@remnic/core 9.69.97 → 9.69.99

package/dist/support-passport/index.js

@@ -4,7 +4,7 @@ import {
   SUPPORT_PASSPORT_MODEL_RESULT_PATH,
   SupportPassportModelBridge,
   parseSupportPassportModelJob
-} from "../chunk-KYOZ5E6V.js";
+} from "../chunk-UEU5IURP.js";
 import {
   DEFAULT_SUPPORT_PASSPORT_CONFIG,
   parseSupportPassportConfig
@@ -14,8 +14,8 @@ import {
   buildSupportPassportPublicRequestHandler,
   composeSupportPassportExternalRequestHandlers,
   normalizeSupportPassportNetworkAddress
-} from "../chunk-VOZNBQNL.js";
-import "../chunk-SMLKHXPF.js";
+} from "../chunk-NHFWYPXN.js";
+import "../chunk-HGG63H3A.js";
 import {
   SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS,
   SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES,
@@ -56,7 +56,7 @@ import {
   notifySupportPassportCommitted,
   resolveSupportPassportModelRoutePlan,
   syncDirectoryForDurability
-} from "../chunk-GXETU7AE.js";
+} from "../chunk-NI5MWLM3.js";
 import "../chunk-W4F3C7N7.js";
 import "../chunk-MPC7TYTZ.js";
 import "../chunk-ZHXSOMYH.js";
@@ -88,7 +88,7 @@ import "../chunk-32HO62I4.js";
 import "../chunk-SOBJ6NEY.js";
 import "../chunk-QPWUG2S3.js";
 import "../chunk-R36IBI2M.js";
-import "../chunk-C6HPNPNK.js";
+import "../chunk-53X6CL3A.js";
 import "../chunk-E6UNM67F.js";
 import "../chunk-6WHJ2EAB.js";
 import "../chunk-AQEJKOKI.js";
@@ -227,13 +227,13 @@ import "../chunk-Z7L72ZHL.js";
 import "../chunk-4O4TKIXQ.js";
 import "../chunk-RMMA44HE.js";
 import "../chunk-SYOIVK7K.js";
-import "../chunk-PH2V7EXZ.js";
+import "../chunk-TK7G5ABN.js";
 import "../chunk-MY7B3HYC.js";
 import "../chunk-353C5UNV.js";
 import "../chunk-5AYUHSAU.js";
 import "../chunk-BT7NVCML.js";
 import "../chunk-PO7NXNGC.js";
-import "../chunk-3BTHXB7Z.js";
+import "../chunk-JWG43U5K.js";
 import "../chunk-KQAFEZQX.js";
 import "../chunk-WEHSQBFR.js";
 import "../chunk-X7Y7WX73.js";
@@ -244,7 +244,7 @@ import "../chunk-SOAU2OE2.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";
 import "../chunk-FP2373TW.js";
-import "../chunk-AF5PW35O.js";
+import "../chunk-XK6GP7QO.js";
 import "../chunk-N7QV3CMX.js";
 import "../chunk-PAAJWQH5.js";
 import "../chunk-2JRB3Z5N.js";
@@ -262,13 +262,13 @@ import "../chunk-C7HJ3NEI.js";
 import "../chunk-N4PYB235.js";
 import "../chunk-AW4QUFQF.js";
 import "../chunk-5FVVY2EB.js";
-import "../chunk-IVEHY2VT.js";
+import "../chunk-KJKTDMAD.js";
 import "../chunk-UI3NYK34.js";
-import "../chunk-ETUZFFPU.js";
-import "../chunk-MSAI3Q7D.js";
-import "../chunk-AXGJMDBS.js";
+import "../chunk-3E6DGSGZ.js";
+import "../chunk-3QH4NT72.js";
+import "../chunk-KO4X4WRJ.js";
 import "../chunk-TYT4TEQV.js";
-import "../chunk-4NSLQ7EU.js";
+import "../chunk-ANPRNTPT.js";
 import "../chunk-EFHNFTWB.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-75PT4N7Q.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.69.97",
+  "version": "9.69.99",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3327,7 +3327,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.69.97"
+    "@remnic/coding-graph": "^9.69.99"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/offline-sync-exclude-globs.ts

@@ -104,11 +104,11 @@ export function globToRegExp(glob: string): RegExp {
         // (Cursor review on PR #1793: trailing `scratch/**` must match
         // nested `scratch/a/b.md`, matching the offline-mode guide.)
         if (glob[i + 2] === "/") {
-          source += "(?:.*/)?";
+          source += "(?:[\\s\\S]*/)?";
           i += 2;
           continue;
         }
-        source += ".*";
+        source += "[\\s\\S]*";
         i += 1;
         continue;
       }
@@ -128,6 +128,7 @@ export function globToRegExp(glob: string): RegExp {
   return new RegExp(`^${source}$`);
 }
 
+/** Match relative POSIX paths: `*` stays within a segment; `**` crosses separators and matches every path alone. */
 export function compileOfflineSyncExcludeGlobs(
   globs: readonly unknown[],
 ): RegExp[] {

package/src/offline-sync-upload-staging.test.ts

@@ -0,0 +1,324 @@
+/**
+ * Unit coverage for offline-sync-upload-staging.ts (issue #3164): the real
+ * on-disk staging layout under a temp archive root — content-keyed spools,
+ * chunk offset contiguity, crash debris reclamation, symlink defenses, and
+ * the mid-flight reset a second writer performs at offset 0. These functions
+ * are also the write path for remote-authoritative runtime state (#3165).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  symlink,
+  utimes,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+
+import { prepareSafeArchiveRoot, sha256Bytes, type SafeArchiveRoot } from "./transfer/fs-utils.js";
+import { SYNC_INTERNAL_DIR } from "./offline-sync-file-io.js";
+import { applyOfflineSyncFileContentChunk } from "./offline-sync.js";
+import {
+  cleanupOfflineUpload,
+  digestOfflineUploadStagingContent,
+  hashText,
+  pruneOfflineUploadStaging,
+  writeOfflineUploadChunk,
+  writeSafeFileFromUpload,
+  type OfflineUploadStaging,
+} from "./offline-sync-upload-staging.js";
+
+const SHA_A = "a".repeat(64);
+
+let rootDirCounter = 0;
+
+async function newRoot(): Promise<{ root: SafeArchiveRoot; abs: string }> {
+  const abs = await mkdtemp(path.join(tmpdir(), `upload-staging-${process.pid}-${rootDirCounter++}-`));
+  const root = await prepareSafeArchiveRoot(abs, "test-root", "root");
+  return { root, abs };
+}
+
+function uploadsDir(abs: string): string {
+  return path.join(abs, SYNC_INTERNAL_DIR, "uploads");
+}
+
+/** Drive an upload the way applyOfflineSyncFileContentChunk does, with a fixed chunk size. */
+async function stagedUpload(options: {
+  root: SafeArchiveRoot;
+  abs: string;
+  relPath?: string;
+  content: Buffer;
+  chunkSize: number;
+  sourceId?: string;
+}): Promise<string> {
+  const relPath = options.relPath ?? "namespaces/alpha/facts/fact-1.md";
+  const sourceId = options.sourceId ?? "source-1";
+  const sha256 = sha256Bytes(options.content).sha256;
+  let upload: OfflineUploadStaging | null = null;
+  try {
+    if (options.content.length === 0) {
+      upload = await writeOfflineUploadChunk({
+        root: options.root,
+        sourceId,
+        relPath,
+        sha256,
+        bytes: 0,
+        offset: 0,
+        content: Buffer.alloc(0),
+      });
+    }
+    for (let offset = 0; offset < options.content.length; offset += options.chunkSize) {
+      const end = Math.min(offset + options.chunkSize, options.content.length);
+      upload = await writeOfflineUploadChunk({
+        root: options.root,
+        sourceId,
+        relPath,
+        sha256,
+        bytes: options.content.length,
+        offset,
+        content: options.content.subarray(offset, end),
+      });
+    }
+    if (upload === null) throw new Error("unreachable: the empty-content path still writes chunk 0");
+    const digest = await digestOfflineUploadStagingContent({ root: options.root, upload });
+    assert.equal(digest.sha256, sha256);
+    assert.equal(digest.bytes, options.content.length);
+    await writeSafeFileFromUpload(options.root, relPath, upload, undefined, undefined, undefined);
+    return path.join(options.abs, relPath);
+  } finally {
+    if (upload) await cleanupOfflineUpload(upload);
+  }
+}
+
+test("multi-chunk upload writes exact bytes and reclaims its staging", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const content = Buffer.from("abcdefghij", "utf8");
+  const target = await stagedUpload({ root, abs, content, chunkSize: 4 });
+  assert.equal(await readFile(target, "utf8"), "abcdefghij");
+  assert.deepEqual(await readdir(uploadsDir(abs)), [], "staging reclaimed after finalize");
+});
+
+test("empty upload (bytes 0) still creates an empty target file", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const target = await stagedUpload({ root, abs, content: Buffer.alloc(0), chunkSize: 4 });
+  const stat = await lstat(target);
+  assert.equal(stat.size, 0, "empty upload creates a zero-byte target");
+});
+
+test("chunk above offset 0 without the initial chunk fails loudly", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  await assert.rejects(
+    writeOfflineUploadChunk({
+      root,
+      sourceId: "source-1",
+      relPath: "namespaces/alpha/facts/fact-1.md",
+      sha256: SHA_A,
+      bytes: 100,
+      offset: 4,
+      content: Buffer.from("abcd"),
+    }),
+    /missing initial chunk/,
+  );
+});
+
+test("digest refuses a gapped chunk sequence instead of skipping bytes", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const upload = await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 100, offset: 0,
+    content: Buffer.from("aaaa"),
+  });
+  await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 100, offset: 9,
+    content: Buffer.from("bbbb"),
+  });
+  await assert.rejects(
+    digestOfflineUploadStagingContent({ root, upload }),
+    /offset mismatch .* expected 4, got 9/,
+  );
+  await cleanupOfflineUpload(upload);
+});
+
+test("a second writer's offset-0 reset converges identical content and corrupts nothing", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const declared = sha256Bytes(Buffer.from("12345678")).sha256;
+  const shared = { root, sourceId: "source-1", relPath, sha256: declared, bytes: 8 };
+  const first = await writeOfflineUploadChunk({ ...shared, offset: 0, content: Buffer.from("1234") });
+  await writeOfflineUploadChunk({ ...shared, offset: 0, content: Buffer.from("1234") });
+  await writeOfflineUploadChunk({ ...shared, offset: 4, content: Buffer.from("5678") });
+  const digest = await digestOfflineUploadStagingContent({ root, upload: first });
+  assert.deepEqual(digest, { sha256: declared, bytes: 8 });
+  await writeSafeFileFromUpload(root, relPath, first, undefined, undefined, undefined);
+  assert.equal(await readFile(path.join(abs, relPath), "utf8"), "12345678");
+  await cleanupOfflineUpload(first);
+});
+
+test("a reset carrying different bytes fails the real consumer's checksum gate", async (t) => {
+  const { abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const declared = sha256Bytes(Buffer.from("12345678")).sha256;
+  const shared = {
+    root: abs,
+    sourceId: "source-1",
+    path: relPath,
+    sha256: declared,
+    bytes: 8,
+    mtimeMs: 1_700_000_000_000,
+  };
+  await applyOfflineSyncFileContentChunk({ ...shared, offset: 0, content: Buffer.from("1234") });
+  await applyOfflineSyncFileContentChunk({ ...shared, offset: 0, content: Buffer.from("9999") });
+  await assert.rejects(
+    applyOfflineSyncFileContentChunk({ ...shared, offset: 4, content: Buffer.from("5678") }),
+    /checksum mismatch/,
+  );
+  assert.deepEqual(
+    await readdir(uploadsDir(abs)),
+    [],
+    "the consumer reclaimed the failed spool",
+  );
+  assert.equal(fs.existsSync(path.join(abs, relPath)), false, "target never written from a bad spool");
+});
+
+test("crash debris: abandoned staging is reclaimed only after the 24h age, by pattern", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const stagingKey = hashText(["source-1", relPath, SHA_A, "8"].join("\0"));
+  const stage = path.join(uploadsDir(abs), `${stagingKey}.part`);
+  await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 8, offset: 0, content: Buffer.from("1234"),
+  });
+  assert.equal((await readdir(uploadsDir(abs))).length, 1);
+
+  await pruneOfflineUploadStaging(root);
+  assert.equal((await readdir(uploadsDir(abs))).length, 1, "fresh abandoned staging is kept");
+
+  const stale = new Date(Date.now() - 25 * 60 * 60 * 1000);
+  await utimes(stage, stale, stale);
+  await pruneOfflineUploadStaging(root);
+  assert.equal((await readdir(uploadsDir(abs))).length, 0, "aged-out staging is reclaimed");
+
+  await writeFile(path.join(uploadsDir(abs), "not-a-part"), "keep me");
+  await writeFile(path.join(uploadsDir(abs), `${"z".repeat(64)}.part`), "keep me too");
+  await utimes(path.join(uploadsDir(abs), "not-a-part"), stale, stale);
+  await utimes(path.join(uploadsDir(abs), `${"z".repeat(64)}.part`), stale, stale);
+  await pruneOfflineUploadStaging(root);
+  assert.deepEqual((await readdir(uploadsDir(abs))).sort(), [
+    "not-a-part",
+    `${"z".repeat(64)}.part`,
+  ]);
+});
+
+test("symlinked chunk path is rejected before write", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const stagingKey = hashText(["source-1", relPath, SHA_A, "8"].join("\0"));
+  const stage = path.join(uploadsDir(abs), `${stagingKey}.part`);
+  await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 8, offset: 0, content: Buffer.from("1234"),
+  });
+  const victim = path.join(abs, "victim.txt");
+  await writeFile(victim, "do not touch");
+  await symlink(victim, path.join(stage, `${String(4).padStart(20, "0")}.part`));
+  await assert.rejects(
+    writeOfflineUploadChunk({
+      root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 8, offset: 4, content: Buffer.from("5678"),
+    }),
+    /symlink/,
+  );
+  assert.equal(await readFile(victim, "utf8"), "do not touch", "symlink target untouched");
+});
+
+test("symlinked final target is rejected and no tmp file is left behind", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const upload = await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 8, offset: 0, content: Buffer.from("1234"),
+  });
+  const realTarget = path.join(abs, "elsewhere.md");
+  await writeFile(realTarget, "existing file");
+  await mkdir(path.dirname(path.join(abs, relPath)), { recursive: true });
+  await symlink(realTarget, path.join(abs, relPath));
+  await assert.rejects(
+    writeSafeFileFromUpload(root, relPath, upload, undefined, undefined, undefined),
+    /symlink/,
+  );
+  assert.equal(await readFile(realTarget, "utf8"), "existing file", "symlink target not overwritten");
+  const leftovers = (await readdir(path.dirname(path.join(abs, relPath))))
+    .filter((name) => name.startsWith(".remnic-sync."));
+  assert.deepEqual(leftovers, [], "atomic-write tmp cleaned up");
+  await cleanupOfflineUpload(upload);
+});
+
+test("writeFileChunks hook receives every chunk in order without a local tmp", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const relPath = "namespaces/alpha/facts/fact-1.md";
+  const upload = await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 12, offset: 0, content: Buffer.from("1234"),
+  });
+  await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 12, offset: 4, content: Buffer.from("5678"),
+  });
+  await writeOfflineUploadChunk({
+    root, sourceId: "source-1", relPath, sha256: SHA_A, bytes: 12, offset: 8, content: Buffer.from("90ab"),
+  });
+  const streamed: Buffer[] = [];
+  const mtimeMs = 1_700_000_000_000;
+  await writeSafeFileFromUpload(root, relPath, upload, undefined, async (target) => {
+    assert.equal(target.path, relPath);
+    for await (const chunk of target.chunks) streamed.push(Buffer.from(chunk));
+  }, mtimeMs);
+  assert.equal(Buffer.concat(streamed).toString("utf8"), "1234567890ab");
+  assert.equal(
+    fs.existsSync(path.join(abs, relPath)),
+    false,
+    "hook path does not also write a local file",
+  );
+  await cleanupOfflineUpload(upload);
+});
+
+test("concurrent staging keeps identical content at different paths isolated", async (t) => {
+  const { root, abs } = await newRoot();
+  t.after(() => rm(abs, { recursive: true, force: true }));
+  const content = Buffer.from("12345678");
+  const shared = { root, sourceId: "source-1", ...sha256Bytes(content) };
+  const firstPath = "namespaces/alpha/facts/one.md";
+  const secondPath = "namespaces/alpha/facts/two.md";
+  const first = await writeOfflineUploadChunk({
+    ...shared, relPath: firstPath, offset: 0, content: content.subarray(0, 4),
+  });
+  const second = await writeOfflineUploadChunk({
+    ...shared, relPath: secondPath, offset: 0, content: content.subarray(0, 4),
+  });
+  await writeOfflineUploadChunk({
+    ...shared, relPath: firstPath, offset: 4, content: content.subarray(4),
+  });
+  assert.deepEqual(await digestOfflineUploadStagingContent({ root, upload: first }), sha256Bytes(content));
+  await writeSafeFileFromUpload(root, firstPath, first);
+  await cleanupOfflineUpload(first);
+  await writeOfflineUploadChunk({
+    ...shared, relPath: secondPath, offset: 4, content: content.subarray(4),
+  });
+  assert.deepEqual(await digestOfflineUploadStagingContent({ root, upload: second }), sha256Bytes(content));
+  await writeSafeFileFromUpload(root, secondPath, second);
+  await cleanupOfflineUpload(second);
+  assert.deepEqual(await readFile(path.join(abs, firstPath)), content);
+  assert.deepEqual(await readFile(path.join(abs, secondPath)), content);
+});

package/src/offline-sync-upload-staging.ts

@@ -19,7 +19,8 @@ export function hashText(value: string): string {
   return createHash("sha256").update(value).digest("hex");
 }
 
-interface OfflineUploadStaging {
+/** A staged upload spool returned by writeOfflineUploadChunk; consumed by digest/cleanup/finalize. */
+export interface OfflineUploadStaging {
   kind: "single" | "chunks";
   relPath: string;
   filePath: string;

package/src/offline-sync.test.ts

@@ -3077,6 +3077,18 @@ test("globToRegExp treats ** as cross-segment in trailing and embedded positions
   assert.equal(embedded.test("state/a/b/other.json"), false);
 });
 
+test("globToRegExp ** spans line terminators that valid archive paths may contain (#3172)", () => {
+  const trailing = globToRegExp("scratch/**");
+  assert.equal(trailing.test("scratch/a\nb.md"), true);
+  assert.equal(trailing.test("scratch/a\nb/c.md"), true);
+  const embedded = globToRegExp("state/**/runs.json");
+  assert.equal(embedded.test("state/a\nb/runs.json"), true);
+  assert.equal(globToRegExp("**/state/*.sqlite").test("a\nb/state/lcm.sqlite"), true);
+  const single = globToRegExp("state/*.sqlite");
+  assert.equal(single.test("state/a\nb.sqlite"), true);
+  assert.equal(single.test("state/a/b.sqlite"), false);
+});
+
 test("default excludes cover per-namespace state dirs (#1793 review)", () => {
   const sqlite = globToRegExp("**/state/*.sqlite");
   assert.equal(sqlite.test("state/lcm.sqlite"), true);

package/src/offline-sync.ts

@@ -76,6 +76,7 @@ import {
   writeOfflineUploadChunk,
   writeSafeFileFromUpload,
   hashText,
+  type OfflineUploadStaging,
 } from "./offline-sync-upload-staging.js";
 export type { OfflineSyncExcludeFile, OfflineSyncFileTarget } from "./offline-sync-file-io.js";
 
@@ -265,12 +266,6 @@ export interface OfflineSyncApplyFileContentChunkResult {
   currentFile?: OfflineSyncFileState;
 }
 
-interface OfflineUploadStaging {
-  kind: "single" | "chunks";
-  relPath: string;
-  filePath: string;
-}
-
 interface OfflineSyncFileRecordOptions {
   root: SafeArchiveRoot;
   relPath: string;

package/dist/chunk-ETUZFFPU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/offline-sync-upload-staging.ts"],"sourcesContent":["// Offline-sync upload staging: chunked upload spool under\n// `.offline-sync/uploads/` (issue #2033). Extracted from offline-sync.ts so\n// the god-file line-count ratchet does not grow; behavior is unchanged.\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { lstat, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { SYNC_INTERNAL_DIR, setSafeFileMtime } from \"./offline-sync-file-io.js\";\nimport type { OfflineSyncFileTarget } from \"./offline-sync-file-io.js\";\nimport type {\n  OfflineSyncFileStagingWriteTarget,\n  OfflineSyncFileWriteChunksTarget,\n  OfflineSyncFileWriteTarget,\n} from \"./offline-sync.js\";\nimport { type SafeArchiveRoot, resolveSafeArchiveTarget } from \"./transfer/fs-utils.js\";\n\nconst OFFLINE_SYNC_UPLOAD_STAGING_MAX_AGE_MS = 24 * 60 * 60 * 1000;\n\nexport function hashText(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\ninterface OfflineUploadStaging {\n  kind: \"single\" | \"chunks\";\n  relPath: string;\n  filePath: string;\n}\n\nfunction offlineUploadRelPath(options: {\n  sourceId: string;\n  relPath: string;\n  sha256: string;\n  bytes: number;\n}): string {\n  const key = hashText([options.sourceId, options.relPath, options.sha256, String(options.bytes)].join(\"\\0\"));\n  return `${SYNC_INTERNAL_DIR}/uploads/${key}.part`;\n}\n\nasync function offlineUploadPath(\n  root: SafeArchiveRoot,\n  options: {\n    sourceId: string;\n    relPath: string;\n    sha256: string;\n    bytes: number;\n  }\n): Promise<OfflineUploadStaging> {\n  const relPath = offlineUploadRelPath(options);\n  return {\n    kind: \"single\",\n    relPath,\n    filePath: await resolveSafeArchiveTarget(root, relPath),\n  };\n}\n\nasync function offlineUploadChunkPath(\n  root: SafeArchiveRoot,\n  options: {\n    sourceId: string;\n    relPath: string;\n    sha256: string;\n    bytes: number;\n    offset: number;\n  }\n): Promise<OfflineUploadStaging> {\n  const uploadRelPath = offlineUploadRelPath(options);\n  const relPath = `${uploadRelPath}/${String(options.offset).padStart(20, \"0\")}.part`;\n  return {\n    kind: \"chunks\",\n    relPath,\n    filePath: await resolveSafeArchiveTarget(root, relPath),\n  };\n}\n\nexport async function writeOfflineUploadChunk(options: {\n  root: SafeArchiveRoot;\n  sourceId: string;\n  relPath: string;\n  sha256: string;\n  bytes: number;\n  offset: number;\n  content: Buffer;\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n  writeFile?: (target: OfflineSyncFileWriteTarget) => Promise<void>;\n  writeStagingFile?: (target: OfflineSyncFileStagingWriteTarget) => Promise<void>;\n}): Promise<OfflineUploadStaging> {\n  if ((options.writeFile || options.writeStagingFile) && !options.readFile) {\n    throw new Error(\"offline sync upload chunk storage hooks require readFile\");\n  }\n  const uploadRoot = {\n    ...(await offlineUploadPath(options.root, options)),\n    kind: \"chunks\" as const,\n  };\n  if (options.offset === 0) {\n    await rm(uploadRoot.filePath, { recursive: true, force: true }).catch(() => {});\n  } else {\n    const existing = await stat(uploadRoot.filePath).catch((error: unknown) => {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n      throw error;\n    });\n    if (!existing || !existing.isDirectory()) {\n      throw new Error(`offline sync upload is missing initial chunk for ${options.relPath}`);\n    }\n  }\n  const chunk = await offlineUploadChunkPath(options.root, { ...options, offset: options.offset });\n\n  const writeStagingFile = options.writeStagingFile ?? options.writeFile;\n  if (writeStagingFile) {\n    // Storage-backed services provide these hooks so secure-store deployments\n    // keep staged partial uploads encrypted at rest without mutating indexes.\n    await writeOfflineUploadContent({\n      root: options.root,\n      relPath: chunk.relPath,\n      filePath: chunk.filePath,\n      content: options.content,\n      writeFile: writeStagingFile,\n    });\n    return uploadRoot;\n  }\n\n  await mkdir(path.dirname(chunk.filePath), { recursive: true });\n  const existingChunk = await lstat(chunk.filePath).catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw error;\n  });\n  if (existingChunk?.isSymbolicLink()) {\n    throw new Error(`offline sync upload chunk is a symlink: ${chunk.relPath}`);\n  }\n  await writeFile(chunk.filePath, options.content, { mode: 0o600 });\n  return uploadRoot;\n}\n\nexport async function pruneOfflineUploadStaging(root: SafeArchiveRoot): Promise<void> {\n  const uploadsRelPath = `${SYNC_INTERNAL_DIR}/uploads`;\n  const uploadsPath = await resolveSafeArchiveTarget(root, uploadsRelPath);\n  const entries = await readdir(uploadsPath, { withFileTypes: true }).catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n    throw error;\n  });\n  const now = Date.now();\n  await Promise.all(\n    entries.map(async (entry) => {\n      if (!/^[a-f0-9]{64}\\.part$/i.test(entry.name)) return;\n      const relPath = `${uploadsRelPath}/${entry.name}`;\n      const filePath = await resolveSafeArchiveTarget(root, relPath);\n      const info = await lstat(filePath).catch((error: unknown) => {\n        if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n        throw error;\n      });\n      if (!info) return;\n      if (now - info.mtimeMs <= OFFLINE_SYNC_UPLOAD_STAGING_MAX_AGE_MS) return;\n      await rm(filePath, { recursive: true, force: true });\n    })\n  );\n}\n\nasync function* readOfflineUploadStagingChunks(options: {\n  root: SafeArchiveRoot;\n  upload: OfflineUploadStaging;\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n}): AsyncGenerator<Buffer> {\n  if (options.upload.kind === \"single\") {\n    yield await readOfflineUploadContent({\n      root: options.root,\n      relPath: options.upload.relPath,\n      filePath: options.upload.filePath,\n      readFile: options.readFile,\n    });\n    return;\n  }\n\n  const entries = await readdir(options.upload.filePath);\n  const chunkNames = entries.filter((entry) => /^\\d{20}\\.part$/.test(entry)).sort();\n  if (chunkNames.length === 0) {\n    throw new Error(`offline sync upload is missing chunks for ${options.upload.relPath}`);\n  }\n  let expectedOffset = 0;\n  for (const chunkName of chunkNames) {\n    const offset = Number(chunkName.slice(0, 20));\n    if (!Number.isSafeInteger(offset) || offset !== expectedOffset) {\n      throw new Error(\n        `offline sync upload offset mismatch for ${options.upload.relPath}: expected ${expectedOffset}, got ${offset}`\n      );\n    }\n    const relPath = `${options.upload.relPath}/${chunkName}`;\n    const filePath = await resolveSafeArchiveTarget(options.root, relPath);\n    const content = await readOfflineUploadContent({\n      root: options.root,\n      relPath,\n      filePath,\n      readFile: options.readFile,\n    });\n    expectedOffset += content.length;\n    yield content;\n  }\n}\n\nexport async function digestOfflineUploadStagingContent(options: {\n  root: SafeArchiveRoot;\n  upload: OfflineUploadStaging;\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n}): Promise<{ sha256: string; bytes: number }> {\n  const hash = createHash(\"sha256\");\n  let bytes = 0;\n  for await (const chunk of readOfflineUploadStagingChunks(options)) {\n    hash.update(chunk);\n    bytes += chunk.length;\n  }\n  return { sha256: hash.digest(\"hex\"), bytes };\n}\n\nexport async function writeSafeFileFromUpload(\n  root: SafeArchiveRoot,\n  relPath: string,\n  upload: OfflineUploadStaging,\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>,\n  writeFileChunks?: (target: OfflineSyncFileWriteChunksTarget) => Promise<void>,\n  mtimeMs?: number\n): Promise<void> {\n  const target = await resolveSafeArchiveTarget(root, relPath);\n  const chunks = readOfflineUploadStagingChunks({ root, upload, readFile });\n  if (writeFileChunks) {\n    await writeFileChunks({ root: root.abs, path: relPath, filePath: target, chunks });\n    await setSafeFileMtime(root, relPath, mtimeMs);\n    return;\n  }\n\n  await mkdir(path.dirname(target), { recursive: true });\n  const tmp = path.join(path.dirname(target), `.remnic-sync.${process.pid}.${randomUUID()}.tmp`);\n  const handle = await open(tmp, \"w\", 0o600);\n  try {\n    for await (const chunk of chunks) {\n      if (chunk.length > 0) await handle.write(chunk);\n    }\n    await handle.close();\n    const targetStat = await lstat(target).catch((error: unknown) => {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n      throw error;\n    });\n    if (targetStat?.isSymbolicLink()) {\n      throw new Error(`offline sync target is a symlink: ${relPath}`);\n    }\n    await rename(tmp, target);\n    await setSafeFileMtime(root, relPath, mtimeMs);\n  } catch (error) {\n    await handle.close().catch(() => {});\n    await unlink(tmp).catch(() => {});\n    throw error;\n  }\n}\n\nexport async function cleanupOfflineUpload(upload: OfflineUploadStaging): Promise<void> {\n  if (upload.kind === \"chunks\") {\n    await rm(upload.filePath, { recursive: true, force: true });\n    return;\n  }\n  await unlink(upload.filePath).catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw error;\n  });\n}\n\nasync function readOfflineUploadContent(options: {\n  root: SafeArchiveRoot;\n  relPath: string;\n  filePath: string;\n  readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;\n}): Promise<Buffer> {\n  if (options.readFile) {\n    return options.readFile({\n      root: options.root.abs,\n      path: options.relPath,\n      filePath: options.filePath,\n    });\n  }\n  return readFile(options.filePath);\n}\n\nasync function writeOfflineUploadContent(options: {\n  root: SafeArchiveRoot;\n  relPath: string;\n  filePath: string;\n  content: Buffer;\n  writeFile: (target: OfflineSyncFileWriteTarget) => Promise<void>;\n}): Promise<void> {\n  await options.writeFile({\n    root: options.root.abs,\n    path: options.relPath,\n    filePath: options.filePath,\n    content: options.content,\n  });\n}\n"],"mappings":";;;;;;;;;AAGA,SAAS,YAAY,kBAAkB;AACvC,SAAS,OAAO,OAAO,MAAM,UAAU,SAAS,QAAQ,IAAI,MAAM,QAAQ,iBAAiB;AAC3F,OAAO,UAAU;AAUjB,IAAM,yCAAyC,KAAK,KAAK,KAAK;AAEvD,SAAS,SAAS,OAAuB;AAC9C,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAQA,SAAS,qBAAqB,SAKnB;AACT,QAAM,MAAM,SAAS,CAAC,QAAQ,UAAU,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC;AAC1G,SAAO,GAAG,iBAAiB,YAAY,GAAG;AAC5C;AAEA,eAAe,kBACb,MACA,SAM+B;AAC/B,QAAM,UAAU,qBAAqB,OAAO;AAC5C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,UAAU,MAAM,yBAAyB,MAAM,OAAO;AAAA,EACxD;AACF;AAEA,eAAe,uBACb,MACA,SAO+B;AAC/B,QAAM,gBAAgB,qBAAqB,OAAO;AAClD,QAAM,UAAU,GAAG,aAAa,IAAI,OAAO,QAAQ,MAAM,EAAE,SAAS,IAAI,GAAG,CAAC;AAC5E,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,UAAU,MAAM,yBAAyB,MAAM,OAAO;AAAA,EACxD;AACF;AAEA,eAAsB,wBAAwB,SAWZ;AAChC,OAAK,QAAQ,aAAa,QAAQ,qBAAqB,CAAC,QAAQ,UAAU;AACxE,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,aAAa;AAAA,IACjB,GAAI,MAAM,kBAAkB,QAAQ,MAAM,OAAO;AAAA,IACjD,MAAM;AAAA,EACR;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,GAAG,WAAW,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAChF,OAAO;AACL,UAAM,WAAW,MAAM,KAAK,WAAW,QAAQ,EAAE,MAAM,CAAC,UAAmB;AACzE,UAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,YAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,YAAY,CAAC,SAAS,YAAY,GAAG;AACxC,YAAM,IAAI,MAAM,oDAAoD,QAAQ,OAAO,EAAE;AAAA,IACvF;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,uBAAuB,QAAQ,MAAM,EAAE,GAAG,SAAS,QAAQ,QAAQ,OAAO,CAAC;AAE/F,QAAM,mBAAmB,QAAQ,oBAAoB,QAAQ;AAC7D,MAAI,kBAAkB;AAGpB,UAAM,0BAA0B;AAAA,MAC9B,MAAM,QAAQ;AAAA,MACd,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,KAAK,QAAQ,MAAM,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,QAAM,gBAAgB,MAAM,MAAM,MAAM,QAAQ,EAAE,MAAM,CAAC,UAAmB;AAC1E,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR,CAAC;AACD,MAAI,eAAe,eAAe,GAAG;AACnC,UAAM,IAAI,MAAM,2CAA2C,MAAM,OAAO,EAAE;AAAA,EAC5E;AACA,QAAM,UAAU,MAAM,UAAU,QAAQ,SAAS,EAAE,MAAM,IAAM,CAAC;AAChE,SAAO;AACT;AAEA,eAAsB,0BAA0B,MAAsC;AACpF,QAAM,iBAAiB,GAAG,iBAAiB;AAC3C,QAAM,cAAc,MAAM,yBAAyB,MAAM,cAAc;AACvE,QAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC5F,QAAK,MAAgC,SAAS,SAAU,QAAO,CAAC;AAChE,UAAM;AAAA,EACR,CAAC;AACD,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,QAAQ;AAAA,IACZ,QAAQ,IAAI,OAAO,UAAU;AAC3B,UAAI,CAAC,wBAAwB,KAAK,MAAM,IAAI,EAAG;AAC/C,YAAM,UAAU,GAAG,cAAc,IAAI,MAAM,IAAI;AAC/C,YAAM,WAAW,MAAM,yBAAyB,MAAM,OAAO;AAC7D,YAAM,OAAO,MAAM,MAAM,QAAQ,EAAE,MAAM,CAAC,UAAmB;AAC3D,YAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,cAAM;AAAA,MACR,CAAC;AACD,UAAI,CAAC,KAAM;AACX,UAAI,MAAM,KAAK,WAAW,uCAAwC;AAClE,YAAM,GAAG,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,IACrD,CAAC;AAAA,EACH;AACF;AAEA,gBAAgB,+BAA+B,SAIpB;AACzB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,MAAM,yBAAyB;AAAA,MACnC,MAAM,QAAQ;AAAA,MACd,SAAS,QAAQ,OAAO;AAAA,MACxB,UAAU,QAAQ,OAAO;AAAA,MACzB,UAAU,QAAQ;AAAA,IACpB,CAAC;AACD;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO,QAAQ;AACrD,QAAM,aAAa,QAAQ,OAAO,CAAC,UAAU,iBAAiB,KAAK,KAAK,CAAC,EAAE,KAAK;AAChF,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,6CAA6C,QAAQ,OAAO,OAAO,EAAE;AAAA,EACvF;AACA,MAAI,iBAAiB;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,SAAS,OAAO,UAAU,MAAM,GAAG,EAAE,CAAC;AAC5C,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,WAAW,gBAAgB;AAC9D,YAAM,IAAI;AAAA,QACR,2CAA2C,QAAQ,OAAO,OAAO,cAAc,cAAc,SAAS,MAAM;AAAA,MAC9G;AAAA,IACF;AACA,UAAM,UAAU,GAAG,QAAQ,OAAO,OAAO,IAAI,SAAS;AACtD,UAAM,WAAW,MAAM,yBAAyB,QAAQ,MAAM,OAAO;AACrE,UAAM,UAAU,MAAM,yBAAyB;AAAA,MAC7C,MAAM,QAAQ;AAAA,MACd;AAAA,MACA;AAAA,MACA,UAAU,QAAQ;AAAA,IACpB,CAAC;AACD,sBAAkB,QAAQ;AAC1B,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,kCAAkC,SAIT;AAC7C,QAAM,OAAO,WAAW,QAAQ;AAChC,MAAI,QAAQ;AACZ,mBAAiB,SAAS,+BAA+B,OAAO,GAAG;AACjE,SAAK,OAAO,KAAK;AACjB,aAAS,MAAM;AAAA,EACjB;AACA,SAAO,EAAE,QAAQ,KAAK,OAAO,KAAK,GAAG,MAAM;AAC7C;AAEA,eAAsB,wBACpB,MACA,SACA,QACAA,WACA,iBACA,SACe;AACf,QAAM,SAAS,MAAM,yBAAyB,MAAM,OAAO;AAC3D,QAAM,SAAS,+BAA+B,EAAE,MAAM,QAAQ,UAAAA,UAAS,CAAC;AACxE,MAAI,iBAAiB;AACnB,UAAM,gBAAgB,EAAE,MAAM,KAAK,KAAK,MAAM,SAAS,UAAU,QAAQ,OAAO,CAAC;AACjF,UAAM,iBAAiB,MAAM,SAAS,OAAO;AAC7C;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACrD,QAAM,MAAM,KAAK,KAAK,KAAK,QAAQ,MAAM,GAAG,gBAAgB,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM;AAC7F,QAAM,SAAS,MAAM,KAAK,KAAK,KAAK,GAAK;AACzC,MAAI;AACF,qBAAiB,SAAS,QAAQ;AAChC,UAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAAA,IAChD;AACA,UAAM,OAAO,MAAM;AACnB,UAAM,aAAa,MAAM,MAAM,MAAM,EAAE,MAAM,CAAC,UAAmB;AAC/D,UAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,YAAM;AAAA,IACR,CAAC;AACD,QAAI,YAAY,eAAe,GAAG;AAChC,YAAM,IAAI,MAAM,qCAAqC,OAAO,EAAE;AAAA,IAChE;AACA,UAAM,OAAO,KAAK,MAAM;AACxB,UAAM,iBAAiB,MAAM,SAAS,OAAO;AAAA,EAC/C,SAAS,OAAO;AACd,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACnC,UAAM,OAAO,GAAG,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAChC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,qBAAqB,QAA6C;AACtF,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,GAAG,OAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC1D;AAAA,EACF;AACA,QAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,CAAC,UAAmB;AACtD,QAAK,MAAgC,SAAS,SAAU;AACxD,UAAM;AAAA,EACR,CAAC;AACH;AAEA,eAAe,yBAAyB,SAKpB;AAClB,MAAI,QAAQ,UAAU;AACpB,WAAO,QAAQ,SAAS;AAAA,MACtB,MAAM,QAAQ,KAAK;AAAA,MACnB,MAAM,QAAQ;AAAA,MACd,UAAU,QAAQ;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,SAAS,QAAQ,QAAQ;AAClC;AAEA,eAAe,0BAA0B,SAMvB;AAChB,QAAM,QAAQ,UAAU;AAAA,IACtB,MAAM,QAAQ,KAAK;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,EACnB,CAAC;AACH;","names":["readFile"]}