Deploy simready-assets run 20260928-ed4eb73 (GPU variant)

.gitattributes

@@ -33,3 +33,7 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+docker/hf-space/siglip2-model/model_repo/tokenizer/1/tokenizer/tokenizer.json filter=lfs diff=lfs merge=lfs -text
+docker/hf-space/wheels/deepsearch_api-0.1.0-py3-none-any.whl filter=lfs diff=lfs merge=lfs -text
+docker/hf-space/wheels/search_utils-0.1.0-py3-none-any.whl filter=lfs diff=lfs merge=lfs -text
+docker/hf-space/wheels/siglip2_triton_client-0.6.1-py3-none-any.whl filter=lfs diff=lfs merge=lfs -text

Dockerfile

@@ -0,0 +1,297 @@
+# deploy: 20260928-ed4eb73 (simready-assets)
+# GPU variant of the single-container MVP image for Hugging Face Spaces
+# (Docker SDK): everything docker/Dockerfile.hf-space has (OpenSearch + Neo4j
+# + Redis + deepsearch-api + asset-graph-service + nginx under supervisord),
+# plus a *local* siglip2-triton process instead of routing SigLIP2 embeddings
+# to NVCF — see docs/plans/siglip2-embedded-hf-space.md for the investigation
+# and decision behind this file. Meant to be deployed to an HF Space running
+# on a GPU hardware tier (T4 medium — see pipeline/hf_space.py's
+# request_space_hardware call for the gpu variant); docker/Dockerfile.hf-space
+# remains the free/cpu-basic, NVCF-backed variant — this is an additional
+# deploy target, not a replacement (`SIGLIP2_BACKEND=nvcf` is unaffected).
+#
+# Builds the Triton half of this image the same way
+# ../usdsearch/docker/Dockerfile.siglip2-triton does — FROM the bare, public
+# nvcr.io/nvidia/tritonserver image, model_repo/ COPYed in from
+# docker/hf-space/siglip2-model/ (vendored into *this* repo by
+# scripts/extract_siglip2_model.sh, since HF's remote builder can reach
+# neither ../usdsearch nor any private registry) — rather than FROM the
+# prepackaged nvcr.io/nvidia/usdsearch/siglip2-triton image an earlier
+# revision of this file used. Verified live why that prepackaged image was
+# dropped: its published 1.4.0 tag bakes **FP32** weights (vision 4.4 GB +
+# text 2.7 GB, inspected inside a pulled copy) — at this model's baked
+# `instance_group: 2`, that's ~14 GB of resident GPU weight memory alone,
+# and ~18 GB observed live in `nvidia-smi`, blowing past a T4's 16 GB VRAM.
+# ../usdsearch's *current* services/siglip2-triton/model_repo checkout is
+# already FP16-exported (vision 2.2 GB + text 1.4 GB — half the size, ~7 GB
+# at instance_group: 2, comfortably under 16 GB) but was never republished
+# under that NGC tag — vendoring this checkout's own model_repo directly
+# sidesteps waiting on a new publish. See
+# scripts/extract_siglip2_model.sh's own header for the full mechanism and
+# docs/plans/siglip2-embedded-hf-space.md's progress log for when this was
+# last refreshed.
+#
+# nvcr.io/nvidia/tritonserver itself (the base, not the prepackaged image)
+# is on the same *public* NGC catalog path already verified live this
+# project's other public pulls (opensearchproject/opensearch, neo4j) use —
+# no credentials needed, so Hugging Face's own remote builder can pull it.
+#
+# VERIFIED LIVE on a real GPU (RTX 4090, local — not a T4, but same
+# execution path): full build, `docker run --gpus all`, all 6 Triton models
+# READY, OpenSearch/Neo4j restore from S3, deepsearch-api + asset-graph-service
+# healthy through nginx. GPU memory settled at ~10-11 GB (tritonserver
+# ~10.3 GB + a smaller deepsearch-api CUDA-context allocation) — comfortably
+# under a T4's 16 GB, confirming the FP32->FP16 switch actually fixed the
+# budget problem, not just on paper. A real `/v3/deepsearch/search` call
+# came back with genuine `search_type: text_to_vector` /
+# `field: siglip2-embedding` hits (query "a red chair" correctly ranked
+# office-chair assets top) — the local siglip2-triton round trip is real,
+# not just "the process started". LLM query parsing
+# (`/v3/deepsearch/llm_parse/query`) and VLM validation
+# (`/v3/deepsearch/vlm_validate/search_result`) were also exercised live
+# against the already-deployed NVCF Qwen endpoint
+# (config/pipeline.env.srp-staging-controlled's LLM_ENDPOINT_BASE_URL) with
+# $NVCF_GENAI_RUN_KEY as USDSEARCH_LLM_API_KEY — both returned real model
+# output (a structured filter parse; a logprob-based
+# `P(Yes)=... from first-token log-probs.` verdict), confirming this
+# variant's NVCF-backed LLM/VLM path works the same as the NVCF/cpu-basic
+# variant's. See docs/plans/siglip2-embedded-hf-space.md's progress log for
+# the full session notes, including the earlier FP32 attempt this
+# superseded.
+
+ARG OPENSEARCH_VERSION=3.8.0
+ARG NEO4J_VERSION=5.23.0-community
+ARG TRITONSERVER_BASE_IMAGE=nvcr.io/nvidia/tritonserver:26.05-py3
+
+FROM opensearchproject/opensearch:${OPENSEARCH_VERSION} AS opensearch-src
+
+FROM neo4j:${NEO4J_VERSION} AS neo4j-src
+
+FROM ${TRITONSERVER_BASE_IMAGE}
+
+WORKDIR /workspace
+RUN mkdir -p /models
+
+# Vendored model repo (see header comment) — ensembles, the Python-backend
+# tokenizer/preprocessing models, and the two ONNX encoders' *config.pbtxt*
+# only. The encoders' actual weight files (~3.6 GB combined — the ONNX
+# externa-data blobs under each encoder's own 1/ subdirectory) are
+# deliberately NOT baked here: a real `deploy-space-gpu` attempt 403'd with
+# "Repository storage limit reached (Max: 1 GB)" — HF Space git repos have a
+# default 1 GB storage quota, well under what baking these in needs. Instead
+# they're restored from the artifact S3 bucket at container startup
+# (pipeline/hf_space_seed.py --component=siglip2-model, run by
+# supervisord-gpu.conf's [program:siglip2-triton] before tritonserver
+# itself execs) — the same "runtime restore, not baked" pattern this image
+# already uses for the OpenSearch index and Neo4j graph, just for a
+# corpus-independent static artifact instead of per-run data. Publish
+# weights to that S3 path with scripts/publish_siglip2_model_to_s3.sh
+# whenever scripts/extract_siglip2_model.sh refreshes the vendored copy.
+COPY docker/hf-space/siglip2-model/model_repo/ensemble_image_model /models/ensemble_image_model
+COPY docker/hf-space/siglip2-model/model_repo/ensemble_text_model /models/ensemble_text_model
+COPY docker/hf-space/siglip2-model/model_repo/image_preprocessing /models/image_preprocessing
+COPY docker/hf-space/siglip2-model/model_repo/siglip2_vision_encoder_onnx/config.pbtxt /models/siglip2_vision_encoder_onnx/config.pbtxt
+COPY docker/hf-space/siglip2-model/model_repo/siglip2_text_encoder_onnx/config.pbtxt /models/siglip2_text_encoder_onnx/config.pbtxt
+RUN mkdir -p /models/siglip2_vision_encoder_onnx/1 /models/siglip2_text_encoder_onnx/1
+COPY docker/hf-space/siglip2-model/model_repo/tokenizer /models/tokenizer
+
+# Python deps for the tokenizer + image_preprocessing Python-backend models —
+# resolved from pyproject.toml + uv.lock (the source of truth) at build time,
+# same as ../usdsearch/docker/Dockerfile.siglip2-triton itself does, so this
+# doesn't need a separately-maintained requirements.txt that can drift.
+COPY docker/hf-space/siglip2-model/pyproject.toml docker/hf-space/siglip2-model/uv.lock /workspace/
+RUN pip install --no-cache-dir uv \
+    && uv export --frozen --no-hashes --directory /workspace -o /workspace/requirements.txt \
+    && pip install --no-cache-dir -r /workspace/requirements.txt \
+    && rm /workspace/requirements.txt
+
+COPY docker/hf-space/siglip2-model/PACKAGE-LICENSES /PACKAGE-LICENSES
+
+# Same two size/vulnerability trims ../usdsearch/docker/Dockerfile.siglip2-triton
+# itself applies to this exact base image — carried over verbatim rather than
+# dropped, since they're cheap and free up real space (~1 GB+ for Nsight
+# Systems alone) on top of the FP16 savings above.
+RUN rm -rf /usr/local/cuda-13.2/NsightSystems-cli-2026.2.1
+
+USER root
+
+# Non-root runtime uid/gid 1000, same convention docker/Dockerfile.hf-space
+# uses for every data-writing process in that image (matches
+# opensearchproject/opensearch's own "opensearch" user, 1000:1000). This
+# base image is Ubuntu 24.04 ("noble") — not verified live whether uid 1000
+# is already taken by a user the NGC tritonserver image itself creates, so
+# this reuses it (rather than erroring) if it is: --chown=1000:1000 below
+# only cares that the numeric id resolves consistently, not which username
+# owns it.
+RUN if id -u 1000 >/dev/null 2>&1; then \
+        echo "uid 1000 already exists as $(getent passwd 1000 | cut -d: -f1) — reusing it"; \
+    else \
+        groupadd -g 1000 nvs && useradd -u 1000 -g 1000 -m -d /home/nvs -s /usr/sbin/nologin nvs; \
+    fi
+
+# AWS CLI v2 via its official self-contained installer, not apt/pip — same
+# reasoning as docker/Dockerfile.hf-space. python3.12-venv is requested
+# explicitly (Ubuntu splits the venv module out of the base python3.12
+# package on some images) since this base is noble rather than bookworm and
+# hasn't been checked for what's preinstalled.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        redis-server supervisor nginx curl unzip python3.12-venv openssl \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -f /etc/nginx/sites-enabled/default \
+    && curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
+    && unzip -q /tmp/awscliv2.zip -d /tmp \
+    && /tmp/aws/install \
+    && rm -rf /tmp/awscliv2.zip /tmp/aws
+
+# The app venv: same /app/.venv path docker/Dockerfile.hf-space and
+# docker/hf-space/supervisord*.conf both hardcode. Installed from the same
+# repacked usdsearch wheels + constraints.txt as the NVCF variant — see that
+# Dockerfile's header comment for how wheels/ is produced and refreshed.
+# Upstream's own docker/Dockerfile.usdsearch compiles these wheels in a
+# python:3.12-bookworm builder stage but runs them in a
+# nvcr.io/nvidia/base/ubuntu:noble-20260217 *runtime* stage — the same OS
+# family as this Triton image's own base — so installing them here follows
+# upstream's own production direction (older-glibc build -> newer-glibc
+# run), not a new cross-distro risk. Not yet verified live in this repo,
+# though (see header comment).
+COPY docker/hf-space/wheels/ /tmp/usdsearch-wheels/
+RUN python3.12 -m venv /app/.venv \
+    && /app/.venv/bin/pip install --no-cache-dir \
+        --find-links /tmp/usdsearch-wheels \
+        --constraint /tmp/usdsearch-wheels/constraints.txt \
+        /tmp/usdsearch-wheels/*.whl \
+    && rm -rf /tmp/usdsearch-wheels \
+    && chown -R 1000:1000 /app/.venv
+
+COPY --from=opensearch-src --chown=1000:1000 /usr/share/opensearch /usr/share/opensearch
+
+RUN /usr/share/opensearch/bin/opensearch-plugin remove opensearch-performance-analyzer
+
+# See docker/Dockerfile.hf-space's own (much longer) comment on this same
+# block for the full k-NN/faiss library-path story — copied verbatim here
+# since it's the identical opensearchproject/opensearch source image and the
+# identical cross-image-copy cause.
+ENV OPENSEARCH_HOME=/usr/share/opensearch \
+    OPENSEARCH_PATH_CONF=/usr/share/opensearch/config \
+    PATH="/usr/share/opensearch/bin:/app/.venv/bin:${PATH}" \
+    LD_LIBRARY_PATH=/usr/share/opensearch/plugins/opensearch-knn/lib \
+    discovery.type=single-node \
+    DISABLE_SECURITY_PLUGIN=true \
+    DISABLE_INSTALL_DEMO_CONFIG=true \
+    bootstrap.memory_lock=false \
+    OPENSEARCH_JAVA_OPTS="-Xms1g -Xmx1g -Djava.library.path=/usr/share/opensearch/plugins/opensearch-knn/lib"
+
+COPY --from=neo4j-src /opt/java/openjdk /opt/java/openjdk
+COPY --from=neo4j-src /var/lib/neo4j /var/lib/neo4j
+
+RUN mkdir -p /data /logs && chmod 777 /data /logs
+
+RUN cp /var/lib/neo4j/labs/apoc-*-core.jar /var/lib/neo4j/plugins/
+
+RUN { \
+    echo "dbms.security.auth_enabled=false"; \
+    echo "server.memory.heap.initial_size=1G"; \
+    echo "server.memory.heap.max_size=1G"; \
+    echo "server.memory.pagecache.size=512M"; \
+    } >> /var/lib/neo4j/conf/neo4j.conf
+
+ENV NEO4J_HOME=/var/lib/neo4j \
+    PATH="/var/lib/neo4j/bin:/opt/java/openjdk/bin:${PATH}"
+
+COPY docker/hf-space/logging.yml /logging.yml
+COPY docker/hf-space/search_fields.yaml /app/search_fields.yaml
+
+# The GPU-variant supervisord config — same six programs as
+# docker/hf-space/supervisord.conf plus [program:siglip2-triton], and
+# deepsearch-api's own command additionally waits on Triton's readiness
+# before execing uvicorn. See that file's header for the port-collision
+# reasoning (Triton's default HTTP port 8000 clashes with deepsearch-api's
+# own uvicorn; remapped to 8003 here).
+COPY docker/hf-space/supervisord-gpu.conf /etc/supervisor/conf.d/hf-space.conf
+
+COPY docker/hf-space/nginx.conf.template /etc/nginx/hf-space.conf.template
+
+COPY services/explorer/dist /usr/share/nginx/explorer
+
+COPY --chown=1000:1000 pipeline /app/hf-space-pipeline/pipeline
+
+ARG ARTIFACT_S3_URI
+ARG ARTIFACT_S3_REGION=us-east-2
+ARG CORPUS_NAME
+ENV ARTIFACT_S3_URI=${ARTIFACT_S3_URI} \
+    ARTIFACT_S3_REGION=${ARTIFACT_S3_REGION} \
+    CORPUS_NAME=${CORPUS_NAME}
+
+# ─── deepsearch-api config baked for this corpus/run ────────────────────────
+# Same as docker/Dockerfile.hf-space's equivalent block, minus every
+# NVCF-specific ARG/env (SIGLIP2_NVCF_ENDPOINT/FUNCTION_ID and their
+# downstream SIGLIP2_TRITON_SERVER_* values) — this variant never talks to
+# NVCF at all. SIGLIP2_TRITON_SERVER_URL instead points at the local
+# siglip2-triton process's gRPC port (8001, loopback-only — nginx remains
+# the sole externally-proxied port, same as every other backend process in
+# this image), with no SSL and no auth headers, since nothing external ever
+# reaches it.
+ARG ES_NAME
+ARG S3_STORAGE_BUCKET_NAME
+ARG S3_STORAGE_REGION_NAME=us-west-2
+ARG STORAGE_BACKEND_TYPE=s3
+# URL mapping (hf:// -> https://huggingface.co/.../blob/<rev>/), derived per
+# run from the corpus's own HF repos by pipeline/bake.py's
+# hf_url_mapping_rules() and passed in by bake (--build-arg) and
+# deploy-space (Space variables). Defaults to off: an s3:// corpus needs no
+# rewrite, and a storage_api build without these args would otherwise map
+# to some other dataset's prefix.
+ARG USDSEARCH_URL_MAPPING_MODE=off
+ARG USDSEARCH_URL_MAPPING_RULES=[]
+ENV STORAGE_BACKEND_TYPE=${STORAGE_BACKEND_TYPE} \
+    S3_STORAGE_BUCKET_NAME=${S3_STORAGE_BUCKET_NAME} \
+    S3_STORAGE_REGION_NAME=${S3_STORAGE_REGION_NAME} \
+    opensearch_host=http://localhost:9200 \
+    opensearch_index_name=${ES_NAME}-ver5.0 \
+    opensearch_image_cache_index_name=${ES_NAME}-ver4.0-image-cache \
+    opensearch_use_ssl=false \
+    REDIS_URL=redis://localhost:6379 \
+    DEEPSEARCH_BACKEND_ASSET_GRAPH_SERVICE_URL=http://127.0.0.1:8010 \
+    ASSET_GRAPH_SERVICE_ENDPOINT=http://127.0.0.1:8010 \
+    ENABLE_ACCESS_VERIFICATION=False \
+    STORAGE_REQUIRE_AUTH=False \
+    VERIFY_ASSET_EXISTENCE=False \
+    verify_access=false \
+    ASSERT_ADMIN_USER=false \
+    USDSEARCH_VISION_VALIDATION_ENABLED=false \
+    USDSEARCH_LLM_PARSING_ENABLED=false \
+    USDSEARCH_LLM_PARSING_FIELDS_FILEPATH=/app/search_fields.yaml \
+    OTEL_SDK_DISABLED=true \
+    BACKEND_CONFIG_STR="backend_name: es-sample" \
+    DEFAULT_CUTOFF_THRESHOLD=0 \
+    HYBRID_SEARCH_SCORING_CONFIG_VECTOR_FIELDS="{\"siglip2-embedding.embedding\":{\"enabled\":true,\"weight\":1,\"field_name\":\"siglip2-embedding.embedding\",\"dimension\":1536}}" \
+    USDSEARCH_URL_MAPPING_MODE=${USDSEARCH_URL_MAPPING_MODE} \
+    USDSEARCH_URL_MAPPING_RULES="${USDSEARCH_URL_MAPPING_RULES}" \
+    SIGLIP2_TRITON_SERVER_URL=localhost:8001 \
+    TRITON_SERVER_URL=localhost:8001 \
+    SIGLIP2_TRITON_SERVER_SSL=false \
+    PORT=7860
+
+ARG RUN_ID
+ARG CORPUS_SHA256
+ARG USDSEARCH_GIT_SHA
+LABEL org.opencontainers.image.title="usdsearch-hf-space-simready-central-gpu" \
+      org.opencontainers.image.description="Single-container MVP (OpenSearch+Neo4j+Redis+deepsearch-api, SigLIP2 via local Triton on GPU) for Hugging Face Spaces" \
+      com.nvidia.usdsearch.run_id="${RUN_ID}" \
+      com.nvidia.usdsearch.corpus_sha256="${CORPUS_SHA256}" \
+      com.nvidia.usdsearch.usdsearch_git_sha="${USDSEARCH_GIT_SHA}"
+
+# Longer start-period than docker/Dockerfile.hf-space's 10m: this variant
+# additionally waits on Triton loading ~3.6 GB of ONNX weights onto the GPU
+# before deepsearch-api's own uvicorn execs (see supervisord-gpu.conf).
+# Verified live against a small (1488-asset) dev corpus: Triton model load
+# took ~10s and the whole stack was healthy within ~20s total — 15m is
+# deliberately still a generous upper bound, not a tight one, since a larger
+# production corpus's OpenSearch bulk load / Neo4j offline load (the same
+# restore path docker/Dockerfile.hf-space already budgets 10m for) can take
+# much longer than this dev corpus did.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15m --retries=3 \
+    CMD curl -sf "http://localhost:${PORT}/health" || exit 1
+
+EXPOSE 7860
+ENTRYPOINT ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/conf.d/hf-space.conf"]

README.md

@@ -1,12 +1,21 @@
 ---
-title: Simready Central
-emoji: 🏢
-colorFrom: red
-colorTo: indigo
+title: SimReady Central USD Search
+emoji: 🔎
+colorFrom: green
+colorTo: blue
 sdk: docker
-pinned: false
-license: apache-2.0
-short_description: SimReady Central
+app_port: 7860
+hardware: t4-medium
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# SimReady Central USD Search
+
+SimReady Central USD Search — single-container demo (OpenSearch + Neo4j +
+Redis + deepsearch-api + asset-graph-service, SigLIP2 embeddings via a local
+siglip2-triton process — see docker/Dockerfile.hf-space-gpu). Runs on a GPU
+hardware tier (t4-medium), unlike the free-tier
+docker/Dockerfile.hf-space variant, which routes SigLIP2 to NVCF instead.
+The index itself is pulled from the artifact S3 bucket at container
+startup, not baked in. Deployed by
+github.com/NVIDIA-dev/simready-central-indexing-internal's
+`python -m pipeline.run_pipeline deploy-space-gpu`.

docker/hf-space/logging.yml

@@ -0,0 +1,80 @@
+# Copied verbatim from ../usdsearch's own logging.yml (root of that repo,
+# COPY'd to /logging.yml by its docker/Dockerfile.usdsearch) — the wheels in
+# docker/hf-space/wheels/ carry the app code but not this repo-level config
+# file, and packages/base-logging's get_logging_config() hardcodes
+# /logging.yml as its default path ($LOGGING_CONFIG overrides it), so it has
+# to be shipped here too or every service falls back to Python's bare
+# default logging config (harmless — base_logging.setup_logging() catches
+# the FileNotFoundError and just warns — but loses uvicorn's access-log
+# formatting and the per-logger level tuning below, e.g. quieting
+# opensearch/aiohttp.access to WARNING). Re-copy from ../usdsearch's
+# logging.yml if it changes upstream; nothing here is HF-Space-specific.
+#
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+version: 1
+disable_existing_loggers: False
+formatters:
+  default:
+    "()": uvicorn.logging.DefaultFormatter
+    format: '%(levelprefix)s %(asctime)s %(name)s - %(message)s'
+  access:
+    "()": uvicorn.logging.AccessFormatter
+    format: '%(levelprefix)s %(asctime)s %(name)s - %(client_addr)s - "%(request_line)s" %(status_code)s'
+handlers:
+  default:
+    formatter: default
+    class: logging.StreamHandler
+    stream: ext://sys.stderr
+  access:
+    formatter: access
+    class: logging.StreamHandler
+    stream: ext://sys.stdout
+loggers:
+  root:
+    level: INFO
+    handlers:
+      - default
+  idl.service:
+    level: WARNING
+  opensearch:
+    level: WARNING
+  aiohttp.access:
+    level: WARNING
+  uvicorn.error:
+    level: INFO
+    handlers:
+      - default
+    propagate: no
+  uvicorn.access:
+    level: INFO
+    handlers:
+      - access
+    propagate: no
+  search_backend_observability:
+    level: INFO
+    handlers:
+      - default
+    propagate: no
+  websockets.client:
+    level: INFO
+  opentelemetry.sdk.trace:
+    level: WARNING
+  deepsearch_api.request_duration_logger:
+    level: INFO
+    handlers:
+      - default
+    propagate: no

docker/hf-space/nginx.conf.template

@@ -0,0 +1,259 @@
+# Friendly external paths remapped to deepsearch-api's/asset-graph-service's
+# actual routes — same mapping as
+# usdsearch/helm/usdsearch/templates/api_gateway_config_map.yaml.
+# deepsearch-api listens on 127.0.0.1:8000, asset-graph-service on
+# 127.0.0.1:8010 (see docker/hf-space/supervisord.conf) — nginx is the sole
+# process bound to the externally proxied port, so it can front every route
+# with these rewrites plus CORS.
+#
+# The Explorer UI is served at `/` (root), not proxied to deepsearch-api at
+# all — served directly from the static bundle baked into this image at
+# build time (see the Dockerfile). Real difference from the multi-service
+# deployment, which proxies /ui and /static/ to a *separate*
+# deepsearch-explorer container: that bundle is just static files with
+# same-origin relative API calls (REACT_APP_API_URL baked empty) and its
+# own assets already use root-absolute paths (/static/js/..., /ds.png), so
+# serving it directly at `/` — where it already expects to live — needs no
+# extra process and no /ui prefix-stripping trick. The tradeoff: unlike the
+# old single catch-all proxy, deepsearch-api's own root-level routes
+# (/health, /docs, /redoc, /openapi.json, /metrics) now need to be listed
+# explicitly below, since the final `location /` falls through to the SPA
+# instead. Also sidesteps a real problem seen live: a Space deployed with
+# `/` returning a 301 (redirecting to `/ui`, the previous approach) broke —
+# root cause not fully confirmed, but consistent with Hugging Face's own
+# readiness check wanting a real 200 at `/`, not a redirect.
+#
+# __PORT__ is substituted with $PORT at container start (supervisord.conf),
+# matching the Spaces convention of an operator-configurable app_port.
+
+# >>> simready-central slim explorer (http) >>>
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# Included from nginx.conf's http{} (conf.d/*.conf) — an http-level directive is legal here.
+# ONE level under /tmp on purpose: nginx mkdir()s only the last path component (no mkdir -p), and
+# nothing in this image pre-creates a parent — /tmp/nginx-cache/slim-stats fails `nginx -t`. The
+# `levels=` subdirectories are different: nginx creates those itself on the first write.
+proxy_cache_path /tmp/slim-stats-cache levels=1 keys_zone=slim_stats_cache:2m max_size=256m inactive=1h use_temp_path=off;
+# Thumbnails (/images): ~1,500 JPEGs of 27-52 KB (~75 MB) fit well inside 1g. Lives in the container's
+# /tmp, so every deploy, restart or sleep starts it cold.
+proxy_cache_path /tmp/slim-images-cache levels=1:2 keys_zone=slim_images_cache:10m max_size=1g inactive=7d use_temp_path=off;
+# <<< simready-central slim explorer (http) <<<
+server {
+    listen __PORT__;
+
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+
+    location /search {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search(.*)$ /v2/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /search_hybrid {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search_hybrid(.*)$ /v3/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /vlm_validate/search_result {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/vlm_validate/search_result(.*)$ /v3/deepsearch/vlm_validate/search_result$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /llm_parse/ {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/llm_parse/(.*)$ /v3/deepsearch/llm_parse/$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /download {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/download(.*)$ /v3/download$1 break;
+        proxy_pass http://127.0.0.1:8000;
+        # Bundling an asset + all its dependencies can take longer than a single thumbnail.
+        proxy_read_timeout 300s;
+    }
+
+    location /images {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/images(.*)$ /v3/images$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /static/ {
+        alias /usr/share/nginx/explorer/static/;
+    }
+
+    # asset-graph-service routes (query-time graph reads only — see
+    # docker/Dockerfile.hf-space's header for why there's no graph-builder/
+    # asset_graph_generation worker in this image). Same rewrites as the
+    # real gateway config's asset_graph_service locations, just proxying to
+    # our own internal port instead of a separate service/Space.
+    location /asset_graph/usd/scene_summary/ {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/scene_summary/(.*)$ /asset_graph/usd/scene_summary/$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /asset_graph/usd/scene_summary {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/scene_summary(.*)$ /asset_graph/usd/scene_summary/$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /asset_graph/usd/prims {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/prims(.*)$ /asset_graph/usd/prims$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /dependency_graph {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/dependency_graph(.*)$ /dependency_graph$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    # deepsearch-api's own root-level routes — explicit now that `location /`
+    # below serves the Explorer SPA instead of proxying everything
+    # unmatched. /docs and /redoc are prefix matches, not exact: Swagger
+    # UI/ReDoc can request sub-resources under their own path.
+    location = /health { proxy_pass http://127.0.0.1:8000; }
+    location = /openapi.json { proxy_pass http://127.0.0.1:8000; }
+    location = /metrics { proxy_pass http://127.0.0.1:8000; }
+    location /docs { proxy_pass http://127.0.0.1:8000; }
+    location /redoc { proxy_pass http://127.0.0.1:8000; }
+
+    # The Explorer SPA (see header comment) at root: try_files serves any of
+    # its own literal files (index.html, ds.png, favicon.ico, manifest.json,
+    # ...) directly, and falls back to index.html for anything else
+    # (client-side routing) — anything actually meant for the API above was
+    # already matched by a more specific location before nginx gets here.
+    # >>> simready-central slim explorer >>>
+    # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+    # SPDX-License-Identifier: Apache-2.0
+    # services/explorer/dist is SimReady Central's search-only Explorer (repo simready-central,
+    # branch slim, slim/devspace/). The locations here are additive — exact matches, longer
+    # prefixes or a regex — and none of his locations is redefined. This block carries: /config.js,
+    # a no-cache /index.html, a 10-min
+    # proxy cache on /search/stats/usd_properties, a shared proxy cache on /images,
+    # /wikidata_hierarchy.json and JSON 404s for the routes this build does not have. What DOES
+    # reach beyond it: client_max_body_size 32m is server-wide (it applies to ALL his locations
+    # too); `= /images` takes the requests his `/images` prefix served before (same rewrite +
+    # proxy_pass, plus the cache); and an
+    # add_header inside one of our locations replaces his server-level headers for THOSE responses
+    # — /images and the stats cache re-declare his three CORS lines, /config.js and /index.html
+    # (same-origin UI files) do not. Applied by slim/devspace/deploy.sh.
+    client_max_body_size 32m;                         # query-image searches POST a base64 JPEG (nginx default 1 MB)
+    gzip_types text/css application/javascript application/json image/svg+xml;   # stock gzip covers text/html only
+
+    # Runtime index registry (blocking <script src="/config.js">). The CORPUS_NAME marker is
+    # rendered by the same sed that renders the PORT marker (supervisord.conf). download:false —
+    # /download/asset needs the Storage API this image does not run. seedDefaultScope:false —
+    # boot browses the corpus.
+    # railFilters ["profiles","license","category"] + railDefaults ["profiles","license"]: rail = Profiles + License on,
+    # the Wikidata Category tree an OPT-IN row in Preferences › Select Filters (owner, 2026-09-21); the parser catalog
+    # docker/hf-space/search_fields.yaml stays curated to profile + license. propertyAliases: this API stores the
+    # Wikidata code as semantic:wikidata_qcode:params:semanticData (wikidata_qcode= matches nothing here), so the
+    # Explorer translates its canonical name at the wire and renames the stats key back on arrival.
+    # propertyFilterCombine "and": the API ORs every filter_by_properties_include_any token globally, so with License
+    # pre-checked a Category pick would change nothing — a property with ONE checked value rides filter_by_properties
+    # (AND) instead; a multi-valued one (the tree's qcodes) stays the OR bucket. Measured: license 1488, one qcode 124,
+    # both in include_any 1488, license AND qcode 124.
+    location = /config.js {
+        default_type application/javascript;
+        add_header Cache-Control "no-cache, must-revalidate" always;
+        return 200 '(function(){var c="__CORPUS_NAME__";if(!c||c.indexOf("__")===0){c="usdsearch-dev";}window.__SERVER_MAPPING__={"usdsearch-dev":{"name":c+" (Hugging Face)","apiUrl":"","embedding_config":{"field_name":"siglip2-embedding.embedding","dimension":1536},"features":{"download":false,"s3UrlRemap":false,"seedDefaultScope":false,"railFilters":["profiles","license","category"],"railDefaults":["profiles","license"],"propertyAliases":{"wikidata_qcode":"semantic:wikidata_qcode:params:semanticData"},"propertyFilterCombine":"and","defaultFilters":{"simready_metadata_asset_license":["CC-BY-4.0"]}}}};window.__DEFAULT_SERVER__="usdsearch-dev";})();';
+    }
+    # index.html must always revalidate (covers the try_files fallback too): a swap or rollback
+    # must not leave a browser holding an index.html that names deleted chunks.
+    location = /index.html {
+        root /usr/share/nginx/explorer;
+        add_header Cache-Control "no-cache" always;
+    }
+
+    # Property inventory (rail facets + parser grounding): multi-MB aggregation — cached 10 min.
+    location = /search/stats/usd_properties {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search(.*)$ /v2/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_ignore_headers Cache-Control Expires;
+        proxy_cache slim_stats_cache;
+        proxy_cache_key "$request_uri";
+        proxy_cache_valid 200 10m;
+        proxy_cache_lock on;
+        proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
+        proxy_read_timeout 120s;
+        add_header X-Cache-Status $upstream_cache_status always;
+        # add_header above drops his server-level headers — re-declared as in his template
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Thumbnails: his `location /images` rewrite + proxy_pass (this exact match wins over his prefix)
+    # plus a SHARED cache — every cold /images costs the API ~150 CPU-ms on its one event loop.
+    # Keyed by the full URI (image_key, or asset_url + img_offset); the API's `Cache-Control: private`
+    # is ignored on purpose. Valid ONLY while the image runs with STORAGE_REQUIRE_AUTH=False (deploy.sh
+    # refuses a hub Dockerfile without it): with per-user storage auth, add
+    # `proxy_no_cache $arg_asset_url; proxy_cache_bypass $arg_asset_url;` so the access-checked
+    # asset_url path is never shared (image_key is content-addressed and unchecked). add_header here
+    # drops his server-level headers, so his three CORS lines are re-declared; proxy_hide_header
+    # keeps a chained nginx (check.sh --replica) to its own X-Cache-Status.
+    location = /images {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/images(.*)$ /v3/images$1 break;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_cache slim_images_cache;
+        proxy_cache_key "$request_uri";
+        proxy_ignore_headers Cache-Control Expires;
+        proxy_hide_header X-Cache-Status;
+        proxy_cache_valid 200 7d;
+        proxy_cache_lock on;
+        proxy_cache_lock_timeout 15s;
+        proxy_cache_use_stale error timeout updating;
+        add_header X-Cache-Status $upstream_cache_status always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Our 404s are JSON like the API's own (a bare `return 404;` would be nginx's text/html error
+    # page): reachable only from the locations below, so nothing of his changes.
+    location @slim_not_found {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # Per-corpus Wikidata hierarchy — the Category tree's ancestry: the bundle ships the corpus's file at its root
+    # (slim/scripts/build-explorer-public.sh, since 2026-09-21); absent → a real 404 and the Explorer falls back.
+    location = /wikidata_hierarchy.json {
+        root /usr/share/nginx/explorer;
+        try_files $uri @slim_not_found;
+    }
+    # The streaming validate shim does not exist here: a real 404 pins per-image validation through
+    # /vlm_validate/search_result (longer prefix, still his); a 502 or index.html would disable it.
+    location /vlm_validate/ {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # Central's per-user surface is absent in this build: hard 404s, never the SPA's index.html.
+    location ~ ^/(auth|packs|prefs|chats|created_assets|concept_images|meshy_quota|info|process|folder_hierarchy\.json|api/create-chat|api/cad2simready)(/|$) {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # <<< simready-central slim explorer <<<
+    location / {
+        root /usr/share/nginx/explorer;
+        try_files $uri $uri/ /index.html;
+    }
+}

docker/hf-space/search_fields.yaml

@@ -0,0 +1,599 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Trimmed to the two fields the SimReady Central slim Explorer's rail actually
+# exposes (features.railFilters in docker/hf-space/nginx.conf.template's
+# /config.js: Profiles + License) — see main@8c555a9dc920 ("Serve SimReady
+# Central's slim Explorer at / — Profiles + License filtering..."), which
+# replaced the full auto-derived catalog below with exactly these two for the
+# same reason: deepsearch_api.llm_parse.fields loads this file for BOTH the
+# LLM query parser and the catalog-driven rail facets, so a wider catalog here
+# widens the parser AND the rail. `label:` on each field is preserved from
+# that commit for the same reason (Explorer rail display name).
+#
+# `simready_metadata_mass`/`simready_metadata_rigid_body_count` added
+# parser-only (no `label:`) — neither is in nginx.conf.template's
+# railFilters allow-list, so they're invisible to the rail regardless of
+# being registered here; only the LLM query parser picks them up. Verified
+# live via /search/stats/usd_properties: mass is numeric (kg), continuous
+# (1407 distinct values across 1484 of 1488 assets, range 0.001-217652.74,
+# median ~1.77); rigid_body_count is numeric (integer), 37 distinct values
+# across 1484 of 1488 assets, range 1-106, most common value 1 (904
+# assets).
+#
+# The rest of the auto-generated catalog (40 fields total; regenerate via
+# whatever produced this file's original derivation from the corpus's USD
+# properties) is kept below, commented out, in case LLM-query-parsing over
+# the full property set is wanted again later — see the header this replaces
+# for how to regenerate it.
+fields:
+- name: simready_metadata_validation_profile
+  type: string
+  operators:
+  - eq
+  - contains
+  description: 'Auto-generated from USD property ''simready_metadata_validation__profile'' (1488 assets).
+    Common values: ''Robotics-Prop'' (1484), ''Prop-Robotics-Physx'' (4).'
+  examples:
+  - '"simready_metadata_validation_profile is Robotics-Prop" -> simready_metadata_validation_profile eq
+    "Robotics-Prop"'
+  label: Profiles
+  map:
+    kind: property_match
+    property: simready_metadata_validation__profile
+- name: simready_metadata_asset_license
+  type: string
+  operators:
+  - eq
+  - contains
+  description: 'Auto-generated from USD property ''simready_metadata_asset_license'' (1488 assets). Common
+    values: ''CC-BY-4.0''.'
+  examples:
+  - '"simready_metadata_asset_license is CC-BY-4.0" -> simready_metadata_asset_license eq "CC-BY-4.0"'
+  label: License
+  map:
+    kind: property_match
+    property: simready_metadata_asset_license
+- name: simready_metadata_mass
+  type: number
+  operators:
+  - gt
+  - gte
+  - lt
+  - lte
+  - eq
+  description: 'Auto-generated from USD property ''simready_metadata_mass'' (1484 of 1488 assets). Mass
+    in kilograms. Range 0.001-217652.74, median ~1.77.'
+  examples:
+  - '"simready_metadata_mass over 10" -> simready_metadata_mass gt 10'
+  map:
+    kind: property_numeric
+    property: simready_metadata_mass
+- name: simready_metadata_rigid_body_count
+  type: number
+  operators:
+  - gt
+  - gte
+  - lt
+  - lte
+  - eq
+  description: 'Auto-generated from USD property ''simready_metadata_rigid_body_count'' (1484 of 1488
+    assets). Number of rigid bodies in the physics simulation. Integer, range 1-106, most common value 1
+    (904 assets).'
+  examples:
+  - '"simready_metadata_rigid_body_count over 5" -> simready_metadata_rigid_body_count gt 5'
+  map:
+    kind: property_numeric
+    property: simready_metadata_rigid_body_count
+
+# --- auto-derived fields below, commented out (see header) ---
+# - name: polygon_count_436
+#   type: number
+#   operators:
+#   - gt
+#   - gte
+#   - lt
+#   - lte
+#   - eq
+#   description: Auto-generated from USD property '__polygon_count' (1492 assets).
+#   examples:
+#   - '"polygon_count_436 over 10" -> polygon_count_436 gt 10'
+#   map:
+#     kind: property_numeric
+#     property: __polygon_count
+# - name: simready_metadata_variants_physics_mu_jo_co_activate_option
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__MuJoCo__activateOption''
+#     (1492 assets). Common values: ''Enabled''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_mu_jo_co_activate_option is Enabled" -> simready_metadata_variants_physics_mu_jo_co_activate_option
+#     eq "Enabled"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__MuJoCo__activateOption
+# - name: simready_metadata_variants_physics_mu_jo_co_prim
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__MuJoCo__prim''
+#     (1492 assets). Common values: ''/RootNode''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_mu_jo_co_prim is /RootNode" -> simready_metadata_variants_physics_mu_jo_co_prim
+#     eq "/RootNode"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__MuJoCo__prim
+# - name: simready_metadata_variants_physics_mu_jo_co_variant_set_name
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__MuJoCo__variantSetName''
+#     (1492 assets). Common values: ''MuJoCo''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_mu_jo_co_variant_set_name is MuJoCo" -> simready_metadata_variants_physics_mu_jo_co_variant_set_name
+#     eq "MuJoCo"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__MuJoCo__variantSetName
+# - name: simready_metadata_variants_physics_newton_activate_option
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__Newton__activateOption''
+#     (1492 assets). Common values: ''Enabled''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_newton_activate_option is Enabled" -> simready_metadata_variants_physics_newton_activate_option
+#     eq "Enabled"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__Newton__activateOption
+# - name: simready_metadata_variants_physics_newton_prim
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__Newton__prim''
+#     (1492 assets). Common values: ''/RootNode''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_newton_prim is /RootNode" -> simready_metadata_variants_physics_newton_prim
+#     eq "/RootNode"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__Newton__prim
+# - name: simready_metadata_variants_physics_newton_variant_set_name
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__Newton__variantSetName''
+#     (1492 assets). Common values: ''Newton''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_newton_variant_set_name is Newton" -> simready_metadata_variants_physics_newton_variant_set_name
+#     eq "Newton"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__Newton__variantSetName
+# - name: simready_metadata_variants_physics_phys_x_activate_option
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__PhysX__activateOption''
+#     (1492 assets). Common values: ''Enabled''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_phys_x_activate_option is Enabled" -> simready_metadata_variants_physics_phys_x_activate_option
+#     eq "Enabled"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__PhysX__activateOption
+# - name: simready_metadata_variants_physics_phys_x_prim
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__PhysX__prim''
+#     (1492 assets). Common values: ''/RootNode''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_phys_x_prim is /RootNode" -> simready_metadata_variants_physics_phys_x_prim
+#     eq "/RootNode"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__PhysX__prim
+# - name: simready_metadata_variants_physics_phys_x_variant_set_name
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_Variants__Physics__PhysX__variantSetName''
+#     (1492 assets). Common values: ''PhysX''.'
+#   examples:
+#   - '"simready_metadata_variants_physics_phys_x_variant_set_name is PhysX" -> simready_metadata_variants_physics_phys_x_variant_set_name
+#     eq "PhysX"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_Variants__Physics__PhysX__variantSetName
+# - name: simready_metadata_asset_type
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_asset_type'' (1492 assets). Common
+#     values: ''prop''.'
+#   examples:
+#   - '"simready_metadata_asset_type is prop" -> simready_metadata_asset_type eq "prop"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_asset_type
+# - name: simready_metadata_validation_profile_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__profile_version'' (1492
+#     assets). Common values: ''3.1.0'', ''1.0.0'', ''3.2.0''.'
+#   examples:
+#   - '"simready_metadata_validation_profile_version is 3.1.0" -> simready_metadata_validation_profile_version
+#     eq "3.1.0"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__profile_version
+# - name: simready_metadata_author
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_author'' (1488 assets). Common values:
+#     ''NVIDIA''.'
+#   examples:
+#   - '"simready_metadata_author is NVIDIA" -> simready_metadata_author eq "NVIDIA"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_author
+# - name: simready_metadata_category
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_category'' (1488 assets). Common
+#     values: ''prop'', ''candle'', ''book'', ''glasses''.'
+#   examples:
+#   - '"simready_metadata_category is prop" -> simready_metadata_category eq "prop"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_category
+# - name: simready_metadata_mass
+#   type: number
+#   operators:
+#   - gt
+#   - gte
+#   - lt
+#   - lte
+#   - eq
+#   description: Auto-generated from USD property 'simready_metadata_mass' (1488 assets).
+#   examples:
+#   - '"simready_metadata_mass over 10" -> simready_metadata_mass gt 10'
+#   map:
+#     kind: property_numeric
+#     property: simready_metadata_mass
+# - name: simready_metadata_rigid_body_count
+#   type: number
+#   operators:
+#   - gt
+#   - gte
+#   - lt
+#   - lte
+#   - eq
+#   description: Auto-generated from USD property 'simready_metadata_rigid_body_count' (1488 assets).
+#   examples:
+#   - '"simready_metadata_rigid_body_count over 10" -> simready_metadata_rigid_body_count gt 10'
+#   map:
+#     kind: property_numeric
+#     property: simready_metadata_rigid_body_count
+# - name: semantic_wikidata_class_params_semantic_type
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''semantic:wikidata_class:params:semanticType'' (1264
+#     assets). Common values: ''wikidata_class''.'
+#   examples:
+#   - '"semantic_wikidata_class_params_semantic_type is wikidata_class" -> semantic_wikidata_class_params_semantic_type
+#     eq "wikidata_class"'
+#   map:
+#     kind: property_match
+#     property: semantic:wikidata_class:params:semanticType
+# - name: semantic_wikidata_qcode_params_semantic_type
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''semantic:wikidata_qcode:params:semanticType'' (1264
+#     assets). Common values: ''wikidata_qcode''.'
+#   examples:
+#   - '"semantic_wikidata_qcode_params_semantic_type is wikidata_qcode" -> semantic_wikidata_qcode_params_semantic_type
+#     eq "wikidata_qcode"'
+#   map:
+#     kind: property_match
+#     property: semantic:wikidata_qcode:params:semanticType
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__dependencies''
+#     (1000 assets). Common values: "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_dependencies is [{''FET_000_STANDARD'':
+#     {''version'': ''0.1.0''}}]" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_dependencies
+#     eq "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_optional_requirements
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__optional
+#     requirements'' (1000 assets). Common values: "[''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.008'']",
+#     "[''com.nvidia.simready.RV.008'', ''com.nvidia.simready.RV.010'']".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_optional_requirements
+#     is [''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.008'']" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_optional_requirements
+#     eq "[''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.008'']"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__optional requirements
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__passed
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__version''
+#     (1000 assets). Common values: ''0.1.0''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_version is 0.1.0" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_mujoco_version
+#     eq "0.1.0"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_MUJOCO__version
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__dependencies''
+#     (1000 assets). Common values: "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_dependencies is [{''FET_000_STANDARD'':
+#     {''version'': ''0.1.0''}}]" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_dependencies
+#     eq "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_optional_requirements
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__optional
+#     requirements'' (1000 assets). Common values: "[''com.nvidia.simready.RV.005'', ''com.nvidia.simready.RV.010'']",
+#     "[''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.005'']".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_optional_requirements
+#     is [''com.nvidia.simready.RV.005'', ''com.nvidia.simready.RV.010'']" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_optional_requirements
+#     eq "[''com.nvidia.simready.RV.005'', ''com.nvidia.simready.RV.010'']"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__optional requirements
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__passed
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__version''
+#     (1000 assets). Common values: ''0.1.0''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_version is 0.1.0" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_newton_version
+#     eq "0.1.0"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_NEWTON__version
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__dependencies''
+#     (1000 assets). Common values: "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_dependencies is [{''FET_000_STANDARD'':
+#     {''version'': ''0.1.0''}}]" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_dependencies
+#     eq "[{''FET_000_STANDARD'': {''version'': ''0.1.0''}}]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_optional_requirements
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__optional
+#     requirements'' (1000 assets). Common values: "[''com.nvidia.simready.RV.001'', ''com.nvidia.simready.RV.002'',
+#     ''com.nvidia.simready.RV.010'']", "[''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.001'',
+#     ''com.nvidia.simready.RV.002'']", "[''com.nvidia.simready.RV.002'', ''com.nvidia.simready.RV.001'',
+#     ''com.nvidia.simready.RV.010'']", "[''com.nvidia.simready.RV.001'', ''com.nvidia.simready.RV.010'',
+#     ''com.nvidia.simready.RV.002'']", "[''com.nvidia.simready.RV.002'', ''com.nvidia.simready.RV.010'',
+#     ''com.nvidia.simready.RV.001'']", "[''com.nvidia.simready.RV.010'', ''com.nvidia.simready.RV.002'',
+#     ''com.nvidia.simready.RV.001'']".'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_optional_requirements is
+#     [''com.nvidia.simready.RV.001'', ''com.nvidia.simready.RV.002'', ''com.nvidia.simready.RV.010'']"
+#     -> simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_optional_requirements
+#     eq "[''com.nvidia.simready.RV.001'', ''com.nvidia.simready.RV.002'', ''com.nvidia.simready.RV.010'']"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__optional requirements
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__passed
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__version''
+#     (1000 assets). Common values: ''0.1.0''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_version is 0.1.0" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_physx_version
+#     eq "0.1.0"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_PHYSX__version
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__dependencies''
+#     (1000 assets). Common values: ''[]''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_dependencies is []"
+#     -> simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_dependencies eq "[]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__passed
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__version''
+#     (1000 assets). Common values: ''0.1.0''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_version is 0.1.0" ->
+#     simready_metadata_validation_validated_features_2026_08_18_fet_000_standard_version eq "0.1.0"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_000_STANDARD__version
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__dependencies''
+#     (1000 assets). Common values: ''[]''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_dependencies is []"
+#     -> simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_dependencies eq "[]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__passed
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_version
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__version''
+#     (1000 assets). Common values: ''1.0.1''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_version is 1.0.1" ->
+#     simready_metadata_validation_validated_features_2026_08_18_fet_001_standard_version eq "1.0.1"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_001_STANDARD__version
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_dependencies
+#   type: string
+#   operators:
+#   - eq
+#   - contains
+#   description: 'Auto-generated from USD property ''simready_metadata_validation__validated_features__2026-08-18__FET_003_MUJOCO__dependencies''
+#     (1000 assets). Common values: ''[]''.'
+#   examples:
+#   - '"simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_dependencies is []" ->
+#     simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_dependencies eq "[]"'
+#   map:
+#     kind: property_match
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_003_MUJOCO__dependencies
+# - name: simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_passed
+#   type: boolean
+#   operators:
+#   - eq
+#   - exists
+#   description: Auto-generated from USD property 'simready_metadata_validation__validated_features__2026-08-18__FET_003_MUJOCO__passed'
+#     (1000 assets).
+#   examples:
+#   - '"with simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_passed" -> simready_metadata_validation_validated_features_2026_08_18_fet_003_mujoco_passed
+#     eq true'
+#   map:
+#     kind: property_exists
+#     property: simready_metadata_validation__validated_features__2026-08-18__FET_003_MUJOCO__passed
+#

docker/hf-space/siglip2-model/PACKAGE-LICENSES/siglip2-giant-opt-patch16-384.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

docker/hf-space/siglip2-model/SOURCE.txt

@@ -0,0 +1,4 @@
+# Generated by scripts/extract_siglip2_model.sh — do not hand-edit.
+source_repo=../usdsearch
+source_commit=555bee64e6f4d12995ab49313d8a1487cae97c84
+extracted_at=2026-09-23T08:29:31Z

docker/hf-space/siglip2-model/model_repo/ensemble_image_model/config.pbtxt

@@ -0,0 +1,48 @@
+name: "ensemble_image_model"
+platform: "ensemble"
+max_batch_size: 32
+
+input [
+  {
+    name: "raw_image"
+    data_type: TYPE_UINT8
+    dims: [-1, -1, 3]
+  }
+]
+
+output [
+  {
+    name: "image_embeds"
+    data_type: TYPE_FP32
+    dims: [1536]
+  }
+]
+
+ensemble_scheduling {
+  step [
+    {
+      model_name: "image_preprocessing"
+      model_version: -1
+      input_map {
+        key: "raw_image"
+        value: "raw_image"
+      }
+      output_map {
+        key: "pixel_values"
+        value: "pixel_values"
+      }
+    },
+    {
+      model_name: "siglip2_vision_encoder_onnx"
+      model_version: -1
+      input_map {
+        key: "pixel_values"
+        value: "pixel_values"
+      }
+      output_map {
+        key: "image_embeds"
+        value: "image_embeds"
+      }
+    }
+  ]
+}

docker/hf-space/siglip2-model/model_repo/ensemble_text_model/config.pbtxt

@@ -0,0 +1,48 @@
+name: "ensemble_text_model"
+platform: "ensemble"
+max_batch_size: 32
+
+input [
+  {
+    name: "text"
+    data_type: TYPE_STRING
+    dims: [1]
+  }
+]
+
+output [
+  {
+    name: "embeddings"
+    data_type: TYPE_FP32
+    dims: [1536]
+  }
+]
+
+ensemble_scheduling {
+  step [
+    {
+      model_name: "tokenizer"
+      model_version: -1
+      input_map {
+        key: "text"
+        value: "text"
+      }
+      output_map {
+        key: "input_ids"
+        value: "input_ids"
+      }
+    },
+    {
+      model_name: "siglip2_text_encoder_onnx"
+      model_version: -1
+      input_map {
+        key: "input_ids"
+        value: "input_ids"
+      }
+      output_map {
+        key: "embeddings"
+        value: "embeddings"
+      }
+    }
+  ]
+}

docker/hf-space/siglip2-model/model_repo/image_preprocessing/1/model.py

@@ -0,0 +1,101 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# standard modules
+import json
+import os
+from pathlib import Path
+
+# third party modules
+import numpy as np
+import triton_python_backend_utils as pb_utils
+from PIL import Image
+
+# PIL resampling enum values
+_RESAMPLE_MAP = {
+    0: Image.NEAREST,
+    1: Image.LANCZOS,
+    2: Image.BILINEAR,
+    3: Image.BICUBIC,
+}
+
+
+class TritonPythonModel:
+    """Image preprocessor using PIL resize + vectorized numpy rescale/normalize.
+
+    Uses direct PIL + numpy operations to avoid torch dependency in the
+    Triton server container (CPU-only torch conflicts with ONNX Runtime CUDA).
+    """
+
+    def initialize(self, args: dict) -> None:
+        model_config = json.loads(args["model_config"])
+
+        current_dir = Path(__file__).parent
+        preprocessor_config_path = os.path.join(current_dir, "preprocessor_config", "preprocessor_config.json")
+        with open(preprocessor_config_path, "r") as f:
+            config = json.load(f)
+
+        self.height = config["size"]["height"]
+        self.width = config["size"]["width"]
+        self.rescale_factor = np.float32(config.get("rescale_factor", 1.0 / 255.0))
+        self.image_mean = np.array(config.get("image_mean", [0.5, 0.5, 0.5]), dtype=np.float32).reshape(3, 1, 1)
+        self.image_std = np.array(config.get("image_std", [0.5, 0.5, 0.5]), dtype=np.float32).reshape(3, 1, 1)
+        self.do_resize = config.get("do_resize", True)
+        self.do_rescale = config.get("do_rescale", True)
+        self.do_normalize = config.get("do_normalize", True)
+        self.resample = _RESAMPLE_MAP.get(config.get("resample", 2), Image.BILINEAR)
+
+        data_type = model_config["output"][0]["data_type"]
+        self.output_dtype = pb_utils.triton_string_to_numpy(data_type)
+
+    def _process_single(self, img_hwc: np.ndarray) -> np.ndarray:
+        """Process a single HWC uint8 image to CHW float32."""
+        if self.do_resize:
+            pil_img = Image.fromarray(img_hwc)
+            pil_img = pil_img.resize((self.width, self.height), self.resample)
+            img_hwc = np.asarray(pil_img)
+
+        # HWC -> CHW
+        img = img_hwc.transpose(2, 0, 1).astype(np.float32)
+
+        if self.do_rescale:
+            img *= self.rescale_factor
+
+        if self.do_normalize:
+            img = (img - self.image_mean) / self.image_std
+
+        return img
+
+    def execute(self, requests: list) -> list:
+        responses = []
+        for request in requests:
+            image_tensor = pb_utils.get_input_tensor_by_name(request, "raw_image")
+            images = image_tensor.as_numpy()
+
+            batch_size = images.shape[0]
+            pixel_values = np.empty((batch_size, 3, self.height, self.width), dtype=self.output_dtype)
+
+            for i in range(batch_size):
+                pixel_values[i] = self._process_single(images[i])
+
+            inference_response = pb_utils.InferenceResponse(
+                output_tensors=[pb_utils.Tensor("pixel_values", pixel_values)]
+            )
+            responses.append(inference_response)
+
+        return responses
+
+    def finalize(self) -> None:
+        print("Cleaning up image preprocessor...")

docker/hf-space/siglip2-model/model_repo/image_preprocessing/1/preprocessor_config/preprocessor_config.json

@@ -0,0 +1,24 @@
+{
+  "do_convert_rgb": null,
+  "do_normalize": true,
+  "do_rescale": true,
+  "do_resize": true,
+  "image_mean": [
+    0.5,
+    0.5,
+    0.5
+  ],
+  "image_processor_type": "SiglipImageProcessor",
+  "image_std": [
+    0.5,
+    0.5,
+    0.5
+  ],
+  "processor_class": "SiglipProcessor",
+  "resample": 2,
+  "rescale_factor": 0.00392156862745098,
+  "size": {
+    "height": 384,
+    "width": 384
+  }
+}

docker/hf-space/siglip2-model/model_repo/image_preprocessing/config.pbtxt

@@ -0,0 +1,31 @@
+name: "image_preprocessing"
+backend: "python"
+max_batch_size: 32
+
+input [
+  {
+    name: "raw_image"
+    data_type: TYPE_UINT8
+    dims: [-1, -1, 3]
+  }
+]
+
+output [
+  {
+    name: "pixel_values"
+    data_type: TYPE_FP32
+    dims: [3, 384, 384]
+  }
+]
+
+dynamic_batching {
+  preferred_batch_size: [4, 8, 16]
+  max_queue_delay_microseconds: 50000
+}
+
+instance_group [
+  {
+    count: 4
+    kind: KIND_CPU
+  }
+]

docker/hf-space/siglip2-model/model_repo/siglip2_text_encoder_onnx/config.pbtxt

@@ -0,0 +1,67 @@
+name: "siglip2_text_encoder_onnx"
+backend: "onnxruntime"
+max_batch_size: 32
+
+input [
+  {
+    name: "input_ids"
+    data_type: TYPE_INT64
+    dims: [64]
+  }
+]
+
+output [
+  {
+    name: "embeddings"
+    data_type: TYPE_FP32
+    dims: [1536]
+  }
+]
+
+dynamic_batching {
+  preferred_batch_size: [8, 16, 32]
+  max_queue_delay_microseconds: 50000
+}
+
+instance_group [
+  {
+    count: 2
+    kind: KIND_AUTO
+  }
+]
+
+parameters {
+  key: "execution_accelerators"
+  value: { string_value: "cuda:0" }
+}
+parameters {
+  key: "enable_mem_pattern"
+  value: { string_value: "1" }
+}
+parameters {
+  key: "enable_mem_reuse"
+  value: { string_value: "1" }
+}
+
+optimization {
+  graph {
+    level: 0
+  }
+}
+
+model_warmup [
+  {
+    name: "warmup_batch_1"
+    batch_size: 1
+    inputs [
+      {
+        key: "input_ids"
+        value: {
+          data_type: TYPE_INT64
+          dims: [64]
+          zero_data: true
+        }
+      }
+    ]
+  }
+]

docker/hf-space/siglip2-model/model_repo/siglip2_vision_encoder_onnx/config.pbtxt

@@ -0,0 +1,65 @@
+name: "siglip2_vision_encoder_onnx"
+backend: "onnxruntime"
+max_batch_size: 32
+
+input [
+  {
+    name: "pixel_values"
+    data_type: TYPE_FP32
+    dims: [3, 384, 384]
+  }
+]
+
+output [
+  {
+    name: "image_embeds"
+    data_type: TYPE_FP32
+    dims: [1536]
+  }
+]
+
+dynamic_batching {
+  preferred_batch_size: [4, 8, 16]
+  max_queue_delay_microseconds: 50000
+}
+
+instance_group [
+  {
+    count: 2
+    kind: KIND_AUTO
+  }
+]
+
+parameters {
+  key: "execution_accelerators"
+  value: { string_value: "cuda:0" }
+}
+parameters {
+  key: "enable_mem_pattern"
+  value: { string_value: "1" }
+}
+parameters {
+  key: "enable_mem_reuse"
+  value: { string_value: "1" }
+}
+
+optimization {
+  graph {
+    level: 0
+  }
+}
+
+model_warmup [
+  {
+    name: "warmup_batch_1"
+    batch_size: 1
+    inputs {
+      key: "pixel_values"
+      value: {
+        data_type: TYPE_FP32
+        dims: [3, 384, 384]
+        zero_data: true
+      }
+    }
+  }
+]

docker/hf-space/siglip2-model/model_repo/tokenizer/1/model.py

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# standard modules
+import json
+from pathlib import Path
+
+# third party modules
+import numpy as np
+import triton_python_backend_utils as pb_utils
+from tokenizers import Tokenizer
+
+
+class TritonPythonModel:
+    """Triton Python backend model for SigLIP2 tokenizer."""
+
+    def initialize(self, args):
+        model_config = json.loads(args["model_config"])
+
+        current_dir = Path(__file__).parent
+        tokenizer_file = current_dir / "tokenizer" / "tokenizer.json"
+
+        # Load tokenizer directly from tokenizer.json using tokenizers library
+        self.tokenizer = Tokenizer.from_file(str(tokenizer_file))
+
+        # Enable padding and truncation
+        self.tokenizer.enable_padding(length=64, pad_id=0, pad_token="<pad>")
+        self.tokenizer.enable_truncation(max_length=64)
+
+        # Resolve output dtypes from model config
+        self.output_dtypes = {}
+        for output_config in model_config["output"]:
+            name = output_config["name"]
+            data_type = output_config["data_type"]
+            self.output_dtypes[name] = pb_utils.triton_string_to_numpy(data_type)
+
+    def execute(self, requests: list) -> list:
+        responses = []
+        for request in requests:
+            # Get input text
+            text_tensor = pb_utils.get_input_tensor_by_name(request, "text")
+            text_data = text_tensor.as_numpy()
+
+            # Decode bytes to strings if necessary
+            if text_data.dtype == np.object_:
+                texts = [t.decode("utf-8") if isinstance(t, bytes) else t for t in text_data.flatten()]
+            else:
+                texts = text_data.flatten().tolist()
+
+            # Tokenize using tokenizers library
+            encoded = self.tokenizer.encode_batch(texts)
+
+            # Extract input IDs from encodings
+            input_ids_dtype = self.output_dtypes.get("input_ids", np.int64)
+            input_ids = np.array([enc.ids for enc in encoded], dtype=input_ids_dtype)
+
+            # Create output tensors
+            input_ids_tensor = pb_utils.Tensor("input_ids", input_ids)
+
+            # Create response
+            inference_response = pb_utils.InferenceResponse(output_tensors=[input_ids_tensor])
+            responses.append(inference_response)
+
+        return responses
+
+    def finalize(self):
+        """Clean up resources."""
+        print("Cleaning up tokenizer...")

docker/hf-space/siglip2-model/model_repo/tokenizer/1/tokenizer/tokenizer.json

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fc1870feba58b2d0cbcc75bfcb5124ee5c1202c5a64fdde45d473d228f1f35ae
+size 34363171

docker/hf-space/siglip2-model/model_repo/tokenizer/config.pbtxt

@@ -0,0 +1,35 @@
+name: "tokenizer"
+backend: "python"
+max_batch_size: 32
+
+input [
+  {
+    name: "text"
+    data_type: TYPE_STRING
+    dims: [1]
+  }
+]
+
+output [
+  {
+    name: "input_ids"
+    data_type: TYPE_INT64
+    dims: [64]
+  }
+]
+
+dynamic_batching {
+  preferred_batch_size: [8, 16, 32]
+  max_queue_delay_microseconds: 50000
+}
+
+instance_group [
+  {
+    count: 4
+    kind: KIND_CPU
+  }
+]
+
+response_cache {
+  enable: true
+}

docker/hf-space/siglip2-model/pyproject.toml

@@ -0,0 +1,14 @@
+[project]
+name = "siglip2-triton-server"
+version = "0.1.0"
+description = "Server dependencies for SigLIP2 Triton"
+requires-python = ">=3.11,<3.14"
+dependencies = [
+    "tokenizers>=0.22.2",
+    "transformers>=4.57.1",
+    "pillow>=12.3.0",
+    "numpy",
+    "wheel>=0.46.3",
+    "urllib3>=2.7.0",
+    "starlette>=1.3.1",
+]

docker/hf-space/siglip2-model/uv.lock

@@ -0,0 +1,597 @@
+version = 1
+revision = 3
+requires-python = ">=3.11, <3.14"
+
+[[package]]
+name = "annotated-doc"
+version = "0.0.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/57/ba/046ceea27344560984e26a590f90bc7f4a75b06701f653222458922b558c/annotated_doc-0.0.4.tar.gz", hash = "sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4", size = 7288, upload-time = "2025-11-10T22:07:42.062Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/d3/26bf1008eb3d2daa8ef4cacc7f3bfdc11818d111f7e2d0201bc6e3b49d45/annotated_doc-0.0.4-py3-none-any.whl", hash = "sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320", size = 5303, upload-time = "2025-11-10T22:07:40.673Z" },
+]
+
+[[package]]
+name = "anyio"
+version = "4.13.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2026.4.22"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" },
+]
+
+[[package]]
+name = "click"
+version = "8.3.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/bb/63/f9e1ea081ce35720d8b92acde70daaedace594dc93b693c869e0d5910718/click-8.3.3.tar.gz", hash = "sha256:398329ad4837b2ff7cbe1dd166a4c0f8900c3ca3a218de04466f38f6497f18a2", size = 328061, upload-time = "2026-04-22T15:11:27.506Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ae/44/c1221527f6a71a01ec6fbad7fa78f1d50dfa02217385cf0fa3eec7087d59/click-8.3.3-py3-none-any.whl", hash = "sha256:a2bf429bb3033c89fa4936ffb35d5cb471e3719e1f3c8a7c3fff0b8314305613", size = 110502, upload-time = "2026-04-22T15:11:25.044Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "filelock"
+version = "3.29.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b5/fe/997687a931ab51049acce6fa1f23e8f01216374ea81374ddee763c493db5/filelock-3.29.0.tar.gz", hash = "sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90", size = 57571, upload-time = "2026-04-19T15:39:10.068Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/81/47/dd9a212ef6e343a6857485ffe25bba537304f1913bdbed446a23f7f592e1/filelock-3.29.0-py3-none-any.whl", hash = "sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258", size = 39812, upload-time = "2026-04-19T15:39:08.752Z" },
+]
+
+[[package]]
+name = "fsspec"
+version = "2026.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d5/8d/1c51c094345df128ca4a990d633fe1a0ff28726c9e6b3c41ba65087bba1d/fsspec-2026.4.0.tar.gz", hash = "sha256:301d8ac70ae90ef3ad05dcf94d6c3754a097f9b5fe4667d2787aa359ec7df7e4", size = 312760, upload-time = "2026-04-29T20:42:38.635Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d5/0c/043d5e551459da400957a1395e0febbf771446ff34291afcbe3d8be2a279/fsspec-2026.4.0-py3-none-any.whl", hash = "sha256:11ef7bb35dab8a394fde6e608221d5cf3e8499401c249bebaeaad760a1a8dec2", size = 203402, upload-time = "2026-04-29T20:42:36.842Z" },
+]
+
+[[package]]
+name = "h11"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/ee/02a2c011bdab74c6fb3c75474d40b3052059d95df7e73351460c8588d963/h11-0.16.0.tar.gz", hash = "sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1", size = 101250, upload-time = "2025-04-24T03:35:25.427Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" },
+]
+
+[[package]]
+name = "hf-xet"
+version = "1.5.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/74/d8/5c06fc76461418326a7decf8367480c35be11a41fd938633929c60a9ec6b/hf_xet-1.5.0.tar.gz", hash = "sha256:e0fb0a34d9f406eed88233e829a67ec016bec5af19e480eac65a233ea289a948", size = 837196, upload-time = "2026-05-06T06:18:15.583Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/9b/6912c99070915a4f28119e3c5b52a9abd1eec0ad5cb293b8c967a0c6f5a2/hf_xet-1.5.0-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:7d70fe2ce97b9db73b9c9b9c81fe3693640aec83416a966c446afea54acfae3c", size = 4023383, upload-time = "2026-05-06T06:17:53.947Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/6d/9563cfde59b5d8128a9c7ec972a087f4c782e4f7bac5a85234edfd5d5e49/hf_xet-1.5.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:73a0dae8c71de3b0633a45c73f4a4a5ed09e94b43441d82981a781d4f12baa42", size = 3792751, upload-time = "2026-05-06T06:17:51.791Z" },
+    { url = "https://files.pythonhosted.org/packages/07/a5/ed5a0cf35b49a0571af5a8f53416dad1877a718c021c9937c3a53cb45781/hf_xet-1.5.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a60290ec57e9b71767fba7c3645ddafdd0759974b540441510c629c6db6db24a", size = 4456058, upload-time = "2026-05-06T06:17:40.735Z" },
+    { url = "https://files.pythonhosted.org/packages/60/fb/3ae8bf2a7a37a4197d0195d7247fd25b3952e15cb8a599e285dfaa6f52b3/hf_xet-1.5.0-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:e5de0f6deada0dada870bb376a11bcd1f08abf3a968a6d118f33e72d1b1eb480", size = 4250783, upload-time = "2026-05-06T06:17:38.412Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/9b/8bae40d4d91525085137196e84eb0ed49cf65b5e96e5c3ecdadd8bd0fac2/hf_xet-1.5.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c799d49f1a5544a0ef7591c0ee75e0d6b93d6f56dc7a4979f59f7518d2872216", size = 4445594, upload-time = "2026-05-06T06:18:04.219Z" },
+    { url = "https://files.pythonhosted.org/packages/13/59/c74efbbd4e8728172b2cc72a2bc014d2947a4b7bdced932fbd3f5da1a4e5/hf_xet-1.5.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:2baea1b0b989e5c152fe81425f7745ddc8901280ba3d97c98d8cdece7b706c60", size = 4663995, upload-time = "2026-05-06T06:18:06.1Z" },
+    { url = "https://files.pythonhosted.org/packages/73/32/8e1e0410af64cda9b139d1dcebdc993a8ff9c8c7c0e2696ae356d75ccc0d/hf_xet-1.5.0-cp313-cp313t-win_amd64.whl", hash = "sha256:526345b3ed45f374f6317349df489167606736c876241ba984105afe7fd4839d", size = 3966608, upload-time = "2026-05-06T06:18:19.74Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/34/a8febc8f4edbea8b3e21b02ebc8b628679b84ba7e45cde624a7736b51500/hf_xet-1.5.0-cp313-cp313t-win_arm64.whl", hash = "sha256:786d28e2eb8315d5035544b9d137b4a842d600c434bb91bf7d0d953cce906ad4", size = 3796946, upload-time = "2026-05-06T06:18:17.568Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/fb/69ff198a82cae7eb1a69fb84d93b3a3e4816564d76817fe541ddc96874eb/hf_xet-1.5.0-cp37-abi3-macosx_10_12_x86_64.whl", hash = "sha256:dad0dc84e941b8ba3c860659fe1fdc35c049d47cce293f003287757e971a8f56", size = 4030814, upload-time = "2026-05-06T06:17:57.933Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/ff/edcc2b40162bef3ff78e14ab637e5f3b89243d6aee72f5949d3bb6a5af83/hf_xet-1.5.0-cp37-abi3-macosx_11_0_arm64.whl", hash = "sha256:fd6e5a9b0fdac4ed03ed45ef79254a655b1aaab514a02202617fbf643f5fdf7a", size = 3798444, upload-time = "2026-05-06T06:17:55.79Z" },
+    { url = "https://files.pythonhosted.org/packages/49/4d/103f76b04310e5e57656696cc184690d20c466af0bca3ca88f8c8ea5d4f3/hf_xet-1.5.0-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3531b1823a0e6d77d80f9ed15ca0e00f0d115094f8ac033d5cae88f4564cc949", size = 4465986, upload-time = "2026-05-06T06:17:44.886Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/a2/546f47f464737b3edbab6f8ddb57f2599b93d2cbb66f06abb475ccb48651/hf_xet-1.5.0-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:9a0ee58cd18d5ea799f7ed11290bbccbe56bdd8b1d97ca74b9cc49a3945d7a3b", size = 4259865, upload-time = "2026-05-06T06:17:42.639Z" },
+    { url = "https://files.pythonhosted.org/packages/95/7f/1be593c1f28613be2e196473481cd81bfc5910795e30a34e8f744f6cac4f/hf_xet-1.5.0-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1e60df5a42e9bed8628b6416af2cba4cba57ae9f02de226a06b020d98e1aab18", size = 4459835, upload-time = "2026-05-06T06:18:08.026Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/b2/703569fc881f3284487e68cda7b42179978480da3c438042a6bbbb4a671c/hf_xet-1.5.0-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:4b35549ce62601b84da4ff9b24d970032ace3d4430f52d91bcbb26c901d6c690", size = 4672414, upload-time = "2026-05-06T06:18:09.864Z" },
+    { url = "https://files.pythonhosted.org/packages/af/37/1b6def445c567286b50aa3b33828158e135b1be44938dde59f11382a500c/hf_xet-1.5.0-cp37-abi3-win_amd64.whl", hash = "sha256:2806c7c17b4d23f8d88f7c4814f838c3b6150773fe339c20af23e1cfaf2797e4", size = 3977238, upload-time = "2026-05-06T06:18:23.621Z" },
+    { url = "https://files.pythonhosted.org/packages/62/94/3b66b148778ee100dcfd69c2ca22b57b41b44d3063ceec934f209e9184ce/hf_xet-1.5.0-cp37-abi3-win_arm64.whl", hash = "sha256:b6c9df403040248c76d808d3e047d64db2d923bae593eb244c41e425cf6cd7be", size = 3806916, upload-time = "2026-05-06T06:18:21.7Z" },
+]
+
+[[package]]
+name = "httpcore"
+version = "1.0.9"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "h11" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
+]
+
+[[package]]
+name = "httpx"
+version = "0.28.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "certifi" },
+    { name = "httpcore" },
+    { name = "idna" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/df/48c586a5fe32a0f01324ee087459e112ebb7224f646c0b5023f5e79e9956/httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc", size = 141406, upload-time = "2024-12-06T15:37:23.222Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" },
+]
+
+[[package]]
+name = "huggingface-hub"
+version = "1.14.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "filelock" },
+    { name = "fsspec" },
+    { name = "hf-xet", marker = "platform_machine == 'AMD64' or platform_machine == 'aarch64' or platform_machine == 'amd64' or platform_machine == 'arm64' or platform_machine == 'x86_64'" },
+    { name = "httpx" },
+    { name = "packaging" },
+    { name = "pyyaml" },
+    { name = "tqdm" },
+    { name = "typer" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/39/40/43109e943fd718b0ccd0cd61eb4f1c347df22bf81f5874c6f22adf44bcff/huggingface_hub-1.14.0.tar.gz", hash = "sha256:d6d2c9cd6be1d02ae9ec6672d5587d10a427f377db688e82528f426a041622c2", size = 782365, upload-time = "2026-05-06T14:14:34.278Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/89/a5/33b49ba7bea7c41bb37f74ec0f8beea0831e052330196633fe2c77516ea6/huggingface_hub-1.14.0-py3-none-any.whl", hash = "sha256:efe075535c62e130b30e836b138e13785f6f043d1f0539e0a39aa411a99e90b8", size = 661479, upload-time = "2026-05-06T14:14:32.029Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.18"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
+]
+
+[[package]]
+name = "markdown-it-py"
+version = "4.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "mdurl" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/06/ff/7841249c247aa650a76b9ee4bbaeae59370dc8bfd2f6c01f3630c35eb134/markdown_it_py-4.2.0.tar.gz", hash = "sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49", size = 82454, upload-time = "2026-05-07T12:08:28.36Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/81/4da04ced5a082363ecfa159c010d200ecbd959ae410c10c0264a38cac0f5/markdown_it_py-4.2.0-py3-none-any.whl", hash = "sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a", size = 91687, upload-time = "2026-05-07T12:08:27.182Z" },
+]
+
+[[package]]
+name = "mdurl"
+version = "0.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba", size = 8729, upload-time = "2022-08-14T12:40:10.846Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/38/89ba8ad64ae25be8de66a6d463314cf1eb366222074cfda9ee839c56a4b4/mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8", size = 9979, upload-time = "2022-08-14T12:40:09.779Z" },
+]
+
+[[package]]
+name = "numpy"
+version = "2.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d0/ad/fed0499ce6a338d2a03ebae59cd15093910c8875328855781952abf6c2fe/numpy-2.4.6.tar.gz", hash = "sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda", size = 20735807, upload-time = "2026-05-18T23:37:14.07Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/49/ec46835a70be8fa6446c495126ac84fdb28cb2558e1620ffb87a10c8b64c/numpy-2.4.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4", size = 16969194, upload-time = "2026-05-18T23:33:13.503Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/0d/f5957185c0ee2f3e12f78715aa9e3b353fd83633316c8532b38faa37e3f6/numpy-2.4.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d", size = 14964111, upload-time = "2026-05-18T23:33:17.795Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/40/40a40ee0ddf7ceb782c49af278894b686e586d65d8c1889c8b5da01a3d7d/numpy-2.4.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8", size = 5469159, upload-time = "2026-05-18T23:33:20.654Z" },
+    { url = "https://files.pythonhosted.org/packages/63/13/f9a8046535cb21deae82f8d03de9617e08882d274fad2539630761888228/numpy-2.4.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538", size = 6798936, upload-time = "2026-05-18T23:33:22.987Z" },
+    { url = "https://files.pythonhosted.org/packages/33/a8/6fa8c1a345a8c85dbb21932c447bee07c30a2c2a3f31e369c0a84b300147/numpy-2.4.6-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47", size = 15966692, upload-time = "2026-05-18T23:33:26.62Z" },
+    { url = "https://files.pythonhosted.org/packages/02/03/74fe2a4cb3817d94d86402f2506554130a2f01414e299b5a843e5a8a957f/numpy-2.4.6-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93", size = 16918164, upload-time = "2026-05-18T23:33:29.955Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/80/3615be3313f7e7696609bc194b9f0101da809df79e859bdb84e0cd043f46/numpy-2.4.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8", size = 17322877, upload-time = "2026-05-18T23:33:34.724Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ac/a691e0fe2675e370d0e08ff905adc49a1c8830e8cae03efe4477e92cd55d/numpy-2.4.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6", size = 18651487, upload-time = "2026-05-18T23:33:38.217Z" },
+    { url = "https://files.pythonhosted.org/packages/15/a7/9bc1cd626d7bf6869bfedf27b91b6ab5dd607758bf8e959d6fa80c6a59cb/numpy-2.4.6-cp311-cp311-win32.whl", hash = "sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8", size = 6233945, upload-time = "2026-05-18T23:33:41.331Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/31/7fc6239c12bce7e931463251cca4426c465e1876ba3cc785402ef4dd8f4e/numpy-2.4.6-cp311-cp311-win_amd64.whl", hash = "sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147", size = 12608406, upload-time = "2026-05-18T23:33:44.131Z" },
+    { url = "https://files.pythonhosted.org/packages/27/83/140f85a466595a16382996a1bf06b2b54bcd597488921b0c9daaeeda72af/numpy-2.4.6-cp311-cp311-win_arm64.whl", hash = "sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577", size = 10479528, upload-time = "2026-05-18T23:33:50.725Z" },
+    { url = "https://files.pythonhosted.org/packages/95/2a/3d7b5ac8aac24feaf9ad7ed58f45b0bbc06d37e4338ae84c9f2298b570f9/numpy-2.4.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1", size = 16689119, upload-time = "2026-05-18T23:33:54.065Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/12/92c4c131527599e8288d6918e888d88726f84d805d784b771f32408aeaef/numpy-2.4.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb", size = 14699246, upload-time = "2026-05-18T23:33:57.621Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/fe/c0a6b7b2ca128a8fb228575147073b660656734b8ebe4d76c8fd748dcc79/numpy-2.4.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41", size = 5204410, upload-time = "2026-05-18T23:34:00.302Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/d4/9770d14ba719432bb90a421bfd443872ed0f70f7264b64bec12ea363d5fd/numpy-2.4.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698", size = 6551240, upload-time = "2026-05-18T23:34:02.852Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/c6/50a46a6205feba2343f1d6d17438107c5dc491ed1c736e6ea68689fd906b/numpy-2.4.6-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f", size = 15671012, upload-time = "2026-05-18T23:34:05.485Z" },
+    { url = "https://files.pythonhosted.org/packages/99/60/14115e6364fa676c5397c2ad3004e527e9aa487abf5d0706ec81bbd08529/numpy-2.4.6-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853", size = 16645538, upload-time = "2026-05-18T23:34:09.265Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/c5/693cbe59e57db94d2231fa519ca3978dc9e19da5a8f088588f5c6e947ff2/numpy-2.4.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a", size = 17020706, upload-time = "2026-05-18T23:34:13.053Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/fc/85b7c4eff9b4966ade25c2273cf7e7012e92366c032058653934b37de044/numpy-2.4.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2", size = 18368541, upload-time = "2026-05-18T23:34:17.024Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/81/e1b27545deedce7f4a0b348618c6b62d74e36a4dc9ccd42f3eb2f85eee32/numpy-2.4.6-cp312-cp312-win32.whl", hash = "sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45", size = 5962825, upload-time = "2026-05-18T23:34:20.3Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/ca/feab00bd44aa5fe1ad2c18f08b4d3bb92e26484b0b1d1443897809ed528c/numpy-2.4.6-cp312-cp312-win_amd64.whl", hash = "sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751", size = 12321687, upload-time = "2026-05-18T23:34:23.095Z" },
+    { url = "https://files.pythonhosted.org/packages/63/cf/5a6d34850a39d1093558564f77ee8e8e0bee5061151b8f05a55711001ec7/numpy-2.4.6-cp312-cp312-win_arm64.whl", hash = "sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8", size = 10221482, upload-time = "2026-05-18T23:34:25.876Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/82/bdab26d7438c6791ca31b7c024ca37c1eab8b726ba236129005cd4a06e45/numpy-2.4.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0", size = 16684648, upload-time = "2026-05-18T23:34:29.41Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/30/a80189bcc7f5e4258b3fbc3968d909d1756f54d023299ecc39ad6fdb9ef8/numpy-2.4.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb", size = 14693902, upload-time = "2026-05-18T23:34:33.013Z" },
+    { url = "https://files.pythonhosted.org/packages/97/12/70b5d0d7c15e1ebb8a6a84a8caa1d19e181d84fb58bb6d70aca29099dec1/numpy-2.4.6-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f", size = 5198992, upload-time = "2026-05-18T23:34:36.132Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/8c/ebd2a8f8a83541f8d38cc5667e8c2b69cecfd30da6e45693e8158857d44b/numpy-2.4.6-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3", size = 6546944, upload-time = "2026-05-18T23:34:38.484Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/c5/7b863a97a91671a0338f4253bd3b5a3d3852f0692dae91711c9f4a10e787/numpy-2.4.6-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b", size = 15669392, upload-time = "2026-05-18T23:34:41.257Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/9d/3584b9984ca4c047aea75214ce1a4c4c73d849bd71b604264b7f5653f8a8/numpy-2.4.6-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089", size = 16633220, upload-time = "2026-05-18T23:34:45.075Z" },
+    { url = "https://files.pythonhosted.org/packages/05/ae/7c67fba23bd98caec7c99261f3a16072ade14813486b0282cb29846de832/numpy-2.4.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a", size = 17020800, upload-time = "2026-05-18T23:34:49.065Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/5d/3b6725cb31d983c5e66916f5d36f6d7e5521129e4c4404d64f918292a5b6/numpy-2.4.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605", size = 18357600, upload-time = "2026-05-18T23:34:52.709Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/da/2ccc6c2fe8898dee01d90c75c5f5f914a23daf99e3e0f59516a08760c8b5/numpy-2.4.6-cp313-cp313-win32.whl", hash = "sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91", size = 5961134, upload-time = "2026-05-18T23:34:55.618Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/cd/9cc4dc876fb065d5c220aae4d5e14826b2715331bb7618ce1fb07a679d99/numpy-2.4.6-cp313-cp313-win_amd64.whl", hash = "sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359", size = 12318598, upload-time = "2026-05-18T23:34:58.928Z" },
+    { url = "https://files.pythonhosted.org/packages/39/1e/c0bcba1f8694116485fe28fd1be698c278fcda4141c5b0e53a2aed8b12a8/numpy-2.4.6-cp313-cp313-win_arm64.whl", hash = "sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778", size = 10222272, upload-time = "2026-05-18T23:35:02.167Z" },
+    { url = "https://files.pythonhosted.org/packages/63/6d/cc5619247c8f4204e507f5883528372e4ac4bb189e579fb859a12e480b1f/numpy-2.4.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1", size = 14821197, upload-time = "2026-05-18T23:35:05.468Z" },
+    { url = "https://files.pythonhosted.org/packages/00/58/f1c39161c87d9e9bed660f1ed4bafc0e403d5ec9650b6dd77aead07d489b/numpy-2.4.6-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe", size = 5326287, upload-time = "2026-05-18T23:35:08.693Z" },
+    { url = "https://files.pythonhosted.org/packages/af/57/3917ab0fd97f271a8694513581b8a36c655f111c446852c302f04ccdb6fc/numpy-2.4.6-cp313-cp313t-macosx_14_0_x86_64.whl", hash = "sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997", size = 6646763, upload-time = "2026-05-18T23:35:11.459Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/0f/037e64c494b67581ae18193d770adef354c41f3f2c8ebf865602d949bf8f/numpy-2.4.6-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20", size = 15728070, upload-time = "2026-05-18T23:35:14.79Z" },
+    { url = "https://files.pythonhosted.org/packages/21/a6/5d2bae9c9542eb4df16dc9c46dc79c186e9bad53805dfa5399a6023c6db0/numpy-2.4.6-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d", size = 16681752, upload-time = "2026-05-18T23:35:18.836Z" },
+    { url = "https://files.pythonhosted.org/packages/92/14/23d1dfb410ae362cd59ce53e936b1513d545eb40db3949ced632e19a459e/numpy-2.4.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67", size = 17086024, upload-time = "2026-05-18T23:35:22.52Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/6e/23595a2c642cdf3bc567877064bdd7f91c8b0038a4453cf2daf7248eafe9/numpy-2.4.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd", size = 18403398, upload-time = "2026-05-18T23:35:26.398Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/90/0ac3bc947217e66dec77e7cbc6a1979d1af70b6461b82f620d3bccd5e4c8/numpy-2.4.6-cp313-cp313t-win32.whl", hash = "sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab", size = 6084971, upload-time = "2026-05-18T23:35:29.387Z" },
+    { url = "https://files.pythonhosted.org/packages/77/71/5673e351671a1d2bd6063b91b44f70c0affea7d1516fa7a6572941ba4aa1/numpy-2.4.6-cp313-cp313t-win_amd64.whl", hash = "sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75", size = 12458532, upload-time = "2026-05-18T23:35:32.175Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/88/19d3503c5046e688f049274b27a3ef3d771152fa80d3ba3d01a3dff61abe/numpy-2.4.6-cp313-cp313t-win_arm64.whl", hash = "sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd", size = 10291881, upload-time = "2026-05-18T23:35:35.465Z" },
+    { url = "https://files.pythonhosted.org/packages/de/12/b422cc84439adc0d00de605bf4a308890ae5c26f2c71fbd73e5d08fbb0dd/numpy-2.4.6-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662", size = 16847511, upload-time = "2026-05-18T23:36:50.673Z" },
+    { url = "https://files.pythonhosted.org/packages/44/53/f481bef68011740f8849418d82db07230e825013f31f4eef5ba5b805316a/numpy-2.4.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7", size = 14889064, upload-time = "2026-05-18T23:36:53.879Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/57/42ed575c10ced8af951d426bc4e1f8aff16fd851db33f067036215a7f860/numpy-2.4.6-pp311-pypy311_pp73-macosx_14_0_arm64.whl", hash = "sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f", size = 5394157, upload-time = "2026-05-18T23:36:57.194Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/ef/f66cc724fcc36c1e364c67f51ae9146090b8b584f27d58b97fdae3edd737/numpy-2.4.6-pp311-pypy311_pp73-macosx_14_0_x86_64.whl", hash = "sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c", size = 6708728, upload-time = "2026-05-18T23:36:59.575Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/9c/c531f2293b91265d8b48e9b329f54fdd7ffae73cb4134ea10cca4237e9cc/numpy-2.4.6-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0", size = 15798374, upload-time = "2026-05-18T23:37:02.674Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/b0/413077f6b1153ed3cba361401c6783bbad6114804a000cc22eb71c13e190/numpy-2.4.6-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02", size = 16747286, upload-time = "2026-05-18T23:37:06.327Z" },
+    { url = "https://files.pythonhosted.org/packages/15/ce/e5ec180bc41812edcd8daeb8639d205622c0e8c02259d8ab25a0201b3c2a/numpy-2.4.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73", size = 12504263, upload-time = "2026-05-18T23:37:09.715Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "pillow"
+version = "12.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fb/c8/0a78b0e02d7ac54bc03e5321c9220da52f0c2ea83b21f7c40e7f3169c502/pillow-12.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756", size = 5392415, upload-time = "2026-07-01T11:53:47.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/5b/a02d30018abd97ced9f5a6c63d28597694a00d066516b9c1c6de45859fc9/pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6", size = 4785266, upload-time = "2026-07-01T11:53:49.079Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/98/766667a4be768150a202836acd9fad19c06824ca86c4286d3cf6b274964e/pillow-12.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd", size = 6263814, upload-time = "2026-07-01T11:53:51.32Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/2d/ede717bc1144f63886c21fd349bb95860b0d1a21149ff16f2bb362b612b6/pillow-12.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd", size = 6934408, upload-time = "2026-07-01T11:53:53.487Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/48/9c58b685e69d49c31af6c8eb9012055fab7e665785165c84796e2c73ce72/pillow-12.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c", size = 6337160, upload-time = "2026-07-01T11:53:55.457Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/fa/dc2a5c0ba6df93f67c31d34b808b7ce440b40cdbf96f0b81cde1d1e6fa93/pillow-12.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5", size = 7045172, upload-time = "2026-07-01T11:53:57.736Z" },
+    { url = "https://files.pythonhosted.org/packages/86/a5/444817a4d4c4c2417df00513086ca196f388d8f9ef40c2e4ccd1ad1af54b/pillow-12.3.0-cp311-cp311-win32.whl", hash = "sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b", size = 6472232, upload-time = "2026-07-01T11:53:59.767Z" },
+    { url = "https://files.pythonhosted.org/packages/63/c6/4bad1b18d132a50b27e1365e1ab163616f7a5bb56d330f66f9d1d9d4f9d4/pillow-12.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a", size = 7233653, upload-time = "2026-07-01T11:54:02.066Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/16/00f91ab7760dc842f5aad55217e80fc4a7067a0604535249bc8a2d6d9870/pillow-12.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26", size = 2568195, upload-time = "2026-07-01T11:54:04.622Z" },
+    { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" },
+    { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" },
+    { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" },
+    { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" },
+    { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" },
+    { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/ac/31fb64e1e7efb5a4b50cd3d92049ba89ac6e4d8d3bb6a74e15048ca3353e/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89", size = 4161684, upload-time = "2026-07-01T11:54:25.934Z" },
+    { url = "https://files.pythonhosted.org/packages/87/b4/9805e23d2b4d77842b468513841fda254ee42f0289d25088340e4ff46e2d/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace", size = 4255487, upload-time = "2026-07-01T11:54:27.935Z" },
+    { url = "https://files.pythonhosted.org/packages/df/39/ecf519435a200c693fe053a6ee4d835b41cf963a4dfc2551c4e637cb2a71/pillow-12.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec", size = 3696433, upload-time = "2026-07-01T11:54:29.813Z" },
+    { url = "https://files.pythonhosted.org/packages/42/92/2fc3ffad878ae8dd5469ec1bc8eb83b71f48e13efdf68f02709003982a32/pillow-12.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66", size = 5345889, upload-time = "2026-07-01T11:54:31.97Z" },
+    { url = "https://files.pythonhosted.org/packages/10/76/8803c13605b763d33d156c4678fc77f8443389c0c51c8aef707bb02015f4/pillow-12.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35", size = 4780109, upload-time = "2026-07-01T11:54:34.026Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/01/e18aff37cb0b4aac47ac90f016d347a49aca667ef97f190b06ac2aabc928/pillow-12.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65", size = 6263736, upload-time = "2026-07-01T11:54:36.131Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/62/de5bdd77d935331f4f802edc11e4d82950f642caad6cb2f949837b8560e2/pillow-12.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3", size = 6937129, upload-time = "2026-07-01T11:54:38.216Z" },
+    { url = "https://files.pythonhosted.org/packages/70/4d/105627a13300c5e0df1d174230b32fd1273062c96f7745fd552b945d1e1d/pillow-12.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a", size = 6339562, upload-time = "2026-07-01T11:54:40.354Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/1d/f13de01a553988ab895ba1c722e06cf3144d4f57656fd5b81b6d881f1179/pillow-12.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e", size = 7049439, upload-time = "2026-07-01T11:54:42.489Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/f9/066794cca041b969964f779ee5fa66a9498bbf34248ac39c5d7954e4198f/pillow-12.3.0-cp313-cp313-win32.whl", hash = "sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f", size = 6473287, upload-time = "2026-07-01T11:54:44.9Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/9b/7a58e61d62be561da3a356fe2384d4059a6345fc130e23ef1c36a5b81d24/pillow-12.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8", size = 7239691, upload-time = "2026-07-01T11:54:47.141Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/b0/c4ed4f0ef8f8fa5ee8351537db6650bb8189f7e118842978dd6589065692/pillow-12.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b", size = 2568185, upload-time = "2026-07-01T11:54:49.137Z" },
+    { url = "https://files.pythonhosted.org/packages/75/18/2e8b40223153ccbc60df07f9e8928dc0c76202aa4e55ae9f53962b6510d6/pillow-12.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468", size = 5302510, upload-time = "2026-07-01T11:56:25.736Z" },
+    { url = "https://files.pythonhosted.org/packages/46/3e/51fabf59d5ab801ceab709453d3ab6b180083496579549de4c45ced6528a/pillow-12.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94", size = 4736058, upload-time = "2026-07-01T11:56:28.041Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/20/22fe9384b7949e25fb1293bcfc84fb82590ff4ea6b37c95b24d26d793d86/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e", size = 5237776, upload-time = "2026-07-01T11:56:30.263Z" },
+    { url = "https://files.pythonhosted.org/packages/08/14/f6ba68107680ffa74b39985f3f30884e41318fbc4250caa423c79b4788bb/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3", size = 5860358, upload-time = "2026-07-01T11:56:32.68Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0169bc772ec491108b62f644f8ecf1fe5d8ae5ebafde2ee2142210166903/pillow-12.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a", size = 7231786, upload-time = "2026-07-01T11:56:35.046Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pyyaml"
+version = "6.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6d/16/a95b6757765b7b031c9374925bb718d55e0a9ba8a1b6a12d25962ea44347/pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e", size = 185826, upload-time = "2025-09-25T21:31:58.655Z" },
+    { url = "https://files.pythonhosted.org/packages/16/19/13de8e4377ed53079ee996e1ab0a9c33ec2faf808a4647b7b4c0d46dd239/pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824", size = 175577, upload-time = "2025-09-25T21:32:00.088Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/62/d2eb46264d4b157dae1275b573017abec435397aa59cbcdab6fc978a8af4/pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c", size = 775556, upload-time = "2025-09-25T21:32:01.31Z" },
+    { url = "https://files.pythonhosted.org/packages/10/cb/16c3f2cf3266edd25aaa00d6c4350381c8b012ed6f5276675b9eba8d9ff4/pyyaml-6.0.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00", size = 882114, upload-time = "2025-09-25T21:32:03.376Z" },
+    { url = "https://files.pythonhosted.org/packages/71/60/917329f640924b18ff085ab889a11c763e0b573da888e8404ff486657602/pyyaml-6.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d", size = 806638, upload-time = "2025-09-25T21:32:04.553Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/6f/529b0f316a9fd167281a6c3826b5583e6192dba792dd55e3203d3f8e655a/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a", size = 767463, upload-time = "2025-09-25T21:32:06.152Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/6a/b627b4e0c1dd03718543519ffb2f1deea4a1e6d42fbab8021936a4d22589/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4", size = 794986, upload-time = "2025-09-25T21:32:07.367Z" },
+    { url = "https://files.pythonhosted.org/packages/45/91/47a6e1c42d9ee337c4839208f30d9f09caa9f720ec7582917b264defc875/pyyaml-6.0.3-cp311-cp311-win32.whl", hash = "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b", size = 142543, upload-time = "2025-09-25T21:32:08.95Z" },
+    { url = "https://files.pythonhosted.org/packages/da/e3/ea007450a105ae919a72393cb06f122f288ef60bba2dc64b26e2646fa315/pyyaml-6.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf", size = 158763, upload-time = "2025-09-25T21:32:09.96Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/33/422b98d2195232ca1826284a76852ad5a86fe23e31b009c9886b2d0fb8b2/pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196", size = 182063, upload-time = "2025-09-25T21:32:11.445Z" },
+    { url = "https://files.pythonhosted.org/packages/89/a0/6cf41a19a1f2f3feab0e9c0b74134aa2ce6849093d5517a0c550fe37a648/pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0", size = 173973, upload-time = "2025-09-25T21:32:12.492Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/23/7a778b6bd0b9a8039df8b1b1d80e2e2ad78aa04171592c8a5c43a56a6af4/pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28", size = 775116, upload-time = "2025-09-25T21:32:13.652Z" },
+    { url = "https://files.pythonhosted.org/packages/65/30/d7353c338e12baef4ecc1b09e877c1970bd3382789c159b4f89d6a70dc09/pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c", size = 844011, upload-time = "2025-09-25T21:32:15.21Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/9d/b3589d3877982d4f2329302ef98a8026e7f4443c765c46cfecc8858c6b4b/pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc", size = 807870, upload-time = "2025-09-25T21:32:16.431Z" },
+    { url = "https://files.pythonhosted.org/packages/05/c0/b3be26a015601b822b97d9149ff8cb5ead58c66f981e04fedf4e762f4bd4/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e", size = 761089, upload-time = "2025-09-25T21:32:17.56Z" },
+    { url = "https://files.pythonhosted.org/packages/be/8e/98435a21d1d4b46590d5459a22d88128103f8da4c2d4cb8f14f2a96504e1/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea", size = 790181, upload-time = "2025-09-25T21:32:18.834Z" },
+    { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" },
+    { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
+]
+
+[[package]]
+name = "regex"
+version = "2026.5.9"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/dc/0e/49aee608ad09480e7fd276898c99ec6192985fa331abe4eb3a986094490b/regex-2026.5.9.tar.gz", hash = "sha256:a8234aa23ec39894bfe4a3f1b85616a7032481964a13ac6fc9f10de4f6fca270", size = 416074, upload-time = "2026-05-09T23:15:19.37Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c2/dc/c1f2df4027e82fc54b5a473e4b250f5139faca49a0fbe29a48668d228f34/regex-2026.5.9-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:ccf5249114cc3e772ecdd88a98a86eca0fd74c61ce32a94743758c083fc05d48", size = 489445, upload-time = "2026-05-09T23:12:06.111Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d2/59f01110660081cce9c0bc30ebd0b5ee250dacf658e3248ed92f01e0e8ee/regex-2026.5.9-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:46f1326ca6e65b0879d23ca302c0f2415aad42ff0309b9c818e7949fe19a41d8", size = 291271, upload-time = "2026-05-09T23:12:07.731Z" },
+    { url = "https://files.pythonhosted.org/packages/58/b6/14b2c84ff90ddb370c81d27503f4a0fcf071496416f4855f6cc8c5d81c35/regex-2026.5.9-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:ef31cbfe458e21c6122ba8150ff060e0c7789ed0d26eb423f25472584920b555", size = 289212, upload-time = "2026-05-09T23:12:09.266Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d0/4db86529117320de0c84afd90e70bb47434625875e34fcef9d8c127c5b16/regex-2026.5.9-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:992604d02e6d9c6d786c24a706a71ecffe1020fc1ef264044474cd81fa2c3919", size = 792310, upload-time = "2026-05-09T23:12:11.416Z" },
+    { url = "https://files.pythonhosted.org/packages/07/78/fe4800cd322f862ecffd2d553409b20d80650e5ed71b9d178f853d020b82/regex-2026.5.9-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9411dd64ca95477225734a93dfc8583b51916b8d5942f99d6cac21e09965451", size = 861721, upload-time = "2026-05-09T23:12:13.681Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/d0/b3618a895dd8feb897c61bb2954edd265e1767d82a01d53065d5871127a3/regex-2026.5.9-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3dd4a3ff360dfb836fecdb93a4598f9d6e2ac81e3e397125145c6221bf58cf4c", size = 906460, upload-time = "2026-05-09T23:12:15.443Z" },
+    { url = "https://files.pythonhosted.org/packages/33/6f/1481597e859ef19508b345eec4afd1416ed6e6b459c75a64026ef193aecf/regex-2026.5.9-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2a661a7d270a61f7cf460caee8b9fa2d5ef9e5c681234bcb9e0fe14f488e7dfc", size = 799843, upload-time = "2026-05-09T23:12:16.892Z" },
+    { url = "https://files.pythonhosted.org/packages/73/59/955734c803f59108deccba3597ae440c76b62a652733c0006e6243758420/regex-2026.5.9-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f079e50a0d3cc3cd5091fa9ff45869a2e6b2cd35895731edafb0327901a8d86d", size = 773610, upload-time = "2026-05-09T23:12:19.127Z" },
+    { url = "https://files.pythonhosted.org/packages/68/8f/70c04a236d651c81881dac42ef8538bddda6121434509d0a22d9e601503b/regex-2026.5.9-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4ebe8f0b5ec5a5024dc4a4c59f444c4e9afc5f2abdbb8962065b75d27fb971f9", size = 781645, upload-time = "2026-05-09T23:12:20.806Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/96/05c7434d88185e5d27fe54aeb74df86bd77cd79f52f0b4eae54faa8fea70/regex-2026.5.9-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:97cf3bc1b7d7d2306772ec07366c80d9df00ff79e79cea32898883a646d2fae2", size = 854473, upload-time = "2026-05-09T23:12:22.465Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/c1/6e3d8202d981f3117004bf341ee74893ba4ba8a9fbaf4b94615846550a08/regex-2026.5.9-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:0f9eede6a5cbdc02d4978090186390936e1776a7d1359b21e41014c609880bcf", size = 763311, upload-time = "2026-05-09T23:12:24.351Z" },
+    { url = "https://files.pythonhosted.org/packages/93/c7/e7737f1526b3fb32bd4c337fd6c71c3ebb5c8296fc34d11197e0955d2e35/regex-2026.5.9-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:01f0f5f55f4b64dacec85dc116d3c05fd23ad3ff037bbc73a2085775953c2611", size = 844593, upload-time = "2026-05-09T23:12:26.341Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/27/0daffb1a535bb39f422c3d200f4ab023c71110ad66a32b366bee708baba0/regex-2026.5.9-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1268eddd8486dc561d08eee1156e40aa3a8fe10f4bdec8fa653b455fcbffd12c", size = 789167, upload-time = "2026-05-09T23:12:27.975Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/fc/294fe4fac4f2ed67207b17471815870c1c45b3a489e08e0ac96daea16ef6/regex-2026.5.9-cp311-cp311-win32.whl", hash = "sha256:8676474c07469d6f33dd1085ca2cd45f65785f32518f2b20e36d9953ca07f994", size = 266249, upload-time = "2026-05-09T23:12:30.141Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/b0/8dce459f6245bcf8f6e9f23ac9569f1a0f15c131cc0745e82b43226204cf/regex-2026.5.9-cp311-cp311-win_amd64.whl", hash = "sha256:246de9d60aa3f8538b519834dd95cbf276ea263d6a7bd5a3666dc3fa0230505b", size = 278423, upload-time = "2026-05-09T23:12:31.676Z" },
+    { url = "https://files.pythonhosted.org/packages/db/8d/f9aeff6ad63a3ef720386f2907e6d34a35a510a6e498ebad28b0fb3f6ab6/regex-2026.5.9-cp311-cp311-win_arm64.whl", hash = "sha256:d726ca3f0d76969bf1e8e477d160d3d666bbf999f6860bd314889e5345782046", size = 270420, upload-time = "2026-05-09T23:12:33.194Z" },
+    { url = "https://files.pythonhosted.org/packages/50/9b/6550044bc44e17c84d312c031c2ec42fbdb6a4ec4e29093be3a172d08772/regex-2026.5.9-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:57eeeb05db7979413dec5438f2db21d7ecbba787cde7a711df1a6f6df672aa06", size = 490451, upload-time = "2026-05-09T23:12:34.72Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/95/fc7ba4303b5a0f92446a12ee6778ef2c6c799233f5060042a31bf390cfe9/regex-2026.5.9-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:398c521292f4c7fb807001dcd54694d3a1fcafc179a36ad9cc56f98df85930b6", size = 292112, upload-time = "2026-05-09T23:12:36.285Z" },
+    { url = "https://files.pythonhosted.org/packages/54/4b/ee27938d1b2c443e89a9a10e00d2d19aa5ee300cd3d61140644e93bb083e/regex-2026.5.9-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f7a7c26137296beba7784de6eba69c6a93a63ccebc385e4962fe67e267a91225", size = 289599, upload-time = "2026-05-09T23:12:38.089Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/dd/ba103dc19614e25f3880800ca67ce093d6e21b325d72b8383c7bf906e9fa/regex-2026.5.9-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6441cc660d76107934a09c22167200839a0e89604a6297f78a974e66e931d2c0", size = 796732, upload-time = "2026-05-09T23:12:40.062Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/e7/f035b4fd858b050b0080bf302968dc0f59ba34e391872d54936758e6844e/regex-2026.5.9-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:91328f1c23d47595ca3ef0a7557fa129c5a23404b775c770697d2f35b33e0107", size = 865440, upload-time = "2026-05-09T23:12:42.059Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/51/8cd301ecc899aea28124357f729f4272f44de7806fc7ca02490bfbe253e8/regex-2026.5.9-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:93a7860539414dddaefba2b40f8771765ae17949d4c7182b876ce429e11a8309", size = 912329, upload-time = "2026-05-09T23:12:44.373Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/1e/3fbe2fa1e8cebd62f3bb7d3321cff1640aca2e240b51d9bd624aad949260/regex-2026.5.9-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:dd2810d22146b6d838acc5ec15602cb6b47920aa4e33015df3868eedfd20bab8", size = 801239, upload-time = "2026-05-09T23:12:46.268Z" },
+    { url = "https://files.pythonhosted.org/packages/17/2f/6f6008682bf2cf98040a0d3153a8e557b6ab728d7713d045cee4ce544ab8/regex-2026.5.9-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:daff2bdbaf1d23e52fdff7c0b7bc2048b68f978df6a4d107ac981f94caef2e66", size = 777054, upload-time = "2026-05-09T23:12:48.051Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2b/eee0d20a6842ba04df4b8847a920b57ef56853f14ef85405473e586b605a/regex-2026.5.9-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4eeb011098fcb77af513dcef521a3dbecbf8849b1e38940759d293b7a93f5026", size = 785098, upload-time = "2026-05-09T23:12:49.851Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/98/6fc1e6410feefb92159edaed5041992bfe390e8d26c721865434acbca558/regex-2026.5.9-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:ea9c8ecfa1b73c73b626534d6626e5340d429630943672b8480724f44e84b962", size = 860095, upload-time = "2026-05-09T23:12:51.666Z" },
+    { url = "https://files.pythonhosted.org/packages/18/a3/bd855e0f2cb1a978ecf6fa6bb69632dd9c3f6ea3b81cde62fde14c9daec7/regex-2026.5.9-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:cd2846168eb9ee3c513902bc8225409cb1caab31d04728b145171fa1625d9621", size = 765762, upload-time = "2026-05-09T23:12:53.413Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/66/0ae8c092e60b14c79d24f8e0b7f0aea5bfbffdcab00b5483d13404d3c3a5/regex-2026.5.9-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:39617fb0cde9c0e6306dc70e3bfc096f3da793219879f7ae7aa341a69fbdcf6d", size = 852100, upload-time = "2026-05-09T23:12:55.256Z" },
+    { url = "https://files.pythonhosted.org/packages/21/de/8dfde60fc1b21c946a893ba273403b72617edb261370cb1087099a83f088/regex-2026.5.9-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fd03c4f0e33280d15cae17159b899245d6b7c53d21def19b263b39655061f5ce", size = 789479, upload-time = "2026-05-09T23:12:57.573Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/1c/bdcc98f9a4af4fdd166c74941174619ccff4726d3ce32faa8e9a2ecd38dd/regex-2026.5.9-cp312-cp312-win32.whl", hash = "sha256:164eba9b755ea6f244b0d881196fbc1fac09714e9782c9e2732b813142033c8e", size = 266699, upload-time = "2026-05-09T23:12:59.14Z" },
+    { url = "https://files.pythonhosted.org/packages/78/87/240d36864f9e48ace85f72e79ced97ceb7f27ce87739a947dcb834b4e6bc/regex-2026.5.9-cp312-cp312-win_amd64.whl", hash = "sha256:86f40a5d6444db30a125c9c9177e6b25dad981cbc37451fd838f145e6edac92e", size = 277783, upload-time = "2026-05-09T23:13:00.789Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/b5/7b30f312b0669dff5beebe5b0989dc2d1a312b1a44fab852199c387a5b96/regex-2026.5.9-cp312-cp312-win_arm64.whl", hash = "sha256:96f5f58b54a063d7ea9dca08e1cf57bfe10499c4d579ee672da284f57f5f0070", size = 270513, upload-time = "2026-05-09T23:13:02.426Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/da/797e91ecec6f84135da778ddce78c20e0af5d2a15c26f87a81bc3eadb6db/regex-2026.5.9-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:d626b84406444b165fc0ba981604edea39f0588ff1f92baa23fe50799ea9afdb", size = 490303, upload-time = "2026-05-09T23:13:04.382Z" },
+    { url = "https://files.pythonhosted.org/packages/44/da/bf30abaaa737b58f4a4b8c4a03659e02fd92092c822e0197ed9e0daab917/regex-2026.5.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:d7bdc0ab8f3dd7e1b4f9ab88634e13374669db86bb3c72e8292f07ae313f539f", size = 292019, upload-time = "2026-05-09T23:13:06.022Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/e7/d0eaf5713828417b9e5648cf81fa9bacd4961f6ab98c380c2034f8716e35/regex-2026.5.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a8820737949116ffff55fe18f9fc644530063ba6ebfcb8314239416e78f1347c", size = 289468, upload-time = "2026-05-09T23:13:08.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/9b/b3fdd62b003baa1a9b593cd8c8699c9651c2e80cc21a5c715707983c42d7/regex-2026.5.9-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:aa0fbdbac82cb3e4450d0ccde7d7a35607f4cb2dd9fba4b8b69bfaf8c9fa6aed", size = 796749, upload-time = "2026-05-09T23:13:10.573Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/30/66ab84588765f5b4b271a9ca09ef7ce2b87caa95176ec3d2ad65d7bc4902/regex-2026.5.9-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:57e8915c7986aa33d25e4d3629cef711cd2863f2961b10409f0c04cb8b7d9020", size = 865445, upload-time = "2026-05-09T23:13:12.523Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/89/f05169e8588aac365f35ffc7f3bc3184f095ef4cfded7cfaa3c7fd5dbd89/regex-2026.5.9-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:508f56a89ba9cb26e4168cbc37dbd60a28d82430a9e18ad1d25fe0883c314ca2", size = 912322, upload-time = "2026-05-09T23:13:14.281Z" },
+    { url = "https://files.pythonhosted.org/packages/30/e1/c93444052cf41581f3c884ab3fb5823daf0992f11cd4388d4275ca610558/regex-2026.5.9-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b6d189041f15691cfa2b6c4290448ec221244d225b3f5fe9e7771b34ffcdf6e2", size = 801269, upload-time = "2026-05-09T23:13:16.569Z" },
+    { url = "https://files.pythonhosted.org/packages/50/fe/0cf96b882f540e62e8b9956599798203d599c44cf4c77917ca27400ff69b/regex-2026.5.9-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e82db382b44d0111b22601c509c89f64434816c9e0eef9d1989cda8cc6ff1c04", size = 777085, upload-time = "2026-05-09T23:13:18.675Z" },
+    { url = "https://files.pythonhosted.org/packages/23/5c/d78d4924e7fc875557b9e9b768423925fdfaac5549d06da7810019a9bd26/regex-2026.5.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2acfb48634f64996b57f90f39afa692ff362162722581921fe92239a59960f3c", size = 785153, upload-time = "2026-05-09T23:13:20.525Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/e0/5214774090e7b4524dcea3e3c4aa74141d43043f8beb49c1599db1c8b53a/regex-2026.5.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:d29eebfc9525db68cad3c97eedd7f754fa265aa5cd0cf4f863b2421e1b48fc9f", size = 860164, upload-time = "2026-05-09T23:13:22.263Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/e1/4a57a83350319b1271f0d7a249b8672513ed928b237a741631270de6caea/regex-2026.5.9-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:debb893095e944091c16e641a6e33c1b0f4cb61ab945ec5afbf53ce7068834d8", size = 765731, upload-time = "2026-05-09T23:13:24.277Z" },
+    { url = "https://files.pythonhosted.org/packages/12/f4/499e74a20c156fc75836ee04a72a38d1a063978f600937f9760467beb1b0/regex-2026.5.9-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:d659eee77986549c9ea45b861c7567e44d6287c3dc9a4565478853f7b9fe2ff6", size = 852062, upload-time = "2026-05-09T23:13:26.125Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/92/7eebc0d0a01e78629695f342ba17e0deaff8fb45e79cc0d7b98287da6e3e/regex-2026.5.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2efa205e6d98b24d1f3ab395c11aa15cdf10935bca283d0285e0499c284fba21", size = 789577, upload-time = "2026-05-09T23:13:27.814Z" },
+    { url = "https://files.pythonhosted.org/packages/05/a4/018e71f7d2ad48c1ebe6d3ae0026f9b7cb4802fd15c7cc02fdf724355102/regex-2026.5.9-cp313-cp313-win32.whl", hash = "sha256:f3844f134e834076677dd369976e9f5068679fcb8e50102fdf6b7ac96a3ec127", size = 266691, upload-time = "2026-05-09T23:13:29.549Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/1d/861a93719fb9ee7dbfc3761b3797b7a3e112a5d42c6129459d2d741be9b5/regex-2026.5.9-cp313-cp313-win_amd64.whl", hash = "sha256:3527bb4942d2c14552155406cdedd906567456821848aed1cb4933a391bf5eca", size = 277747, upload-time = "2026-05-09T23:13:31.859Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/c6/0a2436ae4da1ba76e51cb98943c6838a9a721faa40ebe2dce07694ae34e3/regex-2026.5.9-cp313-cp313-win_arm64.whl", hash = "sha256:56a33f191f17d8c417f99945ebdc1e691d3af9605d86ec68c7e54a57e3e17af6", size = 270500, upload-time = "2026-05-09T23:13:33.525Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/e9/d21346f7b60ed58789371358ed66b09d00f832e1bd7c06e55d9da5679882/regex-2026.5.9-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:01f28d868834624c934b8d2e0aa1c8341337e37831f4a012f18a5afcba4cbaf3", size = 494172, upload-time = "2026-05-09T23:13:35.935Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/43/fd1177a2032037c681baecdb3422ee4e1424aec4e4f470ef47793d325274/regex-2026.5.9-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:48036f6374aaa79eb3b754ec29c61d1c6b1606749d705a13f8854fa2539671f6", size = 293952, upload-time = "2026-05-09T23:13:38.307Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7d/9fbf919768368d3f8a4f6c692cf2aa61e482b2b81ec6a298ace4cbf02480/regex-2026.5.9-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:b96350aa424e79d4fd6b567b344dcbe2b2d6bfc48dfe7717587e1fa6d43da6ff", size = 292314, upload-time = "2026-05-09T23:13:40.353Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/6c/e41bfeecb589716843e7c4df09ba46ff2a42961457afece19059d85caeef/regex-2026.5.9-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8f3af7a4903c5c04a11a196a5aa75cdd7dd3f8508132f9fb3259d9f5908e3b88", size = 811681, upload-time = "2026-05-09T23:13:42.543Z" },
+    { url = "https://files.pythonhosted.org/packages/87/83/a5c1c525fba0aa656e88ad0face0b1829788ef4c2fb6b26df58aa1151b84/regex-2026.5.9-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7e87577720152d2caae19fe2baaf1f8d5ca12091e9e229f03915c37d1e4b9178", size = 871135, upload-time = "2026-05-09T23:13:44.326Z" },
+    { url = "https://files.pythonhosted.org/packages/18/d4/80882e799e440dd878b0979cbebf8fa4d54624a332c83037c7a701649e3f/regex-2026.5.9-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c8b9b9d294cfea3cd19c718ade7cc93492b2c4991abd9a68d0b3477ae6d8e100", size = 917265, upload-time = "2026-05-09T23:13:47.295Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ff/8db60211e2286e396aad7dc7725356c502bff0901ea05bd6cdc2e1a042b9/regex-2026.5.9-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:728d8bfd28a8845c8b6bc5dc7ce010453d206396786c0765c2740cb65f37791e", size = 816311, upload-time = "2026-05-09T23:13:49.885Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/47/742ef579c61730f8d268e5cf1f9ce0e37e2ea041ad0f5644724f2378e463/regex-2026.5.9-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7e30b874d341fac767d7df5a0870540541c2c054b80cfaac116e8d367a8a7ff2", size = 785498, upload-time = "2026-05-09T23:13:52.25Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/ab/cb0999802dcb0fb95b1ab005e8d4163d8afdd67efc2cb6b6630ac13f8cb1/regex-2026.5.9-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:fd190e88a895a8901325fad284a3f74ea52b1da8525b76cc811fa9b1edf0ce2b", size = 801348, upload-time = "2026-05-09T23:13:54.127Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/8ca59a24c55bc34d166eefaf3717bd77772f329fdbf984d86581e0a3571c/regex-2026.5.9-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:8e76e8161ad00694cfce6767d5dea860c6391ac5b83e5c3a39661e696f11fc7e", size = 866493, upload-time = "2026-05-09T23:13:56.067Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/3d/30f2ae62cef3278bb5bb821f467277a55fb73f01032cf85997e15e8289a8/regex-2026.5.9-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:ddda5340e6c01a293027dd46232fa79eaff1b48058ce7a98f572b6445b088041", size = 772811, upload-time = "2026-05-09T23:13:57.867Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/ae/7d2089bcd78ad0c0161bc684339df50032acb438a7bd3305e7ddb1193cec/regex-2026.5.9-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:205109e96b3cf5adf8f4cd62bedde9487feb282b9497a3535451e5a24cd706a0", size = 856584, upload-time = "2026-05-09T23:13:59.679Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/29/92ff47f75990131ea4f24ba17819e5a9d141e10819807e09addd73409af6/regex-2026.5.9-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dfbe4579b9f08036aa7d101d1835437a20783574ac66327e6b29b4018a138081", size = 803453, upload-time = "2026-05-09T23:14:01.978Z" },
+    { url = "https://files.pythonhosted.org/packages/04/99/eff29f1037dcab36702c9ee5d6858cf1ce2336ea8ea2987f64245b99ea5e/regex-2026.5.9-cp313-cp313t-win32.whl", hash = "sha256:ed2c9e8068b614c574d8d30e543d617cf5379b0535d46f97ef00e904745a08b5", size = 269951, upload-time = "2026-05-09T23:14:03.661Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/9d/8870b8981d27b22cda77bb26a5ac7ebfa9c7d9e0dea195a834a82380e748/regex-2026.5.9-cp313-cp313t-win_amd64.whl", hash = "sha256:b46b0f094dc1d3b90356c85a0bd2c9bafc4a6a190b9d6f8ddd5a033b6e088ed4", size = 281240, upload-time = "2026-05-09T23:14:05.56Z" },
+    { url = "https://files.pythonhosted.org/packages/72/b1/3379415e8f135c13ac551353397cc4fe97b4978f3cac73c5fcbcded548b8/regex-2026.5.9-cp313-cp313t-win_arm64.whl", hash = "sha256:872acc074bd29ffc9913ecdfedf6ea77502312ca44a4aa0d3779089c6069d8de", size = 272383, upload-time = "2026-05-09T23:14:07.843Z" },
+]
+
+[[package]]
+name = "rich"
+version = "15.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markdown-it-py" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c0/8f/0722ca900cc807c13a6a0c696dacf35430f72e0ec571c4275d2371fca3e9/rich-15.0.0.tar.gz", hash = "sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36", size = 230680, upload-time = "2026-04-12T08:24:00.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/82/3b/64d4899d73f91ba49a8c18a8ff3f0ea8f1c1d75481760df8c68ef5235bf5/rich-15.0.0-py3-none-any.whl", hash = "sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb", size = 310654, upload-time = "2026-04-12T08:24:02.83Z" },
+]
+
+[[package]]
+name = "safetensors"
+version = "0.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/29/9c/6e74567782559a63bd040a236edca26fd71bc7ba88de2ef35d75df3bca5e/safetensors-0.7.0.tar.gz", hash = "sha256:07663963b67e8bd9f0b8ad15bb9163606cd27cc5a1b96235a50d8369803b96b0", size = 200878, upload-time = "2025-11-19T15:18:43.199Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fa/47/aef6c06649039accf914afef490268e1067ed82be62bcfa5b7e886ad15e8/safetensors-0.7.0-cp38-abi3-macosx_10_12_x86_64.whl", hash = "sha256:c82f4d474cf725255d9e6acf17252991c3c8aac038d6ef363a4bf8be2f6db517", size = 467781, upload-time = "2025-11-19T15:18:35.84Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/00/374c0c068e30cd31f1e1b46b4b5738168ec79e7689ca82ee93ddfea05109/safetensors-0.7.0-cp38-abi3-macosx_11_0_arm64.whl", hash = "sha256:94fd4858284736bb67a897a41608b5b0c2496c9bdb3bf2af1fa3409127f20d57", size = 447058, upload-time = "2025-11-19T15:18:34.416Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/06/578ffed52c2296f93d7fd2d844cabfa92be51a587c38c8afbb8ae449ca89/safetensors-0.7.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e07d91d0c92a31200f25351f4acb2bc6aff7f48094e13ebb1d0fb995b54b6542", size = 491748, upload-time = "2025-11-19T15:18:09.79Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/33/1debbbb70e4791dde185edb9413d1fe01619255abb64b300157d7f15dddd/safetensors-0.7.0-cp38-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8469155f4cb518bafb4acf4865e8bb9d6804110d2d9bdcaa78564b9fd841e104", size = 503881, upload-time = "2025-11-19T15:18:16.145Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/1c/40c2ca924d60792c3be509833df711b553c60effbd91da6f5284a83f7122/safetensors-0.7.0-cp38-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:54bef08bf00a2bff599982f6b08e8770e09cc012d7bba00783fc7ea38f1fb37d", size = 623463, upload-time = "2025-11-19T15:18:21.11Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/3a/13784a9364bd43b0d61eef4bea2845039bc2030458b16594a1bd787ae26e/safetensors-0.7.0-cp38-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:42cb091236206bb2016d245c377ed383aa7f78691748f3bb6ee1bfa51ae2ce6a", size = 532855, upload-time = "2025-11-19T15:18:25.719Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/60/429e9b1cb3fc651937727befe258ea24122d9663e4d5709a48c9cbfceecb/safetensors-0.7.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dac7252938f0696ddea46f5e855dd3138444e82236e3be475f54929f0c510d48", size = 507152, upload-time = "2025-11-19T15:18:33.023Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/a8/4b45e4e059270d17af60359713ffd83f97900d45a6afa73aaa0d737d48b6/safetensors-0.7.0-cp38-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:1d060c70284127fa805085d8f10fbd0962792aed71879d00864acda69dbab981", size = 541856, upload-time = "2025-11-19T15:18:31.075Z" },
+    { url = "https://files.pythonhosted.org/packages/06/87/d26d8407c44175d8ae164a95b5a62707fcc445f3c0c56108e37d98070a3d/safetensors-0.7.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:cdab83a366799fa730f90a4ebb563e494f28e9e92c4819e556152ad55e43591b", size = 674060, upload-time = "2025-11-19T15:18:37.211Z" },
+    { url = "https://files.pythonhosted.org/packages/11/f5/57644a2ff08dc6325816ba7217e5095f17269dada2554b658442c66aed51/safetensors-0.7.0-cp38-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:672132907fcad9f2aedcb705b2d7b3b93354a2aec1b2f706c4db852abe338f85", size = 771715, upload-time = "2025-11-19T15:18:38.689Z" },
+    { url = "https://files.pythonhosted.org/packages/86/31/17883e13a814bd278ae6e266b13282a01049b0c81341da7fd0e3e71a80a3/safetensors-0.7.0-cp38-abi3-musllinux_1_2_i686.whl", hash = "sha256:5d72abdb8a4d56d4020713724ba81dac065fedb7f3667151c4a637f1d3fb26c0", size = 714377, upload-time = "2025-11-19T15:18:40.162Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d8/0c8a7dc9b41dcac53c4cbf9df2b9c83e0e0097203de8b37a712b345c0be5/safetensors-0.7.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:b0f6d66c1c538d5a94a73aa9ddca8ccc4227e6c9ff555322ea40bdd142391dd4", size = 677368, upload-time = "2025-11-19T15:18:41.627Z" },
+    { url = "https://files.pythonhosted.org/packages/05/e5/cb4b713c8a93469e3c5be7c3f8d77d307e65fe89673e731f5c2bfd0a9237/safetensors-0.7.0-cp38-abi3-win32.whl", hash = "sha256:c74af94bf3ac15ac4d0f2a7c7b4663a15f8c2ab15ed0fc7531ca61d0835eccba", size = 326423, upload-time = "2025-11-19T15:18:45.74Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/e6/ec8471c8072382cb91233ba7267fd931219753bb43814cbc71757bfd4dab/safetensors-0.7.0-cp38-abi3-win_amd64.whl", hash = "sha256:d1239932053f56f3456f32eb9625590cc7582e905021f94636202a864d470755", size = 341380, upload-time = "2025-11-19T15:18:44.427Z" },
+]
+
+[[package]]
+name = "shellingham"
+version = "1.5.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/58/15/8b3609fd3830ef7b27b655beb4b4e9c62313a4e8da8c676e142cc210d58e/shellingham-1.5.4.tar.gz", hash = "sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de", size = 10310, upload-time = "2023-10-24T04:13:40.426Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e0/f9/0595336914c5619e5f28a1fb793285925a8cd4b432c9da0a987836c7f822/shellingham-1.5.4-py2.py3-none-any.whl", hash = "sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686", size = 9755, upload-time = "2023-10-24T04:13:38.866Z" },
+]
+
+[[package]]
+name = "siglip2-triton-server"
+version = "0.1.0"
+source = { virtual = "." }
+dependencies = [
+    { name = "numpy" },
+    { name = "pillow" },
+    { name = "starlette" },
+    { name = "tokenizers" },
+    { name = "transformers" },
+    { name = "urllib3" },
+    { name = "wheel" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "numpy" },
+    { name = "pillow", specifier = ">=12.3.0" },
+    { name = "starlette", specifier = ">=1.3.1" },
+    { name = "tokenizers", specifier = ">=0.22.2" },
+    { name = "transformers", specifier = ">=4.57.1" },
+    { name = "urllib3", specifier = ">=2.7.0" },
+    { name = "wheel", specifier = ">=0.46.3" },
+]
+
+[[package]]
+name = "starlette"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/eb/e3/7c1dc7381d9f8ab7d854328ebfa884e62cb3f3d8549ddfd37c7814f42afa/starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0", size = 2703240, upload-time = "2026-06-12T09:23:11.602Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/bb/2799cc2ede3ed41131f8975621e7213dfc7ef4acbbaadfa440f32500c370/starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6", size = 73632, upload-time = "2026-06-12T09:23:10.017Z" },
+]
+
+[[package]]
+name = "tokenizers"
+version = "0.22.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "huggingface-hub" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/73/6f/f80cfef4a312e1fb34baf7d85c72d4411afde10978d4657f8cdd811d3ccc/tokenizers-0.22.2.tar.gz", hash = "sha256:473b83b915e547aa366d1eee11806deaf419e17be16310ac0a14077f1e28f917", size = 372115, upload-time = "2026-01-05T10:45:15.988Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/92/97/5dbfabf04c7e348e655e907ed27913e03db0923abb5dfdd120d7b25630e1/tokenizers-0.22.2-cp39-abi3-macosx_10_12_x86_64.whl", hash = "sha256:544dd704ae7238755d790de45ba8da072e9af3eea688f698b137915ae959281c", size = 3100275, upload-time = "2026-01-05T10:41:02.158Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/47/174dca0502ef88b28f1c9e06b73ce33500eedfac7a7692108aec220464e7/tokenizers-0.22.2-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:1e418a55456beedca4621dbab65a318981467a2b188e982a23e117f115ce5001", size = 2981472, upload-time = "2026-01-05T10:41:00.276Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/84/7990e799f1309a8b87af6b948f31edaa12a3ed22d11b352eaf4f4b2e5753/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2249487018adec45d6e3554c71d46eb39fa8ea67156c640f7513eb26f318cec7", size = 3290736, upload-time = "2026-01-05T10:40:32.165Z" },
+    { url = "https://files.pythonhosted.org/packages/78/59/09d0d9ba94dcd5f4f1368d4858d24546b4bdc0231c2354aa31d6199f0399/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:25b85325d0815e86e0bac263506dd114578953b7b53d7de09a6485e4a160a7dd", size = 3168835, upload-time = "2026-01-05T10:40:38.847Z" },
+    { url = "https://files.pythonhosted.org/packages/47/50/b3ebb4243e7160bda8d34b731e54dd8ab8b133e50775872e7a434e524c28/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:bfb88f22a209ff7b40a576d5324bf8286b519d7358663db21d6246fb17eea2d5", size = 3521673, upload-time = "2026-01-05T10:40:56.614Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/fa/89f4cb9e08df770b57adb96f8cbb7e22695a4cb6c2bd5f0c4f0ebcf33b66/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1c774b1276f71e1ef716e5486f21e76333464f47bece56bbd554485982a9e03e", size = 3724818, upload-time = "2026-01-05T10:40:44.507Z" },
+    { url = "https://files.pythonhosted.org/packages/64/04/ca2363f0bfbe3b3d36e95bf67e56a4c88c8e3362b658e616d1ac185d47f2/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:df6c4265b289083bf710dff49bc51ef252f9d5be33a45ee2bed151114a56207b", size = 3379195, upload-time = "2026-01-05T10:40:51.139Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/76/932be4b50ef6ccedf9d3c6639b056a967a86258c6d9200643f01269211ca/tokenizers-0.22.2-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:369cc9fc8cc10cb24143873a0d95438bb8ee257bb80c71989e3ee290e8d72c67", size = 3274982, upload-time = "2026-01-05T10:40:58.331Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/28/5f9f5a4cc211b69e89420980e483831bcc29dade307955cc9dc858a40f01/tokenizers-0.22.2-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:29c30b83d8dcd061078b05ae0cb94d3c710555fbb44861139f9f83dcca3dc3e4", size = 9478245, upload-time = "2026-01-05T10:41:04.053Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/fb/66e2da4704d6aadebf8cb39f1d6d1957df667ab24cff2326b77cda0dcb85/tokenizers-0.22.2-cp39-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:37ae80a28c1d3265bb1f22464c856bd23c02a05bb211e56d0c5301a435be6c1a", size = 9560069, upload-time = "2026-01-05T10:45:10.673Z" },
+    { url = "https://files.pythonhosted.org/packages/16/04/fed398b05caa87ce9b1a1bb5166645e38196081b225059a6edaff6440fac/tokenizers-0.22.2-cp39-abi3-musllinux_1_2_i686.whl", hash = "sha256:791135ee325f2336f498590eb2f11dc5c295232f288e75c99a36c5dbce63088a", size = 9899263, upload-time = "2026-01-05T10:45:12.559Z" },
+    { url = "https://files.pythonhosted.org/packages/05/a1/d62dfe7376beaaf1394917e0f8e93ee5f67fea8fcf4107501db35996586b/tokenizers-0.22.2-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:38337540fbbddff8e999d59970f3c6f35a82de10053206a7562f1ea02d046fa5", size = 10033429, upload-time = "2026-01-05T10:45:14.333Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/18/a545c4ea42af3df6effd7d13d250ba77a0a86fb20393143bbb9a92e434d4/tokenizers-0.22.2-cp39-abi3-win32.whl", hash = "sha256:a6bf3f88c554a2b653af81f3204491c818ae2ac6fbc09e76ef4773351292bc92", size = 2502363, upload-time = "2026-01-05T10:45:20.593Z" },
+    { url = "https://files.pythonhosted.org/packages/65/71/0670843133a43d43070abeb1949abfdef12a86d490bea9cd9e18e37c5ff7/tokenizers-0.22.2-cp39-abi3-win_amd64.whl", hash = "sha256:c9ea31edff2968b44a88f97d784c2f16dc0729b8b143ed004699ebca91f05c48", size = 2747786, upload-time = "2026-01-05T10:45:18.411Z" },
+    { url = "https://files.pythonhosted.org/packages/72/f4/0de46cfa12cdcbcd464cc59fde36912af405696f687e53a091fb432f694c/tokenizers-0.22.2-cp39-abi3-win_arm64.whl", hash = "sha256:9ce725d22864a1e965217204946f830c37876eee3b2ba6fc6255e8e903d5fcbc", size = 2612133, upload-time = "2026-01-05T10:45:17.232Z" },
+]
+
+[[package]]
+name = "tqdm"
+version = "4.67.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/09/a9/6ba95a270c6f1fbcd8dac228323f2777d886cb206987444e4bce66338dd4/tqdm-4.67.3.tar.gz", hash = "sha256:7d825f03f89244ef73f1d4ce193cb1774a8179fd96f31d7e1dcde62092b960bb", size = 169598, upload-time = "2026-02-03T17:35:53.048Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/16/e1/3079a9ff9b8e11b846c6ac5c8b5bfb7ff225eee721825310c91b3b50304f/tqdm-4.67.3-py3-none-any.whl", hash = "sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf", size = 78374, upload-time = "2026-02-03T17:35:50.982Z" },
+]
+
+[[package]]
+name = "transformers"
+version = "5.8.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "huggingface-hub" },
+    { name = "numpy" },
+    { name = "packaging" },
+    { name = "pyyaml" },
+    { name = "regex" },
+    { name = "safetensors" },
+    { name = "tokenizers" },
+    { name = "tqdm" },
+    { name = "typer" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e7/e6/4134ea2fbea322cddc7ffc94a0d8ee47fe32ce8e876b320cd37d88edfc4d/transformers-5.8.1.tar.gz", hash = "sha256:4dd5b6de4105725104d84fd6abd74b305f4debfc251b38c648ee5dd087cf543b", size = 8532019, upload-time = "2026-05-13T03:21:57.234Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fc/b1/8be7e7ef0b5200491312201918b6125ef9c9df9dd0f0240ccef9ac824e6b/transformers-5.8.1-py3-none-any.whl", hash = "sha256:5340fb95962162cdfdae5cc91d7f8fedd92ed75216c1154c5e1f590fcf56dd0e", size = 10632882, upload-time = "2026-05-13T03:21:52.876Z" },
+]
+
+[[package]]
+name = "typer"
+version = "0.25.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-doc" },
+    { name = "click" },
+    { name = "rich" },
+    { name = "shellingham" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e4/51/9aed62104cea109b820bbd6c14245af756112017d309da813ef107d42e7e/typer-0.25.1.tar.gz", hash = "sha256:9616eb8853a09ffeabab1698952f33c6f29ffdbceb4eaeecf571880e8d7664cc", size = 122276, upload-time = "2026-04-30T19:32:16.964Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3f/f9/2b3ff4e56e5fa7debfaf9eb135d0da96f3e9a1d5b27222223c7296336e5f/typer-0.25.1-py3-none-any.whl", hash = "sha256:75caa44ed46a03fb2dab8808753ffacdbfea88495e74c85a28c5eefcf5f39c89", size = 58409, upload-time = "2026-04-30T19:32:18.271Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+]
+
+[[package]]
+name = "wheel"
+version = "0.47.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/39/62/75f18a0f03b4219c456652c7780e4d749b929eb605c098ce3a5b6b6bc081/wheel-0.47.0.tar.gz", hash = "sha256:cc72bd1009ba0cf63922e28f94d9d83b920aa2bb28f798a31d0691b02fa3c9b3", size = 63854, upload-time = "2026-04-22T15:51:27.727Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/87/1b/9e33c09813d65e248f7f773119148a612516a4bea93e9c6f545f78455b7c/wheel-0.47.0-py3-none-any.whl", hash = "sha256:212281cab4dff978f6cedd499cd893e1f620791ca6ff7107cf270781e587eced", size = 32218, upload-time = "2026-04-22T15:51:26.296Z" },
+]

docker/hf-space/supervisord-gpu.conf

@@ -0,0 +1,113 @@
+; GPU variant of supervisord.conf (docker/Dockerfile.hf-space-gpu): the same
+; six programs as the NVCF/cpu-basic variant, plus [program:siglip2-triton]
+; (restores its ONNX weights from S3, then execs the local siglip2-triton
+; server — see its own comment), and deepsearch-api's own command
+; additionally waits on Triton's readiness before execing uvicorn — same
+; "poll a real endpoint the process only starts once ready" idiom already
+; used below for neo4j/opensearch. See
+; docs/plans/siglip2-embedded-hf-space.md for the decision behind this file.
+; Verified live end to end (2026-09-23), including through a real bake.py
+; run and its own --gpus all smoke test.
+
+[supervisord]
+nodaemon=true
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+[program:opensearch]
+command=/usr/share/opensearch/opensearch-docker-entrypoint.sh opensearch
+directory=/usr/share/opensearch
+user=1000
+autorestart=true
+startsecs=5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:redis]
+command=/usr/bin/redis-server --port 6379 --databases 32 --save "" --stop-writes-on-bgsave-error no --dir /tmp
+user=1000
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:siglip2-triton]
+; This program's command *is* pipeline/hf_space_seed.py --component=siglip2-model,
+; not tritonserver itself — same "restore then exec into the real process"
+; shape as [program:neo4j] below, for the same reason: the ~3.6 GB SigLIP2
+; ONNX encoder weights aren't baked into the image (HF Space git repos cap
+; storage at 1 GB by default — verified live, a real deploy blew through it)
+; so they're synced from the artifact S3 bucket here before tritonserver
+; execs — see that script's own docstring. The exec'd tritonserver command
+; (SIGLIP2_TRITON_CMD in hf_space_seed.py) --http-ports off Triton's own
+; default (8000) because deepsearch-api's own uvicorn already binds
+; 127.0.0.1:8000 in this same container — only the gRPC port (8001,
+; Triton's default, unchanged) is actually used by the siglip2-triton-client
+; wheel deepsearch-api talks through; the HTTP port is kept (not disabled)
+; only so this program's own readiness can be polled the same curl-based
+; way every other program here is. Nothing here is bound beyond localhost
+; in effect anyway — nginx is the sole externally-proxied process in this
+; image, same as every other backend.
+command=/bin/sh -c "cd /app/hf-space-pipeline && exec /app/.venv/bin/python -m pipeline.hf_space_seed --component=siglip2-model"
+directory=/app/hf-space-pipeline
+user=root
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:neo4j]
+command=/bin/sh -c "cd /app/hf-space-pipeline && exec /app/.venv/bin/python -m pipeline.hf_space_seed --component=neo4j"
+directory=/app/hf-space-pipeline
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:asset-graph-service]
+command=/bin/sh -c "until curl -sf http://localhost:7474 >/dev/null 2>&1; do sleep 2; done; exec /app/.venv/bin/python -m uvicorn asset_graph_service.api:app --host 127.0.0.1 --port 8010"
+environment=DB_URI="neo4j://localhost:7687",DB_USERNAME="neo4j",DB_PASSWORD="none",ACCEPT_EULA="Y",OTEL_SDK_DISABLED="true"
+directory=/app
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:deepsearch-api]
+; Waits on siglip2-triton's own readiness (via its remapped HTTP port,
+; 8003 — see [program:siglip2-triton] above) in addition to running
+; pipeline/hf_space_seed.py, same "don't exec uvicorn until every backend
+; this process depends on is actually ready" rule the cpu-basic/NVCF
+; variant already follows for OpenSearch.
+command=/bin/sh -c "until curl -sf http://localhost:8003/v2/health/ready >/dev/null 2>&1; do sleep 2; done; cd /app/hf-space-pipeline && /app/.venv/bin/python -m pipeline.hf_space_seed && cd /app && exec /app/.venv/bin/python -m uvicorn deepsearch_api.main:app --host 127.0.0.1 --port 8000"
+directory=/app
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:nginx]
+command=/bin/sh -c "until curl -sf http://localhost:8000/health >/dev/null 2>&1 && curl -sf http://localhost:8010/docs >/dev/null 2>&1; do sleep 2; done; sed -e 's/__PORT__/%(ENV_PORT)s/' -e 's|__CORPUS_NAME__|%(ENV_CORPUS_NAME)s|g' /etc/nginx/hf-space.conf.template > /etc/nginx/conf.d/hf-space.conf && exec nginx -g 'daemon off;'"
+user=root
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

docker/hf-space/supervisord.conf

@@ -0,0 +1,130 @@
+; Runs the MVP single-container stack (OpenSearch + Neo4j + Redis +
+; deepsearch-api + asset-graph-service) for a Hugging Face Docker Space,
+; which proxies exactly one port and has no docker-compose support — see
+; docker/Dockerfile.hf-space.
+;
+; No local siglip2-triton — SigLIP2 embeddings always go to NVCF in this
+; image. No graph-builder/asset_graph_generation worker either: both are
+; indexing-time-only (building the graph from scratch), not needed to serve
+; an already-built one — deepsearch-api's asset-graph calls are wired up as
+; a dependency-injected per-request client (see routers_v2/dependencies.py),
+; never a hard startup dependency, so /v2/deepsearch/search and
+; /v3/deepsearch/search work regardless of asset-graph-service's own
+; readiness.
+
+[supervisord]
+nodaemon=true
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+[program:opensearch]
+command=/usr/share/opensearch/opensearch-docker-entrypoint.sh opensearch
+directory=/usr/share/opensearch
+user=1000
+autorestart=true
+startsecs=5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:redis]
+command=/usr/bin/redis-server --port 6379 --databases 32 --save "" --stop-writes-on-bgsave-error no --dir /tmp
+user=1000
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:neo4j]
+; This program's command *is* pipeline/hf_space_seed.py --component=neo4j,
+; not neo4j itself: neo4j-admin's offline load has to finish before the
+; real neo4j process starts (unlike OpenSearch's live bulk-load), so the
+; seed step execs into the actual `neo4j console` as its last step once
+; restore is done — see that module's docstring. A restore failure (e.g.
+; bad AWS creds, no published run) correctly counts as this program failing
+; to start, same as every other startup error here.
+command=/bin/sh -c "cd /app/hf-space-pipeline && exec /app/.venv/bin/python -m pipeline.hf_space_seed --component=neo4j"
+directory=/app/hf-space-pipeline
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:asset-graph-service]
+; Waits for neo4j's own HTTP port rather than depending on it through
+; supervisord (which has no real dependency ordering) — same shape as
+; deepsearch-api waiting on hf_space_seed.py's own OpenSearch poll, just
+; inline here since it's a one-line curl loop rather than needing a Python
+; script. Bound to localhost only, same as deepsearch-api — nginx is the
+; sole externally-proxied process.
+command=/bin/sh -c "until curl -sf http://localhost:7474 >/dev/null 2>&1; do sleep 2; done; exec /app/.venv/bin/python -m uvicorn asset_graph_service.api:app --host 127.0.0.1 --port 8010"
+environment=DB_URI="neo4j://localhost:7687",DB_USERNAME="neo4j",DB_PASSWORD="none",ACCEPT_EULA="Y",OTEL_SDK_DISABLED="true"
+directory=/app
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:deepsearch-api]
+; Bound to localhost only — nginx (below) is the sole process bound to the
+; externally proxied port, so it can front every route with the friendly-URL
+; rewrites and CORS headers in nginx.conf.template.
+;
+; Runs pipeline/hf_space_seed.py first and only execs uvicorn once it
+; succeeds: that script waits for opensearch (started in parallel by
+; supervisord, below) and bulk-loads this corpus's indexed run from S3
+; before deepsearch-api has anything to search — see that module's
+; docstring for why this happens at container startup, not `docker build`
+; time. A seeding failure (e.g. no published run yet, or bad AWS creds)
+; correctly counts as this program failing to start, same as any other
+; startup error here.
+command=/bin/sh -c "cd /app/hf-space-pipeline && /app/.venv/bin/python -m pipeline.hf_space_seed && cd /app && exec /app/.venv/bin/python -m uvicorn deepsearch_api.main:app --host 127.0.0.1 --port 8000"
+directory=/app
+user=1000
+autorestart=true
+startsecs=10
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:nginx]
+; nginx is the *only* process bound to the externally-proxied port, and
+; Hugging Face's own Space "ready" detection is just "does something answer
+; on app_port" — so starting nginx immediately (as this used to) flipped the
+; Space to Running as soon as the container booted, while deepsearch-api and
+; asset-graph-service were still behind it restoring their data (a
+; multi-hundred-MB S3 bulk load / offline neo4j-admin load, routinely taking
+; minutes — see bake.py's own verify_baked comment on the same point): the
+; Explorer UI loaded instantly but every search/graph call 502'd or came
+; back empty until restore finished. Waiting for both backends' own readiness
+; first — same "poll a real endpoint the process only starts once restore
+; finished" idiom asset-graph-service already uses above for neo4j, not a
+; new pattern — means the external port stays closed, and HF keeps the Space
+; in "building"/"starting" rather than Running, until the stack actually
+; works. /health / /docs are plain unauthenticated GETs, so no extra config
+; needed to poll them from inside the container.
+;
+; nginx reads $PORT if HF sets it (Spaces convention), else the baked
+; default matches the Space's declared app_port (7860) — same convention
+; deepsearch-api used to follow directly before nginx sat in front of it.
+; %(ENV_PORT)s is substituted by supervisord itself, so no extra templating
+; tool (envsubst etc.) is needed in the image.
+command=/bin/sh -c "until curl -sf http://localhost:8000/health >/dev/null 2>&1 && curl -sf http://localhost:8010/docs >/dev/null 2>&1; do sleep 2; done; sed -e 's/__PORT__/%(ENV_PORT)s/' -e 's|__CORPUS_NAME__|%(ENV_CORPUS_NAME)s|g' /etc/nginx/hf-space.conf.template > /etc/nginx/conf.d/hf-space.conf && exec nginx -g 'daemon off;'"
+user=root
+autorestart=true
+startsecs=3
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

docker/hf-space/wheels/SOURCE.txt

@@ -0,0 +1,3 @@
+# Generated by scripts/extract_usdsearch_wheels.sh — do not hand-edit.
+source_image=nvcr.io/m3sujtetvf5w/usdsearch/usdsearch:1.5.0-a1b3d0fa
+extracted_at=2026-09-24T14:15:22Z

docker/hf-space/wheels/constraints.txt

@@ -0,0 +1,160 @@
+aioboto3==15.5.0
+aiobotocore==2.25.1
+aiofiles==25.1.0
+aiohappyeyeballs==2.6.1
+aiohttp==3.14.3
+aiohttp-retry==2.9.1
+aioitertools==0.13.0
+aiosignal==1.4.0
+annotated-doc==0.0.4
+annotated-types==0.7.0
+anyio==4.13.0
+asgi-correlation-id==4.3.4
+asgiref==3.11.1
+asset-graph-builder==0.1.0
+async-lru==2.3.0
+attrs==26.1.0
+Authlib==1.7.2
+backoff==2.2.1
+boto3==1.40.61
+botocore==1.40.61
+certifi==2026.4.22
+cffi==2.0.0
+charset-normalizer==3.4.7
+click==8.3.2
+cryptography==50.0.0
+deepsearch-crawler==0.1.0
+deepsearch-monitor==0.1.0
+deepsearch-utils==0.1.0
+Deprecated==1.3.1
+distro==1.9.0
+elastic-transport==9.2.1
+elasticsearch==9.3.0
+envyaml==1.10.211231
+Events==0.5
+fastapi==0.136.0
+fastapi-swagger==0.4.48
+filelock==3.29.0
+fire==0.7.1
+frozenlist==1.8.0
+fsspec==2026.3.0
+googleapis-common-protos==1.74.0
+greenlet==3.4.0
+grpcio==1.80.0
+h11==0.16.0
+hf-xet==1.4.3
+hiredis==3.3.1
+httpcore==1.0.9
+httptools==0.7.1
+httpx==0.28.1
+huggingface_hub==1.11.0
+humanize==4.15.0
+idna==3.18
+importlib_metadata==8.7.1
+Jinja2==3.1.6
+jiter==0.14.0
+jmespath==1.1.0
+joserfc==1.7.2
+jsonpatch==1.33
+jsonpointer==3.1.1
+kubernetes_asyncio==35.0.1
+langchain==1.3.15
+langchain-classic==1.0.7
+langchain-core==1.5.6
+langchain-openai==1.1.16
+langchain-protocol==0.0.18
+langchain-text-splitters==1.1.2
+langgraph==1.2.11
+langgraph-checkpoint==4.1.1
+langgraph-prebuilt==1.1.0
+langgraph-sdk==0.4.2
+langsmith==0.8.18
+markdown-it-py==4.0.0
+MarkupSafe==3.0.3
+mdurl==0.1.2
+multidict==6.7.1
+neo4j==6.1.0
+ngsearch-backend==0.1.0
+ngsearch-cache==0.1.0
+ngsearch-crawlers==0.1.0
+ngsearch-info-endpoint==0.1.0
+ngsearch-plugins==0.1.0
+ngsearch-storage==0.1.0
+numpy==2.4.6
+openai==2.32.0
+opensearch-protobufs==0.19.0
+opensearch-py==3.1.0
+opentelemetry-api==1.41.0
+opentelemetry-exporter-otlp==1.41.0
+opentelemetry-exporter-otlp-proto-common==1.41.0
+opentelemetry-exporter-otlp-proto-grpc==1.41.0
+opentelemetry-exporter-otlp-proto-http==1.41.0
+opentelemetry-instrumentation==0.62b0
+opentelemetry-instrumentation-aiohttp-client==0.62b0
+opentelemetry-instrumentation-asgi==0.62b0
+opentelemetry-instrumentation-fastapi==0.62b0
+opentelemetry-instrumentation-grpc==0.62b0
+opentelemetry-instrumentation-httpx==0.62b0
+opentelemetry-proto==1.41.0
+opentelemetry-sdk==1.41.0
+opentelemetry-semantic-conventions==0.62b0
+opentelemetry-util-http==0.62b0
+orjson==3.11.8
+ormsgpack==1.12.2
+packaging==26.1
+pillow==12.3.0
+prometheus_client==0.25.0
+prometheus-fastapi-instrumentator==8.0.0
+propcache==0.4.1
+protobuf==6.33.6
+psutil==7.2.2
+pycparser==3.0
+pydantic==2.13.3
+pydantic_core==2.46.3
+pydantic-settings==2.14.2
+Pygments==2.20.0
+pyinstrument==5.1.2
+pyparsing==3.3.2
+python-dateutil==2.9.0.post0
+python-dotenv==1.2.2
+python-json-logger==4.1.0
+python-multipart==0.0.32
+python-rapidjson==1.23
+pytinyexr==0.9.1
+pytz==2026.1.post1
+PyYAML==6.0.3
+redis==7.4.0
+regex==2026.4.4
+requests==2.33.1
+requests-toolbelt==1.0.0
+rich==15.0.0
+s3transfer==0.14.0
+safetensors==0.7.0
+sentry-sdk==2.58.0
+setuptools==82.0.1
+shellingham==1.5.4
+six==1.17.0
+sniffio==1.3.1
+SQLAlchemy==2.0.49
+starlette==1.3.1
+tenacity==9.1.4
+termcolor==3.3.0
+tiktoken==0.12.0
+tokenizers==0.22.2
+tqdm==4.67.3
+transformers==5.5.4
+tritonclient==2.41.0
+typer==0.24.1
+typing_extensions==4.15.0
+typing-inspection==0.4.2
+urllib3==2.7.0
+usd-core==25.11
+usdsearch==0.1.0
+uuid_utils==0.14.1
+uvicorn==0.45.0
+websockets==15.0.1
+wrapt==1.17.3
+xxhash==3.6.0
+yarl==1.23.0
+zipp==3.23.1
+zstandard==0.25.0

docker/hf-space/wheels/deepsearch_api-0.1.0-py3-none-any.whl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:16406fa180ff1ecac8b48bbface39243eeb471bfcee62af8f5b3cccb7891985e
+size 212789

docker/hf-space/wheels/search_utils-0.1.0-py3-none-any.whl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f81e65e56543e8393c4bae7aecab58b4c66c5cb8034e450ca88993efde4aaca9
+size 286603

docker/hf-space/wheels/siglip2_triton_client-0.6.1-py3-none-any.whl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5f8405481eb33cd4bc22401bf7a9391d5ba32342caa3206ce990854d7ca15df0
+size 5482420

pipeline/__init__.py

@@ -0,0 +1 @@
+"""USD Search index re-generation pipeline."""

pipeline/artifact_store.py

@@ -0,0 +1,139 @@
+"""Shared plumbing for talking to the dedicated artifact S3 bucket.
+
+Used by both `upload` (stage 3, write) and `restore` (read, to continue
+indexing on top of a previous run's data). Deliberately separate credentials
+from `S3_STORAGE_*` (the source corpus bucket), so a mistake in one credential
+set can't touch the other bucket — see the plan, §7.
+"""
+
+from __future__ import annotations
+
+import functools
+import os
+import re
+import subprocess
+import time
+from typing import Dict, List
+
+from .config import Config
+
+
+@functools.lru_cache(maxsize=1)
+def _aws_cli_major_version() -> int:
+    """1 or 2 — memoized, one `aws --version` subprocess call per process.
+
+    Defaults to 1 (the more defensive branch in aws_cmd(), below) if
+    detection fails for any reason, rather than assuming the newer,
+    less-defensive CLI is present."""
+    try:
+        result = subprocess.run(["aws", "--version"], capture_output=True, text=True, timeout=10)
+        match = re.search(r"aws-cli/(\d+)\.", result.stdout + result.stderr)
+        if match:
+            return int(match.group(1))
+    except Exception:  # noqa: BLE001 - detection failure just falls through to the default below
+        pass
+    return 1
+
+ARTIFACT_AWS_ACCESS_KEY_ID_VAR = "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID"
+ARTIFACT_AWS_SECRET_ACCESS_KEY_VAR = "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY"
+
+
+def artifact_env() -> Dict[str, str]:
+    key = os.environ.get(ARTIFACT_AWS_ACCESS_KEY_ID_VAR, "").strip()
+    secret = os.environ.get(ARTIFACT_AWS_SECRET_ACCESS_KEY_VAR, "").strip()
+    if not key or not secret:
+        raise SystemExit(
+            f"{ARTIFACT_AWS_ACCESS_KEY_ID_VAR} / {ARTIFACT_AWS_SECRET_ACCESS_KEY_VAR} "
+            "must be set in the environment to reach the artifact bucket."
+        )
+    env = dict(os.environ)
+    env["AWS_ACCESS_KEY_ID"] = key
+    env["AWS_SECRET_ACCESS_KEY"] = secret
+    env.pop("AWS_PROFILE", None)
+    return env
+
+
+def aws_cmd(cfg: Config, read_timeout: int = 300) -> List[str]:
+    cmd = ["aws", "s3"]
+    # aws-cli v1's `s3` subcommands mis-sign SigV4 requests against a bucket
+    # outside the CLI's configured default region (`SignatureDoesNotMatch`,
+    # even though `aws s3api` and plain `--region` alone are unaffected) —
+    # pin the endpoint explicitly to the artifact bucket's actual region.
+    # v1-only: verified live (2026-09-23) that aws-cli v2 (what both HF Space
+    # Dockerfiles bake, via the official installer — see
+    # docker/Dockerfile.hf-space-gpu) signs correctly with just `--region`,
+    # no `--endpoint-url` override needed at all. Kept conditional rather
+    # than dropped outright: this function is also called by this pipeline's
+    # own local `enumerate`/`upload`/`restore` stages, run on whatever `aws`
+    # an operator's own machine happens to have on PATH — and at least one
+    # (this session's own dev machine) is still v1.
+    region = cfg.get("ARTIFACT_S3_REGION", "us-east-2").strip()
+    if _aws_cli_major_version() >= 2:
+        cmd += ["--region", region]
+    else:
+        cmd += ["--endpoint-url", f"https://s3.{region}.amazonaws.com"]
+    # Bounded, not left to whatever the network happens to do: a CI run
+    # hung for 45 minutes (the whole job's ceiling) with no error and no
+    # log, right around where restore's `aws s3 cp`/`sync` calls run — those
+    # had no timeout anywhere, unlike the httpx calls elsewhere in this
+    # pipeline, which all do. Not confirmed as the cause (the actual hang
+    # point is unrecoverable — see the plan, §11), but a real, previously
+    # unprotected gap either way: any of these calls could hang forever on a
+    # stalled connection with zero backstop. `subprocess.run`'s own
+    # `timeout=` (used at every call site below) is the hard kill if even
+    # these don't fire.
+    #
+    # connect_timeout/read_timeout were originally 10s/60s — read_timeout is
+    # per-socket-read (resets on every chunk received, not a total-transfer
+    # deadline), so 60s looked plenty for this pipeline's normal restore
+    # payloads (MBs). Verified live it wasn't: a real deploy to a T4 HF
+    # Space hit `aws s3 sync ... exit status 255` (no further detail in the
+    # logs — --only-show-errors swallows it) on *both* the ~3.6 GB
+    # siglip2-model sync (raised to 300s there first) *and*, on a later
+    # deploy, the ordinary ~30 MB neo4j restore that had worked moments
+    # earlier on the same Space — i.e. this is a real, apparently
+    # intermittent characteristic of that Space's network path to S3, not
+    # specific to large-payload transfers, so the safer fix is raising the
+    # default here for every caller rather than special-casing one.
+    cmd += ["--cli-connect-timeout", "30", "--cli-read-timeout", str(read_timeout)]
+    return cmd
+
+
+def run_aws_with_retry(
+    cmd: List[str], *, env: Dict[str, str], timeout: int, max_attempts: int = 4, base_delay: float = 5.0,
+) -> subprocess.CompletedProcess:
+    """Run an `aws s3 ...` command, retrying on failure with exponential
+    backoff (5s/10s/20s between attempts by default).
+
+    Raising aws_cmd()'s own CLI timeouts (see that function's comment) alone
+    didn't fix the intermittent `aws s3 sync ... exit status 255` a real T4
+    HF Space deploy hit repeatedly, on both a small (~30 MB neo4j) and large
+    (~3.6 GB siglip2-model) payload, with no more detail than a bare
+    "aws: [ERROR]:" even with output captured — consistent with something
+    transient in that Space's network path to S3 (e.g. an egress connection
+    limit under concurrent load — OpenSearch, Neo4j, and siglip2-model all
+    restore in parallel at container startup) rather than a single
+    reproducible cause worth chasing further from here. A short backoff-retry
+    loop is the standard mitigation for exactly this class of transient
+    failure and costs nothing when the first attempt just succeeds (the
+    common case, verified live outside this specific Space).
+    """
+    result = None
+    for attempt in range(1, max_attempts + 1):
+        result = subprocess.run(cmd, capture_output=True, text=True, env=env, timeout=timeout)
+        if result.returncode == 0:
+            return result
+        print(f"==> aws command failed (attempt {attempt}/{max_attempts}, exit {result.returncode})")
+        if result.stdout.strip():
+            print(f"    stdout: {result.stdout.strip()}")
+        if result.stderr.strip():
+            print(f"    stderr: {result.stderr.strip()}")
+        if attempt < max_attempts:
+            delay = base_delay * (2 ** (attempt - 1))
+            print(f"==> retrying in {delay:.0f}s")
+            time.sleep(delay)
+    raise SystemExit(f"aws command failed after {max_attempts} attempts: {' '.join(str(c) for c in cmd[:8])} ...")
+
+
+def bucket_base(cfg: Config) -> str:
+    return cfg.require("ARTIFACT_S3_URI").rstrip("/")

pipeline/bake.py

@@ -0,0 +1,631 @@
+"""Stage 4 — build (and optionally push) images with the data pre-loaded.
+
+Staging happens here, on the host, so the Dockerfiles stay simple:
+
+  * settings + mappings are merged into one `<index>.create.json` per index,
+    with `index.knn.derived_source` stripped — the same transform upstream's
+    loader.sh applies, carried over verbatim because that setting is rejected
+    on restore.
+  * the elasticdump data file is converted to `_bulk` chunks (to_bulk.py),
+    since the OpenSearch image has no Node to run elasticdump with.
+"""
+
+from __future__ import annotations
+
+import gzip
+import json
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Dict, List
+
+from . import hf_addressing
+from .artifact_store import artifact_env
+from .config import (
+    BUILD_DIR,
+    REPO_ROOT,
+    Config,
+    SIGLIP2_NVCF_ENDPOINT_DEFAULT,
+    SIGLIP2_NVCF_FUNCTION_ID_DEFAULT,
+    TRITONSERVER_BASE_IMAGE_DEFAULT,
+)
+from .enumerate_assets import load_manifest, save_manifest
+from .export import NEO4J_ARTIFACTS, OS_ARTIFACTS
+from .to_bulk import convert
+
+BAKE_DIR = BUILD_DIR / "bake"
+DOCKER_DIR = REPO_ROOT / "docker"
+
+
+def _run(cmd: List[str], timeout: int = 900, **kwargs) -> subprocess.CompletedProcess:
+    print("  $ " + " ".join(cmd[:8]) + (" ..." if len(cmd) > 8 else ""))
+    return subprocess.run(cmd, check=True, timeout=timeout, **kwargs)
+
+
+def _read_json_gz(path: Path) -> Dict:
+    """Load a gzipped elasticdump artifact, undoing double JSON encoding.
+
+    elasticdump is inconsistent about this: `--type=settings` writes the body as
+    a JSON *string* containing JSON, while `--type=mapping` writes a plain
+    object. Upstream loader.sh normalises both with a `try fromjson catch .`
+    step; this is the same defence, applied to whichever form we get.
+    """
+    with gzip.open(path, "rt") as fh:
+        doc = json.load(fh)
+    for _ in range(3):
+        if not isinstance(doc, str):
+            break
+        try:
+            doc = json.loads(doc)
+        except json.JSONDecodeError:
+            break
+    if not isinstance(doc, dict):
+        raise SystemExit(f"{path.name}: expected a JSON object, got {type(doc).__name__}")
+    return doc
+
+
+def _unwrap(doc: Dict, key: str) -> Dict:
+    """elasticdump writes {"<index>": {"settings": ...}}; loader.sh also accepts
+    the bare {"settings": ...} form. Handle both, like loader.sh does."""
+    if key in doc:
+        return doc[key]
+    if len(doc) == 1:
+        inner = next(iter(doc.values()))
+        if isinstance(inner, dict) and key in inner:
+            return inner[key]
+    raise SystemExit(f"could not find {key!r} in dump: keys={list(doc)[:5]}")
+
+
+def build_create_body(settings_path: Path, mapping_path: Path) -> Dict:
+    settings = _unwrap(_read_json_gz(settings_path), "settings")
+    mappings = _unwrap(_read_json_gz(mapping_path), "mappings")
+
+    index_settings = settings.get("index")
+    if isinstance(index_settings, dict):
+        # Present in the dump, rejected on create. loader.sh strips it too.
+        # The dump spells it as a literal dotted key mapping to an object:
+        #   "knn.derived_source": {"enabled": "false"}
+        # but tolerate the nested spelling as well.
+        index_settings.pop("knn.derived_source", None)
+        index_settings.pop("knn.derived_source.enabled", None)
+        if isinstance(index_settings.get("knn"), dict):
+            index_settings["knn"].pop("derived_source", None)
+        # Cluster-assigned values that cannot be supplied on create.
+        for key in ("uuid", "creation_date", "creation_date_string", "provided_name",
+                    "version", "resize", "routing", "history"):
+            index_settings.pop(key, None)
+    return {"settings": settings, "mappings": mappings}
+
+
+def stage_opensearch(cfg: Config, manifest: Dict) -> Path:
+    seed_dir = BAKE_DIR / "opensearch" / "seed"
+    if seed_dir.exists():
+        shutil.rmtree(seed_dir)
+    seed_dir.mkdir(parents=True)
+
+    artifacts = manifest.get("opensearch_artifacts") or {}
+    if not artifacts:
+        raise SystemExit("manifest has no opensearch_artifacts — run `export` first.")
+
+    ordered: List[str] = []
+    for index in sorted(artifacts):
+        print(f"  staging {index}")
+        body = build_create_body(
+            OS_ARTIFACTS / f"{index}.settings.json.gz",
+            OS_ARTIFACTS / f"{index}.mapping.json.gz",
+        )
+        (seed_dir / f"{index}.create.json").write_text(json.dumps(body))
+        chunks = convert(
+            OS_ARTIFACTS / f"{index}.data.json.gz",
+            seed_dir,
+            index,
+            chunk_docs=cfg.get_int("BULK_CHUNK_DOCS", 500),
+        )
+        print(f"    {len(chunks)} bulk chunk(s)")
+        ordered.append(index)
+
+    (seed_dir / "indexes.txt").write_text("\n".join(ordered) + "\n")
+
+    context = BAKE_DIR / "opensearch"
+    for name in ("Dockerfile.opensearch-baked", "opensearch-seed.sh", "check_bulk.py"):
+        shutil.copy2(DOCKER_DIR / name, context / name)
+    return context
+
+
+def stage_neo4j(manifest: Dict) -> Path:
+    context = BAKE_DIR / "neo4j"
+    dumps = context / "dumps"
+    if dumps.exists():
+        shutil.rmtree(dumps)
+    dumps.mkdir(parents=True)
+
+    artifact = manifest.get("neo4j_artifact")
+    if not artifact:
+        raise SystemExit("manifest has no neo4j_artifact — run `export` first.")
+
+    src = NEO4J_ARTIFACTS / artifact["file"]
+    dest = dumps / "neo4j.dump"
+    with gzip.open(src, "rb") as fh, dest.open("wb") as out:
+        shutil.copyfileobj(fh, out)
+    print(f"  staged {dest.name} ({dest.stat().st_size:,} bytes)")
+
+    for name in ("Dockerfile.neo4j-baked", "neo4j-seeded-entrypoint.sh"):
+        shutil.copy2(DOCKER_DIR / name, context / name)
+    return context
+
+
+def _image_names(cfg: Config) -> Dict[str, str]:
+    registry = cfg.get("REGISTRY", "nvcr.io/m3sujtetvf5w/usdsearch").rstrip("/")
+    names = {
+        "opensearch": f"{registry}/{cfg.get('OPENSEARCH_IMAGE_NAME', 'opensearch-simready-central')}",
+        "neo4j": f"{registry}/{cfg.get('NEO4J_IMAGE_NAME', 'neo4j-simready-central')}",
+    }
+    # The combined single-container MVP image (docker/Dockerfile.hf-space)
+    # always routes siglip2 to NVCF — it has no local Triton — so it's only
+    # buildable when the run itself is already NVCF-backed. cfg is the same
+    # object bake/verify/push all load from pipeline.env, so this stays
+    # consistent across those stages without threading a separate flag.
+    if cfg.siglip2_nvcf:
+        names["hf_space"] = f"{registry}/{cfg.get('HF_SPACE_IMAGE_NAME', 'hf-space-simready-central')}"
+    # The GPU variant (docker/Dockerfile.hf-space-gpu, local siglip2-triton
+    # instead of NVCF) is a separate, optional deploy target — independent
+    # of SIGLIP2_BACKEND/siglip2_nvcf above, since it serves the same
+    # already-indexed corpus regardless of how the indexing stack itself
+    # computed embeddings. Off by default (HF_SPACE_BUILD_GPU_VARIANT):
+    # existing pipelines shouldn't pay for an extra ~15 GB build/push they
+    # didn't ask for.
+    if cfg.hf_space_gpu_variant_enabled:
+        names["hf_space_gpu"] = f"{registry}/{cfg.get('HF_SPACE_GPU_IMAGE_NAME', 'hf-space-simready-central-gpu')}"
+    return names
+
+
+def hf_url_mapping_rules(manifest: Dict) -> List[Dict[str, str]]:
+    """USDSEARCH_URL_MAPPING_RULES for a storage_api corpus: one rule per HF
+    repo the manifest records, rewriting the indexed hf:// prefix to that
+    repo's browsable file-viewer URL (.../blob/<revision>/). The internal
+    prefix comes from hf_addressing.build(), so it matches the indexed
+    addresses exactly, pinned-sha `/resolve/<sha>/` segment included.
+    Empty for an S3 corpus. Per-repo prefixes never nest, so the library's
+    _validate_rules() ambiguity check can't trip on a multi-repo corpus.
+    """
+    rules = []
+    for host, repo_type, repo_id, revision in manifest.get("hf_repos") or []:
+        type_prefix = hf_addressing.REPO_TYPE_PREFIX.get(repo_type, "")
+        public_repo = "/".join(p for p in (type_prefix, repo_id) if p)
+        rules.append({
+            "internal": hf_addressing.build(
+                host=host, repo_type=repo_type, repo_id=repo_id, revision=revision, is_folder=True
+            ),
+            "public": f"https://{host}/{public_repo}/blob/{revision}/",
+        })
+    return rules
+
+
+def hf_space_build_args(cfg: Config, manifest: Dict) -> Dict[str, str]:
+    """The `docker/Dockerfile.hf-space` ARGs this run needs, shared between
+    the local/CI `docker build` (bake.run, as --build-arg) and pipeline/
+    hf_space.py's deploy stage (as HF Space "Variables" — Hugging Face
+    passes any Space Variable whose name matches a Dockerfile ARG through as
+    a build-arg on its own build, same mechanism, different trigger). One
+    dict so the two build-arg lists can't silently drift apart.
+    """
+    storage_backend = manifest.get("storage_backend", "s3")
+    args = {
+        "OPENSEARCH_VERSION": cfg.get("OPENSEARCH_VERSION", "3.8.0"),
+        "ARTIFACT_S3_URI": cfg.require("ARTIFACT_S3_URI"),
+        "ARTIFACT_S3_REGION": cfg.get("ARTIFACT_S3_REGION", "us-east-2"),
+        "CORPUS_NAME": manifest["corpus_name"],
+        "ES_NAME": manifest["es_name"],
+        # Search never makes a live storage-backend call at serve time (the
+        # Dockerfile bakes verification off — see its own comment), but the
+        # backend *type* still has to match what the corpus was indexed
+        # under: it gates a client-side URL/result code path unrelated to
+        # verification, and getting it wrong silently returns zero search
+        # results rather than erroring. Verified live.
+        "STORAGE_BACKEND_TYPE": storage_backend,
+        "SIGLIP2_NVCF_ENDPOINT": cfg.get("SIGLIP2_NVCF_ENDPOINT", SIGLIP2_NVCF_ENDPOINT_DEFAULT),
+        "SIGLIP2_NVCF_FUNCTION_ID": cfg.get("SIGLIP2_NVCF_FUNCTION_ID", SIGLIP2_NVCF_FUNCTION_ID_DEFAULT),
+    }
+    # S3_STORAGE_* is only ever meaningful for an S3-sourced corpus, and
+    # threading a source bucket name through for an HF-sourced one would be
+    # actively misleading.
+    if storage_backend != "storage_api":
+        args["S3_STORAGE_BUCKET_NAME"] = cfg.get("S3_STORAGE_BUCKET_NAME", "")
+        args["S3_STORAGE_REGION_NAME"] = cfg.get("S3_STORAGE_REGION_NAME", "us-west-2")
+    # Derived from this run's own corpus rather than hardcoded in the
+    # Dockerfile, so a Space follows its corpus when the dataset moves.
+    rules = hf_url_mapping_rules(manifest)
+    args["USDSEARCH_URL_MAPPING_MODE"] = "rules" if rules else "off"
+    args["USDSEARCH_URL_MAPPING_RULES"] = json.dumps(rules)
+    return args
+
+
+def hf_space_gpu_build_args(cfg: Config, manifest: Dict) -> Dict[str, str]:
+    """The `docker/Dockerfile.hf-space-gpu` ARGs this run needs — same shape
+    as hf_space_build_args() above, minus every NVCF-only key (that
+    Dockerfile has no SIGLIP2_NVCF_* ARGs at all: SigLIP2 comes from the
+    local siglip2-triton process it bakes in, not NVCF), plus the bare
+    Triton base image, overridable in case a newer NGC tritonserver tag
+    needs picking up without a Dockerfile edit. The SigLIP2 model weights
+    themselves are not a build-arg — they're vendored source
+    (docker/hf-space/siglip2-model/, see scripts/extract_siglip2_model.sh),
+    committed like every other file this Dockerfile COPYs.
+    """
+    args = hf_space_build_args(cfg, manifest)
+    args.pop("SIGLIP2_NVCF_ENDPOINT", None)
+    args.pop("SIGLIP2_NVCF_FUNCTION_ID", None)
+    args["TRITONSERVER_BASE_IMAGE"] = cfg.get("TRITONSERVER_BASE_IMAGE", TRITONSERVER_BASE_IMAGE_DEFAULT)
+    return args
+
+
+def image_tags(cfg: Config, manifest: Dict) -> Dict[str, str]:
+    # <corpus name>-<run_id> — in CI, run_id is itself
+    # <branch slug>-<workflow run id>-<short commit sha> (see
+    # nvcf-pipeline.yml's "Compute version" step), so the full tag traces
+    # a published image back to the exact corpus, branch, CI run and commit
+    # that built it. Locally, run_id falls back to enumerate_assets.py's
+    # `YYYYMMDD-<corpus sha prefix>`.
+    version = f"{manifest['corpus_name']}-{manifest['run_id']}"
+    return {name: f"{image}:{version}" for name, image in _image_names(cfg).items()}
+
+
+def latest_tags(cfg: Config, manifest: Dict) -> Dict[str, str]:
+    """`<corpus name>-latest` — updated only when `push` actually publishes."""
+    tag = f"{manifest['corpus_name']}-latest"
+    return {name: f"{image}:{tag}" for name, image in _image_names(cfg).items()}
+
+
+def run(cfg: Config, push: bool = False) -> int:
+    manifest = load_manifest()
+    tags = image_tags(cfg, manifest)
+    common = [
+        "--build-arg", f"RUN_ID={manifest['run_id']}",
+        "--build-arg", f"CORPUS_SHA256={manifest['corpus_sha256']}",
+        "--build-arg", f"USDSEARCH_GIT_SHA={manifest.get('usdsearch_git_sha', 'unknown')}",
+    ]
+
+    print("Staging OpenSearch seed ...")
+    os_context = stage_opensearch(cfg, manifest)
+    print(f"\nBuilding {tags['opensearch']}")
+    _run([
+        "docker", "build",
+        "-f", str(os_context / "Dockerfile.opensearch-baked"),
+        "-t", tags["opensearch"],
+        "--build-arg", f"OPENSEARCH_VERSION={cfg.get('OPENSEARCH_VERSION', '3.8.0')}",
+        "--build-arg", f"MAIN_INDEX={cfg.main_index}",
+        "--build-arg", f"DOC_COUNT={manifest.get('base_docs_indexed', 0)}",
+        *common, str(os_context),
+    ])
+
+    if "hf_space" in tags:
+        print(f"\nBuilding {tags['hf_space']} (single-container MVP: opensearch+redis+deepsearch-api, "
+              f"for Hugging Face Spaces)")
+        # Fails fast here, before the Neo4j build, if no NVCF token is in the
+        # environment — same fallback chain as the indexing/runtime nvcf
+        # overlays (config.py's siglip2_nvcf_env), so a missing token is
+        # reported the same way everywhere rather than surfacing later as an
+        # opaque docker build failure. No AWS-credential check here: this
+        # image no longer bakes the index in at build time (see the
+        # Dockerfile's header) — the artifact-bucket keys are only needed at
+        # `verify_baked`'s smoke-test `docker run`, and at the real Space's
+        # own runtime.
+        cfg.siglip2_nvcf_env()
+        # Build context is REPO_ROOT here (not DOCKER_DIR, unlike the
+        # opensearch/neo4j builds above): this Dockerfile COPYs pipeline/ in
+        # directly (its runtime seed step needs it) rather than reusing
+        # another already-built image's tag, since HF's own builder must be
+        # able to build it standalone with only public base images.
+        build_arg_flags = [
+            flag
+            for key, value in hf_space_build_args(cfg, manifest).items()
+            for flag in ("--build-arg", f"{key}={value}")
+        ]
+        _run([
+            "docker", "build",
+            "-f", str(DOCKER_DIR / "Dockerfile.hf-space"),
+            "-t", tags["hf_space"],
+            *build_arg_flags,
+            *common, str(REPO_ROOT),
+        ])
+    else:
+        print("\nSIGLIP2_BACKEND=local — skipping the HF Space image (it is NVCF-only by "
+              "design; set SIGLIP2_BACKEND=nvcf to build it — see docker/Dockerfile.hf-space)")
+
+    if "hf_space_gpu" in tags:
+        print(f"\nBuilding {tags['hf_space_gpu']} (single-container MVP + local siglip2-triton, "
+              f"for a GPU-tier Hugging Face Space — see docker/Dockerfile.hf-space-gpu)")
+        # No NVCF token needed here (this variant never calls NVCF) — only
+        # the same build-arg dict shape as the NVCF image, minus its
+        # NVCF-only keys. Build context is REPO_ROOT, same reasoning as the
+        # NVCF hf_space build above.
+        build_arg_flags = [
+            flag
+            for key, value in hf_space_gpu_build_args(cfg, manifest).items()
+            for flag in ("--build-arg", f"{key}={value}")
+        ]
+        _run([
+            "docker", "build",
+            "-f", str(DOCKER_DIR / "Dockerfile.hf-space-gpu"),
+            "-t", tags["hf_space_gpu"],
+            *build_arg_flags,
+            *common, str(REPO_ROOT),
+        ])
+
+    print("\nStaging Neo4j dump ...")
+    neo_context = stage_neo4j(manifest)
+    print(f"\nBuilding {tags['neo4j']}")
+    _run([
+        "docker", "build",
+        "-f", str(neo_context / "Dockerfile.neo4j-baked"),
+        "-t", tags["neo4j"],
+        "--build-arg", f"NEO4J_VERSION={cfg.get('NEO4J_VERSION', '5.23.0-community')}",
+        "--build-arg", f"NODE_COUNT={manifest.get('neo4j_node_count', 0)}",
+        "--build-arg", f"RELATIONSHIP_COUNT={manifest.get('neo4j_relationship_count', 0)}",
+        *common, str(neo_context),
+    ])
+
+    manifest["images"] = tags
+    (BUILD_DIR / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
+
+    print("\nVerifying the baked data from a fresh container ...")
+    if verify_baked(cfg, tags, manifest) != 0:
+        return 1
+
+    if push:
+        # Only reached after `verify` has passed; run_pipeline never pushes
+        # before the smoke test.
+        for name, tag in tags.items():
+            print(f"\nPushing {tag}")
+            _run(["docker", "push", tag])
+
+    print("\nbuilt:")
+    for name, tag in tags.items():
+        print(f"  {name}: {tag}")
+    if not push:
+        print("\nNot pushed. `run_pipeline.py verify` runs the smoke test; push with")
+        print("`run_pipeline.py push` once it passes.")
+    return 0
+
+
+def verify_baked(cfg: Config, tags: Dict[str, str], manifest: Dict) -> int:
+    """Check the data from a fresh `docker run`, not from the build log.
+
+    This is what catches the VOLUME trap: a Dockerfile that writes into a
+    declared VOLUME builds green and ships an empty database, and only starting
+    the built image reveals it.
+    """
+    ok = True
+
+    print("  opensearch ...")
+    result = subprocess.run(
+        ["docker", "run", "--rm", "-d", "-p", "19200:9200", tags["opensearch"]],
+        capture_output=True, text=True, check=True, timeout=60,
+    )
+    container = result.stdout.strip()
+    try:
+        import time
+        import httpx
+        expected = manifest.get("base_docs_indexed", 0)
+        count = -1
+        shards_ready = False
+        for _ in range(90):
+            try:
+                response = httpx.get(f"http://localhost:19200/{cfg.main_index}/_count", timeout=5.0)
+                if response.status_code < 400:
+                    body = response.json()
+                    shards = body.get("_shards", {})
+                    shards_ready = shards.get("successful") == shards.get("total")
+                    count = int(body["count"])
+                    # A fresh container recovers its shards from the baked
+                    # segments over several seconds. OpenSearch answers
+                    # `_count` as soon as any shard is open, and
+                    # `allow_partial_search_results` defaults to true, so a
+                    # response with `shards_ready=False` can silently
+                    # undercount rather than error — keep polling instead of
+                    # trusting the first HTTP 200.
+                    if shards_ready and count == expected:
+                        break
+            except httpx.HTTPError:
+                pass
+            time.sleep(2)
+        print(f"    {cfg.main_index}: {count} docs (expected {expected}, shards ready: {shards_ready})")
+        if count != expected or count == 0:
+            print("    FAIL: baked OpenSearch image does not hold the expected documents")
+            ok = False
+    finally:
+        subprocess.run(["docker", "rm", "-f", container], capture_output=True, check=False, timeout=30)
+
+    print("  neo4j ...")
+    result = subprocess.run(
+        ["docker", "run", "--rm", "-d", "-p", "17687:7687", tags["neo4j"]],
+        capture_output=True, text=True, check=True, timeout=60,
+    )
+    container = result.stdout.strip()
+    try:
+        import time
+        from neo4j import GraphDatabase
+        expected = manifest.get("neo4j_node_count", 0)
+        nodes = -1
+        # A bounded wall-clock deadline, not a bare iteration count: the
+        # driver is given no timeouts below by default, so a single stuck
+        # connection attempt (e.g. the server accepting TCP but stalling
+        # mid-handshake) can block far longer than the intended ~3 minutes
+        # of polling — 90 iterations at an unbounded per-attempt cost was
+        # exactly the shape of a run that hung here for 44 minutes and
+        # blew straight through this step's own 10-minute CI timeout
+        # without ever failing cleanly.
+        deadline = time.monotonic() + 180
+        while time.monotonic() < deadline:
+            try:
+                driver = GraphDatabase.driver(
+                    "bolt://localhost:17687", auth=None,
+                    connection_timeout=5.0, connection_acquisition_timeout=5.0,
+                )
+                with driver.session() as session:
+                    nodes = session.run("MATCH (n) RETURN count(n) AS c").single()["c"]
+                driver.close()
+                break
+            except Exception:  # noqa: BLE001 - the server is simply not up yet
+                time.sleep(2)
+        print(f"    nodes: {nodes} (expected {expected})")
+        if expected > 0 and nodes != expected:
+            print("    FAIL: baked Neo4j image does not hold the expected graph")
+            ok = False
+    finally:
+        subprocess.run(["docker", "rm", "-f", container], capture_output=True, check=False, timeout=30)
+
+    if "hf_space" in tags:
+        print("  hf-space (combined MVP image) ...")
+        # The AWS keys here exercise the same runtime restore
+        # (pipeline/hf_space_seed.py, via supervisord) a real Space does —
+        # this smoke test is what actually proves that path works, not just
+        # that the image builds. A longer deadline than the other images'
+        # health checks: startup now includes a real S3 download + bulk
+        # load, not just a process coming up.
+        token = cfg.siglip2_nvcf_env()["SIGLIP2_TRITON_SERVER_AUTH_TOKEN"]
+        aws = artifact_env()
+        result = subprocess.run(
+            ["docker", "run", "--rm", "-d", "-p", "17860:7860",
+             "-e", f"SIGLIP2_TRITON_SERVER_AUTH_TOKEN={token}",
+             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID={aws['AWS_ACCESS_KEY_ID']}",
+             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY={aws['AWS_SECRET_ACCESS_KEY']}",
+             tags["hf_space"]],
+            capture_output=True, text=True, check=True, timeout=60,
+        )
+        container = result.stdout.strip()
+        try:
+            import time
+            import httpx
+            healthy = False
+            deadline = time.monotonic() + 300
+            while time.monotonic() < deadline:
+                try:
+                    if httpx.get("http://localhost:17860/health", timeout=5.0).status_code == 200:
+                        healthy = True
+                        break
+                except httpx.HTTPError:
+                    pass
+                time.sleep(2)
+            print(f"    /health responded: {healthy}")
+            if not healthy:
+                print("    FAIL: hf-space image never became healthy")
+                ok = False
+
+            # /health only proves deepsearch-api/OpenSearch came up — it says
+            # nothing about neo4j/asset-graph-service, which have their own
+            # offline-load startup path (pipeline/hf_space_seed.py
+            # --component=neo4j) that can fail silently as far as /health is
+            # concerned, and which routinely takes longer than deepsearch-api's
+            # own startup (a multi-hundred-MB neo4j-admin load, run offline,
+            # before that program even execs into `neo4j console`) — so this
+            # has to poll, not fire once right after /health passes. Exercise
+            # a real graph read through nginx, the same way a client actually
+            # would: search for a real asset url, then ask
+            # asset-graph-service for its prims.
+            graph_ok = False
+            if healthy:
+                graph_deadline = time.monotonic() + 180
+                while time.monotonic() < graph_deadline and not graph_ok:
+                    try:
+                        search_resp = httpx.get(
+                            "http://localhost:17860/search", params={"query": "box", "limit": 1}, timeout=10.0,
+                        )
+                        results = search_resp.json()
+                        asset_url = results[0]["url"] if results else None
+                        if asset_url:
+                            prims_resp = httpx.get(
+                                "http://localhost:17860/asset_graph/usd/prims",
+                                params={"asset_url": asset_url}, timeout=10.0,
+                            )
+                            prims = prims_resp.json()
+                            graph_ok = prims_resp.status_code == 200 and isinstance(prims, list) and len(prims) > 0
+                    except (httpx.HTTPError, ValueError):
+                        pass
+                    if not graph_ok:
+                        time.sleep(3)
+                print(f"    asset-graph-service responded with real prims: {graph_ok}")
+                if not graph_ok:
+                    print("    FAIL: hf-space image's neo4j/asset-graph-service restore did not produce queryable data")
+                    ok = False
+
+            # Recorded independently of `ok`/ the other images' checks —
+            # deploy-space (pipeline/hf_space.py) gates on this specifically,
+            # not on the separate full-stack `verify` stage's smoke_passed,
+            # since that stage also exercises asset-graph-service and other
+            # components the hf_space image doesn't even include.
+            manifest["hf_space_smoke_passed"] = healthy and graph_ok
+            save_manifest(manifest)
+        finally:
+            subprocess.run(["docker", "rm", "-f", container], capture_output=True, check=False, timeout=30)
+
+    if "hf_space_gpu" in tags:
+        print("  hf-space-gpu (local siglip2-triton variant) ...")
+        # Unlike every other smoke test in this function, this one needs an
+        # actual GPU on the machine running `bake` — `--gpus all` fails fast
+        # and loudly if there isn't one, rather than hanging, which is the
+        # right failure mode here: this is why this variant is opt-in
+        # (HF_SPACE_BUILD_GPU_VARIANT) and why the existing nightly CI
+        # workflow (no-GPU-runner, per docs/plans/index-regeneration-
+        # pipeline.md §12) doesn't enable it. No NVCF token needed. AWS keys
+        # still are — the index restore path is identical to the NVCF
+        # variant's.
+        aws = artifact_env()
+        result = subprocess.run(
+            ["docker", "run", "--rm", "-d", "-p", "17861:7860", "--gpus", "all",
+             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID={aws['AWS_ACCESS_KEY_ID']}",
+             "-e", f"SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY={aws['AWS_SECRET_ACCESS_KEY']}",
+             tags["hf_space_gpu"]],
+            capture_output=True, text=True, check=True, timeout=60,
+        )
+        container = result.stdout.strip()
+        try:
+            import time
+            import httpx
+            healthy = False
+            # Longer deadline than the NVCF variant's: this one also has to
+            # load ~3.6 GB of ONNX weights onto the GPU before deepsearch-api
+            # execs uvicorn (see supervisord-gpu.conf) — not measured live
+            # yet (see docker/Dockerfile.hf-space-gpu's header), budgeted
+            # generously rather than guessed tight.
+            deadline = time.monotonic() + 600
+            while time.monotonic() < deadline:
+                try:
+                    if httpx.get("http://localhost:17861/health", timeout=5.0).status_code == 200:
+                        healthy = True
+                        break
+                except httpx.HTTPError:
+                    pass
+                time.sleep(2)
+            print(f"    /health responded: {healthy}")
+            if not healthy:
+                print("    FAIL: hf-space-gpu image never became healthy")
+                ok = False
+
+            embedding_ok = False
+            if healthy:
+                try:
+                    search_resp = httpx.get(
+                        "http://localhost:17861/search", params={"query": "box", "limit": 1}, timeout=15.0,
+                    )
+                    results = search_resp.json()
+                    # A non-empty, non-erroring hybrid-search response through
+                    # nginx is proof the local siglip2-triton text-embedding
+                    # round trip actually worked, not just that the process
+                    # answered /health — same "exercise a real call, not just
+                    # readiness" reasoning as the NVCF variant's asset-graph
+                    # check above.
+                    embedding_ok = search_resp.status_code == 200 and isinstance(results, list) and len(results) > 0
+                except (httpx.HTTPError, ValueError):
+                    pass
+                print(f"    local siglip2-triton search round trip: {embedding_ok}")
+                if not embedding_ok:
+                    print("    FAIL: hf-space-gpu image's local siglip2-triton embedding path did not "
+                          "return real results")
+                    ok = False
+
+            manifest["hf_space_gpu_smoke_passed"] = healthy and embedding_ok
+            save_manifest(manifest)
+        finally:
+            subprocess.run(["docker", "rm", "-f", container], capture_output=True, check=False, timeout=30)
+
+    return 0 if ok else 1

pipeline/clear.py

@@ -0,0 +1,101 @@
+"""Stage 1b (pre-submit) — clear stale data before delta submission.
+
+Two OpenSearch/Neo4j write paths have different idempotency on resubmission
+(verified against upstream source, not assumed):
+
+  * OpenSearch base documents are safe: the doc `_id` is a deterministic hash
+    of the URL (`OpenSearchCache.update_meta`,
+    packages/search-utils/.../elasticsearch.py:90-91), so `/process/asset`
+    overwrites the same document. No clearing needed for a resubmission.
+  * Neo4j asset *nodes* are safe (`MERGE (n:Asset {url: ...})`,
+    asset_graph_service/db/neo4j.py:244-253) but *edges* are not — they are
+    written with `apoc.create.relationship`, which always inserts
+    (neo4j.py:262-274). Reprocessing an asset that already has edges in the
+    graph duplicates every one of them.
+
+`DETACH DELETE` on the asset node removes the node *and every edge touching
+it* in one statement, which fixes the edge case and doubles as exactly what a
+`removed` asset needs (gone from both stores, never resubmitted). So one
+`clear()` step covers both:
+
+  * a "repeating" asset — present in the restored baseline AND in this run's
+    `assets.jsonl` — gets Neo4j-cleared, then resubmitted by `submit`. The
+    OpenSearch doc does not need clearing; the resubmission overwrites it.
+  * a "removed" asset (corpus.json's `removed` list) — gets Neo4j-cleared
+    *and* its OpenSearch doc deleted, and is never resubmitted (enumerate
+    already drops it from assets.jsonl).
+"""
+
+from __future__ import annotations
+
+from typing import Dict, List, Set
+
+import httpx
+
+from .config import BUILD_DIR, Config
+from .corpus import Corpus
+from .enumerate_assets import load_assets
+from .restore import load_baseline_urls
+
+
+def compute_targets(corpus: Corpus) -> Dict[str, Set[str]]:
+    current = {a.url for a in load_assets()}
+    baseline = load_baseline_urls()
+    removed = corpus.removed_set
+
+    repeating = current & baseline
+    return {
+        "neo4j_clear": repeating | removed,
+        "opensearch_delete": set(removed),
+    }
+
+
+def clear_neo4j(cfg: Config, urls: List[str]) -> int:
+    if not urls:
+        return 0
+    from neo4j import GraphDatabase
+
+    driver = GraphDatabase.driver(cfg.neo4j_bolt_url, auth=None)
+    try:
+        with driver.session() as session:
+            result = session.run(
+                "UNWIND $urls AS u MATCH (n:Asset {url: u}) DETACH DELETE n RETURN count(n) AS c",
+                urls=urls,
+            )
+            return int(result.single()["c"])
+    finally:
+        driver.close()
+
+
+def clear_opensearch(cfg: Config, urls: List[str]) -> int:
+    if not urls:
+        return 0
+    response = httpx.post(
+        f"{cfg.opensearch_url}/{cfg.main_index}/_delete_by_query?refresh=true",
+        json={"query": {"terms": {"base_key": urls}}},
+        timeout=60.0,
+    )
+    response.raise_for_status()
+    return int(response.json().get("deleted", 0))
+
+
+def run(cfg: Config) -> int:
+    corpus = Corpus.load(BUILD_DIR / "corpus.json")
+    targets = compute_targets(corpus)
+
+    neo4j_urls = sorted(targets["neo4j_clear"])
+    opensearch_urls = sorted(targets["opensearch_delete"])
+
+    if not neo4j_urls and not opensearch_urls:
+        print("nothing to clear — no repeating or removed assets against the baseline")
+        return 0
+
+    print(f"clearing {len(neo4j_urls)} Neo4j node(s) (repeating + removed) ...")
+    cleared = clear_neo4j(cfg, neo4j_urls)
+    print(f"  detached and deleted {cleared} node(s)")
+
+    print(f"deleting {len(opensearch_urls)} OpenSearch doc(s) (removed only) ...")
+    deleted = clear_opensearch(cfg, opensearch_urls)
+    print(f"  deleted {deleted} doc(s)")
+
+    return 0

pipeline/config.py

@@ -0,0 +1,512 @@
+"""Pipeline configuration, loaded from config/pipeline.env.
+
+Deliberately reads only this file (plus the process environment as an
+override), never CI_* variables: stage 1 runs locally today and on a CI runner
+later, and that later change should be a wrapper exporting the same names
+rather than a second configuration path.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Dict, List, Optional
+
+# The default NVCF function backing the siglip2-triton embedding model.
+# Fixed, not looked up by name: NVCF function-name resolution needs an extra
+# API call the smoke tooling in ../usdsearch (ci/siglip2-triton/smoke_test_nvcf.py)
+# only falls back to when no id is given. We always have the id, so nothing in
+# this repo ever needs to resolve a name.
+SIGLIP2_NVCF_FUNCTION_ID_DEFAULT = "af53131c-7416-40b4-b652-4a8b4c82a6e6"
+SIGLIP2_NVCF_ENDPOINT_DEFAULT = "grpc.nvcf.nvidia.com:443"
+
+# Same fallback chain and order as smoke_test_nvcf.py:106-107 in ../usdsearch
+# (`NVCF_RUN_KEY or NGC_GENAI_API_KEY or NVCF_GENAI_RUN_KEY`), so whichever of
+# the three an operator already has exported just works, matching upstream's
+# own tooling rather than picking one name and hoping it matches.
+SIGLIP2_NVCF_AUTH_TOKEN_VARS_DEFAULT = ("NVCF_RUN_KEY", "NGC_GENAI_API_KEY", "NVCF_GENAI_RUN_KEY")
+
+# The HF Space GPU variant's Triton base image (bare, public NGC catalog
+# tritonserver — verified live via the nvcr.io v2 registry API with an
+# anonymous guest-client token, no docker login needed; model_repo/ is
+# vendored in separately by scripts/extract_siglip2_model.sh, not baked into
+# this base — see that script's header for why the prepackaged
+# nvcr.io/nvidia/usdsearch/siglip2-triton image was dropped: its published
+# tag bakes FP32 weights, too large for a T4's 16 GB VRAM) and the HF Space
+# hardware tier it's meant to run on. See docker/Dockerfile.hf-space-gpu and
+# docs/plans/siglip2-embedded-hf-space.md.
+TRITONSERVER_BASE_IMAGE_DEFAULT = "nvcr.io/nvidia/tritonserver:26.05-py3"
+HF_SPACE_GPU_HARDWARE_DEFAULT = "t4-medium"
+
+# The two source-content backends the indexing stack (stage 1) can point at.
+# "s3" reads S3_STORAGE_* directly; "storage_api" runs `hf-storage-api`
+# (https://gitlab-master.nvidia.com/omniverse/gen-ai/hf-storage-api-service)
+# locally, backed by a HuggingFace dataset — see docs/plans/
+# index-regeneration-pipeline.md's decision log. Matches the corpus JSON's own
+# `storage_backend` field (pipeline/corpus.py); enumerate_assets.py checks the
+# two agree, since a corpus written for one backend indexed against the other
+# would silently list zero assets rather than error clearly.
+STORAGE_BACKENDS = ("s3", "storage_api")
+DEFAULT_STORAGE_BACKEND = "s3"
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BUILD_DIR = REPO_ROOT / ".build"
+DEFAULT_ENV_FILE = REPO_ROOT / "config" / "pipeline.env"
+
+
+def parse_env_file(path: Path) -> Dict[str, str]:
+    """Parse a KEY=VALUE env file. Blank lines and # comments are ignored.
+
+    Values are taken literally: no shell expansion, no quote stripping beyond a
+    single matched pair, because these values end up in URLs and S3 keys where a
+    stray transformation is hard to notice and expensive to debug.
+    """
+    out: Dict[str, str] = {}
+    if not path.exists():
+        return out
+    for raw in path.read_text().splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if "=" not in line:
+            continue
+        key, _, value = line.partition("=")
+        key = key.strip()
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        out[key] = value
+    return out
+
+
+@dataclass
+class Config:
+    values: Dict[str, str] = field(default_factory=dict)
+    env_file: Path = DEFAULT_ENV_FILE
+
+    @classmethod
+    def load(cls, env_file: Optional[Path] = None) -> "Config":
+        path = Path(env_file) if env_file else DEFAULT_ENV_FILE
+        values = parse_env_file(path)
+        # Process environment wins, so a one-off override needs no file edit.
+        for key in list(values) + [
+            "ARTIFACT_S3_URI",
+            "RUN_ID",
+            "RESTORE_RUN_ID",
+            "ES_NAME",
+            "CORPUS_FILE",
+            "INFO_ENDPOINT_URL",
+            "OPENSEARCH_URL",
+            "SIGLIP2_BACKEND",
+            "SIGLIP2_NVCF_ENDPOINT",
+            "STORAGE_BACKEND_TYPE",
+            "SIGLIP2_NVCF_FUNCTION_ID",
+            "SIGLIP2_NVCF_FUNCTION_VERSION_ID",
+            "HF_SPACE_REPO_ID",
+            "HF_SPACE_TITLE",
+            "HF_SPACE_REPO_ID_GPU",
+            "HF_SPACE_TITLE_GPU",
+            "HF_SPACE_BUILD_GPU_VARIANT",
+            "HF_SPACE_GPU_HARDWARE",
+            "TRITONSERVER_BASE_IMAGE",
+            "LLM_ENDPOINT_BASE_URL",
+            "LLM_PARSING_MODEL",
+            "VISION_VALIDATION_MODEL",
+            "VLM_METADATA_ENABLED",
+        ]:
+            if os.environ.get(key):
+                values[key] = os.environ[key]
+        return cls(values=values, env_file=path)
+
+    # ── typed accessors ───────────────────────────────────────────────────
+
+    def get(self, key: str, default: str = "") -> str:
+        return self.values.get(key, default) or default
+
+    def require(self, key: str) -> str:
+        value = self.values.get(key, "").strip()
+        if not value:
+            raise SystemExit(
+                f"{key} is not set. Add it to {self.env_file} "
+                f"(see config/pipeline.env.example)."
+            )
+        return value
+
+    def get_int(self, key: str, default: int) -> int:
+        raw = self.values.get(key, "").strip()
+        return int(raw) if raw else default
+
+    def get_float(self, key: str, default: float) -> float:
+        raw = self.values.get(key, "").strip()
+        return float(raw) if raw else default
+
+    # ── derived values ────────────────────────────────────────────────────
+
+    @property
+    def es_name(self) -> str:
+        return self.get("ES_NAME", "simready-central")
+
+    @property
+    def main_index(self) -> str:
+        """`{ES_NAME}-ver5.0` — OSCacheDict.get_index_name()."""
+        return f"{self.es_name}-ver5.0"
+
+    @property
+    def image_cache_index(self) -> str:
+        """`{ES_NAME}-ver4.0-image-cache` — storage_index_name + field + "-cache"."""
+        return f"{self.es_name}-ver4.0-image-cache"
+
+    @property
+    def corpus_file(self) -> Path:
+        return REPO_ROOT / self.get("CORPUS_FILE", "config/corpus.json")
+
+    @property
+    def info_endpoint(self) -> str:
+        return self.get("INFO_ENDPOINT_URL", "http://localhost:8001").rstrip("/")
+
+    @property
+    def opensearch_url(self) -> str:
+        return self.get("OPENSEARCH_URL", "http://localhost:9200").rstrip("/")
+
+    @property
+    def neo4j_bolt_url(self) -> str:
+        return self.get("NEO4J_BOLT_URL", "bolt://localhost:7687")
+
+    # ── siglip2 backend (local Triton vs. NVCF) ─────────────────────────────
+
+    @property
+    def siglip2_backend(self) -> str:
+        backend = self.get("SIGLIP2_BACKEND", "local").strip().lower()
+        if backend not in ("local", "nvcf"):
+            raise SystemExit(f"SIGLIP2_BACKEND must be 'local' or 'nvcf', got {backend!r}")
+        return backend
+
+    @property
+    def siglip2_nvcf(self) -> bool:
+        return self.siglip2_backend == "nvcf"
+
+    # ── HF Space GPU variant (local siglip2-triton, no NVCF) ────────────────
+    # Independent of SIGLIP2_BACKEND above (which is the *indexing stack's*
+    # compose backend, local-GPU vs. NVCF) — this is a second, optional
+    # `bake`/`deploy-space-gpu` target that serves the same already-indexed
+    # corpus through docker/Dockerfile.hf-space-gpu instead of
+    # docker/Dockerfile.hf-space, off by default so existing pipelines that
+    # don't want the extra ~15 GB build/push are unaffected. See
+    # docs/plans/siglip2-embedded-hf-space.md.
+
+    @property
+    def hf_space_gpu_variant_enabled(self) -> bool:
+        return self.get("HF_SPACE_BUILD_GPU_VARIANT", "false").strip().lower() in ("1", "true", "yes")
+
+    # ── storage backend (S3 vs. hf-storage-api / storage_api) ──────────────
+
+    @property
+    def storage_backend(self) -> str:
+        backend = self.get("STORAGE_BACKEND_TYPE", DEFAULT_STORAGE_BACKEND).strip().lower()
+        if backend not in STORAGE_BACKENDS:
+            raise SystemExit(f"STORAGE_BACKEND_TYPE must be one of {STORAGE_BACKENDS}, got {backend!r}")
+        return backend
+
+    @property
+    def storage_api_backend(self) -> bool:
+        return self.storage_backend == "storage_api"
+
+    def siglip2_nvcf_env(self) -> Dict[str, str]:
+        """Env vars the gRPC Triton client (packages/siglip2-triton-client)
+        reads to reach an NVCF-hosted function instead of a local container —
+        same `SIGLIP2_TRITON_SERVER_*`-prefixed pydantic-settings fields
+        either way, just pointed at NVCF with auth headers instead of the
+        local siglip2-triton service.
+
+        `SIGLIP2_NVCF_AUTH_TOKEN_VAR`, if set, names one specific *environment
+        variable* to read the token from. Left unset (the default), the same
+        three-way fallback chain as upstream's smoke tooling applies — the
+        token itself is never read from `pipeline.env` or committed, same
+        pattern as the S3 artifact credentials.
+        """
+        function_id = self.get("SIGLIP2_NVCF_FUNCTION_ID", SIGLIP2_NVCF_FUNCTION_ID_DEFAULT)
+        version_id = self.get("SIGLIP2_NVCF_FUNCTION_VERSION_ID").strip()
+        headers = {"function-id": function_id}
+        if version_id:
+            headers["function-version-id"] = version_id
+
+        explicit_var = self.get("SIGLIP2_NVCF_AUTH_TOKEN_VAR").strip()
+        token_vars = (explicit_var,) if explicit_var else SIGLIP2_NVCF_AUTH_TOKEN_VARS_DEFAULT
+        token = ""
+        for var in token_vars:
+            token = os.environ.get(var, "").strip()
+            if token:
+                break
+        if not token:
+            raise SystemExit(
+                f"SIGLIP2_BACKEND=nvcf but none of {', '.join('$' + v for v in token_vars)} "
+                f"is set in the environment. One must hold the NVCF run key "
+                f"(never committed to pipeline.env)."
+            )
+
+        return {
+            "SIGLIP2_TRITON_SERVER_URL": self.get("SIGLIP2_NVCF_ENDPOINT", SIGLIP2_NVCF_ENDPOINT_DEFAULT),
+            "SIGLIP2_TRITON_SERVER_SSL": "true",
+            "SIGLIP2_TRITON_SERVER_AUTH_TOKEN": token,
+            "SIGLIP2_TRITON_SERVER_HEADERS": json.dumps(headers),
+            # deepsearch-api reads this one unprefixed (main.py:161); the
+            # worker reads the SIGLIP2_TRITON_SERVER_URL above instead.
+            "TRITON_SERVER_URL": self.get("SIGLIP2_NVCF_ENDPOINT", SIGLIP2_NVCF_ENDPOINT_DEFAULT),
+        }
+
+    # ── LLM parsing / VLM verification endpoint (HF Space) ──────────────────
+
+    @property
+    def llm_endpoint_base_url(self) -> str:
+        """Empty (the default) means the HF Space keeps shipping with both
+        roles disabled, exactly as it does today
+        (`USDSEARCH_LLM_PARSING_ENABLED`/`USDSEARCH_VISION_VALIDATION_ENABLED`
+        baked `false` in docker/Dockerfile.hf-space) — this is the one knob
+        that turns them on. Point it at any OpenAI-compatible
+        `/v1/chat/completions` server that serves both a `LLM_PARSING_MODEL`
+        alias and a `VISION_VALIDATION_MODEL` alias — e.g. either of this
+        repo's own deploy scripts' endpoints
+        (scripts/deploy_hf_endpoint.py / scripts/deploy_nvcf_endpoint.py)."""
+        return self.get("LLM_ENDPOINT_BASE_URL").strip()
+
+    @property
+    def llm_parsing_model(self) -> str:
+        return self.get("LLM_PARSING_MODEL", "parser")
+
+    @property
+    def vision_validation_model(self) -> str:
+        return self.get("VISION_VALIDATION_MODEL", "reranker")
+
+    def llm_endpoint_api_key(self) -> str:
+        """Read from the environment only — never `pipeline.env`, same
+        policy as every other credential this pipeline touches (NVCF token,
+        S3 keys, HF Space deploy token). Provider-agnostic by design — HF
+        Inference Endpoints, NVCF, or anything else OpenAI-compatible — so
+        there's no single "the" NVCF/HF var name to default to; instead of
+        forcing every provider through one hardcoded `$LLM_ENDPOINT_API_KEY`
+        name, `LLM_ENDPOINT_API_KEY_VAR` (in `pipeline.env`, not sensitive
+        itself — it's just a variable *name*) names which env var actually
+        holds the bearer token for whichever endpoint `LLM_ENDPOINT_BASE_URL`
+        currently points at, so switching providers (e.g. NVCF's
+        `$NVCF_GENAI_RUN_KEY` vs. an HF Inference Endpoint's
+        `$HF_INFERENCE_ENDPOINT_TOKEN` — see docs/development.md) is a
+        `pipeline.env` edit, not an extra `export` before every command.
+        `$LLM_ENDPOINT_API_KEY` itself, if set, still wins outright — same
+        name/precedence as before this existed, so nothing already relying
+        on it breaks."""
+        explicit_var = self.get("LLM_ENDPOINT_API_KEY_VAR").strip()
+        token = os.environ.get("LLM_ENDPOINT_API_KEY", "").strip()
+        if not token and explicit_var:
+            token = os.environ.get(explicit_var, "").strip()
+        if not token:
+            hint = f" (or ${explicit_var}, per LLM_ENDPOINT_API_KEY_VAR)" if explicit_var else ""
+            raise SystemExit(
+                f"LLM_ENDPOINT_BASE_URL is set but no bearer token was found — set "
+                f"$LLM_ENDPOINT_API_KEY{hint} in the environment (never pipeline.env) to the "
+                f"key for that endpoint."
+            )
+        return token
+
+    def llm_endpoint_variables(self) -> Dict[str, str]:
+        """Non-sensitive `USDSEARCH_LLM_*`/`USDSEARCH_VISION_VALIDATION_*`
+        env vars for the HF Space — plain runtime Space "Variables", not
+        Dockerfile build ARGs: docker/Dockerfile.hf-space already bakes
+        `USDSEARCH_LLM_PARSING_ENABLED`/`USDSEARCH_VISION_VALIDATION_ENABLED`
+        as `ENV ... false` defaults, and a runtime-injected env var of the
+        same name overrides an image's baked `ENV` value (standard Docker
+        behavior) — so applying these to an already-built, already-running
+        Space needs no rebuild, just a restart. See llm_endpoint_api_key()
+        for the one secret half of this (USDSEARCH_LLM_API_KEY).
+
+        `enable_thinking: false` is forced into both EXTRA_BODY values
+        unconditionally: it's required for this pipeline's own Qwen3.6
+        deploy scripts and a harmless no-op for a hypothetical non-Qwen
+        endpoint (OpenAI-compatible servers ignore unknown request-body
+        keys — see llm_client.client.LLMClient's own docstring in
+        ../usdsearch). `USDSEARCH_VISION_VALIDATION_METHOD=logprob` matches
+        this pipeline's own deploy scripts' `reranker` role (a single-token
+        logprob judge, not the default `generative` structured-JSON verdict)
+        — pin explicitly rather than relying on the client's own default,
+        since a `generative`-only endpoint would otherwise get a request
+        shape it never expected. Verified live against the deployed NVCF
+        `reranker` endpoint: it returns real per-token `top_logprobs`, and a
+        full `/vlm_validate/search_result` round trip through this image
+        comes back with `reasoning: "P(Yes)=... from first-token
+        log-probs."`, not a generated sentence, confirming the logprob path
+        actually runs rather than just the flag being set.
+
+        The `..._LOGPROB_*` knobs are pinned so client default changes can't
+        drift this deployment. `max_tokens=1`: Qwen emits the verdict at
+        position 0. `top_logprobs=20`: the judge scores P(Yes)/(P(Yes)+P(No))
+        over the returned tokens, so 1 makes every verdict 0 or 100 and
+        abstains (504) when the top token is neither; it costs nothing extra
+        (the engine computes the full distribution) and must stay <= 20 (the
+        client cap; the engine allows 25). `MAX_TRIES=2`: the client calls
+        with max_retries=0, so one transient engine error would otherwise be a
+        503, which stops the Explorer validating the whole search.
+        """
+        if not self.llm_endpoint_base_url:
+            # Nothing to override — defer entirely to the Dockerfile's own
+            # baked `false` defaults rather than pushing a redundant (and,
+            # for USDSEARCH_LLM_BASE_URL, actively wrong — an explicit empty
+            # string is not the same as "unset" to pydantic-settings)
+            # variable update.
+            return {}
+        extra_body = json.dumps({"chat_template_kwargs": {"enable_thinking": False}})
+        return {
+            "USDSEARCH_LLM_PARSING_ENABLED": "true",
+            "USDSEARCH_VISION_VALIDATION_ENABLED": "true",
+            "USDSEARCH_LLM_BASE_URL": self.llm_endpoint_base_url,
+            "USDSEARCH_LLM_PARSING_MODEL": self.llm_parsing_model,
+            "USDSEARCH_VISION_VALIDATION_MODEL": self.vision_validation_model,
+            "USDSEARCH_LLM_PARSING_EXTRA_BODY": extra_body,
+            "USDSEARCH_VISION_VALIDATION_EXTRA_BODY": extra_body,
+            "USDSEARCH_VISION_VALIDATION_METHOD": "logprob",
+            "USDSEARCH_VISION_VALIDATION_LOGPROB_COVER_MIN": "0.2",
+            "USDSEARCH_VISION_VALIDATION_LOGPROB_ABSTAIN_AS_NO": "false",
+            "USDSEARCH_VISION_VALIDATION_LOGPROB_TOP_LOGPROBS": "20",
+            "USDSEARCH_VISION_VALIDATION_LOGPROB_MAX_TOKENS": "1",
+            "USDSEARCH_VISION_VALIDATION_MAX_TRIES": "2",
+        }
+
+    # ── VLM metadata extraction from thumbnails (indexing-time plugin) ──────
+    #
+    # The `thumbnail_to_vision_metadata` plugin (inactive by default, see
+    # config/plugin.config.yaml) calls out to an LLM/VLM at indexing time to
+    # caption/tag each asset's thumbnail. Off unless VLM_METADATA_ENABLED=true
+    # — same "additive, opt-in" posture as SIGLIP2_BACKEND=nvcf and
+    # STORAGE_BACKEND_TYPE=storage_api.
+    #
+    # Deliberately its OWN connection, separate from LLM_ENDPOINT_BASE_URL
+    # (the HF Space's real-time LLM-parsing/vision-validation connection,
+    # llm_endpoint_variables() above): this role runs batch/background at
+    # indexing time in its own container (monitor-worker-thumbnail-to-
+    # vision-metadata), never in the HF Space process, so there is no reason
+    # to share a connection sized/rate-limited for interactive query traffic.
+    #
+    # No pipeline-specific wrapper env vars here (unlike LLM_ENDPOINT_* above)
+    # — docker-compose.indexing.vlm-metadata.yml's worker reads the real
+    # container var names directly (USDSEARCH_LLM_API_KEY/_BASE_URL,
+    # USDSEARCH_VISION_METADATA_MODEL — packages/llm-client/llm_client/
+    # client.py's LLMConnectionConfig / metadata_generation.py's
+    # MetadataGenerationConfig in ../usdsearch), null-pass-through from
+    # whatever's already exported in the shell (compose_env()'s `dict(os.environ)`
+    # base already carries them to the `docker compose` subprocess — no
+    # translation needed). Left unset, USDSEARCH_LLM_BASE_URL/
+    # USDSEARCH_VISION_METADATA_MODEL fall back to llm_client's own shipped
+    # defaults (DEFAULT_BASE_URL = "https://inference-api.nvidia.com" / NVIDIA
+    # Inference Hub, MetadataGenerationConfig.model = "azure/openai/gpt-5.6-sol"
+    # — see ../usdsearch's docs/models-and-config.md, "Metadata gen" row) —
+    # exactly the endpoint+model this deployment wants. Only
+    # $USDSEARCH_LLM_API_KEY is required; require_vlm_metadata_credentials()
+    # below fails fast (before `up`) if it's missing.
+
+    @property
+    def vlm_metadata_enabled(self) -> bool:
+        return self.get("VLM_METADATA_ENABLED", "false").strip().lower() in ("1", "true", "yes")
+
+    def require_vlm_metadata_credentials(self) -> None:
+        if not os.environ.get("USDSEARCH_LLM_API_KEY", "").strip():
+            raise SystemExit(
+                "VLM_METADATA_ENABLED=true but $USDSEARCH_LLM_API_KEY is not set in the "
+                "environment (never pipeline.env) — the bearer key for the VLM metadata "
+                "endpoint (NVIDIA Inference Hub by default; see "
+                "../usdsearch/docs/models-and-config.md)."
+            )
+
+    def compose_env(self) -> Dict[str, str]:
+        """The environment every `docker compose`/`docker run` subprocess
+        this pipeline spawns should get — `pipeline.env`'s values plus
+        (when `SIGLIP2_BACKEND=nvcf`) the computed NVCF endpoint/auth vars
+        the compose overlays interpolate.
+
+        A single source of truth for this, used everywhere a compose command
+        touches the indexing project (`run_pipeline.py`'s `up`/`down`,
+        `verify.py`'s runtime bring-up, and `export.py`/`restore.py`'s own
+        `stop`/`start neo4j asset-graph-service` calls) — those last two used
+        to build their `docker compose` commands with no `env=` at all,
+        silently inheriting the bare process environment instead. Harmless
+        so far only because neither `neo4j` nor `asset-graph-service`
+        actually reads the vars that went missing (`ES_NAME`,
+        `S3_STORAGE_BUCKET_NAME`, `SIGLIP2_TRITON_SERVER_*`) — but real
+        enough to show up as a page of "variable is not set" warnings in the
+        CI log, which is what surfaced it.
+        """
+        env = dict(os.environ)
+        env.update({k: v for k, v in self.values.items() if v})
+        if self.siglip2_nvcf:
+            env.update(self.siglip2_nvcf_env())
+        if self.storage_api_backend:
+            # The hf-storage-api container's YAML-null env passthrough
+            # (docker-compose.indexing.storage-api.yml) forwards a host var
+            # only under its own literal name, HF_ADAPTER_HF_TOKEN — but
+            # every other HF credential in this pipeline (the enumerator,
+            # pipeline/hf_space.py) reads the standard $HF_TOKEN. Mapped here
+            # so operators only ever set one variable. Verified live: without
+            # this, hf-storage-api silently ran unauthenticated and every
+            # submission against a private dataset 401'd as "Asset missing".
+            hf_token = os.environ.get("HF_TOKEN", "").strip()
+            if hf_token:
+                env["HF_ADAPTER_HF_TOKEN"] = hf_token
+        # No vlm_metadata_enabled-specific merge needed here: `env` already
+        # started as `dict(os.environ)` above, so USDSEARCH_LLM_API_KEY/
+        # USDSEARCH_LLM_BASE_URL/USDSEARCH_VISION_METADATA_MODEL — whatever's
+        # already exported in the shell — reach docker-compose.indexing.vlm-metadata.yml's
+        # null-pass-through vars unchanged. See the "VLM metadata extraction"
+        # section above for why this role deliberately has no pipeline-specific
+        # wrapper vars the way LLM_ENDPOINT_* does.
+        return env
+
+    def indexing_compose_files(self) -> List[str]:
+        files = ["-f", str(REPO_ROOT / "compose" / "docker-compose.indexing.yml")]
+        if self.siglip2_nvcf:
+            files += ["-f", str(REPO_ROOT / "compose" / "docker-compose.indexing.nvcf-siglip2.yml")]
+        # Only the indexing stack ever talks to a storage backend directly —
+        # the runtime stack (verify/HF Space) serves an already-baked index and
+        # needs neither S3 nor a running hf-storage-api. See runtime_compose_files().
+        if self.storage_api_backend:
+            files += ["-f", str(REPO_ROOT / "compose" / "docker-compose.indexing.storage-api.yml")]
+        # Independent of storage backend (the new worker reads thumbnails
+        # through whichever backend is already configured), applied last by
+        # convention alongside the others above.
+        if self.vlm_metadata_enabled:
+            files += ["-f", str(REPO_ROOT / "compose" / "docker-compose.indexing.vlm-metadata.yml")]
+        return files
+
+    def runtime_compose_files(self) -> List[str]:
+        files = ["-f", str(REPO_ROOT / "compose" / "docker-compose.runtime.yml")]
+        if self.siglip2_nvcf:
+            files += ["-f", str(REPO_ROOT / "compose" / "docker-compose.runtime.nvcf-siglip2.yml")]
+        return files
+
+
+BASE_PLUGINS = ("thumbnail_to_embedding", "asset_graph_generation")
+"""The two plugins this pipeline always runs."""
+
+# Every plugin key config/plugin.config.yaml lists — used to generate
+# .build/plugin.config.yaml (see enumerate_assets.write_plugin_config_yaml).
+# Keep in sync with that file's own keys.
+ALL_PLUGIN_NAMES = (
+    "thumbnail_to_embedding",
+    "asset_graph_generation",
+    "thumbnail_generation",
+    "rendering_to_embedding",
+    "image_to_embedding",
+    "image_to_vision_metadata",
+    "rendering_to_vision_metadata",
+    "thumbnail_to_vision_metadata",
+)
+
+
+def active_plugins(cfg: "Config") -> tuple:
+    """The plugins this run actually enqueues — BASE_PLUGINS plus, opt-in,
+    `thumbnail_to_vision_metadata` (VLM_METADATA_ENABLED=true). Superseded
+    the old module-level `ACTIVE_PLUGINS` constant so this can vary per run
+    rather than being fixed at import time; every former caller of that
+    constant now calls this with its own `cfg` instead."""
+    plugins = list(BASE_PLUGINS)
+    if cfg.vlm_metadata_enabled:
+        plugins.append("thumbnail_to_vision_metadata")
+    return tuple(plugins)

pipeline/corpus.py

@@ -0,0 +1,370 @@
+"""Corpus definition: parsing, validation, and include/exclude matching.
+
+The corpus JSON is the sole authority over what gets indexed. With the crawler
+removed, nothing else filters and nothing else can widen the set, so the
+matching rules here are deliberately dumb: literal `s3://bucket/key` prefixes
+compared with `str.startswith`. No globs, no regex. Glob-vs-regex ambiguity is
+exactly the kind of thing that silently indexes the wrong 200k assets.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable, List, Sequence, Tuple, Union
+
+from . import hf_addressing
+
+DEFAULT_EXTENSIONS = (".usd", ".usda", ".usdc", ".usdz")
+
+STORAGE_BACKENDS = ("s3", "storage_api")
+DEFAULT_STORAGE_BACKEND = "s3"
+
+# `hf-storage-api`'s catalog unit is an asset *folder*, identified by a marker
+# file at its root (its `layout.marker`/`layout.manifest`, default
+# "com.nvidia.simready.packaging.json" — the SimReady packaging convention).
+# Once a folder is catalogued, every file beneath it is individually
+# addressable (its own `resolve()` walks the whole subtree, not just the
+# marker) — so this pipeline's existing file-level include/exclude/extension
+# matching still selects exactly which files get indexed; `asset_marker` only
+# tells the enumerator (and the catalog it generates) which ancestor folder of
+# each matched file is "the asset" for hf-storage-api's access-boundary.
+DEFAULT_ASSET_MARKER = "com.nvidia.simready.packaging.json"
+
+# The revision an hf:// corpus entry with no /resolve/<sha>/ segment is taken
+# to track — matches hf-storage-api's own RepoConfig.revision default.
+DEFAULT_HF_REVISION = "main"
+
+# Applied on top of the corpus, mirroring the upstream monitor's OV_EXCLUDE_PATHS
+# default. Thumbnails are inputs to thumbnail_to_embedding, never assets.
+ALWAYS_EXCLUDE_SUBSTRINGS = ("/.thumbs/", ".__omni_channel__")
+
+
+class CorpusError(ValueError):
+    """Raised for a corpus file that cannot be used as written."""
+
+
+@dataclass(frozen=True)
+class S3Prefix:
+    bucket: str
+    key: str
+
+    @property
+    def uri(self) -> str:
+        return f"s3://{self.bucket}/{self.key}"
+
+    @staticmethod
+    def parse(raw: str, whence: str) -> "S3Prefix":
+        if not isinstance(raw, str) or not raw.startswith("s3://"):
+            raise CorpusError(f"{whence}: {raw!r} is not an s3:// URL")
+        remainder = raw[len("s3://"):]
+        if "/" not in remainder:
+            # "s3://bucket" with no key would mean the whole bucket. Require an
+            # explicit trailing slash so that intent is visible in the file.
+            raise CorpusError(
+                f"{whence}: {raw!r} has no key. Write 's3://{remainder}/' if you "
+                f"really mean the entire bucket."
+            )
+        bucket, _, key = remainder.partition("/")
+        if not bucket:
+            raise CorpusError(f"{whence}: {raw!r} has an empty bucket name")
+        return S3Prefix(bucket=bucket, key=key)
+
+
+@dataclass(frozen=True)
+class HfPrefix:
+    """An ``hf://`` prefix naming a HuggingFace repo (+ pinned revision) and an
+    optional path prefix within it — the ``storage_api`` backend's equivalent
+    of :class:`S3Prefix`'s bucket/key. See `pipeline/hf_addressing.py` for the
+    address grammar.
+    """
+
+    host: str
+    repo_type: str
+    repo_id: str
+    revision: str
+    key: str  # trailing "/" preserved for a folder, exactly like S3Prefix.key
+
+    @property
+    def repo_key(self) -> Tuple[str, str, str, str]:
+        """Groups prefixes that share one repo+revision — the `storage_api`
+        equivalent of `S3Prefix.bucket`, used by `hf_repos`/
+        `include_prefixes_for_repo`."""
+        return (self.host, self.repo_type, self.repo_id, self.revision)
+
+    @property
+    def uri(self) -> str:
+        is_folder = self.key == "" or self.key.endswith("/")
+        return hf_addressing.build(
+            host=self.host, repo_type=self.repo_type, repo_id=self.repo_id,
+            revision=self.revision, path=self.key, is_folder=is_folder,
+        )
+
+    @staticmethod
+    def parse(raw: str, whence: str) -> "HfPrefix":
+        if not isinstance(raw, str) or not raw.startswith("hf://"):
+            raise CorpusError(f"{whence}: {raw!r} is not an hf:// URL")
+        try:
+            addr = hf_addressing.parse(raw)
+        except hf_addressing.AddressError as exc:
+            raise CorpusError(f"{whence}: {raw!r} is not a valid hf:// address ({exc})") from exc
+        # A /resolve/<rev>/ segment is only ever valid as a pinned commit sha:
+        # hf-storage-api's own address minting omits it entirely for a moving
+        # ref (`AssetStore._emit_revision`), and its resolve path checks a
+        # present segment against the repo's *actual* resolved sha
+        # (`_serves_revision`) — so a literal `resolve/main/` never matches
+        # and the address 404s. Verified live. No segment at all means "the
+        # repo's configured revision", which this pipeline always takes to be
+        # `main` (moving) — see DEFAULT_HF_REVISION.
+        if addr.revision and not hf_addressing.looks_like_sha(addr.revision):
+            raise CorpusError(
+                f"{whence}: {raw!r} pins /resolve/{addr.revision}/, which is not a full "
+                f"commit sha. hf-storage-api never resolves a moving ref embedded this "
+                f"way (it always 404s) — either pin an actual sha, or drop the "
+                f"/resolve/{addr.revision}/ segment entirely to track '{DEFAULT_HF_REVISION}'."
+            )
+        revision = addr.revision or DEFAULT_HF_REVISION
+        key = addr.path
+        if addr.is_folder and key and not key.endswith("/"):
+            key += "/"
+        return HfPrefix(
+            host=addr.host, repo_type=addr.repo_type, repo_id=addr.repo_id,
+            revision=revision, key=key,
+        )
+
+
+Prefix = Union[S3Prefix, HfPrefix]
+
+_PREFIX_PARSERS = {"s3": S3Prefix.parse, "storage_api": HfPrefix.parse}
+
+
+@dataclass
+class Corpus:
+    name: str
+    storage_backend: str
+    include: List[Prefix]
+    exclude: List[Prefix]
+    removed: List[str]
+    extensions: Tuple[str, ...]
+    sha256: str
+    source_path: Path
+    asset_marker: str = DEFAULT_ASSET_MARKER
+    # Both passed straight through to the generated hf-storage-api catalog's
+    # `layout:` block (pipeline/hf_catalog.py) — "" means omit the key and
+    # let hf-storage-api's own default apply. Needed for a dataset whose
+    # thumbnails/root-USD don't sit at hf-storage-api's default SimReady
+    # locations: verified live against nvidia/srp-staging-controlled, whose
+    # actual layout is `catalog_kind: wrapp` (root USD resolved from the
+    # `.wrapp` package's own top-level file, not the `{data_dir}/{asset_name}.usd`
+    # naming guess) with thumbnails at `.thumbs/` directly under the asset
+    # folder, not `{data_dir}/.thumbs`. Without these, hf-storage-api's
+    # GetMetadata silently computes a nonsense root_usd/thumbnail path and
+    # thumbnail_to_embedding "succeeds" with zero embeddings — no error,
+    # just 0% coverage.
+    catalog_kind: str = ""
+    thumbs_dir: str = ""
+    # `content_fallback` is hf-storage-api's own naming-convention template
+    # for the root USD when no `root_usd_index`/`.wrapp` sidecar is present
+    # (default `{data_dir}/{asset_name}.usd`) — overridable here for a
+    # dataset whose filenames don't match that guess. Verified live against
+    # nvidia/srp-staging-controlled's 2026-09 layout restructure: every one
+    # of 1488 assets' root USD is `{folder}/simready_usd/sm_{folder}_01.usd`,
+    # not `{folder}/simready_usd/{folder}.usd` — and that restructure also
+    # dropped the `.wrapp` sidecar `catalog_kind: wrapp` depends on entirely
+    # (folder() itself 404s without one, before content_fallback even runs),
+    # so this corpus now needs `catalog_kind: manifest` (the default) with
+    # this override, not `wrapp` + thumbs_dir as before.
+    content_fallback: str = ""
+
+    @property
+    def buckets(self) -> List[str]:
+        """S3 only — see `hf_repos` for the `storage_api` equivalent."""
+        return sorted({p.bucket for p in self.include})
+
+    @property
+    def hf_repos(self) -> List[Tuple[str, str, str, str]]:
+        """`storage_api` only — see `buckets` for the S3 equivalent. Each
+        tuple is `(host, repo_type, repo_id, revision)`, i.e. `HfPrefix.repo_key`."""
+        return sorted({p.repo_key for p in self.include})
+
+    @property
+    def removed_set(self) -> frozenset:
+        return frozenset(self.removed)
+
+    def include_prefixes_for(self, bucket: str) -> List[str]:
+        return [p.key for p in self.include if p.bucket == bucket]
+
+    def include_prefixes_for_repo(self, repo_key: Tuple[str, str, str, str]) -> List[str]:
+        return [p.key for p in self.include if p.repo_key == repo_key]
+
+    # ── matching ──────────────────────────────────────────────────────────
+
+    def is_excluded(self, uri: str) -> bool:
+        if any(s in uri for s in ALWAYS_EXCLUDE_SUBSTRINGS):
+            return True
+        return any(uri.startswith(p.uri) for p in self.exclude)
+
+    def is_included(self, uri: str) -> bool:
+        return any(uri.startswith(p.uri) for p in self.include)
+
+    def has_wanted_extension(self, uri: str) -> bool:
+        lowered = uri.lower()
+        return any(lowered.endswith(ext) for ext in self.extensions)
+
+    def accepts(self, uri: str) -> bool:
+        """Exclude wins over include, matching upstream `exclude_items` order."""
+        if self.is_excluded(uri):
+            return False
+        if not self.is_included(uri):
+            return False
+        return self.has_wanted_extension(uri)
+
+    # ── loading ─────────────────────────────────────────────────────���─────
+
+    @classmethod
+    def load(cls, path: Path) -> "Corpus":
+        if not path.exists():
+            raise CorpusError(
+                f"corpus file not found: {path}. Copy config/corpus.example.json "
+                f"and edit it."
+            )
+        raw_bytes = path.read_bytes()
+        try:
+            doc = json.loads(raw_bytes)
+        except json.JSONDecodeError as exc:
+            raise CorpusError(f"{path}: invalid JSON — {exc}") from exc
+        return cls.from_dict(doc, sha256=hashlib.sha256(raw_bytes).hexdigest(), source_path=path)
+
+    @classmethod
+    def from_dict(cls, doc: dict, sha256: str = "", source_path: Path = Path(".")) -> "Corpus":
+        if not isinstance(doc, dict):
+            raise CorpusError("corpus must be a JSON object")
+
+        version = doc.get("version", 1)
+        if version != 1:
+            raise CorpusError(f"unsupported corpus version {version!r}; expected 1")
+
+        name = doc.get("name") or ""
+        if not name:
+            raise CorpusError("corpus 'name' is required")
+
+        storage_backend = doc.get("storage_backend") or DEFAULT_STORAGE_BACKEND
+        if storage_backend not in STORAGE_BACKENDS:
+            raise CorpusError(
+                f"storage_backend: {storage_backend!r} is not one of {STORAGE_BACKENDS}"
+            )
+        parse_prefix = _PREFIX_PARSERS[storage_backend]
+
+        raw_include = doc.get("include") or []
+        if not raw_include:
+            # An empty include is almost always an accident, and reading it as
+            # "everything" would index an entire bucket by omission.
+            raise CorpusError(
+                "corpus 'include' is empty. Refusing to interpret that as "
+                "'index everything' — list the prefixes explicitly."
+            )
+        include = [parse_prefix(r, "include") for r in raw_include]
+        exclude = [parse_prefix(r, "exclude") for r in (doc.get("exclude") or [])]
+        # Exact asset URLs (not prefixes) known to have been indexed before and
+        # since deleted from the source bucket. Matched by exact equality
+        # against a baseline run's asset list, never by prefix — see `clear`
+        # (restore/delta indexing). Validated the same way as include/exclude
+        # so a malformed URL is caught here, not at Neo4j/OpenSearch call time.
+        removed = [parse_prefix(r, "removed").uri for r in (doc.get("removed") or [])]
+
+        extensions = tuple(
+            e.lower() if e.startswith(".") else f".{e.lower()}"
+            for e in (doc.get("extensions") or DEFAULT_EXTENSIONS)
+        )
+        asset_marker = doc.get("asset_marker") or DEFAULT_ASSET_MARKER
+        if storage_backend != "storage_api" and "asset_marker" in doc:
+            raise CorpusError("asset_marker is only meaningful for storage_backend: storage_api")
+        catalog_kind = doc.get("catalog_kind") or ""
+        if storage_backend != "storage_api" and "catalog_kind" in doc:
+            raise CorpusError("catalog_kind is only meaningful for storage_backend: storage_api")
+        thumbs_dir = doc.get("thumbs_dir") or ""
+        if storage_backend != "storage_api" and "thumbs_dir" in doc:
+            raise CorpusError("thumbs_dir is only meaningful for storage_backend: storage_api")
+        content_fallback = doc.get("content_fallback") or ""
+        if storage_backend != "storage_api" and "content_fallback" in doc:
+            raise CorpusError("content_fallback is only meaningful for storage_backend: storage_api")
+
+        corpus = cls(
+            name=name,
+            storage_backend=storage_backend,
+            include=include,
+            exclude=exclude,
+            removed=removed,
+            extensions=extensions,
+            sha256=sha256,
+            source_path=source_path,
+            asset_marker=asset_marker,
+            catalog_kind=catalog_kind,
+            thumbs_dir=thumbs_dir,
+            content_fallback=content_fallback,
+        )
+        corpus.validate()
+        return corpus
+
+    def validate(self) -> None:
+        """Structural checks that catch the common typos."""
+        seen = set()
+        for prefix in self.include:
+            if prefix.uri in seen:
+                raise CorpusError(f"include: duplicate entry {prefix.uri!r}")
+            seen.add(prefix.uri)
+
+        # A prefix nested inside another include is redundant, not wrong — but
+        # it usually signals a misunderstanding of the trailing-slash rule.
+        for a in self.include:
+            for b in self.include:
+                if a is not b and a.uri != b.uri and a.uri.startswith(b.uri):
+                    raise CorpusError(
+                        f"include: {a.uri!r} is already covered by {b.uri!r}; "
+                        f"remove the redundant entry"
+                    )
+
+        # A stray exclude — one that sits under no include — is nearly always a
+        # typo, and it silently does nothing.
+        for prefix in self.exclude:
+            if not any(prefix.uri.startswith(inc.uri) for inc in self.include):
+                raise CorpusError(
+                    f"exclude: {prefix.uri!r} is not under any include prefix, so "
+                    f"it would have no effect. Fix the path or drop the entry."
+                )
+
+        removed_seen = set()
+        for uri in self.removed:
+            if uri in removed_seen:
+                raise CorpusError(f"removed: duplicate entry {uri!r}")
+            removed_seen.add(uri)
+
+    @property
+    def run_id_suffix(self) -> str:
+        return self.sha256[:7]
+
+
+def summarize(corpus: Corpus) -> str:
+    if corpus.storage_backend == "storage_api":
+        sources_label = "hf repos"
+        sources = ", ".join(f"{repo_id}@{revision}" for _host, _rtype, repo_id, revision in corpus.hf_repos)
+    else:
+        sources_label = "buckets"
+        sources = ", ".join(corpus.buckets)
+    lines = [
+        f"corpus:          {corpus.name}",
+        f"storage_backend: {corpus.storage_backend}",
+        f"sha256:          {corpus.sha256}",
+        f"{sources_label}:{' ' * (12 - len(sources_label))} {sources}",
+        f"include:         {len(corpus.include)} prefixes",
+        f"exclude:         {len(corpus.exclude)} prefixes",
+        f"removed:         {len(corpus.removed)} assets",
+        f"extensions:      {', '.join(corpus.extensions)}",
+    ]
+    return "\n".join(lines)
+
+
+def iter_uris(objects: Iterable[Tuple[str, str]]) -> Sequence[str]:
+    return [f"s3://{bucket}/{key}" for bucket, key in objects]

pipeline/enumerate_assets.py

@@ -0,0 +1,331 @@
+"""Stage 0 — expand the corpus into an exact asset list.
+
+With the crawler removed, nothing lists the bucket at index time, so this stage
+owns enumeration. Its output is the pipeline's ground truth: `N = len(assets)`
+is the expected document count, known before any indexing starts, and every
+later stage asserts against it.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Dict, Iterator, List, Optional, Set, Tuple
+
+import boto3
+import yaml
+from botocore import UNSIGNED
+from botocore.client import Config as BotoConfig
+
+from . import hf_addressing, hf_catalog
+from .config import ALL_PLUGIN_NAMES, BUILD_DIR, REPO_ROOT, Config, active_plugins
+from .corpus import Corpus, summarize
+
+SETTINGS_TEMPLATE = """\
+# Generated by `run_pipeline.py enumerate` — do not edit by hand.
+# Mounted into info-endpoint and omni-writer as /app/settings.yaml.
+backends:
+  default_backend:
+    search_backend_config:
+      es_host: opensearch
+      es_port: 9200
+      ES_NAME: {es_name}
+      backend_type: os_index
+      DS_EMBEDDING_DIM: {embedding_dim}
+"""
+
+
+@dataclass
+class Asset:
+    url: str
+    size: int
+    etag: str
+
+
+def _s3_client(cfg: Config):
+    """An S3 client that signs only when credentials were supplied.
+
+    Mirrors the upstream storage client's behaviour: a public bucket must be
+    read anonymously, and passing empty-string credentials would force signed
+    requests and fail with NoCredentialsError.
+    """
+    key = cfg.get("S3_STORAGE_AWS_ACCESS_KEY_ID").strip()
+    secret = cfg.get("S3_STORAGE_AWS_SECRET_ACCESS_KEY").strip()
+    endpoint = cfg.get("S3_STORAGE_AWS_ENDPOINT_URL").strip() or None
+    region = cfg.get("S3_STORAGE_REGION_NAME", "us-west-2")
+
+    if key and secret:
+        return boto3.client(
+            "s3",
+            aws_access_key_id=key,
+            aws_secret_access_key=secret,
+            endpoint_url=endpoint,
+            region_name=region,
+        )
+    return boto3.client(
+        "s3",
+        endpoint_url=endpoint,
+        region_name=region,
+        config=BotoConfig(signature_version=UNSIGNED),
+    )
+
+
+def list_prefix(client, bucket: str, prefix: str) -> Iterator[Dict]:
+    paginator = client.get_paginator("list_objects_v2")
+    for page in paginator.paginate(Bucket=bucket, Prefix=prefix):
+        for obj in page.get("Contents", []):
+            yield obj
+
+
+def enumerate_corpus(corpus: Corpus, cfg: Config) -> List[Asset]:
+    client = _s3_client(cfg)
+    seen: Dict[str, Asset] = {}
+    listed = 0
+
+    for bucket in corpus.buckets:
+        for prefix in corpus.include_prefixes_for(bucket):
+            print(f"  listing s3://{bucket}/{prefix} ...", flush=True)
+            for obj in list_prefix(client, bucket, prefix):
+                listed += 1
+                url = f"s3://{bucket}/{obj['Key']}"
+                if not corpus.accepts(url):
+                    continue
+                # Sibling include prefixes cannot overlap (validate() rejects
+                # nesting), but dedupe anyway so a future rule change cannot
+                # produce duplicate submissions.
+                seen.setdefault(
+                    url,
+                    Asset(url=url, size=int(obj.get("Size", 0)), etag=str(obj.get("ETag", "")).strip('"')),
+                )
+
+    # `removed` always wins, even over a matching `include` prefix: it names
+    # an asset the operator knows is gone, and re-submitting it here would
+    # fight the `clear` step (restore/delta indexing) that is about to drop it
+    # from the index.
+    removed = corpus.removed_set
+    if removed:
+        dropped = [url for url in seen if url in removed]
+        for url in dropped:
+            del seen[url]
+        if dropped:
+            print(f"  dropped {len(dropped)} 'removed' asset(s) from submission")
+
+    print(f"  listed {listed} objects, accepted {len(seen)}")
+    return [seen[k] for k in sorted(seen)]
+
+
+def _hf_api():
+    """A `huggingface_hub.HfApi`, authenticated from `$HF_TOKEN` when set.
+
+    Read from the environment only, never `pipeline.env` — same policy as
+    every other credential this pipeline touches (S3 keys, the NVCF token).
+    `None` is fine for a public dataset; `list_repo_tree` then calls
+    anonymously.
+    """
+    from huggingface_hub import HfApi
+
+    return HfApi(token=os.environ.get("HF_TOKEN") or None)
+
+
+def enumerate_corpus_hf(corpus: Corpus, cfg: Config) -> Tuple[List[Asset], Dict[hf_catalog.RepoKey, List[str]]]:
+    """The `storage_api` backend's counterpart to `enumerate_corpus` — lists
+    each corpus HF repo's full file tree, applies the same include/exclude/
+    extension matching `Corpus.accepts` already uses for S3, and additionally
+    derives the `hf-storage-api` catalog's asset-folder set from the matched
+    files (see `pipeline/hf_catalog.py`) — one repo-tree read serves both.
+    """
+    from huggingface_hub import RepoFile
+
+    api = _hf_api()
+    seen: Dict[str, Asset] = {}
+    matched_paths_by_repo: Dict[hf_catalog.RepoKey, List[str]] = {}
+    all_paths_by_repo: Dict[hf_catalog.RepoKey, Set[str]] = {}
+    listed = 0
+
+    for repo_key in corpus.hf_repos:
+        host, repo_type, repo_id, revision = repo_key
+        print(f"  listing hf://{host}/{repo_type}s/{repo_id}/resolve/{revision}/ ...", flush=True)
+        file_entries = {
+            entry.path: entry
+            for entry in api.list_repo_tree(repo_id, recursive=True, revision=revision, repo_type=repo_type)
+            if isinstance(entry, RepoFile)
+        }
+        all_paths_by_repo[repo_key] = set(file_entries)
+
+        matched: List[str] = []
+        for path, entry in file_entries.items():
+            listed += 1
+            url = hf_addressing.build(host=host, repo_type=repo_type, repo_id=repo_id, revision=revision, path=path)
+            if not corpus.accepts(url):
+                continue
+            matched.append(path)
+            seen.setdefault(url, Asset(url=url, size=int(entry.size or 0), etag=entry.blob_id or ""))
+        matched_paths_by_repo[repo_key] = matched
+
+    # See enumerate_corpus()'s own comment: `removed` always wins.
+    removed = corpus.removed_set
+    if removed:
+        dropped = [url for url in seen if url in removed]
+        for url in dropped:
+            del seen[url]
+        if dropped:
+            print(f"  dropped {len(dropped)} 'removed' asset(s) from submission")
+
+    print(f"  listed {listed} objects, accepted {len(seen)}")
+    asset_folders = hf_catalog.asset_folders_by_repo(corpus, matched_paths_by_repo, all_paths_by_repo)
+    return [seen[k] for k in sorted(seen)], asset_folders
+
+
+def _usdsearch_git_sha(cfg: Config) -> str:
+    repo = (REPO_ROOT / cfg.get("USDSEARCH_REPO", "../usdsearch")).resolve()
+    try:
+        out = subprocess.run(
+            ["git", "-C", str(repo), "rev-parse", "--short", "HEAD"],
+            capture_output=True, text=True, timeout=10,
+        )
+        return out.stdout.strip() if out.returncode == 0 else "unknown"
+    except (OSError, subprocess.SubprocessError):
+        return "unknown"
+
+
+def build_run_id(cfg: Config, corpus: Corpus) -> str:
+    explicit = cfg.get("RUN_ID").strip()
+    if explicit:
+        return explicit
+    return f"{datetime.now(timezone.utc):%Y%m%d}-{corpus.run_id_suffix}"
+
+
+def write_settings_yaml(cfg: Config, path: Path) -> None:
+    path.write_text(
+        SETTINGS_TEMPLATE.format(
+            es_name=cfg.es_name,
+            embedding_dim=cfg.get_int("DS_EMBEDDING_DIM", 1536),
+        )
+    )
+
+
+PLUGIN_CONFIG_SOURCE = REPO_ROOT / "config" / "plugin.config.yaml"
+
+
+def write_plugin_config_yaml(cfg: Config, path: Path) -> None:
+    """Generate `.build/plugin.config.yaml`, the file actually mounted into
+    info-endpoint (docker-compose.indexing.yml) — a copy of
+    config/plugin.config.yaml with `thumbnail_to_vision_metadata.active`
+    overridden to match `VLM_METADATA_ENABLED`, the one plugin this pipeline
+    toggles per run rather than pinning statically. Every other key is left
+    exactly as authored in the source file (same "explicit list, no silent
+    all-active fallback" policy that file's own header describes).
+    """
+    plugin_config: Dict[str, Dict] = yaml.safe_load(PLUGIN_CONFIG_SOURCE.read_text()) or {}
+    enabled = set(active_plugins(cfg))
+    for name in ALL_PLUGIN_NAMES:
+        plugin_config.setdefault(name, {})["active"] = name in enabled
+    path.write_text(
+        "# Generated by `run_pipeline.py enumerate` from config/plugin.config.yaml "
+        "— do not edit by hand.\n" + yaml.safe_dump(plugin_config, sort_keys=False)
+    )
+
+
+def run(cfg: Config, dry_run: bool = False) -> int:
+    corpus = Corpus.load(cfg.corpus_file)
+    print(summarize(corpus))
+    print()
+
+    if corpus.storage_backend != cfg.storage_backend:
+        print(
+            f"\nERROR: corpus.json declares storage_backend={corpus.storage_backend!r} but "
+            f"STORAGE_BACKEND_TYPE={cfg.storage_backend!r} (pipeline.env / environment). "
+            f"They must agree — indexing against the wrong backend silently matches zero assets."
+        )
+        return 1
+
+    BUILD_DIR.mkdir(parents=True, exist_ok=True)
+
+    asset_folders: Dict[hf_catalog.RepoKey, List[str]] = {}
+    if corpus.storage_backend == "storage_api":
+        print("Enumerating HuggingFace ...")
+        assets, asset_folders = enumerate_corpus_hf(corpus, cfg)
+    else:
+        print("Enumerating S3 ...")
+        assets = enumerate_corpus(corpus, cfg)
+    if not assets:
+        print(
+            "\nERROR: the corpus matched zero objects. Check the include prefixes "
+            "and the extension list against what is actually in the bucket/repo."
+        )
+        return 1
+
+    run_id = build_run_id(cfg, corpus)
+
+    assets_path = BUILD_DIR / "assets.jsonl"
+    if not dry_run:
+        with assets_path.open("w") as fh:
+            for asset in assets:
+                fh.write(json.dumps(asdict(asset)) + "\n")
+
+    manifest = {
+        "run_id": run_id,
+        "corpus_name": corpus.name,
+        "corpus_sha256": corpus.sha256,
+        "storage_backend": corpus.storage_backend,
+        "created_utc": datetime.now(timezone.utc).isoformat(),
+        "usdsearch_git_sha": _usdsearch_git_sha(cfg),
+        "es_name": cfg.es_name,
+        "main_index": cfg.main_index,
+        "image_cache_index": cfg.image_cache_index,
+        "buckets": corpus.buckets if corpus.storage_backend == "s3" else [],
+        "hf_repos": [list(k) for k in corpus.hf_repos] if corpus.storage_backend == "storage_api" else [],
+        "active_plugins": list(active_plugins(cfg)),
+        "asset_count": len(assets),
+        "removed": list(corpus.removed),
+    }
+    if not dry_run:
+        if corpus.storage_backend == "storage_api":
+            catalog = hf_catalog.build_catalog(corpus, asset_folders)
+            (BUILD_DIR / "hf-storage-api-catalog.yaml").write_text(hf_catalog.dump_catalog(catalog))
+        (BUILD_DIR / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
+        write_settings_yaml(cfg, BUILD_DIR / "settings.yaml")
+        write_plugin_config_yaml(cfg, BUILD_DIR / "plugin.config.yaml")
+        # The exact input, copied for reproducibility and uploaded in stage 3.
+        (BUILD_DIR / "corpus.json").write_text(cfg.corpus_file.read_text())
+
+    print()
+    print(f"run_id:      {run_id}")
+    print(f"assets:      {len(assets)}")
+    print(f"main index:  {cfg.main_index}")
+    print(f"image index: {cfg.image_cache_index}")
+    if dry_run:
+        print("\n(dry run — nothing written)")
+    else:
+        print(f"\nwrote {assets_path.relative_to(REPO_ROOT)} and manifest.json")
+    return 0
+
+
+def load_assets(path: Optional[Path] = None) -> List[Asset]:
+    path = path or (BUILD_DIR / "assets.jsonl")
+    if not path.exists():
+        raise SystemExit(
+            f"{path} not found — run `python -m pipeline.run_pipeline enumerate` first."
+        )
+    out = []
+    for line in path.read_text().splitlines():
+        if line.strip():
+            out.append(Asset(**json.loads(line)))
+    return out
+
+
+def load_manifest() -> Dict:
+    path = BUILD_DIR / "manifest.json"
+    if not path.exists():
+        raise SystemExit(
+            f"{path} not found — run `python -m pipeline.run_pipeline enumerate` first."
+        )
+    return json.loads(path.read_text())
+
+
+def save_manifest(manifest: Dict) -> None:
+    (BUILD_DIR / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")

pipeline/export.py

@@ -0,0 +1,296 @@
+"""Stage 2 — export the OpenSearch indexes and the Neo4j database.
+
+The OpenSearch export deliberately produces the exact file layout that
+upstream's `services/deepsearch_api/loader.sh` consumes:
+
+    <index>.settings.json   <index>.mapping.json   <index>.data.json
+
+so the artifacts are restorable by the existing Helm `data_loader_job` and
+container-test compose, not only by our own bake step. That compatibility is the
+acceptance test for this stage (see the plan, §9 step 5).
+"""
+
+from __future__ import annotations
+
+import gzip
+import hashlib
+import json
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Dict, List
+
+import httpx
+
+from .config import BUILD_DIR, REPO_ROOT, Config
+from .enumerate_assets import load_manifest, save_manifest
+
+ARTIFACTS = BUILD_DIR / "artifacts"
+OS_ARTIFACTS = ARTIFACTS / "opensearch"
+NEO4J_ARTIFACTS = ARTIFACTS / "neo4j"
+
+COMPOSE_PROJECT = "simready-indexing"
+ELASTICDUMP_IMAGE = "elasticdump/elasticsearch-dump:latest"
+
+
+def _run(cmd: List[str], **kwargs) -> subprocess.CompletedProcess:
+    print("    $ " + " ".join(cmd[:6]) + (" ..." if len(cmd) > 6 else ""))
+    return subprocess.run(cmd, check=True, **kwargs)
+
+
+def _uid_gid() -> str:
+    import os
+    return f"{os.getuid()}:{os.getgid()}"
+
+
+def discover_indexes(cfg: Config) -> List[str]:
+    """Indexes belonging to this ES_NAME, read from the cluster.
+
+    Discovery rather than a hardcoded pair: the pointcloud cache exists in some
+    corpora, and a rename that missed one place would otherwise export an empty
+    index without complaint.
+    """
+    response = httpx.get(f"{cfg.opensearch_url}/_cat/indices?format=json", timeout=30.0)
+    response.raise_for_status()
+    names = sorted(
+        row["index"] for row in response.json()
+        if row.get("index", "").startswith(f"{cfg.es_name}-")
+    )
+    if cfg.main_index not in names:
+        raise SystemExit(
+            f"main index {cfg.main_index} not found in the cluster. Found: {names or 'none'}. "
+            f"Check ES_NAME against what the writers actually created."
+        )
+    return names
+
+
+def _network_name() -> str:
+    return f"{COMPOSE_PROJECT}_default"
+
+
+def elasticdump(index: str, dump_type: str, out_path: Path) -> None:
+    _run([
+        "docker", "run", "--rm",
+        "--network", _network_name(),
+        "--user", _uid_gid(),
+        "-v", f"{OS_ARTIFACTS}:/out",
+        ELASTICDUMP_IMAGE,
+        f"--input=http://opensearch:9200/{index}",
+        f"--output=/out/{out_path.name}",
+        f"--type={dump_type}",
+        "--limit=1000",
+        "--overwrite",
+    ])
+
+
+def sha256_of(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as fh:
+        for block in iter(lambda: fh.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def gzip_file(path: Path) -> Path:
+    dest = path.with_suffix(path.suffix + ".gz")
+    with path.open("rb") as src, gzip.open(dest, "wb") as out:
+        shutil.copyfileobj(src, out)
+    return dest
+
+
+def export_opensearch(cfg: Config, manifest: Dict) -> Dict:
+    OS_ARTIFACTS.mkdir(parents=True, exist_ok=True)
+    indexes = discover_indexes(cfg)
+    print(f"  indexes: {', '.join(indexes)}")
+
+    expected = manifest.get("asset_count", 0)
+    main_count = int(
+        httpx.get(f"{cfg.opensearch_url}/{cfg.main_index}/_count", timeout=30.0).json()["count"]
+    )
+    if expected and main_count != expected:
+        raise SystemExit(
+            f"pre-flight: {cfg.main_index} holds {main_count} docs but the run expects "
+            f"{expected}. Refusing to export a partial index — re-run stage 1."
+        )
+
+    # Flush so everything written is on disk and countable.
+    httpx.post(f"{cfg.opensearch_url}/_flush", timeout=120.0)
+
+    exported: Dict[str, Dict] = {}
+    for index in indexes:
+        print(f"  exporting {index} ...")
+        files = {}
+        for dump_type, suffix in (
+            ("settings", "settings.json"),
+            ("mapping", "mapping.json"),
+            ("data", "data.json"),
+        ):
+            plain = OS_ARTIFACTS / f"{index}.{suffix}"
+            elasticdump(index, dump_type, plain)
+            if not plain.exists() or plain.stat().st_size == 0:
+                raise SystemExit(f"elasticdump produced no {dump_type} for {index}")
+            compressed = gzip_file(plain)
+            files[dump_type] = {
+                "file": compressed.name,
+                "bytes": compressed.stat().st_size,
+                "sha256": sha256_of(compressed),
+            }
+        count = int(
+            httpx.get(f"{cfg.opensearch_url}/{index}/_count", timeout=30.0).json()["count"]
+        )
+        data_lines = sum(
+            1 for _ in (OS_ARTIFACTS / f"{index}.data.json").open() if _.strip()
+        )
+        if data_lines != count:
+            raise SystemExit(
+                f"{index}: dumped {data_lines} rows but the index reports {count} docs"
+            )
+        exported[index] = {"doc_count": count, "files": files}
+        print(f"    {count} docs")
+
+    return exported
+
+
+def verify_dump(cfg: Config, dump: Path) -> None:
+    """Load the dump into a throwaway data dir to prove it is loadable.
+
+    Same principle as `bake.py::verify_baked` — check the artifact actually
+    works from a fresh process, not just that a file got written. A dump can
+    fail this while still existing on disk at a plausible size — see the
+    stop-ordering comment in `export_neo4j` — and `bake` finding out is
+    hours and several stages too late.
+
+    Runs as the host uid, unlike the real dump/load steps: those touch the
+    named `neo4j-data` volume, already owned by the in-container uid 7474,
+    so they must run as root. This scratch dir is fresh and ours, so running
+    as root here would just leave root-owned files behind that the host
+    user can't clean up afterwards.
+    """
+    import tempfile
+
+    with tempfile.TemporaryDirectory() as scratch:
+        result = subprocess.run(
+            [
+                "docker", "run", "--rm",
+                "--user", _uid_gid(),
+                "-v", f"{dump.parent}:/dumps:ro",
+                "-v", f"{scratch}:/data",
+                f"neo4j:{cfg.get('NEO4J_VERSION', '5.23.0-community')}",
+                "neo4j-admin", "database", "load", "neo4j",
+                "--from-path=/dumps", "--overwrite-destination=true",
+            ],
+            capture_output=True, text=True, check=False,
+        )
+        if result.returncode != 0:
+            raise SystemExit(
+                f"neo4j dump failed to verify-load — likely corrupted by AGS "
+                f"and neo4j being stopped concurrently (see the stop-ordering "
+                f"comment in export_neo4j):\n{result.stdout}\n{result.stderr}"
+            )
+
+
+def export_neo4j(cfg: Config) -> Dict:
+    NEO4J_ARTIFACTS.mkdir(parents=True, exist_ok=True)
+
+    # Community edition cannot stop the default database from Cypher (no
+    # manual `db.checkpoint()` either — that procedure doesn't exist outside
+    # Enterprise), so the dump has to be taken offline via a plain container
+    # stop, relying on Neo4j's own graceful-shutdown checkpoint.
+    #
+    # AGS *must* be given its own `stop` call, fully awaited, before neo4j's
+    # `stop` call starts — not one `stop asset-graph-service neo4j` command
+    # naming both. `docker compose stop` sends SIGTERM to every named service
+    # concurrently regardless of argument order, so a single combined call
+    # can (and, reproduced directly, does) stop AGS and neo4j at the same
+    # moment — if AGS is mid-write when neo4j's shutdown checkpoint starts,
+    # the resulting dump is corrupted (truncated trailing zstd frame,
+    # `Not a valid Neo4j archive`) while still landing on disk at a
+    # plausible size, silently, caught only by a `neo4j-admin database load`
+    # deep in a later `bake`. Two sequential calls make the ordering real
+    # instead of advisory; `verify_dump` below is the safety net regardless.
+    # `docker compose stop`'s default grace period (~10s) is nowhere near
+    # enough for Neo4j's own graceful-shutdown checkpoint on a real corpus —
+    # verified live: a ~69k-node/81k-relationship graph took ~103s to stop
+    # cleanly. Short of that, compose SIGKILLs it, which produces exactly the
+    # "plausible size, silently corrupted" dump the comment above warns
+    # about, just from a different cause (timeout, not concurrent-stop
+    # ordering) — caught by `verify_dump` below either way, but avoidable.
+    print("  stopping asset-graph-service ...")
+    _run(["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+          "stop", "--timeout", "300", "asset-graph-service"], env=cfg.compose_env())
+    print("  stopping neo4j ...")
+    _run(["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+          "stop", "--timeout", "300", "neo4j"], env=cfg.compose_env())
+
+    print("  dumping neo4j ...")
+    # Runs as root (the image default), NOT as the host uid: the data volume is
+    # owned by the in-container neo4j user (uid 7474), and neo4j-admin refuses
+    # with "You do not have permission to dump the database" under --user.
+    # The dump is chowned to the host uid afterwards so the artifact is readable
+    # and removable outside the container.
+    #
+    # rm -f the previous dump ourselves, rather than passing
+    # --overwrite-destination=true: that flag has a confirmed upstream bug
+    # (neo4j/neo4j#13604) where overwriting a pre-existing *larger* archive
+    # doesn't fully truncate it, leaving old bytes at the tail of the new one
+    # — `Not a valid Neo4j archive` / `ZstdIOException: Unknown frame
+    # descriptor` on load, reproduced here on every retry (each one dumping
+    # over the previous attempt's own leftover file). The Neo4j maintainers'
+    # own workaround (same issue, 2025-10-27) is to delete the destination
+    # first and never pass --overwrite-destination — a genuinely fresh
+    # destination file can't hit this bug.
+    _run([
+        "docker", "run", "--rm",
+        "--entrypoint", "bash",
+        "-v", f"{COMPOSE_PROJECT}_neo4j-data:/data",
+        "-v", f"{NEO4J_ARTIFACTS}:/dumps",
+        f"neo4j:{cfg.get('NEO4J_VERSION', '5.23.0-community')}",
+        "-c",
+        "set -e; rm -f /dumps/neo4j.dump; neo4j-admin database dump neo4j --to-path=/dumps; "
+        f"chown -R {_uid_gid()} /dumps",
+    ])
+
+    dump = NEO4J_ARTIFACTS / "neo4j.dump"
+    if not dump.exists():
+        raise SystemExit(f"neo4j-admin produced no dump at {dump}")
+
+    print("  verifying the dump loads cleanly ...")
+    verify_dump(cfg, dump)
+
+    compressed = gzip_file(dump)
+
+    print("  restarting neo4j and asset-graph-service ...")
+    _run(["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+          "start", "neo4j", "asset-graph-service"], env=cfg.compose_env())
+
+    return {
+        "file": compressed.name,
+        "bytes": compressed.stat().st_size,
+        "sha256": sha256_of(compressed),
+    }
+
+
+def run(cfg: Config) -> int:
+    manifest = load_manifest()
+    ARTIFACTS.mkdir(parents=True, exist_ok=True)
+
+    print("Exporting OpenSearch ...")
+    manifest["opensearch_artifacts"] = export_opensearch(cfg, manifest)
+
+    print("\nExporting Neo4j ...")
+    manifest["neo4j_artifact"] = export_neo4j(cfg)
+
+    # Copy the inputs alongside the data so an artifact set is self-describing.
+    for name in ("corpus.json", "index-report.json", "assets.jsonl"):
+        src = BUILD_DIR / name
+        if src.exists():
+            shutil.copy2(src, ARTIFACTS / name)
+
+    save_manifest(manifest)
+    shutil.copy2(BUILD_DIR / "manifest.json", ARTIFACTS / "manifest.json")
+
+    print(f"\nartifacts in {ARTIFACTS.relative_to(REPO_ROOT)}:")
+    for path in sorted(ARTIFACTS.rglob("*")):
+        if path.is_file():
+            print(f"  {path.relative_to(ARTIFACTS)}  ({path.stat().st_size:,} bytes)")
+    return 0

pipeline/hf_addressing.py

@@ -0,0 +1,133 @@
+"""Parse/build ``hf://`` asset addresses in the same namespace `hf-storage-api`
+(the gRPC Omniverse Storage API server backing the ``storage_api`` backend,
+https://gitlab-master.nvidia.com/omniverse/gen-ai/hf-storage-api-service) hands
+out and resolves.
+
+This is a small, faithful port of that service's own
+``src/hf_storage_api/addressing.py`` (``build``/``parse``) — not an import,
+since this repo has no dependency on that service's package. Keeping the
+grammar here in sync with upstream matters: this pipeline's enumerator (stage
+0) must mint the *exact* addresses the running `hf-storage-api` instance will
+resolve at indexing time, or `/process/asset` submissions 404 against a
+storage backend that considers them out of catalog.
+
+Addresses look like ``hf://<host>/[datasets/]<owner>/<name>[/resolve/<rev>]/<path>``
+— folders end in ``/``, assets never do. `hf://` (not `https://`) is used
+throughout this repo's corpus files and compose wiring specifically because
+Kit's `omni.client` has a built-in HTTPS provider that would otherwise
+ambiguously claim a plain `https://huggingface.co/...` address ahead of the
+registered Storage API one — see the cluster's `hf-storage-api.yaml`
+(`config.uriScheme: hf`).
+
+**The `/resolve/<rev>/` segment must be a pinned commit sha, or absent
+entirely — never a moving ref like `main`.** `hf-storage-api`'s own address
+minting (`AssetStore._emit_revision`) only ever emits that segment for a
+repo whose configured revision looks like a sha; for a moving ref it emits
+none, specifically so an asset's address survives a re-crawl. Its resolve
+path (`AssetStore.stat`/`_serves_revision`) enforces the same rule on the
+way in: an address carrying a literal `resolve/main/` is checked against the
+repo's *actual* resolved sha and — since `"main" != "<sha>"` — never
+matches, so `Stat` always answers `NOT_FOUND`. Verified live against a real
+deployment: every submission against a `resolve/main/`-shaped address
+404'd, and the exact same paths resolved cleanly with that segment removed.
+`looks_like_sha()`/`build()`/`parse()` below enforce this at the address
+grammar level rather than leaving it to each call site to remember.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from urllib.parse import unquote, urlsplit
+
+REPO_TYPE_PREFIX = {"dataset": "datasets", "space": "spaces", "model": ""}
+
+SCHEME = "hf"
+
+
+def looks_like_sha(revision: str) -> bool:
+    """Mirrors `hf-storage-api`'s own `store._looks_like_sha` exactly — a
+    full 40-hex-char git commit sha, case-insensitive."""
+    return len(revision) == 40 and all(c in "0123456789abcdef" for c in revision.lower())
+
+
+class AddressError(ValueError):
+    """The address is not a well-formed hf:// asset address."""
+
+
+@dataclass(frozen=True)
+class Address:
+    host: str
+    repo_type: str
+    repo_id: str  # "<owner>/<name>"
+    path: str  # repo-relative, no leading slash; "" for the repo root
+    is_folder: bool
+    revision: str | None = None
+
+
+def parse(address: str) -> Address:
+    """Parse ``hf://host/[datasets/]<owner>/<name>[/resolve/<rev>][/<path>]``."""
+    if not address:
+        raise AddressError("empty address")
+
+    split = urlsplit(address)
+    if split.scheme != SCHEME:
+        raise AddressError(f"expected scheme {SCHEME!r}, got {split.scheme!r} in {address!r}")
+    if not split.netloc:
+        raise AddressError(f"missing host in {address!r}")
+
+    is_folder = split.path.endswith("/")
+    segments = [unquote(s) for s in split.path.split("/") if s]
+
+    repo_type = "model"
+    for rtype, prefix in REPO_TYPE_PREFIX.items():
+        if prefix and segments[:1] == [prefix]:
+            repo_type, segments = rtype, segments[1:]
+            break
+
+    if len(segments) < 2:
+        raise AddressError(f"address does not name a repo (<owner>/<name>): {address!r}")
+
+    repo_id = f"{segments[0]}/{segments[1]}"
+    rest = segments[2:]
+
+    revision: str | None = None
+    if len(rest) >= 2 and rest[0] == "resolve":
+        revision, rest = rest[1], rest[2:]
+
+    return Address(
+        host=split.netloc,
+        repo_type=repo_type,
+        repo_id=repo_id,
+        path="/".join(rest),
+        is_folder=is_folder,
+        revision=revision,
+    )
+
+
+def build(
+    *,
+    host: str,
+    repo_type: str,
+    repo_id: str,
+    revision: str,
+    path: str = "",
+    is_folder: bool = False,
+) -> str:
+    """Emit a canonical ``hf://`` address. Folders end in ``/``; assets never do.
+
+    ``revision`` is the *repo's configured* revision (e.g. a corpus's
+    `HfPrefix.revision` or `hf-storage-api`'s `RepoConfig.revision`) — the
+    `/resolve/<rev>/` segment is emitted only when it looks like a pinned
+    commit sha (`looks_like_sha`), mirroring `AssetStore._emit_revision`
+    exactly. A moving ref (e.g. ``"main"``) is silently omitted from the
+    address rather than embedded literally — embedding it produces an
+    address `hf-storage-api` itself can never resolve (see the module
+    docstring).
+    """
+    prefix = REPO_TYPE_PREFIX.get(repo_type, "")
+    resolve_segment = f"resolve/{revision}" if looks_like_sha(revision) else ""
+    parts = [p for p in (prefix, repo_id, resolve_segment, path.strip("/")) if p]
+    out = f"{SCHEME}://{host}/" + "/".join(parts)
+    if is_folder and not out.endswith("/"):
+        out += "/"
+    return out

pipeline/hf_catalog.py

@@ -0,0 +1,109 @@
+"""Derive the `hf-storage-api` catalog (stage 0 output) from this run's matched
+HF asset files.
+
+`hf-storage-api`'s catalog names asset *folders*, not individual files — a
+folder is "the asset" once it (or an ancestor) carries `corpus.asset_marker`,
+and every file beneath a catalogued folder is then individually addressable
+(see `pipeline/corpus.py`'s `DEFAULT_ASSET_MARKER` docstring). This module
+turns the flat list of matched file paths `enumerate_assets.py` already
+computed (via the same include/exclude/extension rules used for the S3
+backend) into the folder set that catalog needs, by walking each matched
+file's ancestors for the nearest one containing the marker — using the same
+full repo-tree listing already fetched for matching, so this costs no extra
+HuggingFace calls.
+"""
+
+from __future__ import annotations
+
+import yaml
+
+from pathlib import PurePosixPath
+from typing import Dict, Iterable, List, Set, Tuple
+
+from .corpus import Corpus
+
+# (host, repo_type, repo_id, revision) -> set of every path present in that
+# repo tree, used to test marker-file membership without extra HF calls.
+RepoKey = Tuple[str, str, str, str]
+
+
+def _marker_path(folder: str, marker: str) -> str:
+    return f"{folder}/{marker}" if folder else marker
+
+
+def _ancestors(folder: str) -> Iterable[str]:
+    """`folder` itself, then each ancestor up to (and including) the repo root `""`."""
+    current = folder
+    while True:
+        yield current
+        if not current:
+            return
+        current = PurePosixPath(current).parent.as_posix()
+        if current == ".":
+            current = ""
+
+
+def find_asset_folder(path: str, marker: str, all_paths: Set[str]) -> str:
+    """The nearest ancestor of `path`'s directory that contains `marker`,
+    walking upward to the repo root. Falls back to `path`'s immediate parent
+    directory if no ancestor carries the marker — a corpus can include files
+    from a dataset with no marker file at all, and the folder is still a
+    well-defined catalog entry (just not marker-discoverable on its own).
+    """
+    parent = PurePosixPath(path).parent.as_posix()
+    parent = "" if parent == "." else parent
+    for ancestor in _ancestors(parent):
+        if _marker_path(ancestor, marker) in all_paths:
+            return ancestor
+    return parent
+
+
+def asset_folders_by_repo(
+    corpus: Corpus,
+    matched_paths_by_repo: Dict[RepoKey, List[str]],
+    all_paths_by_repo: Dict[RepoKey, Set[str]],
+) -> Dict[RepoKey, List[str]]:
+    """One sorted, deduplicated folder list per repo, derived from this run's
+    matched files."""
+    out: Dict[RepoKey, List[str]] = {}
+    for repo_key, matched_paths in matched_paths_by_repo.items():
+        all_paths = all_paths_by_repo.get(repo_key, set())
+        folders = {
+            find_asset_folder(path, corpus.asset_marker, all_paths) for path in matched_paths
+        }
+        out[repo_key] = sorted(folders)
+    return out
+
+
+def build_catalog(corpus: Corpus, asset_folders: Dict[RepoKey, List[str]]) -> dict:
+    """Render the `hf-storage-api` YAML catalog dict — see
+    `catalog.example.yaml` in
+    https://gitlab-master.nvidia.com/omniverse/gen-ai/hf-storage-api-service.
+    """
+    repos = []
+    for host, repo_type, repo_id, revision in corpus.hf_repos:
+        folders = asset_folders.get((host, repo_type, repo_id, revision), [])
+        repos.append({
+            "repo_id": repo_id,
+            "repo_type": repo_type,
+            "revision": revision,
+            "assets": folders,
+        })
+    layout = {"marker": corpus.asset_marker, "manifest": corpus.asset_marker}
+    if corpus.catalog_kind:
+        layout["catalog_kind"] = corpus.catalog_kind
+    if corpus.thumbs_dir:
+        layout["thumbs_dir"] = corpus.thumbs_dir
+    if corpus.content_fallback:
+        layout["content_fallback"] = corpus.content_fallback
+    return {
+        # All corpus entries share one host (validated by HfPrefix parsing);
+        # hf-storage-api's `endpoint` is catalog-wide.
+        "endpoint": f"https://{corpus.hf_repos[0][0]}" if corpus.hf_repos else "https://huggingface.co",
+        "repos": repos,
+        "layout": layout,
+    }
+
+
+def dump_catalog(catalog: dict) -> str:
+    return yaml.safe_dump(catalog, sort_keys=False)

pipeline/hf_space.py

@@ -0,0 +1,314 @@
+"""Stage 6 — deploy the HF Space source (not a prebuilt image) to a Hugging
+Face Space.
+
+Wired into CI as a manual-dispatch-only step (never the nightly schedule —
+see nvcf-pipeline.yml); run locally with
+`python -m pipeline.run_pipeline deploy-space --env-file ...` once `bake`
+has verified the hf_space Dockerfile builds for this corpus (see
+docker/Dockerfile.hf-space's header for why this Space builds from source
+with only public base images, rather than pulling a prebuilt image of ours:
+Hugging Face's own infra builds a Space's Dockerfile with no credentials
+available for a private registry pull). Gates on `bake`'s own
+hf_space_smoke_passed (set by bake.py's verify_baked), not the separate
+`verify` stage's smoke_passed — `verify` brings up the *entire* runtime
+stack, including asset-graph-service and other components the hf_space
+image doesn't even include, so requiring it to fully pass would block a
+deploy over failures this image can't possibly be affected by.
+
+Requires a Hugging Face token with write access to the target Space's org,
+resolved the usual huggingface_hub way (`hf auth login`, or `HF_TOKEN` in
+the environment) — never read from pipeline.env, same policy as every other
+credential this pipeline touches.
+
+The index itself is *not* redeployed by this script — pipeline/hf_space_seed.py
+restores it from S3 at container startup (see that module's docstring), so a
+Space already picks up a newly `push`ed run on its own next restart, with no
+redeploy at all. What this script's `# deploy: <run_id> (<corpus>)` marker
+line (prepended to the Dockerfile) is for is forcing that restart when you
+want it now rather than waiting: Hugging Face only rebuilds/restarts a Space
+on a new commit, never by noticing that S3 data changed — without the
+marker, re-running this stage when the pipeline code hasn't otherwise
+changed would produce byte-identical file content and silently commit
+nothing. The previous container keeps serving traffic until the new build
+is ready (or forever, if the new build fails) — see docs/hub/spaces-overview's
+"restarting" note.
+
+RESTORE_RUN_ID (pin the Space to one fixed run instead of always-latest) is
+deliberately left unmanaged here — set it directly via the Space's Settings
+-> Variables in the HF UI if needed, so a redeploy never silently clobbers
+an operator's manual pin.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import Dict
+
+from huggingface_hub import HfApi, SpaceHardware
+
+from .artifact_store import artifact_env
+from .bake import DOCKER_DIR, hf_space_build_args, hf_space_gpu_build_args, image_tags
+from .config import BUILD_DIR, HF_SPACE_GPU_HARDWARE_DEFAULT, REPO_ROOT, Config
+from .enumerate_assets import load_manifest
+
+STAGE_DIR = BUILD_DIR / "hf_space_deploy"
+STAGE_DIR_GPU = BUILD_DIR / "hf_space_deploy_gpu"
+
+README_TEMPLATE = """---
+title: {title}
+emoji: \U0001f50e
+colorFrom: green
+colorTo: blue
+sdk: docker
+app_port: 7860
+---
+
+# {title}
+
+SimReady Central USD Search — single-container demo (OpenSearch + Redis +
+deepsearch-api, SigLIP2 embeddings via NVCF). Built by Hugging Face from
+this repo's docker/Dockerfile.hf-space; the index itself is pulled from the
+artifact S3 bucket at container startup, not baked in. Deployed by
+github.com/NVIDIA-dev/simready-central-indexing-internal's
+`python -m pipeline.run_pipeline deploy-space`.
+"""
+
+# GPU variant — see docker/Dockerfile.hf-space-gpu and
+# docs/plans/siglip2-embedded-hf-space.md. `hardware:` in the front matter
+# only sets the *default* for a brand-new Space; run() below also calls
+# request_space_hardware explicitly so an existing Space actually gets
+# switched to it on redeploy, since HF only reads this front-matter field
+# at Space-creation time.
+README_TEMPLATE_GPU = """---
+title: {title}
+emoji: \U0001f50e
+colorFrom: green
+colorTo: blue
+sdk: docker
+app_port: 7860
+hardware: {hardware}
+---
+
+# {title}
+
+SimReady Central USD Search — single-container demo (OpenSearch + Neo4j +
+Redis + deepsearch-api + asset-graph-service, SigLIP2 embeddings via a local
+siglip2-triton process — see docker/Dockerfile.hf-space-gpu). Runs on a GPU
+hardware tier ({hardware}), unlike the free-tier
+docker/Dockerfile.hf-space variant, which routes SigLIP2 to NVCF instead.
+The index itself is pulled from the artifact S3 bucket at container
+startup, not baked in. Deployed by
+github.com/NVIDIA-dev/simready-central-indexing-internal's
+`python -m pipeline.run_pipeline deploy-space-gpu`.
+"""
+
+
+def stage_repo(dest: Path, manifest: Dict, readme: str, dockerfile_name: str = "Dockerfile.hf-space") -> None:
+    if dest.exists():
+        shutil.rmtree(dest)
+    dest.mkdir(parents=True)
+
+    marker = f"# deploy: {manifest['run_id']} ({manifest['corpus_name']})\n"
+    dockerfile = (DOCKER_DIR / dockerfile_name).read_text()
+    (dest / "Dockerfile").write_text(marker + dockerfile)
+    (dest / "README.md").write_text(readme)
+
+    # docker/hf-space/siglip2-model/ (vendored via scripts/extract_siglip2_model.sh)
+    # is only referenced by Dockerfile.hf-space-gpu's own COPY instructions —
+    # excluded entirely for the NVCF/cpu-basic variant. Even for the GPU
+    # variant, that Dockerfile only COPYs the two ONNX encoders'
+    # config.pbtxt (tiny) — NOT their ~3.6 GB weight files under each
+    # encoder's own 1/ subdirectory, which are restored from S3 at container
+    # startup instead (pipeline/hf_space_seed.py --component=siglip2-model —
+    # see that Dockerfile's own comment for why: HF Space git repos cap
+    # storage at 1 GB by default, and a real deploy-space-gpu attempt 403'd
+    # with "Repository storage limit reached" until *both* of these
+    # exclusions existed — the first fix here only handled the NVCF variant,
+    # verified live to still be insufficient for the GPU one on its own).
+    def _ignore_siglip2_weights(dir_path: str, names: List[str]) -> List[str]:
+        if Path(dir_path).name in ("siglip2_vision_encoder_onnx", "siglip2_text_encoder_onnx") and "1" in names:
+            return ["1"]
+        return []
+
+    if dockerfile_name == "Dockerfile.hf-space-gpu":
+        hf_space_ignore = _ignore_siglip2_weights
+    else:
+        hf_space_ignore = shutil.ignore_patterns("siglip2-model")
+    shutil.copytree(DOCKER_DIR / "hf-space", dest / "docker" / "hf-space", ignore=hf_space_ignore)
+    shutil.copytree(
+        REPO_ROOT / "pipeline", dest / "pipeline",
+        ignore=shutil.ignore_patterns("__pycache__", "*.pyc"),
+    )
+    # The Dockerfile COPYs this in directly now (see its own comment) —
+    # must ship alongside it or HF's build fails with a missing path.
+    # A dist built by simready-central's slim/scripts/build-explorer-public.sh
+    # carries services/explorer/dist/build-info.json ({product, version,
+    # bundle_id, built_at, flags}) — the bundle's provenance; the upstream
+    # USD Search Explorer build has no such file.
+    shutil.copytree(REPO_ROOT / "services" / "explorer" / "dist", dest / "services" / "explorer" / "dist")
+
+
+def run(cfg: Config) -> int:
+    manifest = load_manifest()
+    if not manifest.get("hf_space_smoke_passed"):
+        print(
+            "The hf_space image's own smoke test has not passed for this "
+            "run. Run `bake` (its verify_baked step sets "
+            "hf_space_smoke_passed) before deploying — an unverified build "
+            "shouldn't go live."
+        )
+        return 1
+    if "hf_space" not in image_tags(cfg, manifest):
+        print("No hf_space image for this run (SIGLIP2_BACKEND != nvcf) — nothing to deploy.")
+        return 1
+
+    repo_id = cfg.require("HF_SPACE_REPO_ID")  # e.g. "nvidia/simready-central"
+    title = cfg.get("HF_SPACE_TITLE", repo_id.split("/", 1)[-1])
+    siglip2_token = cfg.siglip2_nvcf_env()["SIGLIP2_TRITON_SERVER_AUTH_TOKEN"]
+    aws = artifact_env()  # raises if the artifact-bucket keys aren't set
+
+    print(f"staging Space source at {STAGE_DIR} ...")
+    stage_repo(STAGE_DIR, manifest, README_TEMPLATE.format(title=title))
+
+    api = HfApi()
+    print(f"creating/reusing Space {repo_id} ...")
+    api.create_repo(repo_id=repo_id, repo_type="space", space_sdk="docker", exist_ok=True)
+
+    print("setting build-arg variables ...")
+    # Hugging Face passes any Space "Variable" whose name matches a
+    # Dockerfile ARG through as a --build-arg on its own build (see
+    # docs/hub/spaces-sdks-docker) — this is the *only* way these values
+    # reach HF's build, since nothing here invokes `docker build` directly
+    # against the committed Dockerfile. hf_space_build_args() is the same
+    # dict bake.py's own local/CI build passes via --build-arg, so the two
+    # can't silently drift apart.
+    for key, value in hf_space_build_args(cfg, manifest).items():
+        api.add_space_variable(repo_id, key, value)
+
+    print("setting runtime secrets ...")
+    # Names must match what pipeline/artifact_store.py's artifact_env() and
+    # config.py's siglip2_nvcf_env() read from the environment — Hugging
+    # Face injects Space secrets as plain runtime env vars, so no separate
+    # "buildtime" naming/mounting is needed (see hf_space_seed.py's
+    # docstring for why this pipeline restores at runtime rather than build
+    # time in the first place).
+    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID", aws["AWS_ACCESS_KEY_ID"])
+    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY", aws["AWS_SECRET_ACCESS_KEY"])
+    api.add_space_secret(repo_id, "SIGLIP2_TRITON_SERVER_AUTH_TOKEN", siglip2_token)
+
+    # LLM parsing / VLM verification: off by default (see
+    # docker/Dockerfile.hf-space's baked USDSEARCH_LLM_PARSING_ENABLED/
+    # USDSEARCH_VISION_VALIDATION_ENABLED=false) — only touched when
+    # LLM_ENDPOINT_BASE_URL is actually set, so a deploy with it unset
+    # doesn't require LLM_ENDPOINT_API_KEY either and behaves exactly as
+    # before this feature existed.
+    llm_vars = cfg.llm_endpoint_variables()
+    if llm_vars:
+        print(f"enabling LLM parsing / VLM verification -> {cfg.llm_endpoint_base_url}")
+        for key, value in llm_vars.items():
+            api.add_space_variable(repo_id, key, value)
+        api.add_space_secret(repo_id, "USDSEARCH_LLM_API_KEY", cfg.llm_endpoint_api_key())
+
+    print("committing Space source ...")
+    api.upload_folder(
+        repo_id=repo_id,
+        repo_type="space",
+        folder_path=str(STAGE_DIR),
+        commit_message=f"Deploy {manifest['corpus_name']} run {manifest['run_id']}",
+        # The Explorer bundle is content-hashed (static/js/main.<hash>.js):
+        # without this, every deploy after a bundle change leaves the previous
+        # hashed chunks behind as orphans on the Hub, and a stale index.html
+        # from another bundle can survive next to the new one.
+        delete_patterns=["services/explorer/dist/**"],
+    )
+
+    print(f"\ndeployed: https://huggingface.co/spaces/{repo_id}")
+    print(
+        "Hugging Face is now rebuilding on this commit — the previous "
+        "container (if any) keeps serving until the new one is ready."
+    )
+    return 0
+
+
+def run_gpu(cfg: Config) -> int:
+    """Deploy the GPU variant (docker/Dockerfile.hf-space-gpu, local
+    siglip2-triton instead of NVCF) to its own, separate Space —
+    HF_SPACE_REPO_ID_GPU, not HF_SPACE_REPO_ID. Same shape as run() above;
+    see that function's own comments for anything not called out again
+    here. Gated on hf_space_gpu_smoke_passed (set by bake.py's
+    verify_baked, which needs a GPU host to run at all — see that
+    function's own comment) rather than hf_space_smoke_passed, since the
+    two images are built and verified independently.
+    """
+    manifest = load_manifest()
+    if not manifest.get("hf_space_gpu_smoke_passed"):
+        print(
+            "The hf_space_gpu image's own smoke test has not passed for "
+            "this run. Run `bake` with HF_SPACE_BUILD_GPU_VARIANT=true on a "
+            "GPU-equipped host (its verify_baked step sets "
+            "hf_space_gpu_smoke_passed) before deploying."
+        )
+        return 1
+    if "hf_space_gpu" not in image_tags(cfg, manifest):
+        print("No hf_space_gpu image for this run (HF_SPACE_BUILD_GPU_VARIANT != true) — nothing to deploy.")
+        return 1
+
+    repo_id = cfg.require("HF_SPACE_REPO_ID_GPU")  # e.g. "nvidia/simready-central-gpu"
+    title = cfg.get("HF_SPACE_TITLE_GPU", repo_id.split("/", 1)[-1])
+    hardware = cfg.get("HF_SPACE_GPU_HARDWARE", HF_SPACE_GPU_HARDWARE_DEFAULT)
+    aws = artifact_env()  # raises if the artifact-bucket keys aren't set — no NVCF token needed here
+
+    print(f"staging Space source at {STAGE_DIR_GPU} ...")
+    stage_repo(
+        STAGE_DIR_GPU, manifest,
+        README_TEMPLATE_GPU.format(title=title, hardware=hardware),
+        dockerfile_name="Dockerfile.hf-space-gpu",
+    )
+
+    api = HfApi()
+    print(f"creating/reusing Space {repo_id} ...")
+    api.create_repo(repo_id=repo_id, repo_type="space", space_sdk="docker", exist_ok=True)
+
+    print(f"requesting {hardware} hardware ...")
+    # Front-matter `hardware:` (in README_TEMPLATE_GPU) only takes effect
+    # when HF creates a brand-new Space; an existing Space keeps whatever
+    # tier it's already on unless explicitly changed here — this call is
+    # what actually makes a redeploy switch it, e.g. after bumping
+    # HF_SPACE_GPU_HARDWARE.
+    api.request_space_hardware(repo_id, hardware=SpaceHardware(hardware))
+
+    print("setting build-arg variables ...")
+    for key, value in hf_space_gpu_build_args(cfg, manifest).items():
+        api.add_space_variable(repo_id, key, value)
+
+    print("setting runtime secrets ...")
+    # No SIGLIP2_TRITON_SERVER_AUTH_TOKEN here — this variant's local
+    # siglip2-triton process has no auth in front of it (loopback-only,
+    # same as OpenSearch/Neo4j/Redis in this image).
+    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_ACCESS_KEY_ID", aws["AWS_ACCESS_KEY_ID"])
+    api.add_space_secret(repo_id, "SIMREADYCENTRAL_INDEX_STORE_AWS_SECRET_ACCESS_KEY", aws["AWS_SECRET_ACCESS_KEY"])
+
+    llm_vars = cfg.llm_endpoint_variables()
+    if llm_vars:
+        print(f"enabling LLM parsing / VLM verification -> {cfg.llm_endpoint_base_url}")
+        for key, value in llm_vars.items():
+            api.add_space_variable(repo_id, key, value)
+        api.add_space_secret(repo_id, "USDSEARCH_LLM_API_KEY", cfg.llm_endpoint_api_key())
+
+    print("committing Space source ...")
+    api.upload_folder(
+        repo_id=repo_id,
+        repo_type="space",
+        folder_path=str(STAGE_DIR_GPU),
+        commit_message=f"Deploy {manifest['corpus_name']} run {manifest['run_id']} (GPU variant)",
+        delete_patterns=["services/explorer/dist/**"],
+    )
+
+    print(f"\ndeployed: https://huggingface.co/spaces/{repo_id}")
+    print(
+        "Hugging Face is now rebuilding on this commit — the previous "
+        "container (if any) keeps serving until the new one is ready. "
+        f"Billing runs at the {hardware} rate while this Space is not asleep."
+    )
+    return 0

pipeline/hf_space_seed.py

@@ -0,0 +1,245 @@
+"""Runtime OpenSearch/Neo4j/siglip2-model seeding for the HF Space image.
+
+Run at container startup by supervisord, one call per data store — see
+docker/hf-space/supervisord.conf (NVCF/cpu-basic variant) and
+docker/hf-space/supervisord-gpu.conf (GPU variant): `--component=opensearch`
+gates deepsearch-api's own startup on finishing (it waits for OpenSearch,
+then restores into the already-running cluster over HTTP); `--component=neo4j`
+*is* the neo4j supervisord program's command, since neo4j-admin's load
+requires the database to be offline — restore has to happen and finish
+*before* the real `neo4j` process starts, not after, unlike OpenSearch's
+live-bulk-load. `--component=siglip2-model` (GPU variant only) *is* the
+siglip2-triton supervisord program's command, same "restore then exec into
+the real process" shape as neo4j's — see main_siglip2_model()'s own
+docstring for why these particular weights are restored at runtime instead
+of baked in, unlike everything else this variant's Dockerfile does bake.
+Not at `docker build` time: HF Space secrets are only ever
+plain runtime env vars for a Docker Space (there is no way to give a `FROM`
+pull credentials at Hugging Face's own build time — see
+docker/Dockerfile.hf-space's header — and using a runtime secret sidesteps
+that entirely, since restoring becomes something the already-running,
+already-public container does for itself, with the artifact-bucket AWS
+keys arriving the same way the NVCF token does). Reuses `restore.py`'s
+tested S3-download + PUT-index + `_bulk` + `_refresh` sequence for
+OpenSearch directly, just without the indexing pipeline's own local
+manifest.json/docker-compose state, since none of that exists inside a
+Space container — only the plain env vars baked in by pipeline/bake.py
+(ARTIFACT_S3_URI, ARTIFACT_S3_REGION, CORPUS_NAME) plus one live one:
+
+RESTORE_RUN_ID — optional runtime *variable* (not secret; not baked in).
+Empty (the default) means "whatever this corpus's `latest.json` pointer
+currently names" — re-resolved independently by each component on every
+container (re)start, so a Space picks up newly `push`ed runs on its next
+restart with no redeploy needed. Set to an explicit run id (matching
+pipeline/restore.py's own RESTORE_RUN_ID) to pin the Space to one fixed run
+regardless of what gets published later — set via the Space's Settings ->
+Variables (a plain, non-secret runtime var, editable without triggering a
+rebuild). Both components resolve it the same way, so they always agree on
+which run to restore — except for a narrow, accepted race: if a new run is
+published to S3 in the brief window between the two components' own
+independent (unpinned) `latest.json` reads, they could disagree by one run.
+Low-probability and self-corrects on the Space's next restart; not worth
+the added complexity of coordinating the two processes over this.
+"""
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import httpx
+
+from .artifact_store import artifact_env, aws_cmd, run_aws_with_retry
+from .config import BUILD_DIR, Config
+from .restore import RESTORE_DIR, download, restore_opensearch
+
+OS_URL = "http://localhost:9200"
+NEO4J_HOME = Path("/var/lib/neo4j")
+NEO4J_DATA_DIR = Path("/data")
+# Separate from OpenSearch's own RESTORE_DIR (pipeline/restore.py's default)
+# so the two components' downloads, run by separate supervisord programs,
+# never race on the same directory — see download()'s own docstring note.
+NEO4J_RESTORE_DIR = BUILD_DIR / "restore-neo4j"
+
+# GPU variant only (docker/Dockerfile.hf-space-gpu) — a third component,
+# corpus-*independent* unlike the two above (the same weights serve every
+# corpus this variant might ever be built for): restores the SigLIP2 ONNX
+# encoders' weight files, which the Dockerfile deliberately does NOT bake
+# in (see its own comment — HF Space git repos cap storage at 1 GB by
+# default, well under the ~3.6 GB these weights need). Published once via
+# scripts/publish_siglip2_model_to_s3.sh, whenever
+# scripts/extract_siglip2_model.sh refreshes the vendored copy; restored
+# here into the config.pbtxt-only skeleton the Dockerfile does bake.
+MODELS_DIR = Path("/models")
+SIGLIP2_MODEL_S3_PREFIX_DEFAULT = "siglip2-model/fp16-v1"
+SIGLIP2_TRITON_CMD = [
+    "tritonserver", "--model-repository=/models", "--http-port=8003",
+    "--log-verbose=0", "--strict-model-config=true",
+    "--backend-config=onnxruntime,default-max-batch-size=32",
+    "--response-cache-byte-size=536870912", "--exit-on-error=false",
+]
+
+
+def resolve_prefix(cfg: Config, base: str, corpus_name: str) -> str:
+    pinned = cfg.get("RESTORE_RUN_ID").strip()
+    if pinned:
+        print(f"==> RESTORE_RUN_ID={pinned} — using a pinned run, not latest.json")
+        return f"{base}/{corpus_name}/{pinned}"
+
+    pointer_uri = f"{base}/{corpus_name}/latest.json"
+    # Outer timeout raised alongside aws_cmd()'s own --cli-read-timeout
+    # default (see that function's comment) — even this tiny a file hit the
+    # same intermittent connectivity issue on a real T4 Space deploy.
+    result = subprocess.run(
+        aws_cmd(cfg) + ["cp", pointer_uri, "-"],
+        capture_output=True, text=True, env=artifact_env(), timeout=120,
+    )
+    if result.returncode != 0:
+        raise SystemExit(
+            f"no published run found at {pointer_uri} — run `upload` for "
+            f"this corpus at least once before starting this Space."
+        )
+    return json.loads(result.stdout)["prefix"]
+
+
+def wait_for_cluster(timeout: float = 180.0) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            if httpx.get(f"{OS_URL}/_cluster/health", timeout=5.0).status_code < 400:
+                return
+        except httpx.HTTPError:
+            pass
+        time.sleep(2)
+    raise SystemExit("OpenSearch did not become ready before the seeding deadline")
+
+
+def main_opensearch(cfg: Config, base: str, corpus_name: str) -> int:
+    print("==> waiting for OpenSearch")
+    wait_for_cluster()
+
+    prefix = resolve_prefix(cfg, base, corpus_name)
+    print(f"==> restoring from {prefix}")
+    download(cfg, prefix)
+    manifest = json.loads((RESTORE_DIR / "manifest.json").read_text())
+    restore_opensearch(cfg, manifest)
+
+    print("==> document counts")
+    for index in sorted(manifest.get("opensearch_artifacts") or {}):
+        count = httpx.get(f"{OS_URL}/{index}/_count", timeout=10.0).json()["count"]
+        print(f"    {index}: {count}")
+        if count == 0:
+            raise SystemExit(f"index {index} is empty after seeding")
+
+    print("==> seed complete")
+    return 0
+
+
+def main_neo4j(cfg: Config, base: str, corpus_name: str) -> int:
+    # Idempotency guard, same reasoning as docker/neo4j-seeded-entrypoint.sh:
+    # a supervisord restart of this program after a crash (not a fresh
+    # container) should just start neo4j, not re-download/re-load.
+    if (NEO4J_DATA_DIR / "databases" / "neo4j").exists():
+        print("==> /data already populated, skipping restore")
+    else:
+        prefix = resolve_prefix(cfg, base, corpus_name)
+        print(f"==> restoring from {prefix}")
+        download(cfg, prefix, dest=NEO4J_RESTORE_DIR)
+        manifest = json.loads((NEO4J_RESTORE_DIR / "manifest.json").read_text())
+        artifact = manifest.get("neo4j_artifact")
+        if not artifact:
+            raise SystemExit("manifest has no neo4j_artifact for this run")
+
+        load_dir = NEO4J_RESTORE_DIR / "neo4j" / "load"
+        load_dir.mkdir(parents=True, exist_ok=True)
+        src = NEO4J_RESTORE_DIR / "neo4j" / artifact["file"]
+        dest = load_dir / "neo4j.dump"
+        with gzip.open(src, "rb") as fh, dest.open("wb") as out:
+            shutil.copyfileobj(fh, out)
+
+        print("==> loading neo4j (offline — must finish before the server starts)")
+        subprocess.run(
+            [str(NEO4J_HOME / "bin" / "neo4j-admin"), "database", "load", "neo4j",
+             f"--from-path={load_dir}", "--overwrite-destination=true"],
+            check=True, timeout=600,
+        )
+        shutil.rmtree(NEO4J_RESTORE_DIR, ignore_errors=True)
+        print("==> neo4j load complete")
+
+    print("==> starting neo4j")
+    os.execvp(str(NEO4J_HOME / "bin" / "neo4j"), [str(NEO4J_HOME / "bin" / "neo4j"), "console"])
+
+
+def main_siglip2_model(cfg: Config) -> int:
+    """Restore the SigLIP2 ONNX encoders' weight files, then exec tritonserver.
+
+    Corpus-independent (unlike main_opensearch/main_neo4j) — these weights
+    are the same regardless of which corpus this Space serves, published
+    once at a fixed S3 prefix (scripts/publish_siglip2_model_to_s3.sh), not
+    part of any indexing run's own artifact set. Restored at runtime rather
+    than baked into docker/Dockerfile.hf-space-gpu because HF Space git
+    repos cap storage at 1 GB by default — verified live 2026-09-23, a real
+    deploy-space-gpu attempt 403'd ("Repository storage limit reached") at
+    ~3.6 GB of baked weights.
+    """
+    # Idempotency guard, same reasoning as main_neo4j's: a supervisord
+    # restart of this program after a crash (not a fresh container) should
+    # just start tritonserver, not re-download ~3.6 GB.
+    marker = MODELS_DIR / ".siglip2_weights_restored"
+    if marker.exists():
+        print("==> siglip2 weights already restored, skipping")
+    else:
+        prefix_name = cfg.get("SIGLIP2_MODEL_S3_PREFIX", SIGLIP2_MODEL_S3_PREFIX_DEFAULT).strip()
+        # Deliberately not resolve_prefix()/ARTIFACT_S3_URI's <corpus>/<run>
+        # shape — these weights are corpus-independent, published once at a
+        # fixed prefix (see scripts/publish_siglip2_model_to_s3.sh), not
+        # part of any indexing run's own artifact set.
+        base = cfg.require("ARTIFACT_S3_URI").rstrip("/")
+        prefix = f"{base}/{prefix_name}"
+        print(f"==> restoring siglip2 model weights from {prefix}")
+        # run_aws_with_retry, not a bare subprocess.run: a real deploy hit
+        # an intermittent `exit 255` here (and, on a later deploy, on the
+        # much smaller neo4j sync too) that longer timeouts alone didn't
+        # fully fix — see that function's own docstring.
+        run_aws_with_retry(
+            aws_cmd(cfg) + ["sync", prefix + "/", str(MODELS_DIR), "--only-show-errors"],
+            env=artifact_env(), timeout=1800,
+        )
+        for name in ("siglip2_vision_encoder_onnx", "siglip2_text_encoder_onnx"):
+            weight_file = MODELS_DIR / name / "1" / "model.onnx"
+            if not weight_file.exists():
+                raise SystemExit(f"{weight_file} missing after sync from {prefix} — publish incomplete?")
+        marker.touch()
+        print("==> siglip2 weights restored")
+
+    print("==> starting siglip2-triton")
+    os.execvp(SIGLIP2_TRITON_CMD[0], SIGLIP2_TRITON_CMD)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--component", choices=["opensearch", "neo4j", "siglip2-model"], default="opensearch")
+    args = parser.parse_args()
+
+    cfg = Config(values=dict(os.environ))
+
+    if args.component == "siglip2-model":
+        return main_siglip2_model(cfg)
+
+    base = cfg.require("ARTIFACT_S3_URI").rstrip("/")
+    corpus_name = cfg.require("CORPUS_NAME")
+
+    if args.component == "neo4j":
+        return main_neo4j(cfg, base, corpus_name)
+    return main_opensearch(cfg, base, corpus_name)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

pipeline/queues.py

@@ -0,0 +1,59 @@
+"""Redis plugin-queue depth, for submission backpressure and drain checks.
+
+Key names are not guessed. From `packages/cache/cache/src/client/redis.py:109`
+and `client/config.py:22`, the streams are:
+
+    deepsearch_{plugin_name}_jobs     per-plugin job stream
+    deepsearch_results                plugin results, drained by omni-writer
+
+with consumer group `deepsearch-worker-pool`. "Unprocessed" for a stream is the
+consumer group's backlog (`lag`) plus its in-flight entries (`pending`), which
+is what `_total_unprocessed` reports internally.
+"""
+
+from __future__ import annotations
+
+from typing import Dict, Iterable
+
+import redis.asyncio as aioredis
+
+STREAM_PREFIX = "deepsearch"
+
+
+def plugin_stream(plugin_name: str) -> str:
+    return f"{STREAM_PREFIX}_{plugin_name}_jobs"
+
+
+RESULTS_STREAM = f"{STREAM_PREFIX}_results"
+
+
+async def stream_backlog(client: "aioredis.Redis", stream: str) -> int:
+    """Unprocessed entries in `stream`, across all consumer groups.
+
+    Before any consumer group exists the whole stream is unprocessed, so fall
+    back to XLEN rather than reporting a misleading zero.
+    """
+    try:
+        groups = await client.xinfo_groups(stream)
+    except aioredis.ResponseError:
+        return 0  # stream does not exist yet
+    if not groups:
+        try:
+            return int(await client.xlen(stream))
+        except aioredis.ResponseError:
+            return 0
+    total = 0
+    for group in groups:
+        lag = group.get("lag")
+        total += int(lag or 0) + int(group.get("pending") or 0)
+    return total
+
+
+async def queue_depths(client: "aioredis.Redis", plugins: Iterable[str]) -> Dict[str, int]:
+    depths = {p: await stream_backlog(client, plugin_stream(p)) for p in plugins}
+    depths["results"] = await stream_backlog(client, RESULTS_STREAM)
+    return depths
+
+
+def connect(url: str) -> "aioredis.Redis":
+    return aioredis.from_url(url, decode_responses=True)

pipeline/restore.py

@@ -0,0 +1,266 @@
+"""Stage 1a (pre-submit) — restore a previous run's index into the live stack.
+
+Paired with `clear`, this turns full-corpus indexing into delta indexing:
+resume from the last successful run's complete OpenSearch + Neo4j state, then
+`submit` only touches the assets this run's corpus.json actually names —
+`new`, `changed` (a URL that already exists in the baseline, so it must be
+cleared first — see `clear.py`), or `removed` (cleared and never resubmitted).
+
+Skipped cleanly on the very first run for a corpus: no `latest.json` yet and
+no explicit `RESTORE_RUN_ID` means there is nothing to restore, so the stack
+just starts empty, exactly as before this feature existed.
+
+The OpenSearch load mirrors `docker/opensearch-seed.sh` (same PUT-index +
+`_bulk` + `_refresh` sequence, same settings/mappings merge from `bake.py`),
+run directly against the live cluster instead of a build-time container. The
+Neo4j load mirrors `export.py::export_neo4j`'s stop/dump/restart dance,
+reversed: stop, `neo4j-admin database load --overwrite-destination=true`,
+restart.
+"""
+
+from __future__ import annotations
+
+import gzip
+import json
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Dict, List, Optional
+
+import httpx
+
+from .artifact_store import artifact_env, aws_cmd, bucket_base, run_aws_with_retry
+from .bake import build_create_body
+from .config import BUILD_DIR, Config
+from .enumerate_assets import load_manifest
+from .export import COMPOSE_PROJECT
+from .to_bulk import iter_bulk_lines
+
+RESTORE_DIR = BUILD_DIR / "restore"
+BASELINE_ASSETS = RESTORE_DIR / "assets.jsonl"
+
+
+def _run(cmd: List[str], **kwargs) -> subprocess.CompletedProcess:
+    print("  $ " + " ".join(str(c) for c in cmd[:8]) + (" ..." if len(cmd) > 8 else ""))
+    return subprocess.run(cmd, check=True, **kwargs)
+
+
+def resolve_baseline_prefix(cfg: Config) -> Optional[str]:
+    """The S3 prefix to restore from, or None if there is no previous run."""
+    corpus_name = load_manifest()["corpus_name"]
+    base = bucket_base(cfg)
+
+    explicit = cfg.get("RESTORE_RUN_ID").strip()
+    if explicit:
+        return f"{base}/{corpus_name}/{explicit}"
+
+    pointer_uri = f"{base}/{corpus_name}/latest.json"
+    try:
+        result = subprocess.run(
+            aws_cmd(cfg) + ["cp", pointer_uri, "-"],
+            capture_output=True, text=True, env=artifact_env(), timeout=60,
+        )
+    except subprocess.TimeoutExpired:
+        raise SystemExit(
+            f"aws s3 cp {pointer_uri} timed out after 60s — see artifact_store.py's "
+            f"aws_cmd() docstring for why this call is bounded at all."
+        )
+    if result.returncode != 0:
+        return None
+    pointer = json.loads(result.stdout)
+    return pointer["prefix"]
+
+
+def download(cfg: Config, prefix: str, dest: Path = RESTORE_DIR) -> None:
+    # dest is overridable so two independent restores (e.g. the HF Space's
+    # OpenSearch and Neo4j restores, run by separate supervisord programs —
+    # see pipeline/hf_space_seed.py) can download in parallel without
+    # racing on the same directory: one's `rmtree` could wipe out files the
+    # other is still reading.
+    if dest.exists():
+        shutil.rmtree(dest)
+    dest.mkdir(parents=True)
+    # Outer wall-clock timeout raised alongside aws_cmd()'s own
+    # --cli-read-timeout default (see that function's comment) — a per-read
+    # timeout larger than this outer one would just get preempted by it.
+    # run_aws_with_retry (not the bare _run() every other caller in this
+    # file uses) — see its own docstring for why this specific call needed
+    # backoff-retry, not just a longer timeout.
+    print("  $ " + " ".join(str(c) for c in (aws_cmd(cfg) + ["sync", prefix + "/", str(dest), "--only-show-errors"])[:8]) + " ...")
+    run_aws_with_retry(
+        aws_cmd(cfg) + ["sync", prefix + "/", str(dest), "--only-show-errors"],
+        env=artifact_env(), timeout=360,
+    )
+
+
+def bulk_load(opensearch_url: str, index: str, data_path: Path, chunk_docs: int) -> int:
+    lines = iter_bulk_lines(data_path, index)
+    batch: List[str] = []
+    docs_in_batch = 0
+    loaded = 0
+
+    def flush() -> None:
+        nonlocal batch, docs_in_batch, loaded
+        if not batch:
+            return
+        response = httpx.post(
+            f"{opensearch_url}/_bulk",
+            content=("\n".join(batch) + "\n").encode(),
+            headers={"Content-Type": "application/x-ndjson"},
+            timeout=120.0,
+        )
+        response.raise_for_status()
+        result = response.json()
+        if result.get("errors"):
+            failed = [
+                item for action in result.get("items", [])
+                for item in action.values() if item.get("error")
+            ]
+            raise SystemExit(
+                f"{index}: bulk restore rejected {len(failed)} document(s): {failed[:3]}"
+            )
+        loaded += docs_in_batch
+        batch = []
+        docs_in_batch = 0
+
+    for action_line, source_line in zip(*[lines] * 2):
+        batch.append(action_line)
+        batch.append(source_line)
+        docs_in_batch += 1
+        if docs_in_batch >= chunk_docs:
+            flush()
+    flush()
+    return loaded
+
+
+def restore_opensearch(cfg: Config, manifest: Dict) -> None:
+    artifacts = manifest.get("opensearch_artifacts") or {}
+    if not artifacts:
+        print("  no opensearch_artifacts in the baseline manifest, nothing to load")
+        return
+
+    os_dir = RESTORE_DIR / "opensearch"
+    chunk_docs = cfg.get_int("BULK_CHUNK_DOCS", 500)
+    for index in sorted(artifacts):
+        print(f"  loading {index} ...")
+        # info-endpoint/omni-writer create the index empty at their own
+        # startup, with whatever minimal/dynamic mapping their app code uses
+        # — not the full settings+mappings a previous run resolved. Loading
+        # into that leaves fields like `usd_dimensions.*` dynamically typed,
+        # which OpenSearch resolves per-document during the bulk load itself
+        # and can reject a later doc with "cannot be changed from type X to
+        # Y" if two documents' JSON numbers imply different types. An index
+        # that already holds documents is left alone (never drop real data);
+        # an empty one is replaced with the authoritative baseline mapping.
+        count_response = httpx.get(f"{cfg.opensearch_url}/{index}/_count", timeout=10.0)
+        existing_docs = count_response.json().get("count", 0) if count_response.status_code < 400 else 0
+        if existing_docs == 0:
+            if count_response.status_code < 400:
+                httpx.delete(f"{cfg.opensearch_url}/{index}", timeout=30.0)
+            body = build_create_body(
+                os_dir / f"{index}.settings.json.gz",
+                os_dir / f"{index}.mapping.json.gz",
+            )
+            response = httpx.put(f"{cfg.opensearch_url}/{index}", json=body, timeout=30.0)
+            if response.status_code >= 400:
+                # raise_for_status()'s own message is just "403 Forbidden" —
+                # the actual reason (e.g. a disk-watermark read-only block)
+                # is in the body, and only there.
+                raise SystemExit(
+                    f"PUT {cfg.opensearch_url}/{index} failed: "
+                    f"{response.status_code} {response.text}"
+                )
+        else:
+            print(f"    {index} already holds {existing_docs} doc(s) — leaving its mapping as-is")
+
+        loaded = bulk_load(cfg.opensearch_url, index, os_dir / f"{index}.data.json.gz", chunk_docs)
+        print(f"    loaded {loaded} docs")
+
+    # Same reasoning as opensearch-seed.sh: the index is created with a long
+    # refresh_interval, so `_count` reads 0 until an explicit refresh happens.
+    httpx.post(f"{cfg.opensearch_url}/_refresh", timeout=60.0)
+
+
+def restore_neo4j(cfg: Config, manifest: Dict) -> None:
+    artifact = manifest.get("neo4j_artifact")
+    if not artifact:
+        print("  no neo4j_artifact in the baseline manifest, nothing to load")
+        return
+
+    load_dir = RESTORE_DIR / "neo4j" / "load"
+    if load_dir.exists():
+        shutil.rmtree(load_dir)
+    load_dir.mkdir(parents=True)
+    src = RESTORE_DIR / "neo4j" / artifact["file"]
+    dest = load_dir / "neo4j.dump"
+    with gzip.open(src, "rb") as fh, dest.open("wb") as out:
+        shutil.copyfileobj(fh, out)
+
+    print("  stopping asset-graph-service and neo4j ...")
+    _run(["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+          "stop", "asset-graph-service", "neo4j"], env=cfg.compose_env())
+
+    print("  loading neo4j ...")
+    # Runs as root (the image default, same as export's dump), then chowns
+    # back to uid 7474 — the volume is owned by the in-container neo4j user,
+    # same fact export.py's dump step relies on in the other direction.
+    _run([
+        "docker", "run", "--rm",
+        "--entrypoint", "bash",
+        "-v", f"{COMPOSE_PROJECT}_neo4j-data:/data",
+        "-v", f"{load_dir}:/dumps",
+        f"neo4j:{cfg.get('NEO4J_VERSION', '5.23.0-community')}",
+        "-c",
+        "set -e; neo4j-admin database load neo4j --from-path=/dumps "
+        "--overwrite-destination=true; chown -R 7474:7474 /data",
+    ])
+
+    print("  restarting neo4j and asset-graph-service ...")
+    _run(["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+          "start", "neo4j", "asset-graph-service"], env=cfg.compose_env())
+
+
+def run(cfg: Config) -> int:
+    prefix = resolve_baseline_prefix(cfg)
+    if prefix is None:
+        print("no previous run found for this corpus — starting from an empty index")
+        if RESTORE_DIR.exists():
+            shutil.rmtree(RESTORE_DIR)
+        RESTORE_DIR.mkdir(parents=True)
+        BASELINE_ASSETS.write_text("")
+        return 0
+
+    print(f"restoring baseline from {prefix}")
+    download(cfg, prefix)
+    manifest = json.loads((RESTORE_DIR / "manifest.json").read_text())
+
+    print("\nRestoring OpenSearch ...")
+    restore_opensearch(cfg, manifest)
+
+    print("\nRestoring Neo4j ...")
+    restore_neo4j(cfg, manifest)
+
+    print(f"\nrestored run {manifest['run_id']} ({manifest.get('asset_count', '?')} baseline assets)")
+    return 0
+
+
+def load_baseline_urls() -> set:
+    """URLs already indexed as of the restored baseline. Empty on a first run."""
+    if not BASELINE_ASSETS.exists():
+        return set()
+    return {
+        json.loads(line)["url"]
+        for line in BASELINE_ASSETS.read_text().splitlines()
+        if line.strip()
+    }
+
+
+def expected_total(removed: set, current_urls: set) -> int:
+    """Doc/node count the whole index should hold once this run finishes.
+
+    baseline, minus whatever this run explicitly removed, unioned with
+    whatever this run submits (new assets add, repeating assets overwrite in
+    place so they don't double-count).
+    """
+    baseline = load_baseline_urls()
+    return len((baseline - removed) | current_urls)

pipeline/run_pipeline.py

@@ -0,0 +1,311 @@
+"""USD Search index re-generation pipeline — single entry point.
+
+    python -m pipeline.run_pipeline <stage> [options]
+
+Stages run in order and each is independently re-runnable:
+
+    enumerate  corpus.json -> exact asset list (N) + manifest
+    index      bring the stack up, restore the baseline, clear, submit the
+               delta, wait
+    export     elasticdump the indexes; neo4j-admin dump the graph
+    upload     publish the artifact set to S3
+    bake       build images with the data pre-loaded
+    verify     runtime-only stack from the baked images + smoke test
+    push       push the baked images (only after verify passes)
+    all        every stage in order
+
+    deploy-space  deploy the hf_space image to a Hugging Face Space (not
+                  part of `all` — run manually after `push`; see
+                  pipeline/hf_space.py)
+    deploy-space-gpu  same, for the GPU variant (local siglip2-triton
+                      instead of NVCF, HF_SPACE_BUILD_GPU_VARIANT=true —
+                      see docker/Dockerfile.hf-space-gpu and
+                      docs/plans/siglip2-embedded-hf-space.md)
+
+Helper stages: `up`, `down`, `restore`, `clear`, `submit`, `wait`, `status`.
+
+`restore`/`clear` turn this into delta indexing: `restore` loads the previous
+run's complete OpenSearch + Neo4j state (from `latest.json`, or an explicit
+`RESTORE_RUN_ID`) into the freshly-up stack; `clear` then removes anything
+this run's corpus.json marks `removed`, plus anything that's about to be
+resubmitted (a URL present in both the baseline and this run's assets —
+Neo4j's dependency edges aren't idempotent on reprocessing, so the old ones
+must go first). `submit` then only touches this run's assets.jsonl — the
+delta the corpus.json actually names. First run for a corpus (no previous
+`latest.json`) skips `restore` cleanly and behaves exactly as before this
+feature existed.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import List
+
+from .config import BUILD_DIR, Config
+
+INDEXING_PROJECT = "simready-indexing"
+
+
+def _compose(cfg: Config, args: List[str]) -> int:
+    cmd = ["docker", "compose", "-p", INDEXING_PROJECT, *cfg.indexing_compose_files(), *args]
+    print("$ " + " ".join(cmd[:8]) + (" ..." if len(cmd) > 8 else ""))
+    return subprocess.run(cmd, env=cfg.compose_env(), check=False).returncode
+
+
+# ── stages ───────────────────────────────────────────────────────────────────
+
+
+def stage_enumerate(cfg: Config, args) -> int:
+    from .enumerate_assets import run
+    return run(cfg, dry_run=args.dry_run)
+
+
+def stage_up(cfg: Config, args) -> int:
+    if not (BUILD_DIR / "settings.yaml").exists() or not (BUILD_DIR / "plugin.config.yaml").exists():
+        print("`.build/settings.yaml`/`.build/plugin.config.yaml` are missing — run `enumerate` first.")
+        return 1
+    if cfg.siglip2_nvcf:
+        print(f"siglip2 backend: nvcf ({cfg.get('SIGLIP2_NVCF_ENDPOINT', 'grpc.nvcf.nvidia.com:443')}) "
+              f"— no local GPU needed for embeddings.")
+    if cfg.vlm_metadata_enabled:
+        cfg.require_vlm_metadata_credentials()
+        model = os.environ.get("USDSEARCH_VISION_METADATA_MODEL", "").strip() or "azure/openai/gpt-5.6-sol (default)"
+        base_url = os.environ.get("USDSEARCH_LLM_BASE_URL", "").strip() or "https://inference-api.nvidia.com (default)"
+        print(f"VLM metadata extraction: enabled (model={model!r} @ {base_url})")
+    # Independent replica counts, not one shared knob: thumbnail_to_embedding
+    # and asset_graph_generation don't actually bottleneck together in
+    # practice — the Kit-based USD parse graph-builder does for
+    # asset_graph_generation is far slower per-asset than a siglip2 call, so
+    # a real corpus typically wants these scaled very differently. All three
+    # services dropped container_name (and, for the two workers, host ports)
+    # in compose/docker-compose.indexing.yml specifically to allow this.
+    scale_args: List[str] = []
+    scale_targets = [
+        ("monitor-worker-thumbnail-to-embedding", "THUMBNAIL_WORKER_REPLICAS"),
+        ("monitor-worker-asset-graph-generation", "AGS_WORKER_REPLICAS"),
+        ("graph-builder", "GRAPH_BUILDER_REPLICAS"),
+    ]
+    if cfg.vlm_metadata_enabled:
+        scale_targets.append(
+            ("monitor-worker-thumbnail-to-vision-metadata", "VLM_METADATA_WORKER_REPLICAS")
+        )
+    for service, key in scale_targets:
+        replicas = cfg.get_int(key, 1)
+        if replicas > 1:
+            print(f"scaling {service} to {replicas} replicas ({key})")
+            scale_args += ["--scale", f"{service}={replicas}"]
+    return _compose(cfg, ["up", "-d", "--wait", *scale_args])
+
+
+def stage_down(cfg: Config, args) -> int:
+    return _compose(cfg, ["down"] + (["-v"] if args.volumes else []))
+
+
+def stage_restore(cfg: Config, args) -> int:
+    from .restore import run
+    return run(cfg)
+
+
+def stage_clear(cfg: Config, args) -> int:
+    from .clear import run
+    return run(cfg)
+
+
+def stage_submit(cfg: Config, args) -> int:
+    from .submit import run
+    return run(cfg, resume=not args.no_resume)
+
+
+def stage_wait(cfg: Config, args) -> int:
+    from .status import run
+    return run(cfg)
+
+
+def stage_index(cfg: Config, args) -> int:
+    """Bring the stack up, restore the baseline, clear, submit the delta, wait."""
+    steps = (
+        ("up", stage_up),
+        ("restore", stage_restore),
+        ("clear", stage_clear),
+        ("submit", stage_submit),
+        ("wait", stage_wait),
+    )
+    for step, fn in steps:
+        print(f"\n{'=' * 70}\n== index: {step}\n{'=' * 70}")
+        code = fn(cfg, args)
+        if code != 0:
+            print(f"\nindex stage failed at `{step}` (exit {code})")
+            return code
+    return 0
+
+
+def stage_export(cfg: Config, args) -> int:
+    from .export import run
+    return run(cfg)
+
+
+def stage_upload(cfg: Config, args) -> int:
+    from .upload import run
+    return run(cfg)
+
+
+def stage_bake(cfg: Config, args) -> int:
+    from .bake import run
+    return run(cfg, push=False)
+
+
+def stage_verify(cfg: Config, args) -> int:
+    from .verify import run
+    return run(cfg, keep_up=args.keep_up)
+
+
+def stage_deploy_space(cfg: Config, args) -> int:
+    from .hf_space import run
+    return run(cfg)
+
+
+def stage_deploy_space_gpu(cfg: Config, args) -> int:
+    from .hf_space import run_gpu
+    return run_gpu(cfg)
+
+
+def stage_push(cfg: Config, args) -> int:
+    from .bake import image_tags, latest_tags
+    from .enumerate_assets import load_manifest
+    manifest = load_manifest()
+    if not manifest.get("smoke_passed") and not args.force:
+        print(
+            "The smoke test has not passed for this run. Run `verify` first, or "
+            "pass --force if you are pushing deliberately without it."
+        )
+        return 1
+    latest = latest_tags(cfg, manifest)
+    for name, tag in image_tags(cfg, manifest).items():
+        print(f"pushing {tag}")
+        result = subprocess.run(["docker", "push", tag], check=False)
+        if result.returncode != 0:
+            return result.returncode
+
+        # `-latest` only ever means "the most recently *published* run" —
+        # a `docker tag` here, not built alongside the versioned tag in
+        # bake.py, so a plain `bake` (never pushed) never touches it.
+        latest_tag = latest[name]
+        print(f"tagging {latest_tag}")
+        subprocess.run(["docker", "tag", tag, latest_tag], check=True)
+        print(f"pushing {latest_tag}")
+        result = subprocess.run(["docker", "push", latest_tag], check=False)
+        if result.returncode != 0:
+            return result.returncode
+    return 0
+
+
+def stage_all(cfg: Config, args) -> int:
+    order = [
+        ("enumerate", stage_enumerate),
+        ("index", stage_index),
+        ("export", stage_export),
+        ("upload", stage_upload),
+        ("bake", stage_bake),
+        ("verify", stage_verify),
+        ("push", stage_push),
+    ]
+    names = [n for n, _ in order]
+    start = names.index(args.start) if args.start else 0
+    stop = names.index(args.stop) + 1 if args.stop else len(order)
+
+    for i, (name, fn) in enumerate(order[start:stop], start=start):
+        print(f"\n{'#' * 70}\n# stage: {name}\n{'#' * 70}")
+        code = fn(cfg, args)
+        if name == "upload" and code == 2:
+            # ARTIFACT_S3_URI is the one unresolved input; skipping it must not
+            # block baking and verifying locally.
+            print("skipping upload (ARTIFACT_S3_URI unset) and continuing")
+            continue
+        if code != 0:
+            print(f"\npipeline stopped: stage `{name}` failed (exit {code})")
+            return code
+        if name == "export" and i + 1 < stop:
+            # `export` already captured everything the indexing stack has to
+            # offer — neither `upload` nor `bake` touch it again, and
+            # `verify` next brings up the *runtime* stack, which binds the
+            # same host ports (9200, 7474/7687, ...) anyway. Tear it down
+            # here, not after `bake`: leaving opensearch/neo4j/usdsearch/
+            # graph-builder running for the full duration of `bake`'s two
+            # `docker build`s serves no purpose and competes for the same
+            # constrained disk/memory a CI runner has — a run was observed
+            # to hang inside `bake` for 44+ minutes, unresponsive even to
+            # the job's own force-cancel, consistent with the runner
+            # thrashing under that contention rather than any single
+            # command actually being stuck. Skipped if `--stop export` or
+            # `--stop upload` means nothing after this needs the stack down,
+            # so an operator who stopped here on purpose can still inspect it.
+            print("\ntearing down the indexing stack (nothing after `export` needs it) ...")
+            _compose(cfg, ["down", "--volumes"])
+    print("\npipeline complete")
+    return 0
+
+
+STAGES = {
+    "enumerate": stage_enumerate,
+    "up": stage_up,
+    "down": stage_down,
+    "restore": stage_restore,
+    "clear": stage_clear,
+    "submit": stage_submit,
+    "wait": stage_wait,
+    "status": stage_wait,
+    "index": stage_index,
+    "export": stage_export,
+    "upload": stage_upload,
+    "bake": stage_bake,
+    "verify": stage_verify,
+    "push": stage_push,
+    "deploy-space": stage_deploy_space,
+    "deploy-space-gpu": stage_deploy_space_gpu,
+    "all": stage_all,
+}
+
+
+def main(argv: List[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="run_pipeline",
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("stage", choices=sorted(STAGES))
+    parser.add_argument("--env-file", type=Path, default=None,
+                        help="defaults to config/pipeline.env")
+    parser.add_argument("--dry-run", action="store_true",
+                        help="enumerate: list and filter without writing")
+    parser.add_argument("--no-resume", action="store_true",
+                        help="submit: ignore the checkpoint and resubmit everything")
+    parser.add_argument("--volumes", action="store_true",
+                        help="down: also remove volumes (destroys the index)")
+    parser.add_argument("--keep-up", action="store_true",
+                        help="verify: leave the runtime stack running afterwards")
+    parser.add_argument("--force", action="store_true",
+                        help="push: push without a passing smoke test")
+    parser.add_argument("--start", choices=list(STAGES), default=None,
+                        help="all: resume from this stage")
+    parser.add_argument("--stop", choices=list(STAGES), default=None,
+                        help="all: stop after this stage")
+    args = parser.parse_args(argv)
+
+    cfg = Config.load(args.env_file)
+    if not cfg.values:
+        print(
+            f"No configuration found at {cfg.env_file}.\n"
+            f"Copy config/pipeline.env.example to config/pipeline.env and edit it.",
+            file=sys.stderr,
+        )
+        return 1
+
+    return STAGES[args.stage](cfg, args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

pipeline/status.py

@@ -0,0 +1,381 @@
+"""Stage 1b — wait for indexing to complete, then report on it.
+
+Two phases, because the endpoint's two halves have different timing
+(see submit.py):
+
+  Phase A (deterministic)  the base metadata write is synchronous, so once
+                           submission succeeds for N assets the main index must
+                           hold exactly N documents. No polling.
+
+  Phase B (polled)         plugin work is asynchronous. Poll
+                           /info/indexing/asset/status per asset, which reports
+                           per-plugin state *and the failure reason*.
+
+`PluginStatusType` (services/info-endpoint/.../api/models.py:26) has five
+states, not the three its endpoint docstring lists — `failed_indexing` and
+`out_of_sync_and_failed_indexing` are terminal failures we can read directly
+rather than inferring from history strings.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import subprocess
+import time
+from dataclasses import dataclass, field
+from typing import Dict, List, Optional, Set, Tuple
+
+import httpx
+
+from .config import BUILD_DIR, Config, active_plugins
+from .enumerate_assets import load_assets, load_manifest
+from .export import COMPOSE_PROJECT
+from .queues import connect, queue_depths
+
+
+def dump_worker_logs(cfg: Config) -> None:
+    """Surface why assets never went terminal, when the poll loop gives up.
+
+    The actual failure (if any) happened inside these containers — the
+    worker calling out to NVCF/Triton, or info-endpoint dispatching the
+    job — not in this script, so a bare "TIMEOUT" here explains nothing on
+    its own. Best-effort: never let a logging step mask the real failure.
+    """
+    print("\n  worker/info-endpoint logs (last 100 lines each), for diagnosis:")
+    services = ["monitor-worker-thumbnail-to-embedding", "monitor-worker-asset-graph-generation", "info-endpoint"]
+    if cfg.vlm_metadata_enabled:
+        services.insert(2, "monitor-worker-thumbnail-to-vision-metadata")
+    for service in services:
+        print(f"\n  --- {service} ---")
+        try:
+            subprocess.run(
+                ["docker", "compose", "-p", COMPOSE_PROJECT, *cfg.indexing_compose_files(),
+                 "logs", "--tail", "100", service],
+                check=False, timeout=30, env=cfg.compose_env(),
+            )
+        except subprocess.SubprocessError as exc:
+            print(f"  (could not fetch logs for {service}: {exc})")
+
+DONE = {"in_sync"}
+TERMINAL_FAILURE = {"failed_indexing", "out_of_sync_and_failed_indexing"}
+PENDING = {"out_of_sync", "not_found"}
+
+
+@dataclass
+class PluginOutcome:
+    url: str
+    plugin: str
+    status: str
+    exception: str = ""
+
+
+@dataclass
+class Tally:
+    ok: int = 0
+    failed: int = 0
+    pending: int = 0
+    failures: List[PluginOutcome] = field(default_factory=list)
+
+
+async def fetch_status(
+    client: httpx.AsyncClient, base_url: str, url: str
+) -> Optional[Dict]:
+    try:
+        response = await client.get(
+            f"{base_url}/info/indexing/asset/status", params={"url": url}
+        )
+    except (httpx.TransportError, httpx.TimeoutException):
+        return None
+    if response.status_code >= 400:
+        return None
+    return response.json()
+
+
+def classify(doc: Dict, plugins: Tuple[str, ...]) -> Dict[str, Tuple[str, str]]:
+    """-> {plugin: (verdict, detail)} where verdict is ok|failed|pending."""
+    out: Dict[str, Tuple[str, str]] = {}
+    for plugin, info in (doc.get("plugins_statuses") or {}).items():
+        if plugin not in plugins:
+            continue
+        state = info.get("indexing_status", "not_found")
+        detail = ""
+        history = info.get("plugin_status_history") or []
+        if history:
+            last = history[-1]
+            detail = str(last.get("exception") or last.get("status") or "")
+        if state in DONE:
+            out[plugin] = ("ok", detail)
+        elif state in TERMINAL_FAILURE:
+            out[plugin] = ("failed", detail or state)
+        else:
+            out[plugin] = ("pending", state)
+    # A plugin absent from the response has never been seen for this asset.
+    for plugin in plugins:
+        out.setdefault(plugin, ("pending", "absent"))
+    return out
+
+
+async def poll_until_done(cfg: Config, urls: List[str]) -> Tuple[Dict[str, Tally], List[str]]:
+    """Poll the outstanding set until every (asset, plugin) pair is terminal."""
+    interval = cfg.get_float("STATUS_POLL_INTERVAL", 15.0)
+    timeout = cfg.get_float("STATUS_TIMEOUT", 21600.0)
+    concurrency = cfg.get_int("STATUS_CONCURRENCY", 16)
+    redis_url = f"redis://localhost:{cfg.get_int('REDIS_HOST_PORT', 6380)}"
+    plugins = active_plugins(cfg)
+
+    tallies: Dict[str, Tally] = {p: Tally() for p in plugins}
+    settled: Dict[Tuple[str, str], Tuple[str, str]] = {}
+    outstanding: Set[str] = set(urls)
+    deadline = time.monotonic() + timeout
+    semaphore = asyncio.Semaphore(concurrency)
+    redis_client = connect(redis_url)
+
+    limits = httpx.Limits(max_connections=concurrency * 2)
+    async with httpx.AsyncClient(limits=limits, timeout=httpx.Timeout(30.0)) as client:
+        while outstanding:
+            if time.monotonic() > deadline:
+                print(f"\nTIMEOUT after {timeout:.0f}s with {len(outstanding)} assets outstanding.")
+                dump_worker_logs(cfg)
+                break
+
+            async def check(url: str) -> Tuple[str, Optional[Dict]]:
+                async with semaphore:
+                    return url, await fetch_status(client, cfg.info_endpoint, url)
+
+            batch = await asyncio.gather(*(check(u) for u in sorted(outstanding)))
+
+            for url, doc in batch:
+                if doc is None:
+                    continue
+                verdicts = classify(doc, plugins)
+                if all(v[0] != "pending" for v in verdicts.values()):
+                    outstanding.discard(url)
+                    for plugin, (verdict, detail) in verdicts.items():
+                        settled[(url, plugin)] = (verdict, detail)
+
+            depths = await queue_depths(redis_client, plugins)
+            queued = sum(v for k, v in depths.items() if k != "results")
+            print(
+                f"  outstanding={len(outstanding)} "
+                f"queued={queued} results={depths['results']}",
+                flush=True,
+            )
+
+            if not outstanding:
+                break
+
+            # Everything drained but assets are still not terminal: the jobs
+            # were never picked up. The usual cause is a worker whose
+            # JOB_ITEM_TYPE omits "priority", which discards every job this
+            # pipeline creates.
+            if queued == 0 and depths["results"] == 0:
+                await asyncio.sleep(interval)
+                depths = await queue_depths(redis_client, plugins)
+                if sum(depths.values()) == 0:
+                    print(
+                        f"\nQueues are empty but {len(outstanding)} assets never reached a "
+                        f"terminal state.\nCheck that both workers set "
+                        f"DEEPSEARCH_MONITOR_WORKER_CONFIG_JOB_ITEM_TYPE to "
+                        f'\'["priority","normal","none"]\' — the default drops '
+                        f"priority jobs silently."
+                    )
+                    dump_worker_logs(cfg)
+                    break
+            await asyncio.sleep(interval)
+
+    await redis_client.aclose()
+
+    for (url, plugin), (verdict, detail) in settled.items():
+        tally = tallies[plugin]
+        if verdict == "ok":
+            tally.ok += 1
+        else:
+            tally.failed += 1
+            tally.failures.append(PluginOutcome(url, plugin, verdict, detail))
+    for url in outstanding:
+        for plugin in plugins:
+            tallies[plugin].pending += 1
+
+    return tallies, sorted(outstanding)
+
+
+# ── OpenSearch / Neo4j measurements ──────────────────────────────────────────
+
+
+def refresh_index(cfg: Config, index: str) -> None:
+    """Force docs into a searchable state before counting.
+
+    Indexes are created with a long `refresh_interval` (§2.8 batch tuning), so
+    `_count` can lag a synchronous write by up to that interval and report a
+    false submission gap — the same class of bug §8.2 already found at bake
+    time ("`_refresh`, not just `_flush`").
+    """
+    try:
+        httpx.post(f"{cfg.opensearch_url}/{index}/_refresh", timeout=30.0)
+    except httpx.HTTPError:
+        pass  # os_count will report a possibly-stale count; not fatal here
+
+
+def os_count(cfg: Config, index: str) -> int:
+    try:
+        response = httpx.get(f"{cfg.opensearch_url}/{index}/_count", timeout=30.0)
+        if response.status_code >= 400:
+            return 0
+        return int(response.json().get("count", 0))
+    except httpx.HTTPError:
+        return 0
+
+
+def embedding_coverage(cfg: Config) -> Tuple[int, float]:
+    """Documents carrying a siglip2 embedding, as a fraction of the index.
+
+    Every corpus asset is assumed to already have a thumbnail (see the plan,
+    §5.4), so this should be 1.0. It is measured rather than trusted because a
+    missing thumbnail produces a searchable-by-text but vector-less document —
+    a silent recall hole.
+    """
+    total = os_count(cfg, cfg.main_index)
+    if total == 0:
+        return 0, 0.0
+    query = {"query": {"nested": {
+        "path": "siglip2-embedding",
+        "query": {"exists": {"field": "siglip2-embedding.embedding"}},
+    }}}
+    try:
+        response = httpx.post(
+            f"{cfg.opensearch_url}/{cfg.main_index}/_count",
+            json=query, timeout=60.0,
+        )
+        if response.status_code >= 400:
+            return 0, 0.0
+        with_embedding = int(response.json().get("count", 0))
+    except httpx.HTTPError:
+        return 0, 0.0
+    return with_embedding, with_embedding / total
+
+
+def neo4j_counts(cfg: Config) -> Tuple[int, int]:
+    try:
+        from neo4j import GraphDatabase
+    except ImportError:
+        return -1, -1
+    try:
+        # Neo4j runs with auth disabled in this stack, so no credentials.
+        driver = GraphDatabase.driver(cfg.neo4j_bolt_url, auth=None)
+        with driver.session() as session:
+            nodes = session.run("MATCH (n) RETURN count(n) AS c").single()["c"]
+            rels = session.run("MATCH ()-[r]->() RETURN count(r) AS c").single()["c"]
+        driver.close()
+        return int(nodes), int(rels)
+    except Exception as exc:  # noqa: BLE001 - report, never abort the stage
+        print(f"  warning: could not read Neo4j counts ({type(exc).__name__}: {exc})")
+        return -1, -1
+
+
+def run(cfg: Config) -> int:
+    from .restore import expected_total as compute_expected_total
+
+    manifest = load_manifest()
+    assets = load_assets()
+    expected = len(assets)  # submitted this run — scopes Phase B / plugin ratios
+    urls = [a.url for a in assets]
+
+    # Whole-index target: baseline (restored, minus this run's `removed`) plus
+    # whatever this run submits. Equals `expected` when there is no baseline
+    # (first run for a corpus, or `restore` never ran).
+    removed = set(manifest.get("removed") or [])
+    total_expected = compute_expected_total(removed, {a.url for a in assets})
+
+    print(f"expected assets this run: {expected}")
+    print(f"expected index total:     {total_expected}\n")
+
+    print("Phase A — base documents (synchronous write, no polling needed)")
+    refresh_index(cfg, cfg.main_index)
+    base_docs = os_count(cfg, cfg.main_index)
+    print(f"  {cfg.main_index}: {base_docs} docs (expected {total_expected})")
+
+    print("\nPhase B — plugin completion")
+    tallies, outstanding = asyncio.run(poll_until_done(cfg, urls))
+
+    print("\nMeasuring index ...")
+    refresh_index(cfg, cfg.main_index)
+    refresh_index(cfg, cfg.image_cache_index)
+    image_docs = os_count(cfg, cfg.image_cache_index)
+    embedded, coverage = embedding_coverage(cfg)
+    nodes, rels = neo4j_counts(cfg)
+    base_docs = os_count(cfg, cfg.main_index)
+
+    report = {
+        "run_id": manifest["run_id"],
+        "asset_count_expected": expected,
+        "index_total_expected": total_expected,
+        "base_docs_indexed": base_docs,
+        "image_cache_docs": image_docs,
+        "embedding_coverage": round(coverage, 4),
+        "docs_with_embedding": embedded,
+        "neo4j_node_count": nodes,
+        "neo4j_relationship_count": rels,
+        "per_plugin": {
+            p: {"ok": t.ok, "failed": t.failed, "pending": t.pending}
+            for p, t in tallies.items()
+        },
+        "failures": [
+            {"url": f.url, "plugin": f.plugin, "status": f.status, "exception": f.exception}
+            for t in tallies.values() for f in t.failures
+        ],
+        "never_terminal": outstanding,
+    }
+    (BUILD_DIR / "index-report.json").write_text(json.dumps(report, indent=2) + "\n")
+
+    # Carry the counts forward; the smoke test and export's pre-flight check
+    # both assert against these, and they need to reflect the whole merged
+    # index (baseline + delta), not just what this run submitted.
+    manifest.update({
+        "asset_count": total_expected,
+        "base_docs_indexed": base_docs,
+        "image_cache_docs": image_docs,
+        "neo4j_node_count": nodes,
+        "neo4j_relationship_count": rels,
+    })
+    from .enumerate_assets import save_manifest
+    save_manifest(manifest)
+
+    # ── acceptance ────────────────────────────────────────────────────────
+    print("\n── Report ──")
+    print(f"  base docs:          {base_docs} / {total_expected}")
+    print(f"  image cache docs:   {image_docs}")
+    print(f"  embedding coverage: {coverage:.2%} ({embedded}/{base_docs})")
+    print(f"  neo4j nodes/rels:   {nodes} / {rels}")
+    for plugin, tally in tallies.items():
+        print(f"  {plugin}: ok={tally.ok} failed={tally.failed} pending={tally.pending}")
+
+    failed = False
+    if base_docs != total_expected:
+        print(
+            f"\nFAIL: base document count {base_docs} != expected {total_expected} "
+            f"(baseline + this run's delta, minus removed). The metadata write is "
+            f"synchronous, so this is a submission gap, not a timing one — see "
+            f".build/submit-failures.json."
+        )
+        failed = True
+
+    plugin_min = cfg.get_float("PLUGIN_OK_MIN", 0.95)
+    for plugin, tally in tallies.items():
+        ratio = tally.ok / expected if expected else 0.0
+        if ratio < plugin_min:
+            print(f"\nFAIL: {plugin} completed {ratio:.2%} of assets, below PLUGIN_OK_MIN {plugin_min:.2%}.")
+            failed = True
+
+    coverage_min = cfg.get_float("EMBEDDING_COVERAGE_MIN", 0.99)
+    if coverage < coverage_min:
+        print(
+            f"\nFAIL: embedding coverage {coverage:.2%} is below EMBEDDING_COVERAGE_MIN "
+            f"{coverage_min:.2%}.\nThe corpus is assumed to be fully thumbnailed; a "
+            f"systematic gap here means it is not, and the fix is to enable the "
+            f"thumbnail_generation plugin."
+        )
+        failed = True
+
+    print(f"\nwrote .build/index-report.json")
+    return 1 if failed else 0