chat-recall 0.5.5 → 0.5.7

package/dist/target-breaker.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Stop hammering a server that is not answering.
+ *
+ * ── The behaviour this replaces ───────────────────────────────────────────
+ * Every walk tried every configured target, in full, forever. A target that was
+ * down did not merely fail — it failed SLOWLY, once per session, inside the same
+ * serial walk as the healthy one: connect timeout, three retries with 2s/8s/30s
+ * backoff, then the next session. One measured log carried 1,772 `fetch failed`
+ * and 3,526 HTTP 429 and was still producing them at 26–38 per hour, days later.
+ *
+ * The cost lands on the wrong target. Because targets are walked in sequence, a
+ * dead LAN box delays every ship to the healthy SaaS host behind it, and the
+ * whole walk's completion — which is what the ledger, the health file and the
+ * progress report all wait on.
+ *
+ * ── The rule ─────────────────────────────────────────────────────────────
+ * Consecutive whole-walk failures trip the breaker. It stays open for a
+ * doubling cooldown, capped, and one success closes it completely.
+ *
+ * Deliberately counted per WALK, not per request. A single walk already retries
+ * internally and obeys Retry-After; failing individual requests are normal
+ * operation and must not trip anything. What "the target is down" actually looks
+ * like is a whole walk failing, repeatedly.
+ *
+ * Process-lifetime only, and that is the right lifetime: a restart is exactly
+ * when you want to retry a target you gave up on. Nothing is persisted.
+ *
+ * A tripped breaker is never silent. It is reported to the health file so the
+ * user hears "this server is being skipped" instead of watching a target quietly
+ * never sync.
+ */
+/** Consecutive failed walks before a target is skipped. */
+export declare const TRIP_AFTER_FAILURES: number;
+/** First cooldown, doubled per subsequent failure. */
+export declare const BASE_COOLDOWN_MS: number;
+/** Ceiling, so a target is always retried eventually. */
+export declare const MAX_COOLDOWN_MS: number;
+/** Test seam. */
+export declare function _resetBreakers(): void;
+/** Cooldown for the Nth consecutive failure, doubling and capped. */
+export declare function cooldownFor(failures: number): number;
+export interface BreakerVerdict {
+    /** True when this target should be skipped right now. */
+    open: boolean;
+    /** Milliseconds until the next attempt. 0 when closed. */
+    retryInMs: number;
+    failures: number;
+    lastError: string;
+}
+/** Should this target be skipped? */
+export declare function breakerState(serverUrl: string, now?: number): BreakerVerdict;
+/** A walk against this target completed. Clear everything. */
+export declare function noteTargetSuccess(serverUrl: string): void;
+/**
+ * A walk against this target failed. Returns the verdict for the NEXT attempt,
+ * so the caller can report "skipping for 4m" in the same breath as the failure.
+ */
+export declare function noteTargetFailure(serverUrl: string, error: string, now?: number): BreakerVerdict;
+/** One line for the log, or null when there is nothing to say. */
+export declare function breakerNotice(serverUrl: string, v: BreakerVerdict): string | null;
+//# sourceMappingURL=target-breaker.d.ts.map

package/dist/target-breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-breaker.d.ts","sourceRoot":"","sources":["../src/target-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,QAAoD,CAAC;AACrF,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,QAAgE,CAAC;AAC9F,yDAAyD;AACzD,eAAO,MAAM,eAAe,QAAgE,CAAC;AAM7F,iBAAiB;AACjB,wBAAgB,cAAc,IAAI,IAAI,CAAmB;AAIzD,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,cAAc,CAMhF;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,cAAc,CAapG;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAKjF"}

package/dist/target-breaker.js

@@ -0,0 +1,85 @@
+/**
+ * Stop hammering a server that is not answering.
+ *
+ * ── The behaviour this replaces ───────────────────────────────────────────
+ * Every walk tried every configured target, in full, forever. A target that was
+ * down did not merely fail — it failed SLOWLY, once per session, inside the same
+ * serial walk as the healthy one: connect timeout, three retries with 2s/8s/30s
+ * backoff, then the next session. One measured log carried 1,772 `fetch failed`
+ * and 3,526 HTTP 429 and was still producing them at 26–38 per hour, days later.
+ *
+ * The cost lands on the wrong target. Because targets are walked in sequence, a
+ * dead LAN box delays every ship to the healthy SaaS host behind it, and the
+ * whole walk's completion — which is what the ledger, the health file and the
+ * progress report all wait on.
+ *
+ * ── The rule ─────────────────────────────────────────────────────────────
+ * Consecutive whole-walk failures trip the breaker. It stays open for a
+ * doubling cooldown, capped, and one success closes it completely.
+ *
+ * Deliberately counted per WALK, not per request. A single walk already retries
+ * internally and obeys Retry-After; failing individual requests are normal
+ * operation and must not trip anything. What "the target is down" actually looks
+ * like is a whole walk failing, repeatedly.
+ *
+ * Process-lifetime only, and that is the right lifetime: a restart is exactly
+ * when you want to retry a target you gave up on. Nothing is persisted.
+ *
+ * A tripped breaker is never silent. It is reported to the health file so the
+ * user hears "this server is being skipped" instead of watching a target quietly
+ * never sync.
+ */
+/** Consecutive failed walks before a target is skipped. */
+export const TRIP_AFTER_FAILURES = Number(process.env.CHAT_RECALL_BREAKER_TRIP) || 3;
+/** First cooldown, doubled per subsequent failure. */
+export const BASE_COOLDOWN_MS = Number(process.env.CHAT_RECALL_BREAKER_COOLDOWN_MS) || 60_000;
+/** Ceiling, so a target is always retried eventually. */
+export const MAX_COOLDOWN_MS = Number(process.env.CHAT_RECALL_BREAKER_MAX_MS) || 15 * 60_000;
+const state = new Map();
+/** Test seam. */
+export function _resetBreakers() { state.clear(); }
+const key = (serverUrl) => serverUrl.replace(/\/+$/, '');
+/** Cooldown for the Nth consecutive failure, doubling and capped. */
+export function cooldownFor(failures) {
+    const over = Math.max(0, failures - TRIP_AFTER_FAILURES);
+    return Math.min(MAX_COOLDOWN_MS, BASE_COOLDOWN_MS * 2 ** over);
+}
+/** Should this target be skipped? */
+export function breakerState(serverUrl, now = Date.now()) {
+    const s = state.get(key(serverUrl));
+    if (!s || s.openUntil <= now) {
+        return { open: false, retryInMs: 0, failures: s?.failures ?? 0, lastError: s?.lastError ?? '' };
+    }
+    return { open: true, retryInMs: s.openUntil - now, failures: s.failures, lastError: s.lastError };
+}
+/** A walk against this target completed. Clear everything. */
+export function noteTargetSuccess(serverUrl) {
+    state.delete(key(serverUrl));
+}
+/**
+ * A walk against this target failed. Returns the verdict for the NEXT attempt,
+ * so the caller can report "skipping for 4m" in the same breath as the failure.
+ */
+export function noteTargetFailure(serverUrl, error, now = Date.now()) {
+    const k = key(serverUrl);
+    const prior = state.get(k);
+    const failures = (prior?.failures ?? 0) + 1;
+    const lastError = error.slice(0, 200);
+    if (failures < TRIP_AFTER_FAILURES) {
+        // Not yet a pattern — a single failed walk is ordinary.
+        state.set(k, { failures, openUntil: 0, lastError });
+        return { open: false, retryInMs: 0, failures, lastError };
+    }
+    const cooldown = cooldownFor(failures);
+    state.set(k, { failures, openUntil: now + cooldown, lastError });
+    return { open: true, retryInMs: cooldown, failures, lastError };
+}
+/** One line for the log, or null when there is nothing to say. */
+export function breakerNotice(serverUrl, v) {
+    if (!v.open)
+        return null;
+    const mins = Math.max(1, Math.round(v.retryInMs / 60_000));
+    return `skipping ${serverUrl} — ${v.failures} consecutive failed sync(s), next attempt in ~${mins}m`
+        + (v.lastError ? ` (last error: ${v.lastError})` : '');
+}
+//# sourceMappingURL=target-breaker.js.map

package/dist/target-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-breaker.js","sourceRoot":"","sources":["../src/target-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACrF,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,CAAC;AAC9F,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC;AAI7F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;AAEvC,iBAAiB;AACjB,MAAM,UAAU,cAAc,KAAW,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAEzD,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzE,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,gBAAgB,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAWD,qCAAqC;AACrC,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;AACpG,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACnC,wDAAwD;QACxD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,CAAiB;IAChE,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC;IAC3D,OAAO,YAAY,SAAS,MAAM,CAAC,CAAC,QAAQ,iDAAiD,IAAI,GAAG;UAChG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/telemetry-consent.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Has the user opted out?
+ *
+ * Default is ON for the operational facts above — an opt-OUT, which is what the
+ * product intends and what the docs must say plainly. Anything that touches user
+ * CONTENT is not covered by this and is not collected at all, at any setting.
+ */
+export declare function userConsents(): boolean;
+/** Record what the server said about this tenant's plan. */
+export declare function setTelemetryEligible(serverUrl: string, allowed: boolean): void;
+/** Default NO: a server that never said yes never gets telemetry. */
+export declare function serverAllowsTelemetry(serverUrl: string): boolean;
+/** Test seam. */
+export declare function _resetTelemetryEligibility(): void;
+/** Both gates, for one target. */
+export declare function mayReport(serverUrl: string): boolean;
+export interface SensitiveKeyViolation {
+    key: string;
+    where: string;
+}
+/** Every forbidden key in `obj`, deeply. Empty means safe to send. */
+export declare function findSensitiveKeys(obj: unknown, where?: string): SensitiveKeyViolation[];
+/**
+ * Throw when a payload carries a forbidden key.
+ *
+ * Deliberately loud: a telemetry event that leaks a file path is a privacy
+ * incident, and the cheapest place to stop it is the type of failure a developer
+ * cannot ignore.
+ */
+export declare function assertNoSensitiveKeys(payload: unknown): void;
+//# sourceMappingURL=telemetry-consent.d.ts.map

package/dist/telemetry-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-consent.d.ts","sourceRoot":"","sources":["../src/telemetry-consent.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAKD,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,iBAAiB;AACjB,wBAAgB,0BAA0B,IAAI,IAAI,CAAsB;AAExE,kCAAkC;AAClC,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpD;AAWD,MAAM,WAAW,qBAAqB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAErE,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAK,GAAG,qBAAqB,EAAE,CAYnF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAQ5D"}

package/dist/telemetry-consent.js

@@ -0,0 +1,115 @@
+/**
+ * Whether this machine may report operational telemetry, and what counts as it.
+ *
+ * TWO INDEPENDENT GATES, both of which must open. They are separate on purpose:
+ * one answers "is the user willing", the other "is the operator entitled", and
+ * conflating them is how a product ends up collecting from someone who said no.
+ *
+ *   1. CONSENT — the user's setting, checked on this machine. It wins over
+ *      everything. No server response can override it, because a server should
+ *      not be able to talk a client into sending data its owner declined.
+ *
+ *   2. ELIGIBILITY — the server says whether this tenant's plan includes it.
+ *      The client cannot know its own plan (the entitlement lives in the control
+ *      plane), so it is told, and it defaults to NOT eligible: an older server
+ *      that says nothing gets nothing.
+ *
+ * The server enforces (2) again at ingest. This gate is an optimisation — it
+ * stops the data leaving a machine that shouldn't send it — not the boundary.
+ *
+ * ── What may be reported, and what may never be ──────────────────────────
+ * Operational facts about the COLLECTOR, never about the user's work:
+ *
+ *   allowed   walk duration, sessions considered/shipped, bytes uploaded,
+ *             429/failure counts, breaker trips, RSS peak, CLI version, OS,
+ *             error CLASS plus a redacted message
+ *   forbidden transcript content, prompts, file paths, project names, session
+ *             ids, repository names, anything derived from what the user wrote
+ *
+ * `assertNoSensitiveKeys` enforces the second list structurally rather than by
+ * review, because "no paths" is exactly the promise that erodes one convenient
+ * field at a time.
+ */
+import { loadSettings } from '@chat-recall/engine/core/settings.js';
+/** Env kill-switch, for a machine where editing settings is not practical. */
+const ENV_OFF = () => {
+    const v = (process.env.CHAT_RECALL_TELEMETRY || '').trim().toLowerCase();
+    return v === '0' || v === 'off' || v === 'false' || v === 'no';
+};
+/**
+ * Has the user opted out?
+ *
+ * Default is ON for the operational facts above — an opt-OUT, which is what the
+ * product intends and what the docs must say plainly. Anything that touches user
+ * CONTENT is not covered by this and is not collected at all, at any setting.
+ */
+export function userConsents() {
+    if (ENV_OFF())
+        return false;
+    try {
+        const s = loadSettings();
+        return s.privacy?.telemetry !== false;
+    }
+    catch {
+        // Unreadable settings must not be read as consent.
+        return false;
+    }
+}
+/** Eligibility as last reported by a server, keyed by server URL. */
+const eligible = new Map();
+/** Record what the server said about this tenant's plan. */
+export function setTelemetryEligible(serverUrl, allowed) {
+    eligible.set(serverUrl.replace(/\/+$/, ''), allowed);
+}
+/** Default NO: a server that never said yes never gets telemetry. */
+export function serverAllowsTelemetry(serverUrl) {
+    return eligible.get(serverUrl.replace(/\/+$/, '')) === true;
+}
+/** Test seam. */
+export function _resetTelemetryEligibility() { eligible.clear(); }
+/** Both gates, for one target. */
+export function mayReport(serverUrl) {
+    return userConsents() && serverAllowsTelemetry(serverUrl);
+}
+/**
+ * Keys that must never appear in a telemetry payload.
+ *
+ * Checked structurally so the promise survives the next person adding "just the
+ * project name for context". A violation throws in development and drops the
+ * event in production — never sends it anyway.
+ */
+const FORBIDDEN_KEY = /(path|dir|file|project|repo|session|prompt|content|text|title|branch|url|email|user|home|cwd)/i;
+/** Every forbidden key in `obj`, deeply. Empty means safe to send. */
+export function findSensitiveKeys(obj, where = '') {
+    const out = [];
+    const walk = (v, at) => {
+        if (!v || typeof v !== 'object')
+            return;
+        if (Array.isArray(v)) {
+            v.forEach((e, i) => walk(e, `${at}[${i}]`));
+            return;
+        }
+        for (const [k, val] of Object.entries(v)) {
+            if (FORBIDDEN_KEY.test(k))
+                out.push({ key: k, where: at || '(root)' });
+            walk(val, at ? `${at}.${k}` : k);
+        }
+    };
+    walk(obj, where);
+    return out;
+}
+/**
+ * Throw when a payload carries a forbidden key.
+ *
+ * Deliberately loud: a telemetry event that leaks a file path is a privacy
+ * incident, and the cheapest place to stop it is the type of failure a developer
+ * cannot ignore.
+ */
+export function assertNoSensitiveKeys(payload) {
+    const bad = findSensitiveKeys(payload);
+    if (bad.length > 0) {
+        throw new Error(`telemetry payload carries forbidden key(s): ${bad.map((b) => `${b.where}.${b.key}`).join(', ')}. `
+            + 'Operational telemetry must describe the COLLECTOR, never the user\'s work.');
+    }
+}
+//# sourceMappingURL=telemetry-consent.js.map

package/dist/telemetry-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-consent.js","sourceRoot":"","sources":["../src/telemetry-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,OAAO,GAAG,GAAY,EAAE;IAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAA2C,CAAC;QAClE,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,KAAK,KAAK,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAgB;IACtE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,0BAA0B,KAAW,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAExE,kCAAkC;AAClC,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,OAAO,YAAY,EAAE,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,gGAAgG,CAAC;AAIvH,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,KAAK,GAAG,EAAE;IACxD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAU,EAAQ,EAAE;QAC5C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACjG,4EAA4E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,22 @@
+/** One reportable fact about a collector run. `kind` is the event class. */
+export interface TelemetryEvent {
+    kind: string;
+    /** Numbers only, plus the few enumerated strings below. No free text. */
+    [k: string]: string | number | boolean | undefined;
+}
+/**
+ * Record an event. Cheap and synchronous — it never blocks the caller and never
+ * throws, because a measurement must not be able to break the thing it measures.
+ */
+export declare function record(event: TelemetryEvent): void;
+/** Pending events, for tests and `doctor`. */
+export declare function pending(): readonly TelemetryEvent[];
+export declare function _clearForTests(): void;
+/**
+ * Ship whatever is queued to every eligible target, then clear.
+ *
+ * Called after a sync completes — the connection is warm, the numbers are final,
+ * and there is no separate schedule to get wrong.
+ */
+export declare function flush(): Promise<void>;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAqCA,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACpD;AAKD;;;GAGG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAWlD;AAED,8CAA8C;AAC9C,wBAAgB,OAAO,IAAI,SAAS,cAAc,EAAE,CAAkB;AACtE,wBAAgB,cAAc,IAAI,IAAI,CAAsB;AAE5D;;;;;GAKG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAsC3C"}

package/dist/telemetry.js

@@ -0,0 +1,125 @@
+/**
+ * Report how the COLLECTOR is doing, to the user's own server.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────
+ * Every performance fact known about this product came from one developer
+ * machine. "How long does a first sync take for a customer with 5,000 sessions?"
+ * had no answer, because nothing measured a customer. The collector already
+ * computes everything needed — walk duration, sessions considered, bytes shipped,
+ * 429 counts, breaker trips, RSS peak — and then throws it away.
+ *
+ * ── What it is not ───────────────────────────────────────────────────────
+ * Not analytics, not usage tracking, not anything about what the user is doing.
+ * `assertNoSensitiveKeys` refuses a payload carrying a path, project, session id,
+ * prompt or content key, so the promise is enforced by the type of failure a
+ * developer cannot ignore rather than by review.
+ *
+ * ── Gates ────────────────────────────────────────────────────────────────
+ * Both must open (see telemetry-consent.ts): the user has not opted out, AND the
+ * server says this tenant's plan includes it. The server checks the plan again at
+ * ingest, so this gate exists to stop the data LEAVING a machine that should not
+ * send it — the client is never the boundary.
+ *
+ * ── Failure policy ───────────────────────────────────────────────────────
+ * Fire-and-forget, and silent. Telemetry that logs its own failures produces
+ * noise about the thing that was supposed to reduce noise, and a collector must
+ * never fail a sync because it could not report on the sync.
+ */
+import { hostname, platform } from 'os';
+import { mayReport, assertNoSensitiveKeys } from './telemetry-consent.js';
+import { fetchWithTimeout } from './http.js';
+import { loadAllCredentials } from './sync-client.js';
+const cliVersion = () => {
+    try {
+        return typeof __CLI_VERSION__ === 'string' ? __CLI_VERSION__ : 'dev';
+    }
+    catch {
+        return 'dev';
+    }
+};
+const MAX_QUEUE = 50;
+const queue = [];
+/**
+ * Record an event. Cheap and synchronous — it never blocks the caller and never
+ * throws, because a measurement must not be able to break the thing it measures.
+ */
+export function record(event) {
+    try {
+        assertNoSensitiveKeys(event);
+    }
+    catch (err) {
+        // A forbidden key is a developer error, not a runtime condition. Loud in
+        // development, dropped in production — never sent either way.
+        if (process.env.NODE_ENV !== 'production')
+            throw err;
+        return;
+    }
+    if (queue.length >= MAX_QUEUE)
+        queue.shift(); // newest matter most
+    queue.push(event);
+}
+/** Pending events, for tests and `doctor`. */
+export function pending() { return queue; }
+export function _clearForTests() { queue.length = 0; }
+/**
+ * Ship whatever is queued to every eligible target, then clear.
+ *
+ * Called after a sync completes — the connection is warm, the numbers are final,
+ * and there is no separate schedule to get wrong.
+ */
+export async function flush() {
+    if (queue.length === 0)
+        return;
+    let targets = [];
+    try {
+        targets = loadAllCredentials();
+    }
+    catch {
+        return;
+    }
+    const eligible = targets.filter((t) => mayReport(t.serverUrl));
+    if (eligible.length === 0) {
+        // Nothing may receive these. Drop them rather than growing a queue that will
+        // never drain — a user who opted out must not accumulate a backlog either.
+        queue.length = 0;
+        return;
+    }
+    const events = queue.map((e) => ({
+        ...e,
+        ts: Date.now(),
+        cliVersion: cliVersion(),
+        os: platform(),
+        // A STABLE, NON-IDENTIFYING machine marker. The server overwrites device_id
+        // from the authenticated token anyway (it is the only side that can resolve
+        // it), so this is a fallback for older servers and is deliberately a hash,
+        // never the hostname itself.
+        deviceId: hashHost(),
+    }));
+    queue.length = 0;
+    await Promise.allSettled(eligible.map(async (t) => {
+        try {
+            await fetchWithTimeout(`${t.serverUrl.replace(/\/+$/, '')}/api/client-events`, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    ...(t.token ? { authorization: `Bearer ${t.token}` } : {}),
+                },
+                body: JSON.stringify({ events }),
+            }, 10_000);
+        }
+        catch { /* fire and forget — see the header */ }
+    }));
+}
+/** sha256 of the hostname, first 12 — stable per machine, not reversible. */
+function hashHost() {
+    try {
+        // Lazy so the crypto import is not paid by callers that never report.
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { createHash } = require('node:crypto');
+        return createHash('sha256').update(hostname()).digest('hex').slice(0, 12);
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,CAAC;QAAC,OAAO,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACvG,CAAC,CAAC;AASF,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,KAAK,GAAqB,EAAE,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAqB;IAC1C,IAAI,CAAC;QACH,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAAE,MAAM,GAAG,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAG,qBAAqB;IACrE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,KAAgC,OAAO,KAAK,CAAC,CAAC,CAAC;AACtE,MAAM,UAAU,cAAc,KAAW,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,OAAO,GAAgD,EAAE,CAAC;IAC9D,IAAI,CAAC;QAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,2EAA2E;QAC3E,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC;QACJ,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;QACd,UAAU,EAAE,UAAU,EAAE;QACxB,EAAE,EAAE,QAAQ,EAAE;QACd,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,6BAA6B;QAC7B,QAAQ,EAAE,QAAQ,EAAE;KACrB,CAAC,CAAC,CAAC;IACJ,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEjB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,EAAE;gBAC7E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;aACjC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC;QAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;QAC9E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC"}

package/dist/tick-queue.d.ts

@@ -0,0 +1,67 @@
+/**
+ * One background task at a time, in priority order, with same-kind coalescing.
+ *
+ * ── What it replaces ─────────────────────────────────────────────────────
+ * Three independent in-flight booleans — `syncInFlight`, `intentDrainInFlight`,
+ * `codeIndexInFlight`. Each correctly stopped its OWN tick from overlapping
+ * itself, and none of them knew about the others, so a code-intelligence sweep
+ * could run at the same time as a full sync walk and an intent drain. All three
+ * are heavy: the sweep spawns codeindex and holds its output, the walk holds a
+ * session container, the drain copies files. Measured with a sweep and a walk
+ * overlapping, the main thread sat at 80–95% and RSS more than doubled.
+ *
+ * They also could not express what the daemon actually wants: shipping to the
+ * server matters more than refreshing code intelligence, so if both are due, the
+ * sweep should wait.
+ *
+ * ── Semantics ────────────────────────────────────────────────────────────
+ * SERIAL — exactly one task runs at a time.
+ *
+ * COALESCED PER KIND — if a kind is already waiting, a new request for that kind
+ * is dropped rather than queued twice. Both would do the same work against the
+ * same state, and the second would find nothing to do. This preserves what the
+ * booleans got right (no self-overlap) without the "silently skipped" behaviour:
+ * a request that arrives while its kind is RUNNING sets a re-run flag, so a file
+ * change during a walk still gets a walk afterwards instead of being lost.
+ *
+ * PRIORITISED — lower number first, and only among tasks already waiting. A
+ * running task is never preempted; a long sweep still finishes.
+ */
+export type TickKind = string;
+export interface TickQueueOpts {
+    /** Reports every state change; the daemon logs through it. */
+    onError?: (kind: TickKind, err: unknown) => void;
+}
+export declare class TickQueue {
+    private readonly opts;
+    private waiting;
+    private running;
+    /** Kinds that asked to run while they were already running. */
+    private rerun;
+    constructor(opts?: TickQueueOpts);
+    /** The kind currently executing, or null when idle. Diagnostics only. */
+    get active(): TickKind | null;
+    get depth(): number;
+    /**
+     * Ask for `kind` to run. Returns immediately — this is a scheduler, not a
+     * `await`-able task.
+     */
+    request(kind: TickKind, priority: number, run: () => Promise<void>): void;
+    private pump;
+    /** Tests: settle the queue. */
+    drain(): Promise<void>;
+}
+/**
+ * Priorities for the daemon's ticks. Lower runs first.
+ *
+ * Shipping to the server is the product; everything else is enrichment. Code
+ * intelligence is last because it is the heaviest and the least urgent — it
+ * refreshes on a 180-minute cadence, so waiting out a walk costs nothing.
+ */
+export declare const TICK_PRIORITY: {
+    readonly sync: 10;
+    readonly intents: 20;
+    readonly codeIndex: 30;
+    readonly housekeeping: 40;
+};
+//# sourceMappingURL=tick-queue.d.ts.map

package/dist/tick-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tick-queue.d.ts","sourceRoot":"","sources":["../src/tick-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAQ9B,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAClD;AAED,qBAAa,SAAS;IAMR,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,OAAO,CAAyB;IACxC,+DAA+D;IAC/D,OAAO,CAAC,KAAK,CAAuB;gBAEP,IAAI,GAAE,aAAkB;IAErD,yEAAyE;IACzE,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAyB;IACtD,IAAI,KAAK,IAAI,MAAM,CAAgC;IAEnD;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;YAY3D,IAAI;IAuBlB,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/tick-queue.js

@@ -0,0 +1,104 @@
+/**
+ * One background task at a time, in priority order, with same-kind coalescing.
+ *
+ * ── What it replaces ─────────────────────────────────────────────────────
+ * Three independent in-flight booleans — `syncInFlight`, `intentDrainInFlight`,
+ * `codeIndexInFlight`. Each correctly stopped its OWN tick from overlapping
+ * itself, and none of them knew about the others, so a code-intelligence sweep
+ * could run at the same time as a full sync walk and an intent drain. All three
+ * are heavy: the sweep spawns codeindex and holds its output, the walk holds a
+ * session container, the drain copies files. Measured with a sweep and a walk
+ * overlapping, the main thread sat at 80–95% and RSS more than doubled.
+ *
+ * They also could not express what the daemon actually wants: shipping to the
+ * server matters more than refreshing code intelligence, so if both are due, the
+ * sweep should wait.
+ *
+ * ── Semantics ────────────────────────────────────────────────────────────
+ * SERIAL — exactly one task runs at a time.
+ *
+ * COALESCED PER KIND — if a kind is already waiting, a new request for that kind
+ * is dropped rather than queued twice. Both would do the same work against the
+ * same state, and the second would find nothing to do. This preserves what the
+ * booleans got right (no self-overlap) without the "silently skipped" behaviour:
+ * a request that arrives while its kind is RUNNING sets a re-run flag, so a file
+ * change during a walk still gets a walk afterwards instead of being lost.
+ *
+ * PRIORITISED — lower number first, and only among tasks already waiting. A
+ * running task is never preempted; a long sweep still finishes.
+ */
+export class TickQueue {
+    opts;
+    waiting = [];
+    running = null;
+    /** Kinds that asked to run while they were already running. */
+    rerun = new Set();
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    /** The kind currently executing, or null when idle. Diagnostics only. */
+    get active() { return this.running; }
+    get depth() { return this.waiting.length; }
+    /**
+     * Ask for `kind` to run. Returns immediately — this is a scheduler, not a
+     * `await`-able task.
+     */
+    request(kind, priority, run) {
+        if (this.running === kind) {
+            // Its state changed underneath it; run once more when it finishes rather
+            // than dropping the request (a file change during a walk must not be lost).
+            this.rerun.add(kind);
+            return;
+        }
+        if (this.waiting.some((w) => w.kind === kind))
+            return; // coalesced
+        this.waiting.push({ kind, priority, run });
+        void this.pump();
+    }
+    async pump() {
+        if (this.running !== null)
+            return;
+        const next = this.waiting
+            .map((w, i) => ({ w, i }))
+            .sort((a, b) => (a.w.priority - b.w.priority) || (a.i - b.i))[0];
+        if (!next)
+            return;
+        this.waiting.splice(next.i, 1);
+        const { kind, priority, run } = next.w;
+        this.running = kind;
+        try {
+            await run();
+        }
+        catch (err) {
+            this.opts.onError?.(kind, err);
+        }
+        finally {
+            this.running = null;
+            if (this.rerun.delete(kind)) {
+                // Re-queue at its own priority; it takes its turn like anything else.
+                this.waiting.push({ kind, priority, run });
+            }
+            void this.pump();
+        }
+    }
+    /** Tests: settle the queue. */
+    async drain() {
+        while (this.running !== null || this.waiting.length > 0) {
+            await new Promise((r) => setImmediate(r));
+        }
+    }
+}
+/**
+ * Priorities for the daemon's ticks. Lower runs first.
+ *
+ * Shipping to the server is the product; everything else is enrichment. Code
+ * intelligence is last because it is the heaviest and the least urgent — it
+ * refreshes on a 180-minute cadence, so waiting out a walk costs nothing.
+ */
+export const TICK_PRIORITY = {
+    sync: 10,
+    intents: 20,
+    codeIndex: 30,
+    housekeeping: 40,
+};
+//# sourceMappingURL=tick-queue.js.map