@remnic/core 9.69.87 → 9.69.89

package/dist/chunk-UCPGOUDZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embedding-index-storage.ts"],"sourcesContent":["/**\n * File-level storage for the embedding fallback index (issue #3146).\n *\n * Two single-generation layouts, exactly one authoritative at a time:\n *   - `legacy`:  the single `state/embeddings.json` file, used while the\n *     whole index serializes within `resolveIndexFileCharLimit()` chars;\n *   - `sharded`: the published `state/embeddings/` directory of hash-assigned\n *     shard files, migrated to ONE-WAY and ATOMICALLY (stage a complete shard\n *     set, publish with a single directory rename, demote the legacy file to\n *     a non-authoritative recovery artifact). Generations never merge, so a\n *     crash cannot resurrect deleted entries or drop published ones.\n *\n * This module owns files, budgets, and durable diagnostics only — no index\n * caching or provider logic (that lives in `embedding-fallback.ts`).\n */\nimport path from \"node:path\";\nimport { constants as bufferConstants } from \"node:buffer\";\nimport { lstat, mkdir, mkdtemp, realpath, readFile, readdir, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport { log } from \"./logger.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport type { EmbeddingGenerationFence } from \"./embedding-generation-lock.js\";\n\nexport type EmbeddingProviderType = \"openai\" | \"local\" | \"host\";\n\nexport type EmbeddingIndexEntry = {\n  vector: number[];\n  path: string;\n};\n\nexport type EmbeddingIndexFile = {\n  version: 1;\n  provider: EmbeddingProviderType;\n  model: string;\n  entries: Record<string, EmbeddingIndexEntry>;\n};\n\nexport type EmbeddingIndexIdentity = Pick<EmbeddingIndexFile, \"provider\" | \"model\">;\n\n/** Outcome of reading one managed index file (legacy or shard). */\nexport type ManagedIndexRead =\n  | { outcome: \"ok\"; file: EmbeddingIndexFile }\n  | { outcome: \"absent\" }\n  | { outcome: \"foreign\" }\n  | { outcome: \"unreadable\"; reason: string };\n\n/** Which generation owns the index right now. */\nexport type IndexLayout = \"empty\" | \"legacy\" | \"sharded\";\n\n/**\n * Thrown when an embedding index (or one of its shards) cannot be persisted\n * within the per-file serialization budget. Issue #3146: index files are\n * materialized as single V8 strings, so a JSON document at or past\n * `bufferConstants.MAX_STRING_LENGTH` chars makes every read and write throw\n * `RangeError: Invalid string length`. The index is sharded before that\n * ceiling; this tagged error is reserved for the residual case where even\n * one shard cannot hold the payload (e.g. a single entry with an enormous\n * vector), so callers can classify it as recoverable-with-record instead of\n * an opaque background failure.\n */\nexport class EmbeddingIndexCapacityError extends Error {\n  override readonly name = \"EmbeddingIndexCapacityError\" as const;\n  constructor(\n    message: string,\n    readonly memoryId?: string,\n  ) {\n    super(message);\n  }\n}\n\n/**\n * Thrown when an index file that should be authoritative cannot be read\n * (I/O error, over-budget size, unparseable JSON). Mutation paths fail\n * CLOSED on this: they must not continue with a fresh empty index and\n * pretend the previous vectors were loaded — the file is left untouched in\n * place for recovery. Read-only paths (recall) fail open to empty results\n * and record the reason durably.\n */\nexport class EmbeddingIndexStorageError extends Error {\n  override readonly name = \"EmbeddingIndexStorageError\" as const;\n}\n\n/** Durable diagnostic row describing the last failed embedding-index write. */\nexport interface EmbeddingIndexWriteFailure {\n  ts: string;\n  kind: \"capacity\" | \"io\";\n  message: string;\n  memoryId?: string;\n}\n\n/**\n * Durable embedding-index diagnostics (issue #3146), persisted at\n * `<memoryDir>/state/embedding-fallback-status.json` and surfaced through\n * console_state, so background ingestion failures are visible to operators\n * instead of only ever appearing as log lines.\n */\nexport interface EmbeddingIndexStatusFile {\n  version: 1;\n  /** Cumulative count of failed index writes since the file was created. */\n  failureCount: number;\n  /** Active write failure; cleared by the next successful save. */\n  lastWriteFailure?: EmbeddingIndexWriteFailure;\n  /** Set when an unreadable index file was detected instead of overwritten. */\n  lastReadRecovery?: { ts: string; message: string };\n  lastSuccessAt?: string;\n}\n\n/**\n * Per-file serialization budget (JSON-string chars) for WRITES of the legacy\n * `state/embeddings.json` file and of every shard under `state/embeddings/`.\n * The 16MiB margin keeps the write round-trip clear of the V8 single-string\n * ceiling even with UTF-8 byte/count skew and small header growth. Override\n * per environment (tests, headroom tuning) via\n * `REMNIC_EMBEDDING_INDEX_FILE_CHAR_LIMIT`.\n *\n * READS are gated by the HARD ceiling (`resolveIndexHardReadCharLimit`),\n * never by this budget: a legacy index written by an older version may\n * legitimately sit between the soft budget and the hard ceiling (the\n * reported production file does), and it must still load and migrate.\n */\nconst DEFAULT_INDEX_FILE_CHAR_LIMIT =\n  bufferConstants.MAX_STRING_LENGTH - 16 * 1024 * 1024;\n\n/**\n * Hard single-string ceiling for READS: files at or above this size are not\n * attempted (a readFile would throw `RangeError: Invalid string length`);\n * their bytes are preserved in place and mutations fail closed with an\n * actionable error. Defaults to the V8 maximum; tests inject a small value\n * via `REMNIC_EMBEDDING_INDEX_HARD_READ_LIMIT_CHARS`.\n */\nfunction resolveIndexHardReadCharLimit(): number {\n  const soft = resolveIndexFileCharLimit();\n  const raw = readEnvVar(\"REMNIC_EMBEDDING_INDEX_HARD_READ_LIMIT_CHARS\");\n  if (raw) {\n    const parsed = Number(raw);\n    if (Number.isInteger(parsed) && parsed >= soft) return parsed;\n  }\n  return bufferConstants.MAX_STRING_LENGTH;\n}\n\n/** Hash shards under `state/embeddings/` used once the budget is exceeded. */\nconst SHARD_COUNT = 64;\n\nconst SHARD_FILE_PATTERN = /^shard-\\d{4}\\.json$/;\n\nexport function resolveIndexFileCharLimit(): number {\n  const raw = readEnvVar(\"REMNIC_EMBEDDING_INDEX_FILE_CHAR_LIMIT\");\n  if (raw) {\n    const parsed = Number(raw);\n    if (Number.isInteger(parsed) && parsed >= 1024) return parsed;\n  }\n  return DEFAULT_INDEX_FILE_CHAR_LIMIT;\n}\n\nfunction shardFileName(shardIndex: number): string {\n  return `shard-${String(shardIndex).padStart(4, \"0\")}.json`;\n}\n\n/**\n * Fixed transaction backup path for identity replacements. A fixed (not\n * per-process) name is what makes the rename gap recoverable: whatever\n * process restarts after a crash finds the demoted former generation here\n * and rolls it back into place.\n */\nfunction replacementBackupPath(shardDir: string): string {\n  return path.join(path.dirname(shardDir), \"embeddings.pre-replace.tmp\");\n}\n\n/**\n * Stable FNV-1a shard assignment: an entry always hashes to the same shard,\n * so an update or removal never needs a manifest to find its file.\n */\nexport function shardIndexOf(memoryId: string, shardCount: number): number {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < memoryId.length; i++) {\n    hash ^= memoryId.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return hash % shardCount;\n}\n\n/**\n * A shard file named `shard-NNNN.json` must only contain ids that hash to\n * that shard: a misplaced copy would be loaded today and silently resurrect\n * stale vectors after the computed shard is rewritten (issue #3148, round 6).\n * Throws the tagged storage error so mutations fail closed and recall fails\n * open at its boundary.\n */\nexport function validateShardMembership(shardName: string, file: EmbeddingIndexFile): void {\n  const match = /^shard-(\\d{4})\\.json$/.exec(shardName);\n  if (!match) return; // not a shard file (legacy documents have no constraint)\n  const shardIndex = Number(match[1]);\n  for (const id of Object.keys(file.entries)) {\n    if (shardIndexOf(id, SHARD_COUNT) !== shardIndex) {\n      throw new EmbeddingIndexStorageError(\n        `refusing embedding index shard ${shardName}: id ${id} hashes to shard ${shardIndexOf(id, SHARD_COUNT)}, not ${shardIndex}; file preserved in place`,\n      );\n    }\n  }\n}\n\nexport function isInvalidStringLengthError(err: unknown): boolean {\n  return err instanceof RangeError && /invalid string length/i.test(err.message);\n}\n\n/**\n * Parse and FULLY validate one serialized index document (legacy or shard).\n * The single read boundary shared by disk reads and offline-sync pulls: a\n * document with a valid header but a malformed body (`entries` not a plain\n * record, or an entry whose `path` is not a string / whose `vector` is not a\n * finite-number array) is `unreadable`, not `ok` — recall fails open on the\n * tagged reason, mutations fail closed, and the bytes are never overwritten\n * (issue #3148 review, round 4).\n */\nexport function parseEmbeddingIndexDocument(raw: string): ManagedIndexRead {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    return {\n      outcome: \"unreadable\",\n      reason: `JSON parse failed: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n  if (\n    !parsed ||\n    typeof parsed !== \"object\" ||\n    Array.isArray(parsed) ||\n    (parsed as Partial<EmbeddingIndexFile>).version !== 1 ||\n    typeof (parsed as Partial<EmbeddingIndexFile>).provider !== \"string\" ||\n    typeof (parsed as Partial<EmbeddingIndexFile>).model !== \"string\" ||\n    ((parsed as Partial<EmbeddingIndexFile>).model as string).length === 0\n  ) {\n    return { outcome: \"foreign\" };\n  }\n  // An unsupported identity must fail closed like any other malformed\n  // document: recall cannot serve it and mutations must not adopt it as\n  // authoritative (issue #3148, round 6).\n  if (\n    (parsed as Partial<EmbeddingIndexFile>).provider !== \"openai\" &&\n    (parsed as Partial<EmbeddingIndexFile>).provider !== \"local\" &&\n    (parsed as Partial<EmbeddingIndexFile>).provider !== \"host\"\n  ) {\n    return { outcome: \"foreign\" };\n  }\n  const entries = (parsed as Partial<EmbeddingIndexFile>).entries;\n  if (!entries || typeof entries !== \"object\" || Array.isArray(entries)) {\n    return {\n      outcome: \"unreadable\",\n      reason: \"entries must be a plain record of memory id -> entry\",\n    };\n  }\n  for (const [id, entry] of Object.entries(entries as Record<string, unknown>)) {\n    if (!entry || typeof entry !== \"object\" || Array.isArray(entry)) {\n      return { outcome: \"unreadable\", reason: `entry ${id} must be an object` };\n    }\n    const candidate = entry as Partial<EmbeddingIndexEntry>;\n    if (typeof candidate.path !== \"string\") {\n      return { outcome: \"unreadable\", reason: `entry ${id}.path must be a string` };\n    }\n    if (!Array.isArray(candidate.vector)) {\n      return { outcome: \"unreadable\", reason: `entry ${id}.vector must be an array` };\n    }\n    for (const component of candidate.vector) {\n      if (!Number.isFinite(component)) {\n        return {\n          outcome: \"unreadable\",\n          reason: `entry ${id}.vector must contain only finite numbers`,\n        };\n      }\n    }\n  }\n  return { outcome: \"ok\", file: parsed as EmbeddingIndexFile };\n}\n\n/**\n * Group a complete index into per-shard entry records using the stable FNV\n * assignment. Shared by `persist()` and the offline-sync generation\n * transaction so a converted generation shards identically everywhere.\n */\nexport function shardEntriesForIndex(\n  index: EmbeddingIndexFile,\n): Map<number, Record<string, EmbeddingIndexEntry>> {\n  const groups = new Map<number, Record<string, EmbeddingIndexEntry>>();\n  for (const id of Object.keys(index.entries)) {\n    const shardIndex = shardIndexOf(id, SHARD_COUNT);\n    const group = groups.get(shardIndex);\n    if (group) group[id] = index.entries[id];\n    else groups.set(shardIndex, { [id]: index.entries[id] });\n  }\n  return groups;\n}\n\n/**\n * Serialize one shard, translating a ceiling overflow into a tagged,\n * recoverable capacity error. Exported for the offline-sync generation\n * transaction, which stages incoming generations through the same budget.\n */\nexport function serializeEmbeddingShard(\n  index: EmbeddingIndexFile,\n  shardIndex: number,\n  entries: Record<string, EmbeddingIndexEntry>,\n  limit: number = resolveIndexFileCharLimit(),\n): string {\n  let body: string;\n  try {\n    body = JSON.stringify({\n      version: 1 as const,\n      provider: index.provider,\n      model: index.model,\n      entries,\n    });\n  } catch (err) {\n    throw new EmbeddingIndexCapacityError(\n      `embedding index shard ${shardFileName(shardIndex)} exceeded the single-string ceiling while serializing: ${err instanceof Error ? err.message : String(err)}`,\n      largestEntryId(entries) || undefined,\n    );\n  }\n  if (body.length > limit) {\n    const worstId = largestEntryId(entries);\n    const worstLength = worstId && entries[worstId] ? JSON.stringify(entries[worstId]).length : 0;\n    throw new EmbeddingIndexCapacityError(\n      `embedding index shard ${shardFileName(shardIndex)} needs ${body.length} chars, over the ${limit}-char single-file limit; largest entry ${worstId || \"(unknown)\"} serializes to ${worstLength} chars`,\n      worstId || undefined,\n    );\n  }\n  return body;\n}\n\nfunction largestEntryId(entries: Record<string, EmbeddingIndexEntry>): string {\n  let worstId = \"\";\n  let worstLength = 0;\n  for (const [id, entry] of Object.entries(entries)) {\n    let length: number;\n    try {\n      length = JSON.stringify(entry).length;\n    } catch {\n      return id;\n    }\n    if (length > worstLength) {\n      worstLength = length;\n      worstId = id;\n    }\n  }\n  return worstId;\n}\n\n/**\n * Optional canonical secure-store IO for the daemon. When provided (both\n * halves), file content is read/written through the SAME\n * StorageManager-backed contract offline sync uses: canonical-path AAD,\n * secure-key-aware, atomic. Shard STAGING writes carry the FINAL published\n * path so the post-publish rename keeps the ciphertext decryptable; dirty\n * shard, status, and legacy writes are their own canonical final path.\n * When omitted, the store behaves exactly as before (raw plaintext fs).\n * The diagnostics status file is intentionally ALWAYS plain: it holds no\n * memory content (failure strings/counts only) and console_state reads it\n * without unlocking the store.\n */\nexport interface EmbeddingIndexStoreIo {\n  readUtf8(filePath: string): Promise<string>;\n  writeUtf8(filePath: string, contents: string, opts?: { finalAadFilePath?: string }): Promise<void>;\n}\n\nexport class EmbeddingIndexFileStore {\n  constructor(\n    private readonly indexPath: string,\n    private readonly shardDir: string,\n    private readonly statusPath: string,\n    private readonly io?: EmbeddingIndexStoreIo,\n  ) {\n    if (io && (Boolean(io.readUtf8) !== Boolean(io.writeUtf8))) {\n      throw new EmbeddingIndexStorageError(\n        \"embedding index store io requires both readUtf8 and writeUtf8; a half-wired io would mix encrypted and plaintext files\",\n      );\n    }\n  }\n\n  /** Legacy single-file layout path (public for error messages). */\n  get legacyPath(): string {\n    return this.indexPath;\n  }\n\n  /** Record an unreadable-authoritative-file reason (both read and mutation paths). */\n  async recordIndexStatusForLoad(reason: string): Promise<void> {\n    await this.recordIndexStatus({\n      lastReadRecovery: { ts: new Date().toISOString(), message: reason },\n    });\n  }\n\n  /**\n   * Which generation owns the index right now. The published\n   * `state/embeddings/` directory IS the layout marker: until it exists the\n   * legacy file is authoritative; from the atomic rename onward it never\n   * merges again.\n   */\n  async detectLayout(): Promise<IndexLayout> {\n    // An interrupted identity replacement leaves the published directory\n    // absent with the fixed transaction backup still on disk (the publish\n    // rename never completed). Report SHARDED for that gap: the backup holds\n    // the authoritative generation, so neither the legacy file nor a fresh\n    // index may win, and reads fail open to empty until the mutation queue\n    // performs the rollback. The rollback itself only ever runs inside\n    // persist() — a write — so read paths never race an in-flight\n    // replacement with a recovery rename (issue #3148 review).\n    try {\n      // lstat, NOT stat: a symlinked generation directory must be rejected\n      // outright — following it would read or write OUTSIDE the state\n      // directory through the link (codex PRRT_kwDORJXyws6mZ72r).\n      const info = await lstat(this.shardDir);\n      if (info.isSymbolicLink()) {\n        throw new EmbeddingIndexStorageError(\n          `embedding index shard directory is a symlink; refusing to read or write through it: ${this.shardDir}`,\n        );\n      }\n      return \"sharded\";\n    } catch (err) {\n      if (err instanceof EmbeddingIndexStorageError) throw err;\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n        // The pointer exists but cannot be stat'ed — fail towards the\n        // published generation so its readers surface the I/O error.\n        log.warn(`embedding index: shard dir stat failed (${err instanceof Error ? err.message : String(err)}); assuming sharded layout`);\n        return \"sharded\";\n      }\n      if (await this.replacementBackupExists()) return \"sharded\";\n      return this.legacyOrEmptyLayout();\n    }\n  }\n\n  /**\n   * Roll the fixed transaction backup back into the published position.\n   * Returns true when a rollback happened.\n   */\n  private async replacementBackupExists(): Promise<boolean> {\n    const backupPath = replacementBackupPath(this.shardDir);\n    try {\n      await stat(backupPath);\n      return true;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      // An unreadable backup must not be silently treated as absent —\n      // that would permit the legacy fallback over a generation we cannot\n      // inspect (issue #3148 review, round 1).\n      throw new EmbeddingIndexStorageError(\n        `cannot stat embedding index replacement backup ${backupPath}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  /**\n   * The fixed transaction backup is a path with well-known semantics; a\n   * planted symlink must never be restored into the published position (it\n   * would point the generation outside the memory dir) nor removed through\n   * as if it were the former generation. Symlinks are rejected outright.\n   */\n  private async assertBackupNotSymlink(backupPath: string): Promise<void> {\n    const info = await lstat(backupPath).catch((err) => {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n      throw err;\n    });\n    if (info?.isSymbolicLink()) {\n      throw new EmbeddingIndexStorageError(\n        `embedding index replacement backup is a symlink; refusing to touch it: ${backupPath}`,\n      );\n    }\n  }\n\n  /**\n   * Mutation-queue entry point: roll the fixed transaction backup back into\n   * the published position after an interrupted replacement. Returns true\n   * when a rollback happened. Only fires in the actual rename gap\n   * (published directory absent); callers must invalidate any cached index\n   * view when this returns true.\n   */\n  async recoverIfInterrupted(fence?: EmbeddingGenerationFence): Promise<boolean> {\n    // Only the rename gap (published directory absent) is recoverable. When\n    // the directory is present - including after a crash that followed a\n    // successful publish - the generation on disk is already authoritative\n    // and renaming the backup onto it would fail with EEXIST (issue #3148\n    // review, round 2).\n    try {\n      await stat(this.shardDir);\n      return false;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n        log.warn(`embedding index: recovery skipped because shard dir stat failed: ${err instanceof Error ? err.message : String(err)}`);\n        return false;\n      }\n    }\n    const backupPath = replacementBackupPath(this.shardDir);\n    if (!(await this.replacementBackupExists())) return false;\n    await this.assertBackupNotSymlink(backupPath);\n    // The rollback rename is destructive: reassert lock ownership first.\n    await fence?.();\n    await rename(backupPath, this.shardDir);\n    log.warn(\n      `embedding index: recovered interrupted replacement; former generation restored from ${backupPath}`,\n    );\n    await this.recordIndexStatus({\n      lastReadRecovery: {\n        ts: new Date().toISOString(),\n        message: \"interrupted identity replacement rolled back to the former generation\",\n      },\n    });\n    return true;\n  }\n\n  private async legacyOrEmptyLayout(): Promise<IndexLayout> {\n    try {\n      await stat(this.indexPath);\n      return \"legacy\";\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return \"empty\";\n      throw err;\n    }\n  }\n\n  /** Header identity of the authoritative generation, read leniently. */\n  async identityFromDisk(): Promise<EmbeddingIndexIdentity | null> {\n    const layout = await this.detectLayout();\n    if (layout === \"sharded\") {\n      // Shard files are bounded by the per-file budget, so the identity\n      // probe never reads a ceiling-sized string.\n      for (const name of await this.readShardNames()) {\n        const read = await this.readFileAt(path.join(this.shardDir, name));\n        if (read.outcome === \"ok\") {\n          return { provider: read.file.provider, model: read.file.model };\n        }\n      }\n      return null;\n    }\n    if (layout === \"legacy\") {\n      const read = await this.readFileAt(this.indexPath);\n      if (read.outcome === \"ok\") {\n        return { provider: read.file.provider, model: read.file.model };\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Load every readable shard into `merged`. Returns the generation identity.\n   * Unreadable shards record durable diagnostics; `strict` additionally\n   * fails the mutation closed.\n   */\n  async readShardGenerationInto(\n    merged: Record<string, EmbeddingIndexEntry>,\n  ): Promise<EmbeddingIndexIdentity | null> {\n    let identity: EmbeddingIndexIdentity | null = null;\n    for (const name of await this.readShardNames()) {\n      const read = await this.readFileAt(path.join(this.shardDir, name));\n      if (read.outcome !== \"ok\") {\n        if (read.outcome === \"unreadable\") {\n          await this.recordIndexStatus({\n            lastReadRecovery: { ts: new Date().toISOString(), message: `${name}: ${read.reason}` },\n          });\n          throw new EmbeddingIndexStorageError(\n            `refusing to continue from unreadable embedding index shard ${name}: ${read.reason}`,\n          );\n        }\n        await this.recordIndexStatus({\n          lastReadRecovery: { ts: new Date().toISOString(), message: `${name}: unrecognized index format` },\n        });\n        throw new EmbeddingIndexStorageError(\n          `refusing to continue from malformed embedding index shard ${name} (unrecognized format); file preserved in place`,\n        );\n      }\n      try {\n        validateShardMembership(name, read.file);\n      } catch (error) {\n        await this.recordIndexStatus({\n          lastReadRecovery: { ts: new Date().toISOString(), message: String(error) },\n        });\n        throw error;\n      }\n      const shardIdentity = { provider: read.file.provider, model: read.file.model };\n      if (!identity) identity = shardIdentity;\n      if (!sameIndexIdentity(shardIdentity, identity)) {\n        // A partial rewrite from this map would silently drop the foreign\n        // shard's entries, so even recall must not serve this generation.\n        throw new EmbeddingIndexStorageError(\n          `refusing to continue from mixed-identity embedding index generation: ${name} is ${shardIdentity.provider}/${shardIdentity.model} but the generation identity is ${identity.provider}/${identity.model}; files preserved in place`,\n        );\n      }\n      Object.assign(merged, read.file.entries);\n    }\n    return identity;\n  }\n\n  async readLegacy(): Promise<ManagedIndexRead> {\n    return this.readFileAt(this.indexPath);\n  }\n\n  /**\n   * Read one managed index file (legacy or shard). The file is never\n   * modified or moved here: an unreadable file stays in place for recovery\n   * and is reported through the returned outcome (mutation paths fail\n   * closed on it; read-only paths fail open and record the reason).\n   */\n  /**\n   * Read/mutation boundary for any generation member or the legacy marker\n   * (codex PRRT_kwDORJXyws6mZ72r): a symlinked member is rejected outright\n   * and its real target must stay inside the canonical state directory —\n   * following a planted link would read or write outside the memory root.\n   * Runs BEFORE the secure IO so storage-backed reads are covered too.\n   */\n  private async assertGenerationFileNotSymlinked(filePath: string): Promise<void> {\n    const info = await lstat(filePath).catch((err) => {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n      throw new EmbeddingIndexStorageError(\n        `cannot lstat embedding index file ${filePath}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    });\n    const stateDir = path.dirname(this.shardDir);\n    // Containment must be checked even when the member itself is a regular\n    // file: a SYMLINKED GENERATION DIRECTORY lets reads through to whatever\n    // path the link resolves to — a regular file in a linked dir is still\n    // outside the memory root and must be rejected.\n    const real = await realpath(filePath).catch(() => null);\n    if (real) {\n      const scope = await realpath(stateDir).catch(() => stateDir);\n      const rel = path.relative(scope, real);\n      if (rel.startsWith(\"..\") || path.isAbsolute(rel)) {\n        throw new EmbeddingIndexStorageError(\n          `embedding index file escapes the state directory via symlink; refusing: ${filePath} -> ${real}`,\n        );\n      }\n    }\n    if (!info || !info.isSymbolicLink()) return;\n    throw new EmbeddingIndexStorageError(\n      `embedding index file is a symlink; refusing to read or write through it: ${filePath}`,\n    );\n  }\n\n  async readFileAt(filePath: string): Promise<ManagedIndexRead> {\n    await this.assertGenerationFileNotSymlinked(filePath);\n    const hardLimit = resolveIndexHardReadCharLimit();\n    let size = 0;\n    try {\n      size = (await stat(filePath)).size;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return { outcome: \"absent\" };\n      return { outcome: \"unreadable\", reason: `stat failed: ${err instanceof Error ? err.message : String(err)}` };\n    }\n    // Reads are gated by the HARD single-string ceiling only — NOT by the\n    // soft write budget — so a legacy index from an older version sitting\n    // between the two still loads and migrates (issue #3146). Byte size is\n    // only a conservative bound for UTF-8 (bytes ≥ chars): at or below it a\n    // readFile is guaranteed materializable; past it the file MAY still be\n    // readable as a string, but refusing is the safe side. An over-ceiling\n    // file is preserved in place; the caller decides fail-open (recall) or\n    // fail-closed (mutation).\n    if (size > hardLimit) {\n      return {\n        outcome: \"unreadable\",\n        reason: `file is ${size} bytes, over the ${hardLimit}-char hard single-string read ceiling (V8 RangeError territory); bytes preserved in place — move or prune the file to recover`,\n      };\n    }\n    let raw: string;\n    try {\n      raw = this.io\n        ? await this.io.readUtf8(filePath)\n        : await readFile(filePath, \"utf-8\");\n    } catch (err) {\n      return { outcome: \"unreadable\", reason: `read failed: ${err instanceof Error ? err.message : String(err)}` };\n    }\n    return parseEmbeddingIndexDocument(raw);\n  }\n\n  private async readShardNames(): Promise<string[]> {\n    try {\n      return (await readdir(this.shardDir))\n        .filter((name) => SHARD_FILE_PATTERN.test(name))\n        .sort();\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n      // The published generation exists but cannot be enumerated. Treating\n      // it as empty would let a mutation overwrite shards it never saw, so\n      // this must propagate — strict mutation fails closed, recall fails\n      // open at its boundary (issue #3146 review).\n      throw new EmbeddingIndexStorageError(\n        `cannot enumerate embedding index shard directory ${this.shardDir}: ${err instanceof Error ? `${err.message} (${(err as NodeJS.ErrnoException).code ?? \"unknown\"})` : String(err)}`,\n      );\n    }\n  }\n\n  /**\n   * Persist the index. Layout decisions, in order:\n   *   - published generation: rewrite only the shards this mutation touched;\n   *   - legacy/empty generation and the whole index fits one bounded JSON\n   *     string: stay the single `state/embeddings.json` file;\n   *   - over budget: ONE-WAY migration — stage a complete shard set, publish\n   *     it with a single directory rename, then rename the legacy file aside\n   *     as a non-authoritative recovery artifact (issue #3146).\n   */\n  async persist(\n    index: EmbeddingIndexFile,\n    opts: {\n      touchedIds?: readonly string[];\n      memoryId?: string;\n      /** Reasserts mutation-lock ownership immediately before each destructive write (after serialization). */\n      fence?: EmbeddingGenerationFence;\n    } = {},\n  ): Promise<void> {\n    const stateDir = path.dirname(this.indexPath);\n    await mkdir(stateDir, { recursive: true });\n    await this.cleanForeignStagingDirs();\n    // NOTE: interrupted-replacement recovery runs in the mutation wrapper\n    // (EmbeddingFallback.enqueueIndexMutation) BEFORE this method, so the\n    // caller's index already reflects the restored generation.\n\n    const groups = shardEntriesForIndex(index);\n\n    const layout = await this.detectLayout();\n\n    if (layout === \"sharded\") {\n      const limit = resolveIndexFileCharLimit();\n      // An identity change on a published generation (a sharded host index\n      // replaced by a fallback provider, or a host-model change) must\n      // publish a COMPLETE replacement: the dirty-shard fast path would\n      // rewrite only the touched shard under the new identity and leave the\n      // former identity's shards in place — a mixed generation that every\n      // later load rejects (codex P1, PR #3148).\n      const diskIdentity = await this.identityFromDisk();\n      if (groups.size === 0) {\n        // An empty directory has no transport-visible deletion evidence.\n        // Publish a valid empty shard so a peer without a shared base also\n        // replaces its stale generation rather than preserving old vectors.\n        groups.set(0, {});\n        await this.publishReplacementGeneration(index, groups, limit, opts.fence);\n        return;\n      }\n      const identityChanged =\n        diskIdentity !== null &&\n        (diskIdentity.provider !== index.provider || diskIdentity.model !== index.model);\n      if (identityChanged) {\n        await this.publishReplacementGeneration(index, groups, limit, opts.fence);\n        return;\n      }\n      const dirtyShards = opts.touchedIds?.length\n        ? new Set(opts.touchedIds.map((id) => shardIndexOf(id, SHARD_COUNT)))\n        : null;\n      // Serialize every touched shard BEFORE writing anything so a capacity\n      // failure cannot leave a partial rewrite.\n      const targets = dirtyShards ? [...dirtyShards] : [...groups.keys()];\n      const payloads = targets\n        .filter((shardIndex) => groups.has(shardIndex))\n        .map((shardIndex) => ({\n          shardIndex,\n          body: serializeEmbeddingShard(index, shardIndex, groups.get(shardIndex)!, limit),\n        }));\n      // Serialization is done: reassert lock ownership immediately before\n      // the destructive live-generation writes.\n      await opts.fence?.();\n      for (const payload of payloads) {\n        await this.writeAtomicFile(\n          path.join(this.shardDir, shardFileName(payload.shardIndex)),\n          payload.body,\n        );\n      }\n      // A dirty shard with no remaining entries (its last entry was just\n      // removed) must be removed from disk, not silently skipped.\n      for (const shardIndex of targets) {\n        if (!groups.has(shardIndex)) {\n          await rm(path.join(this.shardDir, shardFileName(shardIndex)), { force: true });\n        }\n      }\n      return;\n    }\n\n    let whole: string | null;\n    try {\n      whole = JSON.stringify(index);\n    } catch (err) {\n      if (!isInvalidStringLengthError(err)) throw err;\n      whole = null;\n    }\n    const limit = resolveIndexFileCharLimit();\n    if (whole !== null && whole.length <= limit) {\n      // Serialized above: reassert lock ownership immediately before the\n      // destructive atomic write.\n      await opts.fence?.();\n      await this.writeAtomicFile(this.indexPath, whole);\n      return;\n    }\n\n    // One-way migration. Until the publish rename, the legacy file stays\n    // authoritative; afterwards the published directory is the only\n    // generation and the legacy file is demoted to a recovery artifact.\n    const stagingDir = path.join(\n      stateDir,\n      `embeddings.staging.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`,\n    );\n    await mkdir(stagingDir, { recursive: true });\n    try {\n      await this.stageShardSet(stagingDir, index, groups, limit);\n      // Atomic publish: the directory appearing IS the layout marker.\n      await this.publishSwappedGeneration(stagingDir, opts.fence);\n    } catch (err) {\n      await rm(stagingDir, { recursive: true, force: true }).catch(() => undefined);\n      throw err;\n    }\n    await rename(\n      this.indexPath,\n      `${this.indexPath}.pre-migration.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`,\n    ).catch(() => undefined);\n  }\n\n  /**\n   * Replace a published generation wholesale after a provider/model identity\n   * change (replacement semantics — the former entries are obsolete by\n   * definition). Crash-safe by the same construction as the migration: the\n   * COMPLETE new-identity set is staged and validated first (old bytes are\n   * not touched until staging succeeds), then published atomically through\n   * `publishSwappedGeneration`.\n   */\n  private async publishReplacementGeneration(\n    index: EmbeddingIndexFile,\n    groups: Map<number, Record<string, EmbeddingIndexEntry>>,\n    limit: number,\n    fence?: EmbeddingGenerationFence,\n  ): Promise<void> {\n    const stateDir = path.dirname(this.indexPath);\n    const stagingDir = path.join(\n      stateDir,\n      `embeddings.staging.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`,\n    );\n    await mkdir(stagingDir, { recursive: true });\n    try {\n      await this.stageShardSet(stagingDir, index, groups, limit);\n      await this.publishSwappedGeneration(stagingDir, fence);\n    } catch (err) {\n      await rm(stagingDir, { recursive: true, force: true }).catch(() => undefined);\n      throw err;\n    }\n  }\n\n  /**\n   * Write a complete shard set into a staging directory. Every shard is\n   * serialized before the first write, so a capacity failure cannot leave a\n   * partial stage behind.\n   */\n  private async stageShardSet(\n    stagingDir: string,\n    index: EmbeddingIndexFile,\n    groups: Map<number, Record<string, EmbeddingIndexEntry>>,\n    limit: number,\n  ): Promise<void> {\n    const payloads = [...groups]\n      .map(([shardIndex, entries]) => ({\n        shardIndex,\n        body: serializeEmbeddingShard(index, shardIndex, entries, limit),\n      }));\n    for (const payload of payloads) {\n      const finalAadFilePath = path.join(this.shardDir, shardFileName(payload.shardIndex));\n      await this.writeAtomicFile(\n        path.join(stagingDir, shardFileName(payload.shardIndex)),\n        payload.body,\n        { finalAadFilePath },\n      );\n    }\n  }\n\n  /**\n   * Atomically remove the published generation (offline-sync: the remote\n   * deleted the whole index) by publishing an EMPTY staged directory\n   * through the shared swap: the rename is atomic, so the former generation\n   * moves whole into the fixed backup and back — a failure before the\n   * commit rolls the former generation back intact, and a post-commit\n   * backup-cleanup failure is non-fatal (the empty published directory\n   * stays the authoritative one-way layout marker). The fixed backup is\n   * symlink-checked first (round 5).\n   */\n  async removePublishedGeneration(fence?: EmbeddingGenerationFence): Promise<void> {\n    const backupPath = replacementBackupPath(this.shardDir);\n    await this.assertBackupNotSymlink(backupPath);\n    await rm(backupPath, { recursive: true, force: true });\n    // Remove by publishing an EMPTY staged directory through the SAME swap\n    // state machine as every other publication: rename is atomic, so the\n    // former generation moves whole into the fixed backup and back — a\n    // partially-deleted generation can never be exposed. The empty\n    // published directory stays the one-way layout marker, so a stray\n    // legacy file can never become authoritative after removal. The\n    // demoted backup's post-commit cleanup is non-fatal (existing\n    // publishSwappedGeneration semantics).\n    await mkdir(path.dirname(this.shardDir), { recursive: true });\n    const emptyStaging = await mkdtemp(\n      path.join(path.dirname(this.shardDir), \"embeddings.staging.tmp-empty-\"),\n    );\n    try {\n      await this.publishSwappedGeneration(emptyStaging, fence);\n    } catch (err) {\n      await rm(emptyStaging, { recursive: true, force: true }).catch(() => undefined);\n      throw err;\n    }\n  }\n\n  /**\n   * Atomically publish a fully staged generation directory as THE published\n   * generation. The former published directory is demoted to the FIXED\n   * transaction backup and the staging dir is renamed in with a single\n   * rename; if the publish rename fails the former generation is rolled\n   * back, and if the process dies in the rename gap `detectLayout()` /\n   * `recoverIfInterrupted()` perform the same rollback on next use.\n   * Shared by the mutation-side migration/replacement and the offline-sync\n   * generation transaction (issue #3148, round 4) so there is exactly one\n   * swap state machine. Staging-dir cleanup stays with the caller.\n   */\n  async publishSwappedGeneration(stagingDir: string, fence?: EmbeddingGenerationFence): Promise<void> {\n    // The replacement is published: the backup is obsolete disk. A cleanup\n    // failure is non-fatal (the next replacement removes it) but must stay\n    // visible.\n    const backupPath = replacementBackupPath(this.shardDir);\n    await this.assertBackupNotSymlink(backupPath);\n    // Cheap ownership check before the destructive backup cleanup: a peer\n    // stale-break would otherwise see the backup vanish under it before we\n    // even reach the live renames (Kilo PRRT_kwDORJXyws6mZ8i5).\n    await fence?.();\n    await rm(backupPath, { recursive: true, force: true });\n    // Second ownership check immediately before the live renames: any\n    // delay between the cleanup and the rename still allows a stale-break,\n    // and publishing now would clobber the peer's write.\n    await fence?.();\n    let demoted = false;\n    try {\n      await stat(this.shardDir);\n      await rename(this.shardDir, backupPath);\n      demoted = true;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n    }\n    try {\n      await rename(stagingDir, this.shardDir);\n    } catch (err) {\n      if (demoted) await rename(backupPath, this.shardDir).catch(() => undefined);\n      throw err;\n    }\n    await rm(backupPath, { recursive: true, force: true }).catch((err) => {\n      log.warn(`embedding index: could not remove replacement backup ${backupPath}: ${err}`);\n    });\n  }\n\n  /** Remove staging dirs orphaned by crashed migrations. A foreign dir younger than the grace window may belong to a live writer mid-migration, so only older dirs are removed (issue #3148 review, round 3). */\n  private static readonly STAGING_CLEANUP_GRACE_MS = 10 * 60 * 1000;\n\n  private async cleanForeignStagingDirs(): Promise<void> {\n    const stateDir = path.dirname(this.indexPath);\n    let names: string[] = [];\n    try {\n      names = await readdir(stateDir);\n    } catch {\n      return;\n    }\n    const ownPrefix = `embeddings.staging.tmp-${process.pid}-`;\n    const cutoff = Date.now() - EmbeddingIndexFileStore.STAGING_CLEANUP_GRACE_MS;\n    for (const name of names) {\n      if (!name.startsWith(\"embeddings.staging.tmp-\") || name.startsWith(ownPrefix)) continue;\n      try {\n        const stats = await stat(path.join(stateDir, name));\n        if (stats.mtimeMs > cutoff) continue;\n      } catch {\n        continue;\n      }\n      await rm(path.join(stateDir, name), { recursive: true, force: true }).catch(() => undefined);\n    }\n  }\n\n  /**\n   * Temp-file + rename write. The temp name carries `.tmp-` so offline sync\n   * ignores in-flight files under `state/`. With a wired io, the write goes\n   * through the canonical secure-store contract instead, optionally binding\n   * the ciphertext to the FINAL published path (staged shards).\n   */\n  private async writeAtomicFile(\n    filePath: string,\n    contents: string,\n    opts?: { finalAadFilePath?: string; bypassSecureIo?: boolean },\n  ): Promise<void> {\n    if (this.io && opts?.bypassSecureIo !== true) {\n      await this.io.writeUtf8(filePath, contents, opts?.finalAadFilePath === undefined ? undefined : { finalAadFilePath: opts.finalAadFilePath });\n      return;\n    }\n    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;\n    try {\n      await writeFile(tempPath, contents, \"utf-8\");\n      await rename(tempPath, filePath);\n    } catch (err) {\n      await rm(tempPath, { force: true }).catch(() => undefined);\n      throw err;\n    }\n  }\n\n  /**\n   * Record the outcome of one index mutation durably. This is diagnostics,\n   * NOT recovery: write failures are recorded and then re-thrown by the\n   * caller so the extraction/consolidation task fails explicitly instead of\n   * declaring success over an index that could not be persisted (issue\n   * #3146).\n   */\n  async recordIndexWriteOutcome(err: unknown, memoryId?: string): Promise<void> {\n    if (!err) {\n      await this.recordIndexStatus({\n        lastWriteFailure: null,\n        lastSuccessAt: new Date().toISOString(),\n      });\n      return;\n    }\n    const kind: EmbeddingIndexWriteFailure[\"kind\"] =\n      err instanceof EmbeddingIndexCapacityError || isInvalidStringLengthError(err)\n        ? \"capacity\"\n        : \"io\";\n    await this.recordIndexStatus({\n      failureCountIncrement: 1,\n      lastWriteFailure: {\n        ts: new Date().toISOString(),\n        kind,\n        message: err instanceof Error ? err.message : String(err),\n        ...(memoryId ? { memoryId } : {}),\n      },\n    });\n  }\n\n  /**\n   * Merge diagnostic state into `state/embedding-fallback-status.json`.\n   * Best-effort: a diagnostics failure never masks the real outcome.\n   */\n  private async recordIndexStatus(\n    patch: {\n      failureCountIncrement?: number;\n      lastWriteFailure?: EmbeddingIndexWriteFailure | null;\n      lastReadRecovery?: { ts: string; message: string };\n      lastSuccessAt?: string;\n    },\n  ): Promise<void> {\n    try {\n      let current: EmbeddingIndexStatusFile = { version: 1, failureCount: 0 };\n      try {\n        const parsed = JSON.parse(await readFile(this.statusPath, \"utf-8\")) as Partial<EmbeddingIndexStatusFile>;\n        if (parsed && typeof parsed === \"object\" && typeof parsed.failureCount === \"number\") {\n          current = { ...parsed, version: 1, failureCount: parsed.failureCount };\n        }\n      } catch {\n        // Absent or unreadable status starts fresh; the index files own the truth.\n      }\n      const next: EmbeddingIndexStatusFile = { ...current };\n      if (patch.failureCountIncrement) next.failureCount += patch.failureCountIncrement;\n      if (patch.lastWriteFailure !== undefined) {\n        if (patch.lastWriteFailure === null) delete next.lastWriteFailure;\n        else next.lastWriteFailure = patch.lastWriteFailure;\n      }\n      if (patch.lastReadRecovery !== undefined) next.lastReadRecovery = patch.lastReadRecovery;\n      if (patch.lastSuccessAt !== undefined) next.lastSuccessAt = patch.lastSuccessAt;\n      // The status file is ALWAYS plain (non-secret diagnostics: failure\n      // strings and counts only). It bypasses the secure io so console_state\n      // keeps reading it on locked stores and failure counts never reset.\n      await mkdir(path.dirname(this.statusPath), { recursive: true });\n      await this.writeAtomicFile(this.statusPath, JSON.stringify(next), { bypassSecureIo: true });\n    } catch (err) {\n      log.debug(`embedding fallback status write failed: ${err}`);\n    }\n  }\n}\n\nfunction sameIndexIdentity(\n  left: EmbeddingIndexIdentity,\n  right: EmbeddingIndexIdentity,\n): boolean {\n  return left.provider === right.provider && left.model === right.model;\n}\n"],"mappings":";;;;;;;;AAeA,OAAO,UAAU;AACjB,SAAS,aAAa,uBAAuB;AAC7C,SAAS,OAAO,OAAO,SAAS,UAAU,UAAU,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AA0CzF,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YACE,SACS,UACT;AACA,UAAM,OAAO;AAFJ;AAAA,EAGX;AAAA,EAHW;AAAA,EAHO,OAAO;AAO3B;AAUO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAClC,OAAO;AAC3B;AAwCA,IAAM,gCACJ,gBAAgB,oBAAoB,KAAK,OAAO;AASlD,SAAS,gCAAwC;AAC/C,QAAM,OAAO,0BAA0B;AACvC,QAAM,MAAM,WAAW,8CAA8C;AACrE,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,OAAO,UAAU,MAAM,KAAK,UAAU,KAAM,QAAO;AAAA,EACzD;AACA,SAAO,gBAAgB;AACzB;AAGA,IAAM,cAAc;AAEpB,IAAM,qBAAqB;AAEpB,SAAS,4BAAoC;AAClD,QAAM,MAAM,WAAW,wCAAwC;AAC/D,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,OAAO,UAAU,MAAM,KAAK,UAAU,KAAM,QAAO;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,cAAc,YAA4B;AACjD,SAAO,SAAS,OAAO,UAAU,EAAE,SAAS,GAAG,GAAG,CAAC;AACrD;AAQA,SAAS,sBAAsB,UAA0B;AACvD,SAAO,KAAK,KAAK,KAAK,QAAQ,QAAQ,GAAG,4BAA4B;AACvE;AAMO,SAAS,aAAa,UAAkB,YAA4B;AACzE,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,YAAQ,SAAS,WAAW,CAAC;AAC7B,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,SAAO,OAAO;AAChB;AASO,SAAS,wBAAwB,WAAmB,MAAgC;AACzF,QAAM,QAAQ,wBAAwB,KAAK,SAAS;AACpD,MAAI,CAAC,MAAO;AACZ,QAAM,aAAa,OAAO,MAAM,CAAC,CAAC;AAClC,aAAW,MAAM,OAAO,KAAK,KAAK,OAAO,GAAG;AAC1C,QAAI,aAAa,IAAI,WAAW,MAAM,YAAY;AAChD,YAAM,IAAI;AAAA,QACR,kCAAkC,SAAS,QAAQ,EAAE,oBAAoB,aAAa,IAAI,WAAW,CAAC,SAAS,UAAU;AAAA,MAC3H;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,2BAA2B,KAAuB;AAChE,SAAO,eAAe,cAAc,yBAAyB,KAAK,IAAI,OAAO;AAC/E;AAWO,SAAS,4BAA4B,KAA+B;AACzE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,sBAAsB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAChF;AAAA,EACF;AACA,MACE,CAAC,UACD,OAAO,WAAW,YAClB,MAAM,QAAQ,MAAM,KACnB,OAAuC,YAAY,KACpD,OAAQ,OAAuC,aAAa,YAC5D,OAAQ,OAAuC,UAAU,YACvD,OAAuC,MAAiB,WAAW,GACrE;AACA,WAAO,EAAE,SAAS,UAAU;AAAA,EAC9B;AAIA,MACG,OAAuC,aAAa,YACpD,OAAuC,aAAa,WACpD,OAAuC,aAAa,QACrD;AACA,WAAO,EAAE,SAAS,UAAU;AAAA,EAC9B;AACA,QAAM,UAAW,OAAuC;AACxD,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACrE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,EACF;AACA,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,OAAkC,GAAG;AAC5E,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,aAAO,EAAE,SAAS,cAAc,QAAQ,SAAS,EAAE,qBAAqB;AAAA,IAC1E;AACA,UAAM,YAAY;AAClB,QAAI,OAAO,UAAU,SAAS,UAAU;AACtC,aAAO,EAAE,SAAS,cAAc,QAAQ,SAAS,EAAE,yBAAyB;AAAA,IAC9E;AACA,QAAI,CAAC,MAAM,QAAQ,UAAU,MAAM,GAAG;AACpC,aAAO,EAAE,SAAS,cAAc,QAAQ,SAAS,EAAE,2BAA2B;AAAA,IAChF;AACA,eAAW,aAAa,UAAU,QAAQ;AACxC,UAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ,SAAS,EAAE;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,MAAM,OAA6B;AAC7D;AAOO,SAAS,qBACd,OACkD;AAClD,QAAM,SAAS,oBAAI,IAAiD;AACpE,aAAW,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;AAC3C,UAAM,aAAa,aAAa,IAAI,WAAW;AAC/C,UAAM,QAAQ,OAAO,IAAI,UAAU;AACnC,QAAI,MAAO,OAAM,EAAE,IAAI,MAAM,QAAQ,EAAE;AAAA,QAClC,QAAO,IAAI,YAAY,EAAE,CAAC,EAAE,GAAG,MAAM,QAAQ,EAAE,EAAE,CAAC;AAAA,EACzD;AACA,SAAO;AACT;AAOO,SAAS,wBACd,OACA,YACA,SACA,QAAgB,0BAA0B,GAClC;AACR,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,UAAU;AAAA,MACpB,SAAS;AAAA,MACT,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,yBAAyB,cAAc,UAAU,CAAC,0DAA0D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAC5J,eAAe,OAAO,KAAK;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,cAAc,WAAW,QAAQ,OAAO,IAAI,KAAK,UAAU,QAAQ,OAAO,CAAC,EAAE,SAAS;AAC5F,UAAM,IAAI;AAAA,MACR,yBAAyB,cAAc,UAAU,CAAC,UAAU,KAAK,MAAM,oBAAoB,KAAK,0CAA0C,WAAW,WAAW,kBAAkB,WAAW;AAAA,MAC7L,WAAW;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,SAAsD;AAC5E,MAAI,UAAU;AACd,MAAI,cAAc;AAClB,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACjD,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,UAAU,KAAK,EAAE;AAAA,IACjC,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,SAAS,aAAa;AACxB,oBAAc;AACd,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAmBO,IAAM,0BAAN,MAAM,yBAAwB;AAAA,EACnC,YACmB,WACA,UACA,YACA,IACjB;AAJiB;AACA;AACA;AACA;AAEjB,QAAI,MAAO,QAAQ,GAAG,QAAQ,MAAM,QAAQ,GAAG,SAAS,GAAI;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAVmB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAUnB,IAAI,aAAqB;AACvB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,yBAAyB,QAA+B;AAC5D,UAAM,KAAK,kBAAkB;AAAA,MAC3B,kBAAkB,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,OAAO;AAAA,IACpE,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAAqC;AASzC,QAAI;AAIF,YAAM,OAAO,MAAM,MAAM,KAAK,QAAQ;AACtC,UAAI,KAAK,eAAe,GAAG;AACzB,cAAM,IAAI;AAAA,UACR,uFAAuF,KAAK,QAAQ;AAAA,QACtG;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,eAAe,2BAA4B,OAAM;AACrD,UAAK,IAA8B,SAAS,UAAU;AAGpD,YAAI,KAAK,2CAA2C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,4BAA4B;AAChI,eAAO;AAAA,MACT;AACA,UAAI,MAAM,KAAK,wBAAwB,EAAG,QAAO;AACjD,aAAO,KAAK,oBAAoB;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,0BAA4C;AACxD,UAAM,aAAa,sBAAsB,KAAK,QAAQ;AACtD,QAAI;AACF,YAAM,KAAK,UAAU;AACrB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO;AAI7D,YAAM,IAAI;AAAA,QACR,kDAAkD,UAAU,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,uBAAuB,YAAmC;AACtE,UAAM,OAAO,MAAM,MAAM,UAAU,EAAE,MAAM,CAAC,QAAQ;AAClD,UAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,YAAM;AAAA,IACR,CAAC;AACD,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,0EAA0E,UAAU;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,qBAAqB,OAAoD;AAM7E,QAAI;AACF,YAAM,KAAK,KAAK,QAAQ;AACxB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,UAAU;AACpD,YAAI,KAAK,oEAAoE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC/H,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,aAAa,sBAAsB,KAAK,QAAQ;AACtD,QAAI,CAAE,MAAM,KAAK,wBAAwB,EAAI,QAAO;AACpD,UAAM,KAAK,uBAAuB,UAAU;AAE5C,UAAM,QAAQ;AACd,UAAM,OAAO,YAAY,KAAK,QAAQ;AACtC,QAAI;AAAA,MACF,uFAAuF,UAAU;AAAA,IACnG;AACA,UAAM,KAAK,kBAAkB;AAAA,MAC3B,kBAAkB;AAAA,QAChB,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,sBAA4C;AACxD,QAAI;AACF,YAAM,KAAK,KAAK,SAAS;AACzB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,mBAA2D;AAC/D,UAAM,SAAS,MAAM,KAAK,aAAa;AACvC,QAAI,WAAW,WAAW;AAGxB,iBAAW,QAAQ,MAAM,KAAK,eAAe,GAAG;AAC9C,cAAM,OAAO,MAAM,KAAK,WAAW,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC;AACjE,YAAI,KAAK,YAAY,MAAM;AACzB,iBAAO,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAAA,QAChE;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,QAAI,WAAW,UAAU;AACvB,YAAM,OAAO,MAAM,KAAK,WAAW,KAAK,SAAS;AACjD,UAAI,KAAK,YAAY,MAAM;AACzB,eAAO,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAAA,MAChE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,wBACJ,QACwC;AACxC,QAAI,WAA0C;AAC9C,eAAW,QAAQ,MAAM,KAAK,eAAe,GAAG;AAC9C,YAAM,OAAO,MAAM,KAAK,WAAW,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC;AACjE,UAAI,KAAK,YAAY,MAAM;AACzB,YAAI,KAAK,YAAY,cAAc;AACjC,gBAAM,KAAK,kBAAkB;AAAA,YAC3B,kBAAkB,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,GAAG,IAAI,KAAK,KAAK,MAAM,GAAG;AAAA,UACvF,CAAC;AACD,gBAAM,IAAI;AAAA,YACR,8DAA8D,IAAI,KAAK,KAAK,MAAM;AAAA,UACpF;AAAA,QACF;AACA,cAAM,KAAK,kBAAkB;AAAA,UAC3B,kBAAkB,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,GAAG,IAAI,8BAA8B;AAAA,QAClG,CAAC;AACD,cAAM,IAAI;AAAA,UACR,6DAA6D,IAAI;AAAA,QACnE;AAAA,MACF;AACA,UAAI;AACF,gCAAwB,MAAM,KAAK,IAAI;AAAA,MACzC,SAAS,OAAO;AACd,cAAM,KAAK,kBAAkB;AAAA,UAC3B,kBAAkB,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,SAAS,OAAO,KAAK,EAAE;AAAA,QAC3E,CAAC;AACD,cAAM;AAAA,MACR;AACA,YAAM,gBAAgB,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAC7E,UAAI,CAAC,SAAU,YAAW;AAC1B,UAAI,CAAC,kBAAkB,eAAe,QAAQ,GAAG;AAG/C,cAAM,IAAI;AAAA,UACR,wEAAwE,IAAI,OAAO,cAAc,QAAQ,IAAI,cAAc,KAAK,mCAAmC,SAAS,QAAQ,IAAI,SAAS,KAAK;AAAA,QACxM;AAAA,MACF;AACA,aAAO,OAAO,QAAQ,KAAK,KAAK,OAAO;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAwC;AAC5C,WAAO,KAAK,WAAW,KAAK,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAc,iCAAiC,UAAiC;AAC9E,UAAM,OAAO,MAAM,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAChD,UAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,YAAM,IAAI;AAAA,QACR,qCAAqC,QAAQ,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpG;AAAA,IACF,CAAC;AACD,UAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ;AAK3C,UAAM,OAAO,MAAM,SAAS,QAAQ,EAAE,MAAM,MAAM,IAAI;AACtD,QAAI,MAAM;AACR,YAAM,QAAQ,MAAM,SAAS,QAAQ,EAAE,MAAM,MAAM,QAAQ;AAC3D,YAAM,MAAM,KAAK,SAAS,OAAO,IAAI;AACrC,UAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG;AAChD,cAAM,IAAI;AAAA,UACR,2EAA2E,QAAQ,OAAO,IAAI;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,CAAC,KAAK,eAAe,EAAG;AACrC,UAAM,IAAI;AAAA,MACR,4EAA4E,QAAQ;AAAA,IACtF;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,UAA6C;AAC5D,UAAM,KAAK,iCAAiC,QAAQ;AACpD,UAAM,YAAY,8BAA8B;AAChD,QAAI,OAAO;AACX,QAAI;AACF,cAAQ,MAAM,KAAK,QAAQ,GAAG;AAAA,IAChC,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO,EAAE,SAAS,SAAS;AACjF,aAAO,EAAE,SAAS,cAAc,QAAQ,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,IAC7G;AASA,QAAI,OAAO,WAAW;AACpB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,WAAW,IAAI,oBAAoB,SAAS;AAAA,MACtD;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,KACP,MAAM,KAAK,GAAG,SAAS,QAAQ,IAC/B,MAAM,SAAS,UAAU,OAAO;AAAA,IACtC,SAAS,KAAK;AACZ,aAAO,EAAE,SAAS,cAAc,QAAQ,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,IAC7G;AACA,WAAO,4BAA4B,GAAG;AAAA,EACxC;AAAA,EAEA,MAAc,iBAAoC;AAChD,QAAI;AACF,cAAQ,MAAM,QAAQ,KAAK,QAAQ,GAChC,OAAO,CAAC,SAAS,mBAAmB,KAAK,IAAI,CAAC,EAC9C,KAAK;AAAA,IACV,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAK9D,YAAM,IAAI;AAAA,QACR,oDAAoD,KAAK,QAAQ,KAAK,eAAe,QAAQ,GAAG,IAAI,OAAO,KAAM,IAA8B,QAAQ,SAAS,MAAM,OAAO,GAAG,CAAC;AAAA,MACnL;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QACJ,OACA,OAKI,CAAC,GACU;AACf,UAAM,WAAW,KAAK,QAAQ,KAAK,SAAS;AAC5C,UAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;AACzC,UAAM,KAAK,wBAAwB;AAKnC,UAAM,SAAS,qBAAqB,KAAK;AAEzC,UAAM,SAAS,MAAM,KAAK,aAAa;AAEvC,QAAI,WAAW,WAAW;AACxB,YAAMA,SAAQ,0BAA0B;AAOxC,YAAM,eAAe,MAAM,KAAK,iBAAiB;AACjD,UAAI,OAAO,SAAS,GAAG;AAIrB,eAAO,IAAI,GAAG,CAAC,CAAC;AAChB,cAAM,KAAK,6BAA6B,OAAO,QAAQA,QAAO,KAAK,KAAK;AACxE;AAAA,MACF;AACA,YAAM,kBACJ,iBAAiB,SAChB,aAAa,aAAa,MAAM,YAAY,aAAa,UAAU,MAAM;AAC5E,UAAI,iBAAiB;AACnB,cAAM,KAAK,6BAA6B,OAAO,QAAQA,QAAO,KAAK,KAAK;AACxE;AAAA,MACF;AACA,YAAM,cAAc,KAAK,YAAY,SACjC,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,aAAa,IAAI,WAAW,CAAC,CAAC,IAClE;AAGJ,YAAM,UAAU,cAAc,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC;AAClE,YAAM,WAAW,QACd,OAAO,CAAC,eAAe,OAAO,IAAI,UAAU,CAAC,EAC7C,IAAI,CAAC,gBAAgB;AAAA,QACpB;AAAA,QACA,MAAM,wBAAwB,OAAO,YAAY,OAAO,IAAI,UAAU,GAAIA,MAAK;AAAA,MACjF,EAAE;AAGJ,YAAM,KAAK,QAAQ;AACnB,iBAAW,WAAW,UAAU;AAC9B,cAAM,KAAK;AAAA,UACT,KAAK,KAAK,KAAK,UAAU,cAAc,QAAQ,UAAU,CAAC;AAAA,UAC1D,QAAQ;AAAA,QACV;AAAA,MACF;AAGA,iBAAW,cAAc,SAAS;AAChC,YAAI,CAAC,OAAO,IAAI,UAAU,GAAG;AAC3B,gBAAM,GAAG,KAAK,KAAK,KAAK,UAAU,cAAc,UAAU,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,QAC/E;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,UAAU,KAAK;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,CAAC,2BAA2B,GAAG,EAAG,OAAM;AAC5C,cAAQ;AAAA,IACV;AACA,UAAM,QAAQ,0BAA0B;AACxC,QAAI,UAAU,QAAQ,MAAM,UAAU,OAAO;AAG3C,YAAM,KAAK,QAAQ;AACnB,YAAM,KAAK,gBAAgB,KAAK,WAAW,KAAK;AAChD;AAAA,IACF;AAKA,UAAM,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,0BAA0B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAAA,IAC5F;AACA,UAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAC3C,QAAI;AACF,YAAM,KAAK,cAAc,YAAY,OAAO,QAAQ,KAAK;AAEzD,YAAM,KAAK,yBAAyB,YAAY,KAAK,KAAK;AAAA,IAC5D,SAAS,KAAK;AACZ,YAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC5E,YAAM;AAAA,IACR;AACA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,GAAG,KAAK,SAAS,sBAAsB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAAA,IAC1F,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,6BACZ,OACA,QACA,OACA,OACe;AACf,UAAM,WAAW,KAAK,QAAQ,KAAK,SAAS;AAC5C,UAAM,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,0BAA0B,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAAA,IAC5F;AACA,UAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAC3C,QAAI;AACF,YAAM,KAAK,cAAc,YAAY,OAAO,QAAQ,KAAK;AACzD,YAAM,KAAK,yBAAyB,YAAY,KAAK;AAAA,IACvD,SAAS,KAAK;AACZ,YAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC5E,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,cACZ,YACA,OACA,QACA,OACe;AACf,UAAM,WAAW,CAAC,GAAG,MAAM,EACxB,IAAI,CAAC,CAAC,YAAY,OAAO,OAAO;AAAA,MAC/B;AAAA,MACA,MAAM,wBAAwB,OAAO,YAAY,SAAS,KAAK;AAAA,IACjE,EAAE;AACJ,eAAW,WAAW,UAAU;AAC9B,YAAM,mBAAmB,KAAK,KAAK,KAAK,UAAU,cAAc,QAAQ,UAAU,CAAC;AACnF,YAAM,KAAK;AAAA,QACT,KAAK,KAAK,YAAY,cAAc,QAAQ,UAAU,CAAC;AAAA,QACvD,QAAQ;AAAA,QACR,EAAE,iBAAiB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,0BAA0B,OAAiD;AAC/E,UAAM,aAAa,sBAAsB,KAAK,QAAQ;AACtD,UAAM,KAAK,uBAAuB,UAAU;AAC5C,UAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AASrD,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5D,UAAM,eAAe,MAAM;AAAA,MACzB,KAAK,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAAG,+BAA+B;AAAA,IACxE;AACA,QAAI;AACF,YAAM,KAAK,yBAAyB,cAAc,KAAK;AAAA,IACzD,SAAS,KAAK;AACZ,YAAM,GAAG,cAAc,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9E,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,yBAAyB,YAAoB,OAAiD;AAIlG,UAAM,aAAa,sBAAsB,KAAK,QAAQ;AACtD,UAAM,KAAK,uBAAuB,UAAU;AAI5C,UAAM,QAAQ;AACd,UAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAIrD,UAAM,QAAQ;AACd,QAAI,UAAU;AACd,QAAI;AACF,YAAM,KAAK,KAAK,QAAQ;AACxB,YAAM,OAAO,KAAK,UAAU,UAAU;AACtC,gBAAU;AAAA,IACZ,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,IAC9D;AACA,QAAI;AACF,YAAM,OAAO,YAAY,KAAK,QAAQ;AAAA,IACxC,SAAS,KAAK;AACZ,UAAI,QAAS,OAAM,OAAO,YAAY,KAAK,QAAQ,EAAE,MAAM,MAAM,MAAS;AAC1E,YAAM;AAAA,IACR;AACA,UAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACpE,UAAI,KAAK,wDAAwD,UAAU,KAAK,GAAG,EAAE;AAAA,IACvF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,OAAwB,2BAA2B,KAAK,KAAK;AAAA,EAE7D,MAAc,0BAAyC;AACrD,UAAM,WAAW,KAAK,QAAQ,KAAK,SAAS;AAC5C,QAAI,QAAkB,CAAC;AACvB,QAAI;AACF,cAAQ,MAAM,QAAQ,QAAQ;AAAA,IAChC,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,0BAA0B,QAAQ,GAAG;AACvD,UAAM,SAAS,KAAK,IAAI,IAAI,yBAAwB;AACpD,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,KAAK,WAAW,yBAAyB,KAAK,KAAK,WAAW,SAAS,EAAG;AAC/E,UAAI;AACF,cAAM,QAAQ,MAAM,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC;AAClD,YAAI,MAAM,UAAU,OAAQ;AAAA,MAC9B,QAAQ;AACN;AAAA,MACF;AACA,YAAM,GAAG,KAAK,KAAK,UAAU,IAAI,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC7F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,gBACZ,UACA,UACA,MACe;AACf,QAAI,KAAK,MAAM,MAAM,mBAAmB,MAAM;AAC5C,YAAM,KAAK,GAAG,UAAU,UAAU,UAAU,MAAM,qBAAqB,SAAY,SAAY,EAAE,kBAAkB,KAAK,iBAAiB,CAAC;AAC1I;AAAA,IACF;AACA,UAAM,WAAW,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACpG,QAAI;AACF,YAAM,UAAU,UAAU,UAAU,OAAO;AAC3C,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AACZ,YAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AACzD,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,wBAAwB,KAAc,UAAkC;AAC5E,QAAI,CAAC,KAAK;AACR,YAAM,KAAK,kBAAkB;AAAA,QAC3B,kBAAkB;AAAA,QAClB,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,MACxC,CAAC;AACD;AAAA,IACF;AACA,UAAM,OACJ,eAAe,+BAA+B,2BAA2B,GAAG,IACxE,aACA;AACN,UAAM,KAAK,kBAAkB;AAAA,MAC3B,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,QAChB,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B;AAAA,QACA,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,kBACZ,OAMe;AACf,QAAI;AACF,UAAI,UAAoC,EAAE,SAAS,GAAG,cAAc,EAAE;AACtE,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,OAAO,CAAC;AAClE,YAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,iBAAiB,UAAU;AACnF,oBAAU,EAAE,GAAG,QAAQ,SAAS,GAAG,cAAc,OAAO,aAAa;AAAA,QACvE;AAAA,MACF,QAAQ;AAAA,MAER;AACA,YAAM,OAAiC,EAAE,GAAG,QAAQ;AACpD,UAAI,MAAM,sBAAuB,MAAK,gBAAgB,MAAM;AAC5D,UAAI,MAAM,qBAAqB,QAAW;AACxC,YAAI,MAAM,qBAAqB,KAAM,QAAO,KAAK;AAAA,YAC5C,MAAK,mBAAmB,MAAM;AAAA,MACrC;AACA,UAAI,MAAM,qBAAqB,OAAW,MAAK,mBAAmB,MAAM;AACxE,UAAI,MAAM,kBAAkB,OAAW,MAAK,gBAAgB,MAAM;AAIlE,YAAM,MAAM,KAAK,QAAQ,KAAK,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,YAAM,KAAK,gBAAgB,KAAK,YAAY,KAAK,UAAU,IAAI,GAAG,EAAE,gBAAgB,KAAK,CAAC;AAAA,IAC5F,SAAS,KAAK;AACZ,UAAI,MAAM,2CAA2C,GAAG,EAAE;AAAA,IAC5D;AAAA,EACF;AACF;AAEA,SAAS,kBACP,MACA,OACS;AACT,SAAO,KAAK,aAAa,MAAM,YAAY,KAAK,UAAU,MAAM;AAClE;","names":["limit"]}

package/dist/{chunk-MOQPEFLN.js → chunk-UP75KL3L.js}

@@ -4,7 +4,7 @@ import {
 import {
   drainPendingLifecycleForSyncOrThrow,
   drainPendingLifecycleLedgerForSync
-} from "./chunk-JE334SIA.js";
+} from "./chunk-22DYJLFN.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
@@ -181,4 +181,4 @@ export {
   offlineSyncStorageForSnapshot,
   drainPendingLifecycleForOfflineSync
 };
-//# sourceMappingURL=chunk-MOQPEFLN.js.map
+//# sourceMappingURL=chunk-UP75KL3L.js.map

package/dist/{chunk-W4AOR52H.js → chunk-UQDC3W77.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-CS52MFDV.js";
+} from "./chunk-SZG4WFAG.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-W4AOR52H.js.map
+//# sourceMappingURL=chunk-UQDC3W77.js.map

package/dist/{chunk-X7Y7WX73.js → chunk-UVYI6VIX.js}

@@ -246,4 +246,4 @@ export {
   decryptCapsuleFile,
   decryptCapsuleFileInMemory
 };
-//# sourceMappingURL=chunk-X7Y7WX73.js.map
+//# sourceMappingURL=chunk-UVYI6VIX.js.map

package/dist/{chunk-D5F7TKMH.js → chunk-V4JZCTMK.js}

@@ -19,7 +19,7 @@ import {
 import {
   decryptMemoryDirToPlaintext,
   migrateMemoryDirToEncrypted
-} from "./chunk-JN72EPOE.js";
+} from "./chunk-MAAL6OZV.js";
 import {
   generateSalt
 } from "./chunk-A6XUJE5D.js";
@@ -499,4 +499,4 @@ export {
   renderStatusReport,
   createPassphraseReader
 };
-//# sourceMappingURL=chunk-D5F7TKMH.js.map
+//# sourceMappingURL=chunk-V4JZCTMK.js.map

package/dist/{chunk-MQJL6CDZ.js → chunk-VA4O3U7U.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-BFO3IR56.js";
+} from "./chunk-TPEZ2SHV.js";
 import {
   StorageManager
-} from "./chunk-FRCESVV6.js";
+} from "./chunk-4HUCP4R4.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -23,7 +23,7 @@ import {
   serializeLocationDay,
   updateLocationSourceDay,
   writeLocationDay
-} from "./chunk-BMYZTZ5D.js";
+} from "./chunk-MY7B3HYC.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-BMXEBWBT.js";
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-MQJL6CDZ.js.map
+//# sourceMappingURL=chunk-VA4O3U7U.js.map

package/dist/{chunk-4CDYONWO.js → chunk-VDO32NLK.js}

@@ -1,9 +1,9 @@
 import {
   hasMemoryData
-} from "./chunk-6TT6HRE4.js";
+} from "./chunk-3AGHSQPM.js";
 import {
   resolveNamespaceStorageRoot
-} from "./chunk-BFO3IR56.js";
+} from "./chunk-TPEZ2SHV.js";
 import {
   getConfiguredNamespaces
 } from "./chunk-OWYHHW67.js";
@@ -724,4 +724,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-4CDYONWO.js.map
+//# sourceMappingURL=chunk-VDO32NLK.js.map

package/dist/{chunk-SOZUJCME.js → chunk-VHDKPGMG.js}

@@ -1,7 +1,7 @@
 import {
   buildStandup,
   parseStandupDate
-} from "./chunk-CUCWX3MO.js";
+} from "./chunk-QZLCVO2V.js";
 import {
   backfillMemoryStorage,
   runLocationBackfill,
@@ -9,23 +9,23 @@ import {
   runLocationDay,
   runLocationStatus,
   runLocationSync
-} from "./chunk-MQJL6CDZ.js";
+} from "./chunk-VA4O3U7U.js";
 import {
   externalWikiSearchOperation
-} from "./chunk-FAN73COB.js";
+} from "./chunk-7D7OUO5W.js";
 import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-FOH7AMMI.js";
+} from "./chunk-CALBQ2NG.js";
 import {
   CorrectionContractError
 } from "./chunk-QLK3SL7Q.js";
 import {
   memoryStoreRequestSchema,
   retainedCategoryAlias
-} from "./chunk-3C3J243X.js";
+} from "./chunk-3QKO4QN7.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1914,4 +1914,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-SOZUJCME.js.map
+//# sourceMappingURL=chunk-VHDKPGMG.js.map

package/dist/{chunk-QWW2JDDX.js → chunk-WNRTXEWW.js}

@@ -1,6 +1,6 @@
 import {
   runGraphEdgeDecayMaintenanceAcrossNamespaces
-} from "./chunk-BJRAELDH.js";
+} from "./chunk-SCXURCVT.js";
 import {
   normalizeDreamsStatusWindowHours
 } from "./chunk-EQWEIIKQ.js";
@@ -8,7 +8,7 @@ import {
   executeResolution,
   isValidResolutionVerb,
   runPreferenceDriftScan
-} from "./chunk-NE7I2RCT.js";
+} from "./chunk-R3X2T2LP.js";
 import {
   getRecallTimingStatus,
   isRecallTimingsOperator
@@ -21,13 +21,13 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-FOH7AMMI.js";
+} from "./chunk-CALBQ2NG.js";
 import {
   parseSharedWriteOutputControls
 } from "./chunk-IFBSZGW3.js";
 import {
   validateBriefingFormat
-} from "./chunk-P2WZHLUF.js";
+} from "./chunk-NOL7SEWN.js";
 import {
   parseDeepRecallMaxSteps
 } from "./chunk-A7AISUJI.js";
@@ -36,7 +36,7 @@ import {
   recallRequestSchema,
   retainedCategoryAlias,
   suggestionSubmitRequestSchema
-} from "./chunk-3C3J243X.js";
+} from "./chunk-3QKO4QN7.js";
 import {
   enforceNamespaceAllowList,
   tokenCapabilityStore
@@ -603,4 +603,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-QWW2JDDX.js.map
+//# sourceMappingURL=chunk-WNRTXEWW.js.map

package/dist/{chunk-NR2ASHBL.js → chunk-XOV7NRY5.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-5MA7ZLPD.js";
 import {
   LocalLlmClient
-} from "./chunk-S7GCT7NU.js";
+} from "./chunk-RBITPCMK.js";
 import {
   completeBackgroundGeneration,
   parseBackgroundGenerationJson
@@ -798,4 +798,4 @@ export {
   summarizeHourlyStatus,
   HourlySummarizer
 };
-//# sourceMappingURL=chunk-NR2ASHBL.js.map
+//# sourceMappingURL=chunk-XOV7NRY5.js.map

package/dist/{chunk-KP7SANCF.js → chunk-YPI4RQWV.js}

@@ -1,6 +1,6 @@
 import {
   isNamespaceKind
-} from "./chunk-6TT6HRE4.js";
+} from "./chunk-3AGHSQPM.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -40,4 +40,4 @@ export {
   positiveIntQueryParam,
   optionalNamespaceKindQueryParam
 };
-//# sourceMappingURL=chunk-KP7SANCF.js.map
+//# sourceMappingURL=chunk-YPI4RQWV.js.map

package/dist/{chunk-JKMHZF3Q.js → chunk-YSWJXOOL.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-FRCESVV6.js";
+} from "./chunk-4HUCP4R4.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-JKMHZF3Q.js.map
+//# sourceMappingURL=chunk-YSWJXOOL.js.map

package/dist/{chunk-LQG5O5EP.js → chunk-Z3O53WZR.js}

@@ -2,7 +2,7 @@ import {
   readCausalTrajectoryRecordsStrict,
   readCausalTrajectoryRevisionToken,
   resolveCausalTrajectoryStoreDir
-} from "./chunk-N4S4NUX5.js";
+} from "./chunk-B3O3IRZN.js";
 
 // src/coding/pre-action-gate.ts
 import { createHash } from "crypto";
@@ -221,4 +221,4 @@ export {
   normalizeActionIntent,
   PreActionFailureGate
 };
-//# sourceMappingURL=chunk-LQG5O5EP.js.map
+//# sourceMappingURL=chunk-Z3O53WZR.js.map

package/dist/{chunk-QVS22WTO.js → chunk-ZG5DWWKK.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-ZCUTSMR2.js";
 import {
   StorageManager
-} from "./chunk-FRCESVV6.js";
+} from "./chunk-4HUCP4R4.js";
 import {
   excludeSupportPassportPrivateMemories
 } from "./chunk-PWPIERBM.js";
@@ -134,4 +134,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-QVS22WTO.js.map
+//# sourceMappingURL=chunk-ZG5DWWKK.js.map