@remnic/core 9.7.15 → 9.9.0

package/dist/chunk-KF5EUVKQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-boundary.ts"],"sourcesContent":["/**\n * Single input-validation and error boundary for the CLI/MCP/HTTP access\n * surfaces (issue #1525, epic #1520 Phase 1).\n *\n * Every operation that crosses the access-service facade passes through ONE\n * registry entry: a zod-validated request envelope, a shared error mapper,\n * and the \"reject invalid input and list valid options\" behavior that\n * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented\n * per handler. The three surfaces become thin adapters — one operation\n * definition, three transports — so a validation fix lands everywhere at\n * once.\n *\n * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`\n * prefix. Session/namespace tenancy stays in the handler layer (resolved via\n * ScopePlan #1521); the boundary validates SHAPE, not tenancy.\n */\n\nimport { z } from \"zod\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\nimport { EngramAccessInputError, type EngramAccessService } from \"./access-service.js\";\nimport {\n  assertFleetWideOperationAllowed,\n  assertOperationAllowed,\n  capabilityAllowsOp,\n  tokenCapabilityStore,\n} from \"./access-token-capabilities.js\";\nimport { expandTildePath } from \"./utils/path.js\";\n\n// ---------------------------------------------------------------------------\n// Canonical operation names — host-agnostic (rule 31)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Add to this union as\n * each domain-group migration PR (memory ops → connectors → namespaces …)\n * lands; the fitness test in `access-surface-catalog.test.ts` treats the\n * registered set as the migration state.\n */\nexport const OPERATION_NAMES = [\n  \"memory_get\",\n  \"memory_search\",\n  \"memory_store\",\n  \"coding_decision\",\n  \"coding_architecture\",\n  // codegraph parity tools (issue #1554) -- each maps to one codegraph_*\n  // boundary operation that delegates to the surface handler in\n  // coding/codegraph-surfaces.ts. Names match the external tool suffixes.\n  \"codegraph_index\",\n  \"codegraph_list_projects\",\n  \"codegraph_delete_project\",\n  \"codegraph_index_status\",\n  \"codegraph_search_graph\",\n  \"codegraph_trace_path\",\n  \"codegraph_detect_changes\",\n  \"codegraph_query_graph\",\n  \"codegraph_get_schema\",\n  \"codegraph_get_snippet\",\n  \"codegraph_get_architecture\",\n  \"codegraph_search_code\",\n  \"codegraph_manage_adr\",\n  \"codegraph_ingest_traces\",\n  \"memory_correct_plan\",\n  \"memory_correct_apply\",\n  \"coding_delta\",\n  // Remaining MCP/HTTP handlers migrated through the boundary (issue #1525).\n  \"recall\",\n  \"recall_explain\",\n  \"set_coding_context\",\n  \"recall_tier_explain\",\n  \"recall_xray\",\n  \"namespace_writable\",\n  \"wearables_status\",\n  \"wearables_sync\",\n  \"transcript_day\",\n  \"transcript_search\",\n  \"transcript_memories\",\n  \"action_confidence\",\n  \"chatgpt_memory_inspector\",\n  \"day_summary\",\n  \"capsule_export\",\n  \"capsule_import\",\n  \"capsule_list\",\n  \"memory_governance_run\",\n  \"procedure_mining_run\",\n  \"pattern_reinforcement_run\",\n  \"procedural_stats\",\n  \"memory_timeline\",\n  \"suggestion_submit\",\n  \"entity_get\",\n  \"review_queue_list\",\n  \"correction_pending\",\n  \"observe\",\n  \"lcm_search\",\n  \"lcm_compaction_flush\",\n  \"lcm_compaction_record\",\n  \"continuity_audit_generate\",\n  \"continuity_incident_open\",\n  \"continuity_incident_close\",\n  \"continuity_incident_list\",\n  \"continuity_loop_add_or_update\",\n  \"continuity_loop_review\",\n  \"identity_anchor_get\",\n  \"identity_anchor_update\",\n  \"memory_identity\",\n  \"work_task\",\n  \"work_project\",\n  \"work_board\",\n  \"shared_context_write_output\",\n  \"shared_feedback_record\",\n  \"shared_priorities_append\",\n  \"relay_mission_append\",\n  \"relay_mission_read\",\n  \"shared_context_cross_signals_run\",\n  \"shared_context_curate_daily\",\n  \"compounding_weekly_synthesize\",\n  \"compounding_promote_candidate\",\n  \"compression_guidelines_optimize\",\n  \"compression_guidelines_activate\",\n  \"memory_profile\",\n  \"memory_entities_list\",\n  \"memory_questions\",\n  \"memory_last_recall\",\n  \"memory_intent_debug\",\n  \"memory_qmd_debug\",\n  \"memory_graph_explain\",\n  \"graph_snapshot\",\n  \"memory_feedback\",\n  \"memory_promote\",\n  \"memory_outcome\",\n  \"memory_action_apply\",\n  \"context_checkpoint\",\n  \"briefing\",\n  \"review_list\",\n  \"review_resolve\",\n  \"contradiction_scan_run\",\n  \"memory_summarize_hourly\",\n  \"conversation_index_update\",\n  \"profiling_report\",\n  \"graph_edge_decay_run\",\n  \"live_connectors_run\",\n  \"peer_list\",\n  \"peer_get\",\n  \"peer_set\",\n  \"peer_delete\",\n  \"peer_profile_get\",\n  \"peer_forget\",\n  \"console_state\",\n  \"dreams_status\",\n  \"dreams_run\",\n  // HTTP-only routes (no direct MCP tool equivalent).\n  \"adapters_status\",\n  \"offline_sync_snapshot\",\n  \"offline_sync_snapshot_stream\",\n  \"offline_sync_files\",\n  \"offline_sync_file_content\",\n  \"offline_sync_apply_file_content\",\n  \"offline_sync_apply\",\n  \"lcm_status\",\n  \"memory_list\",\n  \"recall_timings\",\n  \"entity_list\",\n  \"maintenance_status\",\n  \"quality_status\",\n  \"trust_zones_status\",\n  \"trust_zones_records\",\n  \"review_disposition\",\n  \"trust_zones_promote\",\n  \"trust_zones_demo_seed\",\n  \"citations_observed\",\n  \"contradiction_detail\",\n  \"graph_events\",\n  // Chat surface — conversational memory inspection/correction (issue #1583).\n  \"chat_message\",\n  \"chat_events\",\n] as const;\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Derived from\n * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog\n * used for token-capability validation cannot drift from the type. The\n * fitness test in `access-surface-catalog.test.ts` treats the registered set\n * as the migration state.\n */\nexport type OperationName = (typeof OPERATION_NAMES)[number];\n\n// ---------------------------------------------------------------------------\n// Operation context — what every handler receives\n// ---------------------------------------------------------------------------\n\n/**\n * Per-call context. `service` is the facade the handler delegates to; the\n * boundary never reaches past it. `authenticatedPrincipal` is resolved by\n * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary\n * runs, so handlers stay principal-source-agnostic. `hooks` carries\n * transport-level callbacks (e.g. HTTP write-quota enforcement) that must\n * fire atomically inside the service call; surfaces that have no such hook\n * leave it undefined.\n */\nexport interface OperationContext {\n  readonly service: EngramAccessService;\n  readonly authenticatedPrincipal?: string;\n  readonly operatorPrincipal?: string;\n  /** Per-request cancellation supplied by transports that own a request lifecycle. */\n  readonly abortSignal?: AbortSignal;\n  /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */\n  readonly sourceConnector?: string;\n  readonly hooks?: OperationHooks;\n}\n\n/**\n * Transport-level callbacks a handler forwards into the service call. Kept\n * narrow on purpose: the boundary owns validation + dispatch shape, not\n * transport policy. Add fields here only when a surface genuinely needs a\n * callback the service itself consumes.\n */\nexport interface OperationHooks {\n  /** HTTP write-quota gate; throws to reject the write when exhausted. */\n  readonly enforceWriteQuota?: () => void | Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Operation spec + bound operation\n// ---------------------------------------------------------------------------\n\nexport interface OperationSpec<In, Out> {\n  /** Canonical operation id; matches an {@link OperationName}. */\n  readonly name: OperationName;\n  readonly description: string;\n  /** Zod schema validating the raw request envelope. */\n  readonly schema: z.ZodType<In>;\n  /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */\n  readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;\n  /**\n   * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL\n   * namespaces (or against a single non-namespaced global layer) and carries no\n   * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint\n   * never applies. When set, {@link defineOperation}'s run wrapper rejects any\n   * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed\n   * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens\n   * (cron, internal callers, no capability record) are unaffected (issue #1850).\n   */\n  readonly fleetWide?: boolean;\n  /**\n   * Alternate op allow-list: when set, the token may invoke this operation if\n   * its ops allow-list permits ANY of these ops (instead of the default rule\n   * that requires the op's own {@link name}). Lets a read-only diagnostic be\n   * granted by the write ops it diagnoses — e.g. `namespace_writable` is\n   * runnable by any token permitted to `observe`/`memory_store`, so a token\n   * minted before the diagnostic op existed can still call it. Unrestricted /\n   * legacy tokens (no ops axis) are unaffected. Keeps the boundary and any HTTP\n   * transport for the same op enforcing ONE policy.\n   */\n  readonly allowedByOps?: readonly OperationName[];\n}\n\nexport interface BoundOperation<In = unknown, Out = unknown> {\n  readonly spec: OperationSpec<In, Out>;\n  /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */\n  readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;\n}\n\n// ---------------------------------------------------------------------------\n// Shared normalizers the boundary owns (rules 17, 28, 36, 48, 51)\n// ---------------------------------------------------------------------------\n\n/**\n * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans\n * and the string spellings clients send (\"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\n * \"on\"/\"off\", case-insensitive). Rejects anything else loudly — `Boolean(\"false\")`\n * would silently be `true`, which is the bug rule 36 exists to prevent.\n *\n * `undefined`/`null`/`\"\"` → `undefined`, so callers can keep treating an\n * absent flag as \"use the default\" without a separate presence check.\n */\nexport function coerceBooleanLike(value: unknown): boolean | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\") {\n    const lower = value.trim().toLowerCase();\n    if (lower === \"true\" || lower === \"1\" || lower === \"yes\" || lower === \"on\") return true;\n    if (lower === \"false\" || lower === \"0\" || lower === \"no\" || lower === \"off\") return false;\n  }\n  throw new EngramAccessInputError(\n    `expected a boolean-like value (true|false|1|0|yes|no|on|off); got ${JSON.stringify(value)}`,\n  );\n}\n\n/**\n * Coerce + validate a positive integer from a numeric string or number\n * (rule 28). Loosely-typed MCP/CLI clients send `\"5\"`; `typeof saved === \"number\"`\n * on read-back would reject it later, so we coerce at the edge and reject\n * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).\n *\n * `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function coercePositiveInteger(value: unknown, label: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return value;\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!/^[+-]?\\d+$/.test(trimmed)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    const parsed = Number(trimmed);\n    if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return parsed;\n  }\n  throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n}\n\n/**\n * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;\n * ad-hoc regex drifts. `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function normalizeOptionalPath(value: unknown): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new EngramAccessInputError(`expected a path string; got ${JSON.stringify(value)}`);\n  }\n  return expandTildePath(value);\n}\n\n// ---------------------------------------------------------------------------\n// Error formatting — rule 51: list valid options, never silently default\n// ---------------------------------------------------------------------------\n\n/**\n * Turn a zod failure into an {@link EngramAccessInputError} whose message\n * names the offending field and — for enum/union issues — lists the valid\n * options, so the caller can correct rather than guess (rule 51).\n */\nexport function formatZodIssues(error: z.ZodError): string {\n  const parts: string[] = [];\n  for (const issue of error.issues) {\n    // Collapse array-index paths (e.g. [\"currentContextScopes\", 1]) to\n    // the field name so the message reads \"field: must be ...\" not\n    // \"field.1: must be ...\".\n    const hasNumeric = issue.path.some((p) => typeof p === \"number\");\n    const path = hasNumeric\n      ? issue.path.filter((p) => typeof p === \"string\").join(\".\") || \"(root)\"\n      : issue.path.length > 0 ? issue.path.join(\".\") : \"(root)\";\n    const options = enumOptionsFromIssue(issue);\n    const suffix = options ? `. Valid: ${options.join(\", \")}` : \"\";\n    parts.push(`${path}: ${issue.message}${suffix}`);\n  }\n  return parts.length > 0\n    ? `request validation failed: ${parts.join(\"; \")}`\n    : \"request validation failed\";\n}\n\nfunction enumOptionsFromIssue(issue: z.ZodIssue): readonly string[] | undefined {\n  // zod exposes accepted enum values on the issue for ZodEnum / ZodNativeEnum\n  // and on the options of invalid_union discriminators. Reading them here\n  // keeps \"list valid options\" in ONE place rather than per handler.\n  if (issue.code === z.ZodIssueCode.invalid_enum_value) {\n    const rawOptions = (issue as { options?: unknown }).options;\n    if (Array.isArray(rawOptions)) {\n      return rawOptions.map((opt) => String(opt));\n    }\n  }\n  return undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\nconst registry = new Map<OperationName, BoundOperation>();\n\n/**\n * Register an operation. Throws if the name is already registered — duplicate\n * registration is a programming error, not a runtime input fault, so it throws\n * a plain Error (not the input-error class surfaces translate for clients).\n */\n/**\n * Error map that converts Zod's generic type-mismatch messages into\n * human-readable \"must be a <type>\" messages (rule 51).  Applied at the\n * boundary chokepoint so every operation gets consistent messaging\n * without per-handler boilerplate.\n */\nconst humanReadableErrorMap: z.ZodErrorMap = (issue, ctx) => {\n  if (issue.code === z.ZodIssueCode.invalid_type) {\n    if (issue.received === \"undefined\") return { message: ctx.defaultError };\n    // Array-element type errors — collapse to field-level message.\n    if (issue.path.some((p) => typeof p === \"number\")) {\n      const arrField = issue.path.filter((p) => typeof p === \"string\").join(\".\");\n      return { message: `${arrField} must be an array of ${issue.expected}s` };\n    }\n    const fieldName = issue.path.length > 0 ? String(issue.path[issue.path.length - 1]) : \"value\";\n    switch (issue.expected) {\n      case \"string\": return { message: `${fieldName} must be a string` };\n      case \"boolean\": return { message: `${fieldName} must be a boolean` };\n      case \"number\": return { message: `${fieldName} must be a number` };\n      case \"array\": return { message: `${fieldName} must be an array` };\n      case \"object\": return { message: `${fieldName} must be an object` };\n      default: return { message: ctx.defaultError };\n    }\n  }\n  return { message: ctx.defaultError };\n};\n\nexport function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out> {\n  if (registry.has(spec.name)) {\n    throw new Error(`access-boundary: operation already registered: ${spec.name}`);\n  }\n  const bound: BoundOperation<In, Out> = {\n    spec,\n    run: async (rawInput, ctx) => {\n      const parseResult = spec.schema.safeParse(rawInput, { errorMap: humanReadableErrorMap });\n      if (!parseResult.success) {\n        throw new EngramAccessInputError(formatZodIssues(parseResult.error));\n      }\n      // Per-token capability enforcement (issue #1837): when the presenting\n      // token carries an ops allow-list, reject operations not in it. The\n      // capability record is carried via AsyncLocalStorage, set once per\n      // authorized HTTP/MCP request; absent (CLI/tests/direct callers) ⇒\n      // unrestricted. Default-deny ONLY when an ops axis is present — legacy\n      // tokens (absent record) and explicit-unrestricted new tokens are\n      // unaffected.\n      // When the op declares alternate grant ops, permit any of them (so the\n      // batch/MCP path matches an HTTP transport that relaxes the same op);\n      // otherwise the token must carry the op's own name. Unrestricted/legacy\n      // tokens pass either way (capabilityAllowsOp is true when no ops axis).\n      if (spec.allowedByOps && spec.allowedByOps.length > 0) {\n        const store = tokenCapabilityStore.getStore();\n        if (!spec.allowedByOps.some((op) => capabilityAllowsOp(store, op))) {\n          throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${spec.name}`);\n        }\n      } else {\n        assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);\n      }\n      // Fleet-wide / global maintenance ops (issue #1850 round 10): these run\n      // across all namespaces with no `namespace` arg, so the tools/call\n      // effective-namespace gate never fires. A namespace-SCOPED token must not\n      // trigger cross-namespace maintenance — fail closed BEFORE the handler so\n      // a denial never leaks a partial mutation. No-op for unrestricted/legacy.\n      if (spec.fleetWide) {\n        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());\n      }\n      return spec.handler(parseResult.data, ctx);\n    },\n  };\n  // Store under the canonical name; the cast is safe because In/Out are\n  // erased at the registry boundary and recovered by callers via getOperation.\n  registry.set(spec.name, bound as unknown as BoundOperation);\n  return bound;\n}\n\n/** Look up a registered operation by canonical name. */\nexport function getOperation(name: OperationName): BoundOperation | undefined {\n  return registry.get(name);\n}\n\n/** All registered operation names. */\nexport function listRegisteredOperations(): readonly OperationName[] {\n  return [...registry.keys()];\n}\n\n/** Test-only: clear the registry so pilot definitions can be re-registered. */\nexport function __resetRegistryForTest(): void {\n  registry.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiBA,SAAS,SAAS;AAsBX,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AAqGO,SAAS,kBAAkB,OAAqC;AACrE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,MAAM,KAAK,EAAE,YAAY;AACvC,QAAI,UAAU,UAAU,UAAU,OAAO,UAAU,SAAS,UAAU,KAAM,QAAO;AACnF,QAAI,UAAU,WAAW,UAAU,OAAO,UAAU,QAAQ,UAAU,MAAO,QAAO;AAAA,EACtF;AACA,QAAM,IAAI;AAAA,IACR,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,EAC5F;AACF;AAUO,SAAS,sBAAsB,OAAgB,OAAmC;AACvF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,KAAK,GAAG;AACrE,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAAG;AAChD,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AACtG;AAMO,SAAS,sBAAsB,OAAoC;AACxE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,uBAAuB,+BAA+B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EACzF;AACA,SAAO,gBAAgB,KAAK;AAC9B;AAWO,SAAS,gBAAgB,OAA2B;AACzD,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,MAAM,QAAQ;AAIhC,UAAM,aAAa,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC/D,UAAM,OAAO,aACT,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,WAC7D,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AACnD,UAAM,UAAU,qBAAqB,KAAK;AAC1C,UAAM,SAAS,UAAU,YAAY,QAAQ,KAAK,IAAI,CAAC,KAAK;AAC5D,UAAM,KAAK,GAAG,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD;AACA,SAAO,MAAM,SAAS,IAClB,8BAA8B,MAAM,KAAK,IAAI,CAAC,KAC9C;AACN;AAEA,SAAS,qBAAqB,OAAkD;AAI9E,MAAI,MAAM,SAAS,EAAE,aAAa,oBAAoB;AACpD,UAAM,aAAc,MAAgC;AACpD,QAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,aAAO,WAAW,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,IAAM,WAAW,oBAAI,IAAmC;AAaxD,IAAM,wBAAuC,CAAC,OAAO,QAAQ;AAC3D,MAAI,MAAM,SAAS,EAAE,aAAa,cAAc;AAC9C,QAAI,MAAM,aAAa,YAAa,QAAO,EAAE,SAAS,IAAI,aAAa;AAEvE,QAAI,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAG;AACjD,YAAM,WAAW,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AACzE,aAAO,EAAE,SAAS,GAAG,QAAQ,wBAAwB,MAAM,QAAQ,IAAI;AAAA,IACzE;AACA,UAAM,YAAY,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI;AACtF,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAW,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MACnE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAS,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MAChE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MAClE;AAAS,eAAO,EAAE,SAAS,IAAI,aAAa;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,IAAI,aAAa;AACrC;AAEO,SAAS,gBAAyB,MAAuD;AAC9F,MAAI,SAAS,IAAI,KAAK,IAAI,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD,KAAK,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,QAAiC;AAAA,IACrC;AAAA,IACA,KAAK,OAAO,UAAU,QAAQ;AAC5B,YAAM,cAAc,KAAK,OAAO,UAAU,UAAU,EAAE,UAAU,sBAAsB,CAAC;AACvF,UAAI,CAAC,YAAY,SAAS;AACxB,cAAM,IAAI,uBAAuB,gBAAgB,YAAY,KAAK,CAAC;AAAA,MACrE;AAYA,UAAI,KAAK,gBAAgB,KAAK,aAAa,SAAS,GAAG;AACrD,cAAM,QAAQ,qBAAqB,SAAS;AAC5C,YAAI,CAAC,KAAK,aAAa,KAAK,CAAC,OAAO,mBAAmB,OAAO,EAAE,CAAC,GAAG;AAClE,gBAAM,IAAI,2BAA2B,6CAA6C,KAAK,IAAI,EAAE;AAAA,QAC/F;AAAA,MACF,OAAO;AACL,+BAAuB,qBAAqB,SAAS,GAAG,KAAK,IAAI;AAAA,MACnE;AAMA,UAAI,KAAK,WAAW;AAClB,wCAAgC,qBAAqB,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,KAAK,QAAQ,YAAY,MAAM,GAAG;AAAA,IAC3C;AAAA,EACF;AAGA,WAAS,IAAI,KAAK,MAAM,KAAkC;AAC1D,SAAO;AACT;AAGO,SAAS,aAAa,MAAiD;AAC5E,SAAO,SAAS,IAAI,IAAI;AAC1B;AAGO,SAAS,2BAAqD;AACnE,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;AAGO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;","names":[]}

package/dist/chunk-KFZY2OFH.js

@@ -0,0 +1,42 @@
+// src/bounded-jsonl-state.ts
+var RECALL_IMPRESSIONS_ROTATE_KEEP_MAX = 1e3;
+function parseBoundedJsonlStateConfig(cfg, parseIntegerAtLeast) {
+  const recallImpressionsRotateKeep = parseIntegerAtLeast(
+    cfg.recallImpressionsRotateKeep,
+    5,
+    1,
+    "recallImpressionsRotateKeep"
+  );
+  if (recallImpressionsRotateKeep > RECALL_IMPRESSIONS_ROTATE_KEEP_MAX) {
+    throw new Error(
+      `recallImpressionsRotateKeep must be an integer between 1 and ${RECALL_IMPRESSIONS_ROTATE_KEEP_MAX}; got ${JSON.stringify(cfg.recallImpressionsRotateKeep)}`
+    );
+  }
+  return {
+    memoryLifecycleLedgerCompactBytes: parseIntegerAtLeast(
+      cfg.memoryLifecycleLedgerCompactBytes,
+      64 * 1024 * 1024,
+      0,
+      "memoryLifecycleLedgerCompactBytes"
+    ),
+    memoryLifecycleLedgerCompactMinIntervalMs: parseIntegerAtLeast(
+      cfg.memoryLifecycleLedgerCompactMinIntervalMs,
+      6 * 60 * 60 * 1e3,
+      6e4,
+      "memoryLifecycleLedgerCompactMinIntervalMs"
+    ),
+    recallImpressionsRotateBytes: parseIntegerAtLeast(
+      cfg.recallImpressionsRotateBytes,
+      32 * 1024 * 1024,
+      0,
+      "recallImpressionsRotateBytes"
+    ),
+    recallImpressionsRotateKeep
+  };
+}
+
+export {
+  RECALL_IMPRESSIONS_ROTATE_KEEP_MAX,
+  parseBoundedJsonlStateConfig
+};
+//# sourceMappingURL=chunk-KFZY2OFH.js.map

package/dist/chunk-KFZY2OFH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bounded-jsonl-state.ts"],"sourcesContent":["/**\n * Bounded JSONL state configuration (issue #1910).\n *\n * Extracted from `config.ts`/`types.ts` so the god-file line-count ratchets\n * (issue #1995) do not grow: `PluginConfig` extends the interface below and\n * `parseConfig` spreads `parseBoundedJsonlStateConfig`. No behavior change —\n * the knobs, defaults, and coercion rules are identical to the inline forms.\n */\n\n/** Knobs that bound the unbounded JSONL state files (issue #1910). */\nexport interface BoundedJsonlStateConfig {\n  /**\n   * Auto-compact `state/memory-lifecycle-ledger.jsonl` when it exceeds this many\n   * bytes, triggered off the debounced maintenance path. `0` disables. Default\n   * 64MB.\n   */\n  memoryLifecycleLedgerCompactBytes: number;\n  /**\n   * Minimum interval between auto-compactions of the lifecycle ledger, so a\n   * heavy rebuild cannot run back-to-back. Floored at 60s. Default 6h.\n   */\n  memoryLifecycleLedgerCompactMinIntervalMs: number;\n  /**\n   * Rotate `state/recall_impressions.jsonl` to `.1..N` when it exceeds this many\n   * bytes. `0` disables. Default 32MB.\n   */\n  recallImpressionsRotateBytes: number;\n  /**\n   * Number of rotated recall-impression archives to keep (`.1 .. .N`). Floored\n   * at 1 when rotation is enabled. Default 5.\n   */\n  recallImpressionsRotateKeep: number;\n}\n\n/** Integer coercion contract shared with `config.ts` (`parseIntegerAtLeast`). */\ntype IntegerParser = (value: unknown, fallback: number, min: number, keyName: string) => number;\n\n/**\n * Upper bound for `recallImpressionsRotateKeep`. Each retained slot costs one\n * rename under the held cross-process impressions lock on every rotation, so an\n * accidentally huge value (a `1000000` typo) would stall recall recording and\n * block other writers. 1000 archives is already far past any real retention\n * need; a larger request is REJECTED before it reaches the rotation loop (#2033).\n */\nexport const RECALL_IMPRESSIONS_ROTATE_KEEP_MAX = 1000;\n\n/**\n * Parse the bounded-state knobs. Numeric knobs accept CLI/overlay string forms\n * (Gotcha #28) via `coerceNumber`, then require an integer >= min. A\n * present-but-malformed or fractional value is REJECTED (throws) rather than\n * silently taking the default; only an absent value falls back. `0` survives\n * when `min` is 0, so the documented disable stays effective on every surface\n * (byte thresholds floor at 0, the min-interval at 60s, and the keep count at 1\n * so rotation always retains at least one archive).\n */\nexport function parseBoundedJsonlStateConfig(\n  cfg: Record<string, unknown>,\n  parseIntegerAtLeast: IntegerParser,\n): BoundedJsonlStateConfig {\n  const recallImpressionsRotateKeep = parseIntegerAtLeast(\n    cfg.recallImpressionsRotateKeep,\n    5,\n    1,\n    \"recallImpressionsRotateKeep\",\n  );\n  if (recallImpressionsRotateKeep > RECALL_IMPRESSIONS_ROTATE_KEEP_MAX) {\n    throw new Error(\n      `recallImpressionsRotateKeep must be an integer between 1 and `\n      + `${RECALL_IMPRESSIONS_ROTATE_KEEP_MAX}; got ${JSON.stringify(cfg.recallImpressionsRotateKeep)}`,\n    );\n  }\n  return {\n    memoryLifecycleLedgerCompactBytes: parseIntegerAtLeast(\n      cfg.memoryLifecycleLedgerCompactBytes,\n      64 * 1024 * 1024,\n      0,\n      \"memoryLifecycleLedgerCompactBytes\",\n    ),\n    memoryLifecycleLedgerCompactMinIntervalMs: parseIntegerAtLeast(\n      cfg.memoryLifecycleLedgerCompactMinIntervalMs,\n      6 * 60 * 60 * 1000,\n      60_000,\n      \"memoryLifecycleLedgerCompactMinIntervalMs\",\n    ),\n    recallImpressionsRotateBytes: parseIntegerAtLeast(\n      cfg.recallImpressionsRotateBytes,\n      32 * 1024 * 1024,\n      0,\n      \"recallImpressionsRotateBytes\",\n    ),\n    recallImpressionsRotateKeep,\n  };\n}\n"],"mappings":";AA4CO,IAAM,qCAAqC;AAW3C,SAAS,6BACd,KACA,qBACyB;AACzB,QAAM,8BAA8B;AAAA,IAClC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,8BAA8B,oCAAoC;AACpE,UAAM,IAAI;AAAA,MACR,gEACK,kCAAkC,SAAS,KAAK,UAAU,IAAI,2BAA2B,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,mCAAmC;AAAA,MACjC,IAAI;AAAA,MACJ,KAAK,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AAAA,IACA,2CAA2C;AAAA,MACzC,IAAI;AAAA,MACJ,IAAI,KAAK,KAAK;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,8BAA8B;AAAA,MAC5B,IAAI;AAAA,MACJ,KAAK,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-4OKLXWDZ.js → chunk-KNB7IBBU.js}

@@ -1,7 +1,7 @@
 import {
   TOKEN_CAPABILITIES_VERSION,
   normalizeCapabilities
-} from "./chunk-D7FOKIY5.js";
+} from "./chunk-7AMFUATK.js";
 import {
   resolveHomeDir
 } from "./chunk-JUC24CTX.js";
@@ -253,4 +253,4 @@ export {
   getAllValidTokensCached,
   resolveConnectorFromToken
 };
-//# sourceMappingURL=chunk-4OKLXWDZ.js.map
+//# sourceMappingURL=chunk-KNB7IBBU.js.map

package/dist/{chunk-QLULYKWZ.js → chunk-KSXJOC4F.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-JUC24CTX.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/connectors/codex-materialize.ts
 import {
@@ -694,4 +694,4 @@ export {
   truncateToTokenBudget,
   describeMemoriesDir
 };
-//# sourceMappingURL=chunk-QLULYKWZ.js.map
+//# sourceMappingURL=chunk-KSXJOC4F.js.map

package/dist/{chunk-2S6QHZGJ.js → chunk-L2DPF4DF.js}

@@ -703,4 +703,4 @@ export {
   applyPageRankRefinement,
   applyLateralInhibition
 };
-//# sourceMappingURL=chunk-2S6QHZGJ.js.map
+//# sourceMappingURL=chunk-L2DPF4DF.js.map

package/dist/{chunk-JI5AVXYO.js → chunk-LEPOP46W.js}

@@ -1,14 +1,14 @@
-import {
-  failOpenFaissHealth
-} from "./chunk-TN7THW5U.js";
 import {
   rebuildConversationChunksFailOpen,
   upsertConversationChunksFailOpen
-} from "./chunk-R5VAVVHP.js";
+} from "./chunk-72A4L5JJ.js";
 import {
   searchConversationIndex,
   searchConversationIndexFaissFailOpen
-} from "./chunk-FC77VUX5.js";
+} from "./chunk-A7Q43EUZ.js";
+import {
+  failOpenFaissHealth
+} from "./chunk-ET356KSB.js";
 
 // src/conversation-index/backend.ts
 function createConversationIndexBackend(options) {
@@ -235,4 +235,4 @@ function createFaissBackend(getFaiss) {
 export {
   createConversationIndexBackend
 };
-//# sourceMappingURL=chunk-JI5AVXYO.js.map
+//# sourceMappingURL=chunk-LEPOP46W.js.map

package/dist/{chunk-O7BBFJLP.js → chunk-LTAVSOZW.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-AQEJKOKI.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/lcm/archive.ts
 function estimateTokens(text) {
@@ -546,4 +546,4 @@ export {
   estimateTokens,
   LcmArchive
 };
-//# sourceMappingURL=chunk-O7BBFJLP.js.map
+//# sourceMappingURL=chunk-LTAVSOZW.js.map

package/dist/{chunk-E3VODCC3.js → chunk-LUDXM7MD.js}

@@ -108,10 +108,22 @@ async function rerankLocalOrNoop(opts) {
   }
   return rankedIds;
 }
+function reorderByRankedKeys(results, rankedKeys, keyOf) {
+  const byKey = new Map(results.map((r) => [keyOf(r), r]));
+  const reordered = [];
+  for (const key of rankedKeys) {
+    const it = byKey.get(key);
+    if (it) reordered.push(it);
+  }
+  const rankedSet = new Set(rankedKeys);
+  for (const r of results) if (!rankedSet.has(keyOf(r))) reordered.push(r);
+  return reordered;
+}
 
 export {
   RerankCache,
   parseRerankResponse,
-  rerankLocalOrNoop
+  rerankLocalOrNoop,
+  reorderByRankedKeys
 };
-//# sourceMappingURL=chunk-E3VODCC3.js.map
+//# sourceMappingURL=chunk-LUDXM7MD.js.map

package/dist/{chunk-E3VODCC3.js.map → chunk-LUDXM7MD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/rerank.ts"],"sourcesContent":["export interface RerankCandidate {\n  id: string;\n  originalIndex: number;\n}\n\nexport interface RerankScore {\n  id: string;\n  score: number;\n}\n\nexport interface RerankCacheEntry {\n  expiresAtMs: number;\n  rankedIds: string[];\n}\n\nexport class RerankCache {\n  private entries = new Map<string, RerankCacheEntry>();\n\n  get(key: string): string[] | null {\n    const e = this.entries.get(key);\n    if (!e) return null;\n    if (Date.now() > e.expiresAtMs) {\n      this.entries.delete(key);\n      return null;\n    }\n    return e.rankedIds.slice();\n  }\n\n  set(key: string, rankedIds: string[], ttlMs: number): void {\n    this.entries.set(key, { rankedIds: rankedIds.slice(), expiresAtMs: Date.now() + ttlMs });\n  }\n}\n\n/**\n * Parse a rerank response (JSON) and return candidates sorted by score.\n *\n * Rules:\n * - Unknown IDs in the response are ignored.\n * - Candidates missing from the response keep relative order after scored ones.\n * - Stable tie-breaker: originalIndex ascending.\n */\nexport function parseRerankResponse(\n  raw: string,\n  candidates: RerankCandidate[]\n): Array<RerankCandidate & { score?: number }> {\n  const byId = new Map<string, RerankCandidate>();\n  for (const c of candidates) byId.set(c.id, c);\n\n  const scores = new Map<string, number>();\n  try {\n    const parsed = JSON.parse(raw) as { scores?: Array<Partial<RerankScore>> };\n    if (Array.isArray(parsed.scores)) {\n      for (const s of parsed.scores) {\n        if (!s || typeof s.id !== \"string\") continue;\n        if (!byId.has(s.id)) continue;\n        if (typeof s.score !== \"number\" || !Number.isFinite(s.score)) continue;\n        scores.set(s.id, s.score);\n      }\n    }\n  } catch {\n    // Ignore parse errors and fall back to original order.\n  }\n\n  const withScore = candidates.map((c) => ({\n    ...c,\n    score: scores.get(c.id),\n  }));\n\n  return withScore.sort((a, b) => {\n    const as = a.score;\n    const bs = b.score;\n    if (typeof as === \"number\" && typeof bs === \"number\") {\n      if (bs !== as) return bs - as;\n      return a.originalIndex - b.originalIndex;\n    }\n    if (typeof as === \"number\") return -1;\n    if (typeof bs === \"number\") return 1;\n    return a.originalIndex - b.originalIndex;\n  });\n}\n\nfunction stableKey(query: string, ids: string[]): string {\n  // Keep candidate boundaries explicit; candidate IDs are arbitrary strings.\n  return JSON.stringify([query.trim().toLowerCase(), ids]);\n}\n\nfunction clampSnippet(snippet: string, maxChars: number): string {\n  const s = snippet.replace(/\\s+/g, \" \").trim();\n  return s.length > maxChars ? s.slice(0, maxChars) : s;\n}\n\nexport async function rerankLocalOrNoop(opts: {\n  query: string;\n  candidates: Array<{ id: string; snippet: string }>;\n  local: {\n    chatCompletion: (\n      messages: Array<{ role: string; content: string }>,\n      options?: {\n        maxTokens?: number;\n        temperature?: number;\n        timeoutMs?: number;\n        operation?: string;\n        priority?: \"recall-critical\" | \"background\";\n      }\n    ) => Promise<{ content: string } | null>;\n  };\n  enabled: boolean;\n  timeoutMs: number;\n  maxCandidates: number;\n  cache?: RerankCache;\n  cacheEnabled: boolean;\n  cacheTtlMs: number;\n}): Promise<string[] | null> {\n  if (!opts.enabled) return null;\n\n  const ids = opts.candidates.slice(0, opts.maxCandidates).map((c) => c.id);\n  if (ids.length <= 1) return ids;\n\n  const key = stableKey(opts.query, ids);\n  if (opts.cache && opts.cacheEnabled) {\n    const cached = opts.cache.get(key);\n    if (cached) return cached;\n  }\n\n  const payload = opts.candidates.slice(0, opts.maxCandidates).map((c) => ({\n    id: c.id,\n    snippet: clampSnippet(c.snippet, 400),\n  }));\n\n  const system = \"You are a ranking system. Return JSON only. No markdown, no commentary.\";\n  const user = JSON.stringify(\n    {\n      task: \"rerank\",\n      query: opts.query,\n      candidates: payload,\n      output: {\n        scores: [{ id: \"string\", score: \"number 0-100\" }],\n      },\n      rules: [\n        \"Assign higher score to more relevant candidates.\",\n        \"Prefer durability and direct relevance to the query.\",\n        \"If unsure, keep scores close together.\",\n      ],\n    },\n    null,\n    0\n  );\n\n  const res = await opts.local.chatCompletion(\n    [\n      { role: \"system\", content: system },\n      { role: \"user\", content: user },\n    ],\n    {\n      maxTokens: 800,\n      temperature: 0.0,\n      timeoutMs: opts.timeoutMs,\n      operation: \"rerank\",\n      priority: \"recall-critical\",\n    }\n  );\n  if (!res?.content) return null;\n\n  const parsed = parseRerankResponse(\n    res.content,\n    ids.map((id, i) => ({ id, originalIndex: i }))\n  );\n  const rankedIds = parsed.map((p) => p.id);\n\n  if (opts.cache && opts.cacheEnabled) {\n    opts.cache.set(key, rankedIds, opts.cacheTtlMs);\n  }\n\n  return rankedIds;\n}\n"],"mappings":";AAeO,IAAM,cAAN,MAAkB;AAAA,EACf,UAAU,oBAAI,IAA8B;AAAA,EAEpD,IAAI,KAA8B;AAChC,UAAM,IAAI,KAAK,QAAQ,IAAI,GAAG;AAC9B,QAAI,CAAC,EAAG,QAAO;AACf,QAAI,KAAK,IAAI,IAAI,EAAE,aAAa;AAC9B,WAAK,QAAQ,OAAO,GAAG;AACvB,aAAO;AAAA,IACT;AACA,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AAAA,EAEA,IAAI,KAAa,WAAqB,OAAqB;AACzD,SAAK,QAAQ,IAAI,KAAK,EAAE,WAAW,UAAU,MAAM,GAAG,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,EACzF;AACF;AAUO,SAAS,oBACd,KACA,YAC6C;AAC7C,QAAM,OAAO,oBAAI,IAA6B;AAC9C,aAAW,KAAK,WAAY,MAAK,IAAI,EAAE,IAAI,CAAC;AAE5C,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChC,iBAAW,KAAK,OAAO,QAAQ;AAC7B,YAAI,CAAC,KAAK,OAAO,EAAE,OAAO,SAAU;AACpC,YAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAAG;AACrB,YAAI,OAAO,EAAE,UAAU,YAAY,CAAC,OAAO,SAAS,EAAE,KAAK,EAAG;AAC9D,eAAO,IAAI,EAAE,IAAI,EAAE,KAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,IACvC,GAAG;AAAA,IACH,OAAO,OAAO,IAAI,EAAE,EAAE;AAAA,EACxB,EAAE;AAEF,SAAO,UAAU,KAAK,CAAC,GAAG,MAAM;AAC9B,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,UAAU;AACpD,UAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,aAAO,EAAE,gBAAgB,EAAE;AAAA,IAC7B;AACA,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,WAAO,EAAE,gBAAgB,EAAE;AAAA,EAC7B,CAAC;AACH;AAEA,SAAS,UAAU,OAAe,KAAuB;AAEvD,SAAO,KAAK,UAAU,CAAC,MAAM,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AACzD;AAEA,SAAS,aAAa,SAAiB,UAA0B;AAC/D,QAAM,IAAI,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC5C,SAAO,EAAE,SAAS,WAAW,EAAE,MAAM,GAAG,QAAQ,IAAI;AACtD;AAEA,eAAsB,kBAAkB,MAqBX;AAC3B,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,MAAM,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACxE,MAAI,IAAI,UAAU,EAAG,QAAO;AAE5B,QAAM,MAAM,UAAU,KAAK,OAAO,GAAG;AACrC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,UAAM,SAAS,KAAK,MAAM,IAAI,GAAG;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,UAAU,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,OAAO;AAAA,IACvE,IAAI,EAAE;AAAA,IACN,SAAS,aAAa,EAAE,SAAS,GAAG;AAAA,EACtC,EAAE;AAEF,QAAM,SAAS;AACf,QAAM,OAAO,KAAK;AAAA,IAChB;AAAA,MACE,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,YAAY;AAAA,MACZ,QAAQ;AAAA,QACN,QAAQ,CAAC,EAAE,IAAI,UAAU,OAAO,eAAe,CAAC;AAAA,MAClD;AAAA,MACA,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,KAAK,MAAM;AAAA,IAC3B;AAAA,MACE,EAAE,MAAM,UAAU,SAAS,OAAO;AAAA,MAClC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,SAAS;AAAA,IACb,IAAI;AAAA,IACJ,IAAI,IAAI,CAAC,IAAI,OAAO,EAAE,IAAI,eAAe,EAAE,EAAE;AAAA,EAC/C;AACA,QAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE;AAExC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,SAAK,MAAM,IAAI,KAAK,WAAW,KAAK,UAAU;AAAA,EAChD;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/rerank.ts"],"sourcesContent":["export interface RerankCandidate {\n  id: string;\n  originalIndex: number;\n}\n\nexport interface RerankScore {\n  id: string;\n  score: number;\n}\n\nexport interface RerankCacheEntry {\n  expiresAtMs: number;\n  rankedIds: string[];\n}\n\nexport class RerankCache {\n  private entries = new Map<string, RerankCacheEntry>();\n\n  get(key: string): string[] | null {\n    const e = this.entries.get(key);\n    if (!e) return null;\n    if (Date.now() > e.expiresAtMs) {\n      this.entries.delete(key);\n      return null;\n    }\n    return e.rankedIds.slice();\n  }\n\n  set(key: string, rankedIds: string[], ttlMs: number): void {\n    this.entries.set(key, { rankedIds: rankedIds.slice(), expiresAtMs: Date.now() + ttlMs });\n  }\n}\n\n/**\n * Parse a rerank response (JSON) and return candidates sorted by score.\n *\n * Rules:\n * - Unknown IDs in the response are ignored.\n * - Candidates missing from the response keep relative order after scored ones.\n * - Stable tie-breaker: originalIndex ascending.\n */\nexport function parseRerankResponse(\n  raw: string,\n  candidates: RerankCandidate[]\n): Array<RerankCandidate & { score?: number }> {\n  const byId = new Map<string, RerankCandidate>();\n  for (const c of candidates) byId.set(c.id, c);\n\n  const scores = new Map<string, number>();\n  try {\n    const parsed = JSON.parse(raw) as { scores?: Array<Partial<RerankScore>> };\n    if (Array.isArray(parsed.scores)) {\n      for (const s of parsed.scores) {\n        if (!s || typeof s.id !== \"string\") continue;\n        if (!byId.has(s.id)) continue;\n        if (typeof s.score !== \"number\" || !Number.isFinite(s.score)) continue;\n        scores.set(s.id, s.score);\n      }\n    }\n  } catch {\n    // Ignore parse errors and fall back to original order.\n  }\n\n  const withScore = candidates.map((c) => ({\n    ...c,\n    score: scores.get(c.id),\n  }));\n\n  return withScore.sort((a, b) => {\n    const as = a.score;\n    const bs = b.score;\n    if (typeof as === \"number\" && typeof bs === \"number\") {\n      if (bs !== as) return bs - as;\n      return a.originalIndex - b.originalIndex;\n    }\n    if (typeof as === \"number\") return -1;\n    if (typeof bs === \"number\") return 1;\n    return a.originalIndex - b.originalIndex;\n  });\n}\n\nfunction stableKey(query: string, ids: string[]): string {\n  // Keep candidate boundaries explicit; candidate IDs are arbitrary strings.\n  return JSON.stringify([query.trim().toLowerCase(), ids]);\n}\n\nfunction clampSnippet(snippet: string, maxChars: number): string {\n  const s = snippet.replace(/\\s+/g, \" \").trim();\n  return s.length > maxChars ? s.slice(0, maxChars) : s;\n}\n\nexport async function rerankLocalOrNoop(opts: {\n  query: string;\n  candidates: Array<{ id: string; snippet: string }>;\n  local: {\n    chatCompletion: (\n      messages: Array<{ role: string; content: string }>,\n      options?: {\n        maxTokens?: number;\n        temperature?: number;\n        timeoutMs?: number;\n        operation?: string;\n        priority?: \"recall-critical\" | \"background\";\n      }\n    ) => Promise<{ content: string } | null>;\n  };\n  enabled: boolean;\n  timeoutMs: number;\n  maxCandidates: number;\n  cache?: RerankCache;\n  cacheEnabled: boolean;\n  cacheTtlMs: number;\n}): Promise<string[] | null> {\n  if (!opts.enabled) return null;\n\n  const ids = opts.candidates.slice(0, opts.maxCandidates).map((c) => c.id);\n  if (ids.length <= 1) return ids;\n\n  const key = stableKey(opts.query, ids);\n  if (opts.cache && opts.cacheEnabled) {\n    const cached = opts.cache.get(key);\n    if (cached) return cached;\n  }\n\n  const payload = opts.candidates.slice(0, opts.maxCandidates).map((c) => ({\n    id: c.id,\n    snippet: clampSnippet(c.snippet, 400),\n  }));\n\n  const system = \"You are a ranking system. Return JSON only. No markdown, no commentary.\";\n  const user = JSON.stringify(\n    {\n      task: \"rerank\",\n      query: opts.query,\n      candidates: payload,\n      output: {\n        scores: [{ id: \"string\", score: \"number 0-100\" }],\n      },\n      rules: [\n        \"Assign higher score to more relevant candidates.\",\n        \"Prefer durability and direct relevance to the query.\",\n        \"If unsure, keep scores close together.\",\n      ],\n    },\n    null,\n    0\n  );\n\n  const res = await opts.local.chatCompletion(\n    [\n      { role: \"system\", content: system },\n      { role: \"user\", content: user },\n    ],\n    {\n      maxTokens: 800,\n      temperature: 0.0,\n      timeoutMs: opts.timeoutMs,\n      operation: \"rerank\",\n      priority: \"recall-critical\",\n    }\n  );\n  if (!res?.content) return null;\n\n  const parsed = parseRerankResponse(\n    res.content,\n    ids.map((id, i) => ({ id, originalIndex: i }))\n  );\n  const rankedIds = parsed.map((p) => p.id);\n\n  if (opts.cache && opts.cacheEnabled) {\n    opts.cache.set(key, rankedIds, opts.cacheTtlMs);\n  }\n\n  return rankedIds;\n}\n\n/**\n * Reorder `results` to match `rankedKeys` (a ranker's output order), keying by\n * `keyOf`. Items not present in `rankedKeys` are appended in their original\n * order. `keyOf` must return a stable identity (e.g. namespace-qualified) so\n * same-relative-path items across namespaces are not conflated.\n */\nexport function reorderByRankedKeys<T>(\n  results: readonly T[],\n  rankedKeys: readonly string[],\n  keyOf: (item: T) => string,\n): T[] {\n  const byKey = new Map(results.map((r) => [keyOf(r), r]));\n  const reordered: T[] = [];\n  for (const key of rankedKeys) {\n    const it = byKey.get(key);\n    if (it) reordered.push(it);\n  }\n  const rankedSet = new Set(rankedKeys);\n  for (const r of results) if (!rankedSet.has(keyOf(r))) reordered.push(r);\n  return reordered;\n}\n"],"mappings":";AAeO,IAAM,cAAN,MAAkB;AAAA,EACf,UAAU,oBAAI,IAA8B;AAAA,EAEpD,IAAI,KAA8B;AAChC,UAAM,IAAI,KAAK,QAAQ,IAAI,GAAG;AAC9B,QAAI,CAAC,EAAG,QAAO;AACf,QAAI,KAAK,IAAI,IAAI,EAAE,aAAa;AAC9B,WAAK,QAAQ,OAAO,GAAG;AACvB,aAAO;AAAA,IACT;AACA,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AAAA,EAEA,IAAI,KAAa,WAAqB,OAAqB;AACzD,SAAK,QAAQ,IAAI,KAAK,EAAE,WAAW,UAAU,MAAM,GAAG,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,EACzF;AACF;AAUO,SAAS,oBACd,KACA,YAC6C;AAC7C,QAAM,OAAO,oBAAI,IAA6B;AAC9C,aAAW,KAAK,WAAY,MAAK,IAAI,EAAE,IAAI,CAAC;AAE5C,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChC,iBAAW,KAAK,OAAO,QAAQ;AAC7B,YAAI,CAAC,KAAK,OAAO,EAAE,OAAO,SAAU;AACpC,YAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAAG;AACrB,YAAI,OAAO,EAAE,UAAU,YAAY,CAAC,OAAO,SAAS,EAAE,KAAK,EAAG;AAC9D,eAAO,IAAI,EAAE,IAAI,EAAE,KAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,IACvC,GAAG;AAAA,IACH,OAAO,OAAO,IAAI,EAAE,EAAE;AAAA,EACxB,EAAE;AAEF,SAAO,UAAU,KAAK,CAAC,GAAG,MAAM;AAC9B,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,UAAU;AACpD,UAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,aAAO,EAAE,gBAAgB,EAAE;AAAA,IAC7B;AACA,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,WAAO,EAAE,gBAAgB,EAAE;AAAA,EAC7B,CAAC;AACH;AAEA,SAAS,UAAU,OAAe,KAAuB;AAEvD,SAAO,KAAK,UAAU,CAAC,MAAM,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AACzD;AAEA,SAAS,aAAa,SAAiB,UAA0B;AAC/D,QAAM,IAAI,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC5C,SAAO,EAAE,SAAS,WAAW,EAAE,MAAM,GAAG,QAAQ,IAAI;AACtD;AAEA,eAAsB,kBAAkB,MAqBX;AAC3B,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,MAAM,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACxE,MAAI,IAAI,UAAU,EAAG,QAAO;AAE5B,QAAM,MAAM,UAAU,KAAK,OAAO,GAAG;AACrC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,UAAM,SAAS,KAAK,MAAM,IAAI,GAAG;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,UAAU,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,OAAO;AAAA,IACvE,IAAI,EAAE;AAAA,IACN,SAAS,aAAa,EAAE,SAAS,GAAG;AAAA,EACtC,EAAE;AAEF,QAAM,SAAS;AACf,QAAM,OAAO,KAAK;AAAA,IAChB;AAAA,MACE,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,YAAY;AAAA,MACZ,QAAQ;AAAA,QACN,QAAQ,CAAC,EAAE,IAAI,UAAU,OAAO,eAAe,CAAC;AAAA,MAClD;AAAA,MACA,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,KAAK,MAAM;AAAA,IAC3B;AAAA,MACE,EAAE,MAAM,UAAU,SAAS,OAAO;AAAA,MAClC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,SAAS;AAAA,IACb,IAAI;AAAA,IACJ,IAAI,IAAI,CAAC,IAAI,OAAO,EAAE,IAAI,eAAe,EAAE,EAAE;AAAA,EAC/C;AACA,QAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE;AAExC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,SAAK,MAAM,IAAI,KAAK,WAAW,KAAK,UAAU;AAAA,EAChD;AAEA,SAAO;AACT;AAQO,SAAS,oBACd,SACA,YACA,OACK;AACL,QAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,QAAM,YAAiB,CAAC;AACxB,aAAW,OAAO,YAAY;AAC5B,UAAM,KAAK,MAAM,IAAI,GAAG;AACxB,QAAI,GAAI,WAAU,KAAK,EAAE;AAAA,EAC3B;AACA,QAAM,YAAY,IAAI,IAAI,UAAU;AACpC,aAAW,KAAK,QAAS,KAAI,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,EAAG,WAAU,KAAK,CAAC;AACvE,SAAO;AACT;","names":[]}

package/dist/{chunk-2IZAGAJR.js → chunk-LULR4IUW.js}

@@ -1,9 +1,9 @@
 import {
   writeFileAtomically
-} from "./chunk-SFQ6QNL7.js";
+} from "./chunk-R6YJI3HE.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/relevance.ts
 import { mkdir, readFile } from "fs/promises";
@@ -75,4 +75,4 @@ var RelevanceStore = class {
 export {
   RelevanceStore
 };
-//# sourceMappingURL=chunk-2IZAGAJR.js.map
+//# sourceMappingURL=chunk-LULR4IUW.js.map