;) {\n        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);\n        if (bytesRead === 0) break;\n        position += bytesRead;\n        const plain = decipher.update(buffer.subarray(0, bytesRead));\n        if (plain.length > 0) yield plain;\n      }\n      const final = decipher.final();\n      if (final.length > 0) yield final;\n    } catch (err) {\n      if (err instanceof SecureStoreDecryptError) throw err;\n      const message = err instanceof Error ? err.message : String(err);\n      throw new SecureStoreDecryptError(`secure-store decryption failed: ${message}`);\n    }\n  } finally {\n    await handle.close();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, dir);\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = uniqueAtomicTempPath(filePath, \"enc-tmp\");\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(dir: string, key: Buffer): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const plaintext = decryptFileBodyForPath(buf, key, filePath, dir);\n      const tempPath = uniqueAtomicTempPath(filePath, \"dec-tmp\");\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction uniqueAtomicTempPath(filePath: string, label: string): string {\n  return `${filePath}.${label}-${process.pid}-${Date.now()}-${randomUUID()}`;\n}\n\nfunction decryptFileBodyForPath(\n  buf: Buffer,\n  key: Buffer,\n  filePath: string,\n  memoryDir?: string,\n  aadFilePath?: string\n): Buffer {\n  // A canonical-AAD stage read (offline-sync generation transaction) binds\n  // the FINAL published path, not the physical staging path.\n  const aad = aadFilePath !== undefined ? filePathAad(aadFilePath, memoryDir) : filePathAad(filePath, memoryDir);\n  try {\n    return decryptFileBody(buf, key, aad);\n  } catch (err) {\n    if (!(err instanceof SecureStoreDecryptError)) {\n      throw err;\n    }\n    const legacyRoot = legacyNamespaceAadRootForFile(filePath, memoryDir);\n    if (legacyRoot) {\n      try {\n        return decryptFileBody(buf, key, filePathAad(filePath, legacyRoot));\n      } catch {\n        // Fall through to the namespace-reader fallback below.\n      }\n    }\n\n    const topLevelRoot = topLevelAadRootForNamespaceReader(filePath, memoryDir);\n    if (topLevelRoot) {\n      try {\n        return decryptFileBody(buf, key, filePathAad(filePath, topLevelRoot));\n      } catch {\n        // Preserve the caller-facing error from the canonical decrypt attempt.\n      }\n    }\n\n    throw err;\n  }\n}\n\nfunction topLevelAadRootForNamespaceReader(filePath: string, memoryDir?: string): string | null {\n  if (!memoryDir || !path.isAbsolute(filePath)) return null;\n  const resolvedMemoryDir = path.resolve(memoryDir);\n  const rel = path.relative(resolvedMemoryDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return null;\n  const parts = resolvedMemoryDir.split(path.sep);\n  if (parts.length < 3 || parts.at(-2) !== \"namespaces\" || !parts.at(-1)) return null;\n  const topLevelRoot = parts.slice(0, -2).join(path.sep) || path.sep;\n  const topRel = path.relative(topLevelRoot, filePath);\n  if (topRel === \"\" || topRel.startsWith(\"..\") || path.isAbsolute(topRel)) {\n    return null;\n  }\n  const topParts = topRel.split(path.sep);\n  if (topParts[0] !== \"namespaces\" || topParts[1] !== parts.at(-1)) {\n    return null;\n  }\n  return topLevelRoot;\n}\n\nfunction legacyNamespaceAadRootForFile(filePath: string, memoryDir?: string): string | null {\n  if (!memoryDir || !path.isAbsolute(filePath)) return null;\n  const rel = path.relative(memoryDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return null;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(memoryDir, \"namespaces\", parts[1]);\n  }\n  return null;\n}\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir\n): Promise<string[]> {\n  const results: string[] = [];\n  let scanDir = dir;\n  let scanRootDir = rootDir;\n  if (path.resolve(dir) === path.resolve(rootDir)) {\n    const normalizedRoot = await resolveStorageManagedRootForScan(dir);\n    if (!normalizedRoot) return results;\n    scanDir = normalizedRoot;\n    scanRootDir = normalizedRoot;\n  }\n  let names: string[];\n  try {\n    names = await readdir(scanDir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(scanDir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, scanRootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, scanRootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nasync function resolveStorageManagedRootForScan(dir: string): Promise<string | null> {\n  const lstatPath = normalizePathForLstat(dir);\n  let stat: Awaited<ReturnType<typeof lstat>>;\n  try {\n    stat = await lstat(lstatPath);\n  } catch (error) {\n    if (isFsErrorWithCode(error, \"ENOENT\")) return null;\n    throw error;\n  }\n  if (stat.isSymbolicLink()) {\n    throw new Error(`secure-store migration root must not be a symlink: ${dir}`);\n  }\n  if (!stat.isDirectory()) {\n    throw new Error(`secure-store migration root must be a directory: ${dir}`);\n  }\n  return lstatPath;\n}\n\nfunction normalizePathForLstat(filePath: string): string {\n  return stripTrailingPathSeparators(path.normalize(filePath));\n}\n\nfunction isFsErrorWithCode(error: unknown, code: string): boolean {\n  return typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === code;\n}\n\nfunction stripTrailingPathSeparators(filePath: string): string {\n  const root = path.parse(filePath).root;\n  let end = filePath.length;\n  while (\n    end > root.length &&\n    (filePath[end - 1] === path.sep || filePath[end - 1] === path.posix.sep || filePath[end - 1] === path.win32.sep)\n  ) {\n    end -= 1;\n  }\n  return end === filePath.length ? filePath : filePath.slice(0, end);\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\n// Every recall MEMORY category directory (facts/ + the CATEGORY_DIR_MAP memory\n// dirs) must be encryptable at rest — #1546 routes decision/preference/moment/...\n// memories into their own dirs, so hardcoding only facts/corrections/procedures/\n// reasoning-traces would silently write those categories in plaintext on\n// encrypted stores. RECALL_FALLBACK_DIRS is the single source of truth for that\n// set; the extra non-category markdown roots (artifacts/archive/entities/\n// identity) are appended.\n//\n// questions/ is deliberately EXCLUDED (RECALL_FALLBACK_DIRS omits the non-memory\n// queue dirs): the question queue is written/resolved through plain readFile/\n// writeFile (StorageManager.writeQuestion/resolveQuestion), NOT the secure-file\n// helpers. Encrypting questions/ here would make migration seal those files,\n// after which resolveQuestion() would read ciphertext as UTF-8, fail to update\n// the frontmatter, and overwrite/corrupt the file while returning success\n// (codex #1563 review). Keeping questions/ plaintext preserves the queue's\n// existing behavior; #1546 does not change question encryption.\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set<string>([\n  ...RECALL_FALLBACK_DIRS,\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\"state\", \"indexes\", \"index\", \"provenance\"]);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6CA,SAAS,gBAAgB,kBAAkB,aAAa,kBAAkB;AAC1E,SAAS,OAAO,OAAO,QAAQ,UAAU,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC7F,OAAO,UAAU;AA0BV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAY/C,IAAM,uCAAuC,oBAAoB;AAUjE,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAMA,eAAe,qBAAqB,QAA8B,QAAiC;AACjG,MAAI,YAAY;AAChB,SAAO,YAAY,OAAO,QAAQ;AAChC,UAAM,SAAS,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO,SAAS,WAAW,SAAS;AACxF,QAAI,OAAO,cAAc,EAAG;AAC5B,iBAAa,OAAO;AAAA,EACtB;AACA,SAAO;AACT;AAaA,eAAsB,gCAAgC,WAAqC;AACzF,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,MAAM,SAAS;AAAA,EACnC,SAAS,KAAK;AACZ,QAAI,YAAY,KAAK,QAAQ,EAAG,QAAO;AACvC,UAAM;AAAA,EACR;AACA,MAAI,CAAC,UAAU,OAAO,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,SAAS;AAAA,IAEvD;AAAA,EACF;AACA,QAAM,SAAS,MAAM,SAAS,WAAW,GAAG;AAC5C,MAAI;AACF,UAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,UAAM,YAAY,MAAM,qBAAqB,QAAQ,MAAM;AAC3D,WAAO,gBAAgB,OAAO,SAAS,GAAG,SAAS,CAAC;AAAA,EACtD,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,gBAAc,QAAQ;AACtB,MAAI;AACF,WAAO,KAAa,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI,wBAAwB,mCAAmC,GAAG,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,eAAe,MAA0B;AAChD,QAAM,MAAM,OAAO,MAAM,IAAI,oBAAoB;AACjD,MAAI,WAAW,kBAAkB,CAAC;AAClC,SAAO,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAC7B,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,6BACpB,UACA,KACA,WACA,MACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IACpE;AAAA,EACF;AACA,SAAO,uBAAuB,KAAK,KAAK,UAAU,WAAW,MAAM,WAAW;AAChF;AAEA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,UAAQ,MAAM,6BAA6B,UAAU,KAAK,SAAS,GAAG,SAAS,MAAM;AACvF;AAoCA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,MAAM,YAAY,IAAI;AACrD,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,gBAAgB,SAAY,YAAY,aAAa,SAAS,IAAI,YAAY,UAAU,SAAS;AAC7G,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,qBAAqB,UAAU,KAAK;AACrD,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AAEA,eAAsB,kCACpB,UACA,QACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,YAAY,SAAS,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK;AAC5E,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,WAAW,KAAK,IAAI;AAClD,QAAI;AACF,UAAI,QAAQ,MAAM;AAChB,cAAM,OAAO,aAAa;AAC1B,cAAM,KAAK,YAAY,SAAS;AAChC,cAAM,SAAS,OAAO,MAAM,oBAAoB,oBAAoB;AACpE,oBAAY,KAAK,QAAQ,CAAC;AAC1B,eAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,eAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAC3D,cAAM,iBAAiB;AACvB,eAAO,WAAW,kBAAkB,iBAAiB,gBAAgB,OAAO;AAC5E,aAAK,KAAK,QAAQ,iBAAiB,gBAAgB,IAAI;AACvD,WAAG,KAAK,QAAQ,iBAAiB,gBAAgB,EAAE;AACnD,cAAM,OAAO,MAAM,MAAM;AAEzB,cAAM,SAAS,eAAe,eAAe,KAAK,IAAI,EAAE,eAAe,gBAAgB,CAAC;AACxF,cAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,eAAO,OAAO,OAAO,OAAO,CAAC,eAAe,IAAI,GAAG,GAAG,CAAC,CAAC;AACxD,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,WAAW,EAAG;AACxB,gBAAM,YAAY,OAAO,OAAO,KAAK;AACrC,cAAI,UAAU,SAAS,EAAG,OAAM,OAAO,MAAM,SAAS;AAAA,QACxD;AACA,cAAM,QAAQ,OAAO,MAAM;AAC3B,YAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAC9C,cAAM,UAAU,OAAO,WAAW;AAClC,cAAM,OAAO,MAAM,SAAS,GAAG,QAAQ,QAAQ,oBAAoB,gBAAgB,OAAO;AAAA,MAC5F,OAAO;AACL,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAAA,QAChD;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,QAAI,QAAQ;AACV,YAAM,OAAO,WAAW,QAAQ;AAAA,IAClC;AACA,gBAAY;AAAA,EACd,UAAE;AACA,QAAI,CAAC,aAAa,QAAQ;AACxB,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AAOA,gBAAuB,iCACrB,UACA,KACA,WACA,YAAY,KAAK,MACM;AACvB,QAAM,SAAS,MAAM,SAAS,UAAU,GAAG;AAC3C,QAAM,aAAa,oBAAoB;AACvC,MAAI;AACF,UAAM,SAAS,OAAO,MAAM,UAAU;AACtC,UAAM,cAAc,MAAM,qBAAqB,QAAQ,MAAM;AAC7D,UAAM,aAAa,OAAO,SAAS,GAAG,WAAW;AACjD,QAAI,CAAC,gBAAgB,UAAU,GAAG;AAChC,UAAI,cAAc,EAAG,OAAM,OAAO,KAAK,UAAU;AACjD,UAAIA,YAAW;AACf,YAAMC,UAAS,OAAO,MAAM,SAAS;AACrC,iBAAS;AACP,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAKA,SAAQ,GAAGA,QAAO,QAAQD,SAAQ;AAC1E,YAAI,cAAc,EAAG;AACrB,QAAAA,aAAY;AACZ,cAAM,OAAO,KAAKC,QAAO,SAAS,GAAG,SAAS,CAAC;AAAA,MACjD;AACA;AAAA,IACF;AACA,QAAI,cAAc,YAAY;AAC5B,YAAM,IAAI,MAAM,uCAAuC,QAAQ,EAAE;AAAA,IACnE;AACA,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI;AAAA,QACR,+DAA0D,QAAQ;AAAA,MAEpE;AAAA,IACF;AACA,UAAM,WAAW,OAAO,SAAS,iBAAiB;AAClD,UAAM,UAAU,SAAS,UAAU,gBAAgB,OAAO;AAC1D,QAAI,YAAY,kBAAkB;AAChC,YAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE;AAAA,IACzE;AACA,UAAM,OAAO,SAAS,SAAS,gBAAgB,MAAM,gBAAgB,OAAO,oBAAoB;AAChG,UAAM,KAAK,SAAS,SAAS,gBAAgB,IAAI,gBAAgB,KAAK,SAAS;AAC/E,UAAM,UAAU,SAAS,SAAS,gBAAgB,SAAS,gBAAgB,UAAU,eAAe;AACpG,UAAM,WAAW,iBAAiB,eAAe,KAAK,IAAI,EAAE,eAAe,gBAAgB,CAAC;AAC5F,aAAS,OAAO,OAAO,OAAO,CAAC,eAAe,IAAI,GAAG,YAAY,UAAU,SAAS,CAAC,CAAC,CAAC;AACvF,aAAS,WAAW,OAAO;AAC3B,QAAI,WAAW;AACf,UAAM,SAAS,OAAO,MAAM,SAAS;AACrC,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,QAAQ;AAC1E,YAAI,cAAc,EAAG;AACrB,oBAAY;AACZ,cAAM,QAAQ,SAAS,OAAO,OAAO,SAAS,GAAG,SAAS,CAAC;AAC3D,YAAI,MAAM,SAAS,EAAG,OAAM;AAAA,MAC9B;AACA,YAAM,QAAQ,SAAS,MAAM;AAC7B,UAAI,MAAM,SAAS,EAAG,OAAM;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,eAAe,wBAAyB,OAAM;AAClD,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,YAAM,IAAI,wBAAwB,mCAAmC,OAAO,EAAE;AAAA,IAChF;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,GAAG;AACrC,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BAA4B,KAAa,KAAqC;AAClG,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,YAAY,uBAAuB,KAAK,KAAK,UAAU,GAAG;AAChE,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,qBAAqB,UAAkB,OAAuB;AACrE,SAAO,GAAG,QAAQ,IAAI,KAAK,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC;AAC1E;AAEA,SAAS,uBACP,KACA,KACA,UACA,WACA,aACQ;AAGR,QAAM,MAAM,gBAAgB,SAAY,YAAY,aAAa,SAAS,IAAI,YAAY,UAAU,SAAS;AAC7G,MAAI;AACF,WAAO,gBAAgB,KAAK,KAAK,GAAG;AAAA,EACtC,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,0BAA0B;AAC7C,YAAM;AAAA,IACR;AACA,UAAM,aAAa,8BAA8B,UAAU,SAAS;AACpE,QAAI,YAAY;AACd,UAAI;AACF,eAAO,gBAAgB,KAAK,KAAK,YAAY,UAAU,UAAU,CAAC;AAAA,MACpE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,eAAe,kCAAkC,UAAU,SAAS;AAC1E,QAAI,cAAc;AAChB,UAAI;AACF,eAAO,gBAAgB,KAAK,KAAK,YAAY,UAAU,YAAY,CAAC;AAAA,MACtE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,kCAAkC,UAAkB,WAAmC;AAC9F,MAAI,CAAC,aAAa,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AACrD,QAAM,oBAAoB,KAAK,QAAQ,SAAS;AAChD,QAAM,MAAM,KAAK,SAAS,mBAAmB,QAAQ;AACrD,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,kBAAkB,MAAM,KAAK,GAAG;AAC9C,MAAI,MAAM,SAAS,KAAK,MAAM,GAAG,EAAE,MAAM,gBAAgB,CAAC,MAAM,GAAG,EAAE,EAAG,QAAO;AAC/E,QAAM,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,GAAG,KAAK,KAAK;AAC/D,QAAM,SAAS,KAAK,SAAS,cAAc,QAAQ;AACnD,MAAI,WAAW,MAAM,OAAO,WAAW,IAAI,KAAK,KAAK,WAAW,MAAM,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,MAAM,KAAK,GAAG;AACtC,MAAI,SAAS,CAAC,MAAM,gBAAgB,SAAS,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG;AAChE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,UAAkB,WAAmC;AAC1F,MAAI,CAAC,aAAa,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AACrD,QAAM,MAAM,KAAK,SAAS,WAAW,QAAQ;AAC7C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,WAAW,cAAc,MAAM,CAAC,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AAOA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU;AACd,MAAI,cAAc;AAClB,MAAI,KAAK,QAAQ,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG;AAC/C,UAAM,iBAAiB,MAAM,iCAAiC,GAAG;AACjE,QAAI,CAAC,eAAgB,QAAO;AAC5B,cAAU;AACV,kBAAc;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS,EAAE,UAAU,OAAO,CAAC;AAAA,EACrD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,SAAS,IAAI;AACpC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,WAAW;AAC3E,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,iCAAiC,KAAqC;AACnF,QAAM,YAAY,sBAAsB,GAAG;AAC3C,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,MAAM,SAAS;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,kBAAkB,OAAO,QAAQ,EAAG,QAAO;AAC/C,UAAM;AAAA,EACR;AACA,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,sDAAsD,GAAG,EAAE;AAAA,EAC7E;AACA,MAAI,CAAC,KAAK,YAAY,GAAG;AACvB,UAAM,IAAI,MAAM,oDAAoD,GAAG,EAAE;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAA0B;AACvD,SAAO,4BAA4B,KAAK,UAAU,QAAQ,CAAC;AAC7D;AAEA,SAAS,kBAAkB,OAAgB,MAAuB;AAChE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAC/F;AAEA,SAAS,4BAA4B,UAA0B;AAC7D,QAAM,OAAO,KAAK,MAAM,QAAQ,EAAE;AAClC,MAAI,MAAM,SAAS;AACnB,SACE,MAAM,KAAK,WACV,SAAS,MAAM,CAAC,MAAM,KAAK,OAAO,SAAS,MAAM,CAAC,MAAM,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC,MAAM,KAAK,MAAM,MAC5G;AACA,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,SAAS,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG;AACnE;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAkBA,IAAM,qCAAqC,oBAAI,IAAY;AAAA,EACzD,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,SAAS,WAAW,SAAS,YAAY,CAAC;","names":["position","buffer","unlink"]}

package/dist/{chunk-MY2PLXSM.js → chunk-MCTM4YPL.js}

@@ -551,6 +551,7 @@ var TOOL_OUTPUT_SCHEMAS = {
     maintenanceLedgerTail: T_ARRAY,
     qmdProbe: T_OBJECT,
     daemon: T_OBJECT,
+    embeddingIndex: T_OBJECT,
     errors: T_ARRAY
   }),
   dreams_status: objectSchema({ phases: T_OBJECT, windowStart: T_STRING, windowEnd: T_STRING }),
@@ -630,4 +631,4 @@ function applyToolOutputSchemas(tools, canonicalPrefix, legacyPrefix) {
 export {
   applyToolOutputSchemas
 };
-//# sourceMappingURL=chunk-MY2PLXSM.js.map
+//# sourceMappingURL=chunk-MCTM4YPL.js.map