codebaseiq 0.2.0 → 0.3.0

package/dist/watch-server.js

@@ -1,8 +1,8 @@
-import{c as nr}from"./chunk-37TKC6MB.js";import{a as rr}from"./chunk-L3YSDLNB.js";import{a as It,b as j,d as w,e as Vt,f as Ce,g as Bt,h as Ft,i as Ut,j as Re,k as Qt,l as Gt,o as Ee}from"./chunk-36WRYYTE.js";import{c as Xt,d as Jt,e as Kt,f as Zt,g as er,h as tr}from"./chunk-NJA4MMBD.js";import{j as Ht,l as zt,n as Yt}from"./chunk-CDWSLAPN.js";import{a as Tt,b as Mt,c as At,d as we,e as Ot,f as xe,g as Lt,i as Wt,j as Dt,k as qt,o as _t,q as Nt,r as jt,s as $t}from"./chunk-TAJ6UGCO.js";import"./chunk-BLKYYQ7C.js";import{f as it,g as J}from"./chunk-HBXZAGY6.js";import{a as ye,b as F}from"./chunk-ZZ3MWF33.js";import{U as lt,X as ut}from"./chunk-IGQQUENU.js";import"./chunk-YUKYB54I.js";import{a as mt}from"./chunk-AAQQPKCU.js";import"./chunk-HCMQZPEO.js";import"./chunk-P5XHIJHI.js";import"./chunk-H5QXP63L.js";import"./chunk-2Q2LW5JW.js";import"./chunk-EXMVF3JR.js";import"./chunk-5IO2APSS.js";import{b as pt,d as Rt}from"./chunk-QVWDQTMG.js";import"./chunk-3AC56WAR.js";import{c as K,d as ct,e as dt}from"./chunk-IBM3F2BJ.js";import"./chunk-M7LAIM77.js";import"./chunk-FWY2PRIF.js";import"./chunk-DRENNWRG.js";import{c as Et,d as Pt,j as kt}from"./chunk-5XEVXVTK.js";import"./chunk-SV2LEFVM.js";import{B as ft,D as ht,P as ve,Q as gt,R as yt,T as Z,U as vt,V as N,W as St,da as bt,ea as A,ga as ee,ja as wt,ka as Se,ma as xt,oa as be,pa as Ct}from"./chunk-WJOQC4P7.js";import{c as nt}from"./chunk-IYBIBMPF.js";import{d as ze}from"./chunk-XYLV727H.js";import"./chunk-4NHWNAWQ.js";import"./chunk-2VKB5CMA.js";import{A as ot,B as st,C as fe,D as he,E as ge,F as at,j as tt}from"./chunk-ACZDU5GK.js";import{a as Ye,b as Xe,c as Je,d as Ke,e as Ze}from"./chunk-R2NOK63J.js";import{c as D,d as q}from"./chunk-6URCE5QY.js";import{G as R,N as et,Q as rt,T as _,Y as pe,b as Ue,h as X,m as Qe,n as Ge,o as He}from"./chunk-4O52YNKL.js";import v from"process";import{rmSync as qr}from"fs";import{resolve as $n}from"path";import{pathToFileURL as Vn}from"url";var te=class{root;now;randomId;retryDelayMs;active;retryNotBeforeMs=0;currentStatus;constructor(t,r={}){this.root=t,this.now=r.now??Date.now,this.randomId=r.randomId,this.retryDelayMs=Math.max(1,Math.floor(r.retryDelayMs??1e3)),this.currentStatus=xe(t)}initializeAfterOwnershipAcquired(){let t=Ot(this.root),r=Lt(this.root,{now:()=>new Date(this.now())});return this.refreshStatus(),{recoveredClaims:t,prunedHistory:r}}observeLegacyRequest(t,r){Tt(this.root,r??"stale index observed by a legacy command",{idempotencyKey:`legacy-activity:${t}`,now:()=>new Date(t)}),this.refreshStatus()}poll(t,r){if(this.active||t.state!=="idle"||this.now()<this.retryNotBeforeMs)return!1;let i=Mt(this.root,{now:()=>new Date(this.now()),...this.randomId?{randomId:this.randomId}:{}});if(this.refreshStatus(),i.requests.length===0)return!1;this.active=i;try{return r(Nr(i)),!0}catch(n){throw we(this.root,i),this.active=void 0,this.retryNotBeforeMs=this.now()+this.retryDelayMs,this.refreshStatus(),n}}completeActive(){return this.active?(At(this.root,this.active,()=>new Date(this.now())),this.active=void 0,this.retryNotBeforeMs=0,this.refreshStatus(),!0):!1}failActive(){return this.active?(we(this.root,this.active),this.active=void 0,this.retryNotBeforeMs=this.now()+this.retryDelayMs,this.refreshStatus(),!0):!1}status(){return{...this.currentStatus}}refreshStatus(){this.currentStatus=xe(this.root)}};function Nr(e){if(e.requests.length===1)return e.requests[0].detail;let r=[...new Set(e.requests.map(i=>i.detail))].slice(0,3).join("; ");return`${e.requests.length} coalesced refresh requests${r?`: ${r}`:""}`.slice(0,2048)}import{createHash as yn}from"crypto";import{readdirSync as vn,statSync as Sn}from"fs";import{join as Me}from"path";import{performance as Ae}from"perf_hooks";var Pe;function ke(e){Pe=e}function ir(){return Pe||{argv:process.argv.slice(2),execPath:process.execPath,...process.argv[1]!==void 0?{scriptPath:process.argv[1]}:{},cwd:process.cwd()}}import{Command as ln,Help as un}from"commander";import{Option as $r}from"commander";function Ie(e){return e.evidence?e.evidence:jr.has(e.id)?"mixed":e.heuristic?"heuristic":"graph-fact"}var jr=new Set(["health","context","co-change"]);function or(e){if(e.claims){if(e.claims.origin==="mixed"&&!e.claims.families?.length)throw new Error(`Mixed command ${e.id} must declare at least one claim family.`);return e.claims}let t=Ie(e);if(t==="mixed")throw new Error(`Mixed command ${e.id} must declare claim families.`);let r=e.agent?Jt(e.agent.operation):[];return r.length>0&&r.every(n=>n==="repository-observation"||n==="repository-preview")?{origin:t==="heuristic"?"heuristic":"compiler-graph",observedSources:["index-generation"],producerValidation:{status:"not-evaluated"}}:{origin:"unknown",observedSources:["process"],producerValidation:{status:"not-evaluated"}}}function sr(e,t){return Zt(new Map(t.map(r=>[r.id,Ie(r)]))),tr(new Map(t.map(r=>[r.id,or(r)]))),er(new Map(t.flatMap(r=>r.agent?[[r.id,{...r.agent,resultUnits:Br(r)}]]:[]))),t.map(r=>{let i=r.hidden?e.command(r.command,{hidden:!0}):e.command(r.command);i.description(r.description),r.helpAfter&&i.addHelpText("after",`
+import{c as nr}from"./chunk-GP7C5VAE.js";import{a as rr}from"./chunk-DVWO7RBC.js";import{a as It,b as j,d as w,e as Vt,f as Ce,g as Bt,h as Ft,i as Ut,j as Re,k as Qt,l as Gt,o as Ee}from"./chunk-OFGOOL6U.js";import{c as Xt,d as Jt,e as Kt,f as Zt,g as er,h as tr}from"./chunk-FH5WG4LE.js";import{j as Ht,l as zt,n as Yt}from"./chunk-DAKIGMIK.js";import{a as Tt,b as Mt,c as At,d as we,e as Ot,f as xe,g as Lt,i as Wt,j as Dt,k as qt,o as _t,q as Nt,r as jt,s as $t}from"./chunk-GWYZVVKY.js";import"./chunk-LONKINMJ.js";import{f as it,g as J}from"./chunk-O2M3VNDY.js";import{a as ye,b as F}from"./chunk-ZZ3MWF33.js";import{N as lt,Q as ut}from"./chunk-6WAPPQ5F.js";import"./chunk-YUKYB54I.js";import{a as mt}from"./chunk-AAQQPKCU.js";import"./chunk-DDN2F6GB.js";import"./chunk-P5XHIJHI.js";import"./chunk-EQNMD62X.js";import"./chunk-2PRONPAS.js";import"./chunk-P4NVCOM7.js";import{b as pt,d as Rt}from"./chunk-EIBGSU2R.js";import"./chunk-CIYA2KZN.js";import{c as K,d as ct,e as dt}from"./chunk-4LK5OIPW.js";import"./chunk-C6WKPKCF.js";import"./chunk-XQAVQVIL.js";import"./chunk-DRENNWRG.js";import{c as Et,d as Pt,j as kt}from"./chunk-PUVNH4PO.js";import"./chunk-SV2LEFVM.js";import{B as ft,D as ht,P as ve,Q as gt,R as yt,T as Z,U as vt,V as N,W as St,da as bt,ea as A,ga as ee,ja as wt,ka as Se,ma as xt,oa as be,pa as Ct}from"./chunk-MEUHIDI3.js";import{c as nt}from"./chunk-5FWR5HLG.js";import{d as ze}from"./chunk-T75DS2E6.js";import"./chunk-YT4DVWUV.js";import"./chunk-RCIGX23V.js";import{A as ot,B as st,C as fe,D as he,E as ge,F as at,j as tt}from"./chunk-D7DOB27N.js";import{a as Ye,b as Xe,c as Je,d as Ke,e as Ze}from"./chunk-R2NOK63J.js";import{a as D,e as q}from"./chunk-6O3KXIDL.js";import{G as R,N as et,Q as rt,T as _,Y as pe,b as Ue,h as X,m as Qe,n as Ge,o as He}from"./chunk-UQYQBLJX.js";import v from"process";import{rmSync as qr}from"fs";import{resolve as $n}from"path";import{pathToFileURL as Vn}from"url";var te=class{root;now;randomId;retryDelayMs;active;retryNotBeforeMs=0;currentStatus;constructor(t,r={}){this.root=t,this.now=r.now??Date.now,this.randomId=r.randomId,this.retryDelayMs=Math.max(1,Math.floor(r.retryDelayMs??1e3)),this.currentStatus=xe(t)}initializeAfterOwnershipAcquired(){let t=Ot(this.root),r=Lt(this.root,{now:()=>new Date(this.now())});return this.refreshStatus(),{recoveredClaims:t,prunedHistory:r}}observeLegacyRequest(t,r){Tt(this.root,r??"stale index observed by a legacy command",{idempotencyKey:`legacy-activity:${t}`,now:()=>new Date(t)}),this.refreshStatus()}poll(t,r){if(this.active||t.state!=="idle"||this.now()<this.retryNotBeforeMs)return!1;let i=Mt(this.root,{now:()=>new Date(this.now()),...this.randomId?{randomId:this.randomId}:{}});if(this.refreshStatus(),i.requests.length===0)return!1;this.active=i;try{return r(Nr(i)),!0}catch(n){throw we(this.root,i),this.active=void 0,this.retryNotBeforeMs=this.now()+this.retryDelayMs,this.refreshStatus(),n}}completeActive(){return this.active?(At(this.root,this.active,()=>new Date(this.now())),this.active=void 0,this.retryNotBeforeMs=0,this.refreshStatus(),!0):!1}failActive(){return this.active?(we(this.root,this.active),this.active=void 0,this.retryNotBeforeMs=this.now()+this.retryDelayMs,this.refreshStatus(),!0):!1}status(){return{...this.currentStatus}}refreshStatus(){this.currentStatus=xe(this.root)}};function Nr(e){if(e.requests.length===1)return e.requests[0].detail;let r=[...new Set(e.requests.map(i=>i.detail))].slice(0,3).join("; ");return`${e.requests.length} coalesced refresh requests${r?`: ${r}`:""}`.slice(0,2048)}import{createHash as yn}from"crypto";import{readdirSync as vn,statSync as Sn}from"fs";import{join as Me}from"path";import{performance as Ae}from"perf_hooks";var Pe;function ke(e){Pe=e}function ir(){return Pe||{argv:process.argv.slice(2),execPath:process.execPath,...process.argv[1]!==void 0?{scriptPath:process.argv[1]}:{},cwd:process.cwd()}}import{Command as ln,Help as un}from"commander";import{Option as $r}from"commander";function Ie(e){return e.evidence?e.evidence:jr.has(e.id)?"mixed":e.heuristic?"heuristic":"graph-fact"}var jr=new Set(["health","context","co-change"]);function or(e){if(e.claims){if(e.claims.origin==="mixed"&&!e.claims.families?.length)throw new Error(`Mixed command ${e.id} must declare at least one claim family.`);return e.claims}let t=Ie(e);if(t==="mixed")throw new Error(`Mixed command ${e.id} must declare claim families.`);let r=e.agent?Jt(e.agent.operation):[];return r.length>0&&r.every(n=>n==="repository-observation"||n==="repository-preview")?{origin:t==="heuristic"?"heuristic":"compiler-graph",observedSources:["index-generation"],producerValidation:{status:"not-evaluated"}}:{origin:"unknown",observedSources:["process"],producerValidation:{status:"not-evaluated"}}}function sr(e,t){return Zt(new Map(t.map(r=>[r.id,Ie(r)]))),tr(new Map(t.map(r=>[r.id,or(r)]))),er(new Map(t.flatMap(r=>r.agent?[[r.id,{...r.agent,resultUnits:Br(r)}]]:[]))),t.map(r=>{let i=r.hidden?e.command(r.command,{hidden:!0}):e.command(r.command);i.description(r.description),r.helpAfter&&i.addHelpText("after",`
 ${r.helpAfter.trim()}
 `);for(let n of r.arguments??[])i.argument(n.name);for(let n of r.options??[])if(n.hidden){let o=new $r(n.flags,n.description).hideHelp();n.parser&&o.argParser(n.parser),Object.hasOwn(n,"defaultValue")&&o.default(n.defaultValue),i.addOption(o)}else n.parser&&Object.hasOwn(n,"defaultValue")?i.option(n.flags,n.description,n.parser,n.defaultValue):n.parser?i.option(n.flags,n.description,n.parser):Object.hasOwn(n,"defaultValue")?i.option(n.flags,n.description,n.defaultValue):i.option(n.flags,n.description);return i.action(async(...n)=>{try{let o=i.optsWithGlobals();Vr(o);let a=ir(),l=()=>r.id===Ht?r.handler(...n):zt({command:r.id,producerVersion:R,invocationPrefix:a.scriptPath?[a.execPath,a.scriptPath]:["codebaseiq"],argv:[...a.argv],cwd:a.cwd,json:o.json===!0,sourceSession:o.session!==!1,reemitSource:o.reemit===!0,...typeof o.outputPageSize=="number"?{pageSize:o.outputPageSize}:{},...typeof o.outputCursor=="string"?{cursor:o.outputCursor}:{}},()=>r.handler(...n)),y=r.agent?Xt(r.agent.operation,{args:n.slice(0,-1),options:o}):void 0;await(y?Kt(y,l):l())}catch(o){Fr(o)}finally{A(void 0),yt()}}),{descriptor:r,command:i}})}function Vr(e){if(e.resultOnly===!0&&e.json!==!0)throw new Error("--result-only requires --json.");if(e.compact===!0&&e.json!==!0)throw new Error("--compact requires --json.")}function Br(e){let t=e.agent?.resultUnits;if(t?.kind==="field"&&t.field.trim()==="")throw new Error(`Command ${e.id} declares an empty result-unit field.`);return t||(e.renderShape==="list"||e.renderShape==="table"||e.renderShape==="grouped-by-file"?{kind:"rows"}:{kind:"report"})}function Fr(e){let t=e instanceof Error?e.message:String(e);console.error(`error: ${F(t)}`),process.exitCode=1}var Ur=new Set(Ee),ar=new Map(Ee.map((e,t)=>[e,t])),Qr=new Set(["Navigation","Graph","Impact","Exploration"]),Gr=new Set(["Cleanup","Health"]),Hr=new Set(["Indexing","Core","Maintenance"]);function zr(e){if(e.hidden||e.agent?.semantic?.compatibility==="deprecated")return"compatibility";if(Ur.has(e.id))return"primary-exploration";let t=e.docs?.category;if(t&&Qr.has(t))return"specialized-analysis";if(t&&Gr.has(t))return"quality-cleanup";if(t&&Hr.has(t))return"maintenance";if(t==="Formal Models")return"formal-modeling";throw new Error(`Visible command ${e.id} has no cockpit panel (docs category: ${t??"missing"}).`)}function Yr(e,t={}){return[{id:"primary-exploration",title:"Primary exploration",purpose:"Locate exact referents, project chosen relationships, and read only named implementation gaps."},{id:"specialized-analysis",title:"Specialized analysis",purpose:"Run a named graph, impact, or structural analysis when that exact analysis answers the task."},{id:"quality-cleanup",title:"Quality and cleanup",purpose:"Evaluate repository quality, cleanup candidates, and configured architecture findings."},{id:"maintenance",title:"Maintenance",purpose:"Build, inspect, configure, and maintain the project index and local integrations."},{id:"formal-modeling",title:"Formal modeling",purpose:"Create, verify, and check explicit state-machine models and traces."},{id:"compatibility",title:"Compatibility and deprecated controls",purpose:"Preserved invocation surfaces for existing consumers; do not choose these for new workflows."}].map(n=>({...n,commands:e.filter(o=>zr(o)===n.id).sort((o,a)=>n.id==="primary-exploration"?(ar.get(o.id)??Number.MAX_SAFE_INTEGER)-(ar.get(a.id)??Number.MAX_SAFE_INTEGER):0)})).filter(n=>n.commands.length>0&&(t.includeCompatibility||n.id!=="compatibility"))}function cr(e,t,r={}){let i=[`Usage: ${e.name()} [options] [command]`,"",e.description(),"","Options:"],n=e.options.map(a=>a.flags),o=Math.max(...n.map(a=>a.length),0);for(let a of e.options)i.push(`  ${a.flags.padEnd(o)}  ${a.description}`);i.push(`  ${"-h, --help".padEnd(o)}  Display this grouped command help`);for(let a of Yr(t,r)){i.push("",`${a.title}:`,`  ${a.purpose}`);let l=Math.max(...a.commands.map(y=>y.command.length),0);for(let y of a.commands)i.push(`  ${y.command.padEnd(l)}  ${y.description}`)}return r.includeCompatibility||i.push("","Run `codebaseiq --help-all` to include compatibility and deprecated controls."),i.push("Run `codebaseiq <command> --help` for one control's options and examples.",""),i.join(`
 `)}import{existsSync as Xr,mkdirSync as Jr,writeFileSync as Kr}from"fs";import{homedir as Zr}from"os";import{join as re}from"path";var en=1440*60*1e3,lr="update-check.json",tn="https://registry.npmjs.org/codebaseiq/latest";async function ur(e={}){let t=e.env??process.env;if(t.CODEBASEIQ_UPDATE_CHECK==="0"||t.NO_UPDATE_NOTIFIER)return;let r=e.cacheDir??on(t),i=e.now??Date.now(),n=e.currentVersion??R,o=sn(r),a=o&&i-o.checkedAt<en?o.latestVersion:await an(r,e.fetchLatestVersion??dn,i);if(!a||!nn(a,n))return;(e.writeNotice??(y=>console.error(y)))(rn(n,a))}function rn(e,t){return[`codebaseiq update available: ${e} -> ${t}.`,"Agent: tell your human to update with: npm install -g codebaseiq@latest",""].join(`
 `)}function nn(e,t){let r=dr(e),i=dr(t);if(!r||!i)return e!==t;for(let n=0;n<r.length;n++){let o=r[n]-i[n];if(o>0)return!0;if(o<0)return!1}return!1}function on(e){let t=e.XDG_CACHE_HOME||re(Zr(),".cache");return re(t,"codebaseiq")}function sn(e){let t=re(e,lr);if(!Xr(t))return null;try{let r=JSON.parse(X(t,"update notice cache"));return typeof r.checkedAt=="number"&&(typeof r.latestVersion=="string"||r.latestVersion===null)?{checkedAt:r.checkedAt,latestVersion:r.latestVersion}:null}catch{return null}}async function an(e,t,r){let i;try{i=await t()}catch{i=null}return cn(e,{checkedAt:r,latestVersion:i}),i}function cn(e,t){try{Jr(e,{recursive:!0}),Kr(re(e,lr),`${JSON.stringify(t,null,2)}
 `)}catch{}}async function dn(){let e=await fetch(tn,{signal:AbortSignal.timeout(1e3)});if(!e.ok)return null;let t=await e.json();return typeof t.version=="string"?t.version:null}function dr(e){let t=/^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(e);return t?[Number(t[1]),Number(t[2]),Number(t[3])]:null}async function fr(e={}){let t=new ln;e.resident&&t.exitOverride(),e.terminalOutput&&t.configureOutput({writeOut:n=>process.stdout.write(ye(n)),writeErr:n=>process.stderr.write(ye(n))}),t.name("codebaseiq").description("Language-agnostic code intelligence CLI powered by SCIP indexes").version(R).option("--output-page-size <characters>","Return bounded output pages with an exact continuation command",Yt).option("--output-cursor <cursor>","Continue a bounded output page").option("--no-session","Disable the explicit exploration evidence ledger").option("--reemit","Recovery only: render source and graph evidence again instead of citing session receipts").option("--help-all","Display every command, including compatibility and deprecated controls");let r=await nr(e.invocationCommand);sr(t,r);let i=new un;return t.configureHelp({formatHelp:(n,o)=>n===t?cr(t,r):i.formatHelp(n,o)}),t.hook("preAction",async(n,o)=>{let a=o.name();if(e.resident){await e.resident.preAction(a);return}let l=wt(a),y=Wt(a);if(!l&&!y){pr(),await mr(a);return}let d=bt(),c=_(d);gt(c);let u=ee(d,c);A(u),pr(),await mr(a);let{config:f,paths:s}=u;if(l){let g=await rr({commandName:a,projectRoot:d,config:f,paths:s,dbPathSource:u.dbPathSource,gitContext:c});process.env.CODEBASEIQ_DEBUG&&console.error(`evidence-freshness: ${g.source}`),g.service.kind==="failed"&&console.error(`warning: codebaseiq watch service did not start: ${g.service.message}`),(g.service.kind==="failed"||g.service.kind==="skipped")&&j(d,R);return}if(!y){j(d,R);return}let h=Dt({commandName:a,projectRoot:d,cacheDir:s.cacheDir,cliVersion:R,config:f,gitContext:c});h.kind==="failed"&&console.error(`warning: codebaseiq watch service did not start: ${h.message}`),(h.kind==="failed"||h.kind==="skipped")&&j(d,R)}),t.hook("postAction",()=>A(void 0)),{program:t,descriptors:r}}async function mr(e){e.startsWith("__")||await ur({commandName:e})}function pr(){if(Je(),!Ye()||Ke())return;let e=null;try{e=Ct(t=>nt(t))}catch{}Ze({command:Xe()??`codebaseiq ${process.argv.slice(2).join(" ")}`,toolVersion:R,projectFingerprint:e})}import{execFileSync as hr}from"child_process";import{lstatSync as mn}from"fs";import{join as pn}from"path";var Te=3e4;function gr(){return{env:rt(),encoding:"utf8",maxBuffer:64*1024*1024,stdio:["ignore","pipe","ignore"],windowsHide:!0,timeout:Te,killSignal:"SIGKILL"}}function yr(e){return{generation:e.generation,epoch:e.epoch,changeSequence:e.changeSequence,headCommit:e.headCommit,treeOid:e.treeOid,fingerprintByPath:new Map(e.snapshot.files.map(t=>[t.path,t.hash])),languages:[...e.snapshot.languages],markerFiles:[...e.config.indexer?.typescript?.projects??[],...e.config.indexer?.clojure?.configPath?[e.config.indexer.clojure.configPath]:[]]}}function vr(e,t,r){if(r.epoch!==t.epoch)return{continuous:!1,reason:"the watcher observation epoch advanced since this generation was published"};if(r.changeSequence!==t.changeSequence)return{continuous:!1,reason:"the watcher observed a change after this generation was published"};let i,n;try{i=fn(e),n=hn(e)}catch(o){return{continuous:!1,reason:`git state could not be read: ${o instanceof Error?o.message:String(o)}`}}if(i.headCommit!==t.headCommit||i.treeOid!==t.treeOid)return{continuous:!1,reason:"the git HEAD tree moved since this generation was published"};for(let o of n){if(Ge(o,t.languages,t.markerFiles)==="other")continue;let a=t.fingerprintByPath.get(o),l=gn(pn(e,o));if(l===null)return{continuous:!1,reason:`indexed input ${o} is no longer readable as a plain file`};if(a!==l)return{continuous:!1,reason:a===void 0?`indexed input ${o} appeared after this generation was published`:`indexed input ${o} changed after this generation was published`}}return{continuous:!0}}function fn(e){let t=hr("git",["-C",e,"rev-parse","HEAD","HEAD^{tree}"],{...gr(),timeout:Te}).split(`
-`).map(n=>n.trim()).filter(Boolean),[r,i]=t;if(!/^[0-9a-f]{40,64}$/.test(r??"")||!/^[0-9a-f]{40,64}$/.test(i??""))throw new Error("git did not report a resolved HEAD tree");return{headCommit:r,treeOid:i}}function hn(e){return hr("git",["-C",e,"status","--porcelain=v1","-z","--untracked-files=all","--no-renames","--","."],{...gr(),timeout:Te}).split("\0").filter(t=>t.length>=4&&t[2]===" ").map(t=>t.slice(3))}function gn(e){try{return mn(e).isFile()?Qe(e,{maxBytes:Ue,inputKind:"project-file"}):null}catch{return null}}var E=class extends Error{constructor(r,i){super(i);this.code=r}code};function xr(e){let t=!1,r,i=()=>{let d=r;if(r=void 0,!!d)try{d.db.close()}catch{}},n=()=>{let d=e.indexGeneration();if(!d)throw new E("stale-index","The resident index is not idle-fresh; run the command in-process.");return d},o=d=>{let c=e.observation();if(!c||c.published.generation!==d)throw new E("stale-index","No provable observation is bound to the published generation; run the command in-process.");let u=vr(e.projectRoot,c.published,{epoch:c.epoch,changeSequence:c.changeSequence});if(!u.continuous)throw new E("stale-index",`${u.reason}; run the command in-process.`)},a=()=>{let d=n(),c=xn(e.projectRoot);if(r&&(r.generation!==d||r.stamp!==c||N(e.dbPath)!==d)&&i(),!r){let u=xt(e.projectRoot);if(N(e.dbPath)!==d){try{u.close()}catch{}throw new E("stale-index","The published generation moved while opening the resident database.")}r={generation:d,stamp:c,db:u}}return r.db},l=d=>{if(!Se(d))throw new E("ineligible-command",`Command ${d} always executes in-process.`);n();let c=ee(e.projectRoot,_(e.projectRoot));if(c.dbPathSource!=="configured")throw new E("stale-index","The resident host does not serve fallback index locations.");A(c)};return{execute:async d=>{if(t)return U("busy","The resident host is executing another request; run the command in-process.");let c=d.argv[0];if(!c||c.startsWith("-")||!Se(c))return U("ineligible-command","Only evidence commands are served by the resident host.");let u;try{u=n(),o(u)}catch(p){return Sr(p)}t=!0;let f=Ae.now(),s=new Oe(d.tty),h=wn(d.envAllowlist),g=process.exitCode;process.exitCode=0,ke({argv:d.argv,execPath:d.clientInvocation?.execPath??process.execPath,...d.clientInvocation?.scriptPath!==void 0?{scriptPath:d.clientInvocation.scriptPath}:{},cwd:d.cwd}),be(a);try{let{program:p}=await fr({invocationCommand:c,resident:{preAction:l}});s.install();try{await p.parseAsync([...d.argv],{from:"user"})}finally{s.restore()}let b=typeof process.exitCode=="number"?process.exitCode:0;return{ok:!0,kind:"executed",protocolVersion:w,serverPid:process.pid,exitCode:b,stdout:s.stdout(),stderr:s.stderr(),generation:u,durationMs:Ae.now()-f}}catch(p){return p instanceof E?Sr(p):bn(p)?{ok:!0,kind:"executed",protocolVersion:w,serverPid:process.pid,exitCode:p.exitCode,stdout:s.stdout(),stderr:s.stderr(),generation:u,durationMs:Ae.now()-f}:U("execution-error",`Resident execution failed: ${p instanceof Error?p.message:String(p)}`)}finally{be(void 0),ke(void 0),A(void 0),process.exitCode=g,h(),t=!1}},releaseDatabase:i}}function U(e,t){return{ok:!1,protocolVersion:w,code:e,message:t}}function Sr(e){return e instanceof E?U(e.code,e.message):U("execution-error",e instanceof Error?e.message:String(e))}function bn(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&(e.code.startsWith("commander.")||e.code==="commander")&&typeof e.exitCode=="number"}function wn(e){let t=new Map;for(let r of Ft){t.set(r,process.env[r]);let i=e?.[r];i===void 0?delete process.env[r]:process.env[r]=i}return()=>{for(let[r,i]of t)i===void 0?delete process.env[r]:process.env[r]=i}}var Oe=class{constructor(t){this.tty=t}tty;stdoutChunks=[];stderrChunks=[];restorers=[];install(){this.restorers=[br(process.stdout,this.stdoutChunks),br(process.stderr,this.stderrChunks),ne(process.stdout,"isTTY",this.tty?.isTTY??!1),ne(process.stderr,"isTTY",this.tty?.isTTY??!1),ne(process.stdout,"columns",this.tty?.columns),ne(process.stderr,"columns",this.tty?.columns)]}restore(){for(let t of this.restorers.reverse())t();this.restorers=[]}stdout(){return this.stdoutChunks.join("")}stderr(){return this.stderrChunks.join("")}};function br(e,t){let r=e.write,i=(n,o,a)=>{t.push(typeof n=="string"?n:Buffer.isBuffer(n)?n.toString(typeof o=="string"?o:"utf8"):String(n));let l=typeof a=="function"?a:typeof o=="function"?o:void 0;return typeof l=="function"&&l(),!0};return e.write=i,()=>{e.write=r}}function ne(e,t,r){let i=Object.hasOwn(e,t),n=i?Object.getOwnPropertyDescriptor(e,t):void 0;return r===void 0?i&&Reflect.deleteProperty(e,t):Object.defineProperty(e,t,{value:r,configurable:!0,writable:!0}),()=>{n?Object.defineProperty(e,t,n):Reflect.deleteProperty(e,t)}}function xn(e){let t=yn("sha256");for(let i of[".codebaseiq.json",".codebaseiq-baseline.json"])t.update(i),t.update(wr(Me(e,i)));let r=Me(e,".codebaseiq","suppressions");t.update(r);try{for(let i of vn(r).sort())t.update(i),t.update(wr(Me(r,i)))}catch{t.update("absent")}return t.digest("hex")}function wr(e){try{let t=Sn(e);return`${t.size}:${t.mtimeMs}`}catch{return"absent"}}import{chmodSync as Cn,mkdirSync as Rn,rmSync as Cr}from"fs";import{createServer as En}from"net";import{dirname as Pn}from"path";var Rr=1e4,kn=5e3,In=6e5;function Er(e){let t=pe(e.projectRoot),r=0,i,n,o=new Set,a=En(c=>{o.add(c),c.setTimeout(Rr,()=>c.destroy()),c.on("error",()=>c.destroy()),c.on("close",()=>o.delete(c));let u=Qt(Vt,f=>{r+=1,i=new Date().toISOString(),e.onActivity?.(),l(f,c).then(s=>d(c,s)).catch(s=>{n=s instanceof Error?s.message:String(s),c.destroy()})},f=>{n=f.message,d(c,{ok:!1,protocolVersion:w,code:"invalid-request",message:f.message})});c.on("data",f=>{try{u.push(f)}catch(s){n=s instanceof Error?s.message:String(s),c.destroy()}})}),l=async(c,u)=>{let f=Gt(c);return f?pe(f.projectRoot)!==t?{ok:!1,protocolVersion:w,code:"wrong-project",message:"This query lane serves a different project root."}:y(f,u):{ok:!1,protocolVersion:w,code:"invalid-request",message:"The query lane received a request it could not validate."}},y=async(c,u)=>{if(c.kind==="ping"){let s=e.indexGeneration();return{ok:!0,kind:"pong",protocolVersion:w,serverPid:process.pid,...e.processIdentity?{processIdentity:e.processIdentity}:{},cliVersion:e.cliVersion,projectRoot:t,...s?{indexGeneration:s}:{}}}if(!e.execute)return{ok:!1,protocolVersion:w,code:"unsupported",message:"Resident execution is not enabled on this service; run the command in-process."};let f=Math.max(c.deadlineMs??Bt,Rr);u.setTimeout(Math.min(f+kn,In));try{u.write(Re({ok:!0,kind:"accepted",protocolVersion:w,serverPid:process.pid},Ce))}catch(s){return n=s instanceof Error?s.message:String(s),u.destroy(),{ok:!1,protocolVersion:w,code:"execution-error",message:"The query lane could not acknowledge the request."}}try{return await e.execute(c)}catch(s){return n=s instanceof Error?s.message:String(s),{ok:!1,protocolVersion:w,code:"execution-error",message:`Resident execution failed: ${n}`}}},d=(c,u)=>{try{c.end(Re(u,Ce))}catch(f){n=f instanceof Error?f.message:String(f),c.destroy()}};return process.platform!=="win32"&&(Rn(Pn(e.socketPath),{recursive:!0,mode:448}),Cr(e.socketPath,{force:!0})),new Promise((c,u)=>{a.once("error",u),a.listen(e.socketPath,()=>{if(a.removeListener("error",u),a.on("error",f=>{n=f.message}),process.platform!=="win32")try{Cn(e.socketPath,384)}catch{}c({status:()=>({protocolVersion:w,socketPath:e.socketPath,requests:r,...i!==void 0?{lastRequestAt:i}:{},...n!==void 0?{lastError:n}:{}}),close:()=>new Promise(f=>{for(let s of o)s.destroy();a.close(()=>{process.platform!=="win32"&&Cr(e.socketPath,{force:!0}),f()})})})})})}import{randomUUID as Mn}from"crypto";import{Worker as An}from"worker_threads";var ie=class{constructor(t){this.options=t;this.now=t.now??Date.now,this.setTimer=t.setTimer??setTimeout,this.clearTimer=t.clearTimer??clearTimeout}options;now;setTimer;clearTimer;worker=null;active=null;activeFailure=null;terminating=null;closed=!1;workerGeneration=0;canAccept(){return!this.closed&&this.active===null&&this.terminating===null}start(t){if(!this.canAccept())return!1;if(t.deadlineAtMs<this.now()){try{this.options.onReject(t,`${this.options.name} request expired before processing.`)}catch(o){this.closed=!0,this.options.onFatal(Le(o))}return!0}let r=this.ensureWorker(),i=Math.max(1,Math.min(2147483647,t.deadlineAtMs-this.now())),n=this.setTimer(()=>{this.failActiveAfterTermination(`${this.options.name} request exceeded its deadline.`)},i);this.active={request:t,timer:n};try{r.postMessage({kind:"request",...t})}catch(o){this.failActiveAfterTermination(Pr(o))}return!0}async close(t=`${this.options.name} service is shutting down.`){if(this.closed=!0,this.active){await this.failActiveAfterTermination(t);return}await this.terminateWorker()}ensureWorker(){if(this.worker)return this.worker;let t=this.options.createWorker(),r=++this.workerGeneration;return t.on("message",i=>this.handleMessage(r,i)),t.on("error",i=>{r===this.workerGeneration&&this.failActiveAfterTermination(`${this.options.name} worker failed: ${i.message}`)}),t.on("exit",i=>{r!==this.workerGeneration||this.terminating||(this.worker=null,this.active&&this.failActiveAfterTermination(`${this.options.name} worker exited unexpectedly with code ${i}.`))}),this.worker=t,t}handleMessage(t,r){if(t!==this.workerGeneration||this.closed||!this.active)return;let i=Tn(r);if(!i){this.failActiveAfterTermination(`${this.options.name} worker returned an invalid response.`);return}if(i.requestId!==this.active.request.requestId){this.failActiveAfterTermination(`${this.options.name} worker returned a mismatched request identity.`);return}if(this.now()>this.active.request.deadlineAtMs){this.failActiveAfterTermination(`${this.options.name} request expired while it was processing.`);return}let n=this.active;try{this.options.onStatus(i.status),i.ok?this.options.onComplete(n.request,i.result,i.status):this.options.onReject(n.request,i.error,i.status)}catch(o){this.closed=!0,this.clearTimer(n.timer),this.options.onFatal(Le(o));return}this.releaseActive(n)}async failActiveAfterTermination(t){if(this.activeFailure){await this.activeFailure;return}let r=this.active;if(!r){await this.terminateWorker();return}this.clearTimer(r.timer);let i=(async()=>{if(await this.terminateWorker()){try{this.options.onReject(r.request,t)}catch(o){this.closed=!0,this.options.onFatal(Le(o));return}this.releaseActive(r)}})();this.activeFailure=i;try{await i}finally{this.activeFailure===i&&(this.activeFailure=null)}}releaseActive(t){this.active===t&&(this.active=null,this.clearTimer(t.timer))}async terminateWorker(){if(this.terminating)return this.terminating;let t=this.worker;if(!t)return!0;this.worker=null;let r=++this.workerGeneration;return this.terminating=(async()=>{try{return await t.terminate(),!0}catch(i){return this.closed=!0,this.options.onFatal(new Error(`${this.options.name} worker termination failed: ${Pr(i)}`,{cause:i})),!1}finally{r===this.workerGeneration&&(this.terminating=null)}})(),this.terminating}};function Tn(e){if(!e||typeof e!="object")return null;let t=e;if(t.kind!=="response"||typeof t.requestId!="string"||!("status"in t))return null;if(t.ok===!0){if(!("result"in t)||"error"in t)return null}else if(t.ok===!1){if("result"in t||typeof t.error!="string")return null}else return null;return t}function Le(e){return e instanceof Error?e:new Error(String(e))}function Pr(e){return e instanceof Error?e.message:String(e)}function kr(e){let t=()=>({protocolVersion:K,state:"idle",requests:0,sessionsCreated:0,sessionsReplaced:0,initializations:0,programUpdates:0,documentsEmitted:0,documentsRemoved:0});return Tr({name:"TypeScript index",paths:e.paths,now:e.now,limits:e.limits,initialStatus:t,parseEnvelope:dt,createWorker:()=>Mr(e,{kind:"index",projectRoot:e.projectRoot,dbPath:e.dbPath}),complete(r,i,n,o){fe(e.paths,r,{ok:!0,protocolVersion:K,id:i.id,baseGeneration:i.baseGeneration,response:n},{nowMs:o,limits:e.limits})},reject(r,i,n,o){he(e.paths,r,{ok:!1,protocolVersion:K,id:i,error:n},n,{nowMs:o,limits:e.limits})},onBusy:e.onBusy,onFatal:e.onFatal})}function Ir(e){let t=()=>({protocolVersion:Z,state:"idle",requests:0,sessionsCreated:0,sessionsReused:0,sessionsRefreshed:0,sessionsReplaced:0,projectsCreated:0});return Tr({name:"TypeScript semantic",paths:e.paths,now:e.now,limits:e.limits,initialStatus:t,parseEnvelope:St,createWorker:()=>Mr(e,{kind:"semantic",projectRoot:e.projectRoot}),complete(r,i,n,o){fe(e.paths,r,{ok:!0,protocolVersion:Z,id:i.id,generation:i.generation,response:n},{nowMs:o,limits:e.limits})},reject(r,i,n,o){he(e.paths,r,{ok:!1,protocolVersion:Z,id:i,error:n},n,{nowMs:o,limits:e.limits})},onBusy:e.onBusy,onFatal:e.onFatal})}function Tr(e){let t=e.now??Date.now,r=D(process.pid),i={pid:process.pid,...r?{processIdentity:r}:{}},n=`${e.name.toLowerCase().replaceAll(" ","-")}-${process.pid}-${Mn()}`,o={...e.limits,maxBatch:1},a=null,l=e.initialStatus(),y=!1,d=s=>{y=!0,e.onFatal(s)},c=new ie({name:e.name,createWorker:e.createWorker,now:t,onComplete(s,h,g){let p=u(s.requestId);l=g,e.complete(p.claim,p.envelope,h,t()),f(p)},onReject(s,h,g){let p=u(s.requestId);g!==void 0&&(l=g),e.reject(p.claim,p.envelope.id,h,t()),f(p)},onStatus(s){l=s},onFatal:d});return{poll(){if(y||!c.canAccept())return 0;let s=ot(e.paths,{ownerId:n,nowMs:t(),limits:o,owner:i,liveness:{isProcessAlive:tt,readProcessIdentity:D}})[0];if(!s)return 0;let h=s.requestId;try{let g=e.parseEnvelope(st(s,o));if(h=g.id,g.id!==s.requestId)throw new Error(`${e.name} request identity does not match its mailbox path.`);if(g.deadlineAtMs<t())throw new Error(`${e.name} request expired before processing.`);if(a={claim:s,envelope:g},e.onBusy?.(g.deadlineAtMs),!c.start({requestId:g.id,deadlineAtMs:g.deadlineAtMs,payload:g}))throw new Error(`${e.name} worker lane closed admission after claiming a request.`)}catch(g){let p=Ln(g);try{e.reject(s,h,p,t()),a?.claim===s&&f(a)}catch(b){d(On(b))}}return 1},status(){return{...l,mailbox:at(e.paths)}},async close(s){await c.close(s)}};function u(s){let h=a;if(!h||h.envelope.id!==s)throw new Error(`${e.name} parent lost the active mailbox claim.`);return h}function f(s){a===s&&(a=null,e.onBusy?.(void 0))}}function Mr(e,t){if(e.createWorker)return e.createWorker(t);let r=e.workerUrl??new URL("./typescript-mailbox-worker.js",import.meta.url);return new An(r,{workerData:t})}function On(e){return e instanceof Error?e:new Error(String(e))}function Ln(e){return e instanceof Error?e.message:String(e)}import{existsSync as Wn}from"fs";import{fileURLToPath as Ar}from"url";import{Worker as Dn}from"worker_threads";var qn=2e3;function Wr(e){let t=e.userCacheRoot??Et(),r={kind:"sentinel-worker",projectRoot:e.projectRoot,cacheDir:e.indexPaths.cacheDir,dbPath:e.indexPaths.dbPath,cliVersion:e.cliVersion,userCacheRoot:t},i=e.createWorker??_n,n,o=0,a=!1,l=!1,y,d=()=>{let s;try{s=i(r)}catch(p){e.log(`worker could not be started: ${Lr(p)}`);return}let h,g={worker:s,exited:new Promise(p=>{h=p})};n=g,s.on("message",p=>{n===g&&c(p)}),s.on("error",p=>e.log(`worker failed: ${p.message}`)),s.on("exit",p=>{if(h(),n===g&&(n=void 0,o=0,!l)){if(e.log(`worker exited unexpectedly with code ${p}`),Or(t,e.projectRoot),a){e.log("worker will not be restarted again");return}a=!0,d()}})},c=s=>{let h=Nn(s);h?.kind==="sessions"?o=h.live:h?.kind==="log"&&e.log(h.message)},u=s=>{try{n?.worker.postMessage(s)}catch(h){e.log(`${s.kind} could not be posted: ${Lr(h)}`)}},f=async()=>{l=!0;let s=n;s&&(u({kind:"shutdown"}),await jn(s.exited,e.stopTimeoutMs??qn),n===s&&(n=void 0,await s.worker.terminate().catch(()=>{}))),o=0,Or(t,e.projectRoot)};return d(),{filesChanged:s=>u({kind:"filesChanged",paths:s}),generationPublished:()=>u({kind:"generationPublished"}),releaseDb:()=>u({kind:"releaseDb"}),liveSessionCount:()=>o,stop:()=>y??=f()}}function Dr(){let e,t=!1;return{attach(r){e=r},filesChanged:r=>e?.filesChanged(r),bulkChange:()=>e?.filesChanged([]),watcherStatus(r){r.state==="idle"?t=!1:e&&!t&&(t=!0,e.releaseDb())},generationPublished(){t=!1,e?.generationPublished()},liveSessionCount:()=>e?.liveSessionCount()??0,async stop(){await e?.stop()}}}function _n(e){let t=new URL("./sentinel-worker.js",import.meta.url);if(!Wn(Ar(t)))throw new Error(`sentinel worker was not found at ${Ar(t)}. Run npm run build first.`);let r=new Dn(t,{workerData:e});return r.unref(),r}function Nn(e){if(typeof e!="object"||e===null)return;let{kind:t,live:r,message:i}=e;if(t==="sessions"&&typeof r=="number"&&Number.isInteger(r)&&r>=0)return{kind:t,live:r};if(t==="log"&&typeof i=="string")return{kind:t,message:i}}function Or(e,t){try{kt(e,Pt(t),process.pid)}catch{}}async function jn(e,t){let r,i=new Promise(n=>{r=setTimeout(n,t)});try{await Promise.race([e,i])}finally{clearTimeout(r)}}function Lr(e){return e instanceof Error?e.message:String(e)}var Bn=1e3,Fn=250,Un=6e4,Qn=10,Gn=50,Hn=250;function zn(e,t=1){if(e>0)return Qn;let r=Math.max(0,Math.min(3,t-1));return Math.min(Hn,Gn*2**r)}async function Yn(e,t){let r=t.processIndexRequests(),i=t.processSemanticRequests(),n=r+i,o=n>0?0:e+1;if(t.afterMailboxPoll({indexRequests:r,semanticRequests:i,processedRequests:n}),t.shouldStop())return{indexRequests:r,semanticRequests:i,processedRequests:n,consecutiveIdlePolls:o,stopped:!0};let a=zn(n,o);return await t.wait(a),{indexRequests:r,semanticRequests:i,processedRequests:n,consecutiveIdlePolls:o,stopped:!1,delayMs:a}}function Xn(e,t=v.env){return e==="fresh"||t.CODEBASEIQ_SENTINEL_ENSURE==="1"?null:{kind:"watch-startup",detail:`index ${e} when watch service started`}}async function Jn(e,t,r={}){let i=qt(e,t),n=i.projectRoot;v.env.CODEBASEIQ_PROJECT_ROOT=n;let o=ft(n);o.watch={...o.watch,...r};let a=ht(o);if(!a.enabled)throw new Error('watch mode is disabled; set "watch.enabled": true before starting the service');let l=et(n,o),y=ut(l.cacheDir),d=D(v.pid),c=jt(y.lockPath,n,{readProcessIdentity:m=>m===v.pid?d:D(m)});if(!c.acquired)return;let u=new te(y.refreshRequestsPath,{retryDelayMs:Math.max(1e3,a.cooldownMs)});u.initializeAfterOwnershipAcquired();let f=Date.now(),s=q(),h=f,g=s,p={state:"idle"},b,Q,P,G,oe=J(l.dbPath),se=!1,We=!1,De=0,qe=Number.NEGATIVE_INFINITY,_e=Number.NEGATIVE_INFINITY,Ne=Number.NEGATIVE_INFINITY,je=Number.NEGATIVE_INFINITY,ae,ce,$e=0,de=vt(l.cacheDir),le=ct(l.cacheDir);Rt(de),pt(le);let H,$,L,Ve=o.sentinel?.enabled===!0,I=Dr(),Be=m=>{if(L=void 0,!!m)try{let x=_(n);if(!x?.headCommit||!x.treeOid)return;let S=ze(X(l.metaPath,"reindex metadata"));if(S.kind!=="legacy"&&S.kind!=="supported")return;let k=He(S.metadata.fingerprint);if(!k)return;L=yr({generation:m,...W.observation(),headCommit:x.headCommit,treeOid:x.treeOid,snapshot:k,config:o})}catch{}},C=(m=!1,x=m?"durable":"visibility")=>{if(!We)return;let S=Date.now(),k=q();!m&&k-qe<Bn||(qe=k,_t(y.statePath,{version:1,protocolVersion:lt,pid:v.pid,...d?{processIdentity:d}:{},projectRoot:n,...i.worktreeId?{worktreeId:i.worktreeId}:{},cliVersion:t,startedAt:new Date(f).toISOString(),heartbeatAt:new Date(S).toISOString(),lastActivityAt:new Date(h).toISOString(),...a.idleTimeoutMs===0?{}:{idleDeadlineAt:new Date((I.liveSessionCount()>0?S:h)+a.idleTimeoutMs).toISOString()},watcher:p,...p.state==="idle"&&b?{indexGeneration:b}:{},...Q?{lastRefresh:Q}:{},...P?{lastError:P}:{},reindexActivity:oe,refreshRequests:u.status(),typescriptSemantic:{...ue.status(),...ae===void 0?{}:{busyUntil:new Date(ae).toISOString()}},typescriptIndex:{...me.status(),...ce===void 0?{}:{busyUntil:new Date(ce).toISOString()}},...H?{queryLane:H.status()}:{}},{durability:x}))},T=()=>{h=Date.now(),g=q()},Fe=m=>{T(),G??=m,P={at:new Date().toISOString(),message:m.message},C(!0,"visibility")},ue=Ir({paths:de,projectRoot:n,onBusy(m){ae=m===void 0?void 0:m+5e3,C(!0,"visibility")},onFatal:Fe}),me=kr({paths:le,projectRoot:n,dbPath:l.dbPath,onBusy(m){ce=m===void 0?void 0:m+5e3,C(!0,"visibility")},onFatal:Fe}),W=new It({projectRoot:n,config:{...o,watch:a},outputDb:l.dbPath,languages:o.languages,onStatus(m){p=m,I.watcherStatus(m),m.state!=="idle"&&(b=void 0,L=void 0,$?.releaseDatabase(),T()),C(!0)},...Ve?{onFileChanged:I.filesChanged,onBulkChange:I.bulkChange}:{},onReindexComplete(){T();let m=ve(n,o,l);return Q=m.lastRefresh,b=m.state==="fresh"?N(l.dbPath)??void 0:void 0,Be(b),oe=J(l.dbPath),u.completeActive(),P=void 0,C(!0),I.generationPublished(),m.state==="fresh"},onReindexError(){u.failActive()},onRefreshSuppressed(m){let x=it(l.dbPath,m);x.state==="failed"&&(P={at:new Date().toISOString(),message:`Suppressed-refresh telemetry was not recorded: ${x.reason}`},C(!0,"visibility")),oe=J(l.dbPath)},onError(m){T(),b=void 0,L=void 0,P={at:new Date().toISOString(),message:m.message},C(!0)}}),z=()=>{se=!0};v.once("SIGINT",z),v.once("SIGTERM",z);let V=!1,Y,B;try{try{$=v.env.CODEBASEIQ_DAEMON==="1"||o.daemon?.enabled===!0?xr({projectRoot:n,dbPath:l.dbPath,indexGeneration:()=>b,observation:()=>L?{published:L,...W.observation()}:void 0}):void 0,H=await Er({socketPath:Ut(l.cacheDir),projectRoot:n,cliVersion:t,...d?{processIdentity:d}:{},indexGeneration:()=>b,onActivity:T,...$?{execute:k=>$.execute(k)}:{}})}catch(S){P={at:new Date().toISOString(),message:`Query lane did not start: ${S instanceof Error?S.message:String(S)}`}}Ve&&I.attach(Wr({projectRoot:n,indexPaths:l,cliVersion:t,log(S){v.env.CODEBASEIQ_DEBUG&&console.error(`sentinel: ${F(S)}`)}})),W.start();let m=ve(n,o,l);Q=m.lastRefresh,b=m.state==="fresh"?N(l.dbPath)??void 0:void 0,Be(b);let x=Xn(m.state);for(x&&W.requestRefresh(x,{immediate:!0}),T(),We=!0,C(!0);!se;){let S=await Yn($e,{processIndexRequests:()=>me.poll(),processSemanticRequests:()=>ue.poll(),afterMailboxPoll:({processedRequests:k})=>{let O=q();if(O-je>=Un&&(je=O,ge(le),ge(de)),O-Ne>=6e4&&(Ne=O,j(n,t)),O-_e>=Fn){_e=O;let M=Nt(y.activityPath);M&&M.atMs>h&&(h=M.atMs,g=O),M?.refreshRequestedAtMs!==void 0&&M.refreshRequestedAtMs>De&&(De=M.refreshRequestedAtMs,u.observeLegacyRequest(M.refreshRequestedAtMs,M.refreshDetail??"stale index observed by a legacy command")),u.poll(p,_r=>{T(),W.requestRefresh({kind:"watch-demand",detail:_r},{immediate:!0})})}k>0&&(T(),C(!0,"visibility")),C()},shouldStop:()=>se||G!==void 0||$t({watcher:p,lastActivityAtMs:g,nowMs:q(),idleTimeoutMs:a.idleTimeoutMs,liveSessions:I.liveSessionCount()}),wait:Kn});if($e=S.consecutiveIdlePolls,S.stopped)break}}catch(m){V=!0,Y=m}finally{v.off("SIGINT",z),v.off("SIGTERM",z),await H?.close(),await I.stop(),$?.releaseDatabase(),await Promise.all([ue.close("TypeScript semantic service stopped before completing the request."),me.close("TypeScript index service stopped before completing the request.")]);let m=await W.stop();m.state==="stopped"?(qr(y.statePath,{force:!0}),qr(y.activityPath,{force:!0}),c.release()):(P={at:new Date().toISOString(),message:`Watch service shutdown is degraded: ${m.reasons.join("; ")}`},C(!0),B=new Error(P.message))}if(!V&&G&&(V=!0,Y=G),V&&B)throw new AggregateError([Y,B],"Watch service execution and shutdown both failed.");if(V)throw Y;if(B)throw B}function Kn(e){return new Promise(t=>setTimeout(t,e))}function Zn(e,t={report:r=>console.error(r),exit:r=>v.exit(r)}){return t.report(`watch-service: ${F(e instanceof Error?e.message:String(e))}`),t.exit(1)}var ei=v.argv[1]?Vn($n(v.argv[1])).href:null;if(ei===import.meta.url){mt();let e=v.argv[2],t=v.argv[3],r=ti(v.argv[4]);if(!e||!t)console.error("watch-service: expected <project-root> <cli-version>"),v.exitCode=1;else try{await Jn(e,t,r)}catch(i){Zn(i)}}function ti(e){if(!e)return{};try{let t=JSON.parse(e);return t&&typeof t=="object"?t:{}}catch{return{}}}export{Yn as runWatchServiceLoopIteration,Jn as runWatchServiceServer,Xn as startupRefreshTrigger,Zn as terminateWatchServiceProcess,zn as watchServiceLoopDelayMs};
+`).map(n=>n.trim()).filter(Boolean),[r,i]=t;if(!/^[0-9a-f]{40,64}$/.test(r??"")||!/^[0-9a-f]{40,64}$/.test(i??""))throw new Error("git did not report a resolved HEAD tree");return{headCommit:r,treeOid:i}}function hn(e){return hr("git",["-C",e,"status","--porcelain=v1","-z","--untracked-files=all","--no-renames","--","."],{...gr(),timeout:Te}).split("\0").filter(t=>t.length>=4&&t[2]===" ").map(t=>t.slice(3))}function gn(e){try{return mn(e).isFile()?Qe(e,{maxBytes:Ue,inputKind:"project-file"}):null}catch{return null}}var E=class extends Error{constructor(r,i){super(i);this.code=r}code};function xr(e){let t=!1,r,i=()=>{let d=r;if(r=void 0,!!d)try{d.db.close()}catch{}},n=()=>{let d=e.indexGeneration();if(!d)throw new E("stale-index","The resident index is not idle-fresh; run the command in-process.");return d},o=d=>{let c=e.observation();if(!c||c.published.generation!==d)throw new E("stale-index","No provable observation is bound to the published generation; run the command in-process.");let u=vr(e.projectRoot,c.published,{epoch:c.epoch,changeSequence:c.changeSequence});if(!u.continuous)throw new E("stale-index",`${u.reason}; run the command in-process.`)},a=()=>{let d=n(),c=xn(e.projectRoot);if(r&&(r.generation!==d||r.stamp!==c||N(e.dbPath)!==d)&&i(),!r){let u=xt(e.projectRoot);if(N(e.dbPath)!==d){try{u.close()}catch{}throw new E("stale-index","The published generation moved while opening the resident database.")}r={generation:d,stamp:c,db:u}}return r.db},l=d=>{if(!Se(d))throw new E("ineligible-command",`Command ${d} always executes in-process.`);n();let c=ee(e.projectRoot,_(e.projectRoot));if(c.dbPathSource!=="configured")throw new E("stale-index","The resident host does not serve fallback index locations.");A(c)};return{execute:async d=>{if(t)return U("busy","The resident host is executing another request; run the command in-process.");let c=d.argv[0];if(!c||c.startsWith("-")||!Se(c))return U("ineligible-command","Only evidence commands are served by the resident host.");let u;try{u=n(),o(u)}catch(p){return Sr(p)}t=!0;let f=Ae.now(),s=new Oe(d.tty),h=wn(d.envAllowlist),g=process.exitCode;process.exitCode=0,ke({argv:d.argv,execPath:d.clientInvocation?.execPath??process.execPath,...d.clientInvocation?.scriptPath!==void 0?{scriptPath:d.clientInvocation.scriptPath}:{},cwd:d.cwd}),be(a);try{let{program:p}=await fr({invocationCommand:c,resident:{preAction:l}});s.install();try{await p.parseAsync([...d.argv],{from:"user"})}finally{s.restore()}let b=typeof process.exitCode=="number"?process.exitCode:0;return{ok:!0,kind:"executed",protocolVersion:w,serverPid:process.pid,exitCode:b,stdout:s.stdout(),stderr:s.stderr(),generation:u,durationMs:Ae.now()-f}}catch(p){return p instanceof E?Sr(p):bn(p)?{ok:!0,kind:"executed",protocolVersion:w,serverPid:process.pid,exitCode:p.exitCode,stdout:s.stdout(),stderr:s.stderr(),generation:u,durationMs:Ae.now()-f}:U("execution-error",`Resident execution failed: ${p instanceof Error?p.message:String(p)}`)}finally{be(void 0),ke(void 0),A(void 0),process.exitCode=g,h(),t=!1}},releaseDatabase:i}}function U(e,t){return{ok:!1,protocolVersion:w,code:e,message:t}}function Sr(e){return e instanceof E?U(e.code,e.message):U("execution-error",e instanceof Error?e.message:String(e))}function bn(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&(e.code.startsWith("commander.")||e.code==="commander")&&typeof e.exitCode=="number"}function wn(e){let t=new Map;for(let r of Ft){t.set(r,process.env[r]);let i=e?.[r];i===void 0?delete process.env[r]:process.env[r]=i}return()=>{for(let[r,i]of t)i===void 0?delete process.env[r]:process.env[r]=i}}var Oe=class{constructor(t){this.tty=t}tty;stdoutChunks=[];stderrChunks=[];restorers=[];install(){this.restorers=[br(process.stdout,this.stdoutChunks),br(process.stderr,this.stderrChunks),ne(process.stdout,"isTTY",this.tty?.isTTY??!1),ne(process.stderr,"isTTY",this.tty?.isTTY??!1),ne(process.stdout,"columns",this.tty?.columns),ne(process.stderr,"columns",this.tty?.columns)]}restore(){for(let t of this.restorers.reverse())t();this.restorers=[]}stdout(){return this.stdoutChunks.join("")}stderr(){return this.stderrChunks.join("")}};function br(e,t){let r=e.write,i=(n,o,a)=>{t.push(typeof n=="string"?n:Buffer.isBuffer(n)?n.toString(typeof o=="string"?o:"utf8"):String(n));let l=typeof a=="function"?a:typeof o=="function"?o:void 0;return typeof l=="function"&&l(),!0};return e.write=i,()=>{e.write=r}}function ne(e,t,r){let i=Object.hasOwn(e,t),n=i?Object.getOwnPropertyDescriptor(e,t):void 0;return r===void 0?i&&Reflect.deleteProperty(e,t):Object.defineProperty(e,t,{value:r,configurable:!0,writable:!0}),()=>{n?Object.defineProperty(e,t,n):Reflect.deleteProperty(e,t)}}function xn(e){let t=yn("sha256");for(let i of[".codebaseiq.json",".codebaseiq-baseline.json"])t.update(i),t.update(wr(Me(e,i)));let r=Me(e,".codebaseiq","suppressions");t.update(r);try{for(let i of vn(r).sort())t.update(i),t.update(wr(Me(r,i)))}catch{t.update("absent")}return t.digest("hex")}function wr(e){try{let t=Sn(e);return`${t.size}:${t.mtimeMs}`}catch{return"absent"}}import{chmodSync as Cn,mkdirSync as Rn,rmSync as Cr}from"fs";import{createServer as En}from"net";import{dirname as Pn}from"path";var Rr=1e4,kn=5e3,In=6e5;function Er(e){let t=pe(e.projectRoot),r=0,i,n,o=new Set,a=En(c=>{o.add(c),c.setTimeout(Rr,()=>c.destroy()),c.on("error",()=>c.destroy()),c.on("close",()=>o.delete(c));let u=Qt(Vt,f=>{r+=1,i=new Date().toISOString(),e.onActivity?.(),l(f,c).then(s=>d(c,s)).catch(s=>{n=s instanceof Error?s.message:String(s),c.destroy()})},f=>{n=f.message,d(c,{ok:!1,protocolVersion:w,code:"invalid-request",message:f.message})});c.on("data",f=>{try{u.push(f)}catch(s){n=s instanceof Error?s.message:String(s),c.destroy()}})}),l=async(c,u)=>{let f=Gt(c);return f?pe(f.projectRoot)!==t?{ok:!1,protocolVersion:w,code:"wrong-project",message:"This query lane serves a different project root."}:y(f,u):{ok:!1,protocolVersion:w,code:"invalid-request",message:"The query lane received a request it could not validate."}},y=async(c,u)=>{if(c.kind==="ping"){let s=e.indexGeneration();return{ok:!0,kind:"pong",protocolVersion:w,serverPid:process.pid,...e.processIdentity?{processIdentity:e.processIdentity}:{},cliVersion:e.cliVersion,projectRoot:t,...s?{indexGeneration:s}:{}}}if(!e.execute)return{ok:!1,protocolVersion:w,code:"unsupported",message:"Resident execution is not enabled on this service; run the command in-process."};let f=Math.max(c.deadlineMs??Bt,Rr);u.setTimeout(Math.min(f+kn,In));try{u.write(Re({ok:!0,kind:"accepted",protocolVersion:w,serverPid:process.pid},Ce))}catch(s){return n=s instanceof Error?s.message:String(s),u.destroy(),{ok:!1,protocolVersion:w,code:"execution-error",message:"The query lane could not acknowledge the request."}}try{return await e.execute(c)}catch(s){return n=s instanceof Error?s.message:String(s),{ok:!1,protocolVersion:w,code:"execution-error",message:`Resident execution failed: ${n}`}}},d=(c,u)=>{try{c.end(Re(u,Ce))}catch(f){n=f instanceof Error?f.message:String(f),c.destroy()}};return process.platform!=="win32"&&(Rn(Pn(e.socketPath),{recursive:!0,mode:448}),Cr(e.socketPath,{force:!0})),new Promise((c,u)=>{a.once("error",u),a.listen(e.socketPath,()=>{if(a.removeListener("error",u),a.on("error",f=>{n=f.message}),process.platform!=="win32")try{Cn(e.socketPath,384)}catch{}c({status:()=>({protocolVersion:w,socketPath:e.socketPath,requests:r,...i!==void 0?{lastRequestAt:i}:{},...n!==void 0?{lastError:n}:{}}),close:()=>new Promise(f=>{for(let s of o)s.destroy();a.close(()=>{process.platform!=="win32"&&Cr(e.socketPath,{force:!0}),f()})})})})})}import{randomUUID as Mn}from"crypto";import{Worker as An}from"worker_threads";var ie=class{constructor(t){this.options=t;this.now=t.now??Date.now,this.setTimer=t.setTimer??setTimeout,this.clearTimer=t.clearTimer??clearTimeout}options;now;setTimer;clearTimer;worker=null;active=null;activeFailure=null;terminating=null;closed=!1;workerGeneration=0;canAccept(){return!this.closed&&this.active===null&&this.terminating===null}start(t){if(!this.canAccept())return!1;if(t.deadlineAtMs<this.now()){try{this.options.onReject(t,`${this.options.name} request expired before processing.`)}catch(o){this.closed=!0,this.options.onFatal(Le(o))}return!0}let r=this.ensureWorker(),i=Math.max(1,Math.min(2147483647,t.deadlineAtMs-this.now())),n=this.setTimer(()=>{this.failActiveAfterTermination(`${this.options.name} request exceeded its deadline.`)},i);this.active={request:t,timer:n};try{r.postMessage({kind:"request",...t})}catch(o){this.failActiveAfterTermination(Pr(o))}return!0}async close(t=`${this.options.name} service is shutting down.`){if(this.closed=!0,this.active){await this.failActiveAfterTermination(t);return}await this.terminateWorker()}ensureWorker(){if(this.worker)return this.worker;let t=this.options.createWorker(),r=++this.workerGeneration;return t.on("message",i=>this.handleMessage(r,i)),t.on("error",i=>{r===this.workerGeneration&&this.failActiveAfterTermination(`${this.options.name} worker failed: ${i.message}`)}),t.on("exit",i=>{r!==this.workerGeneration||this.terminating||(this.worker=null,this.active&&this.failActiveAfterTermination(`${this.options.name} worker exited unexpectedly with code ${i}.`))}),this.worker=t,t}handleMessage(t,r){if(t!==this.workerGeneration||this.closed||!this.active)return;let i=Tn(r);if(!i){this.failActiveAfterTermination(`${this.options.name} worker returned an invalid response.`);return}if(i.requestId!==this.active.request.requestId){this.failActiveAfterTermination(`${this.options.name} worker returned a mismatched request identity.`);return}if(this.now()>this.active.request.deadlineAtMs){this.failActiveAfterTermination(`${this.options.name} request expired while it was processing.`);return}let n=this.active;try{this.options.onStatus(i.status),i.ok?this.options.onComplete(n.request,i.result,i.status):this.options.onReject(n.request,i.error,i.status)}catch(o){this.closed=!0,this.clearTimer(n.timer),this.options.onFatal(Le(o));return}this.releaseActive(n)}async failActiveAfterTermination(t){if(this.activeFailure){await this.activeFailure;return}let r=this.active;if(!r){await this.terminateWorker();return}this.clearTimer(r.timer);let i=(async()=>{if(await this.terminateWorker()){try{this.options.onReject(r.request,t)}catch(o){this.closed=!0,this.options.onFatal(Le(o));return}this.releaseActive(r)}})();this.activeFailure=i;try{await i}finally{this.activeFailure===i&&(this.activeFailure=null)}}releaseActive(t){this.active===t&&(this.active=null,this.clearTimer(t.timer))}async terminateWorker(){if(this.terminating)return this.terminating;let t=this.worker;if(!t)return!0;this.worker=null;let r=++this.workerGeneration;return this.terminating=(async()=>{try{return await t.terminate(),!0}catch(i){return this.closed=!0,this.options.onFatal(new Error(`${this.options.name} worker termination failed: ${Pr(i)}`,{cause:i})),!1}finally{r===this.workerGeneration&&(this.terminating=null)}})(),this.terminating}};function Tn(e){if(!e||typeof e!="object")return null;let t=e;if(t.kind!=="response"||typeof t.requestId!="string"||!("status"in t))return null;if(t.ok===!0){if(!("result"in t)||"error"in t)return null}else if(t.ok===!1){if("result"in t||typeof t.error!="string")return null}else return null;return t}function Le(e){return e instanceof Error?e:new Error(String(e))}function Pr(e){return e instanceof Error?e.message:String(e)}function kr(e){let t=()=>({protocolVersion:K,state:"idle",requests:0,sessionsCreated:0,sessionsReplaced:0,initializations:0,programUpdates:0,documentsEmitted:0,documentsRemoved:0});return Tr({name:"TypeScript index",paths:e.paths,now:e.now,limits:e.limits,initialStatus:t,parseEnvelope:dt,createWorker:()=>Mr(e,{kind:"index",projectRoot:e.projectRoot,dbPath:e.dbPath}),complete(r,i,n,o){fe(e.paths,r,{ok:!0,protocolVersion:K,id:i.id,baseGeneration:i.baseGeneration,response:n},{nowMs:o,limits:e.limits})},reject(r,i,n,o){he(e.paths,r,{ok:!1,protocolVersion:K,id:i,error:n},n,{nowMs:o,limits:e.limits})},onBusy:e.onBusy,onFatal:e.onFatal})}function Ir(e){let t=()=>({protocolVersion:Z,state:"idle",requests:0,sessionsCreated:0,sessionsReused:0,sessionsRefreshed:0,sessionsReplaced:0,projectsCreated:0});return Tr({name:"TypeScript semantic",paths:e.paths,now:e.now,limits:e.limits,initialStatus:t,parseEnvelope:St,createWorker:()=>Mr(e,{kind:"semantic",projectRoot:e.projectRoot}),complete(r,i,n,o){fe(e.paths,r,{ok:!0,protocolVersion:Z,id:i.id,generation:i.generation,response:n},{nowMs:o,limits:e.limits})},reject(r,i,n,o){he(e.paths,r,{ok:!1,protocolVersion:Z,id:i,error:n},n,{nowMs:o,limits:e.limits})},onBusy:e.onBusy,onFatal:e.onFatal})}function Tr(e){let t=e.now??Date.now,r=q(process.pid),i={pid:process.pid,...r?{processIdentity:r}:{}},n=`${e.name.toLowerCase().replaceAll(" ","-")}-${process.pid}-${Mn()}`,o={...e.limits,maxBatch:1},a=null,l=e.initialStatus(),y=!1,d=s=>{y=!0,e.onFatal(s)},c=new ie({name:e.name,createWorker:e.createWorker,now:t,onComplete(s,h,g){let p=u(s.requestId);l=g,e.complete(p.claim,p.envelope,h,t()),f(p)},onReject(s,h,g){let p=u(s.requestId);g!==void 0&&(l=g),e.reject(p.claim,p.envelope.id,h,t()),f(p)},onStatus(s){l=s},onFatal:d});return{poll(){if(y||!c.canAccept())return 0;let s=ot(e.paths,{ownerId:n,nowMs:t(),limits:o,owner:i,liveness:{isProcessAlive:tt,readProcessIdentity:q}})[0];if(!s)return 0;let h=s.requestId;try{let g=e.parseEnvelope(st(s,o));if(h=g.id,g.id!==s.requestId)throw new Error(`${e.name} request identity does not match its mailbox path.`);if(g.deadlineAtMs<t())throw new Error(`${e.name} request expired before processing.`);if(a={claim:s,envelope:g},e.onBusy?.(g.deadlineAtMs),!c.start({requestId:g.id,deadlineAtMs:g.deadlineAtMs,payload:g}))throw new Error(`${e.name} worker lane closed admission after claiming a request.`)}catch(g){let p=Ln(g);try{e.reject(s,h,p,t()),a?.claim===s&&f(a)}catch(b){d(On(b))}}return 1},status(){return{...l,mailbox:at(e.paths)}},async close(s){await c.close(s)}};function u(s){let h=a;if(!h||h.envelope.id!==s)throw new Error(`${e.name} parent lost the active mailbox claim.`);return h}function f(s){a===s&&(a=null,e.onBusy?.(void 0))}}function Mr(e,t){if(e.createWorker)return e.createWorker(t);let r=e.workerUrl??new URL("./typescript-mailbox-worker.js",import.meta.url);return new An(r,{workerData:t})}function On(e){return e instanceof Error?e:new Error(String(e))}function Ln(e){return e instanceof Error?e.message:String(e)}import{existsSync as Wn}from"fs";import{fileURLToPath as Ar}from"url";import{Worker as Dn}from"worker_threads";var qn=2e3;function Wr(e){let t=e.userCacheRoot??Et(),r={kind:"sentinel-worker",projectRoot:e.projectRoot,cacheDir:e.indexPaths.cacheDir,dbPath:e.indexPaths.dbPath,cliVersion:e.cliVersion,userCacheRoot:t},i=e.createWorker??_n,n,o=0,a=!1,l=!1,y,d=()=>{let s;try{s=i(r)}catch(p){e.log(`worker could not be started: ${Lr(p)}`);return}let h,g={worker:s,exited:new Promise(p=>{h=p})};n=g,s.on("message",p=>{n===g&&c(p)}),s.on("error",p=>e.log(`worker failed: ${p.message}`)),s.on("exit",p=>{if(h(),n===g&&(n=void 0,o=0,!l)){if(e.log(`worker exited unexpectedly with code ${p}`),Or(t,e.projectRoot),a){e.log("worker will not be restarted again");return}a=!0,d()}})},c=s=>{let h=Nn(s);h?.kind==="sessions"?o=h.live:h?.kind==="log"&&e.log(h.message)},u=s=>{try{n?.worker.postMessage(s)}catch(h){e.log(`${s.kind} could not be posted: ${Lr(h)}`)}},f=async()=>{l=!0;let s=n;s&&(u({kind:"shutdown"}),await jn(s.exited,e.stopTimeoutMs??qn),n===s&&(n=void 0,await s.worker.terminate().catch(()=>{}))),o=0,Or(t,e.projectRoot)};return d(),{filesChanged:s=>u({kind:"filesChanged",paths:s}),generationPublished:()=>u({kind:"generationPublished"}),releaseDb:()=>u({kind:"releaseDb"}),liveSessionCount:()=>o,stop:()=>y??=f()}}function Dr(){let e,t=!1;return{attach(r){e=r},filesChanged:r=>e?.filesChanged(r),bulkChange:()=>e?.filesChanged([]),watcherStatus(r){r.state==="idle"?t=!1:e&&!t&&(t=!0,e.releaseDb())},generationPublished(){t=!1,e?.generationPublished()},liveSessionCount:()=>e?.liveSessionCount()??0,async stop(){await e?.stop()}}}function _n(e){let t=new URL("./sentinel-worker.js",import.meta.url);if(!Wn(Ar(t)))throw new Error(`sentinel worker was not found at ${Ar(t)}. Run npm run build first.`);let r=new Dn(t,{workerData:e});return r.unref(),r}function Nn(e){if(typeof e!="object"||e===null)return;let{kind:t,live:r,message:i}=e;if(t==="sessions"&&typeof r=="number"&&Number.isInteger(r)&&r>=0)return{kind:t,live:r};if(t==="log"&&typeof i=="string")return{kind:t,message:i}}function Or(e,t){try{kt(e,Pt(t),process.pid)}catch{}}async function jn(e,t){let r,i=new Promise(n=>{r=setTimeout(n,t)});try{await Promise.race([e,i])}finally{clearTimeout(r)}}function Lr(e){return e instanceof Error?e.message:String(e)}var Bn=1e3,Fn=250,Un=6e4,Qn=10,Gn=50,Hn=250;function zn(e,t=1){if(e>0)return Qn;let r=Math.max(0,Math.min(3,t-1));return Math.min(Hn,Gn*2**r)}async function Yn(e,t){let r=t.processIndexRequests(),i=t.processSemanticRequests(),n=r+i,o=n>0?0:e+1;if(t.afterMailboxPoll({indexRequests:r,semanticRequests:i,processedRequests:n}),t.shouldStop())return{indexRequests:r,semanticRequests:i,processedRequests:n,consecutiveIdlePolls:o,stopped:!0};let a=zn(n,o);return await t.wait(a),{indexRequests:r,semanticRequests:i,processedRequests:n,consecutiveIdlePolls:o,stopped:!1,delayMs:a}}function Xn(e,t=v.env){return e==="fresh"||t.CODEBASEIQ_SENTINEL_ENSURE==="1"?null:{kind:"watch-startup",detail:`index ${e} when watch service started`}}async function Jn(e,t,r={}){let i=qt(e,t),n=i.projectRoot;v.env.CODEBASEIQ_PROJECT_ROOT=n;let o=ft(n);o.watch={...o.watch,...r};let a=ht(o);if(!a.enabled)throw new Error('watch mode is disabled; set "watch.enabled": true before starting the service');let l=et(n,o),y=ut(l.cacheDir),d=q(v.pid),c=jt(y.lockPath,n,{readProcessIdentity:m=>m===v.pid?d:q(m)});if(!c.acquired)return;let u=new te(y.refreshRequestsPath,{retryDelayMs:Math.max(1e3,a.cooldownMs)});u.initializeAfterOwnershipAcquired();let f=Date.now(),s=D(),h=f,g=s,p={state:"idle"},b,Q,P,G,oe=J(l.dbPath),se=!1,We=!1,De=0,qe=Number.NEGATIVE_INFINITY,_e=Number.NEGATIVE_INFINITY,Ne=Number.NEGATIVE_INFINITY,je=Number.NEGATIVE_INFINITY,ae,ce,$e=0,de=vt(l.cacheDir),le=ct(l.cacheDir);Rt(de),pt(le);let H,$,L,Ve=o.sentinel?.enabled===!0,I=Dr(),Be=m=>{if(L=void 0,!!m)try{let x=_(n);if(!x?.headCommit||!x.treeOid)return;let S=ze(X(l.metaPath,"reindex metadata"));if(S.kind!=="legacy"&&S.kind!=="supported")return;let k=He(S.metadata.fingerprint);if(!k)return;L=yr({generation:m,...W.observation(),headCommit:x.headCommit,treeOid:x.treeOid,snapshot:k,config:o})}catch{}},C=(m=!1,x=m?"durable":"visibility")=>{if(!We)return;let S=Date.now(),k=D();!m&&k-qe<Bn||(qe=k,_t(y.statePath,{version:1,protocolVersion:lt,pid:v.pid,...d?{processIdentity:d}:{},projectRoot:n,...i.worktreeId?{worktreeId:i.worktreeId}:{},cliVersion:t,startedAt:new Date(f).toISOString(),heartbeatAt:new Date(S).toISOString(),lastActivityAt:new Date(h).toISOString(),...a.idleTimeoutMs===0?{}:{idleDeadlineAt:new Date((I.liveSessionCount()>0?S:h)+a.idleTimeoutMs).toISOString()},watcher:p,...p.state==="idle"&&b?{indexGeneration:b}:{},...Q?{lastRefresh:Q}:{},...P?{lastError:P}:{},reindexActivity:oe,refreshRequests:u.status(),typescriptSemantic:{...ue.status(),...ae===void 0?{}:{busyUntil:new Date(ae).toISOString()}},typescriptIndex:{...me.status(),...ce===void 0?{}:{busyUntil:new Date(ce).toISOString()}},...H?{queryLane:H.status()}:{}},{durability:x}))},T=()=>{h=Date.now(),g=D()},Fe=m=>{T(),G??=m,P={at:new Date().toISOString(),message:m.message},C(!0,"visibility")},ue=Ir({paths:de,projectRoot:n,onBusy(m){ae=m===void 0?void 0:m+5e3,C(!0,"visibility")},onFatal:Fe}),me=kr({paths:le,projectRoot:n,dbPath:l.dbPath,onBusy(m){ce=m===void 0?void 0:m+5e3,C(!0,"visibility")},onFatal:Fe}),W=new It({projectRoot:n,config:{...o,watch:a},outputDb:l.dbPath,languages:o.languages,onStatus(m){p=m,I.watcherStatus(m),m.state!=="idle"&&(b=void 0,L=void 0,$?.releaseDatabase(),T()),C(!0)},...Ve?{onFileChanged:I.filesChanged,onBulkChange:I.bulkChange}:{},onReindexComplete(){T();let m=ve(n,o,l);return Q=m.lastRefresh,b=m.state==="fresh"?N(l.dbPath)??void 0:void 0,Be(b),oe=J(l.dbPath),u.completeActive(),P=void 0,C(!0),I.generationPublished(),m.state==="fresh"},onReindexError(){u.failActive()},onRefreshSuppressed(m){let x=it(l.dbPath,m);x.state==="failed"&&(P={at:new Date().toISOString(),message:`Suppressed-refresh telemetry was not recorded: ${x.reason}`},C(!0,"visibility")),oe=J(l.dbPath)},onError(m){T(),b=void 0,L=void 0,P={at:new Date().toISOString(),message:m.message},C(!0)}}),z=()=>{se=!0};v.once("SIGINT",z),v.once("SIGTERM",z);let V=!1,Y,B;try{try{$=v.env.CODEBASEIQ_DAEMON==="1"||o.daemon?.enabled===!0?xr({projectRoot:n,dbPath:l.dbPath,indexGeneration:()=>b,observation:()=>L?{published:L,...W.observation()}:void 0}):void 0,H=await Er({socketPath:Ut(l.cacheDir),projectRoot:n,cliVersion:t,...d?{processIdentity:d}:{},indexGeneration:()=>b,onActivity:T,...$?{execute:k=>$.execute(k)}:{}})}catch(S){P={at:new Date().toISOString(),message:`Query lane did not start: ${S instanceof Error?S.message:String(S)}`}}Ve&&I.attach(Wr({projectRoot:n,indexPaths:l,cliVersion:t,log(S){v.env.CODEBASEIQ_DEBUG&&console.error(`sentinel: ${F(S)}`)}})),W.start();let m=ve(n,o,l);Q=m.lastRefresh,b=m.state==="fresh"?N(l.dbPath)??void 0:void 0,Be(b);let x=Xn(m.state);for(x&&W.requestRefresh(x,{immediate:!0}),T(),We=!0,C(!0);!se;){let S=await Yn($e,{processIndexRequests:()=>me.poll(),processSemanticRequests:()=>ue.poll(),afterMailboxPoll:({processedRequests:k})=>{let O=D();if(O-je>=Un&&(je=O,ge(le),ge(de)),O-Ne>=6e4&&(Ne=O,j(n,t)),O-_e>=Fn){_e=O;let M=Nt(y.activityPath);M&&M.atMs>h&&(h=M.atMs,g=O),M?.refreshRequestedAtMs!==void 0&&M.refreshRequestedAtMs>De&&(De=M.refreshRequestedAtMs,u.observeLegacyRequest(M.refreshRequestedAtMs,M.refreshDetail??"stale index observed by a legacy command")),u.poll(p,_r=>{T(),W.requestRefresh({kind:"watch-demand",detail:_r},{immediate:!0})})}k>0&&(T(),C(!0,"visibility")),C()},shouldStop:()=>se||G!==void 0||$t({watcher:p,lastActivityAtMs:g,nowMs:D(),idleTimeoutMs:a.idleTimeoutMs,liveSessions:I.liveSessionCount()}),wait:Kn});if($e=S.consecutiveIdlePolls,S.stopped)break}}catch(m){V=!0,Y=m}finally{v.off("SIGINT",z),v.off("SIGTERM",z),await H?.close(),await I.stop(),$?.releaseDatabase(),await Promise.all([ue.close("TypeScript semantic service stopped before completing the request."),me.close("TypeScript index service stopped before completing the request.")]);let m=await W.stop();m.state==="stopped"?(qr(y.statePath,{force:!0}),qr(y.activityPath,{force:!0}),c.release()):(P={at:new Date().toISOString(),message:`Watch service shutdown is degraded: ${m.reasons.join("; ")}`},C(!0),B=new Error(P.message))}if(!V&&G&&(V=!0,Y=G),V&&B)throw new AggregateError([Y,B],"Watch service execution and shutdown both failed.");if(V)throw Y;if(B)throw B}function Kn(e){return new Promise(t=>setTimeout(t,e))}function Zn(e,t={report:r=>console.error(r),exit:r=>v.exit(r)}){return t.report(`watch-service: ${F(e instanceof Error?e.message:String(e))}`),t.exit(1)}var ei=v.argv[1]?Vn($n(v.argv[1])).href:null;if(ei===import.meta.url){mt();let e=v.argv[2],t=v.argv[3],r=ti(v.argv[4]);if(!e||!t)console.error("watch-service: expected <project-root> <cli-version>"),v.exitCode=1;else try{await Jn(e,t,r)}catch(i){Zn(i)}}function ti(e){if(!e)return{};try{let t=JSON.parse(e);return t&&typeof t=="object"?t:{}}catch{return{}}}export{Yn as runWatchServiceLoopIteration,Jn as runWatchServiceServer,Xn as startupRefreshTrigger,Zn as terminateWatchServiceProcess,zn as watchServiceLoopDelayMs};
 //# sourceMappingURL=watch-server.js.map

package/docs/INDEX_GENERATIONS.md

@@ -48,8 +48,8 @@ bounded process-local validation cache is keyed by manifest identity plus
 stable device, inode, size, modification-time, and change-time evidence, so a
 same-size mutation invalidates the cached proof and is rehashed.
 
-The top-level files remain for the SCIP CLI, indexers, older codebaseiq
-versions, and external inspection. They are derived mirrors, not the internal
+The top-level files remain for indexers, older codebaseiq versions, and
+external inspection. They are derived mirrors, not the internal
 read authority. A current codebaseiq process never combines rows from a
 generation directory with metadata or SCIP bytes freshly reread through those
 replaceable paths.

package/docs/NPM_RELEASE.md

@@ -0,0 +1,323 @@
+# npm Release
+
+`codebaseiq` is published to npm as one package. This runbook covers how a
+release is prepared, published, and recovered, and is the publisher checklist
+for the workstation that runs it.
+
+A release is one irreversible registry publication of an exact tarball.
+Unlike a database transaction, it cannot be rolled back. Its essential safety
+property is therefore not atomicity: it is that every registry state the
+process can leave behind identifies the intended bytes, is observed before the
+next irreversible step, and can be reconciled by rerunning one command.
+
+## Authority and guarantees
+
+The registry and the immutability of npm versions are the release authority. A
+local checkout, a local state record, and a successful `npm publish` exit code
+are all evidence, never proof. A release is eligible to publish only when all
+of these facts agree:
+
+1. The Git checkout is clean, and `HEAD` is the same object ID before and after
+   the preflight and the pack.
+2. One canonical, credential-free HTTPS npm registry is resolved and retained
+   for the complete run.
+3. Typecheck, the production dependency audit, the complete test suite, and
+   lint (which includes formatting, the production build, API compatibility,
+   downstream compilation, and skill link checks) all pass.
+4. The packed tarball's own `package.json` names the reviewed package and
+   version.
+5. The registry either does not have that version (an explicit `E404`) or has
+   it with bytes identical to the local tarball.
+
+## Publisher checklist
+
+This checklist covers a release run from a workstation. It is the entry point
+for the operator runbook below.
+
+A workstation release is the only one available. The repository's release
+workflow is a preflight: it reports the plan, carries no registry credential,
+and cannot publish. Two facts keep it that way. The declaration build needs more
+memory than a standard hosted runner has, for the reason recorded in the
+`//build` note in `package.json`. And the release lock is checkout-local, so it
+could not serialize a runner against a workstation: exactly one host may run
+the coordinator in publish mode at a time.
+
+### Workstation prerequisites
+
+None of these are checked by the coordinator, and each one fails late if it is
+missing.
+
+- **Repository credentials.** The remote is private, so the clone needs a
+  credential helper, a token, or an SSH remote. Nothing in the repository
+  provisions this, and the coordinator only ever reads local `HEAD`.
+- **A Git identity**, because the release change must be committed before the
+  coordinator will run. A signing configuration inherited from another machine
+  needs a usable key: suite cases that commit do not disable signing.
+- **A checkout whose line endings are LF.** `format:check` is the first thing
+  `lint` runs, and `lint` is the last preflight command, so a checkout made with
+  `core.autocrlf=true` fails after typecheck, the audit, and the complete suite
+  have already passed. Put the checkout on the Linux filesystem.
+- **Node.js** at or above the `engines` floor.
+- **Memory above the declaration build's requirement**, recorded with its
+  measured thresholds in the `//build` note in `package.json`. Under WSL2 this
+  is a `.wslconfig` setting on the Windows host, outside the checkout, and it
+  takes effect only after the virtual machine is restarted.
+- **Disk for work that never appears in the checkout**: a temporary tree holding
+  the packed tarball and, when the version already exists, the tarball
+  downloaded from the registry. `TMPDIR` must be writable; the coordinator
+  creates its temporary tree before anything else.
+- **Network reachability** for the npm registry and for the production
+  dependency audit.
+- **A registry credential keyed to the registry the coordinator resolves.**
+  Authentication is never checked before publication. A token stored under a
+  different host key still produces a clean dry run, because an anonymous
+  lookup answers `E404` and the package reads as absent; it fails only at
+  publication, after the complete preflight.
+- **Development dependencies installed.** Every release entry point runs through
+  `vite-node`, which arrives only as a transitive development dependency. An
+  install that omits them, including one caused by an exported
+  `NODE_ENV=production`, fails before any gate runs.
+- **A terminal, or an exported `CI`.** The reporter is selected on that variable
+  alone. Redirecting or piping a run with `CI` unset selects the reporter whose
+  main-process cost fails a suite in which every test passed.
+- **Knowledge of which optional toolchains are present.** Cases that skip on a
+  bare machine become real work when their toolchain exists: `cargo` on `PATH`
+  compiles a Rust kernel, and a Java runtime with the cached model-checker jar
+  runs a specification. A developer workstation is where these are present.
+
+### Order of work
+
+1. Establish credentials and Git identity, then clone.
+2. Confirm the checkout is clean with `git status --porcelain=v1
+--untracked-files=all`. The cleanliness gate runs twice, before preflight and
+   again after the pack, so anything a run leaves behind aborts it at the end.
+3. Install dependencies.
+4. Follow the operator runbook below.
+
+### First publish
+
+Three traps have no representation in the failure table, because each one is
+reachable before the coordinator reports anything:
+
+- **Do not move `HEAD` between the dry run and the publication.** The dry run
+  writes the durable record before its own branch is taken, and that record
+  pins the source revision. Committing a fix the dry run revealed is enough to
+  make the publication refuse. The recovery for a first publish is to move the
+  recorded file out of the coordinate-stable path, which is ignored by Git, and
+  rerun the dry run at the new revision. Do not bump a version to satisfy a
+  local bookkeeping file when nothing has reached the registry.
+- **Confirm the name is ownable before burning a preflight.** Registry presence
+  is decided per version, and only `E404` counts as absent. A name owned by
+  someone else without this version reads as absent, so the coordinator runs
+  everything and fails at publication on a permission error it does not
+  interpret.
+- **A malformed lock is the one thing a rerun cannot clear.** A lock whose owner
+  is a dead process is reclaimed automatically; a corrupt record fails closed and
+  reports contention until it is removed by hand.
+
+A release that bumps the version must update the version expectations in
+`tests/scripts/runtime-support-contract.test.ts` and the recorded version in
+`package-lock.json` in the same commit. The suite runs as a preflight command,
+so a bump without that edit fails before anything is packed.
+
+## Registry identity gate
+
+A packed package identity is the npm package coordinate plus the exact tarball
+SHA-1, SHA-512, and size, observed from one locally created `.tgz`. What
+distinguishes it from a version-existence check is that it identifies the bytes
+intended for installation, not merely the name under which some bytes were
+published.
+
+Before any registry mutation, the release flow:
+
+1. packs the package once, with lifecycle scripts disabled, into a private
+   temporary directory;
+2. recomputes the tarball hashes and size instead of trusting npm's JSON
+   report; and
+3. extracts `package/package.json` from the tar archive under a 64 MiB
+   decompression ceiling and requires its name and version to equal the
+   reviewed `package.json`.
+
+For an existing version, the flow reads npm's `dist` identity, downloads the
+published tarball with lifecycle scripts disabled, recomputes its hashes, and
+requires all of the following to agree:
+
+- registry metadata and downloaded tarball SHA-1 and SHA-512;
+- local and registry package names and versions; and
+- local and registry tarball SHA-1 and SHA-512.
+
+An explicit npm `E404` is the only evidence that authorizes the
+not-yet-published branch. Authentication failures, timeouts, output-limit
+failures, malformed metadata, generic proxy errors, and server failures are
+ambiguous registry states and stop the release. Pack and registry commands
+have finite 120-second and 30-second deadlines respectively, a 4 MiB captured
+output ceiling, and typed timeout/output/exit failure classification.
+
+The coordinator publishes an already verified local `.tgz`, not a directory
+that npm could repack differently. If a publish command fails because another
+process won the race, the coordinator rereads and downloads the winning
+registry version. It may continue only when the winner has the same complete
+identity; a different winner requires a new package version.
+
+## Release coordinator
+
+The release coordinator is the repository command that owns the whole
+sequence. It differs from a lifecycle hook by packing and validating the
+artifact before any registry mutation, recording local recovery evidence, and
+verifying registry truth after the publication:
+
+1. acquire the token-owned release lock;
+2. require a clean Git checkout and record the exact `HEAD` object ID;
+3. resolve one canonical credential-free HTTPS npm registry and retain it for
+   the complete run;
+4. run typecheck, the production dependency audit, the complete test suite, and
+   lint;
+5. pack the package with lifecycle scripts disabled;
+6. extract the packed `package.json` and require its coordinate;
+7. require Git `HEAD` and complete tracked/untracked working-tree cleanliness
+   to be unchanged;
+8. durably record the registry and the local tarball identity before reading
+   the registry;
+9. observe and fully verify the registry coordinate, always passing the
+   retained registry URL explicitly, before the publish;
+10. publish and verify the package if absent, then durably record that fact; and
+11. remove the private pack and release the owned lock.
+
+Every Git, npm pack, registry, publish, test, and lint process has a finite
+deadline and captured-output limit. A cleanup or lock-release failure produces
+a nonzero outcome without erasing an earlier build, registry, or publication
+failure from the diagnostic.
+
+### Operator runbook
+
+Prepare and commit the complete release change first. The checkout must be
+clean because the recorded source revision is the wider evidence from which
+the packed artifact was tested and produced.
+
+1. Bump the package version.
+2. Review and commit the version, lockfile, changelog, schemas, release code,
+   and tests.
+3. Run:
+
+   ```bash
+   npm run release:npm:dry-run
+   ```
+
+   This runs the complete local preflight, packs the artifact, writes the
+   local recovery record, and reads/downloads any existing registry version.
+   It never invokes `npm publish`.
+
+4. Review the reported coordinate, integrity, registry state, and the JSON
+   record under `.codebaseiq/releases/`.
+5. Run:
+
+   ```bash
+   npm run release:npm
+   ```
+
+6. Require the final output to say that the exact registry identity is
+   verified. A later retry of the same command is safe: it repeats local
+   preflight and registry verification, but it does not republish an already
+   identical coordinate.
+
+Do not run `npm publish` directly. The root `prepublishOnly` guard refuses that
+path because npm's lifecycle cannot run the preflight, record or recover local
+state, or reconcile an ambiguous publish against the registry. An operator can
+deliberately bypass lifecycle scripts with npm's `--ignore-scripts` option;
+that is an administrative capability outside the repository's enforcement
+boundary, not an alternate supported release path. The coordinator itself uses
+`--ignore-scripts` only when publishing the tarball it has already packed,
+hashed, inspected, and recorded.
+
+### Durable local release state
+
+A local release-state record is a schema-versioned JSON recovery fact stored
+outside the npm tarball under `.codebaseiq/releases/`. It is distinguished
+from registry authority by recording what this checkout intended and what an
+earlier run verified, while never permitting a later run to skip fresh
+registry observation.
+
+Schema version 2 records:
+
+- a content-derived `releaseId`;
+- the clean Git revision used for preflight and packing;
+- the canonical HTTPS npm registry on which the coordinate is interpreted;
+- the package's name, version, byte size, SHA-1, and SHA-512 integrity;
+- `createdAt` and nondecreasing `updatedAt` timestamps;
+- the writer identity; and
+- a canonical set of completed facts: `local-preflight-complete` and
+  `main-registry-verified`.
+
+The registry fact is an independent observation, not a fictional transaction
+log. For example, an old or manually created state may lack
+`main-registry-verified` while the registry already has the exact package. The
+next coordinator run still verifies the coordinate and records the fact without
+publishing.
+
+The path is stable for one package coordinate. Repacking different bytes,
+using a different source revision, or selecting a different registry under
+that same version therefore collides with the existing record and stops before
+registry work. The record is atomically replaced while the release lock is
+owned. The coordinator reports `directory-durable` when the host synchronizes
+the containing directory and `file-flushed; directory sync unsupported` when
+Windows exposes only the bounded file guarantee; a real synchronization failure
+aborts the run. It is intentionally ignored by Git and omitted from the npm
+package: it is local recovery state, not portable release authority. Fresh
+registry observation, immutable npm versions, and exact package identity remain
+the external safety authority regardless of the local result. The normative
+shape is `docs/schemas/npm-release-state.schema.json`.
+
+Current-schema additive fields are tolerated. Malformed JSON, a wrong
+discriminator, an invalid identity, a noncanonical stage list, or an
+unsupported schema fails closed. Do not hand-edit a damaged record. Preserve it
+for diagnosis, move it out of the coordinate-stable path, and rerun from the
+exact recorded source revision; the new run will recompute local bytes and
+reverify the registry coordinate before acquiring publication authority.
+
+## Failure and recovery
+
+| Observed state or failure                                           | Safe outcome and recovery                                                                                                  |
+| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| Dirty checkout before preflight                                     | Stop before tests and registry reads; commit, remove, or intentionally ignore/restore every tracked or untracked path      |
+| Missing, insecure, credential-bearing, or malformed registry URL    | Stop before tests and registry reads; configure one canonical credential-free HTTPS npm registry                           |
+| Git revision or any tracked/untracked path changes during preflight | Stop before the state record and registry reads; remove the concurrent editor and rerun from one completely clean revision |
+| Test, lint, build, API, or pack fails                               | No registry mutation has occurred; fix the local failure and rerun                                                         |
+| Packed `package.json` names a different coordinate                  | Stop before the state record and registry reads; fix the package metadata and rerun                                        |
+| Initial state publication fails                                     | No registry read or mutation has occurred; repair local filesystem durability/permissions and rerun                        |
+| State contains only `local-preflight-complete`                      | Registry is freshly reconciled; an absent package is published                                                             |
+| Package is exact, state is stale or absent                          | Record the observed fact and finish without publication                                                                    |
+| Publish succeeds but its state write fails                          | Retry observes the exact registry identity and records completion                                                          |
+| Publish reports failure but an identical winner is visible          | Accept the registry fact after downloading and hashing it; continue                                                        |
+| Publish and its immediate registry reconciliation both fail         | Report both causal failures; rerun the coordinator to establish registry truth before another publication decision         |
+| Publish returns success but identity is not yet visible             | Stop after bounded visibility retries; rerun the coordinator rather than publishing blindly                                |
+| Registry query times out, is unauthorized, or is malformed          | Stop; ambiguity is not converted to absence                                                                                |
+| Published tarball disagrees with `dist` metadata                    | Stop; treat the download or registry metadata as corrupt                                                                   |
+| Existing coordinate has different bytes                             | Stop; npm versions are immutable, so bump the package version                                                              |
+| State records different source or bytes under the same version      | Stop before registry reads; resume the recorded revision, or bump the package version                                      |
+| Configured registry differs from the recorded release registry      | Stop before registry reads; restore the intended registry or begin a new package version for the other registry            |
+| Malformed or unsupported local state                                | Preserve and move the artifact for diagnosis; rerun from the recorded revision so local and registry facts are rebuilt     |
+| Release lock is held by a live owner                                | Wait; a dead attributable owner is reclaimed conservatively, while unverifiable ownership fails closed                     |
+| Cleanup and an earlier operation both fail                          | Both failures are reported; inspect registry/state first, then rerun to reconcile                                          |
+| Lock ownership changes before release                               | Command exits nonzero; do not infer failure or success from the local message—rerun and require exact registry identity    |
+
+## Compatibility
+
+The local release-state schema is versioned independently of the package.
+Version 2 is the single-package record. Additive current fields are
+compatible; removing or reinterpreting a required identity, source, stage, or
+timestamp field requires a new schema and an explicit recovery policy.
+
+Version 1 recorded two packages and is not read: a version 1 record is
+rejected as an unsupported schema rather than migrated. It would also never be
+found, because the record path is now derived from the single package
+coordinate. Records are local, ignored by Git, and describe only an earlier
+run's intent, so leaving one in place is harmless; the registry remains the
+authority.
+
+## Retired Windows sidecar
+
+Earlier releases published a second package, `codebaseiq-windows`, ahead of the
+main package. It existed only to carry the `scip` index converter's Windows
+executables, which codebaseiq no longer invokes. Releases now neither build,
+pin, nor publish it. Versions already on the registry are untouched, and
+nothing here unpublishes them.

package/docs/schemas/npm-release-state.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/PlunderStruck/codebaseiq/blob/main/docs/schemas/npm-release-state.schema.json",
   "title": "codebaseiq npm release state",
-  "description": "Durable local progress for one exact main-package and Windows-sidecar npm release.",
+  "description": "Durable local progress for one exact codebaseiq npm release.",
   "type": "object",
   "required": [
     "kind",
@@ -20,7 +20,7 @@
       "const": "codebaseiq-npm-release-state"
     },
     "schemaVersion": {
-      "const": 1
+      "const": 2
     },
     "releaseId": {
       "type": "string",
@@ -56,13 +56,10 @@
     },
     "packages": {
       "type": "object",
-      "required": ["main", "sidecar"],
+      "required": ["main"],
       "properties": {
         "main": {
           "$ref": "#/$defs/packageIdentity"
-        },
-        "sidecar": {
-          "$ref": "#/$defs/packageIdentity"
         }
       },
       "additionalProperties": true
@@ -72,20 +69,14 @@
       "minItems": 1,
       "uniqueItems": true,
       "items": {
-        "enum": ["local-preflight-complete", "sidecar-registry-verified", "main-registry-verified"]
+        "enum": ["local-preflight-complete", "main-registry-verified"]
       },
       "oneOf": [
         {
           "const": ["local-preflight-complete"]
         },
-        {
-          "const": ["local-preflight-complete", "sidecar-registry-verified"]
-        },
         {
           "const": ["local-preflight-complete", "main-registry-verified"]
-        },
-        {
-          "const": ["local-preflight-complete", "sidecar-registry-verified", "main-registry-verified"]
         }
       ]
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebaseiq",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.",
   "repository": {
     "type": "git",
@@ -24,10 +24,7 @@
     "docs/assets/**/*",
     "docs/schemas/**/*",
     "docs/*.md",
-    "scripts/build-codebaseiq-windows.mjs",
     "scripts/evidence-product-contract.mjs",
-    "scripts/codebaseiq-windows-provenance.mjs",
-    "scripts/verify-codebaseiq-windows.mjs",
     "skills/**/*.md",
     "skills/**/agents/*.yaml",
     "ui/view/**/*"
@@ -381,11 +378,8 @@
     "api:report": "node scripts/api-surface-contract.mjs report",
     "api:check": "npm run build && node scripts/api-surface-contract.mjs check && tsc -p tests/fixtures/public-api-consumer/tsconfig.json",
     "api:update": "npm run build && node scripts/api-surface-contract.mjs update",
-    "lint": "npm run format:check && eslint src tests ui/view tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/build-codebaseiq-windows.mjs scripts/cache-lifecycle-soak.ts scripts/codex-exploration-sandbox.mjs scripts/codex-exploration-trial-core.mjs scripts/codex-exploration-trial.mjs scripts/compare-exploration-trials.mjs scripts/exploration-benchmark-core.mjs scripts/exploration-benchmark.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-codebaseiq-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/codebaseiq-windows-package-identity.ts scripts/codebaseiq-windows-provenance.mjs scripts/codebaseiq-windows-release.ts scripts/verify-identity-collision-cli.mjs scripts/verify-codebaseiq-windows.mjs scripts/verify-codebaseiq-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
-    "build:codebaseiq-windows": "node scripts/build-codebaseiq-windows.mjs",
-    "verify:codebaseiq-windows": "node scripts/verify-codebaseiq-windows.mjs",
+    "lint": "npm run format:check && eslint src tests ui/view tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/cache-lifecycle-soak.ts scripts/codex-exploration-sandbox.mjs scripts/codex-exploration-trial-core.mjs scripts/codex-exploration-trial.mjs scripts/compare-exploration-trials.mjs scripts/exploration-benchmark-core.mjs scripts/exploration-benchmark.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/npm-package-identity.ts scripts/npm-release-runtime.ts scripts/verify-identity-collision-cli.mjs && npm run api:check && node scripts/check-skill-links.mjs",
     "verify:identity-collision-cli": "node scripts/verify-identity-collision-cli.mjs",
-    "verify:codebaseiq-windows-registry": "vite-node scripts/verify-codebaseiq-windows-registry.ts",
     "bench:evidence-products": "node scripts/evidence-product-contract.mjs",
     "bench:exploration": "node scripts/exploration-benchmark.mjs",
     "bench:exploration:codex": "node scripts/codex-exploration-trial.mjs",
@@ -397,7 +391,6 @@
     "docs:commands": "vite-node scripts/render-command-reference.ts --write",
     "prepublishOnly": "vite-node scripts/release-npm-guard.ts",
     "postinstall": "node dist/postinstall.js || true",
-    "publish:codebaseiq-windows": "vite-node scripts/publish-codebaseiq-windows.ts",
     "release:npm": "vite-node scripts/release-npm.ts",
     "release:npm:dry-run": "vite-node scripts/release-npm.ts --dry-run"
   },
@@ -420,7 +413,7 @@
   ],
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.15.0"
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
@@ -438,7 +431,6 @@
   "optionalDependencies": {
     "@sourcegraph/scip-typescript": "0.4.0",
     "scip-python-plus": "0.7.5",
-    "codebaseiq-windows": "0.1.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-c": "0.23.2",
     "tree-sitter-c-sharp": "0.23.1",