@securecoms/agent-bridge 0.27.0 → 0.28.0

package/dist/embedder.js

@@ -0,0 +1,1574 @@
+// src/memory/embedder/embedder-main.ts
+import { Worker } from "node:worker_threads";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/memory/embedder/engine.ts
+import { createHash } from "node:crypto";
+var HashMismatch = class extends Error {
+};
+function verifyBuffer(bytes2, sha256, size) {
+  if (bytes2.length !== size || createHash("sha256").update(bytes2).digest("hex") !== sha256) throw new HashMismatch("embedder file mismatch");
+}
+
+// src/memory/embedder/manifest.ts
+var file = (modelId, name, sha256, size) => Object.freeze({ name, urlPath: `/models/embeddings/${modelId}/${sha256}/${name}`, sha256, size });
+var MODEL_ID = "minilm-l6-v2-int8";
+var EMBEDDING_MANIFEST = Object.freeze({
+  modelId: MODEL_ID,
+  dims: 384,
+  maxTokens: 256,
+  pooling: "mean",
+  normalize: true,
+  similarityThreshold: 0.19,
+  onnxInputs: Object.freeze(["input_ids", "attention_mask", "token_type_ids"]),
+  onnxOutput: "last_hidden_state",
+  wasmSha256: "ec8580a9d7b9476ceee52e10a7f94124e4dc71a019d666ed6d4726697c109a4d",
+  wasmSize: 13961845,
+  files: Object.freeze([
+    file(MODEL_ID, "model.onnx", "afdb6f1a0e45b715d0bb9b11772f032c399babd23bfc31fed1c170afc848bdb1", 22972370),
+    file(MODEL_ID, "vocab.txt", "07eced375cec144d27c900241f3e339478dec958f92fddbc551f295c992038a3", 231508),
+    file(MODEL_ID, "LICENSE", "d83f8f68a86e308e30d1ddf3d1b9984500f0c39ab8a1c7d274ab2799c21155b4", 9934),
+    file(MODEL_ID, "NOTICE", "99446995c7800bd9ce033f24c477b00daa50f06da85e441e903f4ce1e32c7507", 320)
+  ])
+});
+var TOKENIZER_OPTIONS = Object.freeze({
+  lowercase: true,
+  stripAccents: true,
+  unkToken: "[UNK]",
+  unknownDropped: false,
+  addSpecialTokens: true,
+  maxInputCharsPerWord: 100
+});
+
+// src/memory/embedder/layout.ts
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+var defaultModelsRoot = (home = homedir()) => join(home, ".securecoms", "models", "embeddings");
+var filePath = (root, modelId, f2) => join(root, modelId, f2.sha256, f2.name);
+
+// src/memory/embedder/embedder-paths.ts
+import { createHash as createHash2 } from "node:crypto";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// src/memory/embedder/protocol.ts
+import { StringDecoder } from "node:string_decoder";
+var EMBEDDER_PROTOCOL = 1;
+var MAX_TEXT_BYTES = 8192;
+var MAX_LINE_BYTES = 69632;
+function encodeVec64(v) {
+  const b = Buffer.alloc(v.length * 4);
+  for (let i = 0; i < v.length; i++) b.writeFloatLE(v[i], i * 4);
+  return b.toString("base64");
+}
+function lineReader(onLine, onOverflow, maxLine = MAX_LINE_BYTES) {
+  const dec = new StringDecoder("utf8");
+  let buf = "";
+  let dead = false;
+  const cap = () => typeof maxLine === "function" ? maxLine() : maxLine;
+  const overflow = () => {
+    dead = true;
+    buf = "";
+    onOverflow();
+  };
+  return (chunk) => {
+    if (dead) return;
+    buf += dec.write(chunk);
+    let i;
+    while ((i = buf.indexOf("\n")) >= 0) {
+      const line = buf.slice(0, i);
+      buf = buf.slice(i + 1);
+      if (Buffer.byteLength(line) > cap()) {
+        overflow();
+        return;
+      }
+      if (line) onLine(line);
+    }
+    if (Buffer.byteLength(buf) > cap()) overflow();
+  };
+}
+
+// src/memory/embedder/embedder-paths.ts
+function embedderKey(m) {
+  const model = m.files.find((f2) => f2.name === "model.onnx");
+  return createHash2("sha256").update(`${EMBEDDER_PROTOCOL}\0${m.modelId}\0${model.sha256}\0${m.wasmSha256}`).digest("hex").slice(0, 16);
+}
+var embedderRunDir = (home = homedir2()) => join2(home, ".securecoms", "run", "embedder");
+var embedderPaths = (dir2, key2) => ({
+  sock: join2(dir2, `${key2}.sock`),
+  token: join2(dir2, `${key2}.token`),
+  lock: join2(dir2, `${key2}.spawn.lock`),
+  status: join2(dir2, `${key2}.status`),
+  pid: join2(dir2, `${key2}.pid`)
+  // E1 delta H1: the instance's lifetime lock
+});
+var SOCKET_PATH_MAX = 103;
+var windowsRunDir = (env = process.env) => {
+  if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA unset");
+  return join2(env.LOCALAPPDATA, "SecureComs", "run", "embedder");
+};
+
+// src/memory/embedder/run-dir.ts
+import { existsSync, lstatSync, mkdirSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+var RunDirRefused = class extends Error {
+};
+function ensureRunDir(dir2, uid = process.getuid?.() ?? -1, lstat = lstatSync) {
+  const parent = dirname2(dir2);
+  if (!existsSync(parent)) mkdirSync(parent, { recursive: true, mode: 448 });
+  const ps = lstat(parent);
+  if (ps.isSymbolicLink() || !ps.isDirectory()) throw new RunDirRefused("run directory parent is not a real directory");
+  if (ps.uid !== uid) throw new RunDirRefused("run directory parent is not owned by this user");
+  if ((ps.mode & 18) !== 0) throw new RunDirRefused("run directory parent is group or world writable");
+  try {
+    mkdirSync(dir2, { mode: 448 });
+  } catch (e) {
+    if (e.code !== "EEXIST") throw e;
+  }
+  const st = lstat(dir2);
+  if (st.isSymbolicLink() || !st.isDirectory()) throw new RunDirRefused("run directory is not a real directory");
+  if (st.uid !== uid) throw new RunDirRefused("run directory is not owned by this user");
+  if ((st.mode & 511) !== 448) throw new RunDirRefused("run directory mode is not 0700");
+}
+
+// src/memory/embedder/server.ts
+import { createServer, connect } from "node:net";
+import { randomBytes as randomBytes4 } from "node:crypto";
+
+// src/memory/embedder/handshake.ts
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+var PREAUTH_MAX_CONNECTIONS = 64;
+var PREAUTH_MAX_LINE = 256;
+var PREAUTH_TIMEOUT_MS = 250;
+var PREAUTH_MAX_CONNECTIONS_TCP = 8;
+var nonce = () => randomBytes(16).toString("hex");
+var mac = (token, side, ns, nc, protocol) => createHmac("sha256", Buffer.from(token, "hex")).update(`${side}:${protocol}:${ns}:${nc}`).digest("hex");
+var macClient = (token, ns, nc, protocol = EMBEDDER_PROTOCOL) => mac(token, "c", ns, nc, protocol);
+var macServer = (token, ns, nc, protocol = EMBEDDER_PROTOCOL) => mac(token, "s", ns, nc, protocol);
+function macEqual(a, b) {
+  if (!/^[0-9a-f]{64}$/.test(a) || !/^[0-9a-f]{64}$/.test(b)) return false;
+  return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+}
+
+// src/memory/embedder/session.ts
+import { hkdfSync, randomBytes as randomBytes2 } from "node:crypto";
+
+// ../../node_modules/@noble/ciphers/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function abool(b) {
+  if (typeof b !== "boolean")
+    throw new Error(`boolean expected, not ${b}`);
+}
+function anumber(n) {
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new Error("positive integer expected, got " + n);
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data2) {
+  if (typeof data2 === "string")
+    data2 = utf8ToBytes(data2);
+  else if (isBytes(data2))
+    data2 = copyBytes(data2);
+  else
+    throw new Error("Uint8Array expected, got " + typeof data2);
+  return data2;
+}
+function checkOpts(defaults, opts) {
+  if (opts == null || typeof opts !== "object")
+    throw new Error("options must be defined");
+  const merged = Object.assign(defaults, opts);
+  return merged;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key2, ...args) {
+    abytes(key2);
+    if (!isLE)
+      throw new Error("Non little-endian hardware is not yet supported");
+    if (params.nonceLength !== void 0) {
+      const nonce2 = args[0];
+      if (!nonce2)
+        throw new Error("nonce / iv required");
+      if (params.varSizeNonce)
+        abytes(nonce2);
+      else
+        abytes(nonce2, params.nonceLength);
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0) {
+      abytes(args[1]);
+    }
+    const cipher = constructor(key2, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes(output);
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data2, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes(data2);
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data2, output);
+      },
+      decrypt(data2, output) {
+        abytes(data2);
+        if (tagl && data2.length < tagl)
+          throw new Error("invalid ciphertext length: smaller than tagLength=" + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data2, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  if (out.length !== expectedLength)
+    throw new Error("invalid output length, expected " + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function setBigUint64(view, byteOffset, value, isLE2) {
+  if (typeof view.setBigUint64 === "function")
+    return view.setBigUint64(byteOffset, value, isLE2);
+  const _32n = BigInt(32);
+  const _u32_max = BigInt(4294967295);
+  const wh = Number(value >> _32n & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = isLE2 ? 4 : 0;
+  const l = isLE2 ? 0 : 4;
+  view.setUint32(byteOffset + h, wh, isLE2);
+  view.setUint32(byteOffset + l, wl, isLE2);
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  abool(isLE2);
+  const num = new Uint8Array(16);
+  const view = createView(num);
+  setBigUint64(view, 0, BigInt(aadLength), isLE2);
+  setBigUint64(view, 8, BigInt(dataLength), isLE2);
+  return num;
+}
+function isAligned32(bytes2) {
+  return bytes2.byteOffset % 4 === 0;
+}
+function copyBytes(bytes2) {
+  return Uint8Array.from(bytes2);
+}
+
+// ../../node_modules/@noble/ciphers/esm/_arx.js
+var _utf8ToBytes = (str) => Uint8Array.from(str.split("").map((c) => c.charCodeAt(0)));
+var sigma16 = _utf8ToBytes("expand 16-byte k");
+var sigma32 = _utf8ToBytes("expand 32-byte k");
+var sigma16_32 = u32(sigma16);
+var sigma32_32 = u32(sigma32);
+function rotl(a, b) {
+  return a << b | a >>> 32 - b;
+}
+function isAligned322(b) {
+  return b.byteOffset % 4 === 0;
+}
+var BLOCK_LEN = 64;
+var BLOCK_LEN32 = 16;
+var MAX_COUNTER = 2 ** 32 - 1;
+var U32_EMPTY = new Uint32Array();
+function runCipher(core, sigma, key2, nonce2, data2, output, counter, rounds) {
+  const len = data2.length;
+  const block = new Uint8Array(BLOCK_LEN);
+  const b32 = u32(block);
+  const isAligned = isAligned322(data2) && isAligned322(output);
+  const d32 = isAligned ? u32(data2) : U32_EMPTY;
+  const o32 = isAligned ? u32(output) : U32_EMPTY;
+  for (let pos = 0; pos < len; counter++) {
+    core(sigma, key2, nonce2, b32, counter, rounds);
+    if (counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    const take = Math.min(BLOCK_LEN, len - pos);
+    if (isAligned && take === BLOCK_LEN) {
+      const pos32 = pos / 4;
+      if (pos % 4 !== 0)
+        throw new Error("arx: invalid block position");
+      for (let j = 0, posj; j < BLOCK_LEN32; j++) {
+        posj = pos32 + j;
+        o32[posj] = d32[posj] ^ b32[j];
+      }
+      pos += BLOCK_LEN;
+      continue;
+    }
+    for (let j = 0, posj; j < take; j++) {
+      posj = pos + j;
+      output[posj] = data2[posj] ^ block[j];
+    }
+    pos += take;
+  }
+}
+function createCipher(core, opts) {
+  const { allowShortKeys, extendNonceFn, counterLength, counterRight, rounds } = checkOpts({ allowShortKeys: false, counterLength: 8, counterRight: false, rounds: 20 }, opts);
+  if (typeof core !== "function")
+    throw new Error("core must be a function");
+  anumber(counterLength);
+  anumber(rounds);
+  abool(counterRight);
+  abool(allowShortKeys);
+  return (key2, nonce2, data2, output, counter = 0) => {
+    abytes(key2);
+    abytes(nonce2);
+    abytes(data2);
+    const len = data2.length;
+    if (output === void 0)
+      output = new Uint8Array(len);
+    abytes(output);
+    anumber(counter);
+    if (counter < 0 || counter >= MAX_COUNTER)
+      throw new Error("arx: counter overflow");
+    if (output.length < len)
+      throw new Error(`arx: output (${output.length}) is shorter than data (${len})`);
+    const toClean = [];
+    let l = key2.length;
+    let k;
+    let sigma;
+    if (l === 32) {
+      toClean.push(k = copyBytes(key2));
+      sigma = sigma32_32;
+    } else if (l === 16 && allowShortKeys) {
+      k = new Uint8Array(32);
+      k.set(key2);
+      k.set(key2, 16);
+      sigma = sigma16_32;
+      toClean.push(k);
+    } else {
+      throw new Error(`arx: invalid 32-byte key, got length=${l}`);
+    }
+    if (!isAligned322(nonce2))
+      toClean.push(nonce2 = copyBytes(nonce2));
+    const k32 = u32(k);
+    if (extendNonceFn) {
+      if (nonce2.length !== 24)
+        throw new Error(`arx: extended nonce must be 24 bytes`);
+      extendNonceFn(sigma, k32, u32(nonce2.subarray(0, 16)), k32);
+      nonce2 = nonce2.subarray(16);
+    }
+    const nonceNcLen = 16 - counterLength;
+    if (nonceNcLen !== nonce2.length)
+      throw new Error(`arx: nonce must be ${nonceNcLen} or 16 bytes`);
+    if (nonceNcLen !== 12) {
+      const nc = new Uint8Array(12);
+      nc.set(nonce2, counterRight ? 0 : 12 - nonce2.length);
+      nonce2 = nc;
+      toClean.push(nonce2);
+    }
+    const n32 = u32(nonce2);
+    runCipher(core, sigma, k32, n32, data2, output, counter, rounds);
+    clean(...toClean);
+    return output;
+  };
+}
+
+// ../../node_modules/@noble/ciphers/esm/_poly1305.js
+var u8to16 = (a, i) => a[i++] & 255 | (a[i++] & 255) << 8;
+var Poly1305 = class {
+  constructor(key2) {
+    this.blockLen = 16;
+    this.outputLen = 16;
+    this.buffer = new Uint8Array(16);
+    this.r = new Uint16Array(10);
+    this.h = new Uint16Array(10);
+    this.pad = new Uint16Array(8);
+    this.pos = 0;
+    this.finished = false;
+    key2 = toBytes(key2);
+    abytes(key2, 32);
+    const t0 = u8to16(key2, 0);
+    const t1 = u8to16(key2, 2);
+    const t2 = u8to16(key2, 4);
+    const t3 = u8to16(key2, 6);
+    const t4 = u8to16(key2, 8);
+    const t5 = u8to16(key2, 10);
+    const t6 = u8to16(key2, 12);
+    const t7 = u8to16(key2, 14);
+    this.r[0] = t0 & 8191;
+    this.r[1] = (t0 >>> 13 | t1 << 3) & 8191;
+    this.r[2] = (t1 >>> 10 | t2 << 6) & 7939;
+    this.r[3] = (t2 >>> 7 | t3 << 9) & 8191;
+    this.r[4] = (t3 >>> 4 | t4 << 12) & 255;
+    this.r[5] = t4 >>> 1 & 8190;
+    this.r[6] = (t4 >>> 14 | t5 << 2) & 8191;
+    this.r[7] = (t5 >>> 11 | t6 << 5) & 8065;
+    this.r[8] = (t6 >>> 8 | t7 << 8) & 8191;
+    this.r[9] = t7 >>> 5 & 127;
+    for (let i = 0; i < 8; i++)
+      this.pad[i] = u8to16(key2, 16 + 2 * i);
+  }
+  process(data2, offset, isLast = false) {
+    const hibit = isLast ? 0 : 1 << 11;
+    const { h, r } = this;
+    const r0 = r[0];
+    const r1 = r[1];
+    const r2 = r[2];
+    const r3 = r[3];
+    const r4 = r[4];
+    const r5 = r[5];
+    const r6 = r[6];
+    const r7 = r[7];
+    const r8 = r[8];
+    const r9 = r[9];
+    const t0 = u8to16(data2, offset + 0);
+    const t1 = u8to16(data2, offset + 2);
+    const t2 = u8to16(data2, offset + 4);
+    const t3 = u8to16(data2, offset + 6);
+    const t4 = u8to16(data2, offset + 8);
+    const t5 = u8to16(data2, offset + 10);
+    const t6 = u8to16(data2, offset + 12);
+    const t7 = u8to16(data2, offset + 14);
+    let h0 = h[0] + (t0 & 8191);
+    let h1 = h[1] + ((t0 >>> 13 | t1 << 3) & 8191);
+    let h2 = h[2] + ((t1 >>> 10 | t2 << 6) & 8191);
+    let h3 = h[3] + ((t2 >>> 7 | t3 << 9) & 8191);
+    let h4 = h[4] + ((t3 >>> 4 | t4 << 12) & 8191);
+    let h5 = h[5] + (t4 >>> 1 & 8191);
+    let h6 = h[6] + ((t4 >>> 14 | t5 << 2) & 8191);
+    let h7 = h[7] + ((t5 >>> 11 | t6 << 5) & 8191);
+    let h8 = h[8] + ((t6 >>> 8 | t7 << 8) & 8191);
+    let h9 = h[9] + (t7 >>> 5 | hibit);
+    let c = 0;
+    let d0 = c + h0 * r0 + h1 * (5 * r9) + h2 * (5 * r8) + h3 * (5 * r7) + h4 * (5 * r6);
+    c = d0 >>> 13;
+    d0 &= 8191;
+    d0 += h5 * (5 * r5) + h6 * (5 * r4) + h7 * (5 * r3) + h8 * (5 * r2) + h9 * (5 * r1);
+    c += d0 >>> 13;
+    d0 &= 8191;
+    let d1 = c + h0 * r1 + h1 * r0 + h2 * (5 * r9) + h3 * (5 * r8) + h4 * (5 * r7);
+    c = d1 >>> 13;
+    d1 &= 8191;
+    d1 += h5 * (5 * r6) + h6 * (5 * r5) + h7 * (5 * r4) + h8 * (5 * r3) + h9 * (5 * r2);
+    c += d1 >>> 13;
+    d1 &= 8191;
+    let d2 = c + h0 * r2 + h1 * r1 + h2 * r0 + h3 * (5 * r9) + h4 * (5 * r8);
+    c = d2 >>> 13;
+    d2 &= 8191;
+    d2 += h5 * (5 * r7) + h6 * (5 * r6) + h7 * (5 * r5) + h8 * (5 * r4) + h9 * (5 * r3);
+    c += d2 >>> 13;
+    d2 &= 8191;
+    let d3 = c + h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * (5 * r9);
+    c = d3 >>> 13;
+    d3 &= 8191;
+    d3 += h5 * (5 * r8) + h6 * (5 * r7) + h7 * (5 * r6) + h8 * (5 * r5) + h9 * (5 * r4);
+    c += d3 >>> 13;
+    d3 &= 8191;
+    let d4 = c + h0 * r4 + h1 * r3 + h2 * r2 + h3 * r1 + h4 * r0;
+    c = d4 >>> 13;
+    d4 &= 8191;
+    d4 += h5 * (5 * r9) + h6 * (5 * r8) + h7 * (5 * r7) + h8 * (5 * r6) + h9 * (5 * r5);
+    c += d4 >>> 13;
+    d4 &= 8191;
+    let d5 = c + h0 * r5 + h1 * r4 + h2 * r3 + h3 * r2 + h4 * r1;
+    c = d5 >>> 13;
+    d5 &= 8191;
+    d5 += h5 * r0 + h6 * (5 * r9) + h7 * (5 * r8) + h8 * (5 * r7) + h9 * (5 * r6);
+    c += d5 >>> 13;
+    d5 &= 8191;
+    let d6 = c + h0 * r6 + h1 * r5 + h2 * r4 + h3 * r3 + h4 * r2;
+    c = d6 >>> 13;
+    d6 &= 8191;
+    d6 += h5 * r1 + h6 * r0 + h7 * (5 * r9) + h8 * (5 * r8) + h9 * (5 * r7);
+    c += d6 >>> 13;
+    d6 &= 8191;
+    let d7 = c + h0 * r7 + h1 * r6 + h2 * r5 + h3 * r4 + h4 * r3;
+    c = d7 >>> 13;
+    d7 &= 8191;
+    d7 += h5 * r2 + h6 * r1 + h7 * r0 + h8 * (5 * r9) + h9 * (5 * r8);
+    c += d7 >>> 13;
+    d7 &= 8191;
+    let d8 = c + h0 * r8 + h1 * r7 + h2 * r6 + h3 * r5 + h4 * r4;
+    c = d8 >>> 13;
+    d8 &= 8191;
+    d8 += h5 * r3 + h6 * r2 + h7 * r1 + h8 * r0 + h9 * (5 * r9);
+    c += d8 >>> 13;
+    d8 &= 8191;
+    let d9 = c + h0 * r9 + h1 * r8 + h2 * r7 + h3 * r6 + h4 * r5;
+    c = d9 >>> 13;
+    d9 &= 8191;
+    d9 += h5 * r4 + h6 * r3 + h7 * r2 + h8 * r1 + h9 * r0;
+    c += d9 >>> 13;
+    d9 &= 8191;
+    c = (c << 2) + c | 0;
+    c = c + d0 | 0;
+    d0 = c & 8191;
+    c = c >>> 13;
+    d1 += c;
+    h[0] = d0;
+    h[1] = d1;
+    h[2] = d2;
+    h[3] = d3;
+    h[4] = d4;
+    h[5] = d5;
+    h[6] = d6;
+    h[7] = d7;
+    h[8] = d8;
+    h[9] = d9;
+  }
+  finalize() {
+    const { h, pad } = this;
+    const g = new Uint16Array(10);
+    let c = h[1] >>> 13;
+    h[1] &= 8191;
+    for (let i = 2; i < 10; i++) {
+      h[i] += c;
+      c = h[i] >>> 13;
+      h[i] &= 8191;
+    }
+    h[0] += c * 5;
+    c = h[0] >>> 13;
+    h[0] &= 8191;
+    h[1] += c;
+    c = h[1] >>> 13;
+    h[1] &= 8191;
+    h[2] += c;
+    g[0] = h[0] + 5;
+    c = g[0] >>> 13;
+    g[0] &= 8191;
+    for (let i = 1; i < 10; i++) {
+      g[i] = h[i] + c;
+      c = g[i] >>> 13;
+      g[i] &= 8191;
+    }
+    g[9] -= 1 << 13;
+    let mask = (c ^ 1) - 1;
+    for (let i = 0; i < 10; i++)
+      g[i] &= mask;
+    mask = ~mask;
+    for (let i = 0; i < 10; i++)
+      h[i] = h[i] & mask | g[i];
+    h[0] = (h[0] | h[1] << 13) & 65535;
+    h[1] = (h[1] >>> 3 | h[2] << 10) & 65535;
+    h[2] = (h[2] >>> 6 | h[3] << 7) & 65535;
+    h[3] = (h[3] >>> 9 | h[4] << 4) & 65535;
+    h[4] = (h[4] >>> 12 | h[5] << 1 | h[6] << 14) & 65535;
+    h[5] = (h[6] >>> 2 | h[7] << 11) & 65535;
+    h[6] = (h[7] >>> 5 | h[8] << 8) & 65535;
+    h[7] = (h[8] >>> 8 | h[9] << 5) & 65535;
+    let f2 = h[0] + pad[0];
+    h[0] = f2 & 65535;
+    for (let i = 1; i < 8; i++) {
+      f2 = (h[i] + pad[i] | 0) + (f2 >>> 16) | 0;
+      h[i] = f2 & 65535;
+    }
+    clean(g);
+  }
+  update(data2) {
+    aexists(this);
+    data2 = toBytes(data2);
+    abytes(data2);
+    const { buffer, blockLen } = this;
+    const len = data2.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(data2, pos);
+        continue;
+      }
+      buffer.set(data2.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(buffer, 0, false);
+        this.pos = 0;
+      }
+    }
+    return this;
+  }
+  destroy() {
+    clean(this.h, this.r, this.buffer, this.pad);
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, h } = this;
+    let { pos } = this;
+    if (pos) {
+      buffer[pos++] = 1;
+      for (; pos < 16; pos++)
+        buffer[pos] = 0;
+      this.process(buffer, 0, true);
+    }
+    this.finalize();
+    let opos = 0;
+    for (let i = 0; i < 8; i++) {
+      out[opos++] = h[i] >>> 0;
+      out[opos++] = h[i] >>> 8;
+    }
+    return out;
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+};
+function wrapConstructorWithKey(hashCons) {
+  const hashC = (msg, key2) => hashCons(key2).update(toBytes(msg)).digest();
+  const tmp = hashCons(new Uint8Array(32));
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = (key2) => hashCons(key2);
+  return hashC;
+}
+var poly1305 = wrapConstructorWithKey((key2) => new Poly1305(key2));
+
+// ../../node_modules/@noble/ciphers/esm/chacha.js
+function chachaCore(s, k, n, out, cnt, rounds = 20) {
+  let y00 = s[0], y01 = s[1], y02 = s[2], y03 = s[3], y04 = k[0], y05 = k[1], y06 = k[2], y07 = k[3], y08 = k[4], y09 = k[5], y10 = k[6], y11 = k[7], y12 = cnt, y13 = n[0], y14 = n[1], y15 = n[2];
+  let x00 = y00, x01 = y01, x02 = y02, x03 = y03, x04 = y04, x05 = y05, x06 = y06, x07 = y07, x08 = y08, x09 = y09, x10 = y10, x11 = y11, x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+  for (let r = 0; r < rounds; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  out[oi++] = y00 + x00 | 0;
+  out[oi++] = y01 + x01 | 0;
+  out[oi++] = y02 + x02 | 0;
+  out[oi++] = y03 + x03 | 0;
+  out[oi++] = y04 + x04 | 0;
+  out[oi++] = y05 + x05 | 0;
+  out[oi++] = y06 + x06 | 0;
+  out[oi++] = y07 + x07 | 0;
+  out[oi++] = y08 + x08 | 0;
+  out[oi++] = y09 + x09 | 0;
+  out[oi++] = y10 + x10 | 0;
+  out[oi++] = y11 + x11 | 0;
+  out[oi++] = y12 + x12 | 0;
+  out[oi++] = y13 + x13 | 0;
+  out[oi++] = y14 + x14 | 0;
+  out[oi++] = y15 + x15 | 0;
+}
+function hchacha(s, k, i, o32) {
+  let x00 = s[0], x01 = s[1], x02 = s[2], x03 = s[3], x04 = k[0], x05 = k[1], x06 = k[2], x07 = k[3], x08 = k[4], x09 = k[5], x10 = k[6], x11 = k[7], x12 = i[0], x13 = i[1], x14 = i[2], x15 = i[3];
+  for (let r = 0; r < 20; r += 2) {
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = x00 + x04 | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = x08 + x12 | 0;
+    x04 = rotl(x04 ^ x08, 7);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = x01 + x05 | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = x09 + x13 | 0;
+    x05 = rotl(x05 ^ x09, 7);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = x02 + x06 | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = x10 + x14 | 0;
+    x06 = rotl(x06 ^ x10, 7);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = x03 + x07 | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = x11 + x15 | 0;
+    x07 = rotl(x07 ^ x11, 7);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = x00 + x05 | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = x10 + x15 | 0;
+    x05 = rotl(x05 ^ x10, 7);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = x01 + x06 | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = x11 + x12 | 0;
+    x06 = rotl(x06 ^ x11, 7);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = x02 + x07 | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = x08 + x13 | 0;
+    x07 = rotl(x07 ^ x08, 7);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = x03 + x04 | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = x09 + x14 | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+  o32[oi++] = x00;
+  o32[oi++] = x01;
+  o32[oi++] = x02;
+  o32[oi++] = x03;
+  o32[oi++] = x12;
+  o32[oi++] = x13;
+  o32[oi++] = x14;
+  o32[oi++] = x15;
+}
+var chacha20 = /* @__PURE__ */ createCipher(chachaCore, {
+  counterRight: false,
+  counterLength: 4,
+  allowShortKeys: false
+});
+var xchacha20 = /* @__PURE__ */ createCipher(chachaCore, {
+  counterRight: false,
+  counterLength: 8,
+  extendNonceFn: hchacha,
+  allowShortKeys: false
+});
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var updatePadded = (h, msg) => {
+  h.update(msg);
+  const left = msg.length % 16;
+  if (left)
+    h.update(ZEROS16.subarray(left));
+};
+var ZEROS32 = /* @__PURE__ */ new Uint8Array(32);
+function computeTag(fn, key2, nonce2, data2, AAD) {
+  const authKey = fn(key2, nonce2, ZEROS32);
+  const h = poly1305.create(authKey);
+  if (AAD)
+    updatePadded(h, AAD);
+  updatePadded(h, data2);
+  const num = u64Lengths(data2.length, AAD ? AAD.length : 0, true);
+  h.update(num);
+  const res = h.digest();
+  clean(authKey, num);
+  return res;
+}
+var _poly1305_aead = (xorStream) => (key2, nonce2, AAD) => {
+  const tagLength = 16;
+  return {
+    encrypt(plaintext, output) {
+      const plength = plaintext.length;
+      output = getOutput(plength + tagLength, output, false);
+      output.set(plaintext);
+      const oPlain = output.subarray(0, -tagLength);
+      xorStream(key2, nonce2, oPlain, oPlain, 1);
+      const tag = computeTag(xorStream, key2, nonce2, oPlain, AAD);
+      output.set(tag, plength);
+      clean(tag);
+      return output;
+    },
+    decrypt(ciphertext, output) {
+      output = getOutput(ciphertext.length - tagLength, output, false);
+      const data2 = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = computeTag(xorStream, key2, nonce2, data2, AAD);
+      if (!equalBytes(passedTag, tag))
+        throw new Error("invalid tag");
+      output.set(ciphertext.subarray(0, -tagLength));
+      xorStream(key2, nonce2, output, output, 1);
+      clean(tag);
+      return output;
+    }
+  };
+};
+var chacha20poly1305 = /* @__PURE__ */ wrapCipher({ blockSize: 64, nonceLength: 12, tagLength: 16 }, _poly1305_aead(chacha20));
+var xchacha20poly1305 = /* @__PURE__ */ wrapCipher({ blockSize: 64, nonceLength: 24, tagLength: 16 }, _poly1305_aead(xchacha20));
+
+// src/memory/embedder/session.ts
+function deriveSessionKeys(token, ns, nc) {
+  const ikm = Buffer.from(token, "hex");
+  const salt = Buffer.from(ns + nc, "hex");
+  const k = (label) => new Uint8Array(hkdfSync("sha256", ikm, salt, `securecoms-embedder ${label} v1`, 32));
+  return { c2s: k("c2s"), s2c: k("s2c") };
+}
+var SealedChannel = class {
+  constructor(sendKey, recvKey, sendLabel, recvLabel) {
+    this.sendKey = sendKey;
+    this.recvKey = recvKey;
+    this.sendLabel = sendLabel;
+    this.recvLabel = recvLabel;
+  }
+  sendSeq = 0;
+  recvSeq = 0;
+  seal(frame) {
+    const nonce2 = randomBytes2(24);
+    const aad = new TextEncoder().encode(`${this.sendLabel}:${this.sendSeq++}`);
+    const ct = xchacha20poly1305(this.sendKey, nonce2, aad).encrypt(new TextEncoder().encode(JSON.stringify(frame)));
+    return Buffer.concat([nonce2, Buffer.from(ct)]).toString("base64");
+  }
+  /** Null on any failure (bad base64, wrong key, tampering, replay): the caller closes the connection. */
+  open(line) {
+    try {
+      const b = Buffer.from(line, "base64");
+      if (b.length < 24 + 16) return null;
+      const aad = new TextEncoder().encode(`${this.recvLabel}:${this.recvSeq}`);
+      const pt = xchacha20poly1305(this.recvKey, b.subarray(0, 24), aad).decrypt(b.subarray(24));
+      this.recvSeq++;
+      const f2 = JSON.parse(new TextDecoder().decode(pt));
+      return f2 && typeof f2 === "object" && !Array.isArray(f2) ? f2 : null;
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/memory/embedder/server.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, rmSync as rmSync2, statSync, writeFileSync } from "node:fs";
+
+// src/memory/embedder/locks.ts
+import { closeSync, constants, fstatSync, linkSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { uptime } from "node:os";
+var LOCK_STALE_MS = 1e4;
+var BOOT_TOLERANCE_S = 60;
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+};
+var PROCESS_LOCK_ENV = {
+  pid: process.pid,
+  alive,
+  bootTime: () => Math.round((Date.now() - uptime() * 1e3) / 1e3),
+  startTime: () => Math.round(Date.now() - process.uptime() * 1e3)
+};
+function inspect(path) {
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch {
+    return null;
+  }
+  try {
+    const st = fstatSync(fd, { bigint: true });
+    return { dev: st.dev, ino: st.ino, mtimeNs: st.mtimeNs, mtimeMs: Number(st.mtimeMs), text: readFileSync(fd, "utf8") };
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
+var sameLock = (a, b) => a !== null && a.dev === b.dev && a.ino === b.ino && a.mtimeNs === b.mtimeNs && a.text === b.text;
+function holderDead(text, env) {
+  const [pidS, bootS] = text.split(" ");
+  const pid = Number(pidS), boot = Number(bootS);
+  if (Number.isInteger(boot) && boot > 0 && Math.abs(boot - env.bootTime()) > BOOT_TOLERANCE_S) return true;
+  return !(Number.isInteger(pid) && pid > 0 && env.alive(pid));
+}
+function takeLock(path, now = Date.now, env = PROCESS_LOCK_ENV) {
+  const id = `${env.pid} ${env.bootTime()} ${env.startTime()} ${randomBytes3(8).toString("hex")}`;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      const fd = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
+      try {
+        writeSync(fd, id);
+      } finally {
+        closeSync(fd);
+      }
+      return { id };
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    const seen = inspect(path);
+    if (!seen) continue;
+    if (!holderDead(seen.text, env) || now() - seen.mtimeMs < LOCK_STALE_MS) return null;
+    env.beforeSteal?.();
+    const aside = `${path}.stale.${randomBytes3(6).toString("hex")}`;
+    try {
+      renameSync(path, aside);
+    } catch {
+      continue;
+    }
+    if (!sameLock(inspect(aside), seen)) {
+      try {
+        linkSync(aside, path);
+      } catch {
+      }
+      rmSync(aside, { force: true });
+      return null;
+    }
+    rmSync(aside, { force: true });
+  }
+  return null;
+}
+function releaseLock(path, id) {
+  try {
+    if (readFileSync(path, "utf8") === id) rmSync(path, { force: true });
+  } catch {
+  }
+}
+
+// src/service-log.ts
+var ENUM_VALUE = /^[a-z][a-z_]{0,31}$/;
+var ServiceLogEnum = class _ServiceLogEnum {
+  constructor(value) {
+    this.value = value;
+  }
+  static of(value, allowed) {
+    return new _ServiceLogEnum(allowed.includes(value) && ENUM_VALUE.test(value) ? value : "invalid");
+  }
+};
+var TOKEN = /^[a-z][a-z0-9_.-]{0,63}$/;
+var CLASS = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+function errorClass(error) {
+  if (error === null) return "NullThrown";
+  if (typeof error !== "object" && typeof error !== "function") {
+    const primitive = {
+      string: "StringThrown",
+      number: "NumberThrown",
+      boolean: "BooleanThrown",
+      bigint: "BigIntThrown",
+      symbol: "SymbolThrown",
+      undefined: "UndefinedThrown"
+    };
+    return primitive[typeof error] ?? "UnknownThrown";
+  }
+  try {
+    const name = Object.getPrototypeOf(error)?.constructor?.name;
+    return typeof name === "string" && CLASS.test(name) ? name : "Error";
+  } catch {
+    return "Error";
+  }
+}
+function formatServiceLog(level, event, fields = {}, error) {
+  const safeEvent = TOKEN.test(event) ? event : "invalid_event";
+  const parts = [`[bridge] ${level} ${safeEvent}`];
+  for (const [key2, value] of Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!TOKEN.test(key2)) continue;
+    if (typeof value === "boolean") parts.push(`${key2}=${value}`);
+    else if (typeof value === "number" && Number.isFinite(value)) parts.push(`${key2}=${value}`);
+    else if (value instanceof ServiceLogEnum && ENUM_VALUE.test(value.value)) parts.push(`${key2}=${value.value}`);
+  }
+  if (error !== void 0) parts.push(`error_class=${errorClass(error)}`);
+  return parts.join(" ");
+}
+function writeServiceLog(level, event, fields, error) {
+  const line = formatServiceLog(level, event, fields, error);
+  process.stderr.write(`${line}
+`);
+}
+
+// src/memory/embedder/scheduler.ts
+var MAX_QUERIES_PER_CONN = 4;
+var MAX_BACKGROUND_PER_CONN = 1;
+var MAX_CONNECTIONS = 32;
+var BACKGROUND_PER_SECOND = 16;
+var Scheduler = class {
+  constructor(o) {
+    this.o = o;
+  }
+  q = [/* @__PURE__ */ new Map(), /* @__PURE__ */ new Map()];
+  last = [-1, -1];
+  // last connection served, per class
+  bgStarts = [];
+  enqueue(j) {
+    const m = this.q[j.priority];
+    const list = m.get(j.conn) ?? [];
+    if (list.length >= (j.priority === 0 ? MAX_QUERIES_PER_CONN : MAX_BACKGROUND_PER_CONN)) return "busy";
+    list.push(j);
+    m.set(j.conn, list);
+    return "ok";
+  }
+  cancel(conn, jobId) {
+    for (const m of this.q) {
+      const list = m.get(conn);
+      if (!list) continue;
+      const i = list.findIndex((j) => j.jobId === jobId);
+      if (i >= 0) {
+        list.splice(i, 1);
+        return true;
+      }
+    }
+    return false;
+  }
+  dropConnection(conn) {
+    for (const m of this.q) m.delete(conn);
+  }
+  size() {
+    let n = 0;
+    for (const m of this.q) for (const l of m.values()) n += l.length;
+    return n;
+  }
+  take(p) {
+    const conns = [...this.q[p].entries()].filter(([, l]) => l.length > 0).map(([c2]) => c2).sort((a, b) => a - b);
+    if (conns.length === 0) return void 0;
+    const c = conns.find((x) => x > this.last[p]) ?? conns[0];
+    this.last[p] = c;
+    return this.q[p].get(c).shift();
+  }
+  next() {
+    const q = this.take(0);
+    if (q) return q;
+    if (this.o.backgroundHeld()) return void 0;
+    const now = this.o.now();
+    this.bgStarts = this.bgStarts.filter((t) => now - t < 1e3);
+    if (this.bgStarts.length >= BACKGROUND_PER_SECOND) return void 0;
+    const b = this.take(1);
+    if (b) this.bgStarts.push(now);
+    return b;
+  }
+};
+
+// src/memory/embedder/server.ts
+var AlreadyRunning = class extends Error {
+};
+var RESET_TIMEOUT_MS = 3e4;
+var MAX_PENDING_WRITE_BYTES = 1 << 20;
+var live = (sock) => new Promise((r) => {
+  const c = connect(sock);
+  c.once("connect", () => {
+    c.destroy();
+    r(true);
+  });
+  c.once("error", () => r(false));
+});
+var bindPath = (sock) => `${sock}.${randomBytes4(4).toString("hex")}`;
+var SocketPathTooLong = class extends Error {
+};
+async function listenUnix(server, sock) {
+  const bound = bindPath(sock);
+  await new Promise((res, rej) => {
+    server.once("error", rej);
+    server.listen(bound, () => {
+      server.off("error", rej);
+      res();
+    });
+  });
+  chmodSync(bound, 384);
+  renameSync2(bound, sock);
+}
+async function startEmbedderServer(o) {
+  const log = o.log ?? writeServiceLog;
+  const tcp = (o.transport ?? (process.platform === "win32" ? "tcp" : "unix")) === "tcp";
+  if (!tcp && Buffer.byteLength(bindPath(embedderPaths(o.dir, o.key).sock)) > SOCKET_PATH_MAX) throw new SocketPathTooLong("embedder socket path too long");
+  if (process.platform !== "win32") ensureRunDir(o.dir, o.uid);
+  else mkdirSync2(o.dir, { recursive: true });
+  const p = embedderPaths(o.dir, o.key);
+  const lock = takeLock(p.pid, o.now);
+  if (!lock) throw new AlreadyRunning("embedder already running");
+  let published = "";
+  const server = createServer();
+  try {
+    if (!tcp && existsSync2(p.sock)) {
+      if (await live(p.sock)) throw new AlreadyRunning("embedder already running");
+      rmSync2(p.sock, { force: true });
+    }
+    const token = randomBytes4(32).toString("hex");
+    const publish = (extra = {}) => {
+      rmSync2(`${p.token}.tmp`, { force: true });
+      writeFileSync(`${p.token}.tmp`, JSON.stringify({ ...extra, token }), { mode: 384, flag: "wx" });
+      renameSync2(`${p.token}.tmp`, p.token);
+      published = readFileSync2(p.token, "utf8");
+    };
+    if (!tcp) publish();
+    return await serve(o, log, p, lock, token, () => published, server, tcp, publish);
+  } catch (e) {
+    server.close();
+    try {
+      if (published && readFileSync2(p.token, "utf8") === published) rmSync2(p.token, { force: true });
+    } catch {
+    }
+    releaseLock(p.pid, lock.id);
+    throw e;
+  }
+}
+async function serve(o, log, p, lock, token, published, server, tcp, publish) {
+  const sched = new Scheduler({ now: o.now ?? Date.now, backgroundHeld: o.backgroundHeld ?? (() => false) });
+  const conns = /* @__PURE__ */ new Map();
+  const all = /* @__PURE__ */ new Set();
+  const chans = /* @__PURE__ */ new Map();
+  let ordinal = 0;
+  let running = null;
+  let idleTimer;
+  let retryTimer;
+  let stopped = false;
+  const touchIdle = () => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => void stop("idle"), o.idleMs ?? 30 * 6e4);
+  };
+  const send = (conn, f2) => {
+    const s = conns.get(conn);
+    const c = chans.get(conn);
+    if (!s || !c || s.destroyed) return;
+    s.write(c.seal(f2) + "\n");
+    if (s.writableLength > MAX_PENDING_WRITE_BYTES) {
+      log("warn", "embedder.slow_reader_closed");
+      s.destroy();
+    }
+  };
+  const pump = async () => {
+    if (running || stopped) return;
+    const job = sched.next();
+    if (!job) {
+      if (sched.size() > 0 && !retryTimer) retryTimer = setTimeout(() => {
+        retryTimer = void 0;
+        void pump();
+      }, o.retryMs ?? 250);
+      return;
+    }
+    running = { job, cancelled: false };
+    const r = running;
+    let timer;
+    let resetFailed = false;
+    try {
+      const vec = await Promise.race([o.embed(job.text), new Promise((res) => {
+        timer = setTimeout(() => res("timeout"), o.jobTimeoutMs ?? 2e3);
+      })]);
+      if (vec === "timeout") {
+        log("warn", "embedder.worker_reset");
+        let resetTimer;
+        const ok = await Promise.race([
+          o.resetInner().then(() => true, () => false),
+          new Promise((res) => {
+            resetTimer = setTimeout(() => res(false), o.resetTimeoutMs ?? RESET_TIMEOUT_MS);
+          })
+        ]);
+        clearTimeout(resetTimer);
+        resetFailed = !ok;
+        if (!r.cancelled) send(job.conn, { t: "error", job_id: job.jobId, code: "worker_reset" });
+      } else if (!r.cancelled) send(job.conn, { t: "result", job_id: job.jobId, model_id: o.hello.model_id, vec: encodeVec64(vec) });
+    } catch {
+      if (!r.cancelled) send(job.conn, { t: "error", job_id: job.jobId, code: "failed" });
+    } finally {
+      clearTimeout(timer);
+      running = null;
+    }
+    if (resetFailed) {
+      log("error", "embedder.reset_failed");
+      await stop("reset_failed");
+      return;
+    }
+    void pump();
+  };
+  let open = 0;
+  let preauth = 0;
+  server.on("connection", (sock) => {
+    if (stopped || open >= MAX_CONNECTIONS || preauth >= (tcp ? PREAUTH_MAX_CONNECTIONS_TCP : PREAUTH_MAX_CONNECTIONS)) {
+      sock.destroy();
+      return;
+    }
+    open++;
+    preauth++;
+    all.add(sock);
+    let authed = false;
+    const conn = ++ordinal;
+    const ns = nonce();
+    const helloTimer = setTimeout(() => sock.destroy(), o.helloTimeoutMs ?? PREAUTH_TIMEOUT_MS);
+    sock.once("close", () => {
+      open--;
+      if (!authed) preauth--;
+      all.delete(sock);
+      clearTimeout(helloTimer);
+      conns.delete(conn);
+      chans.delete(conn);
+      sched.dropConnection(conn);
+    });
+    sock.on("error", () => sock.destroy());
+    sock.write(JSON.stringify({ t: "challenge", protocol: EMBEDDER_PROTOCOL, ns }) + "\n");
+    sock.on("data", lineReader((line) => {
+      if (sock.destroyed) return;
+      let f2;
+      const chan = chans.get(conn);
+      if (chan) {
+        f2 = chan.open(line);
+        if (!f2) {
+          log("warn", "embedder.frame_rejected");
+          sock.destroy();
+          return;
+        }
+      } else {
+        try {
+          f2 = JSON.parse(line);
+        } catch {
+          sock.destroy();
+          return;
+        }
+      }
+      if (!f2 || typeof f2 !== "object") {
+        sock.destroy();
+        return;
+      }
+      if (!authed) {
+        const nc = typeof f2.nc === "string" && /^[0-9a-f]{32}$/.test(f2.nc) ? f2.nc : null;
+        if (f2.t !== "hello" || !nc || typeof f2.mac_c !== "string" || !macEqual(f2.mac_c, macClient(token, ns, nc))) {
+          sock.destroy();
+          return;
+        }
+        authed = true;
+        preauth--;
+        clearTimeout(helloTimer);
+        conns.set(conn, sock);
+        sock.write(JSON.stringify({ t: "hello", mac_s: macServer(token, ns, nc), ...o.hello }) + "\n");
+        const k = deriveSessionKeys(token, ns, nc);
+        chans.set(conn, new SealedChannel(k.s2c, k.c2s, "s2c", "c2s"));
+        return;
+      }
+      if (f2.t === "cancel") {
+        if (!Number.isSafeInteger(f2.job_id)) {
+          sock.destroy();
+          return;
+        }
+        const cid = f2.job_id;
+        if (!sched.cancel(conn, cid) && running && running.job.conn === conn && running.job.jobId === cid) running.cancelled = true;
+        return;
+      }
+      if (f2.t !== "job" || !Number.isSafeInteger(f2.job_id) || typeof f2.text !== "string" || f2.priority !== 0 && f2.priority !== 1) {
+        sock.destroy();
+        return;
+      }
+      const jobId = f2.job_id;
+      touchIdle();
+      if (Buffer.byteLength(f2.text) > MAX_TEXT_BYTES) {
+        send(conn, { t: "error", job_id: jobId, code: "too_long" });
+        return;
+      }
+      if (sched.enqueue({ conn, jobId, priority: f2.priority, text: f2.text }) === "busy") {
+        send(conn, { t: "error", job_id: jobId, code: "busy" });
+        return;
+      }
+      void pump();
+    }, () => sock.destroy(), () => authed ? MAX_LINE_BYTES : PREAUTH_MAX_LINE));
+  });
+  if (tcp) {
+    await new Promise((res, rej) => {
+      server.once("error", rej);
+      server.listen({ host: "127.0.0.1", port: 0 }, () => {
+        server.off("error", rej);
+        res();
+      });
+    });
+    publish({ port: server.address().port });
+  } else await listenUnix(server, p.sock);
+  const ident = () => {
+    const st = statSync(p.sock, { bigint: true });
+    return `${st.dev}:${st.ino}:${st.birthtimeNs}:${st.ctimeNs}`;
+  };
+  const ours = tcp ? "" : ident();
+  touchIdle();
+  log("info", "embedder.listening");
+  async function stop(reason) {
+    if (stopped) return;
+    stopped = true;
+    clearTimeout(idleTimer);
+    clearTimeout(retryTimer);
+    for (const s of all) s.destroy();
+    await new Promise((r) => server.close(() => r()));
+    try {
+      if (!tcp && ident() === ours) rmSync2(p.sock, { force: true });
+    } catch {
+    }
+    try {
+      if (readFileSync2(p.token, "utf8") === published()) rmSync2(p.token, { force: true });
+    } catch {
+    }
+    releaseLock(p.pid, lock.id);
+    log("info", "embedder.stopped");
+    o.onExit?.(reason);
+  }
+  return { close: () => stop("closed"), connections: () => conns.size, address: () => server.address() };
+}
+
+// src/memory/embedder/inner-source.ts
+function innerWorkerUrl(source) {
+  return new URL(`data:text/javascript;base64,${Buffer.from(source, "utf8").toString("base64")}`);
+}
+
+// src/memory/embedder/no-dial.ts
+import { createRequire, syncBuiltinESMExports } from "node:module";
+var NO_DIAL_MESSAGE = "outbound connections are forbidden in the embedder";
+function forbidOutbound() {
+  const net = createRequire(import.meta.url)("node:net");
+  const mark = Symbol.for("securecoms.embedder.noDial");
+  if (net[mark]) return;
+  const refuse = () => {
+    throw new Error(NO_DIAL_MESSAGE);
+  };
+  net.Socket.prototype.connect = refuse;
+  net.connect = refuse;
+  net.createConnection = refuse;
+  net[mark] = true;
+  syncBuiltinESMExports();
+}
+
+// src/memory/embedder/heartbeats.ts
+import { lstatSync as lstatSync2, readdirSync } from "node:fs";
+import { join as join3 } from "node:path";
+var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+var HEARTBEAT_STALE_MS = 3e4;
+function heartbeatAgeFresh(ageMs, staleMs = HEARTBEAT_STALE_MS) {
+  return ageMs >= -HEARTBEAT_FUTURE_SKEW_MS && ageMs <= staleMs;
+}
+function anyHeartbeatFresh(dir2, now, staleMs = HEARTBEAT_STALE_MS) {
+  let names;
+  try {
+    names = readdirSync(dir2);
+  } catch {
+    return false;
+  }
+  return names.some((n) => {
+    try {
+      const st = lstatSync2(join3(dir2, n));
+      return st.isFile() && heartbeatAgeFresh(now - st.mtimeMs, staleMs);
+    } catch {
+      return false;
+    }
+  });
+}
+
+// src/memory/embedder/embedder-main.ts
+globalThis.fetch = () => {
+  throw new Error("network forbidden in the embedder");
+};
+var key = process.argv[process.argv.indexOf("--key") + 1];
+if (key !== embedderKey(EMBEDDING_MANIFEST)) process.exit(2);
+var dist = fileURLToPath(new URL(".", import.meta.url));
+var win = process.platform === "win32";
+var dir = win ? windowsRunDir() : embedderRunDir();
+try {
+  if (win) mkdirSync3(dir, { recursive: true });
+  else ensureRunDir(dir);
+} catch {
+  process.exit(4);
+}
+var status = embedderPaths(dir, key).status;
+var writeStatus = (fatal) => {
+  try {
+    rmSync3(status, { force: true });
+    writeFileSync2(status, JSON.stringify({ fatal }), { mode: 384, flag: "wx" });
+  } catch {
+  }
+};
+var f = (n) => EMBEDDING_MANIFEST.files.find((x) => x.name === n);
+var bytes;
+try {
+  const read = (p, sha, size) => {
+    const b = readFileSync3(p);
+    verifyBuffer(b, sha, size);
+    return b;
+  };
+  bytes = {
+    model: read(filePath(defaultModelsRoot(), EMBEDDING_MANIFEST.modelId, f("model.onnx")), f("model.onnx").sha256, f("model.onnx").size),
+    vocab: read(filePath(defaultModelsRoot(), EMBEDDING_MANIFEST.modelId, f("vocab.txt")), f("vocab.txt").sha256, f("vocab.txt").size),
+    wasm: read(join4(dist, "ort-wasm-simd-threaded.wasm"), EMBEDDING_MANIFEST.wasmSha256, EMBEDDING_MANIFEST.wasmSize)
+  };
+} catch (e) {
+  writeStatus(e instanceof HashMismatch ? "verify_failed" : "load_failed");
+  process.exit(3);
+}
+var data = {
+  bytes,
+  model: { sha256: f("model.onnx").sha256, size: f("model.onnx").size },
+  vocab: { sha256: f("vocab.txt").sha256, size: f("vocab.txt").size },
+  wasm: { sha256: EMBEDDING_MANIFEST.wasmSha256, size: EMBEDDING_MANIFEST.wasmSize },
+  tokenizer: TOKENIZER_OPTIONS,
+  maxTokens: EMBEDDING_MANIFEST.maxTokens,
+  dims: EMBEDDING_MANIFEST.dims,
+  pooling: EMBEDDING_MANIFEST.pooling,
+  normalize: EMBEDDING_MANIFEST.normalize,
+  inputs: EMBEDDING_MANIFEST.onnxInputs,
+  output: EMBEDDING_MANIFEST.onnxOutput
+};
+var inner;
+var seq = 0;
+var waiting = /* @__PURE__ */ new Map();
+var failAll = (why) => {
+  for (const w of waiting.values()) w.rej(new Error(why));
+  waiting.clear();
+};
+var innerUrl = innerWorkerUrl(readFileSync3(join4(dist, "embedder-worker.js"), "utf8"));
+var spawnInner = () => new Promise((res, rej) => {
+  const w = new Worker(innerUrl, { workerData: data });
+  inner = w;
+  w.once("message", (m) => m?.ready ? res() : rej(Object.assign(new Error("inner fatal"), { fatal: m?.fatal })));
+  w.on("message", (m) => {
+    const p = waiting.get(m?.job_id);
+    if (!p) return;
+    waiting.delete(m.job_id);
+    if (m.vec instanceof Float32Array && m.vec.length === EMBEDDING_MANIFEST.dims) p.res(m.vec);
+    else p.rej(new Error("failed"));
+  });
+  w.on("error", () => {
+    if (inner === w) failAll("inner error");
+    rej(new Error("inner error"));
+  });
+  w.on("exit", () => {
+    if (inner === w) failAll("inner exit");
+  });
+});
+try {
+  await spawnInner();
+} catch (e) {
+  writeStatus(e.fatal === "verify_failed" ? "verify_failed" : "load_failed");
+  process.exit(3);
+}
+rmSync3(status, { force: true });
+var heartbeats = join4(homedir3(), ".securecoms", "run", "voice-call");
+var backgroundHeld = () => anyHeartbeatFresh(heartbeats, Date.now());
+try {
+  const srv = await startEmbedderServer({
+    dir,
+    key,
+    backgroundHeld,
+    // 11b review L2: an inner worker that cannot be rebuilt is a load failure the spawner can read; idle and signals exit 0.
+    onExit: (reason) => {
+      if (reason === "reset_failed") {
+        writeStatus("load_failed");
+        process.exit(3);
+      }
+      process.exit(0);
+    },
+    hello: { protocol: EMBEDDER_PROTOCOL, model_id: EMBEDDING_MANIFEST.modelId, model_sha256: f("model.onnx").sha256, wasm_sha256: EMBEDDING_MANIFEST.wasmSha256, dims: EMBEDDING_MANIFEST.dims },
+    embed: (text) => new Promise((res, rej) => {
+      const id = ++seq;
+      waiting.set(id, { res, rej });
+      inner.postMessage({ job_id: id, text });
+    }),
+    resetInner: async () => {
+      const old = inner;
+      failAll("reset");
+      await old.terminate();
+      await spawnInner();
+    }
+  });
+  forbidOutbound();
+  for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) process.once(sig, () => void srv.close());
+} catch (e) {
+  process.exit(e instanceof AlreadyRunning ? 0 : e instanceof SocketPathTooLong ? 5 : 4);
+}
+/*! Bundled license information:
+
+@noble/ciphers/esm/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
+*/