@remnic/core 9.69.88 → 9.69.89

package/dist/{chunk-K6T33R4Q.js → chunk-AXGJMDBS.js}

@@ -1,12 +1,12 @@
+import {
+  EMBEDDING_SHARD_FILE_PATTERN
+} from "./chunk-TYT4TEQV.js";
 import {
   matchesOfflineSyncDefaultExclude
 } from "./chunk-4NSLQ7EU.js";
 import {
   resolveSafeArchiveTarget
 } from "./chunk-GCGJW34D.js";
-import {
-  EMBEDDING_SHARD_FILE_PATTERN
-} from "./chunk-TYT4TEQV.js";
 import {
   assertEmbeddingGenerationLockHeld,
   embeddingGenerationLockPath,
@@ -151,6 +151,7 @@ async function applyEmbeddingGenerationTransaction(input) {
     if (await store.recoverIfInterrupted(fence)) {
       await resolveSafeArchiveTarget(root, shardDirRel);
     }
+    const justifiedRemovals = input.justifiedRemovals ?? /* @__PURE__ */ new Set();
     const baseStates = baseStatesForGeneration(input.baseStates, shardDirRel);
     if (baseStates.size > 0) {
       const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);
@@ -158,10 +159,18 @@ async function applyEmbeddingGenerationTransaction(input) {
       const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 }));
       const deferrals = divergedEmbeddingGenerationDeferrals({
         incomingFiles: incomingGenerationStates(input),
-        baseFiles: baseArr,
+        // A pre-authorized removal keeps its base entry only while still on
+        // disk (digest auth): present members are compared normally — a
+        // daemon rewrite still defers — while an absent member is already
+        // applied and must not diverge the retry (#3150 review).
+        baseFiles: baseArr.filter((member) => !justifiedRemovals.has(member.path) || localCensus.has(member.path)),
         currentFiles: censusArr
       });
-      const addedOrRemovedSinceBase = censusArr.some((member) => !baseStates.has(member.path)) || baseArr.some((member) => !localCensus.has(member.path));
+      const incomingShardPaths = new Set(input.incomingShardPaths);
+      const addedOrRemovedSinceBase = censusArr.some((member) => !baseStates.has(member.path) && !justifiedRemovals.has(member.path) && // An incoming member found in the census is the apply's own
+      // already-published work (response-loss retry), not a local
+      // addition; its bytes were verified above.
+      !incomingShardPaths.has(member.path)) || baseArr.some((member) => !localCensus.has(member.path) && !justifiedRemovals.has(member.path));
       if (deferrals.length > 0 || addedOrRemovedSinceBase) {
         const handled = new Set(input.incomingShardPaths);
         if (input.incomingMarker) handled.add(input.incomingMarker.path);
@@ -180,6 +189,31 @@ async function applyEmbeddingGenerationTransaction(input) {
           deferredLocalDivergence: true
         };
       }
+    } else if (input.freshCreateClaim) {
+      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);
+      if (localCensus.size > 0) {
+        const incomingArr = incomingGenerationStates(input).sort((left, right) => left.path.localeCompare(right.path));
+        const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 })).sort((left, right) => left.path.localeCompare(right.path));
+        const identical = censusArr.length === incomingArr.length && censusArr.every((member, index) => member.path === incomingArr[index]?.path && member.sha256 === incomingArr[index]?.sha256);
+        if (!identical) {
+          const handled = new Set(input.incomingShardPaths);
+          if (input.incomingMarker) handled.add(input.incomingMarker.path);
+          if (input.incomingMarkerPresent) handled.add(markerRel);
+          for (const relPath of localCensus.keys()) handled.add(relPath);
+          log.warn(
+            `embedding generation ${shardDirRel} deferred: base-less creation does not match the existing local generation under the mutation lock; nothing published, nothing removed`
+          );
+          return {
+            shardDirRel,
+            upserted: 0,
+            deleted: 0,
+            writtenStates: /* @__PURE__ */ new Map(),
+            removedPaths: /* @__PURE__ */ new Set(),
+            handledPaths: handled,
+            deferredLocalDivergence: true
+          };
+        }
+      }
     }
     const published = /* @__PURE__ */ new Map();
     let identity = null;
@@ -301,6 +335,23 @@ async function applyEmbeddingGenerationTransaction(input) {
           log.warn(`embedding generation ${shardDirRel}: marker cleanup deferred after publish: ${err}`);
         }
       }
+      if (input.deletionMtimeByPath !== void 0 && io.deleteFile) {
+        let firstTombstoneError = null;
+        for (const relPath of removedPaths) {
+          try {
+            await io.deleteFile({
+              root: root.abs,
+              path: relPath,
+              filePath: await resolveSafeArchiveTarget(root, relPath),
+              mtimeMs: input.deletionMtimeByPath.get(relPath) ?? input.now
+            });
+          } catch (err) {
+            firstTombstoneError ??= err;
+            log.warn(`embedding generation ${shardDirRel}: tombstone recording failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
+        if (firstTombstoneError) throw firstTombstoneError;
+      }
       return {
         shardDirRel,
         upserted: published.size,
@@ -515,6 +566,103 @@ function divergedEmbeddingGenerationDeferrals(options) {
   }
   return deferred.sort((left, right) => left.localeCompare(right));
 }
+async function applyIncomingEmbeddingGenerations(options) {
+  const incomingGenerations = detectIncomingEmbeddingGenerations(options.incomingMap.keys());
+  const generationDirs = /* @__PURE__ */ new Set([
+    ...incomingGenerations.shardDirs,
+    ...incomingGenerations.legacyMarkerDirs
+  ]);
+  const deferredGenerationDirs = /* @__PURE__ */ new Set();
+  for (const deferredPath of options.deferredPaths) {
+    const membership = embeddingGenerationMembership(deferredPath);
+    if (membership) deferredGenerationDirs.add(membership.shardDir);
+  }
+  const transactionResults = [];
+  for (const shardDir of generationDirs) {
+    if (options.omittedGenerationDirs.has(shardDir)) {
+      throw new EmbeddingIndexStorageError(
+        `offline sync snapshot both includes and omits embedding generation ${shardDir}; refusing to apply`
+      );
+    }
+  }
+  if (generationDirs.size > 0 && options.customIoPresent && !(options.io.writeStagingFile && options.io.readStagingFile)) {
+    throw new EmbeddingIndexStorageError(
+      "refusing to replace embedding generation: custom storage IO requires both writeStagingFile and readStagingFile hooks; unencrypted raw staging would plaintext-downgrade the index"
+    );
+  }
+  for (const shardDir of generationDirs) {
+    if (deferredGenerationDirs.has(shardDir)) continue;
+    if (incomingGenerations.legacyMarkerDirs.has(shardDir) && !incomingGenerations.shardDirs.has(shardDir)) {
+      const markerRel = [...options.incomingMap.keys()].find(
+        (relPath) => embeddingMarkerDirOf(relPath) === shardDir.slice(0, -`/${EMBEDDING_SHARD_DIR_BASENAME}`.length)
+      );
+      if (!markerRel) continue;
+      transactionResults.push(await applyEmbeddingGenerationTransaction({
+        root: options.root,
+        shardDirRel: shardDir,
+        incomingShardPaths: [],
+        incomingMarker: {
+          path: markerRel,
+          sha256: options.incomingMap.get(markerRel).sha256,
+          buffer: options.incomingBuffers.get(markerRel) ?? null
+        },
+        incomingMarkerPresent: false,
+        incomingShardStates: /* @__PURE__ */ new Map(),
+        incomingBuffers: options.incomingBuffers,
+        baseStates: options.baseMap,
+        io: options.io,
+        now: options.now
+      }));
+      continue;
+    }
+    transactionResults.push(await applyEmbeddingGenerationTransaction({
+      root: options.root,
+      shardDirRel: shardDir,
+      incomingShardPaths: [...options.incomingMap.keys()].filter((relPath) => embeddingShardDirOf(relPath) === shardDir).sort(),
+      incomingMarker: null,
+      incomingMarkerPresent: Boolean(
+        incomingGenerations.legacyMarkerDirs.has(shardDir)
+      ),
+      incomingShardStates: new Map(
+        [...options.incomingMap.values()].filter((state) => embeddingShardDirOf(state.path) === shardDir).map((state) => [state.path, state])
+      ),
+      incomingBuffers: options.incomingBuffers,
+      baseStates: options.baseMap,
+      io: options.io,
+      now: options.now
+    }));
+  }
+  const localGenerationDirs = /* @__PURE__ */ new Set();
+  for (const relPath of options.currentMap.keys()) {
+    const membership = embeddingGenerationMembership(relPath);
+    if (membership?.kind === "shard") localGenerationDirs.add(membership.shardDir);
+  }
+  for (const shardDir of localGenerationDirs) {
+    if (generationDirs.has(shardDir) || deferredGenerationDirs.has(shardDir) || options.omittedGenerationDirs.has(shardDir)) {
+      continue;
+    }
+    const localMembers = [...options.currentMap.keys()].filter(
+      (relPath) => embeddingGenerationMembership(relPath)?.shardDir === shardDir
+    );
+    if (localMembers.length === 0) continue;
+    const baseMembers = localMembers.filter((relPath) => options.baseMap.has(relPath));
+    const tombstonedMembers = options.deletionMtimeByPath === void 0 ? [] : [...options.deletionMtimeByPath.keys()].filter(
+      (relPath) => embeddingGenerationMembership(relPath)?.shardDir === shardDir
+    );
+    const tombstoneCovered = tombstonedMembers.length > 0;
+    const baseEvidenced = baseMembers.length > 0 && baseMembers.every((relPath) => !options.incomingMap.has(relPath));
+    if (!tombstoneCovered && !baseEvidenced) continue;
+    transactionResults.push(await applyEmbeddingGenerationRemoval({
+      root: options.root,
+      shardDirRel: shardDir,
+      io: { deleteFile: options.io.deleteFile, readFile: options.io.readFile },
+      deletionMtimeByPath: options.deletionMtimeByPath,
+      baseStates: options.baseMap,
+      now: options.now
+    }));
+  }
+  return { transactionResults, deferredGenerationDirs };
+}
 
 export {
   EMBEDDING_SHARD_DIR_BASENAME,
@@ -530,6 +678,7 @@ export {
   resolvePushEmbeddingGenerationState,
   storageBackedIndexStoreIo,
   applyEmbeddingGenerationRemoval,
-  divergedEmbeddingGenerationDeferrals
+  divergedEmbeddingGenerationDeferrals,
+  applyIncomingEmbeddingGenerations
 };
-//# sourceMappingURL=chunk-K6T33R4Q.js.map
+//# sourceMappingURL=chunk-AXGJMDBS.js.map

package/dist/chunk-AXGJMDBS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/offline-sync-embedding-generation.ts"],"sourcesContent":["// Embedding-index generation semantics for offline sync (issue #3146, PR\n// #3148). Extracted from offline-sync.ts so the god-file line-count ratchet\n// does not grow when the rules gain behavior. The snapshot walker treats\n// every `state/embeddings/` shard set — or a legacy `state/embeddings.json`\n// marker — as ONE generation, in both directions:\n//\n//   1. Atomic replacement (apply side): an incoming generation is staged\n//      complete, verified byte-for-byte, and published through the store's\n//      single backup-swap state machine. A crash or write failure can never\n//      leave a mix of the local and incoming generation on disk, and a\n//      local-only shard of a replaced generation is removed by the swap, not\n//      merged into the incoming set.\n//   2. Filter-to-omit, never filter-to-delete (push side): when an exclusion\n//      filter removes ANY member of a local generation from a push, the\n//      WHOLE generation is omitted — files and deletion metadata — and the\n//      receiver keeps its copy. A filtered generation must never look\n//      deleted, and a partially filtered snapshot must never look like a\n//      complete generation.\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { lstat, mkdir, readFile, readdir, rm, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport {\n  type EmbeddingIndexFile,\n  EmbeddingIndexFileStore,\n  type EmbeddingIndexIdentity,\n  type EmbeddingIndexStoreIo,\n  EmbeddingIndexStorageError,\n  parseEmbeddingIndexDocument,\n  serializeEmbeddingShard,\n  shardEntriesForIndex,\n  validateShardMembership,\n} from \"./embedding-index-storage.js\";\nimport {\n  assertEmbeddingGenerationLockHeld,\n  type EmbeddingGenerationFence,\n  embeddingGenerationLockPath,\n  withEmbeddingGenerationLock,\n} from \"./embedding-generation-lock.js\";\nimport type { OfflineSyncExcludeFile, OfflineSyncFileTarget } from \"./offline-sync-file-io.js\";\nimport { EMBEDDING_SHARD_FILE_PATTERN } from \"./offline-sync-runtime-state.js\";\nimport { log } from \"./logger.js\";\nimport type {\n  OfflineSyncFileDeleteTarget,\n  OfflineSyncFileStagingReadTarget,\n  OfflineSyncFileStagingWriteTarget,\n  OfflineSyncFileState,\n} from \"./offline-sync.js\";\nimport { type SafeArchiveRoot, resolveSafeArchiveTarget } from \"./transfer/fs-utils.js\";\n\nconst EMBEDDING_MARKER_BASENAME = \"embeddings.json\";\nexport const EMBEDDING_SHARD_DIR_BASENAME = \"embeddings\";\n\n/**\n * Canonical `state` dir prefix (\"state\" or \"namespaces/<ns>/state\") for a\n * path's segments, or null when the path is not canonical runtime state.\n */\nfunction canonicalStateDirPrefix(parts: string[]): string | null {\n  if (parts[0] === \"state\") return \"state\";\n  if (parts[0] === \"namespaces\" && parts.length >= 4 && parts[2] === \"state\") {\n    return `namespaces/${parts[1]}/state`;\n  }\n  return null;\n}\n\n/** The sharded-generation directory when `relPath` is one of its shards. */\nexport function embeddingShardDirOf(relPath: string): string | null {\n  const parts = relPath.split(\"/\");\n  if (parts.length < 3) return null;\n  if (!EMBEDDING_SHARD_FILE_PATTERN.test(parts[parts.length - 1] ?? \"\")) return null;\n  if (parts[parts.length - 2] !== EMBEDDING_SHARD_DIR_BASENAME) return null;\n  if (canonicalStateDirPrefix(parts) === null) return null;\n  return parts.slice(0, -1).join(\"/\");\n}\n\n/**\n * True when `dirPath` is a canonical embeddings generation dir\n * (`state/embeddings` or `namespaces/<ns>/state/embeddings`). Encodes the\n * snapshot-field shape contract without a ReDoS-shaped literal (issue #2439).\n */\nexport function isEmbeddingGenerationDirPath(dirPath: string): boolean {\n  const membership = embeddingGenerationMembership(`${dirPath}/shard-0000.json`);\n  return membership !== null && membership.shardDir === dirPath;\n}\n\n/** The state dir when `relPath` is the legacy single-file marker. */\nexport function embeddingMarkerDirOf(relPath: string): string | null {\n  const parts = relPath.split(\"/\");\n  if ((parts[parts.length - 1] ?? \"\") !== EMBEDDING_MARKER_BASENAME) return null;\n  if (canonicalStateDirPrefix(parts) === null) return null;\n  return parts.slice(0, -1).join(\"/\");\n}\n\n/**\n * Membership of `relPath` in an embedding generation: shards belong to their\n * `.../embeddings` directory, the legacy marker belongs to the sibling\n * `.../embeddings` directory of its state dir.\n */\nexport function embeddingGenerationMembership(relPath: string): { kind: \"shard\" | \"marker\"; shardDir: string } | null {\n  const shardDir = embeddingShardDirOf(relPath);\n  if (shardDir) return { kind: \"shard\", shardDir };\n  const markerDir = embeddingMarkerDirOf(relPath);\n  if (markerDir) return { kind: \"marker\", shardDir: `${markerDir}/${EMBEDDING_SHARD_DIR_BASENAME}` };\n  return null;\n}\n\nexport interface IncomingEmbeddingGenerations {\n  /** Generation dirs with at least one incoming shard. */\n  shardDirs: Set<string>;\n  /** State dirs whose incoming snapshot carries the legacy marker. */\n  legacyMarkerDirs: Set<string>;\n}\n\n/** Classify incoming snapshot paths into embedding generations. */\nexport function detectIncomingEmbeddingGenerations(incomingPaths: Iterable<string>): IncomingEmbeddingGenerations {\n  const shardDirs = new Set<string>();\n  const legacyMarkerDirs = new Set<string>();\n  for (const relPath of incomingPaths) {\n    const membership = embeddingGenerationMembership(relPath);\n    if (!membership) continue;\n    if (membership.kind === \"shard\") shardDirs.add(membership.shardDir);\n    else legacyMarkerDirs.add(membership.shardDir);\n  }\n  return { shardDirs, legacyMarkerDirs };\n}\n\nfunction shardRelPath(shardDirRel: string, shardIndex: number): string {\n  return `${shardDirRel}/shard-${String(shardIndex).padStart(4, \"0\")}.json`;\n}\n\nfunction describeIndexReadFailure(\n  read: { outcome: \"absent\" } | { outcome: \"foreign\" } | { outcome: \"unreadable\"; reason: string }\n): string {\n  if (read.outcome === \"unreadable\") return read.reason;\n  if (read.outcome === \"foreign\") return \"unrecognized index format\";\n  return \"generation document is absent\";\n}\n\nfunction sha256Hex(buffer: Buffer): string {\n  return createHash(\"sha256\").update(buffer).digest(\"hex\");\n}\n\nasync function pathExists(absPath: string): Promise<boolean> {\n  try {\n    await lstat(absPath);\n    return true;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw err;\n  }\n}\n\nexport interface EmbeddingGenerationTransactionIo {\n  /** Storage-backed local read: hydrates unchanged shards (metadata-only\n   * pulls skip their content) and decrypts secure-store files. */\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n  writeStagingFile?: (target: OfflineSyncFileStagingWriteTarget) => Promise<void>;\n  readStagingFile?: (target: OfflineSyncFileStagingReadTarget) => Promise<Buffer>;\n  deleteFile?: (target: OfflineSyncFileDeleteTarget) => Promise<void>;\n}\n\nexport interface EmbeddingGenerationTransactionInput {\n  root: SafeArchiveRoot;\n  /** The generation dir, e.g. `state/embeddings`. */\n  shardDirRel: string;\n  /** Incoming shard rel paths — the complete incoming sharded generation. */\n  incomingShardPaths: string[];\n  /** Incoming legacy marker (rel path + verified content), when the\n   * incoming generation is legacy-layout. Mutually exclusive with\n   * `incomingShardPaths`. */\n  incomingMarker: { path: string; sha256: string; buffer: Buffer | null } | null;\n  /** True when the incoming snapshot ALSO carries the legacy marker while\n   * shards form the generation (mixed remote): the per-file loop then writes\n   * the marker as the inert remote artifact, so this transaction must NOT\n   * remove a local marker. */\n  incomingMarkerPresent: boolean;\n  /** Incoming shard records (sha256 for local hydration of unchanged\n   * metadata-only pulls). */\n  incomingShardStates: ReadonlyMap<string, OfflineSyncFileState>;\n  /** Verified incoming content by rel path (absent for shards the metadata\n   * hydration skipped because the local hash already matches). */\n  incomingBuffers: ReadonlyMap<string, Buffer>;\n  /**\n   * Shared-base states (pre-census): lets the transaction re-evaluate\n   * divergence against ACTUAL disk contents while holding the mutation\n   * lock, instead of trusting the census taken before the lock\n   * (codex P1: a daemon mutation between census and lock was discarded).\n   */\n  baseStates?: ReadonlyMap<string, { sha256: string }>;\n  /**\n   * Paths this apply is pre-authorized to remove (changeset deletes / remote\n   * tombstones). A base member absent from the under-lock census is\n   * divergence UNLESS it is pre-authorized — the retry after a response loss\n   * must re-apply idempotently instead of failing as diverged (#3150\n   * review). A pre-authorized member still present with a changed digest\n   * defers as before, so a daemon rewrite is never silently swept.\n   */\n  justifiedRemovals?: ReadonlySet<string>;\n  /**\n   * Deletion revisions (mtimeMs by path) to record through the delete hook\n   * AFTER the swap publishes. Swept members bypass the per-file delete path,\n   * so without this their tombstones are lost and a later peer without\n   * shared-base evidence can reintroduce the removed shards (codex P1).\n   */\n  deletionMtimeByPath?: ReadonlyMap<string, number>;\n  /**\n   * True when the incoming set claims to be a FRESH creation but carries no\n   * base evidence (manifested changeset members are all base-less upserts):\n   * a non-empty local generation must match the incoming set exactly or the\n   * apply defers as diverged, because the empty-base divergence skip would\n   * otherwise silently replace it (#3150 review).\n   */\n  freshCreateClaim?: boolean;\n  io: EmbeddingGenerationTransactionIo;\n  now: number;\n}\n\nexport interface EmbeddingGenerationTransactionResult {\n  shardDirRel: string;\n  upserted: number;\n  deleted: number;\n  /** nextBase states for files the transaction published. */\n  writtenStates: Map<string, OfflineSyncFileState>;\n  /** nextBase paths the transaction removed (stale shards, demoted marker). */\n  removedPaths: Set<string>;\n  /** Paths the per-file apply loop must skip — all handled here. */\n  handledPaths: Set<string>;\n  /** True when the generation was deferred (not published) because the disk\n   * diverged from the shared base while the lock was held. */\n  deferredLocalDivergence?: boolean;\n}\n\n/**\n * Content for ONE incoming generation member: the verified incoming buffer,\n * or the LOCAL file hash-verified against the incoming record (metadata-only\n * pulls skip content whose local hash already matches — the local bytes ARE\n * the incoming content). Shared by the shard and legacy-marker branches.\n */\nasync function hydratedIncomingBuffer(\n  io: EmbeddingGenerationTransactionIo,\n  root: SafeArchiveRoot,\n  relPath: string,\n  expectedSha256: string,\n  incoming: Buffer | null | undefined,\n): Promise<Buffer> {\n  if (incoming) return incoming;\n  const filePath = await resolveSafeArchiveTarget(root, relPath);\n  const local = io.readFile\n    ? await io.readFile({ root: root.abs, path: relPath, filePath })\n    : await readFile(filePath);\n  if (sha256Hex(local) !== expectedSha256) {\n    throw new EmbeddingIndexStorageError(\n      `cannot hydrate unchanged embedding index file ${relPath}: local digest does not match the incoming record; local generation preserved`,\n    );\n  }\n  return local;\n}\n\n/**\n * Apply ONE incoming embedding generation atomically (issue #3148, round 4):\n * recover an interrupted replacement, validate the complete incoming\n * generation (legacy markers are converted to the sharded layout so the\n * one-way layout is preserved), stage it, verify the staged bytes, then\n * publish through the shared backup-swap. Any failure before the swap leaves\n * the local generation untouched; a crash in the swap gap is rolled back by\n * the store's recovery on next use.\n */\n/**\n * Enumerate and hash the ACTUAL local generation on disk (legacy marker +\n * every shard) through the configured secure IO — the fresh in-lock census\n * the stale pre-lock apply census cannot be trusted for (codex P1).\n */\n/** Scope the shared vault base to this physical embedding generation. */\nfunction baseStatesForGeneration(\n  base: ReadonlyMap<string, { sha256: string }> | undefined,\n  shardDirRel: string,\n): Map<string, { sha256: string }> {\n  return new Map([...base ?? []].filter(([relPath]) => embeddingGenerationMembership(relPath)?.shardDir === shardDirRel));\n}\n\nasync function censusGenerationState(\n  io: EmbeddingGenerationTransactionIo,\n  root: SafeArchiveRoot,\n  markerRel: string,\n  markerAbs: string,\n  shardDirAbs: string,\n  shardDirRel: string,\n): Promise<Map<string, string>> {\n  const census = new Map<string, string>();\n  const readSha = async (relPath: string, filePath: string) =>\n    sha256Hex(io.readFile ? await io.readFile({ root: root.abs, path: relPath, filePath }) : await readFile(filePath));\n  if (await pathExists(markerAbs)) census.set(markerRel, await readSha(markerRel, markerAbs));\n  const names = await readdir(shardDirAbs).catch((err: NodeJS.ErrnoException) => {\n    if (err.code === \"ENOENT\") return [] as string[];\n    throw err;\n  });\n  for (const name of names.filter((candidate) => EMBEDDING_SHARD_FILE_PATTERN.test(candidate)).sort()) {\n    const relPath = `${shardDirRel}/${name}`;\n    census.set(relPath, await readSha(relPath, path.join(shardDirAbs, name)));\n  }\n  return census;\n}\n\n/** Incoming member states for the divergence helper (digests as fallback). */\nfunction incomingGenerationStates(input: EmbeddingGenerationTransactionInput): { path: string; sha256: string }[] {\n  const states = input.incomingShardPaths.map((relPath) => ({\n    path: relPath,\n    sha256: input.incomingShardStates.get(relPath)?.sha256 ?? sha256Hex(input.incomingBuffers.get(relPath) ?? Buffer.alloc(0)),\n  }));\n  if (input.incomingMarker) {\n    states.push({ path: input.incomingMarker.path, sha256: input.incomingMarker.sha256 });\n  }\n  return states;\n}\n\nexport async function applyEmbeddingGenerationTransaction(\n  input: EmbeddingGenerationTransactionInput\n): Promise<EmbeddingGenerationTransactionResult> {\n  const { root, shardDirRel, io } = input;\n  const stateDirRel = shardDirRel.slice(0, -`/${EMBEDDING_SHARD_DIR_BASENAME}`.length);\n  const stateDirAbs = await resolveSafeArchiveTarget(root, stateDirRel);\n  return await withEmbeddingGenerationLock(stateDirAbs, async (section) => {\n    const lockPath = embeddingGenerationLockPath(stateDirAbs);\n    const fence: EmbeddingGenerationFence = () => assertEmbeddingGenerationLockHeld(lockPath, section);\n    const markerRel = `${stateDirRel}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirAbs = await resolveSafeArchiveTarget(root, shardDirRel);\n    const markerAbs = await resolveSafeArchiveTarget(root, markerRel);\n    const store = new EmbeddingIndexFileStore(\n      markerAbs,\n      shardDirAbs,\n      await resolveSafeArchiveTarget(root, `${stateDirRel}/embedding-fallback-status.json`)\n    );\n\n    // 1. Close a pending rename gap (old generation restored) before staging:\n    //    the swap below must never build on a half-replaced generation. The\n    //    fixed backup path is validated first: a planted symlink (or any\n    //    escape) must fail closed instead of being renamed into the published\n    //    position or removed through. The restored target is re-resolved so a\n    //    symlinked restoration cannot slip past the subsequent IO.\n    const backupRel = `${stateDirRel}/embeddings.pre-replace.tmp`;\n    await resolveSafeArchiveTarget(root, backupRel);\n    if (await store.recoverIfInterrupted(fence)) {\n      await resolveSafeArchiveTarget(root, shardDirRel);\n    }\n\n    // Codex P1: the apply census was taken BEFORE this lock, so it may be\n    // stale. Re-enumerate and hash the ACTUAL local generation through the\n    // secure IO and defer the WHOLE generation when the disk no longer\n    // matches the shared base — a concurrent daemon mutation must never be\n    // silently discarded by the swap.\n    // No shared base (fresh catch-up) = no divergence semantics to protect,\n    // UNLESS the apply claims a fresh creation (manifested base-less\n    // upserts): an existing local generation must then match the incoming\n    // set exactly or defer, instead of being silently replaced.\n    const justifiedRemovals = input.justifiedRemovals ?? new Set<string>();\n    const baseStates = baseStatesForGeneration(input.baseStates, shardDirRel);\n    if (baseStates.size > 0) {\n      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);\n      const baseArr = [...baseStates].map(([relPath, state]) => ({ path: relPath, sha256: state.sha256 }));\n      const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 }));\n      const deferrals = divergedEmbeddingGenerationDeferrals({\n        incomingFiles: incomingGenerationStates(input),\n        // A pre-authorized removal keeps its base entry only while still on\n        // disk (digest auth): present members are compared normally — a\n        // daemon rewrite still defers — while an absent member is already\n        // applied and must not diverge the retry (#3150 review).\n        baseFiles: baseArr.filter((member) => !justifiedRemovals.has(member.path) || localCensus.has(member.path)),\n        currentFiles: censusArr,\n      });\n      const incomingShardPaths = new Set(input.incomingShardPaths);\n      const addedOrRemovedSinceBase =\n        censusArr.some((member) =>\n          !baseStates.has(member.path) &&\n          !justifiedRemovals.has(member.path) &&\n          // An incoming member found in the census is the apply's own\n          // already-published work (response-loss retry), not a local\n          // addition; its bytes were verified above.\n          !incomingShardPaths.has(member.path)) ||\n        baseArr.some((member) => !localCensus.has(member.path) && !justifiedRemovals.has(member.path));\n      if (deferrals.length > 0 || addedOrRemovedSinceBase) {\n        const handled = new Set<string>(input.incomingShardPaths);\n        if (input.incomingMarker) handled.add(input.incomingMarker.path);\n        if (input.incomingMarkerPresent) handled.add(markerRel);\n        for (const relPath of localCensus.keys()) handled.add(relPath);\n        log.warn(\n          `embedding generation ${shardDirRel} deferred: disk diverged from the shared base under the mutation lock (${deferrals.length > 0 ? deferrals.join(\", \") : \"generation membership changed since base\"}); nothing published, nothing removed`,\n        );\n        return {\n          shardDirRel,\n          upserted: 0,\n          deleted: 0,\n          writtenStates: new Map<string, OfflineSyncFileState>(),\n          removedPaths: new Set<string>(),\n          handledPaths: handled,\n          deferredLocalDivergence: true,\n        };\n      }\n    } else if (input.freshCreateClaim) {\n      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);\n      if (localCensus.size > 0) {\n        const incomingArr = incomingGenerationStates(input).sort((left, right) => left.path.localeCompare(right.path));\n        const censusArr = [...localCensus]\n          .map(([relPath, sha256]) => ({ path: relPath, sha256 }))\n          .sort((left, right) => left.path.localeCompare(right.path));\n        const identical =\n          censusArr.length === incomingArr.length &&\n          censusArr.every((member, index) => member.path === incomingArr[index]?.path && member.sha256 === incomingArr[index]?.sha256);\n        if (!identical) {\n          const handled = new Set<string>(input.incomingShardPaths);\n          if (input.incomingMarker) handled.add(input.incomingMarker.path);\n          if (input.incomingMarkerPresent) handled.add(markerRel);\n          for (const relPath of localCensus.keys()) handled.add(relPath);\n          log.warn(\n            `embedding generation ${shardDirRel} deferred: base-less creation does not match the existing local generation under the mutation lock; nothing published, nothing removed`,\n          );\n          return {\n            shardDirRel,\n            upserted: 0,\n            deleted: 0,\n            writtenStates: new Map<string, OfflineSyncFileState>(),\n            removedPaths: new Set<string>(),\n            handledPaths: handled,\n            deferredLocalDivergence: true,\n          };\n        }\n      }\n    }\n\n    const published = new Map<string, Buffer>();\n    let identity: EmbeddingIndexIdentity | null = null;\n  // Divergence re-evaluation happens HERE, under the lock, against real\n  // disk bytes: the apply-side census may already be stale.\n  // 2. Build the complete incoming generation (final rel path → plaintext\n  //    bytes) and validate every document BEFORE touching local state.\n  if (input.incomingMarker) {\n    const markerBuffer = await hydratedIncomingBuffer(\n      io,\n      root,\n      input.incomingMarker.path,\n      input.incomingMarker.sha256,\n      input.incomingMarker.buffer,\n    );\n    const read = parseEmbeddingIndexDocument(markerBuffer.toString(\"utf-8\"));\n    if (read.outcome !== \"ok\") {\n      throw new EmbeddingIndexStorageError(\n        `refusing incoming embedding index generation ${markerRel}: ${describeIndexReadFailure(read)}; local generation preserved`\n      );\n    }\n    identity = { provider: read.file.provider, model: read.file.model };\n    const groups = shardEntriesForIndex(read.file);\n    for (const [shardIndex, entries] of groups) {\n      if (Object.keys(entries).length === 0) continue;\n      published.set(\n        shardRelPath(shardDirRel, shardIndex),\n        Buffer.from(serializeEmbeddingShard(read.file, shardIndex, entries), \"utf-8\")\n      );\n    }\n  } else {\n    for (const relPath of input.incomingShardPaths) {\n      // Metadata-only pulls skip content whose local hash already matches\n      // the incoming record: the LOCAL bytes ARE the incoming content, so\n      // read and hash-verify them instead of failing (codex rounds 5-6).\n      const state = input.incomingShardStates.get(relPath);\n      const buffer = await hydratedIncomingBuffer(\n        io,\n        root,\n        relPath,\n        state?.sha256 ?? \"\",\n        input.incomingBuffers.get(relPath),\n      );\n      const read = parseEmbeddingIndexDocument(buffer.toString(\"utf-8\"));\n      if (read.outcome !== \"ok\") {\n        throw new EmbeddingIndexStorageError(\n          `refusing incoming embedding index shard ${relPath}: ${describeIndexReadFailure(read)}; local generation preserved`\n        );\n      }\n      validateShardMembership(relPath.split(\"/\").pop() ?? \"\", read.file);\n      const shardIdentity = { provider: read.file.provider, model: read.file.model };\n      if (!identity) identity = shardIdentity;\n      if (identity.provider !== shardIdentity.provider || identity.model !== shardIdentity.model) {\n        throw new EmbeddingIndexStorageError(\n          `refusing mixed-identity incoming embedding index generation in ${shardDirRel}: ${relPath} is ${shardIdentity.provider}/${shardIdentity.model} but the generation is ${identity.provider}/${identity.model}; local generation preserved`\n        );\n      }\n      published.set(relPath, buffer);\n    }\n    if (published.size === 0) {\n      throw new EmbeddingIndexStorageError(\n        `incoming embedding index generation ${shardDirRel} is empty; local generation preserved`\n      );\n    }\n  }\n\n    const stagingRel = `${stateDirRel}/embeddings.staging.tmp-sync-${process.pid}-${input.now}-${randomBytes(8).toString(\"hex\")}`;\n    const stagingAbs = await resolveSafeArchiveTarget(root, stagingRel);\n    try {\n      await mkdir(stagingAbs, { recursive: true });\n\n      // 3. Stage the complete generation. With storage-backed IO the staged\n      //    ciphertext binds its FINAL canonical path (`aadRelPath`), so after\n      //    the directory swap it decrypts at the published path — a physical\n      //    staging-path AAD would make the published generation unreadable.\n      for (const [relPath, buffer] of published) {\n        const stagedRel = `${stagingRel}/${path.basename(relPath)}`;\n        const stagedAbs = await resolveSafeArchiveTarget(root, stagedRel);\n        const finalAbs = await resolveSafeArchiveTarget(root, relPath);\n        if (io.writeStagingFile) {\n          await io.writeStagingFile({\n            root: root.abs,\n            path: stagedRel,\n            filePath: stagedAbs,\n            content: buffer,\n            finalAadFilePath: finalAbs,\n          });\n        } else {\n          await writeFile(stagedAbs, buffer, { mode: 0o600 });\n        }\n      }\n\n      // 4. Verify the staged bytes against the incoming content before the\n      //    published generation is touched at all.\n      for (const [relPath, buffer] of published) {\n        const stagedRel = `${stagingRel}/${path.basename(relPath)}`;\n        const stagedAbs = await resolveSafeArchiveTarget(root, stagedRel);\n        const staged = io.readStagingFile\n          ? await io.readStagingFile({\n              root: root.abs,\n              path: stagedRel,\n              filePath: stagedAbs,\n              finalAadFilePath: await resolveSafeArchiveTarget(root, relPath),\n            })\n          : await readFile(stagedAbs);\n        if (!staged.equals(buffer)) {\n          throw new EmbeddingIndexStorageError(\n            `staged embedding index file ${stagedRel} does not match the incoming content; local generation preserved`\n          );\n        }\n      }\n\n      // 5. Publish with the ONE swap state machine shared with persist(). The\n      //    old directory moves aside wholesale, so local shards absent from\n      //    the incoming generation are removed by the swap — never merged.\n      const localShardRels = (\n        await readdir(shardDirAbs).catch((err) => {\n          if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [] as string[];\n          throw err;\n        })\n      )\n        .filter((name) => EMBEDDING_SHARD_FILE_PATTERN.test(name))\n        .map((name) => `${shardDirRel}/${name}`)\n        .sort();\n      await store.publishSwappedGeneration(stagingAbs, fence);\n\n      const writtenStates = new Map<string, OfflineSyncFileState>();\n      for (const [relPath, buffer] of published) {\n        writtenStates.set(relPath, {\n          path: relPath,\n          sha256: sha256Hex(buffer),\n          bytes: buffer.length,\n          mtimeMs: input.now,\n        });\n      }\n      const removedPaths = new Set<string>(localShardRels.filter((rel) => !published.has(rel)));\n      let deleted = removedPaths.size;\n      let markerCleanupFailed = false;\n      if ((await pathExists(markerAbs)) && !input.incomingMarker && !input.incomingMarkerPresent) {\n        // Publication is already committed. Keep its base advancement even if\n        // marker cleanup fails, retaining the marker in base for a retry.\n        try {\n          if (io.deleteFile) await io.deleteFile({ root: root.abs, path: markerRel, filePath: markerAbs });\n          else await rm(markerAbs, { force: true });\n          removedPaths.add(markerRel);\n          deleted += 1;\n        } catch (err) {\n          markerCleanupFailed = true;\n          log.warn(`embedding generation ${shardDirRel}: marker cleanup deferred after publish: ${err}`);\n        }\n      }\n      // Swept members bypass the per-file delete path, so record their\n      // deletion revisions here — mirroring the whole-generation removal\n      // path — or a later peer without shared-base evidence can reintroduce\n      // the removed shards (codex P1). An empty map still records (with\n      // `now`) when the caller declared a deletion context, so tombstones\n      // whose changeset deletes omit mtimeMs are not lost. Every member\n      // gets an attempt before the failure propagates: the push side then\n      // retries a fully-recorded apply or nothing, and the\n      // justified-removals exemption keeps that retry idempotent.\n      if (input.deletionMtimeByPath !== undefined && io.deleteFile) {\n        let firstTombstoneError: unknown = null;\n        for (const relPath of removedPaths) {\n          try {\n            await io.deleteFile({\n              root: root.abs,\n              path: relPath,\n              filePath: await resolveSafeArchiveTarget(root, relPath),\n              mtimeMs: input.deletionMtimeByPath.get(relPath) ?? input.now,\n            });\n          } catch (err) {\n            firstTombstoneError ??= err;\n            log.warn(`embedding generation ${shardDirRel}: tombstone recording failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`);\n          }\n        }\n        if (firstTombstoneError) throw firstTombstoneError;\n      }\n      return {\n        shardDirRel,\n        upserted: published.size,\n        deleted,\n        writtenStates,\n        removedPaths,\n        handledPaths: new Set([...published.keys(), ...removedPaths, ...(markerCleanupFailed ? [markerRel] : [])]),\n      };\n    } catch (err) {\n      await rm(stagingAbs, { recursive: true, force: true }).catch(() => undefined);\n      throw err;\n    }\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Push-side whole-generation omission\n// ---------------------------------------------------------------------------\n\nexport interface EmbeddingGenerationOmissionOptions {\n  rootAbs: string;\n  userExcludeRegexps?: readonly RegExp[];\n  excludeFile?: OfflineSyncExcludeFile;\n  /** Recorded deletion-revision paths: a tombstoned member counts as a\n   * generation member for omission detection even though it is absent on\n   * disk (its exclusion must omit the WHOLE generation). */\n  tombstonedPaths?: readonly string[];\n  /**\n   * Per-path push exclusion predicate (structural + node-local defaults +\n   * user regexps). Defaults to the built-in default excludes + the supplied\n   * user regexps, matching the walk that consumes the result.\n   */\n  isExcludedRelPath?: (relPath: string) => boolean;\n}\n\nexport interface EmbeddingGenerationOmission {\n  /** Existing member paths omitted because their generation is partial. */\n  omittedPaths: Set<string>;\n  /** Generation dirs whose members are omitted (snapshot field value). */\n  omittedDirs: string[];\n}\n\n/**\n * Compute the push-side whole-generation omission set: when ANY on-disk\n * member of an embedding generation is excluded by a push filter, EVERY\n * member of that generation is omitted (issue #3148, round 4).\n */\nexport async function computeOmittedEmbeddingGenerationPaths(\n  options: EmbeddingGenerationOmissionOptions\n): Promise<EmbeddingGenerationOmission> {\n  const omittedPaths = new Set<string>();\n  const omittedDirs: string[] = [];\n  const stateDirs = [\"state\"];\n  let namespaceNames: string[] = [];\n  try {\n    namespaceNames = (await readdir(path.join(options.rootAbs, \"namespaces\"), { withFileTypes: true }))\n      .filter((entry) => entry.isDirectory())\n      .map((entry) => entry.name);\n  } catch {\n    // no namespaces\n  }\n  for (const ns of namespaceNames) stateDirs.push(`namespaces/${ns}/state`);\n  const isExcluded = options.isExcludedRelPath ??\n    ((relPath: string) =>\n      matchesOfflineSyncDefaultExclude(relPath) ||\n      Boolean(options.userExcludeRegexps?.some((re) => re.test(relPath))));\n\n  for (const stateDir of stateDirs) {\n    const markerRel = `${stateDir}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirRel = `${stateDir}/${EMBEDDING_SHARD_DIR_BASENAME}`;\n    const shardDirAbs = path.join(options.rootAbs, ...shardDirRel.split(\"/\"));\n    const memberRels: string[] = [];\n    if (await pathExists(path.join(options.rootAbs, ...markerRel.split(\"/\")))) {\n      memberRels.push(markerRel);\n    }\n    let shardNames: string[] = [];\n    try {\n      shardNames = (await readdir(shardDirAbs, { withFileTypes: true }))\n        .filter((entry) => entry.isFile() && EMBEDDING_SHARD_FILE_PATTERN.test(entry.name))\n        .map((entry) => entry.name);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n    }\n    for (const name of shardNames) memberRels.push(`${shardDirRel}/${name}`);\n    // A tombstoned member is part of the generation even though it is\n    // already absent on disk: its exclusion must omit the WHOLE generation,\n    // not just drop its revision individually (codex round 6, XkFf).\n    for (const tombstoned of options.tombstonedPaths ?? []) {\n      const membership = embeddingGenerationMembership(tombstoned);\n      if (membership?.shardDir === shardDirRel && !memberRels.includes(tombstoned)) {\n        memberRels.push(tombstoned);\n      }\n    }\n    if (memberRels.length === 0) continue;\n\n    const excludedMembers: string[] = [];\n    for (const relPath of memberRels) {\n      let excluded = isExcluded(relPath);\n      if (!excluded && options.excludeFile) {\n        excluded = await options.excludeFile({\n          root: options.rootAbs,\n          path: relPath,\n          filePath: path.join(options.rootAbs, ...relPath.split(\"/\")),\n        });\n      }\n      if (excluded) excludedMembers.push(relPath);\n    }\n    if (excludedMembers.length === 0) continue;\n    omittedDirs.push(shardDirRel);\n    omittedPaths.add(shardDirRel); // skip new shards after the omission header\n    for (const relPath of memberRels) omittedPaths.add(relPath);\n  }\n  return { omittedPaths, omittedDirs };\n}\n\n/** Reject an exclusion introduced after the snapshot header was computed. */\nexport async function assertEmbeddingGenerationStillIncluded(\n  rootAbs: string, shardDirRel: string, excludeFile: OfflineSyncExcludeFile | undefined,\n  isExcludedRelPath: (relPath: string) => boolean, tombstonedPaths: readonly string[],\n): Promise<void> {\n  const current = await computeOmittedEmbeddingGenerationPaths({ rootAbs, excludeFile, isExcludedRelPath, tombstonedPaths });\n  if (current.omittedDirs.includes(shardDirRel)) {\n    throw new EmbeddingIndexStorageError(\n      `embedding generation ${shardDirRel} became partially excluded during snapshot capture; retry with a fresh omission header`,\n    );\n  }\n}\n\n/** True when a path belongs to a generation the push omitted. */\nexport function isPathInOmittedEmbeddingGeneration(relPath: string, omittedDirs: ReadonlySet<string>): boolean {\n  const membership = embeddingGenerationMembership(relPath);\n  return membership !== null && omittedDirs.has(membership.shardDir);\n}\n\nexport type { EmbeddingIndexFile };\n\nimport { matchesOfflineSyncDefaultExclude } from \"./offline-sync-exclude-globs.js\";\nimport type { OfflineSyncDeletionRevision } from \"./offline-sync.js\";\n\nexport interface PushEmbeddingGenerationState {\n  /** Generation dirs omitted by the push filters (snapshot header value). */\n  omittedDirs: string[];\n  /** All omitted member paths (walk skip set). */\n  omittedPaths: Set<string>;\n  /** Deletions with whole-generation suppression applied. */\n  deletions: OfflineSyncDeletionRevision[];\n}\n\n/**\n * One-call push-side generation state for streaming snapshot builders: the\n * whole-generation omission set (from user regexps, excludeFile, and default\n * excludes) plus the deletion list with omitted-generation revisions\n * suppressed — including revisions for members that are already absent, so a\n * filtered generation can never be announced as deleted.\n */\nexport async function resolvePushEmbeddingGenerationState(options: {\n  rootAbs: string;\n  includeTranscripts: boolean;\n  userExcludeRegexps?: readonly RegExp[];\n  excludeFile?: OfflineSyncExcludeFile;\n  deletions: readonly OfflineSyncDeletionRevision[];\n}): Promise<PushEmbeddingGenerationState> {\n  const omission = await computeOmittedEmbeddingGenerationPaths({\n    rootAbs: options.rootAbs,\n    userExcludeRegexps: options.userExcludeRegexps,\n    excludeFile: options.excludeFile,\n    // RAW pre-filter tombstones: a deleted member's exclusion must omit the\n    // whole generation even though the member is already absent on disk.\n    tombstonedPaths: options.deletions.map((deletion) => deletion.path),\n    isExcludedRelPath: (relPath) =>\n      matchesOfflineSyncDefaultExclude(relPath) ||\n      Boolean(options.userExcludeRegexps?.some((re) => re.test(relPath))),\n  });\n  const omittedDirs = new Set(omission.omittedDirs);\n  const deletions = options.deletions.filter((deletion) => {\n    if (matchesOfflineSyncDefaultExclude(deletion.path)) return false;\n    if (options.userExcludeRegexps?.some((re) => re.test(deletion.path))) return false;\n    const membership = embeddingGenerationMembership(deletion.path);\n    if (membership && omittedDirs.has(membership.shardDir)) return false;\n    return true;\n  });\n  return { omittedDirs: omission.omittedDirs, omittedPaths: omission.omittedPaths, deletions };\n}\n\n\ninterface StorageBackedIndexIoHost {\n  readOfflineSyncFile(filePath: string, opts?: { aadFilePath?: string }): Promise<Buffer>;\n  writeOfflineSyncStagingFile(\n    filePath: string,\n    content: Buffer,\n    opts?: { aadFilePath?: string },\n  ): Promise<void>;\n}\n\n/**\n * Daemon wiring for the index store IO backed by a StorageManager:\n * canonical-path secure reads/writes, so sync-published encrypted shards\n * decrypt in the daemon and daemon-written shards decrypt on sync. Shard\n * STAGING writes bind the FINAL published path.\n */\nexport function storageBackedIndexStoreIo(storage: StorageBackedIndexIoHost): EmbeddingIndexStoreIo {\n  return {\n    readUtf8: async (filePath) => (await storage.readOfflineSyncFile(filePath)).toString(\"utf-8\"),\n    writeUtf8: (filePath, contents, opts) =>\n      storage.writeOfflineSyncStagingFile(\n        filePath,\n        Buffer.from(contents, \"utf-8\"),\n        opts?.finalAadFilePath === undefined ? undefined : { aadFilePath: opts.finalAadFilePath },\n      ),\n  };\n}\n\nexport interface EmbeddingGenerationRemovalInput {\n  root: SafeArchiveRoot;\n  /** The generation dir, e.g. `state/embeddings`. */\n  shardDirRel: string;\n  io: Pick<EmbeddingGenerationTransactionIo, \"deleteFile\" | \"readFile\">;\n  /** Incoming deletion revisions by path, threaded so each removed member's\n   * tombstone is recorded through the configured delete hook AFTER the\n   * atomic empty publication (round 6: raw removal must not lose them). */\n  deletionMtimeByPath?: ReadonlyMap<string, number>;\n  now: number;\n  /**\n   * Shared-base states: when the live generation diverged from the base\n   * (daemon indexed, added, or removed members after the census), the\n   * removal DEFERS instead of erasing the local work (codex P1).\n   */\n  baseStates?: ReadonlyMap<string, { sha256: string }>;\n}\n\n/**\n * Remove a LOCAL embedding generation atomically because the remote deleted\n * it wholesale (every member has a deletion revision): recover first, then\n * demote the published directory through the store's single swap state\n * machine and delete the backup — a crash or delete failure can never leave\n * a partial same-identity generation serving silently missing memories.\n * The local legacy marker, when present, is removed through the same delete\n * hook the per-file path uses.\n */\nexport async function applyEmbeddingGenerationRemoval(\n  input: EmbeddingGenerationRemovalInput,\n): Promise<EmbeddingGenerationTransactionResult> {\n  const { root, shardDirRel, io } = input;\n  const stateDirRel = shardDirRel.slice(0, -(`/${EMBEDDING_SHARD_DIR_BASENAME}`.length));\n  const stateDirAbs = await resolveSafeArchiveTarget(root, stateDirRel);\n  return await withEmbeddingGenerationLock(stateDirAbs, async (section) => {\n    const lockPath = embeddingGenerationLockPath(stateDirAbs);\n    const fence: EmbeddingGenerationFence = () => assertEmbeddingGenerationLockHeld(lockPath, section);\n    const markerRel = `${stateDirRel}/${EMBEDDING_MARKER_BASENAME}`;\n    const shardDirAbs = await resolveSafeArchiveTarget(root, shardDirRel);\n    const markerAbs = await resolveSafeArchiveTarget(root, markerRel);\n    const store = new EmbeddingIndexFileStore(\n      markerAbs,\n      shardDirAbs,\n      await resolveSafeArchiveTarget(root, `${stateDirRel}/embedding-fallback-status.json`),\n    );\n    await store.recoverIfInterrupted(fence);\n\n    // Codex P1: the deletion census is stale by the time the lock is held.\n    // When the live generation no longer matches the shared base (daemon\n    // indexed, added, or removed members), DEFER the removal — the local\n    // work survives and a later sync re-evaluates with a fresh base.\n    // No shared base (fresh catch-up) = no divergence semantics to protect.\n    const baseStates = baseStatesForGeneration(input.baseStates, shardDirRel);\n    if (baseStates.size > 0) {\n      const localCensus = await censusGenerationState(io, root, markerRel, markerAbs, shardDirAbs, shardDirRel);\n      const baseArr = [...baseStates].map(([relPath, state]) => ({ path: relPath, sha256: state.sha256 }));\n      const censusArr = [...localCensus].map(([relPath, sha256]) => ({ path: relPath, sha256 }));\n      const changedSinceBase =\n        censusArr.some((member) => {\n          // A MODIFIED member must also defer: removing the generation would\n          // erase the daemon's rewrite, not just the remote's stale copy.\n          const baseSha = baseStates.get(member.path)?.sha256;\n          return baseSha === undefined || baseSha !== member.sha256;\n        }) || baseArr.some((member) => !localCensus.has(member.path));\n      if (changedSinceBase) {\n        const removedPaths = new Set<string>([...localCensus.keys()]);\n        log.warn(\n          `embedding generation removal ${shardDirRel} deferred: disk diverged from the shared base under the mutation lock; local generation preserved`,\n        );\n        return {\n          shardDirRel,\n          upserted: 0,\n          deleted: 0,\n          writtenStates: new Map<string, OfflineSyncFileState>(),\n          removedPaths,\n          handledPaths: new Set(removedPaths),\n          deferredLocalDivergence: true,\n        };\n      }\n    }\n    const localShardRels = (await readdir(shardDirAbs).catch((err) => {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return [] as string[];\n      throw err;\n    }))\n      .filter((name) => EMBEDDING_SHARD_FILE_PATTERN.test(name))\n      .map((name) => `${shardDirRel}/${name}`)\n      .sort();\n    await store.removePublishedGeneration(fence);\n    const removedPaths = new Set(localShardRels);\n    let deleted = removedPaths.size;\n    const markerPresent = await pathExists(markerAbs);\n    if (markerPresent) {\n      removedPaths.add(markerRel);\n      deleted += 1;\n    }\n    // Preserve the replicated tombstones through the configured hooks AFTER\n    // the atomic publication: raw removal must not lose the deletion\n    // revisions, or a downstream sync without base evidence retains stale\n    // entries. EVERY member (shards and marker) is recorded exactly ONCE with\n    // the remote revision when known, so a first hook call without a revision\n    // is never overwritten by an older replicated one. The storage hook\n    // tolerates already-absent paths.\n    let firstError: unknown = null;\n    for (const relPath of removedPaths) {\n      const memberAbs = relPath === markerRel ? markerAbs : await resolveSafeArchiveTarget(root, relPath);\n      const mtimeMs = input.deletionMtimeByPath?.get(relPath) ?? input.now;\n      if (io.deleteFile) {\n        try {\n          await io.deleteFile({\n            root: root.abs,\n            path: relPath,\n            filePath: await resolveSafeArchiveTarget(root, relPath),\n            mtimeMs,\n          });\n        } catch (err) {\n          firstError ??= err;\n          log.warn(`embedding generation removal: tombstone recording failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`);\n        }\n      } else if (relPath === markerRel && markerPresent) {\n        await rm(markerAbs, { force: true });\n      }\n    }\n    if (firstError) throw firstError;\n    return {\n      shardDirRel,\n      upserted: 0,\n      deleted,\n      writtenStates: new Map(),\n      removedPaths,\n      handledPaths: new Set(removedPaths),\n    };\n  });\n}\n\n/** Defer a whole generation when the shared remote base would erase a local change. */\nexport function divergedEmbeddingGenerationDeferrals(options: {\n  incomingFiles: readonly { path: string; sha256: string }[];\n  baseFiles: readonly { path: string; sha256: string }[];\n  currentFiles: readonly { path: string; sha256: string }[];\n}): string[] {\n  const base = new Map(options.baseFiles.map((f) => [f.path, f.sha256]));\n  const current = new Map(options.currentFiles.map((f) => [f.path, f.sha256]));\n  const incomingByPath = new Map(options.incomingFiles.map((f) => [f.path, f.sha256]));\n  const sharedDirs = new Set(options.baseFiles.map((f) => embeddingGenerationMembership(f.path)?.shardDir));\n  const conflictedDirs = new Set<string>();\n  for (const relPath of new Set([...base.keys(), ...current.keys(), ...incomingByPath.keys()])) {\n    const membership = embeddingGenerationMembership(relPath);\n    // Without a shared generation base this is an initial remote-authoritative\n    // import, not evidence of local indexing after a synchronized snapshot.\n    if (!membership || !sharedDirs.has(membership.shardDir)) continue;\n    const currentSha = current.get(relPath);\n    if (currentSha !== base.get(relPath) && currentSha !== incomingByPath.get(relPath)) {\n      conflictedDirs.add(membership.shardDir);\n    }\n  }\n  if (conflictedDirs.size === 0) return [];\n  const deferred: string[] = [];\n  // Include local/base members too: an all-absent remote generation still\n  // needs a concrete deferral so its removal cannot erase a local change.\n  for (const relPath of new Set([...base.keys(), ...current.keys(), ...incomingByPath.keys()])) {\n    const membership = embeddingGenerationMembership(relPath);\n    if (membership && conflictedDirs.has(membership.shardDir)) deferred.push(relPath);\n  }\n  return deferred.sort((left, right) => left.localeCompare(right));\n}\n\n// ---------------------------------------------------------------------------\n// Snapshot-side generation routing, extracted from applyOfflineSyncSnapshot\n// for issue #3150 so the changeset path could share the machinery without\n// growing the offline-sync.ts ratchet ceiling. Behavior-preserving.\n// ---------------------------------------------------------------------------\n\nexport interface IncomingEmbeddingGenerationApply {\n  transactionResults: EmbeddingGenerationTransactionResult[];\n  deferredGenerationDirs: Set<string>;\n}\n\nexport interface IncomingEmbeddingGenerationApplyOptions {\n  root: SafeArchiveRoot;\n  incomingMap: ReadonlyMap<string, OfflineSyncFileState>;\n  incomingBuffers: ReadonlyMap<string, Buffer>;\n  baseMap: ReadonlyMap<string, OfflineSyncFileState>;\n  currentMap: ReadonlyMap<string, OfflineSyncFileState>;\n  deferredPaths: ReadonlySet<string>;\n  omittedGenerationDirs: ReadonlySet<string>;\n  deletionMtimeByPath?: ReadonlyMap<string, number>;\n  io: EmbeddingGenerationTransactionIo;\n  /** True when the caller supplied ANY custom storage IO. */\n  customIoPresent: boolean;\n  now: number;\n}\n\n/**\n * Snapshot-side generation routing, extracted from applyOfflineSyncSnapshot\n * for issue #3150 (the changeset path needed the same machinery and the\n * offline-sync.ts line ratchet had no headroom). Incoming generations replace\n * as ONE unit through the shared locked transaction. Behavior-preserving —\n * the #3148 regression suites own this contract.\n */\nexport async function applyIncomingEmbeddingGenerations(\n  options: IncomingEmbeddingGenerationApplyOptions,\n): Promise<IncomingEmbeddingGenerationApply> {\n  const incomingGenerations = detectIncomingEmbeddingGenerations(options.incomingMap.keys());\n  const generationDirs = new Set<string>([\n    ...incomingGenerations.shardDirs,\n    ...incomingGenerations.legacyMarkerDirs,\n  ]);\n  const deferredGenerationDirs = new Set<string>();\n  for (const deferredPath of options.deferredPaths) {\n    const membership = embeddingGenerationMembership(deferredPath);\n    if (membership) deferredGenerationDirs.add(membership.shardDir);\n  }\n  const transactionResults: EmbeddingGenerationTransactionResult[] = [];\n  // Included and omitted cannot describe the same generation.\n  for (const shardDir of generationDirs) {\n    if (options.omittedGenerationDirs.has(shardDir)) {\n      throw new EmbeddingIndexStorageError(\n        `offline sync snapshot both includes and omits embedding generation ${shardDir}; refusing to apply`,\n      );\n    }\n  }\n  // Fail closed BEFORE any publication: custom storage IO (encrypted or\n  // otherwise) without the staging pair would make the generation transaction\n  // fall back to unencrypted raw writes — a plaintext downgrade of the staged\n  // generation. Callers must wire both staging hooks (the CLI does).\n  if (\n    generationDirs.size > 0 &&\n    options.customIoPresent &&\n    !(options.io.writeStagingFile && options.io.readStagingFile)\n  ) {\n    throw new EmbeddingIndexStorageError(\n      \"refusing to replace embedding generation: custom storage IO requires both writeStagingFile and readStagingFile hooks; unencrypted raw staging would plaintext-downgrade the index\",\n    );\n  }\n  for (const shardDir of generationDirs) {\n    if (deferredGenerationDirs.has(shardDir)) continue;\n    if (\n      incomingGenerations.legacyMarkerDirs.has(shardDir) &&\n      !incomingGenerations.shardDirs.has(shardDir)\n    ) {\n      // Cross-layout: an incoming legacy marker replaces a local sharded\n      // generation as a whole (codex round 4). When shards are ALSO\n      // incoming, the sharded set is the generation and the marker is\n      // written as an inert artifact by the per-file loop below.\n      const markerRel = [...options.incomingMap.keys()].find(\n        (relPath) => embeddingMarkerDirOf(relPath) === shardDir.slice(0, -`/${EMBEDDING_SHARD_DIR_BASENAME}`.length),\n      );\n      if (!markerRel) continue;\n      transactionResults.push(await applyEmbeddingGenerationTransaction({\n        root: options.root,\n        shardDirRel: shardDir,\n        incomingShardPaths: [],\n        incomingMarker: {\n          path: markerRel,\n          sha256: options.incomingMap.get(markerRel)!.sha256,\n          buffer: options.incomingBuffers.get(markerRel) ?? null,\n        },\n        incomingMarkerPresent: false,\n        incomingShardStates: new Map(),\n        incomingBuffers: options.incomingBuffers,\n        baseStates: options.baseMap,\n        io: options.io,\n        now: options.now,\n      }));\n      continue;\n    }\n    transactionResults.push(await applyEmbeddingGenerationTransaction({\n      root: options.root,\n      shardDirRel: shardDir,\n      incomingShardPaths: [...options.incomingMap.keys()]\n        .filter((relPath) => embeddingShardDirOf(relPath) === shardDir)\n        .sort(),\n      incomingMarker: null,\n      incomingMarkerPresent: Boolean(\n        incomingGenerations.legacyMarkerDirs.has(shardDir),\n      ),\n      incomingShardStates: new Map(\n        [...options.incomingMap.values()]\n          .filter((state) => embeddingShardDirOf(state.path) === shardDir)\n          .map((state) => [state.path, state]),\n      ),\n      incomingBuffers: options.incomingBuffers,\n      baseStates: options.baseMap,\n      io: options.io,\n      now: options.now,\n    }));\n  }\n  // Whole-generation removal (codex round 6 P1): when the remote deleted a\n  // previously shared sharded index, the deletion revisions cover EVERY\n  // local member. Remove that generation as ONE atomic swap instead of\n  // deleting shards one-by-one, so a crash or delete failure can never\n  // expose a partial same-identity generation serving missing memories.\n  const localGenerationDirs = new Set<string>();\n  for (const relPath of options.currentMap.keys()) {\n    const membership = embeddingGenerationMembership(relPath);\n    if (membership?.kind === \"shard\") localGenerationDirs.add(membership.shardDir);\n  }\n  for (const shardDir of localGenerationDirs) {\n    if (\n      generationDirs.has(shardDir) ||\n      deferredGenerationDirs.has(shardDir) ||\n      options.omittedGenerationDirs.has(shardDir)\n    ) {\n      continue;\n    }\n    const localMembers = [...options.currentMap.keys()].filter(\n      (relPath) => embeddingGenerationMembership(relPath)?.shardDir === shardDir,\n    );\n    if (localMembers.length === 0) continue;\n    // Tombstone or shared-base absence authorizes whole-generation removal.\n    const baseMembers = localMembers.filter((relPath) => options.baseMap.has(relPath));\n    // Tombstone evidence is satisfied by the members the REMOTE knew: the\n    // remote cannot tombstone local-only extras or an inert legacy marker,\n    // and the removal sweeps those once the remote deletion is established.\n    // Non-empty same-generation tombstones establish remote absence on\n    // their own: they may name shards already absent locally (removed in an\n    // earlier round), so the set is NOT required to intersect localMembers\n    // (codex round 6, XiOb).\n    const tombstonedMembers =\n      options.deletionMtimeByPath === undefined\n        ? []\n        : [...options.deletionMtimeByPath.keys()].filter(\n            (relPath) => embeddingGenerationMembership(relPath)?.shardDir === shardDir,\n          );\n    const tombstoneCovered = tombstonedMembers.length > 0;\n    const baseEvidenced =\n      baseMembers.length > 0 && baseMembers.every((relPath) => !options.incomingMap.has(relPath));\n    if (!tombstoneCovered && !baseEvidenced) continue;\n    transactionResults.push(await applyEmbeddingGenerationRemoval({\n      root: options.root,\n      shardDirRel: shardDir,\n      io: { deleteFile: options.io.deleteFile, readFile: options.io.readFile },\n      deletionMtimeByPath: options.deletionMtimeByPath,\n      baseStates: options.baseMap,\n      now: options.now,\n    }));\n  }\n  return { transactionResults, deferredGenerationDirs };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,SAAS,YAAY,mBAAmB;AACxC,SAAS,OAAO,OAAO,UAAU,SAAS,IAAI,iBAAiB;AAC/D,OAAO,UAAU;AA6BjB,IAAM,4BAA4B;AAC3B,IAAM,+BAA+B;AAM5C,SAAS,wBAAwB,OAAgC;AAC/D,MAAI,MAAM,CAAC,MAAM,QAAS,QAAO;AACjC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,SAAS;AAC1E,WAAO,cAAc,MAAM,CAAC,CAAC;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,oBAAoB,SAAgC;AAClE,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI,CAAC,6BAA6B,KAAK,MAAM,MAAM,SAAS,CAAC,KAAK,EAAE,EAAG,QAAO;AAC9E,MAAI,MAAM,MAAM,SAAS,CAAC,MAAM,6BAA8B,QAAO;AACrE,MAAI,wBAAwB,KAAK,MAAM,KAAM,QAAO;AACpD,SAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACpC;AAOO,SAAS,6BAA6B,SAA0B;AACrE,QAAM,aAAa,8BAA8B,GAAG,OAAO,kBAAkB;AAC7E,SAAO,eAAe,QAAQ,WAAW,aAAa;AACxD;AAGO,SAAS,qBAAqB,SAAgC;AACnE,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,OAAK,MAAM,MAAM,SAAS,CAAC,KAAK,QAAQ,0BAA2B,QAAO;AAC1E,MAAI,wBAAwB,KAAK,MAAM,KAAM,QAAO;AACpD,SAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACpC;AAOO,SAAS,8BAA8B,SAAwE;AACpH,QAAM,WAAW,oBAAoB,OAAO;AAC5C,MAAI,SAAU,QAAO,EAAE,MAAM,SAAS,SAAS;AAC/C,QAAM,YAAY,qBAAqB,OAAO;AAC9C,MAAI,UAAW,QAAO,EAAE,MAAM,UAAU,UAAU,GAAG,SAAS,IAAI,4BAA4B,GAAG;AACjG,SAAO;AACT;AAUO,SAAS,mCAAmC,eAA+D;AAChH,QAAM,YAAY,oBAAI,IAAY;AAClC,QAAM,mBAAmB,oBAAI,IAAY;AACzC,aAAW,WAAW,eAAe;AACnC,UAAM,aAAa,8BAA8B,OAAO;AACxD,QAAI,CAAC,WAAY;AACjB,QAAI,WAAW,SAAS,QAAS,WAAU,IAAI,WAAW,QAAQ;AAAA,QAC7D,kBAAiB,IAAI,WAAW,QAAQ;AAAA,EAC/C;AACA,SAAO,EAAE,WAAW,iBAAiB;AACvC;AAEA,SAAS,aAAa,aAAqB,YAA4B;AACrE,SAAO,GAAG,WAAW,UAAU,OAAO,UAAU,EAAE,SAAS,GAAG,GAAG,CAAC;AACpE;AAEA,SAAS,yBACP,MACQ;AACR,MAAI,KAAK,YAAY,aAAc,QAAO,KAAK;AAC/C,MAAI,KAAK,YAAY,UAAW,QAAO;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AACzD;AAEA,eAAe,WAAW,SAAmC;AAC3D,MAAI;AACF,UAAM,MAAM,OAAO;AACnB,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACF;AAwFA,eAAe,uBACb,IACA,MACA,SACA,gBACA,UACiB;AACjB,MAAI,SAAU,QAAO;AACrB,QAAM,WAAW,MAAM,yBAAyB,MAAM,OAAO;AAC7D,QAAM,QAAQ,GAAG,WACb,MAAM,GAAG,SAAS,EAAE,MAAM,KAAK,KAAK,MAAM,SAAS,SAAS,CAAC,IAC7D,MAAM,SAAS,QAAQ;AAC3B,MAAI,UAAU,KAAK,MAAM,gBAAgB;AACvC,UAAM,IAAI;AAAA,MACR,iDAAiD,OAAO;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,wBACP,MACA,aACiC;AACjC,SAAO,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,MAAM,8BAA8B,OAAO,GAAG,aAAa,WAAW,CAAC;AACxH;AAEA,eAAe,sBACb,IACA,MACA,WACA,WACA,aACA,aAC8B;AAC9B,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,UAAU,OAAO,SAAiB,aACtC,UAAU,GAAG,WAAW,MAAM,GAAG,SAAS,EAAE,MAAM,KAAK,KAAK,MAAM,SAAS,SAAS,CAAC,IAAI,MAAM,SAAS,QAAQ,CAAC;AACnH,MAAI,MAAM,WAAW,SAAS,EAAG,QAAO,IAAI,WAAW,MAAM,QAAQ,WAAW,SAAS,CAAC;AAC1F,QAAM,QAAQ,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAA+B;AAC7E,QAAI,IAAI,SAAS,SAAU,QAAO,CAAC;AACnC,UAAM;AAAA,EACR,CAAC;AACD,aAAW,QAAQ,MAAM,OAAO,CAAC,cAAc,6BAA6B,KAAK,SAAS,CAAC,EAAE,KAAK,GAAG;AACnG,UAAM,UAAU,GAAG,WAAW,IAAI,IAAI;AACtC,WAAO,IAAI,SAAS,MAAM,QAAQ,SAAS,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC;AAAA,EAC1E;AACA,SAAO;AACT;AAGA,SAAS,yBAAyB,OAAgF;AAChH,QAAM,SAAS,MAAM,mBAAmB,IAAI,CAAC,aAAa;AAAA,IACxD,MAAM;AAAA,IACN,QAAQ,MAAM,oBAAoB,IAAI,OAAO,GAAG,UAAU,UAAU,MAAM,gBAAgB,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC;AAAA,EAC3H,EAAE;AACF,MAAI,MAAM,gBAAgB;AACxB,WAAO,KAAK,EAAE,MAAM,MAAM,eAAe,MAAM,QAAQ,MAAM,eAAe,OAAO,CAAC;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,oCACpB,OAC+C;AAC/C,QAAM,EAAE,MAAM,aAAa,GAAG,IAAI;AAClC,QAAM,cAAc,YAAY,MAAM,GAAG,CAAC,IAAI,4BAA4B,GAAG,MAAM;AACnF,QAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,SAAO,MAAM,4BAA4B,aAAa,OAAO,YAAY;AACvE,UAAM,WAAW,4BAA4B,WAAW;AACxD,UAAM,QAAkC,MAAM,kCAAkC,UAAU,OAAO;AACjG,UAAM,YAAY,GAAG,WAAW,IAAI,yBAAyB;AAC7D,UAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,UAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,UAAM,QAAQ,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,yBAAyB,MAAM,GAAG,WAAW,iCAAiC;AAAA,IACtF;AAQA,UAAM,YAAY,GAAG,WAAW;AAChC,UAAM,yBAAyB,MAAM,SAAS;AAC9C,QAAI,MAAM,MAAM,qBAAqB,KAAK,GAAG;AAC3C,YAAM,yBAAyB,MAAM,WAAW;AAAA,IAClD;AAWA,UAAM,oBAAoB,MAAM,qBAAqB,oBAAI,IAAY;AACrE,UAAM,aAAa,wBAAwB,MAAM,YAAY,WAAW;AACxE,QAAI,WAAW,OAAO,GAAG;AACvB,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,WAAW,WAAW,aAAa,WAAW;AACxG,YAAM,UAAU,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AACnG,YAAM,YAAY,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,MAAM,SAAS,OAAO,EAAE;AACzF,YAAM,YAAY,qCAAqC;AAAA,QACrD,eAAe,yBAAyB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,QAK7C,WAAW,QAAQ,OAAO,CAAC,WAAW,CAAC,kBAAkB,IAAI,OAAO,IAAI,KAAK,YAAY,IAAI,OAAO,IAAI,CAAC;AAAA,QACzG,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,qBAAqB,IAAI,IAAI,MAAM,kBAAkB;AAC3D,YAAM,0BACJ,UAAU,KAAK,CAAC,WACd,CAAC,WAAW,IAAI,OAAO,IAAI,KAC3B,CAAC,kBAAkB,IAAI,OAAO,IAAI;AAAA;AAAA;AAAA,MAIlC,CAAC,mBAAmB,IAAI,OAAO,IAAI,CAAC,KACtC,QAAQ,KAAK,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,IAAI,KAAK,CAAC,kBAAkB,IAAI,OAAO,IAAI,CAAC;AAC/F,UAAI,UAAU,SAAS,KAAK,yBAAyB;AACnD,cAAM,UAAU,IAAI,IAAY,MAAM,kBAAkB;AACxD,YAAI,MAAM,eAAgB,SAAQ,IAAI,MAAM,eAAe,IAAI;AAC/D,YAAI,MAAM,sBAAuB,SAAQ,IAAI,SAAS;AACtD,mBAAW,WAAW,YAAY,KAAK,EAAG,SAAQ,IAAI,OAAO;AAC7D,YAAI;AAAA,UACF,wBAAwB,WAAW,0EAA0E,UAAU,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,0CAA0C;AAAA,QACvM;AACA,eAAO;AAAA,UACL;AAAA,UACA,UAAU;AAAA,UACV,SAAS;AAAA,UACT,eAAe,oBAAI,IAAkC;AAAA,UACrD,cAAc,oBAAI,IAAY;AAAA,UAC9B,cAAc;AAAA,UACd,yBAAyB;AAAA,QAC3B;AAAA,MACF;AAAA,IACF,WAAW,MAAM,kBAAkB;AACjC,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,WAAW,WAAW,aAAa,WAAW;AACxG,UAAI,YAAY,OAAO,GAAG;AACxB,cAAM,cAAc,yBAAyB,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC7G,cAAM,YAAY,CAAC,GAAG,WAAW,EAC9B,IAAI,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,MAAM,SAAS,OAAO,EAAE,EACtD,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC5D,cAAM,YACJ,UAAU,WAAW,YAAY,UACjC,UAAU,MAAM,CAAC,QAAQ,UAAU,OAAO,SAAS,YAAY,KAAK,GAAG,QAAQ,OAAO,WAAW,YAAY,KAAK,GAAG,MAAM;AAC7H,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,IAAI,IAAY,MAAM,kBAAkB;AACxD,cAAI,MAAM,eAAgB,SAAQ,IAAI,MAAM,eAAe,IAAI;AAC/D,cAAI,MAAM,sBAAuB,SAAQ,IAAI,SAAS;AACtD,qBAAW,WAAW,YAAY,KAAK,EAAG,SAAQ,IAAI,OAAO;AAC7D,cAAI;AAAA,YACF,wBAAwB,WAAW;AAAA,UACrC;AACA,iBAAO;AAAA,YACL;AAAA,YACA,UAAU;AAAA,YACV,SAAS;AAAA,YACT,eAAe,oBAAI,IAAkC;AAAA,YACrD,cAAc,oBAAI,IAAY;AAAA,YAC9B,cAAc;AAAA,YACd,yBAAyB;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,oBAAI,IAAoB;AAC1C,QAAI,WAA0C;AAKhD,QAAI,MAAM,gBAAgB;AACxB,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,MAAM,eAAe;AAAA,QACrB,MAAM,eAAe;AAAA,QACrB,MAAM,eAAe;AAAA,MACvB;AACA,YAAM,OAAO,4BAA4B,aAAa,SAAS,OAAO,CAAC;AACvE,UAAI,KAAK,YAAY,MAAM;AACzB,cAAM,IAAI;AAAA,UACR,gDAAgD,SAAS,KAAK,yBAAyB,IAAI,CAAC;AAAA,QAC9F;AAAA,MACF;AACA,iBAAW,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAClE,YAAM,SAAS,qBAAqB,KAAK,IAAI;AAC7C,iBAAW,CAAC,YAAY,OAAO,KAAK,QAAQ;AAC1C,YAAI,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG;AACvC,kBAAU;AAAA,UACR,aAAa,aAAa,UAAU;AAAA,UACpC,OAAO,KAAK,wBAAwB,KAAK,MAAM,YAAY,OAAO,GAAG,OAAO;AAAA,QAC9E;AAAA,MACF;AAAA,IACF,OAAO;AACL,iBAAW,WAAW,MAAM,oBAAoB;AAI9C,cAAM,QAAQ,MAAM,oBAAoB,IAAI,OAAO;AACnD,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,UAAU;AAAA,UACjB,MAAM,gBAAgB,IAAI,OAAO;AAAA,QACnC;AACA,cAAM,OAAO,4BAA4B,OAAO,SAAS,OAAO,CAAC;AACjE,YAAI,KAAK,YAAY,MAAM;AACzB,gBAAM,IAAI;AAAA,YACR,2CAA2C,OAAO,KAAK,yBAAyB,IAAI,CAAC;AAAA,UACvF;AAAA,QACF;AACA,gCAAwB,QAAQ,MAAM,GAAG,EAAE,IAAI,KAAK,IAAI,KAAK,IAAI;AACjE,cAAM,gBAAgB,EAAE,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,KAAK,MAAM;AAC7E,YAAI,CAAC,SAAU,YAAW;AAC1B,YAAI,SAAS,aAAa,cAAc,YAAY,SAAS,UAAU,cAAc,OAAO;AAC1F,gBAAM,IAAI;AAAA,YACR,kEAAkE,WAAW,KAAK,OAAO,OAAO,cAAc,QAAQ,IAAI,cAAc,KAAK,0BAA0B,SAAS,QAAQ,IAAI,SAAS,KAAK;AAAA,UAC5M;AAAA,QACF;AACA,kBAAU,IAAI,SAAS,MAAM;AAAA,MAC/B;AACA,UAAI,UAAU,SAAS,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,uCAAuC,WAAW;AAAA,QACpD;AAAA,MACF;AAAA,IACF;AAEE,UAAM,aAAa,GAAG,WAAW,gCAAgC,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC3H,UAAM,aAAa,MAAM,yBAAyB,MAAM,UAAU;AAClE,QAAI;AACF,YAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAM3C,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,cAAM,YAAY,GAAG,UAAU,IAAI,KAAK,SAAS,OAAO,CAAC;AACzD,cAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,cAAM,WAAW,MAAM,yBAAyB,MAAM,OAAO;AAC7D,YAAI,GAAG,kBAAkB;AACvB,gBAAM,GAAG,iBAAiB;AAAA,YACxB,MAAM,KAAK;AAAA,YACX,MAAM;AAAA,YACN,UAAU;AAAA,YACV,SAAS;AAAA,YACT,kBAAkB;AAAA,UACpB,CAAC;AAAA,QACH,OAAO;AACL,gBAAM,UAAU,WAAW,QAAQ,EAAE,MAAM,IAAM,CAAC;AAAA,QACpD;AAAA,MACF;AAIA,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,cAAM,YAAY,GAAG,UAAU,IAAI,KAAK,SAAS,OAAO,CAAC;AACzD,cAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,cAAM,SAAS,GAAG,kBACd,MAAM,GAAG,gBAAgB;AAAA,UACvB,MAAM,KAAK;AAAA,UACX,MAAM;AAAA,UACN,UAAU;AAAA,UACV,kBAAkB,MAAM,yBAAyB,MAAM,OAAO;AAAA,QAChE,CAAC,IACD,MAAM,SAAS,SAAS;AAC5B,YAAI,CAAC,OAAO,OAAO,MAAM,GAAG;AAC1B,gBAAM,IAAI;AAAA,YACR,+BAA+B,SAAS;AAAA,UAC1C;AAAA,QACF;AAAA,MACF;AAKA,YAAM,kBACJ,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AACxC,YAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,cAAM;AAAA,MACR,CAAC,GAEA,OAAO,CAAC,SAAS,6BAA6B,KAAK,IAAI,CAAC,EACxD,IAAI,CAAC,SAAS,GAAG,WAAW,IAAI,IAAI,EAAE,EACtC,KAAK;AACR,YAAM,MAAM,yBAAyB,YAAY,KAAK;AAEtD,YAAM,gBAAgB,oBAAI,IAAkC;AAC5D,iBAAW,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC,sBAAc,IAAI,SAAS;AAAA,UACzB,MAAM;AAAA,UACN,QAAQ,UAAU,MAAM;AAAA,UACxB,OAAO,OAAO;AAAA,UACd,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AACA,YAAM,eAAe,IAAI,IAAY,eAAe,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AACxF,UAAI,UAAU,aAAa;AAC3B,UAAI,sBAAsB;AAC1B,UAAK,MAAM,WAAW,SAAS,KAAM,CAAC,MAAM,kBAAkB,CAAC,MAAM,uBAAuB;AAG1F,YAAI;AACF,cAAI,GAAG,WAAY,OAAM,GAAG,WAAW,EAAE,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,UAAU,CAAC;AAAA,cAC1F,OAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AACxC,uBAAa,IAAI,SAAS;AAC1B,qBAAW;AAAA,QACb,SAAS,KAAK;AACZ,gCAAsB;AACtB,cAAI,KAAK,wBAAwB,WAAW,4CAA4C,GAAG,EAAE;AAAA,QAC/F;AAAA,MACF;AAUA,UAAI,MAAM,wBAAwB,UAAa,GAAG,YAAY;AAC5D,YAAI,sBAA+B;AACnC,mBAAW,WAAW,cAAc;AAClC,cAAI;AACF,kBAAM,GAAG,WAAW;AAAA,cAClB,MAAM,KAAK;AAAA,cACX,MAAM;AAAA,cACN,UAAU,MAAM,yBAAyB,MAAM,OAAO;AAAA,cACtD,SAAS,MAAM,oBAAoB,IAAI,OAAO,KAAK,MAAM;AAAA,YAC3D,CAAC;AAAA,UACH,SAAS,KAAK;AACZ,oCAAwB;AACxB,gBAAI,KAAK,wBAAwB,WAAW,oCAAoC,OAAO,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,UAChJ;AAAA,QACF;AACA,YAAI,oBAAqB,OAAM;AAAA,MACjC;AACA,aAAO;AAAA,QACL;AAAA,QACA,UAAU,UAAU;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,oBAAI,IAAI,CAAC,GAAG,UAAU,KAAK,GAAG,GAAG,cAAc,GAAI,sBAAsB,CAAC,SAAS,IAAI,CAAC,CAAE,CAAC;AAAA,MAC3G;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,GAAG,YAAY,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAC5E,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAkCA,eAAsB,uCACpB,SACsC;AACtC,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,cAAwB,CAAC;AAC/B,QAAM,YAAY,CAAC,OAAO;AAC1B,MAAI,iBAA2B,CAAC;AAChC,MAAI;AACF,sBAAkB,MAAM,QAAQ,KAAK,KAAK,QAAQ,SAAS,YAAY,GAAG,EAAE,eAAe,KAAK,CAAC,GAC9F,OAAO,CAAC,UAAU,MAAM,YAAY,CAAC,EACrC,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EAC9B,QAAQ;AAAA,EAER;AACA,aAAW,MAAM,eAAgB,WAAU,KAAK,cAAc,EAAE,QAAQ;AACxE,QAAM,aAAa,QAAQ,sBACxB,CAAC,YACA,iCAAiC,OAAO,KACxC,QAAQ,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAEtE,aAAW,YAAY,WAAW;AAChC,UAAM,YAAY,GAAG,QAAQ,IAAI,yBAAyB;AAC1D,UAAM,cAAc,GAAG,QAAQ,IAAI,4BAA4B;AAC/D,UAAM,cAAc,KAAK,KAAK,QAAQ,SAAS,GAAG,YAAY,MAAM,GAAG,CAAC;AACxE,UAAM,aAAuB,CAAC;AAC9B,QAAI,MAAM,WAAW,KAAK,KAAK,QAAQ,SAAS,GAAG,UAAU,MAAM,GAAG,CAAC,CAAC,GAAG;AACzE,iBAAW,KAAK,SAAS;AAAA,IAC3B;AACA,QAAI,aAAuB,CAAC;AAC5B,QAAI;AACF,oBAAc,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC,GAC7D,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,6BAA6B,KAAK,MAAM,IAAI,CAAC,EACjF,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,IAC9D;AACA,eAAW,QAAQ,WAAY,YAAW,KAAK,GAAG,WAAW,IAAI,IAAI,EAAE;AAIvE,eAAW,cAAc,QAAQ,mBAAmB,CAAC,GAAG;AACtD,YAAM,aAAa,8BAA8B,UAAU;AAC3D,UAAI,YAAY,aAAa,eAAe,CAAC,WAAW,SAAS,UAAU,GAAG;AAC5E,mBAAW,KAAK,UAAU;AAAA,MAC5B;AAAA,IACF;AACA,QAAI,WAAW,WAAW,EAAG;AAE7B,UAAM,kBAA4B,CAAC;AACnC,eAAW,WAAW,YAAY;AAChC,UAAI,WAAW,WAAW,OAAO;AACjC,UAAI,CAAC,YAAY,QAAQ,aAAa;AACpC,mBAAW,MAAM,QAAQ,YAAY;AAAA,UACnC,MAAM,QAAQ;AAAA,UACd,MAAM;AAAA,UACN,UAAU,KAAK,KAAK,QAAQ,SAAS,GAAG,QAAQ,MAAM,GAAG,CAAC;AAAA,QAC5D,CAAC;AAAA,MACH;AACA,UAAI,SAAU,iBAAgB,KAAK,OAAO;AAAA,IAC5C;AACA,QAAI,gBAAgB,WAAW,EAAG;AAClC,gBAAY,KAAK,WAAW;AAC5B,iBAAa,IAAI,WAAW;AAC5B,eAAW,WAAW,WAAY,cAAa,IAAI,OAAO;AAAA,EAC5D;AACA,SAAO,EAAE,cAAc,YAAY;AACrC;AAGA,eAAsB,uCACpB,SAAiB,aAAqB,aACtC,mBAAiD,iBAClC;AACf,QAAM,UAAU,MAAM,uCAAuC,EAAE,SAAS,aAAa,mBAAmB,gBAAgB,CAAC;AACzH,MAAI,QAAQ,YAAY,SAAS,WAAW,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR,wBAAwB,WAAW;AAAA,IACrC;AAAA,EACF;AACF;AAGO,SAAS,mCAAmC,SAAiB,aAA2C;AAC7G,QAAM,aAAa,8BAA8B,OAAO;AACxD,SAAO,eAAe,QAAQ,YAAY,IAAI,WAAW,QAAQ;AACnE;AAuBA,eAAsB,oCAAoC,SAMhB;AACxC,QAAM,WAAW,MAAM,uCAAuC;AAAA,IAC5D,SAAS,QAAQ;AAAA,IACjB,oBAAoB,QAAQ;AAAA,IAC5B,aAAa,QAAQ;AAAA;AAAA;AAAA,IAGrB,iBAAiB,QAAQ,UAAU,IAAI,CAAC,aAAa,SAAS,IAAI;AAAA,IAClE,mBAAmB,CAAC,YAClB,iCAAiC,OAAO,KACxC,QAAQ,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAAA,EACtE,CAAC;AACD,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW;AAChD,QAAM,YAAY,QAAQ,UAAU,OAAO,CAAC,aAAa;AACvD,QAAI,iCAAiC,SAAS,IAAI,EAAG,QAAO;AAC5D,QAAI,QAAQ,oBAAoB,KAAK,CAAC,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,EAAG,QAAO;AAC7E,UAAM,aAAa,8BAA8B,SAAS,IAAI;AAC9D,QAAI,cAAc,YAAY,IAAI,WAAW,QAAQ,EAAG,QAAO;AAC/D,WAAO;AAAA,EACT,CAAC;AACD,SAAO,EAAE,aAAa,SAAS,aAAa,cAAc,SAAS,cAAc,UAAU;AAC7F;AAkBO,SAAS,0BAA0B,SAA0D;AAClG,SAAO;AAAA,IACL,UAAU,OAAO,cAAc,MAAM,QAAQ,oBAAoB,QAAQ,GAAG,SAAS,OAAO;AAAA,IAC5F,WAAW,CAAC,UAAU,UAAU,SAC9B,QAAQ;AAAA,MACN;AAAA,MACA,OAAO,KAAK,UAAU,OAAO;AAAA,MAC7B,MAAM,qBAAqB,SAAY,SAAY,EAAE,aAAa,KAAK,iBAAiB;AAAA,IAC1F;AAAA,EACJ;AACF;AA6BA,eAAsB,gCACpB,OAC+C;AAC/C,QAAM,EAAE,MAAM,aAAa,GAAG,IAAI;AAClC,QAAM,cAAc,YAAY,MAAM,GAAG,CAAE,IAAI,4BAA4B,GAAG,MAAO;AACrF,QAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,SAAO,MAAM,4BAA4B,aAAa,OAAO,YAAY;AACvE,UAAM,WAAW,4BAA4B,WAAW;AACxD,UAAM,QAAkC,MAAM,kCAAkC,UAAU,OAAO;AACjG,UAAM,YAAY,GAAG,WAAW,IAAI,yBAAyB;AAC7D,UAAM,cAAc,MAAM,yBAAyB,MAAM,WAAW;AACpE,UAAM,YAAY,MAAM,yBAAyB,MAAM,SAAS;AAChE,UAAM,QAAQ,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,MAAM,yBAAyB,MAAM,GAAG,WAAW,iCAAiC;AAAA,IACtF;AACA,UAAM,MAAM,qBAAqB,KAAK;AAOtC,UAAM,aAAa,wBAAwB,MAAM,YAAY,WAAW;AACxE,QAAI,WAAW,OAAO,GAAG;AACvB,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,WAAW,WAAW,aAAa,WAAW;AACxG,YAAM,UAAU,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,OAAO,EAAE;AACnG,YAAM,YAAY,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,MAAM,SAAS,OAAO,EAAE;AACzF,YAAM,mBACJ,UAAU,KAAK,CAAC,WAAW;AAGzB,cAAM,UAAU,WAAW,IAAI,OAAO,IAAI,GAAG;AAC7C,eAAO,YAAY,UAAa,YAAY,OAAO;AAAA,MACrD,CAAC,KAAK,QAAQ,KAAK,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC;AAC9D,UAAI,kBAAkB;AACpB,cAAMA,gBAAe,oBAAI,IAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC;AAC5D,YAAI;AAAA,UACF,gCAAgC,WAAW;AAAA,QAC7C;AACA,eAAO;AAAA,UACL;AAAA,UACA,UAAU;AAAA,UACV,SAAS;AAAA,UACT,eAAe,oBAAI,IAAkC;AAAA,UACrD,cAAAA;AAAA,UACA,cAAc,IAAI,IAAIA,aAAY;AAAA,UAClC,yBAAyB;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,QAAQ,WAAW,EAAE,MAAM,CAAC,QAAQ;AAChE,UAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,YAAM;AAAA,IACR,CAAC,GACE,OAAO,CAAC,SAAS,6BAA6B,KAAK,IAAI,CAAC,EACxD,IAAI,CAAC,SAAS,GAAG,WAAW,IAAI,IAAI,EAAE,EACtC,KAAK;AACR,UAAM,MAAM,0BAA0B,KAAK;AAC3C,UAAM,eAAe,IAAI,IAAI,cAAc;AAC3C,QAAI,UAAU,aAAa;AAC3B,UAAM,gBAAgB,MAAM,WAAW,SAAS;AAChD,QAAI,eAAe;AACjB,mBAAa,IAAI,SAAS;AAC1B,iBAAW;AAAA,IACb;AAQA,QAAI,aAAsB;AAC1B,eAAW,WAAW,cAAc;AAClC,YAAM,YAAY,YAAY,YAAY,YAAY,MAAM,yBAAyB,MAAM,OAAO;AAClG,YAAM,UAAU,MAAM,qBAAqB,IAAI,OAAO,KAAK,MAAM;AACjE,UAAI,GAAG,YAAY;AACjB,YAAI;AACF,gBAAM,GAAG,WAAW;AAAA,YAClB,MAAM,KAAK;AAAA,YACX,MAAM;AAAA,YACN,UAAU,MAAM,yBAAyB,MAAM,OAAO;AAAA,YACtD;AAAA,UACF,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,yBAAe;AACf,cAAI,KAAK,gEAAgE,OAAO,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,QACzI;AAAA,MACF,WAAW,YAAY,aAAa,eAAe;AACjD,cAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,MACrC;AAAA,IACF;AACA,QAAI,WAAY,OAAM;AACtB,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,eAAe,oBAAI,IAAI;AAAA,MACvB;AAAA,MACA,cAAc,IAAI,IAAI,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAGO,SAAS,qCAAqC,SAIxC;AACX,QAAM,OAAO,IAAI,IAAI,QAAQ,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACrE,QAAM,UAAU,IAAI,IAAI,QAAQ,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC3E,QAAM,iBAAiB,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,QAAM,aAAa,IAAI,IAAI,QAAQ,UAAU,IAAI,CAAC,MAAM,8BAA8B,EAAE,IAAI,GAAG,QAAQ,CAAC;AACxG,QAAM,iBAAiB,oBAAI,IAAY;AACvC,aAAW,WAAW,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,QAAQ,KAAK,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,GAAG;AAC5F,UAAM,aAAa,8BAA8B,OAAO;AAGxD,QAAI,CAAC,cAAc,CAAC,WAAW,IAAI,WAAW,QAAQ,EAAG;AACzD,UAAM,aAAa,QAAQ,IAAI,OAAO;AACtC,QAAI,eAAe,KAAK,IAAI,OAAO,KAAK,eAAe,eAAe,IAAI,OAAO,GAAG;AAClF,qBAAe,IAAI,WAAW,QAAQ;AAAA,IACxC;AAAA,EACF;AACA,MAAI,eAAe,SAAS,EAAG,QAAO,CAAC;AACvC,QAAM,WAAqB,CAAC;AAG5B,aAAW,WAAW,oBAAI,IAAI,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,QAAQ,KAAK,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,GAAG;AAC5F,UAAM,aAAa,8BAA8B,OAAO;AACxD,QAAI,cAAc,eAAe,IAAI,WAAW,QAAQ,EAAG,UAAS,KAAK,OAAO;AAAA,EAClF;AACA,SAAO,SAAS,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACjE;AAmCA,eAAsB,kCACpB,SAC2C;AAC3C,QAAM,sBAAsB,mCAAmC,QAAQ,YAAY,KAAK,CAAC;AACzF,QAAM,iBAAiB,oBAAI,IAAY;AAAA,IACrC,GAAG,oBAAoB;AAAA,IACvB,GAAG,oBAAoB;AAAA,EACzB,CAAC;AACD,QAAM,yBAAyB,oBAAI,IAAY;AAC/C,aAAW,gBAAgB,QAAQ,eAAe;AAChD,UAAM,aAAa,8BAA8B,YAAY;AAC7D,QAAI,WAAY,wBAAuB,IAAI,WAAW,QAAQ;AAAA,EAChE;AACA,QAAM,qBAA6D,CAAC;AAEpE,aAAW,YAAY,gBAAgB;AACrC,QAAI,QAAQ,sBAAsB,IAAI,QAAQ,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR,sEAAsE,QAAQ;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AAKA,MACE,eAAe,OAAO,KACtB,QAAQ,mBACR,EAAE,QAAQ,GAAG,oBAAoB,QAAQ,GAAG,kBAC5C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,aAAW,YAAY,gBAAgB;AACrC,QAAI,uBAAuB,IAAI,QAAQ,EAAG;AAC1C,QACE,oBAAoB,iBAAiB,IAAI,QAAQ,KACjD,CAAC,oBAAoB,UAAU,IAAI,QAAQ,GAC3C;AAKA,YAAM,YAAY,CAAC,GAAG,QAAQ,YAAY,KAAK,CAAC,EAAE;AAAA,QAChD,CAAC,YAAY,qBAAqB,OAAO,MAAM,SAAS,MAAM,GAAG,CAAC,IAAI,4BAA4B,GAAG,MAAM;AAAA,MAC7G;AACA,UAAI,CAAC,UAAW;AAChB,yBAAmB,KAAK,MAAM,oCAAoC;AAAA,QAChE,MAAM,QAAQ;AAAA,QACd,aAAa;AAAA,QACb,oBAAoB,CAAC;AAAA,QACrB,gBAAgB;AAAA,UACd,MAAM;AAAA,UACN,QAAQ,QAAQ,YAAY,IAAI,SAAS,EAAG;AAAA,UAC5C,QAAQ,QAAQ,gBAAgB,IAAI,SAAS,KAAK;AAAA,QACpD;AAAA,QACA,uBAAuB;AAAA,QACvB,qBAAqB,oBAAI,IAAI;AAAA,QAC7B,iBAAiB,QAAQ;AAAA,QACzB,YAAY,QAAQ;AAAA,QACpB,IAAI,QAAQ;AAAA,QACZ,KAAK,QAAQ;AAAA,MACf,CAAC,CAAC;AACF;AAAA,IACF;AACA,uBAAmB,KAAK,MAAM,oCAAoC;AAAA,MAChE,MAAM,QAAQ;AAAA,MACd,aAAa;AAAA,MACb,oBAAoB,CAAC,GAAG,QAAQ,YAAY,KAAK,CAAC,EAC/C,OAAO,CAAC,YAAY,oBAAoB,OAAO,MAAM,QAAQ,EAC7D,KAAK;AAAA,MACR,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,QACrB,oBAAoB,iBAAiB,IAAI,QAAQ;AAAA,MACnD;AAAA,MACA,qBAAqB,IAAI;AAAA,QACvB,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAC7B,OAAO,CAAC,UAAU,oBAAoB,MAAM,IAAI,MAAM,QAAQ,EAC9D,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,MACvC;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,YAAY,QAAQ;AAAA,MACpB,IAAI,QAAQ;AAAA,MACZ,KAAK,QAAQ;AAAA,IACf,CAAC,CAAC;AAAA,EACJ;AAMA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,aAAW,WAAW,QAAQ,WAAW,KAAK,GAAG;AAC/C,UAAM,aAAa,8BAA8B,OAAO;AACxD,QAAI,YAAY,SAAS,QAAS,qBAAoB,IAAI,WAAW,QAAQ;AAAA,EAC/E;AACA,aAAW,YAAY,qBAAqB;AAC1C,QACE,eAAe,IAAI,QAAQ,KAC3B,uBAAuB,IAAI,QAAQ,KACnC,QAAQ,sBAAsB,IAAI,QAAQ,GAC1C;AACA;AAAA,IACF;AACA,UAAM,eAAe,CAAC,GAAG,QAAQ,WAAW,KAAK,CAAC,EAAE;AAAA,MAClD,CAAC,YAAY,8BAA8B,OAAO,GAAG,aAAa;AAAA,IACpE;AACA,QAAI,aAAa,WAAW,EAAG;AAE/B,UAAM,cAAc,aAAa,OAAO,CAAC,YAAY,QAAQ,QAAQ,IAAI,OAAO,CAAC;AAQjF,UAAM,oBACJ,QAAQ,wBAAwB,SAC5B,CAAC,IACD,CAAC,GAAG,QAAQ,oBAAoB,KAAK,CAAC,EAAE;AAAA,MACtC,CAAC,YAAY,8BAA8B,OAAO,GAAG,aAAa;AAAA,IACpE;AACN,UAAM,mBAAmB,kBAAkB,SAAS;AACpD,UAAM,gBACJ,YAAY,SAAS,KAAK,YAAY,MAAM,CAAC,YAAY,CAAC,QAAQ,YAAY,IAAI,OAAO,CAAC;AAC5F,QAAI,CAAC,oBAAoB,CAAC,cAAe;AACzC,uBAAmB,KAAK,MAAM,gCAAgC;AAAA,MAC5D,MAAM,QAAQ;AAAA,MACd,aAAa;AAAA,MACb,IAAI,EAAE,YAAY,QAAQ,GAAG,YAAY,UAAU,QAAQ,GAAG,SAAS;AAAA,MACvE,qBAAqB,QAAQ;AAAA,MAC7B,YAAY,QAAQ;AAAA,MACpB,KAAK,QAAQ;AAAA,IACf,CAAC,CAAC;AAAA,EACJ;AACA,SAAO,EAAE,oBAAoB,uBAAuB;AACtD;","names":["removedPaths"]}

package/dist/{chunk-GZDTVYK2.js → chunk-AZIOEOK4.js}

@@ -1,6 +1,6 @@
 import {
   resolveCorpusNamespaceRoots
-} from "./chunk-5MNUBT7T.js";
+} from "./chunk-DO4C4AXD.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-IG747LRN.js";
@@ -200,4 +200,4 @@ async function readAggregateExtractionWatermark(options) {
 export {
   readAggregateExtractionWatermark
 };
-//# sourceMappingURL=chunk-GZDTVYK2.js.map
+//# sourceMappingURL=chunk-AZIOEOK4.js.map

package/dist/{chunk-VDX2J7OX.js → chunk-BUKK5SWA.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-WEHSQBFR.js";
 import {
   encryptCapsuleFile
-} from "./chunk-DQEMWVMT.js";
+} from "./chunk-UVYI6VIX.js";
 import {
   CAPSULE_SCHEMA_VERSION,
   EXPORT_FORMAT
@@ -261,4 +261,4 @@ export {
   exportCapsule,
   isValidCapsuleSince
 };
-//# sourceMappingURL=chunk-VDX2J7OX.js.map
+//# sourceMappingURL=chunk-BUKK5SWA.js.map

package/dist/{chunk-5X4MXNEU.js → chunk-C6HPNPNK.js}

@@ -2,11 +2,11 @@ import {
   OFFLINE_SYNC_SNAPSHOT_FORMAT,
   filterOfflineSyncDeletionRevisions,
   iterateOfflineSyncSnapshotFileRecords
-} from "./chunk-OCFXVDBZ.js";
+} from "./chunk-IVEHY2VT.js";
 import {
   computeOmittedEmbeddingGenerationPaths,
   embeddingGenerationMembership
-} from "./chunk-K6T33R4Q.js";
+} from "./chunk-AXGJMDBS.js";
 import {
   matchesOfflineSyncDefaultExclude
 } from "./chunk-4NSLQ7EU.js";
@@ -61,4 +61,4 @@ async function buildEmbeddingAwareSnapshotStream(options) {
 export {
   buildEmbeddingAwareSnapshotStream
 };
-//# sourceMappingURL=chunk-5X4MXNEU.js.map
+//# sourceMappingURL=chunk-C6HPNPNK.js.map

package/dist/{chunk-QB57WIS6.js → chunk-CALBQ2NG.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-MPC7TYTZ.js";
 import {
   importCapsule
-} from "./chunk-VVX5PZFS.js";
+} from "./chunk-H36X4NRH.js";
 import {
   isSharedContextWriteInputError
 } from "./chunk-IFBSZGW3.js";
@@ -33,15 +33,15 @@ import {
   resolveCodegraphProjectId,
   serializeDecisionRecord
 } from "./chunk-EQUD7FP4.js";
+import {
+  WriteQuarantineStore
+} from "./chunk-PJSK6OJM.js";
 import {
   WHO_KNOWS_DEFAULT_LIMIT,
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-6UQFJULG.js";
-import {
-  WriteQuarantineStore
-} from "./chunk-PJSK6OJM.js";
+} from "./chunk-SZG4WFAG.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -69,6 +69,10 @@ import {
 import {
   runRecallWhy
 } from "./chunk-RDJ6C7NZ.js";
+import {
+  DEFAULT_TRAVERSE_LIMIT,
+  selectTraverseNeighbors
+} from "./chunk-YE4JBZO5.js";
 import {
   assertIdInNavigationWindow
 } from "./chunk-5KVT6G5U.js";
@@ -78,13 +82,12 @@ import {
 import {
   planDisclosureStep
 } from "./chunk-JLPNONPH.js";
-import {
-  DEFAULT_TRAVERSE_LIMIT,
-  selectTraverseNeighbors
-} from "./chunk-YE4JBZO5.js";
 import {
   parseNavigateLinkType
 } from "./chunk-7O5EW7KX.js";
+import {
+  decideDisclosureEscalation
+} from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
 } from "./chunk-KN6CIN7I.js";
@@ -96,14 +99,11 @@ import {
   takeNavigateBudget
 } from "./chunk-VYDGHJIN.js";
 import {
-  decideDisclosureEscalation
-} from "./chunk-H7XKCNR6.js";
+  readAggregateExtractionWatermark
+} from "./chunk-AZIOEOK4.js";
 import {
   buildEmbeddingAwareSnapshotStream
-} from "./chunk-5X4MXNEU.js";
-import {
-  readAggregateExtractionWatermark
-} from "./chunk-GZDTVYK2.js";
+} from "./chunk-C6HPNPNK.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-E6UNM67F.js";
@@ -130,7 +130,7 @@ import {
 } from "./chunk-HWLIMQE2.js";
 import {
   readProjectedHarmonicGraph
-} from "./chunk-AEU4EQGV.js";
+} from "./chunk-7QE46QXI.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -182,11 +182,11 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-AWG3TIAY.js";
+} from "./chunk-NMZVDRVP.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-5MNUBT7T.js";
+} from "./chunk-DO4C4AXD.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
@@ -197,7 +197,7 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-JVPWRNHA.js";
+} from "./chunk-NOL7SEWN.js";
 import {
   ExtractionDeadlineError
 } from "./chunk-BUQKSQXL.js";
@@ -244,10 +244,10 @@ import {
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-STEOT4DI.js";
+} from "./chunk-4HUCP4R4.js";
 import {
   namespaceCollectionName
-} from "./chunk-LV5H6FTN.js";
+} from "./chunk-RJLV4BKR.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -287,7 +287,7 @@ import {
 } from "./chunk-SYOIVK7K.js";
 import {
   splitCanonicalWriteRequest
-} from "./chunk-FKD656D2.js";
+} from "./chunk-64ZUALXK.js";
 import {
   applyBriefingLocationContext,
   daySummaryAutoOptions
@@ -309,16 +309,16 @@ import {
 } from "./chunk-PO7NXNGC.js";
 import {
   reapplyCategoryCoercion
-} from "./chunk-LW3HKRL7.js";
+} from "./chunk-3QKO4QN7.js";
 import {
   exportCapsule
-} from "./chunk-VDX2J7OX.js";
+} from "./chunk-BUKK5SWA.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-C6U57KG4.js";
+} from "./chunk-RMDGAAZF.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-UP75KL3L.js";
@@ -363,7 +363,7 @@ import {
   buildOfflineSyncSnapshotFromBase,
   normalizeOfflineSyncChangeset,
   readOfflineSyncFileContentChunk
-} from "./chunk-OCFXVDBZ.js";
+} from "./chunk-IVEHY2VT.js";
 import {
   compileOfflineSyncExcludeGlobs
 } from "./chunk-4NSLQ7EU.js";
@@ -3776,6 +3776,14 @@ async function applySupportPassportOfflineSyncChangeset(storage, options) {
       guard.assertContentAllowed(target.path, target.content);
       await storage.writeOfflineSyncFile(target.filePath, target.content);
     },
+    // Secure staging for embedding-generation replacement (#3150): staged
+    // ciphertext binds the FINAL published path, matching the snapshot apply.
+    writeStagingFile: async ({ filePath, content, finalAadFilePath }) => storage.writeOfflineSyncStagingFile(
+      filePath,
+      content,
+      finalAadFilePath === void 0 ? void 0 : { aadFilePath: finalAadFilePath }
+    ),
+    readStagingFile: async ({ filePath, finalAadFilePath }) => storage.readOfflineSyncFile(filePath, finalAadFilePath === void 0 ? void 0 : { aadFilePath: finalAadFilePath }),
     deleteFile: async (target) => {
       await guard.assertTargetAllowed(target);
       await storage.deleteOfflineSyncFile(target.filePath, target.mtimeMs ?? null);
@@ -18540,4 +18548,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-QB57WIS6.js.map
+//# sourceMappingURL=chunk-CALBQ2NG.js.map