chat-recall 0.0.1 → 0.4.8

package/dist/sync-ledger.js

@@ -0,0 +1,366 @@
+/**
+ * Per-conversation sync ledger — client-side bookkeeping for "is THIS
+ * session synced at its current version?".
+ *
+ * Replaces the global lastSyncAt watermark as the source of truth for
+ * incremental sync: every tick walks all sessions, skips the ones whose
+ * ledger row already covers their current mtime, pushes the rest, and
+ * marks a session ONLY after the server acked the batch containing it.
+ * A session that fails to upload stays unmarked and is retried on the
+ * next tick — nothing can be silently skipped forever.
+ *
+ * Keyed by server URL so switching endpoints (self-host ↔ SaaS) restarts
+ * coverage for the new target without forgetting the old one.
+ *
+ * Storage is a plain JSON file under the data dir — NOT SQLite. The thin
+ * collector has no local database, and this is local client state (it's
+ * meaningless on a server and not part of the StorageDriver contract). Keeping
+ * it as JSON is what lets the collector ship with zero native modules.
+ *
+ * Freshness has TWO dimensions, not one:
+ *   - mtime: did the source transcript change?
+ *   - extractor version: did the code that derives synced rows change?
+ * A session is up to date only when BOTH the synced mtime covers the file
+ * AND the synced extractor version is current. This is what makes an
+ * extraction fix self-heal — see extractor-version.ts.
+ *
+ * Shape: { "<serverUrl>": { "<sessionId>": <entry>, ... }, ... }
+ *   where <entry> is { m: <syncedMtime>, v: <extractorVersion> } — or, for
+ *   ledgers written before versioning, a bare <syncedMtime> number (read as
+ *   version 0 so every legacy row is treated as extractor-stale once).
+ */
+import { readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { getDataDir } from '@chat-recall/engine/core/paths.js';
+import { extractorVersionForId } from '@chat-recall/engine/core/extractor-version.js';
+/** Normalize either on-disk shape to {m,v,f}; legacy numbers are version 0. */
+function toRow(entry) {
+    if (entry === undefined)
+        return undefined;
+    return typeof entry === 'number' ? { m: entry, v: 0 } : entry;
+}
+const ledgerPath = () => join(getDataDir(), 'sync-ledger.json');
+/** Where the ledger lives — exposed so repair tooling can back it up before
+ *  editing the file that decides what gets uploaded. */
+export function ledgerFilePath() { return ledgerPath(); }
+// In-memory cache so a sync walk doesn't re-read the file per batch. Loaded
+// lazily; writes go through atomic tmp+rename so a crash mid-write can't
+// corrupt the ledger (worst case: a session re-uploads, which is safe).
+let cache = null;
+function load() {
+    if (cache)
+        return cache;
+    try {
+        const parsed = JSON.parse(readFileSync(ledgerPath(), 'utf-8'));
+        cache = parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        cache = {};
+    }
+    return cache;
+}
+function persist(data) {
+    const path = ledgerPath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(data));
+    renameSync(tmp, path);
+}
+const itemVersionsPath = () => join(getDataDir(), 'item-versions.json');
+let itemVersionsCache = null;
+function loadItemVersionsAll() {
+    if (itemVersionsCache)
+        return itemVersionsCache;
+    try {
+        const parsed = JSON.parse(readFileSync(itemVersionsPath(), 'utf-8'));
+        itemVersionsCache = parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        itemVersionsCache = {};
+    }
+    return itemVersionsCache;
+}
+/** tool → last item-extractor version fully walked for this server. */
+export function loadItemVersions(server) {
+    return { ...(loadItemVersionsAll()[server] || {}) };
+}
+/** Record (merge) the versions this server's items were just walked under. */
+export function saveItemVersions(server, versions) {
+    const all = loadItemVersionsAll();
+    all[server] = { ...(all[server] || {}), ...versions };
+    const path = itemVersionsPath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(all));
+    renameSync(tmp, path);
+}
+/** session_id → mtime the server has acked, for one target server. */
+export function getSyncedMtimes(server) {
+    const data = load();
+    const out = new Map();
+    for (const [id, entry] of Object.entries(data[server] || {}))
+        out.set(id, toRow(entry).m);
+    return out;
+}
+/**
+ * session_id → {mtime, extractorVersion} the server has acked. This is the
+ * accessor the freshness gate uses: a session is current only when the synced
+ * mtime covers the file AND the synced version is >= EXTRACTOR_VERSION.
+ */
+export function getSyncedRows(server) {
+    const data = load();
+    const out = new Map();
+    for (const [id, entry] of Object.entries(data[server] || {}))
+        out.set(id, toRow(entry));
+    return out;
+}
+/** Raw data for one server, useful when you need to mutate (e.g. tombstones). */
+export function getLedgerData(server) {
+    const data = load();
+    return data[server] || {};
+}
+/** Persist mutated data for one server. */
+export function persistLedgerData(server, serverData) {
+    const data = load();
+    data[server] = serverData;
+    persist(data);
+}
+/**
+ * Mark sessions as synced at the given mtimes, stamped with the CURRENT
+ * extractor version (after a server ack). The version stamp is what lets a
+ * later extraction-code change invalidate these rows for re-sync.
+ *
+ * `offset` and `size` are the tail-sync byte cursor (append-only transcripts).
+ * They default to 0 (FULL sync) so callers that don't care about tail sync
+ * leave them absent/0 → the next tick treats the session as FULL-eligible
+ * only when mtime advances, exactly as before this field existed.
+ */
+/**
+ * Record sync progress.
+ *
+ * ── The byte cursor is a DELIVERY RECEIPT, not a measurement ──────────────
+ * `o`/`s` mean "the server has these bytes". `syncMode` returns SKIP/APPEND off
+ * them, so writing a cursor the server never acknowledged makes a session look
+ * complete forever: skipped on every pass, never re-exported, unreachable.
+ * Self-sealing, and silent — nothing reports it.
+ *
+ * That is not hypothetical. A call site stamped the cursor at the LOCAL
+ * `fileSize()` after a tail came back empty, purely to stop the gate retrying.
+ * Once `fileSize()` began summing copies across profile homes, the cursor
+ * jumped to the union size while the server still held one home's half —
+ * measured on session 7adc748c: ledger `s: 7195821`, server 2004 of 2698
+ * records, and it could never re-ship because it read as done.
+ *
+ * So the cursor now moves ONLY when the caller passes `acked: true`, meaning a
+ * server write for those bytes succeeded. Anti-thrash callers that just want to
+ * stop retrying within an mtime pass a row WITHOUT `acked` — mtime alone
+ * already yields SKIP for an unchanged file, which was all they needed.
+ */
+/** How many times a caller tried to move the cursor without an ack. Surfaced so
+ *  a regression shows up as a number instead of silent data loss. */
+let unackedCursorAttempts = 0;
+export function unackedCursorAttemptCount() { return unackedCursorAttempts; }
+export function _resetUnackedCursorCount() { unackedCursorAttempts = 0; }
+export function markSynced(server, rows) {
+    if (rows.length === 0)
+        return;
+    const data = load();
+    const forServer = data[server] || (data[server] = {});
+    for (const r of rows) {
+        // PRESERVE per-field coverage `f` — it's owned by field reconciliation and
+        // must survive a conversation re-sync. Overwriting the whole entry here was
+        // wiping it, making every reconcile re-scan from scratch.
+        const prev = toRow(forServer[r.id]);
+        const prevF = prev?.f;
+        const prevOS = prev && (prev.o !== undefined || prev.s !== undefined)
+            ? { o: prev.o, s: prev.s }
+            : {};
+        // Unacknowledged rows keep whatever cursor the server last confirmed. A
+        // local measurement must never move it forward — see the header.
+        const cursorFromCaller = r.acked === true;
+        if (!cursorFromCaller && (r.offset !== undefined || r.size !== undefined)) {
+            unackedCursorAttempts++;
+        }
+        const o = (cursorFromCaller ? r.offset : undefined) ?? prevOS.o ?? 0;
+        const s = (cursorFromCaller ? r.size : undefined) ?? prevOS.s ?? 0;
+        // Record the version that applies to THIS session's tool (per-tool), so a
+        // tool-specific extractor bump only re-ships that tool's sessions.
+        const ev = extractorVersionForId(r.id);
+        const base = prevF
+            ? { m: Math.floor(r.mtime), v: ev, f: prevF }
+            : { m: Math.floor(r.mtime), v: ev };
+        if (o > 0 || s > 0) {
+            base.o = o;
+            base.s = s;
+        }
+        // Content hash: set when a FULL sync (or an unchanged-content skip) supplies
+        // it. An APPEND passes no hash → the stale head hash is dropped, so a later
+        // FULL never falsely matches the grown content.
+        if (r.hash !== undefined)
+            base.h = r.hash;
+        forServer[r.id] = base;
+    }
+    persist(data);
+}
+/**
+ * Does `field` need (re)scanning for a session whose ledger row is `row` and
+ * whose current transcript mtime is `mtime`? True when never covered, covered
+ * at an older field version, or (for mtime-sensitive fields) the transcript
+ * moved past the mtime it was scanned at. `force` overrides everything. An
+ * absent-but-current field returns false — that's the no-retry guarantee.
+ */
+export function fieldNeedsScan(row, field, mtime, force = false) {
+    if (force)
+        return true;
+    const cov = row?.f?.[field.name];
+    if (!cov)
+        return true;
+    if (cov.v < field.version)
+        return true;
+    if (field.mtimeSensitive && (cov.m ?? 0) < Math.floor(mtime))
+        return true;
+    return false;
+}
+/**
+ * Record per-field coverage after the server acked (or, for absent fields,
+ * locally). Each row stamps ONE field's {version, present, mtime} onto the
+ * session's `f` map WITHOUT touching its {m,v} conversation state or any other
+ * field. Preserves/creates the row as needed.
+ */
+export function markFieldCoverage(server, field, rows) {
+    if (rows.length === 0)
+        return;
+    const data = load();
+    const forServer = data[server] || (data[server] = {});
+    for (const r of rows) {
+        const row = toRow(forServer[r.id]) ?? { m: 0, v: 0 };
+        const f = row.f ? { ...row.f } : {};
+        f[field.name] = { v: field.version, p: r.present ? 1 : 0, m: Math.floor(r.mtime) };
+        forServer[r.id] = { ...row, f };
+    }
+    persist(data);
+}
+const reconcilePath = () => join(getDataDir(), 'sync-field-reconcile.json');
+let reconcileCache = null;
+function loadReconcile() {
+    if (reconcileCache)
+        return reconcileCache;
+    try {
+        const parsed = JSON.parse(readFileSync(reconcilePath(), 'utf-8'));
+        reconcileCache = parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        reconcileCache = {};
+    }
+    return reconcileCache;
+}
+function persistReconcile(data) {
+    const path = reconcilePath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(data));
+    renameSync(tmp, path);
+}
+function stateFor(server) {
+    const data = loadReconcile();
+    return data[server] || (data[server] = { reconciled: {}, force: {} });
+}
+/** True if a one-time FULL backfill pass is owed for `field` on `server` —
+ *  either never reconciled at this version, or a re-scan was forced. */
+export function fieldNeedsFullPass(server, field) {
+    const st = stateFor(server);
+    return st.force[field.name] === true || (st.reconciled[field.name] ?? 0) < field.version;
+}
+/** Mark a field's full backfill pass complete for `server` at `version`, and
+ *  clear any force flag. Call only after the whole pass succeeded. */
+export function markFieldFullPassDone(server, field) {
+    const data = loadReconcile();
+    const st = data[server] || (data[server] = { reconciled: {}, force: {} });
+    st.reconciled[field.name] = field.version;
+    delete st.force[field.name];
+    persistReconcile(data);
+}
+/** UI/CLI hook: demand a one-time re-scan of `field` (optionally on one server,
+ *  else all known servers). Sets the force flag the next sync honors. */
+export function forceFieldRescan(fieldName, server) {
+    const data = loadReconcile();
+    const servers = server ? [server] : Object.keys(data);
+    if (servers.length === 0 && server)
+        servers.push(server);
+    for (const s of servers) {
+        const st = data[s] || (data[s] = { reconciled: {}, force: {} });
+        st.force[fieldName] = true;
+    }
+    persistReconcile(data);
+}
+/** Test-only: drop the in-memory caches so a fresh file read happens next call. */
+export function _resetLedgerCacheForTests() {
+    cache = null;
+    reconcileCache = null;
+}
+/**
+ * Invalidate a session's ledger row so the next sync tick classifies it as
+ * FULL (never-synced). Used when the server signals `full_resync_needed` for
+ * an append — the client must not retry append (the server lost the prior
+ * envelope); it must FULL re-sync. Deleting the row (rather than clearing just
+ * o/s) is correct: a FULL re-sync re-derives everything including field
+ * coverage `f`, so there's nothing worth preserving. Preserves other sessions.
+ */
+export function markFullResync(server, sessionId) {
+    const data = load();
+    const forServer = data[server];
+    if (!forServer)
+        return;
+    if (!(sessionId in forServer))
+        return;
+    delete forServer[sessionId];
+    persist(data);
+}
+/**
+ * Classify one session's sync mode for this tick.
+ *
+ * @param row        ledger row for this session (undefined = never synced)
+ * @param mtime      current transcript mtime (ms, floored)
+ * @param fileSize   current transcript byte size (0 when unknown / not append-only)
+ * @param extractorVersion current EXTRACTOR_VERSION
+ * @param isAppendOnly  whether the backend's transcript is an append-only file
+ *                      (Claude/Gemini/Codex JSONL = true; OpenCode SQLite = false)
+ */
+export function syncMode(row, mtime, fileSize, extractorVersion, isAppendOnly) {
+    // Never synced → FULL.
+    if (!row)
+        return 'full';
+    // Extractor version bump → FULL (re-derive everything, even if mtime unchanged).
+    if (row.v < extractorVersion)
+        return 'full';
+    const offset = row.o ?? 0;
+    // Append-only file shrank below the last cursor (rotation/truncation/compaction)
+    // → the cursor is invalid; FULL re-sync.
+    if (isAppendOnly && offset > 0 && fileSize > 0 && fileSize < offset)
+        return 'full';
+    // Append-only file that grew since the last ship (size increased), with a
+    // valid prior offset → APPEND. Checked BEFORE skip because mtime can have
+    // coarse (second-level) granularity on some filesystems while size is the
+    // real growth signal — a sub-second append may not move mtime but does grow
+    // the file. (Shrink already handled above; size>=offset guaranteed here.)
+    //
+    // Safe now: the server enforces an OFFSET-CONTINUITY GUARD — an append only
+    // merges when the tail's base_offset equals the server's synced-through `o`,
+    // else it returns full_resync_needed and the client falls back to FULL. That
+    // catches the truncated/stale base that the original append blindly extended
+    // (a 1079-msg session once stored as 65). Default ON; CHAT_RECALL_TAIL_APPEND=0
+    // is the emergency off-switch. See docs/SYNC-INCREMENTAL.md.
+    if (process.env.CHAT_RECALL_TAIL_APPEND !== '0' &&
+        isAppendOnly && fileSize > 0 && offset > 0 && fileSize > (row.s ?? 0)) {
+        return 'append';
+    }
+    // mtime unchanged → the last sync (FULL or APPEND) covered this version of
+    // the file. SKIP. The byte cursor is NOT a skip prerequisite — a FULL sync
+    // that didn't record an offset still shipped the whole file at this mtime.
+    if (row.m >= Math.floor(mtime))
+        return 'skip';
+    // Everything else (mtime moved on a non-append-only backend, first tail sync
+    // with no prior offset, …) → FULL.
+    return 'full';
+}
+//# sourceMappingURL=sync-ledger.js.map

package/dist/sync-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-ledger.js","sourceRoot":"","sources":["../src/sync-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAgCtF,+EAA+E;AAC/E,SAAS,KAAK,CAAC,KAA8B;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAExE;wDACwD;AACxD,MAAM,UAAU,cAAc,KAAa,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC;AAEjE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,IAAI,KAAK,GAAkB,IAAI,CAAC;AAEhC,SAAS,IAAI;IACX,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,KAAK,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAWD,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAChF,IAAI,iBAAiB,GAAwB,IAAI,CAAC;AAElD,SAAS,mBAAmB;IAC1B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,iBAAiB,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QAAC,iBAAiB,GAAG,EAAE,CAAC;IAAC,CAAC;IACnC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,QAAgC;IAC/E,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAuC;IACvF,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;qEACqE;AACrE,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAC9B,MAAM,UAAU,yBAAyB,KAAa,OAAO,qBAAqB,CAAC,CAAC,CAAC;AACrF,MAAM,UAAU,wBAAwB,KAAW,qBAAqB,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,IAKE;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,2EAA2E;QAC3E,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;YACnE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;YAC1B,CAAC,CAAC,EAAE,CAAC;QACP,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;QAC1C,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1E,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAc,KAAK;YAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC/C,6EAA6E;QAC7E,4EAA4E;QAC5E,gDAAgD;QAChD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1C,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,GAA0B,EAC1B,KAAiE,EACjE,KAAa,EACb,KAAK,GAAG,KAAK;IAEb,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAwC,EACxC,IAA4D;IAE5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAWD,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,2BAA2B,CAAC,CAAC;AACpF,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,SAAS,aAAa;IACpB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,cAAc,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QAAC,cAAc,GAAG,EAAE,CAAC;IAAC,CAAC;IAChC,OAAO,cAAc,CAAC;AACxB,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AACD,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAwC;IACzF,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;AAC3F,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,KAAwC;IAC5F,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAC1C,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAe;IACjE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,yBAAyB;IACvC,KAAK,GAAG,IAAI,CAAC;IACb,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB;IAC9D,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAAE,OAAO;IACtC,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,GAA0B,EAC1B,KAAa,EACb,QAAgB,EAChB,gBAAwB,EACxB,YAAqB;IAErB,uBAAuB;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,iFAAiF;IACjF,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,iFAAiF;IACjF,yCAAyC;IACzC,IAAI,YAAY,IAAI,MAAM,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,MAAM;QAAE,OAAO,MAAM,CAAC;IACnF,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAC3C,YAAY,IAAI,QAAQ,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9C,6EAA6E;IAC7E,mCAAmC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/update-notice.d.ts

@@ -0,0 +1,16 @@
+interface UpdateCheck {
+    /** Newest version advertised by any server we sync to. */
+    serverVersion: string;
+    /** When we last asked (epoch ms). */
+    checkedAt: number;
+}
+/**
+ * The pending-update line, or null when current/unknown. Pure read of the
+ * cached probe — no I/O beyond one small file, safe on every command.
+ */
+export declare function updateNotice(): string | null;
+/** Ask each logged-in server what it serves, and cache the newest. Best-effort. */
+export declare function refreshUpdateCheck(force?: boolean): Promise<UpdateCheck | null>;
+export declare function printUpdateNotice(): void;
+export {};
+//# sourceMappingURL=update-notice.d.ts.map

package/dist/update-notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notice.d.ts","sourceRoot":"","sources":["../src/update-notice.ts"],"names":[],"mappings":"AAsBA,UAAU,WAAW;IACnB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAeD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAO5C;AAED,mFAAmF;AACnF,wBAAsB,kBAAkB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAwBnF;AASD,wBAAgB,iBAAiB,IAAI,IAAI,CASxC"}

package/dist/update-notice.js

@@ -0,0 +1,107 @@
+/**
+ * "You are running an old CLI" — the last-resort channel.
+ *
+ * Auto-update (auto-update.ts) handles the normal case, but it can only help a
+ * client that already HAS it: anything older simply never asks, and a machine
+ * whose `npm i -g` fails retries silently forever. Both cases end the same way —
+ * a box quietly runs a months-old collector and nobody finds out until someone
+ * notices missing data by hand.
+ *
+ * So: every CLI invocation prints ONE stderr line when the server it syncs to
+ * advertises a newer release. Reading a cached probe keeps that free — the
+ * actual capabilities call runs at most every 6h, detached, and never blocks or
+ * fails a command.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getDataDir } from '@chat-recall/engine/core/paths.js';
+import { compareVersions } from './auto-update.js';
+import { fetchWithTimeout, cliVersion } from './http.js';
+const CHECK_TTL_MS = 6 * 3600 * 1000;
+const checkPath = () => join(getDataDir(), 'update-check.json');
+function readCheck() {
+    try {
+        const c = JSON.parse(readFileSync(checkPath(), 'utf-8'));
+        return c && typeof c.serverVersion === 'string' ? c : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCheck(c) {
+    try {
+        writeFileSync(checkPath(), JSON.stringify(c));
+    }
+    catch { /* cache is a nicety */ }
+}
+/**
+ * The pending-update line, or null when current/unknown. Pure read of the
+ * cached probe — no I/O beyond one small file, safe on every command.
+ */
+export function updateNotice() {
+    const c = readCheck();
+    if (!c)
+        return null;
+    const own = cliVersion();
+    if (compareVersions(c.serverVersion, own) <= 0)
+        return null;
+    return `chat-recall ${c.serverVersion} is available (you have ${own}). `
+        + `Auto-update should apply it; force it now with: chat-recall update`;
+}
+/** Ask each logged-in server what it serves, and cache the newest. Best-effort. */
+export async function refreshUpdateCheck(force = false) {
+    const prev = readCheck();
+    if (!force && prev && Date.now() - prev.checkedAt < CHECK_TTL_MS)
+        return prev;
+    let newest = '0.0.0';
+    try {
+        const { loadAllCredentials } = await import('./sync-client.js');
+        for (const cred of loadAllCredentials()) {
+            if (!cred.serverUrl)
+                continue;
+            const base = cred.serverUrl.replace(/\/+$/, '');
+            try {
+                const res = await fetchWithTimeout(`${base}/api/capabilities`, {
+                    headers: cred.token ? { authorization: `Bearer ${cred.token}` } : {},
+                }, 5_000);
+                if (!res.ok)
+                    continue;
+                const caps = (await res.json());
+                const v = caps?.cli?.version;
+                if (v && compareVersions(v, newest) > 0)
+                    newest = v;
+            }
+            catch { /* one unreachable server must not poison the check */ }
+        }
+    }
+    catch {
+        return prev;
+    }
+    if (newest === '0.0.0')
+        return prev;
+    const next = { serverVersion: newest, checkedAt: Date.now() };
+    writeCheck(next);
+    return next;
+}
+/**
+ * Print the notice (once per process) and kick a detached refresh.
+ *
+ * stderr, never stdout: piping `chat-recall search … | jq` must keep working.
+ * The refresh is unref'd so it can never hold a short command open.
+ */
+let printed = false;
+export function printUpdateNotice() {
+    if (printed)
+        return;
+    printed = true;
+    try {
+        const msg = updateNotice();
+        if (msg)
+            console.error(`\n  ⚠  ${msg}\n`);
+        const t = setTimeout(() => { void refreshUpdateCheck().catch(() => { }); }, 0);
+        if (typeof t.unref === 'function')
+            t.unref();
+    }
+    catch { /* a nudge must never break a command */ }
+}
+//# sourceMappingURL=update-notice.js.map

package/dist/update-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notice.js","sourceRoot":"","sources":["../src/update-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AASrC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAEhE,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAgB,CAAC;QACxE,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,CAAc;IAChC,IAAI,CAAC;QAAC,aAAa,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,eAAe,CAAC,CAAC,aAAa,2BAA2B,GAAG,KAAK;UACpE,oEAAoE,CAAC;AAC3E,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAK,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,IAAI,mBAAmB,EAAE;oBAC7D,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;iBACrE,EAAE,KAAK,CAAC,CAAC;gBACV,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,SAAS;gBACtB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;gBACzE,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;gBAC7B,IAAI,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxB,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC9D,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,MAAM,UAAU,iBAAiB;IAC/B,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;AACtD,CAAC"}

package/dist/verify-deep.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `chat-recall verify --deep` — does the server actually hold what this machine
+ * has, per session?
+ *
+ * Every silent-loss incident in this codebase was found by a human asking about
+ * one specific session. Nothing reported them, because every symptom looks like
+ * healthy operation: `15604 skipped` is what a fully-synced corpus prints too.
+ * This is the check that turns "did session X make it?" from an investigation
+ * into a command.
+ *
+ * It compares in the unit the server's shrink guard uses — `gzipContainer().size`
+ * of the local union versus the archive's stored `size` — so a difference means
+ * the server is genuinely missing records, not that two measurements disagree.
+ * Sub-unit noise is ignored via a tolerance.
+ *
+ * Both sides must be the REDACTED container (see Deps.localContainerSize): the
+ * archive stores what was shipped, and what was shipped had its secrets
+ * replaced by sentinels.
+ *
+ * Deliberately NOT an mtime comparison: the server stores the client-sent mtime,
+ * which drifts sub-second against the file for essentially every session. An
+ * mtime-based version of this check reported 9,975 of 10,032 sessions suspect
+ * when the true number was 13.
+ *
+ * Classification matters as much as detection:
+ *   pending   — the ledger knows there is more to send; it will go on its own
+ *   STRANDED  — the ledger claims complete while the server holds less, so
+ *               nothing will ever re-ship it. This is the actionable class.
+ */
+export interface VerifyFinding {
+    sessionId: string;
+    projectPath: string;
+    localSize: number;
+    serverSize: number;
+    deficit: number;
+    /** Ledger claims complete ⇒ nothing will re-ship it without intervention. */
+    stranded: boolean;
+}
+export interface VerifyReport {
+    server: string;
+    checked: number;
+    complete: number;
+    missingArchive: number;
+    pending: VerifyFinding[];
+    stranded: VerifyFinding[];
+}
+interface Deps {
+    listSessions(sinceMs: number): Array<{
+        rawId: string;
+        prefixedId: string;
+        projectPath: string;
+        mtime: number;
+    }>;
+    /**
+     * Size of the container as it WOULD BE SHIPPED — i.e. REDACTED, then gzipped.
+     *
+     * This is a hard requirement, not a preference. The sync path redacts before
+     * archiving, so measuring the raw container compares two different artifacts:
+     * a long secret becomes a short sentinel and the local side reads bigger
+     * forever. Two sessions were reported stranded through a full repair+sync
+     * cycle for exactly this reason — the deficit was redaction, not loss, and no
+     * amount of re-shipping could ever close it.
+     */
+    localContainerSize(rawId: string): number | null;
+    fileSize(rawId: string): number;
+    serverSizes(server: string, token: string): Promise<Map<string, number>>;
+}
+/**
+ * Pure comparison, injectable so it can be tested without a server or a real
+ * transcript corpus.
+ */
+export declare function verifyAgainstServer(server: string, token: string, sinceMs: number, deps: Deps, now?: number): Promise<VerifyReport>;
+/** Every configured target, so a multi-server setup is verified as a whole. */
+export declare function verifyTargets(): Array<{
+    serverUrl: string;
+    token: string;
+}>;
+export {};
+//# sourceMappingURL=verify-deep.d.ts.map

package/dist/verify-deep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-deep.d.ts","sourceRoot":"","sources":["../src/verify-deep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAmBD,UAAU,IAAI;IACZ,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChH;;;;;;;;;OASG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,CAAC,CAyCvB;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,IAAI,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3E"}