From 5e26a3cffd3e4216711519556489c9ca615f72c0 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Sun, 9 Aug 2026 12:59:55 +0300 Subject: [PATCH 1/2] feat: add FCAME private result transport Add opaque private result descriptors and bounded exact-title lookup for guarded Knowledge publication. Expose metadata-only capability reporting, keep private payload materializers outside the public package surface, and ship generated artifacts for 0.2.100. Agent: quintilianus --- README.md | 34 +++ bin/knowledge-mcp.js | 2 +- bin/knowledge-serve.js | 150 +++++++++++++ bin/knowledge.js | 58 ++--- dist/guarded-write-contract.d.ts | 74 +++++++ dist/guarded-writer.d.ts | 9 +- dist/index.d.ts | 2 +- dist/index.js | 351 +++++++++++++++++++++++++++++++ dist/serve.js | 284 +++++++++++++++++++++++++ package.json | 2 +- src/cli.ts | 26 ++- src/guarded-write-contract.ts | 254 ++++++++++++++++++++++ src/guarded-writer.ts | 96 +++++++++ src/index.ts | 12 ++ src/serve.ts | 192 +++++++++++++++++ tests/cli.test.ts | 13 ++ tests/guarded-writer.test.ts | 110 ++++++++++ tests/package-release.test.ts | 15 +- 18 files changed, 1647 insertions(+), 37 deletions(-) diff --git a/README.md b/README.md index 0e93584..547acb4 100644 --- a/README.md +++ b/README.md @@ -175,6 +175,40 @@ const result = await guarded.execute(privateInput); // an exact full-ID readback. A rejection throws KnowledgeGuardedWriteRejectedError. ``` +For callers that must keep returned titles and bodies off public result +surfaces, use `executePrivate(...)` and `readbackPrivate(...)`. They return an +opaque private-result descriptor whose JSON form contains only its kind, item +count, expiry, and result digest. `inspectKnowledgePrivateResult(...)` +materializes a metadata-only proof inside the process: full item ID, version, +title/content/source/tag/metadata digests, and replay receipt identity, never +the title or body. + +Deduplicate reviewed sources by an exact title only through the package-owned +private title descriptor: + +```ts +import { + createKnowledgePrivateTitleLookupDescriptor, + inspectKnowledgePrivateResult, +} from '@hasna/knowledge'; + +const lookup = createKnowledgePrivateTitleLookupDescriptor({ + operation_id: 'doctrine-rollout-2026-08', + step_id: 'lookup-one', + binding, + title: privateReviewedTitle, +}); +const proof = inspectKnowledgePrivateResult(await guarded.lookupTitle(lookup)); +``` + +The producer sends the title only in the authenticated bounded request. The +server matches the exact authority, tenant, scope, parent, and title, selects at +most two rows to detect ambiguity, and returns zero or one digest-only proof. +Two matching titles fail closed with `private_title_lookup_ambiguous`; the +endpoint never falls back to a collection scan and never returns item bodies or +titles. `knowledge guarded capabilities --json` reports this private transport +support without reading configuration, opening a store, or making a request. + The deterministic key is: ```text diff --git a/bin/knowledge-mcp.js b/bin/knowledge-mcp.js index 252860e..67d5741 100755 --- a/bin/knowledge-mcp.js +++ b/bin/knowledge-mcp.js @@ -14997,7 +14997,7 @@ import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSy // package.json var package_default = { name: "@hasna/knowledge", - version: "0.2.99", + version: "0.2.100", description: "Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions", type: "module", exports: { diff --git a/bin/knowledge-serve.js b/bin/knowledge-serve.js index aadcc44..7fcdcc4 100755 --- a/bin/knowledge-serve.js +++ b/bin/knowledge-serve.js @@ -729,6 +729,7 @@ function makeShortId(id) { import { createHash as createHash2, randomUUID } from "crypto"; var KNOWLEDGE_GUARDED_WRITE_CONTRACT = "FCAME-1"; var KNOWLEDGE_PRIVATE_INPUT_SCHEMA = "hasna.knowledge.private-input.v1"; +var KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA = "hasna.knowledge.private-title-lookup.v1"; var DEFAULT_KNOWLEDGE_GUARDED_LIMITS = Object.freeze({ submission: Object.freeze({ max_calls: 1, @@ -753,6 +754,8 @@ var MAX_GUARDED_BYTES = 4 * 1024 * 1024; var MAX_GUARDED_WALL_TIME_MS = 30000; var MAX_DESCRIPTOR_LIFETIME_MS = 60 * 60 * 1000; var PRIVATE_PAYLOADS = new WeakMap; +var PRIVATE_TITLE_LOOKUPS = new WeakMap; +var PRIVATE_RESULTS = new WeakMap; function assertObjectKeys(value, field, allowed, required = allowed) { if (!value || typeof value !== "object" || Array.isArray(value)) { throw new Error(`${field} must be an object.`); @@ -1188,6 +1191,18 @@ function assertKnowledgeGuardedPayload(verb, payload) { throw new Error("update payload must change at least one field."); } } +function knowledgePrivateItemProof(item) { + return Object.freeze({ + id: item.id, + version: Number(item.version ?? 1), + title_sha256: knowledgeGuardedContentSha256(item.title), + content_sha256: knowledgeGuardedContentSha256(item.content), + url_sha256: item.url === null || item.url === undefined ? null : knowledgeGuardedContentSha256(item.url), + tags_sha256: knowledgeGuardedDigest(item.tags ?? []), + metadata_sha256: knowledgeGuardedDigest(item.metadata ?? {}), + archived: item.archived === true + }); +} function evaluateKnowledgeGuardedManifestCompletion(steps) { if (steps.length === 0 || steps.some((step) => step.state === "unverified_external_authority" || step.recovery_state === "unverified_external_authority")) { return { terminal_complete: false, accepted_complete: false }; @@ -2564,6 +2579,37 @@ class GuardedWriteRepo { limits }; } + async lookupTitle(title, binding, limits) { + const rows = await this.client.many(`SELECT * FROM knowledge_items + WHERE title = $1 + AND authority_classification = $2 + AND authority_id = $3 + AND tenant_id = $4 + AND scope = $5 + AND parent_id = $6 + ORDER BY id + LIMIT 2`, [ + title, + binding.authority.classification, + binding.authority.authority_id, + binding.tenant_id, + binding.scope, + binding.parent_id + ]); + if (rows.length > 1) + throw new PrivateTitleLookupAmbiguousError; + const items = rows.map((row) => knowledgePrivateItemProof(rowToItem(row))); + return { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + exact: true, + bounded: true, + item_count: items.length, + binding, + title_digest: knowledgeGuardedContentSha256(title), + items, + limits + }; + } async readback(fullId, binding, limits) { const row = await this.client.get(`SELECT * FROM knowledge_items WHERE id = $1 @@ -2593,6 +2639,13 @@ class GuardedWriteRepo { }; } } + +class PrivateTitleLookupAmbiguousError extends Error { + constructor() { + super("more than one exact title exists in the frozen binding."); + this.name = "PrivateTitleLookupAmbiguousError"; + } +} function knowledgeOpenApi(version) { const noteSchema = { type: "object", @@ -2950,6 +3003,17 @@ function knowledgeOpenApi(version) { } } }, + "/v1/guarded-writes/lookups/title": { + post: { + operationId: "lookupGuardedKnowledgeTitle", + summary: "Bounded exact-title lookup under one frozen FCAME-1 binding", + description: "Returns zero or one metadata-only item proof. More than one exact title is an ambiguity error; " + "item bodies and titles are never returned.", + responses: { + "200": { description: "Exact bounded metadata-only result containing zero or one item proof." }, + "409": { description: "More than one exact title exists under the frozen binding." } + } + } + }, "/v1/guarded-adoptions": { post: { operationId: "executeGuardedKnowledgeAdoption", @@ -3305,6 +3369,67 @@ function validateGuardedEnvelope(value, headerBounds, authority, idempotencyKey) throw new HttpError(400, error instanceof Error ? error.message : "invalid guarded write envelope."); } } +function validatePrivateTitleLookupEnvelope(value, headerBounds, authority) { + try { + if (!value || typeof value !== "object") { + throw new Error("private title lookup envelope is required."); + } + const envelope = value; + assertExactRequestKeys(value, "private title lookup envelope", ["contract", "descriptor", "title", "limits"]); + if (envelope.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT) { + throw new Error("unsupported guarded-write contract."); + } + const descriptor = envelope.descriptor; + if (!descriptor || descriptor.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || descriptor.schema !== KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA) { + throw new Error("invalid private title lookup descriptor schema."); + } + assertExactRequestKeys(descriptor, "private title lookup descriptor", [ + "contract", + "schema", + "operation_id", + "step_id", + "title_digest", + "binding_digest", + "binding", + "expires_at" + ]); + if (typeof descriptor.operation_id !== "string" || descriptor.operation_id.length === 0 || typeof descriptor.step_id !== "string" || descriptor.step_id.length === 0 || typeof envelope.title !== "string" || envelope.title.length === 0 || envelope.title.length > 2048) { + throw new Error("private title lookup operation, step, and bounded title are required."); + } + const descriptorExpiresAt = Date.parse(descriptor.expires_at); + const descriptorNow = Date.now(); + if (!Number.isFinite(descriptorExpiresAt) || descriptorExpiresAt <= descriptorNow || descriptorExpiresAt > descriptorNow + 60 * 60 * 1000) { + throw new Error("private title lookup descriptor is expired or malformed."); + } + assertKnowledgeGuardedBinding(descriptor.binding); + assertConfiguredAuthority(descriptor.binding, authority); + assertKnowledgeGuardedBounds(envelope.limits, "private title lookup bounds"); + if (canonicalKnowledgeGuardedJson(envelope.limits) !== canonicalKnowledgeGuardedJson(headerBounds)) { + throw new Error("private title lookup limits must exactly match the producer bound headers."); + } + const titleDigest = knowledgeGuardedContentSha256(envelope.title); + if (titleDigest !== descriptor.title_digest) { + throw new Error("private title lookup digest does not match the frozen descriptor."); + } + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error("private title lookup binding digest does not match."); + } + if (knowledgeGuardedUtf8Bytes(envelope) > headerBounds.max_bytes) { + throw new Error("private title lookup envelope exceeds the producer byte cap."); + } + return envelope; + } catch (error) { + if (error instanceof HttpError) + throw error; + throw new HttpError(400, error instanceof Error ? error.message : "invalid private title lookup envelope."); + } +} function validateGuardedAdoptionEnvelope(value, headerBounds, authority, idempotencyKey) { try { if (!value || typeof value !== "object") { @@ -3596,6 +3721,31 @@ function createServeHandler(deps) { throw error; } } + if (path === "/v1/guarded-writes/lookups/title" && method === "POST") { + if (!guardedRepo) { + return json({ error: "guarded_authority_unconfigured" }, 503); + } + const startedAt = Date.now(); + const tenantId = req.headers.get("x-knowledge-tenant-id"); + if (!tenantId) + throw new HttpError(400, "x-knowledge-tenant-id is required."); + await authOrThrow(req, ["knowledge:read"], tenantId); + const bounds = guardedBoundsFromHeaders(req); + const raw = await readBoundedJson(req, bounds, startedAt); + const envelope = validatePrivateTitleLookupEnvelope(raw, bounds, guardedRepo.authority); + if (envelope.descriptor.binding.tenant_id !== tenantId) { + throw new HttpError(403, "descriptor tenant does not match the authenticated request tenant."); + } + try { + const result = await guardedRepo.lookupTitle(envelope.title, envelope.descriptor.binding, bounds); + return boundedJson(result, 200, bounds, startedAt); + } catch (error) { + if (error instanceof PrivateTitleLookupAmbiguousError) { + return boundedJson({ error: "private_title_lookup_ambiguous" }, 409, bounds, startedAt); + } + throw error; + } + } const guardedReceiptMatch = path.match(/^\/v1\/guarded-writes\/receipts\/([^/]+)$/); if (guardedReceiptMatch) { if (method !== "GET") diff --git a/bin/knowledge.js b/bin/knowledge.js index 356d1aa..6c8f33c 100755 --- a/bin/knowledge.js +++ b/bin/knowledge.js @@ -577,7 +577,7 @@ VALUES (10, datetime('now')); last_verified_at = COALESCE(last_verified_at, updated_at), confidence = COALESCE(confidence, 0.8) WHERE valid_from IS NULL OR last_verified_at IS NULL OR confidence IS NULL; - `),_.exec(wQ)}function GS(_){let $=_.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("chunks_fts");return Boolean($?.sql&&$.sql.includes("remove_diacritics"))}function dQ(_){if(!e$(_,"chunks_fts"))return!1;return v_(_)<9||!GS(_)}function mQ(_){if(!e$(_,"chunks_fts"))return;if(GS(_)){_.exec("INSERT OR IGNORE INTO schema_versions(version, applied_at) VALUES (9, datetime('now'));");return}_.exec(uQ)}function iQ(_){return v_(_)<10||!e$(_,"knowledge_promotion_candidates")||!e$(_,"durable_knowledge_records")}function lQ(_){_.exec(xQ)}function _E(_){let $=v(_);try{return{schema_version:v_($),sources:F_($,"sources"),source_revisions:F_($,"source_revisions"),chunks:F_($,"chunks"),wiki_pages:F_($,"wiki_pages"),citations:F_($,"citations"),indexes:F_($,"knowledge_indexes"),runs:F_($,"runs"),run_events:F_($,"run_events"),redaction_findings:F_($,"redaction_findings"),audit_events:F_($,"audit_events"),approval_gates:F_($,"approval_gates"),storage_objects:F_($,"storage_objects"),embeddings:F_($,"chunk_embeddings"),vector_entries:F_($,"vector_index_entries"),reindex_queue:F_($,"reindex_queue"),knowledge_machines:F_($,"knowledge_machines"),sync_snapshots:F_($,"knowledge_sync_snapshots"),sync_changes:F_($,"knowledge_sync_changes"),sync_conflicts:F_($,"knowledge_sync_conflicts"),sync_table_clocks:F_($,"knowledge_sync_table_clocks"),sync_imports:F_($,"knowledge_sync_imports"),promotion_candidates:F_($,"knowledge_promotion_candidates"),durable_records:F_($,"durable_knowledge_records")}}finally{$.close()}}import{chmodSync as tQ,existsSync as oQ,mkdirSync as YS,readFileSync as pQ,statSync as eQ,writeFileSync as aQ}from"fs";import{dirname as sQ,join as $E,relative as _T,sep as $T}from"path";import{pathToFileURL as DT}from"url";function f$(_){let $=_.replace(/\\/g,"/").trim();if(!$||$.startsWith("/"))throw Error(`Invalid artifact key: ${_}`);let D=$.split("/").filter(Boolean);if(D.length===0||D.some((U)=>U==="."||U===".."))throw Error(`Invalid artifact key: ${_}`);return D.join("/")}function DE(_,$){let D=_T(_,$);if(D.startsWith("..")||D===".."||D.startsWith(`..${$T}`))throw Error(`Artifact path escapes root: ${$}`)}function gT(_){if(!_)return;let $={};for(let[D,U]of Object.entries(_))if(typeof U==="string")$[D]=U;else if(typeof U==="number"||typeof U==="boolean")$[D]=String(U);return Object.keys($).length>0?$:void 0}class QS{root;type="local";canRead=!0;canWrite=!0;constructor(_){this.root=_;YS(_,{recursive:!0,mode:448})}async put(_){let $=f$(_.key),D=$E(this.root,$);return DE(this.root,D),YS(sQ(D),{recursive:!0,mode:448}),aQ(D,_.body,{mode:384}),tQ(D,384),{key:$,uri:DT(D).href,modified_at:eQ(D).mtime.toISOString()}}async getText(_){let $=f$(_),D=$E(this.root,$);return DE(this.root,D),pQ(D,"utf8")}async exists(_){let $=f$(_),D=$E(this.root,$);return DE(this.root,D),oQ(D)}}class TS{options;type="s3";canRead=!0;canWrite=!0;client;constructor(_){this.options=_;this.client=_.client}async getClient(){if(this.client)return this.client;let[{S3Client:_},{fromIni:$}]=await Promise.all([import("@aws-sdk/client-s3"),import("@aws-sdk/credential-providers")]);return this.client=new _({region:this.options.region,credentials:this.options.profile?$({profile:this.options.profile}):void 0,maxAttempts:this.options.max_attempts}),this.client}objectKey(_){let $=f$(_),D=this.options.prefix?f$(this.options.prefix):"";return D?`${D}/${$}`:$}async put(_){let[{PutObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=f$(_.key),g=this.objectKey(U);return await D.send(new $({Bucket:this.options.bucket,Key:g,Body:_.body,ContentType:_.content_type,Metadata:gT(_.metadata),ServerSideEncryption:this.options.server_side_encryption,SSEKMSKeyId:this.options.kms_key_id})),{key:U,uri:`s3://${this.options.bucket}/${g}`,modified_at:new Date().toISOString()}}async getText(_){let[{GetObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=this.objectKey(_),g=await D.send(new $({Bucket:this.options.bucket,Key:U}));if(!g.Body)return"";return await g.Body.transformToString()}async exists(_){let[{HeadObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=this.objectKey(_);try{return await D.send(new $({Bucket:this.options.bucket,Key:U})),!0}catch(g){let I=g instanceof Error?g.name:"";if(I==="NotFound"||I==="NoSuchKey"||I==="NotFoundError")return!1;throw g}}}function gE(_,$){if(_.storage.type==="s3"){if(!_.storage.s3?.bucket)throw Error("S3 artifact storage requires storage.s3.bucket");return new TS({bucket:_.storage.s3.bucket,prefix:_.storage.s3.prefix,region:_.storage.s3.region,profile:_.storage.s3.profile,max_attempts:_.storage.s3.max_attempts,server_side_encryption:_.storage.s3.server_side_encryption,kms_key_id:_.storage.s3.kms_key_id})}return new QS($.artifactsDir)}import{createHash as JU}from"crypto";import{spawnSync as pZ}from"child_process";import{existsSync as W_,readFileSync as eZ}from"fs";import{hostname as aZ}from"os";import{join as f9,resolve as p9}from"path";import{createHash as Z7,randomUUID as b7}from"crypto";import{createHash as JT,randomUUID as PT}from"crypto";import{existsSync as IE,readdirSync as zT}from"fs";import{join as bS}from"path";import{pathToFileURL as ST}from"url";import{existsSync as UT,mkdirSync as IT,readFileSync as jT,unlinkSync as NT,writeFileSync as ET}from"fs";import{homedir as OT}from"os";import{dirname as AT,join as qS}from"path";var UE="https://knowledge.md";function a$(_){let $=new URL(_);if($.protocol!=="http:"&&$.protocol!=="https:")throw Error("Knowledge API URL must use http or https.");let D=$.pathname.replace(/\/+$/,"");if(D==="/api"||D==="/api/v1")$.pathname="/";else if(D.endsWith("/api/v1"))$.pathname=D.slice(0,-7)||"/";else if(D.endsWith("/api"))$.pathname=D.slice(0,-4)||"/";return $.toString().replace(/\/+$/,"")}function dU(_=process.env){if(_.HASNA_KNOWLEDGE_AUTH_PATH)return _.HASNA_KNOWLEDGE_AUTH_PATH;let $=_.HASNA_KNOWLEDGE_AUTH_DIR??qS(OT(),".hasna","knowledge");return qS($,"auth.json")}function BS(_,$=process.env){return a$($.KNOWLEDGE_API_URL??_?.hosted?.api_url??UE)}function VS(_=process.env){try{let $=dU(_);if(!UT($))return null;let D=JSON.parse(jT($,"utf8"));return typeof D.api_key==="string"&&D.api_key.length>0?D:null}catch{return null}}function KS(_,$=process.env){let D=dU($),U={..._,api_url:_.api_url?a$(_.api_url):void 0,created_at:_.created_at??new Date().toISOString()};return IT(AT(D),{recursive:!0,mode:448}),ET(D,`${JSON.stringify(U,null,2)} + `),_.exec(wQ)}function GS(_){let $=_.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get("chunks_fts");return Boolean($?.sql&&$.sql.includes("remove_diacritics"))}function dQ(_){if(!e$(_,"chunks_fts"))return!1;return v_(_)<9||!GS(_)}function mQ(_){if(!e$(_,"chunks_fts"))return;if(GS(_)){_.exec("INSERT OR IGNORE INTO schema_versions(version, applied_at) VALUES (9, datetime('now'));");return}_.exec(uQ)}function iQ(_){return v_(_)<10||!e$(_,"knowledge_promotion_candidates")||!e$(_,"durable_knowledge_records")}function lQ(_){_.exec(xQ)}function _E(_){let $=v(_);try{return{schema_version:v_($),sources:F_($,"sources"),source_revisions:F_($,"source_revisions"),chunks:F_($,"chunks"),wiki_pages:F_($,"wiki_pages"),citations:F_($,"citations"),indexes:F_($,"knowledge_indexes"),runs:F_($,"runs"),run_events:F_($,"run_events"),redaction_findings:F_($,"redaction_findings"),audit_events:F_($,"audit_events"),approval_gates:F_($,"approval_gates"),storage_objects:F_($,"storage_objects"),embeddings:F_($,"chunk_embeddings"),vector_entries:F_($,"vector_index_entries"),reindex_queue:F_($,"reindex_queue"),knowledge_machines:F_($,"knowledge_machines"),sync_snapshots:F_($,"knowledge_sync_snapshots"),sync_changes:F_($,"knowledge_sync_changes"),sync_conflicts:F_($,"knowledge_sync_conflicts"),sync_table_clocks:F_($,"knowledge_sync_table_clocks"),sync_imports:F_($,"knowledge_sync_imports"),promotion_candidates:F_($,"knowledge_promotion_candidates"),durable_records:F_($,"durable_knowledge_records")}}finally{$.close()}}import{chmodSync as tQ,existsSync as oQ,mkdirSync as YS,readFileSync as pQ,statSync as eQ,writeFileSync as aQ}from"fs";import{dirname as sQ,join as $E,relative as _T,sep as $T}from"path";import{pathToFileURL as DT}from"url";function f$(_){let $=_.replace(/\\/g,"/").trim();if(!$||$.startsWith("/"))throw Error(`Invalid artifact key: ${_}`);let D=$.split("/").filter(Boolean);if(D.length===0||D.some((U)=>U==="."||U===".."))throw Error(`Invalid artifact key: ${_}`);return D.join("/")}function DE(_,$){let D=_T(_,$);if(D.startsWith("..")||D===".."||D.startsWith(`..${$T}`))throw Error(`Artifact path escapes root: ${$}`)}function gT(_){if(!_)return;let $={};for(let[D,U]of Object.entries(_))if(typeof U==="string")$[D]=U;else if(typeof U==="number"||typeof U==="boolean")$[D]=String(U);return Object.keys($).length>0?$:void 0}class QS{root;type="local";canRead=!0;canWrite=!0;constructor(_){this.root=_;YS(_,{recursive:!0,mode:448})}async put(_){let $=f$(_.key),D=$E(this.root,$);return DE(this.root,D),YS(sQ(D),{recursive:!0,mode:448}),aQ(D,_.body,{mode:384}),tQ(D,384),{key:$,uri:DT(D).href,modified_at:eQ(D).mtime.toISOString()}}async getText(_){let $=f$(_),D=$E(this.root,$);return DE(this.root,D),pQ(D,"utf8")}async exists(_){let $=f$(_),D=$E(this.root,$);return DE(this.root,D),oQ(D)}}class TS{options;type="s3";canRead=!0;canWrite=!0;client;constructor(_){this.options=_;this.client=_.client}async getClient(){if(this.client)return this.client;let[{S3Client:_},{fromIni:$}]=await Promise.all([import("@aws-sdk/client-s3"),import("@aws-sdk/credential-providers")]);return this.client=new _({region:this.options.region,credentials:this.options.profile?$({profile:this.options.profile}):void 0,maxAttempts:this.options.max_attempts}),this.client}objectKey(_){let $=f$(_),D=this.options.prefix?f$(this.options.prefix):"";return D?`${D}/${$}`:$}async put(_){let[{PutObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=f$(_.key),g=this.objectKey(U);return await D.send(new $({Bucket:this.options.bucket,Key:g,Body:_.body,ContentType:_.content_type,Metadata:gT(_.metadata),ServerSideEncryption:this.options.server_side_encryption,SSEKMSKeyId:this.options.kms_key_id})),{key:U,uri:`s3://${this.options.bucket}/${g}`,modified_at:new Date().toISOString()}}async getText(_){let[{GetObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=this.objectKey(_),g=await D.send(new $({Bucket:this.options.bucket,Key:U}));if(!g.Body)return"";return await g.Body.transformToString()}async exists(_){let[{HeadObjectCommand:$},D]=await Promise.all([import("@aws-sdk/client-s3"),this.getClient()]),U=this.objectKey(_);try{return await D.send(new $({Bucket:this.options.bucket,Key:U})),!0}catch(g){let I=g instanceof Error?g.name:"";if(I==="NotFound"||I==="NoSuchKey"||I==="NotFoundError")return!1;throw g}}}function gE(_,$){if(_.storage.type==="s3"){if(!_.storage.s3?.bucket)throw Error("S3 artifact storage requires storage.s3.bucket");return new TS({bucket:_.storage.s3.bucket,prefix:_.storage.s3.prefix,region:_.storage.s3.region,profile:_.storage.s3.profile,max_attempts:_.storage.s3.max_attempts,server_side_encryption:_.storage.s3.server_side_encryption,kms_key_id:_.storage.s3.kms_key_id})}return new QS($.artifactsDir)}import{createHash as JU}from"crypto";import{spawnSync as pZ}from"child_process";import{existsSync as W_,readFileSync as eZ}from"fs";import{hostname as aZ}from"os";import{join as fG,resolve as pG}from"path";import{createHash as Z7,randomUUID as b7}from"crypto";import{createHash as JT,randomUUID as PT}from"crypto";import{existsSync as IE,readdirSync as zT}from"fs";import{join as bS}from"path";import{pathToFileURL as ST}from"url";import{existsSync as UT,mkdirSync as IT,readFileSync as jT,unlinkSync as NT,writeFileSync as ET}from"fs";import{homedir as OT}from"os";import{dirname as AT,join as qS}from"path";var UE="https://knowledge.md";function a$(_){let $=new URL(_);if($.protocol!=="http:"&&$.protocol!=="https:")throw Error("Knowledge API URL must use http or https.");let D=$.pathname.replace(/\/+$/,"");if(D==="/api"||D==="/api/v1")$.pathname="/";else if(D.endsWith("/api/v1"))$.pathname=D.slice(0,-7)||"/";else if(D.endsWith("/api"))$.pathname=D.slice(0,-4)||"/";return $.toString().replace(/\/+$/,"")}function dU(_=process.env){if(_.HASNA_KNOWLEDGE_AUTH_PATH)return _.HASNA_KNOWLEDGE_AUTH_PATH;let $=_.HASNA_KNOWLEDGE_AUTH_DIR??qS(OT(),".hasna","knowledge");return qS($,"auth.json")}function BS(_,$=process.env){return a$($.KNOWLEDGE_API_URL??_?.hosted?.api_url??UE)}function VS(_=process.env){try{let $=dU(_);if(!UT($))return null;let D=JSON.parse(jT($,"utf8"));return typeof D.api_key==="string"&&D.api_key.length>0?D:null}catch{return null}}function KS(_,$=process.env){let D=dU($),U={..._,api_url:_.api_url?a$(_.api_url):void 0,created_at:_.created_at??new Date().toISOString()};return IT(AT(D),{recursive:!0,mode:448}),ET(D,`${JSON.stringify(U,null,2)} `,{mode:384}),U}function FS(_=process.env){try{return NT(dU(_)),!0}catch{return!1}}function LT(_=process.env){if(_.KNOWLEDGE_API_KEY)return{apiKey:_.KNOWLEDGE_API_KEY,source:"env"};if(_.HASNA_KNOWLEDGE_API_KEY)return{apiKey:_.HASNA_KNOWLEDGE_API_KEY,source:"env"};let $=VS(_);return $?.api_key?{apiKey:$.api_key,source:"file"}:{apiKey:null,source:"none"}}function MS(_,$=process.env){let D=VS($),U=LT($),g=$.KNOWLEDGE_API_URL?BS(_,$):D?.api_url?a$(D.api_url):BS(_,$);return{authenticated:Boolean(U.apiKey),source:U.source,api_url:g,auth_path:dU($),email:U.source==="file"?D?.email??null:null,org_id:U.source==="file"?D?.org_id??null:null,org_slug:U.source==="file"?D?.org_slug??null:null,user_id:U.source==="file"?D?.user_id??null:null,api_key_present:Boolean(U.apiKey)}}var ZS=2;var HS=[{kind:"schema",prefix:"schemas/",description:"Machine-readable agent schemas and source rules."},{kind:"index",prefix:"indexes/",description:"Small orientation indexes and future shard manifests."},{kind:"log",prefix:"logs/",description:"Append-only JSONL run and wiki-maintenance log partitions."},{kind:"run",prefix:"runs/",description:"Prompt/tool/cost ledgers and generated output records."},{kind:"wiki_page",prefix:"wiki/",description:"Generated cited Markdown pages, not raw source files."},{kind:"export",prefix:"exports/",description:"Portable exports and snapshots of derived knowledge state."}],WT=["cloud.env","knowledge.db.pre-cloud-*.bak","db.json.pre-cloud-*.bak","migration-exports"];function kS(_){let $=[];if(IE(bS(_.home,"cloud.env")))$.push("cloud.env");if(IE(bS(_.home,"migration-exports")))$.push("migration-exports");if(IE(_.home)){for(let D of zT(_.home))if(/^(?:knowledge\.db|db\.json)\.pre-cloud-.+\.bak$/i.test(D))$.push(D)}return $}function J0(_){let $=typeof _==="string"?Buffer.from(_):Buffer.from(_);return{hash:`sha256:${JT("sha256").update($).digest("hex")}`,size_bytes:$.byteLength}}function CS(_){return HS.find((D)=>_.startsWith(D.prefix))?.kind??"artifact"}function mU(_,$,D="global"){let U=jE(_,$),g=_.storage.s3??null,I=g?.prefix?.replace(/^\/+|\/+$/g,"")??"",j=g?`s3://${g.bucket}/${I?`${I}/`:""}`:"",N=P_.s3.prefix.replace(/^\/+|\/+$/g,""),O=`s3://${P_.s3.bucket}/${N}/`,A=_.storage.type==="s3"&&g?.bucket===P_.s3.bucket&&(g.region??null)===P_.s3.region;return{scope:D,mode:_.mode,storage_type:_.storage.type,workspace_home:$.home,local_layout:{app_path:l$,config_path:$.configPath,json_store_path:$.jsonStorePath,knowledge_db_path:$.knowledgeDbPath,directories:{artifacts:$.artifactsDir,cache:$.cacheDir,exports:$.exportsDir,indexes:$.indexesDir,logs:$.logsDir,runs:$.runsDir,schemas:$.schemasDir,wiki:$.wikiDir}},artifact_store:{type:_.storage.type,artifacts_root:_.storage.artifacts_root,uri_prefix:_.storage.type==="s3"?j:ST(`${$.artifactsDir}/`).href,s3:g?{bucket:g.bucket,prefix:I,region:g.region??null,profile:g.profile??null,server_side_encryption:g.server_side_encryption??null,kms_key_configured:Boolean(g.kms_key_id)}:null},canonical_example:{division:P_.division,app_type:P_.app_type,app:P_.app,env:P_.env,active:A,local_path:P_.local_path,s3:{bucket:P_.s3.bucket,region:P_.s3.region,profile:P_.s3.profile,prefix:N,uri_prefix:O,server_side_encryption:P_.s3.server_side_encryption},secrets:{env:P_.secrets.env,aws:P_.secrets.aws,s3:P_.secrets.s3,rds:P_.secrets.rds,future_rds:P_.secrets.future_rds},evidence_doc:P_.evidence_doc},hosted:{enabled:_.mode==="hosted",api_url:a$(_.hosted?.api_url??UE),api_url_env:"KNOWLEDGE_API_URL",api_key_env:"KNOWLEDGE_API_KEY",auth_storage:"~/.hasna/knowledge/auth.json",registry_contract_version:ZS,requires_hosted_account_for_local_use:!1},secret_handling:{workspace_env_files_supported:!1,forbidden_workspace_files:WT,forbidden_workspace_files_present:kS($),runtime_env_keys:["HASNA_KNOWLEDGE_STORAGE_MODE","KNOWLEDGE_STORAGE_MODE","HASNA_KNOWLEDGE_DATABASE_URL","KNOWLEDGE_DATABASE_URL"],secret_ref_authority:"open-secrets",approved_secret_refs:{env:P_.secrets.env,aws:P_.secrets.aws,s3:P_.secrets.s3,rds:P_.secrets.rds},db_url_rotation_decision:{status:"blocked_without_secret_authority",reason:"No live secret mutation authority is available in @hasna/knowledge. Rotate the DB URL only through the approved secret authority if separate evidence proves the URL propagated to backups, exports, sync bundles, reports, or copied artifacts.",authority_required:!0}},source_ownership:{owner:"open-files",preferred_ref:_.sources.preferred_ref,allowed_schemes:_.sources.allowed_schemes,raw_source_bytes_stored_in_open_knowledge:!1,stores:["source refs","source revisions and hashes","citation spans","redacted extracted chunks","embeddings","generated wiki artifacts","indexes","run ledgers"],does_not_store:["raw open-files bytes","S3 object credentials","connector secrets","hosted tenant ownership state"]},private_fleet_boundary:{manifest_authority:"open-machines",source_ref_authority:"open-files",secret_ref_authority:"open-secrets",raw_private_manifest_bytes_stored_in_open_knowledge:!1,accepted_source_ref_schemes:_.sources.allowed_schemes.filter((L)=>["open-files","s3","file"].includes(L)),stores:["source refs for private manifests","redacted setup decisions","runbook summaries","citation spans into approved knowledge sources","machine setup evidence hashes"],does_not_store:["private fleet manifests","machine hostnames","machine serial numbers","sudo passwords","VNC passwords","SSH private keys","GitHub App private keys","secret values"],example_manifest_ref:"open-files://source/private-fleet-manifest/path/machines.json"},generated_artifacts:HS,scalability:{catalog:"knowledge.db tracks sources, revisions, chunks, citations, indexes, runs, and storage_objects.",indexes:"Indexes are cataloged DB rows plus sharded artifacts, not one giant index.md.",logs:"Logs use dated JSONL partitions under logs/yyyy/mm/dd.jsonl.",markdown:"Markdown pages are the readable wiki layer over DB/object-store state."},warnings:U.warnings}}function jE(_,$){let D=[],U=[],g=kS($);for(let I of g)D.push(`Forbidden Knowledge workspace file present: ${I}. Move secrets to open-secrets/runtime env and remove or replace legacy backups/exports with redacted owner-only artifacts.`);if(!$.home.endsWith(l$))U.push(`Workspace home does not end with ${l$}: ${$.home}`);if(_.storage.type==="s3"){if(!_.storage.s3?.bucket)D.push("storage.s3.bucket is required when storage.type is s3.");if(!_.storage.s3?.prefix)U.push("storage.s3.prefix is empty; generated knowledge artifacts will be written at the bucket root.");if(_.mode==="local")U.push("storage.type is s3 while mode is local; this is valid for BYO S3, but hosted wrappers should set mode to hosted.")}if(_.storage.type==="local"&&_.storage.s3)U.push("storage.s3 is configured but ignored while storage.type is local.");if(_.sources.preferred_ref!=="open-files")U.push("sources.preferred_ref should stay open-files for durable company knowledge.");if(!_.sources.allowed_schemes.includes("open-files"))D.push("sources.allowed_schemes must include open-files.");if(_.mode==="hosted"&&_.hosted?.api_url)try{a$(_.hosted.api_url)}catch{D.push("hosted.api_url must be an http(s) URL when mode is hosted.")}return{ok:D.length===0,errors:D,warnings:U}}function s$(_,$,D=new Date){let U=D.toISOString(),g=_.prepare(` INSERT INTO storage_objects ( id, artifact_uri, kind, content_type, hash, size_bytes, metadata_json, created_at, updated_at @@ -1019,13 +1019,13 @@ ${JSON.stringify(_.evidence,null,2)}`].join(` WHERE v.chunk_id = reindex_queue.target_id AND v.provider = ? AND v.model = ? - )`,["completed",D,"embedding","pending",g.provider,g.model]).changes}finally{I.close()}}async function _9(_){h(_.dbPath);let $=(_.now??new Date).toISOString(),D=`run_${eR()}`,U=_.full?iM(_.dbPath):{embeddings:0,vectorEntries:0},g=I3({..._,reason:_.full?"full_embedding_rebuild":"missing_embedding"}),I=v(_.dbPath);try{I.run(`INSERT INTO runs (id, type, prompt, status, provider, model, metadata_json, created_at, updated_at) + )`,["completed",D,"embedding","pending",g.provider,g.model]).changes}finally{I.close()}}async function _G(_){h(_.dbPath);let $=(_.now??new Date).toISOString(),D=`run_${eR()}`,U=_.full?iM(_.dbPath):{embeddings:0,vectorEntries:0},g=I3({..._,reason:_.full?"full_embedding_rebuild":"missing_embedding"}),I=v(_.dbPath);try{I.run(`INSERT INTO runs (id, type, prompt, status, provider, model, metadata_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[D,"embedding-refresh",_.full?"full":"incremental","running","local",I4(_.modelRef,_.config),JSON.stringify({full:_.full===!0,queued:g}),$,$])}finally{I.close()}let j=await _I({dbPath:_.dbPath,config:_.config,env:_.env,modelRef:_.modelRef,dimensions:_.dimensions,fake:_.fake,limit:_.limit,now:_.now}),N=lM(_.dbPath,_,$),O=v(_.dbPath);try{O.run("UPDATE runs SET status = ?, metadata_json = ?, updated_at = ? WHERE id = ?",["completed",JSON.stringify({full:_.full===!0,queued:g,indexed:j,completed_queue_items:N}),$,D]),O.run(`INSERT INTO run_events (id, run_id, level, event, metadata_json, created_at) - VALUES (?, ?, ?, ?, ?, ?)`,[`evt_${eR()}`,D,"info","embedding_refresh_completed",JSON.stringify({queued:g,indexed:j,completed_queue_items:N}),$])}finally{O.close()}return{run_id:D,full:_.full===!0,deleted_embeddings:U.embeddings,deleted_vector_entries:U.vectorEntries,queued:g,indexed:j,completed_queue_items:N}}import{createHash as g9}from"crypto";import{existsSync as U9,lstatSync as tM,readdirSync as oM,readFileSync as pM,statSync as eM}from"fs";import{basename as $D,extname as aM,join as sM,relative as _Z,resolve as O3,sep as $Z}from"path";import{pathToFileURL as $9}from"url";var DZ=100,gZ=25,UZ=262144,IZ=5,jZ=new Set([".md",".mdx",".txt",".json",".jsonc",".toml",".yaml",".yml"]),j3=new Set(["CODEWITH.md","AGENTS.md","CLAUDE.md","RULES.md","INSTRUCTIONS.md"]),NZ=new Set([".git","node_modules","dist","build",".codewith-worktrees",".connect",".secrets",".tmp","tmp","auth_profiles","profiles","preserved","backup","backups","cache","logs","runs"]),EZ=/(^|[._-])(secret|secrets|token|tokens|credential|credentials|password|passwd|private[_-]?key|id_rsa)([._-]|$)/i,oj=/(agent|rule|rules|instruction|instructions|global|operating|standard|knowledge)/i;function N3(_){return`sha256:${g9("sha256").update(_).digest("hex")}`}function OZ(_){return`sha256:${g9("sha256").update(_).digest("hex")}`}function OU(_){return _.split($Z).join("/")}function E3(_,$){let D=_Z(_,$);return D?OU(D):$D($)}function n6(_){return jZ.has(aM(_).toLowerCase())}function D9(_){return OU(_).split("/").some(($)=>EZ.test($))}function I9(_,$=220){let D=_.normalize("NFKC").trim().replace(/\s+/g," ");if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-1)).trim()}...`}function j9(_){if(!_)return 0;return _.split(/\r\n|\n|\r/).length}function N9(_){return{source_ref:_.sourceRef,source_path:_.sourcePath,line_start:_.lineCount>0?1:0,line_end:_.lineCount,content_hash:_.contentHash}}function AZ(){return[{base:".",maxDepth:0,spec:{family:"rule_doc",owner:"repository",scope:"global",precedence:{rank:10,label:"root-rule-doc"},tags:["global-rules","rule-doc"],include:(_)=>j3.has(_)}},{base:".codewith",spec:{family:"codewith",owner:"codewith",scope:"global",precedence:{rank:20,label:"codewith"},tags:["global-rules","codewith","agent-instructions"],include:(_)=>{let $=OU(_),D=$D($);if(j3.has(D)||$==="config.toml")return!0;if($.endsWith("/SKILL.md"))return!0;if(/^(rules|instructions|prompts|plans)\//.test($)&&n6($))return!0;return!1}}},{base:".claude",spec:{family:"claude",owner:"claude",scope:"global",precedence:{rank:30,label:"claude-rules"},tags:["global-rules","claude","agent-instructions"],include:(_)=>{let $=OU(_);return $==="CLAUDE.md"||/^rules\//.test($)&&n6($)}}},{base:".codex",spec:{family:"codex",owner:"codex",scope:"global",precedence:{rank:40,label:"codex"},tags:["global-rules","codex","agent-instructions"],include:(_)=>{let $=OU(_),D=$D($);if(j3.has(D)||D==="config.toml")return!0;return/^(rules|instructions|prompts)\//.test($)&&n6($)}}},{base:".opencode",spec:{family:"opencode",owner:"opencode",scope:"global",precedence:{rank:50,label:"opencode"},tags:["global-rules","opencode","agent-instructions"],include:(_)=>oj.test(_)&&n6(_)}},{base:".",maxDepth:0,spec:{family:"opencode",owner:"opencode",scope:"global",precedence:{rank:50,label:"opencode-config"},tags:["global-rules","opencode","config"],include:(_)=>["opencode.json","opencode.jsonc","opencode.toml","opencode.yaml","opencode.yml"].includes(_)}},{base:".hasna/prompts",spec:{family:"prompt",owner:"hasna",scope:"global",precedence:{rank:60,label:"selected-prompts"},tags:["global-rules","prompt"],include:(_)=>oj.test(_)&&n6(_)}},{base:".hasna/plans",spec:{family:"plan",owner:"hasna",scope:"global",precedence:{rank:65,label:"selected-plans"},tags:["global-rules","plan"],include:(_)=>oj.test(_)&&n6(_)}},{base:"docs",spec:{family:"rule_doc",owner:"repository",scope:"global",precedence:{rank:70,label:"rule-docs"},tags:["global-rules","rule-doc"],include:(_)=>oj.test(_)&&n6(_)}}]}function LZ(_,$){let D=new Map;for(let U of AZ()){let g=O3(_,U.base);if(!U9(g))continue;if(eM(g).isFile()){let j=$D(g);if(U.spec.include(j))D.set(g,{...U.spec,absPath:g});continue}E9({basePath:g,depth:0,maxDepth:U.maxDepth??IZ,spec:U.spec,candidates:D,skipped:$})}return[...D.values()].sort((U,g)=>{if(U.precedence.rank!==g.precedence.rank)return U.precedence.rank-g.precedence.rank;return U.absPath.localeCompare(g.absPath)})}function E9(_){let $=_.rootBasePath??_.basePath;if(_.depth>_.maxDepth)return;for(let D of oM(_.basePath,{withFileTypes:!0})){let U=sM(_.basePath,D.name),g=E3($,U);if(D.isSymbolicLink())continue;if(D.isDirectory()){if(NZ.has(D.name))continue;if(D9(g)){_.skipped.push({source_family:_.spec.family,source_path:U,reason:"sensitive_path"});continue}E9({..._,rootBasePath:$,basePath:U,depth:_.depth+1});continue}if(!D.isFile())continue;let I=E3(O3($),U);if(D9(I)){_.skipped.push({source_family:_.spec.family,source_path:U,reason:"sensitive_path"});continue}if(!_.spec.include(I))continue;if(!n6(U))continue;_.candidates.set(U,{..._.spec,absPath:U})}}function JZ(_){if((_.tags??[]).map((U)=>U.toLowerCase()).some((U)=>["rule","rules","agent","instructions","global-rules","global-agent-rules"].includes(U)))return!0;let D=`${_.title} -${_.content.slice(0,500)}`.toLowerCase();return/\b(agent|rule|rules|instruction|instructions|codewith|claude|codex|opencode)\b/.test(D)}function O9(_,$){let D={source_path:_.source_path,source_path_ref:_.source_path_ref,source_ref:_.source_ref,owner:_.owner,scope:_.scope,precedence:_.precedence,source_hash:_.source_hash,content_hash:_.content_hash,discovered_at:_.discovered_at,tags:_.tags,redaction_status:_.redaction_status,citations:_.citations};return{source_ref:_.source_ref,name:_.title,mime:"text/markdown",size:Buffer.byteLength($),hash:_.content_hash,revision:_.content_hash,status:"active",updated_at:_.discovered_at,permissions:{mode:"read_only",allowed_purposes:["knowledge_index","knowledge_answer","agent_context"]},rule_provenance:D,source_family:_.source_family,source_path_ref:_.source_path_ref,owner:_.owner,scope:_.scope,precedence:_.precedence,tags:_.tags,redaction_status:_.redaction_status,legacy_json_id:_.legacy_json_id??null,extracted_text:$}}function PZ(_){let $=tM(_.candidate.absPath),D=_.candidate.absPath,U=E3(_.root,D);if($.size>_.maxBytesPerFile){let J=$9(D).href;return{evidence:{source_family:_.candidate.family,title:$D(D),source_path:D,source_path_ref:U,source_ref:J,owner:_.candidate.owner,scope:_.candidate.scope,precedence:_.candidate.precedence,source_hash:"sha256:skipped-too-large",content_hash:"sha256:skipped-too-large",discovered_at:_.discoveredAt,tags:[..._.candidate.tags,"skipped"],redaction_status:"refused",redactions:[],citations:[],bytes:$.size,line_count:0,importable:!1,skipped_reason:"max_bytes_exceeded",preview:null},text:"",manifest:null}}let g=pM(D),I=g.toString("utf8"),j=u_(I,_.safetyPolicy),O=j.findings.some((J)=>J.severity==="high")?"refused":j.findings.length>0?"redacted":"clean",A=N3(j.text),L=$9(D).href,z=j9(j.text),W={source_family:_.candidate.family,title:$D(D),source_path:D,source_path_ref:U,source_ref:L,owner:_.candidate.owner,scope:_.candidate.scope,precedence:_.candidate.precedence,source_hash:OZ(g),content_hash:A,discovered_at:_.discoveredAt,tags:[..._.candidate.tags],redaction_status:O,redactions:j.findings.map((J)=>({type:J.type,severity:J.severity})),citations:[N9({sourceRef:L,sourcePath:D,lineCount:z,contentHash:A})],bytes:g.byteLength,line_count:z,importable:O!=="refused",skipped_reason:O==="refused"?"secret_refused":null,preview:O==="refused"?null:I9(j.text)};return{evidence:W,text:j.text,manifest:W.importable?O9(W,j.text):null}}function zZ(_){let $=u_(_.item.content,_.safetyPolicy),U=$.findings.some((A)=>A.severity==="high")?"refused":$.findings.length>0?"redacted":"clean",g=`open-files://source/legacy-json/path/${encodeURIComponent(_.item.id)}`,I=N3($.text),j=N3(_.item.content),N=j9($.text),O={source_family:"legacy_json",title:_.item.title,source_path:_.legacyStorePath,source_path_ref:`legacy-json:${_.item.id}`,source_ref:g,owner:"legacy-json",scope:_.scope,precedence:{rank:90,label:"legacy-json-note"},source_hash:j,content_hash:I,discovered_at:_.discoveredAt,tags:[...new Set(["global-rules","legacy-json",..._.item.tags??[]])],redaction_status:U,redactions:$.findings.map((A)=>({type:A.type,severity:A.severity})),citations:[N9({sourceRef:g,sourcePath:_.legacyStorePath,lineCount:N,contentHash:I})],bytes:Buffer.byteLength(_.item.content),line_count:N,importable:U!=="refused",skipped_reason:U==="refused"?"secret_refused":null,preview:U==="refused"?null:I9($.text),legacy_json_id:_.item.id};return{evidence:O,text:$.text,manifest:O.importable?O9(O,$.text):null}}function SZ(_){if(!_.legacyStorePath||!U9(_.legacyStorePath))return 0;let $=new Map(_.records.filter((D)=>D.legacy_json_id&&D.importable).map((D)=>[D.legacy_json_id,D]));if($.size===0)return 0;return v$(_.legacyStorePath,()=>{let D=I0(_.legacyStorePath);if(!D.exists)return 0;let U=0;for(let g of D.items){let I=$.get(g.id);if(!I)continue;let j=g.metadata??{};g.archived=!0,g.metadata={...j,knowledge_rules_import:{status:"deprecated_after_source_backed_promotion",deprecated_at:_.now,source_ref:I.source_ref,source_hash:I.source_hash,content_hash:I.content_hash,data_loss:!1}},g.tags=[...new Set([...g.tags??[],"deprecated:knowledge-rules-import"])],g.updated_at=_.now,U+=1}if(U>0)t$(_.legacyStorePath,{items:D.items});return U})}async function A9(_={}){let $=O3(_.root??process.cwd()),D=_.scope??"global",U=_.owner??"global-agent-rules-standard",g=_.dryRun!==!1,I=(_.now??new Date).toISOString(),j=Math.max(1,Math.min(_.maxItems??DZ,1000)),N=Math.max(1,Math.min(_.limit??gZ,100)),O=Math.max(1024,Math.min(_.maxBytesPerFile??UZ,2097152)),A=[],z=LZ($,A).slice(0,j).map((Z)=>PZ({root:$,candidate:{...Z,owner:Z.owner==="repository"?U:Z.owner,scope:D},discoveredAt:I,maxBytesPerFile:O,safetyPolicy:_.safetyPolicy})),J=(_.includeLegacy===!1||!_.legacyStorePath?{exists:!1,items:[]}:I0(_.legacyStorePath)).items.filter((Z)=>Z.archived!==!0&&JZ(Z)).slice(0,j),P=J.map((Z)=>zZ({item:Z,legacyStorePath:_.legacyStorePath,discoveredAt:I,scope:D,safetyPolicy:_.safetyPolicy})),S=[...z,...P].slice(0,j),X=S.map((Z)=>Z.evidence),R=S.filter((Z)=>Z.manifest).map((Z)=>Z.manifest),V=X.filter((Z)=>Z.redaction_status==="refused").length,Q=X.slice(0,N),T=A.slice(0,N),q=null,K=0;if(!g){if(!_.dbPath)throw Error("rules provenance apply mode requires dbPath.");if(R.length>0)q=await $4({dbPath:_.dbPath,items:R,sourceLabel:"knowledge://rules-provenance/global-agent-rules",readAction:"rules_provenance_import",allowFileSourceRefs:!0,safetyPolicy:_.safetyPolicy,now:_.now,maxItems:j});if(_.deprecateLegacy!==!1)K=SZ({legacyStorePath:_.legacyStorePath,records:X,now:I})}return{ok:V===0||R.length>0||g,workflow:"global-rules-provenance-import",dry_run:g,writes_performed:!g,root:$,scope:D,owner:U,discovered_at:I,max_items:j,evidence_limit:N,records_seen:X.length,records_importable:R.length,records_refused:V,records_skipped:A.length,evidence_truncated:X.length>Q.length,skipped_truncated:A.length>T.length,evidence:Q,skipped:T,import_result:q,legacy:{store_path:_.legacyStorePath??null,candidates:J.length,promoted:P.filter((Z)=>Z.manifest).length,deprecated:K,data_loss:!1},message:g?`Discovered ${X.length} rule source(s); ${R.length} importable, ${V} refused`:`Imported ${q?.items_seen??0} rule source(s); ${K} legacy note(s) deprecated`}}import{createHash as WZ,randomUUID as L9}from"crypto";function XZ(_){return`sha256:${WZ("sha256").update(_).digest("hex")}`}function J9(_){let $=_.trim().split(/\s+/).filter(Boolean).length;return Math.max(1,Math.ceil($*1.25))}function P9(_){return _&&typeof _==="object"&&!Array.isArray(_)?_:{}}function d6(_){return typeof _==="string"&&_.length>0?_:null}function RZ(_){let $=P9(_),D=d6($.url)??d6($.uri)??d6($.sourceUrl);if(!D)return null;return{url:D,title:d6($.title)??d6($.name),snippet:d6($.snippet)??d6($.text)??d6($.description),provider_metadata:$}}function pj(_,$){if(Array.isArray(_)){for(let g of _)pj(g,$);return}let D=RZ(_);if(D)$.set(D.url,D);let U=P9(_);for(let g of["sources","results","citations","annotations","output"])if(U[g])pj(U[g],$)}function GZ(_,$){return Array.from({length:Math.min($,3)},(D,U)=>({url:`https://example.com/knowledge-web-${U+1}`,title:`Fake web source ${U+1}`,snippet:`Deterministic web-search fixture for "${_}"`,provider_metadata:{fake:!0,rank:U+1}}))}async function YZ(_){let{generateText:$}=await import("ai"),{createOpenAI:D}=await import("@ai-sdk/openai"),U=$6(_.config,"openai"),g=D({apiKey:_.env[U.api_key_env],baseURL:U.base_url}),I=g.tools?.webSearch;if(!I)throw Error("OpenAI provider does not expose tools.webSearch.");return $({model:g(_.model),prompt:_.query,tools:{web_search:I({externalWebAccess:!0,searchContextSize:"medium",..._.domains.length>0?{allowedDomains:_.domains}:{}})},toolChoice:{type:"tool",toolName:"web_search"}})}async function QZ(_){let{generateText:$}=await import("ai"),{createAnthropic:D}=await import("@ai-sdk/anthropic"),U=$6(_.config,"anthropic"),g=D({apiKey:_.env[U.api_key_env],baseURL:U.base_url}),I=g.tools?.webSearch_20250305??g.tools?.webSearch;if(!I)throw Error("Anthropic provider does not expose a web search tool.");return $({model:g(_.model),prompt:_.query,tools:{web_search:I({maxUses:_.maxUses,..._.domains.length>0?{allowedDomains:_.domains}:{}})}})}async function TZ(_,$,D){if(!_.fileResults||$.length===0)return 0;let U=$.map((I)=>{let j=[I.title,I.snippet,I.url].filter(Boolean).join(` -`),N=XZ(j);return{source_ref:I.url,name:I.title??I.url,url:I.url,mime:"text/plain",hash:N,revision:N,status:"active",updated_at:D,permissions:{mode:"read_only",allowed_purposes:["knowledge_answer","knowledge_index"]},metadata:{source_ref:I.url,content_source:"provider_web_search",provider_metadata:I.provider_metadata},extracted_text:j}});return(await $4({dbPath:_.dbPath,items:U,sourceLabel:`web-search:${_.query}`,readAction:"provider_web_search_file_results",safetyPolicy:_.safetyPolicy,now:new Date(D)})).sources_upserted}async function z9(_){let $=_.query.trim();if(!$)throw Error("Web search query is required.");let D=_.env??process.env,U=(_.now??new Date).toISOString(),g=Math.max(1,Math.min(_.limit??5,20)),I=Math.max(1,Math.min(_.maxUses??3,10)),j=_.domains??[],N=G$(_.modelRef??(_.provider?`${_.provider}:${$6(_.config,_.provider).default_model}`:"default"),_.config),O=f_(N),A=_.provider??O.provider,L=O.provider===A?O.model:$6(_.config,A).default_model,z=`run_${L9()}`;if(!_.fake&&_.safetyPolicy)P0(_.safetyPolicy);if(!_.fake&&A!=="openai"&&A!=="anthropic")throw Error(`Provider ${A} does not expose native web search yet.`);if(!_.fake)g4(A,_.config,D);h(_.dbPath);let W=v(_.dbPath);try{W.run(`INSERT INTO runs (id, type, prompt, status, provider, model, metadata_json, created_at, updated_at) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[z,"provider-web-search",$,"running",A,L,JSON.stringify({domains:j,max_uses:I,fake:_.fake===!0}),U,U]),X_(W,{event_type:"source_read",action:_.fake?"fake_provider_web_search":"provider_web_search",target_uri:$,decision:"allow",metadata:{provider:A,model:L,domains:j,max_uses:I},created_at:U})}finally{W.close()}let J="",P=[],S={input_tokens:J9($),output_tokens:0,cost_usd:0},X=[];if(_.fake)P=GZ($,g),J=`Fake web search answer for: ${$}`,S.output_tokens=J9(J);else{let V=A==="openai"?await YZ({query:$,model:L,config:_.config,env:D,maxUses:I,domains:j}):await QZ({query:$,model:L,config:_.config,env:D,maxUses:I,domains:j});J=V.text;let Q=new Map;pj(V.sources,Q),pj(V.toolResults,Q),P=Array.from(Q.values()).slice(0,g);let T=U4({provider:A,model:L,usage:V.usage,providerMetadata:V.providerMetadata});S={input_tokens:T.input_tokens,output_tokens:T.output_tokens,cost_usd:T.cost_usd}}let G=await TZ(_,P,U),R=v(_.dbPath);try{R.run("UPDATE runs SET status = ?, metadata_json = ?, updated_at = ? WHERE id = ?",["completed",JSON.stringify({domains:j,max_uses:I,sources:P.length,filed_sources:G,fake:_.fake===!0}),U,z]),R.run(`INSERT INTO run_events (id, run_id, level, event, metadata_json, created_at) - VALUES (?, ?, ?, ?, ?, ?)`,[`evt_${L9()}`,z,"info","provider_web_search_completed",JSON.stringify({sources:P.length,filed_sources:G}),U]),W0(R,{run_id:z,provider:A,model:L,input_tokens:S.input_tokens,output_tokens:S.output_tokens,cost_usd:S.cost_usd,metadata:{web_search:!0,sources:P.length,filed_sources:G},created_at:U})}finally{R.close()}if(P.length===0)X.push("no_web_sources_returned");return{run_id:z,query:$,provider:A,model:L,answer:J,sources:P,filed_sources:G,usage:S,warnings:X}}import{createHash as qZ,randomUUID as BZ}from"crypto";function DD(_,$){return`${_}_${qZ("sha256").update($).digest("hex").slice(0,20)}`}function A3(_){return _.normalize("NFKC").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,80)||"knowledge-page"}function VZ(_){return{year:String(_.getUTCFullYear()),month:String(_.getUTCMonth()+1).padStart(2,"0"),day:String(_.getUTCDate()).padStart(2,"0")}}function KZ(_){let $=_.trim().split(/\s+/).filter(Boolean).length;return Math.max(1,Math.ceil($*1.25))}function S9(_){if(!_)return{};try{let $=JSON.parse(_);return $&&typeof $==="object"&&!Array.isArray($)?$:{}}catch{return{}}}function FZ(_){return Array.from(new Set((_??"").toLowerCase().match(/[\p{L}\p{N}_]+/gu)??[])).slice(0,12)}function W9(_){return _.replace(/[\\%_]/g,($)=>`\\${$}`)}function MZ(_,$){let D=Math.max(1,Math.min($.limit??10,50)),U=$.sourceRefs??[],g=FZ($.query),I=["c.kind = 'source'"],j=[];if(U.length>0){I.push(`(${U.map(()=>"(s.uri = ? OR c.metadata_json LIKE ?)").join(" OR ")})`);for(let N of U)j.push(N,`%${W9(N)}%`)}if(g.length>0){I.push(`(${g.map(()=>"lower(c.text) LIKE ? ESCAPE '\\'").join(" OR ")})`);for(let N of g)j.push(`%${W9(N)}%`)}return j.push(D),_.query(`SELECT + VALUES (?, ?, ?, ?, ?, ?)`,[`evt_${eR()}`,D,"info","embedding_refresh_completed",JSON.stringify({queued:g,indexed:j,completed_queue_items:N}),$])}finally{O.close()}return{run_id:D,full:_.full===!0,deleted_embeddings:U.embeddings,deleted_vector_entries:U.vectorEntries,queued:g,indexed:j,completed_queue_items:N}}import{createHash as gG}from"crypto";import{existsSync as UG,lstatSync as tM,readdirSync as oM,readFileSync as pM,statSync as eM}from"fs";import{basename as $D,extname as aM,join as sM,relative as _Z,resolve as O3,sep as $Z}from"path";import{pathToFileURL as $G}from"url";var DZ=100,gZ=25,UZ=262144,IZ=5,jZ=new Set([".md",".mdx",".txt",".json",".jsonc",".toml",".yaml",".yml"]),j3=new Set(["CODEWITH.md","AGENTS.md","CLAUDE.md","RULES.md","INSTRUCTIONS.md"]),NZ=new Set([".git","node_modules","dist","build",".codewith-worktrees",".connect",".secrets",".tmp","tmp","auth_profiles","profiles","preserved","backup","backups","cache","logs","runs"]),EZ=/(^|[._-])(secret|secrets|token|tokens|credential|credentials|password|passwd|private[_-]?key|id_rsa)([._-]|$)/i,oj=/(agent|rule|rules|instruction|instructions|global|operating|standard|knowledge)/i;function N3(_){return`sha256:${gG("sha256").update(_).digest("hex")}`}function OZ(_){return`sha256:${gG("sha256").update(_).digest("hex")}`}function OU(_){return _.split($Z).join("/")}function E3(_,$){let D=_Z(_,$);return D?OU(D):$D($)}function n6(_){return jZ.has(aM(_).toLowerCase())}function DG(_){return OU(_).split("/").some(($)=>EZ.test($))}function IG(_,$=220){let D=_.normalize("NFKC").trim().replace(/\s+/g," ");if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-1)).trim()}...`}function jG(_){if(!_)return 0;return _.split(/\r\n|\n|\r/).length}function NG(_){return{source_ref:_.sourceRef,source_path:_.sourcePath,line_start:_.lineCount>0?1:0,line_end:_.lineCount,content_hash:_.contentHash}}function AZ(){return[{base:".",maxDepth:0,spec:{family:"rule_doc",owner:"repository",scope:"global",precedence:{rank:10,label:"root-rule-doc"},tags:["global-rules","rule-doc"],include:(_)=>j3.has(_)}},{base:".codewith",spec:{family:"codewith",owner:"codewith",scope:"global",precedence:{rank:20,label:"codewith"},tags:["global-rules","codewith","agent-instructions"],include:(_)=>{let $=OU(_),D=$D($);if(j3.has(D)||$==="config.toml")return!0;if($.endsWith("/SKILL.md"))return!0;if(/^(rules|instructions|prompts|plans)\//.test($)&&n6($))return!0;return!1}}},{base:".claude",spec:{family:"claude",owner:"claude",scope:"global",precedence:{rank:30,label:"claude-rules"},tags:["global-rules","claude","agent-instructions"],include:(_)=>{let $=OU(_);return $==="CLAUDE.md"||/^rules\//.test($)&&n6($)}}},{base:".codex",spec:{family:"codex",owner:"codex",scope:"global",precedence:{rank:40,label:"codex"},tags:["global-rules","codex","agent-instructions"],include:(_)=>{let $=OU(_),D=$D($);if(j3.has(D)||D==="config.toml")return!0;return/^(rules|instructions|prompts)\//.test($)&&n6($)}}},{base:".opencode",spec:{family:"opencode",owner:"opencode",scope:"global",precedence:{rank:50,label:"opencode"},tags:["global-rules","opencode","agent-instructions"],include:(_)=>oj.test(_)&&n6(_)}},{base:".",maxDepth:0,spec:{family:"opencode",owner:"opencode",scope:"global",precedence:{rank:50,label:"opencode-config"},tags:["global-rules","opencode","config"],include:(_)=>["opencode.json","opencode.jsonc","opencode.toml","opencode.yaml","opencode.yml"].includes(_)}},{base:".hasna/prompts",spec:{family:"prompt",owner:"hasna",scope:"global",precedence:{rank:60,label:"selected-prompts"},tags:["global-rules","prompt"],include:(_)=>oj.test(_)&&n6(_)}},{base:".hasna/plans",spec:{family:"plan",owner:"hasna",scope:"global",precedence:{rank:65,label:"selected-plans"},tags:["global-rules","plan"],include:(_)=>oj.test(_)&&n6(_)}},{base:"docs",spec:{family:"rule_doc",owner:"repository",scope:"global",precedence:{rank:70,label:"rule-docs"},tags:["global-rules","rule-doc"],include:(_)=>oj.test(_)&&n6(_)}}]}function LZ(_,$){let D=new Map;for(let U of AZ()){let g=O3(_,U.base);if(!UG(g))continue;if(eM(g).isFile()){let j=$D(g);if(U.spec.include(j))D.set(g,{...U.spec,absPath:g});continue}EG({basePath:g,depth:0,maxDepth:U.maxDepth??IZ,spec:U.spec,candidates:D,skipped:$})}return[...D.values()].sort((U,g)=>{if(U.precedence.rank!==g.precedence.rank)return U.precedence.rank-g.precedence.rank;return U.absPath.localeCompare(g.absPath)})}function EG(_){let $=_.rootBasePath??_.basePath;if(_.depth>_.maxDepth)return;for(let D of oM(_.basePath,{withFileTypes:!0})){let U=sM(_.basePath,D.name),g=E3($,U);if(D.isSymbolicLink())continue;if(D.isDirectory()){if(NZ.has(D.name))continue;if(DG(g)){_.skipped.push({source_family:_.spec.family,source_path:U,reason:"sensitive_path"});continue}EG({..._,rootBasePath:$,basePath:U,depth:_.depth+1});continue}if(!D.isFile())continue;let I=E3(O3($),U);if(DG(I)){_.skipped.push({source_family:_.spec.family,source_path:U,reason:"sensitive_path"});continue}if(!_.spec.include(I))continue;if(!n6(U))continue;_.candidates.set(U,{..._.spec,absPath:U})}}function JZ(_){if((_.tags??[]).map((U)=>U.toLowerCase()).some((U)=>["rule","rules","agent","instructions","global-rules","global-agent-rules"].includes(U)))return!0;let D=`${_.title} +${_.content.slice(0,500)}`.toLowerCase();return/\b(agent|rule|rules|instruction|instructions|codewith|claude|codex|opencode)\b/.test(D)}function OG(_,$){let D={source_path:_.source_path,source_path_ref:_.source_path_ref,source_ref:_.source_ref,owner:_.owner,scope:_.scope,precedence:_.precedence,source_hash:_.source_hash,content_hash:_.content_hash,discovered_at:_.discovered_at,tags:_.tags,redaction_status:_.redaction_status,citations:_.citations};return{source_ref:_.source_ref,name:_.title,mime:"text/markdown",size:Buffer.byteLength($),hash:_.content_hash,revision:_.content_hash,status:"active",updated_at:_.discovered_at,permissions:{mode:"read_only",allowed_purposes:["knowledge_index","knowledge_answer","agent_context"]},rule_provenance:D,source_family:_.source_family,source_path_ref:_.source_path_ref,owner:_.owner,scope:_.scope,precedence:_.precedence,tags:_.tags,redaction_status:_.redaction_status,legacy_json_id:_.legacy_json_id??null,extracted_text:$}}function PZ(_){let $=tM(_.candidate.absPath),D=_.candidate.absPath,U=E3(_.root,D);if($.size>_.maxBytesPerFile){let J=$G(D).href;return{evidence:{source_family:_.candidate.family,title:$D(D),source_path:D,source_path_ref:U,source_ref:J,owner:_.candidate.owner,scope:_.candidate.scope,precedence:_.candidate.precedence,source_hash:"sha256:skipped-too-large",content_hash:"sha256:skipped-too-large",discovered_at:_.discoveredAt,tags:[..._.candidate.tags,"skipped"],redaction_status:"refused",redactions:[],citations:[],bytes:$.size,line_count:0,importable:!1,skipped_reason:"max_bytes_exceeded",preview:null},text:"",manifest:null}}let g=pM(D),I=g.toString("utf8"),j=u_(I,_.safetyPolicy),O=j.findings.some((J)=>J.severity==="high")?"refused":j.findings.length>0?"redacted":"clean",A=N3(j.text),L=$G(D).href,z=jG(j.text),W={source_family:_.candidate.family,title:$D(D),source_path:D,source_path_ref:U,source_ref:L,owner:_.candidate.owner,scope:_.candidate.scope,precedence:_.candidate.precedence,source_hash:OZ(g),content_hash:A,discovered_at:_.discoveredAt,tags:[..._.candidate.tags],redaction_status:O,redactions:j.findings.map((J)=>({type:J.type,severity:J.severity})),citations:[NG({sourceRef:L,sourcePath:D,lineCount:z,contentHash:A})],bytes:g.byteLength,line_count:z,importable:O!=="refused",skipped_reason:O==="refused"?"secret_refused":null,preview:O==="refused"?null:IG(j.text)};return{evidence:W,text:j.text,manifest:W.importable?OG(W,j.text):null}}function zZ(_){let $=u_(_.item.content,_.safetyPolicy),U=$.findings.some((A)=>A.severity==="high")?"refused":$.findings.length>0?"redacted":"clean",g=`open-files://source/legacy-json/path/${encodeURIComponent(_.item.id)}`,I=N3($.text),j=N3(_.item.content),N=jG($.text),O={source_family:"legacy_json",title:_.item.title,source_path:_.legacyStorePath,source_path_ref:`legacy-json:${_.item.id}`,source_ref:g,owner:"legacy-json",scope:_.scope,precedence:{rank:90,label:"legacy-json-note"},source_hash:j,content_hash:I,discovered_at:_.discoveredAt,tags:[...new Set(["global-rules","legacy-json",..._.item.tags??[]])],redaction_status:U,redactions:$.findings.map((A)=>({type:A.type,severity:A.severity})),citations:[NG({sourceRef:g,sourcePath:_.legacyStorePath,lineCount:N,contentHash:I})],bytes:Buffer.byteLength(_.item.content),line_count:N,importable:U!=="refused",skipped_reason:U==="refused"?"secret_refused":null,preview:U==="refused"?null:IG($.text),legacy_json_id:_.item.id};return{evidence:O,text:$.text,manifest:O.importable?OG(O,$.text):null}}function SZ(_){if(!_.legacyStorePath||!UG(_.legacyStorePath))return 0;let $=new Map(_.records.filter((D)=>D.legacy_json_id&&D.importable).map((D)=>[D.legacy_json_id,D]));if($.size===0)return 0;return v$(_.legacyStorePath,()=>{let D=I0(_.legacyStorePath);if(!D.exists)return 0;let U=0;for(let g of D.items){let I=$.get(g.id);if(!I)continue;let j=g.metadata??{};g.archived=!0,g.metadata={...j,knowledge_rules_import:{status:"deprecated_after_source_backed_promotion",deprecated_at:_.now,source_ref:I.source_ref,source_hash:I.source_hash,content_hash:I.content_hash,data_loss:!1}},g.tags=[...new Set([...g.tags??[],"deprecated:knowledge-rules-import"])],g.updated_at=_.now,U+=1}if(U>0)t$(_.legacyStorePath,{items:D.items});return U})}async function AG(_={}){let $=O3(_.root??process.cwd()),D=_.scope??"global",U=_.owner??"global-agent-rules-standard",g=_.dryRun!==!1,I=(_.now??new Date).toISOString(),j=Math.max(1,Math.min(_.maxItems??DZ,1000)),N=Math.max(1,Math.min(_.limit??gZ,100)),O=Math.max(1024,Math.min(_.maxBytesPerFile??UZ,2097152)),A=[],z=LZ($,A).slice(0,j).map((Z)=>PZ({root:$,candidate:{...Z,owner:Z.owner==="repository"?U:Z.owner,scope:D},discoveredAt:I,maxBytesPerFile:O,safetyPolicy:_.safetyPolicy})),J=(_.includeLegacy===!1||!_.legacyStorePath?{exists:!1,items:[]}:I0(_.legacyStorePath)).items.filter((Z)=>Z.archived!==!0&&JZ(Z)).slice(0,j),P=J.map((Z)=>zZ({item:Z,legacyStorePath:_.legacyStorePath,discoveredAt:I,scope:D,safetyPolicy:_.safetyPolicy})),S=[...z,...P].slice(0,j),X=S.map((Z)=>Z.evidence),R=S.filter((Z)=>Z.manifest).map((Z)=>Z.manifest),V=X.filter((Z)=>Z.redaction_status==="refused").length,Q=X.slice(0,N),T=A.slice(0,N),q=null,K=0;if(!g){if(!_.dbPath)throw Error("rules provenance apply mode requires dbPath.");if(R.length>0)q=await $4({dbPath:_.dbPath,items:R,sourceLabel:"knowledge://rules-provenance/global-agent-rules",readAction:"rules_provenance_import",allowFileSourceRefs:!0,safetyPolicy:_.safetyPolicy,now:_.now,maxItems:j});if(_.deprecateLegacy!==!1)K=SZ({legacyStorePath:_.legacyStorePath,records:X,now:I})}return{ok:V===0||R.length>0||g,workflow:"global-rules-provenance-import",dry_run:g,writes_performed:!g,root:$,scope:D,owner:U,discovered_at:I,max_items:j,evidence_limit:N,records_seen:X.length,records_importable:R.length,records_refused:V,records_skipped:A.length,evidence_truncated:X.length>Q.length,skipped_truncated:A.length>T.length,evidence:Q,skipped:T,import_result:q,legacy:{store_path:_.legacyStorePath??null,candidates:J.length,promoted:P.filter((Z)=>Z.manifest).length,deprecated:K,data_loss:!1},message:g?`Discovered ${X.length} rule source(s); ${R.length} importable, ${V} refused`:`Imported ${q?.items_seen??0} rule source(s); ${K} legacy note(s) deprecated`}}import{createHash as WZ,randomUUID as LG}from"crypto";function XZ(_){return`sha256:${WZ("sha256").update(_).digest("hex")}`}function JG(_){let $=_.trim().split(/\s+/).filter(Boolean).length;return Math.max(1,Math.ceil($*1.25))}function PG(_){return _&&typeof _==="object"&&!Array.isArray(_)?_:{}}function d6(_){return typeof _==="string"&&_.length>0?_:null}function RZ(_){let $=PG(_),D=d6($.url)??d6($.uri)??d6($.sourceUrl);if(!D)return null;return{url:D,title:d6($.title)??d6($.name),snippet:d6($.snippet)??d6($.text)??d6($.description),provider_metadata:$}}function pj(_,$){if(Array.isArray(_)){for(let g of _)pj(g,$);return}let D=RZ(_);if(D)$.set(D.url,D);let U=PG(_);for(let g of["sources","results","citations","annotations","output"])if(U[g])pj(U[g],$)}function GZ(_,$){return Array.from({length:Math.min($,3)},(D,U)=>({url:`https://example.com/knowledge-web-${U+1}`,title:`Fake web source ${U+1}`,snippet:`Deterministic web-search fixture for "${_}"`,provider_metadata:{fake:!0,rank:U+1}}))}async function YZ(_){let{generateText:$}=await import("ai"),{createOpenAI:D}=await import("@ai-sdk/openai"),U=$6(_.config,"openai"),g=D({apiKey:_.env[U.api_key_env],baseURL:U.base_url}),I=g.tools?.webSearch;if(!I)throw Error("OpenAI provider does not expose tools.webSearch.");return $({model:g(_.model),prompt:_.query,tools:{web_search:I({externalWebAccess:!0,searchContextSize:"medium",..._.domains.length>0?{allowedDomains:_.domains}:{}})},toolChoice:{type:"tool",toolName:"web_search"}})}async function QZ(_){let{generateText:$}=await import("ai"),{createAnthropic:D}=await import("@ai-sdk/anthropic"),U=$6(_.config,"anthropic"),g=D({apiKey:_.env[U.api_key_env],baseURL:U.base_url}),I=g.tools?.webSearch_20250305??g.tools?.webSearch;if(!I)throw Error("Anthropic provider does not expose a web search tool.");return $({model:g(_.model),prompt:_.query,tools:{web_search:I({maxUses:_.maxUses,..._.domains.length>0?{allowedDomains:_.domains}:{}})}})}async function TZ(_,$,D){if(!_.fileResults||$.length===0)return 0;let U=$.map((I)=>{let j=[I.title,I.snippet,I.url].filter(Boolean).join(` +`),N=XZ(j);return{source_ref:I.url,name:I.title??I.url,url:I.url,mime:"text/plain",hash:N,revision:N,status:"active",updated_at:D,permissions:{mode:"read_only",allowed_purposes:["knowledge_answer","knowledge_index"]},metadata:{source_ref:I.url,content_source:"provider_web_search",provider_metadata:I.provider_metadata},extracted_text:j}});return(await $4({dbPath:_.dbPath,items:U,sourceLabel:`web-search:${_.query}`,readAction:"provider_web_search_file_results",safetyPolicy:_.safetyPolicy,now:new Date(D)})).sources_upserted}async function zG(_){let $=_.query.trim();if(!$)throw Error("Web search query is required.");let D=_.env??process.env,U=(_.now??new Date).toISOString(),g=Math.max(1,Math.min(_.limit??5,20)),I=Math.max(1,Math.min(_.maxUses??3,10)),j=_.domains??[],N=G$(_.modelRef??(_.provider?`${_.provider}:${$6(_.config,_.provider).default_model}`:"default"),_.config),O=f_(N),A=_.provider??O.provider,L=O.provider===A?O.model:$6(_.config,A).default_model,z=`run_${LG()}`;if(!_.fake&&_.safetyPolicy)P0(_.safetyPolicy);if(!_.fake&&A!=="openai"&&A!=="anthropic")throw Error(`Provider ${A} does not expose native web search yet.`);if(!_.fake)g4(A,_.config,D);h(_.dbPath);let W=v(_.dbPath);try{W.run(`INSERT INTO runs (id, type, prompt, status, provider, model, metadata_json, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[z,"provider-web-search",$,"running",A,L,JSON.stringify({domains:j,max_uses:I,fake:_.fake===!0}),U,U]),X_(W,{event_type:"source_read",action:_.fake?"fake_provider_web_search":"provider_web_search",target_uri:$,decision:"allow",metadata:{provider:A,model:L,domains:j,max_uses:I},created_at:U})}finally{W.close()}let J="",P=[],S={input_tokens:JG($),output_tokens:0,cost_usd:0},X=[];if(_.fake)P=GZ($,g),J=`Fake web search answer for: ${$}`,S.output_tokens=JG(J);else{let V=A==="openai"?await YZ({query:$,model:L,config:_.config,env:D,maxUses:I,domains:j}):await QZ({query:$,model:L,config:_.config,env:D,maxUses:I,domains:j});J=V.text;let Q=new Map;pj(V.sources,Q),pj(V.toolResults,Q),P=Array.from(Q.values()).slice(0,g);let T=U4({provider:A,model:L,usage:V.usage,providerMetadata:V.providerMetadata});S={input_tokens:T.input_tokens,output_tokens:T.output_tokens,cost_usd:T.cost_usd}}let G=await TZ(_,P,U),R=v(_.dbPath);try{R.run("UPDATE runs SET status = ?, metadata_json = ?, updated_at = ? WHERE id = ?",["completed",JSON.stringify({domains:j,max_uses:I,sources:P.length,filed_sources:G,fake:_.fake===!0}),U,z]),R.run(`INSERT INTO run_events (id, run_id, level, event, metadata_json, created_at) + VALUES (?, ?, ?, ?, ?, ?)`,[`evt_${LG()}`,z,"info","provider_web_search_completed",JSON.stringify({sources:P.length,filed_sources:G}),U]),W0(R,{run_id:z,provider:A,model:L,input_tokens:S.input_tokens,output_tokens:S.output_tokens,cost_usd:S.cost_usd,metadata:{web_search:!0,sources:P.length,filed_sources:G},created_at:U})}finally{R.close()}if(P.length===0)X.push("no_web_sources_returned");return{run_id:z,query:$,provider:A,model:L,answer:J,sources:P,filed_sources:G,usage:S,warnings:X}}import{createHash as qZ,randomUUID as BZ}from"crypto";function DD(_,$){return`${_}_${qZ("sha256").update($).digest("hex").slice(0,20)}`}function A3(_){return _.normalize("NFKC").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,80)||"knowledge-page"}function VZ(_){return{year:String(_.getUTCFullYear()),month:String(_.getUTCMonth()+1).padStart(2,"0"),day:String(_.getUTCDate()).padStart(2,"0")}}function KZ(_){let $=_.trim().split(/\s+/).filter(Boolean).length;return Math.max(1,Math.ceil($*1.25))}function SG(_){if(!_)return{};try{let $=JSON.parse(_);return $&&typeof $==="object"&&!Array.isArray($)?$:{}}catch{return{}}}function FZ(_){return Array.from(new Set((_??"").toLowerCase().match(/[\p{L}\p{N}_]+/gu)??[])).slice(0,12)}function WG(_){return _.replace(/[\\%_]/g,($)=>`\\${$}`)}function MZ(_,$){let D=Math.max(1,Math.min($.limit??10,50)),U=$.sourceRefs??[],g=FZ($.query),I=["c.kind = 'source'"],j=[];if(U.length>0){I.push(`(${U.map(()=>"(s.uri = ? OR c.metadata_json LIKE ?)").join(" OR ")})`);for(let N of U)j.push(N,`%${WG(N)}%`)}if(g.length>0){I.push(`(${g.map(()=>"lower(c.text) LIKE ? ESCAPE '\\'").join(" OR ")})`);for(let N of g)j.push(`%${WG(N)}%`)}return j.push(D),_.query(`SELECT c.id AS chunk_id, c.text, c.start_offset, @@ -1041,9 +1041,9 @@ ${_.content.slice(0,500)}`.toLowerCase();return/\b(agent|rule|rules|instruction| JOIN sources s ON s.id = sr.source_id WHERE ${I.join(" AND ")} ORDER BY c.created_at ASC, c.ordinal ASC - LIMIT ?`).all(...j)}function X9(_,$=420){let D=_.replace(/\s+/g," ").trim();return D.length<=$?D:`${D.slice(0,$-1).trim()}...`}function ZZ(_,$){if(_.title?.trim())return _.title.trim();if(_.query?.trim())return _.query.trim();return $[0]?.source_title??"Compiled Knowledge"}function bZ(_,$,D){let U=$.map((I,j)=>{return`- [${`S${j+1}`}] ${I.source_title??I.source_uri??"Source"} (${I.source_uri??"unknown"}, revision ${I.revision??"unknown"}, hash ${I.hash??"unknown"})`}),g=$.map((I,j)=>{let N=`S${j+1}`;return[`## ${I.source_title??`Source ${j+1}`}`,"",X9(I.text),"",`Citation: [${N}]`].join(` + LIMIT ?`).all(...j)}function XG(_,$=420){let D=_.replace(/\s+/g," ").trim();return D.length<=$?D:`${D.slice(0,$-1).trim()}...`}function ZZ(_,$){if(_.title?.trim())return _.title.trim();if(_.query?.trim())return _.query.trim();return $[0]?.source_title??"Compiled Knowledge"}function bZ(_,$,D){let U=$.map((I,j)=>{return`- [${`S${j+1}`}] ${I.source_title??I.source_uri??"Source"} (${I.source_uri??"unknown"}, revision ${I.revision??"unknown"}, hash ${I.hash??"unknown"})`}),g=$.map((I,j)=>{let N=`S${j+1}`;return[`## ${I.source_title??`Source ${j+1}`}`,"",XG(I.text),"",`Citation: [${N}]`].join(` `)});return[`# ${_}`,"",`Generated at: ${D}`,"","## Sources","",...U,"",...g,""].join(` -`)}async function ej(_,$){let D=await _.put($);return{key:D.key,uri:D.uri,kind:$.key.startsWith("logs/")?"log":"wiki_page",content_type:$.content_type,modified_at:D.modified_at,...J0($.body),metadata:{...$.metadata??{}}}}async function R9(_,$,D){let{year:U,month:g,day:I}=VZ(D),j=`logs/${U}/${g}/${I}.jsonl`,N="";try{N=await _.getText(j)}catch{N=""}return ej(_,{key:j,body:`${N}${JSON.stringify($)} +`)}async function ej(_,$){let D=await _.put($);return{key:D.key,uri:D.uri,kind:$.key.startsWith("logs/")?"log":"wiki_page",content_type:$.content_type,modified_at:D.modified_at,...J0($.body),metadata:{...$.metadata??{}}}}async function RG(_,$,D){let{year:U,month:g,day:I}=VZ(D),j=`logs/${U}/${g}/${I}.jsonl`,N="";try{N=await _.getText(j)}catch{N=""}return ej(_,{key:j,body:`${N}${JSON.stringify($)} `,content_type:"application/x-ndjson",metadata:{provenance:U$({generated_from:String($.event??"wiki_log"),artifact_key:j})}})}function L3(_,$){_.run(`INSERT INTO wiki_pages (id, path, title, artifact_uri, content_hash, status, metadata_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(path) DO UPDATE SET @@ -1053,16 +1053,16 @@ ${_.content.slice(0,500)}`.toLowerCase();return/\b(agent|rule|rules|instruction| status = excluded.status, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at`,[$.pageId,$.path,$.title,$.artifactUri,$.contentHash,"active",JSON.stringify({artifact_key:$.path,provenance:$.provenance}),$.now,$.now]);let D=_.query("SELECT id FROM chunks WHERE wiki_page_id = ?").all($.pageId);for(let g of D)_.run("DELETE FROM chunks_fts WHERE chunk_id = ?",[g.id]);_.run("DELETE FROM chunks WHERE wiki_page_id = ?",[$.pageId]);let U=DD("chk",`${$.pageId}\x00${$.contentHash}`);_.run(`INSERT INTO chunks (id, wiki_page_id, kind, ordinal, text, token_count, start_offset, end_offset, metadata_json, created_at) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[U,$.pageId,"wiki",0,$.body,KZ($.body),0,$.body.length,JSON.stringify({artifact_key:$.path,artifact_uri:$.artifactUri,content_hash:$.contentHash,provenance:$.provenance}),$.now]),_.run("INSERT INTO chunks_fts (chunk_id, text, title, source_uri) VALUES (?, ?, ?, ?)",[U,$.body,$.title,$.artifactUri])}function G9(_,$,D,U){_.run("DELETE FROM citations WHERE wiki_page_id = ?",[$]);for(let g of D)_.run(`INSERT INTO citations (id, wiki_page_id, chunk_id, source_uri, quote, start_offset, end_offset, metadata_json, created_at) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[DD("cit",`${$}\x00${g.source_uri}\x00${g.chunk_id??BZ()}`),$,g.chunk_id,g.source_uri,g.quote,g.start_offset,g.end_offset,JSON.stringify(g.metadata),U]);return D.length}function Y9(_,$){return _.run(`INSERT INTO knowledge_indexes (id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[U,$.pageId,"wiki",0,$.body,KZ($.body),0,$.body.length,JSON.stringify({artifact_key:$.path,artifact_uri:$.artifactUri,content_hash:$.contentHash,provenance:$.provenance}),$.now]),_.run("INSERT INTO chunks_fts (chunk_id, text, title, source_uri) VALUES (?, ?, ?, ?)",[U,$.body,$.title,$.artifactUri])}function GG(_,$,D,U){_.run("DELETE FROM citations WHERE wiki_page_id = ?",[$]);for(let g of D)_.run(`INSERT INTO citations (id, wiki_page_id, chunk_id, source_uri, quote, start_offset, end_offset, metadata_json, created_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[DD("cit",`${$}\x00${g.source_uri}\x00${g.chunk_id??BZ()}`),$,g.chunk_id,g.source_uri,g.quote,g.start_offset,g.end_offset,JSON.stringify(g.metadata),U]);return D.length}function YG(_,$){return _.run(`INSERT INTO knowledge_indexes (id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(kind, name, shard_key) DO UPDATE SET artifact_uri = excluded.artifact_uri, metadata_json = excluded.metadata_json, - updated_at = excluded.updated_at`,[DD("idx",`wiki-topic\x00${$.path}`),"wiki_topic",$.title,$.artifactUri,$.path,JSON.stringify({artifact_key:$.path,content_hash:$.contentHash}),$.now,$.now]),1}function HZ(_){return _.toLowerCase().match(/[a-z0-9][a-z0-9-]{2,}/)?.[0]??"knowledge"}async function Q9(_){let $=_.now??new Date,D=$.toISOString();h(_.dbPath);let U=v(_.dbPath),g;try{g=MZ(U,_)}finally{U.close()}if(g.length===0)throw Error("No source chunks matched wiki compile input.");let I=ZZ(_,g),N=`wiki/generated/${A3(I)}.md`,O=bZ(I,g,D),A=g.map((q)=>{let K=S9(q.metadata_json);return typeof K.source_ref==="string"?K.source_ref:q.source_uri}).filter((q)=>Boolean(q)),L=U$({generated_from:"wiki_compile",artifact_key:N,source_refs:A}),z=await ej(_.store,{key:N,body:O,content_type:"text/markdown",metadata:{generated_from:"wiki_compile"}}),W=DD("wiki",N),J=g.map((q)=>({chunk_id:q.chunk_id,source_uri:q.source_uri??"unknown",quote:X9(q.text,240),start_offset:q.start_offset,end_offset:q.end_offset,metadata:{source_revision_id:q.source_revision_id,revision:q.revision,hash:q.hash,source_ref:S9(q.metadata_json).source_ref??q.source_uri}})),P=HZ(I),S=`wiki/concepts/${A3(P)}.md`,X=[`# ${P}`,"",`Related page: [[${N}]]`,""].join(` -`),G=U$({generated_from:"wiki_compile_concept",artifact_key:S,source_refs:A}),R=await ej(_.store,{key:S,body:X,content_type:"text/markdown",metadata:{generated_from:"wiki_compile_concept"}}),V=DD("wiki",S),Q=await R9(_.store,{ts:D,event:"wiki_compile_completed",page_key:N,source_refs:A,chunks_seen:g.length},$),T=v(_.dbPath);try{s$(T,[z,R,Q],$),L3(T,{pageId:W,path:N,title:I,artifactUri:z.uri,contentHash:z.hash??"",body:O,provenance:L,now:D}),L3(T,{pageId:V,path:S,title:P,artifactUri:R.uri,contentHash:R.hash??"",body:X,provenance:G,now:D}),T.run(`INSERT OR REPLACE INTO wiki_backlinks (from_page_id, to_page_id, label, created_at) - VALUES (?, ?, ?, ?)`,[W,V,"concept",D]);let q=G9(T,W,J,D),K=Y9(T,{title:I,path:N,artifactUri:z.uri,contentHash:z.hash??"",now:D});return{page_id:W,path:N,artifact_uri:z.uri,content_hash:z.hash??"",chunks_seen:g.length,citations_written:q,concept_page_id:V,indexes_updated:K,log_key:Q.key,warnings:[]}}finally{T.close()}}async function T9(_){if(!_.approveWrite)return{approved:!1,durable_writes_performed:!1,page_id:null,path:null,artifact_uri:null,citations_written:0,log_key:null,message:"Dry-run: answer filing requires --approve-write."};let $=_.now??new Date,D=$.toISOString(),U=_.prompt.length>80?`${_.prompt.slice(0,77)}...`:_.prompt,I=`wiki/answers/${A3(U)}.md`,j=_.context.citations,N=[`# ${U}`,"",_.answer,"","## Citations","",...j.map((P,S)=>`- [C${S+1}] ${P.source_ref??P.source_uri??P.artifact_path??P.artifact_uri??"unknown"} ${P.hash?`(hash ${P.hash})`:""}`),""].join(` -`),O=j.map((P)=>P.source_ref??P.source_uri).filter((P)=>Boolean(P)),A=U$({generated_from:"knowledge_answer",artifact_key:I,source_refs:O}),L=await ej(_.store,{key:I,body:N,content_type:"text/markdown",metadata:{generated_from:"knowledge_answer"}}),z=await R9(_.store,{ts:D,event:"wiki_answer_filed",page_key:I,prompt:_.prompt,citations:j.length},$),W=DD("wiki",I),J=v(_.dbPath);try{s$(J,[L,z],$),L3(J,{pageId:W,path:I,title:U,artifactUri:L.uri,contentHash:L.hash??"",body:N,provenance:A,now:D});let P=G9(J,W,j.map((S)=>({chunk_id:S.chunk_id,source_uri:S.source_uri??S.artifact_uri??"unknown",quote:S.quote,start_offset:S.start_offset,end_offset:S.end_offset,metadata:{source_ref:S.source_ref,artifact_path:S.artifact_path,revision:S.revision,hash:S.hash}})),D);return Y9(J,{title:U,path:I,artifactUri:L.uri,contentHash:L.hash??"",now:D}),{approved:!0,durable_writes_performed:!0,page_id:W,path:I,artifact_uri:L.uri,citations_written:P,log_key:z.key,message:`Filed answer to ${I}`}}finally{J.close()}}function y4(_,$){_.push($)}function q9(_){h(_.dbPath);let $=v(_.dbPath),D=[];try{let U=$.query("SELECT COUNT(*) AS n FROM wiki_pages WHERE status = 'active'").get()?.n??0,g=$.query("SELECT COUNT(*) AS n FROM citations").get()?.n??0,I=$.query("SELECT COUNT(*) AS n FROM wiki_backlinks").get()?.n??0,j=$.query(`SELECT wp.id, wp.path + updated_at = excluded.updated_at`,[DD("idx",`wiki-topic\x00${$.path}`),"wiki_topic",$.title,$.artifactUri,$.path,JSON.stringify({artifact_key:$.path,content_hash:$.contentHash}),$.now,$.now]),1}function HZ(_){return _.toLowerCase().match(/[a-z0-9][a-z0-9-]{2,}/)?.[0]??"knowledge"}async function QG(_){let $=_.now??new Date,D=$.toISOString();h(_.dbPath);let U=v(_.dbPath),g;try{g=MZ(U,_)}finally{U.close()}if(g.length===0)throw Error("No source chunks matched wiki compile input.");let I=ZZ(_,g),N=`wiki/generated/${A3(I)}.md`,O=bZ(I,g,D),A=g.map((q)=>{let K=SG(q.metadata_json);return typeof K.source_ref==="string"?K.source_ref:q.source_uri}).filter((q)=>Boolean(q)),L=U$({generated_from:"wiki_compile",artifact_key:N,source_refs:A}),z=await ej(_.store,{key:N,body:O,content_type:"text/markdown",metadata:{generated_from:"wiki_compile"}}),W=DD("wiki",N),J=g.map((q)=>({chunk_id:q.chunk_id,source_uri:q.source_uri??"unknown",quote:XG(q.text,240),start_offset:q.start_offset,end_offset:q.end_offset,metadata:{source_revision_id:q.source_revision_id,revision:q.revision,hash:q.hash,source_ref:SG(q.metadata_json).source_ref??q.source_uri}})),P=HZ(I),S=`wiki/concepts/${A3(P)}.md`,X=[`# ${P}`,"",`Related page: [[${N}]]`,""].join(` +`),G=U$({generated_from:"wiki_compile_concept",artifact_key:S,source_refs:A}),R=await ej(_.store,{key:S,body:X,content_type:"text/markdown",metadata:{generated_from:"wiki_compile_concept"}}),V=DD("wiki",S),Q=await RG(_.store,{ts:D,event:"wiki_compile_completed",page_key:N,source_refs:A,chunks_seen:g.length},$),T=v(_.dbPath);try{s$(T,[z,R,Q],$),L3(T,{pageId:W,path:N,title:I,artifactUri:z.uri,contentHash:z.hash??"",body:O,provenance:L,now:D}),L3(T,{pageId:V,path:S,title:P,artifactUri:R.uri,contentHash:R.hash??"",body:X,provenance:G,now:D}),T.run(`INSERT OR REPLACE INTO wiki_backlinks (from_page_id, to_page_id, label, created_at) + VALUES (?, ?, ?, ?)`,[W,V,"concept",D]);let q=GG(T,W,J,D),K=YG(T,{title:I,path:N,artifactUri:z.uri,contentHash:z.hash??"",now:D});return{page_id:W,path:N,artifact_uri:z.uri,content_hash:z.hash??"",chunks_seen:g.length,citations_written:q,concept_page_id:V,indexes_updated:K,log_key:Q.key,warnings:[]}}finally{T.close()}}async function TG(_){if(!_.approveWrite)return{approved:!1,durable_writes_performed:!1,page_id:null,path:null,artifact_uri:null,citations_written:0,log_key:null,message:"Dry-run: answer filing requires --approve-write."};let $=_.now??new Date,D=$.toISOString(),U=_.prompt.length>80?`${_.prompt.slice(0,77)}...`:_.prompt,I=`wiki/answers/${A3(U)}.md`,j=_.context.citations,N=[`# ${U}`,"",_.answer,"","## Citations","",...j.map((P,S)=>`- [C${S+1}] ${P.source_ref??P.source_uri??P.artifact_path??P.artifact_uri??"unknown"} ${P.hash?`(hash ${P.hash})`:""}`),""].join(` +`),O=j.map((P)=>P.source_ref??P.source_uri).filter((P)=>Boolean(P)),A=U$({generated_from:"knowledge_answer",artifact_key:I,source_refs:O}),L=await ej(_.store,{key:I,body:N,content_type:"text/markdown",metadata:{generated_from:"knowledge_answer"}}),z=await RG(_.store,{ts:D,event:"wiki_answer_filed",page_key:I,prompt:_.prompt,citations:j.length},$),W=DD("wiki",I),J=v(_.dbPath);try{s$(J,[L,z],$),L3(J,{pageId:W,path:I,title:U,artifactUri:L.uri,contentHash:L.hash??"",body:N,provenance:A,now:D});let P=GG(J,W,j.map((S)=>({chunk_id:S.chunk_id,source_uri:S.source_uri??S.artifact_uri??"unknown",quote:S.quote,start_offset:S.start_offset,end_offset:S.end_offset,metadata:{source_ref:S.source_ref,artifact_path:S.artifact_path,revision:S.revision,hash:S.hash}})),D);return YG(J,{title:U,path:I,artifactUri:L.uri,contentHash:L.hash??"",now:D}),{approved:!0,durable_writes_performed:!0,page_id:W,path:I,artifact_uri:L.uri,citations_written:P,log_key:z.key,message:`Filed answer to ${I}`}}finally{J.close()}}function y4(_,$){_.push($)}function qG(_){h(_.dbPath);let $=v(_.dbPath),D=[];try{let U=$.query("SELECT COUNT(*) AS n FROM wiki_pages WHERE status = 'active'").get()?.n??0,g=$.query("SELECT COUNT(*) AS n FROM citations").get()?.n??0,I=$.query("SELECT COUNT(*) AS n FROM wiki_backlinks").get()?.n??0,j=$.query(`SELECT wp.id, wp.path FROM wiki_pages wp LEFT JOIN citations c ON c.wiki_page_id = wp.id WHERE wp.status = 'active' AND wp.path LIKE 'wiki/generated/%' @@ -1134,14 +1134,14 @@ This is a compact orientation index for agents. It is not the full search index. Raw source files are resolved through open-files. This app stores source refs, citations, chunks, generated wiki artifacts, indexes, and run records. -`}function B9(){return`# Wiki +`}function BG(){return`# Wiki Generated durable knowledge pages live here. Pages should be concise, cited, and organized for both humans and agents. -`}async function V9(_,$=new Date){let{year:D,month:U,day:g}=CZ($),I="schemas/v1.md",j="indexes/root.md",N="wiki/README.md",O=`logs/${D}/${U}/${g}.jsonl`,A={ts:$.toISOString(),event:"wiki_layout_initialized",schema_key:"schemas/v1.md",root_index_key:"indexes/root.md",wiki_readme_key:"wiki/README.md"},L=[{key:"schemas/v1.md",body:vZ(),content_type:"text/markdown"},{key:"indexes/root.md",body:fZ(),content_type:"text/markdown"},{key:"wiki/README.md",body:B9(),content_type:"text/markdown"},{key:O,body:`${JSON.stringify(A)} +`}async function VG(_,$=new Date){let{year:D,month:U,day:g}=CZ($),I="schemas/v1.md",j="indexes/root.md",N="wiki/README.md",O=`logs/${D}/${U}/${g}.jsonl`,A={ts:$.toISOString(),event:"wiki_layout_initialized",schema_key:"schemas/v1.md",root_index_key:"indexes/root.md",wiki_readme_key:"wiki/README.md"},L=[{key:"schemas/v1.md",body:vZ(),content_type:"text/markdown"},{key:"indexes/root.md",body:fZ(),content_type:"text/markdown"},{key:"wiki/README.md",body:BG(),content_type:"text/markdown"},{key:O,body:`${JSON.stringify(A)} `,content_type:"application/x-ndjson"}],z=await Promise.all(L.map(async(W)=>{let J=await _.put(W);return{key:J.key,uri:J.uri,kind:CS(W.key),content_type:W.content_type,modified_at:J.modified_at,metadata:{provenance:U$({generated_from:"wiki_layout_init",artifact_key:W.key,citation_required:W.key.startsWith("wiki/")||W.key.startsWith("indexes/")})},...J0(W.body)}}));return{schema_key:"schemas/v1.md",root_index_key:"indexes/root.md",wiki_readme_key:"wiki/README.md",log_key:O,artifacts:z,written:["schemas/v1.md","indexes/root.md","wiki/README.md",O]}}function P3(_){let $=_.metadata?.provenance;if($&&typeof $==="object"&&!Array.isArray($))return $;return U$({generated_from:"wiki_layout_init",artifact_key:_.key})}function wZ(_,$,D,U,g,I){let j=P3(U),N=J3("chk",`${$}\x00${U.hash??U.uri}`),O=_.query("SELECT id FROM chunks WHERE wiki_page_id = ?").all($);for(let A of O)_.run("DELETE FROM chunks_fts WHERE chunk_id = ?",[A.id]);_.run("DELETE FROM chunks WHERE wiki_page_id = ?",[$]),_.run(`INSERT INTO chunks (id, wiki_page_id, kind, ordinal, text, token_count, start_offset, end_offset, metadata_json, created_at) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,$,"wiki",0,g,rZ(g),0,g.length,JSON.stringify({artifact_key:U.key,artifact_uri:U.uri,content_hash:U.hash??null,provenance:j}),I]),_.run("INSERT INTO chunks_fts (chunk_id, text, title, source_uri) VALUES (?, ?, ?, ?)",[N,g,D,U.uri])}function K9(_,$,D=new Date){let U=D.toISOString(),g=$.find((j)=>j.key.endsWith("indexes/root.md")),I=$.find((j)=>j.key.endsWith("wiki/README.md"));if(g)_.run(`INSERT INTO knowledge_indexes (id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,$,"wiki",0,g,rZ(g),0,g.length,JSON.stringify({artifact_key:U.key,artifact_uri:U.uri,content_hash:U.hash??null,provenance:j}),I]),_.run("INSERT INTO chunks_fts (chunk_id, text, title, source_uri) VALUES (?, ?, ?, ?)",[N,g,D,U.uri])}function KG(_,$,D=new Date){let U=D.toISOString(),g=$.find((j)=>j.key.endsWith("indexes/root.md")),I=$.find((j)=>j.key.endsWith("wiki/README.md"));if(g)_.run(`INSERT INTO knowledge_indexes (id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(kind, name, shard_key) DO UPDATE SET artifact_uri = excluded.artifact_uri, @@ -1154,13 +1154,13 @@ Pages should be concise, cited, and organized for both humans and agents. content_hash = excluded.content_hash, status = excluded.status, metadata_json = excluded.metadata_json, - updated_at = excluded.updated_at`,[j,"wiki/README.md","Wiki",I.uri,I.hash??null,"active",JSON.stringify({artifact_key:I.key,provenance:P3(I)}),U,U]),wZ(_,j,"Wiki",I,B9(),U)}}import{createHash as F9}from"crypto";import{cpSync as Y3,chmodSync as S3,existsSync as K$,lstatSync as k9,mkdirSync as aj,readdirSync as Q3,readFileSync as AU,renameSync as uZ,rmSync as _N,writeFileSync as M9}from"fs";import{dirname as W3,join as L6,relative as xZ}from"path";function X3(_,$=_){if(!K$(_))return[];let D=k9(_);if(D.isFile())return[xZ($,_)||"."];if(!D.isDirectory())return[];return Q3(_).flatMap((U)=>X3(L6(_,U),$)).sort()}function Z9(_,$){if($.length===0)return{sha256:null,bytes:0};let D=F9("sha256"),U=0;for(let g of $){let I=L6(_,g),j=AU(I),N=F9("sha256").update(j).digest("hex");U+=j.byteLength,D.update(g),D.update("\x00"),D.update(N),D.update("\x00")}return{sha256:D.digest("hex"),bytes:U}}function yZ(_){if(!K$(_))return null;let $=JSON.parse(AU(_,"utf8"));return Array.isArray($.items)?$.items.length:null}function hZ(_){if(!K$(_))return{exists:!1,integrity_check:null,table_counts:{}};let $=RS(_);try{let D=$.query("PRAGMA integrity_check").get(),U=D?Object.values(D)[0]??null:null,g=$.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all(),I={};for(let j of g){let N=`"${j.name.replaceAll('"','""')}"`,O=$.query(`SELECT COUNT(*) AS n FROM ${N}`).get();I[j.name]=O?.n??0}return{exists:!0,integrity_check:U,table_counts:I}}finally{$.close()}}function d_(_,$={}){let D=X3(_.home),U=Z9(_.home,D),g=X3(_.artifactsDir),I=Z9(_.artifactsDir,g),j=K$(_.knowledgeDbPath);return{path:_.home,exists:K$(_.home),file_count:D.length,total_bytes:U.bytes,tree_sha256:U.sha256,json_items:yZ(_.jsonStorePath),sqlite:$.includeSqlite===!1?{exists:j,integrity_check:null,table_counts:{}}:hZ(_.knowledgeDbPath),artifacts:{exists:K$(_.artifactsDir),file_count:g.length,total_bytes:I.bytes,tree_sha256:I.sha256},files:D}}function cZ(_,$){if(!$.exists)return!0;if($.files.filter((U)=>U!=="config.json").length>0)return!1;if(!$.files.includes("config.json"))return!0;try{return JSON.stringify(JSON.parse(AU(_.configPath,"utf8")))===JSON.stringify(MD())}catch{return!1}}function R3(_,$){return _.file_count===$.file_count&&_.total_bytes===$.total_bytes&&_.tree_sha256===$.tree_sha256&&_.json_items===$.json_items&&_.sqlite.integrity_check===$.sqlite.integrity_check&&JSON.stringify(_.sqlite.table_counts)===JSON.stringify($.sqlite.table_counts)&&_.artifacts.file_count===$.artifacts.file_count&&_.artifacts.total_bytes===$.artifacts.total_bytes&&_.artifacts.tree_sha256===$.artifacts.tree_sha256}function sj(_){return _.toISOString().replace(/[-:]/g,"").replace(/\.\d{3}Z$/,"Z")}function G3(_){if(Array.isArray(_))return`[${_.map(G3).join(",")}]`;if(_&&typeof _==="object")return`{${Object.entries(_).sort(([$],[D])=>$.localeCompare(D)).map(([$,D])=>`${JSON.stringify($)}:${G3(D)}`).join(",")}}`;return JSON.stringify(_)}function b9(_){return G3(_)}function z3(_){return typeof _.short_id==="string"&&_.short_id.trim().length>0?_.short_id:null}function h4(_){if(!K$(_))return{items:[]};let $=JSON.parse(AU(_,"utf8"));if(!$||!Array.isArray($.items))throw Error(`Invalid knowledge JSON store shape at ${_}`);return{items:$.items}}function H9(_,$){let D=new Map(_.items.map((L)=>[L.id,L])),U=new Map;for(let L of _.items){let z=U.get(L.id);if(z&&z.item.id!==L.id);U.set(L.id,{item:L,keyKind:"id",source:"current"});let W=z3(L);if(W&&!U.has(W))U.set(W,{item:L,keyKind:"short_id",source:"current"})}let g=[],I=0,j=0,N=0,O=[];for(let L of $.items){let z=D.get(L.id);if(z){if(b9(z)===b9(L))I+=1;else j+=1,g.push({type:"id_conflict",id:L.id,legacy_title:L.title,current_title:z.title});continue}let W=[{key:L.id,keyKind:"id"},...z3(L)?[{key:z3(L),keyKind:"short_id"}]:[]],J=!1;for(let{key:P,keyKind:S}of W){let X=U.get(P);if(!X)continue;if(S==="id"&&X.keyKind==="id")j+=1,g.push({type:"id_conflict",id:P,legacy_id:L.id,current_id:X.item.id,legacy_title:L.title,current_title:X.item.title});else N+=1,g.push({type:"short_id_conflict",id:P,legacy_id:L.id,current_id:X.item.id,legacy_title:L.title,current_title:X.item.title});J=!0}if(J)continue;O.push(L);for(let{key:P,keyKind:S}of W)U.set(P,{item:L,keyKind:S,source:"legacy"})}let A={items:[..._.items,...O]};return{stats:{current_items:_.items.length,legacy_items:$.items.length,duplicate_ids_identical:I,duplicate_ids_conflicting:j,short_id_conflicts:N,stranded_items:O.length,merged_items:g.length===0?O.length:0,expected_total_items:_.items.length+O.length,final_items:null},conflicts:g,mergedStore:A}}function nZ(_,$){let D=[...new Set(_)].sort(),U=(g)=>{if(g>=D.length)return $();return v$(D[g],()=>U(g+1),{createParent:!0})};return U(0)}function C9(_){let $=_.now??new Date,D=_.approveWrite!==!0,U=d_(_.legacy),g=d_(_.current),I={legacy_exists:U.exists,legacy_store_exists:K$(_.legacy.jsonStorePath),current_store_exists:K$(_.current.jsonStorePath),approval_present:_.approveWrite===!0&&Boolean(_.approvedBy),legacy_backup_written:!1,no_conflicts:!1,final_count_matches_expected:!1},j=[];if(!U.exists||!I.legacy_store_exists)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:U,current_before:g,backup_after:null,current_after:g,merge:{current_items:h4(_.current.jsonStorePath).items.length,legacy_items:0,duplicate_ids_identical:0,duplicate_ids_conflicting:0,short_id_conflicts:0,stranded_items:0,merged_items:0,expected_total_items:h4(_.current.jsonStorePath).items.length,final_items:g.json_items},conflicts:[],checks:{...I,no_conflicts:!0,final_count_matches_expected:!0},warnings:j,message:`No legacy knowledge JSON store found at ${_.legacy.jsonStorePath}`};let N=h4(_.current.jsonStorePath),O=h4(_.legacy.jsonStorePath),A=H9(N,O);if(I.no_conflicts=A.conflicts.length===0,A.conflicts.length>0)j.push("merge_conflicts_detected");if(!I.approval_present)j.push("write_approval_required");if(D||!I.approval_present||A.conflicts.length>0)return{ok:A.conflicts.length===0,dry_run:!0,approval_required:!I.approval_present,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:`${_.legacy.home}.merge-backup-${sj($)}`,legacy_before:U,current_before:g,backup_after:null,current_after:null,merge:A.stats,conflicts:A.conflicts,checks:I,warnings:j,message:A.conflicts.length===0?`Dry run: would merge ${A.stats.stranded_items} legacy item(s) into ${_.current.jsonStorePath}`:`Refusing legacy merge with ${A.conflicts.length} conflict(s)`};return nZ([_.current.jsonStorePath,_.legacy.jsonStorePath],()=>{let L=h4(_.current.jsonStorePath),z=h4(_.legacy.jsonStorePath),W=H9(L,z);if(I.no_conflicts=W.conflicts.length===0,W.conflicts.length>0)return{ok:!1,dry_run:!0,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:d_(_.legacy),current_before:d_(_.current),backup_after:null,current_after:null,merge:W.stats,conflicts:W.conflicts,checks:I,warnings:[...j,"merge_conflicts_detected_after_lock"],message:`Refusing legacy merge with ${W.conflicts.length} conflict(s)`};if(W.stats.stranded_items===0)return W.stats.final_items=L.items.length,I.final_count_matches_expected=L.items.length===W.stats.expected_total_items,{ok:I.no_conflicts&&I.final_count_matches_expected,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:d_(_.legacy),current_before:d_(_.current),backup_after:null,current_after:d_(_.current),merge:W.stats,conflicts:[],checks:I,warnings:j,message:`Legacy merge already up to date for ${_.current.jsonStorePath}`};let J=`${_.legacy.home}.merge-backup-${sj($)}`;aj(W3(J),{recursive:!0}),Y3(_.legacy.home,J,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0});let P=g$(J),S=d_(P);if(I.legacy_backup_written=R3(d_(_.legacy),S),!I.legacy_backup_written)throw Error(`Legacy knowledge merge backup verification failed: ${J}`);t$(_.current.jsonStorePath,W.mergedStore);let X=h4(_.current.jsonStorePath);W.stats.final_items=X.items.length,I.final_count_matches_expected=X.items.length===W.stats.expected_total_items;let G=d_(_.current),R=I.legacy_backup_written&&I.no_conflicts&&I.final_count_matches_expected;return{ok:R,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:J,legacy_before:U,current_before:g,backup_after:S,current_after:G,merge:W.stats,conflicts:[],checks:I,warnings:j,message:R?`Merged ${W.stats.merged_items} legacy item(s) into ${_.current.jsonStorePath}`:`Merged legacy knowledge store, but verification failed for ${_.current.jsonStorePath}`}})}function dZ(_){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,_)}function T3(_){return _ instanceof Error&&/\b(EBUSY|EPERM)\b/.test(_.message)}function mZ(_){let $;for(let D=0;D<8;D+=1)try{_N(_,{recursive:!0,force:!1});return}catch(U){if($=U,!T3(U))throw U;dZ(50*(D+1))}throw $}function r9(_){if(!K$(_))return;let $=k9(_);if(S3(_,$.isDirectory()?448:384),!$.isDirectory())return;for(let D of Q3(_))r9(L6(_,D))}function iZ(_){return _==="TOMBSTONE.md"||_==="migration.json"||_==="knowledge.db"||_==="knowledge.db-shm"||_==="knowledge.db-wal"||_==="knowledge.db-journal"}function lZ(_){for(let $ of Q3(_)){if($==="TOMBSTONE.md"||$==="migration.json")continue;try{_N(L6(_,$),{recursive:!0,force:!1})}catch(D){if(!T3(D)||!$.startsWith("knowledge.db"))throw D}}}function tZ(_,$){try{uZ(_,$);return}catch(D){Y3(_,$,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0});try{mZ(_)}catch(U){if(T3(U)){lZ(_);return}throw _N($,{recursive:!0,force:!0}),U}if(D instanceof Error&&D.message.includes("EXDEV"))return}}function oZ(_,$,D){if(!$.exists)return!1;if(!$.files.includes("TOMBSTONE.md")||!$.files.includes("migration.json"))return!1;if($.files.some((U)=>!iZ(U)))return!1;try{let U=JSON.parse(AU(L6(_.home,"migration.json"),"utf8"));return U.new_path===D&&typeof U.backup_path==="string"}catch{return!1}}function v9(_){let $=_.now??new Date,D=_.approveWrite!==!0,U=d_(_.current),g=cZ(_.current,U),I=_.approveWrite===!0&&Boolean(_.approvedBy)&&(!U.exists||g),j=d_(_.legacy,{includeSqlite:!I}),N={legacy_exists:j.exists,current_absent_or_default_scaffold:!U.exists||g,approval_present:_.approveWrite===!0&&Boolean(_.approvedBy),legacy_is_tombstone:!1,backup_matches_legacy:!1,migrated_matches_backup:!1,tombstone_written:!1},O=[];if(!j.exists)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,tombstone_path:null,legacy_before:j,current_before:U,backup_after:null,current_after:null,checks:N,warnings:O,message:`No legacy knowledge workspace found at ${_.legacy.home}`};if(N.legacy_is_tombstone=oZ(_.legacy,j,_.current.home),N.legacy_is_tombstone)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,tombstone_path:L6(_.legacy.home,"TOMBSTONE.md"),legacy_before:j,current_before:U,backup_after:null,current_after:U,checks:{...N,tombstone_written:!0},warnings:O,message:`Legacy knowledge workspace already migrated to ${_.current.home}`};if(!N.current_absent_or_default_scaffold)O.push("current_workspace_contains_data");if(!N.approval_present)O.push("write_approval_required");if(D||!N.current_absent_or_default_scaffold||!N.approval_present)return{ok:N.current_absent_or_default_scaffold,dry_run:!0,approval_required:!0,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:`${_.legacy.home}.backup-${sj($)}`,tombstone_path:L6(_.legacy.home,"TOMBSTONE.md"),legacy_before:j,current_before:U,backup_after:null,current_after:null,checks:N,warnings:O,message:N.current_absent_or_default_scaffold?`Dry run: would migrate ${_.legacy.home} to ${_.current.home}`:`Cannot migrate while ${_.current.home} contains data`};let A=`${_.legacy.home}.backup-${sj($)}`;aj(W3(_.current.home),{recursive:!0}),aj(W3(A),{recursive:!0}),Y3(_.legacy.home,A,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0}),r9(A);let L=g$(A),z=d_(L,{includeSqlite:!1});if(N.backup_matches_legacy=R3(j,z),!N.backup_matches_legacy)throw Error(`Legacy knowledge backup verification failed: ${A}`);if(U.exists&&g)_N(_.current.home,{recursive:!0,force:!0});tZ(_.legacy.home,_.current.home);let W=d_(_.current,{includeSqlite:!1});N.migrated_matches_backup=R3(z,W);let J=d_(L),P=d_(_.current),S={...J,path:_.legacy.home};aj(_.legacy.home,{recursive:!0});let X=L6(_.legacy.home,"TOMBSTONE.md");M9(X,["# Migrated OpenKnowledge Workspace","",`Migrated at: ${$.toISOString()}`,`Approved by: ${_.approvedBy}`,`New path: ${_.current.home}`,`Backup path: ${A}`,"","This directory is a diagnostic tombstone only. OpenKnowledge reads and writes the canonical .hasna/knowledge workspace.",""].join(` -`),{mode:384}),S3(X,384);let G=L6(_.legacy.home,"migration.json");M9(G,`${JSON.stringify({migrated_at:$.toISOString(),approved_by:_.approvedBy,new_path:_.current.home,backup_path:A,legacy_before:S,backup_after:J,current_after:P},null,2)} -`,{mode:384}),S3(G,384),N.tombstone_written=K$(X);let R=N.backup_matches_legacy&&N.migrated_matches_backup&&N.tombstone_written;return{ok:R,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:A,tombstone_path:X,legacy_before:S,current_before:U,backup_after:J,current_after:P,checks:N,warnings:O,message:R?`Migrated legacy knowledge workspace to ${_.current.home}`:`Migrated legacy knowledge workspace, but verification failed for ${_.current.home}`}}function sZ(_){let $=p9(_);if(W_(f9($,"knowledge.db"))||W_(f9($,"config.json")))return g0($);return g0(g$(FN($)).home)}function q3(_){return`${aZ()}:${JU("sha256").update(_.home).digest("hex").slice(0,12)}`}function K3(_){return`'${_.replace(/'/g,"'\\''")}'`}function _b(_){return["knowledge",..._].map(K3).join(" ")}function w9(_,$){return`cd ${K3(_)} && knowledge ${$.map(K3).join(" ")}`}function e9(_){return!_||_==="local"||_==="localhost"}function LU(_,$){return{source:_.source,adapter:_.adapter,project_root:$,project_root_source:_.project_root_source,workspace_root:_.workspace_root,workspace_root_source:_.workspace_root_source,open_files_root:_.open_files_root,open_files_root_source:_.open_files_root_source,trust_status:_.trust_status,auth_status:_.auth_status,current:_.current,primary:_.primary,diagnostics:_.diagnostics,repair_hints:_.repair_hints,evidence:_.evidence,cacheability:_.cacheability,warnings:_.warnings}}function B3(_){return{source:_.source,adapter:_.adapter,target:_.target,route:_.route,target_kind:_.targetKind,confidence:_.confidence,evidence:_.evidence,cacheability:_.cacheability}}function $b(_){try{let $=JSON.parse(_);return Array.isArray($)?$.filter((D)=>typeof D==="string"):[]}catch{return[]}}function PU(_){return _&&typeof _==="object"&&!Array.isArray(_)?_:{}}function k_(_){return typeof _==="string"&&_.length>0?_:null}function Db(_){return typeof _==="number"&&Number.isFinite(_)?_:null}function $N(_){return typeof _==="boolean"?_:null}function gb(_){return Array.isArray(_)?_.filter(($)=>typeof $==="string"):[]}function a9(_,$,D){let U=PU(_),g=k_(U.observed_at)??k_($[`${D}_observed_at`]),I=k_(U.source_authority)??k_($[`${D}_source_authority`]);if(!g||!I)return null;return{observed_at:g,verified_at:k_(U.verified_at),expires_at:k_(U.expires_at)??k_($[`${D}_expires_at`]),ttl_ms:Db(U.ttl_ms),source_authority:I,confidence:k_(U.confidence)??(D==="route"?k_($.route_confidence):null),cacheable:$N(U.cacheable)??$N($[`${D}_cacheable`])??!1,stale:$N(U.stale)??$N($[`${D}_stale`])??!1,reasons:gb(U.reasons)}}function Ub(_,$){return _.machine_id===$||_.hostname===$||_.ssh_target===$||_.tailscale_dns===$||$b(_.tailscale_ips_json).includes($)}function u9(_,$){return fE(_).find((D)=>Ub(D,$))??null}function s9(_){return PU(c4(_.metadata_json).resolver_evidence)}function zU(_){return PU(c4(_.capabilities_json).resolver)}function _G(_){let $=zU(_),D=k_($.route_kind);if(D==="local"||D==="lan"||D==="tailscale"||D==="ssh"||D==="unknown")return D;if(_.tailscale_dns&&_.ssh_target===_.tailscale_dns)return"tailscale";return _.ssh_target?"ssh":"unknown"}function Ib(_){let $=zU(_),D=k_($.route_target_kind);if(D==="local"||D==="lan"||D==="tailscale"||D==="ssh"||D==="unknown")return D;return _G(_)}function jb(_){return k_(zU(_).route_confidence)??"medium"}function x9(_,$,D){let U=s9(_),g=PU(U.route),I=zU(_);return{target:_.ssh_target??_.tailscale_dns??_.hostname??_.machine_id,route:_G(_),targetKind:Ib(_),confidence:jb(_),source:"registry",adapter:D.adapter,evidence:{registry:!0,requested_machine_id:$,machine_id:_.machine_id,recorded_at:_.updated_at,route:g},cacheability:a9(g.cacheability,I,"route")??D.cacheability,warnings:[...new Set([...D.warnings,"registry_route_fallback"])]}}function y9(_,$,D){if(!_.workspace_home)return null;let U=s9(_),g=PU(U.workspace),I=zU(_);return{ok:!0,source:"registry",adapter:D.adapter,requested_machine_id:$,machine_id:_.machine_id,project_id:k_(g.project_id)??D.project_id,repo_name:k_(g.repo_name)??D.repo_name,project_root:_.workspace_home,project_root_source:k_(I.project_root_source)??"registry",workspace_root:k_(g.workspace_root),workspace_root_source:k_(I.workspace_root_source)??"registry",open_files_root:k_(g.open_files_root),open_files_root_source:k_(I.open_files_root_source)??"registry",trust_status:k_(I.trust_status)??"unknown",auth_status:k_(I.auth_status)??"unknown",current:!1,primary:!1,diagnostics:[],repair_hints:[],evidence:{registry:!0,requested_machine_id:$,machine_id:_.machine_id,recorded_at:_.updated_at,workspace:g},cacheability:a9(g.cacheability,I,"workspace")??D.cacheability,warnings:[...new Set([...D.warnings,"registry_workspace_fallback"])]}}function h9(_){if(!_)return null;let $=_.diagnostics.filter((U)=>U.severity!=="ok"),D=_.repair_hints[0];if(!$.length&&!_.warnings.length&&!D)return null;return[$.length?`workspace diagnostics: ${$.map((U)=>`${U.id}=${U.status}`).join(", ")}`:null,_.warnings.length?`warnings: ${_.warnings.join(", ")}`:null,D?`repair: ${D.shell_command}`:null].filter(Boolean).join("; ")}function DN(_){return{id:_.id,reason:_.reason,command:["knowledge",..._.args],shell_command:_b(_.args)}}function gN(_,$){let D=v(_);try{return Number(D.query($).get()?.count??0)}finally{D.close()}}function Nb(_,$){let D=gN(_,"SELECT COUNT(*) AS count FROM sources WHERE uri LIKE 'open-files://%'"),U=gN(_,"SELECT COUNT(*) AS count FROM sources WHERE metadata_json LIKE '%open-files://%' OR metadata_json LIKE '%source_ref%'"),g=gN(_,"SELECT COUNT(*) AS count FROM source_revisions WHERE extracted_text_uri IS NOT NULL"),I=gN(_,["SELECT COUNT(*) AS count FROM sources","WHERE metadata_json LIKE '%raw_bytes%'","OR metadata_json LIKE '%raw_content%'","OR metadata_json LIKE '%content_base64%'","OR metadata_json LIKE '%source_bytes%'"].join(" ")),j=I===0;return{ok:j,source_of_truth:"open-files",configured_root:$?.open_files_root??null,configured_root_source:$?.open_files_root_source??null,source_refs:{open_files:D,metadata_mentions:U},extracted_text_artifacts:g,raw_source_bytes_owned_by:"open-files",raw_payload_sentinel_hits:I,message:j?`${D} open-files source ref(s); raw source bytes remain owned by open-files`:`${I} raw source payload metadata sentinel(s) found`}}var Eb=new Set(["raw","raw_bytes","raw_content","content_base64","source_bytes","source_content","body","body_bytes"]);function F3(_,$=0){if($>8)return!1;if(!_||typeof _!=="object")return!1;if(Array.isArray(_))return _.some((D)=>F3(D,$+1));for(let[D,U]of Object.entries(_)){if(Eb.has(D.toLowerCase()))return!0;if(F3(U,$+1))return!0}return!1}function c4(_){try{let $=JSON.parse(_);return $&&typeof $==="object"&&!Array.isArray($)?$:{}}catch{return{}}}function c9(_,$=20,D=200){if(!Number.isFinite(_)||_<=0)return $;return Math.min(Math.floor(_),D)}function Ob(_,$=220){let D=_??"";return D.length>$?`${D.slice(0,$)}...`:D}function S$(_,$=["metadata_json"]){return _.map((D)=>{let U={...D};for(let g of $){let I=U[g];if(typeof I==="string"){let j=g.endsWith("_json")?g.slice(0,-5):g;U[j]=c4(I),delete U[g]}}return U})}function UN(_){if(typeof _!=="string")return[];try{let $=JSON.parse(_);return Array.isArray($)?$:[]}catch{return[]}}function M3(_){if(typeof _!=="string")return{};return c4(_)}function Ab(_){let $={..._};return $.source_refs=UN($.source_refs_json),$.evidence_refs=UN($.evidence_refs_json),$.requires_approval=$.requires_approval===1||$.requires_approval===!0,$.checks=M3($.checks_json),$.metadata=M3($.metadata_json),delete $.source_refs_json,delete $.evidence_refs_json,delete $.checks_json,delete $.metadata_json,$}function Lb(_){let $={..._};return $.source_refs=UN($.source_refs_json),$.evidence_refs=UN($.evidence_refs_json),$.metadata=M3($.metadata_json),delete $.source_refs_json,delete $.evidence_refs_json,delete $.metadata_json,$}function p_(_,$,D=[]){return _.query($).all(...D)}function Jb(_){if(!W_(_))return{exists:!1,read_error:null,items:[]};try{let $=JSON.parse(eZ(_,"utf8"));if(!$||!Array.isArray($.items))return{exists:!0,read_error:"invalid_store_shape",items:[]};return{exists:!0,read_error:null,items:$.items}}catch($){return{exists:!0,read_error:$ instanceof Error?$.message:String($),items:[]}}}function n9(_){return{id:_.id,short_id:_.short_id??null,title:_.title,content_preview:Ob(_.content),url:_.url??null,tags:_.tags??[],metadata:_.metadata??{},archived:_.archived===!0,created_at:_.created_at,updated_at:_.updated_at}}function d9(){return{schema_version:0,sources:0,source_revisions:0,chunks:0,wiki_pages:0,citations:0,indexes:0,runs:0,run_events:0,redaction_findings:0,audit_events:0,approval_gates:0,storage_objects:0,embeddings:0,vector_entries:0,reindex_queue:0,knowledge_machines:0,sync_snapshots:0,sync_changes:0,sync_conflicts:0,sync_table_clocks:0,sync_imports:0,promotion_candidates:0,durable_records:0}}function $G(_,$,D=!1){return{query:_,limit:$,offset:0,mode:{keyword:!0,catalog:!0,semantic:D},semantic_provider:null,semantic_model:null,semantic_dimensions:null,counts:{keyword_results:0,catalog_results:0,semantic_results:0,merged_results:0},warnings:["knowledge_db_missing"],results:[]}}function Pb(_){return _.normalize("NFKC").trim().replace(/\s+/g," ").toLowerCase()}function zb(_,$,D=!1){let U=$G(_,$,D);return{query:_,normalized_query:Pb(_),created_at:new Date().toISOString(),mode:U.mode,warnings:U.warnings,search_counts:U.counts,results:[],citations:[],excerpts:[],graph:{citations:[],backlinks:[]},notes:{permissions:[],freshness:[]}}}function V3(_,$,D){let U=D??$.jsonStorePath;if(W_(U))return U;if(_==="global"){let g=FD();if(W_(g))return g}return U}function Sb(_){let $=JSON.stringify(_);return Math.max(1,Math.ceil($.length/4))}function Z3(_,$){let D=(_??"").normalize("NFKC").trim().replace(/\s+/g," ");if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-1)).trim()}...`}function m9(_,$,D){let U=u_(Z3(_,D),$);return{text:U.text,redactions:U.findings.length}}function i9(_,$,D){let U=_.now??new Date,g=_.source??"search",I=_.purpose??(g==="loops"||g==="runs"?"proposal":"agent_context"),j=(_.query??_.topic??$.query).normalize("NFKC").trim().replace(/\s+/g," "),N=Math.max(1,Math.min(_.maxItems??_.limit??8,50)),O=Math.max(500,Math.min(_.maxTokens??6000,1e5)),A=0,L=$.citations.slice(0,Math.max(N*2,N)).map((R,V)=>{let Q=m9(R.quote,D,V<3?220:140);A+=Q.redactions;let T=R.source_ref??R.source_uri??R.artifact_path??R.artifact_uri??R.id;return{id:`cite_${JU("sha256").update(`${R.id}\x00${T}`).digest("hex").slice(0,12)}`,kind:R.artifact_uri||R.artifact_path?"artifact":"source",ref:T,source_ref:R.source_ref,source_uri:R.source_uri,artifact_uri:R.artifact_uri,artifact_path:R.artifact_path,run_id:null,run_event_id:null,revision:R.revision,hash:R.hash,chunk_id:R.chunk_id,offsets:{start:R.start_offset,end:R.end_offset},quote_preview:Q.text}}),z=new Map($.citations.map((R,V)=>[R.id,L[V]])),W=$.excerpts.slice(0,Math.max(N*2,N)).map((R)=>{let V=$.results.find((q)=>q.id===R.result_id),Q=R.citation_id?z.get(R.citation_id):void 0,T=m9(R.text,D,520);return A+=T.redactions,{id:`ev_${JU("sha256").update(`${R.kind}\x00${R.result_id}\x00${R.citation_id??""}`).digest("hex").slice(0,14)}`,kind:R.kind,title:Z3(V?.title??Q?.ref??R.kind,100),text_preview:T.text,score:Number(R.score.toFixed(6)),citation_ids:Q?[Q.id]:[],provenance:{source:g,record_ref:`${R.kind}:${R.result_id}`,created_at:$.created_at,updated_at:null,metadata_keys:[]}}}).sort((R,V)=>V.score-R.score||R.id.localeCompare(V.id)).slice(0,N),J=new Set(W.flatMap((R)=>R.citation_ids)),P=L.filter((R)=>J.has(R.id)),S=Array.from(new Set($.warnings)),X=`ctx_${JU("sha256").update([g,I,j,S.join(","),W.map((R)=>R.id).join(",")].join("\x00")).digest("hex").slice(0,20)}`,G={ok:!0,format:"knowledge-agent-context-pack",version:1,created_at:U.toISOString(),source:g,purpose:I,query:j,topic:_.topic??null,since:_.since??null,dry_run:!0,idempotency_key:X,budgets:{max_tokens:O,estimated_tokens:0,max_items:N,items_included:W.length,items_available:$.excerpts.length,items_truncated:Math.max(0,$.excerpts.length-W.length),token_budget_exceeded:!1},safety:{raw_artifact_content_included:!1,durable_writes_performed:!1,redactions:A,reminders:["This pack is read-only and performs no durable writes.","Legacy JSON note evidence is bounded and redacted before inclusion."]},citations:P,evidence:W,duplicate_candidates:[],outline:{title:j?`Knowledge context: ${Z3(j,80)}`:"Knowledge context",bullets:W.length>0?W.slice(0,5).map((R)=>`${R.id}: ${R.title}`):["No matching bounded evidence was found."],evidence_ids:W.slice(0,8).map((R)=>R.id),duplicate_candidate_ids:[],next_actions:["Use evidence_ids and citation_ids in prompts instead of raw excerpts when possible.","Inspect cited refs only if the bounded preview is insufficient.","Use knowledge build/file-answer only with explicit approval for durable writes."]},warnings:S,message:`${W.length} bounded evidence item(s), estimated under ${O} token(s)`};return G.budgets.estimated_tokens=Sb(G),G.budgets.token_budget_exceeded=G.budgets.estimated_tokens>O,G.message=`${G.evidence.length} bounded evidence item(s), estimated ${G.budgets.estimated_tokens}/${O} token(s)`,G}function Wb(){return{schema_version:0,chunks:0,vector_entries:0,missing_embeddings:0,queued:{},stale_revisions:0}}function Xb(){return{total_embeddings:0,total_vector_entries:0,indexes:[]}}function Rb(_){return{ok:!0,scope:_.scope,workspace_home:_.workspaceHome,sqlite_schema_version:0,local_machine_id:_.localMachineId??null,machines:{total:0,rows:[]},snapshots:{total:0,latest:null},changes:{total:0,by_operation:[]},clocks:{total:0,rows:[]},imports:{total:0,latest:null},conflicts:{total:0,by_status:[],open:0},table_counts:{},message:"0 machine(s), 0 open sync conflict(s)"}}function l9(_){let $=_.now??new Date,D=_.source??"search",U=_.purpose??(D==="loops"||D==="runs"?"proposal":"agent_context"),g=(_.query??_.topic??"").normalize("NFKC").trim().replace(/\s+/g," "),I=Math.max(1,Math.min(_.maxItems??_.limit??8,50)),j=Math.max(500,Math.min(_.maxTokens??6000,1e5)),N=`ctx_${JU("sha256").update(["empty",D,U,g,_.topic??"",_.since??""].join("\x00")).digest("hex").slice(0,20)}`;return{ok:!0,format:"knowledge-agent-context-pack",version:1,created_at:$.toISOString(),source:D,purpose:U,query:g,topic:_.topic??null,since:_.since??null,dry_run:!0,idempotency_key:N,budgets:{max_tokens:j,estimated_tokens:0,max_items:I,items_included:0,items_available:0,items_truncated:0,token_budget_exceeded:!1},safety:{raw_artifact_content_included:!1,durable_writes_performed:!1,redactions:0,reminders:["This pack is read-only and performs no durable writes.","No knowledge.db exists for this scope yet."]},citations:[],evidence:[],duplicate_candidates:[],outline:{title:g?`Context for ${g}`:"Knowledge context",bullets:[],evidence_ids:[],duplicate_candidate_ids:[],next_actions:[]},warnings:["knowledge_db_missing"],message:`0 bounded evidence item(s), estimated 0/${j} token(s)`}}function b3(_){let $=_.artifact_store.s3?.prefix?.replace(/^\/+|\/+$/g,"");return $?`${$}/`:null}function Gb(_,$){let D=v(_);try{let U=D.query(`SELECT artifact_uri, kind, hash, size_bytes, metadata_json + updated_at = excluded.updated_at`,[j,"wiki/README.md","Wiki",I.uri,I.hash??null,"active",JSON.stringify({artifact_key:I.key,provenance:P3(I)}),U,U]),wZ(_,j,"Wiki",I,BG(),U)}}import{createHash as FG}from"crypto";import{cpSync as Y3,chmodSync as S3,existsSync as K$,lstatSync as kG,mkdirSync as aj,readdirSync as Q3,readFileSync as AU,renameSync as uZ,rmSync as _N,writeFileSync as MG}from"fs";import{dirname as W3,join as L6,relative as xZ}from"path";function X3(_,$=_){if(!K$(_))return[];let D=kG(_);if(D.isFile())return[xZ($,_)||"."];if(!D.isDirectory())return[];return Q3(_).flatMap((U)=>X3(L6(_,U),$)).sort()}function ZG(_,$){if($.length===0)return{sha256:null,bytes:0};let D=FG("sha256"),U=0;for(let g of $){let I=L6(_,g),j=AU(I),N=FG("sha256").update(j).digest("hex");U+=j.byteLength,D.update(g),D.update("\x00"),D.update(N),D.update("\x00")}return{sha256:D.digest("hex"),bytes:U}}function yZ(_){if(!K$(_))return null;let $=JSON.parse(AU(_,"utf8"));return Array.isArray($.items)?$.items.length:null}function hZ(_){if(!K$(_))return{exists:!1,integrity_check:null,table_counts:{}};let $=RS(_);try{let D=$.query("PRAGMA integrity_check").get(),U=D?Object.values(D)[0]??null:null,g=$.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all(),I={};for(let j of g){let N=`"${j.name.replaceAll('"','""')}"`,O=$.query(`SELECT COUNT(*) AS n FROM ${N}`).get();I[j.name]=O?.n??0}return{exists:!0,integrity_check:U,table_counts:I}}finally{$.close()}}function d_(_,$={}){let D=X3(_.home),U=ZG(_.home,D),g=X3(_.artifactsDir),I=ZG(_.artifactsDir,g),j=K$(_.knowledgeDbPath);return{path:_.home,exists:K$(_.home),file_count:D.length,total_bytes:U.bytes,tree_sha256:U.sha256,json_items:yZ(_.jsonStorePath),sqlite:$.includeSqlite===!1?{exists:j,integrity_check:null,table_counts:{}}:hZ(_.knowledgeDbPath),artifacts:{exists:K$(_.artifactsDir),file_count:g.length,total_bytes:I.bytes,tree_sha256:I.sha256},files:D}}function cZ(_,$){if(!$.exists)return!0;if($.files.filter((U)=>U!=="config.json").length>0)return!1;if(!$.files.includes("config.json"))return!0;try{return JSON.stringify(JSON.parse(AU(_.configPath,"utf8")))===JSON.stringify(MD())}catch{return!1}}function R3(_,$){return _.file_count===$.file_count&&_.total_bytes===$.total_bytes&&_.tree_sha256===$.tree_sha256&&_.json_items===$.json_items&&_.sqlite.integrity_check===$.sqlite.integrity_check&&JSON.stringify(_.sqlite.table_counts)===JSON.stringify($.sqlite.table_counts)&&_.artifacts.file_count===$.artifacts.file_count&&_.artifacts.total_bytes===$.artifacts.total_bytes&&_.artifacts.tree_sha256===$.artifacts.tree_sha256}function sj(_){return _.toISOString().replace(/[-:]/g,"").replace(/\.\d{3}Z$/,"Z")}function G3(_){if(Array.isArray(_))return`[${_.map(G3).join(",")}]`;if(_&&typeof _==="object")return`{${Object.entries(_).sort(([$],[D])=>$.localeCompare(D)).map(([$,D])=>`${JSON.stringify($)}:${G3(D)}`).join(",")}}`;return JSON.stringify(_)}function bG(_){return G3(_)}function z3(_){return typeof _.short_id==="string"&&_.short_id.trim().length>0?_.short_id:null}function h4(_){if(!K$(_))return{items:[]};let $=JSON.parse(AU(_,"utf8"));if(!$||!Array.isArray($.items))throw Error(`Invalid knowledge JSON store shape at ${_}`);return{items:$.items}}function HG(_,$){let D=new Map(_.items.map((L)=>[L.id,L])),U=new Map;for(let L of _.items){let z=U.get(L.id);if(z&&z.item.id!==L.id);U.set(L.id,{item:L,keyKind:"id",source:"current"});let W=z3(L);if(W&&!U.has(W))U.set(W,{item:L,keyKind:"short_id",source:"current"})}let g=[],I=0,j=0,N=0,O=[];for(let L of $.items){let z=D.get(L.id);if(z){if(bG(z)===bG(L))I+=1;else j+=1,g.push({type:"id_conflict",id:L.id,legacy_title:L.title,current_title:z.title});continue}let W=[{key:L.id,keyKind:"id"},...z3(L)?[{key:z3(L),keyKind:"short_id"}]:[]],J=!1;for(let{key:P,keyKind:S}of W){let X=U.get(P);if(!X)continue;if(S==="id"&&X.keyKind==="id")j+=1,g.push({type:"id_conflict",id:P,legacy_id:L.id,current_id:X.item.id,legacy_title:L.title,current_title:X.item.title});else N+=1,g.push({type:"short_id_conflict",id:P,legacy_id:L.id,current_id:X.item.id,legacy_title:L.title,current_title:X.item.title});J=!0}if(J)continue;O.push(L);for(let{key:P,keyKind:S}of W)U.set(P,{item:L,keyKind:S,source:"legacy"})}let A={items:[..._.items,...O]};return{stats:{current_items:_.items.length,legacy_items:$.items.length,duplicate_ids_identical:I,duplicate_ids_conflicting:j,short_id_conflicts:N,stranded_items:O.length,merged_items:g.length===0?O.length:0,expected_total_items:_.items.length+O.length,final_items:null},conflicts:g,mergedStore:A}}function nZ(_,$){let D=[...new Set(_)].sort(),U=(g)=>{if(g>=D.length)return $();return v$(D[g],()=>U(g+1),{createParent:!0})};return U(0)}function CG(_){let $=_.now??new Date,D=_.approveWrite!==!0,U=d_(_.legacy),g=d_(_.current),I={legacy_exists:U.exists,legacy_store_exists:K$(_.legacy.jsonStorePath),current_store_exists:K$(_.current.jsonStorePath),approval_present:_.approveWrite===!0&&Boolean(_.approvedBy),legacy_backup_written:!1,no_conflicts:!1,final_count_matches_expected:!1},j=[];if(!U.exists||!I.legacy_store_exists)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:U,current_before:g,backup_after:null,current_after:g,merge:{current_items:h4(_.current.jsonStorePath).items.length,legacy_items:0,duplicate_ids_identical:0,duplicate_ids_conflicting:0,short_id_conflicts:0,stranded_items:0,merged_items:0,expected_total_items:h4(_.current.jsonStorePath).items.length,final_items:g.json_items},conflicts:[],checks:{...I,no_conflicts:!0,final_count_matches_expected:!0},warnings:j,message:`No legacy knowledge JSON store found at ${_.legacy.jsonStorePath}`};let N=h4(_.current.jsonStorePath),O=h4(_.legacy.jsonStorePath),A=HG(N,O);if(I.no_conflicts=A.conflicts.length===0,A.conflicts.length>0)j.push("merge_conflicts_detected");if(!I.approval_present)j.push("write_approval_required");if(D||!I.approval_present||A.conflicts.length>0)return{ok:A.conflicts.length===0,dry_run:!0,approval_required:!I.approval_present,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:`${_.legacy.home}.merge-backup-${sj($)}`,legacy_before:U,current_before:g,backup_after:null,current_after:null,merge:A.stats,conflicts:A.conflicts,checks:I,warnings:j,message:A.conflicts.length===0?`Dry run: would merge ${A.stats.stranded_items} legacy item(s) into ${_.current.jsonStorePath}`:`Refusing legacy merge with ${A.conflicts.length} conflict(s)`};return nZ([_.current.jsonStorePath,_.legacy.jsonStorePath],()=>{let L=h4(_.current.jsonStorePath),z=h4(_.legacy.jsonStorePath),W=HG(L,z);if(I.no_conflicts=W.conflicts.length===0,W.conflicts.length>0)return{ok:!1,dry_run:!0,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:d_(_.legacy),current_before:d_(_.current),backup_after:null,current_after:null,merge:W.stats,conflicts:W.conflicts,checks:I,warnings:[...j,"merge_conflicts_detected_after_lock"],message:`Refusing legacy merge with ${W.conflicts.length} conflict(s)`};if(W.stats.stranded_items===0)return W.stats.final_items=L.items.length,I.final_count_matches_expected=L.items.length===W.stats.expected_total_items,{ok:I.no_conflicts&&I.final_count_matches_expected,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,legacy_before:d_(_.legacy),current_before:d_(_.current),backup_after:null,current_after:d_(_.current),merge:W.stats,conflicts:[],checks:I,warnings:j,message:`Legacy merge already up to date for ${_.current.jsonStorePath}`};let J=`${_.legacy.home}.merge-backup-${sj($)}`;aj(W3(J),{recursive:!0}),Y3(_.legacy.home,J,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0});let P=g$(J),S=d_(P);if(I.legacy_backup_written=R3(d_(_.legacy),S),!I.legacy_backup_written)throw Error(`Legacy knowledge merge backup verification failed: ${J}`);t$(_.current.jsonStorePath,W.mergedStore);let X=h4(_.current.jsonStorePath);W.stats.final_items=X.items.length,I.final_count_matches_expected=X.items.length===W.stats.expected_total_items;let G=d_(_.current),R=I.legacy_backup_written&&I.no_conflicts&&I.final_count_matches_expected;return{ok:R,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:J,legacy_before:U,current_before:g,backup_after:S,current_after:G,merge:W.stats,conflicts:[],checks:I,warnings:j,message:R?`Merged ${W.stats.merged_items} legacy item(s) into ${_.current.jsonStorePath}`:`Merged legacy knowledge store, but verification failed for ${_.current.jsonStorePath}`}})}function dZ(_){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,_)}function T3(_){return _ instanceof Error&&/\b(EBUSY|EPERM)\b/.test(_.message)}function mZ(_){let $;for(let D=0;D<8;D+=1)try{_N(_,{recursive:!0,force:!1});return}catch(U){if($=U,!T3(U))throw U;dZ(50*(D+1))}throw $}function rG(_){if(!K$(_))return;let $=kG(_);if(S3(_,$.isDirectory()?448:384),!$.isDirectory())return;for(let D of Q3(_))rG(L6(_,D))}function iZ(_){return _==="TOMBSTONE.md"||_==="migration.json"||_==="knowledge.db"||_==="knowledge.db-shm"||_==="knowledge.db-wal"||_==="knowledge.db-journal"}function lZ(_){for(let $ of Q3(_)){if($==="TOMBSTONE.md"||$==="migration.json")continue;try{_N(L6(_,$),{recursive:!0,force:!1})}catch(D){if(!T3(D)||!$.startsWith("knowledge.db"))throw D}}}function tZ(_,$){try{uZ(_,$);return}catch(D){Y3(_,$,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0});try{mZ(_)}catch(U){if(T3(U)){lZ(_);return}throw _N($,{recursive:!0,force:!0}),U}if(D instanceof Error&&D.message.includes("EXDEV"))return}}function oZ(_,$,D){if(!$.exists)return!1;if(!$.files.includes("TOMBSTONE.md")||!$.files.includes("migration.json"))return!1;if($.files.some((U)=>!iZ(U)))return!1;try{let U=JSON.parse(AU(L6(_.home,"migration.json"),"utf8"));return U.new_path===D&&typeof U.backup_path==="string"}catch{return!1}}function vG(_){let $=_.now??new Date,D=_.approveWrite!==!0,U=d_(_.current),g=cZ(_.current,U),I=_.approveWrite===!0&&Boolean(_.approvedBy)&&(!U.exists||g),j=d_(_.legacy,{includeSqlite:!I}),N={legacy_exists:j.exists,current_absent_or_default_scaffold:!U.exists||g,approval_present:_.approveWrite===!0&&Boolean(_.approvedBy),legacy_is_tombstone:!1,backup_matches_legacy:!1,migrated_matches_backup:!1,tombstone_written:!1},O=[];if(!j.exists)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,tombstone_path:null,legacy_before:j,current_before:U,backup_after:null,current_after:null,checks:N,warnings:O,message:`No legacy knowledge workspace found at ${_.legacy.home}`};if(N.legacy_is_tombstone=oZ(_.legacy,j,_.current.home),N.legacy_is_tombstone)return{ok:!0,dry_run:D,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:null,tombstone_path:L6(_.legacy.home,"TOMBSTONE.md"),legacy_before:j,current_before:U,backup_after:null,current_after:U,checks:{...N,tombstone_written:!0},warnings:O,message:`Legacy knowledge workspace already migrated to ${_.current.home}`};if(!N.current_absent_or_default_scaffold)O.push("current_workspace_contains_data");if(!N.approval_present)O.push("write_approval_required");if(D||!N.current_absent_or_default_scaffold||!N.approval_present)return{ok:N.current_absent_or_default_scaffold,dry_run:!0,approval_required:!0,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:`${_.legacy.home}.backup-${sj($)}`,tombstone_path:L6(_.legacy.home,"TOMBSTONE.md"),legacy_before:j,current_before:U,backup_after:null,current_after:null,checks:N,warnings:O,message:N.current_absent_or_default_scaffold?`Dry run: would migrate ${_.legacy.home} to ${_.current.home}`:`Cannot migrate while ${_.current.home} contains data`};let A=`${_.legacy.home}.backup-${sj($)}`;aj(W3(_.current.home),{recursive:!0}),aj(W3(A),{recursive:!0}),Y3(_.legacy.home,A,{recursive:!0,force:!1,errorOnExist:!0,preserveTimestamps:!0}),rG(A);let L=g$(A),z=d_(L,{includeSqlite:!1});if(N.backup_matches_legacy=R3(j,z),!N.backup_matches_legacy)throw Error(`Legacy knowledge backup verification failed: ${A}`);if(U.exists&&g)_N(_.current.home,{recursive:!0,force:!0});tZ(_.legacy.home,_.current.home);let W=d_(_.current,{includeSqlite:!1});N.migrated_matches_backup=R3(z,W);let J=d_(L),P=d_(_.current),S={...J,path:_.legacy.home};aj(_.legacy.home,{recursive:!0});let X=L6(_.legacy.home,"TOMBSTONE.md");MG(X,["# Migrated OpenKnowledge Workspace","",`Migrated at: ${$.toISOString()}`,`Approved by: ${_.approvedBy}`,`New path: ${_.current.home}`,`Backup path: ${A}`,"","This directory is a diagnostic tombstone only. OpenKnowledge reads and writes the canonical .hasna/knowledge workspace.",""].join(` +`),{mode:384}),S3(X,384);let G=L6(_.legacy.home,"migration.json");MG(G,`${JSON.stringify({migrated_at:$.toISOString(),approved_by:_.approvedBy,new_path:_.current.home,backup_path:A,legacy_before:S,backup_after:J,current_after:P},null,2)} +`,{mode:384}),S3(G,384),N.tombstone_written=K$(X);let R=N.backup_matches_legacy&&N.migrated_matches_backup&&N.tombstone_written;return{ok:R,dry_run:!1,approval_required:!1,scope:_.scope,current_home:_.current.home,legacy_home:_.legacy.home,backup_home:A,tombstone_path:X,legacy_before:S,current_before:U,backup_after:J,current_after:P,checks:N,warnings:O,message:R?`Migrated legacy knowledge workspace to ${_.current.home}`:`Migrated legacy knowledge workspace, but verification failed for ${_.current.home}`}}function sZ(_){let $=pG(_);if(W_(fG($,"knowledge.db"))||W_(fG($,"config.json")))return g0($);return g0(g$(FN($)).home)}function q3(_){return`${aZ()}:${JU("sha256").update(_.home).digest("hex").slice(0,12)}`}function K3(_){return`'${_.replace(/'/g,"'\\''")}'`}function _b(_){return["knowledge",..._].map(K3).join(" ")}function wG(_,$){return`cd ${K3(_)} && knowledge ${$.map(K3).join(" ")}`}function eG(_){return!_||_==="local"||_==="localhost"}function LU(_,$){return{source:_.source,adapter:_.adapter,project_root:$,project_root_source:_.project_root_source,workspace_root:_.workspace_root,workspace_root_source:_.workspace_root_source,open_files_root:_.open_files_root,open_files_root_source:_.open_files_root_source,trust_status:_.trust_status,auth_status:_.auth_status,current:_.current,primary:_.primary,diagnostics:_.diagnostics,repair_hints:_.repair_hints,evidence:_.evidence,cacheability:_.cacheability,warnings:_.warnings}}function B3(_){return{source:_.source,adapter:_.adapter,target:_.target,route:_.route,target_kind:_.targetKind,confidence:_.confidence,evidence:_.evidence,cacheability:_.cacheability}}function $b(_){try{let $=JSON.parse(_);return Array.isArray($)?$.filter((D)=>typeof D==="string"):[]}catch{return[]}}function PU(_){return _&&typeof _==="object"&&!Array.isArray(_)?_:{}}function k_(_){return typeof _==="string"&&_.length>0?_:null}function Db(_){return typeof _==="number"&&Number.isFinite(_)?_:null}function $N(_){return typeof _==="boolean"?_:null}function gb(_){return Array.isArray(_)?_.filter(($)=>typeof $==="string"):[]}function aG(_,$,D){let U=PU(_),g=k_(U.observed_at)??k_($[`${D}_observed_at`]),I=k_(U.source_authority)??k_($[`${D}_source_authority`]);if(!g||!I)return null;return{observed_at:g,verified_at:k_(U.verified_at),expires_at:k_(U.expires_at)??k_($[`${D}_expires_at`]),ttl_ms:Db(U.ttl_ms),source_authority:I,confidence:k_(U.confidence)??(D==="route"?k_($.route_confidence):null),cacheable:$N(U.cacheable)??$N($[`${D}_cacheable`])??!1,stale:$N(U.stale)??$N($[`${D}_stale`])??!1,reasons:gb(U.reasons)}}function Ub(_,$){return _.machine_id===$||_.hostname===$||_.ssh_target===$||_.tailscale_dns===$||$b(_.tailscale_ips_json).includes($)}function uG(_,$){return fE(_).find((D)=>Ub(D,$))??null}function sG(_){return PU(c4(_.metadata_json).resolver_evidence)}function zU(_){return PU(c4(_.capabilities_json).resolver)}function _9(_){let $=zU(_),D=k_($.route_kind);if(D==="local"||D==="lan"||D==="tailscale"||D==="ssh"||D==="unknown")return D;if(_.tailscale_dns&&_.ssh_target===_.tailscale_dns)return"tailscale";return _.ssh_target?"ssh":"unknown"}function Ib(_){let $=zU(_),D=k_($.route_target_kind);if(D==="local"||D==="lan"||D==="tailscale"||D==="ssh"||D==="unknown")return D;return _9(_)}function jb(_){return k_(zU(_).route_confidence)??"medium"}function xG(_,$,D){let U=sG(_),g=PU(U.route),I=zU(_);return{target:_.ssh_target??_.tailscale_dns??_.hostname??_.machine_id,route:_9(_),targetKind:Ib(_),confidence:jb(_),source:"registry",adapter:D.adapter,evidence:{registry:!0,requested_machine_id:$,machine_id:_.machine_id,recorded_at:_.updated_at,route:g},cacheability:aG(g.cacheability,I,"route")??D.cacheability,warnings:[...new Set([...D.warnings,"registry_route_fallback"])]}}function yG(_,$,D){if(!_.workspace_home)return null;let U=sG(_),g=PU(U.workspace),I=zU(_);return{ok:!0,source:"registry",adapter:D.adapter,requested_machine_id:$,machine_id:_.machine_id,project_id:k_(g.project_id)??D.project_id,repo_name:k_(g.repo_name)??D.repo_name,project_root:_.workspace_home,project_root_source:k_(I.project_root_source)??"registry",workspace_root:k_(g.workspace_root),workspace_root_source:k_(I.workspace_root_source)??"registry",open_files_root:k_(g.open_files_root),open_files_root_source:k_(I.open_files_root_source)??"registry",trust_status:k_(I.trust_status)??"unknown",auth_status:k_(I.auth_status)??"unknown",current:!1,primary:!1,diagnostics:[],repair_hints:[],evidence:{registry:!0,requested_machine_id:$,machine_id:_.machine_id,recorded_at:_.updated_at,workspace:g},cacheability:aG(g.cacheability,I,"workspace")??D.cacheability,warnings:[...new Set([...D.warnings,"registry_workspace_fallback"])]}}function hG(_){if(!_)return null;let $=_.diagnostics.filter((U)=>U.severity!=="ok"),D=_.repair_hints[0];if(!$.length&&!_.warnings.length&&!D)return null;return[$.length?`workspace diagnostics: ${$.map((U)=>`${U.id}=${U.status}`).join(", ")}`:null,_.warnings.length?`warnings: ${_.warnings.join(", ")}`:null,D?`repair: ${D.shell_command}`:null].filter(Boolean).join("; ")}function DN(_){return{id:_.id,reason:_.reason,command:["knowledge",..._.args],shell_command:_b(_.args)}}function gN(_,$){let D=v(_);try{return Number(D.query($).get()?.count??0)}finally{D.close()}}function Nb(_,$){let D=gN(_,"SELECT COUNT(*) AS count FROM sources WHERE uri LIKE 'open-files://%'"),U=gN(_,"SELECT COUNT(*) AS count FROM sources WHERE metadata_json LIKE '%open-files://%' OR metadata_json LIKE '%source_ref%'"),g=gN(_,"SELECT COUNT(*) AS count FROM source_revisions WHERE extracted_text_uri IS NOT NULL"),I=gN(_,["SELECT COUNT(*) AS count FROM sources","WHERE metadata_json LIKE '%raw_bytes%'","OR metadata_json LIKE '%raw_content%'","OR metadata_json LIKE '%content_base64%'","OR metadata_json LIKE '%source_bytes%'"].join(" ")),j=I===0;return{ok:j,source_of_truth:"open-files",configured_root:$?.open_files_root??null,configured_root_source:$?.open_files_root_source??null,source_refs:{open_files:D,metadata_mentions:U},extracted_text_artifacts:g,raw_source_bytes_owned_by:"open-files",raw_payload_sentinel_hits:I,message:j?`${D} open-files source ref(s); raw source bytes remain owned by open-files`:`${I} raw source payload metadata sentinel(s) found`}}var Eb=new Set(["raw","raw_bytes","raw_content","content_base64","source_bytes","source_content","body","body_bytes"]);function F3(_,$=0){if($>8)return!1;if(!_||typeof _!=="object")return!1;if(Array.isArray(_))return _.some((D)=>F3(D,$+1));for(let[D,U]of Object.entries(_)){if(Eb.has(D.toLowerCase()))return!0;if(F3(U,$+1))return!0}return!1}function c4(_){try{let $=JSON.parse(_);return $&&typeof $==="object"&&!Array.isArray($)?$:{}}catch{return{}}}function cG(_,$=20,D=200){if(!Number.isFinite(_)||_<=0)return $;return Math.min(Math.floor(_),D)}function Ob(_,$=220){let D=_??"";return D.length>$?`${D.slice(0,$)}...`:D}function S$(_,$=["metadata_json"]){return _.map((D)=>{let U={...D};for(let g of $){let I=U[g];if(typeof I==="string"){let j=g.endsWith("_json")?g.slice(0,-5):g;U[j]=c4(I),delete U[g]}}return U})}function UN(_){if(typeof _!=="string")return[];try{let $=JSON.parse(_);return Array.isArray($)?$:[]}catch{return[]}}function M3(_){if(typeof _!=="string")return{};return c4(_)}function Ab(_){let $={..._};return $.source_refs=UN($.source_refs_json),$.evidence_refs=UN($.evidence_refs_json),$.requires_approval=$.requires_approval===1||$.requires_approval===!0,$.checks=M3($.checks_json),$.metadata=M3($.metadata_json),delete $.source_refs_json,delete $.evidence_refs_json,delete $.checks_json,delete $.metadata_json,$}function Lb(_){let $={..._};return $.source_refs=UN($.source_refs_json),$.evidence_refs=UN($.evidence_refs_json),$.metadata=M3($.metadata_json),delete $.source_refs_json,delete $.evidence_refs_json,delete $.metadata_json,$}function p_(_,$,D=[]){return _.query($).all(...D)}function Jb(_){if(!W_(_))return{exists:!1,read_error:null,items:[]};try{let $=JSON.parse(eZ(_,"utf8"));if(!$||!Array.isArray($.items))return{exists:!0,read_error:"invalid_store_shape",items:[]};return{exists:!0,read_error:null,items:$.items}}catch($){return{exists:!0,read_error:$ instanceof Error?$.message:String($),items:[]}}}function nG(_){return{id:_.id,short_id:_.short_id??null,title:_.title,content_preview:Ob(_.content),url:_.url??null,tags:_.tags??[],metadata:_.metadata??{},archived:_.archived===!0,created_at:_.created_at,updated_at:_.updated_at}}function dG(){return{schema_version:0,sources:0,source_revisions:0,chunks:0,wiki_pages:0,citations:0,indexes:0,runs:0,run_events:0,redaction_findings:0,audit_events:0,approval_gates:0,storage_objects:0,embeddings:0,vector_entries:0,reindex_queue:0,knowledge_machines:0,sync_snapshots:0,sync_changes:0,sync_conflicts:0,sync_table_clocks:0,sync_imports:0,promotion_candidates:0,durable_records:0}}function $9(_,$,D=!1){return{query:_,limit:$,offset:0,mode:{keyword:!0,catalog:!0,semantic:D},semantic_provider:null,semantic_model:null,semantic_dimensions:null,counts:{keyword_results:0,catalog_results:0,semantic_results:0,merged_results:0},warnings:["knowledge_db_missing"],results:[]}}function Pb(_){return _.normalize("NFKC").trim().replace(/\s+/g," ").toLowerCase()}function zb(_,$,D=!1){let U=$9(_,$,D);return{query:_,normalized_query:Pb(_),created_at:new Date().toISOString(),mode:U.mode,warnings:U.warnings,search_counts:U.counts,results:[],citations:[],excerpts:[],graph:{citations:[],backlinks:[]},notes:{permissions:[],freshness:[]}}}function V3(_,$,D){let U=D??$.jsonStorePath;if(W_(U))return U;if(_==="global"){let g=FD();if(W_(g))return g}return U}function Sb(_){let $=JSON.stringify(_);return Math.max(1,Math.ceil($.length/4))}function Z3(_,$){let D=(_??"").normalize("NFKC").trim().replace(/\s+/g," ");if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-1)).trim()}...`}function mG(_,$,D){let U=u_(Z3(_,D),$);return{text:U.text,redactions:U.findings.length}}function iG(_,$,D){let U=_.now??new Date,g=_.source??"search",I=_.purpose??(g==="loops"||g==="runs"?"proposal":"agent_context"),j=(_.query??_.topic??$.query).normalize("NFKC").trim().replace(/\s+/g," "),N=Math.max(1,Math.min(_.maxItems??_.limit??8,50)),O=Math.max(500,Math.min(_.maxTokens??6000,1e5)),A=0,L=$.citations.slice(0,Math.max(N*2,N)).map((R,V)=>{let Q=mG(R.quote,D,V<3?220:140);A+=Q.redactions;let T=R.source_ref??R.source_uri??R.artifact_path??R.artifact_uri??R.id;return{id:`cite_${JU("sha256").update(`${R.id}\x00${T}`).digest("hex").slice(0,12)}`,kind:R.artifact_uri||R.artifact_path?"artifact":"source",ref:T,source_ref:R.source_ref,source_uri:R.source_uri,artifact_uri:R.artifact_uri,artifact_path:R.artifact_path,run_id:null,run_event_id:null,revision:R.revision,hash:R.hash,chunk_id:R.chunk_id,offsets:{start:R.start_offset,end:R.end_offset},quote_preview:Q.text}}),z=new Map($.citations.map((R,V)=>[R.id,L[V]])),W=$.excerpts.slice(0,Math.max(N*2,N)).map((R)=>{let V=$.results.find((q)=>q.id===R.result_id),Q=R.citation_id?z.get(R.citation_id):void 0,T=mG(R.text,D,520);return A+=T.redactions,{id:`ev_${JU("sha256").update(`${R.kind}\x00${R.result_id}\x00${R.citation_id??""}`).digest("hex").slice(0,14)}`,kind:R.kind,title:Z3(V?.title??Q?.ref??R.kind,100),text_preview:T.text,score:Number(R.score.toFixed(6)),citation_ids:Q?[Q.id]:[],provenance:{source:g,record_ref:`${R.kind}:${R.result_id}`,created_at:$.created_at,updated_at:null,metadata_keys:[]}}}).sort((R,V)=>V.score-R.score||R.id.localeCompare(V.id)).slice(0,N),J=new Set(W.flatMap((R)=>R.citation_ids)),P=L.filter((R)=>J.has(R.id)),S=Array.from(new Set($.warnings)),X=`ctx_${JU("sha256").update([g,I,j,S.join(","),W.map((R)=>R.id).join(",")].join("\x00")).digest("hex").slice(0,20)}`,G={ok:!0,format:"knowledge-agent-context-pack",version:1,created_at:U.toISOString(),source:g,purpose:I,query:j,topic:_.topic??null,since:_.since??null,dry_run:!0,idempotency_key:X,budgets:{max_tokens:O,estimated_tokens:0,max_items:N,items_included:W.length,items_available:$.excerpts.length,items_truncated:Math.max(0,$.excerpts.length-W.length),token_budget_exceeded:!1},safety:{raw_artifact_content_included:!1,durable_writes_performed:!1,redactions:A,reminders:["This pack is read-only and performs no durable writes.","Legacy JSON note evidence is bounded and redacted before inclusion."]},citations:P,evidence:W,duplicate_candidates:[],outline:{title:j?`Knowledge context: ${Z3(j,80)}`:"Knowledge context",bullets:W.length>0?W.slice(0,5).map((R)=>`${R.id}: ${R.title}`):["No matching bounded evidence was found."],evidence_ids:W.slice(0,8).map((R)=>R.id),duplicate_candidate_ids:[],next_actions:["Use evidence_ids and citation_ids in prompts instead of raw excerpts when possible.","Inspect cited refs only if the bounded preview is insufficient.","Use knowledge build/file-answer only with explicit approval for durable writes."]},warnings:S,message:`${W.length} bounded evidence item(s), estimated under ${O} token(s)`};return G.budgets.estimated_tokens=Sb(G),G.budgets.token_budget_exceeded=G.budgets.estimated_tokens>O,G.message=`${G.evidence.length} bounded evidence item(s), estimated ${G.budgets.estimated_tokens}/${O} token(s)`,G}function Wb(){return{schema_version:0,chunks:0,vector_entries:0,missing_embeddings:0,queued:{},stale_revisions:0}}function Xb(){return{total_embeddings:0,total_vector_entries:0,indexes:[]}}function Rb(_){return{ok:!0,scope:_.scope,workspace_home:_.workspaceHome,sqlite_schema_version:0,local_machine_id:_.localMachineId??null,machines:{total:0,rows:[]},snapshots:{total:0,latest:null},changes:{total:0,by_operation:[]},clocks:{total:0,rows:[]},imports:{total:0,latest:null},conflicts:{total:0,by_status:[],open:0},table_counts:{},message:"0 machine(s), 0 open sync conflict(s)"}}function lG(_){let $=_.now??new Date,D=_.source??"search",U=_.purpose??(D==="loops"||D==="runs"?"proposal":"agent_context"),g=(_.query??_.topic??"").normalize("NFKC").trim().replace(/\s+/g," "),I=Math.max(1,Math.min(_.maxItems??_.limit??8,50)),j=Math.max(500,Math.min(_.maxTokens??6000,1e5)),N=`ctx_${JU("sha256").update(["empty",D,U,g,_.topic??"",_.since??""].join("\x00")).digest("hex").slice(0,20)}`;return{ok:!0,format:"knowledge-agent-context-pack",version:1,created_at:$.toISOString(),source:D,purpose:U,query:g,topic:_.topic??null,since:_.since??null,dry_run:!0,idempotency_key:N,budgets:{max_tokens:j,estimated_tokens:0,max_items:I,items_included:0,items_available:0,items_truncated:0,token_budget_exceeded:!1},safety:{raw_artifact_content_included:!1,durable_writes_performed:!1,redactions:0,reminders:["This pack is read-only and performs no durable writes.","No knowledge.db exists for this scope yet."]},citations:[],evidence:[],duplicate_candidates:[],outline:{title:g?`Context for ${g}`:"Knowledge context",bullets:[],evidence_ids:[],duplicate_candidate_ids:[],next_actions:[]},warnings:["knowledge_db_missing"],message:`0 bounded evidence item(s), estimated 0/${j} token(s)`}}function b3(_){let $=_.artifact_store.s3?.prefix?.replace(/^\/+|\/+$/g,"");return $?`${$}/`:null}function Gb(_,$){let D=v(_);try{let U=D.query(`SELECT artifact_uri, kind, hash, size_bytes, metadata_json FROM storage_objects ORDER BY artifact_uri ASC`).all(),g=new Map,I=0,j=0,N=0,O=0,A=0,L=0,z=0,W=0,J=0,P=0,S=0,X=0,G=new Map,R=[],V=[],Q=[],T=[],q=$.artifact_store.uri_prefix,K=b3($);for(let G_ of U){if(g.set(G_.kind,(g.get(G_.kind)??0)+1),G_.hash?.startsWith("sha256:"))I+=1;if(typeof G_.size_bytes==="number"&&G_.size_bytes>=0)j+=1,N+=G_.size_bytes;if(G_.artifact_uri.startsWith(q))O+=1;else if(R.length<5)R.push(G_.artifact_uri);let H_=c4(G_.metadata_json);if(F3(H_))z+=1;let D0=typeof H_.key==="string"?H_.key:null;if(!D0)A+=1;else if(K&&D0.startsWith(K)){if(L+=1,V.length<5)V.push(D0)}let Lz=typeof H_.artifact_modified_at==="string"?H_.artifact_modified_at:null;if(Lz)if(Number.isNaN(Date.parse(Lz))){if(J+=1,Q.length<5)Q.push(G_.artifact_uri)}else W+=1;let KD=H_.provenance&&typeof H_.provenance==="object"&&!Array.isArray(H_.provenance)?H_.provenance:null;if(KD){P+=1;let qN=typeof KD.artifact_key==="string"?KD.artifact_key:null,Jz=typeof KD.generated_from==="string"?KD.generated_from:"unknown";if(G.set(Jz,(G.get(Jz)??0)+1),qN){if(S+=1,D0&&qN!==D0){if(X+=1,T.length<5)T.push(`${G_.artifact_uri}:provenance.artifact_key=${qN}:key=${D0}`)}}else if(T.length<5)T.push(`${G_.artifact_uri}:missing_provenance_artifact_key`)}else if(T.length<5)T.push(`${G_.artifact_uri}:missing_provenance`)}let Z=U.length-I,e=U.length-j,g_=U.length-W-J,I_=U.length-P,J_=P-S,a=U.length-O,r_=[Z>0?`artifact_manifest_missing_hash:${Z}`:null,e>0?`artifact_manifest_missing_size:${e}`:null,A>0?`artifact_manifest_missing_key:${A}`:null,a>0?`artifact_manifest_uri_prefix_mismatch:${a}`:null,L>0?`artifact_manifest_s3_key_contains_storage_prefix:${L}`:null,J>0?`artifact_manifest_invalid_modified_at:${J}`:null,I_>0?`artifact_manifest_missing_provenance:${I_}`:null,J_>0?`artifact_manifest_missing_provenance_artifact_key:${J_}`:null,X>0?`artifact_manifest_provenance_key_mismatch:${X}`:null,z>0?`artifact_manifest_raw_payload_sentinels:${z}`:null].filter((G_)=>Boolean(G_)),V_=r_.length===0;return{ok:V_,read_only:!0,storage_type:$.storage_type,artifact_uri_prefix:q,s3:$.artifact_store.s3,artifacts:{total:U.length,by_kind:[...g.entries()].map(([G_,H_])=>({kind:G_,count:H_})).sort((G_,H_)=>G_.kind.localeCompare(H_.kind)),with_hash:I,missing_hash:Z,with_size:j,missing_size:e,total_size_bytes:N},modified_time:{with_modified_at:W,missing_modified_at:g_,invalid_modified_at:J,examples:Q},provenance:{with_provenance:P,missing_provenance:I_,with_artifact_key:S,missing_artifact_key:J_,artifact_key_mismatches:X,generated_from:[...G.entries()].map(([G_,H_])=>({value:G_,count:H_})).sort((G_,H_)=>G_.value.localeCompare(H_.value)),examples:T},uri_prefix:{matching:O,mismatched:a,examples:R},keys:{with_key:U.length-A,missing_key:A,prefixed_with_storage_prefix:L,prefixed_examples:V},sync_manifest:{copied_by_sync:!0,generated_artifacts_only:!0,includes_raw_source_bytes:!1,hash_algorithm:"sha256",portable_keys:L===0&&A===0,tracks_modified_time:W>0&&J===0,preserves_provenance:I_===0&&J_===0&&X===0},raw_payload_sentinel_hits:z,warnings:r_,message:V_?`${U.length} generated artifact manifest row(s) ready for ${$.storage_type} sync`:`Generated artifact manifest needs attention: ${r_.join(", ")}`}}finally{D.close()}}function Yb(_,$){let D=b3($);if(!D)return[];let U=v(_);try{let g=U.query(`SELECT id, artifact_uri, kind, hash, size_bytes, metadata_json FROM storage_objects - ORDER BY artifact_uri ASC`).all(),I=[];for(let j of g){let N=c4(j.metadata_json),O=typeof N.key==="string"?N.key:null;if(!O?.startsWith(D))continue;let A=O.slice(D.length);if(!A)continue;I.push({id:j.id,artifact_uri:j.artifact_uri,kind:j.kind,current_key:O,repaired_key:f$(A),hash:j.hash,size_bytes:j.size_bytes})}return I}finally{U.close()}}function Qb(_){let $=["--scope",_.scope,"--json"],D=_.tables?.length?["--tables",_.tables.join(",")]:[],U=[DN({id:"sync_status",reason:"Inspect local sync registry, clocks, snapshots, and conflicts.",args:["sync","status",...$]})];if(_.machine&&!e9(_.machine))U.push(DN({id:"sync_dry_run_remote",reason:"Preview remote machine sync before changing either workspace.",args:["sync","dry-run","--machine",_.machine,..._.peerWorkspace?["--peer-workspace",_.peerWorkspace]:[],...D,...$]}));else if(_.peerWorkspace)U.push(DN({id:"sync_dry_run_peer",reason:"Preview local peer sync before changing either workspace.",args:["sync","dry-run","--peer-workspace",_.peerWorkspace,...D,...$]}));for(let g of _.resolvedWorkspace?.repair_hints??[])U.push({id:g.id,reason:g.reason,command:g.command,shell_command:g.shell_command});if(_.openConflicts>0)U.push(DN({id:"sync_conflicts",reason:"Review open conflicts before relying on bidirectional sync.",args:["sync","conflicts",...$]}));return U}function Tb(){let _=process.env.KNOWLEDGE_SSH_COMMAND?.trim()||"ssh",$=process.env.KNOWLEDGE_SSH_COMMAND_ARGS_JSON;if(!$)return{command:_,argsPrefix:[]};let D;try{D=JSON.parse($)}catch(U){throw Error(`KNOWLEDGE_SSH_COMMAND_ARGS_JSON must be a JSON string array: ${U instanceof Error?U.message:String(U)}`)}if(!Array.isArray(D)||!D.every((U)=>typeof U==="string"))throw Error("KNOWLEDGE_SSH_COMMAND_ARGS_JSON must be a JSON string array.");return{command:_,argsPrefix:D}}function t9(_,$,D,U){let g=Tb(),I=pZ(g.command,[...g.argsPrefix,U.target,$],{encoding:"utf8",env:process.env,input:D,maxBuffer:67108864});if((I.status??1)!==0){let j=U.source==="open-machines"?` via ${U.route??"resolved"}:${U.target}`:"";throw Error(`ssh ${_}${j} failed: ${(I.stderr||I.stdout||String(I.status)).trim()}`)}return I.stdout||""}function o9(_,$,D){try{return JSON.parse(D)}catch(U){let g=D.trim().slice(0,240);throw Error(`Remote knowledge ${$} on ${_} did not return JSON. Install a compatible @hasna/knowledge CLI on the remote machine. Output: ${g||String(U)}`)}}function qb(_,$){if(typeof $!=="object"||$===null||!("format"in $)||$.format!=="knowledge-sync-bundle")throw Error(`Remote knowledge sync export on ${_} did not return a knowledge sync bundle. Install @hasna/knowledge 0.2.32 or newer on the remote machine.`);let{protocol_version:D,min_protocol_version:U}=$;if(typeof D!=="number"||typeof U!=="number"||DK6)throw Error(`Remote knowledge sync export on ${_} uses an unsupported sync protocol. Install @hasna/knowledge 0.2.32 or newer on both machines.`)}function Bb(_,$){if(typeof $!=="object"||$===null||!("ok"in $)||!("target"in $)||!("tables"in $)||!("artifacts"in $)||!("conflicts_created"in $))throw Error(`Remote knowledge sync import on ${_} did not return a sync import result. Install @hasna/knowledge 0.2.32 or newer on the remote machine.`);let{protocol_version:D,min_protocol_version:U}=$;if(typeof D!=="number"||typeof U!=="number"||DK6)throw Error(`Remote knowledge sync import on ${_} uses an unsupported sync protocol. Install @hasna/knowledge 0.2.32 or newer on both machines.`)}function Vb(_){if(!_)return;let $=_.trim().toLowerCase();if($==="local"||$==="offline")return"local";if($==="hosted"||$==="remote"||$==="knowledge.md")return"hosted";throw Error("Invalid setup mode. Use hosted or local.")}class DG{options;ensuredWorkspace;cachedConfig;constructor(_={}){this.options=_}get scope(){return this.options.scope??"global"}get workspace(){return this.ensuredWorkspace??HU(this.options.scope,this.options.cwd)}ensureWorkspace(){if(!this.ensuredWorkspace)this.ensuredWorkspace=g0(this.workspace.home);return this.ensuredWorkspace}jsonStorePath(){return this.ensureWorkspace().jsonStorePath}itemStore(){let _=this.ensureWorkspace();return cU({storePath:_.jsonStorePath,storePathOverridden:!1})}async listItems(){return this.itemStore().listAll()}async getItem(_){return this.itemStore().get(_)}async createItem(_){return this.itemStore().create(_)}async updateItem(_,$){return this.itemStore().update(_,$)}async deleteItem(_){return this.itemStore().delete(_)}async deleteItems(_){return this.itemStore().deleteMany(_)}async resolveInventory(_={}){if(this.isApiMode())return this.cloudInventory(_);return this.inventory(_)}config(_={}){let $=_.ensure?this.ensureWorkspace():this.workspace;if(!this.cachedConfig||_.ensure||W_($.configPath))this.cachedConfig=W_($.configPath)?ZN($.configPath):MD();return this.cachedConfig}safetyPolicy(){return yS(this.config(),this.workspace)}artifactStore(){return gE(this.config(),this.ensureWorkspace())}storageContract(){return mU(this.config(),this.workspace,this.scope)}validateStorage(){return jE(this.config(),this.workspace)}assertStorageValid(_){let $=this.validateStorage();if(!$.ok)throw Error(`Storage contract invalid before ${_}: ${$.errors.join("; ")}`)}migrateLegacyPath(_={}){let $=this.workspace,D=MN(this.options.scope,this.options.cwd),U=v9({scope:this.scope,current:$,legacy:D,approveWrite:_.approveWrite,approvedBy:_.approvedBy});if(!U.dry_run&&U.ok)this.ensuredWorkspace=void 0,this.cachedConfig=void 0;return U}mergeLegacyPath(_={}){let $=this.workspace,D=MN(this.options.scope,this.options.cwd),U=C9({scope:this.scope,current:$,legacy:D,approveWrite:_.approveWrite,approvedBy:_.approvedBy});if(!U.dry_run&&U.ok)this.ensuredWorkspace=void 0,this.cachedConfig=void 0;return U}setup(_={}){let $=this.ensureWorkspace(),D=this.config({ensure:!0}),U=Vb(_.mode)??D.mode,g=_.apiUrl?a$(_.apiUrl):D.hosted?.api_url?a$(D.hosted.api_url):null,I={...D,mode:U,hosted:{...D.hosted??{},...g?{api_url:g}:{}},storage:_.canonicalExample?Xz():D.storage};Rz($.configPath,I),this.cachedConfig=I;let j=mU(I,$,this.scope);return{ok:!0,mode:U,api_url:I.hosted?.api_url??null,storage_type:I.storage.type,artifact_uri_prefix:j.artifact_store.uri_prefix,canonical_example:j.canonical_example,config_path:$.configPath,next:U==="hosted"?["knowledge auth login --api-key ","knowledge storage status --json"]:["knowledge search ","knowledge "],message:`Set knowledge mode to ${U}`}}authStatus(_=process.env){return MS(this.config(),_)}saveAuth(_,$=process.env){let D=_.apiUrl??this.config().hosted?.api_url;return KS({api_key:_.apiKey,email:_.email,org_id:_.orgId,org_slug:_.orgSlug,user_id:_.userId,api_url:D},$)}clearAuth(_=process.env){return FS(_)}paths(){let _=this.workspace;return{ok:!0,scope:this.scope,home:_.home,exists:W_(_.home),config_path:_.configPath,config_exists:W_(_.configPath),json_store_path:_.jsonStorePath,json_store_exists:W_(_.jsonStorePath),knowledge_db_path:_.knowledgeDbPath,knowledge_db_exists:W_(_.knowledgeDbPath),artifacts_dir:_.artifactsDir,indexes_dir:_.indexesDir,logs_dir:_.logsDir,runs_dir:_.runsDir,schemas_dir:_.schemasDir,wiki_dir:_.wikiDir,config:this.config(),message:_.home}}initDb(){return h(this.ensureWorkspace().knowledgeDbPath)}dbStats(){nU("reading knowledge.db stats");let _=this.workspace;if(!W_(_.knowledgeDbPath))return d9();return _E(_.knowledgeDbPath)}enqueuePromotion(_){return dR(this.ensureWorkspace().knowledgeDbPath,_)}promotionInbox(_={}){return iR(this.ensureWorkspace().knowledgeDbPath,_)}getPromotion(_){return mR(this.ensureWorkspace().knowledgeDbPath,_)}reviewPromotion(_,$){return lR(this.ensureWorkspace().knowledgeDbPath,_,$)}promoteCandidate(_,$={}){return tR(this.ensureWorkspace().knowledgeDbPath,_,$)}rejectPromotion(_,$={}){return oR(this.ensureWorkspace().knowledgeDbPath,_,$)}durableRecords(_={}){return pR(this.ensureWorkspace().knowledgeDbPath,_)}itemOnlyInventory(_){let $=this.workspace,{items:D,limit:U,includeArchived:g,storePath:I,storeExists:j,storeReadError:N}=_,O=D.filter((W)=>W.archived!==!0),A=g?D:O,L=d9(),z={legacy_items:D.length,active_items:O.length,archived_items:D.length-O.length,schema_version:L.schema_version,sources:L.sources,source_revisions:L.source_revisions,chunks:L.chunks,wiki_pages:L.wiki_pages,citations:L.citations,indexes:L.indexes,runs:L.runs,run_events:L.run_events,storage_objects:L.storage_objects,embeddings:L.embeddings,vector_entries:L.vector_entries,reindex_queue:L.reindex_queue,redaction_findings:L.redaction_findings,audit_events:L.audit_events,approval_gates:L.approval_gates,knowledge_machines:L.knowledge_machines,sync_snapshots:L.sync_snapshots,sync_changes:L.sync_changes,sync_conflicts:L.sync_conflicts,sync_table_clocks:L.sync_table_clocks,sync_imports:L.sync_imports,promotion_candidates:L.promotion_candidates,durable_records:L.durable_records};return{ok:!0,scope:this.scope,home:$.home,limit:U,paths:{json_store_path:$.jsonStorePath,json_store_exists:W_($.jsonStorePath),knowledge_db_path:$.knowledgeDbPath,knowledge_db_exists:W_($.knowledgeDbPath),artifacts_dir:$.artifactsDir,indexes_dir:$.indexesDir,logs_dir:$.logsDir,wiki_dir:$.wikiDir},summary:z,legacy_store:{path:I,exists:j,read_error:N,total_items:D.length,active_items:O.length,archived_items:D.length-O.length,items_returned:Math.min(A.length,U)},items:A.slice(0,U).map(n9),sources:[],source_revisions:[],chunks:[],wiki_pages:[],indexes:[],storage_objects:[],runs:[],vector_indexes:[],reindex_queue:[],machines:[],sync_conflicts:[],approval_gates:[],audit_events:[],promotion_candidates:[],durable_records:[],message:`${D.length} item(s), 0 source(s), 0 chunk(s), 0 wiki page(s), 0 artifact(s)`}}async cloudInventory(_={}){let $=c9(_.limit),D=await this.fetchCloudItems(),U=uD();return this.itemOnlyInventory({items:D,limit:$,includeArchived:_.includeArchived??!1,storePath:U?.baseUrl??"cloud",storeExists:!0,storeReadError:null})}inventory(_={}){let $=this.workspace,D=c9(_.limit),U=_.storePath??$.jsonStorePath,g=Jb(U),I=g.items.filter((L)=>L.archived!==!0),j=_.includeArchived?g.items:I;if(!W_($.knowledgeDbPath))return this.itemOnlyInventory({items:g.items,limit:D,includeArchived:_.includeArchived??!1,storePath:U,storeExists:g.exists,storeReadError:g.read_error});h($.knowledgeDbPath);let O=_E($.knowledgeDbPath),A=v($.knowledgeDbPath);try{let L=S$(p_(A,` + ORDER BY artifact_uri ASC`).all(),I=[];for(let j of g){let N=c4(j.metadata_json),O=typeof N.key==="string"?N.key:null;if(!O?.startsWith(D))continue;let A=O.slice(D.length);if(!A)continue;I.push({id:j.id,artifact_uri:j.artifact_uri,kind:j.kind,current_key:O,repaired_key:f$(A),hash:j.hash,size_bytes:j.size_bytes})}return I}finally{U.close()}}function Qb(_){let $=["--scope",_.scope,"--json"],D=_.tables?.length?["--tables",_.tables.join(",")]:[],U=[DN({id:"sync_status",reason:"Inspect local sync registry, clocks, snapshots, and conflicts.",args:["sync","status",...$]})];if(_.machine&&!eG(_.machine))U.push(DN({id:"sync_dry_run_remote",reason:"Preview remote machine sync before changing either workspace.",args:["sync","dry-run","--machine",_.machine,..._.peerWorkspace?["--peer-workspace",_.peerWorkspace]:[],...D,...$]}));else if(_.peerWorkspace)U.push(DN({id:"sync_dry_run_peer",reason:"Preview local peer sync before changing either workspace.",args:["sync","dry-run","--peer-workspace",_.peerWorkspace,...D,...$]}));for(let g of _.resolvedWorkspace?.repair_hints??[])U.push({id:g.id,reason:g.reason,command:g.command,shell_command:g.shell_command});if(_.openConflicts>0)U.push(DN({id:"sync_conflicts",reason:"Review open conflicts before relying on bidirectional sync.",args:["sync","conflicts",...$]}));return U}function Tb(){let _=process.env.KNOWLEDGE_SSH_COMMAND?.trim()||"ssh",$=process.env.KNOWLEDGE_SSH_COMMAND_ARGS_JSON;if(!$)return{command:_,argsPrefix:[]};let D;try{D=JSON.parse($)}catch(U){throw Error(`KNOWLEDGE_SSH_COMMAND_ARGS_JSON must be a JSON string array: ${U instanceof Error?U.message:String(U)}`)}if(!Array.isArray(D)||!D.every((U)=>typeof U==="string"))throw Error("KNOWLEDGE_SSH_COMMAND_ARGS_JSON must be a JSON string array.");return{command:_,argsPrefix:D}}function tG(_,$,D,U){let g=Tb(),I=pZ(g.command,[...g.argsPrefix,U.target,$],{encoding:"utf8",env:process.env,input:D,maxBuffer:67108864});if((I.status??1)!==0){let j=U.source==="open-machines"?` via ${U.route??"resolved"}:${U.target}`:"";throw Error(`ssh ${_}${j} failed: ${(I.stderr||I.stdout||String(I.status)).trim()}`)}return I.stdout||""}function oG(_,$,D){try{return JSON.parse(D)}catch(U){let g=D.trim().slice(0,240);throw Error(`Remote knowledge ${$} on ${_} did not return JSON. Install a compatible @hasna/knowledge CLI on the remote machine. Output: ${g||String(U)}`)}}function qb(_,$){if(typeof $!=="object"||$===null||!("format"in $)||$.format!=="knowledge-sync-bundle")throw Error(`Remote knowledge sync export on ${_} did not return a knowledge sync bundle. Install @hasna/knowledge 0.2.32 or newer on the remote machine.`);let{protocol_version:D,min_protocol_version:U}=$;if(typeof D!=="number"||typeof U!=="number"||DK6)throw Error(`Remote knowledge sync export on ${_} uses an unsupported sync protocol. Install @hasna/knowledge 0.2.32 or newer on both machines.`)}function Bb(_,$){if(typeof $!=="object"||$===null||!("ok"in $)||!("target"in $)||!("tables"in $)||!("artifacts"in $)||!("conflicts_created"in $))throw Error(`Remote knowledge sync import on ${_} did not return a sync import result. Install @hasna/knowledge 0.2.32 or newer on the remote machine.`);let{protocol_version:D,min_protocol_version:U}=$;if(typeof D!=="number"||typeof U!=="number"||DK6)throw Error(`Remote knowledge sync import on ${_} uses an unsupported sync protocol. Install @hasna/knowledge 0.2.32 or newer on both machines.`)}function Vb(_){if(!_)return;let $=_.trim().toLowerCase();if($==="local"||$==="offline")return"local";if($==="hosted"||$==="remote"||$==="knowledge.md")return"hosted";throw Error("Invalid setup mode. Use hosted or local.")}class D9{options;ensuredWorkspace;cachedConfig;constructor(_={}){this.options=_}get scope(){return this.options.scope??"global"}get workspace(){return this.ensuredWorkspace??HU(this.options.scope,this.options.cwd)}ensureWorkspace(){if(!this.ensuredWorkspace)this.ensuredWorkspace=g0(this.workspace.home);return this.ensuredWorkspace}jsonStorePath(){return this.ensureWorkspace().jsonStorePath}itemStore(){let _=this.ensureWorkspace();return cU({storePath:_.jsonStorePath,storePathOverridden:!1})}async listItems(){return this.itemStore().listAll()}async getItem(_){return this.itemStore().get(_)}async createItem(_){return this.itemStore().create(_)}async updateItem(_,$){return this.itemStore().update(_,$)}async deleteItem(_){return this.itemStore().delete(_)}async deleteItems(_){return this.itemStore().deleteMany(_)}async resolveInventory(_={}){if(this.isApiMode())return this.cloudInventory(_);return this.inventory(_)}config(_={}){let $=_.ensure?this.ensureWorkspace():this.workspace;if(!this.cachedConfig||_.ensure||W_($.configPath))this.cachedConfig=W_($.configPath)?ZN($.configPath):MD();return this.cachedConfig}safetyPolicy(){return yS(this.config(),this.workspace)}artifactStore(){return gE(this.config(),this.ensureWorkspace())}storageContract(){return mU(this.config(),this.workspace,this.scope)}validateStorage(){return jE(this.config(),this.workspace)}assertStorageValid(_){let $=this.validateStorage();if(!$.ok)throw Error(`Storage contract invalid before ${_}: ${$.errors.join("; ")}`)}migrateLegacyPath(_={}){let $=this.workspace,D=MN(this.options.scope,this.options.cwd),U=vG({scope:this.scope,current:$,legacy:D,approveWrite:_.approveWrite,approvedBy:_.approvedBy});if(!U.dry_run&&U.ok)this.ensuredWorkspace=void 0,this.cachedConfig=void 0;return U}mergeLegacyPath(_={}){let $=this.workspace,D=MN(this.options.scope,this.options.cwd),U=CG({scope:this.scope,current:$,legacy:D,approveWrite:_.approveWrite,approvedBy:_.approvedBy});if(!U.dry_run&&U.ok)this.ensuredWorkspace=void 0,this.cachedConfig=void 0;return U}setup(_={}){let $=this.ensureWorkspace(),D=this.config({ensure:!0}),U=Vb(_.mode)??D.mode,g=_.apiUrl?a$(_.apiUrl):D.hosted?.api_url?a$(D.hosted.api_url):null,I={...D,mode:U,hosted:{...D.hosted??{},...g?{api_url:g}:{}},storage:_.canonicalExample?Xz():D.storage};Rz($.configPath,I),this.cachedConfig=I;let j=mU(I,$,this.scope);return{ok:!0,mode:U,api_url:I.hosted?.api_url??null,storage_type:I.storage.type,artifact_uri_prefix:j.artifact_store.uri_prefix,canonical_example:j.canonical_example,config_path:$.configPath,next:U==="hosted"?["knowledge auth login --api-key ","knowledge storage status --json"]:["knowledge search ","knowledge "],message:`Set knowledge mode to ${U}`}}authStatus(_=process.env){return MS(this.config(),_)}saveAuth(_,$=process.env){let D=_.apiUrl??this.config().hosted?.api_url;return KS({api_key:_.apiKey,email:_.email,org_id:_.orgId,org_slug:_.orgSlug,user_id:_.userId,api_url:D},$)}clearAuth(_=process.env){return FS(_)}paths(){let _=this.workspace;return{ok:!0,scope:this.scope,home:_.home,exists:W_(_.home),config_path:_.configPath,config_exists:W_(_.configPath),json_store_path:_.jsonStorePath,json_store_exists:W_(_.jsonStorePath),knowledge_db_path:_.knowledgeDbPath,knowledge_db_exists:W_(_.knowledgeDbPath),artifacts_dir:_.artifactsDir,indexes_dir:_.indexesDir,logs_dir:_.logsDir,runs_dir:_.runsDir,schemas_dir:_.schemasDir,wiki_dir:_.wikiDir,config:this.config(),message:_.home}}initDb(){return h(this.ensureWorkspace().knowledgeDbPath)}dbStats(){nU("reading knowledge.db stats");let _=this.workspace;if(!W_(_.knowledgeDbPath))return dG();return _E(_.knowledgeDbPath)}enqueuePromotion(_){return dR(this.ensureWorkspace().knowledgeDbPath,_)}promotionInbox(_={}){return iR(this.ensureWorkspace().knowledgeDbPath,_)}getPromotion(_){return mR(this.ensureWorkspace().knowledgeDbPath,_)}reviewPromotion(_,$){return lR(this.ensureWorkspace().knowledgeDbPath,_,$)}promoteCandidate(_,$={}){return tR(this.ensureWorkspace().knowledgeDbPath,_,$)}rejectPromotion(_,$={}){return oR(this.ensureWorkspace().knowledgeDbPath,_,$)}durableRecords(_={}){return pR(this.ensureWorkspace().knowledgeDbPath,_)}itemOnlyInventory(_){let $=this.workspace,{items:D,limit:U,includeArchived:g,storePath:I,storeExists:j,storeReadError:N}=_,O=D.filter((W)=>W.archived!==!0),A=g?D:O,L=dG(),z={legacy_items:D.length,active_items:O.length,archived_items:D.length-O.length,schema_version:L.schema_version,sources:L.sources,source_revisions:L.source_revisions,chunks:L.chunks,wiki_pages:L.wiki_pages,citations:L.citations,indexes:L.indexes,runs:L.runs,run_events:L.run_events,storage_objects:L.storage_objects,embeddings:L.embeddings,vector_entries:L.vector_entries,reindex_queue:L.reindex_queue,redaction_findings:L.redaction_findings,audit_events:L.audit_events,approval_gates:L.approval_gates,knowledge_machines:L.knowledge_machines,sync_snapshots:L.sync_snapshots,sync_changes:L.sync_changes,sync_conflicts:L.sync_conflicts,sync_table_clocks:L.sync_table_clocks,sync_imports:L.sync_imports,promotion_candidates:L.promotion_candidates,durable_records:L.durable_records};return{ok:!0,scope:this.scope,home:$.home,limit:U,paths:{json_store_path:$.jsonStorePath,json_store_exists:W_($.jsonStorePath),knowledge_db_path:$.knowledgeDbPath,knowledge_db_exists:W_($.knowledgeDbPath),artifacts_dir:$.artifactsDir,indexes_dir:$.indexesDir,logs_dir:$.logsDir,wiki_dir:$.wikiDir},summary:z,legacy_store:{path:I,exists:j,read_error:N,total_items:D.length,active_items:O.length,archived_items:D.length-O.length,items_returned:Math.min(A.length,U)},items:A.slice(0,U).map(nG),sources:[],source_revisions:[],chunks:[],wiki_pages:[],indexes:[],storage_objects:[],runs:[],vector_indexes:[],reindex_queue:[],machines:[],sync_conflicts:[],approval_gates:[],audit_events:[],promotion_candidates:[],durable_records:[],message:`${D.length} item(s), 0 source(s), 0 chunk(s), 0 wiki page(s), 0 artifact(s)`}}async cloudInventory(_={}){let $=cG(_.limit),D=await this.fetchCloudItems(),U=uD();return this.itemOnlyInventory({items:D,limit:$,includeArchived:_.includeArchived??!1,storePath:U?.baseUrl??"cloud",storeExists:!0,storeReadError:null})}inventory(_={}){let $=this.workspace,D=cG(_.limit),U=_.storePath??$.jsonStorePath,g=Jb(U),I=g.items.filter((L)=>L.archived!==!0),j=_.includeArchived?g.items:I;if(!W_($.knowledgeDbPath))return this.itemOnlyInventory({items:g.items,limit:D,includeArchived:_.includeArchived??!1,storePath:U,storeExists:g.exists,storeReadError:g.read_error});h($.knowledgeDbPath);let O=_E($.knowledgeDbPath),A=v($.knowledgeDbPath);try{let L=S$(p_(A,` SELECT s.id, s.uri, @@ -1346,8 +1346,8 @@ Pages should be concise, cited, and organized for both humans and agents. FROM durable_knowledge_records ORDER BY updated_at DESC, created_at DESC LIMIT ? - `,[D]).map(Lb),e={legacy_items:g.items.length,active_items:I.length,archived_items:g.items.length-I.length,schema_version:O.schema_version,sources:O.sources,source_revisions:O.source_revisions,chunks:O.chunks,wiki_pages:O.wiki_pages,citations:O.citations,indexes:O.indexes,runs:O.runs,run_events:O.run_events,storage_objects:O.storage_objects,embeddings:O.embeddings,vector_entries:O.vector_entries,reindex_queue:O.reindex_queue,redaction_findings:O.redaction_findings,audit_events:O.audit_events,approval_gates:O.approval_gates,knowledge_machines:O.knowledge_machines,sync_snapshots:O.sync_snapshots,sync_changes:O.sync_changes,sync_conflicts:O.sync_conflicts,sync_table_clocks:O.sync_table_clocks,sync_imports:O.sync_imports,promotion_candidates:O.promotion_candidates,durable_records:O.durable_records};return{ok:!0,scope:this.scope,home:$.home,limit:D,paths:{json_store_path:U,json_store_exists:g.exists,knowledge_db_path:$.knowledgeDbPath,knowledge_db_exists:!0,artifacts_dir:$.artifactsDir,indexes_dir:$.indexesDir,logs_dir:$.logsDir,wiki_dir:$.wikiDir},summary:e,legacy_store:{path:U,exists:g.exists,read_error:g.read_error,total_items:g.items.length,active_items:I.length,archived_items:g.items.length-I.length,items_returned:Math.min(j.length,D)},items:j.slice(0,D).map(n9),sources:L,source_revisions:z,chunks:W,wiki_pages:J,indexes:P,storage_objects:S,runs:X,vector_indexes:G,reindex_queue:R,machines:V,sync_conflicts:Q,approval_gates:T,audit_events:q,promotion_candidates:K,durable_records:Z,message:`${g.items.length} item(s), ${O.sources} source(s), ${O.chunks} chunk(s), ${O.wiki_pages} wiki page(s), ${O.storage_objects} artifact(s)`}}finally{A.close()}}assertAppWikiWrite(_){xD({scope:this.scope,workspace:this.workspace,safetyPolicy:this.safetyPolicy(),allowGlobal:_})}async initAppWiki(_={}){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return UW({scope:this.scope,workspace:$,store:this.artifactStore(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal})}async addAppWikiNote(_){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return IW({scope:this.scope,workspace:$,store:this.artifactStore(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal,title:_.title,content:_.content,tags:_.tags,sourceRefs:_.sourceRefs,path:_.path,metadata:_.metadata})}listAppWikiNotes(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return[];return jW({dbPath:$.knowledgeDbPath,limit:_.limit})}async getAppWikiNote(_,$={}){let D=this.workspace;if(!W_(D.knowledgeDbPath))return null;return NW({dbPath:D.knowledgeDbPath,store:this.artifactStore(),id:_,includeContent:$.includeContent})}async addAppWikiSourceRef(_){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return EW({scope:this.scope,workspace:$,sourceRef:_.sourceRef,purpose:_.purpose,config:this.config(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal})}async searchAppWiki(_){return this.search(_)}async queryAppWiki(_){return this.retrieveContext(_)}async initWiki(){let _=this.ensureWorkspace();h(_.knowledgeDbPath);let $=await V9(this.artifactStore()),D=v(_.knowledgeDbPath);try{s$(D,$.artifacts),K9(D,$.artifacts)}finally{D.close()}return $}async compileWiki(_={}){let $=this.ensureWorkspace();return Q9({..._,dbPath:$.knowledgeDbPath,store:this.artifactStore()})}async fileAnswer(_){let $=this.ensureWorkspace(),D=await this.retrieveContext({query:_.prompt,limit:_.limit,semantic:_.semantic,modelRef:_.modelRef,dimensions:_.dimensions,fake:_.fake});return T9({dbPath:$.knowledgeDbPath,store:this.artifactStore(),prompt:_.prompt,answer:_.answer,context:D,approveWrite:_.approveWrite})}lintWiki(){let _=this.ensureWorkspace();return q9({dbPath:_.knowledgeDbPath})}async ingestManifest(_){let $=this.ensureWorkspace();return sS({dbPath:$.knowledgeDbPath,input:_,config:this.config(),safetyPolicy:this.safetyPolicy()})}async ingestSource(_,$){let D=this.ensureWorkspace();return eU({dbPath:D.knowledgeDbPath,sourceRef:_,purpose:$,config:this.config(),safetyPolicy:this.safetyPolicy()})}async importRulesProvenance(_={}){let $=_.dryRun!==!1,D=$?this.workspace:this.ensureWorkspace();return A9({root:_.root??this.options.cwd??process.cwd(),scope:this.scope,owner:_.owner,dryRun:$,deprecateLegacy:_.deprecateLegacy,includeLegacy:_.includeLegacy,legacyStorePath:D.jsonStorePath,dbPath:D.knowledgeDbPath,safetyPolicy:this.safetyPolicy(),maxItems:_.maxItems,limit:_.limit})}async resolveSource(_,$={}){let D=this.ensureWorkspace();return tU({dbPath:D.knowledgeDbPath,sourceRef:_,purpose:$.purpose,limit:$.limit,safetyPolicy:this.safetyPolicy()})}async consumeOutbox(_){let $=this.ensureWorkspace();return TR({dbPath:$.knowledgeDbPath,input:_,config:this.config(),safetyPolicy:this.safetyPolicy()})}reindexHealth(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return Wb();return sR({..._,dbPath:$.knowledgeDbPath,config:this.config()})}enqueueReindex(_={}){let $=this.ensureWorkspace();return I3({..._,dbPath:$.knowledgeDbPath,config:this.config()})}async refreshEmbeddings(_={}){let $=this.ensureWorkspace();return _9({..._,dbPath:$.knowledgeDbPath,config:this.config()})}providerStatus(_=process.env){return PW(this.config(),_)}modelRegistry(){return XE(this.config())}embeddingStatus(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return Xb();return GW(_.knowledgeDbPath)}async indexEmbeddings(_={}){let $=this.ensureWorkspace();return _I({..._,dbPath:$.knowledgeDbPath,config:this.config()})}isApiMode(){return Y6()}async fetchCloudItems(){let _=uD();if(!_)throw Error("knowledge: cloud store requested but not resolvable (check HASNA_KNOWLEDGE_API_URL + HASNA_KNOWLEDGE_API_KEY).");return hU(_)}async semanticSearch(_){let $=this.workspace;if(this.isApiMode()){let D=await this.fetchCloudItems(),U=await j4(D,{..._},["semantic_search_requires_local_catalog"]);return{provider:"openai",model:"text-embedding-3-small",dimensions:_.dimensions??1536,query:_.query,results:U.results}}if(!W_($.knowledgeDbPath))return{provider:"openai",model:"text-embedding-3-small",dimensions:_.dimensions??1536,query:_.query,results:[]};return $I({..._,dbPath:$.knowledgeDbPath,config:this.config()})}async search(_){let $=this.workspace;if(this.isApiMode()){let U=await this.fetchCloudItems();return j4(U,_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){if(W_(D))return II({..._,legacyStorePath:D,config:this.config()});return $G(_.query,Math.max(1,Math.min(_.limit??10,100)),_.semantic===!0||_.fake===!0||Boolean(_.modelRef))}return UI({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async retrieveContext(_){let $=this.workspace;if(this.isApiMode()){let U=await this.fetchCloudItems();return NI(U,_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){if(W_(D)){let U=await II({..._,legacyStorePath:D,config:this.config()});return G0(U,{contextChars:_.contextChars})}return zb(_.query,Math.max(1,Math.min(_.limit??10,100)),_.semantic===!0||_.fake===!0||Boolean(_.modelRef))}return Y0({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async contextPack(_){let $=this.workspace;if(this.isApiMode()){let U=(_.query??_.topic??"").trim();if(U&&_.source!=="loops"&&_.source!=="runs"){let g=await this.fetchCloudItems(),I=await j4(g,{..._,query:U}),j=G0(I,{contextChars:_.contextChars});return i9(_,j,this.safetyPolicy())}return l9(_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){let U=(_.query??_.topic??"").trim();if(U&&_.source!=="loops"&&_.source!=="runs"&&W_(D)){let g=await II({..._,query:U,legacyStorePath:D,config:this.config()}),I=G0(g,{contextChars:_.contextChars});return i9(_,I,this.safetyPolicy())}return l9(_)}return oW({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config(),safetyPolicy:this.safetyPolicy()})}async runPrompt(_){if(this.isApiMode()){let U=await this.fetchCloudItems();return yW(U,{..._,config:this.config()})}let $=this.ensureWorkspace(),D=_.legacyStorePath??$.jsonStorePath;if(!_.legacyStorePath)kD(D);return xW({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async webSearch(_){let $=this.ensureWorkspace();return z9({..._,dbPath:$.knowledgeDbPath,config:this.config(),safetyPolicy:this.safetyPolicy()})}async machineTopology(_={}){let $=this.workspace;return wR({..._,knowledge:{scope:this.scope,workspace_home:$.home}})}async machinePreflight(_={}){let $=this.workspace;return yR({..._,knowledge:{scope:this.scope,workspace_home:$.home}})}syncStatus(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return Rb({scope:this.scope,workspaceHome:_.home});return RX({dbPath:_.knowledgeDbPath,scope:this.scope,workspaceHome:_.home})}async syncDoctor(_={}){let $=this.ensureWorkspace();h($.knowledgeDbPath);let D=this.syncStatus(),U=this.storageContract(),g=this.validateStorage(),I=Gb($.knowledgeDbPath,U),j=_.machine?.trim()||null,N=_.peerWorkspace?.trim()||null,O=[],A=null,L=null;if(j&&!e9(j)){let S=await _3({machineId:j,includeTailscale:_.includeTailscale});A=B3(S),O.push(...S.warnings)}if(j||N){let S=await lj({machineId:j??q3($),peerWorkspace:N,includeTailscale:_.includeTailscale});if(j&&!N&&(A?.source==="raw"||!S.ok||!S.project_root)){let X=u9($.knowledgeDbPath,j);if(X){if(A?.source==="raw"&&X.ssh_target)A=B3(x9(X,j,{target:A.target,route:A.route,targetKind:A.target_kind,confidence:A.confidence,source:A.source,adapter:A.adapter,evidence:A.evidence,cacheability:A.cacheability,warnings:[]}));if(!S.ok||!S.project_root){let G=y9(X,j,S);if(G)L=LU(G,G.project_root),O.push(...G.warnings)}}}L=S.ok&&S.project_root?LU(S,S.project_root):L??{...LU(S,N??""),project_root:S.project_root??N??""},O.push(...S.warnings)}if(!g.ok)O.push(...g.errors.map((S)=>`storage:${S}`));let z=Nb($.knowledgeDbPath,L);if(!z.ok)O.push("open_files_boundary_raw_payload_sentinels");if(!I.ok)O.push(...I.warnings);let W=L?.diagnostics.filter((S)=>S.severity==="fail")??[],J=g.ok&&I.ok&&z.ok&&W.length===0&&(L?.project_root!==""||!L),P=Qb({scope:this.scope,machine:j,peerWorkspace:N,tables:_.tables,resolvedWorkspace:L,openConflicts:D.conflicts.open});return{ok:J,read_only:!0,generated_at:new Date().toISOString(),scope:this.scope,workspace_home:$.home,database:{sqlite_schema_version:D.sqlite_schema_version,table_counts:D.table_counts},storage:{contract:U,validation:g,artifact_manifest:I},sync:{machines:D.machines.total,snapshots:D.snapshots.total,clocks:D.clocks.total,imports:D.imports.total,open_conflicts:D.conflicts.open,table_clocks:D.clocks.rows},open_files:z,resolved_route:A,resolved_workspace:L,recommended_commands:P,warnings:[...new Set(O)],message:J?`Sync readiness ok: ${D.clocks.total} table clock(s), ${D.conflicts.open} open conflict(s)`:`Sync readiness needs attention: ${[...new Set(O)].join(", ")||"workspace diagnostics failed"}`}}repairArtifactManifestKeys(_={}){let $=this.ensureWorkspace();h($.knowledgeDbPath);let D=this.storageContract(),U=b3(D),g=Yb($.knowledgeDbPath,D),I=_.dryRun===!0||_.approveWrite!==!0;if(g.length===0)return{ok:!0,dry_run:I,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:"No legacy S3 artifact manifest keys found"};if(_.dryRun===!0)return{ok:!0,dry_run:!0,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:`Would repair ${g.length} legacy S3 artifact manifest key(s)`};if(_.approveWrite!==!0||!_.approvedBy)return{ok:!1,dry_run:!0,approval_required:!0,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:"Artifact key repair requires --approve-write and --approved-by "};let j=v($.knowledgeDbPath);try{let N=new Date().toISOString();j.transaction((L)=>{let z=j.query("UPDATE storage_objects SET metadata_json = ?, updated_at = ? WHERE id = ?"),W=j.query("SELECT id, metadata_json FROM storage_objects").all(),J=new Map(W.map((P)=>[P.id,c4(P.metadata_json)]));for(let P of L){let S=J.get(P.id)??{};S.key=P.repaired_key,z.run(JSON.stringify(S),N,P.id)}})(g);let A=X_(j,{event_type:"artifact_manifest_key_repair",action:"storage.artifact_manifest.repair_keys",target_uri:`knowledge-storage://${$.home}/storage_objects`,decision:"allow",metadata:{approved_by:_.approvedBy,repaired:g.length,storage_type:D.storage_type,storage_prefix:U,artifact_uris:g.map((L)=>L.artifact_uri)}});return{ok:!0,dry_run:!1,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:g.length,audit_event_id:A,message:`Repaired ${g.length} legacy S3 artifact manifest key(s)`}}finally{j.close()}}async createSyncSnapshot(_={}){let $=this.ensureWorkspace(),D=await this.machineTopology({includeTailscale:_.includeTailscale!==!1});return XX({dbPath:$.knowledgeDbPath,scope:this.scope,workspaceHome:$.home,storage:this.storageContract(),topology:D,machineId:_.machineId})}syncConflicts(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return[];return GX($.knowledgeDbPath,_)}syncConflict(_){let $=this.ensureWorkspace(),D=XI($.knowledgeDbPath,_);if(!D)throw Error(`Sync conflict not found: ${_}`);return D}proposeSyncConflictResolution(_){let $=this.ensureWorkspace();return oD($.knowledgeDbPath,_)}async proposeSyncConflictResolutionWithAi(_){let $=this.ensureWorkspace();return YR({dbPath:$.knowledgeDbPath,id:_.id,config:this.config(),modelRef:_.modelRef,fake:_.fake,env:_.env})}resolveSyncConflict(_){let $=this.ensureWorkspace(),D=oD($.knowledgeDbPath,_.id);if(_.approveWrite!==!0||!_.approvedBy)return{ok:!1,approval_required:!0,conflict:D.conflict,proposal:D,message:"Sync conflict resolution requires --approve-write and --approved-by "};let U=TX($.knowledgeDbPath,{id:_.id,strategy:_.strategy??D.proposed_strategy,approvedBy:_.approvedBy,proposedPatchUri:_.proposedPatchUri}),g=v($.knowledgeDbPath);try{let I=X_(g,{event_type:"sync_conflict_resolution",action:"sync.conflict.resolve",target_uri:`knowledge-sync-conflict://${_.id}`,decision:"allow",metadata:{conflict_id:_.id,entity_kind:U.entity_kind,entity_id:U.entity_id,strategy:U.resolution_strategy,approved_by:U.approved_by,proposed_patch_uri:U.proposed_patch_uri}});return{ok:!0,approval_required:!1,conflict:U,audit_event_id:I,message:`Resolved sync conflict ${_.id}`}}finally{g.close()}}syncMachines(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return[];return fE(_.knowledgeDbPath)}exportSyncBundle(_={}){let $=this.ensureWorkspace();return this.assertStorageValid("sync export"),h($.knowledgeDbPath),tD({dbPath:$.knowledgeDbPath,scope:this.scope,workspaceHome:$.home,storage:this.storageContract(),machineId:_.machineId??null,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.recordClocks!==!1})}async importSyncBundle(_){let $=this.ensureWorkspace();return this.assertStorageValid("sync import"),h($.knowledgeDbPath),WI({targetDbPath:$.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:$.home,targetStorage:this.storageContract(),targetStore:this.artifactStore(),bundle:_.bundle,direction:_.direction??"import",dryRun:_.dryRun,localMachineId:_.machineId??null})}async syncRemotePeer(_){let $=_.direction??"both",D=_.dryRun===!0,U=this.ensureWorkspace();h(U.knowledgeDbPath);let g=_.tables?.length?["--tables",_.tables.join(",")]:[],I=_.includeArtifactContent===!1?["--no-artifact-content"]:[],j=["--scope",this.scope,"--json"],N=await _3({machineId:_.machine,includeTailscale:_.includeTailscale}),O=await lj({machineId:_.machine,peerWorkspace:_.peerWorkspace,includeTailscale:_.includeTailscale});if(!_.peerWorkspace&&N.source==="raw"||!O.ok||!O.project_root){let J=u9(U.knowledgeDbPath,_.machine);if(J){if(!_.peerWorkspace&&N.source==="raw"&&J.ssh_target)N=x9(J,_.machine,N);if(!O.ok||!O.project_root){let P=y9(J,_.machine,O);if(P)O=P}}}if(!O.ok||!O.project_root)throw Error([`Unable to resolve peer workspace for ${_.machine}.`,"Pass --peer-workspace or configure workspace path mapping in machines.",O.warnings.length?`Warnings: ${O.warnings.join(", ")}`:null].filter(Boolean).join(" "));let A=O.project_root,L={ok:!0,dry_run:D,direction:$,transport:"ssh",machine:_.machine,resolved_machine:N.target,resolved_route:B3(N),resolved_workspace:LU(O,O.project_root),peer_workspace:A,message:""},z=!1,W=()=>{if(D||z)return;zX(U.knowledgeDbPath,{machineId:_.machine,route:N,workspace:O}),z=!0};if($==="pull"||$==="both"){let J=w9(A,["sync","export",...j,...g,...I]),P=t9(_.machine,J,void 0,N),S=o9(_.machine,"sync export",P);qb(_.machine,S),L.pull=await this.importSyncBundle({bundle:S,dryRun:D,direction:"pull",machineId:_.machineId??null})}if($==="push"||$==="both"){W();let J=this.exportSyncBundle({machineId:_.machineId??null,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:!D}),P=w9(A,["sync","import",...j,...D?["--dry-run"]:[]]),S=o9(_.machine,"sync import",t9(_.machine,P,JSON.stringify(J),N));Bb(_.machine,S),L.push=S}return L.ok=(L.pull?.ok??!0)&&(L.push?.ok??!0),W(),L.message=[h9(L.resolved_workspace),L.pull?`pull: ${L.pull.message}`:null,L.push?`push: ${L.push.message}`:null].filter(Boolean).join("; "),L}async syncPeer(_){let $=_.direction??"both",D=this.ensureWorkspace();h(D.knowledgeDbPath);let U=p9(_.peerWorkspace),g=sZ(U);h(g.knowledgeDbPath);let I=ZN(g.configPath),j=mU(I,g,this.scope),N=gE(I,g),O=_.machineId??q3(D),A=q3(g),L=await lj({machineId:_.machineId??A,peerWorkspace:U,includeTailscale:!1}),z=()=>tD({dbPath:D.knowledgeDbPath,scope:this.scope,workspaceHome:D.home,storage:this.storageContract(),machineId:O,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.dryRun!==!0}),W=()=>tD({dbPath:g.knowledgeDbPath,scope:this.scope,workspaceHome:g.home,storage:j,machineId:A,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.dryRun!==!0}),J={ok:!0,dry_run:_.dryRun===!0,direction:$,resolved_workspace:LU(L,L.project_root??U),message:""};if($==="pull"||$==="both")J.pull=await WI({targetDbPath:D.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:D.home,targetStorage:this.storageContract(),targetStore:this.artifactStore(),bundle:W(),targetBundle:z(),direction:"pull",dryRun:_.dryRun,localMachineId:O});if($==="push"||$==="both")J.push=await WI({targetDbPath:g.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:g.home,targetStorage:j,targetStore:N,bundle:z(),targetBundle:W(),direction:"push",dryRun:_.dryRun,localMachineId:A});return J.ok=(J.pull?.ok??!0)&&(J.push?.ok??!0),J.message=[h9(J.resolved_workspace),J.pull?`pull: ${J.pull.message}`:null,J.push?`push: ${J.push.message}`:null].filter(Boolean).join("; "),J}}function IN(_={}){return new DG(_)}import{createHash as gG}from"crypto";var Kb=Object.defineProperty,Fb=(_)=>_;function Mb(_,$){this[_]=Fb.bind(null,$)}var Zb=(_,$)=>{for(var D in $)Kb(_,D,{get:$[D],enumerable:!0,configurable:!0,set:Mb.bind($,D)})},E={};Zb(E,{void:()=>PH,util:()=>U_,unknown:()=>LH,union:()=>XH,undefined:()=>EH,tuple:()=>YH,transformer:()=>jG,symbol:()=>NH,string:()=>YG,strictObject:()=>WH,setErrorMap:()=>kb,set:()=>qH,record:()=>QH,quotelessJson:()=>bb,promise:()=>ZH,preprocess:()=>kH,pipeline:()=>CH,ostring:()=>rH,optional:()=>bH,onumber:()=>vH,oboolean:()=>fH,objectUtil:()=>C3,object:()=>SH,number:()=>QG,nullable:()=>HH,null:()=>OH,never:()=>JH,nativeEnum:()=>MH,nan:()=>UH,map:()=>TH,makeIssue:()=>EN,literal:()=>KH,lazy:()=>VH,late:()=>DH,isValid:()=>n4,isDirty:()=>v3,isAsync:()=>SU,isAborted:()=>r3,intersection:()=>GH,instanceof:()=>gH,getParsedType:()=>P6,getErrorMap:()=>NN,function:()=>BH,enum:()=>FH,effect:()=>jG,discriminatedUnion:()=>RH,defaultErrorMap:()=>OD,datetimeRegex:()=>XG,date:()=>jH,custom:()=>GG,coerce:()=>wH,boolean:()=>TG,bigint:()=>IH,array:()=>zH,any:()=>AH,addIssueToContext:()=>u,ZodVoid:()=>XU,ZodUnknown:()=>m6,ZodUnion:()=>PD,ZodUndefined:()=>LD,ZodType:()=>__,ZodTuple:()=>d$,ZodTransformer:()=>R$,ZodSymbol:()=>WU,ZodString:()=>F$,ZodSet:()=>i4,ZodSchema:()=>__,ZodRecord:()=>RU,ZodReadonly:()=>YD,ZodPromise:()=>l4,ZodPipeline:()=>QU,ZodParsedType:()=>y,ZodOptional:()=>Z$,ZodObject:()=>b_,ZodNumber:()=>i6,ZodNullable:()=>z6,ZodNull:()=>JD,ZodNever:()=>n$,ZodNativeEnum:()=>XD,ZodNaN:()=>YU,ZodMap:()=>GU,ZodLiteral:()=>WD,ZodLazy:()=>SD,ZodIssueCode:()=>k,ZodIntersection:()=>zD,ZodFunction:()=>ND,ZodFirstPartyTypeKind:()=>i,ZodError:()=>O$,ZodEnum:()=>t6,ZodEffects:()=>R$,ZodDiscriminatedUnion:()=>LN,ZodDefault:()=>RD,ZodDate:()=>d4,ZodCatch:()=>GD,ZodBranded:()=>JN,ZodBoolean:()=>AD,ZodBigInt:()=>l6,ZodArray:()=>M$,ZodAny:()=>m4,Schema:()=>__,ParseStatus:()=>m_,OK:()=>a_,NEVER:()=>uH,INVALID:()=>m,EMPTY_PATH:()=>Cb,DIRTY:()=>jD,BRAND:()=>$H});var U_;(function(_){_.assertEqual=(g)=>{};function $(g){}_.assertIs=$;function D(g){throw Error()}_.assertNever=D,_.arrayToEnum=(g)=>{let I={};for(let j of g)I[j]=j;return I},_.getValidEnumValues=(g)=>{let I=_.objectKeys(g).filter((N)=>typeof g[g[N]]!=="number"),j={};for(let N of I)j[N]=g[N];return _.objectValues(j)},_.objectValues=(g)=>{return _.objectKeys(g).map(function(I){return g[I]})},_.objectKeys=typeof Object.keys==="function"?(g)=>Object.keys(g):(g)=>{let I=[];for(let j in g)if(Object.prototype.hasOwnProperty.call(g,j))I.push(j);return I},_.find=(g,I)=>{for(let j of g)if(I(j))return j;return},_.isInteger=typeof Number.isInteger==="function"?(g)=>Number.isInteger(g):(g)=>typeof g==="number"&&Number.isFinite(g)&&Math.floor(g)===g;function U(g,I=" | "){return g.map((j)=>typeof j==="string"?`'${j}'`:j).join(I)}_.joinValues=U,_.jsonStringifyReplacer=(g,I)=>{if(typeof I==="bigint")return I.toString();return I}})(U_||(U_={}));var C3;(function(_){_.mergeShapes=($,D)=>{return{...$,...D}}})(C3||(C3={}));var y=U_.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),P6=(_)=>{switch(typeof _){case"undefined":return y.undefined;case"string":return y.string;case"number":return Number.isNaN(_)?y.nan:y.number;case"boolean":return y.boolean;case"function":return y.function;case"bigint":return y.bigint;case"symbol":return y.symbol;case"object":if(Array.isArray(_))return y.array;if(_===null)return y.null;if(_.then&&typeof _.then==="function"&&_.catch&&typeof _.catch==="function")return y.promise;if(typeof Map<"u"&&_ instanceof Map)return y.map;if(typeof Set<"u"&&_ instanceof Set)return y.set;if(typeof Date<"u"&&_ instanceof Date)return y.date;return y.object;default:return y.unknown}},k=U_.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),bb=(_)=>{return JSON.stringify(_,null,2).replace(/"([^"]+)":/g,"$1:")};class O$ extends Error{get errors(){return this.issues}constructor(_){super();this.issues=[],this.addIssue=(D)=>{this.issues=[...this.issues,D]},this.addIssues=(D=[])=>{this.issues=[...this.issues,...D]};let $=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,$);else this.__proto__=$;this.name="ZodError",this.issues=_}format(_){let $=_||function(g){return g.message},D={_errors:[]},U=(g)=>{for(let I of g.issues)if(I.code==="invalid_union")I.unionErrors.map(U);else if(I.code==="invalid_return_type")U(I.returnTypeError);else if(I.code==="invalid_arguments")U(I.argumentsError);else if(I.path.length===0)D._errors.push($(I));else{let j=D,N=0;while(N$.message){let $={},D=[];for(let U of this.issues)if(U.path.length>0){let g=U.path[0];$[g]=$[g]||[],$[g].push(_(U))}else D.push(_(U));return{formErrors:D,fieldErrors:$}}get formErrors(){return this.flatten()}}O$.create=(_)=>{return new O$(_)};var Hb=(_,$)=>{let D;switch(_.code){case k.invalid_type:if(_.received===y.undefined)D="Required";else D=`Expected ${_.expected}, received ${_.received}`;break;case k.invalid_literal:D=`Invalid literal value, expected ${JSON.stringify(_.expected,U_.jsonStringifyReplacer)}`;break;case k.unrecognized_keys:D=`Unrecognized key(s) in object: ${U_.joinValues(_.keys,", ")}`;break;case k.invalid_union:D="Invalid input";break;case k.invalid_union_discriminator:D=`Invalid discriminator value. Expected ${U_.joinValues(_.options)}`;break;case k.invalid_enum_value:D=`Invalid enum value. Expected ${U_.joinValues(_.options)}, received '${_.received}'`;break;case k.invalid_arguments:D="Invalid function arguments";break;case k.invalid_return_type:D="Invalid function return type";break;case k.invalid_date:D="Invalid date";break;case k.invalid_string:if(typeof _.validation==="object")if("includes"in _.validation){if(D=`Invalid input: must include "${_.validation.includes}"`,typeof _.validation.position==="number")D=`${D} at one or more positions greater than or equal to ${_.validation.position}`}else if("startsWith"in _.validation)D=`Invalid input: must start with "${_.validation.startsWith}"`;else if("endsWith"in _.validation)D=`Invalid input: must end with "${_.validation.endsWith}"`;else U_.assertNever(_.validation);else if(_.validation!=="regex")D=`Invalid ${_.validation}`;else D="Invalid";break;case k.too_small:if(_.type==="array")D=`Array must contain ${_.exact?"exactly":_.inclusive?"at least":"more than"} ${_.minimum} element(s)`;else if(_.type==="string")D=`String must contain ${_.exact?"exactly":_.inclusive?"at least":"over"} ${_.minimum} character(s)`;else if(_.type==="number")D=`Number must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${_.minimum}`;else if(_.type==="bigint")D=`Number must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${_.minimum}`;else if(_.type==="date")D=`Date must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${new Date(Number(_.minimum))}`;else D="Invalid input";break;case k.too_big:if(_.type==="array")D=`Array must contain ${_.exact?"exactly":_.inclusive?"at most":"less than"} ${_.maximum} element(s)`;else if(_.type==="string")D=`String must contain ${_.exact?"exactly":_.inclusive?"at most":"under"} ${_.maximum} character(s)`;else if(_.type==="number")D=`Number must be ${_.exact?"exactly":_.inclusive?"less than or equal to":"less than"} ${_.maximum}`;else if(_.type==="bigint")D=`BigInt must be ${_.exact?"exactly":_.inclusive?"less than or equal to":"less than"} ${_.maximum}`;else if(_.type==="date")D=`Date must be ${_.exact?"exactly":_.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number(_.maximum))}`;else D="Invalid input";break;case k.custom:D="Invalid input";break;case k.invalid_intersection_types:D="Intersection results could not be merged";break;case k.not_multiple_of:D=`Number must be a multiple of ${_.multipleOf}`;break;case k.not_finite:D="Number must be finite";break;default:D=$.defaultError,U_.assertNever(_)}return{message:D}},OD=Hb,zG=OD;function kb(_){zG=_}function NN(){return zG}var EN=(_)=>{let{data:$,path:D,errorMaps:U,issueData:g}=_,I=[...D,...g.path||[]],j={...g,path:I};if(g.message!==void 0)return{...g,path:I,message:g.message};let N="",O=U.filter((A)=>!!A).slice().reverse();for(let A of O)N=A(j,{data:$,defaultError:N}).message;return{...g,path:I,message:N}},Cb=[];function u(_,$){let D=NN(),U=EN({issueData:$,data:_.data,path:_.path,errorMaps:[_.common.contextualErrorMap,_.schemaErrorMap,D,D===OD?void 0:OD].filter((g)=>!!g)});_.common.issues.push(U)}class m_{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray(_,$){let D=[];for(let U of $){if(U.status==="aborted")return m;if(U.status==="dirty")_.dirty();D.push(U.value)}return{status:_.value,value:D}}static async mergeObjectAsync(_,$){let D=[];for(let U of $){let g=await U.key,I=await U.value;D.push({key:g,value:I})}return m_.mergeObjectSync(_,D)}static mergeObjectSync(_,$){let D={};for(let U of $){let{key:g,value:I}=U;if(g.status==="aborted")return m;if(I.status==="aborted")return m;if(g.status==="dirty")_.dirty();if(I.status==="dirty")_.dirty();if(g.value!=="__proto__"&&(typeof I.value<"u"||U.alwaysSet))D[g.value]=I.value}return{status:_.value,value:D}}}var m=Object.freeze({status:"aborted"}),jD=(_)=>({status:"dirty",value:_}),a_=(_)=>({status:"valid",value:_}),r3=(_)=>_.status==="aborted",v3=(_)=>_.status==="dirty",n4=(_)=>_.status==="valid",SU=(_)=>typeof Promise<"u"&&_ instanceof Promise,n;(function(_){_.errToObj=($)=>typeof $==="string"?{message:$}:$||{},_.toString=($)=>typeof $==="string"?$:$?.message})(n||(n={}));class b${constructor(_,$,D,U){this._cachedPath=[],this.parent=_,this.data=$,this._path=D,this._key=U}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var UG=(_,$)=>{if(n4($))return{success:!0,data:$.value};else{if(!_.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let D=new O$(_.common.issues);return this._error=D,this._error}}}};function p(_){if(!_)return{};let{errorMap:$,invalid_type_error:D,required_error:U,description:g}=_;if($&&(D||U))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if($)return{errorMap:$,description:g};return{errorMap:(j,N)=>{let{message:O}=_;if(j.code==="invalid_enum_value")return{message:O??N.defaultError};if(typeof N.data>"u")return{message:O??U??N.defaultError};if(j.code!=="invalid_type")return{message:N.defaultError};return{message:O??D??N.defaultError}},description:g}}class __{get description(){return this._def.description}_getType(_){return P6(_.data)}_getOrReturnCtx(_,$){return $||{common:_.parent.common,data:_.data,parsedType:P6(_.data),schemaErrorMap:this._def.errorMap,path:_.path,parent:_.parent}}_processInputParams(_){return{status:new m_,ctx:{common:_.parent.common,data:_.data,parsedType:P6(_.data),schemaErrorMap:this._def.errorMap,path:_.path,parent:_.parent}}}_parseSync(_){let $=this._parse(_);if(SU($))throw Error("Synchronous parse encountered promise.");return $}_parseAsync(_){let $=this._parse(_);return Promise.resolve($)}parse(_,$){let D=this.safeParse(_,$);if(D.success)return D.data;throw D.error}safeParse(_,$){let D={common:{issues:[],async:$?.async??!1,contextualErrorMap:$?.errorMap},path:$?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)},U=this._parseSync({data:_,path:D.path,parent:D});return UG(D,U)}"~validate"(_){let $={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)};if(!this["~standard"].async)try{let D=this._parseSync({data:_,path:[],parent:$});return n4(D)?{value:D.value}:{issues:$.common.issues}}catch(D){if(D?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;$.common={issues:[],async:!0}}return this._parseAsync({data:_,path:[],parent:$}).then((D)=>n4(D)?{value:D.value}:{issues:$.common.issues})}async parseAsync(_,$){let D=await this.safeParseAsync(_,$);if(D.success)return D.data;throw D.error}async safeParseAsync(_,$){let D={common:{issues:[],contextualErrorMap:$?.errorMap,async:!0},path:$?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)},U=this._parse({data:_,path:D.path,parent:D}),g=await(SU(U)?U:Promise.resolve(U));return UG(D,g)}refine(_,$){let D=(U)=>{if(typeof $==="string"||typeof $>"u")return{message:$};else if(typeof $==="function")return $(U);else return $};return this._refinement((U,g)=>{let I=_(U),j=()=>g.addIssue({code:k.custom,...D(U)});if(typeof Promise<"u"&&I instanceof Promise)return I.then((N)=>{if(!N)return j(),!1;else return!0});if(!I)return j(),!1;else return!0})}refinement(_,$){return this._refinement((D,U)=>{if(!_(D))return U.addIssue(typeof $==="function"?$(D,U):$),!1;else return!0})}_refinement(_){return new R$({schema:this,typeName:i.ZodEffects,effect:{type:"refinement",refinement:_}})}superRefine(_){return this._refinement(_)}constructor(_){this.spa=this.safeParseAsync,this._def=_,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:($)=>this["~validate"]($)}}optional(){return Z$.create(this,this._def)}nullable(){return z6.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return M$.create(this)}promise(){return l4.create(this,this._def)}or(_){return PD.create([this,_],this._def)}and(_){return zD.create(this,_,this._def)}transform(_){return new R$({...p(this._def),schema:this,typeName:i.ZodEffects,effect:{type:"transform",transform:_}})}default(_){let $=typeof _==="function"?_:()=>_;return new RD({...p(this._def),innerType:this,defaultValue:$,typeName:i.ZodDefault})}brand(){return new JN({typeName:i.ZodBranded,type:this,...p(this._def)})}catch(_){let $=typeof _==="function"?_:()=>_;return new GD({...p(this._def),innerType:this,catchValue:$,typeName:i.ZodCatch})}describe(_){return new this.constructor({...this._def,description:_})}pipe(_){return QU.create(this,_)}readonly(){return YD.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var rb=/^c[^\s-]{8,}$/i,vb=/^[0-9a-z]+$/,fb=/^[0-9A-HJKMNP-TV-Z]{26}$/i,wb=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,ub=/^[a-z0-9_-]{21}$/i,xb=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,yb=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,hb=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,cb="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",H3,nb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,db=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,mb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,ib=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,lb=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,tb=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,SG="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",ob=new RegExp(`^${SG}$`);function WG(_){let $="[0-5]\\d";if(_.precision)$=`${$}\\.\\d{${_.precision}}`;else if(_.precision==null)$=`${$}(\\.\\d+)?`;let D=_.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${$})${D}`}function pb(_){return new RegExp(`^${WG(_)}$`)}function XG(_){let $=`${SG}T${WG(_)}`,D=[];if(D.push(_.local?"Z?":"Z"),_.offset)D.push("([+-]\\d{2}:?\\d{2})");return $=`${$}(${D.join("|")})`,new RegExp(`^${$}$`)}function eb(_,$){if(($==="v4"||!$)&&nb.test(_))return!0;if(($==="v6"||!$)&&mb.test(_))return!0;return!1}function ab(_,$){if(!xb.test(_))return!1;try{let[D]=_.split(".");if(!D)return!1;let U=D.replace(/-/g,"+").replace(/_/g,"/").padEnd(D.length+(4-D.length%4)%4,"="),g=JSON.parse(atob(U));if(typeof g!=="object"||g===null)return!1;if("typ"in g&&g?.typ!=="JWT")return!1;if(!g.alg)return!1;if($&&g.alg!==$)return!1;return!0}catch{return!1}}function sb(_,$){if(($==="v4"||!$)&&db.test(_))return!0;if(($==="v6"||!$)&&ib.test(_))return!0;return!1}class F$ extends __{_parse(_){if(this._def.coerce)_.data=String(_.data);if(this._getType(_)!==y.string){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.string,received:g.parsedType}),m}let D=new m_,U=void 0;for(let g of this._def.checks)if(g.kind==="min"){if(_.data.lengthg.value)U=this._getOrReturnCtx(_,U),u(U,{code:k.too_big,maximum:g.value,type:"string",inclusive:!0,exact:!1,message:g.message}),D.dirty()}else if(g.kind==="length"){let I=_.data.length>g.value,j=_.data.length_.test(U),{validation:$,code:k.invalid_string,...n.errToObj(D)})}_addCheck(_){return new F$({...this._def,checks:[...this._def.checks,_]})}email(_){return this._addCheck({kind:"email",...n.errToObj(_)})}url(_){return this._addCheck({kind:"url",...n.errToObj(_)})}emoji(_){return this._addCheck({kind:"emoji",...n.errToObj(_)})}uuid(_){return this._addCheck({kind:"uuid",...n.errToObj(_)})}nanoid(_){return this._addCheck({kind:"nanoid",...n.errToObj(_)})}cuid(_){return this._addCheck({kind:"cuid",...n.errToObj(_)})}cuid2(_){return this._addCheck({kind:"cuid2",...n.errToObj(_)})}ulid(_){return this._addCheck({kind:"ulid",...n.errToObj(_)})}base64(_){return this._addCheck({kind:"base64",...n.errToObj(_)})}base64url(_){return this._addCheck({kind:"base64url",...n.errToObj(_)})}jwt(_){return this._addCheck({kind:"jwt",...n.errToObj(_)})}ip(_){return this._addCheck({kind:"ip",...n.errToObj(_)})}cidr(_){return this._addCheck({kind:"cidr",...n.errToObj(_)})}datetime(_){if(typeof _==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:_});return this._addCheck({kind:"datetime",precision:typeof _?.precision>"u"?null:_?.precision,offset:_?.offset??!1,local:_?.local??!1,...n.errToObj(_?.message)})}date(_){return this._addCheck({kind:"date",message:_})}time(_){if(typeof _==="string")return this._addCheck({kind:"time",precision:null,message:_});return this._addCheck({kind:"time",precision:typeof _?.precision>"u"?null:_?.precision,...n.errToObj(_?.message)})}duration(_){return this._addCheck({kind:"duration",...n.errToObj(_)})}regex(_,$){return this._addCheck({kind:"regex",regex:_,...n.errToObj($)})}includes(_,$){return this._addCheck({kind:"includes",value:_,position:$?.position,...n.errToObj($?.message)})}startsWith(_,$){return this._addCheck({kind:"startsWith",value:_,...n.errToObj($)})}endsWith(_,$){return this._addCheck({kind:"endsWith",value:_,...n.errToObj($)})}min(_,$){return this._addCheck({kind:"min",value:_,...n.errToObj($)})}max(_,$){return this._addCheck({kind:"max",value:_,...n.errToObj($)})}length(_,$){return this._addCheck({kind:"length",value:_,...n.errToObj($)})}nonempty(_){return this.min(1,n.errToObj(_))}trim(){return new F$({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new F$({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new F$({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find((_)=>_.kind==="datetime")}get isDate(){return!!this._def.checks.find((_)=>_.kind==="date")}get isTime(){return!!this._def.checks.find((_)=>_.kind==="time")}get isDuration(){return!!this._def.checks.find((_)=>_.kind==="duration")}get isEmail(){return!!this._def.checks.find((_)=>_.kind==="email")}get isURL(){return!!this._def.checks.find((_)=>_.kind==="url")}get isEmoji(){return!!this._def.checks.find((_)=>_.kind==="emoji")}get isUUID(){return!!this._def.checks.find((_)=>_.kind==="uuid")}get isNANOID(){return!!this._def.checks.find((_)=>_.kind==="nanoid")}get isCUID(){return!!this._def.checks.find((_)=>_.kind==="cuid")}get isCUID2(){return!!this._def.checks.find((_)=>_.kind==="cuid2")}get isULID(){return!!this._def.checks.find((_)=>_.kind==="ulid")}get isIP(){return!!this._def.checks.find((_)=>_.kind==="ip")}get isCIDR(){return!!this._def.checks.find((_)=>_.kind==="cidr")}get isBase64(){return!!this._def.checks.find((_)=>_.kind==="base64")}get isBase64url(){return!!this._def.checks.find((_)=>_.kind==="base64url")}get minLength(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxLength(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}}F$.create=(_)=>{return new F$({checks:[],typeName:i.ZodString,coerce:_?.coerce??!1,...p(_)})};function _H(_,$){let D=(_.toString().split(".")[1]||"").length,U=($.toString().split(".")[1]||"").length,g=D>U?D:U,I=Number.parseInt(_.toFixed(g).replace(".","")),j=Number.parseInt($.toFixed(g).replace(".",""));return I%j/10**g}class i6 extends __{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse(_){if(this._def.coerce)_.data=Number(_.data);if(this._getType(_)!==y.number){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.number,received:g.parsedType}),m}let D=void 0,U=new m_;for(let g of this._def.checks)if(g.kind==="int"){if(!U_.isInteger(_.data))D=this._getOrReturnCtx(_,D),u(D,{code:k.invalid_type,expected:"integer",received:"float",message:g.message}),U.dirty()}else if(g.kind==="min"){if(g.inclusive?_.datag.value:_.data>=g.value)D=this._getOrReturnCtx(_,D),u(D,{code:k.too_big,maximum:g.value,type:"number",inclusive:g.inclusive,exact:!1,message:g.message}),U.dirty()}else if(g.kind==="multipleOf"){if(_H(_.data,g.value)!==0)D=this._getOrReturnCtx(_,D),u(D,{code:k.not_multiple_of,multipleOf:g.value,message:g.message}),U.dirty()}else if(g.kind==="finite"){if(!Number.isFinite(_.data))D=this._getOrReturnCtx(_,D),u(D,{code:k.not_finite,message:g.message}),U.dirty()}else U_.assertNever(g);return{status:U.value,value:_.data}}gte(_,$){return this.setLimit("min",_,!0,n.toString($))}gt(_,$){return this.setLimit("min",_,!1,n.toString($))}lte(_,$){return this.setLimit("max",_,!0,n.toString($))}lt(_,$){return this.setLimit("max",_,!1,n.toString($))}setLimit(_,$,D,U){return new i6({...this._def,checks:[...this._def.checks,{kind:_,value:$,inclusive:D,message:n.toString(U)}]})}_addCheck(_){return new i6({...this._def,checks:[...this._def.checks,_]})}int(_){return this._addCheck({kind:"int",message:n.toString(_)})}positive(_){return this._addCheck({kind:"min",value:0,inclusive:!1,message:n.toString(_)})}negative(_){return this._addCheck({kind:"max",value:0,inclusive:!1,message:n.toString(_)})}nonpositive(_){return this._addCheck({kind:"max",value:0,inclusive:!0,message:n.toString(_)})}nonnegative(_){return this._addCheck({kind:"min",value:0,inclusive:!0,message:n.toString(_)})}multipleOf(_,$){return this._addCheck({kind:"multipleOf",value:_,message:n.toString($)})}finite(_){return this._addCheck({kind:"finite",message:n.toString(_)})}safe(_){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:n.toString(_)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:n.toString(_)})}get minValue(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxValue(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}get isInt(){return!!this._def.checks.find((_)=>_.kind==="int"||_.kind==="multipleOf"&&U_.isInteger(_.value))}get isFinite(){let _=null,$=null;for(let D of this._def.checks)if(D.kind==="finite"||D.kind==="int"||D.kind==="multipleOf")return!0;else if(D.kind==="min"){if($===null||D.value>$)$=D.value}else if(D.kind==="max"){if(_===null||D.value<_)_=D.value}return Number.isFinite($)&&Number.isFinite(_)}}i6.create=(_)=>{return new i6({checks:[],typeName:i.ZodNumber,coerce:_?.coerce||!1,...p(_)})};class l6 extends __{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse(_){if(this._def.coerce)try{_.data=BigInt(_.data)}catch{return this._getInvalidInput(_)}if(this._getType(_)!==y.bigint)return this._getInvalidInput(_);let D=void 0,U=new m_;for(let g of this._def.checks)if(g.kind==="min"){if(g.inclusive?_.datag.value:_.data>=g.value)D=this._getOrReturnCtx(_,D),u(D,{code:k.too_big,type:"bigint",maximum:g.value,inclusive:g.inclusive,message:g.message}),U.dirty()}else if(g.kind==="multipleOf"){if(_.data%g.value!==BigInt(0))D=this._getOrReturnCtx(_,D),u(D,{code:k.not_multiple_of,multipleOf:g.value,message:g.message}),U.dirty()}else U_.assertNever(g);return{status:U.value,value:_.data}}_getInvalidInput(_){let $=this._getOrReturnCtx(_);return u($,{code:k.invalid_type,expected:y.bigint,received:$.parsedType}),m}gte(_,$){return this.setLimit("min",_,!0,n.toString($))}gt(_,$){return this.setLimit("min",_,!1,n.toString($))}lte(_,$){return this.setLimit("max",_,!0,n.toString($))}lt(_,$){return this.setLimit("max",_,!1,n.toString($))}setLimit(_,$,D,U){return new l6({...this._def,checks:[...this._def.checks,{kind:_,value:$,inclusive:D,message:n.toString(U)}]})}_addCheck(_){return new l6({...this._def,checks:[...this._def.checks,_]})}positive(_){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:n.toString(_)})}negative(_){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:n.toString(_)})}nonpositive(_){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:n.toString(_)})}nonnegative(_){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:n.toString(_)})}multipleOf(_,$){return this._addCheck({kind:"multipleOf",value:_,message:n.toString($)})}get minValue(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxValue(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}}l6.create=(_)=>{return new l6({checks:[],typeName:i.ZodBigInt,coerce:_?.coerce??!1,...p(_)})};class AD extends __{_parse(_){if(this._def.coerce)_.data=Boolean(_.data);if(this._getType(_)!==y.boolean){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.boolean,received:D.parsedType}),m}return a_(_.data)}}AD.create=(_)=>{return new AD({typeName:i.ZodBoolean,coerce:_?.coerce||!1,...p(_)})};class d4 extends __{_parse(_){if(this._def.coerce)_.data=new Date(_.data);if(this._getType(_)!==y.date){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.date,received:g.parsedType}),m}if(Number.isNaN(_.data.getTime())){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_date}),m}let D=new m_,U=void 0;for(let g of this._def.checks)if(g.kind==="min"){if(_.data.getTime()g.value)U=this._getOrReturnCtx(_,U),u(U,{code:k.too_big,message:g.message,inclusive:!0,exact:!1,maximum:g.value,type:"date"}),D.dirty()}else U_.assertNever(g);return{status:D.value,value:new Date(_.data.getTime())}}_addCheck(_){return new d4({...this._def,checks:[...this._def.checks,_]})}min(_,$){return this._addCheck({kind:"min",value:_.getTime(),message:n.toString($)})}max(_,$){return this._addCheck({kind:"max",value:_.getTime(),message:n.toString($)})}get minDate(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _!=null?new Date(_):null}get maxDate(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _!=null?new Date(_):null}}d4.create=(_)=>{return new d4({checks:[],coerce:_?.coerce||!1,typeName:i.ZodDate,...p(_)})};class WU extends __{_parse(_){if(this._getType(_)!==y.symbol){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.symbol,received:D.parsedType}),m}return a_(_.data)}}WU.create=(_)=>{return new WU({typeName:i.ZodSymbol,...p(_)})};class LD extends __{_parse(_){if(this._getType(_)!==y.undefined){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.undefined,received:D.parsedType}),m}return a_(_.data)}}LD.create=(_)=>{return new LD({typeName:i.ZodUndefined,...p(_)})};class JD extends __{_parse(_){if(this._getType(_)!==y.null){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.null,received:D.parsedType}),m}return a_(_.data)}}JD.create=(_)=>{return new JD({typeName:i.ZodNull,...p(_)})};class m4 extends __{constructor(){super(...arguments);this._any=!0}_parse(_){return a_(_.data)}}m4.create=(_)=>{return new m4({typeName:i.ZodAny,...p(_)})};class m6 extends __{constructor(){super(...arguments);this._unknown=!0}_parse(_){return a_(_.data)}}m6.create=(_)=>{return new m6({typeName:i.ZodUnknown,...p(_)})};class n$ extends __{_parse(_){let $=this._getOrReturnCtx(_);return u($,{code:k.invalid_type,expected:y.never,received:$.parsedType}),m}}n$.create=(_)=>{return new n$({typeName:i.ZodNever,...p(_)})};class XU extends __{_parse(_){if(this._getType(_)!==y.undefined){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.void,received:D.parsedType}),m}return a_(_.data)}}XU.create=(_)=>{return new XU({typeName:i.ZodVoid,...p(_)})};class M$ extends __{_parse(_){let{ctx:$,status:D}=this._processInputParams(_),U=this._def;if($.parsedType!==y.array)return u($,{code:k.invalid_type,expected:y.array,received:$.parsedType}),m;if(U.exactLength!==null){let I=$.data.length>U.exactLength.value,j=$.data.lengthU.maxLength.value)u($,{code:k.too_big,maximum:U.maxLength.value,type:"array",inclusive:!0,exact:!1,message:U.maxLength.message}),D.dirty()}if($.common.async)return Promise.all([...$.data].map((I,j)=>{return U.type._parseAsync(new b$($,I,$.path,j))})).then((I)=>{return m_.mergeArray(D,I)});let g=[...$.data].map((I,j)=>{return U.type._parseSync(new b$($,I,$.path,j))});return m_.mergeArray(D,g)}get element(){return this._def.type}min(_,$){return new M$({...this._def,minLength:{value:_,message:n.toString($)}})}max(_,$){return new M$({...this._def,maxLength:{value:_,message:n.toString($)}})}length(_,$){return new M$({...this._def,exactLength:{value:_,message:n.toString($)}})}nonempty(_){return this.min(1,_)}}M$.create=(_,$)=>{return new M$({type:_,minLength:null,maxLength:null,exactLength:null,typeName:i.ZodArray,...p($)})};function UD(_){if(_ instanceof b_){let $={};for(let D in _.shape){let U=_.shape[D];$[D]=Z$.create(UD(U))}return new b_({..._._def,shape:()=>$})}else if(_ instanceof M$)return new M$({..._._def,type:UD(_.element)});else if(_ instanceof Z$)return Z$.create(UD(_.unwrap()));else if(_ instanceof z6)return z6.create(UD(_.unwrap()));else if(_ instanceof d$)return d$.create(_.items.map(($)=>UD($)));else return _}class b_ extends __{constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let _=this._def.shape(),$=U_.objectKeys(_);return this._cached={shape:_,keys:$},this._cached}_parse(_){if(this._getType(_)!==y.object){let O=this._getOrReturnCtx(_);return u(O,{code:k.invalid_type,expected:y.object,received:O.parsedType}),m}let{status:D,ctx:U}=this._processInputParams(_),{shape:g,keys:I}=this._getCached(),j=[];if(!(this._def.catchall instanceof n$&&this._def.unknownKeys==="strip")){for(let O in U.data)if(!I.includes(O))j.push(O)}let N=[];for(let O of I){let A=g[O],L=U.data[O];N.push({key:{status:"valid",value:O},value:A._parse(new b$(U,L,U.path,O)),alwaysSet:O in U.data})}if(this._def.catchall instanceof n$){let O=this._def.unknownKeys;if(O==="passthrough")for(let A of j)N.push({key:{status:"valid",value:A},value:{status:"valid",value:U.data[A]}});else if(O==="strict"){if(j.length>0)u(U,{code:k.unrecognized_keys,keys:j}),D.dirty()}else if(O==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let O=this._def.catchall;for(let A of j){let L=U.data[A];N.push({key:{status:"valid",value:A},value:O._parse(new b$(U,L,U.path,A)),alwaysSet:A in U.data})}}if(U.common.async)return Promise.resolve().then(async()=>{let O=[];for(let A of N){let L=await A.key,z=await A.value;O.push({key:L,value:z,alwaysSet:A.alwaysSet})}return O}).then((O)=>{return m_.mergeObjectSync(D,O)});else return m_.mergeObjectSync(D,N)}get shape(){return this._def.shape()}strict(_){return n.errToObj,new b_({...this._def,unknownKeys:"strict",..._!==void 0?{errorMap:($,D)=>{let U=this._def.errorMap?.($,D).message??D.defaultError;if($.code==="unrecognized_keys")return{message:n.errToObj(_).message??U};return{message:U}}}:{}})}strip(){return new b_({...this._def,unknownKeys:"strip"})}passthrough(){return new b_({...this._def,unknownKeys:"passthrough"})}extend(_){return new b_({...this._def,shape:()=>({...this._def.shape(),..._})})}merge(_){return new b_({unknownKeys:_._def.unknownKeys,catchall:_._def.catchall,shape:()=>({...this._def.shape(),..._._def.shape()}),typeName:i.ZodObject})}setKey(_,$){return this.augment({[_]:$})}catchall(_){return new b_({...this._def,catchall:_})}pick(_){let $={};for(let D of U_.objectKeys(_))if(_[D]&&this.shape[D])$[D]=this.shape[D];return new b_({...this._def,shape:()=>$})}omit(_){let $={};for(let D of U_.objectKeys(this.shape))if(!_[D])$[D]=this.shape[D];return new b_({...this._def,shape:()=>$})}deepPartial(){return UD(this)}partial(_){let $={};for(let D of U_.objectKeys(this.shape)){let U=this.shape[D];if(_&&!_[D])$[D]=U;else $[D]=U.optional()}return new b_({...this._def,shape:()=>$})}required(_){let $={};for(let D of U_.objectKeys(this.shape))if(_&&!_[D])$[D]=this.shape[D];else{let g=this.shape[D];while(g instanceof Z$)g=g._def.innerType;$[D]=g}return new b_({...this._def,shape:()=>$})}keyof(){return RG(U_.objectKeys(this.shape))}}b_.create=(_,$)=>{return new b_({shape:()=>_,unknownKeys:"strip",catchall:n$.create(),typeName:i.ZodObject,...p($)})};b_.strictCreate=(_,$)=>{return new b_({shape:()=>_,unknownKeys:"strict",catchall:n$.create(),typeName:i.ZodObject,...p($)})};b_.lazycreate=(_,$)=>{return new b_({shape:_,unknownKeys:"strip",catchall:n$.create(),typeName:i.ZodObject,...p($)})};class PD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=this._def.options;function U(g){for(let j of g)if(j.result.status==="valid")return j.result;for(let j of g)if(j.result.status==="dirty")return $.common.issues.push(...j.ctx.common.issues),j.result;let I=g.map((j)=>new O$(j.ctx.common.issues));return u($,{code:k.invalid_union,unionErrors:I}),m}if($.common.async)return Promise.all(D.map(async(g)=>{let I={...$,common:{...$.common,issues:[]},parent:null};return{result:await g._parseAsync({data:$.data,path:$.path,parent:I}),ctx:I}})).then(U);else{let g=void 0,I=[];for(let N of D){let O={...$,common:{...$.common,issues:[]},parent:null},A=N._parseSync({data:$.data,path:$.path,parent:O});if(A.status==="valid")return A;else if(A.status==="dirty"&&!g)g={result:A,ctx:O};if(O.common.issues.length)I.push(O.common.issues)}if(g)return $.common.issues.push(...g.ctx.common.issues),g.result;let j=I.map((N)=>new O$(N));return u($,{code:k.invalid_union,unionErrors:j}),m}}get options(){return this._def.options}}PD.create=(_,$)=>{return new PD({options:_,typeName:i.ZodUnion,...p($)})};var J6=(_)=>{if(_ instanceof SD)return J6(_.schema);else if(_ instanceof R$)return J6(_.innerType());else if(_ instanceof WD)return[_.value];else if(_ instanceof t6)return _.options;else if(_ instanceof XD)return U_.objectValues(_.enum);else if(_ instanceof RD)return J6(_._def.innerType);else if(_ instanceof LD)return[void 0];else if(_ instanceof JD)return[null];else if(_ instanceof Z$)return[void 0,...J6(_.unwrap())];else if(_ instanceof z6)return[null,...J6(_.unwrap())];else if(_ instanceof JN)return J6(_.unwrap());else if(_ instanceof YD)return J6(_.unwrap());else if(_ instanceof GD)return J6(_._def.innerType);else return[]};class LN extends __{_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.object)return u($,{code:k.invalid_type,expected:y.object,received:$.parsedType}),m;let D=this.discriminator,U=$.data[D],g=this.optionsMap.get(U);if(!g)return u($,{code:k.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[D]}),m;if($.common.async)return g._parseAsync({data:$.data,path:$.path,parent:$});else return g._parseSync({data:$.data,path:$.path,parent:$})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create(_,$,D){let U=new Map;for(let g of $){let I=J6(g.shape[_]);if(!I.length)throw Error(`A discriminator value for key \`${_}\` could not be extracted from all schema options`);for(let j of I){if(U.has(j))throw Error(`Discriminator property ${String(_)} has duplicate value ${String(j)}`);U.set(j,g)}}return new LN({typeName:i.ZodDiscriminatedUnion,discriminator:_,options:$,optionsMap:U,...p(D)})}}function f3(_,$){let D=P6(_),U=P6($);if(_===$)return{valid:!0,data:_};else if(D===y.object&&U===y.object){let g=U_.objectKeys($),I=U_.objectKeys(_).filter((N)=>g.indexOf(N)!==-1),j={..._,...$};for(let N of I){let O=f3(_[N],$[N]);if(!O.valid)return{valid:!1};j[N]=O.data}return{valid:!0,data:j}}else if(D===y.array&&U===y.array){if(_.length!==$.length)return{valid:!1};let g=[];for(let I=0;I<_.length;I++){let j=_[I],N=$[I],O=f3(j,N);if(!O.valid)return{valid:!1};g.push(O.data)}return{valid:!0,data:g}}else if(D===y.date&&U===y.date&&+_===+$)return{valid:!0,data:_};else return{valid:!1}}class zD extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_),U=(g,I)=>{if(r3(g)||r3(I))return m;let j=f3(g.value,I.value);if(!j.valid)return u(D,{code:k.invalid_intersection_types}),m;if(v3(g)||v3(I))$.dirty();return{status:$.value,value:j.data}};if(D.common.async)return Promise.all([this._def.left._parseAsync({data:D.data,path:D.path,parent:D}),this._def.right._parseAsync({data:D.data,path:D.path,parent:D})]).then(([g,I])=>U(g,I));else return U(this._def.left._parseSync({data:D.data,path:D.path,parent:D}),this._def.right._parseSync({data:D.data,path:D.path,parent:D}))}}zD.create=(_,$,D)=>{return new zD({left:_,right:$,typeName:i.ZodIntersection,...p(D)})};class d$ extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.array)return u(D,{code:k.invalid_type,expected:y.array,received:D.parsedType}),m;if(D.data.lengththis._def.items.length)u(D,{code:k.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),$.dirty();let g=[...D.data].map((I,j)=>{let N=this._def.items[j]||this._def.rest;if(!N)return null;return N._parse(new b$(D,I,D.path,j))}).filter((I)=>!!I);if(D.common.async)return Promise.all(g).then((I)=>{return m_.mergeArray($,I)});else return m_.mergeArray($,g)}get items(){return this._def.items}rest(_){return new d$({...this._def,rest:_})}}d$.create=(_,$)=>{if(!Array.isArray(_))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new d$({items:_,typeName:i.ZodTuple,rest:null,...p($)})};class RU extends __{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.object)return u(D,{code:k.invalid_type,expected:y.object,received:D.parsedType}),m;let U=[],g=this._def.keyType,I=this._def.valueType;for(let j in D.data)U.push({key:g._parse(new b$(D,j,D.path,j)),value:I._parse(new b$(D,D.data[j],D.path,j)),alwaysSet:j in D.data});if(D.common.async)return m_.mergeObjectAsync($,U);else return m_.mergeObjectSync($,U)}get element(){return this._def.valueType}static create(_,$,D){if($ instanceof __)return new RU({keyType:_,valueType:$,typeName:i.ZodRecord,...p(D)});return new RU({keyType:F$.create(),valueType:_,typeName:i.ZodRecord,...p($)})}}class GU extends __{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.map)return u(D,{code:k.invalid_type,expected:y.map,received:D.parsedType}),m;let U=this._def.keyType,g=this._def.valueType,I=[...D.data.entries()].map(([j,N],O)=>{return{key:U._parse(new b$(D,j,D.path,[O,"key"])),value:g._parse(new b$(D,N,D.path,[O,"value"]))}});if(D.common.async){let j=new Map;return Promise.resolve().then(async()=>{for(let N of I){let O=await N.key,A=await N.value;if(O.status==="aborted"||A.status==="aborted")return m;if(O.status==="dirty"||A.status==="dirty")$.dirty();j.set(O.value,A.value)}return{status:$.value,value:j}})}else{let j=new Map;for(let N of I){let{key:O,value:A}=N;if(O.status==="aborted"||A.status==="aborted")return m;if(O.status==="dirty"||A.status==="dirty")$.dirty();j.set(O.value,A.value)}return{status:$.value,value:j}}}}GU.create=(_,$,D)=>{return new GU({valueType:$,keyType:_,typeName:i.ZodMap,...p(D)})};class i4 extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.set)return u(D,{code:k.invalid_type,expected:y.set,received:D.parsedType}),m;let U=this._def;if(U.minSize!==null){if(D.data.sizeU.maxSize.value)u(D,{code:k.too_big,maximum:U.maxSize.value,type:"set",inclusive:!0,exact:!1,message:U.maxSize.message}),$.dirty()}let g=this._def.valueType;function I(N){let O=new Set;for(let A of N){if(A.status==="aborted")return m;if(A.status==="dirty")$.dirty();O.add(A.value)}return{status:$.value,value:O}}let j=[...D.data.values()].map((N,O)=>g._parse(new b$(D,N,D.path,O)));if(D.common.async)return Promise.all(j).then((N)=>I(N));else return I(j)}min(_,$){return new i4({...this._def,minSize:{value:_,message:n.toString($)}})}max(_,$){return new i4({...this._def,maxSize:{value:_,message:n.toString($)}})}size(_,$){return this.min(_,$).max(_,$)}nonempty(_){return this.min(1,_)}}i4.create=(_,$)=>{return new i4({valueType:_,minSize:null,maxSize:null,typeName:i.ZodSet,...p($)})};class ND extends __{constructor(){super(...arguments);this.validate=this.implement}_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.function)return u($,{code:k.invalid_type,expected:y.function,received:$.parsedType}),m;function D(j,N){return EN({data:j,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,NN(),OD].filter((O)=>!!O),issueData:{code:k.invalid_arguments,argumentsError:N}})}function U(j,N){return EN({data:j,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,NN(),OD].filter((O)=>!!O),issueData:{code:k.invalid_return_type,returnTypeError:N}})}let g={errorMap:$.common.contextualErrorMap},I=$.data;if(this._def.returns instanceof l4){let j=this;return a_(async function(...N){let O=new O$([]),A=await j._def.args.parseAsync(N,g).catch((W)=>{throw O.addIssue(D(N,W)),O}),L=await Reflect.apply(I,this,A);return await j._def.returns._def.type.parseAsync(L,g).catch((W)=>{throw O.addIssue(U(L,W)),O})})}else{let j=this;return a_(function(...N){let O=j._def.args.safeParse(N,g);if(!O.success)throw new O$([D(N,O.error)]);let A=Reflect.apply(I,this,O.data),L=j._def.returns.safeParse(A,g);if(!L.success)throw new O$([U(A,L.error)]);return L.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(..._){return new ND({...this._def,args:d$.create(_).rest(m6.create())})}returns(_){return new ND({...this._def,returns:_})}implement(_){return this.parse(_)}strictImplement(_){return this.parse(_)}static create(_,$,D){return new ND({args:_?_:d$.create([]).rest(m6.create()),returns:$||m6.create(),typeName:i.ZodFunction,...p(D)})}}class SD extends __{get schema(){return this._def.getter()}_parse(_){let{ctx:$}=this._processInputParams(_);return this._def.getter()._parse({data:$.data,path:$.path,parent:$})}}SD.create=(_,$)=>{return new SD({getter:_,typeName:i.ZodLazy,...p($)})};class WD extends __{_parse(_){if(_.data!==this._def.value){let $=this._getOrReturnCtx(_);return u($,{received:$.data,code:k.invalid_literal,expected:this._def.value}),m}return{status:"valid",value:_.data}}get value(){return this._def.value}}WD.create=(_,$)=>{return new WD({value:_,typeName:i.ZodLiteral,...p($)})};function RG(_,$){return new t6({values:_,typeName:i.ZodEnum,...p($)})}class t6 extends __{_parse(_){if(typeof _.data!=="string"){let $=this._getOrReturnCtx(_),D=this._def.values;return u($,{expected:U_.joinValues(D),received:$.parsedType,code:k.invalid_type}),m}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has(_.data)){let $=this._getOrReturnCtx(_),D=this._def.values;return u($,{received:$.data,code:k.invalid_enum_value,options:D}),m}return a_(_.data)}get options(){return this._def.values}get enum(){let _={};for(let $ of this._def.values)_[$]=$;return _}get Values(){let _={};for(let $ of this._def.values)_[$]=$;return _}get Enum(){let _={};for(let $ of this._def.values)_[$]=$;return _}extract(_,$=this._def){return t6.create(_,{...this._def,...$})}exclude(_,$=this._def){return t6.create(this.options.filter((D)=>!_.includes(D)),{...this._def,...$})}}t6.create=RG;class XD extends __{_parse(_){let $=U_.getValidEnumValues(this._def.values),D=this._getOrReturnCtx(_);if(D.parsedType!==y.string&&D.parsedType!==y.number){let U=U_.objectValues($);return u(D,{expected:U_.joinValues(U),received:D.parsedType,code:k.invalid_type}),m}if(!this._cache)this._cache=new Set(U_.getValidEnumValues(this._def.values));if(!this._cache.has(_.data)){let U=U_.objectValues($);return u(D,{received:D.data,code:k.invalid_enum_value,options:U}),m}return a_(_.data)}get enum(){return this._def.values}}XD.create=(_,$)=>{return new XD({values:_,typeName:i.ZodNativeEnum,...p($)})};class l4 extends __{unwrap(){return this._def.type}_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.promise&&$.common.async===!1)return u($,{code:k.invalid_type,expected:y.promise,received:$.parsedType}),m;let D=$.parsedType===y.promise?$.data:Promise.resolve($.data);return a_(D.then((U)=>{return this._def.type.parseAsync(U,{path:$.path,errorMap:$.common.contextualErrorMap})}))}}l4.create=(_,$)=>{return new l4({type:_,typeName:i.ZodPromise,...p($)})};class R$ extends __{innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===i.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse(_){let{status:$,ctx:D}=this._processInputParams(_),U=this._def.effect||null,g={addIssue:(I)=>{if(u(D,I),I.fatal)$.abort();else $.dirty()},get path(){return D.path}};if(g.addIssue=g.addIssue.bind(g),U.type==="preprocess"){let I=U.transform(D.data,g);if(D.common.async)return Promise.resolve(I).then(async(j)=>{if($.value==="aborted")return m;let N=await this._def.schema._parseAsync({data:j,path:D.path,parent:D});if(N.status==="aborted")return m;if(N.status==="dirty")return jD(N.value);if($.value==="dirty")return jD(N.value);return N});else{if($.value==="aborted")return m;let j=this._def.schema._parseSync({data:I,path:D.path,parent:D});if(j.status==="aborted")return m;if(j.status==="dirty")return jD(j.value);if($.value==="dirty")return jD(j.value);return j}}if(U.type==="refinement"){let I=(j)=>{let N=U.refinement(j,g);if(D.common.async)return Promise.resolve(N);if(N instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return j};if(D.common.async===!1){let j=this._def.schema._parseSync({data:D.data,path:D.path,parent:D});if(j.status==="aborted")return m;if(j.status==="dirty")$.dirty();return I(j.value),{status:$.value,value:j.value}}else return this._def.schema._parseAsync({data:D.data,path:D.path,parent:D}).then((j)=>{if(j.status==="aborted")return m;if(j.status==="dirty")$.dirty();return I(j.value).then(()=>{return{status:$.value,value:j.value}})})}if(U.type==="transform")if(D.common.async===!1){let I=this._def.schema._parseSync({data:D.data,path:D.path,parent:D});if(!n4(I))return m;let j=U.transform(I.value,g);if(j instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:$.value,value:j}}else return this._def.schema._parseAsync({data:D.data,path:D.path,parent:D}).then((I)=>{if(!n4(I))return m;return Promise.resolve(U.transform(I.value,g)).then((j)=>({status:$.value,value:j}))});U_.assertNever(U)}}R$.create=(_,$,D)=>{return new R$({schema:_,typeName:i.ZodEffects,effect:$,...p(D)})};R$.createWithPreprocess=(_,$,D)=>{return new R$({schema:$,effect:{type:"preprocess",transform:_},typeName:i.ZodEffects,...p(D)})};class Z$ extends __{_parse(_){if(this._getType(_)===y.undefined)return a_(void 0);return this._def.innerType._parse(_)}unwrap(){return this._def.innerType}}Z$.create=(_,$)=>{return new Z$({innerType:_,typeName:i.ZodOptional,...p($)})};class z6 extends __{_parse(_){if(this._getType(_)===y.null)return a_(null);return this._def.innerType._parse(_)}unwrap(){return this._def.innerType}}z6.create=(_,$)=>{return new z6({innerType:_,typeName:i.ZodNullable,...p($)})};class RD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=$.data;if($.parsedType===y.undefined)D=this._def.defaultValue();return this._def.innerType._parse({data:D,path:$.path,parent:$})}removeDefault(){return this._def.innerType}}RD.create=(_,$)=>{return new RD({innerType:_,typeName:i.ZodDefault,defaultValue:typeof $.default==="function"?$.default:()=>$.default,...p($)})};class GD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D={...$,common:{...$.common,issues:[]}},U=this._def.innerType._parse({data:D.data,path:D.path,parent:{...D}});if(SU(U))return U.then((g)=>{return{status:"valid",value:g.status==="valid"?g.value:this._def.catchValue({get error(){return new O$(D.common.issues)},input:D.data})}});else return{status:"valid",value:U.status==="valid"?U.value:this._def.catchValue({get error(){return new O$(D.common.issues)},input:D.data})}}removeCatch(){return this._def.innerType}}GD.create=(_,$)=>{return new GD({innerType:_,typeName:i.ZodCatch,catchValue:typeof $.catch==="function"?$.catch:()=>$.catch,...p($)})};class YU extends __{_parse(_){if(this._getType(_)!==y.nan){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.nan,received:D.parsedType}),m}return{status:"valid",value:_.data}}}YU.create=(_)=>{return new YU({typeName:i.ZodNaN,...p(_)})};var $H=Symbol("zod_brand");class JN extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=$.data;return this._def.type._parse({data:D,path:$.path,parent:$})}unwrap(){return this._def.type}}class QU extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.common.async)return(async()=>{let g=await this._def.in._parseAsync({data:D.data,path:D.path,parent:D});if(g.status==="aborted")return m;if(g.status==="dirty")return $.dirty(),jD(g.value);else return this._def.out._parseAsync({data:g.value,path:D.path,parent:D})})();else{let U=this._def.in._parseSync({data:D.data,path:D.path,parent:D});if(U.status==="aborted")return m;if(U.status==="dirty")return $.dirty(),{status:"dirty",value:U.value};else return this._def.out._parseSync({data:U.value,path:D.path,parent:D})}}static create(_,$){return new QU({in:_,out:$,typeName:i.ZodPipeline})}}class YD extends __{_parse(_){let $=this._def.innerType._parse(_),D=(U)=>{if(n4(U))U.value=Object.freeze(U.value);return U};return SU($)?$.then((U)=>D(U)):D($)}unwrap(){return this._def.innerType}}YD.create=(_,$)=>{return new YD({innerType:_,typeName:i.ZodReadonly,...p($)})};function IG(_,$){let D=typeof _==="function"?_($):typeof _==="string"?{message:_}:_;return typeof D==="string"?{message:D}:D}function GG(_,$={},D){if(_)return m4.create().superRefine((U,g)=>{let I=_(U);if(I instanceof Promise)return I.then((j)=>{if(!j){let N=IG($,U),O=N.fatal??D??!0;g.addIssue({code:"custom",...N,fatal:O})}});if(!I){let j=IG($,U),N=j.fatal??D??!0;g.addIssue({code:"custom",...j,fatal:N})}return});return m4.create()}var DH={object:b_.lazycreate},i;(function(_){_.ZodString="ZodString",_.ZodNumber="ZodNumber",_.ZodNaN="ZodNaN",_.ZodBigInt="ZodBigInt",_.ZodBoolean="ZodBoolean",_.ZodDate="ZodDate",_.ZodSymbol="ZodSymbol",_.ZodUndefined="ZodUndefined",_.ZodNull="ZodNull",_.ZodAny="ZodAny",_.ZodUnknown="ZodUnknown",_.ZodNever="ZodNever",_.ZodVoid="ZodVoid",_.ZodArray="ZodArray",_.ZodObject="ZodObject",_.ZodUnion="ZodUnion",_.ZodDiscriminatedUnion="ZodDiscriminatedUnion",_.ZodIntersection="ZodIntersection",_.ZodTuple="ZodTuple",_.ZodRecord="ZodRecord",_.ZodMap="ZodMap",_.ZodSet="ZodSet",_.ZodFunction="ZodFunction",_.ZodLazy="ZodLazy",_.ZodLiteral="ZodLiteral",_.ZodEnum="ZodEnum",_.ZodEffects="ZodEffects",_.ZodNativeEnum="ZodNativeEnum",_.ZodOptional="ZodOptional",_.ZodNullable="ZodNullable",_.ZodDefault="ZodDefault",_.ZodCatch="ZodCatch",_.ZodPromise="ZodPromise",_.ZodBranded="ZodBranded",_.ZodPipeline="ZodPipeline",_.ZodReadonly="ZodReadonly"})(i||(i={}));var gH=(_,$={message:`Input not instance of ${_.name}`})=>GG((D)=>D instanceof _,$),YG=F$.create,QG=i6.create,UH=YU.create,IH=l6.create,TG=AD.create,jH=d4.create,NH=WU.create,EH=LD.create,OH=JD.create,AH=m4.create,LH=m6.create,JH=n$.create,PH=XU.create,zH=M$.create,SH=b_.create,WH=b_.strictCreate,XH=PD.create,RH=LN.create,GH=zD.create,YH=d$.create,QH=RU.create,TH=GU.create,qH=i4.create,BH=ND.create,VH=SD.create,KH=WD.create,FH=t6.create,MH=XD.create,ZH=l4.create,jG=R$.create,bH=Z$.create,HH=z6.create,kH=R$.createWithPreprocess,CH=QU.create,rH=()=>YG().optional(),vH=()=>QG().optional(),fH=()=>TG().optional(),wH={string:(_)=>F$.create({..._,coerce:!0}),number:(_)=>i6.create({..._,coerce:!0}),boolean:(_)=>AD.create({..._,coerce:!0}),bigint:(_)=>l6.create({..._,coerce:!0}),date:(_)=>d4.create({..._,coerce:!0})},uH=m;var x={actorRef:"hasna.actor_ref.v1",resourceRef:"hasna.resource_ref.v1",evidenceRef:"hasna.evidence_ref.v1",workRun:"hasna.work_run.v1",taskToPrProjection:"hasna.task_to_pr_projection.v1",decisionEnvelope:"hasna.decision_envelope.v1",costEstimate:"hasna.cost_estimate.v1",capabilityCard:"hasna.capability_card.v1",providerLiveModeStandard:"hasna.provider_live_mode_standard.v1",contextPack:"hasna.context_pack.v1",integrationRef:"hasna.integration_ref.v1",projectManifest:"hasna.project_manifest.v1",projectPanel:"hasna.project_panel.v1",projectSnapshot:"hasna.project_snapshot.v1",renderManifest:"hasna.render_manifest.v1",agentTrajectory:"hasna.agent_trajectory.v1",validationPlan:"hasna.validation_plan.v1",proofBundle:"hasna.proof_bundle.v1",scaffoldManifest:"hasna.scaffold_manifest.v1",scaffoldInstallRecord:"hasna.scaffold_install_record.v1",appCloudManifest:"hasna.app_cloud_manifest.v1",noCloudEvidencePack:"hasna.no_cloud_evidence_pack.v1",secureLocalStorePolicy:"hasna.secure_local_store_policy.v1",serviceContract:"hasna.service_contract.v1",commsEventEnvelope:"hasna.comms_event_envelope.v1",commsChannelMetadata:"hasna.comms_channel_metadata.v1",commsMessageMetadata:"hasna.comms_message_metadata.v1",app:"hasna.app.v1",release:"hasna.release.v1",rolloutRecord:"hasna.rollout_record.v1",announcement:"hasna.announcement.v1",audience:"hasna.audience.v1"},u3=E.string().regex(/^hasna\.[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*\.v[0-9]+$/),K_=E.string().datetime(),t=E.string().trim().min(1),H$=t.refine((_)=>_.startsWith("artifact://")||_.startsWith("repo://")||_.startsWith("project://")||_.startsWith("dashboard://")||_.startsWith("render://")||_.startsWith("integration://")||_.startsWith("task://")||_.startsWith("todo://")||_.startsWith("file://")||_.startsWith("files://")||_.startsWith("mailery://")||_.startsWith("conversation://")||_.startsWith("knowledge://")||_.startsWith("memento://")||_.startsWith("https://")||_.startsWith("http://")||_.startsWith("git+https://"),"URI must use artifact://, repo://, project://, dashboard://, render://, integration://, task://, todo://, file://, files://, mailery://, conversation://, knowledge://, memento://, http(s)://, or git+https://"),qG=E.string().regex(/^[a-fA-F0-9]{64}$/),BG=E.string().regex(/^(sha256:)?[a-fA-F0-9]{64}$/),o6=E.record(E.unknown()),qD=E.array(E.string().min(1)).default([]),t4=K_.nullable().optional(),xH=new Set(["succeeded","failed","cancelled","blocked","skipped"]),e4=E.enum(["pending","running","succeeded","failed","cancelled","blocked","skipped","unknown"]);function L_(_){return E.object({schema:E.literal(_),id:E.string().min(1),createdAt:K_,updatedAt:t4,metadata:o6.optional()}).strict()}var zd=E.object({schema:u3,id:E.string().min(1),createdAt:K_,updatedAt:t4,metadata:o6.optional()}).strict(),VG=E.enum(["agent","human","service","model","workflow","system"]),yH=L_(x.actorRef).extend({kind:VG,name:E.string().min(1).optional(),provider:E.string().min(1).optional(),accountId:E.string().min(1).optional(),machineId:E.string().min(1).optional(),capabilities:E.array(E.string().min(1)).default([])}).strict(),m$=E.object({kind:VG,id:E.string().min(1),name:E.string().min(1).optional(),provider:E.string().min(1).optional(),accountId:E.string().min(1).optional(),machineId:E.string().min(1).optional()}).strict(),KG=E.enum(["task","project","repo","run","loop","workflow","action","event","integration","session","machine","model","tool","file","document","url","artifact","knowledge","email","conversation","dashboard","render","panel","report","commit","branch","pull_request","issue","comment","verification","finding","context_pack","proof_bundle","memento","eval","budget","cost","alert","incident","app","release","rollout","announcement","audience","feedback","unknown"]),hH=L_(x.resourceRef).extend({kind:KG,name:E.string().min(1).optional(),uri:H$.optional(),externalId:t.optional(),sourcePackage:t.optional(),tags:qD}).strict().superRefine((_,$)=>{if(!_.uri&&!(_.externalId&&_.sourcePackage))$.addIssue({code:E.ZodIssueCode.custom,message:"Resource refs require uri or both sourcePackage and externalId",path:["uri"]})}),s=E.object({kind:KG,id:E.string().min(1),name:E.string().min(1).optional(),uri:H$.optional(),externalId:t.optional(),sourcePackage:t.optional(),tags:qD}).strict().superRefine((_,$)=>{if(!_.uri&&Boolean(_.externalId)!==Boolean(_.sourcePackage))$.addIssue({code:E.ZodIssueCode.custom,message:"Resource pointers with external package locators require both sourcePackage and externalId",path:_.externalId?["sourcePackage"]:["externalId"]})}),x3=E.enum(["file","command_output","screenshot","log","diff","report","artifact","url","video","har","test_result","metric","trace","other"]),cH=E.enum(["none","partial","full","unknown"]),nH=L_(x.evidenceRef).extend({kind:x3,uri:H$,sha256:qG.optional(),summary:E.string().min(1).optional(),contentType:E.string().min(1).optional(),sizeBytes:E.number().int().nonnegative().optional(),redaction:cH.default("unknown"),producer:m$.optional(),resourceRefs:E.array(s).default([]),tags:qD}).strict(),T_=E.object({id:E.string().min(1),kind:x3.optional(),uri:H$.optional(),sha256:qG.optional(),summary:E.string().min(1).optional()}).strict(),TU=L_(x.costEstimate).extend({currency:E.string().regex(/^[A-Z]{3}$/).default("USD"),amountMicros:E.number().int().nonnegative(),provider:E.string().min(1).optional(),model:E.string().min(1).optional(),accountId:E.string().min(1).optional(),promptTokens:E.number().int().nonnegative().optional(),completionTokens:E.number().int().nonnegative().optional(),totalTokens:E.number().int().nonnegative().optional(),basis:E.enum(["actual","estimated","budget","limit"]).default("estimated"),resourceRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.promptTokens!==void 0&&_.completionTokens!==void 0&&_.totalTokens!==void 0&&_.totalTokens!==_.promptTokens+_.completionTokens)$.addIssue({code:E.ZodIssueCode.custom,message:"totalTokens must equal promptTokens plus completionTokens when all are present",path:["totalTokens"]})}),dH=E.enum(["allowed","denied","warned","approval_required","selected","skipped","unknown"]),FG=L_(x.decisionEnvelope).extend({decisionType:E.enum(["guardrail","model_route","tool_select","budget","secret_access","approval","policy","other"]),status:dH,actor:m$.optional(),traceId:E.string().min(1).optional(),inputHash:BG.optional(),policyBundleId:E.string().min(1).optional(),selected:E.array(s).default([]),skipped:E.array(s).default([]),reason:E.string().min(1),obligations:E.array(E.string().min(1)).default([]),redactions:E.array(E.string().min(1)).default([]),costEstimate:TU.optional(),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.status==="selected"&&_.selected.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Selected decisions require at least one selected resource",path:["selected"]});if(_.status==="skipped"&&_.skipped.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Skipped decisions require at least one skipped resource",path:["skipped"]});if(_.status==="denied"){if(_.selected.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Denied decisions cannot include selected resources",path:["selected"]});if(!_.policyBundleId&&_.evidenceRefs.length===0&&_.obligations.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Denied decisions require policy, evidence, or obligations",path:["policyBundleId"]})}if(_.status==="approval_required"&&_.obligations.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Approval-required decisions require actionable obligations",path:["obligations"]})}),mH=L_(x.capabilityCard).extend({kind:E.enum(["model","tool","machine","agent","lane","connector","service"]),name:E.string().min(1),version:E.string().min(1).optional(),status:E.enum(["available","unavailable","degraded","unknown"]).default("unknown"),capabilities:E.array(E.string().min(1)).default([]),limitations:E.array(E.string().min(1)).default([]),riskLevel:E.enum(["low","medium","high","critical","unknown"]).default("unknown"),costEstimate:TU.optional(),evidenceRefs:E.array(T_).default([])}).strict(),QD=E.enum(["mock","fixture","sandbox","read_only_live","live_mutating"]),iH=E.enum(["none","read_only","external_notification","external_mutation","money_movement","dns_or_domain_change","bulk_message_or_call","legal_or_filing","compute_or_infra_mutation","irreversible"]),lH=E.object({refName:t,requiredForModes:E.array(QD).min(1),allowedSecretInputs:E.array(E.enum(["credential_ref","lease_ref"])).min(1).default(["credential_ref"]),failClosedDiagnostic:t,revocationCheck:E.boolean().default(!0)}).strict(),tH=E.object({operation:t,supportedModes:E.array(QD).min(1),sideEffectClass:iH,requiresApproval:E.boolean().default(!1),requiresIdempotencyKey:E.boolean().default(!1),requiresSandboxEvidence:E.boolean().default(!1),requiresRollbackOrRevocation:E.boolean().default(!1),rollbackOrRevocation:t.optional(),noSideEffectSmoke:t.optional(),reconciliation:t.optional()}).strict().superRefine((_,$)=>{if(_.supportedModes.includes("live_mutating")){if(_.sideEffectClass==="none"||_.sideEffectClass==="read_only")$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations must declare a side-effecting class",path:["sideEffectClass"]});if(!_.requiresApproval)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require approval",path:["requiresApproval"]});if(!_.requiresIdempotencyKey)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require idempotency keys",path:["requiresIdempotencyKey"]});if(!_.requiresSandboxEvidence)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require sandbox evidence before live proof",path:["requiresSandboxEvidence"]});if(!_.requiresRollbackOrRevocation||!_.rollbackOrRevocation)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require rollback or revocation instructions",path:["rollbackOrRevocation"]});if(!_.reconciliation)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require reconciliation behavior",path:["reconciliation"]})}}),oH=E.object({providerId:t,appId:t,adapterId:t,ownerPackage:t,modes:E.array(QD).min(1),defaultMode:QD,credentialRequirements:E.array(lH).default([]),operations:E.array(tH).min(1),rateLimitPosture:t,costPosture:t.optional(),auditEvents:E.array(t).default([]),redactionRules:E.array(t).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(!_.modes.includes(_.defaultMode))$.addIssue({code:E.ZodIssueCode.custom,message:"defaultMode must be one of modes",path:["defaultMode"]});let D=new Set(_.operations.flatMap((U)=>U.supportedModes));for(let U of D)if(!_.modes.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`operation mode ${U} is not declared in provider modes`,path:["operations"]});if(D.has("live_mutating")){if(!_.credentialRequirements.some((g)=>g.requiredForModes.includes("live_mutating")))$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating providers require at least one live credential reference requirement",path:["credentialRequirements"]});if(_.auditEvents.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating providers require audit events",path:["auditEvents"]})}}),pH=E.object({appId:t,repo:t,priority:E.enum(["p0","p1","p2"]).default("p1"),requiredEvidence:E.array(t).min(1),firstOperations:E.array(t).min(1),blockedUntil:E.array(t).default([])}).strict(),eH=L_(x.providerLiveModeStandard).extend({name:t,version:t,modes:E.array(QD).refine((_)=>["mock","fixture","sandbox","read_only_live","live_mutating"].every(($)=>_.includes($)),"provider live-mode standard must include every canonical provider mode"),requiredCapabilityFields:E.array(t).min(1),liveMutationGate:E.object({requiredMode:E.literal("live_mutating"),requiredChecks:E.array(t).min(1),forbiddenBypassSignals:E.array(t).min(1),disabledLiveSmoke:t}).strict(),noSideEffectSmoke:E.object({requiredForModes:E.array(QD).min(1),commandEvidence:E.array(t).min(1),secretOutputScan:E.boolean().default(!0)}).strict(),credentialPolicy:E.object({acceptedInputs:E.array(E.enum(["credential_ref","lease_ref"])).min(1),rawSecretInputsAllowed:E.literal(!1),missingCredentialBehavior:E.literal("fail_closed"),revocationCheckRequired:E.boolean().default(!0)}).strict(),operationCards:E.array(oH).min(1),firstAdoptionTargets:E.array(pH).min(1),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=new Set(_.firstAdoptionTargets.map((g)=>g.appId)),U=new Set(_.operationCards.map((g)=>g.appId));for(let g of D)if(!U.has(g))$.addIssue({code:E.ZodIssueCode.custom,message:`first adoption target ${g} requires a provider capability card`,path:["firstAdoptionTargets"]})}),aH=E.object({id:E.string().min(1),title:E.string().min(1).optional(),summary:E.string().min(1),text:E.string().optional(),tokens:E.number().int().nonnegative().optional(),source:T_,resourceRefs:E.array(s).default([])}).strict(),MG=L_(x.contextPack).extend({objective:E.string().min(1),budget:E.object({maxTokens:E.number().int().positive().optional(),maxBytes:E.number().int().positive().optional()}).strict().optional(),items:E.array(aH).default([]),citations:E.array(T_).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),permissions:E.array(E.string().min(1)).default([]),redactions:E.array(E.string().min(1)).default([]),conflicts:E.array(E.string().min(1)).default([]),uncertainty:E.string().min(1).optional()}).strict(),W$=t.refine((_)=>!_.startsWith("/")&&!_.includes("\\")&&!_.split("/").includes(".."),"Project paths must be relative and cannot contain parent-directory segments"),o4=E.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,"Project slugs must be lowercase dashed identifiers"),sH=E.enum(["public","internal","private","sensitive"]),_k=E.enum(["draft","active","paused","archived"]),y3=E.enum(["todos","files","mailery","conversations","knowledge","mementos","reports","actions","render","contracts","custom"]),ZG=L_(x.integrationRef).extend({kind:y3,name:E.string().min(1),projectId:o4.optional(),sourcePackage:t.optional(),externalId:t.optional(),uri:H$.optional(),enabled:E.boolean().default(!0),readOnly:E.boolean().default(!0),capabilities:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),resourceRef:s.optional(),evidenceRefs:E.array(T_).default([]),config:o6.optional()}).strict().superRefine((_,$)=>{if(!_.uri&&!(_.sourcePackage&&_.externalId)&&!_.resourceRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Integration refs require uri, resourceRef, or both sourcePackage and externalId",path:["uri"]})}),$k=E.object({schemaRoot:W$.default(".hasna/project"),dashboardManifest:W$.default(".hasna/project/dashboard.render.json"),snapshotsDir:W$.default(".hasna/project/snapshots"),documentsDir:W$.default("documents"),reportsDir:W$.default("reports"),evidenceDir:W$.default(".hasna/project/evidence"),privateDir:W$.default(".hasna/project/private")}).strict(),Dk=L_(x.projectManifest).extend({projectId:o4,slug:o4,name:E.string().min(1),summary:E.string().min(1).optional(),status:_k.default("active"),classification:sH.default("private"),owner:m$.optional(),layout:$k.default({}),integrations:E.array(ZG).default([]),renderManifests:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),tags:qD}).strict().superRefine((_,$)=>{let D=new Set,U=new Set;if(_.projectId!==_.slug)$.addIssue({code:E.ZodIssueCode.custom,message:"projectId and slug must match for canonical project manifests",path:["slug"]});for(let[g,I]of _.integrations.entries()){if(D.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project manifest integration ids must be unique",path:["integrations",g,"id"]});if(D.add(I.id),I.projectId&&I.projectId!==_.projectId)$.addIssue({code:E.ZodIssueCode.custom,message:"Integration projectId must match the manifest projectId",path:["integrations",g,"projectId"]})}for(let[g,I]of _.renderManifests.entries()){if(I.kind!=="render")$.addIssue({code:E.ZodIssueCode.custom,message:"Project renderManifests must use resource kind render",path:["renderManifests",g,"kind"]});if(U.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project renderManifest refs must be unique",path:["renderManifests",g,"id"]});U.add(I.id)}}),gk=E.enum(["local","package","provider","url"]),h3=E.object({id:E.string().min(1),kind:gk,specifier:E.string().min(1),path:W$.optional(),packageName:E.string().min(1).optional(),uri:H$.optional(),provider:y3.optional(),schemaId:u3.optional(),integrity:BG.optional(),resourceRef:s.optional(),optional:E.boolean().default(!1)}).strict().superRefine((_,$)=>{if(_.kind==="local"&&!_.path)$.addIssue({code:E.ZodIssueCode.custom,message:"Local render imports require path",path:["path"]});if(_.kind==="package"&&!_.packageName)$.addIssue({code:E.ZodIssueCode.custom,message:"Package render imports require packageName",path:["packageName"]});if(_.kind==="provider"&&!_.provider)$.addIssue({code:E.ZodIssueCode.custom,message:"Provider render imports require provider",path:["provider"]});if(_.kind==="url"&&!_.uri)$.addIssue({code:E.ZodIssueCode.custom,message:"URL render imports require uri",path:["uri"]})}),Uk=E.enum(["dashboard","canvas","panel","report","document","custom"]),Ik=E.object({id:E.string().min(1),title:E.string().min(1),kind:Uk,default:E.boolean().default(!1),entry:W$.optional(),imports:E.array(h3).default([]),panelRefs:E.array(s).default([]),dataRefs:E.array(s).default([]),layout:o6.optional()}).strict(),jk=L_(x.renderManifest).extend({projectId:o4,name:E.string().min(1),version:E.string().min(1),manifestPath:W$.default(".hasna/project/dashboard.render.json"),renderer:E.enum(["json_render","react_flow","markdown","html","custom"]).default("json_render"),views:E.array(Ik).min(1),imports:E.array(h3).default([]),theme:o6.optional(),compatibility:E.object({minProjectsVersion:E.string().min(1).optional(),minContractsVersion:E.string().min(1).optional()}).strict().optional(),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=_.views.filter((I)=>I.default),U=new Set,g=new Set;if(D.length>1)$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifests can have at most one default view",path:["views"]});for(let[I,j]of _.imports.entries()){if(g.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifest import ids must be unique",path:["imports",I,"id"]});g.add(j.id)}for(let[I,j]of _.views.entries()){if(U.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifest view ids must be unique",path:["views",I,"id"]});U.add(j.id);let N=new Set;for(let[O,A]of j.imports.entries()){if(N.has(A.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render view import ids must be unique",path:["views",I,"imports",O,"id"]});N.add(A.id)}for(let[O,A]of j.panelRefs.entries())if(A.kind!=="panel")$.addIssue({code:E.ZodIssueCode.custom,message:"Render view panelRefs must use resource kind panel",path:["views",I,"panelRefs",O,"kind"]})}}),Nk=E.enum(["ready","empty","loading","error","auth_required","unavailable","stale"]),Ek=E.enum(["overview","tasks","files","mailery","conversations","knowledge","mementos","reports","actions","timeline","risks","documents","custom"]),Ok=E.object({id:E.string().min(1),label:E.string().min(1),value:E.union([E.string(),E.number(),E.boolean()]),unit:E.string().min(1).optional(),status:E.enum(["good","warning","critical","unknown"]).default("unknown"),resourceRefs:E.array(s).default([])}).strict(),Ak=E.object({id:E.string().min(1),title:E.string().min(1),summary:E.string().min(1).optional(),status:E.string().min(1).optional(),priority:E.enum(["low","medium","high","critical","unknown"]).default("unknown"),timestamp:K_.optional(),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),metadata:o6.optional()}).strict(),Lk=E.object({renderer:E.enum(["json_render","react_flow","markdown","html","custom"]).default("json_render"),title:E.string().min(1).optional(),entry:W$.optional(),imports:E.array(h3).default([]),spec:o6.default({})}).strict(),bG=L_(x.projectPanel).extend({projectId:o4,provider:E.object({kind:y3,id:E.string().min(1),name:E.string().min(1).optional(),sourcePackage:t.optional(),externalId:t.optional()}).strict(),kind:Ek,title:E.string().min(1),summary:E.string().min(1).optional(),state:Nk.default("ready"),stateReason:E.string().min(1).optional(),generatedAt:K_,freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),metrics:E.array(Ok).default([]),items:E.array(Ak).default([]),actions:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),renderFragment:Lk.optional(),warnings:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{let D=new Set(["error","auth_required","unavailable","stale"]),U=new Set,g=new Set;if(D.has(_.state)&&!_.stateReason)$.addIssue({code:E.ZodIssueCode.custom,message:"Non-ready provider states require stateReason",path:["stateReason"]});if(_.state==="ready"&&_.metrics.length===0&&_.items.length===0&&!_.renderFragment)$.addIssue({code:E.ZodIssueCode.custom,message:"Ready panels require metrics, items, or a renderFragment; use state=empty for empty panels",path:["state"]});for(let[I,j]of _.metrics.entries()){if(U.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel metric ids must be unique",path:["metrics",I,"id"]});U.add(j.id)}for(let[I,j]of _.items.entries()){if(g.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel item ids must be unique",path:["items",I,"id"]});g.add(j.id)}for(let[I,j]of _.actions.entries())if(j.kind!=="action")$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel actions must use resource kind action",path:["actions",I,"kind"]})}),Jk=L_(x.projectSnapshot).extend({projectId:o4,generatedAt:K_,status:e4.default("unknown"),manifestRef:s,renderManifestRef:s.optional(),panels:E.array(bG).default([]),contextPacks:E.array(MG).default([]),proofBundleRefs:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),warnings:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown")}).strict().superRefine((_,$)=>{let D=new Set,U=new Set;if(_.manifestRef.kind!=="project")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot manifestRef must use resource kind project",path:["manifestRef","kind"]});if(_.renderManifestRef&&_.renderManifestRef.kind!=="render")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot renderManifestRef must use resource kind render",path:["renderManifestRef","kind"]});for(let[g,I]of _.proofBundleRefs.entries())if(I.kind!=="proof_bundle")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot proofBundleRefs must use resource kind proof_bundle",path:["proofBundleRefs",g,"kind"]});for(let[g,I]of _.panels.entries()){if(I.projectId!==_.projectId)$.addIssue({code:E.ZodIssueCode.custom,message:"Panel projectId must match snapshot projectId",path:["panels",g,"projectId"]});if(D.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot panel ids must be unique",path:["panels",g,"id"]});D.add(I.id)}for(let[g,I]of _.contextPacks.entries()){if(U.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot context pack ids must be unique",path:["contextPacks",g,"id"]});U.add(I.id)}}),HG=E.object({id:E.string().min(1),kind:E.enum(["command","test","typecheck","lint","eval","security","review","deploy","smoke","manual","other"]),required:E.boolean().default(!0),command:E.string().min(1).optional(),expected:E.string().min(1).optional(),timeoutMs:E.number().int().positive().optional(),resourceRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(new Set(["command","test","typecheck","lint","smoke","eval"]).has(_.kind)&&!_.command&&!_.expected)$.addIssue({code:E.ZodIssueCode.custom,message:"Actionable validation checks require command or expected",path:["command"]})}),Pk=L_(x.validationPlan).extend({objective:E.string().min(1),subject:s.optional(),checks:E.array(HG).min(1),verifier:m$.optional(),requiredEvidenceKinds:E.array(x3).default([])}).strict(),zk=E.enum(["open_source","internal_app","platform","app","agent","content","overlay","other"]),Sk=E.enum(["draft","active","deprecated","archived"]),Wk=E.enum(["cli","mcp","library","sdk","rest_api","dashboard","database","auth","billing","worker","daemon","native","browser_extension","ai_provider","media_pipeline","data_pipeline","tests","ci","deployment","docs","other"]),Xk=E.object({key:E.string().regex(/^[A-Z][A-Z0-9_]*$/),description:E.string().min(1),required:E.boolean().default(!1),["secret"]:E.boolean().default(!1),group:E.string().min(1).optional(),default:E.string().optional()}).strict().superRefine((_,$)=>{if(_.secret&&_.default!==void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"Secret scaffold env vars cannot include defaults",path:["default"]})}),Rk=E.object({name:E.string().min(1),command:E.string().min(1),description:E.string().min(1).optional(),required:E.boolean().default(!1)}).strict(),Gk=E.object({packageManager:E.enum(["bun","npm","pnpm","yarn","cargo","pip","other"]).optional(),languages:E.array(E.string().min(1)).default([]),requiredFiles:E.array(E.string().min(1)).default([]),requiredDirectories:E.array(E.string().min(1)).default([]),optionalDirectories:E.array(E.string().min(1)).default([])}).strict(),Yk=L_(x.scaffoldManifest).extend({name:E.string().min(1),version:E.string().min(1),summary:E.string().min(1),type:zk,status:Sk.default("draft"),capabilities:E.array(Wk).default([]),techStack:E.array(E.string().min(1)).default([]),tags:qD,source:s.optional(),output:Gk,env:E.array(Xk).default([]),scripts:E.array(Rk).default([]),validationChecks:E.array(HG).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.source?.uri?.startsWith("file://"))$.addIssue({code:E.ZodIssueCode.custom,message:"Public scaffold manifest source refs cannot use local file:// URIs",path:["source","uri"]});if(_.status==="active"&&_.validationChecks.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Active scaffold manifests require validation checks",path:["validationChecks"]});if(_.status==="active"&&_.output.requiredFiles.length===0&&_.output.requiredDirectories.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Active scaffold manifests require at least one required file or directory",path:["output"]})}),Qk=E.enum(["installed","failed","cancelled","partial","unknown"]),Tk=L_(x.scaffoldInstallRecord).extend({scaffoldId:E.string().min(1),scaffoldVersion:E.string().min(1).optional(),manifestRef:s.optional(),target:s,status:Qk,installedAt:K_.optional(),installer:m$.optional(),packageManager:E.enum(["bun","npm","pnpm","yarn","cargo","pip","other"]).optional(),options:o6.optional(),generatedFiles:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),proofBundleRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.status==="installed"&&!_.installedAt)$.addIssue({code:E.ZodIssueCode.custom,message:"Installed scaffold records require installedAt",path:["installedAt"]});if(_.status==="installed"&&_.generatedFiles.length===0&&_.evidenceRefs.length===0&&_.proofBundleRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Installed scaffold records require generated files, evidence, or proof bundle refs",path:["generatedFiles"]});if((_.status==="failed"||_.status==="partial")&&_.evidenceRefs.length===0&&_.proofBundleRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed or partial scaffold records require evidence or proof bundle refs",path:["evidenceRefs"]})}),TD=E.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,"App ids must be lowercase dashed identifiers"),c3=E.string().regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/,"Must be a valid npm package name"),kG=E.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,"Must be a semver version"),qk=E.string().regex(/^[0-9a-f]{7,40}$/,"Must be a lowercase git sha (7-40 hex chars)"),Bk=t.refine((_)=>_.startsWith("https://github.com/")||_.startsWith("git+https://github.com/"),"GitHub URLs must start with https://github.com/ or git+https://github.com/"),Vk=E.enum(["active","stub","deprecated","archived"]),Kk=E.enum(["stable","beta","canary","internal"]),Fk=E.object({transport:E.enum(["http","stdio"]).default("http"),bin:E.string().min(1).optional(),url:H$.optional()}).strict(),Mk=E.object({healthPath:E.string().min(1).default("/health"),port:E.number().int().positive().optional(),baseUrl:H$.optional()}).strict(),Zk=E.object({bins:E.array(E.string().min(1)).default([]),mcp:Fk.optional(),http:Mk.optional()}).strict(),bk=L_(x.app).extend({appId:TD,npmName:c3,repoFolder:TD,githubUrl:Bk,projectSlug:o4,surfaces:Zk.default({}),lifecycle:Vk,releaseChannel:Kk.default("stable"),summary:E.string().min(1).optional(),tags:qD}).strict().superRefine((_,$)=>{let D=new Set;for(let[U,g]of _.surfaces.bins.entries()){if(D.has(g))$.addIssue({code:E.ZodIssueCode.custom,message:"App surface bins must be unique",path:["surfaces","bins",U]});D.add(g)}}),Hk=E.enum(["skill","ci","backfilled"]),kk=L_(x.release).extend({appId:TD,package:c3,version:kG,gitSha:qk,publishedAt:K_,publishPath:Hk,changelogRef:s.optional(),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.publishPath!=="backfilled"&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"skill and ci releases require publish evidence; only backfilled releases may omit it",path:["evidenceRefs"]})}),Ck=E.enum(["install","update","rollback","freeze-blocked"]),rk=E.object({cliVersion:E.string().min(1).optional(),mcpHealth:E.enum(["ok","degraded","unavailable","not_checked"]).optional()}).strict().superRefine((_,$)=>{if(!_.cliVersion&&_.mcpHealth===void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"Rollout verification requires at least one concrete verifier field"})}),vk=L_(x.rolloutRecord).extend({appId:TD,package:c3,version:kG,machine:t,action:Ck,result:e4,verifiedBy:rk.optional(),at:K_,evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.action==="freeze-blocked"&&_.result!=="blocked"&&_.result!=="skipped")$.addIssue({code:E.ZodIssueCode.custom,message:"freeze-blocked rollout records must report result blocked or skipped",path:["result"]});let D=Boolean(_.verifiedBy?.cliVersion)||_.verifiedBy?.mcpHealth!==void 0&&_.verifiedBy.mcpHealth!=="not_checked",U=_.verifiedBy?Object.keys(_.verifiedBy).length>0:!1;if((_.action==="install"||_.action==="update")&&_.result==="succeeded"&&(!_.verifiedBy||U&&!D))$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded install/update rollout records require concrete verification",path:["verifiedBy"]})}),fk=E.enum(["email","telegram","slack","discord","x","blog","rss","webhook","github","other"]),wk=E.enum(["pending","queued","sent","failed","skipped","suppressed"]),uk=E.object({channel:fk,status:wk,deliveredAt:K_.optional(),detail:E.string().min(1).optional()}).strict().superRefine((_,$)=>{if(_.status==="sent"&&!_.deliveredAt)$.addIssue({code:E.ZodIssueCode.custom,message:"Sent announcement channels require deliveredAt",path:["deliveredAt"]});if(_.status==="failed"&&!_.detail)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed announcement channels require detail",path:["detail"]})}),xk=L_(x.announcement).extend({campaignId:t,appId:TD.optional(),releaseRef:s.optional(),channels:E.array(uk).min(1),audienceRef:s,sentAt:K_}).strict().superRefine((_,$)=>{if(_.releaseRef&&_.releaseRef.kind!=="release")$.addIssue({code:E.ZodIssueCode.custom,message:"Announcement releaseRef must use resource kind release",path:["releaseRef","kind"]});if(_.audienceRef.kind!=="audience")$.addIssue({code:E.ZodIssueCode.custom,message:"Announcement audienceRef must use resource kind audience",path:["audienceRef","kind"]})}),yk=E.enum(["tag","attribute","group"]),hk=E.enum(["eq","neq","in","not_in","exists","not_exists"]),NG=E.union([E.string(),E.number(),E.boolean()]),ck=E.object({kind:yk,key:E.string().min(1).optional(),op:hk.default("eq"),value:NG.optional(),values:E.array(NG).default([])}).strict().superRefine((_,$)=>{if(_.kind==="attribute"&&!_.key)$.addIssue({code:E.ZodIssueCode.custom,message:"Attribute predicates require key",path:["key"]});if((_.op==="eq"||_.op==="neq")&&_.value===void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"eq/neq predicates require value",path:["value"]});if((_.op==="in"||_.op==="not_in")&&_.values.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"in/not_in predicates require values",path:["values"]})}),nk=E.object({match:E.enum(["all","any"]).default("all"),predicates:E.array(ck).min(1)}).strict(),dk=E.enum(["opt_in","opt_out","transactional","none"]),mk=L_(x.audience).extend({audienceId:TD,name:t,definition:nk,consentPolicy:dk,suppressionSyncedAt:t4}).strict(),jN=["@hasna/cloud","open-cloud"],ik=E.enum(["aws","gcp","azure","cloudflare","vercel","neon","supabase","postgres","s3","rds","other"]),lk=E.object({id:E.string().min(1),provider:ik,kind:E.enum(["database","bucket","queue","secret","function","worker","cache","topic","scheduler","object_store","other"]),ownerPackage:E.string().min(1),region:E.string().min(1).optional(),accountId:E.string().min(1).optional(),uri:H$.optional(),machineScoped:E.boolean().default(!1)}).strict(),CG=L_(x.appCloudManifest).extend({packageName:E.string().min(1),packageVersion:E.string().min(1).optional(),appId:E.string().min(1),repository:s.optional(),storageMode:E.enum(["local_only","app_owned_cloud","hybrid_local_cache","external_service"]),cloudBoundary:E.enum(["none","app_owned","external_service","local_cache"]),cloudResources:E.array(lk).default([]),localCache:E.object({path:E.string().min(1).optional(),pullMode:E.enum(["manual","daemon","ci","none"]).default("manual"),conflictPolicy:E.enum(["cloud_wins","local_wins","merge","manual_review"]).default("manual_review")}).strict().optional(),forbiddenSharedRuntimes:E.array(E.string().min(1)).default([...jN]),dependencies:E.array(E.string().min(1)).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=new Set([...jN,..._.forbiddenSharedRuntimes]);if(D.has(_.packageName))$.addIssue({code:E.ZodIssueCode.custom,message:"App-owned cloud manifests cannot be for a forbidden runtime",path:["packageName"]});for(let U of jN)if(!_.forbiddenSharedRuntimes.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`forbiddenSharedRuntimes must include ${U}`,path:["forbiddenSharedRuntimes"]});for(let U of D)if(_.dependencies.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`App-owned cloud manifests cannot depend on ${U}`,path:["dependencies"]});if(_.storageMode==="local_only"&&_.cloudBoundary!=="none")$.addIssue({code:E.ZodIssueCode.custom,message:"local_only storage requires cloudBoundary none",path:["cloudBoundary"]});if(_.storageMode==="app_owned_cloud"&&_.cloudBoundary!=="app_owned")$.addIssue({code:E.ZodIssueCode.custom,message:"app_owned_cloud storage requires cloudBoundary app_owned",path:["cloudBoundary"]});if(_.storageMode==="hybrid_local_cache"){if(_.cloudBoundary!=="local_cache")$.addIssue({code:E.ZodIssueCode.custom,message:"hybrid_local_cache storage requires cloudBoundary local_cache",path:["cloudBoundary"]});if(!_.localCache)$.addIssue({code:E.ZodIssueCode.custom,message:"hybrid_local_cache storage requires localCache settings",path:["localCache"]})}if(_.storageMode==="external_service"){if(_.cloudBoundary!=="external_service")$.addIssue({code:E.ZodIssueCode.custom,message:"external_service storage requires cloudBoundary external_service",path:["cloudBoundary"]});if(_.cloudResources.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"external_service storage must not declare app-owned cloudResources",path:["cloudResources"]})}if((_.storageMode==="app_owned_cloud"||_.storageMode==="hybrid_local_cache")&&_.cloudResources.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Cloud-backed storage modes require explicit app-owned cloudResources",path:["cloudResources"]});if(_.cloudBoundary==="none"&&_.cloudResources.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"cloudBoundary none cannot declare cloudResources",path:["cloudResources"]});_.cloudResources.forEach((U,g)=>{if(U.ownerPackage!==_.packageName)$.addIssue({code:E.ZodIssueCode.custom,message:"Cloud resources must be owned by the app package that declares the manifest",path:["cloudResources",g,"ownerPackage"]})})}),rG=E.enum(["package_manifest","lockfile","source_import","runtime_config","packed_artifact","published_metadata","app_cloud_manifest","remote_config","boundary_doc","other"]),tk=E.enum(["low","medium","high","critical"]),vG=E.object({id:E.string().min(1),kind:rG,severity:tk,path:E.string().min(1).optional(),packageName:E.string().min(1).optional(),pattern:E.string().min(1),message:E.string().min(1),evidenceRefs:E.array(T_).default([])}).strict(),ok=E.object({id:E.string().min(1),kind:rG,status:e4,target:E.string().min(1),command:E.string().min(1).optional(),evidenceRefs:E.array(T_).default([]),findings:E.array(vG).default([])}).strict(),pk=L_(x.noCloudEvidencePack).extend({subject:s,packageName:E.string().min(1).optional(),packageVersion:E.string().min(1).optional(),generatedBy:m$.optional(),scanMode:E.enum(["source_tree","packed_artifact","published_metadata","runtime_config","workspace","ci"]),status:e4,verdict:E.enum(["passed","failed","warning","not_run"]),appCloudManifest:CG.optional(),checks:E.array(ok).min(1),findings:E.array(vG).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=[..._.findings,..._.checks.flatMap((g)=>g.findings)],U=D.filter((g)=>g.severity==="high"||g.severity==="critical");if(_.verdict==="passed"){if(_.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence requires succeeded status",path:["status"]});if(U.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence cannot include high or critical findings",path:["findings"]});if(_.checks.some((g)=>g.status!=="succeeded"))$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence requires every check to be succeeded",path:["checks"]})}if(_.verdict==="failed"&&D.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed no-cloud evidence requires findings",path:["findings"]});if(_.status==="succeeded"&&_.checks.some((g)=>g.status==="failed"))$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded no-cloud evidence cannot contain failed checks",path:["checks"]});_.checks.forEach((g,I)=>{let j=g.findings.filter((N)=>N.severity==="high"||N.severity==="critical");if(g.status==="succeeded"&&j.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded no-cloud checks cannot contain high or critical findings",path:["checks",I,"findings"]})})}),ek=E.object({checkId:E.string().min(1),status:e4,summary:E.string().min(1).optional(),startedAt:t4,finishedAt:t4,evidenceRefs:E.array(T_).default([])}).strict(),ak=L_(x.proofBundle).extend({subject:s,validationPlanRef:s.optional(),status:e4,verdict:E.enum(["passed","failed","inconclusive","not_run"]).default("inconclusive"),checks:E.array(ek).default([]),verifier:m$.optional(),evidenceRefs:E.array(T_).default([]),residualRisks:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown")}).strict().superRefine((_,$)=>{if(_.verdict==="passed"){if(_.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles must have status succeeded",path:["status"]});if(_.checks.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require at least one check result",path:["checks"]});if(_.checks.forEach((U,g)=>{if(U.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require all checks to have status succeeded",path:["checks",g,"status"]})}),!(_.evidenceRefs.length>0||_.checks.some((U)=>U.evidenceRefs.length>0)))$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require evidence",path:["evidenceRefs"]});if(!_.verifier)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require a verifier",path:["verifier"]})}if(_.verdict==="not_run"&&_.checks.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Not-run proof bundles cannot include check results",path:["checks"]});if(_.verdict==="failed"&&!_.checks.some((D)=>D.status==="failed")&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed proof bundles require a failed check or evidence",path:["checks"]})}),sk=L_(x.workRun).extend({objective:E.string().min(1),status:e4,actor:m$,traceId:E.string().min(1).optional(),startedAt:t4,finishedAt:t4,constraints:E.array(E.string().min(1)).default([]),resourceRefs:E.array(s).default([]),decisions:E.array(FG).default([]),costEstimates:E.array(TU).default([]),evidenceRefs:E.array(T_).default([]),validationPlanRefs:E.array(s).default([]),proofBundleRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.startedAt&&_.finishedAt&&Date.parse(_.finishedAt)0||_.proofBundleRefs.length>0;if(_.status==="succeeded"&&!D)$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded work runs require evidence or a proof bundle",path:["evidenceRefs"]});if((_.status==="failed"||_.status==="blocked")&&!D&&_.decisions.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed or blocked work runs require evidence, a proof bundle, or a decision record",path:["evidenceRefs"]})}),_C=Object.freeze({work_run:Object.freeze(["codewith"]),root_request:Object.freeze(["todos"]),pr_group:Object.freeze(["todos"]),leaf_task:Object.freeze(["todos"]),attempt:Object.freeze(["todos"]),writer_generation:Object.freeze(["todos"]),writer_lease:Object.freeze(["repos"]),writer_fence:Object.freeze(["repos"]),provider_profile:Object.freeze(["codewith"]),provider_route:Object.freeze(["codewith"]),admission:Object.freeze(["codewith"]),worker_actor:Object.freeze(["codewith"]),worker:Object.freeze(["codewith"]),runtime:Object.freeze(["codewith"]),repo:Object.freeze(["repos"]),worktree:Object.freeze(["repos"]),branch:Object.freeze(["repos"]),event_stream:Object.freeze(["todos"]),replay_cursor:Object.freeze(["todos"]),handoff:Object.freeze(["todos"]),pull_request:Object.freeze(["todos"]),commit:Object.freeze(["repos"]),review:Object.freeze(["review"]),reviewer:Object.freeze(["review"]),review_run:Object.freeze(["review"]),proof_bundle:Object.freeze(["review"]),repair_cycle:Object.freeze(["todos"]),merge_guard:Object.freeze(["todos"]),merge_operator:Object.freeze(["merge_provider"]),merge_operator_run:Object.freeze(["merge_provider"]),merge_guard_receipt:Object.freeze(["merge_provider"]),merge_outcome:Object.freeze(["merge_provider"]),recovery:Object.freeze(["todos"]),cancellation:Object.freeze(["todos"]),cleanup_eligibility:Object.freeze(["repos"]),cleanup_outcome:Object.freeze(["repos"]),rollback_plan:Object.freeze(["todos"]),rollback_outcome:Object.freeze(["repos"]),terminal_disposition:Object.freeze(["todos"]),openloops_invocation:Object.freeze(["openloops"]),adapter_extension:Object.freeze(["adapter"])}),$C=E.enum(["work_run","root_request","pr_group","leaf_task","attempt","writer_generation","writer_lease","writer_fence","provider_profile","provider_route","admission","worker_actor","worker","runtime","repo","worktree","branch","event_stream","replay_cursor","handoff","pull_request","commit","review","reviewer","review_run","proof_bundle","repair_cycle","merge_guard","merge_operator","merge_operator_run","merge_guard_receipt","merge_outcome","recovery","cancellation","cleanup_eligibility","cleanup_outcome","rollback_plan","rollback_outcome","terminal_disposition","openloops_invocation","adapter_extension"]),DC=E.enum(["todos","codewith","repos","review","merge_provider","openloops","adapter"]),p4=E.string().regex(/^[a-f0-9]{64}$/),PN=E.string().trim().min(3).max(256),fG=/^[a-f0-9]{32}$/;function gC(_,$,D){return`${_}:${$}:opaque-${D.slice(0,32)}`}function UC(_){return`evidence:opaque-${_.slice(0,32)}`}var wG=PN.refine((_)=>{let D=_.startsWith("task_to_pr_projection:opaque-")?_.slice(29):"";return fG.test(D)},"Projection ids must use a nonsemantic 128-bit lowercase hexadecimal surrogate"),n3=PN.refine((_)=>{let D=_.startsWith("attempt_nonce:opaque-")?_.slice(21):"";return fG.test(D)},"Attempt nonces must use a nonsemantic 128-bit lowercase hexadecimal surrogate"),IC=new Set(["writer_lease","writer_fence","provider_profile","provider_route","admission","worker_actor","worker","runtime","worktree","merge_operator","merge_operator_run","merge_guard_receipt","merge_outcome","openloops_invocation","adapter_extension"]),d3=E.object({role:$C,authority:DC,id:PN,digest:p4,redaction:E.enum(["none","partial","full"])}).strict().superRefine((_,$)=>{let D=_C[_.role];if(!D.includes(_.authority))$.addIssue({code:E.ZodIssueCode.custom,message:`${_.role} refs must be owned by ${D.join(" or ")}`,path:["authority"]});if(IC.has(_.role)&&_.redaction==="none")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.role} refs must be redacted and cannot carry a raw locator or credential`,path:["redaction"]});let U=gC(_.role,_.authority,_.digest);if(_.id!==U)$.addIssue({code:E.ZodIssueCode.custom,message:"Reference ids must be nonsemantic authority-bound surrogates derived from the canonical role, authority, and owner-record digest",path:["id"]})}),X$=E.object({id:PN,digest:p4,redaction:E.enum(["partial","full"])}).strict().superRefine((_,$)=>{if(_.id!==UC(_.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Evidence ids must be nonsemantic owner-resolvable surrogates derived from their canonical digest",path:["id"]})});function uG(_,$,D,U){if(_.id===$.id||_.digest===$.digest)D.addIssue({code:E.ZodIssueCode.custom,message:"Stop and lease-revocation facts require distinct evidence identities and digests",path:U})}function b(_){return d3.refine(($)=>$.role===_,{message:`Reference must use role ${_}`,path:["role"]})}function B_(_,$){return _.role===$.role&&_.authority===$.authority&&_.id===$.id&&_.digest===$.digest&&_.redaction===$.redaction}function m3(_,$){return _.role===$.role&&_.authority===$.authority&&_.id===$.id}function ED(_,$,D,U,g){if(m3(_,$))D.addIssue({code:E.ZodIssueCode.custom,message:`${g} requires a fresh canonical role/authority/id`,path:U});if(_.digest===$.digest)D.addIssue({code:E.ZodIssueCode.custom,message:`${g} requires a fresh canonical digest`,path:U})}function ON(_){return`${_.role}\x00${_.authority}\x00${_.id}`}function e_(_,$){return _.algorithm===$.algorithm&&_.value===$.value}var Q_=E.object({algorithm:E.enum(["sha1","sha256"]),value:E.string().regex(/^[a-f0-9]+$/)}).strict().superRefine((_,$)=>{let D=_.algorithm==="sha1"?40:64;if(_.value.length!==D)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.algorithm} object ids must contain exactly ${D} lowercase hex characters`,path:["value"]})});function EG(_){if(_.canonicalizationVersion===1){let D=JSON.stringify(["hasna.task_to_pr_projection.binding.v1",_.canonicalizationVersion,_.rootRequestRef.id,_.rootRequestRef.digest,_.prGroupRef.id,_.prGroupRef.digest,_.leafTaskRef.id,_.leafTaskRef.digest,_.repoRef.id,_.repoRef.digest,_.baseHead.algorithm,_.baseHead.value,_.frozenScopeDigest]);return gG("sha256").update(D,"utf8").digest("hex")}let $=JSON.stringify(["hasna.task_to_pr_projection.binding.v2",_.canonicalizationVersion,...[_.rootRequestRef,_.prGroupRef,_.leafTaskRef,_.repoRef,_.worktreeRef,_.branchRef].flatMap((D)=>[D.role,D.authority,D.id,D.digest]),_.baseHead.algorithm,_.baseHead.value,_.frozenScopeDigest]);return gG("sha256").update($,"utf8").digest("hex")}var jC=E.object({ref:b("attempt"),nonce:n3,admissionRef:b("admission"),admissionWriterGenerationRef:b("writer_generation"),workerActorRef:b("worker_actor"),workerRef:b("worker"),runtimeRef:b("runtime"),writerGenerationRef:b("writer_generation"),writerLeaseRef:b("writer_lease"),writerFenceRef:b("writer_fence"),providerProfileRef:b("provider_profile"),providerRouteRef:b("provider_route")}).strict(),NC=E.object({repoRef:b("repo"),worktreeRef:b("worktree"),branchRef:b("branch"),baseHead:Q_,branchHead:Q_}).strict(),EC=E.object({streamRef:b("event_stream"),replayCursorRef:b("replay_cursor"),sequence:E.number().int().safe().nonnegative(),prefixDigest:p4}).strict(),OC=E.object({ref:b("handoff"),previousAttemptRef:b("attempt"),nextAttemptRef:b("attempt"),previousWriterGenerationRef:b("writer_generation"),nextWriterGenerationRef:b("writer_generation"),stoppedWorkRunRef:b("work_run"),stopEvidenceRef:X$,leaseRevocationEvidenceRef:X$}).strict().superRefine((_,$)=>{ED(_.previousAttemptRef,_.nextAttemptRef,$,["nextAttemptRef"],"Handoff attempt rotation"),ED(_.previousWriterGenerationRef,_.nextWriterGenerationRef,$,["nextWriterGenerationRef"],"Handoff writer-generation rotation"),uG(_.stopEvidenceRef,_.leaseRevocationEvidenceRef,$,["leaseRevocationEvidenceRef"])}),AC=E.object({ref:b("review"),pullRequestRef:b("pull_request"),base:Q_,head:Q_,reviewerRef:b("reviewer"),reviewRunRef:b("review_run"),proofBundleRef:b("proof_bundle"),verdict:E.enum(["approved","changes_requested","blocked"]),reviewedAt:K_}).strict(),LC=E.object({pullRequestRef:b("pull_request"),remoteBranchRef:b("branch"),expectedBase:Q_,providerPullRequestBase:Q_,localHead:Q_,remoteHead:Q_,providerPullRequestHead:Q_,equalityProofRef:b("proof_bundle"),ciProofBundleRefs:E.array(b("proof_bundle")).min(1),verifiedAt:K_}).strict().superRefine((_,$)=>{if(!e_(_.expectedBase,_.providerPullRequestBase))$.addIssue({code:E.ZodIssueCode.custom,message:"Expected and provider-observed pull-request bases must be exactly equal",path:["providerPullRequestBase"]});if(!e_(_.localHead,_.remoteHead)||!e_(_.localHead,_.providerPullRequestHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Local, remote, and provider pull-request heads must be exactly equal",path:["providerPullRequestHead"]});let D=_.ciProofBundleRefs.map(ON);if(new Set(D).size!==D.length)$.addIssue({code:E.ZodIssueCode.custom,message:"CI proof bundle refs must have unique canonical identities",path:["ciProofBundleRefs"]});let U=_.ciProofBundleRefs.map((g)=>g.digest);if(new Set(U).size!==U.length)$.addIssue({code:E.ZodIssueCode.custom,message:"CI proof bundle refs must have unique canonical digests",path:["ciProofBundleRefs"]});if(_.ciProofBundleRefs.some((g)=>m3(g,_.equalityProofRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Head-equality and CI proof refs must have distinct canonical identities",path:["ciProofBundleRefs"]});if(_.ciProofBundleRefs.some((g)=>g.digest===_.equalityProofRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Head-equality and CI proof refs must have distinct canonical digests",path:["ciProofBundleRefs"]})}),JC=E.object({ref:b("repair_cycle"),cycle:E.number().int().min(0).max(2),cap:E.literal(2),exhausted:E.boolean(),latestRepairRef:b("repair_cycle").optional()}).strict().superRefine((_,$)=>{if(_.exhausted!==(_.cycle===_.cap))$.addIssue({code:E.ZodIssueCode.custom,message:"Repair exhaustion must equal the cumulative cycle cap",path:["exhausted"]});if(_.cycle===0&&_.latestRepairRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Cycle zero cannot reference a repair",path:["latestRepairRef"]});if(_.cycle>0&&!_.latestRepairRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Non-zero repair state requires the latest immutable repair ref",path:["latestRepairRef"]});if(_.latestRepairRef&&m3(_.ref,_.latestRepairRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Repair-state and latest-repair refs must be distinct canonical records",path:["latestRepairRef"]});if(_.latestRepairRef&&_.ref.digest===_.latestRepairRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Repair-state and latest-repair refs must have distinct canonical digests",path:["latestRepairRef"]})}),PC=E.object({ref:b("merge_guard"),pullRequestRef:b("pull_request"),expectedBase:Q_,expectedHead:Q_,reviewRefs:E.array(b("review")).min(1),proofBundleRefs:E.array(b("proof_bundle")).min(1),operatorRef:b("merge_operator"),operatorRunRef:b("merge_operator_run"),providerGuardReceiptRef:b("merge_guard_receipt"),mechanism:E.enum(["compare_and_swap","queue_expected_head"]),decision:E.enum(["eligible","denied","consumed","revoked"]),evaluatedAt:K_}).strict().superRefine((_,$)=>{if(new Set(_.reviewRefs.map((I)=>I.id)).size!==_.reviewRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard review refs must be unique",path:["reviewRefs"]});if(new Set(_.proofBundleRefs.map(ON)).size!==_.proofBundleRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard proof refs must have unique canonical identities",path:["proofBundleRefs"]});if(new Set(_.proofBundleRefs.map((I)=>I.digest)).size!==_.proofBundleRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard proof refs must have unique canonical digests",path:["proofBundleRefs"]})}),zC=E.object({ref:b("merge_outcome"),guardRef:b("merge_guard"),pullRequestRef:b("pull_request"),expectedBase:Q_,observedBase:Q_,expectedHead:Q_,observedHead:Q_,status:E.enum(["merged","closed_unmerged","refused","head_drift","base_drift"]),mergeCommitRef:b("commit").optional(),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().superRefine((_,$)=>{let D=e_(_.expectedBase,_.observedBase),U=e_(_.expectedHead,_.observedHead);if(_.status==="merged"){if(!D||!U)$.addIssue({code:E.ZodIssueCode.custom,message:"Merged outcomes require observed base and head to equal the guarded values",path:[!D?"observedBase":"observedHead"]});if(!_.mergeCommitRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Merged outcomes require an immutable merge commit ref",path:["mergeCommitRef"]})}else if(_.mergeCommitRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Unmerged outcomes cannot claim a merge commit",path:["mergeCommitRef"]});if(_.status==="head_drift"&&U)$.addIssue({code:E.ZodIssueCode.custom,message:"Head-drift outcomes require distinct expected and observed heads",path:["observedHead"]});if(_.status==="head_drift"&&!D)$.addIssue({code:E.ZodIssueCode.custom,message:"Head-drift outcomes cannot also carry an unclassified base drift",path:["observedBase"]});if(_.status==="base_drift"&&D)$.addIssue({code:E.ZodIssueCode.custom,message:"Base-drift outcomes require distinct expected and observed bases",path:["observedBase"]});if(_.status==="base_drift"&&!U)$.addIssue({code:E.ZodIssueCode.custom,message:"Base-drift outcomes cannot also carry an unclassified head drift",path:["observedHead"]});if(!U&&_.status!=="head_drift")$.addIssue({code:E.ZodIssueCode.custom,message:"Only a head_drift outcome may record an observed head that differs from the expected head",path:["observedHead"]});if(!D&&_.status!=="base_drift")$.addIssue({code:E.ZodIssueCode.custom,message:"Only a base_drift outcome may record an observed base that differs from the expected base",path:["observedBase"]})}),SC=E.object({guard:PC,outcome:zC.optional()}).strict(),WC=E.object({ref:b("recovery"),priorAttemptRef:b("attempt"),priorWriterGenerationRef:b("writer_generation"),priorWorkRunRef:b("work_run"),successorAttemptNonce:n3,successorWriterGenerationRef:b("writer_generation"),preservedStateRefs:E.array(d3).min(1),stopEvidenceRef:X$,leaseRevocationEvidenceRef:X$}).strict().superRefine((_,$)=>{ED(_.priorWriterGenerationRef,_.successorWriterGenerationRef,$,["successorWriterGenerationRef"],"Recovery writer-generation rotation"),uG(_.stopEvidenceRef,_.leaseRevocationEvidenceRef,$,["leaseRevocationEvidenceRef"])}),XC=E.object({ref:b("cancellation"),cancelledAttemptRef:b("attempt"),preservedStateRefs:E.array(d3).min(1),evidenceRefs:E.array(X$).min(1)}).strict(),RC=E.object({ref:b("cleanup_eligibility"),status:E.enum(["not_ready","preserved","blocked","eligible"]),targetWorktreeRef:b("worktree"),eventCursorRef:b("replay_cursor"),terminalDispositionRef:b("terminal_disposition"),writerLeaseRef:b("writer_lease"),leaseRevocationEvidenceRef:X$,consumedEventEvidenceRef:X$,evaluatedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().superRefine((_,$)=>{if(_.leaseRevocationEvidenceRef.id===_.consumedEventEvidenceRef.id||_.leaseRevocationEvidenceRef.digest===_.consumedEventEvidenceRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup lease-revocation and consumed-event facts require distinct evidence identities and digests",path:["consumedEventEvidenceRef"]})}),GC=E.object({ref:b("cleanup_outcome"),eligibilityRef:b("cleanup_eligibility"),targetWorktreeRef:b("worktree"),status:E.enum(["preserved","deleted","failed","skipped"]),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict(),YC=E.object({eligibility:RC,outcome:GC.optional()}).strict().superRefine((_,$)=>{if(_.outcome&&!B_(_.outcome.eligibilityRef,_.eligibility.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup outcomes must bind the exact eligibility decision",path:["outcome","eligibilityRef"]});if(_.outcome&&!B_(_.outcome.targetWorktreeRef,_.eligibility.targetWorktreeRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility and outcome must bind the same target worktree",path:["outcome","targetWorktreeRef"]});if(_.outcome?.status==="deleted"&&_.eligibility.status!=="eligible")$.addIssue({code:E.ZodIssueCode.custom,message:"Deletion requires an eligible cleanup decision",path:["outcome","status"]})}),QC=E.object({plan:E.object({ref:b("rollback_plan"),targetRef:E.union([b("commit"),b("branch")]),createdAt:K_}).strict(),outcome:E.object({ref:b("rollback_outcome"),planRef:b("rollback_plan"),targetRef:E.union([b("commit"),b("branch")]),status:E.enum(["not_run","succeeded","failed","cancelled"]),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().optional()}).strict().superRefine((_,$)=>{if(_.outcome&&!B_(_.outcome.planRef,_.plan.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Rollback outcomes must bind the exact rollback plan",path:["outcome","planRef"]});if(_.outcome&&!B_(_.outcome.targetRef,_.plan.targetRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Rollback outcomes must bind the exact rollback target",path:["outcome","targetRef"]});if(_.outcome&&Date.parse(_.outcome.finishedAt)({category:"ci_proof",ref:$,base:_.exactHead.expectedBase,head:_.exactHead.localHead}))]:[],..._.reviews.flatMap(($)=>[{category:"review_proof",ref:$.proofBundleRef,base:$.base,head:$.head},{category:"review_record",ref:$.ref,base:$.base,head:$.head},{category:"review_run",ref:$.reviewRunRef,base:$.base,head:$.head}]),..._.merge?[{category:"merge_guard",ref:_.merge.guard.ref},{category:"provider_guard_receipt",ref:_.merge.guard.providerGuardReceiptRef,base:_.merge.guard.expectedBase,head:_.merge.guard.expectedHead}]:[],..._.cleanup?[{category:"cleanup_eligibility",ref:_.cleanup.eligibility.ref}]:[],..._.rollback?[{category:"rollback_plan",ref:_.rollback.plan.ref}]:[],..._.terminalDispositionRef?[{category:"terminal_disposition",ref:_.terminalDispositionRef}]:[]]}function BC(_,$){if(_.category!==$.category)return!1;if(_.category==="projection_id"&&$.category==="projection_id")return _.projectionId===$.projectionId;if(_.category==="attempt_nonce"&&$.category==="attempt_nonce")return _.nonce===$.nonce;if(_.category==="replay_prefix"&&$.category==="replay_prefix")return _.sequence===$.sequence&&_.prefixDigest===$.prefixDigest;if(!("ref"in _)||!("ref"in $))return!1;return B_(_.ref,$.ref)&&(("head"in _)&&("head"in $)&&("base"in _)&&("base"in $)&&e_(_.base,$.base)&&e_(_.head,$.head)||!("head"in _)&&!("head"in $)&&!("base"in _)&&!("base"in $))}var VC="hasna.task_to_pr_adapter_extension.",KC=E.object({mode:E.enum(["local","cloud"]),schema:u3,ref:b("adapter_extension"),digest:p4}).strict().superRefine((_,$)=>{if(!_.schema.startsWith(VC))$.addIssue({code:E.ZodIssueCode.custom,message:"Adapter extension schema ids must use the permanently reserved task-to-PR adapter-extension namespace",path:["schema"]})}),FC=E.enum(["admitted","running","handed_off","reviewing","repairing","merge_ready","merged","closed_unmerged","failed","blocked","cancelled","recovering","cleanup_complete","rolled_back"]),OG=new Set(["admitted","running","handed_off"]),AG=new Set(["merged","closed_unmerged","failed","blocked","cancelled","cleanup_complete","rolled_back"]),MC={admitted:new Set(["absent","denied:none","revoked:none"]),running:new Set(["absent","denied:none","revoked:none"]),handed_off:new Set(["absent","denied:none","revoked:none"]),reviewing:new Set(["absent","denied:none","revoked:none"]),repairing:new Set(["absent","denied:none","revoked:none"]),merge_ready:new Set(["eligible:none"]),merged:new Set(["consumed:merged"]),closed_unmerged:new Set(["consumed:closed_unmerged","consumed:refused","consumed:head_drift","consumed:base_drift"]),failed:new Set(["absent","revoked:none"]),blocked:new Set(["absent","revoked:none"]),cancelled:new Set(["absent","revoked:none"]),recovering:new Set(["absent","denied:none","revoked:none"]),cleanup_complete:new Set(["absent","revoked:none","consumed:merged","consumed:closed_unmerged","consumed:refused","consumed:head_drift","consumed:base_drift"]),rolled_back:new Set(["consumed:merged"])},ZC=E.object({schema:E.literal(x.taskToPrProjection),id:wG,createdAt:K_,canonicalizationVersion:E.union([E.literal(1),E.literal(2)]),identityDigest:p4,frozenScopeDigest:p4,state:FC,workRunRef:b("work_run"),rootRequestRef:b("root_request"),prGroupRef:b("pr_group"),leafTaskRef:b("leaf_task"),attempt:jC,repository:NC,events:EC,openLoopsInvocationRef:b("openloops_invocation").optional(),pullRequestRef:b("pull_request").optional(),exactHead:LC.optional(),handoff:OC.optional(),reviews:E.array(AC).default([]),repair:JC,merge:SC.optional(),recovery:WC.optional(),cancellation:XC.optional(),cleanup:YC.optional(),rollback:QC.optional(),terminalDispositionRef:b("terminal_disposition").optional(),provenanceLedger:E.array(TC),adapterExtensions:E.array(KC).default([]),evidenceRefs:E.array(X$).default([])}).strict().superRefine((_,$)=>{let D=_.canonicalizationVersion===1?EG({canonicalizationVersion:1,rootRequestRef:_.rootRequestRef,prGroupRef:_.prGroupRef,leafTaskRef:_.leafTaskRef,repoRef:_.repository.repoRef,baseHead:_.repository.baseHead,frozenScopeDigest:_.frozenScopeDigest}):EG({canonicalizationVersion:2,rootRequestRef:_.rootRequestRef,prGroupRef:_.prGroupRef,leafTaskRef:_.leafTaskRef,repoRef:_.repository.repoRef,worktreeRef:_.repository.worktreeRef,branchRef:_.repository.branchRef,baseHead:_.repository.baseHead,frozenScopeDigest:_.frozenScopeDigest});if(_.identityDigest!==D)$.addIssue({code:E.ZodIssueCode.custom,message:"identityDigest must equal the selected v1 compatibility or v2 branch/worktree-bound canonical identity digest",path:["identityDigest"]});let U=new Set,g=new Set,I=new Set,j=new Set,N=new Set,O=new Set;for(let[T,q]of _.provenanceLedger.entries()){if("ref"in q){if(U.has(q.ref.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Provenance entries cannot reuse a canonical owner id across categories or generations",path:["provenanceLedger",T,"ref","id"]});if(U.add(q.ref.id),g.has(q.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Provenance entries cannot reuse a canonical digest across categories or generations",path:["provenanceLedger",T,"ref","digest"]});g.add(q.ref.digest);continue}if(q.category==="projection_id"){if(I.has(q.projectionId))$.addIssue({code:E.ZodIssueCode.custom,message:"Projection identity provenance tombstones must be globally unique",path:["provenanceLedger",T,"projectionId"]});I.add(q.projectionId);continue}if(q.category==="attempt_nonce"){if(j.has(q.nonce))$.addIssue({code:E.ZodIssueCode.custom,message:"Attempt nonce provenance tombstones must be globally unique",path:["provenanceLedger",T,"nonce"]});j.add(q.nonce);continue}if(N.has(q.prefixDigest))$.addIssue({code:E.ZodIssueCode.custom,message:"Replay prefix provenance tombstones must be globally unique",path:["provenanceLedger",T,"prefixDigest"]});if(N.add(q.prefixDigest),O.has(q.sequence))$.addIssue({code:E.ZodIssueCode.custom,message:"Replay prefix provenance entries must bind globally unique replay sequences",path:["provenanceLedger",T,"sequence"]});O.add(q.sequence)}for(let T of qC(_))if(!_.provenanceLedger.some((q)=>BC(q,T)))$.addIssue({code:E.ZodIssueCode.custom,message:`The active ${T.category} identity must be represented exactly in the monotonic provenance ledger`,path:["provenanceLedger"]});let A=[_.rootRequestRef,_.prGroupRef,_.leafTaskRef,_.repository.repoRef,_.repository.worktreeRef,_.repository.branchRef,_.events.streamRef,..._.pullRequestRef?[_.pullRequestRef]:[]],L=(T,q,K,Z)=>{let e=new Set(q.map((I_)=>I_.role)),g_=new Set;for(let[I_,J_]of T.entries()){if(!e.has(J_.role))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} cannot preserve an unrecognized ${J_.role} role`,path:[...K,I_]});if(g_.has(J_.role))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} must preserve exactly one canonical ref per role`,path:[...K,I_]});g_.add(J_.role)}if(T.length!==q.length)$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} preservation refs must exactly equal the required canonical role set`,path:K});for(let I_ of q)if(!T.some((J_)=>B_(J_,I_)))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} must preserve ${I_.role}`,path:K})};if(_.handoff&&!B_(_.handoff.nextWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Handoff next generation must be the current attempt writer generation",path:["handoff","nextWriterGenerationRef"]});if(_.handoff&&!B_(_.handoff.nextAttemptRef,_.attempt.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Handoff next attempt must be the current attempt",path:["handoff","nextAttemptRef"]});if(_.handoff)ED(_.handoff.stoppedWorkRunRef,_.workRunRef,$,["handoff","stoppedWorkRunRef"],"Handoff WorkRun rotation");if(_.recovery){if(_.recovery.successorAttemptNonce!==_.attempt.nonce)$.addIssue({code:E.ZodIssueCode.custom,message:"Recovery successor nonce must equal the current attempt nonce",path:["recovery","successorAttemptNonce"]});if(!B_(_.recovery.successorWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Recovery successor generation must equal the current writer generation",path:["recovery","successorWriterGenerationRef"]});ED(_.recovery.priorAttemptRef,_.attempt.ref,$,["recovery","priorAttemptRef"],"Recovery attempt rotation"),ED(_.recovery.priorWorkRunRef,_.workRunRef,$,["recovery","priorWorkRunRef"],"Recovery WorkRun rotation"),L(_.recovery.preservedStateRefs,[_.recovery.priorWorkRunRef,...A],["recovery","preservedStateRefs"],"Recovery")}if(_.cancellation&&!B_(_.cancellation.cancelledAttemptRef,_.attempt.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Cancellation must bind the current attempt",path:["cancellation","cancelledAttemptRef"]});if(_.cancellation)L(_.cancellation.preservedStateRefs,[_.workRunRef,_.attempt.ref,...A],["cancellation","preservedStateRefs"],"Cancellation");if(_.cancellation&&_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"A projection cannot be both the cancellation and recovery snapshot",path:["recovery"]});if(_.handoff&&_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"A projection cannot be both the handoff and recovery snapshot",path:["recovery"]});if(_.cleanup&&!B_(_.cleanup.eligibility.eventCursorRef,_.events.replayCursorRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the current canonical replay cursor",path:["cleanup","eligibility","eventCursorRef"]});if(_.cleanup&&(!_.terminalDispositionRef||!B_(_.cleanup.eligibility.terminalDispositionRef,_.terminalDispositionRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the exact durable terminal owner fact",path:["cleanup","eligibility","terminalDispositionRef"]});if(_.cleanup&&!B_(_.cleanup.eligibility.writerLeaseRef,_.attempt.writerLeaseRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the exact writer lease being revoked",path:["cleanup","eligibility","writerLeaseRef"]});if(_.cleanup&&!B_(_.cleanup.eligibility.targetWorktreeRef,_.repository.worktreeRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the canonical worktree",path:["cleanup","eligibility","targetWorktreeRef"]});if(_.pullRequestRef){if(_.exactHead&&!B_(_.exactHead.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head proof must bind the canonical pull request ref",path:["exactHead","pullRequestRef"]});for(let[T,q]of _.reviews.entries())if(!B_(q.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Every review must bind the canonical pull request ref",path:["reviews",T,"pullRequestRef"]});if(_.merge&&!B_(_.merge.guard.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard must bind the canonical pull request ref",path:["merge","guard","pullRequestRef"]});if(_.merge?.outcome&&!B_(_.merge.outcome.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome must bind the canonical pull request ref",path:["merge","outcome","pullRequestRef"]})}else if(_.exactHead||_.reviews.length>0||_.merge)$.addIssue({code:E.ZodIssueCode.custom,message:"Review and merge state require a canonical pull request ref",path:["pullRequestRef"]});if(_.exactHead&&!e_(_.exactHead.localHead,_.repository.branchHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact local head must equal the canonical branch head",path:["exactHead","localHead"]});if(_.exactHead&&!e_(_.exactHead.expectedBase,_.repository.baseHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head expected base must equal the canonical repository base",path:["exactHead","expectedBase"]});if(_.exactHead&&!B_(_.exactHead.remoteBranchRef,_.repository.branchRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head remote branch ref must equal the canonical repository branch ref",path:["exactHead","remoteBranchRef"]});if(_.exactHead&&Date.parse(_.exactHead.verifiedAt)0&&!_.exactHead)$.addIssue({code:E.ZodIssueCode.custom,message:"Reviews require local/remote/provider exact-head proof",path:["exactHead"]});if(_.exactHead){let T=[{ref:_.exactHead.equalityProofRef,path:["exactHead","equalityProofRef"]},..._.exactHead.ciProofBundleRefs.map((Z,e)=>({ref:Z,path:["exactHead","ciProofBundleRefs",e]})),..._.reviews.map((Z,e)=>({ref:Z.proofBundleRef,path:["reviews",e,"proofBundleRef"]}))],q=new Set,K=new Set;for(let Z of T){let e=ON(Z.ref);if(q.has(e))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head equality, CI, and review proof obligations require globally unique canonical identities",path:Z.path});if(q.add(e),K.has(Z.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head equality, CI, and review proof obligations require globally unique canonical digests",path:Z.path});K.add(Z.ref.digest)}}let z=new Set,W=new Set,J=new Set,P=new Set,S=new Set,X=new Set,G=new Set,R=new Set;for(let[T,q]of _.reviews.entries()){if(!e_(q.base,_.repository.baseHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Review base must equal the exact canonical pull-request base",path:["reviews",T,"base"]});if(!e_(q.head,_.repository.branchHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Review head must equal the exact canonical branch head",path:["reviews",T,"head"]});for(let[Z,e,g_]of[[q.ref.id,z,"ref"],[q.reviewerRef.id,J,"reviewerRef"],[q.reviewRunRef.id,S,"reviewRunRef"]]){if(e.has(Z))$.addIssue({code:E.ZodIssueCode.custom,message:"Review, reviewer, and review-run refs must each be unique",path:["reviews",T,g_]});e.add(Z)}if(W.has(q.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review refs must resolve to distinct canonical record digests",path:["reviews",T,"ref"]});if(W.add(q.ref.digest),P.has(q.reviewerRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Reviewer refs must resolve to distinct canonical actor digests",path:["reviews",T,"reviewerRef"]});if(P.add(q.reviewerRef.digest),X.has(q.reviewRunRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review-run refs must resolve to distinct canonical run digests",path:["reviews",T,"reviewRunRef"]});X.add(q.reviewRunRef.digest);let K=ON(q.proofBundleRef);if(G.has(K))$.addIssue({code:E.ZodIssueCode.custom,message:"Review proof bundles must have unique canonical identities",path:["reviews",T,"proofBundleRef"]});if(G.add(K),R.has(q.proofBundleRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review proof bundles must have unique canonical digests",path:["reviews",T,"proofBundleRef"]});if(R.add(q.proofBundleRef.digest),q.reviewerRef.digest===_.attempt.workerRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Worker and reviewer identities must resolve to distinct canonical digests",path:["reviews",T,"reviewerRef"]});if(q.reviewRunRef.digest===_.attempt.runtimeRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Worker runtime and review run must resolve to distinct canonical digests",path:["reviews",T,"reviewRunRef"]});if(_.exactHead&&Date.parse(q.reviewedAt)Date.parse(_.merge.guard.evaluatedAt)T.verdict!=="approved"))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards require at least one review and all reviews approved",path:["merge","guard","decision"]});if(_.merge.guard.reviewRefs.length!==_.reviews.length||_.merge.guard.reviewRefs.some((T)=>!_.reviews.some((q)=>B_(T,q.ref))))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guard review refs must exactly equal the projected approved review refs as a canonical set",path:["merge","guard","reviewRefs"]});for(let T of _.reviews)if(!_.merge.guard.proofBundleRefs.some((q)=>B_(q,T.proofBundleRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind every exact review proof bundle",path:["merge","guard","proofBundleRefs"]});if(_.exactHead&&!_.merge.guard.proofBundleRefs.some((T)=>B_(T,_.exactHead.equalityProofRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind the exact-head equality proof",path:["merge","guard","proofBundleRefs"]});if(_.exactHead&&_.exactHead.ciProofBundleRefs.some((T)=>!_.merge.guard.proofBundleRefs.some((q)=>B_(q,T))))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind every exact-head CI proof",path:["merge","guard","proofBundleRefs"]})}}if(_.merge?.outcome){if(!B_(_.merge.outcome.guardRef,_.merge.guard.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome must bind the exact immutable merge guard",path:["merge","outcome","guardRef"]});if(!e_(_.merge.outcome.expectedHead,_.merge.guard.expectedHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome expected head must equal the guarded expected head",path:["merge","outcome","expectedHead"]});if(!e_(_.merge.outcome.expectedBase,_.merge.guard.expectedBase))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome expected base must equal the guarded expected base",path:["merge","outcome","expectedBase"]});if(_.merge.guard.decision!=="consumed")$.addIssue({code:E.ZodIssueCode.custom,message:"Every merge outcome requires an explicitly consumed merge guard",path:["merge","guard","decision"]});if(Date.parse(_.merge.outcome.finishedAt)0)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot carry review bindings before review authority is active`,path:["reviews"]});if((OG.has(_.state)||_.state==="recovering")&&(_.merge?.guard.reviewRefs.length??0)>0)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot hide review bindings in a merge guard before review authority is active`,path:["merge","guard","reviewRefs"]});let V=_.merge?`${_.merge.guard.decision}:${_.merge.outcome?.status??"none"}`:"absent";if(!MC[_.state].has(V))$.addIssue({code:E.ZodIssueCode.custom,message:`State ${_.state} is incompatible with merge authority ${V}`,path:["merge"]});if(AG.has(_.state)&&!_.terminalDispositionRef)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections require a durable Todos terminal-disposition owner ref`,path:["terminalDispositionRef"]});if(!AG.has(_.state)&&_.terminalDispositionRef)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot carry a terminal-disposition owner ref`,path:["terminalDispositionRef"]});if(_.state==="reviewing"&&_.reviews.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Reviewing projections require review refs",path:["reviews"]});if(_.state==="cancelled"&&!_.cancellation)$.addIssue({code:E.ZodIssueCode.custom,message:"Cancelled projections require preservation state",path:["cancellation"]});if(_.cancellation&&_.merge?.outcome)$.addIssue({code:E.ZodIssueCode.custom,message:"Cancellation cannot coexist with a terminal merge outcome",path:["cancellation"]});if(_.state==="recovering"&&!_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"Recovering projections require recovery state",path:["recovery"]});if(_.state==="repairing"&&_.repair.cycle===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Repairing projections require a non-zero repair cycle",path:["repair","cycle"]});if(_.merge&&(_.merge.guard.decision==="eligible"||_.merge.guard.decision==="consumed")&&!B_(_.attempt.admissionWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge eligibility requires admission from the current writer generation",path:["attempt","admissionWriterGenerationRef"]});if(_.state==="merge_ready"&&_.merge?.guard.decision!=="eligible")$.addIssue({code:E.ZodIssueCode.custom,message:"Merge-ready projections require an eligible guard",path:["merge"]});if(_.state==="merged"&&_.merge?.outcome?.status!=="merged")$.addIssue({code:E.ZodIssueCode.custom,message:"Merged projections require a merged immutable outcome",path:["merge"]});if(_.state==="closed_unmerged"&&!_.merge?.outcome?.status.match(/^(closed_unmerged|refused|head_drift|base_drift)$/))$.addIssue({code:E.ZodIssueCode.custom,message:"Closed-unmerged projections require a non-merged terminal outcome",path:["merge"]});if(_.state==="cleanup_complete"&&(!_.cleanup?.outcome||!["deleted","preserved","skipped"].includes(_.cleanup.outcome.status)))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup-complete projections require an immutable cleanup outcome",path:["cleanup"]});if(_.state==="rolled_back"&&_.rollback?.outcome?.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Rolled-back projections require a successful rollback outcome",path:["rollback"]});if((_.state==="failed"||_.state==="blocked")&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed and blocked projections require redacted evidence refs",path:["evidenceRefs"]});if(["admitted","running","handed_off","reviewing","repairing","merge_ready","recovering"].includes(_.state)&&(_.merge?.outcome||_.cancellation||_.cleanup?.outcome||_.rollback?.outcome))$.addIssue({code:E.ZodIssueCode.custom,message:"Non-terminal projections cannot carry terminal owner outcomes",path:["state"]});let Q=new Set;for(let[T,q]of _.adapterExtensions.entries()){let K=`${q.mode}:${q.schema}`;if(Q.has(K))$.addIssue({code:E.ZodIssueCode.custom,message:"Adapter extensions must be unique per local/cloud mode and schema",path:["adapterExtensions",T]});Q.add(K)}});var bC=E.object({id:E.string().min(1),at:K_,kind:E.enum(["message","tool_call","command","file_change","error","test","decision","verification","status","other"]),summary:E.string().min(1),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),costEstimate:TU.optional()}).strict(),HC=L_(x.agentTrajectory).extend({actor:m$,workRunRef:s.optional(),events:E.array(bC).default([]),outcome:E.enum(["succeeded","failed","cancelled","blocked","unknown"]).default("unknown"),proofBundleRef:s.optional()}).strict(),kC="v1",CC=E.enum(["library","cli-with-store","service","saas"]),rC=["user-hosted","hasna-saas"],vC=E.enum(rC),fC=["api","sdk","mcp","cli"],xG=E.enum(fC),wC=E.enum(["supported","deferred","unsupported"]),uC=E.enum(["none","local-only","api-key","session","service-token","custom"]),k3=E.object({method:E.enum(["GET","POST","PUT","PATCH","DELETE"]),path:E.string().regex(/^\/[A-Za-z0-9_./:*-]*$/,"Endpoint paths must be absolute HTTP paths"),public:E.boolean().default(!1),description:E.string().min(1).optional()}).strict(),xC=E.object({id:E.string().min(1),kind:E.enum(["auth","storage","secret-ref","migration","health","readiness","redaction","smoke","operator","other"]),required:E.boolean().default(!0),command:E.string().min(1).optional(),evidenceRef:T_.optional(),status:E.enum(["pending","passed","failed","blocked","deferred"]).default("pending"),summary:E.string().min(1).optional()}).strict().superRefine((_,$)=>{if((_.status==="passed"||_.status==="failed"||_.status==="blocked")&&!_.command&&!_.evidenceRef&&!_.summary)$.addIssue({code:E.ZodIssueCode.custom,message:"Terminal readiness gates require command, evidenceRef, or summary",path:["status"]})}),yC=E.object({name:E.string().min(1),kind:xG.optional(),status:wC,bin:E.string().min(1).optional(),mcpBin:E.string().min(1).optional(),authMode:uC,health:k3.optional(),readiness:k3.optional(),version:k3.optional(),apiBasePath:E.string().regex(/^\/v[0-9]+$/,"Stable API base path must be /vN").optional(),openApiPath:E.string().regex(/^\/[A-Za-z0-9_./:-]*$/).optional(),exportSubpath:E.string().regex(/^\.(?:\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*)?$/,"SDK export subpaths must be package export keys such as . or ./sdk").optional(),generatedFrom:E.string().regex(/^\/[A-Za-z0-9_./:-]*$/,"SDK generatedFrom must reference an absolute OpenAPI path").optional(),clientClassName:E.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]*$/).optional(),deferReason:E.string().min(1).optional(),readinessGates:E.array(xC).default([])}).strict().superRefine((_,$)=>{if(_.status==="supported"){if(!_.kind||_.kind==="api"){if(!_.bin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a serve bin",path:["bin"]});if(!_.health)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a health endpoint",path:["health"]});if(!_.readiness)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a readiness endpoint",path:["readiness"]});if(!_.version)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a version endpoint",path:["version"]})}if(_.kind==="cli"&&!_.bin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported CLI surfaces require a bin",path:["bin"]});if(_.kind==="mcp"&&!_.mcpBin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported MCP surfaces require an mcpBin",path:["mcpBin"]});if(_.kind==="sdk"&&!_.exportSubpath)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported SDK surfaces require an exportSubpath",path:["exportSubpath"]})}if((_.status==="deferred"||_.status==="unsupported")&&!_.deferReason)$.addIssue({code:E.ZodIssueCode.custom,message:"Deferred or unsupported service surfaces require a deferReason",path:["deferReason"]});if(_.health&&_.health.path!=="/health")$.addIssue({code:E.ZodIssueCode.custom,message:"Health endpoint must be /health",path:["health","path"]});if(_.health&&_.health.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Health endpoint must use GET",path:["health","method"]});if(_.readiness&&_.readiness.path!=="/ready")$.addIssue({code:E.ZodIssueCode.custom,message:"Readiness endpoint must be /ready",path:["readiness","path"]});if(_.readiness&&_.readiness.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Readiness endpoint must use GET",path:["readiness","method"]});if(_.version&&_.version.path!=="/version")$.addIssue({code:E.ZodIssueCode.custom,message:"Version endpoint must be /version",path:["version","path"]});if(_.version&&_.version.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Version endpoint must use GET",path:["version","method"]})}),hC=["sqlite","postgres"],yG=E.enum(hC),hG=["sqlite","postgres"],cC=E.enum(hG),w3=["postgres"],nC=E.object({kind:xG,reason:E.string().trim().min(1)}).strict(),i3=500,l3=200,AN=(_)=>E.string().trim().min(1).max(_).regex(/^[^\u0000-\u001f\u007f]+$/,"Waiver text must not contain control characters"),dC=["domain","host","ip","email"],mC=E.object({kind:E.enum(dC),reason:AN(i3),reviewedBy:AN(l3),expiresAt:K_}).strict(),iC=E.object({engine:E.enum(w3),reason:AN(i3),reviewedBy:AN(l3).optional(),expiresAt:K_.optional()}).strict();function lC(_){if(_.class!=="cli-with-store")return`storage waivers are not permitted for class ${_.class}`;if(_.bins.includes(`${_.name}-serve`))return`storage waivers are not permitted for a service-capable cli-with-store repo shipping ${_.name}-serve`;if(_.storageMode==="postgres")return"storage waivers are not permitted while storage.mode is postgres, which reads and writes PostgreSQL directly";if(_.hosting.includes("hasna-saas"))return"storage waivers are not permitted for a repo declaring the hasna-saas product story";return null}var tC=E.object({conformance:E.object({waivedSurfaces:E.array(nC).default([]),waiverProfile:E.literal("non-node-monorepo").optional(),waivedStorageEngines:E.array(iC).default([]),waivedAssetInventories:E.array(mC).default([])}).catchall(E.unknown()).optional(),release:E.object({artifactScan:E.object({script:E.string().trim().min(1)}).strict().optional()}).catchall(E.unknown()).optional()}).catchall(E.unknown()),oC=E.string().regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/,"App names must be lowercase dashed identifiers"),pC=["","-cli","-mcp","-serve","-worker","-runner","-daemon","-migrate","-doctor"];function eC(_){return pC.map(($)=>`${_}${$}`)}function LG(_){return`hasna/oss/${_}/database-url`}var aC=E.object({mode:yG,engines:E.array(cC).min(1).optional(),envPrefix:E.string().regex(/^HASNA_[A-Z][A-Z0-9]*_$/).optional(),aliasEnvPrefix:E.string().regex(/^[A-Z][A-Z0-9]*_$/).optional(),databaseUrlSecretRef:E.string().regex(/^hasna\/oss\/[a-z0-9-]+\/database-url$/).optional(),sqlitePath:E.string().min(1).endsWith(".db","storage.sqlitePath must end in .db").optional(),pgTestGate:E.object({envVar:E.string().regex(/^[A-Z][A-Z0-9_]*_TEST_DATABASE_URL$/),command:E.string().trim().min(1)}).strict().optional()}).strict().superRefine((_,$)=>{if(_.engines&&new Set(_.engines).size!==_.engines.length)$.addIssue({code:E.ZodIssueCode.custom,message:"storage.engines must not contain duplicates",path:["engines"]});if(_.engines?.includes("postgres")&&!_.envPrefix)$.addIssue({code:E.ZodIssueCode.custom,message:"storage.engines containing postgres requires envPrefix for the HASNA__DATABASE_URL contract",path:["envPrefix"]})}),cG=E.enum(["0600"]),nG=E.enum(["0700"]),dG=E.enum([".hasna",".codewith"]),sC=E.enum(["directory","file","sqlite_db","sqlite_wal","sqlite_shm","backup","export","report","tmp","log","session","snapshot"]),ID=W$.refine((_)=>!_.startsWith("~"),"Local store path patterns must be relative to their declared root"),_r=E.object({id:E.string().min(1),source:E.enum(["sqlite","manifest","index","runtime","package_adapter"]),table:E.string().min(1).optional(),column:E.string().min(1).optional(),description:E.string().min(1),required:E.boolean().default(!0)}).strict(),$r=E.object({safeWhen:E.enum(["exclusive_access","offline_only","never"]),operations:E.array(E.enum(["wal_checkpoint_truncate","incremental_vacuum","optimize","vacuum"])).default([])}).strict().superRefine((_,$)=>{if(_.safeWhen==="never"&&_.operations.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"sqliteMaintenance.safeWhen=never cannot declare operations",path:["operations"]})}),Dr=E.object({id:E.string().min(1),description:E.string().min(1),ttlDays:E.number().int().nonnegative().optional(),artifactClasses:E.array(sC).min(1),allowlistGlobs:E.array(ID).min(1),activeRecordExclusions:E.array(_r).default([]),sqliteMaintenance:$r.optional()}).strict(),gr=E.object({storeId:E.string().regex(/^[a-z][a-z0-9-]*$/),packageName:E.string().min(1),displayName:E.string().min(1),root:dG,relativePath:ID,directoryMode:nG.default("0700"),fileMode:cG.default("0600"),sqliteDatabaseGlobs:E.array(ID).default([]),sensitiveFileGlobs:E.array(ID).default([]),backupGlobs:E.array(ID).default([]),exportGlobs:E.array(ID).default([]),retentionAdapters:E.array(Dr).default([]),notes:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{if(_.relativePath.includes("*"))$.addIssue({code:E.ZodIssueCode.custom,message:"store relativePath must be a concrete directory; use glob fields for files",path:["relativePath"]});let D=new Set;for(let[U,g]of _.retentionAdapters.entries()){if(D.has(g.id))$.addIssue({code:E.ZodIssueCode.custom,message:"retention adapter ids must be unique within a store",path:["retentionAdapters",U,"id"]});D.add(g.id)}}),mG=L_(x.secureLocalStorePolicy).extend({version:E.string().min(1),scope:E.array(dG).min(1),defaults:E.object({directoryMode:nG.default("0700"),fileMode:cG.default("0600"),dryRunDefault:E.literal(!0),requireExplicitApply:E.literal(!0),includeSqliteSidecars:E.literal(!0),redactedEvidenceOnly:E.literal(!0)}).strict(),stores:E.array(gr).min(1),lifecycle:E.object({retentionDryRunDefault:E.literal(!0),requireActiveRecordExclusionProof:E.literal(!0),requireArtifactAllowlist:E.literal(!0),sqliteMaintenanceRequiresExclusiveAccess:E.literal(!0)}).strict(),warnings:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{let D=new Set;for(let[U,g]of _.stores.entries()){if(D.has(g.storeId))$.addIssue({code:E.ZodIssueCode.custom,message:"store ids must be unique",path:["stores",U,"storeId"]});if(D.add(g.storeId),!_.scope.includes(g.root))$.addIssue({code:E.ZodIssueCode.custom,message:"store root must be listed in policy scope",path:["stores",U,"root"]})}}),Ur=E.object({$schema:E.string().min(1).optional(),schema:E.literal(x.serviceContract),name:oC,class:CC,contractVersion:E.literal(kC),kitVersion:E.string().min(1),description:E.string().min(1).optional(),bins:E.array(E.string().min(1)).default([]),storage:aC.optional(),hosting:E.array(vC).min(1).default(["user-hosted"]),serviceSurfaces:E.array(yC).default([]),metadata:tC.optional()}).strict().superRefine((_,$)=>{if(new Set(_.hosting).size!==_.hosting.length)$.addIssue({code:E.ZodIssueCode.custom,message:"hosting must not contain duplicates",path:["hosting"]});let D=new Set(eC(_.name)),U=new Set;for(let[A,L]of _.bins.entries()){if(U.has(L))$.addIssue({code:E.ZodIssueCode.custom,message:"Duplicate bin declaration",path:["bins",A]});if(U.add(L),!D.has(L))$.addIssue({code:E.ZodIssueCode.custom,message:`Bin "${L}" is not allowlisted for app "${_.name}"; allowed: ${[...D].join(", ")}`,path:["bins",A]})}let g=(A)=>U.has(`${_.name}${A}`);if(_.storage){let A=_.name.toUpperCase().replace(/-/g,"_");if(_.storage.envPrefix&&_.storage.envPrefix!==`HASNA_${A}_`)$.addIssue({code:E.ZodIssueCode.custom,message:`storage.envPrefix must be HASNA_${A}_`,path:["storage","envPrefix"]});if(_.storage.databaseUrlSecretRef&&_.storage.databaseUrlSecretRef!==LG(_.name))$.addIssue({code:E.ZodIssueCode.custom,message:`storage.databaseUrlSecretRef must be ${LG(_.name)}`,path:["storage","databaseUrlSecretRef"]})}if(_.class==="library"){if(_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"library repos must not declare storage",path:["storage"]});if(g("-serve")||g("-mcp"))$.addIssue({code:E.ZodIssueCode.custom,message:"library repos must not ship a -serve or -mcp bin",path:["bins"]})}if(_.class==="cli-with-store"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"cli-with-store repos must declare storage",path:["storage"]});else{if(_.storage.mode==="sqlite"&&!_.storage.sqlitePath)$.addIssue({code:E.ZodIssueCode.custom,message:"sqlite cli-with-store storage requires sqlitePath (~/.hasna//.db)",path:["storage","sqlitePath"]});if(_.storage.engines){let A=new Set(_.storage.engines),L=_.metadata?.conformance?.waivedStorageEngines??[],z=lC({class:_.class,name:_.name,bins:_.bins,hosting:_.hosting,storageMode:_.storage.mode}),W=new Set(z?[]:L.map((P)=>P.engine)),J=hG.filter((P)=>!A.has(P)&&!W.has(P));if(J.length>0){let P=z&&L.length>0?`; declared waiver ignored: ${z}`:"";$.addIssue({code:E.ZodIssueCode.custom,message:`cli-with-store storage.engines must declare both sqlite and postgres unless the engine carries a metadata.conformance.waivedStorageEngines waiver; missing: ${J.join(", ")}${P}`,path:["storage","engines"]})}}}if(!U.has(_.name))$.addIssue({code:E.ZodIssueCode.custom,message:`cli-with-store repos must ship the "${_.name}" bin`,path:["bins"]})}if(_.class==="service"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"service repos must declare storage",path:["storage"]});else if(_.storage.engines&&(!_.storage.engines.includes("sqlite")||!_.storage.engines.includes("postgres")))$.addIssue({code:E.ZodIssueCode.custom,message:"service storage.engines must declare both sqlite and postgres",path:["storage","engines"]});if(!g("-serve"))$.addIssue({code:E.ZodIssueCode.custom,message:`service repos must ship the "${_.name}-serve" bin`,path:["bins"]});if(_.serviceSurfaces.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"service repos must declare at least one service surface",path:["serviceSurfaces"]})}if(_.class==="saas"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must declare storage",path:["storage"]});else{if(_.storage.mode!=="postgres")$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must use the postgres storage backend",path:["storage","mode"]});if(!_.storage.envPrefix)$.addIssue({code:E.ZodIssueCode.custom,message:"saas storage requires envPrefix for the public DATABASE_URL contract",path:["storage","envPrefix"]})}if(!g("-serve"))$.addIssue({code:E.ZodIssueCode.custom,message:`saas repos must ship the "${_.name}-serve" bin`,path:["bins"]});if(_.serviceSurfaces.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must declare at least one service surface",path:["serviceSurfaces"]})}for(let[A,L]of _.serviceSurfaces.entries()){if(L.bin&&!U.has(L.bin))$.addIssue({code:E.ZodIssueCode.custom,message:`Service surface bin "${L.bin}" must be declared in bins`,path:["serviceSurfaces",A,"bin"]});if(L.mcpBin&&!U.has(L.mcpBin))$.addIssue({code:E.ZodIssueCode.custom,message:`Service surface MCP bin "${L.mcpBin}" must be declared in bins`,path:["serviceSurfaces",A,"mcpBin"]})}let I=_.metadata?.conformance?.waivedSurfaces??[],j=new Set;for(let[A,L]of I.entries()){if(j.has(L.kind))$.addIssue({code:E.ZodIssueCode.custom,message:`Duplicate conformance waiver for ${L.kind}`,path:["metadata","conformance","waivedSurfaces",A,"kind"]});j.add(L.kind)}let N=_.metadata?.conformance?.waivedStorageEngines??[],O=new Set;for(let[A,L]of N.entries()){if(O.has(L.engine))$.addIssue({code:E.ZodIssueCode.custom,message:`Duplicate storage-engine waiver for ${L.engine}`,path:["metadata","conformance","waivedStorageEngines",A,"engine"]});O.add(L.engine)}}),Sd=E.object({status:E.enum(["ok","degraded","unavailable"]),version:E.string().min(1),mode:yG}).strict(),Wd=E.object({ready:E.boolean(),reason:E.string().min(1).optional()}).strict(),Xd=E.object({version:E.string().min(1)}).strict(),Ir=E.enum(["info","notice","breaking","critical"]),jr=E.string().regex(/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){1,3}$/,"Comms event types must be 2-4 lowercase dot-separated segments (..)"),Nr=["FREEZE","UNFREEZE","BREAKING","CUTOVER","POLICY","RELEASE"],Er=E.enum(Nr);var Or=E.enum(["fleet","package","machine"]),iG=L_(x.commsEventEnvelope).extend({type:jr,severity:Ir,scope:Or,summary:E.string().min(1).optional(),source:m$.optional(),affected_packages:E.array(t).default([]),affected_machines:E.array(t).default([]),action_required:E.boolean().default(!1),ack_by:K_.optional(),dedupe_key:t,resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.scope==="package"&&_.affected_packages.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Package-scoped comms events require affected_packages",path:["affected_packages"]});if(_.scope==="machine"&&_.affected_machines.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Machine-scoped comms events require affected_machines",path:["affected_machines"]});if(_.ack_by&&!_.action_required)$.addIssue({code:E.ZodIssueCode.custom,message:"Comms events with an ack_by deadline require action_required",path:["action_required"]});if(_.type==="fleet.freeze"||_.type==="fleet.unfreeze"){if(_.severity!=="critical")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events are always critical`,path:["severity"]});if(_.scope!=="fleet")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events are always fleet-scoped`,path:["scope"]});if(!_.action_required)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events require action_required`,path:["action_required"]})}}),Ar=E.enum(["fleet","package","product","loop-lane","initiative","personal"]),Lr=E.enum(["quiet","work","firehose"]),Jr=t.refine((_)=>/^(?:\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)?|gate:[0-9a-f][0-9a-f-]{7,35})$/.test(_),"until must be an ISO date (YYYY-MM-DD), a UTC timestamp, or a gate id (gate:)"),Pr=L_(x.commsChannelMetadata).extend({class:Ar,noise:Lr.optional(),owner:t.optional(),until:Jr.optional(),successor:t.optional()}).strict().superRefine((_,$)=>{if(_.class==="initiative"){if(!_.owner)$.addIssue({code:E.ZodIssueCode.custom,message:"Initiative channels require an owner",path:["owner"]});if(!_.until)$.addIssue({code:E.ZodIssueCode.custom,message:"Initiative channels require an until horizon (date or gate id)",path:["until"]})}}),JG={FREEZE:{defaultSeverity:"critical",allowedSeverities:["critical"],requiredEventType:"fleet.freeze"},UNFREEZE:{defaultSeverity:"critical",allowedSeverities:["critical"],requiredEventType:"fleet.unfreeze"},BREAKING:{defaultSeverity:"breaking",allowedSeverities:["breaking"],requiredEventType:null},CUTOVER:{defaultSeverity:"notice",allowedSeverities:["notice","breaking"],requiredEventType:null},POLICY:{defaultSeverity:"breaking",allowedSeverities:["notice","breaking"],requiredEventType:null},RELEASE:{defaultSeverity:"info",allowedSeverities:["info","notice"],requiredEventType:null}},zr=L_(x.commsMessageMetadata).extend({tag:Er,envelope:iG}).strict().superRefine((_,$)=>{let D=JG[_.tag];if(!D.allowedSeverities.includes(_.envelope.severity))$.addIssue({code:E.ZodIssueCode.custom,message:`[${_.tag}] posts allow severities ${D.allowedSeverities.join(", ")}`,path:["envelope","severity"]});if(D.requiredEventType&&_.envelope.type!==D.requiredEventType)$.addIssue({code:E.ZodIssueCode.custom,message:`[${_.tag}] posts require event type ${D.requiredEventType}`,path:["envelope","type"]});for(let[U,g]of Object.entries(JG))if(g.requiredEventType===_.envelope.type&&_.tag!==U)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.envelope.type} events must use the [${U}] tag`,path:["tag"]})});var Sr={[x.actorRef]:yH,[x.resourceRef]:hH,[x.evidenceRef]:nH,[x.workRun]:sk,[x.taskToPrProjection]:ZC,[x.decisionEnvelope]:FG,[x.costEstimate]:TU,[x.capabilityCard]:mH,[x.providerLiveModeStandard]:eH,[x.contextPack]:MG,[x.integrationRef]:ZG,[x.projectManifest]:Dk,[x.projectPanel]:bG,[x.projectSnapshot]:Jk,[x.renderManifest]:jk,[x.agentTrajectory]:HC,[x.validationPlan]:Pk,[x.proofBundle]:ak,[x.scaffoldManifest]:Yk,[x.scaffoldInstallRecord]:Tk,[x.appCloudManifest]:CG,[x.noCloudEvidencePack]:pk,[x.secureLocalStorePolicy]:mG,[x.serviceContract]:Ur,[x.commsEventEnvelope]:iG,[x.commsChannelMetadata]:Pr,[x.commsMessageMetadata]:zr,[x.app]:bk,[x.release]:kk,[x.rolloutRecord]:vk,[x.announcement]:xk,[x.audience]:mk};class lG extends Error{schemaId;issues;constructor(_,$){super(`Contract validation failed for ${_}`);this.name="ContractValidationError",this.schemaId=_,this.issues=$}}function tG(_,$){let U=Sr[_].safeParse($);if(!U.success)throw new lG(_,U.error.issues);return U.data}var Rd=String.raw`(?:^|[^\w$])(?:_*(?:import|require)|createRequire|Module\s*\.\s*_load)`;var t3=[{pattern:"@hasna/cloud",kind:"module",message:"Shared @hasna/cloud runtime reference is forbidden"},{pattern:"open-cloud",kind:"module",message:"Shared open-cloud runtime reference is forbidden"},{pattern:"cloud-mcp",kind:"module",message:"Legacy cloud-mcp runtime surface is forbidden"},{pattern:"registerCloudTools",kind:"symbol",message:"Legacy registerCloudTools runtime surface is forbidden"},{pattern:"registerCloudCommands",kind:"symbol",message:"Legacy registerCloudCommands runtime surface is forbidden"},{pattern:".hasna/cloud",kind:"config",checkKind:"runtime_config",message:"Legacy .hasna/cloud runtime config is forbidden"},{pattern:"HASNA_CLOUD_",kind:"config",message:"Shared HASNA_CLOUD_* runtime config is forbidden"},{pattern:"HASNA_RDS_PASSWORD",kind:"config",message:"Legacy shared RDS credential config is forbidden"}],Gd=t3.filter((_)=>("checkKind"in _)),Wr=t3.filter((_)=>_.kind==="module"),Yd=[...new Set([...jN,...Wr.map((_)=>_.pattern)])],Qd=t3.filter((_)=>_.kind==="config");var PG="^[^\\u0000-\\u001f\\u007f]*$",Td={$schema:"http://json-schema.org/draft-07/schema#",$id:"https://github.com/hasna/contracts/schema/hasna.service_contract.v1.json",title:"Hasna Service Contract v1",description:"Repo self-description (hasna.contract.json) for the Hasna Service Contract v1. Hosting story, product surfaces, and storage capabilities are separate declarations; the storage backend (sqlite | postgres) is the only runtime switch.",type:"object",additionalProperties:!1,required:["schema","name","class","contractVersion","kitVersion"],allOf:[{if:{required:["class"],properties:{class:{const:"saas"}}},then:{required:["storage"],properties:{storage:{required:["mode","envPrefix"],properties:{mode:{const:"postgres"}}}}}}],properties:{$schema:{type:"string",description:"Optional editor hint pointing at this JSON Schema."},schema:{const:x.serviceContract},name:{type:"string",pattern:"^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",description:"Lowercase dashed app short-name, e.g. todos, mailery, loops."},class:{enum:["library","cli-with-store","service","saas"]},contractVersion:{const:"v1"},kitVersion:{type:"string",minLength:1,description:"Version of @hasna/contracts (the contract kit) the repo tracks."},description:{type:"string",minLength:1},bins:{type:"array",items:{type:"string",minLength:1},description:"Declared bins. Allowlisted: , -cli, -mcp, -serve, -worker, -runner, -daemon, -migrate, -doctor."},hosting:{type:"array",items:{enum:["user-hosted","hasna-saas"]},minItems:1,uniqueItems:!0,description:"Customer-facing product stories. Public OSS cores include user-hosted; add hasna-saas only when a managed control plane exists."},serviceSurfaces:{type:"array",items:{type:"object",additionalProperties:!1,required:["name","status","authMode"],allOf:[{if:{required:["status"],properties:{status:{const:"supported"},kind:{const:"api"}}},then:{required:["bin","health","readiness","version"]}}],properties:{name:{type:"string",minLength:1},kind:{enum:["api","sdk","mcp","cli"]},status:{enum:["supported","deferred","unsupported"]},bin:{type:"string",minLength:1},mcpBin:{type:"string",minLength:1},authMode:{enum:["none","local-only","api-key","session","service-token","custom"]},health:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},readiness:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},version:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},apiBasePath:{type:"string",pattern:"^/v[0-9]+$"},openApiPath:{type:"string",pattern:"^/[A-Za-z0-9_./:-]*$"},exportSubpath:{type:"string",pattern:"^\\.(?:\\/[A-Za-z0-9_.-]+(?:\\/[A-Za-z0-9_.-]+)*)?$",description:"SDK package export key such as . or ./sdk."},generatedFrom:{type:"string",pattern:"^/[A-Za-z0-9_./:-]*$",description:"OpenAPI path used to generate the SDK."},clientClassName:{type:"string",pattern:"^[A-Za-z_$][A-Za-z0-9_$]*$"},deferReason:{type:"string",minLength:1},readinessGates:{type:"array",items:{type:"object",additionalProperties:!1,required:["id","kind"],properties:{id:{type:"string",minLength:1},kind:{enum:["auth","storage","secret-ref","migration","health","readiness","redaction","smoke","operator","other"]},required:{type:"boolean"},command:{type:"string",minLength:1},evidenceRef:{type:"object"},status:{enum:["pending","passed","failed","blocked","deferred"]},summary:{type:"string",minLength:1}}}}}},description:"Declared API, SDK, MCP, and CLI product surfaces. Legacy entries without kind remain parseable; new manifests declare kind explicitly."},storage:{type:"object",additionalProperties:!1,required:["mode"],properties:{mode:{enum:["sqlite","postgres"],description:"Active data backend. sqlite|postgres ONLY \u2014 the single runtime switch."},engines:{type:"array",items:{enum:["sqlite","postgres"]},minItems:1,uniqueItems:!0,description:"Supported storage engines; capability metadata independent of the active backend."},envPrefix:{type:"string",pattern:"^HASNA_[A-Z][A-Z0-9]*_$",description:"Primary env prefix, e.g. HASNA_TODOS_."},aliasEnvPrefix:{type:"string",pattern:"^[A-Z][A-Z0-9]*_$",description:"Optional short alias env prefix, e.g. TODOS_."},databaseUrlSecretRef:{type:"string",pattern:"^hasna/oss/[a-z0-9-]+/database-url$",description:"Legacy/private-tier database secret ref. Public conformance rejects this field."},sqlitePath:{type:"string",pattern:"\\.db$",description:"Local sqlite path (~/.hasna//.db)."},pgTestGate:{type:"object",additionalProperties:!1,required:["envVar","command"],properties:{envVar:{type:"string",pattern:"^[A-Z][A-Z0-9_]*_TEST_DATABASE_URL$"},command:{type:"string",minLength:1}},description:"Environment-gated live PostgreSQL test command."}}},metadata:{type:"object",additionalProperties:!0,properties:{conformance:{type:"object",additionalProperties:!0,properties:{waiverProfile:{const:"non-node-monorepo",description:"Explicit surface-waiver eligibility for exceptional non-Node monorepos. Libraries are eligible for API/MCP waivers without this profile."},waivedSurfaces:{type:"array",uniqueItems:!0,items:{type:"object",additionalProperties:!1,required:["kind","reason"],properties:{kind:{enum:["api","sdk","mcp","cli"]},reason:{type:"string",minLength:1}}}},waivedStorageEngines:{type:"array",uniqueItems:!0,maxItems:w3.length,items:{type:"object",additionalProperties:!1,required:["engine","reason"],properties:{engine:{enum:[...w3]},reason:{type:"string",minLength:1,maxLength:i3,allOf:[{pattern:"\\S"},{pattern:PG}]},reviewedBy:{type:"string",minLength:1,maxLength:l3,allOf:[{pattern:"\\S"},{pattern:PG}]},expiresAt:{type:"string",format:"date-time"}}},description:"Explicit storage-engine exceptions, at most one per engine. Only a CLI-only cli-with-store repo (no -serve bin, storage.mode sqlite, no hasna-saas story) may waive postgres; sqlite is never waivable, expiresAt is a UTC RFC 3339 timestamp, and conformance stops honouring a waiver once it has passed."}}}}}}};var Xr="2026-07-06";function c$(_,$,D,U,g,I=[],j){return{id:_,description:$,ttlDays:D,artifactClasses:U,allowlistGlobs:g,activeRecordExclusions:I.map((N)=>({...N,required:N.required??!0})),sqliteMaintenance:j}}var qd=mG.parse({schema:x.secureLocalStorePolicy,id:"hasna-secure-local-store-defaults",createdAt:"2026-07-06T00:00:00.000Z",version:Xr,scope:[".hasna",".codewith"],defaults:{directoryMode:"0700",fileMode:"0600",dryRunDefault:!0,requireExplicitApply:!0,includeSqliteSidecars:!0,redactedEvidenceOnly:!0},lifecycle:{retentionDryRunDefault:!0,requireActiveRecordExclusionProof:!0,requireArtifactAllowlist:!0,sqliteMaintenanceRequiresExclusiveAccess:!0},stores:[{storeId:"codewith",packageName:"codewith",displayName:"Codewith native state",root:".codewith",relativePath:".",sqliteDatabaseGlobs:["logs_*.sqlite","state_*.sqlite","goals_*.sqlite"],sensitiveFileGlobs:["sessions/**/*.jsonl","shell_snapshots/**/*","logs*.sqlite","state*.sqlite","goals*.sqlite"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("codewith-session-snapshots","Codewith sessions, shell snapshots, logs, monitor output, mailbox payloads, and scheduler state need package-owned redaction before retention applies.",30,["session","snapshot","log"],["sessions/**/*.jsonl","shell_snapshots/**/*","logs/**/*"],[{id:"codewith-active-session",source:"package_adapter",description:"Exclude currently active sessions, leased schedules, monitors, pending interactions, and active goal rows."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})],notes:["Includes native .codewith DBs and transcript-like artifacts; redaction-before-persistence remains package-owned."]},{storeId:"todos",packageName:"@hasna/todos",displayName:"Todos",root:".hasna",relativePath:"todos",sqliteDatabaseGlobs:["todos.db"],sensitiveFileGlobs:["todos.db","todos.db-wal","todos.db-shm","exports/**/*","backups/**/*"],backupGlobs:["backups/**/*","*.bak","*.backup"],exportGlobs:["exports/**/*","*.jsonl","*.csv"],retentionAdapters:[c$("todos-exports-backups","Todos backups and exports are deleted only after package redaction and active task/evidence references are excluded.",14,["backup","export"],["backups/**/*","exports/**/*"],[{id:"todos-active-evidence",source:"sqlite",table:"task_files",column:"path",description:"Exclude files still referenced by active tasks, verification evidence, task comments, or handoff records."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"conversations",packageName:"@hasna/conversations",displayName:"Conversations",root:".hasna",relativePath:"conversations",sqliteDatabaseGlobs:["messages.db"],sensitiveFileGlobs:["messages.db","messages.db-wal","messages.db-shm","exports/**/*","attachments/**/*"],backupGlobs:["backups/**/*","*.bak"],exportGlobs:["exports/**/*","*.json","*.csv"],retentionAdapters:[c$("conversations-exports-attachments","Conversation exports and attachments require message-id redaction and active attachment reference checks before deletion.",14,["export","backup"],["exports/**/*","backups/**/*","attachments/**/*"],[{id:"conversations-active-attachments",source:"sqlite",table:"messages",column:"attachments",description:"Exclude attachments still referenced by retained messages or audited redaction records."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"mementos",packageName:"@hasna/mementos",displayName:"Mementos",root:".hasna",relativePath:"mementos",sqliteDatabaseGlobs:["mementos.db"],sensitiveFileGlobs:["mementos.db","mementos.db-wal","mementos.db-shm","exports/**/*","backups/**/*"],backupGlobs:["backups/**/*","*.bak"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("mementos-audit-search-history","Mementos retention must preserve active memory versions while compacting audit/search surfaces through package-owned adapters.",30,["backup","export","log"],["backups/**/*","exports/**/*","audit/**/*"],[{id:"mementos-active-memory-versions",source:"sqlite",table:"memory_versions",column:"memory_id",description:"Exclude current memory versions and audit entries required for provenance."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"knowledge",packageName:"@hasna/knowledge",displayName:"Knowledge",root:".hasna",relativePath:"knowledge",sqliteDatabaseGlobs:["knowledge.db"],sensitiveFileGlobs:["knowledge.db","knowledge.db-wal","knowledge.db-shm","db.json","migration-exports/**/*","*.bak"],backupGlobs:["*.bak","backups/**/*","*.pre-cloud-*"],exportGlobs:["migration-exports/**/*","exports/**/*","*.jsonl"],retentionAdapters:[c$("knowledge-migrations-exports","Knowledge migration exports and pre-cloud backups require replacement, encryption, or redaction before retention deletion.",14,["backup","export"],["migration-exports/**/*","exports/**/*","*.bak","*.pre-cloud-*"],[{id:"knowledge-current-catalog",source:"manifest",description:"Exclude files referenced by the active catalog or migration ledger."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"projects",packageName:"@hasna/projects",displayName:"Projects",root:".hasna",relativePath:"projects",sqliteDatabaseGlobs:["projects.db","data/*/project.db"],sensitiveFileGlobs:["projects.db","projects.db-wal","projects.db-shm","data/*/project.db","data/*/project.db-wal","data/*/project.db-shm","reports/**/*"],backupGlobs:["backups/**/*","data/*/backups/**/*"],exportGlobs:["reports/**/*","exports/**/*"],retentionAdapters:[c$("projects-reports-workspaces","Project reports, dashboards, workspaces, and per-project DBs need active workspace/location references before cleanup.",30,["backup","export","report","tmp"],["backups/**/*","reports/**/*","workspaces/**/*","data/*/backups/**/*"],[{id:"projects-active-workspaces",source:"sqlite",table:"workspaces",column:"primary_path",description:"Exclude active workspace paths, locations, linked reports, and project store artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"browser",packageName:"@hasna/browser",displayName:"Browser",root:".hasna",relativePath:"browser",sqliteDatabaseGlobs:["browser.db"],sensitiveFileGlobs:["browser.db","browser.db-wal","browser.db-shm","profiles/**/cookies.json","states/**/*.json","auth/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*","traces/**/*","har/**/*"],retentionAdapters:[c$("browser-auth-traces","Browser state, trace, HAR, and auth artifacts require session invalidation or redaction before deletion.",7,["backup","export","session","snapshot"],["profiles/**/*","states/**/*","traces/**/*","har/**/*","exports/**/*"],[{id:"browser-active-profiles",source:"sqlite",table:"sessions",column:"profile_path",description:"Exclude profiles, cookies, and storage state used by active browser sessions."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"terminal",packageName:"@hasna/terminal",displayName:"Terminal",root:".hasna",relativePath:"terminal",sqliteDatabaseGlobs:["sessions.db"],sensitiveFileGlobs:["sessions.db","sessions.db-wal","sessions.db-shm","exports/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("terminal-sessions","Terminal sessions and interactions need active session exclusion plus command-output redaction before retention.",30,["backup","export","session","log"],["backups/**/*","exports/**/*","sessions/**/*"],[{id:"terminal-active-sessions",source:"sqlite",table:"sessions",column:"id",description:"Exclude active terminal session records and any linked interaction artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"logs",packageName:"@hasna/logs",displayName:"Logs",root:".hasna",relativePath:"logs",sqliteDatabaseGlobs:["logs.db"],sensitiveFileGlobs:["logs.db","logs.db-wal","logs.db-shm","exports/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("logs-retention","Logs require redaction before compaction and must preserve active incident/evidence references.",14,["backup","export","log"],["backups/**/*","exports/**/*","*.log","logs/**/*"],[{id:"logs-active-evidence",source:"sqlite",table:"logs",column:"id",description:"Exclude log rows or files linked to active incidents, tasks, or proof bundles."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"loops",packageName:"@hasna/loops",displayName:"OpenLoops",root:".hasna",relativePath:"loops",sqliteDatabaseGlobs:["loops.db","state.db","*.sqlite"],sensitiveFileGlobs:["*.db","*.sqlite","*.db-wal","*.db-shm","reports/**/*","tmp/**/*","runs/**/*"],backupGlobs:["backups/**/*","tmp/**/*"],exportGlobs:["reports/**/*","runs/**/*","exports/**/*"],retentionAdapters:[c$("loops-reports-tmp","Loop reports, tmp files, workflow artifacts, and command output need run-state checks and redaction before retention deletion.",14,["backup","export","report","tmp","log"],["reports/**/*","tmp/**/*","runs/**/*","exports/**/*"],[{id:"loops-active-runs",source:"sqlite",table:"loop_runs",column:"id",description:"Exclude active, leased, recently failed, or evidence-linked loop and workflow run artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]}],warnings:["This package publishes declarations only; each owning package implements and verifies its own local-store lifecycle.","Retention and redaction evidence remain package-owned and must preserve active-record exclusions.","SQLite maintenance is descriptive policy metadata only and is never executed by @hasna/contracts."]});var Rr=64,Bd=new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${Rr-1}}$`),gD="[0-9a-fA-F]",Vd=new RegExp(`^\\{?(?:${gD}{8}-${gD}{4}-${gD}{4}-${gD}{4}-${gD}{12}|${gD}{32})\\}?$`);var Gr=/^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;var Kd=new RegExp(Gr.source.replace(/^\^/,"\\b").replace(/\$$/,"\\b"));var oG="@hasna/knowledge";function Yr(_){if(!Number.isFinite(_??0))return 20;return Math.max(1,Math.min(100,Math.trunc(_??20)))}function Qr(_){return _.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").replace(/-{2,}/g,"-")||"project"}function qU(_,$=180){let D=String(_??"").replace(/\s+/g," ").trim();if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-3))}...`}function C_(_,$=""){return typeof _==="string"&&_.length>0?_:$}function BU(_){return typeof _==="number"&&Number.isFinite(_)?_:0}function BD(_){if(typeof _!=="string"||_.length===0)return;let $=_.includes("T")?_:`${_.replace(" ","T")}Z`,D=new Date($);return Number.isNaN(D.valueOf())?void 0:D.toISOString()}function zN(_){return H$.safeParse(_).success}function k$(_,$,D,U,g=[]){return{kind:_,id:$,name:D,uri:U&&zN(U)?U:void 0,externalId:$,sourcePackage:oG,tags:g}}function Tr(_){return[..._.items.flatMap((D)=>[D.updated_at,D.created_at]),..._.sources.flatMap((D)=>[D.updated_at,D.created_at]),..._.chunks.map((D)=>D.created_at),..._.wiki_pages.flatMap((D)=>[D.updated_at,D.created_at]),..._.storage_objects.flatMap((D)=>[D.updated_at,D.created_at]),..._.runs.flatMap((D)=>[D.updated_at,D.created_at]),..._.reindex_queue.flatMap((D)=>[D.updated_at,D.created_at]),..._.sync_conflicts.map((D)=>D.created_at),..._.approval_gates.flatMap((D)=>[D.updated_at,D.created_at])].map(BD).filter(Boolean).sort((D,U)=>U.localeCompare(D))[0]}function qr(_){if(!_)return"unknown";let $=Date.now()-new Date(_).valueOf();if(!Number.isFinite($))return"unknown";return $>2592000000?"stale":"fresh"}function Br(_){let $=(D)=>{let U=String(D??"").toLowerCase();return U!==""&&!["done","complete","completed","resolved","succeeded","skipped"].includes(U)};return _.reindex_queue.filter((D)=>$(D.status)).length+_.sync_conflicts.filter((D)=>$(D.status)).length+_.approval_gates.filter((D)=>$(D.status)).length}function Vr(_,$){let D=[];for(let U of _.items.slice(0,$))D.push({id:`item_${U.id}`,title:U.title,summary:qU(U.content_preview),status:U.archived?"archived":"active",priority:"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("knowledge",U.id,U.title,`knowledge://item/${encodeURIComponent(U.id)}`,U.tags)],evidenceRefs:U.url&&zN(U.url)?[{id:`url_${U.id}`,kind:"url",uri:U.url,summary:"Source URL for this knowledge item."}]:[],metadata:{source:"legacy_store",archived:U.archived,tags:U.tags,url:U.url||void 0}});for(let U of _.sources.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,C_(U.uri,"source")),I=C_(U.title,C_(U.uri,g)),j=C_(U.uri,`knowledge://source/${encodeURIComponent(g)}`);D.push({id:`source_${g}`,title:I,summary:qU(`${BU(U.chunks)} chunk(s), ${BU(U.revisions)} revision(s)`),status:BU(U.chunks)>0?"indexed":"source",priority:"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("document",g,I,j)],evidenceRefs:zN(j)?[{id:`source_${g}`,kind:"url",uri:j,summary:"Source reference."}]:[],metadata:{source:"knowledge_db.sources",kind:U.kind,chunks:BU(U.chunks),revisions:BU(U.revisions)}})}for(let U of _.chunks.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"chunk"),I=C_(U.source_uri);D.push({id:`chunk_${g}`,title:C_(U.wiki_title,I?`Chunk from ${I}`:`Knowledge chunk ${g}`),summary:qU(U.text_preview),status:"chunk",priority:"low",timestamp:BD(U.created_at),resourceRefs:[k$("context_pack",g,C_(U.wiki_title,g),`knowledge://chunk/${encodeURIComponent(g)}`)],evidenceRefs:I&&zN(I)?[{id:`chunk_source_${g}`,kind:"url",uri:I,summary:"Chunk source reference."}]:[],metadata:{source:"knowledge_db.chunks",source_uri:I||void 0,token_count:U.token_count,ordinal:U.ordinal}})}for(let U of _.sync_conflicts.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"sync_conflict");D.push({id:`sync_conflict_${g}`,title:`Sync conflict: ${C_(U.entity_kind,"entity")}/${C_(U.entity_id,g)}`,summary:qU(`Status ${C_(U.status,"unknown")}; strategy ${C_(U.resolution_strategy,"none")}.`),status:C_(U.status,"unknown"),priority:"critical",timestamp:BD(U.created_at),resourceRefs:[k$("finding",g,"Knowledge sync conflict",`knowledge://sync-conflict/${encodeURIComponent(g)}`)],metadata:{source:"knowledge_db.sync_conflicts",local_machine_id:U.local_machine_id,remote_machine_id:U.remote_machine_id}})}for(let U of _.reindex_queue.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"reindex");D.push({id:`reindex_${g}`,title:`Reindex ${C_(U.kind,"item")}: ${C_(U.target_id,g)}`,summary:qU(U.reason),status:C_(U.status,"unknown"),priority:C_(U.status).toLowerCase()==="failed"?"high":"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("action",g,"Knowledge reindex work item",`knowledge://reindex/${encodeURIComponent(g)}`)],metadata:{source:"knowledge_db.reindex_queue",attempts:U.attempts,source_uri:U.source_uri}})}return D.slice(0,$)}async function pG(_,$={}){let D=Yr($.limit),U=new Date().toISOString(),g=Qr(_),j=await($.service??IN({scope:$.scope??"project",cwd:$.cwd})).resolveInventory({limit:D,storePath:$.storePath,includeArchived:$.includeArchived}),N=Tr(j),O=qr(N),A=j.summary.active_items+j.summary.sources+j.summary.chunks+j.summary.wiki_pages+j.summary.storage_objects,L=Br(j),z=A===0?"empty":O==="stale"?"stale":"ready",W=Vr(j,D),J={schema:x.projectPanel,id:`knowledge_panel_${g}`,createdAt:U,projectId:g,provider:{kind:"knowledge",id:`knowledge_${g}`,name:"Knowledge",sourcePackage:oG,externalId:j.home},kind:"knowledge",title:"Knowledge",summary:z==="empty"?"No project knowledge items, sources, chunks, or wiki pages are available yet.":`${j.summary.active_items} active note(s), ${j.summary.sources} source(s), ${j.summary.chunks} chunk(s), and ${j.summary.wiki_pages} wiki page(s).`,state:z,stateReason:z==="stale"?"Latest indexed knowledge activity is older than 30 days.":void 0,generatedAt:U,freshness:O,metrics:[{id:"active_items",label:"Active notes",value:j.summary.active_items,status:j.summary.active_items>0?"good":"unknown"},{id:"sources",label:"Sources",value:j.summary.sources,status:j.summary.sources>0?"good":"unknown"},{id:"chunks",label:"Chunks",value:j.summary.chunks,status:j.summary.chunks>0?"good":"unknown"},{id:"wiki_pages",label:"Wiki pages",value:j.summary.wiki_pages,status:j.summary.wiki_pages>0?"good":"unknown"},{id:"artifacts",label:"Artifacts",value:j.summary.storage_objects,status:j.summary.storage_objects>0?"good":"unknown"},{id:"vector_entries",label:"Vector entries",value:j.summary.vector_entries,status:j.summary.vector_entries>0?"good":"unknown"},{id:"unresolved",label:"Unresolved",value:L,status:L>0?"warning":"good"}],items:W,actions:[k$("action","knowledge:inventory","Inspect knowledge inventory"),k$("action","knowledge:context-pack","Build cited context pack"),k$("action","knowledge:ingest","Ingest project source")],resourceRefs:[k$("project",g,_,`project://${g}`),k$("knowledge",`home_${g}`,"Knowledge workspace",`knowledge://workspace/${encodeURIComponent(g)}`),k$("artifact",`db_${g}`,"Knowledge database",`knowledge://db/${encodeURIComponent(g)}`)],renderFragment:{renderer:"json_render",title:"Knowledge",spec:{component:"project.knowledge.summary",metrics:["active_items","sources","chunks","wiki_pages","unresolved"],itemLimit:D}},metadata:{scope:j.scope,home:j.home,json_store_exists:j.paths.json_store_exists,latest_activity_at:N}};return tG(x.projectPanel,J)}function eG(_){let $=[`${_.title}: ${_.state}`,_.summary??"",..._.metrics.map((D)=>`${D.label}: ${D.value}`)].filter(Boolean);if(_.items.length>0){$.push("Items:");for(let D of _.items.slice(0,10))if($.push(`- ${D.title}${D.status?` [${D.status}]`:""}`),D.summary)$.push(` ${D.summary}`)}return $.join(` -`)}var _8=["sources","wiki_pages","source_revisions","chunks","chunk_embeddings","wiki_backlinks","citations","knowledge_indexes","runs","run_events","provider_usage","redaction_findings","storage_objects","audit_events","approval_gates","vector_index_entries","reindex_queue","knowledge_machines","knowledge_sync_snapshots","knowledge_sync_changes","knowledge_sync_conflicts","knowledge_sync_table_clocks","knowledge_sync_imports"];var $8="HASNA_KNOWLEDGE_STORAGE_MODE",D8="KNOWLEDGE_STORAGE_MODE";function aG(_){return process.env[_]?.trim()||void 0}function sG(_){let $=_?.trim().toLowerCase().replace(/-/g,"_");if($==="sqlite")return"sqlite";if($==="postgres"||$==="postgresql")return"postgres";return}function Kr(_={}){let $=g0(HU(_.scope,_.cwd).home);return h($.knowledgeDbPath),{db:v($.knowledgeDbPath),path:$.knowledgeDbPath,scope:_.scope??"global"}}function g8(){let _=sG(aG($8))??sG(aG(D8));if(_)return _;return"sqlite"}function o3(_={}){let $=Kr(_);try{Fr($.db);let D=$.db.query("SELECT table_name, last_synced_at, direction FROM _knowledge_sync_meta ORDER BY table_name, direction").all();return{mode:g8(),service:"knowledge",scope:$.scope,databasePath:$.path,tables:_8,sync:D}}finally{$.db.close()}}function Fr(_){_.exec(` + `,[D]).map(Lb),e={legacy_items:g.items.length,active_items:I.length,archived_items:g.items.length-I.length,schema_version:O.schema_version,sources:O.sources,source_revisions:O.source_revisions,chunks:O.chunks,wiki_pages:O.wiki_pages,citations:O.citations,indexes:O.indexes,runs:O.runs,run_events:O.run_events,storage_objects:O.storage_objects,embeddings:O.embeddings,vector_entries:O.vector_entries,reindex_queue:O.reindex_queue,redaction_findings:O.redaction_findings,audit_events:O.audit_events,approval_gates:O.approval_gates,knowledge_machines:O.knowledge_machines,sync_snapshots:O.sync_snapshots,sync_changes:O.sync_changes,sync_conflicts:O.sync_conflicts,sync_table_clocks:O.sync_table_clocks,sync_imports:O.sync_imports,promotion_candidates:O.promotion_candidates,durable_records:O.durable_records};return{ok:!0,scope:this.scope,home:$.home,limit:D,paths:{json_store_path:U,json_store_exists:g.exists,knowledge_db_path:$.knowledgeDbPath,knowledge_db_exists:!0,artifacts_dir:$.artifactsDir,indexes_dir:$.indexesDir,logs_dir:$.logsDir,wiki_dir:$.wikiDir},summary:e,legacy_store:{path:U,exists:g.exists,read_error:g.read_error,total_items:g.items.length,active_items:I.length,archived_items:g.items.length-I.length,items_returned:Math.min(j.length,D)},items:j.slice(0,D).map(nG),sources:L,source_revisions:z,chunks:W,wiki_pages:J,indexes:P,storage_objects:S,runs:X,vector_indexes:G,reindex_queue:R,machines:V,sync_conflicts:Q,approval_gates:T,audit_events:q,promotion_candidates:K,durable_records:Z,message:`${g.items.length} item(s), ${O.sources} source(s), ${O.chunks} chunk(s), ${O.wiki_pages} wiki page(s), ${O.storage_objects} artifact(s)`}}finally{A.close()}}assertAppWikiWrite(_){xD({scope:this.scope,workspace:this.workspace,safetyPolicy:this.safetyPolicy(),allowGlobal:_})}async initAppWiki(_={}){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return UW({scope:this.scope,workspace:$,store:this.artifactStore(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal})}async addAppWikiNote(_){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return IW({scope:this.scope,workspace:$,store:this.artifactStore(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal,title:_.title,content:_.content,tags:_.tags,sourceRefs:_.sourceRefs,path:_.path,metadata:_.metadata})}listAppWikiNotes(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return[];return jW({dbPath:$.knowledgeDbPath,limit:_.limit})}async getAppWikiNote(_,$={}){let D=this.workspace;if(!W_(D.knowledgeDbPath))return null;return NW({dbPath:D.knowledgeDbPath,store:this.artifactStore(),id:_,includeContent:$.includeContent})}async addAppWikiSourceRef(_){this.assertAppWikiWrite(_.allowGlobal);let $=this.ensureWorkspace();return EW({scope:this.scope,workspace:$,sourceRef:_.sourceRef,purpose:_.purpose,config:this.config(),safetyPolicy:this.safetyPolicy(),allowGlobal:_.allowGlobal})}async searchAppWiki(_){return this.search(_)}async queryAppWiki(_){return this.retrieveContext(_)}async initWiki(){let _=this.ensureWorkspace();h(_.knowledgeDbPath);let $=await VG(this.artifactStore()),D=v(_.knowledgeDbPath);try{s$(D,$.artifacts),KG(D,$.artifacts)}finally{D.close()}return $}async compileWiki(_={}){let $=this.ensureWorkspace();return QG({..._,dbPath:$.knowledgeDbPath,store:this.artifactStore()})}async fileAnswer(_){let $=this.ensureWorkspace(),D=await this.retrieveContext({query:_.prompt,limit:_.limit,semantic:_.semantic,modelRef:_.modelRef,dimensions:_.dimensions,fake:_.fake});return TG({dbPath:$.knowledgeDbPath,store:this.artifactStore(),prompt:_.prompt,answer:_.answer,context:D,approveWrite:_.approveWrite})}lintWiki(){let _=this.ensureWorkspace();return qG({dbPath:_.knowledgeDbPath})}async ingestManifest(_){let $=this.ensureWorkspace();return sS({dbPath:$.knowledgeDbPath,input:_,config:this.config(),safetyPolicy:this.safetyPolicy()})}async ingestSource(_,$){let D=this.ensureWorkspace();return eU({dbPath:D.knowledgeDbPath,sourceRef:_,purpose:$,config:this.config(),safetyPolicy:this.safetyPolicy()})}async importRulesProvenance(_={}){let $=_.dryRun!==!1,D=$?this.workspace:this.ensureWorkspace();return AG({root:_.root??this.options.cwd??process.cwd(),scope:this.scope,owner:_.owner,dryRun:$,deprecateLegacy:_.deprecateLegacy,includeLegacy:_.includeLegacy,legacyStorePath:D.jsonStorePath,dbPath:D.knowledgeDbPath,safetyPolicy:this.safetyPolicy(),maxItems:_.maxItems,limit:_.limit})}async resolveSource(_,$={}){let D=this.ensureWorkspace();return tU({dbPath:D.knowledgeDbPath,sourceRef:_,purpose:$.purpose,limit:$.limit,safetyPolicy:this.safetyPolicy()})}async consumeOutbox(_){let $=this.ensureWorkspace();return TR({dbPath:$.knowledgeDbPath,input:_,config:this.config(),safetyPolicy:this.safetyPolicy()})}reindexHealth(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return Wb();return sR({..._,dbPath:$.knowledgeDbPath,config:this.config()})}enqueueReindex(_={}){let $=this.ensureWorkspace();return I3({..._,dbPath:$.knowledgeDbPath,config:this.config()})}async refreshEmbeddings(_={}){let $=this.ensureWorkspace();return _G({..._,dbPath:$.knowledgeDbPath,config:this.config()})}providerStatus(_=process.env){return PW(this.config(),_)}modelRegistry(){return XE(this.config())}embeddingStatus(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return Xb();return GW(_.knowledgeDbPath)}async indexEmbeddings(_={}){let $=this.ensureWorkspace();return _I({..._,dbPath:$.knowledgeDbPath,config:this.config()})}isApiMode(){return Y6()}async fetchCloudItems(){let _=uD();if(!_)throw Error("knowledge: cloud store requested but not resolvable (check HASNA_KNOWLEDGE_API_URL + HASNA_KNOWLEDGE_API_KEY).");return hU(_)}async semanticSearch(_){let $=this.workspace;if(this.isApiMode()){let D=await this.fetchCloudItems(),U=await j4(D,{..._},["semantic_search_requires_local_catalog"]);return{provider:"openai",model:"text-embedding-3-small",dimensions:_.dimensions??1536,query:_.query,results:U.results}}if(!W_($.knowledgeDbPath))return{provider:"openai",model:"text-embedding-3-small",dimensions:_.dimensions??1536,query:_.query,results:[]};return $I({..._,dbPath:$.knowledgeDbPath,config:this.config()})}async search(_){let $=this.workspace;if(this.isApiMode()){let U=await this.fetchCloudItems();return j4(U,_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){if(W_(D))return II({..._,legacyStorePath:D,config:this.config()});return $9(_.query,Math.max(1,Math.min(_.limit??10,100)),_.semantic===!0||_.fake===!0||Boolean(_.modelRef))}return UI({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async retrieveContext(_){let $=this.workspace;if(this.isApiMode()){let U=await this.fetchCloudItems();return NI(U,_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){if(W_(D)){let U=await II({..._,legacyStorePath:D,config:this.config()});return G0(U,{contextChars:_.contextChars})}return zb(_.query,Math.max(1,Math.min(_.limit??10,100)),_.semantic===!0||_.fake===!0||Boolean(_.modelRef))}return Y0({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async contextPack(_){let $=this.workspace;if(this.isApiMode()){let U=(_.query??_.topic??"").trim();if(U&&_.source!=="loops"&&_.source!=="runs"){let g=await this.fetchCloudItems(),I=await j4(g,{..._,query:U}),j=G0(I,{contextChars:_.contextChars});return iG(_,j,this.safetyPolicy())}return lG(_)}let D=V3(this.scope,$,_.legacyStorePath);if(!W_($.knowledgeDbPath)){let U=(_.query??_.topic??"").trim();if(U&&_.source!=="loops"&&_.source!=="runs"&&W_(D)){let g=await II({..._,query:U,legacyStorePath:D,config:this.config()}),I=G0(g,{contextChars:_.contextChars});return iG(_,I,this.safetyPolicy())}return lG(_)}return oW({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config(),safetyPolicy:this.safetyPolicy()})}async runPrompt(_){if(this.isApiMode()){let U=await this.fetchCloudItems();return yW(U,{..._,config:this.config()})}let $=this.ensureWorkspace(),D=_.legacyStorePath??$.jsonStorePath;if(!_.legacyStorePath)kD(D);return xW({..._,dbPath:$.knowledgeDbPath,legacyStorePath:D,config:this.config()})}async webSearch(_){let $=this.ensureWorkspace();return zG({..._,dbPath:$.knowledgeDbPath,config:this.config(),safetyPolicy:this.safetyPolicy()})}async machineTopology(_={}){let $=this.workspace;return wR({..._,knowledge:{scope:this.scope,workspace_home:$.home}})}async machinePreflight(_={}){let $=this.workspace;return yR({..._,knowledge:{scope:this.scope,workspace_home:$.home}})}syncStatus(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return Rb({scope:this.scope,workspaceHome:_.home});return RX({dbPath:_.knowledgeDbPath,scope:this.scope,workspaceHome:_.home})}async syncDoctor(_={}){let $=this.ensureWorkspace();h($.knowledgeDbPath);let D=this.syncStatus(),U=this.storageContract(),g=this.validateStorage(),I=Gb($.knowledgeDbPath,U),j=_.machine?.trim()||null,N=_.peerWorkspace?.trim()||null,O=[],A=null,L=null;if(j&&!eG(j)){let S=await _3({machineId:j,includeTailscale:_.includeTailscale});A=B3(S),O.push(...S.warnings)}if(j||N){let S=await lj({machineId:j??q3($),peerWorkspace:N,includeTailscale:_.includeTailscale});if(j&&!N&&(A?.source==="raw"||!S.ok||!S.project_root)){let X=uG($.knowledgeDbPath,j);if(X){if(A?.source==="raw"&&X.ssh_target)A=B3(xG(X,j,{target:A.target,route:A.route,targetKind:A.target_kind,confidence:A.confidence,source:A.source,adapter:A.adapter,evidence:A.evidence,cacheability:A.cacheability,warnings:[]}));if(!S.ok||!S.project_root){let G=yG(X,j,S);if(G)L=LU(G,G.project_root),O.push(...G.warnings)}}}L=S.ok&&S.project_root?LU(S,S.project_root):L??{...LU(S,N??""),project_root:S.project_root??N??""},O.push(...S.warnings)}if(!g.ok)O.push(...g.errors.map((S)=>`storage:${S}`));let z=Nb($.knowledgeDbPath,L);if(!z.ok)O.push("open_files_boundary_raw_payload_sentinels");if(!I.ok)O.push(...I.warnings);let W=L?.diagnostics.filter((S)=>S.severity==="fail")??[],J=g.ok&&I.ok&&z.ok&&W.length===0&&(L?.project_root!==""||!L),P=Qb({scope:this.scope,machine:j,peerWorkspace:N,tables:_.tables,resolvedWorkspace:L,openConflicts:D.conflicts.open});return{ok:J,read_only:!0,generated_at:new Date().toISOString(),scope:this.scope,workspace_home:$.home,database:{sqlite_schema_version:D.sqlite_schema_version,table_counts:D.table_counts},storage:{contract:U,validation:g,artifact_manifest:I},sync:{machines:D.machines.total,snapshots:D.snapshots.total,clocks:D.clocks.total,imports:D.imports.total,open_conflicts:D.conflicts.open,table_clocks:D.clocks.rows},open_files:z,resolved_route:A,resolved_workspace:L,recommended_commands:P,warnings:[...new Set(O)],message:J?`Sync readiness ok: ${D.clocks.total} table clock(s), ${D.conflicts.open} open conflict(s)`:`Sync readiness needs attention: ${[...new Set(O)].join(", ")||"workspace diagnostics failed"}`}}repairArtifactManifestKeys(_={}){let $=this.ensureWorkspace();h($.knowledgeDbPath);let D=this.storageContract(),U=b3(D),g=Yb($.knowledgeDbPath,D),I=_.dryRun===!0||_.approveWrite!==!0;if(g.length===0)return{ok:!0,dry_run:I,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:"No legacy S3 artifact manifest keys found"};if(_.dryRun===!0)return{ok:!0,dry_run:!0,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:`Would repair ${g.length} legacy S3 artifact manifest key(s)`};if(_.approveWrite!==!0||!_.approvedBy)return{ok:!1,dry_run:!0,approval_required:!0,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:0,audit_event_id:null,message:"Artifact key repair requires --approve-write and --approved-by "};let j=v($.knowledgeDbPath);try{let N=new Date().toISOString();j.transaction((L)=>{let z=j.query("UPDATE storage_objects SET metadata_json = ?, updated_at = ? WHERE id = ?"),W=j.query("SELECT id, metadata_json FROM storage_objects").all(),J=new Map(W.map((P)=>[P.id,c4(P.metadata_json)]));for(let P of L){let S=J.get(P.id)??{};S.key=P.repaired_key,z.run(JSON.stringify(S),N,P.id)}})(g);let A=X_(j,{event_type:"artifact_manifest_key_repair",action:"storage.artifact_manifest.repair_keys",target_uri:`knowledge-storage://${$.home}/storage_objects`,decision:"allow",metadata:{approved_by:_.approvedBy,repaired:g.length,storage_type:D.storage_type,storage_prefix:U,artifact_uris:g.map((L)=>L.artifact_uri)}});return{ok:!0,dry_run:!1,approval_required:!1,storage_type:D.storage_type,storage_prefix:U,candidates:g,repaired:g.length,audit_event_id:A,message:`Repaired ${g.length} legacy S3 artifact manifest key(s)`}}finally{j.close()}}async createSyncSnapshot(_={}){let $=this.ensureWorkspace(),D=await this.machineTopology({includeTailscale:_.includeTailscale!==!1});return XX({dbPath:$.knowledgeDbPath,scope:this.scope,workspaceHome:$.home,storage:this.storageContract(),topology:D,machineId:_.machineId})}syncConflicts(_={}){let $=this.workspace;if(!W_($.knowledgeDbPath))return[];return GX($.knowledgeDbPath,_)}syncConflict(_){let $=this.ensureWorkspace(),D=XI($.knowledgeDbPath,_);if(!D)throw Error(`Sync conflict not found: ${_}`);return D}proposeSyncConflictResolution(_){let $=this.ensureWorkspace();return oD($.knowledgeDbPath,_)}async proposeSyncConflictResolutionWithAi(_){let $=this.ensureWorkspace();return YR({dbPath:$.knowledgeDbPath,id:_.id,config:this.config(),modelRef:_.modelRef,fake:_.fake,env:_.env})}resolveSyncConflict(_){let $=this.ensureWorkspace(),D=oD($.knowledgeDbPath,_.id);if(_.approveWrite!==!0||!_.approvedBy)return{ok:!1,approval_required:!0,conflict:D.conflict,proposal:D,message:"Sync conflict resolution requires --approve-write and --approved-by "};let U=TX($.knowledgeDbPath,{id:_.id,strategy:_.strategy??D.proposed_strategy,approvedBy:_.approvedBy,proposedPatchUri:_.proposedPatchUri}),g=v($.knowledgeDbPath);try{let I=X_(g,{event_type:"sync_conflict_resolution",action:"sync.conflict.resolve",target_uri:`knowledge-sync-conflict://${_.id}`,decision:"allow",metadata:{conflict_id:_.id,entity_kind:U.entity_kind,entity_id:U.entity_id,strategy:U.resolution_strategy,approved_by:U.approved_by,proposed_patch_uri:U.proposed_patch_uri}});return{ok:!0,approval_required:!1,conflict:U,audit_event_id:I,message:`Resolved sync conflict ${_.id}`}}finally{g.close()}}syncMachines(){let _=this.workspace;if(!W_(_.knowledgeDbPath))return[];return fE(_.knowledgeDbPath)}exportSyncBundle(_={}){let $=this.ensureWorkspace();return this.assertStorageValid("sync export"),h($.knowledgeDbPath),tD({dbPath:$.knowledgeDbPath,scope:this.scope,workspaceHome:$.home,storage:this.storageContract(),machineId:_.machineId??null,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.recordClocks!==!1})}async importSyncBundle(_){let $=this.ensureWorkspace();return this.assertStorageValid("sync import"),h($.knowledgeDbPath),WI({targetDbPath:$.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:$.home,targetStorage:this.storageContract(),targetStore:this.artifactStore(),bundle:_.bundle,direction:_.direction??"import",dryRun:_.dryRun,localMachineId:_.machineId??null})}async syncRemotePeer(_){let $=_.direction??"both",D=_.dryRun===!0,U=this.ensureWorkspace();h(U.knowledgeDbPath);let g=_.tables?.length?["--tables",_.tables.join(",")]:[],I=_.includeArtifactContent===!1?["--no-artifact-content"]:[],j=["--scope",this.scope,"--json"],N=await _3({machineId:_.machine,includeTailscale:_.includeTailscale}),O=await lj({machineId:_.machine,peerWorkspace:_.peerWorkspace,includeTailscale:_.includeTailscale});if(!_.peerWorkspace&&N.source==="raw"||!O.ok||!O.project_root){let J=uG(U.knowledgeDbPath,_.machine);if(J){if(!_.peerWorkspace&&N.source==="raw"&&J.ssh_target)N=xG(J,_.machine,N);if(!O.ok||!O.project_root){let P=yG(J,_.machine,O);if(P)O=P}}}if(!O.ok||!O.project_root)throw Error([`Unable to resolve peer workspace for ${_.machine}.`,"Pass --peer-workspace or configure workspace path mapping in machines.",O.warnings.length?`Warnings: ${O.warnings.join(", ")}`:null].filter(Boolean).join(" "));let A=O.project_root,L={ok:!0,dry_run:D,direction:$,transport:"ssh",machine:_.machine,resolved_machine:N.target,resolved_route:B3(N),resolved_workspace:LU(O,O.project_root),peer_workspace:A,message:""},z=!1,W=()=>{if(D||z)return;zX(U.knowledgeDbPath,{machineId:_.machine,route:N,workspace:O}),z=!0};if($==="pull"||$==="both"){let J=wG(A,["sync","export",...j,...g,...I]),P=tG(_.machine,J,void 0,N),S=oG(_.machine,"sync export",P);qb(_.machine,S),L.pull=await this.importSyncBundle({bundle:S,dryRun:D,direction:"pull",machineId:_.machineId??null})}if($==="push"||$==="both"){W();let J=this.exportSyncBundle({machineId:_.machineId??null,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:!D}),P=wG(A,["sync","import",...j,...D?["--dry-run"]:[]]),S=oG(_.machine,"sync import",tG(_.machine,P,JSON.stringify(J),N));Bb(_.machine,S),L.push=S}return L.ok=(L.pull?.ok??!0)&&(L.push?.ok??!0),W(),L.message=[hG(L.resolved_workspace),L.pull?`pull: ${L.pull.message}`:null,L.push?`push: ${L.push.message}`:null].filter(Boolean).join("; "),L}async syncPeer(_){let $=_.direction??"both",D=this.ensureWorkspace();h(D.knowledgeDbPath);let U=pG(_.peerWorkspace),g=sZ(U);h(g.knowledgeDbPath);let I=ZN(g.configPath),j=mU(I,g,this.scope),N=gE(I,g),O=_.machineId??q3(D),A=q3(g),L=await lj({machineId:_.machineId??A,peerWorkspace:U,includeTailscale:!1}),z=()=>tD({dbPath:D.knowledgeDbPath,scope:this.scope,workspaceHome:D.home,storage:this.storageContract(),machineId:O,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.dryRun!==!0}),W=()=>tD({dbPath:g.knowledgeDbPath,scope:this.scope,workspaceHome:g.home,storage:j,machineId:A,tables:_.tables,includeArtifactContent:_.includeArtifactContent,recordClocks:_.dryRun!==!0}),J={ok:!0,dry_run:_.dryRun===!0,direction:$,resolved_workspace:LU(L,L.project_root??U),message:""};if($==="pull"||$==="both")J.pull=await WI({targetDbPath:D.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:D.home,targetStorage:this.storageContract(),targetStore:this.artifactStore(),bundle:W(),targetBundle:z(),direction:"pull",dryRun:_.dryRun,localMachineId:O});if($==="push"||$==="both")J.push=await WI({targetDbPath:g.knowledgeDbPath,targetScope:this.scope,targetWorkspaceHome:g.home,targetStorage:j,targetStore:N,bundle:z(),targetBundle:W(),direction:"push",dryRun:_.dryRun,localMachineId:A});return J.ok=(J.pull?.ok??!0)&&(J.push?.ok??!0),J.message=[hG(J.resolved_workspace),J.pull?`pull: ${J.pull.message}`:null,J.push?`push: ${J.push.message}`:null].filter(Boolean).join("; "),J}}function IN(_={}){return new D9(_)}import{createHash as g9}from"crypto";var Kb=Object.defineProperty,Fb=(_)=>_;function Mb(_,$){this[_]=Fb.bind(null,$)}var Zb=(_,$)=>{for(var D in $)Kb(_,D,{get:$[D],enumerable:!0,configurable:!0,set:Mb.bind($,D)})},E={};Zb(E,{void:()=>PH,util:()=>U_,unknown:()=>LH,union:()=>XH,undefined:()=>EH,tuple:()=>YH,transformer:()=>j9,symbol:()=>NH,string:()=>Y9,strictObject:()=>WH,setErrorMap:()=>kb,set:()=>qH,record:()=>QH,quotelessJson:()=>bb,promise:()=>ZH,preprocess:()=>kH,pipeline:()=>CH,ostring:()=>rH,optional:()=>bH,onumber:()=>vH,oboolean:()=>fH,objectUtil:()=>C3,object:()=>SH,number:()=>Q9,nullable:()=>HH,null:()=>OH,never:()=>JH,nativeEnum:()=>MH,nan:()=>UH,map:()=>TH,makeIssue:()=>EN,literal:()=>KH,lazy:()=>VH,late:()=>DH,isValid:()=>n4,isDirty:()=>v3,isAsync:()=>SU,isAborted:()=>r3,intersection:()=>GH,instanceof:()=>gH,getParsedType:()=>P6,getErrorMap:()=>NN,function:()=>BH,enum:()=>FH,effect:()=>j9,discriminatedUnion:()=>RH,defaultErrorMap:()=>OD,datetimeRegex:()=>X9,date:()=>jH,custom:()=>G9,coerce:()=>wH,boolean:()=>T9,bigint:()=>IH,array:()=>zH,any:()=>AH,addIssueToContext:()=>u,ZodVoid:()=>XU,ZodUnknown:()=>m6,ZodUnion:()=>PD,ZodUndefined:()=>LD,ZodType:()=>__,ZodTuple:()=>d$,ZodTransformer:()=>R$,ZodSymbol:()=>WU,ZodString:()=>F$,ZodSet:()=>i4,ZodSchema:()=>__,ZodRecord:()=>RU,ZodReadonly:()=>YD,ZodPromise:()=>l4,ZodPipeline:()=>QU,ZodParsedType:()=>y,ZodOptional:()=>Z$,ZodObject:()=>b_,ZodNumber:()=>i6,ZodNullable:()=>z6,ZodNull:()=>JD,ZodNever:()=>n$,ZodNativeEnum:()=>XD,ZodNaN:()=>YU,ZodMap:()=>GU,ZodLiteral:()=>WD,ZodLazy:()=>SD,ZodIssueCode:()=>k,ZodIntersection:()=>zD,ZodFunction:()=>ND,ZodFirstPartyTypeKind:()=>i,ZodError:()=>O$,ZodEnum:()=>t6,ZodEffects:()=>R$,ZodDiscriminatedUnion:()=>LN,ZodDefault:()=>RD,ZodDate:()=>d4,ZodCatch:()=>GD,ZodBranded:()=>JN,ZodBoolean:()=>AD,ZodBigInt:()=>l6,ZodArray:()=>M$,ZodAny:()=>m4,Schema:()=>__,ParseStatus:()=>m_,OK:()=>a_,NEVER:()=>uH,INVALID:()=>m,EMPTY_PATH:()=>Cb,DIRTY:()=>jD,BRAND:()=>$H});var U_;(function(_){_.assertEqual=(g)=>{};function $(g){}_.assertIs=$;function D(g){throw Error()}_.assertNever=D,_.arrayToEnum=(g)=>{let I={};for(let j of g)I[j]=j;return I},_.getValidEnumValues=(g)=>{let I=_.objectKeys(g).filter((N)=>typeof g[g[N]]!=="number"),j={};for(let N of I)j[N]=g[N];return _.objectValues(j)},_.objectValues=(g)=>{return _.objectKeys(g).map(function(I){return g[I]})},_.objectKeys=typeof Object.keys==="function"?(g)=>Object.keys(g):(g)=>{let I=[];for(let j in g)if(Object.prototype.hasOwnProperty.call(g,j))I.push(j);return I},_.find=(g,I)=>{for(let j of g)if(I(j))return j;return},_.isInteger=typeof Number.isInteger==="function"?(g)=>Number.isInteger(g):(g)=>typeof g==="number"&&Number.isFinite(g)&&Math.floor(g)===g;function U(g,I=" | "){return g.map((j)=>typeof j==="string"?`'${j}'`:j).join(I)}_.joinValues=U,_.jsonStringifyReplacer=(g,I)=>{if(typeof I==="bigint")return I.toString();return I}})(U_||(U_={}));var C3;(function(_){_.mergeShapes=($,D)=>{return{...$,...D}}})(C3||(C3={}));var y=U_.arrayToEnum(["string","nan","number","integer","float","boolean","date","bigint","symbol","function","undefined","null","array","object","unknown","promise","void","never","map","set"]),P6=(_)=>{switch(typeof _){case"undefined":return y.undefined;case"string":return y.string;case"number":return Number.isNaN(_)?y.nan:y.number;case"boolean":return y.boolean;case"function":return y.function;case"bigint":return y.bigint;case"symbol":return y.symbol;case"object":if(Array.isArray(_))return y.array;if(_===null)return y.null;if(_.then&&typeof _.then==="function"&&_.catch&&typeof _.catch==="function")return y.promise;if(typeof Map<"u"&&_ instanceof Map)return y.map;if(typeof Set<"u"&&_ instanceof Set)return y.set;if(typeof Date<"u"&&_ instanceof Date)return y.date;return y.object;default:return y.unknown}},k=U_.arrayToEnum(["invalid_type","invalid_literal","custom","invalid_union","invalid_union_discriminator","invalid_enum_value","unrecognized_keys","invalid_arguments","invalid_return_type","invalid_date","invalid_string","too_small","too_big","invalid_intersection_types","not_multiple_of","not_finite"]),bb=(_)=>{return JSON.stringify(_,null,2).replace(/"([^"]+)":/g,"$1:")};class O$ extends Error{get errors(){return this.issues}constructor(_){super();this.issues=[],this.addIssue=(D)=>{this.issues=[...this.issues,D]},this.addIssues=(D=[])=>{this.issues=[...this.issues,...D]};let $=new.target.prototype;if(Object.setPrototypeOf)Object.setPrototypeOf(this,$);else this.__proto__=$;this.name="ZodError",this.issues=_}format(_){let $=_||function(g){return g.message},D={_errors:[]},U=(g)=>{for(let I of g.issues)if(I.code==="invalid_union")I.unionErrors.map(U);else if(I.code==="invalid_return_type")U(I.returnTypeError);else if(I.code==="invalid_arguments")U(I.argumentsError);else if(I.path.length===0)D._errors.push($(I));else{let j=D,N=0;while(N$.message){let $={},D=[];for(let U of this.issues)if(U.path.length>0){let g=U.path[0];$[g]=$[g]||[],$[g].push(_(U))}else D.push(_(U));return{formErrors:D,fieldErrors:$}}get formErrors(){return this.flatten()}}O$.create=(_)=>{return new O$(_)};var Hb=(_,$)=>{let D;switch(_.code){case k.invalid_type:if(_.received===y.undefined)D="Required";else D=`Expected ${_.expected}, received ${_.received}`;break;case k.invalid_literal:D=`Invalid literal value, expected ${JSON.stringify(_.expected,U_.jsonStringifyReplacer)}`;break;case k.unrecognized_keys:D=`Unrecognized key(s) in object: ${U_.joinValues(_.keys,", ")}`;break;case k.invalid_union:D="Invalid input";break;case k.invalid_union_discriminator:D=`Invalid discriminator value. Expected ${U_.joinValues(_.options)}`;break;case k.invalid_enum_value:D=`Invalid enum value. Expected ${U_.joinValues(_.options)}, received '${_.received}'`;break;case k.invalid_arguments:D="Invalid function arguments";break;case k.invalid_return_type:D="Invalid function return type";break;case k.invalid_date:D="Invalid date";break;case k.invalid_string:if(typeof _.validation==="object")if("includes"in _.validation){if(D=`Invalid input: must include "${_.validation.includes}"`,typeof _.validation.position==="number")D=`${D} at one or more positions greater than or equal to ${_.validation.position}`}else if("startsWith"in _.validation)D=`Invalid input: must start with "${_.validation.startsWith}"`;else if("endsWith"in _.validation)D=`Invalid input: must end with "${_.validation.endsWith}"`;else U_.assertNever(_.validation);else if(_.validation!=="regex")D=`Invalid ${_.validation}`;else D="Invalid";break;case k.too_small:if(_.type==="array")D=`Array must contain ${_.exact?"exactly":_.inclusive?"at least":"more than"} ${_.minimum} element(s)`;else if(_.type==="string")D=`String must contain ${_.exact?"exactly":_.inclusive?"at least":"over"} ${_.minimum} character(s)`;else if(_.type==="number")D=`Number must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${_.minimum}`;else if(_.type==="bigint")D=`Number must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${_.minimum}`;else if(_.type==="date")D=`Date must be ${_.exact?"exactly equal to ":_.inclusive?"greater than or equal to ":"greater than "}${new Date(Number(_.minimum))}`;else D="Invalid input";break;case k.too_big:if(_.type==="array")D=`Array must contain ${_.exact?"exactly":_.inclusive?"at most":"less than"} ${_.maximum} element(s)`;else if(_.type==="string")D=`String must contain ${_.exact?"exactly":_.inclusive?"at most":"under"} ${_.maximum} character(s)`;else if(_.type==="number")D=`Number must be ${_.exact?"exactly":_.inclusive?"less than or equal to":"less than"} ${_.maximum}`;else if(_.type==="bigint")D=`BigInt must be ${_.exact?"exactly":_.inclusive?"less than or equal to":"less than"} ${_.maximum}`;else if(_.type==="date")D=`Date must be ${_.exact?"exactly":_.inclusive?"smaller than or equal to":"smaller than"} ${new Date(Number(_.maximum))}`;else D="Invalid input";break;case k.custom:D="Invalid input";break;case k.invalid_intersection_types:D="Intersection results could not be merged";break;case k.not_multiple_of:D=`Number must be a multiple of ${_.multipleOf}`;break;case k.not_finite:D="Number must be finite";break;default:D=$.defaultError,U_.assertNever(_)}return{message:D}},OD=Hb,z9=OD;function kb(_){z9=_}function NN(){return z9}var EN=(_)=>{let{data:$,path:D,errorMaps:U,issueData:g}=_,I=[...D,...g.path||[]],j={...g,path:I};if(g.message!==void 0)return{...g,path:I,message:g.message};let N="",O=U.filter((A)=>!!A).slice().reverse();for(let A of O)N=A(j,{data:$,defaultError:N}).message;return{...g,path:I,message:N}},Cb=[];function u(_,$){let D=NN(),U=EN({issueData:$,data:_.data,path:_.path,errorMaps:[_.common.contextualErrorMap,_.schemaErrorMap,D,D===OD?void 0:OD].filter((g)=>!!g)});_.common.issues.push(U)}class m_{constructor(){this.value="valid"}dirty(){if(this.value==="valid")this.value="dirty"}abort(){if(this.value!=="aborted")this.value="aborted"}static mergeArray(_,$){let D=[];for(let U of $){if(U.status==="aborted")return m;if(U.status==="dirty")_.dirty();D.push(U.value)}return{status:_.value,value:D}}static async mergeObjectAsync(_,$){let D=[];for(let U of $){let g=await U.key,I=await U.value;D.push({key:g,value:I})}return m_.mergeObjectSync(_,D)}static mergeObjectSync(_,$){let D={};for(let U of $){let{key:g,value:I}=U;if(g.status==="aborted")return m;if(I.status==="aborted")return m;if(g.status==="dirty")_.dirty();if(I.status==="dirty")_.dirty();if(g.value!=="__proto__"&&(typeof I.value<"u"||U.alwaysSet))D[g.value]=I.value}return{status:_.value,value:D}}}var m=Object.freeze({status:"aborted"}),jD=(_)=>({status:"dirty",value:_}),a_=(_)=>({status:"valid",value:_}),r3=(_)=>_.status==="aborted",v3=(_)=>_.status==="dirty",n4=(_)=>_.status==="valid",SU=(_)=>typeof Promise<"u"&&_ instanceof Promise,n;(function(_){_.errToObj=($)=>typeof $==="string"?{message:$}:$||{},_.toString=($)=>typeof $==="string"?$:$?.message})(n||(n={}));class b${constructor(_,$,D,U){this._cachedPath=[],this.parent=_,this.data=$,this._path=D,this._key=U}get path(){if(!this._cachedPath.length)if(Array.isArray(this._key))this._cachedPath.push(...this._path,...this._key);else this._cachedPath.push(...this._path,this._key);return this._cachedPath}}var U9=(_,$)=>{if(n4($))return{success:!0,data:$.value};else{if(!_.common.issues.length)throw Error("Validation failed but no issues detected.");return{success:!1,get error(){if(this._error)return this._error;let D=new O$(_.common.issues);return this._error=D,this._error}}}};function p(_){if(!_)return{};let{errorMap:$,invalid_type_error:D,required_error:U,description:g}=_;if($&&(D||U))throw Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);if($)return{errorMap:$,description:g};return{errorMap:(j,N)=>{let{message:O}=_;if(j.code==="invalid_enum_value")return{message:O??N.defaultError};if(typeof N.data>"u")return{message:O??U??N.defaultError};if(j.code!=="invalid_type")return{message:N.defaultError};return{message:O??D??N.defaultError}},description:g}}class __{get description(){return this._def.description}_getType(_){return P6(_.data)}_getOrReturnCtx(_,$){return $||{common:_.parent.common,data:_.data,parsedType:P6(_.data),schemaErrorMap:this._def.errorMap,path:_.path,parent:_.parent}}_processInputParams(_){return{status:new m_,ctx:{common:_.parent.common,data:_.data,parsedType:P6(_.data),schemaErrorMap:this._def.errorMap,path:_.path,parent:_.parent}}}_parseSync(_){let $=this._parse(_);if(SU($))throw Error("Synchronous parse encountered promise.");return $}_parseAsync(_){let $=this._parse(_);return Promise.resolve($)}parse(_,$){let D=this.safeParse(_,$);if(D.success)return D.data;throw D.error}safeParse(_,$){let D={common:{issues:[],async:$?.async??!1,contextualErrorMap:$?.errorMap},path:$?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)},U=this._parseSync({data:_,path:D.path,parent:D});return U9(D,U)}"~validate"(_){let $={common:{issues:[],async:!!this["~standard"].async},path:[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)};if(!this["~standard"].async)try{let D=this._parseSync({data:_,path:[],parent:$});return n4(D)?{value:D.value}:{issues:$.common.issues}}catch(D){if(D?.message?.toLowerCase()?.includes("encountered"))this["~standard"].async=!0;$.common={issues:[],async:!0}}return this._parseAsync({data:_,path:[],parent:$}).then((D)=>n4(D)?{value:D.value}:{issues:$.common.issues})}async parseAsync(_,$){let D=await this.safeParseAsync(_,$);if(D.success)return D.data;throw D.error}async safeParseAsync(_,$){let D={common:{issues:[],contextualErrorMap:$?.errorMap,async:!0},path:$?.path||[],schemaErrorMap:this._def.errorMap,parent:null,data:_,parsedType:P6(_)},U=this._parse({data:_,path:D.path,parent:D}),g=await(SU(U)?U:Promise.resolve(U));return U9(D,g)}refine(_,$){let D=(U)=>{if(typeof $==="string"||typeof $>"u")return{message:$};else if(typeof $==="function")return $(U);else return $};return this._refinement((U,g)=>{let I=_(U),j=()=>g.addIssue({code:k.custom,...D(U)});if(typeof Promise<"u"&&I instanceof Promise)return I.then((N)=>{if(!N)return j(),!1;else return!0});if(!I)return j(),!1;else return!0})}refinement(_,$){return this._refinement((D,U)=>{if(!_(D))return U.addIssue(typeof $==="function"?$(D,U):$),!1;else return!0})}_refinement(_){return new R$({schema:this,typeName:i.ZodEffects,effect:{type:"refinement",refinement:_}})}superRefine(_){return this._refinement(_)}constructor(_){this.spa=this.safeParseAsync,this._def=_,this.parse=this.parse.bind(this),this.safeParse=this.safeParse.bind(this),this.parseAsync=this.parseAsync.bind(this),this.safeParseAsync=this.safeParseAsync.bind(this),this.spa=this.spa.bind(this),this.refine=this.refine.bind(this),this.refinement=this.refinement.bind(this),this.superRefine=this.superRefine.bind(this),this.optional=this.optional.bind(this),this.nullable=this.nullable.bind(this),this.nullish=this.nullish.bind(this),this.array=this.array.bind(this),this.promise=this.promise.bind(this),this.or=this.or.bind(this),this.and=this.and.bind(this),this.transform=this.transform.bind(this),this.brand=this.brand.bind(this),this.default=this.default.bind(this),this.catch=this.catch.bind(this),this.describe=this.describe.bind(this),this.pipe=this.pipe.bind(this),this.readonly=this.readonly.bind(this),this.isNullable=this.isNullable.bind(this),this.isOptional=this.isOptional.bind(this),this["~standard"]={version:1,vendor:"zod",validate:($)=>this["~validate"]($)}}optional(){return Z$.create(this,this._def)}nullable(){return z6.create(this,this._def)}nullish(){return this.nullable().optional()}array(){return M$.create(this)}promise(){return l4.create(this,this._def)}or(_){return PD.create([this,_],this._def)}and(_){return zD.create(this,_,this._def)}transform(_){return new R$({...p(this._def),schema:this,typeName:i.ZodEffects,effect:{type:"transform",transform:_}})}default(_){let $=typeof _==="function"?_:()=>_;return new RD({...p(this._def),innerType:this,defaultValue:$,typeName:i.ZodDefault})}brand(){return new JN({typeName:i.ZodBranded,type:this,...p(this._def)})}catch(_){let $=typeof _==="function"?_:()=>_;return new GD({...p(this._def),innerType:this,catchValue:$,typeName:i.ZodCatch})}describe(_){return new this.constructor({...this._def,description:_})}pipe(_){return QU.create(this,_)}readonly(){return YD.create(this)}isOptional(){return this.safeParse(void 0).success}isNullable(){return this.safeParse(null).success}}var rb=/^c[^\s-]{8,}$/i,vb=/^[0-9a-z]+$/,fb=/^[0-9A-HJKMNP-TV-Z]{26}$/i,wb=/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i,ub=/^[a-z0-9_-]{21}$/i,xb=/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/,yb=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,hb=/^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i,cb="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$",H3,nb=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,db=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/,mb=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/,ib=/^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,lb=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/,tb=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/,S9="((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))",ob=new RegExp(`^${S9}$`);function W9(_){let $="[0-5]\\d";if(_.precision)$=`${$}\\.\\d{${_.precision}}`;else if(_.precision==null)$=`${$}(\\.\\d+)?`;let D=_.precision?"+":"?";return`([01]\\d|2[0-3]):[0-5]\\d(:${$})${D}`}function pb(_){return new RegExp(`^${W9(_)}$`)}function X9(_){let $=`${S9}T${W9(_)}`,D=[];if(D.push(_.local?"Z?":"Z"),_.offset)D.push("([+-]\\d{2}:?\\d{2})");return $=`${$}(${D.join("|")})`,new RegExp(`^${$}$`)}function eb(_,$){if(($==="v4"||!$)&&nb.test(_))return!0;if(($==="v6"||!$)&&mb.test(_))return!0;return!1}function ab(_,$){if(!xb.test(_))return!1;try{let[D]=_.split(".");if(!D)return!1;let U=D.replace(/-/g,"+").replace(/_/g,"/").padEnd(D.length+(4-D.length%4)%4,"="),g=JSON.parse(atob(U));if(typeof g!=="object"||g===null)return!1;if("typ"in g&&g?.typ!=="JWT")return!1;if(!g.alg)return!1;if($&&g.alg!==$)return!1;return!0}catch{return!1}}function sb(_,$){if(($==="v4"||!$)&&db.test(_))return!0;if(($==="v6"||!$)&&ib.test(_))return!0;return!1}class F$ extends __{_parse(_){if(this._def.coerce)_.data=String(_.data);if(this._getType(_)!==y.string){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.string,received:g.parsedType}),m}let D=new m_,U=void 0;for(let g of this._def.checks)if(g.kind==="min"){if(_.data.lengthg.value)U=this._getOrReturnCtx(_,U),u(U,{code:k.too_big,maximum:g.value,type:"string",inclusive:!0,exact:!1,message:g.message}),D.dirty()}else if(g.kind==="length"){let I=_.data.length>g.value,j=_.data.length_.test(U),{validation:$,code:k.invalid_string,...n.errToObj(D)})}_addCheck(_){return new F$({...this._def,checks:[...this._def.checks,_]})}email(_){return this._addCheck({kind:"email",...n.errToObj(_)})}url(_){return this._addCheck({kind:"url",...n.errToObj(_)})}emoji(_){return this._addCheck({kind:"emoji",...n.errToObj(_)})}uuid(_){return this._addCheck({kind:"uuid",...n.errToObj(_)})}nanoid(_){return this._addCheck({kind:"nanoid",...n.errToObj(_)})}cuid(_){return this._addCheck({kind:"cuid",...n.errToObj(_)})}cuid2(_){return this._addCheck({kind:"cuid2",...n.errToObj(_)})}ulid(_){return this._addCheck({kind:"ulid",...n.errToObj(_)})}base64(_){return this._addCheck({kind:"base64",...n.errToObj(_)})}base64url(_){return this._addCheck({kind:"base64url",...n.errToObj(_)})}jwt(_){return this._addCheck({kind:"jwt",...n.errToObj(_)})}ip(_){return this._addCheck({kind:"ip",...n.errToObj(_)})}cidr(_){return this._addCheck({kind:"cidr",...n.errToObj(_)})}datetime(_){if(typeof _==="string")return this._addCheck({kind:"datetime",precision:null,offset:!1,local:!1,message:_});return this._addCheck({kind:"datetime",precision:typeof _?.precision>"u"?null:_?.precision,offset:_?.offset??!1,local:_?.local??!1,...n.errToObj(_?.message)})}date(_){return this._addCheck({kind:"date",message:_})}time(_){if(typeof _==="string")return this._addCheck({kind:"time",precision:null,message:_});return this._addCheck({kind:"time",precision:typeof _?.precision>"u"?null:_?.precision,...n.errToObj(_?.message)})}duration(_){return this._addCheck({kind:"duration",...n.errToObj(_)})}regex(_,$){return this._addCheck({kind:"regex",regex:_,...n.errToObj($)})}includes(_,$){return this._addCheck({kind:"includes",value:_,position:$?.position,...n.errToObj($?.message)})}startsWith(_,$){return this._addCheck({kind:"startsWith",value:_,...n.errToObj($)})}endsWith(_,$){return this._addCheck({kind:"endsWith",value:_,...n.errToObj($)})}min(_,$){return this._addCheck({kind:"min",value:_,...n.errToObj($)})}max(_,$){return this._addCheck({kind:"max",value:_,...n.errToObj($)})}length(_,$){return this._addCheck({kind:"length",value:_,...n.errToObj($)})}nonempty(_){return this.min(1,n.errToObj(_))}trim(){return new F$({...this._def,checks:[...this._def.checks,{kind:"trim"}]})}toLowerCase(){return new F$({...this._def,checks:[...this._def.checks,{kind:"toLowerCase"}]})}toUpperCase(){return new F$({...this._def,checks:[...this._def.checks,{kind:"toUpperCase"}]})}get isDatetime(){return!!this._def.checks.find((_)=>_.kind==="datetime")}get isDate(){return!!this._def.checks.find((_)=>_.kind==="date")}get isTime(){return!!this._def.checks.find((_)=>_.kind==="time")}get isDuration(){return!!this._def.checks.find((_)=>_.kind==="duration")}get isEmail(){return!!this._def.checks.find((_)=>_.kind==="email")}get isURL(){return!!this._def.checks.find((_)=>_.kind==="url")}get isEmoji(){return!!this._def.checks.find((_)=>_.kind==="emoji")}get isUUID(){return!!this._def.checks.find((_)=>_.kind==="uuid")}get isNANOID(){return!!this._def.checks.find((_)=>_.kind==="nanoid")}get isCUID(){return!!this._def.checks.find((_)=>_.kind==="cuid")}get isCUID2(){return!!this._def.checks.find((_)=>_.kind==="cuid2")}get isULID(){return!!this._def.checks.find((_)=>_.kind==="ulid")}get isIP(){return!!this._def.checks.find((_)=>_.kind==="ip")}get isCIDR(){return!!this._def.checks.find((_)=>_.kind==="cidr")}get isBase64(){return!!this._def.checks.find((_)=>_.kind==="base64")}get isBase64url(){return!!this._def.checks.find((_)=>_.kind==="base64url")}get minLength(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxLength(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}}F$.create=(_)=>{return new F$({checks:[],typeName:i.ZodString,coerce:_?.coerce??!1,...p(_)})};function _H(_,$){let D=(_.toString().split(".")[1]||"").length,U=($.toString().split(".")[1]||"").length,g=D>U?D:U,I=Number.parseInt(_.toFixed(g).replace(".","")),j=Number.parseInt($.toFixed(g).replace(".",""));return I%j/10**g}class i6 extends __{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte,this.step=this.multipleOf}_parse(_){if(this._def.coerce)_.data=Number(_.data);if(this._getType(_)!==y.number){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.number,received:g.parsedType}),m}let D=void 0,U=new m_;for(let g of this._def.checks)if(g.kind==="int"){if(!U_.isInteger(_.data))D=this._getOrReturnCtx(_,D),u(D,{code:k.invalid_type,expected:"integer",received:"float",message:g.message}),U.dirty()}else if(g.kind==="min"){if(g.inclusive?_.datag.value:_.data>=g.value)D=this._getOrReturnCtx(_,D),u(D,{code:k.too_big,maximum:g.value,type:"number",inclusive:g.inclusive,exact:!1,message:g.message}),U.dirty()}else if(g.kind==="multipleOf"){if(_H(_.data,g.value)!==0)D=this._getOrReturnCtx(_,D),u(D,{code:k.not_multiple_of,multipleOf:g.value,message:g.message}),U.dirty()}else if(g.kind==="finite"){if(!Number.isFinite(_.data))D=this._getOrReturnCtx(_,D),u(D,{code:k.not_finite,message:g.message}),U.dirty()}else U_.assertNever(g);return{status:U.value,value:_.data}}gte(_,$){return this.setLimit("min",_,!0,n.toString($))}gt(_,$){return this.setLimit("min",_,!1,n.toString($))}lte(_,$){return this.setLimit("max",_,!0,n.toString($))}lt(_,$){return this.setLimit("max",_,!1,n.toString($))}setLimit(_,$,D,U){return new i6({...this._def,checks:[...this._def.checks,{kind:_,value:$,inclusive:D,message:n.toString(U)}]})}_addCheck(_){return new i6({...this._def,checks:[...this._def.checks,_]})}int(_){return this._addCheck({kind:"int",message:n.toString(_)})}positive(_){return this._addCheck({kind:"min",value:0,inclusive:!1,message:n.toString(_)})}negative(_){return this._addCheck({kind:"max",value:0,inclusive:!1,message:n.toString(_)})}nonpositive(_){return this._addCheck({kind:"max",value:0,inclusive:!0,message:n.toString(_)})}nonnegative(_){return this._addCheck({kind:"min",value:0,inclusive:!0,message:n.toString(_)})}multipleOf(_,$){return this._addCheck({kind:"multipleOf",value:_,message:n.toString($)})}finite(_){return this._addCheck({kind:"finite",message:n.toString(_)})}safe(_){return this._addCheck({kind:"min",inclusive:!0,value:Number.MIN_SAFE_INTEGER,message:n.toString(_)})._addCheck({kind:"max",inclusive:!0,value:Number.MAX_SAFE_INTEGER,message:n.toString(_)})}get minValue(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxValue(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}get isInt(){return!!this._def.checks.find((_)=>_.kind==="int"||_.kind==="multipleOf"&&U_.isInteger(_.value))}get isFinite(){let _=null,$=null;for(let D of this._def.checks)if(D.kind==="finite"||D.kind==="int"||D.kind==="multipleOf")return!0;else if(D.kind==="min"){if($===null||D.value>$)$=D.value}else if(D.kind==="max"){if(_===null||D.value<_)_=D.value}return Number.isFinite($)&&Number.isFinite(_)}}i6.create=(_)=>{return new i6({checks:[],typeName:i.ZodNumber,coerce:_?.coerce||!1,...p(_)})};class l6 extends __{constructor(){super(...arguments);this.min=this.gte,this.max=this.lte}_parse(_){if(this._def.coerce)try{_.data=BigInt(_.data)}catch{return this._getInvalidInput(_)}if(this._getType(_)!==y.bigint)return this._getInvalidInput(_);let D=void 0,U=new m_;for(let g of this._def.checks)if(g.kind==="min"){if(g.inclusive?_.datag.value:_.data>=g.value)D=this._getOrReturnCtx(_,D),u(D,{code:k.too_big,type:"bigint",maximum:g.value,inclusive:g.inclusive,message:g.message}),U.dirty()}else if(g.kind==="multipleOf"){if(_.data%g.value!==BigInt(0))D=this._getOrReturnCtx(_,D),u(D,{code:k.not_multiple_of,multipleOf:g.value,message:g.message}),U.dirty()}else U_.assertNever(g);return{status:U.value,value:_.data}}_getInvalidInput(_){let $=this._getOrReturnCtx(_);return u($,{code:k.invalid_type,expected:y.bigint,received:$.parsedType}),m}gte(_,$){return this.setLimit("min",_,!0,n.toString($))}gt(_,$){return this.setLimit("min",_,!1,n.toString($))}lte(_,$){return this.setLimit("max",_,!0,n.toString($))}lt(_,$){return this.setLimit("max",_,!1,n.toString($))}setLimit(_,$,D,U){return new l6({...this._def,checks:[...this._def.checks,{kind:_,value:$,inclusive:D,message:n.toString(U)}]})}_addCheck(_){return new l6({...this._def,checks:[...this._def.checks,_]})}positive(_){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!1,message:n.toString(_)})}negative(_){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!1,message:n.toString(_)})}nonpositive(_){return this._addCheck({kind:"max",value:BigInt(0),inclusive:!0,message:n.toString(_)})}nonnegative(_){return this._addCheck({kind:"min",value:BigInt(0),inclusive:!0,message:n.toString(_)})}multipleOf(_,$){return this._addCheck({kind:"multipleOf",value:_,message:n.toString($)})}get minValue(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _}get maxValue(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _}}l6.create=(_)=>{return new l6({checks:[],typeName:i.ZodBigInt,coerce:_?.coerce??!1,...p(_)})};class AD extends __{_parse(_){if(this._def.coerce)_.data=Boolean(_.data);if(this._getType(_)!==y.boolean){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.boolean,received:D.parsedType}),m}return a_(_.data)}}AD.create=(_)=>{return new AD({typeName:i.ZodBoolean,coerce:_?.coerce||!1,...p(_)})};class d4 extends __{_parse(_){if(this._def.coerce)_.data=new Date(_.data);if(this._getType(_)!==y.date){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_type,expected:y.date,received:g.parsedType}),m}if(Number.isNaN(_.data.getTime())){let g=this._getOrReturnCtx(_);return u(g,{code:k.invalid_date}),m}let D=new m_,U=void 0;for(let g of this._def.checks)if(g.kind==="min"){if(_.data.getTime()g.value)U=this._getOrReturnCtx(_,U),u(U,{code:k.too_big,message:g.message,inclusive:!0,exact:!1,maximum:g.value,type:"date"}),D.dirty()}else U_.assertNever(g);return{status:D.value,value:new Date(_.data.getTime())}}_addCheck(_){return new d4({...this._def,checks:[...this._def.checks,_]})}min(_,$){return this._addCheck({kind:"min",value:_.getTime(),message:n.toString($)})}max(_,$){return this._addCheck({kind:"max",value:_.getTime(),message:n.toString($)})}get minDate(){let _=null;for(let $ of this._def.checks)if($.kind==="min"){if(_===null||$.value>_)_=$.value}return _!=null?new Date(_):null}get maxDate(){let _=null;for(let $ of this._def.checks)if($.kind==="max"){if(_===null||$.value<_)_=$.value}return _!=null?new Date(_):null}}d4.create=(_)=>{return new d4({checks:[],coerce:_?.coerce||!1,typeName:i.ZodDate,...p(_)})};class WU extends __{_parse(_){if(this._getType(_)!==y.symbol){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.symbol,received:D.parsedType}),m}return a_(_.data)}}WU.create=(_)=>{return new WU({typeName:i.ZodSymbol,...p(_)})};class LD extends __{_parse(_){if(this._getType(_)!==y.undefined){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.undefined,received:D.parsedType}),m}return a_(_.data)}}LD.create=(_)=>{return new LD({typeName:i.ZodUndefined,...p(_)})};class JD extends __{_parse(_){if(this._getType(_)!==y.null){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.null,received:D.parsedType}),m}return a_(_.data)}}JD.create=(_)=>{return new JD({typeName:i.ZodNull,...p(_)})};class m4 extends __{constructor(){super(...arguments);this._any=!0}_parse(_){return a_(_.data)}}m4.create=(_)=>{return new m4({typeName:i.ZodAny,...p(_)})};class m6 extends __{constructor(){super(...arguments);this._unknown=!0}_parse(_){return a_(_.data)}}m6.create=(_)=>{return new m6({typeName:i.ZodUnknown,...p(_)})};class n$ extends __{_parse(_){let $=this._getOrReturnCtx(_);return u($,{code:k.invalid_type,expected:y.never,received:$.parsedType}),m}}n$.create=(_)=>{return new n$({typeName:i.ZodNever,...p(_)})};class XU extends __{_parse(_){if(this._getType(_)!==y.undefined){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.void,received:D.parsedType}),m}return a_(_.data)}}XU.create=(_)=>{return new XU({typeName:i.ZodVoid,...p(_)})};class M$ extends __{_parse(_){let{ctx:$,status:D}=this._processInputParams(_),U=this._def;if($.parsedType!==y.array)return u($,{code:k.invalid_type,expected:y.array,received:$.parsedType}),m;if(U.exactLength!==null){let I=$.data.length>U.exactLength.value,j=$.data.lengthU.maxLength.value)u($,{code:k.too_big,maximum:U.maxLength.value,type:"array",inclusive:!0,exact:!1,message:U.maxLength.message}),D.dirty()}if($.common.async)return Promise.all([...$.data].map((I,j)=>{return U.type._parseAsync(new b$($,I,$.path,j))})).then((I)=>{return m_.mergeArray(D,I)});let g=[...$.data].map((I,j)=>{return U.type._parseSync(new b$($,I,$.path,j))});return m_.mergeArray(D,g)}get element(){return this._def.type}min(_,$){return new M$({...this._def,minLength:{value:_,message:n.toString($)}})}max(_,$){return new M$({...this._def,maxLength:{value:_,message:n.toString($)}})}length(_,$){return new M$({...this._def,exactLength:{value:_,message:n.toString($)}})}nonempty(_){return this.min(1,_)}}M$.create=(_,$)=>{return new M$({type:_,minLength:null,maxLength:null,exactLength:null,typeName:i.ZodArray,...p($)})};function UD(_){if(_ instanceof b_){let $={};for(let D in _.shape){let U=_.shape[D];$[D]=Z$.create(UD(U))}return new b_({..._._def,shape:()=>$})}else if(_ instanceof M$)return new M$({..._._def,type:UD(_.element)});else if(_ instanceof Z$)return Z$.create(UD(_.unwrap()));else if(_ instanceof z6)return z6.create(UD(_.unwrap()));else if(_ instanceof d$)return d$.create(_.items.map(($)=>UD($)));else return _}class b_ extends __{constructor(){super(...arguments);this._cached=null,this.nonstrict=this.passthrough,this.augment=this.extend}_getCached(){if(this._cached!==null)return this._cached;let _=this._def.shape(),$=U_.objectKeys(_);return this._cached={shape:_,keys:$},this._cached}_parse(_){if(this._getType(_)!==y.object){let O=this._getOrReturnCtx(_);return u(O,{code:k.invalid_type,expected:y.object,received:O.parsedType}),m}let{status:D,ctx:U}=this._processInputParams(_),{shape:g,keys:I}=this._getCached(),j=[];if(!(this._def.catchall instanceof n$&&this._def.unknownKeys==="strip")){for(let O in U.data)if(!I.includes(O))j.push(O)}let N=[];for(let O of I){let A=g[O],L=U.data[O];N.push({key:{status:"valid",value:O},value:A._parse(new b$(U,L,U.path,O)),alwaysSet:O in U.data})}if(this._def.catchall instanceof n$){let O=this._def.unknownKeys;if(O==="passthrough")for(let A of j)N.push({key:{status:"valid",value:A},value:{status:"valid",value:U.data[A]}});else if(O==="strict"){if(j.length>0)u(U,{code:k.unrecognized_keys,keys:j}),D.dirty()}else if(O==="strip");else throw Error("Internal ZodObject error: invalid unknownKeys value.")}else{let O=this._def.catchall;for(let A of j){let L=U.data[A];N.push({key:{status:"valid",value:A},value:O._parse(new b$(U,L,U.path,A)),alwaysSet:A in U.data})}}if(U.common.async)return Promise.resolve().then(async()=>{let O=[];for(let A of N){let L=await A.key,z=await A.value;O.push({key:L,value:z,alwaysSet:A.alwaysSet})}return O}).then((O)=>{return m_.mergeObjectSync(D,O)});else return m_.mergeObjectSync(D,N)}get shape(){return this._def.shape()}strict(_){return n.errToObj,new b_({...this._def,unknownKeys:"strict",..._!==void 0?{errorMap:($,D)=>{let U=this._def.errorMap?.($,D).message??D.defaultError;if($.code==="unrecognized_keys")return{message:n.errToObj(_).message??U};return{message:U}}}:{}})}strip(){return new b_({...this._def,unknownKeys:"strip"})}passthrough(){return new b_({...this._def,unknownKeys:"passthrough"})}extend(_){return new b_({...this._def,shape:()=>({...this._def.shape(),..._})})}merge(_){return new b_({unknownKeys:_._def.unknownKeys,catchall:_._def.catchall,shape:()=>({...this._def.shape(),..._._def.shape()}),typeName:i.ZodObject})}setKey(_,$){return this.augment({[_]:$})}catchall(_){return new b_({...this._def,catchall:_})}pick(_){let $={};for(let D of U_.objectKeys(_))if(_[D]&&this.shape[D])$[D]=this.shape[D];return new b_({...this._def,shape:()=>$})}omit(_){let $={};for(let D of U_.objectKeys(this.shape))if(!_[D])$[D]=this.shape[D];return new b_({...this._def,shape:()=>$})}deepPartial(){return UD(this)}partial(_){let $={};for(let D of U_.objectKeys(this.shape)){let U=this.shape[D];if(_&&!_[D])$[D]=U;else $[D]=U.optional()}return new b_({...this._def,shape:()=>$})}required(_){let $={};for(let D of U_.objectKeys(this.shape))if(_&&!_[D])$[D]=this.shape[D];else{let g=this.shape[D];while(g instanceof Z$)g=g._def.innerType;$[D]=g}return new b_({...this._def,shape:()=>$})}keyof(){return R9(U_.objectKeys(this.shape))}}b_.create=(_,$)=>{return new b_({shape:()=>_,unknownKeys:"strip",catchall:n$.create(),typeName:i.ZodObject,...p($)})};b_.strictCreate=(_,$)=>{return new b_({shape:()=>_,unknownKeys:"strict",catchall:n$.create(),typeName:i.ZodObject,...p($)})};b_.lazycreate=(_,$)=>{return new b_({shape:_,unknownKeys:"strip",catchall:n$.create(),typeName:i.ZodObject,...p($)})};class PD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=this._def.options;function U(g){for(let j of g)if(j.result.status==="valid")return j.result;for(let j of g)if(j.result.status==="dirty")return $.common.issues.push(...j.ctx.common.issues),j.result;let I=g.map((j)=>new O$(j.ctx.common.issues));return u($,{code:k.invalid_union,unionErrors:I}),m}if($.common.async)return Promise.all(D.map(async(g)=>{let I={...$,common:{...$.common,issues:[]},parent:null};return{result:await g._parseAsync({data:$.data,path:$.path,parent:I}),ctx:I}})).then(U);else{let g=void 0,I=[];for(let N of D){let O={...$,common:{...$.common,issues:[]},parent:null},A=N._parseSync({data:$.data,path:$.path,parent:O});if(A.status==="valid")return A;else if(A.status==="dirty"&&!g)g={result:A,ctx:O};if(O.common.issues.length)I.push(O.common.issues)}if(g)return $.common.issues.push(...g.ctx.common.issues),g.result;let j=I.map((N)=>new O$(N));return u($,{code:k.invalid_union,unionErrors:j}),m}}get options(){return this._def.options}}PD.create=(_,$)=>{return new PD({options:_,typeName:i.ZodUnion,...p($)})};var J6=(_)=>{if(_ instanceof SD)return J6(_.schema);else if(_ instanceof R$)return J6(_.innerType());else if(_ instanceof WD)return[_.value];else if(_ instanceof t6)return _.options;else if(_ instanceof XD)return U_.objectValues(_.enum);else if(_ instanceof RD)return J6(_._def.innerType);else if(_ instanceof LD)return[void 0];else if(_ instanceof JD)return[null];else if(_ instanceof Z$)return[void 0,...J6(_.unwrap())];else if(_ instanceof z6)return[null,...J6(_.unwrap())];else if(_ instanceof JN)return J6(_.unwrap());else if(_ instanceof YD)return J6(_.unwrap());else if(_ instanceof GD)return J6(_._def.innerType);else return[]};class LN extends __{_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.object)return u($,{code:k.invalid_type,expected:y.object,received:$.parsedType}),m;let D=this.discriminator,U=$.data[D],g=this.optionsMap.get(U);if(!g)return u($,{code:k.invalid_union_discriminator,options:Array.from(this.optionsMap.keys()),path:[D]}),m;if($.common.async)return g._parseAsync({data:$.data,path:$.path,parent:$});else return g._parseSync({data:$.data,path:$.path,parent:$})}get discriminator(){return this._def.discriminator}get options(){return this._def.options}get optionsMap(){return this._def.optionsMap}static create(_,$,D){let U=new Map;for(let g of $){let I=J6(g.shape[_]);if(!I.length)throw Error(`A discriminator value for key \`${_}\` could not be extracted from all schema options`);for(let j of I){if(U.has(j))throw Error(`Discriminator property ${String(_)} has duplicate value ${String(j)}`);U.set(j,g)}}return new LN({typeName:i.ZodDiscriminatedUnion,discriminator:_,options:$,optionsMap:U,...p(D)})}}function f3(_,$){let D=P6(_),U=P6($);if(_===$)return{valid:!0,data:_};else if(D===y.object&&U===y.object){let g=U_.objectKeys($),I=U_.objectKeys(_).filter((N)=>g.indexOf(N)!==-1),j={..._,...$};for(let N of I){let O=f3(_[N],$[N]);if(!O.valid)return{valid:!1};j[N]=O.data}return{valid:!0,data:j}}else if(D===y.array&&U===y.array){if(_.length!==$.length)return{valid:!1};let g=[];for(let I=0;I<_.length;I++){let j=_[I],N=$[I],O=f3(j,N);if(!O.valid)return{valid:!1};g.push(O.data)}return{valid:!0,data:g}}else if(D===y.date&&U===y.date&&+_===+$)return{valid:!0,data:_};else return{valid:!1}}class zD extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_),U=(g,I)=>{if(r3(g)||r3(I))return m;let j=f3(g.value,I.value);if(!j.valid)return u(D,{code:k.invalid_intersection_types}),m;if(v3(g)||v3(I))$.dirty();return{status:$.value,value:j.data}};if(D.common.async)return Promise.all([this._def.left._parseAsync({data:D.data,path:D.path,parent:D}),this._def.right._parseAsync({data:D.data,path:D.path,parent:D})]).then(([g,I])=>U(g,I));else return U(this._def.left._parseSync({data:D.data,path:D.path,parent:D}),this._def.right._parseSync({data:D.data,path:D.path,parent:D}))}}zD.create=(_,$,D)=>{return new zD({left:_,right:$,typeName:i.ZodIntersection,...p(D)})};class d$ extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.array)return u(D,{code:k.invalid_type,expected:y.array,received:D.parsedType}),m;if(D.data.lengththis._def.items.length)u(D,{code:k.too_big,maximum:this._def.items.length,inclusive:!0,exact:!1,type:"array"}),$.dirty();let g=[...D.data].map((I,j)=>{let N=this._def.items[j]||this._def.rest;if(!N)return null;return N._parse(new b$(D,I,D.path,j))}).filter((I)=>!!I);if(D.common.async)return Promise.all(g).then((I)=>{return m_.mergeArray($,I)});else return m_.mergeArray($,g)}get items(){return this._def.items}rest(_){return new d$({...this._def,rest:_})}}d$.create=(_,$)=>{if(!Array.isArray(_))throw Error("You must pass an array of schemas to z.tuple([ ... ])");return new d$({items:_,typeName:i.ZodTuple,rest:null,...p($)})};class RU extends __{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.object)return u(D,{code:k.invalid_type,expected:y.object,received:D.parsedType}),m;let U=[],g=this._def.keyType,I=this._def.valueType;for(let j in D.data)U.push({key:g._parse(new b$(D,j,D.path,j)),value:I._parse(new b$(D,D.data[j],D.path,j)),alwaysSet:j in D.data});if(D.common.async)return m_.mergeObjectAsync($,U);else return m_.mergeObjectSync($,U)}get element(){return this._def.valueType}static create(_,$,D){if($ instanceof __)return new RU({keyType:_,valueType:$,typeName:i.ZodRecord,...p(D)});return new RU({keyType:F$.create(),valueType:_,typeName:i.ZodRecord,...p($)})}}class GU extends __{get keySchema(){return this._def.keyType}get valueSchema(){return this._def.valueType}_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.map)return u(D,{code:k.invalid_type,expected:y.map,received:D.parsedType}),m;let U=this._def.keyType,g=this._def.valueType,I=[...D.data.entries()].map(([j,N],O)=>{return{key:U._parse(new b$(D,j,D.path,[O,"key"])),value:g._parse(new b$(D,N,D.path,[O,"value"]))}});if(D.common.async){let j=new Map;return Promise.resolve().then(async()=>{for(let N of I){let O=await N.key,A=await N.value;if(O.status==="aborted"||A.status==="aborted")return m;if(O.status==="dirty"||A.status==="dirty")$.dirty();j.set(O.value,A.value)}return{status:$.value,value:j}})}else{let j=new Map;for(let N of I){let{key:O,value:A}=N;if(O.status==="aborted"||A.status==="aborted")return m;if(O.status==="dirty"||A.status==="dirty")$.dirty();j.set(O.value,A.value)}return{status:$.value,value:j}}}}GU.create=(_,$,D)=>{return new GU({valueType:$,keyType:_,typeName:i.ZodMap,...p(D)})};class i4 extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.parsedType!==y.set)return u(D,{code:k.invalid_type,expected:y.set,received:D.parsedType}),m;let U=this._def;if(U.minSize!==null){if(D.data.sizeU.maxSize.value)u(D,{code:k.too_big,maximum:U.maxSize.value,type:"set",inclusive:!0,exact:!1,message:U.maxSize.message}),$.dirty()}let g=this._def.valueType;function I(N){let O=new Set;for(let A of N){if(A.status==="aborted")return m;if(A.status==="dirty")$.dirty();O.add(A.value)}return{status:$.value,value:O}}let j=[...D.data.values()].map((N,O)=>g._parse(new b$(D,N,D.path,O)));if(D.common.async)return Promise.all(j).then((N)=>I(N));else return I(j)}min(_,$){return new i4({...this._def,minSize:{value:_,message:n.toString($)}})}max(_,$){return new i4({...this._def,maxSize:{value:_,message:n.toString($)}})}size(_,$){return this.min(_,$).max(_,$)}nonempty(_){return this.min(1,_)}}i4.create=(_,$)=>{return new i4({valueType:_,minSize:null,maxSize:null,typeName:i.ZodSet,...p($)})};class ND extends __{constructor(){super(...arguments);this.validate=this.implement}_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.function)return u($,{code:k.invalid_type,expected:y.function,received:$.parsedType}),m;function D(j,N){return EN({data:j,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,NN(),OD].filter((O)=>!!O),issueData:{code:k.invalid_arguments,argumentsError:N}})}function U(j,N){return EN({data:j,path:$.path,errorMaps:[$.common.contextualErrorMap,$.schemaErrorMap,NN(),OD].filter((O)=>!!O),issueData:{code:k.invalid_return_type,returnTypeError:N}})}let g={errorMap:$.common.contextualErrorMap},I=$.data;if(this._def.returns instanceof l4){let j=this;return a_(async function(...N){let O=new O$([]),A=await j._def.args.parseAsync(N,g).catch((W)=>{throw O.addIssue(D(N,W)),O}),L=await Reflect.apply(I,this,A);return await j._def.returns._def.type.parseAsync(L,g).catch((W)=>{throw O.addIssue(U(L,W)),O})})}else{let j=this;return a_(function(...N){let O=j._def.args.safeParse(N,g);if(!O.success)throw new O$([D(N,O.error)]);let A=Reflect.apply(I,this,O.data),L=j._def.returns.safeParse(A,g);if(!L.success)throw new O$([U(A,L.error)]);return L.data})}}parameters(){return this._def.args}returnType(){return this._def.returns}args(..._){return new ND({...this._def,args:d$.create(_).rest(m6.create())})}returns(_){return new ND({...this._def,returns:_})}implement(_){return this.parse(_)}strictImplement(_){return this.parse(_)}static create(_,$,D){return new ND({args:_?_:d$.create([]).rest(m6.create()),returns:$||m6.create(),typeName:i.ZodFunction,...p(D)})}}class SD extends __{get schema(){return this._def.getter()}_parse(_){let{ctx:$}=this._processInputParams(_);return this._def.getter()._parse({data:$.data,path:$.path,parent:$})}}SD.create=(_,$)=>{return new SD({getter:_,typeName:i.ZodLazy,...p($)})};class WD extends __{_parse(_){if(_.data!==this._def.value){let $=this._getOrReturnCtx(_);return u($,{received:$.data,code:k.invalid_literal,expected:this._def.value}),m}return{status:"valid",value:_.data}}get value(){return this._def.value}}WD.create=(_,$)=>{return new WD({value:_,typeName:i.ZodLiteral,...p($)})};function R9(_,$){return new t6({values:_,typeName:i.ZodEnum,...p($)})}class t6 extends __{_parse(_){if(typeof _.data!=="string"){let $=this._getOrReturnCtx(_),D=this._def.values;return u($,{expected:U_.joinValues(D),received:$.parsedType,code:k.invalid_type}),m}if(!this._cache)this._cache=new Set(this._def.values);if(!this._cache.has(_.data)){let $=this._getOrReturnCtx(_),D=this._def.values;return u($,{received:$.data,code:k.invalid_enum_value,options:D}),m}return a_(_.data)}get options(){return this._def.values}get enum(){let _={};for(let $ of this._def.values)_[$]=$;return _}get Values(){let _={};for(let $ of this._def.values)_[$]=$;return _}get Enum(){let _={};for(let $ of this._def.values)_[$]=$;return _}extract(_,$=this._def){return t6.create(_,{...this._def,...$})}exclude(_,$=this._def){return t6.create(this.options.filter((D)=>!_.includes(D)),{...this._def,...$})}}t6.create=R9;class XD extends __{_parse(_){let $=U_.getValidEnumValues(this._def.values),D=this._getOrReturnCtx(_);if(D.parsedType!==y.string&&D.parsedType!==y.number){let U=U_.objectValues($);return u(D,{expected:U_.joinValues(U),received:D.parsedType,code:k.invalid_type}),m}if(!this._cache)this._cache=new Set(U_.getValidEnumValues(this._def.values));if(!this._cache.has(_.data)){let U=U_.objectValues($);return u(D,{received:D.data,code:k.invalid_enum_value,options:U}),m}return a_(_.data)}get enum(){return this._def.values}}XD.create=(_,$)=>{return new XD({values:_,typeName:i.ZodNativeEnum,...p($)})};class l4 extends __{unwrap(){return this._def.type}_parse(_){let{ctx:$}=this._processInputParams(_);if($.parsedType!==y.promise&&$.common.async===!1)return u($,{code:k.invalid_type,expected:y.promise,received:$.parsedType}),m;let D=$.parsedType===y.promise?$.data:Promise.resolve($.data);return a_(D.then((U)=>{return this._def.type.parseAsync(U,{path:$.path,errorMap:$.common.contextualErrorMap})}))}}l4.create=(_,$)=>{return new l4({type:_,typeName:i.ZodPromise,...p($)})};class R$ extends __{innerType(){return this._def.schema}sourceType(){return this._def.schema._def.typeName===i.ZodEffects?this._def.schema.sourceType():this._def.schema}_parse(_){let{status:$,ctx:D}=this._processInputParams(_),U=this._def.effect||null,g={addIssue:(I)=>{if(u(D,I),I.fatal)$.abort();else $.dirty()},get path(){return D.path}};if(g.addIssue=g.addIssue.bind(g),U.type==="preprocess"){let I=U.transform(D.data,g);if(D.common.async)return Promise.resolve(I).then(async(j)=>{if($.value==="aborted")return m;let N=await this._def.schema._parseAsync({data:j,path:D.path,parent:D});if(N.status==="aborted")return m;if(N.status==="dirty")return jD(N.value);if($.value==="dirty")return jD(N.value);return N});else{if($.value==="aborted")return m;let j=this._def.schema._parseSync({data:I,path:D.path,parent:D});if(j.status==="aborted")return m;if(j.status==="dirty")return jD(j.value);if($.value==="dirty")return jD(j.value);return j}}if(U.type==="refinement"){let I=(j)=>{let N=U.refinement(j,g);if(D.common.async)return Promise.resolve(N);if(N instanceof Promise)throw Error("Async refinement encountered during synchronous parse operation. Use .parseAsync instead.");return j};if(D.common.async===!1){let j=this._def.schema._parseSync({data:D.data,path:D.path,parent:D});if(j.status==="aborted")return m;if(j.status==="dirty")$.dirty();return I(j.value),{status:$.value,value:j.value}}else return this._def.schema._parseAsync({data:D.data,path:D.path,parent:D}).then((j)=>{if(j.status==="aborted")return m;if(j.status==="dirty")$.dirty();return I(j.value).then(()=>{return{status:$.value,value:j.value}})})}if(U.type==="transform")if(D.common.async===!1){let I=this._def.schema._parseSync({data:D.data,path:D.path,parent:D});if(!n4(I))return m;let j=U.transform(I.value,g);if(j instanceof Promise)throw Error("Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.");return{status:$.value,value:j}}else return this._def.schema._parseAsync({data:D.data,path:D.path,parent:D}).then((I)=>{if(!n4(I))return m;return Promise.resolve(U.transform(I.value,g)).then((j)=>({status:$.value,value:j}))});U_.assertNever(U)}}R$.create=(_,$,D)=>{return new R$({schema:_,typeName:i.ZodEffects,effect:$,...p(D)})};R$.createWithPreprocess=(_,$,D)=>{return new R$({schema:$,effect:{type:"preprocess",transform:_},typeName:i.ZodEffects,...p(D)})};class Z$ extends __{_parse(_){if(this._getType(_)===y.undefined)return a_(void 0);return this._def.innerType._parse(_)}unwrap(){return this._def.innerType}}Z$.create=(_,$)=>{return new Z$({innerType:_,typeName:i.ZodOptional,...p($)})};class z6 extends __{_parse(_){if(this._getType(_)===y.null)return a_(null);return this._def.innerType._parse(_)}unwrap(){return this._def.innerType}}z6.create=(_,$)=>{return new z6({innerType:_,typeName:i.ZodNullable,...p($)})};class RD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=$.data;if($.parsedType===y.undefined)D=this._def.defaultValue();return this._def.innerType._parse({data:D,path:$.path,parent:$})}removeDefault(){return this._def.innerType}}RD.create=(_,$)=>{return new RD({innerType:_,typeName:i.ZodDefault,defaultValue:typeof $.default==="function"?$.default:()=>$.default,...p($)})};class GD extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D={...$,common:{...$.common,issues:[]}},U=this._def.innerType._parse({data:D.data,path:D.path,parent:{...D}});if(SU(U))return U.then((g)=>{return{status:"valid",value:g.status==="valid"?g.value:this._def.catchValue({get error(){return new O$(D.common.issues)},input:D.data})}});else return{status:"valid",value:U.status==="valid"?U.value:this._def.catchValue({get error(){return new O$(D.common.issues)},input:D.data})}}removeCatch(){return this._def.innerType}}GD.create=(_,$)=>{return new GD({innerType:_,typeName:i.ZodCatch,catchValue:typeof $.catch==="function"?$.catch:()=>$.catch,...p($)})};class YU extends __{_parse(_){if(this._getType(_)!==y.nan){let D=this._getOrReturnCtx(_);return u(D,{code:k.invalid_type,expected:y.nan,received:D.parsedType}),m}return{status:"valid",value:_.data}}}YU.create=(_)=>{return new YU({typeName:i.ZodNaN,...p(_)})};var $H=Symbol("zod_brand");class JN extends __{_parse(_){let{ctx:$}=this._processInputParams(_),D=$.data;return this._def.type._parse({data:D,path:$.path,parent:$})}unwrap(){return this._def.type}}class QU extends __{_parse(_){let{status:$,ctx:D}=this._processInputParams(_);if(D.common.async)return(async()=>{let g=await this._def.in._parseAsync({data:D.data,path:D.path,parent:D});if(g.status==="aborted")return m;if(g.status==="dirty")return $.dirty(),jD(g.value);else return this._def.out._parseAsync({data:g.value,path:D.path,parent:D})})();else{let U=this._def.in._parseSync({data:D.data,path:D.path,parent:D});if(U.status==="aborted")return m;if(U.status==="dirty")return $.dirty(),{status:"dirty",value:U.value};else return this._def.out._parseSync({data:U.value,path:D.path,parent:D})}}static create(_,$){return new QU({in:_,out:$,typeName:i.ZodPipeline})}}class YD extends __{_parse(_){let $=this._def.innerType._parse(_),D=(U)=>{if(n4(U))U.value=Object.freeze(U.value);return U};return SU($)?$.then((U)=>D(U)):D($)}unwrap(){return this._def.innerType}}YD.create=(_,$)=>{return new YD({innerType:_,typeName:i.ZodReadonly,...p($)})};function I9(_,$){let D=typeof _==="function"?_($):typeof _==="string"?{message:_}:_;return typeof D==="string"?{message:D}:D}function G9(_,$={},D){if(_)return m4.create().superRefine((U,g)=>{let I=_(U);if(I instanceof Promise)return I.then((j)=>{if(!j){let N=I9($,U),O=N.fatal??D??!0;g.addIssue({code:"custom",...N,fatal:O})}});if(!I){let j=I9($,U),N=j.fatal??D??!0;g.addIssue({code:"custom",...j,fatal:N})}return});return m4.create()}var DH={object:b_.lazycreate},i;(function(_){_.ZodString="ZodString",_.ZodNumber="ZodNumber",_.ZodNaN="ZodNaN",_.ZodBigInt="ZodBigInt",_.ZodBoolean="ZodBoolean",_.ZodDate="ZodDate",_.ZodSymbol="ZodSymbol",_.ZodUndefined="ZodUndefined",_.ZodNull="ZodNull",_.ZodAny="ZodAny",_.ZodUnknown="ZodUnknown",_.ZodNever="ZodNever",_.ZodVoid="ZodVoid",_.ZodArray="ZodArray",_.ZodObject="ZodObject",_.ZodUnion="ZodUnion",_.ZodDiscriminatedUnion="ZodDiscriminatedUnion",_.ZodIntersection="ZodIntersection",_.ZodTuple="ZodTuple",_.ZodRecord="ZodRecord",_.ZodMap="ZodMap",_.ZodSet="ZodSet",_.ZodFunction="ZodFunction",_.ZodLazy="ZodLazy",_.ZodLiteral="ZodLiteral",_.ZodEnum="ZodEnum",_.ZodEffects="ZodEffects",_.ZodNativeEnum="ZodNativeEnum",_.ZodOptional="ZodOptional",_.ZodNullable="ZodNullable",_.ZodDefault="ZodDefault",_.ZodCatch="ZodCatch",_.ZodPromise="ZodPromise",_.ZodBranded="ZodBranded",_.ZodPipeline="ZodPipeline",_.ZodReadonly="ZodReadonly"})(i||(i={}));var gH=(_,$={message:`Input not instance of ${_.name}`})=>G9((D)=>D instanceof _,$),Y9=F$.create,Q9=i6.create,UH=YU.create,IH=l6.create,T9=AD.create,jH=d4.create,NH=WU.create,EH=LD.create,OH=JD.create,AH=m4.create,LH=m6.create,JH=n$.create,PH=XU.create,zH=M$.create,SH=b_.create,WH=b_.strictCreate,XH=PD.create,RH=LN.create,GH=zD.create,YH=d$.create,QH=RU.create,TH=GU.create,qH=i4.create,BH=ND.create,VH=SD.create,KH=WD.create,FH=t6.create,MH=XD.create,ZH=l4.create,j9=R$.create,bH=Z$.create,HH=z6.create,kH=R$.createWithPreprocess,CH=QU.create,rH=()=>Y9().optional(),vH=()=>Q9().optional(),fH=()=>T9().optional(),wH={string:(_)=>F$.create({..._,coerce:!0}),number:(_)=>i6.create({..._,coerce:!0}),boolean:(_)=>AD.create({..._,coerce:!0}),bigint:(_)=>l6.create({..._,coerce:!0}),date:(_)=>d4.create({..._,coerce:!0})},uH=m;var x={actorRef:"hasna.actor_ref.v1",resourceRef:"hasna.resource_ref.v1",evidenceRef:"hasna.evidence_ref.v1",workRun:"hasna.work_run.v1",taskToPrProjection:"hasna.task_to_pr_projection.v1",decisionEnvelope:"hasna.decision_envelope.v1",costEstimate:"hasna.cost_estimate.v1",capabilityCard:"hasna.capability_card.v1",providerLiveModeStandard:"hasna.provider_live_mode_standard.v1",contextPack:"hasna.context_pack.v1",integrationRef:"hasna.integration_ref.v1",projectManifest:"hasna.project_manifest.v1",projectPanel:"hasna.project_panel.v1",projectSnapshot:"hasna.project_snapshot.v1",renderManifest:"hasna.render_manifest.v1",agentTrajectory:"hasna.agent_trajectory.v1",validationPlan:"hasna.validation_plan.v1",proofBundle:"hasna.proof_bundle.v1",scaffoldManifest:"hasna.scaffold_manifest.v1",scaffoldInstallRecord:"hasna.scaffold_install_record.v1",appCloudManifest:"hasna.app_cloud_manifest.v1",noCloudEvidencePack:"hasna.no_cloud_evidence_pack.v1",secureLocalStorePolicy:"hasna.secure_local_store_policy.v1",serviceContract:"hasna.service_contract.v1",commsEventEnvelope:"hasna.comms_event_envelope.v1",commsChannelMetadata:"hasna.comms_channel_metadata.v1",commsMessageMetadata:"hasna.comms_message_metadata.v1",app:"hasna.app.v1",release:"hasna.release.v1",rolloutRecord:"hasna.rollout_record.v1",announcement:"hasna.announcement.v1",audience:"hasna.audience.v1"},u3=E.string().regex(/^hasna\.[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*\.v[0-9]+$/),K_=E.string().datetime(),t=E.string().trim().min(1),H$=t.refine((_)=>_.startsWith("artifact://")||_.startsWith("repo://")||_.startsWith("project://")||_.startsWith("dashboard://")||_.startsWith("render://")||_.startsWith("integration://")||_.startsWith("task://")||_.startsWith("todo://")||_.startsWith("file://")||_.startsWith("files://")||_.startsWith("mailery://")||_.startsWith("conversation://")||_.startsWith("knowledge://")||_.startsWith("memento://")||_.startsWith("https://")||_.startsWith("http://")||_.startsWith("git+https://"),"URI must use artifact://, repo://, project://, dashboard://, render://, integration://, task://, todo://, file://, files://, mailery://, conversation://, knowledge://, memento://, http(s)://, or git+https://"),q9=E.string().regex(/^[a-fA-F0-9]{64}$/),B9=E.string().regex(/^(sha256:)?[a-fA-F0-9]{64}$/),o6=E.record(E.unknown()),qD=E.array(E.string().min(1)).default([]),t4=K_.nullable().optional(),xH=new Set(["succeeded","failed","cancelled","blocked","skipped"]),e4=E.enum(["pending","running","succeeded","failed","cancelled","blocked","skipped","unknown"]);function L_(_){return E.object({schema:E.literal(_),id:E.string().min(1),createdAt:K_,updatedAt:t4,metadata:o6.optional()}).strict()}var zd=E.object({schema:u3,id:E.string().min(1),createdAt:K_,updatedAt:t4,metadata:o6.optional()}).strict(),V9=E.enum(["agent","human","service","model","workflow","system"]),yH=L_(x.actorRef).extend({kind:V9,name:E.string().min(1).optional(),provider:E.string().min(1).optional(),accountId:E.string().min(1).optional(),machineId:E.string().min(1).optional(),capabilities:E.array(E.string().min(1)).default([])}).strict(),m$=E.object({kind:V9,id:E.string().min(1),name:E.string().min(1).optional(),provider:E.string().min(1).optional(),accountId:E.string().min(1).optional(),machineId:E.string().min(1).optional()}).strict(),K9=E.enum(["task","project","repo","run","loop","workflow","action","event","integration","session","machine","model","tool","file","document","url","artifact","knowledge","email","conversation","dashboard","render","panel","report","commit","branch","pull_request","issue","comment","verification","finding","context_pack","proof_bundle","memento","eval","budget","cost","alert","incident","app","release","rollout","announcement","audience","feedback","unknown"]),hH=L_(x.resourceRef).extend({kind:K9,name:E.string().min(1).optional(),uri:H$.optional(),externalId:t.optional(),sourcePackage:t.optional(),tags:qD}).strict().superRefine((_,$)=>{if(!_.uri&&!(_.externalId&&_.sourcePackage))$.addIssue({code:E.ZodIssueCode.custom,message:"Resource refs require uri or both sourcePackage and externalId",path:["uri"]})}),s=E.object({kind:K9,id:E.string().min(1),name:E.string().min(1).optional(),uri:H$.optional(),externalId:t.optional(),sourcePackage:t.optional(),tags:qD}).strict().superRefine((_,$)=>{if(!_.uri&&Boolean(_.externalId)!==Boolean(_.sourcePackage))$.addIssue({code:E.ZodIssueCode.custom,message:"Resource pointers with external package locators require both sourcePackage and externalId",path:_.externalId?["sourcePackage"]:["externalId"]})}),x3=E.enum(["file","command_output","screenshot","log","diff","report","artifact","url","video","har","test_result","metric","trace","other"]),cH=E.enum(["none","partial","full","unknown"]),nH=L_(x.evidenceRef).extend({kind:x3,uri:H$,sha256:q9.optional(),summary:E.string().min(1).optional(),contentType:E.string().min(1).optional(),sizeBytes:E.number().int().nonnegative().optional(),redaction:cH.default("unknown"),producer:m$.optional(),resourceRefs:E.array(s).default([]),tags:qD}).strict(),T_=E.object({id:E.string().min(1),kind:x3.optional(),uri:H$.optional(),sha256:q9.optional(),summary:E.string().min(1).optional()}).strict(),TU=L_(x.costEstimate).extend({currency:E.string().regex(/^[A-Z]{3}$/).default("USD"),amountMicros:E.number().int().nonnegative(),provider:E.string().min(1).optional(),model:E.string().min(1).optional(),accountId:E.string().min(1).optional(),promptTokens:E.number().int().nonnegative().optional(),completionTokens:E.number().int().nonnegative().optional(),totalTokens:E.number().int().nonnegative().optional(),basis:E.enum(["actual","estimated","budget","limit"]).default("estimated"),resourceRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.promptTokens!==void 0&&_.completionTokens!==void 0&&_.totalTokens!==void 0&&_.totalTokens!==_.promptTokens+_.completionTokens)$.addIssue({code:E.ZodIssueCode.custom,message:"totalTokens must equal promptTokens plus completionTokens when all are present",path:["totalTokens"]})}),dH=E.enum(["allowed","denied","warned","approval_required","selected","skipped","unknown"]),F9=L_(x.decisionEnvelope).extend({decisionType:E.enum(["guardrail","model_route","tool_select","budget","secret_access","approval","policy","other"]),status:dH,actor:m$.optional(),traceId:E.string().min(1).optional(),inputHash:B9.optional(),policyBundleId:E.string().min(1).optional(),selected:E.array(s).default([]),skipped:E.array(s).default([]),reason:E.string().min(1),obligations:E.array(E.string().min(1)).default([]),redactions:E.array(E.string().min(1)).default([]),costEstimate:TU.optional(),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.status==="selected"&&_.selected.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Selected decisions require at least one selected resource",path:["selected"]});if(_.status==="skipped"&&_.skipped.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Skipped decisions require at least one skipped resource",path:["skipped"]});if(_.status==="denied"){if(_.selected.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Denied decisions cannot include selected resources",path:["selected"]});if(!_.policyBundleId&&_.evidenceRefs.length===0&&_.obligations.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Denied decisions require policy, evidence, or obligations",path:["policyBundleId"]})}if(_.status==="approval_required"&&_.obligations.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Approval-required decisions require actionable obligations",path:["obligations"]})}),mH=L_(x.capabilityCard).extend({kind:E.enum(["model","tool","machine","agent","lane","connector","service"]),name:E.string().min(1),version:E.string().min(1).optional(),status:E.enum(["available","unavailable","degraded","unknown"]).default("unknown"),capabilities:E.array(E.string().min(1)).default([]),limitations:E.array(E.string().min(1)).default([]),riskLevel:E.enum(["low","medium","high","critical","unknown"]).default("unknown"),costEstimate:TU.optional(),evidenceRefs:E.array(T_).default([])}).strict(),QD=E.enum(["mock","fixture","sandbox","read_only_live","live_mutating"]),iH=E.enum(["none","read_only","external_notification","external_mutation","money_movement","dns_or_domain_change","bulk_message_or_call","legal_or_filing","compute_or_infra_mutation","irreversible"]),lH=E.object({refName:t,requiredForModes:E.array(QD).min(1),allowedSecretInputs:E.array(E.enum(["credential_ref","lease_ref"])).min(1).default(["credential_ref"]),failClosedDiagnostic:t,revocationCheck:E.boolean().default(!0)}).strict(),tH=E.object({operation:t,supportedModes:E.array(QD).min(1),sideEffectClass:iH,requiresApproval:E.boolean().default(!1),requiresIdempotencyKey:E.boolean().default(!1),requiresSandboxEvidence:E.boolean().default(!1),requiresRollbackOrRevocation:E.boolean().default(!1),rollbackOrRevocation:t.optional(),noSideEffectSmoke:t.optional(),reconciliation:t.optional()}).strict().superRefine((_,$)=>{if(_.supportedModes.includes("live_mutating")){if(_.sideEffectClass==="none"||_.sideEffectClass==="read_only")$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations must declare a side-effecting class",path:["sideEffectClass"]});if(!_.requiresApproval)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require approval",path:["requiresApproval"]});if(!_.requiresIdempotencyKey)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require idempotency keys",path:["requiresIdempotencyKey"]});if(!_.requiresSandboxEvidence)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require sandbox evidence before live proof",path:["requiresSandboxEvidence"]});if(!_.requiresRollbackOrRevocation||!_.rollbackOrRevocation)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require rollback or revocation instructions",path:["rollbackOrRevocation"]});if(!_.reconciliation)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating operations require reconciliation behavior",path:["reconciliation"]})}}),oH=E.object({providerId:t,appId:t,adapterId:t,ownerPackage:t,modes:E.array(QD).min(1),defaultMode:QD,credentialRequirements:E.array(lH).default([]),operations:E.array(tH).min(1),rateLimitPosture:t,costPosture:t.optional(),auditEvents:E.array(t).default([]),redactionRules:E.array(t).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(!_.modes.includes(_.defaultMode))$.addIssue({code:E.ZodIssueCode.custom,message:"defaultMode must be one of modes",path:["defaultMode"]});let D=new Set(_.operations.flatMap((U)=>U.supportedModes));for(let U of D)if(!_.modes.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`operation mode ${U} is not declared in provider modes`,path:["operations"]});if(D.has("live_mutating")){if(!_.credentialRequirements.some((g)=>g.requiredForModes.includes("live_mutating")))$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating providers require at least one live credential reference requirement",path:["credentialRequirements"]});if(_.auditEvents.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"live_mutating providers require audit events",path:["auditEvents"]})}}),pH=E.object({appId:t,repo:t,priority:E.enum(["p0","p1","p2"]).default("p1"),requiredEvidence:E.array(t).min(1),firstOperations:E.array(t).min(1),blockedUntil:E.array(t).default([])}).strict(),eH=L_(x.providerLiveModeStandard).extend({name:t,version:t,modes:E.array(QD).refine((_)=>["mock","fixture","sandbox","read_only_live","live_mutating"].every(($)=>_.includes($)),"provider live-mode standard must include every canonical provider mode"),requiredCapabilityFields:E.array(t).min(1),liveMutationGate:E.object({requiredMode:E.literal("live_mutating"),requiredChecks:E.array(t).min(1),forbiddenBypassSignals:E.array(t).min(1),disabledLiveSmoke:t}).strict(),noSideEffectSmoke:E.object({requiredForModes:E.array(QD).min(1),commandEvidence:E.array(t).min(1),secretOutputScan:E.boolean().default(!0)}).strict(),credentialPolicy:E.object({acceptedInputs:E.array(E.enum(["credential_ref","lease_ref"])).min(1),rawSecretInputsAllowed:E.literal(!1),missingCredentialBehavior:E.literal("fail_closed"),revocationCheckRequired:E.boolean().default(!0)}).strict(),operationCards:E.array(oH).min(1),firstAdoptionTargets:E.array(pH).min(1),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=new Set(_.firstAdoptionTargets.map((g)=>g.appId)),U=new Set(_.operationCards.map((g)=>g.appId));for(let g of D)if(!U.has(g))$.addIssue({code:E.ZodIssueCode.custom,message:`first adoption target ${g} requires a provider capability card`,path:["firstAdoptionTargets"]})}),aH=E.object({id:E.string().min(1),title:E.string().min(1).optional(),summary:E.string().min(1),text:E.string().optional(),tokens:E.number().int().nonnegative().optional(),source:T_,resourceRefs:E.array(s).default([])}).strict(),M9=L_(x.contextPack).extend({objective:E.string().min(1),budget:E.object({maxTokens:E.number().int().positive().optional(),maxBytes:E.number().int().positive().optional()}).strict().optional(),items:E.array(aH).default([]),citations:E.array(T_).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),permissions:E.array(E.string().min(1)).default([]),redactions:E.array(E.string().min(1)).default([]),conflicts:E.array(E.string().min(1)).default([]),uncertainty:E.string().min(1).optional()}).strict(),W$=t.refine((_)=>!_.startsWith("/")&&!_.includes("\\")&&!_.split("/").includes(".."),"Project paths must be relative and cannot contain parent-directory segments"),o4=E.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,"Project slugs must be lowercase dashed identifiers"),sH=E.enum(["public","internal","private","sensitive"]),_k=E.enum(["draft","active","paused","archived"]),y3=E.enum(["todos","files","mailery","conversations","knowledge","mementos","reports","actions","render","contracts","custom"]),Z9=L_(x.integrationRef).extend({kind:y3,name:E.string().min(1),projectId:o4.optional(),sourcePackage:t.optional(),externalId:t.optional(),uri:H$.optional(),enabled:E.boolean().default(!0),readOnly:E.boolean().default(!0),capabilities:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),resourceRef:s.optional(),evidenceRefs:E.array(T_).default([]),config:o6.optional()}).strict().superRefine((_,$)=>{if(!_.uri&&!(_.sourcePackage&&_.externalId)&&!_.resourceRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Integration refs require uri, resourceRef, or both sourcePackage and externalId",path:["uri"]})}),$k=E.object({schemaRoot:W$.default(".hasna/project"),dashboardManifest:W$.default(".hasna/project/dashboard.render.json"),snapshotsDir:W$.default(".hasna/project/snapshots"),documentsDir:W$.default("documents"),reportsDir:W$.default("reports"),evidenceDir:W$.default(".hasna/project/evidence"),privateDir:W$.default(".hasna/project/private")}).strict(),Dk=L_(x.projectManifest).extend({projectId:o4,slug:o4,name:E.string().min(1),summary:E.string().min(1).optional(),status:_k.default("active"),classification:sH.default("private"),owner:m$.optional(),layout:$k.default({}),integrations:E.array(Z9).default([]),renderManifests:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),tags:qD}).strict().superRefine((_,$)=>{let D=new Set,U=new Set;if(_.projectId!==_.slug)$.addIssue({code:E.ZodIssueCode.custom,message:"projectId and slug must match for canonical project manifests",path:["slug"]});for(let[g,I]of _.integrations.entries()){if(D.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project manifest integration ids must be unique",path:["integrations",g,"id"]});if(D.add(I.id),I.projectId&&I.projectId!==_.projectId)$.addIssue({code:E.ZodIssueCode.custom,message:"Integration projectId must match the manifest projectId",path:["integrations",g,"projectId"]})}for(let[g,I]of _.renderManifests.entries()){if(I.kind!=="render")$.addIssue({code:E.ZodIssueCode.custom,message:"Project renderManifests must use resource kind render",path:["renderManifests",g,"kind"]});if(U.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project renderManifest refs must be unique",path:["renderManifests",g,"id"]});U.add(I.id)}}),gk=E.enum(["local","package","provider","url"]),h3=E.object({id:E.string().min(1),kind:gk,specifier:E.string().min(1),path:W$.optional(),packageName:E.string().min(1).optional(),uri:H$.optional(),provider:y3.optional(),schemaId:u3.optional(),integrity:B9.optional(),resourceRef:s.optional(),optional:E.boolean().default(!1)}).strict().superRefine((_,$)=>{if(_.kind==="local"&&!_.path)$.addIssue({code:E.ZodIssueCode.custom,message:"Local render imports require path",path:["path"]});if(_.kind==="package"&&!_.packageName)$.addIssue({code:E.ZodIssueCode.custom,message:"Package render imports require packageName",path:["packageName"]});if(_.kind==="provider"&&!_.provider)$.addIssue({code:E.ZodIssueCode.custom,message:"Provider render imports require provider",path:["provider"]});if(_.kind==="url"&&!_.uri)$.addIssue({code:E.ZodIssueCode.custom,message:"URL render imports require uri",path:["uri"]})}),Uk=E.enum(["dashboard","canvas","panel","report","document","custom"]),Ik=E.object({id:E.string().min(1),title:E.string().min(1),kind:Uk,default:E.boolean().default(!1),entry:W$.optional(),imports:E.array(h3).default([]),panelRefs:E.array(s).default([]),dataRefs:E.array(s).default([]),layout:o6.optional()}).strict(),jk=L_(x.renderManifest).extend({projectId:o4,name:E.string().min(1),version:E.string().min(1),manifestPath:W$.default(".hasna/project/dashboard.render.json"),renderer:E.enum(["json_render","react_flow","markdown","html","custom"]).default("json_render"),views:E.array(Ik).min(1),imports:E.array(h3).default([]),theme:o6.optional(),compatibility:E.object({minProjectsVersion:E.string().min(1).optional(),minContractsVersion:E.string().min(1).optional()}).strict().optional(),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=_.views.filter((I)=>I.default),U=new Set,g=new Set;if(D.length>1)$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifests can have at most one default view",path:["views"]});for(let[I,j]of _.imports.entries()){if(g.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifest import ids must be unique",path:["imports",I,"id"]});g.add(j.id)}for(let[I,j]of _.views.entries()){if(U.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render manifest view ids must be unique",path:["views",I,"id"]});U.add(j.id);let N=new Set;for(let[O,A]of j.imports.entries()){if(N.has(A.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Render view import ids must be unique",path:["views",I,"imports",O,"id"]});N.add(A.id)}for(let[O,A]of j.panelRefs.entries())if(A.kind!=="panel")$.addIssue({code:E.ZodIssueCode.custom,message:"Render view panelRefs must use resource kind panel",path:["views",I,"panelRefs",O,"kind"]})}}),Nk=E.enum(["ready","empty","loading","error","auth_required","unavailable","stale"]),Ek=E.enum(["overview","tasks","files","mailery","conversations","knowledge","mementos","reports","actions","timeline","risks","documents","custom"]),Ok=E.object({id:E.string().min(1),label:E.string().min(1),value:E.union([E.string(),E.number(),E.boolean()]),unit:E.string().min(1).optional(),status:E.enum(["good","warning","critical","unknown"]).default("unknown"),resourceRefs:E.array(s).default([])}).strict(),Ak=E.object({id:E.string().min(1),title:E.string().min(1),summary:E.string().min(1).optional(),status:E.string().min(1).optional(),priority:E.enum(["low","medium","high","critical","unknown"]).default("unknown"),timestamp:K_.optional(),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),metadata:o6.optional()}).strict(),Lk=E.object({renderer:E.enum(["json_render","react_flow","markdown","html","custom"]).default("json_render"),title:E.string().min(1).optional(),entry:W$.optional(),imports:E.array(h3).default([]),spec:o6.default({})}).strict(),b9=L_(x.projectPanel).extend({projectId:o4,provider:E.object({kind:y3,id:E.string().min(1),name:E.string().min(1).optional(),sourcePackage:t.optional(),externalId:t.optional()}).strict(),kind:Ek,title:E.string().min(1),summary:E.string().min(1).optional(),state:Nk.default("ready"),stateReason:E.string().min(1).optional(),generatedAt:K_,freshness:E.enum(["fresh","stale","unknown"]).default("unknown"),metrics:E.array(Ok).default([]),items:E.array(Ak).default([]),actions:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),renderFragment:Lk.optional(),warnings:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{let D=new Set(["error","auth_required","unavailable","stale"]),U=new Set,g=new Set;if(D.has(_.state)&&!_.stateReason)$.addIssue({code:E.ZodIssueCode.custom,message:"Non-ready provider states require stateReason",path:["stateReason"]});if(_.state==="ready"&&_.metrics.length===0&&_.items.length===0&&!_.renderFragment)$.addIssue({code:E.ZodIssueCode.custom,message:"Ready panels require metrics, items, or a renderFragment; use state=empty for empty panels",path:["state"]});for(let[I,j]of _.metrics.entries()){if(U.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel metric ids must be unique",path:["metrics",I,"id"]});U.add(j.id)}for(let[I,j]of _.items.entries()){if(g.has(j.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel item ids must be unique",path:["items",I,"id"]});g.add(j.id)}for(let[I,j]of _.actions.entries())if(j.kind!=="action")$.addIssue({code:E.ZodIssueCode.custom,message:"Project panel actions must use resource kind action",path:["actions",I,"kind"]})}),Jk=L_(x.projectSnapshot).extend({projectId:o4,generatedAt:K_,status:e4.default("unknown"),manifestRef:s,renderManifestRef:s.optional(),panels:E.array(b9).default([]),contextPacks:E.array(M9).default([]),proofBundleRefs:E.array(s).default([]),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),warnings:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown")}).strict().superRefine((_,$)=>{let D=new Set,U=new Set;if(_.manifestRef.kind!=="project")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot manifestRef must use resource kind project",path:["manifestRef","kind"]});if(_.renderManifestRef&&_.renderManifestRef.kind!=="render")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot renderManifestRef must use resource kind render",path:["renderManifestRef","kind"]});for(let[g,I]of _.proofBundleRefs.entries())if(I.kind!=="proof_bundle")$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot proofBundleRefs must use resource kind proof_bundle",path:["proofBundleRefs",g,"kind"]});for(let[g,I]of _.panels.entries()){if(I.projectId!==_.projectId)$.addIssue({code:E.ZodIssueCode.custom,message:"Panel projectId must match snapshot projectId",path:["panels",g,"projectId"]});if(D.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot panel ids must be unique",path:["panels",g,"id"]});D.add(I.id)}for(let[g,I]of _.contextPacks.entries()){if(U.has(I.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Project snapshot context pack ids must be unique",path:["contextPacks",g,"id"]});U.add(I.id)}}),H9=E.object({id:E.string().min(1),kind:E.enum(["command","test","typecheck","lint","eval","security","review","deploy","smoke","manual","other"]),required:E.boolean().default(!0),command:E.string().min(1).optional(),expected:E.string().min(1).optional(),timeoutMs:E.number().int().positive().optional(),resourceRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(new Set(["command","test","typecheck","lint","smoke","eval"]).has(_.kind)&&!_.command&&!_.expected)$.addIssue({code:E.ZodIssueCode.custom,message:"Actionable validation checks require command or expected",path:["command"]})}),Pk=L_(x.validationPlan).extend({objective:E.string().min(1),subject:s.optional(),checks:E.array(H9).min(1),verifier:m$.optional(),requiredEvidenceKinds:E.array(x3).default([])}).strict(),zk=E.enum(["open_source","internal_app","platform","app","agent","content","overlay","other"]),Sk=E.enum(["draft","active","deprecated","archived"]),Wk=E.enum(["cli","mcp","library","sdk","rest_api","dashboard","database","auth","billing","worker","daemon","native","browser_extension","ai_provider","media_pipeline","data_pipeline","tests","ci","deployment","docs","other"]),Xk=E.object({key:E.string().regex(/^[A-Z][A-Z0-9_]*$/),description:E.string().min(1),required:E.boolean().default(!1),["secret"]:E.boolean().default(!1),group:E.string().min(1).optional(),default:E.string().optional()}).strict().superRefine((_,$)=>{if(_.secret&&_.default!==void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"Secret scaffold env vars cannot include defaults",path:["default"]})}),Rk=E.object({name:E.string().min(1),command:E.string().min(1),description:E.string().min(1).optional(),required:E.boolean().default(!1)}).strict(),Gk=E.object({packageManager:E.enum(["bun","npm","pnpm","yarn","cargo","pip","other"]).optional(),languages:E.array(E.string().min(1)).default([]),requiredFiles:E.array(E.string().min(1)).default([]),requiredDirectories:E.array(E.string().min(1)).default([]),optionalDirectories:E.array(E.string().min(1)).default([])}).strict(),Yk=L_(x.scaffoldManifest).extend({name:E.string().min(1),version:E.string().min(1),summary:E.string().min(1),type:zk,status:Sk.default("draft"),capabilities:E.array(Wk).default([]),techStack:E.array(E.string().min(1)).default([]),tags:qD,source:s.optional(),output:Gk,env:E.array(Xk).default([]),scripts:E.array(Rk).default([]),validationChecks:E.array(H9).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.source?.uri?.startsWith("file://"))$.addIssue({code:E.ZodIssueCode.custom,message:"Public scaffold manifest source refs cannot use local file:// URIs",path:["source","uri"]});if(_.status==="active"&&_.validationChecks.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Active scaffold manifests require validation checks",path:["validationChecks"]});if(_.status==="active"&&_.output.requiredFiles.length===0&&_.output.requiredDirectories.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Active scaffold manifests require at least one required file or directory",path:["output"]})}),Qk=E.enum(["installed","failed","cancelled","partial","unknown"]),Tk=L_(x.scaffoldInstallRecord).extend({scaffoldId:E.string().min(1),scaffoldVersion:E.string().min(1).optional(),manifestRef:s.optional(),target:s,status:Qk,installedAt:K_.optional(),installer:m$.optional(),packageManager:E.enum(["bun","npm","pnpm","yarn","cargo","pip","other"]).optional(),options:o6.optional(),generatedFiles:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),proofBundleRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.status==="installed"&&!_.installedAt)$.addIssue({code:E.ZodIssueCode.custom,message:"Installed scaffold records require installedAt",path:["installedAt"]});if(_.status==="installed"&&_.generatedFiles.length===0&&_.evidenceRefs.length===0&&_.proofBundleRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Installed scaffold records require generated files, evidence, or proof bundle refs",path:["generatedFiles"]});if((_.status==="failed"||_.status==="partial")&&_.evidenceRefs.length===0&&_.proofBundleRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed or partial scaffold records require evidence or proof bundle refs",path:["evidenceRefs"]})}),TD=E.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,"App ids must be lowercase dashed identifiers"),c3=E.string().regex(/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/,"Must be a valid npm package name"),k9=E.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,"Must be a semver version"),qk=E.string().regex(/^[0-9a-f]{7,40}$/,"Must be a lowercase git sha (7-40 hex chars)"),Bk=t.refine((_)=>_.startsWith("https://github.com/")||_.startsWith("git+https://github.com/"),"GitHub URLs must start with https://github.com/ or git+https://github.com/"),Vk=E.enum(["active","stub","deprecated","archived"]),Kk=E.enum(["stable","beta","canary","internal"]),Fk=E.object({transport:E.enum(["http","stdio"]).default("http"),bin:E.string().min(1).optional(),url:H$.optional()}).strict(),Mk=E.object({healthPath:E.string().min(1).default("/health"),port:E.number().int().positive().optional(),baseUrl:H$.optional()}).strict(),Zk=E.object({bins:E.array(E.string().min(1)).default([]),mcp:Fk.optional(),http:Mk.optional()}).strict(),bk=L_(x.app).extend({appId:TD,npmName:c3,repoFolder:TD,githubUrl:Bk,projectSlug:o4,surfaces:Zk.default({}),lifecycle:Vk,releaseChannel:Kk.default("stable"),summary:E.string().min(1).optional(),tags:qD}).strict().superRefine((_,$)=>{let D=new Set;for(let[U,g]of _.surfaces.bins.entries()){if(D.has(g))$.addIssue({code:E.ZodIssueCode.custom,message:"App surface bins must be unique",path:["surfaces","bins",U]});D.add(g)}}),Hk=E.enum(["skill","ci","backfilled"]),kk=L_(x.release).extend({appId:TD,package:c3,version:k9,gitSha:qk,publishedAt:K_,publishPath:Hk,changelogRef:s.optional(),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.publishPath!=="backfilled"&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"skill and ci releases require publish evidence; only backfilled releases may omit it",path:["evidenceRefs"]})}),Ck=E.enum(["install","update","rollback","freeze-blocked"]),rk=E.object({cliVersion:E.string().min(1).optional(),mcpHealth:E.enum(["ok","degraded","unavailable","not_checked"]).optional()}).strict().superRefine((_,$)=>{if(!_.cliVersion&&_.mcpHealth===void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"Rollout verification requires at least one concrete verifier field"})}),vk=L_(x.rolloutRecord).extend({appId:TD,package:c3,version:k9,machine:t,action:Ck,result:e4,verifiedBy:rk.optional(),at:K_,evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.action==="freeze-blocked"&&_.result!=="blocked"&&_.result!=="skipped")$.addIssue({code:E.ZodIssueCode.custom,message:"freeze-blocked rollout records must report result blocked or skipped",path:["result"]});let D=Boolean(_.verifiedBy?.cliVersion)||_.verifiedBy?.mcpHealth!==void 0&&_.verifiedBy.mcpHealth!=="not_checked",U=_.verifiedBy?Object.keys(_.verifiedBy).length>0:!1;if((_.action==="install"||_.action==="update")&&_.result==="succeeded"&&(!_.verifiedBy||U&&!D))$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded install/update rollout records require concrete verification",path:["verifiedBy"]})}),fk=E.enum(["email","telegram","slack","discord","x","blog","rss","webhook","github","other"]),wk=E.enum(["pending","queued","sent","failed","skipped","suppressed"]),uk=E.object({channel:fk,status:wk,deliveredAt:K_.optional(),detail:E.string().min(1).optional()}).strict().superRefine((_,$)=>{if(_.status==="sent"&&!_.deliveredAt)$.addIssue({code:E.ZodIssueCode.custom,message:"Sent announcement channels require deliveredAt",path:["deliveredAt"]});if(_.status==="failed"&&!_.detail)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed announcement channels require detail",path:["detail"]})}),xk=L_(x.announcement).extend({campaignId:t,appId:TD.optional(),releaseRef:s.optional(),channels:E.array(uk).min(1),audienceRef:s,sentAt:K_}).strict().superRefine((_,$)=>{if(_.releaseRef&&_.releaseRef.kind!=="release")$.addIssue({code:E.ZodIssueCode.custom,message:"Announcement releaseRef must use resource kind release",path:["releaseRef","kind"]});if(_.audienceRef.kind!=="audience")$.addIssue({code:E.ZodIssueCode.custom,message:"Announcement audienceRef must use resource kind audience",path:["audienceRef","kind"]})}),yk=E.enum(["tag","attribute","group"]),hk=E.enum(["eq","neq","in","not_in","exists","not_exists"]),N9=E.union([E.string(),E.number(),E.boolean()]),ck=E.object({kind:yk,key:E.string().min(1).optional(),op:hk.default("eq"),value:N9.optional(),values:E.array(N9).default([])}).strict().superRefine((_,$)=>{if(_.kind==="attribute"&&!_.key)$.addIssue({code:E.ZodIssueCode.custom,message:"Attribute predicates require key",path:["key"]});if((_.op==="eq"||_.op==="neq")&&_.value===void 0)$.addIssue({code:E.ZodIssueCode.custom,message:"eq/neq predicates require value",path:["value"]});if((_.op==="in"||_.op==="not_in")&&_.values.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"in/not_in predicates require values",path:["values"]})}),nk=E.object({match:E.enum(["all","any"]).default("all"),predicates:E.array(ck).min(1)}).strict(),dk=E.enum(["opt_in","opt_out","transactional","none"]),mk=L_(x.audience).extend({audienceId:TD,name:t,definition:nk,consentPolicy:dk,suppressionSyncedAt:t4}).strict(),jN=["@hasna/cloud","open-cloud"],ik=E.enum(["aws","gcp","azure","cloudflare","vercel","neon","supabase","postgres","s3","rds","other"]),lk=E.object({id:E.string().min(1),provider:ik,kind:E.enum(["database","bucket","queue","secret","function","worker","cache","topic","scheduler","object_store","other"]),ownerPackage:E.string().min(1),region:E.string().min(1).optional(),accountId:E.string().min(1).optional(),uri:H$.optional(),machineScoped:E.boolean().default(!1)}).strict(),C9=L_(x.appCloudManifest).extend({packageName:E.string().min(1),packageVersion:E.string().min(1).optional(),appId:E.string().min(1),repository:s.optional(),storageMode:E.enum(["local_only","app_owned_cloud","hybrid_local_cache","external_service"]),cloudBoundary:E.enum(["none","app_owned","external_service","local_cache"]),cloudResources:E.array(lk).default([]),localCache:E.object({path:E.string().min(1).optional(),pullMode:E.enum(["manual","daemon","ci","none"]).default("manual"),conflictPolicy:E.enum(["cloud_wins","local_wins","merge","manual_review"]).default("manual_review")}).strict().optional(),forbiddenSharedRuntimes:E.array(E.string().min(1)).default([...jN]),dependencies:E.array(E.string().min(1)).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=new Set([...jN,..._.forbiddenSharedRuntimes]);if(D.has(_.packageName))$.addIssue({code:E.ZodIssueCode.custom,message:"App-owned cloud manifests cannot be for a forbidden runtime",path:["packageName"]});for(let U of jN)if(!_.forbiddenSharedRuntimes.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`forbiddenSharedRuntimes must include ${U}`,path:["forbiddenSharedRuntimes"]});for(let U of D)if(_.dependencies.includes(U))$.addIssue({code:E.ZodIssueCode.custom,message:`App-owned cloud manifests cannot depend on ${U}`,path:["dependencies"]});if(_.storageMode==="local_only"&&_.cloudBoundary!=="none")$.addIssue({code:E.ZodIssueCode.custom,message:"local_only storage requires cloudBoundary none",path:["cloudBoundary"]});if(_.storageMode==="app_owned_cloud"&&_.cloudBoundary!=="app_owned")$.addIssue({code:E.ZodIssueCode.custom,message:"app_owned_cloud storage requires cloudBoundary app_owned",path:["cloudBoundary"]});if(_.storageMode==="hybrid_local_cache"){if(_.cloudBoundary!=="local_cache")$.addIssue({code:E.ZodIssueCode.custom,message:"hybrid_local_cache storage requires cloudBoundary local_cache",path:["cloudBoundary"]});if(!_.localCache)$.addIssue({code:E.ZodIssueCode.custom,message:"hybrid_local_cache storage requires localCache settings",path:["localCache"]})}if(_.storageMode==="external_service"){if(_.cloudBoundary!=="external_service")$.addIssue({code:E.ZodIssueCode.custom,message:"external_service storage requires cloudBoundary external_service",path:["cloudBoundary"]});if(_.cloudResources.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"external_service storage must not declare app-owned cloudResources",path:["cloudResources"]})}if((_.storageMode==="app_owned_cloud"||_.storageMode==="hybrid_local_cache")&&_.cloudResources.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Cloud-backed storage modes require explicit app-owned cloudResources",path:["cloudResources"]});if(_.cloudBoundary==="none"&&_.cloudResources.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"cloudBoundary none cannot declare cloudResources",path:["cloudResources"]});_.cloudResources.forEach((U,g)=>{if(U.ownerPackage!==_.packageName)$.addIssue({code:E.ZodIssueCode.custom,message:"Cloud resources must be owned by the app package that declares the manifest",path:["cloudResources",g,"ownerPackage"]})})}),r9=E.enum(["package_manifest","lockfile","source_import","runtime_config","packed_artifact","published_metadata","app_cloud_manifest","remote_config","boundary_doc","other"]),tk=E.enum(["low","medium","high","critical"]),v9=E.object({id:E.string().min(1),kind:r9,severity:tk,path:E.string().min(1).optional(),packageName:E.string().min(1).optional(),pattern:E.string().min(1),message:E.string().min(1),evidenceRefs:E.array(T_).default([])}).strict(),ok=E.object({id:E.string().min(1),kind:r9,status:e4,target:E.string().min(1),command:E.string().min(1).optional(),evidenceRefs:E.array(T_).default([]),findings:E.array(v9).default([])}).strict(),pk=L_(x.noCloudEvidencePack).extend({subject:s,packageName:E.string().min(1).optional(),packageVersion:E.string().min(1).optional(),generatedBy:m$.optional(),scanMode:E.enum(["source_tree","packed_artifact","published_metadata","runtime_config","workspace","ci"]),status:e4,verdict:E.enum(["passed","failed","warning","not_run"]),appCloudManifest:C9.optional(),checks:E.array(ok).min(1),findings:E.array(v9).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{let D=[..._.findings,..._.checks.flatMap((g)=>g.findings)],U=D.filter((g)=>g.severity==="high"||g.severity==="critical");if(_.verdict==="passed"){if(_.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence requires succeeded status",path:["status"]});if(U.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence cannot include high or critical findings",path:["findings"]});if(_.checks.some((g)=>g.status!=="succeeded"))$.addIssue({code:E.ZodIssueCode.custom,message:"Passed no-cloud evidence requires every check to be succeeded",path:["checks"]})}if(_.verdict==="failed"&&D.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed no-cloud evidence requires findings",path:["findings"]});if(_.status==="succeeded"&&_.checks.some((g)=>g.status==="failed"))$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded no-cloud evidence cannot contain failed checks",path:["checks"]});_.checks.forEach((g,I)=>{let j=g.findings.filter((N)=>N.severity==="high"||N.severity==="critical");if(g.status==="succeeded"&&j.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded no-cloud checks cannot contain high or critical findings",path:["checks",I,"findings"]})})}),ek=E.object({checkId:E.string().min(1),status:e4,summary:E.string().min(1).optional(),startedAt:t4,finishedAt:t4,evidenceRefs:E.array(T_).default([])}).strict(),ak=L_(x.proofBundle).extend({subject:s,validationPlanRef:s.optional(),status:e4,verdict:E.enum(["passed","failed","inconclusive","not_run"]).default("inconclusive"),checks:E.array(ek).default([]),verifier:m$.optional(),evidenceRefs:E.array(T_).default([]),residualRisks:E.array(E.string().min(1)).default([]),freshness:E.enum(["fresh","stale","unknown"]).default("unknown")}).strict().superRefine((_,$)=>{if(_.verdict==="passed"){if(_.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles must have status succeeded",path:["status"]});if(_.checks.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require at least one check result",path:["checks"]});if(_.checks.forEach((U,g)=>{if(U.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require all checks to have status succeeded",path:["checks",g,"status"]})}),!(_.evidenceRefs.length>0||_.checks.some((U)=>U.evidenceRefs.length>0)))$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require evidence",path:["evidenceRefs"]});if(!_.verifier)$.addIssue({code:E.ZodIssueCode.custom,message:"Passed proof bundles require a verifier",path:["verifier"]})}if(_.verdict==="not_run"&&_.checks.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"Not-run proof bundles cannot include check results",path:["checks"]});if(_.verdict==="failed"&&!_.checks.some((D)=>D.status==="failed")&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed proof bundles require a failed check or evidence",path:["checks"]})}),sk=L_(x.workRun).extend({objective:E.string().min(1),status:e4,actor:m$,traceId:E.string().min(1).optional(),startedAt:t4,finishedAt:t4,constraints:E.array(E.string().min(1)).default([]),resourceRefs:E.array(s).default([]),decisions:E.array(F9).default([]),costEstimates:E.array(TU).default([]),evidenceRefs:E.array(T_).default([]),validationPlanRefs:E.array(s).default([]),proofBundleRefs:E.array(s).default([])}).strict().superRefine((_,$)=>{if(_.startedAt&&_.finishedAt&&Date.parse(_.finishedAt)0||_.proofBundleRefs.length>0;if(_.status==="succeeded"&&!D)$.addIssue({code:E.ZodIssueCode.custom,message:"Succeeded work runs require evidence or a proof bundle",path:["evidenceRefs"]});if((_.status==="failed"||_.status==="blocked")&&!D&&_.decisions.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed or blocked work runs require evidence, a proof bundle, or a decision record",path:["evidenceRefs"]})}),_C=Object.freeze({work_run:Object.freeze(["codewith"]),root_request:Object.freeze(["todos"]),pr_group:Object.freeze(["todos"]),leaf_task:Object.freeze(["todos"]),attempt:Object.freeze(["todos"]),writer_generation:Object.freeze(["todos"]),writer_lease:Object.freeze(["repos"]),writer_fence:Object.freeze(["repos"]),provider_profile:Object.freeze(["codewith"]),provider_route:Object.freeze(["codewith"]),admission:Object.freeze(["codewith"]),worker_actor:Object.freeze(["codewith"]),worker:Object.freeze(["codewith"]),runtime:Object.freeze(["codewith"]),repo:Object.freeze(["repos"]),worktree:Object.freeze(["repos"]),branch:Object.freeze(["repos"]),event_stream:Object.freeze(["todos"]),replay_cursor:Object.freeze(["todos"]),handoff:Object.freeze(["todos"]),pull_request:Object.freeze(["todos"]),commit:Object.freeze(["repos"]),review:Object.freeze(["review"]),reviewer:Object.freeze(["review"]),review_run:Object.freeze(["review"]),proof_bundle:Object.freeze(["review"]),repair_cycle:Object.freeze(["todos"]),merge_guard:Object.freeze(["todos"]),merge_operator:Object.freeze(["merge_provider"]),merge_operator_run:Object.freeze(["merge_provider"]),merge_guard_receipt:Object.freeze(["merge_provider"]),merge_outcome:Object.freeze(["merge_provider"]),recovery:Object.freeze(["todos"]),cancellation:Object.freeze(["todos"]),cleanup_eligibility:Object.freeze(["repos"]),cleanup_outcome:Object.freeze(["repos"]),rollback_plan:Object.freeze(["todos"]),rollback_outcome:Object.freeze(["repos"]),terminal_disposition:Object.freeze(["todos"]),openloops_invocation:Object.freeze(["openloops"]),adapter_extension:Object.freeze(["adapter"])}),$C=E.enum(["work_run","root_request","pr_group","leaf_task","attempt","writer_generation","writer_lease","writer_fence","provider_profile","provider_route","admission","worker_actor","worker","runtime","repo","worktree","branch","event_stream","replay_cursor","handoff","pull_request","commit","review","reviewer","review_run","proof_bundle","repair_cycle","merge_guard","merge_operator","merge_operator_run","merge_guard_receipt","merge_outcome","recovery","cancellation","cleanup_eligibility","cleanup_outcome","rollback_plan","rollback_outcome","terminal_disposition","openloops_invocation","adapter_extension"]),DC=E.enum(["todos","codewith","repos","review","merge_provider","openloops","adapter"]),p4=E.string().regex(/^[a-f0-9]{64}$/),PN=E.string().trim().min(3).max(256),f9=/^[a-f0-9]{32}$/;function gC(_,$,D){return`${_}:${$}:opaque-${D.slice(0,32)}`}function UC(_){return`evidence:opaque-${_.slice(0,32)}`}var w9=PN.refine((_)=>{let D=_.startsWith("task_to_pr_projection:opaque-")?_.slice(29):"";return f9.test(D)},"Projection ids must use a nonsemantic 128-bit lowercase hexadecimal surrogate"),n3=PN.refine((_)=>{let D=_.startsWith("attempt_nonce:opaque-")?_.slice(21):"";return f9.test(D)},"Attempt nonces must use a nonsemantic 128-bit lowercase hexadecimal surrogate"),IC=new Set(["writer_lease","writer_fence","provider_profile","provider_route","admission","worker_actor","worker","runtime","worktree","merge_operator","merge_operator_run","merge_guard_receipt","merge_outcome","openloops_invocation","adapter_extension"]),d3=E.object({role:$C,authority:DC,id:PN,digest:p4,redaction:E.enum(["none","partial","full"])}).strict().superRefine((_,$)=>{let D=_C[_.role];if(!D.includes(_.authority))$.addIssue({code:E.ZodIssueCode.custom,message:`${_.role} refs must be owned by ${D.join(" or ")}`,path:["authority"]});if(IC.has(_.role)&&_.redaction==="none")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.role} refs must be redacted and cannot carry a raw locator or credential`,path:["redaction"]});let U=gC(_.role,_.authority,_.digest);if(_.id!==U)$.addIssue({code:E.ZodIssueCode.custom,message:"Reference ids must be nonsemantic authority-bound surrogates derived from the canonical role, authority, and owner-record digest",path:["id"]})}),X$=E.object({id:PN,digest:p4,redaction:E.enum(["partial","full"])}).strict().superRefine((_,$)=>{if(_.id!==UC(_.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Evidence ids must be nonsemantic owner-resolvable surrogates derived from their canonical digest",path:["id"]})});function u9(_,$,D,U){if(_.id===$.id||_.digest===$.digest)D.addIssue({code:E.ZodIssueCode.custom,message:"Stop and lease-revocation facts require distinct evidence identities and digests",path:U})}function b(_){return d3.refine(($)=>$.role===_,{message:`Reference must use role ${_}`,path:["role"]})}function B_(_,$){return _.role===$.role&&_.authority===$.authority&&_.id===$.id&&_.digest===$.digest&&_.redaction===$.redaction}function m3(_,$){return _.role===$.role&&_.authority===$.authority&&_.id===$.id}function ED(_,$,D,U,g){if(m3(_,$))D.addIssue({code:E.ZodIssueCode.custom,message:`${g} requires a fresh canonical role/authority/id`,path:U});if(_.digest===$.digest)D.addIssue({code:E.ZodIssueCode.custom,message:`${g} requires a fresh canonical digest`,path:U})}function ON(_){return`${_.role}\x00${_.authority}\x00${_.id}`}function e_(_,$){return _.algorithm===$.algorithm&&_.value===$.value}var Q_=E.object({algorithm:E.enum(["sha1","sha256"]),value:E.string().regex(/^[a-f0-9]+$/)}).strict().superRefine((_,$)=>{let D=_.algorithm==="sha1"?40:64;if(_.value.length!==D)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.algorithm} object ids must contain exactly ${D} lowercase hex characters`,path:["value"]})});function E9(_){if(_.canonicalizationVersion===1){let D=JSON.stringify(["hasna.task_to_pr_projection.binding.v1",_.canonicalizationVersion,_.rootRequestRef.id,_.rootRequestRef.digest,_.prGroupRef.id,_.prGroupRef.digest,_.leafTaskRef.id,_.leafTaskRef.digest,_.repoRef.id,_.repoRef.digest,_.baseHead.algorithm,_.baseHead.value,_.frozenScopeDigest]);return g9("sha256").update(D,"utf8").digest("hex")}let $=JSON.stringify(["hasna.task_to_pr_projection.binding.v2",_.canonicalizationVersion,...[_.rootRequestRef,_.prGroupRef,_.leafTaskRef,_.repoRef,_.worktreeRef,_.branchRef].flatMap((D)=>[D.role,D.authority,D.id,D.digest]),_.baseHead.algorithm,_.baseHead.value,_.frozenScopeDigest]);return g9("sha256").update($,"utf8").digest("hex")}var jC=E.object({ref:b("attempt"),nonce:n3,admissionRef:b("admission"),admissionWriterGenerationRef:b("writer_generation"),workerActorRef:b("worker_actor"),workerRef:b("worker"),runtimeRef:b("runtime"),writerGenerationRef:b("writer_generation"),writerLeaseRef:b("writer_lease"),writerFenceRef:b("writer_fence"),providerProfileRef:b("provider_profile"),providerRouteRef:b("provider_route")}).strict(),NC=E.object({repoRef:b("repo"),worktreeRef:b("worktree"),branchRef:b("branch"),baseHead:Q_,branchHead:Q_}).strict(),EC=E.object({streamRef:b("event_stream"),replayCursorRef:b("replay_cursor"),sequence:E.number().int().safe().nonnegative(),prefixDigest:p4}).strict(),OC=E.object({ref:b("handoff"),previousAttemptRef:b("attempt"),nextAttemptRef:b("attempt"),previousWriterGenerationRef:b("writer_generation"),nextWriterGenerationRef:b("writer_generation"),stoppedWorkRunRef:b("work_run"),stopEvidenceRef:X$,leaseRevocationEvidenceRef:X$}).strict().superRefine((_,$)=>{ED(_.previousAttemptRef,_.nextAttemptRef,$,["nextAttemptRef"],"Handoff attempt rotation"),ED(_.previousWriterGenerationRef,_.nextWriterGenerationRef,$,["nextWriterGenerationRef"],"Handoff writer-generation rotation"),u9(_.stopEvidenceRef,_.leaseRevocationEvidenceRef,$,["leaseRevocationEvidenceRef"])}),AC=E.object({ref:b("review"),pullRequestRef:b("pull_request"),base:Q_,head:Q_,reviewerRef:b("reviewer"),reviewRunRef:b("review_run"),proofBundleRef:b("proof_bundle"),verdict:E.enum(["approved","changes_requested","blocked"]),reviewedAt:K_}).strict(),LC=E.object({pullRequestRef:b("pull_request"),remoteBranchRef:b("branch"),expectedBase:Q_,providerPullRequestBase:Q_,localHead:Q_,remoteHead:Q_,providerPullRequestHead:Q_,equalityProofRef:b("proof_bundle"),ciProofBundleRefs:E.array(b("proof_bundle")).min(1),verifiedAt:K_}).strict().superRefine((_,$)=>{if(!e_(_.expectedBase,_.providerPullRequestBase))$.addIssue({code:E.ZodIssueCode.custom,message:"Expected and provider-observed pull-request bases must be exactly equal",path:["providerPullRequestBase"]});if(!e_(_.localHead,_.remoteHead)||!e_(_.localHead,_.providerPullRequestHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Local, remote, and provider pull-request heads must be exactly equal",path:["providerPullRequestHead"]});let D=_.ciProofBundleRefs.map(ON);if(new Set(D).size!==D.length)$.addIssue({code:E.ZodIssueCode.custom,message:"CI proof bundle refs must have unique canonical identities",path:["ciProofBundleRefs"]});let U=_.ciProofBundleRefs.map((g)=>g.digest);if(new Set(U).size!==U.length)$.addIssue({code:E.ZodIssueCode.custom,message:"CI proof bundle refs must have unique canonical digests",path:["ciProofBundleRefs"]});if(_.ciProofBundleRefs.some((g)=>m3(g,_.equalityProofRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Head-equality and CI proof refs must have distinct canonical identities",path:["ciProofBundleRefs"]});if(_.ciProofBundleRefs.some((g)=>g.digest===_.equalityProofRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Head-equality and CI proof refs must have distinct canonical digests",path:["ciProofBundleRefs"]})}),JC=E.object({ref:b("repair_cycle"),cycle:E.number().int().min(0).max(2),cap:E.literal(2),exhausted:E.boolean(),latestRepairRef:b("repair_cycle").optional()}).strict().superRefine((_,$)=>{if(_.exhausted!==(_.cycle===_.cap))$.addIssue({code:E.ZodIssueCode.custom,message:"Repair exhaustion must equal the cumulative cycle cap",path:["exhausted"]});if(_.cycle===0&&_.latestRepairRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Cycle zero cannot reference a repair",path:["latestRepairRef"]});if(_.cycle>0&&!_.latestRepairRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Non-zero repair state requires the latest immutable repair ref",path:["latestRepairRef"]});if(_.latestRepairRef&&m3(_.ref,_.latestRepairRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Repair-state and latest-repair refs must be distinct canonical records",path:["latestRepairRef"]});if(_.latestRepairRef&&_.ref.digest===_.latestRepairRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Repair-state and latest-repair refs must have distinct canonical digests",path:["latestRepairRef"]})}),PC=E.object({ref:b("merge_guard"),pullRequestRef:b("pull_request"),expectedBase:Q_,expectedHead:Q_,reviewRefs:E.array(b("review")).min(1),proofBundleRefs:E.array(b("proof_bundle")).min(1),operatorRef:b("merge_operator"),operatorRunRef:b("merge_operator_run"),providerGuardReceiptRef:b("merge_guard_receipt"),mechanism:E.enum(["compare_and_swap","queue_expected_head"]),decision:E.enum(["eligible","denied","consumed","revoked"]),evaluatedAt:K_}).strict().superRefine((_,$)=>{if(new Set(_.reviewRefs.map((I)=>I.id)).size!==_.reviewRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard review refs must be unique",path:["reviewRefs"]});if(new Set(_.proofBundleRefs.map(ON)).size!==_.proofBundleRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard proof refs must have unique canonical identities",path:["proofBundleRefs"]});if(new Set(_.proofBundleRefs.map((I)=>I.digest)).size!==_.proofBundleRefs.length)$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard proof refs must have unique canonical digests",path:["proofBundleRefs"]})}),zC=E.object({ref:b("merge_outcome"),guardRef:b("merge_guard"),pullRequestRef:b("pull_request"),expectedBase:Q_,observedBase:Q_,expectedHead:Q_,observedHead:Q_,status:E.enum(["merged","closed_unmerged","refused","head_drift","base_drift"]),mergeCommitRef:b("commit").optional(),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().superRefine((_,$)=>{let D=e_(_.expectedBase,_.observedBase),U=e_(_.expectedHead,_.observedHead);if(_.status==="merged"){if(!D||!U)$.addIssue({code:E.ZodIssueCode.custom,message:"Merged outcomes require observed base and head to equal the guarded values",path:[!D?"observedBase":"observedHead"]});if(!_.mergeCommitRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Merged outcomes require an immutable merge commit ref",path:["mergeCommitRef"]})}else if(_.mergeCommitRef)$.addIssue({code:E.ZodIssueCode.custom,message:"Unmerged outcomes cannot claim a merge commit",path:["mergeCommitRef"]});if(_.status==="head_drift"&&U)$.addIssue({code:E.ZodIssueCode.custom,message:"Head-drift outcomes require distinct expected and observed heads",path:["observedHead"]});if(_.status==="head_drift"&&!D)$.addIssue({code:E.ZodIssueCode.custom,message:"Head-drift outcomes cannot also carry an unclassified base drift",path:["observedBase"]});if(_.status==="base_drift"&&D)$.addIssue({code:E.ZodIssueCode.custom,message:"Base-drift outcomes require distinct expected and observed bases",path:["observedBase"]});if(_.status==="base_drift"&&!U)$.addIssue({code:E.ZodIssueCode.custom,message:"Base-drift outcomes cannot also carry an unclassified head drift",path:["observedHead"]});if(!U&&_.status!=="head_drift")$.addIssue({code:E.ZodIssueCode.custom,message:"Only a head_drift outcome may record an observed head that differs from the expected head",path:["observedHead"]});if(!D&&_.status!=="base_drift")$.addIssue({code:E.ZodIssueCode.custom,message:"Only a base_drift outcome may record an observed base that differs from the expected base",path:["observedBase"]})}),SC=E.object({guard:PC,outcome:zC.optional()}).strict(),WC=E.object({ref:b("recovery"),priorAttemptRef:b("attempt"),priorWriterGenerationRef:b("writer_generation"),priorWorkRunRef:b("work_run"),successorAttemptNonce:n3,successorWriterGenerationRef:b("writer_generation"),preservedStateRefs:E.array(d3).min(1),stopEvidenceRef:X$,leaseRevocationEvidenceRef:X$}).strict().superRefine((_,$)=>{ED(_.priorWriterGenerationRef,_.successorWriterGenerationRef,$,["successorWriterGenerationRef"],"Recovery writer-generation rotation"),u9(_.stopEvidenceRef,_.leaseRevocationEvidenceRef,$,["leaseRevocationEvidenceRef"])}),XC=E.object({ref:b("cancellation"),cancelledAttemptRef:b("attempt"),preservedStateRefs:E.array(d3).min(1),evidenceRefs:E.array(X$).min(1)}).strict(),RC=E.object({ref:b("cleanup_eligibility"),status:E.enum(["not_ready","preserved","blocked","eligible"]),targetWorktreeRef:b("worktree"),eventCursorRef:b("replay_cursor"),terminalDispositionRef:b("terminal_disposition"),writerLeaseRef:b("writer_lease"),leaseRevocationEvidenceRef:X$,consumedEventEvidenceRef:X$,evaluatedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().superRefine((_,$)=>{if(_.leaseRevocationEvidenceRef.id===_.consumedEventEvidenceRef.id||_.leaseRevocationEvidenceRef.digest===_.consumedEventEvidenceRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup lease-revocation and consumed-event facts require distinct evidence identities and digests",path:["consumedEventEvidenceRef"]})}),GC=E.object({ref:b("cleanup_outcome"),eligibilityRef:b("cleanup_eligibility"),targetWorktreeRef:b("worktree"),status:E.enum(["preserved","deleted","failed","skipped"]),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict(),YC=E.object({eligibility:RC,outcome:GC.optional()}).strict().superRefine((_,$)=>{if(_.outcome&&!B_(_.outcome.eligibilityRef,_.eligibility.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup outcomes must bind the exact eligibility decision",path:["outcome","eligibilityRef"]});if(_.outcome&&!B_(_.outcome.targetWorktreeRef,_.eligibility.targetWorktreeRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility and outcome must bind the same target worktree",path:["outcome","targetWorktreeRef"]});if(_.outcome?.status==="deleted"&&_.eligibility.status!=="eligible")$.addIssue({code:E.ZodIssueCode.custom,message:"Deletion requires an eligible cleanup decision",path:["outcome","status"]})}),QC=E.object({plan:E.object({ref:b("rollback_plan"),targetRef:E.union([b("commit"),b("branch")]),createdAt:K_}).strict(),outcome:E.object({ref:b("rollback_outcome"),planRef:b("rollback_plan"),targetRef:E.union([b("commit"),b("branch")]),status:E.enum(["not_run","succeeded","failed","cancelled"]),finishedAt:K_,evidenceRefs:E.array(X$).min(1)}).strict().optional()}).strict().superRefine((_,$)=>{if(_.outcome&&!B_(_.outcome.planRef,_.plan.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Rollback outcomes must bind the exact rollback plan",path:["outcome","planRef"]});if(_.outcome&&!B_(_.outcome.targetRef,_.plan.targetRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Rollback outcomes must bind the exact rollback target",path:["outcome","targetRef"]});if(_.outcome&&Date.parse(_.outcome.finishedAt)({category:"ci_proof",ref:$,base:_.exactHead.expectedBase,head:_.exactHead.localHead}))]:[],..._.reviews.flatMap(($)=>[{category:"review_proof",ref:$.proofBundleRef,base:$.base,head:$.head},{category:"review_record",ref:$.ref,base:$.base,head:$.head},{category:"review_run",ref:$.reviewRunRef,base:$.base,head:$.head}]),..._.merge?[{category:"merge_guard",ref:_.merge.guard.ref},{category:"provider_guard_receipt",ref:_.merge.guard.providerGuardReceiptRef,base:_.merge.guard.expectedBase,head:_.merge.guard.expectedHead}]:[],..._.cleanup?[{category:"cleanup_eligibility",ref:_.cleanup.eligibility.ref}]:[],..._.rollback?[{category:"rollback_plan",ref:_.rollback.plan.ref}]:[],..._.terminalDispositionRef?[{category:"terminal_disposition",ref:_.terminalDispositionRef}]:[]]}function BC(_,$){if(_.category!==$.category)return!1;if(_.category==="projection_id"&&$.category==="projection_id")return _.projectionId===$.projectionId;if(_.category==="attempt_nonce"&&$.category==="attempt_nonce")return _.nonce===$.nonce;if(_.category==="replay_prefix"&&$.category==="replay_prefix")return _.sequence===$.sequence&&_.prefixDigest===$.prefixDigest;if(!("ref"in _)||!("ref"in $))return!1;return B_(_.ref,$.ref)&&(("head"in _)&&("head"in $)&&("base"in _)&&("base"in $)&&e_(_.base,$.base)&&e_(_.head,$.head)||!("head"in _)&&!("head"in $)&&!("base"in _)&&!("base"in $))}var VC="hasna.task_to_pr_adapter_extension.",KC=E.object({mode:E.enum(["local","cloud"]),schema:u3,ref:b("adapter_extension"),digest:p4}).strict().superRefine((_,$)=>{if(!_.schema.startsWith(VC))$.addIssue({code:E.ZodIssueCode.custom,message:"Adapter extension schema ids must use the permanently reserved task-to-PR adapter-extension namespace",path:["schema"]})}),FC=E.enum(["admitted","running","handed_off","reviewing","repairing","merge_ready","merged","closed_unmerged","failed","blocked","cancelled","recovering","cleanup_complete","rolled_back"]),O9=new Set(["admitted","running","handed_off"]),A9=new Set(["merged","closed_unmerged","failed","blocked","cancelled","cleanup_complete","rolled_back"]),MC={admitted:new Set(["absent","denied:none","revoked:none"]),running:new Set(["absent","denied:none","revoked:none"]),handed_off:new Set(["absent","denied:none","revoked:none"]),reviewing:new Set(["absent","denied:none","revoked:none"]),repairing:new Set(["absent","denied:none","revoked:none"]),merge_ready:new Set(["eligible:none"]),merged:new Set(["consumed:merged"]),closed_unmerged:new Set(["consumed:closed_unmerged","consumed:refused","consumed:head_drift","consumed:base_drift"]),failed:new Set(["absent","revoked:none"]),blocked:new Set(["absent","revoked:none"]),cancelled:new Set(["absent","revoked:none"]),recovering:new Set(["absent","denied:none","revoked:none"]),cleanup_complete:new Set(["absent","revoked:none","consumed:merged","consumed:closed_unmerged","consumed:refused","consumed:head_drift","consumed:base_drift"]),rolled_back:new Set(["consumed:merged"])},ZC=E.object({schema:E.literal(x.taskToPrProjection),id:w9,createdAt:K_,canonicalizationVersion:E.union([E.literal(1),E.literal(2)]),identityDigest:p4,frozenScopeDigest:p4,state:FC,workRunRef:b("work_run"),rootRequestRef:b("root_request"),prGroupRef:b("pr_group"),leafTaskRef:b("leaf_task"),attempt:jC,repository:NC,events:EC,openLoopsInvocationRef:b("openloops_invocation").optional(),pullRequestRef:b("pull_request").optional(),exactHead:LC.optional(),handoff:OC.optional(),reviews:E.array(AC).default([]),repair:JC,merge:SC.optional(),recovery:WC.optional(),cancellation:XC.optional(),cleanup:YC.optional(),rollback:QC.optional(),terminalDispositionRef:b("terminal_disposition").optional(),provenanceLedger:E.array(TC),adapterExtensions:E.array(KC).default([]),evidenceRefs:E.array(X$).default([])}).strict().superRefine((_,$)=>{let D=_.canonicalizationVersion===1?E9({canonicalizationVersion:1,rootRequestRef:_.rootRequestRef,prGroupRef:_.prGroupRef,leafTaskRef:_.leafTaskRef,repoRef:_.repository.repoRef,baseHead:_.repository.baseHead,frozenScopeDigest:_.frozenScopeDigest}):E9({canonicalizationVersion:2,rootRequestRef:_.rootRequestRef,prGroupRef:_.prGroupRef,leafTaskRef:_.leafTaskRef,repoRef:_.repository.repoRef,worktreeRef:_.repository.worktreeRef,branchRef:_.repository.branchRef,baseHead:_.repository.baseHead,frozenScopeDigest:_.frozenScopeDigest});if(_.identityDigest!==D)$.addIssue({code:E.ZodIssueCode.custom,message:"identityDigest must equal the selected v1 compatibility or v2 branch/worktree-bound canonical identity digest",path:["identityDigest"]});let U=new Set,g=new Set,I=new Set,j=new Set,N=new Set,O=new Set;for(let[T,q]of _.provenanceLedger.entries()){if("ref"in q){if(U.has(q.ref.id))$.addIssue({code:E.ZodIssueCode.custom,message:"Provenance entries cannot reuse a canonical owner id across categories or generations",path:["provenanceLedger",T,"ref","id"]});if(U.add(q.ref.id),g.has(q.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Provenance entries cannot reuse a canonical digest across categories or generations",path:["provenanceLedger",T,"ref","digest"]});g.add(q.ref.digest);continue}if(q.category==="projection_id"){if(I.has(q.projectionId))$.addIssue({code:E.ZodIssueCode.custom,message:"Projection identity provenance tombstones must be globally unique",path:["provenanceLedger",T,"projectionId"]});I.add(q.projectionId);continue}if(q.category==="attempt_nonce"){if(j.has(q.nonce))$.addIssue({code:E.ZodIssueCode.custom,message:"Attempt nonce provenance tombstones must be globally unique",path:["provenanceLedger",T,"nonce"]});j.add(q.nonce);continue}if(N.has(q.prefixDigest))$.addIssue({code:E.ZodIssueCode.custom,message:"Replay prefix provenance tombstones must be globally unique",path:["provenanceLedger",T,"prefixDigest"]});if(N.add(q.prefixDigest),O.has(q.sequence))$.addIssue({code:E.ZodIssueCode.custom,message:"Replay prefix provenance entries must bind globally unique replay sequences",path:["provenanceLedger",T,"sequence"]});O.add(q.sequence)}for(let T of qC(_))if(!_.provenanceLedger.some((q)=>BC(q,T)))$.addIssue({code:E.ZodIssueCode.custom,message:`The active ${T.category} identity must be represented exactly in the monotonic provenance ledger`,path:["provenanceLedger"]});let A=[_.rootRequestRef,_.prGroupRef,_.leafTaskRef,_.repository.repoRef,_.repository.worktreeRef,_.repository.branchRef,_.events.streamRef,..._.pullRequestRef?[_.pullRequestRef]:[]],L=(T,q,K,Z)=>{let e=new Set(q.map((I_)=>I_.role)),g_=new Set;for(let[I_,J_]of T.entries()){if(!e.has(J_.role))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} cannot preserve an unrecognized ${J_.role} role`,path:[...K,I_]});if(g_.has(J_.role))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} must preserve exactly one canonical ref per role`,path:[...K,I_]});g_.add(J_.role)}if(T.length!==q.length)$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} preservation refs must exactly equal the required canonical role set`,path:K});for(let I_ of q)if(!T.some((J_)=>B_(J_,I_)))$.addIssue({code:E.ZodIssueCode.custom,message:`${Z} must preserve ${I_.role}`,path:K})};if(_.handoff&&!B_(_.handoff.nextWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Handoff next generation must be the current attempt writer generation",path:["handoff","nextWriterGenerationRef"]});if(_.handoff&&!B_(_.handoff.nextAttemptRef,_.attempt.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Handoff next attempt must be the current attempt",path:["handoff","nextAttemptRef"]});if(_.handoff)ED(_.handoff.stoppedWorkRunRef,_.workRunRef,$,["handoff","stoppedWorkRunRef"],"Handoff WorkRun rotation");if(_.recovery){if(_.recovery.successorAttemptNonce!==_.attempt.nonce)$.addIssue({code:E.ZodIssueCode.custom,message:"Recovery successor nonce must equal the current attempt nonce",path:["recovery","successorAttemptNonce"]});if(!B_(_.recovery.successorWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Recovery successor generation must equal the current writer generation",path:["recovery","successorWriterGenerationRef"]});ED(_.recovery.priorAttemptRef,_.attempt.ref,$,["recovery","priorAttemptRef"],"Recovery attempt rotation"),ED(_.recovery.priorWorkRunRef,_.workRunRef,$,["recovery","priorWorkRunRef"],"Recovery WorkRun rotation"),L(_.recovery.preservedStateRefs,[_.recovery.priorWorkRunRef,...A],["recovery","preservedStateRefs"],"Recovery")}if(_.cancellation&&!B_(_.cancellation.cancelledAttemptRef,_.attempt.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Cancellation must bind the current attempt",path:["cancellation","cancelledAttemptRef"]});if(_.cancellation)L(_.cancellation.preservedStateRefs,[_.workRunRef,_.attempt.ref,...A],["cancellation","preservedStateRefs"],"Cancellation");if(_.cancellation&&_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"A projection cannot be both the cancellation and recovery snapshot",path:["recovery"]});if(_.handoff&&_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"A projection cannot be both the handoff and recovery snapshot",path:["recovery"]});if(_.cleanup&&!B_(_.cleanup.eligibility.eventCursorRef,_.events.replayCursorRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the current canonical replay cursor",path:["cleanup","eligibility","eventCursorRef"]});if(_.cleanup&&(!_.terminalDispositionRef||!B_(_.cleanup.eligibility.terminalDispositionRef,_.terminalDispositionRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the exact durable terminal owner fact",path:["cleanup","eligibility","terminalDispositionRef"]});if(_.cleanup&&!B_(_.cleanup.eligibility.writerLeaseRef,_.attempt.writerLeaseRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the exact writer lease being revoked",path:["cleanup","eligibility","writerLeaseRef"]});if(_.cleanup&&!B_(_.cleanup.eligibility.targetWorktreeRef,_.repository.worktreeRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup eligibility must bind the canonical worktree",path:["cleanup","eligibility","targetWorktreeRef"]});if(_.pullRequestRef){if(_.exactHead&&!B_(_.exactHead.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head proof must bind the canonical pull request ref",path:["exactHead","pullRequestRef"]});for(let[T,q]of _.reviews.entries())if(!B_(q.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Every review must bind the canonical pull request ref",path:["reviews",T,"pullRequestRef"]});if(_.merge&&!B_(_.merge.guard.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge guard must bind the canonical pull request ref",path:["merge","guard","pullRequestRef"]});if(_.merge?.outcome&&!B_(_.merge.outcome.pullRequestRef,_.pullRequestRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome must bind the canonical pull request ref",path:["merge","outcome","pullRequestRef"]})}else if(_.exactHead||_.reviews.length>0||_.merge)$.addIssue({code:E.ZodIssueCode.custom,message:"Review and merge state require a canonical pull request ref",path:["pullRequestRef"]});if(_.exactHead&&!e_(_.exactHead.localHead,_.repository.branchHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact local head must equal the canonical branch head",path:["exactHead","localHead"]});if(_.exactHead&&!e_(_.exactHead.expectedBase,_.repository.baseHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head expected base must equal the canonical repository base",path:["exactHead","expectedBase"]});if(_.exactHead&&!B_(_.exactHead.remoteBranchRef,_.repository.branchRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head remote branch ref must equal the canonical repository branch ref",path:["exactHead","remoteBranchRef"]});if(_.exactHead&&Date.parse(_.exactHead.verifiedAt)0&&!_.exactHead)$.addIssue({code:E.ZodIssueCode.custom,message:"Reviews require local/remote/provider exact-head proof",path:["exactHead"]});if(_.exactHead){let T=[{ref:_.exactHead.equalityProofRef,path:["exactHead","equalityProofRef"]},..._.exactHead.ciProofBundleRefs.map((Z,e)=>({ref:Z,path:["exactHead","ciProofBundleRefs",e]})),..._.reviews.map((Z,e)=>({ref:Z.proofBundleRef,path:["reviews",e,"proofBundleRef"]}))],q=new Set,K=new Set;for(let Z of T){let e=ON(Z.ref);if(q.has(e))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head equality, CI, and review proof obligations require globally unique canonical identities",path:Z.path});if(q.add(e),K.has(Z.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Exact-head equality, CI, and review proof obligations require globally unique canonical digests",path:Z.path});K.add(Z.ref.digest)}}let z=new Set,W=new Set,J=new Set,P=new Set,S=new Set,X=new Set,G=new Set,R=new Set;for(let[T,q]of _.reviews.entries()){if(!e_(q.base,_.repository.baseHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Review base must equal the exact canonical pull-request base",path:["reviews",T,"base"]});if(!e_(q.head,_.repository.branchHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Review head must equal the exact canonical branch head",path:["reviews",T,"head"]});for(let[Z,e,g_]of[[q.ref.id,z,"ref"],[q.reviewerRef.id,J,"reviewerRef"],[q.reviewRunRef.id,S,"reviewRunRef"]]){if(e.has(Z))$.addIssue({code:E.ZodIssueCode.custom,message:"Review, reviewer, and review-run refs must each be unique",path:["reviews",T,g_]});e.add(Z)}if(W.has(q.ref.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review refs must resolve to distinct canonical record digests",path:["reviews",T,"ref"]});if(W.add(q.ref.digest),P.has(q.reviewerRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Reviewer refs must resolve to distinct canonical actor digests",path:["reviews",T,"reviewerRef"]});if(P.add(q.reviewerRef.digest),X.has(q.reviewRunRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review-run refs must resolve to distinct canonical run digests",path:["reviews",T,"reviewRunRef"]});X.add(q.reviewRunRef.digest);let K=ON(q.proofBundleRef);if(G.has(K))$.addIssue({code:E.ZodIssueCode.custom,message:"Review proof bundles must have unique canonical identities",path:["reviews",T,"proofBundleRef"]});if(G.add(K),R.has(q.proofBundleRef.digest))$.addIssue({code:E.ZodIssueCode.custom,message:"Review proof bundles must have unique canonical digests",path:["reviews",T,"proofBundleRef"]});if(R.add(q.proofBundleRef.digest),q.reviewerRef.digest===_.attempt.workerRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Worker and reviewer identities must resolve to distinct canonical digests",path:["reviews",T,"reviewerRef"]});if(q.reviewRunRef.digest===_.attempt.runtimeRef.digest)$.addIssue({code:E.ZodIssueCode.custom,message:"Worker runtime and review run must resolve to distinct canonical digests",path:["reviews",T,"reviewRunRef"]});if(_.exactHead&&Date.parse(q.reviewedAt)Date.parse(_.merge.guard.evaluatedAt)T.verdict!=="approved"))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards require at least one review and all reviews approved",path:["merge","guard","decision"]});if(_.merge.guard.reviewRefs.length!==_.reviews.length||_.merge.guard.reviewRefs.some((T)=>!_.reviews.some((q)=>B_(T,q.ref))))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guard review refs must exactly equal the projected approved review refs as a canonical set",path:["merge","guard","reviewRefs"]});for(let T of _.reviews)if(!_.merge.guard.proofBundleRefs.some((q)=>B_(q,T.proofBundleRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind every exact review proof bundle",path:["merge","guard","proofBundleRefs"]});if(_.exactHead&&!_.merge.guard.proofBundleRefs.some((T)=>B_(T,_.exactHead.equalityProofRef)))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind the exact-head equality proof",path:["merge","guard","proofBundleRefs"]});if(_.exactHead&&_.exactHead.ciProofBundleRefs.some((T)=>!_.merge.guard.proofBundleRefs.some((q)=>B_(q,T))))$.addIssue({code:E.ZodIssueCode.custom,message:"Eligible merge guards must bind every exact-head CI proof",path:["merge","guard","proofBundleRefs"]})}}if(_.merge?.outcome){if(!B_(_.merge.outcome.guardRef,_.merge.guard.ref))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome must bind the exact immutable merge guard",path:["merge","outcome","guardRef"]});if(!e_(_.merge.outcome.expectedHead,_.merge.guard.expectedHead))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome expected head must equal the guarded expected head",path:["merge","outcome","expectedHead"]});if(!e_(_.merge.outcome.expectedBase,_.merge.guard.expectedBase))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge outcome expected base must equal the guarded expected base",path:["merge","outcome","expectedBase"]});if(_.merge.guard.decision!=="consumed")$.addIssue({code:E.ZodIssueCode.custom,message:"Every merge outcome requires an explicitly consumed merge guard",path:["merge","guard","decision"]});if(Date.parse(_.merge.outcome.finishedAt)0)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot carry review bindings before review authority is active`,path:["reviews"]});if((O9.has(_.state)||_.state==="recovering")&&(_.merge?.guard.reviewRefs.length??0)>0)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot hide review bindings in a merge guard before review authority is active`,path:["merge","guard","reviewRefs"]});let V=_.merge?`${_.merge.guard.decision}:${_.merge.outcome?.status??"none"}`:"absent";if(!MC[_.state].has(V))$.addIssue({code:E.ZodIssueCode.custom,message:`State ${_.state} is incompatible with merge authority ${V}`,path:["merge"]});if(A9.has(_.state)&&!_.terminalDispositionRef)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections require a durable Todos terminal-disposition owner ref`,path:["terminalDispositionRef"]});if(!A9.has(_.state)&&_.terminalDispositionRef)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.state} projections cannot carry a terminal-disposition owner ref`,path:["terminalDispositionRef"]});if(_.state==="reviewing"&&_.reviews.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Reviewing projections require review refs",path:["reviews"]});if(_.state==="cancelled"&&!_.cancellation)$.addIssue({code:E.ZodIssueCode.custom,message:"Cancelled projections require preservation state",path:["cancellation"]});if(_.cancellation&&_.merge?.outcome)$.addIssue({code:E.ZodIssueCode.custom,message:"Cancellation cannot coexist with a terminal merge outcome",path:["cancellation"]});if(_.state==="recovering"&&!_.recovery)$.addIssue({code:E.ZodIssueCode.custom,message:"Recovering projections require recovery state",path:["recovery"]});if(_.state==="repairing"&&_.repair.cycle===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Repairing projections require a non-zero repair cycle",path:["repair","cycle"]});if(_.merge&&(_.merge.guard.decision==="eligible"||_.merge.guard.decision==="consumed")&&!B_(_.attempt.admissionWriterGenerationRef,_.attempt.writerGenerationRef))$.addIssue({code:E.ZodIssueCode.custom,message:"Merge eligibility requires admission from the current writer generation",path:["attempt","admissionWriterGenerationRef"]});if(_.state==="merge_ready"&&_.merge?.guard.decision!=="eligible")$.addIssue({code:E.ZodIssueCode.custom,message:"Merge-ready projections require an eligible guard",path:["merge"]});if(_.state==="merged"&&_.merge?.outcome?.status!=="merged")$.addIssue({code:E.ZodIssueCode.custom,message:"Merged projections require a merged immutable outcome",path:["merge"]});if(_.state==="closed_unmerged"&&!_.merge?.outcome?.status.match(/^(closed_unmerged|refused|head_drift|base_drift)$/))$.addIssue({code:E.ZodIssueCode.custom,message:"Closed-unmerged projections require a non-merged terminal outcome",path:["merge"]});if(_.state==="cleanup_complete"&&(!_.cleanup?.outcome||!["deleted","preserved","skipped"].includes(_.cleanup.outcome.status)))$.addIssue({code:E.ZodIssueCode.custom,message:"Cleanup-complete projections require an immutable cleanup outcome",path:["cleanup"]});if(_.state==="rolled_back"&&_.rollback?.outcome?.status!=="succeeded")$.addIssue({code:E.ZodIssueCode.custom,message:"Rolled-back projections require a successful rollback outcome",path:["rollback"]});if((_.state==="failed"||_.state==="blocked")&&_.evidenceRefs.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Failed and blocked projections require redacted evidence refs",path:["evidenceRefs"]});if(["admitted","running","handed_off","reviewing","repairing","merge_ready","recovering"].includes(_.state)&&(_.merge?.outcome||_.cancellation||_.cleanup?.outcome||_.rollback?.outcome))$.addIssue({code:E.ZodIssueCode.custom,message:"Non-terminal projections cannot carry terminal owner outcomes",path:["state"]});let Q=new Set;for(let[T,q]of _.adapterExtensions.entries()){let K=`${q.mode}:${q.schema}`;if(Q.has(K))$.addIssue({code:E.ZodIssueCode.custom,message:"Adapter extensions must be unique per local/cloud mode and schema",path:["adapterExtensions",T]});Q.add(K)}});var bC=E.object({id:E.string().min(1),at:K_,kind:E.enum(["message","tool_call","command","file_change","error","test","decision","verification","status","other"]),summary:E.string().min(1),resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([]),costEstimate:TU.optional()}).strict(),HC=L_(x.agentTrajectory).extend({actor:m$,workRunRef:s.optional(),events:E.array(bC).default([]),outcome:E.enum(["succeeded","failed","cancelled","blocked","unknown"]).default("unknown"),proofBundleRef:s.optional()}).strict(),kC="v1",CC=E.enum(["library","cli-with-store","service","saas"]),rC=["user-hosted","hasna-saas"],vC=E.enum(rC),fC=["api","sdk","mcp","cli"],x9=E.enum(fC),wC=E.enum(["supported","deferred","unsupported"]),uC=E.enum(["none","local-only","api-key","session","service-token","custom"]),k3=E.object({method:E.enum(["GET","POST","PUT","PATCH","DELETE"]),path:E.string().regex(/^\/[A-Za-z0-9_./:*-]*$/,"Endpoint paths must be absolute HTTP paths"),public:E.boolean().default(!1),description:E.string().min(1).optional()}).strict(),xC=E.object({id:E.string().min(1),kind:E.enum(["auth","storage","secret-ref","migration","health","readiness","redaction","smoke","operator","other"]),required:E.boolean().default(!0),command:E.string().min(1).optional(),evidenceRef:T_.optional(),status:E.enum(["pending","passed","failed","blocked","deferred"]).default("pending"),summary:E.string().min(1).optional()}).strict().superRefine((_,$)=>{if((_.status==="passed"||_.status==="failed"||_.status==="blocked")&&!_.command&&!_.evidenceRef&&!_.summary)$.addIssue({code:E.ZodIssueCode.custom,message:"Terminal readiness gates require command, evidenceRef, or summary",path:["status"]})}),yC=E.object({name:E.string().min(1),kind:x9.optional(),status:wC,bin:E.string().min(1).optional(),mcpBin:E.string().min(1).optional(),authMode:uC,health:k3.optional(),readiness:k3.optional(),version:k3.optional(),apiBasePath:E.string().regex(/^\/v[0-9]+$/,"Stable API base path must be /vN").optional(),openApiPath:E.string().regex(/^\/[A-Za-z0-9_./:-]*$/).optional(),exportSubpath:E.string().regex(/^\.(?:\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*)?$/,"SDK export subpaths must be package export keys such as . or ./sdk").optional(),generatedFrom:E.string().regex(/^\/[A-Za-z0-9_./:-]*$/,"SDK generatedFrom must reference an absolute OpenAPI path").optional(),clientClassName:E.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]*$/).optional(),deferReason:E.string().min(1).optional(),readinessGates:E.array(xC).default([])}).strict().superRefine((_,$)=>{if(_.status==="supported"){if(!_.kind||_.kind==="api"){if(!_.bin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a serve bin",path:["bin"]});if(!_.health)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a health endpoint",path:["health"]});if(!_.readiness)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a readiness endpoint",path:["readiness"]});if(!_.version)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported API surfaces require a version endpoint",path:["version"]})}if(_.kind==="cli"&&!_.bin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported CLI surfaces require a bin",path:["bin"]});if(_.kind==="mcp"&&!_.mcpBin)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported MCP surfaces require an mcpBin",path:["mcpBin"]});if(_.kind==="sdk"&&!_.exportSubpath)$.addIssue({code:E.ZodIssueCode.custom,message:"Supported SDK surfaces require an exportSubpath",path:["exportSubpath"]})}if((_.status==="deferred"||_.status==="unsupported")&&!_.deferReason)$.addIssue({code:E.ZodIssueCode.custom,message:"Deferred or unsupported service surfaces require a deferReason",path:["deferReason"]});if(_.health&&_.health.path!=="/health")$.addIssue({code:E.ZodIssueCode.custom,message:"Health endpoint must be /health",path:["health","path"]});if(_.health&&_.health.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Health endpoint must use GET",path:["health","method"]});if(_.readiness&&_.readiness.path!=="/ready")$.addIssue({code:E.ZodIssueCode.custom,message:"Readiness endpoint must be /ready",path:["readiness","path"]});if(_.readiness&&_.readiness.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Readiness endpoint must use GET",path:["readiness","method"]});if(_.version&&_.version.path!=="/version")$.addIssue({code:E.ZodIssueCode.custom,message:"Version endpoint must be /version",path:["version","path"]});if(_.version&&_.version.method!=="GET")$.addIssue({code:E.ZodIssueCode.custom,message:"Version endpoint must use GET",path:["version","method"]})}),hC=["sqlite","postgres"],y9=E.enum(hC),h9=["sqlite","postgres"],cC=E.enum(h9),w3=["postgres"],nC=E.object({kind:x9,reason:E.string().trim().min(1)}).strict(),i3=500,l3=200,AN=(_)=>E.string().trim().min(1).max(_).regex(/^[^\u0000-\u001f\u007f]+$/,"Waiver text must not contain control characters"),dC=["domain","host","ip","email"],mC=E.object({kind:E.enum(dC),reason:AN(i3),reviewedBy:AN(l3),expiresAt:K_}).strict(),iC=E.object({engine:E.enum(w3),reason:AN(i3),reviewedBy:AN(l3).optional(),expiresAt:K_.optional()}).strict();function lC(_){if(_.class!=="cli-with-store")return`storage waivers are not permitted for class ${_.class}`;if(_.bins.includes(`${_.name}-serve`))return`storage waivers are not permitted for a service-capable cli-with-store repo shipping ${_.name}-serve`;if(_.storageMode==="postgres")return"storage waivers are not permitted while storage.mode is postgres, which reads and writes PostgreSQL directly";if(_.hosting.includes("hasna-saas"))return"storage waivers are not permitted for a repo declaring the hasna-saas product story";return null}var tC=E.object({conformance:E.object({waivedSurfaces:E.array(nC).default([]),waiverProfile:E.literal("non-node-monorepo").optional(),waivedStorageEngines:E.array(iC).default([]),waivedAssetInventories:E.array(mC).default([])}).catchall(E.unknown()).optional(),release:E.object({artifactScan:E.object({script:E.string().trim().min(1)}).strict().optional()}).catchall(E.unknown()).optional()}).catchall(E.unknown()),oC=E.string().regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/,"App names must be lowercase dashed identifiers"),pC=["","-cli","-mcp","-serve","-worker","-runner","-daemon","-migrate","-doctor"];function eC(_){return pC.map(($)=>`${_}${$}`)}function L9(_){return`hasna/oss/${_}/database-url`}var aC=E.object({mode:y9,engines:E.array(cC).min(1).optional(),envPrefix:E.string().regex(/^HASNA_[A-Z][A-Z0-9]*_$/).optional(),aliasEnvPrefix:E.string().regex(/^[A-Z][A-Z0-9]*_$/).optional(),databaseUrlSecretRef:E.string().regex(/^hasna\/oss\/[a-z0-9-]+\/database-url$/).optional(),sqlitePath:E.string().min(1).endsWith(".db","storage.sqlitePath must end in .db").optional(),pgTestGate:E.object({envVar:E.string().regex(/^[A-Z][A-Z0-9_]*_TEST_DATABASE_URL$/),command:E.string().trim().min(1)}).strict().optional()}).strict().superRefine((_,$)=>{if(_.engines&&new Set(_.engines).size!==_.engines.length)$.addIssue({code:E.ZodIssueCode.custom,message:"storage.engines must not contain duplicates",path:["engines"]});if(_.engines?.includes("postgres")&&!_.envPrefix)$.addIssue({code:E.ZodIssueCode.custom,message:"storage.engines containing postgres requires envPrefix for the HASNA__DATABASE_URL contract",path:["envPrefix"]})}),c9=E.enum(["0600"]),n9=E.enum(["0700"]),d9=E.enum([".hasna",".codewith"]),sC=E.enum(["directory","file","sqlite_db","sqlite_wal","sqlite_shm","backup","export","report","tmp","log","session","snapshot"]),ID=W$.refine((_)=>!_.startsWith("~"),"Local store path patterns must be relative to their declared root"),_r=E.object({id:E.string().min(1),source:E.enum(["sqlite","manifest","index","runtime","package_adapter"]),table:E.string().min(1).optional(),column:E.string().min(1).optional(),description:E.string().min(1),required:E.boolean().default(!0)}).strict(),$r=E.object({safeWhen:E.enum(["exclusive_access","offline_only","never"]),operations:E.array(E.enum(["wal_checkpoint_truncate","incremental_vacuum","optimize","vacuum"])).default([])}).strict().superRefine((_,$)=>{if(_.safeWhen==="never"&&_.operations.length>0)$.addIssue({code:E.ZodIssueCode.custom,message:"sqliteMaintenance.safeWhen=never cannot declare operations",path:["operations"]})}),Dr=E.object({id:E.string().min(1),description:E.string().min(1),ttlDays:E.number().int().nonnegative().optional(),artifactClasses:E.array(sC).min(1),allowlistGlobs:E.array(ID).min(1),activeRecordExclusions:E.array(_r).default([]),sqliteMaintenance:$r.optional()}).strict(),gr=E.object({storeId:E.string().regex(/^[a-z][a-z0-9-]*$/),packageName:E.string().min(1),displayName:E.string().min(1),root:d9,relativePath:ID,directoryMode:n9.default("0700"),fileMode:c9.default("0600"),sqliteDatabaseGlobs:E.array(ID).default([]),sensitiveFileGlobs:E.array(ID).default([]),backupGlobs:E.array(ID).default([]),exportGlobs:E.array(ID).default([]),retentionAdapters:E.array(Dr).default([]),notes:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{if(_.relativePath.includes("*"))$.addIssue({code:E.ZodIssueCode.custom,message:"store relativePath must be a concrete directory; use glob fields for files",path:["relativePath"]});let D=new Set;for(let[U,g]of _.retentionAdapters.entries()){if(D.has(g.id))$.addIssue({code:E.ZodIssueCode.custom,message:"retention adapter ids must be unique within a store",path:["retentionAdapters",U,"id"]});D.add(g.id)}}),m9=L_(x.secureLocalStorePolicy).extend({version:E.string().min(1),scope:E.array(d9).min(1),defaults:E.object({directoryMode:n9.default("0700"),fileMode:c9.default("0600"),dryRunDefault:E.literal(!0),requireExplicitApply:E.literal(!0),includeSqliteSidecars:E.literal(!0),redactedEvidenceOnly:E.literal(!0)}).strict(),stores:E.array(gr).min(1),lifecycle:E.object({retentionDryRunDefault:E.literal(!0),requireActiveRecordExclusionProof:E.literal(!0),requireArtifactAllowlist:E.literal(!0),sqliteMaintenanceRequiresExclusiveAccess:E.literal(!0)}).strict(),warnings:E.array(E.string().min(1)).default([])}).strict().superRefine((_,$)=>{let D=new Set;for(let[U,g]of _.stores.entries()){if(D.has(g.storeId))$.addIssue({code:E.ZodIssueCode.custom,message:"store ids must be unique",path:["stores",U,"storeId"]});if(D.add(g.storeId),!_.scope.includes(g.root))$.addIssue({code:E.ZodIssueCode.custom,message:"store root must be listed in policy scope",path:["stores",U,"root"]})}}),Ur=E.object({$schema:E.string().min(1).optional(),schema:E.literal(x.serviceContract),name:oC,class:CC,contractVersion:E.literal(kC),kitVersion:E.string().min(1),description:E.string().min(1).optional(),bins:E.array(E.string().min(1)).default([]),storage:aC.optional(),hosting:E.array(vC).min(1).default(["user-hosted"]),serviceSurfaces:E.array(yC).default([]),metadata:tC.optional()}).strict().superRefine((_,$)=>{if(new Set(_.hosting).size!==_.hosting.length)$.addIssue({code:E.ZodIssueCode.custom,message:"hosting must not contain duplicates",path:["hosting"]});let D=new Set(eC(_.name)),U=new Set;for(let[A,L]of _.bins.entries()){if(U.has(L))$.addIssue({code:E.ZodIssueCode.custom,message:"Duplicate bin declaration",path:["bins",A]});if(U.add(L),!D.has(L))$.addIssue({code:E.ZodIssueCode.custom,message:`Bin "${L}" is not allowlisted for app "${_.name}"; allowed: ${[...D].join(", ")}`,path:["bins",A]})}let g=(A)=>U.has(`${_.name}${A}`);if(_.storage){let A=_.name.toUpperCase().replace(/-/g,"_");if(_.storage.envPrefix&&_.storage.envPrefix!==`HASNA_${A}_`)$.addIssue({code:E.ZodIssueCode.custom,message:`storage.envPrefix must be HASNA_${A}_`,path:["storage","envPrefix"]});if(_.storage.databaseUrlSecretRef&&_.storage.databaseUrlSecretRef!==L9(_.name))$.addIssue({code:E.ZodIssueCode.custom,message:`storage.databaseUrlSecretRef must be ${L9(_.name)}`,path:["storage","databaseUrlSecretRef"]})}if(_.class==="library"){if(_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"library repos must not declare storage",path:["storage"]});if(g("-serve")||g("-mcp"))$.addIssue({code:E.ZodIssueCode.custom,message:"library repos must not ship a -serve or -mcp bin",path:["bins"]})}if(_.class==="cli-with-store"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"cli-with-store repos must declare storage",path:["storage"]});else{if(_.storage.mode==="sqlite"&&!_.storage.sqlitePath)$.addIssue({code:E.ZodIssueCode.custom,message:"sqlite cli-with-store storage requires sqlitePath (~/.hasna//.db)",path:["storage","sqlitePath"]});if(_.storage.engines){let A=new Set(_.storage.engines),L=_.metadata?.conformance?.waivedStorageEngines??[],z=lC({class:_.class,name:_.name,bins:_.bins,hosting:_.hosting,storageMode:_.storage.mode}),W=new Set(z?[]:L.map((P)=>P.engine)),J=h9.filter((P)=>!A.has(P)&&!W.has(P));if(J.length>0){let P=z&&L.length>0?`; declared waiver ignored: ${z}`:"";$.addIssue({code:E.ZodIssueCode.custom,message:`cli-with-store storage.engines must declare both sqlite and postgres unless the engine carries a metadata.conformance.waivedStorageEngines waiver; missing: ${J.join(", ")}${P}`,path:["storage","engines"]})}}}if(!U.has(_.name))$.addIssue({code:E.ZodIssueCode.custom,message:`cli-with-store repos must ship the "${_.name}" bin`,path:["bins"]})}if(_.class==="service"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"service repos must declare storage",path:["storage"]});else if(_.storage.engines&&(!_.storage.engines.includes("sqlite")||!_.storage.engines.includes("postgres")))$.addIssue({code:E.ZodIssueCode.custom,message:"service storage.engines must declare both sqlite and postgres",path:["storage","engines"]});if(!g("-serve"))$.addIssue({code:E.ZodIssueCode.custom,message:`service repos must ship the "${_.name}-serve" bin`,path:["bins"]});if(_.serviceSurfaces.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"service repos must declare at least one service surface",path:["serviceSurfaces"]})}if(_.class==="saas"){if(!_.storage)$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must declare storage",path:["storage"]});else{if(_.storage.mode!=="postgres")$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must use the postgres storage backend",path:["storage","mode"]});if(!_.storage.envPrefix)$.addIssue({code:E.ZodIssueCode.custom,message:"saas storage requires envPrefix for the public DATABASE_URL contract",path:["storage","envPrefix"]})}if(!g("-serve"))$.addIssue({code:E.ZodIssueCode.custom,message:`saas repos must ship the "${_.name}-serve" bin`,path:["bins"]});if(_.serviceSurfaces.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"saas repos must declare at least one service surface",path:["serviceSurfaces"]})}for(let[A,L]of _.serviceSurfaces.entries()){if(L.bin&&!U.has(L.bin))$.addIssue({code:E.ZodIssueCode.custom,message:`Service surface bin "${L.bin}" must be declared in bins`,path:["serviceSurfaces",A,"bin"]});if(L.mcpBin&&!U.has(L.mcpBin))$.addIssue({code:E.ZodIssueCode.custom,message:`Service surface MCP bin "${L.mcpBin}" must be declared in bins`,path:["serviceSurfaces",A,"mcpBin"]})}let I=_.metadata?.conformance?.waivedSurfaces??[],j=new Set;for(let[A,L]of I.entries()){if(j.has(L.kind))$.addIssue({code:E.ZodIssueCode.custom,message:`Duplicate conformance waiver for ${L.kind}`,path:["metadata","conformance","waivedSurfaces",A,"kind"]});j.add(L.kind)}let N=_.metadata?.conformance?.waivedStorageEngines??[],O=new Set;for(let[A,L]of N.entries()){if(O.has(L.engine))$.addIssue({code:E.ZodIssueCode.custom,message:`Duplicate storage-engine waiver for ${L.engine}`,path:["metadata","conformance","waivedStorageEngines",A,"engine"]});O.add(L.engine)}}),Sd=E.object({status:E.enum(["ok","degraded","unavailable"]),version:E.string().min(1),mode:y9}).strict(),Wd=E.object({ready:E.boolean(),reason:E.string().min(1).optional()}).strict(),Xd=E.object({version:E.string().min(1)}).strict(),Ir=E.enum(["info","notice","breaking","critical"]),jr=E.string().regex(/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){1,3}$/,"Comms event types must be 2-4 lowercase dot-separated segments (..)"),Nr=["FREEZE","UNFREEZE","BREAKING","CUTOVER","POLICY","RELEASE"],Er=E.enum(Nr);var Or=E.enum(["fleet","package","machine"]),i9=L_(x.commsEventEnvelope).extend({type:jr,severity:Ir,scope:Or,summary:E.string().min(1).optional(),source:m$.optional(),affected_packages:E.array(t).default([]),affected_machines:E.array(t).default([]),action_required:E.boolean().default(!1),ack_by:K_.optional(),dedupe_key:t,resourceRefs:E.array(s).default([]),evidenceRefs:E.array(T_).default([])}).strict().superRefine((_,$)=>{if(_.scope==="package"&&_.affected_packages.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Package-scoped comms events require affected_packages",path:["affected_packages"]});if(_.scope==="machine"&&_.affected_machines.length===0)$.addIssue({code:E.ZodIssueCode.custom,message:"Machine-scoped comms events require affected_machines",path:["affected_machines"]});if(_.ack_by&&!_.action_required)$.addIssue({code:E.ZodIssueCode.custom,message:"Comms events with an ack_by deadline require action_required",path:["action_required"]});if(_.type==="fleet.freeze"||_.type==="fleet.unfreeze"){if(_.severity!=="critical")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events are always critical`,path:["severity"]});if(_.scope!=="fleet")$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events are always fleet-scoped`,path:["scope"]});if(!_.action_required)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.type} events require action_required`,path:["action_required"]})}}),Ar=E.enum(["fleet","package","product","loop-lane","initiative","personal"]),Lr=E.enum(["quiet","work","firehose"]),Jr=t.refine((_)=>/^(?:\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)?|gate:[0-9a-f][0-9a-f-]{7,35})$/.test(_),"until must be an ISO date (YYYY-MM-DD), a UTC timestamp, or a gate id (gate:)"),Pr=L_(x.commsChannelMetadata).extend({class:Ar,noise:Lr.optional(),owner:t.optional(),until:Jr.optional(),successor:t.optional()}).strict().superRefine((_,$)=>{if(_.class==="initiative"){if(!_.owner)$.addIssue({code:E.ZodIssueCode.custom,message:"Initiative channels require an owner",path:["owner"]});if(!_.until)$.addIssue({code:E.ZodIssueCode.custom,message:"Initiative channels require an until horizon (date or gate id)",path:["until"]})}}),J9={FREEZE:{defaultSeverity:"critical",allowedSeverities:["critical"],requiredEventType:"fleet.freeze"},UNFREEZE:{defaultSeverity:"critical",allowedSeverities:["critical"],requiredEventType:"fleet.unfreeze"},BREAKING:{defaultSeverity:"breaking",allowedSeverities:["breaking"],requiredEventType:null},CUTOVER:{defaultSeverity:"notice",allowedSeverities:["notice","breaking"],requiredEventType:null},POLICY:{defaultSeverity:"breaking",allowedSeverities:["notice","breaking"],requiredEventType:null},RELEASE:{defaultSeverity:"info",allowedSeverities:["info","notice"],requiredEventType:null}},zr=L_(x.commsMessageMetadata).extend({tag:Er,envelope:i9}).strict().superRefine((_,$)=>{let D=J9[_.tag];if(!D.allowedSeverities.includes(_.envelope.severity))$.addIssue({code:E.ZodIssueCode.custom,message:`[${_.tag}] posts allow severities ${D.allowedSeverities.join(", ")}`,path:["envelope","severity"]});if(D.requiredEventType&&_.envelope.type!==D.requiredEventType)$.addIssue({code:E.ZodIssueCode.custom,message:`[${_.tag}] posts require event type ${D.requiredEventType}`,path:["envelope","type"]});for(let[U,g]of Object.entries(J9))if(g.requiredEventType===_.envelope.type&&_.tag!==U)$.addIssue({code:E.ZodIssueCode.custom,message:`${_.envelope.type} events must use the [${U}] tag`,path:["tag"]})});var Sr={[x.actorRef]:yH,[x.resourceRef]:hH,[x.evidenceRef]:nH,[x.workRun]:sk,[x.taskToPrProjection]:ZC,[x.decisionEnvelope]:F9,[x.costEstimate]:TU,[x.capabilityCard]:mH,[x.providerLiveModeStandard]:eH,[x.contextPack]:M9,[x.integrationRef]:Z9,[x.projectManifest]:Dk,[x.projectPanel]:b9,[x.projectSnapshot]:Jk,[x.renderManifest]:jk,[x.agentTrajectory]:HC,[x.validationPlan]:Pk,[x.proofBundle]:ak,[x.scaffoldManifest]:Yk,[x.scaffoldInstallRecord]:Tk,[x.appCloudManifest]:C9,[x.noCloudEvidencePack]:pk,[x.secureLocalStorePolicy]:m9,[x.serviceContract]:Ur,[x.commsEventEnvelope]:i9,[x.commsChannelMetadata]:Pr,[x.commsMessageMetadata]:zr,[x.app]:bk,[x.release]:kk,[x.rolloutRecord]:vk,[x.announcement]:xk,[x.audience]:mk};class l9 extends Error{schemaId;issues;constructor(_,$){super(`Contract validation failed for ${_}`);this.name="ContractValidationError",this.schemaId=_,this.issues=$}}function t9(_,$){let U=Sr[_].safeParse($);if(!U.success)throw new l9(_,U.error.issues);return U.data}var Rd=String.raw`(?:^|[^\w$])(?:_*(?:import|require)|createRequire|Module\s*\.\s*_load)`;var t3=[{pattern:"@hasna/cloud",kind:"module",message:"Shared @hasna/cloud runtime reference is forbidden"},{pattern:"open-cloud",kind:"module",message:"Shared open-cloud runtime reference is forbidden"},{pattern:"cloud-mcp",kind:"module",message:"Legacy cloud-mcp runtime surface is forbidden"},{pattern:"registerCloudTools",kind:"symbol",message:"Legacy registerCloudTools runtime surface is forbidden"},{pattern:"registerCloudCommands",kind:"symbol",message:"Legacy registerCloudCommands runtime surface is forbidden"},{pattern:".hasna/cloud",kind:"config",checkKind:"runtime_config",message:"Legacy .hasna/cloud runtime config is forbidden"},{pattern:"HASNA_CLOUD_",kind:"config",message:"Shared HASNA_CLOUD_* runtime config is forbidden"},{pattern:"HASNA_RDS_PASSWORD",kind:"config",message:"Legacy shared RDS credential config is forbidden"}],Gd=t3.filter((_)=>("checkKind"in _)),Wr=t3.filter((_)=>_.kind==="module"),Yd=[...new Set([...jN,...Wr.map((_)=>_.pattern)])],Qd=t3.filter((_)=>_.kind==="config");var P9="^[^\\u0000-\\u001f\\u007f]*$",Td={$schema:"http://json-schema.org/draft-07/schema#",$id:"https://github.com/hasna/contracts/schema/hasna.service_contract.v1.json",title:"Hasna Service Contract v1",description:"Repo self-description (hasna.contract.json) for the Hasna Service Contract v1. Hosting story, product surfaces, and storage capabilities are separate declarations; the storage backend (sqlite | postgres) is the only runtime switch.",type:"object",additionalProperties:!1,required:["schema","name","class","contractVersion","kitVersion"],allOf:[{if:{required:["class"],properties:{class:{const:"saas"}}},then:{required:["storage"],properties:{storage:{required:["mode","envPrefix"],properties:{mode:{const:"postgres"}}}}}}],properties:{$schema:{type:"string",description:"Optional editor hint pointing at this JSON Schema."},schema:{const:x.serviceContract},name:{type:"string",pattern:"^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",description:"Lowercase dashed app short-name, e.g. todos, mailery, loops."},class:{enum:["library","cli-with-store","service","saas"]},contractVersion:{const:"v1"},kitVersion:{type:"string",minLength:1,description:"Version of @hasna/contracts (the contract kit) the repo tracks."},description:{type:"string",minLength:1},bins:{type:"array",items:{type:"string",minLength:1},description:"Declared bins. Allowlisted: , -cli, -mcp, -serve, -worker, -runner, -daemon, -migrate, -doctor."},hosting:{type:"array",items:{enum:["user-hosted","hasna-saas"]},minItems:1,uniqueItems:!0,description:"Customer-facing product stories. Public OSS cores include user-hosted; add hasna-saas only when a managed control plane exists."},serviceSurfaces:{type:"array",items:{type:"object",additionalProperties:!1,required:["name","status","authMode"],allOf:[{if:{required:["status"],properties:{status:{const:"supported"},kind:{const:"api"}}},then:{required:["bin","health","readiness","version"]}}],properties:{name:{type:"string",minLength:1},kind:{enum:["api","sdk","mcp","cli"]},status:{enum:["supported","deferred","unsupported"]},bin:{type:"string",minLength:1},mcpBin:{type:"string",minLength:1},authMode:{enum:["none","local-only","api-key","session","service-token","custom"]},health:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},readiness:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},version:{type:"object",additionalProperties:!1,required:["method","path"],properties:{method:{const:"GET"},path:{type:"string",pattern:"^/[A-Za-z0-9_./:*-]*$"},public:{type:"boolean"},description:{type:"string",minLength:1}}},apiBasePath:{type:"string",pattern:"^/v[0-9]+$"},openApiPath:{type:"string",pattern:"^/[A-Za-z0-9_./:-]*$"},exportSubpath:{type:"string",pattern:"^\\.(?:\\/[A-Za-z0-9_.-]+(?:\\/[A-Za-z0-9_.-]+)*)?$",description:"SDK package export key such as . or ./sdk."},generatedFrom:{type:"string",pattern:"^/[A-Za-z0-9_./:-]*$",description:"OpenAPI path used to generate the SDK."},clientClassName:{type:"string",pattern:"^[A-Za-z_$][A-Za-z0-9_$]*$"},deferReason:{type:"string",minLength:1},readinessGates:{type:"array",items:{type:"object",additionalProperties:!1,required:["id","kind"],properties:{id:{type:"string",minLength:1},kind:{enum:["auth","storage","secret-ref","migration","health","readiness","redaction","smoke","operator","other"]},required:{type:"boolean"},command:{type:"string",minLength:1},evidenceRef:{type:"object"},status:{enum:["pending","passed","failed","blocked","deferred"]},summary:{type:"string",minLength:1}}}}}},description:"Declared API, SDK, MCP, and CLI product surfaces. Legacy entries without kind remain parseable; new manifests declare kind explicitly."},storage:{type:"object",additionalProperties:!1,required:["mode"],properties:{mode:{enum:["sqlite","postgres"],description:"Active data backend. sqlite|postgres ONLY \u2014 the single runtime switch."},engines:{type:"array",items:{enum:["sqlite","postgres"]},minItems:1,uniqueItems:!0,description:"Supported storage engines; capability metadata independent of the active backend."},envPrefix:{type:"string",pattern:"^HASNA_[A-Z][A-Z0-9]*_$",description:"Primary env prefix, e.g. HASNA_TODOS_."},aliasEnvPrefix:{type:"string",pattern:"^[A-Z][A-Z0-9]*_$",description:"Optional short alias env prefix, e.g. TODOS_."},databaseUrlSecretRef:{type:"string",pattern:"^hasna/oss/[a-z0-9-]+/database-url$",description:"Legacy/private-tier database secret ref. Public conformance rejects this field."},sqlitePath:{type:"string",pattern:"\\.db$",description:"Local sqlite path (~/.hasna//.db)."},pgTestGate:{type:"object",additionalProperties:!1,required:["envVar","command"],properties:{envVar:{type:"string",pattern:"^[A-Z][A-Z0-9_]*_TEST_DATABASE_URL$"},command:{type:"string",minLength:1}},description:"Environment-gated live PostgreSQL test command."}}},metadata:{type:"object",additionalProperties:!0,properties:{conformance:{type:"object",additionalProperties:!0,properties:{waiverProfile:{const:"non-node-monorepo",description:"Explicit surface-waiver eligibility for exceptional non-Node monorepos. Libraries are eligible for API/MCP waivers without this profile."},waivedSurfaces:{type:"array",uniqueItems:!0,items:{type:"object",additionalProperties:!1,required:["kind","reason"],properties:{kind:{enum:["api","sdk","mcp","cli"]},reason:{type:"string",minLength:1}}}},waivedStorageEngines:{type:"array",uniqueItems:!0,maxItems:w3.length,items:{type:"object",additionalProperties:!1,required:["engine","reason"],properties:{engine:{enum:[...w3]},reason:{type:"string",minLength:1,maxLength:i3,allOf:[{pattern:"\\S"},{pattern:P9}]},reviewedBy:{type:"string",minLength:1,maxLength:l3,allOf:[{pattern:"\\S"},{pattern:P9}]},expiresAt:{type:"string",format:"date-time"}}},description:"Explicit storage-engine exceptions, at most one per engine. Only a CLI-only cli-with-store repo (no -serve bin, storage.mode sqlite, no hasna-saas story) may waive postgres; sqlite is never waivable, expiresAt is a UTC RFC 3339 timestamp, and conformance stops honouring a waiver once it has passed."}}}}}}};var Xr="2026-07-06";function c$(_,$,D,U,g,I=[],j){return{id:_,description:$,ttlDays:D,artifactClasses:U,allowlistGlobs:g,activeRecordExclusions:I.map((N)=>({...N,required:N.required??!0})),sqliteMaintenance:j}}var qd=m9.parse({schema:x.secureLocalStorePolicy,id:"hasna-secure-local-store-defaults",createdAt:"2026-07-06T00:00:00.000Z",version:Xr,scope:[".hasna",".codewith"],defaults:{directoryMode:"0700",fileMode:"0600",dryRunDefault:!0,requireExplicitApply:!0,includeSqliteSidecars:!0,redactedEvidenceOnly:!0},lifecycle:{retentionDryRunDefault:!0,requireActiveRecordExclusionProof:!0,requireArtifactAllowlist:!0,sqliteMaintenanceRequiresExclusiveAccess:!0},stores:[{storeId:"codewith",packageName:"codewith",displayName:"Codewith native state",root:".codewith",relativePath:".",sqliteDatabaseGlobs:["logs_*.sqlite","state_*.sqlite","goals_*.sqlite"],sensitiveFileGlobs:["sessions/**/*.jsonl","shell_snapshots/**/*","logs*.sqlite","state*.sqlite","goals*.sqlite"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("codewith-session-snapshots","Codewith sessions, shell snapshots, logs, monitor output, mailbox payloads, and scheduler state need package-owned redaction before retention applies.",30,["session","snapshot","log"],["sessions/**/*.jsonl","shell_snapshots/**/*","logs/**/*"],[{id:"codewith-active-session",source:"package_adapter",description:"Exclude currently active sessions, leased schedules, monitors, pending interactions, and active goal rows."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})],notes:["Includes native .codewith DBs and transcript-like artifacts; redaction-before-persistence remains package-owned."]},{storeId:"todos",packageName:"@hasna/todos",displayName:"Todos",root:".hasna",relativePath:"todos",sqliteDatabaseGlobs:["todos.db"],sensitiveFileGlobs:["todos.db","todos.db-wal","todos.db-shm","exports/**/*","backups/**/*"],backupGlobs:["backups/**/*","*.bak","*.backup"],exportGlobs:["exports/**/*","*.jsonl","*.csv"],retentionAdapters:[c$("todos-exports-backups","Todos backups and exports are deleted only after package redaction and active task/evidence references are excluded.",14,["backup","export"],["backups/**/*","exports/**/*"],[{id:"todos-active-evidence",source:"sqlite",table:"task_files",column:"path",description:"Exclude files still referenced by active tasks, verification evidence, task comments, or handoff records."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"conversations",packageName:"@hasna/conversations",displayName:"Conversations",root:".hasna",relativePath:"conversations",sqliteDatabaseGlobs:["messages.db"],sensitiveFileGlobs:["messages.db","messages.db-wal","messages.db-shm","exports/**/*","attachments/**/*"],backupGlobs:["backups/**/*","*.bak"],exportGlobs:["exports/**/*","*.json","*.csv"],retentionAdapters:[c$("conversations-exports-attachments","Conversation exports and attachments require message-id redaction and active attachment reference checks before deletion.",14,["export","backup"],["exports/**/*","backups/**/*","attachments/**/*"],[{id:"conversations-active-attachments",source:"sqlite",table:"messages",column:"attachments",description:"Exclude attachments still referenced by retained messages or audited redaction records."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"mementos",packageName:"@hasna/mementos",displayName:"Mementos",root:".hasna",relativePath:"mementos",sqliteDatabaseGlobs:["mementos.db"],sensitiveFileGlobs:["mementos.db","mementos.db-wal","mementos.db-shm","exports/**/*","backups/**/*"],backupGlobs:["backups/**/*","*.bak"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("mementos-audit-search-history","Mementos retention must preserve active memory versions while compacting audit/search surfaces through package-owned adapters.",30,["backup","export","log"],["backups/**/*","exports/**/*","audit/**/*"],[{id:"mementos-active-memory-versions",source:"sqlite",table:"memory_versions",column:"memory_id",description:"Exclude current memory versions and audit entries required for provenance."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"knowledge",packageName:"@hasna/knowledge",displayName:"Knowledge",root:".hasna",relativePath:"knowledge",sqliteDatabaseGlobs:["knowledge.db"],sensitiveFileGlobs:["knowledge.db","knowledge.db-wal","knowledge.db-shm","db.json","migration-exports/**/*","*.bak"],backupGlobs:["*.bak","backups/**/*","*.pre-cloud-*"],exportGlobs:["migration-exports/**/*","exports/**/*","*.jsonl"],retentionAdapters:[c$("knowledge-migrations-exports","Knowledge migration exports and pre-cloud backups require replacement, encryption, or redaction before retention deletion.",14,["backup","export"],["migration-exports/**/*","exports/**/*","*.bak","*.pre-cloud-*"],[{id:"knowledge-current-catalog",source:"manifest",description:"Exclude files referenced by the active catalog or migration ledger."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"projects",packageName:"@hasna/projects",displayName:"Projects",root:".hasna",relativePath:"projects",sqliteDatabaseGlobs:["projects.db","data/*/project.db"],sensitiveFileGlobs:["projects.db","projects.db-wal","projects.db-shm","data/*/project.db","data/*/project.db-wal","data/*/project.db-shm","reports/**/*"],backupGlobs:["backups/**/*","data/*/backups/**/*"],exportGlobs:["reports/**/*","exports/**/*"],retentionAdapters:[c$("projects-reports-workspaces","Project reports, dashboards, workspaces, and per-project DBs need active workspace/location references before cleanup.",30,["backup","export","report","tmp"],["backups/**/*","reports/**/*","workspaces/**/*","data/*/backups/**/*"],[{id:"projects-active-workspaces",source:"sqlite",table:"workspaces",column:"primary_path",description:"Exclude active workspace paths, locations, linked reports, and project store artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"browser",packageName:"@hasna/browser",displayName:"Browser",root:".hasna",relativePath:"browser",sqliteDatabaseGlobs:["browser.db"],sensitiveFileGlobs:["browser.db","browser.db-wal","browser.db-shm","profiles/**/cookies.json","states/**/*.json","auth/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*","traces/**/*","har/**/*"],retentionAdapters:[c$("browser-auth-traces","Browser state, trace, HAR, and auth artifacts require session invalidation or redaction before deletion.",7,["backup","export","session","snapshot"],["profiles/**/*","states/**/*","traces/**/*","har/**/*","exports/**/*"],[{id:"browser-active-profiles",source:"sqlite",table:"sessions",column:"profile_path",description:"Exclude profiles, cookies, and storage state used by active browser sessions."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"terminal",packageName:"@hasna/terminal",displayName:"Terminal",root:".hasna",relativePath:"terminal",sqliteDatabaseGlobs:["sessions.db"],sensitiveFileGlobs:["sessions.db","sessions.db-wal","sessions.db-shm","exports/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("terminal-sessions","Terminal sessions and interactions need active session exclusion plus command-output redaction before retention.",30,["backup","export","session","log"],["backups/**/*","exports/**/*","sessions/**/*"],[{id:"terminal-active-sessions",source:"sqlite",table:"sessions",column:"id",description:"Exclude active terminal session records and any linked interaction artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"logs",packageName:"@hasna/logs",displayName:"Logs",root:".hasna",relativePath:"logs",sqliteDatabaseGlobs:["logs.db"],sensitiveFileGlobs:["logs.db","logs.db-wal","logs.db-shm","exports/**/*"],backupGlobs:["backups/**/*"],exportGlobs:["exports/**/*"],retentionAdapters:[c$("logs-retention","Logs require redaction before compaction and must preserve active incident/evidence references.",14,["backup","export","log"],["backups/**/*","exports/**/*","*.log","logs/**/*"],[{id:"logs-active-evidence",source:"sqlite",table:"logs",column:"id",description:"Exclude log rows or files linked to active incidents, tasks, or proof bundles."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]},{storeId:"loops",packageName:"@hasna/loops",displayName:"OpenLoops",root:".hasna",relativePath:"loops",sqliteDatabaseGlobs:["loops.db","state.db","*.sqlite"],sensitiveFileGlobs:["*.db","*.sqlite","*.db-wal","*.db-shm","reports/**/*","tmp/**/*","runs/**/*"],backupGlobs:["backups/**/*","tmp/**/*"],exportGlobs:["reports/**/*","runs/**/*","exports/**/*"],retentionAdapters:[c$("loops-reports-tmp","Loop reports, tmp files, workflow artifacts, and command output need run-state checks and redaction before retention deletion.",14,["backup","export","report","tmp","log"],["reports/**/*","tmp/**/*","runs/**/*","exports/**/*"],[{id:"loops-active-runs",source:"sqlite",table:"loop_runs",column:"id",description:"Exclude active, leased, recently failed, or evidence-linked loop and workflow run artifacts."}],{safeWhen:"exclusive_access",operations:["wal_checkpoint_truncate","optimize"]})]}],warnings:["This package publishes declarations only; each owning package implements and verifies its own local-store lifecycle.","Retention and redaction evidence remain package-owned and must preserve active-record exclusions.","SQLite maintenance is descriptive policy metadata only and is never executed by @hasna/contracts."]});var Rr=64,Bd=new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${Rr-1}}$`),gD="[0-9a-fA-F]",Vd=new RegExp(`^\\{?(?:${gD}{8}-${gD}{4}-${gD}{4}-${gD}{4}-${gD}{12}|${gD}{32})\\}?$`);var Gr=/^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;var Kd=new RegExp(Gr.source.replace(/^\^/,"\\b").replace(/\$$/,"\\b"));var o9="@hasna/knowledge";function Yr(_){if(!Number.isFinite(_??0))return 20;return Math.max(1,Math.min(100,Math.trunc(_??20)))}function Qr(_){return _.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").replace(/-{2,}/g,"-")||"project"}function qU(_,$=180){let D=String(_??"").replace(/\s+/g," ").trim();if(D.length<=$)return D;return`${D.slice(0,Math.max(0,$-3))}...`}function C_(_,$=""){return typeof _==="string"&&_.length>0?_:$}function BU(_){return typeof _==="number"&&Number.isFinite(_)?_:0}function BD(_){if(typeof _!=="string"||_.length===0)return;let $=_.includes("T")?_:`${_.replace(" ","T")}Z`,D=new Date($);return Number.isNaN(D.valueOf())?void 0:D.toISOString()}function zN(_){return H$.safeParse(_).success}function k$(_,$,D,U,g=[]){return{kind:_,id:$,name:D,uri:U&&zN(U)?U:void 0,externalId:$,sourcePackage:o9,tags:g}}function Tr(_){return[..._.items.flatMap((D)=>[D.updated_at,D.created_at]),..._.sources.flatMap((D)=>[D.updated_at,D.created_at]),..._.chunks.map((D)=>D.created_at),..._.wiki_pages.flatMap((D)=>[D.updated_at,D.created_at]),..._.storage_objects.flatMap((D)=>[D.updated_at,D.created_at]),..._.runs.flatMap((D)=>[D.updated_at,D.created_at]),..._.reindex_queue.flatMap((D)=>[D.updated_at,D.created_at]),..._.sync_conflicts.map((D)=>D.created_at),..._.approval_gates.flatMap((D)=>[D.updated_at,D.created_at])].map(BD).filter(Boolean).sort((D,U)=>U.localeCompare(D))[0]}function qr(_){if(!_)return"unknown";let $=Date.now()-new Date(_).valueOf();if(!Number.isFinite($))return"unknown";return $>2592000000?"stale":"fresh"}function Br(_){let $=(D)=>{let U=String(D??"").toLowerCase();return U!==""&&!["done","complete","completed","resolved","succeeded","skipped"].includes(U)};return _.reindex_queue.filter((D)=>$(D.status)).length+_.sync_conflicts.filter((D)=>$(D.status)).length+_.approval_gates.filter((D)=>$(D.status)).length}function Vr(_,$){let D=[];for(let U of _.items.slice(0,$))D.push({id:`item_${U.id}`,title:U.title,summary:qU(U.content_preview),status:U.archived?"archived":"active",priority:"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("knowledge",U.id,U.title,`knowledge://item/${encodeURIComponent(U.id)}`,U.tags)],evidenceRefs:U.url&&zN(U.url)?[{id:`url_${U.id}`,kind:"url",uri:U.url,summary:"Source URL for this knowledge item."}]:[],metadata:{source:"legacy_store",archived:U.archived,tags:U.tags,url:U.url||void 0}});for(let U of _.sources.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,C_(U.uri,"source")),I=C_(U.title,C_(U.uri,g)),j=C_(U.uri,`knowledge://source/${encodeURIComponent(g)}`);D.push({id:`source_${g}`,title:I,summary:qU(`${BU(U.chunks)} chunk(s), ${BU(U.revisions)} revision(s)`),status:BU(U.chunks)>0?"indexed":"source",priority:"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("document",g,I,j)],evidenceRefs:zN(j)?[{id:`source_${g}`,kind:"url",uri:j,summary:"Source reference."}]:[],metadata:{source:"knowledge_db.sources",kind:U.kind,chunks:BU(U.chunks),revisions:BU(U.revisions)}})}for(let U of _.chunks.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"chunk"),I=C_(U.source_uri);D.push({id:`chunk_${g}`,title:C_(U.wiki_title,I?`Chunk from ${I}`:`Knowledge chunk ${g}`),summary:qU(U.text_preview),status:"chunk",priority:"low",timestamp:BD(U.created_at),resourceRefs:[k$("context_pack",g,C_(U.wiki_title,g),`knowledge://chunk/${encodeURIComponent(g)}`)],evidenceRefs:I&&zN(I)?[{id:`chunk_source_${g}`,kind:"url",uri:I,summary:"Chunk source reference."}]:[],metadata:{source:"knowledge_db.chunks",source_uri:I||void 0,token_count:U.token_count,ordinal:U.ordinal}})}for(let U of _.sync_conflicts.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"sync_conflict");D.push({id:`sync_conflict_${g}`,title:`Sync conflict: ${C_(U.entity_kind,"entity")}/${C_(U.entity_id,g)}`,summary:qU(`Status ${C_(U.status,"unknown")}; strategy ${C_(U.resolution_strategy,"none")}.`),status:C_(U.status,"unknown"),priority:"critical",timestamp:BD(U.created_at),resourceRefs:[k$("finding",g,"Knowledge sync conflict",`knowledge://sync-conflict/${encodeURIComponent(g)}`)],metadata:{source:"knowledge_db.sync_conflicts",local_machine_id:U.local_machine_id,remote_machine_id:U.remote_machine_id}})}for(let U of _.reindex_queue.slice(0,Math.max(0,$-D.length))){let g=C_(U.id,"reindex");D.push({id:`reindex_${g}`,title:`Reindex ${C_(U.kind,"item")}: ${C_(U.target_id,g)}`,summary:qU(U.reason),status:C_(U.status,"unknown"),priority:C_(U.status).toLowerCase()==="failed"?"high":"medium",timestamp:BD(U.updated_at??U.created_at),resourceRefs:[k$("action",g,"Knowledge reindex work item",`knowledge://reindex/${encodeURIComponent(g)}`)],metadata:{source:"knowledge_db.reindex_queue",attempts:U.attempts,source_uri:U.source_uri}})}return D.slice(0,$)}async function p9(_,$={}){let D=Yr($.limit),U=new Date().toISOString(),g=Qr(_),j=await($.service??IN({scope:$.scope??"project",cwd:$.cwd})).resolveInventory({limit:D,storePath:$.storePath,includeArchived:$.includeArchived}),N=Tr(j),O=qr(N),A=j.summary.active_items+j.summary.sources+j.summary.chunks+j.summary.wiki_pages+j.summary.storage_objects,L=Br(j),z=A===0?"empty":O==="stale"?"stale":"ready",W=Vr(j,D),J={schema:x.projectPanel,id:`knowledge_panel_${g}`,createdAt:U,projectId:g,provider:{kind:"knowledge",id:`knowledge_${g}`,name:"Knowledge",sourcePackage:o9,externalId:j.home},kind:"knowledge",title:"Knowledge",summary:z==="empty"?"No project knowledge items, sources, chunks, or wiki pages are available yet.":`${j.summary.active_items} active note(s), ${j.summary.sources} source(s), ${j.summary.chunks} chunk(s), and ${j.summary.wiki_pages} wiki page(s).`,state:z,stateReason:z==="stale"?"Latest indexed knowledge activity is older than 30 days.":void 0,generatedAt:U,freshness:O,metrics:[{id:"active_items",label:"Active notes",value:j.summary.active_items,status:j.summary.active_items>0?"good":"unknown"},{id:"sources",label:"Sources",value:j.summary.sources,status:j.summary.sources>0?"good":"unknown"},{id:"chunks",label:"Chunks",value:j.summary.chunks,status:j.summary.chunks>0?"good":"unknown"},{id:"wiki_pages",label:"Wiki pages",value:j.summary.wiki_pages,status:j.summary.wiki_pages>0?"good":"unknown"},{id:"artifacts",label:"Artifacts",value:j.summary.storage_objects,status:j.summary.storage_objects>0?"good":"unknown"},{id:"vector_entries",label:"Vector entries",value:j.summary.vector_entries,status:j.summary.vector_entries>0?"good":"unknown"},{id:"unresolved",label:"Unresolved",value:L,status:L>0?"warning":"good"}],items:W,actions:[k$("action","knowledge:inventory","Inspect knowledge inventory"),k$("action","knowledge:context-pack","Build cited context pack"),k$("action","knowledge:ingest","Ingest project source")],resourceRefs:[k$("project",g,_,`project://${g}`),k$("knowledge",`home_${g}`,"Knowledge workspace",`knowledge://workspace/${encodeURIComponent(g)}`),k$("artifact",`db_${g}`,"Knowledge database",`knowledge://db/${encodeURIComponent(g)}`)],renderFragment:{renderer:"json_render",title:"Knowledge",spec:{component:"project.knowledge.summary",metrics:["active_items","sources","chunks","wiki_pages","unresolved"],itemLimit:D}},metadata:{scope:j.scope,home:j.home,json_store_exists:j.paths.json_store_exists,latest_activity_at:N}};return t9(x.projectPanel,J)}function e9(_){let $=[`${_.title}: ${_.state}`,_.summary??"",..._.metrics.map((D)=>`${D.label}: ${D.value}`)].filter(Boolean);if(_.items.length>0){$.push("Items:");for(let D of _.items.slice(0,10))if($.push(`- ${D.title}${D.status?` [${D.status}]`:""}`),D.summary)$.push(` ${D.summary}`)}return $.join(` +`)}var _8=["sources","wiki_pages","source_revisions","chunks","chunk_embeddings","wiki_backlinks","citations","knowledge_indexes","runs","run_events","provider_usage","redaction_findings","storage_objects","audit_events","approval_gates","vector_index_entries","reindex_queue","knowledge_machines","knowledge_sync_snapshots","knowledge_sync_changes","knowledge_sync_conflicts","knowledge_sync_table_clocks","knowledge_sync_imports"];var $8="HASNA_KNOWLEDGE_STORAGE_MODE",D8="KNOWLEDGE_STORAGE_MODE";function a9(_){return process.env[_]?.trim()||void 0}function s9(_){let $=_?.trim().toLowerCase().replace(/-/g,"_");if($==="sqlite")return"sqlite";if($==="postgres"||$==="postgresql")return"postgres";return}function Kr(_={}){let $=g0(HU(_.scope,_.cwd).home);return h($.knowledgeDbPath),{db:v($.knowledgeDbPath),path:$.knowledgeDbPath,scope:_.scope??"global"}}function g8(){let _=s9(a9($8))??s9(a9(D8));if(_)return _;return"sqlite"}function o3(_={}){let $=Kr(_);try{Fr($.db);let D=$.db.query("SELECT table_name, last_synced_at, direction FROM _knowledge_sync_meta ORDER BY table_name, direction").all();return{mode:g8(),service:"knowledge",scope:$.scope,databasePath:$.path,tables:_8,sync:D}}finally{$.db.close()}}function Fr(_){_.exec(` CREATE TABLE IF NOT EXISTS _knowledge_sync_meta ( table_name TEXT NOT NULL, last_synced_at TEXT, @@ -1356,7 +1356,7 @@ Pages should be concise, cited, and organized for both humans and agents. ) `)}var Y8=UY(G8(),1),{program:Jm,createCommand:Pm,createArgument:zm,createOption:Sm,CommanderError:Wm,InvalidArgumentError:Xm,InvalidOptionArgumentError:Rm,Command:Q8,Argument:Gm,Option:Ym,Help:Qm}=Y8.default;import{chmod as Uz,mkdir as Kv,readFile as Fv,rename as Mv,writeFile as V8}from"fs/promises";import{Buffer as C8}from"buffer";import{existsSync as r8}from"fs";import{homedir as Zv}from"os";import{join as MU}from"path";import{createHmac as vv,timingSafeEqual as Zm}from"crypto";import{randomUUID as uv}from"crypto";import{spawn as xv}from"child_process";import{randomUUID as mv}from"crypto";function Rv(_,$){return $.split(".").reduce((D,U)=>{if(D&&typeof D==="object"&&U in D)return D[U];return},_)}function Gv(_,$){let D=[],U=(I)=>{if(!D.some((j)=>Object.is(j,I)))D.push(I)};if($.includes(".")&&$ in _)U(_[$]);let g=Rv(_,$);if(g!==void 0||!$.includes("."))U(g);return D}function Yv(_,$={}){let D="";for(let U=0;U<_.length;U+=1){let g=_[U];if(g==="*")if(_[U+1]==="*")D+=".*",U+=1;else D+=$.segmentSafe?"[^/]*":".*";else D+=g.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`^${D}$`)}function KU(_,$,D={}){if($===void 0)return!0;if(_===void 0)return!1;return(Array.isArray($)?$:[$]).some((g)=>Yv(g,D).test(_))}function T8(_,$){if(!$)return!0;return Object.entries($).every(([D,U])=>{let g=Gv(_,D);return Qv(g,U,D)})}function Qv(_,$,D){if(Bv($))return!_.some((U)=>q8(U,$.not,D));return _.some((U)=>q8(U,$,D))}function q8(_,$,D){if(typeof $==="string"||Array.isArray($))return Tv(_).some((U)=>KU(U,$,{segmentSafe:D.endsWith("_path")||D.endsWith(".path")}));if(Array.isArray(_))return _.some((U)=>U===$);return _===$}function Tv(_){if(_===void 0)return[];if(Array.isArray(_))return _.flatMap(($)=>qv($)?[String($)]:[]);return[String(_)]}function qv(_){return _===null||typeof _==="string"||typeof _==="number"||typeof _==="boolean"}function Bv(_){return Boolean(_&&typeof _==="object"&&!Array.isArray(_)&&"not"in _)}function Vv(_,$){return KU(_.source,$.source)&&KU(_.type,$.type)&&KU(_.subject,$.subject)&&KU(_.severity,$.severity)&&T8(_.data,$.data)&&T8(_.metadata,$.metadata)}function B8(_,$){if(!_.enabled)return!1;if(!_.filters||_.filters.length===0)return!0;return _.filters.some((D)=>Vv($,D))}var RN="HASNA_EVENTS_DIR",GN="HASNA_EVENTS_HOME",Ez="local-json-v1:",bv=100,Hv=1000;function v8(_){return _||process.env[RN]||process.env[GN]||MU(Zv(),".hasna","events")}function kv(){if(process.env[RN])return RN;if(process.env[GN])return GN;return null}class YN{dataDir;runtime;channelsPath;eventsPath;deliveriesPath;constructor(_=v8()){this.dataDir=_,this.runtime=Cv(_),this.channelsPath=MU(_,"channels.json"),this.eventsPath=MU(_,"events.json"),this.deliveriesPath=MU(_,"deliveries.json")}async init(){await Kv(this.dataDir,{recursive:!0,mode:448}),await Uz(this.dataDir,448).catch(()=>{return}),await this.ensureArrayFile(this.channelsPath),await this.ensureArrayFile(this.eventsPath),await this.ensureArrayFile(this.deliveriesPath)}async addChannel(_){await this.init();let $=await this.readJson(this.channelsPath,[]),D=$.findIndex((U)=>U.id===_.id);if(D>=0)$[D]={..._,createdAt:$[D].createdAt,updatedAt:new Date().toISOString()};else $.push(_);return await this.writeJson(this.channelsPath,$),D>=0?$[D]:_}async listChannels(){return await this.init(),this.readJson(this.channelsPath,[])}async getChannel(_){return(await this.listChannels()).find((D)=>D.id===_)}async removeChannel(_){await this.init();let $=await this.readJson(this.channelsPath,[]),D=$.filter((U)=>U.id!==_);return await this.writeJson(this.channelsPath,D),D.length!==$.length}async appendEvent(_){await this.init();let $=await this.readJson(this.eventsPath,[]);return $.push(_),await this.writeJson(this.eventsPath,$),_}async appendEventOnce(_,$={}){await this.init();let D=await this.readJson(this.eventsPath,[]);if($.dedupe!==!1){let g=F8(D,{id:_.id,dedupeKey:_.dedupeKey});if(g)return{event:g,stored:!1,deduped:!0,identity:{id:g.id,dedupeKey:g.dedupeKey}}}return D.push(_),await this.writeJson(this.eventsPath,D),{event:_,stored:!0,deduped:!1,identity:{id:_.id,dedupeKey:_.dedupeKey}}}async listEvents(_={}){await this.init();let $=await this.readJson(this.eventsPath,[]);return K8($,_)}async listEventsPage(_={}){await this.init();let $=await this.readJson(this.eventsPath,[]),D=K8($,{eventId:_.eventId,source:_.source,type:_.type}),U=QN(_.cursor,_),g=TN(_.limit),I=D.slice(U,U+g),j=U+I.length,N=j{return})}async readJson(_,$){try{let D=await Fv(_,"utf-8");if(!D.trim())return $;return JSON.parse(D)}catch(D){if(D.code==="ENOENT")return $;throw D}}async writeJson(_,$){let D=`${_}.${process.pid}.${Date.now()}.tmp`;await V8(D,`${JSON.stringify($,null,2)} -`,{encoding:"utf-8",mode:384}),await Mv(D,_),await Uz(_,384).catch(()=>{return})}}function Cv(_=v8()){return{mode:"local-files",name:"json-events-store",remote:!1,localFiles:!0,localSqlite:!1,postgres:!1,s3:!1,aws:!1,durable:!0,idempotency:"best-effort-local",replayCursors:!0,description:`Local JSON files in ${_}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`}}function f8(_,$={}){if(!Number.isInteger(_)||_<0)throw Error(`Invalid event cursor offset: ${_}`);let D={offset:_,eventId:$.eventId,source:$.source,type:$.type};return`${Ez}${C8.from(JSON.stringify(D),"utf-8").toString("base64url")}`}function QN(_,$={}){if(!_)return 0;if(!_.startsWith(Ez))throw Error(`Invalid local JSON event cursor: ${_}`);let D=_.slice(Ez.length),U;try{U=JSON.parse(C8.from(D,"base64url").toString("utf-8"))}catch{throw Error(`Invalid local JSON event cursor: ${_}`)}let g=U.offset;if(!Number.isInteger(g)||g<0)throw Error(`Invalid local JSON event cursor: ${_}`);return Iz("eventId",U.eventId,$.eventId),Iz("source",U.source,$.source),Iz("type",U.type,$.type),g}function TN(_){if(_===void 0)return bv;if(!Number.isInteger(_)||_<1)throw Error(`Event page limit must be a positive integer, got ${_}`);return Math.min(_,Hv)}function K8(_,$){let D=_;if($.eventId)D=D.filter((U)=>U.id===$.eventId);if($.source)D=D.filter((U)=>U.source===$.source);if($.type)D=D.filter((U)=>U.type===$.type);if($.cursor){let U=QN($.cursor,$);D=D.slice(U)}if($.limit!==void 0)D=D.slice(0,TN($.limit));return D}function Iz(_,$,D){if($!==D)throw Error(`Local JSON event cursor ${_} filter mismatch`)}function F8(_,$){return _.find((D)=>$.id!==void 0&&D.id===$.id||$.dedupeKey!==void 0&&D.dedupeKey===$.dedupeKey)}async function rv(_){let $=new YN(_);await $.init();let[D,U,g]=await Promise.all([$.listChannels(),$.listEvents(),$.listDeliveries()]),I=D.reduce((j,N)=>{return j[N.transport]=(j[N.transport]??0)+1,j},{});return{service:"events",schemaVersion:"1.0",dataDir:$.dataDir,storage:$.runtime,env:{primary:RN,fallback:GN,active:kv()},files:{channels:jz($.dataDir,"channels.json",D.length),events:jz($.dataDir,"events.json",U.length),deliveries:jz($.dataDir,"deliveries.json",g.length)},counts:{channels:D.length,enabledChannels:D.filter((j)=>j.enabled).length,disabledChannels:D.filter((j)=>!j.enabled).length,events:U.length,deliveries:g.length},transports:I,safety:{includesEventPayloads:!1,includesWebhookSecrets:!1,listOutputsRedactSecrets:!0,statusOutputIsMetadataOnly:!0}}}function jz(_,$,D){let U=MU(_,$);return{path:U,exists:r8(U),records:D}}function fv(_,$){return`${_}.${$}`}function wv(_,$,D){return`sha256=${vv("sha256",_).update(fv($,D)).digest("hex")}`}function i$(){return new Date().toISOString()}function FU(_,$=4096){return _.length>$?`${_.slice(0,$)}...`:_}function yv(_,$){if(!$.webhook)throw Error(`Channel ${$.id} has no webhook config`);let D=JSON.stringify(_),U=_.time,g={"Content-Type":"application/json","User-Agent":"@hasna/events","X-Hasna-Event-Id":_.id,"X-Hasna-Event-Type":_.type,"X-Hasna-Timestamp":U,...$.webhook.headers};if($.webhook.secret)g["X-Hasna-Signature"]=wv($.webhook.secret,U,D);return{body:D,headers:g}}async function hv(_,$,D={}){if(!$.webhook)throw Error(`Channel ${$.id} has no webhook config`);let U=i$(),{body:g,headers:I}=yv(_,$),j=new AbortController,N=setTimeout(()=>j.abort(),$.webhook.timeoutMs??15000);try{let O=await(D.fetchImpl??fetch)($.webhook.url,{method:"POST",headers:I,body:g,signal:j.signal}),A=FU(await O.text());return{attempt:1,status:O.ok?"success":"failed",startedAt:U,completedAt:i$(),responseStatus:O.status,responseBody:A,error:O.ok?void 0:`Webhook returned HTTP ${O.status}`}}catch(O){return{attempt:1,status:"failed",startedAt:U,completedAt:i$(),error:O instanceof Error?O.message:String(O)}}finally{clearTimeout(N)}}async function cv(_,$){if(!$.command)throw Error(`Channel ${$.id} has no command config`);let D=i$(),U=JSON.stringify(_),g={...process.env,...$.command.env,HASNA_CHANNEL_ID:$.id,HASNA_EVENT_ID:_.id,HASNA_EVENT_TYPE:_.type,HASNA_EVENT_SOURCE:_.source,HASNA_EVENT_SUBJECT:_.subject??"",HASNA_EVENT_SEVERITY:_.severity,HASNA_EVENT_TIME:_.time,HASNA_EVENT_DEDUPE_KEY:_.dedupeKey??"",HASNA_EVENT_SCHEMA_VERSION:_.schemaVersion,HASNA_EVENT_JSON:U};return new Promise((I)=>{let j=xv($.command.command,$.command.args??[],{cwd:$.command.cwd,env:g,stdio:["pipe","pipe","pipe"]}),N="",O="",A=setTimeout(()=>j.kill("SIGTERM"),$.command.timeoutMs??15000);j.stdin.end(U),j.stdout.on("data",(L)=>{N+=L.toString()}),j.stderr.on("data",(L)=>{O+=L.toString()}),j.on("error",(L)=>{clearTimeout(A),I({attempt:1,status:"failed",startedAt:D,completedAt:i$(),stdout:FU(N),stderr:FU(O),error:L.message})}),j.on("close",(L,z)=>{clearTimeout(A);let W=L===0;I({attempt:1,status:W?"success":"failed",startedAt:D,completedAt:i$(),stdout:FU(N),stderr:FU(O),error:W?void 0:`Command exited with ${z?`signal ${z}`:`code ${L}`}`})})})}async function nv(_,$,D={}){if($.transport==="webhook")return hv(_,$,D);if($.transport==="command")return cv(_,$);return{attempt:1,status:"skipped",startedAt:i$(),completedAt:i$(),error:`Unsupported transport: ${$.transport}`}}function M8(_,$,D){let U=D.some((g)=>g.status==="success")?"success":D.every((g)=>g.status==="skipped")?"skipped":"failed";return{id:uv(),eventId:_.id,channelId:$.id,transport:$.transport,status:U,attempts:D,createdAt:D[0]?.startedAt??i$(),completedAt:D.at(-1)?.completedAt??i$()}}class w8 extends Error{eventType;issues;constructor(_,$){let D=$.map((U)=>`${U.path||""}: ${U.message}`).join("; ");super(`Event validation failed for type "${_}": ${D}`);this.name="EventValidationError",this.eventType=_,this.issues=$}}class u8{definitions=new Map;register(_){return this.definitions.set(_.type,_),this}unregister(_){return this.definitions.delete(_)}has(_){return this.definitions.has(_)}get(_){return this.definitions.get(_)}list(){return[...this.definitions.values()]}validateEvent(_){let $=this.definitions.get(_.type);if(!$)return{ok:!0};return $.validate(_.data,_)}assertEventValid(_){let $=this.validateEvent(_);if(!$.ok)throw new w8(_.type,$.issues)}}var dv=new u8;function Nz(_){return{id:_.id??mv(),source:_.source,type:_.type,time:pv(_.time),subject:_.subject,severity:_.severity??"info",data:_.data??{},message:_.message,dedupeKey:_.dedupeKey,schemaVersion:_.schemaVersion??"1.0",metadata:_.metadata??{}}}class x8{store;redactors;transportOptions;catalog;validateCatalogTypes;constructor(_={}){this.store=_.store??new YN(_.dataDir),this.redactors=_.redactors??[],this.transportOptions={fetchImpl:_.fetchImpl},this.catalog=_.catalog??dv,this.validateCatalogTypes=_.validateCatalogTypes??!1}async addChannel(_){let $=new Date().toISOString();return this.store.addChannel({..._,createdAt:_.createdAt??$,updatedAt:_.updatedAt??$})}async listChannels(){return this.store.listChannels()}async removeChannel(_){return this.store.removeChannel(_)}async emit(_,$={}){let D=$.redactSensitiveData===!1?Nz(_):tv(Nz(_));if($.validate??this.validateCatalogTypes)this.catalog.assertEventValid(D);let U=await this.appendEvent(D,{dedupe:$.dedupe!==!1});if(U.deduped)return{event:U.event,deliveries:[],deduped:!0};let g=$.deliver===!1?[]:await this.deliver(U.event);return{event:U.event,deliveries:g,deduped:!1}}async listEvents(_={}){if(Object.keys(_).length===0)return this.store.listEvents();return Z8(await this.store.listEvents(),_)}async listEventsPage(_={}){if(this.store.listEventsPage)return this.store.listEventsPage(_);let $=Z8(await this.store.listEvents(),{eventId:_.eventId,source:_.source,type:_.type}),D=QN(_.cursor,_),U=TN(_.limit),g=$.slice(D,D+U),I=D+g.length,j=I<$.length;return{events:g,cursor:_.cursor,nextCursor:j?f8(I,_):void 0,hasMore:j}}async listDeliveries(){return this.store.listDeliveries()}async deliver(_){let D=(await this.store.listChannels()).filter((g)=>B8(g,_)),U=[];for(let g of D){let I=await this.applyRedaction(_,g),j=await this.deliverWithRetry(I,g);await this.store.appendDelivery(j),U.push(j)}return U}async matchChannel(_,$={}){let D=await this.store.getChannel(_);if(!D)throw Error(`Channel not found: ${_}`);let U=Nz({source:$.source??"hasna.events",type:$.type??"events.test",subject:$.subject??_,severity:$.severity??"info",data:$.data??{test:!0},message:$.message??"Hasna events test delivery",dedupeKey:$.dedupeKey,schemaVersion:$.schemaVersion,metadata:$.metadata,time:$.time,id:$.id}),g=B8(D,U);return{channelId:D.id,matched:g,event:U,filters:D.filters,reason:g?void 0:D.enabled?"event did not match channel filters":"channel is disabled"}}async testChannel(_,$={},D={}){let U=await this.store.getChannel(_);if(!U)throw Error(`Channel not found: ${_}`);let g=await this.matchChannel(_,$),I=g.event;if(D.honorFilters&&!g.matched){let O=new Date().toISOString(),A=M8(I,U,[{attempt:1,status:"skipped",startedAt:O,completedAt:O,error:g.reason}]);return A.metadata={reason:"filter_mismatch"},await this.store.appendDelivery(A),A}let j=await this.applyRedaction(I,U),N=await this.deliverWithRetry(j,U);return await this.store.appendDelivery(N),N}async replay(_={}){let $=_.cursor||_.limit!==void 0?await this.listEventsPage(_):{events:await this.listEvents(_),hasMore:!1};if(_.dryRun)return{events:$.events,deliveries:[],cursor:$.cursor,nextCursor:$.nextCursor,hasMore:$.hasMore};let D=[];for(let U of $.events)D.push(...await this.deliver(U));return{events:$.events,deliveries:D,cursor:$.cursor,nextCursor:$.nextCursor,hasMore:$.hasMore}}async appendEvent(_,$){if(this.store.appendEventOnce)return this.store.appendEventOnce(_,{dedupe:$.dedupe});if($.dedupe){let U=await this.store.findEventByIdentity({id:_.id,dedupeKey:_.dedupeKey});if(U)return{event:U,stored:!1,deduped:!0,identity:{id:U.id,dedupeKey:U.dedupeKey}}}let D=await this.store.appendEvent(_);return{event:D,stored:!0,deduped:!1,identity:{id:D.id,dedupeKey:D.dedupeKey}}}async applyRedaction(_,$){let D=iv(_,$.redact?.paths??[],$.redact?.replacement??"[REDACTED]");for(let U of this.redactors)D=await U(D,$);return D}async deliverWithRetry(_,$){let D=ev($.retry),U=[];for(let g=0;g[D,h8(D)?"[REDACTED]":U]));return $}function lv(_){return _.map(y8)}function tv(_,$="[REDACTED]"){return Oz(_,$)}function h8(_){return/secret|token|password|api[_-]?key|authorization/i.test(_)}function Oz(_,$){if(Array.isArray(_))return _.map((D)=>Oz(D,$));if(!_||typeof _!=="object")return _;return Object.fromEntries(Object.entries(_).map(([D,U])=>[D,h8(D)?$:Oz(U,$)]))}function ov(_,$,D){let U=$.split("."),g=_;for(let j of U.slice(0,-1)){let N=g[j];if(!N||typeof N!=="object")return;g=N}let I=U.at(-1);if(I&&I in g)g[I]=D}function Z8(_,$){let D=_;if($.eventId)D=D.filter((U)=>U.id===$.eventId);if($.source)D=D.filter((U)=>U.source===$.source);if($.type)D=D.filter((U)=>U.type===$.type);if($.cursor)D=D.slice(QN($.cursor,$));if($.limit!==void 0)D=D.slice(0,TN($.limit));return D}function pv(_){if(!_)return new Date().toISOString();return _ instanceof Date?_.toISOString():_}function ev(_){return{maxAttempts:Math.max(1,_?.maxAttempts??1),backoffMs:Math.max(0,_?.backoffMs??250),multiplier:Math.max(1,_?.multiplier??2)}}function XN(_,$,D=!1){if(!_?.length)return;let U={};for(let g of _){let I=_f(g,$),j=I.path;if(j in U)throw Error(`Duplicate ${$} filter path: ${j}`);let N=D?sv(I.rawValue,$):I.rawValue;U[j]=I.negated?{not:N}:N}return U}function av(_){let $={};if(_.source)$.source=_.source;if(_.type)$.type=_.type;if(_.subject)$.subject=_.subject;if(_.severity)$.severity=_.severity;let D=b8(XN(_.data,"data"),XN(_.dataJson,"data-json",!0)),U=b8(XN(_.metadata,"metadata"),XN(_.metadataJson,"metadata-json",!0));if(Object.keys(D).length>0)$.data=D;if(Object.keys(U).length>0)$.metadata=U;return Object.keys($).length>0?[$]:void 0}function b8(..._){let $={};for(let D of _){if(!D)continue;for(let[U,g]of Object.entries(D)){if(U in $)throw Error(`Duplicate filter path: ${U}`);$[U]=g}}return $}function sv(_,$){let D=JSON.parse(_);if(D===null||typeof D==="string"||typeof D==="number"||typeof D==="boolean"||Array.isArray(D)&&D.every((U)=>typeof U==="string"))return D;throw Error(`${$} filter JSON values must be string, string[], number, boolean, or null`)}function _f(_,$){let D=_.indexOf("!=");if(D>0)return{path:_.slice(0,D),rawValue:_.slice(D+2),negated:!0};let U=_.indexOf("=");if(U<=0)throw Error(`Invalid ${$} filter, expected path=value or path!=value: ${_}`);return{path:_.slice(0,U),rawValue:_.slice(U+1),negated:!1}}var $f=100;function VD(_,$){if(!_)return $;let D=JSON.parse(_);if(!D||typeof D!=="object"||Array.isArray(D))throw Error("Expected a JSON object");return D}function Df(_){if(!_?.length)return;let $={};for(let D of _){let U=D.indexOf("=");if(U===-1)throw Error(`Invalid header, expected name=value: ${D}`);$[D.slice(0,U)]=D.slice(U+1)}return $}function p6(_){if(_.createClient)return _.createClient();return new x8({store:new YN(_.dataDir)})}function s4(_,$,D){if($)console.log(JSON.stringify(_,null,2));else console.log(D)}function H8(_,$){let D=_ instanceof Error?_.message:String(_);if($)console.log(JSON.stringify({error:D},null,2));else console.error(D);process.exitCode=1}function k8(_){return Boolean(_?.json||_?.opts?.().json||_?.optsWithGlobals?.().json||_?.parent?.opts?.().json||_?.parent?.optsWithGlobals?.().json)}function W6(_,$){return k8(_)||k8($)}function gf(_,$){let D=_.command($.channelsCommandName??"channels").description("Manage Hasna event channels");return D.command("add").description("Add or replace a channel").argument("","Webhook URL or command binary").requiredOption("--id ","Channel identifier").option("--transport ","Transport kind: webhook or command","webhook").option("--name ","Display name").option("--type ","Event type filter, e.g. todos.task.*").option("--source ","Event source filter").option("--subject ","Event subject filter").option("--severity ","Event severity filter").option("--data ","Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard",a4,[]).option("--metadata ","Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard",a4,[]).option("--data-json ","Event data field filter with typed JSON value; path!=json negatives supported",a4,[]).option("--metadata-json ","Event metadata field filter with typed JSON value; path!=json negatives supported",a4,[]).option("--secret ","Webhook HMAC secret").option("--header ","Webhook header",a4,[]).option("--arg ","Command argument",a4,[]).option("--timeout-ms ","Transport timeout in milliseconds",ZU).option("--retry-attempts ","Maximum delivery attempts",ZU).option("--retry-backoff-ms ","Initial retry backoff in milliseconds",ZU).option("--redact ","Event field path to redact before delivery",a4,[]).option("--disabled","Create channel disabled",!1).option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=new Date().toISOString(),N={id:g.id,name:g.name,enabled:!g.disabled,transport:g.transport,filters:av(g),retry:g.retryAttempts||g.retryBackoffMs?{maxAttempts:g.retryAttempts,backoffMs:g.retryBackoffMs}:void 0,redact:g.redact?.length?{paths:g.redact}:void 0,createdAt:j,updatedAt:j};if(g.transport==="webhook")N.webhook={url:U,secret:g.secret,headers:Df(g.header),timeoutMs:g.timeoutMs};else if(g.transport==="command")N.command={command:U,args:g.arg??[],timeoutMs:g.timeoutMs};else throw Error(`Transport ${g.transport} is reserved for future use and cannot be added yet`);let O=await p6($).addChannel(N);s4(y8(O),W6(g,I),`Added ${O.transport} channel ${O.id}`)}),D.command("list").description("List configured channels").option("-j, --json","Print JSON output",!1).action(async(U,g)=>{let I=await p6($).listChannels();if(W6(U,g)){console.log(JSON.stringify(lv(I),null,2));return}if(!I.length){console.log("No channels configured.");return}for(let j of I)console.log(`${j.id} ${j.enabled?"enabled":"disabled"} ${j.transport} ${j.webhook?.url??j.command?.command??j.transport}`)}),D.command("status").description("Show events channel storage status").option("-j, --json","Print JSON output",!1).action(async(U,g)=>{let I=await rv($.dataDir);s4(I,W6(U,g),`events dataDir: ${I.dataDir}`)}),D.command("remove").description("Remove a channel").argument("","Channel identifier").option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=await p6($).removeChannel(U);s4({removed:j},W6(g,I),j?`Removed ${U}`:`Channel not found: ${U}`)}),D.command("test").description("Send a test event to one channel").argument("","Channel identifier").option("--source ","Event source override").option("--type ","Event type","events.test").option("--subject ","Event subject").option("--message ","Event message","Hasna events test delivery").option("--data ","Event data JSON object").option("--metadata ","Event metadata JSON object").option("--honor-filters","Skip delivery when the sample event does not match channel filters",!1).option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=W6(g,I);try{let N=await p6($).testChannel(U,{source:g.source??$.source,type:g.type,subject:g.subject??U,message:g.message,data:VD(g.data,{test:!0}),metadata:VD(g.metadata,{})},{honorFilters:g.honorFilters});s4(N,j,`${N.status}: ${N.channelId}`)}catch(N){H8(N,j)}}),D.command("match").description("Check whether a sample event matches one channel without delivering").argument("","Channel identifier").option("--source ","Event source override").option("--type ","Event type","events.test").option("--subject ","Event subject").option("--message ","Event message","Hasna events match preview").option("--data ","Event data JSON object").option("--metadata ","Event metadata JSON object").option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=W6(g,I);try{let N=await p6($).matchChannel(U,{source:g.source??$.source,type:g.type,subject:g.subject??U,message:g.message,data:VD(g.data,{test:!0}),metadata:VD(g.metadata,{})});s4(N,j,`${N.matched?"matched":"skipped"}: ${N.channelId}`)}catch(N){H8(N,j)}}),D}function Uf(_,$){let D=_.command($.eventsCommandName??"events").description("Emit, list, and replay Hasna events");D.command("emit").description("Emit an event from this app").argument("","Event type").option("--source ","Event source override").option("--subject ","Event subject").option("--severity ","Event severity","info").option("--message ","Event message").option("--dedupe-key ","Dedupe key").option("--data ","Event data JSON object").option("--metadata ","Event metadata JSON object").option("--no-deliver","Record without delivering").option("--no-dedupe","Allow duplicate id/dedupeKey events").option("-j, --json","Print JSON output",!1).action(async(g,I,j)=>{let N=await p6($).emit({source:I.source??$.source,type:g,subject:I.subject,severity:I.severity,message:I.message,dedupeKey:I.dedupeKey,data:VD(I.data,{}),metadata:VD(I.metadata,{})},{deliver:I.deliver,dedupe:I.dedupe});s4(N,W6(I,j),`${N.deduped?"Deduped":"Emitted"} ${N.event.id} to ${N.deliveries.length} channel(s)`)});let U=$.defaultEventListLimit??$f;return D.command("list").description("List recorded events").option("--source ","Filter by source").option("--type ","Filter by type").option("--limit ",`Limit to the most recent events (default ${U}; use 0 for all)`,ZU,U).option("-j, --json","Print JSON output",!1).action(async(g,I)=>{let j=await p6($).listEvents();if(g.source)j=j.filter((N)=>N.source===g.source);if(g.type)j=j.filter((N)=>N.type===g.type);if(g.limit)j=j.slice(-g.limit);if(W6(g,I)){console.log(JSON.stringify(j,null,2));return}if(!j.length){console.log("No events recorded.");return}for(let N of j)console.log(`${N.time} ${N.id} ${N.source} ${N.type} ${N.severity}`)}),D.command("replay").description("Replay recorded events").option("--id ","Replay one event id").option("--source ","Filter by source").option("--type ","Filter by type").option("--cursor ","Opaque replay cursor from a previous page").option("--limit ","Maximum events to replay",ZU).option("--dry-run","Preview without delivery",!1).option("-j, --json","Print JSON output",!1).action(async(g,I)=>{let j=await p6($).replay({eventId:g.id,source:g.source,type:g.type,cursor:g.cursor,limit:g.limit,dryRun:g.dryRun});s4(j,W6(g,I),If(j.events.length,j.deliveries.length,j.nextCursor))}),D}function c8(_,$){gf(_,$),Uf(_,$)}function ZU(_){let $=Number(_);if(!Number.isFinite($))throw Error(`Expected a number, got ${_}`);return $}function a4(_,$){return $.push(_),$}function If(_,$,D){let U=D?`, next cursor: ${D}`:"";return`Replayed ${_} event(s), ${$} delivery result(s)${U}`}import{basename as Nf}from"path";var C$={name:"@hasna/knowledge",version:"0.2.99",description:"Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions",type:"module",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./storage":{import:"./dist/storage.js",types:"./dist/storage.d.ts"},"./serve":{import:"./dist/serve.js",types:"./dist/serve.d.ts"}},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{knowledge:"bin/knowledge.js","knowledge-mcp":"bin/knowledge-mcp.js","knowledge-serve":"bin/knowledge-serve.js"},files:["bin","dist","scripts/apply-cloud-migrations.mjs","scripts/lib/remote-temp-dir.mjs","scripts/smoke-machine-sync-release.mjs","scripts/smoke-machines-adapter.mjs","scripts/smoke-open-files-installed-boundary.mjs","scripts/strip-generated-trailing-whitespace.mjs","scripts/verify-generated-artifacts.mjs","docs/architecture/ai-native-knowledge-base.md","docs/architecture/hosted-wrapper-responsibilities.md","docs/architecture/hybrid-semantic-search.md","docs/architecture/machine-sync-schema.md","docs/examples/app-project-wiki-standard.md","docs/examples/company-wiki-workflow.md","docs/migration/global-rules-provenance-import.md","docs/migration/json-to-sqlite.md","LICENSE","README.md"],scripts:{test:"bun test","test:cli":"bun test tests/cli.test.ts","test:package":"bun test tests/package-release.test.ts","release:pack:check":"node scripts/validate-public-package.mjs","smoke:machines-adapter":"bun scripts/smoke-machines-adapter.mjs","smoke:machine-sync-release":"bun scripts/smoke-machine-sync-release.mjs","smoke:open-files-installed-boundary":"bun scripts/smoke-open-files-installed-boundary.mjs","migrate:cloud":"bun scripts/apply-cloud-migrations.mjs",serve:"bun src/serve-entry.ts","verify:generated":"bun scripts/verify-generated-artifacts.mjs","contracts:conformance":"contracts conformance fixtures",build:"rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bunx tsc -p tsconfig.build.json",prepublishOnly:"bun run contracts:conformance && contracts no-cloud-scan . && bun run build && node scripts/validate-public-package.mjs"},keywords:["knowledge","cli","agents","json","notes","local","store"],license:"Apache-2.0",publishConfig:{registry:"https://registry.npmjs.org",access:"public"},repository:{type:"git",url:"git+https://github.com/hasna/knowledge.git"},bugs:{url:"https://github.com/hasna/knowledge/issues"},author:"Hasna Inc. ",engines:{bun:">=1.0",node:">=18"},dependencies:{"@ai-sdk/anthropic":"^3.0.81","@ai-sdk/deepseek":"^2.0.35","@ai-sdk/openai":"^3.0.68","@aws-sdk/client-s3":"^3.1063.0","@aws-sdk/credential-providers":"^3.1063.0","@hasna/events":"^0.1.3","@modelcontextprotocol/sdk":"^1.29.0","@types/json-schema":"^7.0.15",ai:"^6.0.197",commander:"^13.1.0",pg:"^8.16.3",zod:"^4.3.6"},devDependencies:{"@electric-sql/pglite":"^0.5.4","@hasna/contracts":"0.8.5","@types/bun":"^1.3.14","@types/pg":"^8.15.6"}};var n8={debug:0,info:1,warn:2,error:3},Ef=()=>{if(process.env.DEBUG)return"debug";if(process.env.LOG_LEVEL==="debug")return"debug";if(process.env.LOG_LEVEL==="warn")return"warn";if(process.env.LOG_LEVEL==="error")return"error";return"info"};function $0(_,$,D){if(n8[_]U.toLowerCase()));return $.filter((U)=>!D.has(U.toLowerCase()))}function Az(_,$,D){if(D===void 0)return{..._,message:$};return{..._,added:D.length,message:`${$} (added ${D.length} tag${D.length===1?"":"s"})`}}function Af(_,$){if($===void 0)throw Error("Missing value for --tag. Example: knowledge add <content> -t <tag> -t <tag>");let D=$.split(",").map((U)=>U.trim()).filter((U)=>U.length>0);if(D.length===0)throw Error(`Invalid --tag value ${JSON.stringify($)}: no tag name found. Example: knowledge add <title> <content> -t <tag> -t <tag>`);return Of([..._??[],...D])}function Lf(_){let $=[],D={},U=!1;for(let g=0;g<_.length;g+=1){let I=_[g];if(U){$.push(I);continue}if(I==="--"){U=!0;continue}if(!I.startsWith("-")||$[0]==="add"&&$.length===2&&I.startsWith("---")){$.push(I);continue}switch(I){case"--json":D.json=!0;break;case"--verbose":D.verbose=!0;break;case"--yes":case"-y":D.yes=!0;break;case"--help":case"-h":D.help=!0;break;case"--version":case"-v":D.version=!0;break;case"--desc":D.desc=!0;break;case"--page":case"-p":D.page=Number(_[g+1]),g+=1;break;case"--limit":case"-l":D.limit=Number(_[g+1]),g+=1;break;case"--search":case"-s":D.search=_[g+1],g+=1;break;case"--sort":D.sort=_[g+1],g+=1;break;case"--id":D.id=_[g+1],g+=1;break;case"--store":D.store=_[g+1],g+=1;break;case"--title":D.title=_[g+1],g+=1;break;case"--content":D.content=_[g+1],g+=1;break;case"--url":D.url=_[g+1],g+=1;break;case"--tag":case"-t":D.tag=Af(D.tag,_[g+1]),D.tagRaw=[...D.tagRaw??[],_[g+1]],g+=1;break;case"--format":D.format=_[g+1],g+=1;break;case"--completions":D.completions=_[g+1],g+=1;break;case"--purpose":D.purpose=_[g+1],g+=1;break;case"--model":D.model=_[g+1],g+=1;break;case"--strategy":D.strategy=_[g+1],g+=1;break;case"--dimensions":D.dimensions=Number(_[g+1]),g+=1;break;case"--semantic":D.semantic=!0;break;case"--context":D.context=!0;break;case"--max-tokens":D.maxTokens=Number(_[g+1]),g+=1;break;case"--max-items":D.maxItems=Number(_[g+1]),g+=1;break;case"--from":D.from=_[g+1],g+=1;break;case"--to":D.to=_[g+1],g+=1;break;case"--rev":D.rev=Number(_[g+1]),g+=1;break;case"--if-version":D.ifVersion=Number(_[g+1]),g+=1;break;case"--since":D.since=_[g+1],g+=1;break;case"--topic":D.topic=_[g+1],g+=1;break;case"--dedupe":D.dedupe=!0;break;case"--generate":D.generate=!0;break;case"--approve-write":D.approveWrite=!0;break;case"--provider":D.provider=_[g+1],g+=1;break;case"--mode":D.mode=_[g+1],g+=1;break;case"--machine":D.machine=_[g+1],g+=1;break;case"--workspace":D.workspace=_[g+1],g+=1;break;case"--api-url":D.apiUrl=_[g+1],g+=1;break;case"--canonical-example":D.canonicalExample=!0;break;case"--api-key":D.apiKey=_[g+1],g+=1;break;case"--email":D.email=_[g+1],g+=1;break;case"--org":D.org=_[g+1],g+=1;break;case"--org-id":D.orgId=_[g+1],g+=1;break;case"--user-id":D.userId=_[g+1],g+=1;break;case"--owner":D.owner=_[g+1],g+=1;break;case"--approved-by":D.approvedBy=_[g+1],g+=1;break;case"--patch-uri":D.patchUri=_[g+1],g+=1;break;case"--domain":D.domain=[...D.domain??[],_[g+1]],g+=1;break;case"--file-results":D.fileResults=!0;break;case"--full":D.full=!0;break;case"--dry-run":D.dryRun=!0;break;case"--fake":D.fake=!0;break;case"--no-tailscale":D.tailscale=!1;break;case"--no-artifact-content":D.artifactContent=!1;break;case"--no-color":D.noColor=!0;break;case"--scope":D.scope=_[g+1],g+=1;break;case"--tables":D.tables=_[g+1],g+=1;break;case"--peer-workspace":D.peerWorkspace=_[g+1],g+=1;break;case"--older-than":D.olderThan=Number(_[g+1]),g+=1;break;case"--empty":D.empty=!0;break;case"--archived":D.archived=!0;break;case"--include-archived":D.includeArchived=!0;break;case"--project":D.project=_[g+1],g+=1;break;case"--contract":D.contract=!0;break;case"--source-ref":D.sourceRef=[...D.sourceRef??[],_[g+1]],g+=1;break;case"--allow-global":D.allowGlobal=!0;break;default:throw Error(`Unknown flag: ${I}. Run 'knowledge --help' for valid options.`)}}return{positional:$,flags:D}}function Jf(_){if(!_)return"";return p8[_]??_}function Pf(_,$){let D=Array.from({length:_.length+1},()=>Array($.length+1).fill(0));for(let U=0;U<=_.length;U+=1)D[U][0]=U;for(let U=0;U<=$.length;U+=1)D[0][U]=U;for(let U=1;U<=_.length;U+=1)for(let g=1;g<=$.length;g+=1){let I=_[U-1]===$[g-1]?0:1;D[U][g]=Math.min(D[U-1][g]+1,D[U][g-1]+1,D[U-1][g-1]+I)}return D[_.length][$.length]}function zf(_){if(!_)return"";let $=[...o8,...Object.keys(p8)],D="",U=Number.POSITIVE_INFINITY;for(let g of $){let I=Pf(_,g);if(I<U)U=I,D=g}return U<=3?D:""}function Sf(){return Nf(process.argv[1]??"").replace(/\.(?:js|ts|mjs|cjs)$/,"")==="knowledge"}async function Wf(_){if(!t8.includes(_[0]??""))return!1;let $=new Q8;return $.name("knowledge").description("Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions"),c8($,{source:"knowledge"}),await $.parseAsync(_,{from:"user"}),!0}function Xf(){console.log(`knowledge - local agent knowledge store +`,{encoding:"utf-8",mode:384}),await Mv(D,_),await Uz(_,384).catch(()=>{return})}}function Cv(_=v8()){return{mode:"local-files",name:"json-events-store",remote:!1,localFiles:!0,localSqlite:!1,postgres:!1,s3:!1,aws:!1,durable:!0,idempotency:"best-effort-local",replayCursors:!0,description:`Local JSON files in ${_}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`}}function f8(_,$={}){if(!Number.isInteger(_)||_<0)throw Error(`Invalid event cursor offset: ${_}`);let D={offset:_,eventId:$.eventId,source:$.source,type:$.type};return`${Ez}${C8.from(JSON.stringify(D),"utf-8").toString("base64url")}`}function QN(_,$={}){if(!_)return 0;if(!_.startsWith(Ez))throw Error(`Invalid local JSON event cursor: ${_}`);let D=_.slice(Ez.length),U;try{U=JSON.parse(C8.from(D,"base64url").toString("utf-8"))}catch{throw Error(`Invalid local JSON event cursor: ${_}`)}let g=U.offset;if(!Number.isInteger(g)||g<0)throw Error(`Invalid local JSON event cursor: ${_}`);return Iz("eventId",U.eventId,$.eventId),Iz("source",U.source,$.source),Iz("type",U.type,$.type),g}function TN(_){if(_===void 0)return bv;if(!Number.isInteger(_)||_<1)throw Error(`Event page limit must be a positive integer, got ${_}`);return Math.min(_,Hv)}function K8(_,$){let D=_;if($.eventId)D=D.filter((U)=>U.id===$.eventId);if($.source)D=D.filter((U)=>U.source===$.source);if($.type)D=D.filter((U)=>U.type===$.type);if($.cursor){let U=QN($.cursor,$);D=D.slice(U)}if($.limit!==void 0)D=D.slice(0,TN($.limit));return D}function Iz(_,$,D){if($!==D)throw Error(`Local JSON event cursor ${_} filter mismatch`)}function F8(_,$){return _.find((D)=>$.id!==void 0&&D.id===$.id||$.dedupeKey!==void 0&&D.dedupeKey===$.dedupeKey)}async function rv(_){let $=new YN(_);await $.init();let[D,U,g]=await Promise.all([$.listChannels(),$.listEvents(),$.listDeliveries()]),I=D.reduce((j,N)=>{return j[N.transport]=(j[N.transport]??0)+1,j},{});return{service:"events",schemaVersion:"1.0",dataDir:$.dataDir,storage:$.runtime,env:{primary:RN,fallback:GN,active:kv()},files:{channels:jz($.dataDir,"channels.json",D.length),events:jz($.dataDir,"events.json",U.length),deliveries:jz($.dataDir,"deliveries.json",g.length)},counts:{channels:D.length,enabledChannels:D.filter((j)=>j.enabled).length,disabledChannels:D.filter((j)=>!j.enabled).length,events:U.length,deliveries:g.length},transports:I,safety:{includesEventPayloads:!1,includesWebhookSecrets:!1,listOutputsRedactSecrets:!0,statusOutputIsMetadataOnly:!0}}}function jz(_,$,D){let U=MU(_,$);return{path:U,exists:r8(U),records:D}}function fv(_,$){return`${_}.${$}`}function wv(_,$,D){return`sha256=${vv("sha256",_).update(fv($,D)).digest("hex")}`}function i$(){return new Date().toISOString()}function FU(_,$=4096){return _.length>$?`${_.slice(0,$)}...`:_}function yv(_,$){if(!$.webhook)throw Error(`Channel ${$.id} has no webhook config`);let D=JSON.stringify(_),U=_.time,g={"Content-Type":"application/json","User-Agent":"@hasna/events","X-Hasna-Event-Id":_.id,"X-Hasna-Event-Type":_.type,"X-Hasna-Timestamp":U,...$.webhook.headers};if($.webhook.secret)g["X-Hasna-Signature"]=wv($.webhook.secret,U,D);return{body:D,headers:g}}async function hv(_,$,D={}){if(!$.webhook)throw Error(`Channel ${$.id} has no webhook config`);let U=i$(),{body:g,headers:I}=yv(_,$),j=new AbortController,N=setTimeout(()=>j.abort(),$.webhook.timeoutMs??15000);try{let O=await(D.fetchImpl??fetch)($.webhook.url,{method:"POST",headers:I,body:g,signal:j.signal}),A=FU(await O.text());return{attempt:1,status:O.ok?"success":"failed",startedAt:U,completedAt:i$(),responseStatus:O.status,responseBody:A,error:O.ok?void 0:`Webhook returned HTTP ${O.status}`}}catch(O){return{attempt:1,status:"failed",startedAt:U,completedAt:i$(),error:O instanceof Error?O.message:String(O)}}finally{clearTimeout(N)}}async function cv(_,$){if(!$.command)throw Error(`Channel ${$.id} has no command config`);let D=i$(),U=JSON.stringify(_),g={...process.env,...$.command.env,HASNA_CHANNEL_ID:$.id,HASNA_EVENT_ID:_.id,HASNA_EVENT_TYPE:_.type,HASNA_EVENT_SOURCE:_.source,HASNA_EVENT_SUBJECT:_.subject??"",HASNA_EVENT_SEVERITY:_.severity,HASNA_EVENT_TIME:_.time,HASNA_EVENT_DEDUPE_KEY:_.dedupeKey??"",HASNA_EVENT_SCHEMA_VERSION:_.schemaVersion,HASNA_EVENT_JSON:U};return new Promise((I)=>{let j=xv($.command.command,$.command.args??[],{cwd:$.command.cwd,env:g,stdio:["pipe","pipe","pipe"]}),N="",O="",A=setTimeout(()=>j.kill("SIGTERM"),$.command.timeoutMs??15000);j.stdin.end(U),j.stdout.on("data",(L)=>{N+=L.toString()}),j.stderr.on("data",(L)=>{O+=L.toString()}),j.on("error",(L)=>{clearTimeout(A),I({attempt:1,status:"failed",startedAt:D,completedAt:i$(),stdout:FU(N),stderr:FU(O),error:L.message})}),j.on("close",(L,z)=>{clearTimeout(A);let W=L===0;I({attempt:1,status:W?"success":"failed",startedAt:D,completedAt:i$(),stdout:FU(N),stderr:FU(O),error:W?void 0:`Command exited with ${z?`signal ${z}`:`code ${L}`}`})})})}async function nv(_,$,D={}){if($.transport==="webhook")return hv(_,$,D);if($.transport==="command")return cv(_,$);return{attempt:1,status:"skipped",startedAt:i$(),completedAt:i$(),error:`Unsupported transport: ${$.transport}`}}function M8(_,$,D){let U=D.some((g)=>g.status==="success")?"success":D.every((g)=>g.status==="skipped")?"skipped":"failed";return{id:uv(),eventId:_.id,channelId:$.id,transport:$.transport,status:U,attempts:D,createdAt:D[0]?.startedAt??i$(),completedAt:D.at(-1)?.completedAt??i$()}}class w8 extends Error{eventType;issues;constructor(_,$){let D=$.map((U)=>`${U.path||"<root>"}: ${U.message}`).join("; ");super(`Event validation failed for type "${_}": ${D}`);this.name="EventValidationError",this.eventType=_,this.issues=$}}class u8{definitions=new Map;register(_){return this.definitions.set(_.type,_),this}unregister(_){return this.definitions.delete(_)}has(_){return this.definitions.has(_)}get(_){return this.definitions.get(_)}list(){return[...this.definitions.values()]}validateEvent(_){let $=this.definitions.get(_.type);if(!$)return{ok:!0};return $.validate(_.data,_)}assertEventValid(_){let $=this.validateEvent(_);if(!$.ok)throw new w8(_.type,$.issues)}}var dv=new u8;function Nz(_){return{id:_.id??mv(),source:_.source,type:_.type,time:pv(_.time),subject:_.subject,severity:_.severity??"info",data:_.data??{},message:_.message,dedupeKey:_.dedupeKey,schemaVersion:_.schemaVersion??"1.0",metadata:_.metadata??{}}}class x8{store;redactors;transportOptions;catalog;validateCatalogTypes;constructor(_={}){this.store=_.store??new YN(_.dataDir),this.redactors=_.redactors??[],this.transportOptions={fetchImpl:_.fetchImpl},this.catalog=_.catalog??dv,this.validateCatalogTypes=_.validateCatalogTypes??!1}async addChannel(_){let $=new Date().toISOString();return this.store.addChannel({..._,createdAt:_.createdAt??$,updatedAt:_.updatedAt??$})}async listChannels(){return this.store.listChannels()}async removeChannel(_){return this.store.removeChannel(_)}async emit(_,$={}){let D=$.redactSensitiveData===!1?Nz(_):tv(Nz(_));if($.validate??this.validateCatalogTypes)this.catalog.assertEventValid(D);let U=await this.appendEvent(D,{dedupe:$.dedupe!==!1});if(U.deduped)return{event:U.event,deliveries:[],deduped:!0};let g=$.deliver===!1?[]:await this.deliver(U.event);return{event:U.event,deliveries:g,deduped:!1}}async listEvents(_={}){if(Object.keys(_).length===0)return this.store.listEvents();return Z8(await this.store.listEvents(),_)}async listEventsPage(_={}){if(this.store.listEventsPage)return this.store.listEventsPage(_);let $=Z8(await this.store.listEvents(),{eventId:_.eventId,source:_.source,type:_.type}),D=QN(_.cursor,_),U=TN(_.limit),g=$.slice(D,D+U),I=D+g.length,j=I<$.length;return{events:g,cursor:_.cursor,nextCursor:j?f8(I,_):void 0,hasMore:j}}async listDeliveries(){return this.store.listDeliveries()}async deliver(_){let D=(await this.store.listChannels()).filter((g)=>B8(g,_)),U=[];for(let g of D){let I=await this.applyRedaction(_,g),j=await this.deliverWithRetry(I,g);await this.store.appendDelivery(j),U.push(j)}return U}async matchChannel(_,$={}){let D=await this.store.getChannel(_);if(!D)throw Error(`Channel not found: ${_}`);let U=Nz({source:$.source??"hasna.events",type:$.type??"events.test",subject:$.subject??_,severity:$.severity??"info",data:$.data??{test:!0},message:$.message??"Hasna events test delivery",dedupeKey:$.dedupeKey,schemaVersion:$.schemaVersion,metadata:$.metadata,time:$.time,id:$.id}),g=B8(D,U);return{channelId:D.id,matched:g,event:U,filters:D.filters,reason:g?void 0:D.enabled?"event did not match channel filters":"channel is disabled"}}async testChannel(_,$={},D={}){let U=await this.store.getChannel(_);if(!U)throw Error(`Channel not found: ${_}`);let g=await this.matchChannel(_,$),I=g.event;if(D.honorFilters&&!g.matched){let O=new Date().toISOString(),A=M8(I,U,[{attempt:1,status:"skipped",startedAt:O,completedAt:O,error:g.reason}]);return A.metadata={reason:"filter_mismatch"},await this.store.appendDelivery(A),A}let j=await this.applyRedaction(I,U),N=await this.deliverWithRetry(j,U);return await this.store.appendDelivery(N),N}async replay(_={}){let $=_.cursor||_.limit!==void 0?await this.listEventsPage(_):{events:await this.listEvents(_),hasMore:!1};if(_.dryRun)return{events:$.events,deliveries:[],cursor:$.cursor,nextCursor:$.nextCursor,hasMore:$.hasMore};let D=[];for(let U of $.events)D.push(...await this.deliver(U));return{events:$.events,deliveries:D,cursor:$.cursor,nextCursor:$.nextCursor,hasMore:$.hasMore}}async appendEvent(_,$){if(this.store.appendEventOnce)return this.store.appendEventOnce(_,{dedupe:$.dedupe});if($.dedupe){let U=await this.store.findEventByIdentity({id:_.id,dedupeKey:_.dedupeKey});if(U)return{event:U,stored:!1,deduped:!0,identity:{id:U.id,dedupeKey:U.dedupeKey}}}let D=await this.store.appendEvent(_);return{event:D,stored:!0,deduped:!1,identity:{id:D.id,dedupeKey:D.dedupeKey}}}async applyRedaction(_,$){let D=iv(_,$.redact?.paths??[],$.redact?.replacement??"[REDACTED]");for(let U of this.redactors)D=await U(D,$);return D}async deliverWithRetry(_,$){let D=ev($.retry),U=[];for(let g=0;g<D.maxAttempts;g+=1){let I=await nv(_,$,this.transportOptions);if(I.attempt=g+1,I.status==="failed"&&g+1<D.maxAttempts)I.nextBackoffMs=Math.round(D.backoffMs*D.multiplier**g);if(U.push(I),I.status!=="failed")break;if(I.nextBackoffMs)await Bun.sleep(I.nextBackoffMs)}return M8(_,$,U)}}function iv(_,$,D="[REDACTED]"){if($.length===0)return _;let U=structuredClone(_);for(let g of $)ov(U,g,D);return U}function y8(_){let $=structuredClone(_);if($.webhook?.secret)$.webhook.secret="[REDACTED]";if($.command?.env)$.command.env=Object.fromEntries(Object.entries($.command.env).map(([D,U])=>[D,h8(D)?"[REDACTED]":U]));return $}function lv(_){return _.map(y8)}function tv(_,$="[REDACTED]"){return Oz(_,$)}function h8(_){return/secret|token|password|api[_-]?key|authorization/i.test(_)}function Oz(_,$){if(Array.isArray(_))return _.map((D)=>Oz(D,$));if(!_||typeof _!=="object")return _;return Object.fromEntries(Object.entries(_).map(([D,U])=>[D,h8(D)?$:Oz(U,$)]))}function ov(_,$,D){let U=$.split("."),g=_;for(let j of U.slice(0,-1)){let N=g[j];if(!N||typeof N!=="object")return;g=N}let I=U.at(-1);if(I&&I in g)g[I]=D}function Z8(_,$){let D=_;if($.eventId)D=D.filter((U)=>U.id===$.eventId);if($.source)D=D.filter((U)=>U.source===$.source);if($.type)D=D.filter((U)=>U.type===$.type);if($.cursor)D=D.slice(QN($.cursor,$));if($.limit!==void 0)D=D.slice(0,TN($.limit));return D}function pv(_){if(!_)return new Date().toISOString();return _ instanceof Date?_.toISOString():_}function ev(_){return{maxAttempts:Math.max(1,_?.maxAttempts??1),backoffMs:Math.max(0,_?.backoffMs??250),multiplier:Math.max(1,_?.multiplier??2)}}function XN(_,$,D=!1){if(!_?.length)return;let U={};for(let g of _){let I=_f(g,$),j=I.path;if(j in U)throw Error(`Duplicate ${$} filter path: ${j}`);let N=D?sv(I.rawValue,$):I.rawValue;U[j]=I.negated?{not:N}:N}return U}function av(_){let $={};if(_.source)$.source=_.source;if(_.type)$.type=_.type;if(_.subject)$.subject=_.subject;if(_.severity)$.severity=_.severity;let D=b8(XN(_.data,"data"),XN(_.dataJson,"data-json",!0)),U=b8(XN(_.metadata,"metadata"),XN(_.metadataJson,"metadata-json",!0));if(Object.keys(D).length>0)$.data=D;if(Object.keys(U).length>0)$.metadata=U;return Object.keys($).length>0?[$]:void 0}function b8(..._){let $={};for(let D of _){if(!D)continue;for(let[U,g]of Object.entries(D)){if(U in $)throw Error(`Duplicate filter path: ${U}`);$[U]=g}}return $}function sv(_,$){let D=JSON.parse(_);if(D===null||typeof D==="string"||typeof D==="number"||typeof D==="boolean"||Array.isArray(D)&&D.every((U)=>typeof U==="string"))return D;throw Error(`${$} filter JSON values must be string, string[], number, boolean, or null`)}function _f(_,$){let D=_.indexOf("!=");if(D>0)return{path:_.slice(0,D),rawValue:_.slice(D+2),negated:!0};let U=_.indexOf("=");if(U<=0)throw Error(`Invalid ${$} filter, expected path=value or path!=value: ${_}`);return{path:_.slice(0,U),rawValue:_.slice(U+1),negated:!1}}var $f=100;function VD(_,$){if(!_)return $;let D=JSON.parse(_);if(!D||typeof D!=="object"||Array.isArray(D))throw Error("Expected a JSON object");return D}function Df(_){if(!_?.length)return;let $={};for(let D of _){let U=D.indexOf("=");if(U===-1)throw Error(`Invalid header, expected name=value: ${D}`);$[D.slice(0,U)]=D.slice(U+1)}return $}function p6(_){if(_.createClient)return _.createClient();return new x8({store:new YN(_.dataDir)})}function s4(_,$,D){if($)console.log(JSON.stringify(_,null,2));else console.log(D)}function H8(_,$){let D=_ instanceof Error?_.message:String(_);if($)console.log(JSON.stringify({error:D},null,2));else console.error(D);process.exitCode=1}function k8(_){return Boolean(_?.json||_?.opts?.().json||_?.optsWithGlobals?.().json||_?.parent?.opts?.().json||_?.parent?.optsWithGlobals?.().json)}function W6(_,$){return k8(_)||k8($)}function gf(_,$){let D=_.command($.channelsCommandName??"channels").description("Manage Hasna event channels");return D.command("add").description("Add or replace a channel").argument("<target>","Webhook URL or command binary").requiredOption("--id <id>","Channel identifier").option("--transport <kind>","Transport kind: webhook or command","webhook").option("--name <name>","Display name").option("--type <pattern>","Event type filter, e.g. todos.task.*").option("--source <pattern>","Event source filter").option("--subject <pattern>","Event subject filter").option("--severity <pattern>","Event severity filter").option("--data <path=value...>","Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard",a4,[]).option("--metadata <path=value...>","Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard",a4,[]).option("--data-json <path=json...>","Event data field filter with typed JSON value; path!=json negatives supported",a4,[]).option("--metadata-json <path=json...>","Event metadata field filter with typed JSON value; path!=json negatives supported",a4,[]).option("--secret <secret>","Webhook HMAC secret").option("--header <name=value...>","Webhook header",a4,[]).option("--arg <arg...>","Command argument",a4,[]).option("--timeout-ms <ms>","Transport timeout in milliseconds",ZU).option("--retry-attempts <n>","Maximum delivery attempts",ZU).option("--retry-backoff-ms <ms>","Initial retry backoff in milliseconds",ZU).option("--redact <path...>","Event field path to redact before delivery",a4,[]).option("--disabled","Create channel disabled",!1).option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=new Date().toISOString(),N={id:g.id,name:g.name,enabled:!g.disabled,transport:g.transport,filters:av(g),retry:g.retryAttempts||g.retryBackoffMs?{maxAttempts:g.retryAttempts,backoffMs:g.retryBackoffMs}:void 0,redact:g.redact?.length?{paths:g.redact}:void 0,createdAt:j,updatedAt:j};if(g.transport==="webhook")N.webhook={url:U,secret:g.secret,headers:Df(g.header),timeoutMs:g.timeoutMs};else if(g.transport==="command")N.command={command:U,args:g.arg??[],timeoutMs:g.timeoutMs};else throw Error(`Transport ${g.transport} is reserved for future use and cannot be added yet`);let O=await p6($).addChannel(N);s4(y8(O),W6(g,I),`Added ${O.transport} channel ${O.id}`)}),D.command("list").description("List configured channels").option("-j, --json","Print JSON output",!1).action(async(U,g)=>{let I=await p6($).listChannels();if(W6(U,g)){console.log(JSON.stringify(lv(I),null,2));return}if(!I.length){console.log("No channels configured.");return}for(let j of I)console.log(`${j.id} ${j.enabled?"enabled":"disabled"} ${j.transport} ${j.webhook?.url??j.command?.command??j.transport}`)}),D.command("status").description("Show events channel storage status").option("-j, --json","Print JSON output",!1).action(async(U,g)=>{let I=await rv($.dataDir);s4(I,W6(U,g),`events dataDir: ${I.dataDir}`)}),D.command("remove").description("Remove a channel").argument("<id>","Channel identifier").option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=await p6($).removeChannel(U);s4({removed:j},W6(g,I),j?`Removed ${U}`:`Channel not found: ${U}`)}),D.command("test").description("Send a test event to one channel").argument("<id>","Channel identifier").option("--source <source>","Event source override").option("--type <type>","Event type","events.test").option("--subject <subject>","Event subject").option("--message <message>","Event message","Hasna events test delivery").option("--data <json>","Event data JSON object").option("--metadata <json>","Event metadata JSON object").option("--honor-filters","Skip delivery when the sample event does not match channel filters",!1).option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=W6(g,I);try{let N=await p6($).testChannel(U,{source:g.source??$.source,type:g.type,subject:g.subject??U,message:g.message,data:VD(g.data,{test:!0}),metadata:VD(g.metadata,{})},{honorFilters:g.honorFilters});s4(N,j,`${N.status}: ${N.channelId}`)}catch(N){H8(N,j)}}),D.command("match").description("Check whether a sample event matches one channel without delivering").argument("<id>","Channel identifier").option("--source <source>","Event source override").option("--type <type>","Event type","events.test").option("--subject <subject>","Event subject").option("--message <message>","Event message","Hasna events match preview").option("--data <json>","Event data JSON object").option("--metadata <json>","Event metadata JSON object").option("-j, --json","Print JSON output",!1).action(async(U,g,I)=>{let j=W6(g,I);try{let N=await p6($).matchChannel(U,{source:g.source??$.source,type:g.type,subject:g.subject??U,message:g.message,data:VD(g.data,{test:!0}),metadata:VD(g.metadata,{})});s4(N,j,`${N.matched?"matched":"skipped"}: ${N.channelId}`)}catch(N){H8(N,j)}}),D}function Uf(_,$){let D=_.command($.eventsCommandName??"events").description("Emit, list, and replay Hasna events");D.command("emit").description("Emit an event from this app").argument("<type>","Event type").option("--source <source>","Event source override").option("--subject <subject>","Event subject").option("--severity <severity>","Event severity","info").option("--message <message>","Event message").option("--dedupe-key <key>","Dedupe key").option("--data <json>","Event data JSON object").option("--metadata <json>","Event metadata JSON object").option("--no-deliver","Record without delivering").option("--no-dedupe","Allow duplicate id/dedupeKey events").option("-j, --json","Print JSON output",!1).action(async(g,I,j)=>{let N=await p6($).emit({source:I.source??$.source,type:g,subject:I.subject,severity:I.severity,message:I.message,dedupeKey:I.dedupeKey,data:VD(I.data,{}),metadata:VD(I.metadata,{})},{deliver:I.deliver,dedupe:I.dedupe});s4(N,W6(I,j),`${N.deduped?"Deduped":"Emitted"} ${N.event.id} to ${N.deliveries.length} channel(s)`)});let U=$.defaultEventListLimit??$f;return D.command("list").description("List recorded events").option("--source <source>","Filter by source").option("--type <type>","Filter by type").option("--limit <n>",`Limit to the most recent <n> events (default ${U}; use 0 for all)`,ZU,U).option("-j, --json","Print JSON output",!1).action(async(g,I)=>{let j=await p6($).listEvents();if(g.source)j=j.filter((N)=>N.source===g.source);if(g.type)j=j.filter((N)=>N.type===g.type);if(g.limit)j=j.slice(-g.limit);if(W6(g,I)){console.log(JSON.stringify(j,null,2));return}if(!j.length){console.log("No events recorded.");return}for(let N of j)console.log(`${N.time} ${N.id} ${N.source} ${N.type} ${N.severity}`)}),D.command("replay").description("Replay recorded events").option("--id <id>","Replay one event id").option("--source <source>","Filter by source").option("--type <type>","Filter by type").option("--cursor <cursor>","Opaque replay cursor from a previous page").option("--limit <n>","Maximum events to replay",ZU).option("--dry-run","Preview without delivery",!1).option("-j, --json","Print JSON output",!1).action(async(g,I)=>{let j=await p6($).replay({eventId:g.id,source:g.source,type:g.type,cursor:g.cursor,limit:g.limit,dryRun:g.dryRun});s4(j,W6(g,I),If(j.events.length,j.deliveries.length,j.nextCursor))}),D}function c8(_,$){gf(_,$),Uf(_,$)}function ZU(_){let $=Number(_);if(!Number.isFinite($))throw Error(`Expected a number, got ${_}`);return $}function a4(_,$){return $.push(_),$}function If(_,$,D){let U=D?`, next cursor: ${D}`:"";return`Replayed ${_} event(s), ${$} delivery result(s)${U}`}import{basename as Nf}from"path";var C$={name:"@hasna/knowledge",version:"0.2.100",description:"Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions",type:"module",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./storage":{import:"./dist/storage.js",types:"./dist/storage.d.ts"},"./serve":{import:"./dist/serve.js",types:"./dist/serve.d.ts"}},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{knowledge:"bin/knowledge.js","knowledge-mcp":"bin/knowledge-mcp.js","knowledge-serve":"bin/knowledge-serve.js"},files:["bin","dist","scripts/apply-cloud-migrations.mjs","scripts/lib/remote-temp-dir.mjs","scripts/smoke-machine-sync-release.mjs","scripts/smoke-machines-adapter.mjs","scripts/smoke-open-files-installed-boundary.mjs","scripts/strip-generated-trailing-whitespace.mjs","scripts/verify-generated-artifacts.mjs","docs/architecture/ai-native-knowledge-base.md","docs/architecture/hosted-wrapper-responsibilities.md","docs/architecture/hybrid-semantic-search.md","docs/architecture/machine-sync-schema.md","docs/examples/app-project-wiki-standard.md","docs/examples/company-wiki-workflow.md","docs/migration/global-rules-provenance-import.md","docs/migration/json-to-sqlite.md","LICENSE","README.md"],scripts:{test:"bun test","test:cli":"bun test tests/cli.test.ts","test:package":"bun test tests/package-release.test.ts","release:pack:check":"node scripts/validate-public-package.mjs","smoke:machines-adapter":"bun scripts/smoke-machines-adapter.mjs","smoke:machine-sync-release":"bun scripts/smoke-machine-sync-release.mjs","smoke:open-files-installed-boundary":"bun scripts/smoke-open-files-installed-boundary.mjs","migrate:cloud":"bun scripts/apply-cloud-migrations.mjs",serve:"bun src/serve-entry.ts","verify:generated":"bun scripts/verify-generated-artifacts.mjs","contracts:conformance":"contracts conformance fixtures",build:"rm -rf dist && bun build --target=bun --outfile=bin/knowledge.js --minify --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/cli.ts && bun build --target=bun --outfile=bin/knowledge-mcp.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @modelcontextprotocol/sdk --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/mcp.js && bun build --target=bun --outfile=bin/knowledge-serve.js --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek src/serve-entry.ts && bun build ./src/index.ts ./src/storage.ts ./src/serve.ts --outdir ./dist --target bun --external pg --external @hasna/machines --external @hasna/machines/consumer --external @aws-sdk/client-s3 --external @aws-sdk/credential-providers --external ai --external @ai-sdk/openai --external @ai-sdk/anthropic --external @ai-sdk/deepseek && bun scripts/strip-generated-trailing-whitespace.mjs && bunx tsc -p tsconfig.build.json",prepublishOnly:"bun run contracts:conformance && contracts no-cloud-scan . && bun run build && node scripts/validate-public-package.mjs"},keywords:["knowledge","cli","agents","json","notes","local","store"],license:"Apache-2.0",publishConfig:{registry:"https://registry.npmjs.org",access:"public"},repository:{type:"git",url:"git+https://github.com/hasna/knowledge.git"},bugs:{url:"https://github.com/hasna/knowledge/issues"},author:"Hasna Inc. <hasna@example.com>",engines:{bun:">=1.0",node:">=18"},dependencies:{"@ai-sdk/anthropic":"^3.0.81","@ai-sdk/deepseek":"^2.0.35","@ai-sdk/openai":"^3.0.68","@aws-sdk/client-s3":"^3.1063.0","@aws-sdk/credential-providers":"^3.1063.0","@hasna/events":"^0.1.3","@modelcontextprotocol/sdk":"^1.29.0","@types/json-schema":"^7.0.15",ai:"^6.0.197",commander:"^13.1.0",pg:"^8.16.3",zod:"^4.3.6"},devDependencies:{"@electric-sql/pglite":"^0.5.4","@hasna/contracts":"0.8.5","@types/bun":"^1.3.14","@types/pg":"^8.15.6"}};var n8={debug:0,info:1,warn:2,error:3},Ef=()=>{if(process.env.DEBUG)return"debug";if(process.env.LOG_LEVEL==="debug")return"debug";if(process.env.LOG_LEVEL==="warn")return"warn";if(process.env.LOG_LEVEL==="error")return"error";return"info"};function $0(_,$,D){if(n8[_]<n8[Ef()])return;let U={debug:"[DEBUG]",info:"[INFO]",warn:"[WARN]",error:"[ERROR]"}[_],g=D?`${U} ${$} ${JSON.stringify(D)}`:`${U} ${$}`;if(_==="error")console.error(g);else console.error(g)}var t8=["events","webhooks"],o8=["add","list","get","delete","update","archive","restore","upsert","untag","versions","diff","export","prune","dedupe","stats","inventory","project-panel","paths","mode","guarded","setup","auth","storage","machines","sync","db","wiki","app-wiki","source","ingest","reindex","search","context","proposals","web","ask","build","embeddings","providers","safety","help",...t8],p8={ls:"list",rm:"delete",edit:"update",unarchive:"restore"};function Of(_){let $=new Set,D=[];for(let U of _){let g=U.toLowerCase();if($.has(g))continue;$.add(g),D.push(U)}return D}function d8(_,$){let D=new Set((_??[]).map((U)=>U.toLowerCase()));return $.filter((U)=>!D.has(U.toLowerCase()))}function Az(_,$,D){if(D===void 0)return{..._,message:$};return{..._,added:D.length,message:`${$} (added ${D.length} tag${D.length===1?"":"s"})`}}function Af(_,$){if($===void 0)throw Error("Missing value for --tag. Example: knowledge add <title> <content> -t <tag> -t <tag>");let D=$.split(",").map((U)=>U.trim()).filter((U)=>U.length>0);if(D.length===0)throw Error(`Invalid --tag value ${JSON.stringify($)}: no tag name found. Example: knowledge add <title> <content> -t <tag> -t <tag>`);return Of([..._??[],...D])}function Lf(_){let $=[],D={},U=!1;for(let g=0;g<_.length;g+=1){let I=_[g];if(U){$.push(I);continue}if(I==="--"){U=!0;continue}if(!I.startsWith("-")||$[0]==="add"&&$.length===2&&I.startsWith("---")){$.push(I);continue}switch(I){case"--json":D.json=!0;break;case"--verbose":D.verbose=!0;break;case"--yes":case"-y":D.yes=!0;break;case"--help":case"-h":D.help=!0;break;case"--version":case"-v":D.version=!0;break;case"--desc":D.desc=!0;break;case"--page":case"-p":D.page=Number(_[g+1]),g+=1;break;case"--limit":case"-l":D.limit=Number(_[g+1]),g+=1;break;case"--search":case"-s":D.search=_[g+1],g+=1;break;case"--sort":D.sort=_[g+1],g+=1;break;case"--id":D.id=_[g+1],g+=1;break;case"--store":D.store=_[g+1],g+=1;break;case"--title":D.title=_[g+1],g+=1;break;case"--content":D.content=_[g+1],g+=1;break;case"--url":D.url=_[g+1],g+=1;break;case"--tag":case"-t":D.tag=Af(D.tag,_[g+1]),D.tagRaw=[...D.tagRaw??[],_[g+1]],g+=1;break;case"--format":D.format=_[g+1],g+=1;break;case"--completions":D.completions=_[g+1],g+=1;break;case"--purpose":D.purpose=_[g+1],g+=1;break;case"--model":D.model=_[g+1],g+=1;break;case"--strategy":D.strategy=_[g+1],g+=1;break;case"--dimensions":D.dimensions=Number(_[g+1]),g+=1;break;case"--semantic":D.semantic=!0;break;case"--context":D.context=!0;break;case"--max-tokens":D.maxTokens=Number(_[g+1]),g+=1;break;case"--max-items":D.maxItems=Number(_[g+1]),g+=1;break;case"--from":D.from=_[g+1],g+=1;break;case"--to":D.to=_[g+1],g+=1;break;case"--rev":D.rev=Number(_[g+1]),g+=1;break;case"--if-version":D.ifVersion=Number(_[g+1]),g+=1;break;case"--since":D.since=_[g+1],g+=1;break;case"--topic":D.topic=_[g+1],g+=1;break;case"--dedupe":D.dedupe=!0;break;case"--generate":D.generate=!0;break;case"--approve-write":D.approveWrite=!0;break;case"--provider":D.provider=_[g+1],g+=1;break;case"--mode":D.mode=_[g+1],g+=1;break;case"--machine":D.machine=_[g+1],g+=1;break;case"--workspace":D.workspace=_[g+1],g+=1;break;case"--api-url":D.apiUrl=_[g+1],g+=1;break;case"--canonical-example":D.canonicalExample=!0;break;case"--api-key":D.apiKey=_[g+1],g+=1;break;case"--email":D.email=_[g+1],g+=1;break;case"--org":D.org=_[g+1],g+=1;break;case"--org-id":D.orgId=_[g+1],g+=1;break;case"--user-id":D.userId=_[g+1],g+=1;break;case"--owner":D.owner=_[g+1],g+=1;break;case"--approved-by":D.approvedBy=_[g+1],g+=1;break;case"--patch-uri":D.patchUri=_[g+1],g+=1;break;case"--domain":D.domain=[...D.domain??[],_[g+1]],g+=1;break;case"--file-results":D.fileResults=!0;break;case"--full":D.full=!0;break;case"--dry-run":D.dryRun=!0;break;case"--fake":D.fake=!0;break;case"--no-tailscale":D.tailscale=!1;break;case"--no-artifact-content":D.artifactContent=!1;break;case"--no-color":D.noColor=!0;break;case"--scope":D.scope=_[g+1],g+=1;break;case"--tables":D.tables=_[g+1],g+=1;break;case"--peer-workspace":D.peerWorkspace=_[g+1],g+=1;break;case"--older-than":D.olderThan=Number(_[g+1]),g+=1;break;case"--empty":D.empty=!0;break;case"--archived":D.archived=!0;break;case"--include-archived":D.includeArchived=!0;break;case"--project":D.project=_[g+1],g+=1;break;case"--contract":D.contract=!0;break;case"--source-ref":D.sourceRef=[...D.sourceRef??[],_[g+1]],g+=1;break;case"--allow-global":D.allowGlobal=!0;break;default:throw Error(`Unknown flag: ${I}. Run 'knowledge --help' for valid options.`)}}return{positional:$,flags:D}}function Jf(_){if(!_)return"";return p8[_]??_}function Pf(_,$){let D=Array.from({length:_.length+1},()=>Array($.length+1).fill(0));for(let U=0;U<=_.length;U+=1)D[U][0]=U;for(let U=0;U<=$.length;U+=1)D[0][U]=U;for(let U=1;U<=_.length;U+=1)for(let g=1;g<=$.length;g+=1){let I=_[U-1]===$[g-1]?0:1;D[U][g]=Math.min(D[U-1][g]+1,D[U][g-1]+1,D[U-1][g-1]+I)}return D[_.length][$.length]}function zf(_){if(!_)return"";let $=[...o8,...Object.keys(p8)],D="",U=Number.POSITIVE_INFINITY;for(let g of $){let I=Pf(_,g);if(I<U)U=I,D=g}return U<=3?D:""}function Sf(){return Nf(process.argv[1]??"").replace(/\.(?:js|ts|mjs|cjs)$/,"")==="knowledge"}async function Wf(_){if(!t8.includes(_[0]??""))return!1;let $=new Q8;return $.name("knowledge").description("Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions"),c8($,{source:"knowledge"}),await $.parseAsync(_,{from:"user"}),!0}function Xf(){console.log(`knowledge - local agent knowledge store Usage: knowledge <command> [options] @@ -1381,6 +1381,7 @@ Commands: project-panel Emit Projects dashboard project-panel contract paths Show resolved workspace/store paths mode Report the resolved backend (local or cloud) and why + guarded capabilities Report FCAME-1 private transport capability setup Configure local, hosted, or canonical example S3 mode auth login|whoami|logout Manage hosted API credentials storage status|validate|repair-artifact-keys|migrate-legacy-path|merge-legacy-path|import-legacy @@ -1533,7 +1534,8 @@ Prune Options: and no request is made, so it is safe on a machine with no config and no network. Selection is EXPLICIT-ONLY: set ${o$[0]}=sqlite|postgres. Setting only ${xU[0]} / ${yU[0]} does NOT switch backends; - those are reported as present-but-ignored pointers. Env var NAMES are printed, never values.`);return}if(_==="setup"){console.log("Usage: knowledge setup --mode local|hosted [--api-url https://...] [--canonical-example] [--scope local|global|project] [--json]");return}if(_==="auth"){console.log("Usage: knowledge auth login|whoami|logout [--api-key <key>] [--email <email>] [--org <slug>] [--api-url https://...] [--scope local|global|project] [--json]");return}if(_==="storage"){console.log(`Usage: knowledge storage status|validate|repair-artifact-keys|migrate-legacy-path|merge-legacy-path [--approve-write --approved-by <name>] [--scope local|global|project] [--json] + those are reported as present-but-ignored pointers. Env var NAMES are printed, never values.`);return}if(_==="guarded"){console.log(`Usage: knowledge guarded capabilities [--json] + Reports metadata-only FCAME-1 private input, private result, and exact-title lookup support.`);return}if(_==="setup"){console.log("Usage: knowledge setup --mode local|hosted [--api-url https://...] [--canonical-example] [--scope local|global|project] [--json]");return}if(_==="auth"){console.log("Usage: knowledge auth login|whoami|logout [--api-key <key>] [--email <email>] [--org <slug>] [--api-url https://...] [--scope local|global|project] [--json]");return}if(_==="storage"){console.log(`Usage: knowledge storage status|validate|repair-artifact-keys|migrate-legacy-path|merge-legacy-path [--approve-write --approved-by <name>] [--scope local|global|project] [--json] knowledge storage import-legacy [--dry-run] [--scope global] [--json]`);return}if(_==="machines"){console.log("Usage: knowledge machines topology [--no-tailscale] | preflight [machine] [--workspace <repo>] [--scope local|global|project] [--verbose] [--json]");return}if(_==="sync"){console.log(`Usage: knowledge sync status|doctor|readiness|snapshot|machines|conflicts [show|propose|resolve] [id] | dry-run|pull|push|sync|export|import [--peer-workspace <path>] [--machine <ssh-alias>] [--tables <names>] [--dry-run] [--limit <n>] [--approve-write] [--approved-by <name>] [--strategy <name>] [--mode deterministic|ai] [--model <alias|provider:model>] [--fake] [--no-tailscale] [--scope local|global|project] [--verbose] [--json] Remote machine sync resolves peer paths through @hasna/machines when --peer-workspace is omitted.`);return}if(_==="db"){console.log("Usage: knowledge db init|stats|storage status [--scope local|global|project] [--json]");return}if(_==="wiki"){console.log("Usage: knowledge wiki init|compile|file-answer|lint [query|prompt] [--title <title>] [--content <answer>] [--approve-write] [--limit <n>] [--scope local|global|project] [--json]");return}if(_==="app-wiki"){console.log("Usage: knowledge app-wiki init | note add|get|list | source add <source-ref> | search <query> | query <query> [--title <title>] [--content <text>] [--tag <tag>] [--source-ref <uri>] [--scope project|local|global] [--allow-global] [--json]");return}if(_==="source"){console.log("Usage: knowledge source resolve <source-ref> [--purpose knowledge_answer|knowledge_index] [--limit <n>] [--scope local|global|project] [--json]");return}if(_==="ingest"){console.log("Usage: knowledge ingest manifest <file|s3://bucket/key> | source <source-ref> | rules [--workspace <path>] [--owner <name>] [--dry-run] [--max-items <n>] [--limit <n>] [--purpose knowledge_index] [--scope local|global|project] [--json]");return}if(_==="reindex"){console.log("Usage: knowledge reindex status|enqueue|embeddings|outbox [file|s3://bucket/key] [--full] [--fake] [--scope local|global|project] [--json]");return}if(_==="search"){console.log("Usage: knowledge search <query> [--context] [--semantic] [--model openai:text-embedding-3-small] [--limit <n>] [--dimensions <n>] [--fake] [--scope local|global|project] [--verbose] [--json]");return}if(_==="context"){console.log("Usage: knowledge context pack <query> [--from search|runs|loops] [--max-tokens <n>] [--max-items <n>] [--limit <n>] [--semantic] [--model openai:text-embedding-3-small] [--dimensions <n>] [--fake] [--scope local|global|project] [--verbose] [--json]");return}if(_==="proposals"){console.log("Usage: knowledge proposals context --from loops --topic <text> [--since <duration|ISO>] [--dedupe] [--max-tokens <n>] [--max-items <n>] [--scope local|global|project] [--json]");return}if(_==="web"){console.log("Usage: knowledge web search <query> [--provider openai|anthropic] [--model provider:model] [--domain <domain>] [--file-results] [--fake] [--scope local|global|project] [--verbose] [--json]");return}if(_==="ask"||_==="build"){console.log("Usage: knowledge ask|build <prompt> [--generate] [--semantic] [--model default|provider:model] [--approve-write] [--scope local|global|project] [--verbose] [--json]");return}if(_==="embeddings"){console.log("Usage: knowledge embeddings status|index|search [query] [--model openai:text-embedding-3-small] [--limit <n>] [--dimensions <n>] [--fake] [--scope local|global|project] [--verbose] [--json]");return}if(_==="providers"){console.log("Usage: knowledge providers status|models|check [provider|model-alias] [--scope local|global|project] [--json]");return}if(_==="safety"){console.log("Usage: knowledge safety status|check|approve|audit|redact [args] [--scope local|global|project] [--json]");return}if(_==="events"){console.log("Usage: knowledge events emit|list|replay [args] [--json]");return}if(_==="webhooks"){console.log("Usage: knowledge webhooks add|list|remove|test [args] [--json]");return}Xf()}function Gf(_){if(_.noColor||process.env.NO_COLOR)return!1;if(process.env.FORCE_COLOR)return!0;return process.stdout.isTTY===!0}function r(_,$,D){if($){console.log(JSON.stringify(_,null,2));return}if(typeof _==="string"){console.log(_);return}if(D?.verbose){console.log(JSON.stringify(_,null,2));return}let U=_.message;console.log(U?`${U} @@ -1555,6 +1557,6 @@ ${i_()}`:Yf(_))}function i_(_="full details"){return`Hint: use --verbose for ${_ `)}function i8(_,$){let D=[`Sync ${$} ${_.ok===!1?"needs attention":"completed"}${_.dry_run?" (dry run)":""}`],U=(g,I)=>{if(!I)return;let N=(Array.isArray(I.tables)?I.tables:[]).reduce((L,z)=>L+(z.inserted??0)+(z.updated??0)+(z.deleted??0),0),O=I.artifacts?.copied??0,A=Array.isArray(I.errors)?I.errors.length:0;D.push(`${g}: ${N} table row change(s), ${O} artifact(s), ${A} error(s)`)};if(U("pull",_.pull),U("push",_.push),Array.isArray(_.errors)&&_.errors.length>0)D.push(`Errors: ${_.errors.slice(0,3).map((g)=>D_(g,120)).join("; ")}`);return D.push(i_("per-table rows, artifacts, clocks, and errors")),D.join(` `)}function vf(_){let $=Array.isArray(_.citations)?_.citations:[],D=Array.isArray(_.context?.excerpts)?_.context.excerpts:Array.isArray(_.excerpts)?_.excerpts:[],U=[_.generated?"Generated answer with citations":"Prepared citation context draft",`Citations: ${$.length}; excerpts: ${D.length}`];if(_.answer)U.push(`Answer: ${D_(_.answer,500)}`);for(let g of $.slice(0,5))U.push(`- ${D_(g.source_uri??g.ref??g.id,120)}`);return U.push(i_("full answer payload, context, citations, and run ledger")),U.join(` `)}function ff(_,$){return[`Export preview: ${_.length} item(s) available`,"Default output is compact to avoid terminal/context bloat.","Use --verbose or --json for a JSON object, or --format jsonl for newline-delimited records.",$!=="json"?`Requested format: ${$}`:""].filter(Boolean).join(` -`)}function l8(_){return!_||_==="local"||_==="localhost"}function _0(_){if(!_.id)throw Error("Missing required --id. Example: knowledge get --id <id>")}function wf(_,$){let D=$.sort??"created";if(D!=="created"&&D!=="title")throw Error("Invalid --sort value. Use 'created' or 'title'.");let U=[..._].sort((g,I)=>{if(D==="title")return g.title.localeCompare(I.title);return g.created_at.localeCompare(I.created_at)});if($.desc)U.reverse();return{sorted:U,sort:D,direction:$.desc?"desc":"asc"}}async function uf(_){if(await Wf(_))return;let{positional:$,flags:D}=Lf(_);if($0("debug","CLI invoked",{command:$[0],flags:{json:D.json,store:D.store}}),D.version){console.log(D.json?JSON.stringify({name:C$.name,version:C$.version},null,2):`${C$.name} ${C$.version}`);return}if(D.completions){let J=D.completions;if(J==="bash")console.log('_knowledge() { local cur; cur="${COMP_WORDS[COMP_CWORD]}"; COMPREPLY=($(compgen -W "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive --json --verbose --yes --help --version --desc --page --limit --search --sort --id --store --title --content --url --tag --rev --to --format --completions --purpose --model --dimensions --semantic --context --max-tokens --max-items --from --since --topic --dedupe --generate --approve-write --provider --mode --machine --workspace --peer-workspace --api-url --canonical-example --api-key --email --org --org-id --user-id --owner --domain --file-results --full --dry-run --fake --no-tailscale --no-artifact-content --no-color --scope --tables --archived --include-archived --project --contract --source-ref --allow-global" -- "$cur")); }; complete -F _knowledge knowledge');else if(J==="zsh")console.log(`#compdef knowledge -_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"{created,title}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"{search,loops,runs}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"{local,hosted}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"{local,global,project}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`);else if(J==="fish")console.log('complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables');else throw Error("Invalid --completions value. Use 'bash', 'zsh', or 'fish'.");return}let U=Jf($[0]),g=1,I=$.length>1||/\s/.test(U);if(Sf()&&U&&!o8.includes(U)&&I)U="ask",g=0;if(!U||D.help||U==="help"){let J=U==="help"?$[1]:U||$[1];Rf(J);return}if(U==="mode"){let J=ES(process.env);r(D.json||D.verbose?{ok:!0,...J}:Qf(J),D.json,D);return}NS(process.env,{storePathOverridden:Boolean(D.store)});let j=U==="project-panel"||U==="app-wiki"?D.scope??"project":D.scope,N=IN({scope:j});if(U==="storage"){let J=$[1]??"status";if(J==="import-legacy"){if(D.scope&&D.scope!=="global")throw Error("knowledge storage import-legacy only supports --scope global because ~/.open-knowledge is a global legacy store.");let P=uN({dryRun:D.dryRun});if(r(P,D.json),!P.ok)process.exitCode=1;return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}}let O=Boolean(D.store),A=D.store;if(!A)if(j==="project"||j==="local")A=N.workspace.jsonStorePath;else A=CU();if(!O&&(U==="ask"||U==="build")&&!Y6())kD(A);let L=cU({storePath:A,storePathOverridden:O});if(U==="inventory"){let J=await N.resolveInventory({limit:D.limit,includeArchived:D.includeArchived||D.archived,storePath:Y6()?void 0:A});r(D.json||D.verbose?J:qf(J),D.json,D);return}if(U==="project-panel"){let J=D.project??$[1];if(!J)throw Error("Usage: knowledge project-panel --project <id|name|slug> [--json|--contract]");let P=await pG(J,{service:N,limit:D.limit,storePath:Y6()?void 0:A,includeArchived:D.includeArchived||D.archived});r(D.json||D.contract?P:eG(P),D.json||D.contract);return}if(U==="paths"){let J=N.paths();r(D.json||D.verbose?J:Tf(J),D.json,D);return}if(U==="setup"){let J=N.setup({mode:D.mode,apiUrl:D.apiUrl,canonicalExample:D.canonicalExample});r(J,D.json,D);return}if(U==="auth"){let J=$[1]??"whoami";if(J==="whoami"||J==="status"){let P=N.authStatus(process.env);r({ok:!0,...P,message:P.authenticated?`Authenticated via ${P.source}`:"Not authenticated"},D.json,D);return}if(J==="login"){let P=D.apiKey??process.env.KNOWLEDGE_API_KEY??process.env.HASNA_KNOWLEDGE_API_KEY;if(!P)throw Error("Usage: knowledge auth login --api-key <key> [--email <email>]");let S=N.saveAuth({apiKey:P,email:D.email,orgSlug:D.org,orgId:D.orgId,userId:D.userId,apiUrl:D.apiUrl},process.env);r({ok:!0,authenticated:!0,email:S.email??null,org_slug:S.org_slug??null,api_url:S.api_url??N.authStatus(process.env).api_url,auth_path:N.authStatus(process.env).auth_path,message:`Saved hosted credentials for ${S.email??"API key"}`},D.json,D);return}if(J==="logout"){let P=N.clearAuth(process.env);r({ok:!0,removed:P,message:P?"Removed hosted credentials":"No hosted credentials found"},D.json,D);return}throw Error("Invalid auth action. Use 'login', 'whoami', or 'logout'.")}if(U==="storage"){let J=$[1]??"status";if(J==="status"){let P=N.storageContract(),S=N.validateStorage();r({ok:S.ok,...P,validation:S,message:`${P.storage_type} artifact storage at ${P.artifact_store.uri_prefix}`},D.json,D);return}if(J==="validate"){let P=N.validateStorage();if(r({ok:P.ok,validation:P,message:P.ok?"Storage contract valid":`Storage contract invalid: ${P.errors.join("; ")}`},D.json,D),!P.ok)process.exitCode=1;return}if(J==="repair-artifact-keys"||J==="repair-keys"){let P=N.repairArtifactManifestKeys({approveWrite:D.approveWrite,approvedBy:D.approvedBy,dryRun:D.dryRun});r(P,D.json,D);return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid storage action. Use 'status', 'validate', 'repair-artifact-keys', 'migrate-legacy-path', 'merge-legacy-path', or 'import-legacy'.")}if(U==="machines"){let J=$[1]??"topology";if(J==="topology"||J==="status"){let P=await N.machineTopology({includeTailscale:D.tailscale!==!1});r(D.json||D.verbose?P:Mf(P),D.json,D);return}if(J==="preflight"||J==="check"){let P=$[2]??D.machine??"local",S=D.workspace??process.cwd(),X=await N.machinePreflight({machineId:P,commands:[{command:"bun",required:!0},{command:"knowledge",required:!0}],packages:[{name:C$.name,command:"knowledge",expectedVersion:C$.version,required:!0},{name:"@hasna/machines",command:"machines",required:!1}],workspaces:[{label:"open-knowledge",path:S,expectedPackageName:C$.name,expectedVersion:C$.version,required:!0}]});if(r(D.json||D.verbose?X:Zf(X),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid machines action. Use 'topology' or 'preflight'.")}if(U==="sync"){let J=$[1]??"status",P=D.tables?D.tables.split(",").map((S)=>S.trim()).filter(Boolean):void 0;if(J==="status"){let S=N.syncStatus();r(D.json||D.verbose?S:bf(S),D.json,D);return}if(J==="doctor"||J==="readiness"||J==="preflight"){let S=await N.syncDoctor({machine:D.machine??null,peerWorkspace:D.peerWorkspace??null,includeTailscale:D.tailscale!==!1,tables:P}),X={package:{name:C$.name,version:C$.version},...S};if(r(D.json||D.verbose?X:Hf(X),D.json,D),!S.ok&&!D.json)process.exitCode=1;return}if(J==="snapshot"||J==="record"){let S=await N.createSyncSnapshot({includeTailscale:D.tailscale!==!1,machineId:D.machine});r(D.json||D.verbose?S:kf(S),D.json,D);return}if(J==="conflicts"||J==="conflict"){let S=$[2];if(S==="show"||S==="get"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts show <id>");let V=N.syncConflict(R);r({ok:!0,conflict:V,message:`Sync conflict ${R}`},D.json,D);return}if(S==="propose"||S==="proposal"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts propose <id>");r(D.mode==="ai"?await N.proposeSyncConflictResolutionWithAi({id:R,modelRef:D.model,fake:D.fake}):N.proposeSyncConflictResolution(R),D.json,D);return}if(S==="resolve"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts resolve <id> --approve-write --approved-by <name> [--strategy <name>]");let V=N.resolveSyncConflict({id:R,strategy:D.strategy,approvedBy:D.approvedBy,approveWrite:D.approveWrite,proposedPatchUri:D.patchUri});if(r(V,D.json,D),!V.ok&&!D.json)process.exitCode=1;return}let X=N.syncConflicts({status:S,limit:D.limit}),G={ok:!0,conflicts:X,message:`${X.length} sync conflict(s)`};r(D.json||D.verbose?G:Cf(G),D.json,D);return}if(J==="machines"||J==="registry"){let S=N.syncMachines(),X={ok:!0,machines:S,message:`${S.length} registered sync machine(s)`};r(D.json||D.verbose?X:rf(X),D.json,D);return}if(J==="export"){let S=N.exportSyncBundle({machineId:D.machine??null,tables:P,includeArtifactContent:D.artifactContent!==!1});r(S,!0);return}if(J==="import"){let S=await Bun.stdin.text();if(!S.trim())throw Error("Usage: knowledge sync import < bundle.json");let X=await N.importSyncBundle({bundle:JSON.parse(S),dryRun:D.dryRun,direction:"import",machineId:D.machine??null});r(D.json||D.verbose?X:i8(X,J),D.json,D);return}if(J==="dry-run"||J==="pull"||J==="push"||J==="sync"){if(!D.peerWorkspace&&l8(D.machine))throw Error(`Usage: knowledge sync ${J} --peer-workspace <repo-or-knowledge-home> [--scope project] +`)}function l8(_){return!_||_==="local"||_==="localhost"}function _0(_){if(!_.id)throw Error("Missing required --id. Example: knowledge get --id <id>")}function wf(_,$){let D=$.sort??"created";if(D!=="created"&&D!=="title")throw Error("Invalid --sort value. Use 'created' or 'title'.");let U=[..._].sort((g,I)=>{if(D==="title")return g.title.localeCompare(I.title);return g.created_at.localeCompare(I.created_at)});if($.desc)U.reverse();return{sorted:U,sort:D,direction:$.desc?"desc":"asc"}}async function uf(_){if(await Wf(_))return;let{positional:$,flags:D}=Lf(_);if($0("debug","CLI invoked",{command:$[0],flags:{json:D.json,store:D.store}}),D.version){console.log(D.json?JSON.stringify({name:C$.name,version:C$.version},null,2):`${C$.name} ${C$.version}`);return}if(D.completions){let J=D.completions;if(J==="bash")console.log('_knowledge() { local cur; cur="${COMP_WORDS[COMP_CWORD]}"; COMPREPLY=($(compgen -W "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive --json --verbose --yes --help --version --desc --page --limit --search --sort --id --store --title --content --url --tag --rev --to --format --completions --purpose --model --dimensions --semantic --context --max-tokens --max-items --from --since --topic --dedupe --generate --approve-write --provider --mode --machine --workspace --peer-workspace --api-url --canonical-example --api-key --email --org --org-id --user-id --owner --domain --file-results --full --dry-run --fake --no-tailscale --no-artifact-content --no-color --scope --tables --archived --include-archived --project --contract --source-ref --allow-global" -- "$cur")); }; complete -F _knowledge knowledge');else if(J==="zsh")console.log(`#compdef knowledge +_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"{created,title}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"{search,loops,runs}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"{local,hosted}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"{local,global,project}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`);else if(J==="fish")console.log('complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables');else throw Error("Invalid --completions value. Use 'bash', 'zsh', or 'fish'.");return}let U=Jf($[0]),g=1,I=$.length>1||/\s/.test(U);if(Sf()&&U&&!o8.includes(U)&&I)U="ask",g=0;if(!U||D.help||U==="help"){let J=U==="help"?$[1]:U||$[1];Rf(J);return}if(U==="mode"){let J=ES(process.env);r(D.json||D.verbose?{ok:!0,...J}:Qf(J),D.json,D);return}if(U==="guarded"){if(($[1]??"capabilities")!=="capabilities")throw Error("Usage: knowledge guarded capabilities [--json]");r({ok:!0,contract:"FCAME-1",private_input:!0,private_result:!0,exact_title_lookup:!0,public_body_output:!1},D.json,D);return}NS(process.env,{storePathOverridden:Boolean(D.store)});let j=U==="project-panel"||U==="app-wiki"?D.scope??"project":D.scope,N=IN({scope:j});if(U==="storage"){let J=$[1]??"status";if(J==="import-legacy"){if(D.scope&&D.scope!=="global")throw Error("knowledge storage import-legacy only supports --scope global because ~/.open-knowledge is a global legacy store.");let P=uN({dryRun:D.dryRun});if(r(P,D.json),!P.ok)process.exitCode=1;return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}}let O=Boolean(D.store),A=D.store;if(!A)if(j==="project"||j==="local")A=N.workspace.jsonStorePath;else A=CU();if(!O&&(U==="ask"||U==="build")&&!Y6())kD(A);let L=cU({storePath:A,storePathOverridden:O});if(U==="inventory"){let J=await N.resolveInventory({limit:D.limit,includeArchived:D.includeArchived||D.archived,storePath:Y6()?void 0:A});r(D.json||D.verbose?J:qf(J),D.json,D);return}if(U==="project-panel"){let J=D.project??$[1];if(!J)throw Error("Usage: knowledge project-panel --project <id|name|slug> [--json|--contract]");let P=await p9(J,{service:N,limit:D.limit,storePath:Y6()?void 0:A,includeArchived:D.includeArchived||D.archived});r(D.json||D.contract?P:e9(P),D.json||D.contract);return}if(U==="paths"){let J=N.paths();r(D.json||D.verbose?J:Tf(J),D.json,D);return}if(U==="setup"){let J=N.setup({mode:D.mode,apiUrl:D.apiUrl,canonicalExample:D.canonicalExample});r(J,D.json,D);return}if(U==="auth"){let J=$[1]??"whoami";if(J==="whoami"||J==="status"){let P=N.authStatus(process.env);r({ok:!0,...P,message:P.authenticated?`Authenticated via ${P.source}`:"Not authenticated"},D.json,D);return}if(J==="login"){let P=D.apiKey??process.env.KNOWLEDGE_API_KEY??process.env.HASNA_KNOWLEDGE_API_KEY;if(!P)throw Error("Usage: knowledge auth login --api-key <key> [--email <email>]");let S=N.saveAuth({apiKey:P,email:D.email,orgSlug:D.org,orgId:D.orgId,userId:D.userId,apiUrl:D.apiUrl},process.env);r({ok:!0,authenticated:!0,email:S.email??null,org_slug:S.org_slug??null,api_url:S.api_url??N.authStatus(process.env).api_url,auth_path:N.authStatus(process.env).auth_path,message:`Saved hosted credentials for ${S.email??"API key"}`},D.json,D);return}if(J==="logout"){let P=N.clearAuth(process.env);r({ok:!0,removed:P,message:P?"Removed hosted credentials":"No hosted credentials found"},D.json,D);return}throw Error("Invalid auth action. Use 'login', 'whoami', or 'logout'.")}if(U==="storage"){let J=$[1]??"status";if(J==="status"){let P=N.storageContract(),S=N.validateStorage();r({ok:S.ok,...P,validation:S,message:`${P.storage_type} artifact storage at ${P.artifact_store.uri_prefix}`},D.json,D);return}if(J==="validate"){let P=N.validateStorage();if(r({ok:P.ok,validation:P,message:P.ok?"Storage contract valid":`Storage contract invalid: ${P.errors.join("; ")}`},D.json,D),!P.ok)process.exitCode=1;return}if(J==="repair-artifact-keys"||J==="repair-keys"){let P=N.repairArtifactManifestKeys({approveWrite:D.approveWrite,approvedBy:D.approvedBy,dryRun:D.dryRun});r(P,D.json,D);return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid storage action. Use 'status', 'validate', 'repair-artifact-keys', 'migrate-legacy-path', 'merge-legacy-path', or 'import-legacy'.")}if(U==="machines"){let J=$[1]??"topology";if(J==="topology"||J==="status"){let P=await N.machineTopology({includeTailscale:D.tailscale!==!1});r(D.json||D.verbose?P:Mf(P),D.json,D);return}if(J==="preflight"||J==="check"){let P=$[2]??D.machine??"local",S=D.workspace??process.cwd(),X=await N.machinePreflight({machineId:P,commands:[{command:"bun",required:!0},{command:"knowledge",required:!0}],packages:[{name:C$.name,command:"knowledge",expectedVersion:C$.version,required:!0},{name:"@hasna/machines",command:"machines",required:!1}],workspaces:[{label:"open-knowledge",path:S,expectedPackageName:C$.name,expectedVersion:C$.version,required:!0}]});if(r(D.json||D.verbose?X:Zf(X),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid machines action. Use 'topology' or 'preflight'.")}if(U==="sync"){let J=$[1]??"status",P=D.tables?D.tables.split(",").map((S)=>S.trim()).filter(Boolean):void 0;if(J==="status"){let S=N.syncStatus();r(D.json||D.verbose?S:bf(S),D.json,D);return}if(J==="doctor"||J==="readiness"||J==="preflight"){let S=await N.syncDoctor({machine:D.machine??null,peerWorkspace:D.peerWorkspace??null,includeTailscale:D.tailscale!==!1,tables:P}),X={package:{name:C$.name,version:C$.version},...S};if(r(D.json||D.verbose?X:Hf(X),D.json,D),!S.ok&&!D.json)process.exitCode=1;return}if(J==="snapshot"||J==="record"){let S=await N.createSyncSnapshot({includeTailscale:D.tailscale!==!1,machineId:D.machine});r(D.json||D.verbose?S:kf(S),D.json,D);return}if(J==="conflicts"||J==="conflict"){let S=$[2];if(S==="show"||S==="get"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts show <id>");let V=N.syncConflict(R);r({ok:!0,conflict:V,message:`Sync conflict ${R}`},D.json,D);return}if(S==="propose"||S==="proposal"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts propose <id>");r(D.mode==="ai"?await N.proposeSyncConflictResolutionWithAi({id:R,modelRef:D.model,fake:D.fake}):N.proposeSyncConflictResolution(R),D.json,D);return}if(S==="resolve"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts resolve <id> --approve-write --approved-by <name> [--strategy <name>]");let V=N.resolveSyncConflict({id:R,strategy:D.strategy,approvedBy:D.approvedBy,approveWrite:D.approveWrite,proposedPatchUri:D.patchUri});if(r(V,D.json,D),!V.ok&&!D.json)process.exitCode=1;return}let X=N.syncConflicts({status:S,limit:D.limit}),G={ok:!0,conflicts:X,message:`${X.length} sync conflict(s)`};r(D.json||D.verbose?G:Cf(G),D.json,D);return}if(J==="machines"||J==="registry"){let S=N.syncMachines(),X={ok:!0,machines:S,message:`${S.length} registered sync machine(s)`};r(D.json||D.verbose?X:rf(X),D.json,D);return}if(J==="export"){let S=N.exportSyncBundle({machineId:D.machine??null,tables:P,includeArtifactContent:D.artifactContent!==!1});r(S,!0);return}if(J==="import"){let S=await Bun.stdin.text();if(!S.trim())throw Error("Usage: knowledge sync import < bundle.json");let X=await N.importSyncBundle({bundle:JSON.parse(S),dryRun:D.dryRun,direction:"import",machineId:D.machine??null});r(D.json||D.verbose?X:i8(X,J),D.json,D);return}if(J==="dry-run"||J==="pull"||J==="push"||J==="sync"){if(!D.peerWorkspace&&l8(D.machine))throw Error(`Usage: knowledge sync ${J} --peer-workspace <repo-or-knowledge-home> [--scope project] Remote machine sync can omit --peer-workspace when machines path mapping is configured.`);let S=J==="dry-run"?"both":J==="sync"?"both":J,X=!l8(D.machine)?await N.syncRemotePeer({direction:S,machine:D.machine,peerWorkspace:D.peerWorkspace,tables:P,dryRun:D.dryRun===!0||J==="dry-run",includeArtifactContent:D.artifactContent!==!1,includeTailscale:D.tailscale!==!1}):await N.syncPeer({peerWorkspace:D.peerWorkspace,direction:S,dryRun:D.dryRun===!0||J==="dry-run",tables:P,includeArtifactContent:D.artifactContent!==!1,machineId:D.machine??null});if(r(D.json||D.verbose?X:i8(X,J),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid sync action. Use 'status', 'doctor', 'snapshot', 'conflicts', 'machines', 'dry-run', 'pull', 'push', 'sync', 'export', or 'import'.")}if(U==="db"){let J=$[1]??"init";if(J==="init"){let P=N.initDb();r({ok:!0,...P,message:`Initialized ${P.path}`},D.json,D);return}if(J==="stats"){let P=N.dbStats();r({ok:!0,path:N.workspace.knowledgeDbPath,...P,message:`knowledge.db schema v${P.schema_version}`},D.json,D);return}if(J==="storage"){if(($[2]??"status")==="status"){let S=o3({scope:D.scope});r({ok:!0,...S,message:`knowledge.db storage mode ${S.mode}`},D.json,D);return}throw Error("Invalid db storage action. Only 'status' is supported. The 'push'/'pull'/'sync' Postgres sync commands were removed (DSN-on-client is forbidden); use the cloud API flip instead.")}throw Error("Invalid db action. Use 'init', 'stats', or 'storage'.")}if(U==="app-wiki"){let J=$[1]??"init";if(J==="paths"||J==="status"){r({ok:!0,standard:"hasna-app-wiki.v1",default_scope:"project",global_writes_require:"--allow-global",...N.paths()},D.json);return}if(J==="init"||J==="open"){let P=await N.initAppWiki({allowGlobal:D.allowGlobal});r(P,D.json);return}if(J==="note"||J==="notes"){let P=$[2]??"list";if(P==="add"||P==="create"){let S=D.title??$[3],X=D.content??$.slice(4).join(" ");if(!S||!X)throw Error("Usage: knowledge app-wiki note add --title <title> --content <text> [--source-ref <uri>]");let G=await N.addAppWikiNote({title:S,content:X,tags:D.tag,sourceRefs:D.sourceRef,allowGlobal:D.allowGlobal});r(G,D.json);return}if(P==="list"||P==="ls"){let S=N.listAppWikiNotes({limit:D.limit});r({ok:!0,scope:N.scope,home:N.workspace.home,notes:S,message:`${S.length} app wiki note(s)`},D.json);return}if(P==="get"||P==="show"){let S=$[3]??D.id;if(!S)throw Error("Usage: knowledge app-wiki note get <id-or-path>");let X=await N.getAppWikiNote(S,{includeContent:!0});if(!X)throw Error(`App wiki note not found: ${S}`);r(X,D.json);return}throw Error("Invalid app-wiki note action. Use 'add', 'list', or 'get'.")}if(J==="source"||J==="sources"){let P=$[2]??"add";if(P!=="add"&&P!=="ingest")throw Error("Invalid app-wiki source action. Use 'add'.");let S=$[3]??D.sourceRef?.[0];if(!S)throw Error("Usage: knowledge app-wiki source add <source-ref>");let X=await N.addAppWikiSourceRef({sourceRef:S,purpose:D.purpose,allowGlobal:D.allowGlobal});r({ok:!0,...X,message:`Added app wiki source ${X.source_ref}`},D.json);return}if(J==="search"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge app-wiki search <query>");let S=await N.searchAppWiki({query:P,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S,message:`${S.results.length} app wiki result(s)`},D.json);return}if(J==="query"||J==="context"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge app-wiki query <query>");let S=await N.queryAppWiki({query:P,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S,message:`${S.excerpts.length} app wiki excerpt(s)`},D.json);return}throw Error("Invalid app-wiki action. Use 'init', 'paths', 'note', 'source', 'search', or 'query'.")}if(U==="wiki"){let J=$[1]??"init";if(J==="init"){let P=await N.initWiki();r({ok:!0,...P,message:`Initialized wiki layout in ${N.workspace.home}`},D.json,D);return}if(J==="compile"){let P=$.slice(2),S=P.filter((R)=>/^(open-files|file|s3|https?):\/\//.test(R)),X=P.filter((R)=>!/^(open-files|file|s3|https?):\/\//.test(R)).join(" "),G=await N.compileWiki({title:D.title,query:X||D.search,sourceRefs:S.length>0?S:void 0,limit:D.limit});r({ok:!0,...G,message:`Compiled wiki page ${G.path}`},D.json,D);return}if(J==="file-answer"||J==="answer"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge wiki file-answer <prompt> --content <answer> --approve-write");if(!D.content)throw Error("Missing --content <answer> for wiki file-answer.");let S=await N.fileAnswer({prompt:P,answer:D.content,approveWrite:D.approveWrite,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S},D.json,D);return}if(J==="lint"){let P=N.lintWiki();r({ok:P.ok,...P,message:P.ok?"Wiki lint passed":`Wiki lint found ${P.issue_count} issue(s)`},D.json,D);return}throw Error("Invalid wiki action. Use 'init', 'compile', 'file-answer', or 'lint'.")}if(U==="safety"){let J=$[1]??"status",P=N.ensureWorkspace(),S=N.safetyPolicy();N.initDb();let X=v(P.knowledgeDbPath);try{if(J==="status"){r({ok:!0,mode:S.mode,workspace:P.home,allow_write_roots:S.allowWriteRoots,read_only_source_access:S.readOnlySourceAccess,network:S.network,redaction:S.redaction,approvals:S.approvals,message:`Safety policy: ${S.mode}`},D.json,D);return}if(J==="check"){let G=$[2]??"generated_write",R=$[3]??null,V;try{if(G==="web_search")P0(S),V={action:G,target_uri:R,approval_required:!1,approved:!0,decision:"allow"};else if(G==="s3_read"){if(!R)throw Error("safety check s3_read requires an s3:// target.");q6(R,S),V={action:G,target_uri:R,approval_required:!1,approved:!0,decision:"allow"}}else V=cS(X,S,G,R);X_(X,{event_type:"safety_check",action:G,target_uri:R,decision:V.decision==="allow"?"allow":"requires_approval",metadata:V}),r({ok:!0,...V,message:`Safety check ${V.decision}`},D.json,D);return}catch(Q){throw X_(X,{event_type:"safety_check",action:G,target_uri:R,decision:"deny",metadata:{error:Q instanceof Error?Q.message:String(Q)}}),Q}}if(J==="approve"){let G=$[2]??"generated_write",R=$[3]??null,V=iU(X,{action:G,target_uri:R,reason:"local-cli approval",metadata:{scope:D.scope??"global"}});X_(X,{event_type:"approval",action:G,target_uri:R,decision:"allow",metadata:{approval_id:V.id}}),r({ok:!0,...V,action:G,target_uri:R,message:`Approved ${G}`},D.json,D);return}if(J==="audit"){let G=X.query("SELECT id, event_type, action, target_uri, decision, metadata_json, created_at FROM audit_events ORDER BY created_at DESC LIMIT 50").all().map((R)=>({id:R.id,event_type:R.event_type,action:R.action,target_uri:R.target_uri,decision:R.decision,metadata:JSON.parse(R.metadata_json),created_at:R.created_at}));r({ok:!0,events:G,message:`${G.length} audit event(s)`},D.json,D);return}if(J==="redact"){let G=$.slice(2).join(" ");if(!G)throw Error("Usage: knowledge safety redact <text>");let R=u_(G,S);if(R.findings.length>0)z0(X,{source_uri:"safety://redact",findings:R.findings,metadata:{command:"safety redact"}});X_(X,{event_type:"redaction",action:"safety_redact",target_uri:"safety://redact",decision:R.findings.length>0?"redacted":"allow",metadata:{findings:R.findings.length}}),r({ok:!0,text:R.text,findings:R.findings,message:`Redacted ${R.findings.length} finding(s)`},D.json,D);return}throw Error("Invalid safety action. Use 'status', 'check', 'approve', 'audit', or 'redact'.")}finally{X.close()}}if(U==="source"){if(($[1]??"")!=="resolve")throw Error("Invalid source action. Use 'resolve'.");let P=$[2];if(!P)throw Error("Usage: knowledge source resolve <source-ref>");let S=await N.resolveSource(P,{purpose:D.purpose,limit:D.limit});r({ok:!0,...S,message:S.resolved?`Resolved ${S.source_ref} (${S.content.chunks_returned}/${S.content.chunks_total} chunks)`:`Source not indexed: ${P}`},D.json,D);return}if(U==="ingest"){let J=$[1]??"";if(J==="rules"||J==="global-rules"||J==="agent-rules"){let P=await N.importRulesProvenance({root:D.workspace??process.cwd(),owner:D.owner,dryRun:D.dryRun===!0,maxItems:D.maxItems,limit:D.limit});r({ok:!0,...P},D.json);return}if(J==="manifest"){let P=$[2];if(!P)throw Error("Usage: knowledge ingest manifest <file|s3://bucket/key>");let S=await N.ingestManifest(P);r({ok:!0,...S,message:`Ingested ${S.items_seen} manifest item(s)`},D.json,D);return}if(J==="source"){let P=$[2];if(!P)throw Error("Usage: knowledge ingest source <source-ref>");let S=await N.ingestSource(P,D.purpose);r({ok:!0,...S,message:`Ingested source ${S.source_ref} (${S.chunks_inserted} chunks)`},D.json,D);return}throw Error("Invalid ingest action. Use 'manifest' or 'source'.")}if(U==="reindex"){let J=$[1]??"status";if(J==="status"){let P=N.reindexHealth({modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`${P.missing_embeddings} chunk(s) missing embeddings`},D.json,D);return}if(J==="enqueue"){let P=N.enqueueReindex({modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Queued ${P.enqueued} embedding refresh item(s)`},D.json,D);return}if(J==="embeddings"){let P=await N.refreshEmbeddings({full:D.full,limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Embedded ${P.indexed.chunks_embedded} chunk(s)`},D.json,D);return}if(J==="outbox"){let P=$[2];if(!P)throw Error("Usage: knowledge reindex outbox <file|s3://bucket/key>");let S=await N.consumeOutbox(P);r({ok:!0,...S,message:`Consumed ${S.events_seen} outbox event(s)`},D.json,D);return}throw Error("Invalid reindex action. Use 'status', 'enqueue', 'embeddings', or 'outbox'.")}if(U==="embeddings"){let J=$[1]??"status";if(J==="status"){let P=N.embeddingStatus();r({ok:!0,...P,message:`${P.total_vector_entries} vector index entries`},D.json,D);return}if(J==="index"){let P=await N.indexEmbeddings({limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Embedded ${P.chunks_embedded} chunk(s)`},D.json,D);return}if(J==="search"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge embeddings search <query>");let S=await N.semanticSearch({query:P,limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake}),X={ok:!0,...S,message:`${S.results.length} semantic result(s)`};r(D.json||D.verbose?X:Kf(X),D.json,D);return}throw Error("Invalid embeddings action. Use 'status', 'index', or 'search'.")}if(U==="context"){if(($[1]??"pack")!=="pack")throw Error("Invalid context action. Use 'pack'.");let P=D.from??"search";if(!["search","loops","runs"].includes(P))throw Error("Invalid --from value. Use 'search', 'loops', or 'runs'.");let S=$.slice(2).join(" ")||D.topic||"",X=await N.contextPack({source:P,purpose:P==="loops"||P==="runs"?"proposal":"agent_context",query:S,topic:D.topic,since:D.since,dedupe:D.dedupe,maxTokens:D.maxTokens,maxItems:D.maxItems,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A});m8({ok:!0,...X,message:X.message});return}if(U==="proposals"){if(($[1]??"context")!=="context")throw Error("Invalid proposals action. Use 'context'.");let P=D.from??"loops";if(!["loops","runs"].includes(P))throw Error("Invalid --from value for proposals. Use 'loops' or 'runs'.");let S=D.topic??$.slice(2).join(" ");if(!S.trim())throw Error("Usage: knowledge proposals context --from loops --topic <text>");let X=await N.contextPack({source:P,purpose:"proposal",query:S,topic:S,since:D.since,dedupe:D.dedupe??!0,maxTokens:D.maxTokens,maxItems:D.maxItems,limit:D.limit});m8({ok:!0,...X,message:X.message});return}if(U==="search"){let J=$.slice(1).join(" ");if(!J)throw Error("Usage: knowledge search <query>");if(D.context){let X=await N.retrieveContext({query:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A}),G={ok:!0,...X,message:`${X.excerpts.length} context excerpt(s)`};r(D.json||D.verbose?G:Vf(G),D.json,D);return}let P=await N.search({query:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A}),S={ok:!0,...P,message:`${P.results.length} search result(s)`};r(D.json||D.verbose?S:Bf(S),D.json,D);return}if(U==="web"){if(($[1]??"search")!=="search")throw Error("Invalid web action. Use 'search'.");let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge web search <query>");let S=await N.webSearch({query:P,limit:D.limit,modelRef:D.model,provider:D.provider,domains:D.domain,fake:D.fake,fileResults:D.fileResults}),X={ok:!0,...S,message:`${S.sources.length} web source(s)`};r(D.json||D.verbose?X:Ff(X),D.json,D);return}if(U==="ask"||U==="build"){let J=$.slice(g).join(" ");if(!J)throw Error("Usage: knowledge ask <prompt>");let P=await N.runPrompt({prompt:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,generate:D.generate,approveWrite:D.approveWrite,legacyStorePath:A}),S={ok:!0,...P,message:P.generated?"Generated answer with citations":"Prepared citation context draft"};r(D.json||D.verbose?S:vf(S),D.json,D);return}if(U==="providers"){let J=$[1]??"status";if(J==="status"){let P=N.providerStatus(),S=P.providers.filter((X)=>X.configured).length;r({ok:!0,...P,message:`${S}/${P.providers.length} provider credential(s) configured`},D.json,D);return}if(J==="models"){let P=N.modelRegistry();r({ok:!0,models:P,message:`${P.length} model alias(es)`},D.json,D);return}if(J==="check"){let P=$[2]??"default",S=G$(P,N.config()),X=f_(S),G=g4(X.provider,N.config());r({ok:!0,target:P,model_ref:S,provider:X.provider,model:X.model,credential:G,message:`${X.provider} credentials configured`},D.json,D);return}throw Error("Invalid providers action. Use 'status', 'models', or 'check'.")}if(U==="add"){let J=$[1],P=$[2];if(!J||!P)throw Error("Usage: knowledge add <title> <content>");let S=await L.create({title:J,content:P,url:D.url??null,tags:D.tag??[]});$0("info","Item added",{id:S.id,title:S.title,tags:S.tags?.length??0,transport:L.kind}),r({ok:!0,item:S,message:`Added ${S.id}`},D.json,D);return}if(U==="list"){if(D.format!==void 0&&D.format!=="table"&&D.format!=="json")throw Error("Invalid --format value for list. Use 'table' or 'json'.");let J=await L.listAll(),P=Number.isFinite(D.page)&&D.page>0?D.page:1,S=Number.isFinite(D.limit)&&D.limit>0?D.limit:20,X=D.search?String(D.search).toLowerCase():"",G=(D.tagRaw??D.tag??[]).map((a)=>({whole:a.trim().toLowerCase(),parts:a.split(",").map((r_)=>r_.trim().toLowerCase()).filter((r_)=>r_.length>0)})),R=D.tag?.length?D.tag.map((a)=>a.toLowerCase()).join(","):"none",V=D.format==="table"||!D.json&&!D.format&&Gf(D),Q=D.json||D.format==="json",T=J.items;if(D.archived)T=T.filter((a)=>a.archived===!0);else if(!D.includeArchived)T=T.filter((a)=>!a.archived);if(X)T=T.filter((a)=>Vz(a,X));if(G.length>0)T=T.filter((a)=>{let r_=new Set((a.tags??[]).map((V_)=>V_.toLowerCase()));return G.every(({whole:V_,parts:G_})=>V_.length>0&&r_.has(V_)||G_.every((H_)=>r_.has(H_)))});let{sorted:q,sort:K,direction:Z}=wf(T,D),e=(P-1)*S,g_=q.slice(e,e+S),I_=Math.max(1,Math.ceil(q.length/S)),J_={ok:!0,page:P,limit:S,total:q.length,total_pages:I_,sort:K,direction:Z,items:g_,store_exists:J.exists};if(Q){r(J_,!0);return}if(D.verbose){r(J_,!1,D);return}if(g_.length===0){r(`No items found (search=${X||"none"}, tag=${R})`,!1);return}if(V){let a=(V_)=>V_,r_=`${a("ID")} ${a("TITLE")} ${a("CREATED")} ${a("URL")} ${a("TAGS")}`;console.log(r_);for(let V_ of g_)console.log(`${V_.id} ${a(D_(V_.title,80))} ${V_.created_at} ${V_.url?a(D_(V_.url,90)):""} ${V_.tags?.length?a(D_(`[${V_.tags.join(", ")}]`,80)):""}`);console.log(`Page ${P}/${I_} | showing ${g_.length} of ${q.length} | sort=${K} ${Z} | search=${X||"none"} | tag=${R}`),console.log("Hint: use `knowledge get --id <id> --json` for full item content.")}else{for(let a of g_)console.log(`${a.id} ${D_(a.title,80)} ${a.created_at}${a.url?` ${D_(a.url,90)}`:""}${a.tags?.length?` ${D_(`[${a.tags.join(", ")}]`,80)}`:""}`);console.log(`Page ${P}/${I_} | showing ${g_.length} of ${q.length} | sort=${K} ${Z} | search=${X||"none"} | tag=${R}`),console.log("Hint: use `knowledge get --id <id> --json` for full item content.")}return}if(U==="get"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);r({ok:!0,item:J,store_exists:L.exists,message:`${J.id}: ${J.title}`},D.json,D);return}if(U==="versions"){_0(D);let J=Number.isFinite(D.page)&&D.page>0?D.page:1,P=Number.isFinite(D.limit)&&D.limit>0?D.limit:void 0,S=await L.listVersions(D.id,{limit:P,offset:(J-1)*(P??50)});if(!S)throw Error(`Item not found: ${D.id}`);let X={ok:!0,id:S.item_id,current_version:S.current_version,total:S.total,page:J,store:L.location,versions:S.items,message:S.total===0?`${S.item_id} is at version ${S.current_version} with no retained prior versions`:`${S.item_id} is at version ${S.current_version}; ${S.total} prior version(s) retained`};if(D.json||D.verbose){r(X,D.json,D);return}console.log(X.message);for(let G of S.items){let R=G.actor?` by ${G.actor}`:"",V=G.reason?` (${G.reason})`:"";console.log(`v${G.version} ${G.valid_to}${R}${V} ${G.content_bytes} bytes ${G.content_hash.slice(0,12)}`)}if(S.items.length>0)console.log("Hint: `knowledge diff --id <id> --rev <n>` shows what changed.");return}if(U==="diff"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);if(D.rev!==void 0&&(D.from!==void 0||D.to!==void 0))throw Error("Use either --rev <n> or --from <a> --to <b>, not both.");let P=()=>({title:J.title,content:J.content,url:J.url,tags:J.tags??[],metadata:J.metadata??{},archived:J.archived??!1}),S=`v${J.version??"?"} (current)`,X=async(q)=>{if(q==="current")return{label:S,snapshot:P()};let K=Number(q);if(!Number.isInteger(K)||K<1)throw Error(`Not a version number: ${q}`);if(J.version!==void 0&&K===J.version)return{label:S,snapshot:P()};let Z=await L.getVersion(J.id,K);if(!Z)throw Error(`No version ${K} retained for ${J.id} (it is at version ${J.version??"?"}). Run \`knowledge versions --id <id>\` to see what is retained.`);return{label:`v${Z.version}`,snapshot:{title:Z.title,content:Z.content,url:Z.url,tags:Z.tags,metadata:Z.metadata,archived:Z.archived}}},G,R;if(D.rev!==void 0){if(!Number.isInteger(D.rev)||D.rev<1)throw Error("--rev must be a positive version number.");if(D.rev===1)throw Error("Version 1 has no predecessor to diff against.");G=String(D.rev-1),R=String(D.rev)}else if(D.from!==void 0||D.to!==void 0){if(D.from===void 0||D.to===void 0)throw Error("--from and --to must be given together.");G=D.from,R=D.to}else{let q=await L.listVersions(J.id,{limit:1});if(!q)throw Error(`Item not found: ${D.id}`);if(q.items.length===0)throw Error(`${J.id} is at version ${q.current_version} with no retained prior versions to diff against.`);G=String(q.items[0].version),R="current"}let V=await X(G),Q=await X(R),T=PS(V.snapshot,Q.snapshot);if(D.json||D.verbose){r({ok:!0,id:J.id,from:V.label,to:Q.label,...T},D.json,D);return}console.log(zS(T,`${J.id} ${V.label}`,`${J.id} ${Q.label}`));return}if(U==="update"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);if(D.ifVersion!==void 0&&(!Number.isInteger(D.ifVersion)||D.ifVersion<1))throw Error(`Invalid --if-version ${JSON.stringify(String(D.ifVersion))}: must be a positive integer version number, e.g. the "version" field from a prior 'knowledge get'.`);let P={};if(D.title!==void 0)P.title=D.title;if(D.content!==void 0)P.content=D.content;if(D.url!==void 0)P.url=D.url;let S;if(D.tag!==void 0){if(S=d8(J.tags,D.tag),S.length>0)P.tags=[...J.tags??[],...S]}let X=D.ifVersion!==void 0?D.ifVersion:J.version,G=await L.update(J.id,P,{expectedVersion:X});r(Az({ok:!0,item:G},`Updated ${G?.id??J.id}`,S),D.json,D);return}if(U==="archive"||U==="restore"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);let P=await L.update(J.id,{archived:U==="archive"},{expectedVersion:J.version});r({ok:!0,item:P,message:`${U==="archive"?"Archived":"Restored"} ${P?.id??J.id}`},D.json,D);return}if(U==="untag"){if(_0(D),!D.tag?.length)throw Error("Missing required --tag. Example: knowledge untag --id <id> -t <tag>");let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);let P=J.tags??[],S=new Set(P.map((K)=>K.toLowerCase())),X=new Set;for(let K of D.tagRaw??D.tag){let Z=K.trim().toLowerCase();if(Z.length>0&&S.has(Z)){X.add(Z);continue}for(let e of K.split(",").map((g_)=>g_.trim().toLowerCase()).filter((g_)=>g_.length>0))X.add(e)}let G=P.filter((K)=>!X.has(K.toLowerCase())),R=P.length-G.length,V=[...X].filter((K)=>!S.has(K));if(R===0)throw Error(`No matching tag on ${J.id}: ${V.map((K)=>JSON.stringify(K)).join(", ")} not in [${P.map((K)=>JSON.stringify(K)).join(", ")}]`);let Q=await L.update(J.id,{tags:G},{expectedVersion:J.version}),T=V.length>0?` (not found: ${V.map((K)=>JSON.stringify(K)).join(", ")})`:"",q={ok:!0,item:Q,removed:R,message:`Removed ${R} tag${R===1?"":"s"} from ${Q?.id??J.id}${T}`};if(V.length>0)q.not_found=V;r(q,D.json,D);return}if(U==="upsert"){let J=D.title??$[1],P=D.content??$[2],S=D.id?await L.get(D.id):null;if(!S){if(!J||!P)throw Error("New item requires title and content. Example: knowledge upsert <title> <content> [--id <id>]");let V=await L.create({id:D.id,title:J,content:P,url:D.url??null,tags:D.tag??[]});r(Az({ok:!0,created:!0,item:V},`Upserted ${V.id}`,D.tag),D.json,D);return}let X={};if(J!==void 0)X.title=J;if(P!==void 0)X.content=P;if(D.url!==void 0)X.url=D.url;let G;if(D.tag!==void 0){if(G=d8(S.tags,D.tag),G.length>0)X.tags=[...S.tags??[],...G]}let R=await L.update(S.id,X,{expectedVersion:S.version});r(Az({ok:!0,created:!1,item:R},`Upserted ${R?.id??S.id}`,G),D.json,D);return}if(U==="delete"){if(_0(D),!D.yes)throw Error("Refusing delete without --yes. Re-run with: knowledge delete --id <id> --yes");if(!await L.delete(D.id))throw Error(`Item not found: ${D.id}`);$0("info","Item deleted",{id:D.id,transport:L.kind}),r({ok:!0,deleted_id:D.id,message:`Deleted ${D.id}`},D.json,D);return}if(U==="export"){let J=D.format??"json";if(J!=="json"&&J!=="jsonl")throw Error("Invalid --format. Use 'json' or 'jsonl'.");let P=await L.listAll();if(J==="jsonl")for(let S of P.items)console.log(JSON.stringify(S));else if(D.json||D.format==="json"||D.verbose)r({ok:!0,items:P.items,store_exists:P.exists},D.json||D.format==="json",D);else r(ff(P.items,J),!1);return}if(U==="prune"){if(!D.yes)throw Error("Refusing prune without --yes. Re-run with: knowledge prune --yes [--older-than <days>] [--empty]");let{items:J}=await L.listAll(),P=D.olderThan!==void 0?new Date(Date.now()-D.olderThan*86400000):null,S=J.filter((R)=>P!==null&&new Date(R.created_at)<P||D.empty&&R.content.trim().length===0),X=await L.deleteMany(S.map((R)=>R.id)),G=J.length-X;$0("info","Prune completed",{pruned:X,remaining:G,transport:L.kind}),r({ok:!0,pruned:X,remaining:G,message:`Pruned ${X} item(s)`},D.json,D);return}if(U==="dedupe"){if(!D.yes)throw Error("Refusing dedupe without --yes. Re-run with: knowledge dedupe --yes [--json]");let{items:J}=await L.listAll(),P=new Set,S=[];for(let R of J){let V=`${R.title}\x00${R.content}`;if(P.has(V))S.push(R);else P.add(V)}let X=await L.deleteMany(S.map((R)=>R.id)),G=J.length-X;$0("info","Dedupe completed",{removed:X,remaining:G,transport:L.kind}),r({ok:!0,removed:X,remaining:G,message:`Dedupe removed ${X} duplicate(s)`},D.json,D);return}if(U==="stats"){let J=await L.listAll(),P=J.items.filter((K)=>!K.archived),S=P.length,X=J.items.length-S,G=P.filter((K)=>K.url).length,R=P.filter((K)=>K.tags&&K.tags.length>0).length,V=S>0?P.map((K)=>K.created_at).sort()[0]:null,Q=S>0?P.map((K)=>K.created_at).sort()[S-1]:null,T={};for(let K of P)for(let Z of K.tags||[])T[Z]=(T[Z]||0)+1;let q=Object.entries(T).sort((K,Z)=>Z[1]-K[1]).slice(0,5).map(([K,Z])=>({tag:K,count:Z}));r({ok:!0,total:S,archived:X,with_url:G,with_tags:R,oldest:V,newest:Q,top_tags:q,store_exists:J.exists,message:`${S} items | ${G} with URL | ${R} with tags`},D.json,D);return}let z=zf($[0]),W=z?` Did you mean '${z}'?`:"";throw $0("warn","Unknown command",{input:$[0],suggestion:z}),Error(`Unknown command: ${$[0]}.${W} Run 'knowledge --help' for available commands.`)}function xf(_,$){let D=_ instanceof Error?_.message:String(_);$0("debug","CLI error",{message:D,stack:_ instanceof Error?_.stack:void 0}),console.error(`Error: ${D}`);let U=_ instanceof L0?_:null;if($.includes("--json"))r({ok:!1,error:D,message:D,...U?{code:"version_conflict",expected:U.expected,current:U.current}:{}},!0);process.exitCode=U?2:1}if(import.meta.main){let _=process.argv.slice(2);uf(_).catch(($)=>xf($,_))}export{zf as suggestCommand,wf as sortItems,uf as run,Lf as parseArgs,xf as emitCliError}; diff --git a/dist/guarded-write-contract.d.ts b/dist/guarded-write-contract.d.ts index 4113718..174cf92 100644 --- a/dist/guarded-write-contract.d.ts +++ b/dist/guarded-write-contract.d.ts @@ -1,6 +1,8 @@ import type { KnowledgeItem } from './store.js'; export declare const KNOWLEDGE_GUARDED_WRITE_CONTRACT: 'FCAME-1'; export declare const KNOWLEDGE_PRIVATE_INPUT_SCHEMA: 'hasna.knowledge.private-input.v1'; +export declare const KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA: 'hasna.knowledge.private-title-lookup.v1'; +export declare const KNOWLEDGE_PRIVATE_RESULT_SCHEMA: 'hasna.knowledge.private-result.v1'; export type KnowledgeAuthorityClassification = 'user_hosted' | 'hasna_saas'; export type KnowledgeGuardedWriteVerb = 'create' | 'update'; export interface KnowledgeAuthorityBinding { @@ -185,6 +187,33 @@ export interface CreateKnowledgePrivateInputDescriptorOptions { /** Defaults to five minutes; bounded to one hour. */ expires_in_ms?: number; } +export interface KnowledgePrivateTitleLookupDescriptor { + readonly contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + readonly schema: typeof KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA; + /** Process-private handle. Deliberately non-enumerable and omitted by toJSON. */ + readonly descriptor_id: string; + readonly operation_id: string; + readonly step_id: string; + readonly title_digest: string; + readonly binding_digest: string; + readonly binding: KnowledgeGuardedBinding; + readonly expires_at: string; + toJSON(): Omit<KnowledgePrivateTitleLookupDescriptor, 'descriptor_id' | 'toJSON'>; +} +export interface CreateKnowledgePrivateTitleLookupDescriptorOptions { + operation_id: string; + step_id: string; + binding: KnowledgeGuardedBinding; + title: string; + /** Defaults to five minutes; bounded to one hour. */ + expires_in_ms?: number; +} +export interface KnowledgeGuardedTitleLookupEnvelope { + contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + descriptor: Omit<KnowledgePrivateTitleLookupDescriptor, 'descriptor_id' | 'toJSON'>; + title: string; + limits: KnowledgeGuardedBounds; +} export interface KnowledgeGuardedWriteEnvelope { contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; descriptor: Omit<KnowledgePrivateInputDescriptor, 'toJSON'>; @@ -334,6 +363,46 @@ export interface KnowledgeGuardedWriteResult { reconciliation: KnowledgeTerminalReconciliation; readback: KnowledgeGuardedReadback; } +export interface KnowledgePrivateItemProof { + id: string; + version: number; + title_sha256: string; + content_sha256: string; + url_sha256: string | null; + tags_sha256: string; + metadata_sha256: string; + archived: boolean; +} +export interface KnowledgeGuardedTitleLookup { + contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + exact: true; + bounded: true; + item_count: 0 | 1; + binding: KnowledgeGuardedBinding; + title_digest: string; + items: readonly KnowledgePrivateItemProof[]; + limits: KnowledgeGuardedBounds; +} +export type KnowledgePrivateResultKind = 'write' | 'readback' | 'title_lookup'; +export interface KnowledgePrivateResultDescriptor { + readonly contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + readonly schema: typeof KNOWLEDGE_PRIVATE_RESULT_SCHEMA; + /** Process-private handle. Deliberately non-enumerable and omitted by toJSON. */ + readonly descriptor_id: string; + readonly kind: KnowledgePrivateResultKind; + readonly result_digest: string; + readonly item_count: number; + readonly expires_at: string; + toJSON(): Omit<KnowledgePrivateResultDescriptor, 'descriptor_id' | 'toJSON'>; +} +export interface KnowledgePrivateResultProof { + kind: KnowledgePrivateResultKind; + item_count: number; + items: readonly KnowledgePrivateItemProof[]; + deterministic_key?: string; + receipt_id?: string; + duplicate?: boolean; +} export declare const DEFAULT_KNOWLEDGE_GUARDED_LIMITS: KnowledgeGuardedLimits; export declare function assertKnowledgeGuardedBinding(binding: KnowledgeGuardedBinding): void; export declare function assertKnowledgeGuardedPrecondition(verb: KnowledgeGuardedWriteVerb, precondition: KnowledgeGuardedPrecondition): void; @@ -400,6 +469,11 @@ export declare function computeKnowledgeGuardedManifestDeterministicKey(maintain export declare function assertKnowledgeGuardedPayload(verb: KnowledgeGuardedWriteVerb, payload: KnowledgeGuardedPayload): void; export declare function createKnowledgePrivateInputDescriptor(options: CreateKnowledgePrivateInputDescriptorOptions): KnowledgePrivateInputDescriptor; export declare function revokeKnowledgePrivateInputDescriptor(descriptor: KnowledgePrivateInputDescriptor): void; +export declare function createKnowledgePrivateTitleLookupDescriptor(options: CreateKnowledgePrivateTitleLookupDescriptorOptions): KnowledgePrivateTitleLookupDescriptor; +export declare function revokeKnowledgePrivateTitleLookupDescriptor(descriptor: KnowledgePrivateTitleLookupDescriptor): void; +export declare function knowledgePrivateItemProof(item: KnowledgeItem): KnowledgePrivateItemProof; +export declare function revokeKnowledgePrivateResultDescriptor(descriptor: KnowledgePrivateResultDescriptor): void; +export declare function inspectKnowledgePrivateResult(descriptor: KnowledgePrivateResultDescriptor): KnowledgePrivateResultProof; export declare function assertKnowledgeTerminalCompleteness(reconciliation: KnowledgeTerminalReconciliation, expected: { deterministic_key: string; operation_id: string; diff --git a/dist/guarded-writer.d.ts b/dist/guarded-writer.d.ts index e75e3e3..f2a9c09 100644 --- a/dist/guarded-writer.d.ts +++ b/dist/guarded-writer.d.ts @@ -1,4 +1,4 @@ -import { type CreateKnowledgeGuardedManifestOptions, type KnowledgeGuardedBinding, type KnowledgeGuardedBindingStateReadback, type KnowledgeGuardedBounds, type KnowledgeGuardedAdoptionReconciliation, type KnowledgeGuardedAdoptionReceipt, type KnowledgeGuardedAdoptionResult, type KnowledgeGuardedLegacyAdoptionOptions, type KnowledgeGuardedLegacyRollbackOptions, type KnowledgeGuardedLimits, type KnowledgeGuardedManifestReconciliation, type KnowledgeGuardedManifestSubmission, type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedWriteResult, type KnowledgePrivateInputDescriptor, type KnowledgeTerminalReconciliation } from './guarded-write-contract.js'; +import { type CreateKnowledgeGuardedManifestOptions, type KnowledgeGuardedBinding, type KnowledgeGuardedBindingStateReadback, type KnowledgeGuardedBounds, type KnowledgeGuardedAdoptionReconciliation, type KnowledgeGuardedAdoptionReceipt, type KnowledgeGuardedAdoptionResult, type KnowledgeGuardedLegacyAdoptionOptions, type KnowledgeGuardedLegacyRollbackOptions, type KnowledgeGuardedLimits, type KnowledgeGuardedManifestReconciliation, type KnowledgeGuardedManifestSubmission, type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedWriteResult, type KnowledgePrivateInputDescriptor, type KnowledgePrivateResultDescriptor, type KnowledgePrivateTitleLookupDescriptor, type KnowledgeTerminalReconciliation } from './guarded-write-contract.js'; export interface CreateKnowledgeGuardedWriterOptions { binding: KnowledgeGuardedBinding; env?: NodeJS.ProcessEnv; @@ -16,8 +16,11 @@ export interface KnowledgeGuardedWriter { createManifest(manifest: CreateKnowledgeGuardedManifestOptions, bounds?: KnowledgeGuardedBounds): Promise<KnowledgeGuardedManifestSubmission>; reconcileManifest(manifestId: string, bounds?: KnowledgeGuardedBounds): Promise<KnowledgeGuardedManifestReconciliation>; execute(descriptor: KnowledgePrivateInputDescriptor): Promise<KnowledgeGuardedWriteResult>; + executePrivate(descriptor: KnowledgePrivateInputDescriptor): Promise<KnowledgePrivateResultDescriptor>; + lookupTitle(descriptor: KnowledgePrivateTitleLookupDescriptor): Promise<KnowledgePrivateResultDescriptor>; reconcile(deterministicKey: string, operationId: string, stepId: string, bounds?: KnowledgeGuardedBounds): Promise<KnowledgeTerminalReconciliation>; readback(fullId: string, bounds?: KnowledgeGuardedBounds): Promise<KnowledgeGuardedReadback>; + readbackPrivate(fullId: string, bounds?: KnowledgeGuardedBounds): Promise<KnowledgePrivateResultDescriptor>; readBindingState(fullId: string, bounds?: KnowledgeGuardedBounds): Promise<KnowledgeGuardedBindingStateReadback>; adoptLegacy(options: KnowledgeGuardedLegacyAdoptionOptions): Promise<KnowledgeGuardedAdoptionResult>; rollbackLegacyAdoption(options: KnowledgeGuardedLegacyRollbackOptions): Promise<KnowledgeGuardedRollbackResult>; @@ -34,6 +37,10 @@ export declare class KnowledgeGuardedOperationConflictError extends Error { readonly code = "guarded_operation_conflict"; constructor(receipt: KnowledgeGuardedReceipt); } +export declare class KnowledgePrivateTitleLookupAmbiguousError extends Error { + readonly code = "private_title_lookup_ambiguous"; + constructor(); +} export declare class KnowledgeGuardedManifestConflictError extends Error { readonly manifest: KnowledgeGuardedManifestSubmission['manifest']; readonly code = "guarded_manifest_conflict"; diff --git a/dist/index.d.ts b/dist/index.d.ts index f4303fa..f2a464d 100644 --- a/dist/index.d.ts +++ b/dist/index.d.ts @@ -2,7 +2,7 @@ export { createAppWikiScope, createKnowledgeClient, createKnowledgeSdk, openGlob export { resolveItemStore, type ItemStore, type ItemCreateInput, type ItemPatch, type ItemListResult, type ResolveItemStoreOptions, } from './item-store.js'; export { type KnowledgeItem, type Store as KnowledgeItemStoreFile, } from './store.js'; export { KNOWLEDGE_APP_SLUG, KNOWLEDGE_RESOURCE, isKnowledgeApiMode, resolveKnowledgeCloudStore, type KnowledgeCloudStore, type KnowledgeCloudCreateInput, type KnowledgeCloudListOptions, type KnowledgeCloudPatch, } from './cloud-store.js'; -export { DEFAULT_KNOWLEDGE_GUARDED_LIMITS, KNOWLEDGE_GUARDED_WRITE_CONTRACT, KNOWLEDGE_PRIVATE_INPUT_SCHEMA, assertKnowledgeGuardedBinding, assertKnowledgeGuardedBounds, assertKnowledgeGuardedManifestBinding, assertKnowledgeGuardedManifestOptions, assertKnowledgeGuardedManifestTerminalCompleteness, assertKnowledgeGuardedPayload, assertKnowledgeGuardedPrecondition, assertKnowledgeTerminalCompleteness, canonicalKnowledgeGuardedJson, computeKnowledgeGuardedAdoptionDeterministicKey, computeKnowledgeGuardedAdoptionReceiptId, computeKnowledgeGuardedDeterministicKey, computeKnowledgeGuardedManifestId, computeKnowledgeGuardedManifestDeterministicKey, computeKnowledgeGuardedManifestDigest, computeKnowledgeGuardedReceiptId, computeKnowledgeGuardedRecoveryKey, createKnowledgePrivateInputDescriptor, evaluateKnowledgeGuardedManifestCompletion, knowledgeGuardedDigest, knowledgeGuardedContentSha256, knowledgeGuardedUtf8Bytes, normalizeKnowledgeGuardedLimits, revokeKnowledgePrivateInputDescriptor, type CreateKnowledgeGuardedManifestOptions, type CreateKnowledgePrivateInputDescriptorOptions, type KnowledgeAuthorityBinding, type KnowledgeAuthorityClassification, type KnowledgeGuardedAdoptionAction, type KnowledgeGuardedAdoptionEnvelope, type KnowledgeGuardedAdoptionKeyInput, type KnowledgeGuardedAdoptionReceipt, type KnowledgeGuardedAdoptionReconciliation, type KnowledgeGuardedAdoptionResult, type KnowledgeGuardedAdoptionSubmission, type KnowledgeGuardedBinding, type KnowledgeGuardedBindingState, type KnowledgeGuardedBindingStateReadback, type KnowledgeGuardedBounds, type KnowledgeGuardedCreatePayload, type KnowledgeGuardedDeterministicKeyInput, type KnowledgeGuardedLimits, type KnowledgeGuardedManifest, type KnowledgeGuardedManifestBinding, type KnowledgeGuardedManifestCompletion, type KnowledgeGuardedManifestEnvelope, type KnowledgeGuardedManifestReconciliation, type KnowledgeGuardedManifestReconciliationStep, type KnowledgeGuardedManifestRecovery, type KnowledgeGuardedManifestStep, type KnowledgeGuardedManifestStepState, type KnowledgeGuardedManifestSubmission, type KnowledgeGuardedLegacyAdoptionOptions, type KnowledgeGuardedLegacyRollbackOptions, type KnowledgeGuardedPayload, type KnowledgeGuardedPrecondition, type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedReceiptStatus, type KnowledgeGuardedRecoveryKeyInput, type KnowledgeGuardedRecoveryStrategy, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedSubmission, type KnowledgeGuardedUpdatePayload, type KnowledgeGuardedWriteEnvelope, type KnowledgeGuardedWriteResult, type KnowledgeGuardedWriteVerb, type KnowledgePrivateInputDescriptor, type KnowledgeTerminalReconciliation, } from './guarded-write-contract.js'; +export { DEFAULT_KNOWLEDGE_GUARDED_LIMITS, KNOWLEDGE_GUARDED_WRITE_CONTRACT, KNOWLEDGE_PRIVATE_INPUT_SCHEMA, KNOWLEDGE_PRIVATE_RESULT_SCHEMA, KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, assertKnowledgeGuardedBinding, assertKnowledgeGuardedBounds, assertKnowledgeGuardedManifestBinding, assertKnowledgeGuardedManifestOptions, assertKnowledgeGuardedManifestTerminalCompleteness, assertKnowledgeGuardedPayload, assertKnowledgeGuardedPrecondition, assertKnowledgeTerminalCompleteness, canonicalKnowledgeGuardedJson, computeKnowledgeGuardedAdoptionDeterministicKey, computeKnowledgeGuardedAdoptionReceiptId, computeKnowledgeGuardedDeterministicKey, computeKnowledgeGuardedManifestId, computeKnowledgeGuardedManifestDeterministicKey, computeKnowledgeGuardedManifestDigest, computeKnowledgeGuardedReceiptId, computeKnowledgeGuardedRecoveryKey, createKnowledgePrivateInputDescriptor, createKnowledgePrivateTitleLookupDescriptor, evaluateKnowledgeGuardedManifestCompletion, knowledgeGuardedDigest, knowledgeGuardedContentSha256, knowledgeGuardedUtf8Bytes, inspectKnowledgePrivateResult, normalizeKnowledgeGuardedLimits, revokeKnowledgePrivateInputDescriptor, revokeKnowledgePrivateResultDescriptor, revokeKnowledgePrivateTitleLookupDescriptor, type CreateKnowledgeGuardedManifestOptions, type CreateKnowledgePrivateInputDescriptorOptions, type CreateKnowledgePrivateTitleLookupDescriptorOptions, type KnowledgeAuthorityBinding, type KnowledgeAuthorityClassification, type KnowledgeGuardedAdoptionAction, type KnowledgeGuardedAdoptionEnvelope, type KnowledgeGuardedAdoptionKeyInput, type KnowledgeGuardedAdoptionReceipt, type KnowledgeGuardedAdoptionReconciliation, type KnowledgeGuardedAdoptionResult, type KnowledgeGuardedAdoptionSubmission, type KnowledgeGuardedBinding, type KnowledgeGuardedBindingState, type KnowledgeGuardedBindingStateReadback, type KnowledgeGuardedBounds, type KnowledgeGuardedCreatePayload, type KnowledgeGuardedDeterministicKeyInput, type KnowledgeGuardedLimits, type KnowledgeGuardedManifest, type KnowledgeGuardedManifestBinding, type KnowledgeGuardedManifestCompletion, type KnowledgeGuardedManifestEnvelope, type KnowledgeGuardedManifestReconciliation, type KnowledgeGuardedManifestReconciliationStep, type KnowledgeGuardedManifestRecovery, type KnowledgeGuardedManifestStep, type KnowledgeGuardedManifestStepState, type KnowledgeGuardedManifestSubmission, type KnowledgeGuardedLegacyAdoptionOptions, type KnowledgeGuardedLegacyRollbackOptions, type KnowledgeGuardedPayload, type KnowledgeGuardedPrecondition, type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedReceiptStatus, type KnowledgeGuardedRecoveryKeyInput, type KnowledgeGuardedRecoveryStrategy, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedSubmission, type KnowledgeGuardedTitleLookup, type KnowledgeGuardedUpdatePayload, type KnowledgeGuardedWriteEnvelope, type KnowledgeGuardedWriteResult, type KnowledgeGuardedWriteVerb, type KnowledgePrivateInputDescriptor, type KnowledgePrivateItemProof, type KnowledgePrivateResultDescriptor, type KnowledgePrivateResultProof, type KnowledgePrivateTitleLookupDescriptor, type KnowledgeTerminalReconciliation, } from './guarded-write-contract.js'; export * from './guarded-writer.js'; export { KNOWLEDGE_API_KEY_ENV_KEYS, KNOWLEDGE_API_URL_ENV_KEYS, KNOWLEDGE_MODE_ENV_KEYS, LOCAL_MODE_CANDIDATES, SERVER_MODE_CANDIDATES, contractsStorageModeFor, knowledgeModeReport, localStorageMode, pinnedTransportEnv, resolveKnowledgeModeSelection, serverStorageMode, type KnowledgeMode, type ModeNormalizer, type KnowledgeModeReport, type KnowledgeModeResolution, type KnowledgeModeSource, } from './knowledge-mode.js'; export { NETWORK_GUARD_ENV, KnowledgeNetworkGuardError, assertOutboundRequestAllowed, guardedFetch, isLoopbackHostname, isNetworkGuardActive, } from './net-guard.js'; diff --git a/dist/index.js b/dist/index.js index 41dc1bf..db0bec6 100644 --- a/dist/index.js +++ b/dist/index.js @@ -19556,6 +19556,8 @@ function makeShortId(id) { import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto"; var KNOWLEDGE_GUARDED_WRITE_CONTRACT = "FCAME-1"; var KNOWLEDGE_PRIVATE_INPUT_SCHEMA = "hasna.knowledge.private-input.v1"; +var KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA = "hasna.knowledge.private-title-lookup.v1"; +var KNOWLEDGE_PRIVATE_RESULT_SCHEMA = "hasna.knowledge.private-result.v1"; var DEFAULT_KNOWLEDGE_GUARDED_LIMITS = Object.freeze({ submission: Object.freeze({ max_calls: 1, @@ -19580,6 +19582,8 @@ var MAX_GUARDED_BYTES = 4 * 1024 * 1024; var MAX_GUARDED_WALL_TIME_MS = 30000; var MAX_DESCRIPTOR_LIFETIME_MS = 60 * 60 * 1000; var PRIVATE_PAYLOADS = new WeakMap; +var PRIVATE_TITLE_LOOKUPS = new WeakMap; +var PRIVATE_RESULTS = new WeakMap; function assertObjectKeys(value, field, allowed, required = allowed) { if (!value || typeof value !== "object" || Array.isArray(value)) { throw new Error(`${field} must be an object.`); @@ -20099,6 +20103,151 @@ function materializeKnowledgePrivateInput(descriptor) { } return state.payload; } +function createKnowledgePrivateTitleLookupDescriptor(options) { + assertBoundText(options.operation_id, "operation_id"); + assertBoundText(options.step_id, "step_id"); + assertKnowledgeGuardedBinding(options.binding); + assertBoundText(options.title, "title", 2048); + const expiresIn = options.expires_in_ms ?? 5 * 60 * 1000; + if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const titleDigest = knowledgeGuardedContentSha256(options.title); + const bindingDigest = knowledgeGuardedDigest({ + binding: options.binding, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest + }); + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest, + binding_digest: bindingDigest, + binding: Object.freeze({ + authority: Object.freeze({ ...options.binding.authority }), + tenant_id: options.binding.tenant_id, + scope: options.binding.scope, + parent_id: options.binding.parent_id + }), + expires_at: new Date(Date.now() + expiresIn).toISOString() + }); + const descriptor = { + ...metadata, + toJSON: () => metadata + }; + Object.defineProperty(descriptor, "descriptor_id", { + value: `kpl_${randomUUID2()}`, + enumerable: false, + configurable: false, + writable: false + }); + Object.freeze(descriptor); + PRIVATE_TITLE_LOOKUPS.set(descriptor, { title: options.title, revoked: false }); + return descriptor; +} +function revokeKnowledgePrivateTitleLookupDescriptor(descriptor) { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) + throw new Error("private title lookup descriptor was not created by @hasna/knowledge."); + state.revoked = true; +} +function materializeKnowledgePrivateTitleLookup(descriptor) { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) + throw new Error("private title lookup descriptor was not created by @hasna/knowledge."); + if (state.revoked) + throw new Error("private title lookup descriptor has been revoked."); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error("private title lookup descriptor has expired."); + } + if (knowledgeGuardedContentSha256(state.title) !== descriptor.title_digest) { + throw new Error("private title lookup descriptor digest changed after freeze."); + } + return state.title; +} +function knowledgePrivateItemProof(item) { + return Object.freeze({ + id: item.id, + version: Number(item.version ?? 1), + title_sha256: knowledgeGuardedContentSha256(item.title), + content_sha256: knowledgeGuardedContentSha256(item.content), + url_sha256: item.url === null || item.url === undefined ? null : knowledgeGuardedContentSha256(item.url), + tags_sha256: knowledgeGuardedDigest(item.tags ?? []), + metadata_sha256: knowledgeGuardedDigest(item.metadata ?? {}), + archived: item.archived === true + }); +} +function createKnowledgePrivateResultDescriptor(result, expiresInMs = 5 * 60 * 1000) { + if (!Number.isInteger(expiresInMs) || expiresInMs < 1 || expiresInMs > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const itemCount = result.kind === "title_lookup" ? result.value.item_count : 1; + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_RESULT_SCHEMA, + kind: result.kind, + result_digest: knowledgeGuardedDigest(result.value), + item_count: itemCount, + expires_at: new Date(Date.now() + expiresInMs).toISOString() + }); + const descriptor = { + ...metadata, + toJSON: () => metadata + }; + Object.defineProperty(descriptor, "descriptor_id", { + value: `kpr_${randomUUID2()}`, + enumerable: false, + configurable: false, + writable: false + }); + Object.freeze(descriptor); + PRIVATE_RESULTS.set(descriptor, { result, revoked: false }); + return descriptor; +} +function revokeKnowledgePrivateResultDescriptor(descriptor) { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) + throw new Error("private result descriptor was not created by @hasna/knowledge."); + state.revoked = true; +} +function inspectKnowledgePrivateResult(descriptor) { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) + throw new Error("private result descriptor was not created by @hasna/knowledge."); + if (state.revoked) + throw new Error("private result descriptor has been revoked."); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error("private result descriptor has expired."); + } + if (knowledgeGuardedDigest(state.result.value) !== descriptor.result_digest) { + throw new Error("private result descriptor digest changed after freeze."); + } + if (state.result.kind === "write") { + return Object.freeze({ + kind: "write", + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.readback.item)]), + deterministic_key: state.result.value.deterministic_key, + receipt_id: state.result.value.receipt.receipt_id, + duplicate: state.result.value.duplicate + }); + } + if (state.result.kind === "readback") { + return Object.freeze({ + kind: "readback", + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.item)]) + }); + } + return Object.freeze({ + kind: "title_lookup", + item_count: state.result.value.item_count, + items: Object.freeze([...state.result.value.items]) + }); +} function assertKnowledgeTerminalCompleteness(reconciliation, expected) { if (reconciliation.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || reconciliation.deterministic_key !== expected.deterministic_key || reconciliation.operation_id !== expected.operation_id || reconciliation.step_id !== expected.step_id || reconciliation.exact !== true || reconciliation.bounded !== true || reconciliation.receipt_count !== 1 || reconciliation.terminal_complete !== true || reconciliation.receipt === null) { throw new Error("terminal_completeness_failed: exact bounded reconciliation did not yield one terminal receipt."); @@ -21494,6 +21643,37 @@ class GuardedWriteRepo { limits }; } + async lookupTitle(title, binding, limits) { + const rows = await this.client.many(`SELECT * FROM knowledge_items + WHERE title = $1 + AND authority_classification = $2 + AND authority_id = $3 + AND tenant_id = $4 + AND scope = $5 + AND parent_id = $6 + ORDER BY id + LIMIT 2`, [ + title, + binding.authority.classification, + binding.authority.authority_id, + binding.tenant_id, + binding.scope, + binding.parent_id + ]); + if (rows.length > 1) + throw new PrivateTitleLookupAmbiguousError; + const items = rows.map((row) => knowledgePrivateItemProof(rowToItem(row))); + return { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + exact: true, + bounded: true, + item_count: items.length, + binding, + title_digest: knowledgeGuardedContentSha256(title), + items, + limits + }; + } async readback(fullId, binding, limits) { const row = await this.client.get(`SELECT * FROM knowledge_items WHERE id = $1 @@ -21523,6 +21703,13 @@ class GuardedWriteRepo { }; } } + +class PrivateTitleLookupAmbiguousError extends Error { + constructor() { + super("more than one exact title exists in the frozen binding."); + this.name = "PrivateTitleLookupAmbiguousError"; + } +} function knowledgeOpenApi(version) { const noteSchema = { type: "object", @@ -21880,6 +22067,17 @@ function knowledgeOpenApi(version) { } } }, + "/v1/guarded-writes/lookups/title": { + post: { + operationId: "lookupGuardedKnowledgeTitle", + summary: "Bounded exact-title lookup under one frozen FCAME-1 binding", + description: "Returns zero or one metadata-only item proof. More than one exact title is an ambiguity error; " + "item bodies and titles are never returned.", + responses: { + "200": { description: "Exact bounded metadata-only result containing zero or one item proof." }, + "409": { description: "More than one exact title exists under the frozen binding." } + } + } + }, "/v1/guarded-adoptions": { post: { operationId: "executeGuardedKnowledgeAdoption", @@ -22235,6 +22433,67 @@ function validateGuardedEnvelope(value, headerBounds, authority, idempotencyKey) throw new HttpError(400, error instanceof Error ? error.message : "invalid guarded write envelope."); } } +function validatePrivateTitleLookupEnvelope(value, headerBounds, authority) { + try { + if (!value || typeof value !== "object") { + throw new Error("private title lookup envelope is required."); + } + const envelope = value; + assertExactRequestKeys(value, "private title lookup envelope", ["contract", "descriptor", "title", "limits"]); + if (envelope.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT) { + throw new Error("unsupported guarded-write contract."); + } + const descriptor = envelope.descriptor; + if (!descriptor || descriptor.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || descriptor.schema !== KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA) { + throw new Error("invalid private title lookup descriptor schema."); + } + assertExactRequestKeys(descriptor, "private title lookup descriptor", [ + "contract", + "schema", + "operation_id", + "step_id", + "title_digest", + "binding_digest", + "binding", + "expires_at" + ]); + if (typeof descriptor.operation_id !== "string" || descriptor.operation_id.length === 0 || typeof descriptor.step_id !== "string" || descriptor.step_id.length === 0 || typeof envelope.title !== "string" || envelope.title.length === 0 || envelope.title.length > 2048) { + throw new Error("private title lookup operation, step, and bounded title are required."); + } + const descriptorExpiresAt = Date.parse(descriptor.expires_at); + const descriptorNow = Date.now(); + if (!Number.isFinite(descriptorExpiresAt) || descriptorExpiresAt <= descriptorNow || descriptorExpiresAt > descriptorNow + 60 * 60 * 1000) { + throw new Error("private title lookup descriptor is expired or malformed."); + } + assertKnowledgeGuardedBinding(descriptor.binding); + assertConfiguredAuthority(descriptor.binding, authority); + assertKnowledgeGuardedBounds(envelope.limits, "private title lookup bounds"); + if (canonicalKnowledgeGuardedJson(envelope.limits) !== canonicalKnowledgeGuardedJson(headerBounds)) { + throw new Error("private title lookup limits must exactly match the producer bound headers."); + } + const titleDigest = knowledgeGuardedContentSha256(envelope.title); + if (titleDigest !== descriptor.title_digest) { + throw new Error("private title lookup digest does not match the frozen descriptor."); + } + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error("private title lookup binding digest does not match."); + } + if (knowledgeGuardedUtf8Bytes(envelope) > headerBounds.max_bytes) { + throw new Error("private title lookup envelope exceeds the producer byte cap."); + } + return envelope; + } catch (error) { + if (error instanceof HttpError) + throw error; + throw new HttpError(400, error instanceof Error ? error.message : "invalid private title lookup envelope."); + } +} function validateGuardedAdoptionEnvelope(value, headerBounds, authority, idempotencyKey) { try { if (!value || typeof value !== "object") { @@ -22526,6 +22785,31 @@ function createServeHandler(deps) { throw error; } } + if (path === "/v1/guarded-writes/lookups/title" && method === "POST") { + if (!guardedRepo) { + return json({ error: "guarded_authority_unconfigured" }, 503); + } + const startedAt = Date.now(); + const tenantId = req.headers.get("x-knowledge-tenant-id"); + if (!tenantId) + throw new HttpError(400, "x-knowledge-tenant-id is required."); + await authOrThrow(req, ["knowledge:read"], tenantId); + const bounds = guardedBoundsFromHeaders(req); + const raw = await readBoundedJson(req, bounds, startedAt); + const envelope = validatePrivateTitleLookupEnvelope(raw, bounds, guardedRepo.authority); + if (envelope.descriptor.binding.tenant_id !== tenantId) { + throw new HttpError(403, "descriptor tenant does not match the authenticated request tenant."); + } + try { + const result = await guardedRepo.lookupTitle(envelope.title, envelope.descriptor.binding, bounds); + return boundedJson(result, 200, bounds, startedAt); + } catch (error) { + if (error instanceof PrivateTitleLookupAmbiguousError) { + return boundedJson({ error: "private_title_lookup_ambiguous" }, 409, bounds, startedAt); + } + throw error; + } + } const guardedReceiptMatch = path.match(/^\/v1\/guarded-writes\/receipts\/([^/]+)$/); if (guardedReceiptMatch) { if (method !== "GET") @@ -36937,6 +37221,14 @@ class KnowledgeGuardedOperationConflictError extends Error { } } +class KnowledgePrivateTitleLookupAmbiguousError extends Error { + code = "private_title_lookup_ambiguous"; + constructor() { + super("private_title_lookup_ambiguous: more than one exact title exists in the frozen binding."); + this.name = "KnowledgePrivateTitleLookupAmbiguousError"; + } +} + class KnowledgeGuardedManifestConflictError extends Error { manifest; code = "guarded_manifest_conflict"; @@ -37200,6 +37492,54 @@ class GuardedWriter { readback }; } + async executePrivate(descriptor) { + const result = await this.execute(descriptor); + return createKnowledgePrivateResultDescriptor({ kind: "write", value: result }); + } + async lookupTitle(descriptor) { + if (!sameBinding(descriptor.binding, this.binding)) { + throw new Error("private title lookup descriptor binding does not match this guarded writer."); + } + const title = materializeKnowledgePrivateTitleLookup(descriptor); + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error("private title lookup descriptor binding digest changed after freeze."); + } + const envelope = { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + descriptor: descriptor.toJSON(), + title, + limits: this.limits.readback + }; + if (knowledgeGuardedUtf8Bytes(envelope) > this.limits.readback.max_bytes) { + throw new Error("private_title_lookup_request_exceeds_byte_cap."); + } + let response; + try { + response = await this.transport.post("/guarded-writes/lookups/title", envelope, { + headers: { + ...boundHeaders(this.limits.readback), + "x-knowledge-tenant-id": this.binding.tenant_id + }, + timeoutMs: this.limits.readback.wall_time_ms, + retry: false + }); + } catch (error51) { + if (parseErrorBody(error51)?.error === "private_title_lookup_ambiguous") { + throw new KnowledgePrivateTitleLookupAmbiguousError; + } + throw error51; + } + if (knowledgeGuardedUtf8Bytes(response) > this.limits.readback.max_bytes || response.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || response.exact !== true || response.bounded !== true || response.title_digest !== descriptor.title_digest || !sameBinding(response.binding, this.binding) || response.item_count !== response.items.length || response.item_count > 1 || response.items.some((item) => item.title_sha256 !== descriptor.title_digest)) { + throw new Error("private_title_lookup_exact_bounded_readback_failed."); + } + return createKnowledgePrivateResultDescriptor({ kind: "title_lookup", value: response }); + } async createManifest(manifest, bounds = this.limits.submission) { assertKnowledgeGuardedBounds(bounds, "manifest submission bounds"); const deterministicKey = computeKnowledgeGuardedManifestDeterministicKey(this.binding, manifest); @@ -37477,6 +37817,10 @@ class GuardedWriter { } return response; } + async readbackPrivate(fullId, bounds = this.limits.readback) { + const result = await this.readback(fullId, bounds); + return createKnowledgePrivateResultDescriptor({ kind: "readback", value: result }); + } } function createKnowledgeGuardedWriter(options) { assertKnowledgeGuardedBinding(options.binding); @@ -46469,6 +46813,8 @@ export { saveKnowledgeAuth, runProviderWebSearch, runKnowledgePrompt, + revokeKnowledgePrivateTitleLookupDescriptor, + revokeKnowledgePrivateResultDescriptor, revokeKnowledgePrivateInputDescriptor, revisionIdForSourceRef, retrieveKnowledgeContext, @@ -46526,6 +46872,7 @@ export { isNetworkGuardActive, isLoopbackHostname, isKnowledgeApiMode, + inspectKnowledgePrivateResult, initAppWikiScope, ingestSourceRef, ingestOpenFilesManifestItems, @@ -46559,6 +46906,7 @@ export { createKnowledgeService, createKnowledgeSdk, createKnowledgeProjectPanel, + createKnowledgePrivateTitleLookupDescriptor, createKnowledgePrivateInputDescriptor, createKnowledgeMachinesAdapter, createKnowledgeGuardedWriter, @@ -46604,6 +46952,7 @@ export { LOCAL_MODE_CANDIDATES, LEGACY_HASNA_KNOWLEDGE_APP_PATH, KnowledgeService, + KnowledgePrivateTitleLookupAmbiguousError, KnowledgeNetworkGuardError, KnowledgeGuardedWriteUncertainError, KnowledgeGuardedWriteRejectedError, @@ -46623,6 +46972,8 @@ export { KNOWLEDGE_STORAGE_MODE_ENV, KNOWLEDGE_SERVE_APP, KNOWLEDGE_RESOURCE, + KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, + KNOWLEDGE_PRIVATE_RESULT_SCHEMA, KNOWLEDGE_PRIVATE_INPUT_SCHEMA, KNOWLEDGE_MODE_ENV_KEYS, KNOWLEDGE_MACHINES_ADAPTER_PACKAGE, diff --git a/dist/serve.js b/dist/serve.js index 5756b72..6e98b57 100644 --- a/dist/serve.js +++ b/dist/serve.js @@ -1399,6 +1399,8 @@ function makeShortId(id) { import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto"; var KNOWLEDGE_GUARDED_WRITE_CONTRACT = "FCAME-1"; var KNOWLEDGE_PRIVATE_INPUT_SCHEMA = "hasna.knowledge.private-input.v1"; +var KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA = "hasna.knowledge.private-title-lookup.v1"; +var KNOWLEDGE_PRIVATE_RESULT_SCHEMA = "hasna.knowledge.private-result.v1"; var DEFAULT_KNOWLEDGE_GUARDED_LIMITS = Object.freeze({ submission: Object.freeze({ max_calls: 1, @@ -1423,6 +1425,8 @@ var MAX_GUARDED_BYTES = 4 * 1024 * 1024; var MAX_GUARDED_WALL_TIME_MS = 30000; var MAX_DESCRIPTOR_LIFETIME_MS = 60 * 60 * 1000; var PRIVATE_PAYLOADS = new WeakMap; +var PRIVATE_TITLE_LOOKUPS = new WeakMap; +var PRIVATE_RESULTS = new WeakMap; function assertObjectKeys(value, field, allowed, required = allowed) { if (!value || typeof value !== "object" || Array.isArray(value)) { throw new Error(`${field} must be an object.`); @@ -1942,6 +1946,151 @@ function materializeKnowledgePrivateInput(descriptor) { } return state.payload; } +function createKnowledgePrivateTitleLookupDescriptor(options) { + assertBoundText(options.operation_id, "operation_id"); + assertBoundText(options.step_id, "step_id"); + assertKnowledgeGuardedBinding(options.binding); + assertBoundText(options.title, "title", 2048); + const expiresIn = options.expires_in_ms ?? 5 * 60 * 1000; + if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const titleDigest = knowledgeGuardedContentSha256(options.title); + const bindingDigest = knowledgeGuardedDigest({ + binding: options.binding, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest + }); + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest, + binding_digest: bindingDigest, + binding: Object.freeze({ + authority: Object.freeze({ ...options.binding.authority }), + tenant_id: options.binding.tenant_id, + scope: options.binding.scope, + parent_id: options.binding.parent_id + }), + expires_at: new Date(Date.now() + expiresIn).toISOString() + }); + const descriptor = { + ...metadata, + toJSON: () => metadata + }; + Object.defineProperty(descriptor, "descriptor_id", { + value: `kpl_${randomUUID2()}`, + enumerable: false, + configurable: false, + writable: false + }); + Object.freeze(descriptor); + PRIVATE_TITLE_LOOKUPS.set(descriptor, { title: options.title, revoked: false }); + return descriptor; +} +function revokeKnowledgePrivateTitleLookupDescriptor(descriptor) { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) + throw new Error("private title lookup descriptor was not created by @hasna/knowledge."); + state.revoked = true; +} +function materializeKnowledgePrivateTitleLookup(descriptor) { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) + throw new Error("private title lookup descriptor was not created by @hasna/knowledge."); + if (state.revoked) + throw new Error("private title lookup descriptor has been revoked."); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error("private title lookup descriptor has expired."); + } + if (knowledgeGuardedContentSha256(state.title) !== descriptor.title_digest) { + throw new Error("private title lookup descriptor digest changed after freeze."); + } + return state.title; +} +function knowledgePrivateItemProof(item) { + return Object.freeze({ + id: item.id, + version: Number(item.version ?? 1), + title_sha256: knowledgeGuardedContentSha256(item.title), + content_sha256: knowledgeGuardedContentSha256(item.content), + url_sha256: item.url === null || item.url === undefined ? null : knowledgeGuardedContentSha256(item.url), + tags_sha256: knowledgeGuardedDigest(item.tags ?? []), + metadata_sha256: knowledgeGuardedDigest(item.metadata ?? {}), + archived: item.archived === true + }); +} +function createKnowledgePrivateResultDescriptor(result, expiresInMs = 5 * 60 * 1000) { + if (!Number.isInteger(expiresInMs) || expiresInMs < 1 || expiresInMs > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const itemCount = result.kind === "title_lookup" ? result.value.item_count : 1; + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_RESULT_SCHEMA, + kind: result.kind, + result_digest: knowledgeGuardedDigest(result.value), + item_count: itemCount, + expires_at: new Date(Date.now() + expiresInMs).toISOString() + }); + const descriptor = { + ...metadata, + toJSON: () => metadata + }; + Object.defineProperty(descriptor, "descriptor_id", { + value: `kpr_${randomUUID2()}`, + enumerable: false, + configurable: false, + writable: false + }); + Object.freeze(descriptor); + PRIVATE_RESULTS.set(descriptor, { result, revoked: false }); + return descriptor; +} +function revokeKnowledgePrivateResultDescriptor(descriptor) { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) + throw new Error("private result descriptor was not created by @hasna/knowledge."); + state.revoked = true; +} +function inspectKnowledgePrivateResult(descriptor) { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) + throw new Error("private result descriptor was not created by @hasna/knowledge."); + if (state.revoked) + throw new Error("private result descriptor has been revoked."); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error("private result descriptor has expired."); + } + if (knowledgeGuardedDigest(state.result.value) !== descriptor.result_digest) { + throw new Error("private result descriptor digest changed after freeze."); + } + if (state.result.kind === "write") { + return Object.freeze({ + kind: "write", + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.readback.item)]), + deterministic_key: state.result.value.deterministic_key, + receipt_id: state.result.value.receipt.receipt_id, + duplicate: state.result.value.duplicate + }); + } + if (state.result.kind === "readback") { + return Object.freeze({ + kind: "readback", + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.item)]) + }); + } + return Object.freeze({ + kind: "title_lookup", + item_count: state.result.value.item_count, + items: Object.freeze([...state.result.value.items]) + }); +} function assertKnowledgeTerminalCompleteness(reconciliation, expected) { if (reconciliation.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || reconciliation.deterministic_key !== expected.deterministic_key || reconciliation.operation_id !== expected.operation_id || reconciliation.step_id !== expected.step_id || reconciliation.exact !== true || reconciliation.bounded !== true || reconciliation.receipt_count !== 1 || reconciliation.terminal_complete !== true || reconciliation.receipt === null) { throw new Error("terminal_completeness_failed: exact bounded reconciliation did not yield one terminal receipt."); @@ -3337,6 +3486,37 @@ class GuardedWriteRepo { limits }; } + async lookupTitle(title, binding, limits) { + const rows = await this.client.many(`SELECT * FROM knowledge_items + WHERE title = $1 + AND authority_classification = $2 + AND authority_id = $3 + AND tenant_id = $4 + AND scope = $5 + AND parent_id = $6 + ORDER BY id + LIMIT 2`, [ + title, + binding.authority.classification, + binding.authority.authority_id, + binding.tenant_id, + binding.scope, + binding.parent_id + ]); + if (rows.length > 1) + throw new PrivateTitleLookupAmbiguousError; + const items = rows.map((row) => knowledgePrivateItemProof(rowToItem(row))); + return { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + exact: true, + bounded: true, + item_count: items.length, + binding, + title_digest: knowledgeGuardedContentSha256(title), + items, + limits + }; + } async readback(fullId, binding, limits) { const row = await this.client.get(`SELECT * FROM knowledge_items WHERE id = $1 @@ -3366,6 +3546,13 @@ class GuardedWriteRepo { }; } } + +class PrivateTitleLookupAmbiguousError extends Error { + constructor() { + super("more than one exact title exists in the frozen binding."); + this.name = "PrivateTitleLookupAmbiguousError"; + } +} function knowledgeOpenApi(version) { const noteSchema = { type: "object", @@ -3723,6 +3910,17 @@ function knowledgeOpenApi(version) { } } }, + "/v1/guarded-writes/lookups/title": { + post: { + operationId: "lookupGuardedKnowledgeTitle", + summary: "Bounded exact-title lookup under one frozen FCAME-1 binding", + description: "Returns zero or one metadata-only item proof. More than one exact title is an ambiguity error; " + "item bodies and titles are never returned.", + responses: { + "200": { description: "Exact bounded metadata-only result containing zero or one item proof." }, + "409": { description: "More than one exact title exists under the frozen binding." } + } + } + }, "/v1/guarded-adoptions": { post: { operationId: "executeGuardedKnowledgeAdoption", @@ -4078,6 +4276,67 @@ function validateGuardedEnvelope(value, headerBounds, authority, idempotencyKey) throw new HttpError(400, error instanceof Error ? error.message : "invalid guarded write envelope."); } } +function validatePrivateTitleLookupEnvelope(value, headerBounds, authority) { + try { + if (!value || typeof value !== "object") { + throw new Error("private title lookup envelope is required."); + } + const envelope = value; + assertExactRequestKeys(value, "private title lookup envelope", ["contract", "descriptor", "title", "limits"]); + if (envelope.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT) { + throw new Error("unsupported guarded-write contract."); + } + const descriptor = envelope.descriptor; + if (!descriptor || descriptor.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT || descriptor.schema !== KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA) { + throw new Error("invalid private title lookup descriptor schema."); + } + assertExactRequestKeys(descriptor, "private title lookup descriptor", [ + "contract", + "schema", + "operation_id", + "step_id", + "title_digest", + "binding_digest", + "binding", + "expires_at" + ]); + if (typeof descriptor.operation_id !== "string" || descriptor.operation_id.length === 0 || typeof descriptor.step_id !== "string" || descriptor.step_id.length === 0 || typeof envelope.title !== "string" || envelope.title.length === 0 || envelope.title.length > 2048) { + throw new Error("private title lookup operation, step, and bounded title are required."); + } + const descriptorExpiresAt = Date.parse(descriptor.expires_at); + const descriptorNow = Date.now(); + if (!Number.isFinite(descriptorExpiresAt) || descriptorExpiresAt <= descriptorNow || descriptorExpiresAt > descriptorNow + 60 * 60 * 1000) { + throw new Error("private title lookup descriptor is expired or malformed."); + } + assertKnowledgeGuardedBinding(descriptor.binding); + assertConfiguredAuthority(descriptor.binding, authority); + assertKnowledgeGuardedBounds(envelope.limits, "private title lookup bounds"); + if (canonicalKnowledgeGuardedJson(envelope.limits) !== canonicalKnowledgeGuardedJson(headerBounds)) { + throw new Error("private title lookup limits must exactly match the producer bound headers."); + } + const titleDigest = knowledgeGuardedContentSha256(envelope.title); + if (titleDigest !== descriptor.title_digest) { + throw new Error("private title lookup digest does not match the frozen descriptor."); + } + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error("private title lookup binding digest does not match."); + } + if (knowledgeGuardedUtf8Bytes(envelope) > headerBounds.max_bytes) { + throw new Error("private title lookup envelope exceeds the producer byte cap."); + } + return envelope; + } catch (error) { + if (error instanceof HttpError) + throw error; + throw new HttpError(400, error instanceof Error ? error.message : "invalid private title lookup envelope."); + } +} function validateGuardedAdoptionEnvelope(value, headerBounds, authority, idempotencyKey) { try { if (!value || typeof value !== "object") { @@ -4369,6 +4628,31 @@ function createServeHandler(deps) { throw error; } } + if (path === "/v1/guarded-writes/lookups/title" && method === "POST") { + if (!guardedRepo) { + return json({ error: "guarded_authority_unconfigured" }, 503); + } + const startedAt = Date.now(); + const tenantId = req.headers.get("x-knowledge-tenant-id"); + if (!tenantId) + throw new HttpError(400, "x-knowledge-tenant-id is required."); + await authOrThrow(req, ["knowledge:read"], tenantId); + const bounds = guardedBoundsFromHeaders(req); + const raw = await readBoundedJson(req, bounds, startedAt); + const envelope = validatePrivateTitleLookupEnvelope(raw, bounds, guardedRepo.authority); + if (envelope.descriptor.binding.tenant_id !== tenantId) { + throw new HttpError(403, "descriptor tenant does not match the authenticated request tenant."); + } + try { + const result = await guardedRepo.lookupTitle(envelope.title, envelope.descriptor.binding, bounds); + return boundedJson(result, 200, bounds, startedAt); + } catch (error) { + if (error instanceof PrivateTitleLookupAmbiguousError) { + return boundedJson({ error: "private_title_lookup_ambiguous" }, 409, bounds, startedAt); + } + throw error; + } + } const guardedReceiptMatch = path.match(/^\/v1\/guarded-writes\/receipts\/([^/]+)$/); if (guardedReceiptMatch) { if (method !== "GET") diff --git a/package.json b/package.json index d72ce12..766977c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@hasna/knowledge", - "version": "0.2.99", + "version": "0.2.100", "description": "Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions", "type": "module", "exports": { diff --git a/src/cli.ts b/src/cli.ts index a5c9c89..4e03c09 100755 --- a/src/cli.ts +++ b/src/cli.ts @@ -140,7 +140,7 @@ interface ParseResult { } const EVENTS_COMMANDS = ['events', 'webhooks']; -const COMMANDS = ['add', 'list', 'get', 'delete', 'update', 'archive', 'restore', 'upsert', 'untag', 'versions', 'diff', 'export', 'prune', 'dedupe', 'stats', 'inventory', 'project-panel', 'paths', 'mode', 'setup', 'auth', 'storage', 'machines', 'sync', 'db', 'wiki', 'app-wiki', 'source', 'ingest', 'reindex', 'search', 'context', 'proposals', 'web', 'ask', 'build', 'embeddings', 'providers', 'safety', 'help', ...EVENTS_COMMANDS]; +const COMMANDS = ['add', 'list', 'get', 'delete', 'update', 'archive', 'restore', 'upsert', 'untag', 'versions', 'diff', 'export', 'prune', 'dedupe', 'stats', 'inventory', 'project-panel', 'paths', 'mode', 'guarded', 'setup', 'auth', 'storage', 'machines', 'sync', 'db', 'wiki', 'app-wiki', 'source', 'ingest', 'reindex', 'search', 'context', 'proposals', 'web', 'ask', 'build', 'embeddings', 'providers', 'safety', 'help', ...EVENTS_COMMANDS]; const COMMAND_ALIASES: Record<string, string> = { ls: 'list', rm: 'delete', @@ -370,6 +370,7 @@ Commands: project-panel Emit Projects dashboard project-panel contract paths Show resolved workspace/store paths mode Report the resolved backend (local or cloud) and why + guarded capabilities Report FCAME-1 private transport capability setup Configure local, hosted, or canonical example S3 mode auth login|whoami|logout Manage hosted API credentials storage status|validate|repair-artifact-keys|migrate-legacy-path|merge-legacy-path|import-legacy @@ -503,6 +504,7 @@ function printCommandHelp(command: string): void { if (command === 'project-panel') { console.log('Usage: knowledge project-panel --project <id|name|slug> [--scope project|local|global] [--limit <n>] [--include-archived] [--json|--contract]'); return; } if (command === 'paths') { console.log('Usage: knowledge paths [--scope local|global|project] [--verbose] [--json]'); return; } if (command === 'mode') { console.log(`Usage: knowledge mode [--json]\n Reports which backend this process would use — sqlite (on-box store) or postgres (HTTP /v1) — and\n which env var selected it. Reads the environment only: no store is opened, no config file is read,\n and no request is made, so it is safe on a machine with no config and no network.\n Selection is EXPLICIT-ONLY: set ${KNOWLEDGE_MODE_ENV_KEYS[0]}=sqlite|postgres. Setting only\n ${KNOWLEDGE_API_URL_ENV_KEYS[0]} / ${KNOWLEDGE_API_KEY_ENV_KEYS[0]} does NOT switch backends;\n those are reported as present-but-ignored pointers. Env var NAMES are printed, never values.`); return; } + if (command === 'guarded') { console.log('Usage: knowledge guarded capabilities [--json]\n Reports metadata-only FCAME-1 private input, private result, and exact-title lookup support.'); return; } if (command === 'setup') { console.log('Usage: knowledge setup --mode local|hosted [--api-url https://...] [--canonical-example] [--scope local|global|project] [--json]'); return; } if (command === 'auth') { console.log('Usage: knowledge auth login|whoami|logout [--api-key <key>] [--email <email>] [--org <slug>] [--api-url https://...] [--scope local|global|project] [--json]'); return; } if (command === 'storage') { console.log('Usage: knowledge storage status|validate|repair-artifact-keys|migrate-legacy-path|merge-legacy-path [--approve-write --approved-by <name>] [--scope local|global|project] [--json]\n knowledge storage import-legacy [--dry-run] [--scope global] [--json]'); return; } @@ -874,11 +876,11 @@ async function run(argv: string[]): Promise<void> { if (flags.completions) { const shell = flags.completions; if (shell === 'bash') { - console.log(`_knowledge() { local cur; cur="${"$"}{COMP_WORDS[COMP_CWORD]}"; COMPREPLY=($(compgen -W "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive --json --verbose --yes --help --version --desc --page --limit --search --sort --id --store --title --content --url --tag --rev --to --format --completions --purpose --model --dimensions --semantic --context --max-tokens --max-items --from --since --topic --dedupe --generate --approve-write --provider --mode --machine --workspace --peer-workspace --api-url --canonical-example --api-key --email --org --org-id --user-id --owner --domain --file-results --full --dry-run --fake --no-tailscale --no-artifact-content --no-color --scope --tables --archived --include-archived --project --contract --source-ref --allow-global" -- "$cur")); }; complete -F _knowledge knowledge`); + console.log(`_knowledge() { local cur; cur="${"$"}{COMP_WORDS[COMP_CWORD]}"; COMPREPLY=($(compgen -W "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive --json --verbose --yes --help --version --desc --page --limit --search --sort --id --store --title --content --url --tag --rev --to --format --completions --purpose --model --dimensions --semantic --context --max-tokens --max-items --from --since --topic --dedupe --generate --approve-write --provider --mode --machine --workspace --peer-workspace --api-url --canonical-example --api-key --email --org --org-id --user-id --owner --domain --file-results --full --dry-run --fake --no-tailscale --no-artifact-content --no-color --scope --tables --archived --include-archived --project --contract --source-ref --allow-global" -- "$cur")); }; complete -F _knowledge knowledge`); } else if (shell === 'zsh') { - console.log(`#compdef knowledge\n_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"\{created,title\}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"\{search,loops,runs\}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"\{local,hosted\}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"\{local,global,project\}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`); + console.log(`#compdef knowledge\n_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"\{created,title\}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"\{search,loops,runs\}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"\{local,hosted\}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"\{local,global,project\}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`); } else if (shell === 'fish') { - console.log(`complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables`); + console.log(`complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables`); } else { throw new Error("Invalid --completions value. Use 'bash', 'zsh', or 'fish'."); } @@ -924,6 +926,22 @@ async function run(argv: string[]): Promise<void> { return; } + if (command === 'guarded') { + const action = positional[1] ?? 'capabilities'; + if (action !== 'capabilities') { + throw new Error('Usage: knowledge guarded capabilities [--json]'); + } + output({ + ok: true, + contract: 'FCAME-1', + private_input: true, + private_result: true, + exact_title_lookup: true, + public_body_output: false, + }, flags.json, flags); + return; + } + // Refuse to guess. An API URL with no mode variable is a HALF-CONFIGURED // client: the environment names a store and never says to use it, and every // command below would answer from the on-box store with exit 0 — measured on diff --git a/src/guarded-write-contract.ts b/src/guarded-write-contract.ts index 1890883..2e65dc7 100644 --- a/src/guarded-write-contract.ts +++ b/src/guarded-write-contract.ts @@ -10,6 +10,8 @@ import type { KnowledgeItem } from './store.js'; export const KNOWLEDGE_GUARDED_WRITE_CONTRACT = 'FCAME-1' as const; export const KNOWLEDGE_PRIVATE_INPUT_SCHEMA = 'hasna.knowledge.private-input.v1' as const; +export const KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA = 'hasna.knowledge.private-title-lookup.v1' as const; +export const KNOWLEDGE_PRIVATE_RESULT_SCHEMA = 'hasna.knowledge.private-result.v1' as const; export type KnowledgeAuthorityClassification = 'user_hosted' | 'hasna_saas'; export type KnowledgeGuardedWriteVerb = 'create' | 'update'; @@ -220,6 +222,36 @@ export interface CreateKnowledgePrivateInputDescriptorOptions { expires_in_ms?: number; } +export interface KnowledgePrivateTitleLookupDescriptor { + readonly contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + readonly schema: typeof KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA; + /** Process-private handle. Deliberately non-enumerable and omitted by toJSON. */ + readonly descriptor_id: string; + readonly operation_id: string; + readonly step_id: string; + readonly title_digest: string; + readonly binding_digest: string; + readonly binding: KnowledgeGuardedBinding; + readonly expires_at: string; + toJSON(): Omit<KnowledgePrivateTitleLookupDescriptor, 'descriptor_id' | 'toJSON'>; +} + +export interface CreateKnowledgePrivateTitleLookupDescriptorOptions { + operation_id: string; + step_id: string; + binding: KnowledgeGuardedBinding; + title: string; + /** Defaults to five minutes; bounded to one hour. */ + expires_in_ms?: number; +} + +export interface KnowledgeGuardedTitleLookupEnvelope { + contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + descriptor: Omit<KnowledgePrivateTitleLookupDescriptor, 'descriptor_id' | 'toJSON'>; + title: string; + limits: KnowledgeGuardedBounds; +} + export interface KnowledgeGuardedWriteEnvelope { contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; descriptor: Omit<KnowledgePrivateInputDescriptor, 'toJSON'>; @@ -393,6 +425,51 @@ export interface KnowledgeGuardedWriteResult { readback: KnowledgeGuardedReadback; } +export interface KnowledgePrivateItemProof { + id: string; + version: number; + title_sha256: string; + content_sha256: string; + url_sha256: string | null; + tags_sha256: string; + metadata_sha256: string; + archived: boolean; +} + +export interface KnowledgeGuardedTitleLookup { + contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + exact: true; + bounded: true; + item_count: 0 | 1; + binding: KnowledgeGuardedBinding; + title_digest: string; + items: readonly KnowledgePrivateItemProof[]; + limits: KnowledgeGuardedBounds; +} + +export type KnowledgePrivateResultKind = 'write' | 'readback' | 'title_lookup'; + +export interface KnowledgePrivateResultDescriptor { + readonly contract: typeof KNOWLEDGE_GUARDED_WRITE_CONTRACT; + readonly schema: typeof KNOWLEDGE_PRIVATE_RESULT_SCHEMA; + /** Process-private handle. Deliberately non-enumerable and omitted by toJSON. */ + readonly descriptor_id: string; + readonly kind: KnowledgePrivateResultKind; + readonly result_digest: string; + readonly item_count: number; + readonly expires_at: string; + toJSON(): Omit<KnowledgePrivateResultDescriptor, 'descriptor_id' | 'toJSON'>; +} + +export interface KnowledgePrivateResultProof { + kind: KnowledgePrivateResultKind; + item_count: number; + items: readonly KnowledgePrivateItemProof[]; + deterministic_key?: string; + receipt_id?: string; + duplicate?: boolean; +} + export const DEFAULT_KNOWLEDGE_GUARDED_LIMITS: KnowledgeGuardedLimits = Object.freeze({ submission: Object.freeze({ max_calls: 1, @@ -421,6 +498,18 @@ const PRIVATE_PAYLOADS = new WeakMap<object, { payload: KnowledgeGuardedPayload; revoked: boolean; }>(); +const PRIVATE_TITLE_LOOKUPS = new WeakMap<object, { + title: string; + revoked: boolean; +}>(); +type KnowledgePrivateResultValue = + | { kind: 'write'; value: KnowledgeGuardedWriteResult } + | { kind: 'readback'; value: KnowledgeGuardedReadback } + | { kind: 'title_lookup'; value: KnowledgeGuardedTitleLookup }; +const PRIVATE_RESULTS = new WeakMap<object, { + result: KnowledgePrivateResultValue; + revoked: boolean; +}>(); function assertObjectKeys( value: unknown, @@ -1140,6 +1229,171 @@ export function materializeKnowledgePrivateInput( return state.payload; } +export function createKnowledgePrivateTitleLookupDescriptor( + options: CreateKnowledgePrivateTitleLookupDescriptorOptions, +): KnowledgePrivateTitleLookupDescriptor { + assertBoundText(options.operation_id, 'operation_id'); + assertBoundText(options.step_id, 'step_id'); + assertKnowledgeGuardedBinding(options.binding); + assertBoundText(options.title, 'title', 2048); + const expiresIn = options.expires_in_ms ?? 5 * 60 * 1000; + if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const titleDigest = knowledgeGuardedContentSha256(options.title); + const bindingDigest = knowledgeGuardedDigest({ + binding: options.binding, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest, + }); + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, + operation_id: options.operation_id, + step_id: options.step_id, + title_digest: titleDigest, + binding_digest: bindingDigest, + binding: Object.freeze({ + authority: Object.freeze({ ...options.binding.authority }), + tenant_id: options.binding.tenant_id, + scope: options.binding.scope, + parent_id: options.binding.parent_id, + }), + expires_at: new Date(Date.now() + expiresIn).toISOString(), + } satisfies Omit<KnowledgePrivateTitleLookupDescriptor, 'descriptor_id' | 'toJSON'>); + const descriptor = { + ...metadata, + toJSON: () => metadata, + } as KnowledgePrivateTitleLookupDescriptor; + Object.defineProperty(descriptor, 'descriptor_id', { + value: `kpl_${randomUUID()}`, + enumerable: false, + configurable: false, + writable: false, + }); + Object.freeze(descriptor); + PRIVATE_TITLE_LOOKUPS.set(descriptor, { title: options.title, revoked: false }); + return descriptor; +} + +export function revokeKnowledgePrivateTitleLookupDescriptor( + descriptor: KnowledgePrivateTitleLookupDescriptor, +): void { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) throw new Error('private title lookup descriptor was not created by @hasna/knowledge.'); + state.revoked = true; +} + +/** @internal */ +export function materializeKnowledgePrivateTitleLookup( + descriptor: KnowledgePrivateTitleLookupDescriptor, +): string { + const state = PRIVATE_TITLE_LOOKUPS.get(descriptor); + if (!state) throw new Error('private title lookup descriptor was not created by @hasna/knowledge.'); + if (state.revoked) throw new Error('private title lookup descriptor has been revoked.'); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error('private title lookup descriptor has expired.'); + } + if (knowledgeGuardedContentSha256(state.title) !== descriptor.title_digest) { + throw new Error('private title lookup descriptor digest changed after freeze.'); + } + return state.title; +} + +export function knowledgePrivateItemProof(item: KnowledgeItem): KnowledgePrivateItemProof { + return Object.freeze({ + id: item.id, + version: Number(item.version ?? 1), + title_sha256: knowledgeGuardedContentSha256(item.title), + content_sha256: knowledgeGuardedContentSha256(item.content), + url_sha256: item.url === null || item.url === undefined + ? null + : knowledgeGuardedContentSha256(item.url), + tags_sha256: knowledgeGuardedDigest(item.tags ?? []), + metadata_sha256: knowledgeGuardedDigest(item.metadata ?? {}), + archived: item.archived === true, + }); +} + +/** @internal */ +export function createKnowledgePrivateResultDescriptor( + result: KnowledgePrivateResultValue, + expiresInMs = 5 * 60 * 1000, +): KnowledgePrivateResultDescriptor { + if (!Number.isInteger(expiresInMs) || expiresInMs < 1 || expiresInMs > MAX_DESCRIPTOR_LIFETIME_MS) { + throw new Error(`expires_in_ms must be between 1 and ${MAX_DESCRIPTOR_LIFETIME_MS}.`); + } + const itemCount = result.kind === 'title_lookup' + ? result.value.item_count + : 1; + const metadata = Object.freeze({ + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + schema: KNOWLEDGE_PRIVATE_RESULT_SCHEMA, + kind: result.kind, + result_digest: knowledgeGuardedDigest(result.value), + item_count: itemCount, + expires_at: new Date(Date.now() + expiresInMs).toISOString(), + } satisfies Omit<KnowledgePrivateResultDescriptor, 'descriptor_id' | 'toJSON'>); + const descriptor = { + ...metadata, + toJSON: () => metadata, + } as KnowledgePrivateResultDescriptor; + Object.defineProperty(descriptor, 'descriptor_id', { + value: `kpr_${randomUUID()}`, + enumerable: false, + configurable: false, + writable: false, + }); + Object.freeze(descriptor); + PRIVATE_RESULTS.set(descriptor, { result, revoked: false }); + return descriptor; +} + +export function revokeKnowledgePrivateResultDescriptor( + descriptor: KnowledgePrivateResultDescriptor, +): void { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) throw new Error('private result descriptor was not created by @hasna/knowledge.'); + state.revoked = true; +} + +export function inspectKnowledgePrivateResult( + descriptor: KnowledgePrivateResultDescriptor, +): KnowledgePrivateResultProof { + const state = PRIVATE_RESULTS.get(descriptor); + if (!state) throw new Error('private result descriptor was not created by @hasna/knowledge.'); + if (state.revoked) throw new Error('private result descriptor has been revoked.'); + if (Date.parse(descriptor.expires_at) <= Date.now()) { + throw new Error('private result descriptor has expired.'); + } + if (knowledgeGuardedDigest(state.result.value) !== descriptor.result_digest) { + throw new Error('private result descriptor digest changed after freeze.'); + } + if (state.result.kind === 'write') { + return Object.freeze({ + kind: 'write', + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.readback.item)]), + deterministic_key: state.result.value.deterministic_key, + receipt_id: state.result.value.receipt.receipt_id, + duplicate: state.result.value.duplicate, + }); + } + if (state.result.kind === 'readback') { + return Object.freeze({ + kind: 'readback', + item_count: 1, + items: Object.freeze([knowledgePrivateItemProof(state.result.value.item)]), + }); + } + return Object.freeze({ + kind: 'title_lookup', + item_count: state.result.value.item_count, + items: Object.freeze([...state.result.value.items]), + }); +} + export function assertKnowledgeTerminalCompleteness( reconciliation: KnowledgeTerminalReconciliation, expected: { deterministic_key: string; operation_id: string; step_id: string }, diff --git a/src/guarded-writer.ts b/src/guarded-writer.ts index da3994c..a301599 100644 --- a/src/guarded-writer.ts +++ b/src/guarded-writer.ts @@ -17,9 +17,11 @@ import { computeKnowledgeGuardedAdoptionDeterministicKey, computeKnowledgeGuardedDeterministicKey, computeKnowledgeGuardedManifestDeterministicKey, + createKnowledgePrivateResultDescriptor, knowledgeGuardedDigest, knowledgeGuardedUtf8Bytes, materializeKnowledgePrivateInput, + materializeKnowledgePrivateTitleLookup, normalizeKnowledgeGuardedLimits, type CreateKnowledgeGuardedManifestOptions, type KnowledgeGuardedBinding, @@ -38,10 +40,14 @@ import { type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedSubmission, + type KnowledgeGuardedTitleLookup, + type KnowledgeGuardedTitleLookupEnvelope, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedWriteEnvelope, type KnowledgeGuardedWriteResult, type KnowledgePrivateInputDescriptor, + type KnowledgePrivateResultDescriptor, + type KnowledgePrivateTitleLookupDescriptor, type KnowledgeTerminalReconciliation, } from './guarded-write-contract.js'; @@ -69,6 +75,8 @@ export interface KnowledgeGuardedWriter { bounds?: KnowledgeGuardedBounds, ): Promise<KnowledgeGuardedManifestReconciliation>; execute(descriptor: KnowledgePrivateInputDescriptor): Promise<KnowledgeGuardedWriteResult>; + executePrivate(descriptor: KnowledgePrivateInputDescriptor): Promise<KnowledgePrivateResultDescriptor>; + lookupTitle(descriptor: KnowledgePrivateTitleLookupDescriptor): Promise<KnowledgePrivateResultDescriptor>; reconcile( deterministicKey: string, operationId: string, @@ -79,6 +87,10 @@ export interface KnowledgeGuardedWriter { fullId: string, bounds?: KnowledgeGuardedBounds, ): Promise<KnowledgeGuardedReadback>; + readbackPrivate( + fullId: string, + bounds?: KnowledgeGuardedBounds, + ): Promise<KnowledgePrivateResultDescriptor>; readBindingState( fullId: string, bounds?: KnowledgeGuardedBounds, @@ -119,6 +131,14 @@ export class KnowledgeGuardedOperationConflictError extends Error { } } +export class KnowledgePrivateTitleLookupAmbiguousError extends Error { + readonly code = 'private_title_lookup_ambiguous'; + constructor() { + super('private_title_lookup_ambiguous: more than one exact title exists in the frozen binding.'); + this.name = 'KnowledgePrivateTitleLookupAmbiguousError'; + } +} + export class KnowledgeGuardedManifestConflictError extends Error { readonly code = 'guarded_manifest_conflict'; constructor(readonly manifest: KnowledgeGuardedManifestSubmission['manifest']) { @@ -422,6 +442,74 @@ class GuardedWriter implements KnowledgeGuardedWriter { }; } + async executePrivate( + descriptor: KnowledgePrivateInputDescriptor, + ): Promise<KnowledgePrivateResultDescriptor> { + const result = await this.execute(descriptor); + return createKnowledgePrivateResultDescriptor({ kind: 'write', value: result }); + } + + async lookupTitle( + descriptor: KnowledgePrivateTitleLookupDescriptor, + ): Promise<KnowledgePrivateResultDescriptor> { + if (!sameBinding(descriptor.binding, this.binding)) { + throw new Error('private title lookup descriptor binding does not match this guarded writer.'); + } + const title = materializeKnowledgePrivateTitleLookup(descriptor); + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest, + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error('private title lookup descriptor binding digest changed after freeze.'); + } + const envelope: KnowledgeGuardedTitleLookupEnvelope = { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + descriptor: descriptor.toJSON(), + title, + limits: this.limits.readback, + }; + if (knowledgeGuardedUtf8Bytes(envelope) > this.limits.readback.max_bytes) { + throw new Error('private_title_lookup_request_exceeds_byte_cap.'); + } + let response: KnowledgeGuardedTitleLookup; + try { + response = await this.transport.post<KnowledgeGuardedTitleLookup>( + '/guarded-writes/lookups/title', + envelope, + { + headers: { + ...boundHeaders(this.limits.readback), + 'x-knowledge-tenant-id': this.binding.tenant_id, + }, + timeoutMs: this.limits.readback.wall_time_ms, + retry: false, + }, + ); + } catch (error) { + if (parseErrorBody(error)?.error === 'private_title_lookup_ambiguous') { + throw new KnowledgePrivateTitleLookupAmbiguousError(); + } + throw error; + } + if ( + knowledgeGuardedUtf8Bytes(response) > this.limits.readback.max_bytes + || response.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT + || response.exact !== true + || response.bounded !== true + || response.title_digest !== descriptor.title_digest + || !sameBinding(response.binding, this.binding) + || response.item_count !== response.items.length + || response.item_count > 1 + || response.items.some((item) => item.title_sha256 !== descriptor.title_digest) + ) { + throw new Error('private_title_lookup_exact_bounded_readback_failed.'); + } + return createKnowledgePrivateResultDescriptor({ kind: 'title_lookup', value: response }); + } + async createManifest( manifest: CreateKnowledgeGuardedManifestOptions, bounds: KnowledgeGuardedBounds = this.limits.submission, @@ -802,6 +890,14 @@ class GuardedWriter implements KnowledgeGuardedWriter { } return response; } + + async readbackPrivate( + fullId: string, + bounds: KnowledgeGuardedBounds = this.limits.readback, + ): Promise<KnowledgePrivateResultDescriptor> { + const result = await this.readback(fullId, bounds); + return createKnowledgePrivateResultDescriptor({ kind: 'readback', value: result }); + } } export function createKnowledgeGuardedWriter( diff --git a/src/index.ts b/src/index.ts index a841fcc..9e28cf1 100644 --- a/src/index.ts +++ b/src/index.ts @@ -51,6 +51,8 @@ export { DEFAULT_KNOWLEDGE_GUARDED_LIMITS, KNOWLEDGE_GUARDED_WRITE_CONTRACT, KNOWLEDGE_PRIVATE_INPUT_SCHEMA, + KNOWLEDGE_PRIVATE_RESULT_SCHEMA, + KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, assertKnowledgeGuardedBinding, assertKnowledgeGuardedBounds, assertKnowledgeGuardedManifestBinding, @@ -69,14 +71,19 @@ export { computeKnowledgeGuardedReceiptId, computeKnowledgeGuardedRecoveryKey, createKnowledgePrivateInputDescriptor, + createKnowledgePrivateTitleLookupDescriptor, evaluateKnowledgeGuardedManifestCompletion, knowledgeGuardedDigest, knowledgeGuardedContentSha256, knowledgeGuardedUtf8Bytes, + inspectKnowledgePrivateResult, normalizeKnowledgeGuardedLimits, revokeKnowledgePrivateInputDescriptor, + revokeKnowledgePrivateResultDescriptor, + revokeKnowledgePrivateTitleLookupDescriptor, type CreateKnowledgeGuardedManifestOptions, type CreateKnowledgePrivateInputDescriptorOptions, + type CreateKnowledgePrivateTitleLookupDescriptorOptions, type KnowledgeAuthorityBinding, type KnowledgeAuthorityClassification, type KnowledgeGuardedAdoptionAction, @@ -114,11 +121,16 @@ export { type KnowledgeGuardedRecoveryStrategy, type KnowledgeGuardedRollbackResult, type KnowledgeGuardedSubmission, + type KnowledgeGuardedTitleLookup, type KnowledgeGuardedUpdatePayload, type KnowledgeGuardedWriteEnvelope, type KnowledgeGuardedWriteResult, type KnowledgeGuardedWriteVerb, type KnowledgePrivateInputDescriptor, + type KnowledgePrivateItemProof, + type KnowledgePrivateResultDescriptor, + type KnowledgePrivateResultProof, + type KnowledgePrivateTitleLookupDescriptor, type KnowledgeTerminalReconciliation, } from './guarded-write-contract.js'; export * from './guarded-writer.js'; diff --git a/src/serve.ts b/src/serve.ts index d31b141..604967d 100644 --- a/src/serve.ts +++ b/src/serve.ts @@ -34,6 +34,7 @@ import { import { KNOWLEDGE_GUARDED_WRITE_CONTRACT, KNOWLEDGE_PRIVATE_INPUT_SCHEMA, + KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA, assertKnowledgeGuardedBinding, assertKnowledgeGuardedBounds, assertKnowledgeGuardedManifestOptions, @@ -50,6 +51,7 @@ import { knowledgeGuardedDigest, knowledgeGuardedContentSha256, knowledgeGuardedUtf8Bytes, + knowledgePrivateItemProof, normalizeKnowledgeGuardedLimits, type CreateKnowledgeGuardedManifestOptions, type KnowledgeAuthorityBinding, @@ -70,6 +72,8 @@ import { type KnowledgeGuardedReadback, type KnowledgeGuardedReceipt, type KnowledgeGuardedSubmission, + type KnowledgeGuardedTitleLookup, + type KnowledgeGuardedTitleLookupEnvelope, type KnowledgeGuardedWriteEnvelope, type KnowledgeTerminalReconciliation, } from './guarded-write-contract.js'; @@ -1938,6 +1942,44 @@ class GuardedWriteRepo { }; } + async lookupTitle( + title: string, + binding: KnowledgeGuardedBinding, + limits: KnowledgeGuardedBounds, + ): Promise<KnowledgeGuardedTitleLookup> { + const rows = await this.client.many<Record<string, unknown>>( + `SELECT * FROM knowledge_items + WHERE title = $1 + AND authority_classification = $2 + AND authority_id = $3 + AND tenant_id = $4 + AND scope = $5 + AND parent_id = $6 + ORDER BY id + LIMIT 2`, + [ + title, + binding.authority.classification, + binding.authority.authority_id, + binding.tenant_id, + binding.scope, + binding.parent_id, + ], + ); + if (rows.length > 1) throw new PrivateTitleLookupAmbiguousError(); + const items = rows.map((row) => knowledgePrivateItemProof(rowToItem(row))); + return { + contract: KNOWLEDGE_GUARDED_WRITE_CONTRACT, + exact: true, + bounded: true, + item_count: items.length as 0 | 1, + binding, + title_digest: knowledgeGuardedContentSha256(title), + items, + limits, + }; + } + async readback( fullId: string, binding: KnowledgeGuardedBinding, @@ -1974,6 +2016,13 @@ class GuardedWriteRepo { } } +class PrivateTitleLookupAmbiguousError extends Error { + constructor() { + super('more than one exact title exists in the frozen binding.'); + this.name = 'PrivateTitleLookupAmbiguousError'; + } +} + // --------------------------------------------------------------------------- // OpenAPI document — source of truth for the generated SDK. // --------------------------------------------------------------------------- @@ -2349,6 +2398,19 @@ export function knowledgeOpenApi(version: string): Record<string, unknown> { }, }, }, + '/v1/guarded-writes/lookups/title': { + post: { + operationId: 'lookupGuardedKnowledgeTitle', + summary: 'Bounded exact-title lookup under one frozen FCAME-1 binding', + description: + 'Returns zero or one metadata-only item proof. More than one exact title is an ambiguity error; ' + + 'item bodies and titles are never returned.', + responses: { + '200': { description: 'Exact bounded metadata-only result containing zero or one item proof.' }, + '409': { description: 'More than one exact title exists under the frozen binding.' }, + }, + }, + }, '/v1/guarded-adoptions': { post: { operationId: 'executeGuardedKnowledgeAdoption', @@ -2757,6 +2819,98 @@ function validateGuardedEnvelope( } } +function validatePrivateTitleLookupEnvelope( + value: unknown, + headerBounds: KnowledgeGuardedBounds, + authority: KnowledgeServeGuardedAuthority, +): KnowledgeGuardedTitleLookupEnvelope { + try { + if (!value || typeof value !== 'object') { + throw new Error('private title lookup envelope is required.'); + } + const envelope = value as KnowledgeGuardedTitleLookupEnvelope; + assertExactRequestKeys( + value as Record<string, unknown>, + 'private title lookup envelope', + ['contract', 'descriptor', 'title', 'limits'], + ); + if (envelope.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT) { + throw new Error('unsupported guarded-write contract.'); + } + const descriptor = envelope.descriptor; + if ( + !descriptor + || descriptor.contract !== KNOWLEDGE_GUARDED_WRITE_CONTRACT + || descriptor.schema !== KNOWLEDGE_PRIVATE_TITLE_LOOKUP_SCHEMA + ) { + throw new Error('invalid private title lookup descriptor schema.'); + } + assertExactRequestKeys( + descriptor as Record<string, unknown>, + 'private title lookup descriptor', + [ + 'contract', + 'schema', + 'operation_id', + 'step_id', + 'title_digest', + 'binding_digest', + 'binding', + 'expires_at', + ], + ); + if ( + typeof descriptor.operation_id !== 'string' + || descriptor.operation_id.length === 0 + || typeof descriptor.step_id !== 'string' + || descriptor.step_id.length === 0 + || typeof envelope.title !== 'string' + || envelope.title.length === 0 + || envelope.title.length > 2048 + ) { + throw new Error('private title lookup operation, step, and bounded title are required.'); + } + const descriptorExpiresAt = Date.parse(descriptor.expires_at); + const descriptorNow = Date.now(); + if ( + !Number.isFinite(descriptorExpiresAt) + || descriptorExpiresAt <= descriptorNow + || descriptorExpiresAt > descriptorNow + 60 * 60 * 1000 + ) { + throw new Error('private title lookup descriptor is expired or malformed.'); + } + assertKnowledgeGuardedBinding(descriptor.binding); + assertConfiguredAuthority(descriptor.binding, authority); + assertKnowledgeGuardedBounds(envelope.limits, 'private title lookup bounds'); + if (canonicalKnowledgeGuardedJson(envelope.limits) !== canonicalKnowledgeGuardedJson(headerBounds)) { + throw new Error('private title lookup limits must exactly match the producer bound headers.'); + } + const titleDigest = knowledgeGuardedContentSha256(envelope.title); + if (titleDigest !== descriptor.title_digest) { + throw new Error('private title lookup digest does not match the frozen descriptor.'); + } + const bindingDigest = knowledgeGuardedDigest({ + binding: descriptor.binding, + operation_id: descriptor.operation_id, + step_id: descriptor.step_id, + title_digest: descriptor.title_digest, + }); + if (bindingDigest !== descriptor.binding_digest) { + throw new Error('private title lookup binding digest does not match.'); + } + if (knowledgeGuardedUtf8Bytes(envelope) > headerBounds.max_bytes) { + throw new Error('private title lookup envelope exceeds the producer byte cap.'); + } + return envelope; + } catch (error) { + if (error instanceof HttpError) throw error; + throw new HttpError( + 400, + error instanceof Error ? error.message : 'invalid private title lookup envelope.', + ); + } +} + function validateGuardedAdoptionEnvelope( value: unknown, headerBounds: KnowledgeGuardedBounds, @@ -3183,6 +3337,44 @@ export function createServeHandler(deps: ServeDeps): (req: Request) => Promise<R } } + if (path === '/v1/guarded-writes/lookups/title' && method === 'POST') { + if (!guardedRepo) { + return json({ error: 'guarded_authority_unconfigured' }, 503); + } + const startedAt = Date.now(); + const tenantId = req.headers.get('x-knowledge-tenant-id'); + if (!tenantId) throw new HttpError(400, 'x-knowledge-tenant-id is required.'); + await authOrThrow(req, ['knowledge:read'], tenantId); + const bounds = guardedBoundsFromHeaders(req); + const raw = await readBoundedJson(req, bounds, startedAt); + const envelope = validatePrivateTitleLookupEnvelope( + raw, + bounds, + guardedRepo.authority, + ); + if (envelope.descriptor.binding.tenant_id !== tenantId) { + throw new HttpError(403, 'descriptor tenant does not match the authenticated request tenant.'); + } + try { + const result = await guardedRepo.lookupTitle( + envelope.title, + envelope.descriptor.binding, + bounds, + ); + return boundedJson(result, 200, bounds, startedAt); + } catch (error) { + if (error instanceof PrivateTitleLookupAmbiguousError) { + return boundedJson( + { error: 'private_title_lookup_ambiguous' }, + 409, + bounds, + startedAt, + ); + } + throw error; + } + } + const guardedReceiptMatch = path.match(/^\/v1\/guarded-writes\/receipts\/([^/]+)$/); if (guardedReceiptMatch) { if (method !== 'GET') return json({ error: 'method_not_allowed' }, 405); diff --git a/tests/cli.test.ts b/tests/cli.test.ts index 8ff71f8..52c460d 100644 --- a/tests/cli.test.ts +++ b/tests/cli.test.ts @@ -360,6 +360,7 @@ describe('knowledge cli', () => { expect(out).toContain('inventory'); expect(out).toContain('context pack <query>'); expect(out).toContain('proposals context'); + expect(out).toContain('guarded capabilities'); const sub = runCli(['help', 'list']); expect(sub.exitCode).toBe(0); @@ -373,6 +374,18 @@ describe('knowledge cli', () => { const context = runCli(['help', 'context']); expect(context.exitCode).toBe(0); expect(new TextDecoder().decode(context.stdout)).toContain('knowledge context pack'); + + const guarded = runCli(['guarded', 'capabilities', '--json']); + expect(guarded.exitCode).toBe(0); + const guardedResult = JSON.parse(new TextDecoder().decode(guarded.stdout)) as Record<string, unknown>; + expect(guardedResult).toMatchObject({ + ok: true, + contract: 'FCAME-1', + private_input: true, + private_result: true, + exact_title_lookup: true, + public_body_output: false, + }); }); test("'<sub> --help' prints that subcommand's usage, not root help", () => { diff --git a/tests/guarded-writer.test.ts b/tests/guarded-writer.test.ts index f4dd4d3..309418f 100644 --- a/tests/guarded-writer.test.ts +++ b/tests/guarded-writer.test.ts @@ -24,6 +24,8 @@ import { computeKnowledgeGuardedRecoveryKey, createKnowledgeGuardedWriter, createKnowledgePrivateInputDescriptor, + createKnowledgePrivateTitleLookupDescriptor, + inspectKnowledgePrivateResult, knowledgeGuardedDigest, type KnowledgeGuardedBinding, type KnowledgeGuardedManifestBinding, @@ -1408,6 +1410,114 @@ describe('FCAME-1 guarded Knowledge writer', () => { await expect(writer().readback(result.readback.item.short_id!)).rejects.toThrow(); }); + test('private write and exact readback descriptors expose digests, never private fields or handles', async () => { + const targetId = 'k_fcame_private_result_descriptor'; + const title = 'Private result descriptor title'; + const content = 'private result descriptor body'; + const tags = ['doctrine', 'private-result']; + const metadata = { source: 'reviewed-canonical-source', privacy_class: 'internal-redacted' }; + const input = descriptor({ + operation: 'op-private-result-descriptor', + step: 'step-create', + target: targetId, + payload: { title, content, tags, metadata }, + }); + + const privateResult = await writer().executePrivate(input); + const serialized = JSON.stringify(privateResult); + expect(serialized).not.toContain(title); + expect(serialized).not.toContain(content); + expect(serialized).not.toContain(targetId); + expect(serialized).not.toContain(privateResult.descriptor_id); + expect(serialized).toContain(privateResult.result_digest); + + const proof = inspectKnowledgePrivateResult(privateResult); + expect(proof.kind).toBe('write'); + expect(proof.item_count).toBe(1); + expect(proof.items).toEqual([{ + id: targetId, + version: 1, + title_sha256: createHash('sha256').update(title).digest('hex'), + content_sha256: createHash('sha256').update(content).digest('hex'), + url_sha256: null, + tags_sha256: knowledgeGuardedDigest(tags), + metadata_sha256: knowledgeGuardedDigest(metadata), + archived: false, + }]); + expect(JSON.stringify(proof)).not.toContain(title); + expect(JSON.stringify(proof)).not.toContain(content); + + const exact = await writer().readbackPrivate(targetId); + expect(inspectKnowledgePrivateResult(exact).items).toEqual(proof.items); + + const replay = await writer().executePrivate(input); + const replayProof = inspectKnowledgePrivateResult(replay); + expect(replayProof.duplicate).toBe(true); + expect(replayProof.receipt_id).toBe(proof.receipt_id); + expect(replayProof.items).toEqual(proof.items); + }); + + test('private title lookup is authoritative, bounded, exact-scope, and ambiguity refusing', async () => { + const title = 'Private title lookup target'; + const targetId = 'k_fcame_private_title_lookup'; + await writer().execute(descriptor({ + operation: 'op-private-title-lookup-create', + step: 'step-create', + target: targetId, + payload: { title, content: 'private title lookup body' }, + })); + + const lookup = createKnowledgePrivateTitleLookupDescriptor({ + operation_id: 'op-private-title-lookup', + step_id: 'step-lookup', + binding: BINDING, + title, + }); + const serializedLookup = JSON.stringify(lookup); + expect(serializedLookup).not.toContain(title); + expect(serializedLookup).not.toContain(lookup.descriptor_id); + expect(serializedLookup).toContain(lookup.title_digest); + + const result = await writer().lookupTitle(lookup); + const proof = inspectKnowledgePrivateResult(result); + expect(proof.kind).toBe('title_lookup'); + expect(proof.item_count).toBe(1); + expect(proof.items[0]?.id).toBe(targetId); + expect(proof.items[0]?.title_sha256).toBe(lookup.title_digest); + expect(JSON.stringify(result)).not.toContain(title); + expect(JSON.stringify(proof)).not.toContain(title); + + const wrongScope = createKnowledgeGuardedWriter({ + binding: { ...BINDING, scope: 'project:wrong', parent_id: 'project:wrong' }, + env, + }); + await expect(wrongScope.lookupTitle(lookup)).rejects.toThrow(/binding/i); + + const expired = createKnowledgePrivateTitleLookupDescriptor({ + operation_id: 'op-private-title-lookup-expired', + step_id: 'step-lookup', + binding: BINDING, + title, + expires_in_ms: 1, + }); + await Bun.sleep(5); + await expect(writer().lookupTitle(expired)).rejects.toThrow(/expired/i); + + await writer().execute(descriptor({ + operation: 'op-private-title-lookup-duplicate', + step: 'step-create', + target: 'k_fcame_private_title_lookup_duplicate', + payload: { title, content: 'second item with the same title' }, + })); + const ambiguous = createKnowledgePrivateTitleLookupDescriptor({ + operation_id: 'op-private-title-lookup-ambiguous', + step_id: 'step-lookup', + binding: BINDING, + title, + }); + await expect(writer().lookupTitle(ambiguous)).rejects.toThrow(/ambiguous/i); + }); + test('same-operation replay proves one effect; changed semantics are refused', async () => { const input = descriptor({ operation: 'op-duplicate-proof', diff --git a/tests/package-release.test.ts b/tests/package-release.test.ts index 8995d50..c892ee0 100644 --- a/tests/package-release.test.ts +++ b/tests/package-release.test.ts @@ -108,7 +108,7 @@ describe('public package release safety', () => { } }); - test('guarded private-input public declarations match the runtime export contract', () => { + test('guarded private transport declarations match the runtime export contract', () => { const rootDeclaration = readFileSync(join(repoRoot, 'dist/index.d.ts'), 'utf8'); const guardedContractDeclaration = readFileSync(join(repoRoot, 'dist/guarded-write-contract.d.ts'), 'utf8'); @@ -116,9 +116,22 @@ describe('public package release safety', () => { expect(declarationExportsIdentifier(rootDeclaration, 'createKnowledgePrivateInputDescriptor')).toBe(true); expect(declarationExportsIdentifier(guardedContractDeclaration, 'createKnowledgePrivateInputDescriptor')).toBe(true); + expect(rootRuntimeExports.createKnowledgePrivateTitleLookupDescriptor).toBeFunction(); + expect(declarationExportsIdentifier(rootDeclaration, 'createKnowledgePrivateTitleLookupDescriptor')).toBe(true); + expect(declarationExportsIdentifier(guardedContractDeclaration, 'createKnowledgePrivateTitleLookupDescriptor')).toBe(true); + expect(rootRuntimeExports.inspectKnowledgePrivateResult).toBeFunction(); + expect(declarationExportsIdentifier(rootDeclaration, 'inspectKnowledgePrivateResult')).toBe(true); + expect(declarationExportsIdentifier(guardedContractDeclaration, 'inspectKnowledgePrivateResult')).toBe(true); + expect(rootRuntimeExports.materializeKnowledgePrivateInput).toBeUndefined(); expect(declarationExportsIdentifier(rootDeclaration, 'materializeKnowledgePrivateInput')).toBe(false); expect(declarationExportsIdentifier(guardedContractDeclaration, 'materializeKnowledgePrivateInput')).toBe(false); + expect(rootRuntimeExports.materializeKnowledgePrivateTitleLookup).toBeUndefined(); + expect(declarationExportsIdentifier(rootDeclaration, 'materializeKnowledgePrivateTitleLookup')).toBe(false); + expect(declarationExportsIdentifier(guardedContractDeclaration, 'materializeKnowledgePrivateTitleLookup')).toBe(false); + expect(rootRuntimeExports.createKnowledgePrivateResultDescriptor).toBeUndefined(); + expect(declarationExportsIdentifier(rootDeclaration, 'createKnowledgePrivateResultDescriptor')).toBe(false); + expect(declarationExportsIdentifier(guardedContractDeclaration, 'createKnowledgePrivateResultDescriptor')).toBe(false); }); /** From af8fa95bfdeb3d35a98540ba634807b0949723e2 Mon Sep 17 00:00:00 2001 From: Andrei Hasna <andrei@hasna.com> Date: Sun, 9 Aug 2026 13:11:05 +0300 Subject: [PATCH 2/2] fix: scope private transport capability claim Name the no-body guarantee for the private transport instead of implying that legacy public guarded readback changed. Agent: quintilianus --- bin/knowledge.js | 2 +- src/cli.ts | 2 +- tests/cli.test.ts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/knowledge.js b/bin/knowledge.js index 6c8f33c..558a003 100755 --- a/bin/knowledge.js +++ b/bin/knowledge.js @@ -1558,5 +1558,5 @@ ${i_()}`:Yf(_))}function i_(_="full details"){return`Hint: use --verbose for ${_ `)}function vf(_){let $=Array.isArray(_.citations)?_.citations:[],D=Array.isArray(_.context?.excerpts)?_.context.excerpts:Array.isArray(_.excerpts)?_.excerpts:[],U=[_.generated?"Generated answer with citations":"Prepared citation context draft",`Citations: ${$.length}; excerpts: ${D.length}`];if(_.answer)U.push(`Answer: ${D_(_.answer,500)}`);for(let g of $.slice(0,5))U.push(`- ${D_(g.source_uri??g.ref??g.id,120)}`);return U.push(i_("full answer payload, context, citations, and run ledger")),U.join(` `)}function ff(_,$){return[`Export preview: ${_.length} item(s) available`,"Default output is compact to avoid terminal/context bloat.","Use --verbose or --json for a JSON object, or --format jsonl for newline-delimited records.",$!=="json"?`Requested format: ${$}`:""].filter(Boolean).join(` `)}function l8(_){return!_||_==="local"||_==="localhost"}function _0(_){if(!_.id)throw Error("Missing required --id. Example: knowledge get --id <id>")}function wf(_,$){let D=$.sort??"created";if(D!=="created"&&D!=="title")throw Error("Invalid --sort value. Use 'created' or 'title'.");let U=[..._].sort((g,I)=>{if(D==="title")return g.title.localeCompare(I.title);return g.created_at.localeCompare(I.created_at)});if($.desc)U.reverse();return{sorted:U,sort:D,direction:$.desc?"desc":"asc"}}async function uf(_){if(await Wf(_))return;let{positional:$,flags:D}=Lf(_);if($0("debug","CLI invoked",{command:$[0],flags:{json:D.json,store:D.store}}),D.version){console.log(D.json?JSON.stringify({name:C$.name,version:C$.version},null,2):`${C$.name} ${C$.version}`);return}if(D.completions){let J=D.completions;if(J==="bash")console.log('_knowledge() { local cur; cur="${COMP_WORDS[COMP_CWORD]}"; COMPREPLY=($(compgen -W "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive --json --verbose --yes --help --version --desc --page --limit --search --sort --id --store --title --content --url --tag --rev --to --format --completions --purpose --model --dimensions --semantic --context --max-tokens --max-items --from --since --topic --dedupe --generate --approve-write --provider --mode --machine --workspace --peer-workspace --api-url --canonical-example --api-key --email --org --org-id --user-id --owner --domain --file-results --full --dry-run --fake --no-tailscale --no-artifact-content --no-color --scope --tables --archived --include-archived --project --contract --source-ref --allow-global" -- "$cur")); }; complete -F _knowledge knowledge');else if(J==="zsh")console.log(`#compdef knowledge -_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"{created,title}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"{search,loops,runs}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"{local,hosted}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"{local,global,project}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`);else if(J==="fish")console.log('complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables');else throw Error("Invalid --completions value. Use 'bash', 'zsh', or 'fish'.");return}let U=Jf($[0]),g=1,I=$.length>1||/\s/.test(U);if(Sf()&&U&&!o8.includes(U)&&I)U="ask",g=0;if(!U||D.help||U==="help"){let J=U==="help"?$[1]:U||$[1];Rf(J);return}if(U==="mode"){let J=ES(process.env);r(D.json||D.verbose?{ok:!0,...J}:Qf(J),D.json,D);return}if(U==="guarded"){if(($[1]??"capabilities")!=="capabilities")throw Error("Usage: knowledge guarded capabilities [--json]");r({ok:!0,contract:"FCAME-1",private_input:!0,private_result:!0,exact_title_lookup:!0,public_body_output:!1},D.json,D);return}NS(process.env,{storePathOverridden:Boolean(D.store)});let j=U==="project-panel"||U==="app-wiki"?D.scope??"project":D.scope,N=IN({scope:j});if(U==="storage"){let J=$[1]??"status";if(J==="import-legacy"){if(D.scope&&D.scope!=="global")throw Error("knowledge storage import-legacy only supports --scope global because ~/.open-knowledge is a global legacy store.");let P=uN({dryRun:D.dryRun});if(r(P,D.json),!P.ok)process.exitCode=1;return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}}let O=Boolean(D.store),A=D.store;if(!A)if(j==="project"||j==="local")A=N.workspace.jsonStorePath;else A=CU();if(!O&&(U==="ask"||U==="build")&&!Y6())kD(A);let L=cU({storePath:A,storePathOverridden:O});if(U==="inventory"){let J=await N.resolveInventory({limit:D.limit,includeArchived:D.includeArchived||D.archived,storePath:Y6()?void 0:A});r(D.json||D.verbose?J:qf(J),D.json,D);return}if(U==="project-panel"){let J=D.project??$[1];if(!J)throw Error("Usage: knowledge project-panel --project <id|name|slug> [--json|--contract]");let P=await p9(J,{service:N,limit:D.limit,storePath:Y6()?void 0:A,includeArchived:D.includeArchived||D.archived});r(D.json||D.contract?P:e9(P),D.json||D.contract);return}if(U==="paths"){let J=N.paths();r(D.json||D.verbose?J:Tf(J),D.json,D);return}if(U==="setup"){let J=N.setup({mode:D.mode,apiUrl:D.apiUrl,canonicalExample:D.canonicalExample});r(J,D.json,D);return}if(U==="auth"){let J=$[1]??"whoami";if(J==="whoami"||J==="status"){let P=N.authStatus(process.env);r({ok:!0,...P,message:P.authenticated?`Authenticated via ${P.source}`:"Not authenticated"},D.json,D);return}if(J==="login"){let P=D.apiKey??process.env.KNOWLEDGE_API_KEY??process.env.HASNA_KNOWLEDGE_API_KEY;if(!P)throw Error("Usage: knowledge auth login --api-key <key> [--email <email>]");let S=N.saveAuth({apiKey:P,email:D.email,orgSlug:D.org,orgId:D.orgId,userId:D.userId,apiUrl:D.apiUrl},process.env);r({ok:!0,authenticated:!0,email:S.email??null,org_slug:S.org_slug??null,api_url:S.api_url??N.authStatus(process.env).api_url,auth_path:N.authStatus(process.env).auth_path,message:`Saved hosted credentials for ${S.email??"API key"}`},D.json,D);return}if(J==="logout"){let P=N.clearAuth(process.env);r({ok:!0,removed:P,message:P?"Removed hosted credentials":"No hosted credentials found"},D.json,D);return}throw Error("Invalid auth action. Use 'login', 'whoami', or 'logout'.")}if(U==="storage"){let J=$[1]??"status";if(J==="status"){let P=N.storageContract(),S=N.validateStorage();r({ok:S.ok,...P,validation:S,message:`${P.storage_type} artifact storage at ${P.artifact_store.uri_prefix}`},D.json,D);return}if(J==="validate"){let P=N.validateStorage();if(r({ok:P.ok,validation:P,message:P.ok?"Storage contract valid":`Storage contract invalid: ${P.errors.join("; ")}`},D.json,D),!P.ok)process.exitCode=1;return}if(J==="repair-artifact-keys"||J==="repair-keys"){let P=N.repairArtifactManifestKeys({approveWrite:D.approveWrite,approvedBy:D.approvedBy,dryRun:D.dryRun});r(P,D.json,D);return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid storage action. Use 'status', 'validate', 'repair-artifact-keys', 'migrate-legacy-path', 'merge-legacy-path', or 'import-legacy'.")}if(U==="machines"){let J=$[1]??"topology";if(J==="topology"||J==="status"){let P=await N.machineTopology({includeTailscale:D.tailscale!==!1});r(D.json||D.verbose?P:Mf(P),D.json,D);return}if(J==="preflight"||J==="check"){let P=$[2]??D.machine??"local",S=D.workspace??process.cwd(),X=await N.machinePreflight({machineId:P,commands:[{command:"bun",required:!0},{command:"knowledge",required:!0}],packages:[{name:C$.name,command:"knowledge",expectedVersion:C$.version,required:!0},{name:"@hasna/machines",command:"machines",required:!1}],workspaces:[{label:"open-knowledge",path:S,expectedPackageName:C$.name,expectedVersion:C$.version,required:!0}]});if(r(D.json||D.verbose?X:Zf(X),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid machines action. Use 'topology' or 'preflight'.")}if(U==="sync"){let J=$[1]??"status",P=D.tables?D.tables.split(",").map((S)=>S.trim()).filter(Boolean):void 0;if(J==="status"){let S=N.syncStatus();r(D.json||D.verbose?S:bf(S),D.json,D);return}if(J==="doctor"||J==="readiness"||J==="preflight"){let S=await N.syncDoctor({machine:D.machine??null,peerWorkspace:D.peerWorkspace??null,includeTailscale:D.tailscale!==!1,tables:P}),X={package:{name:C$.name,version:C$.version},...S};if(r(D.json||D.verbose?X:Hf(X),D.json,D),!S.ok&&!D.json)process.exitCode=1;return}if(J==="snapshot"||J==="record"){let S=await N.createSyncSnapshot({includeTailscale:D.tailscale!==!1,machineId:D.machine});r(D.json||D.verbose?S:kf(S),D.json,D);return}if(J==="conflicts"||J==="conflict"){let S=$[2];if(S==="show"||S==="get"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts show <id>");let V=N.syncConflict(R);r({ok:!0,conflict:V,message:`Sync conflict ${R}`},D.json,D);return}if(S==="propose"||S==="proposal"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts propose <id>");r(D.mode==="ai"?await N.proposeSyncConflictResolutionWithAi({id:R,modelRef:D.model,fake:D.fake}):N.proposeSyncConflictResolution(R),D.json,D);return}if(S==="resolve"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts resolve <id> --approve-write --approved-by <name> [--strategy <name>]");let V=N.resolveSyncConflict({id:R,strategy:D.strategy,approvedBy:D.approvedBy,approveWrite:D.approveWrite,proposedPatchUri:D.patchUri});if(r(V,D.json,D),!V.ok&&!D.json)process.exitCode=1;return}let X=N.syncConflicts({status:S,limit:D.limit}),G={ok:!0,conflicts:X,message:`${X.length} sync conflict(s)`};r(D.json||D.verbose?G:Cf(G),D.json,D);return}if(J==="machines"||J==="registry"){let S=N.syncMachines(),X={ok:!0,machines:S,message:`${S.length} registered sync machine(s)`};r(D.json||D.verbose?X:rf(X),D.json,D);return}if(J==="export"){let S=N.exportSyncBundle({machineId:D.machine??null,tables:P,includeArtifactContent:D.artifactContent!==!1});r(S,!0);return}if(J==="import"){let S=await Bun.stdin.text();if(!S.trim())throw Error("Usage: knowledge sync import < bundle.json");let X=await N.importSyncBundle({bundle:JSON.parse(S),dryRun:D.dryRun,direction:"import",machineId:D.machine??null});r(D.json||D.verbose?X:i8(X,J),D.json,D);return}if(J==="dry-run"||J==="pull"||J==="push"||J==="sync"){if(!D.peerWorkspace&&l8(D.machine))throw Error(`Usage: knowledge sync ${J} --peer-workspace <repo-or-knowledge-home> [--scope project] +_knowledge() { _arguments -C "1: :(add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive)" "(--json)--json" "(--verbose)--verbose" "(--yes)-y" "(--help)--help" "(--version)--version" "(--desc)--desc" "(--archived)--archived" "(--include-archived)--include-archived" "(--semantic)--semantic" "(--context)--context" "(--dedupe)--dedupe" "(--generate)--generate" "(--approve-write)--approve-write" "(--canonical-example)--canonical-example" "(--file-results)--file-results" "(--full)--full" "(--dry-run)--dry-run" "(--fake)--fake" "(--no-tailscale)--no-tailscale" "(--no-artifact-content)--no-artifact-content" "(--contract)--contract" "(--allow-global)--allow-global" "(-p --page)"{-p,--page}"[page number]:number:" "(-l --limit)"{-l,--limit}"[items per page]:number:" "(-s --search)"{-s,--search}"[search text]:text:" "(--sort)--sort"{created,title}:" "(--id)--id[item id]:id:" "(--store)--store[store path]:path:" "(--title)--title[new title]:" "(--content)--content[new content]:" "(--url)--url[source url]:" "(-t --tag)"{-t,--tag}"[tag]:tag:" "(--format)--format[json|jsonl]:" "(--completions)--completions[output completions]:shell:(bash zsh fish):" "(--purpose)--purpose[purpose]:" "(--model)--model[model ref]:" "(--dimensions)--dimensions[embedding dimensions]:number:" "(--max-tokens)--max-tokens[token budget]:number:" "(--max-items)--max-items[item budget]:number:" "(--from)--from"{search,loops,runs}:" "(--to)--to[diff target: version number or current]:" "(--rev)--rev[entry version for diff]:number:" "(--since)--since[duration or ISO time]:" "(--topic)--topic[topic text]:" "(--provider)--provider[provider]:" "(--mode)--mode"{local,hosted}:" "(--machine)--machine[machine id or SSH alias]:" "(--workspace)--workspace[repo workspace path]:path:" "(--peer-workspace)--peer-workspace[peer repo or knowledge home path]:path:" "(--api-url)--api-url[hosted API URL]:" "(--api-key)--api-key[hosted API key]:" "(--email)--email[email]:" "(--org)--org[org slug]:" "(--org-id)--org-id[org id]:" "(--user-id)--user-id[user id]:" "(--owner)--owner[provenance owner]:" "(--domain)--domain[domain]:" "(--project)--project[project id/name/slug]:" "(--source-ref)--source-ref[source ref]:" "(--no-color)--no-color[disable color]" "(--scope)--scope"{local,global,project}:" "(--tables)--tables[comma-separated DB sync tables]:" }; _knowledge`);else if(J==="fish")console.log('complete -c knowledge -f; complete -c knowledge -a "add list get update archive restore upsert untag versions diff delete export prune dedupe stats inventory project-panel paths mode guarded setup auth storage machines sync db wiki app-wiki source ingest reindex search context proposals web ask build embeddings providers safety events webhooks help ls rm edit unarchive"; complete -c knowledge -l json; complete -c knowledge -l verbose; complete -c knowledge -l yes -s y; complete -c knowledge -l help -s h; complete -c knowledge -l version -s v; complete -c knowledge -l desc; complete -c knowledge -l archived; complete -c knowledge -l include-archived; complete -c knowledge -l semantic; complete -c knowledge -l context; complete -c knowledge -l max-tokens; complete -c knowledge -l max-items; complete -c knowledge -l from -a "search loops runs"; complete -c knowledge -l to; complete -c knowledge -l rev; complete -c knowledge -l since; complete -c knowledge -l topic; complete -c knowledge -l dedupe; complete -c knowledge -l generate; complete -c knowledge -l approve-write; complete -c knowledge -l allow-global; complete -c knowledge -l canonical-example; complete -c knowledge -l provider; complete -c knowledge -l mode; complete -c knowledge -l machine; complete -c knowledge -l workspace; complete -c knowledge -l peer-workspace; complete -c knowledge -l api-url; complete -c knowledge -l api-key; complete -c knowledge -l email; complete -c knowledge -l org; complete -c knowledge -l org-id; complete -c knowledge -l user-id; complete -c knowledge -l owner; complete -c knowledge -l domain; complete -c knowledge -l project; complete -c knowledge -l contract; complete -c knowledge -l source-ref; complete -c knowledge -l file-results; complete -c knowledge -l full; complete -c knowledge -l dry-run; complete -c knowledge -l fake; complete -c knowledge -l no-tailscale; complete -c knowledge -l no-artifact-content; complete -c knowledge -s p -l page; complete -c knowledge -s l -l limit; complete -c knowledge -s s -l search; complete -c knowledge -l sort; complete -c knowledge -l id; complete -c knowledge -l store; complete -c knowledge -l title; complete -c knowledge -l content; complete -c knowledge -l url; complete -c knowledge -s t -l tag; complete -c knowledge -l format; complete -c knowledge -l completions; complete -c knowledge -l purpose; complete -c knowledge -l model; complete -c knowledge -l dimensions; complete -c knowledge -l no-color; complete -c knowledge -l scope -a "local global project"; complete -c knowledge -l tables');else throw Error("Invalid --completions value. Use 'bash', 'zsh', or 'fish'.");return}let U=Jf($[0]),g=1,I=$.length>1||/\s/.test(U);if(Sf()&&U&&!o8.includes(U)&&I)U="ask",g=0;if(!U||D.help||U==="help"){let J=U==="help"?$[1]:U||$[1];Rf(J);return}if(U==="mode"){let J=ES(process.env);r(D.json||D.verbose?{ok:!0,...J}:Qf(J),D.json,D);return}if(U==="guarded"){if(($[1]??"capabilities")!=="capabilities")throw Error("Usage: knowledge guarded capabilities [--json]");r({ok:!0,contract:"FCAME-1",private_input:!0,private_result:!0,exact_title_lookup:!0,private_transport_body_output:!1},D.json,D);return}NS(process.env,{storePathOverridden:Boolean(D.store)});let j=U==="project-panel"||U==="app-wiki"?D.scope??"project":D.scope,N=IN({scope:j});if(U==="storage"){let J=$[1]??"status";if(J==="import-legacy"){if(D.scope&&D.scope!=="global")throw Error("knowledge storage import-legacy only supports --scope global because ~/.open-knowledge is a global legacy store.");let P=uN({dryRun:D.dryRun});if(r(P,D.json),!P.ok)process.exitCode=1;return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}}let O=Boolean(D.store),A=D.store;if(!A)if(j==="project"||j==="local")A=N.workspace.jsonStorePath;else A=CU();if(!O&&(U==="ask"||U==="build")&&!Y6())kD(A);let L=cU({storePath:A,storePathOverridden:O});if(U==="inventory"){let J=await N.resolveInventory({limit:D.limit,includeArchived:D.includeArchived||D.archived,storePath:Y6()?void 0:A});r(D.json||D.verbose?J:qf(J),D.json,D);return}if(U==="project-panel"){let J=D.project??$[1];if(!J)throw Error("Usage: knowledge project-panel --project <id|name|slug> [--json|--contract]");let P=await p9(J,{service:N,limit:D.limit,storePath:Y6()?void 0:A,includeArchived:D.includeArchived||D.archived});r(D.json||D.contract?P:e9(P),D.json||D.contract);return}if(U==="paths"){let J=N.paths();r(D.json||D.verbose?J:Tf(J),D.json,D);return}if(U==="setup"){let J=N.setup({mode:D.mode,apiUrl:D.apiUrl,canonicalExample:D.canonicalExample});r(J,D.json,D);return}if(U==="auth"){let J=$[1]??"whoami";if(J==="whoami"||J==="status"){let P=N.authStatus(process.env);r({ok:!0,...P,message:P.authenticated?`Authenticated via ${P.source}`:"Not authenticated"},D.json,D);return}if(J==="login"){let P=D.apiKey??process.env.KNOWLEDGE_API_KEY??process.env.HASNA_KNOWLEDGE_API_KEY;if(!P)throw Error("Usage: knowledge auth login --api-key <key> [--email <email>]");let S=N.saveAuth({apiKey:P,email:D.email,orgSlug:D.org,orgId:D.orgId,userId:D.userId,apiUrl:D.apiUrl},process.env);r({ok:!0,authenticated:!0,email:S.email??null,org_slug:S.org_slug??null,api_url:S.api_url??N.authStatus(process.env).api_url,auth_path:N.authStatus(process.env).auth_path,message:`Saved hosted credentials for ${S.email??"API key"}`},D.json,D);return}if(J==="logout"){let P=N.clearAuth(process.env);r({ok:!0,removed:P,message:P?"Removed hosted credentials":"No hosted credentials found"},D.json,D);return}throw Error("Invalid auth action. Use 'login', 'whoami', or 'logout'.")}if(U==="storage"){let J=$[1]??"status";if(J==="status"){let P=N.storageContract(),S=N.validateStorage();r({ok:S.ok,...P,validation:S,message:`${P.storage_type} artifact storage at ${P.artifact_store.uri_prefix}`},D.json,D);return}if(J==="validate"){let P=N.validateStorage();if(r({ok:P.ok,validation:P,message:P.ok?"Storage contract valid":`Storage contract invalid: ${P.errors.join("; ")}`},D.json,D),!P.ok)process.exitCode=1;return}if(J==="repair-artifact-keys"||J==="repair-keys"){let P=N.repairArtifactManifestKeys({approveWrite:D.approveWrite,approvedBy:D.approvedBy,dryRun:D.dryRun});r(P,D.json,D);return}if(J==="migrate-legacy-path"||J==="migrate-legacy"||J==="migrate-path"){let P=N.migrateLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}if(J==="merge-legacy-path"||J==="merge-legacy"||J==="merge-path"){let P=N.mergeLegacyPath({approveWrite:D.approveWrite,approvedBy:D.approvedBy});if(r(P,D.json),!P.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid storage action. Use 'status', 'validate', 'repair-artifact-keys', 'migrate-legacy-path', 'merge-legacy-path', or 'import-legacy'.")}if(U==="machines"){let J=$[1]??"topology";if(J==="topology"||J==="status"){let P=await N.machineTopology({includeTailscale:D.tailscale!==!1});r(D.json||D.verbose?P:Mf(P),D.json,D);return}if(J==="preflight"||J==="check"){let P=$[2]??D.machine??"local",S=D.workspace??process.cwd(),X=await N.machinePreflight({machineId:P,commands:[{command:"bun",required:!0},{command:"knowledge",required:!0}],packages:[{name:C$.name,command:"knowledge",expectedVersion:C$.version,required:!0},{name:"@hasna/machines",command:"machines",required:!1}],workspaces:[{label:"open-knowledge",path:S,expectedPackageName:C$.name,expectedVersion:C$.version,required:!0}]});if(r(D.json||D.verbose?X:Zf(X),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid machines action. Use 'topology' or 'preflight'.")}if(U==="sync"){let J=$[1]??"status",P=D.tables?D.tables.split(",").map((S)=>S.trim()).filter(Boolean):void 0;if(J==="status"){let S=N.syncStatus();r(D.json||D.verbose?S:bf(S),D.json,D);return}if(J==="doctor"||J==="readiness"||J==="preflight"){let S=await N.syncDoctor({machine:D.machine??null,peerWorkspace:D.peerWorkspace??null,includeTailscale:D.tailscale!==!1,tables:P}),X={package:{name:C$.name,version:C$.version},...S};if(r(D.json||D.verbose?X:Hf(X),D.json,D),!S.ok&&!D.json)process.exitCode=1;return}if(J==="snapshot"||J==="record"){let S=await N.createSyncSnapshot({includeTailscale:D.tailscale!==!1,machineId:D.machine});r(D.json||D.verbose?S:kf(S),D.json,D);return}if(J==="conflicts"||J==="conflict"){let S=$[2];if(S==="show"||S==="get"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts show <id>");let V=N.syncConflict(R);r({ok:!0,conflict:V,message:`Sync conflict ${R}`},D.json,D);return}if(S==="propose"||S==="proposal"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts propose <id>");r(D.mode==="ai"?await N.proposeSyncConflictResolutionWithAi({id:R,modelRef:D.model,fake:D.fake}):N.proposeSyncConflictResolution(R),D.json,D);return}if(S==="resolve"){let R=$[3]??D.id;if(!R)throw Error("Usage: knowledge sync conflicts resolve <id> --approve-write --approved-by <name> [--strategy <name>]");let V=N.resolveSyncConflict({id:R,strategy:D.strategy,approvedBy:D.approvedBy,approveWrite:D.approveWrite,proposedPatchUri:D.patchUri});if(r(V,D.json,D),!V.ok&&!D.json)process.exitCode=1;return}let X=N.syncConflicts({status:S,limit:D.limit}),G={ok:!0,conflicts:X,message:`${X.length} sync conflict(s)`};r(D.json||D.verbose?G:Cf(G),D.json,D);return}if(J==="machines"||J==="registry"){let S=N.syncMachines(),X={ok:!0,machines:S,message:`${S.length} registered sync machine(s)`};r(D.json||D.verbose?X:rf(X),D.json,D);return}if(J==="export"){let S=N.exportSyncBundle({machineId:D.machine??null,tables:P,includeArtifactContent:D.artifactContent!==!1});r(S,!0);return}if(J==="import"){let S=await Bun.stdin.text();if(!S.trim())throw Error("Usage: knowledge sync import < bundle.json");let X=await N.importSyncBundle({bundle:JSON.parse(S),dryRun:D.dryRun,direction:"import",machineId:D.machine??null});r(D.json||D.verbose?X:i8(X,J),D.json,D);return}if(J==="dry-run"||J==="pull"||J==="push"||J==="sync"){if(!D.peerWorkspace&&l8(D.machine))throw Error(`Usage: knowledge sync ${J} --peer-workspace <repo-or-knowledge-home> [--scope project] Remote machine sync can omit --peer-workspace when machines path mapping is configured.`);let S=J==="dry-run"?"both":J==="sync"?"both":J,X=!l8(D.machine)?await N.syncRemotePeer({direction:S,machine:D.machine,peerWorkspace:D.peerWorkspace,tables:P,dryRun:D.dryRun===!0||J==="dry-run",includeArtifactContent:D.artifactContent!==!1,includeTailscale:D.tailscale!==!1}):await N.syncPeer({peerWorkspace:D.peerWorkspace,direction:S,dryRun:D.dryRun===!0||J==="dry-run",tables:P,includeArtifactContent:D.artifactContent!==!1,machineId:D.machine??null});if(r(D.json||D.verbose?X:i8(X,J),D.json,D),!X.ok&&!D.json)process.exitCode=1;return}throw Error("Invalid sync action. Use 'status', 'doctor', 'snapshot', 'conflicts', 'machines', 'dry-run', 'pull', 'push', 'sync', 'export', or 'import'.")}if(U==="db"){let J=$[1]??"init";if(J==="init"){let P=N.initDb();r({ok:!0,...P,message:`Initialized ${P.path}`},D.json,D);return}if(J==="stats"){let P=N.dbStats();r({ok:!0,path:N.workspace.knowledgeDbPath,...P,message:`knowledge.db schema v${P.schema_version}`},D.json,D);return}if(J==="storage"){if(($[2]??"status")==="status"){let S=o3({scope:D.scope});r({ok:!0,...S,message:`knowledge.db storage mode ${S.mode}`},D.json,D);return}throw Error("Invalid db storage action. Only 'status' is supported. The 'push'/'pull'/'sync' Postgres sync commands were removed (DSN-on-client is forbidden); use the cloud API flip instead.")}throw Error("Invalid db action. Use 'init', 'stats', or 'storage'.")}if(U==="app-wiki"){let J=$[1]??"init";if(J==="paths"||J==="status"){r({ok:!0,standard:"hasna-app-wiki.v1",default_scope:"project",global_writes_require:"--allow-global",...N.paths()},D.json);return}if(J==="init"||J==="open"){let P=await N.initAppWiki({allowGlobal:D.allowGlobal});r(P,D.json);return}if(J==="note"||J==="notes"){let P=$[2]??"list";if(P==="add"||P==="create"){let S=D.title??$[3],X=D.content??$.slice(4).join(" ");if(!S||!X)throw Error("Usage: knowledge app-wiki note add --title <title> --content <text> [--source-ref <uri>]");let G=await N.addAppWikiNote({title:S,content:X,tags:D.tag,sourceRefs:D.sourceRef,allowGlobal:D.allowGlobal});r(G,D.json);return}if(P==="list"||P==="ls"){let S=N.listAppWikiNotes({limit:D.limit});r({ok:!0,scope:N.scope,home:N.workspace.home,notes:S,message:`${S.length} app wiki note(s)`},D.json);return}if(P==="get"||P==="show"){let S=$[3]??D.id;if(!S)throw Error("Usage: knowledge app-wiki note get <id-or-path>");let X=await N.getAppWikiNote(S,{includeContent:!0});if(!X)throw Error(`App wiki note not found: ${S}`);r(X,D.json);return}throw Error("Invalid app-wiki note action. Use 'add', 'list', or 'get'.")}if(J==="source"||J==="sources"){let P=$[2]??"add";if(P!=="add"&&P!=="ingest")throw Error("Invalid app-wiki source action. Use 'add'.");let S=$[3]??D.sourceRef?.[0];if(!S)throw Error("Usage: knowledge app-wiki source add <source-ref>");let X=await N.addAppWikiSourceRef({sourceRef:S,purpose:D.purpose,allowGlobal:D.allowGlobal});r({ok:!0,...X,message:`Added app wiki source ${X.source_ref}`},D.json);return}if(J==="search"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge app-wiki search <query>");let S=await N.searchAppWiki({query:P,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S,message:`${S.results.length} app wiki result(s)`},D.json);return}if(J==="query"||J==="context"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge app-wiki query <query>");let S=await N.queryAppWiki({query:P,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S,message:`${S.excerpts.length} app wiki excerpt(s)`},D.json);return}throw Error("Invalid app-wiki action. Use 'init', 'paths', 'note', 'source', 'search', or 'query'.")}if(U==="wiki"){let J=$[1]??"init";if(J==="init"){let P=await N.initWiki();r({ok:!0,...P,message:`Initialized wiki layout in ${N.workspace.home}`},D.json,D);return}if(J==="compile"){let P=$.slice(2),S=P.filter((R)=>/^(open-files|file|s3|https?):\/\//.test(R)),X=P.filter((R)=>!/^(open-files|file|s3|https?):\/\//.test(R)).join(" "),G=await N.compileWiki({title:D.title,query:X||D.search,sourceRefs:S.length>0?S:void 0,limit:D.limit});r({ok:!0,...G,message:`Compiled wiki page ${G.path}`},D.json,D);return}if(J==="file-answer"||J==="answer"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge wiki file-answer <prompt> --content <answer> --approve-write");if(!D.content)throw Error("Missing --content <answer> for wiki file-answer.");let S=await N.fileAnswer({prompt:P,answer:D.content,approveWrite:D.approveWrite,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...S},D.json,D);return}if(J==="lint"){let P=N.lintWiki();r({ok:P.ok,...P,message:P.ok?"Wiki lint passed":`Wiki lint found ${P.issue_count} issue(s)`},D.json,D);return}throw Error("Invalid wiki action. Use 'init', 'compile', 'file-answer', or 'lint'.")}if(U==="safety"){let J=$[1]??"status",P=N.ensureWorkspace(),S=N.safetyPolicy();N.initDb();let X=v(P.knowledgeDbPath);try{if(J==="status"){r({ok:!0,mode:S.mode,workspace:P.home,allow_write_roots:S.allowWriteRoots,read_only_source_access:S.readOnlySourceAccess,network:S.network,redaction:S.redaction,approvals:S.approvals,message:`Safety policy: ${S.mode}`},D.json,D);return}if(J==="check"){let G=$[2]??"generated_write",R=$[3]??null,V;try{if(G==="web_search")P0(S),V={action:G,target_uri:R,approval_required:!1,approved:!0,decision:"allow"};else if(G==="s3_read"){if(!R)throw Error("safety check s3_read requires an s3:// target.");q6(R,S),V={action:G,target_uri:R,approval_required:!1,approved:!0,decision:"allow"}}else V=cS(X,S,G,R);X_(X,{event_type:"safety_check",action:G,target_uri:R,decision:V.decision==="allow"?"allow":"requires_approval",metadata:V}),r({ok:!0,...V,message:`Safety check ${V.decision}`},D.json,D);return}catch(Q){throw X_(X,{event_type:"safety_check",action:G,target_uri:R,decision:"deny",metadata:{error:Q instanceof Error?Q.message:String(Q)}}),Q}}if(J==="approve"){let G=$[2]??"generated_write",R=$[3]??null,V=iU(X,{action:G,target_uri:R,reason:"local-cli approval",metadata:{scope:D.scope??"global"}});X_(X,{event_type:"approval",action:G,target_uri:R,decision:"allow",metadata:{approval_id:V.id}}),r({ok:!0,...V,action:G,target_uri:R,message:`Approved ${G}`},D.json,D);return}if(J==="audit"){let G=X.query("SELECT id, event_type, action, target_uri, decision, metadata_json, created_at FROM audit_events ORDER BY created_at DESC LIMIT 50").all().map((R)=>({id:R.id,event_type:R.event_type,action:R.action,target_uri:R.target_uri,decision:R.decision,metadata:JSON.parse(R.metadata_json),created_at:R.created_at}));r({ok:!0,events:G,message:`${G.length} audit event(s)`},D.json,D);return}if(J==="redact"){let G=$.slice(2).join(" ");if(!G)throw Error("Usage: knowledge safety redact <text>");let R=u_(G,S);if(R.findings.length>0)z0(X,{source_uri:"safety://redact",findings:R.findings,metadata:{command:"safety redact"}});X_(X,{event_type:"redaction",action:"safety_redact",target_uri:"safety://redact",decision:R.findings.length>0?"redacted":"allow",metadata:{findings:R.findings.length}}),r({ok:!0,text:R.text,findings:R.findings,message:`Redacted ${R.findings.length} finding(s)`},D.json,D);return}throw Error("Invalid safety action. Use 'status', 'check', 'approve', 'audit', or 'redact'.")}finally{X.close()}}if(U==="source"){if(($[1]??"")!=="resolve")throw Error("Invalid source action. Use 'resolve'.");let P=$[2];if(!P)throw Error("Usage: knowledge source resolve <source-ref>");let S=await N.resolveSource(P,{purpose:D.purpose,limit:D.limit});r({ok:!0,...S,message:S.resolved?`Resolved ${S.source_ref} (${S.content.chunks_returned}/${S.content.chunks_total} chunks)`:`Source not indexed: ${P}`},D.json,D);return}if(U==="ingest"){let J=$[1]??"";if(J==="rules"||J==="global-rules"||J==="agent-rules"){let P=await N.importRulesProvenance({root:D.workspace??process.cwd(),owner:D.owner,dryRun:D.dryRun===!0,maxItems:D.maxItems,limit:D.limit});r({ok:!0,...P},D.json);return}if(J==="manifest"){let P=$[2];if(!P)throw Error("Usage: knowledge ingest manifest <file|s3://bucket/key>");let S=await N.ingestManifest(P);r({ok:!0,...S,message:`Ingested ${S.items_seen} manifest item(s)`},D.json,D);return}if(J==="source"){let P=$[2];if(!P)throw Error("Usage: knowledge ingest source <source-ref>");let S=await N.ingestSource(P,D.purpose);r({ok:!0,...S,message:`Ingested source ${S.source_ref} (${S.chunks_inserted} chunks)`},D.json,D);return}throw Error("Invalid ingest action. Use 'manifest' or 'source'.")}if(U==="reindex"){let J=$[1]??"status";if(J==="status"){let P=N.reindexHealth({modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`${P.missing_embeddings} chunk(s) missing embeddings`},D.json,D);return}if(J==="enqueue"){let P=N.enqueueReindex({modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Queued ${P.enqueued} embedding refresh item(s)`},D.json,D);return}if(J==="embeddings"){let P=await N.refreshEmbeddings({full:D.full,limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Embedded ${P.indexed.chunks_embedded} chunk(s)`},D.json,D);return}if(J==="outbox"){let P=$[2];if(!P)throw Error("Usage: knowledge reindex outbox <file|s3://bucket/key>");let S=await N.consumeOutbox(P);r({ok:!0,...S,message:`Consumed ${S.events_seen} outbox event(s)`},D.json,D);return}throw Error("Invalid reindex action. Use 'status', 'enqueue', 'embeddings', or 'outbox'.")}if(U==="embeddings"){let J=$[1]??"status";if(J==="status"){let P=N.embeddingStatus();r({ok:!0,...P,message:`${P.total_vector_entries} vector index entries`},D.json,D);return}if(J==="index"){let P=await N.indexEmbeddings({limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake});r({ok:!0,...P,message:`Embedded ${P.chunks_embedded} chunk(s)`},D.json,D);return}if(J==="search"){let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge embeddings search <query>");let S=await N.semanticSearch({query:P,limit:D.limit,modelRef:D.model,dimensions:D.dimensions,fake:D.fake}),X={ok:!0,...S,message:`${S.results.length} semantic result(s)`};r(D.json||D.verbose?X:Kf(X),D.json,D);return}throw Error("Invalid embeddings action. Use 'status', 'index', or 'search'.")}if(U==="context"){if(($[1]??"pack")!=="pack")throw Error("Invalid context action. Use 'pack'.");let P=D.from??"search";if(!["search","loops","runs"].includes(P))throw Error("Invalid --from value. Use 'search', 'loops', or 'runs'.");let S=$.slice(2).join(" ")||D.topic||"",X=await N.contextPack({source:P,purpose:P==="loops"||P==="runs"?"proposal":"agent_context",query:S,topic:D.topic,since:D.since,dedupe:D.dedupe,maxTokens:D.maxTokens,maxItems:D.maxItems,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A});m8({ok:!0,...X,message:X.message});return}if(U==="proposals"){if(($[1]??"context")!=="context")throw Error("Invalid proposals action. Use 'context'.");let P=D.from??"loops";if(!["loops","runs"].includes(P))throw Error("Invalid --from value for proposals. Use 'loops' or 'runs'.");let S=D.topic??$.slice(2).join(" ");if(!S.trim())throw Error("Usage: knowledge proposals context --from loops --topic <text>");let X=await N.contextPack({source:P,purpose:"proposal",query:S,topic:S,since:D.since,dedupe:D.dedupe??!0,maxTokens:D.maxTokens,maxItems:D.maxItems,limit:D.limit});m8({ok:!0,...X,message:X.message});return}if(U==="search"){let J=$.slice(1).join(" ");if(!J)throw Error("Usage: knowledge search <query>");if(D.context){let X=await N.retrieveContext({query:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A}),G={ok:!0,...X,message:`${X.excerpts.length} context excerpt(s)`};r(D.json||D.verbose?G:Vf(G),D.json,D);return}let P=await N.search({query:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,legacyStorePath:A}),S={ok:!0,...P,message:`${P.results.length} search result(s)`};r(D.json||D.verbose?S:Bf(S),D.json,D);return}if(U==="web"){if(($[1]??"search")!=="search")throw Error("Invalid web action. Use 'search'.");let P=$.slice(2).join(" ");if(!P)throw Error("Usage: knowledge web search <query>");let S=await N.webSearch({query:P,limit:D.limit,modelRef:D.model,provider:D.provider,domains:D.domain,fake:D.fake,fileResults:D.fileResults}),X={ok:!0,...S,message:`${S.sources.length} web source(s)`};r(D.json||D.verbose?X:Ff(X),D.json,D);return}if(U==="ask"||U==="build"){let J=$.slice(g).join(" ");if(!J)throw Error("Usage: knowledge ask <prompt>");let P=await N.runPrompt({prompt:J,limit:D.limit,semantic:D.semantic,modelRef:D.model,dimensions:D.dimensions,fake:D.fake,generate:D.generate,approveWrite:D.approveWrite,legacyStorePath:A}),S={ok:!0,...P,message:P.generated?"Generated answer with citations":"Prepared citation context draft"};r(D.json||D.verbose?S:vf(S),D.json,D);return}if(U==="providers"){let J=$[1]??"status";if(J==="status"){let P=N.providerStatus(),S=P.providers.filter((X)=>X.configured).length;r({ok:!0,...P,message:`${S}/${P.providers.length} provider credential(s) configured`},D.json,D);return}if(J==="models"){let P=N.modelRegistry();r({ok:!0,models:P,message:`${P.length} model alias(es)`},D.json,D);return}if(J==="check"){let P=$[2]??"default",S=G$(P,N.config()),X=f_(S),G=g4(X.provider,N.config());r({ok:!0,target:P,model_ref:S,provider:X.provider,model:X.model,credential:G,message:`${X.provider} credentials configured`},D.json,D);return}throw Error("Invalid providers action. Use 'status', 'models', or 'check'.")}if(U==="add"){let J=$[1],P=$[2];if(!J||!P)throw Error("Usage: knowledge add <title> <content>");let S=await L.create({title:J,content:P,url:D.url??null,tags:D.tag??[]});$0("info","Item added",{id:S.id,title:S.title,tags:S.tags?.length??0,transport:L.kind}),r({ok:!0,item:S,message:`Added ${S.id}`},D.json,D);return}if(U==="list"){if(D.format!==void 0&&D.format!=="table"&&D.format!=="json")throw Error("Invalid --format value for list. Use 'table' or 'json'.");let J=await L.listAll(),P=Number.isFinite(D.page)&&D.page>0?D.page:1,S=Number.isFinite(D.limit)&&D.limit>0?D.limit:20,X=D.search?String(D.search).toLowerCase():"",G=(D.tagRaw??D.tag??[]).map((a)=>({whole:a.trim().toLowerCase(),parts:a.split(",").map((r_)=>r_.trim().toLowerCase()).filter((r_)=>r_.length>0)})),R=D.tag?.length?D.tag.map((a)=>a.toLowerCase()).join(","):"none",V=D.format==="table"||!D.json&&!D.format&&Gf(D),Q=D.json||D.format==="json",T=J.items;if(D.archived)T=T.filter((a)=>a.archived===!0);else if(!D.includeArchived)T=T.filter((a)=>!a.archived);if(X)T=T.filter((a)=>Vz(a,X));if(G.length>0)T=T.filter((a)=>{let r_=new Set((a.tags??[]).map((V_)=>V_.toLowerCase()));return G.every(({whole:V_,parts:G_})=>V_.length>0&&r_.has(V_)||G_.every((H_)=>r_.has(H_)))});let{sorted:q,sort:K,direction:Z}=wf(T,D),e=(P-1)*S,g_=q.slice(e,e+S),I_=Math.max(1,Math.ceil(q.length/S)),J_={ok:!0,page:P,limit:S,total:q.length,total_pages:I_,sort:K,direction:Z,items:g_,store_exists:J.exists};if(Q){r(J_,!0);return}if(D.verbose){r(J_,!1,D);return}if(g_.length===0){r(`No items found (search=${X||"none"}, tag=${R})`,!1);return}if(V){let a=(V_)=>V_,r_=`${a("ID")} ${a("TITLE")} ${a("CREATED")} ${a("URL")} ${a("TAGS")}`;console.log(r_);for(let V_ of g_)console.log(`${V_.id} ${a(D_(V_.title,80))} ${V_.created_at} ${V_.url?a(D_(V_.url,90)):""} ${V_.tags?.length?a(D_(`[${V_.tags.join(", ")}]`,80)):""}`);console.log(`Page ${P}/${I_} | showing ${g_.length} of ${q.length} | sort=${K} ${Z} | search=${X||"none"} | tag=${R}`),console.log("Hint: use `knowledge get --id <id> --json` for full item content.")}else{for(let a of g_)console.log(`${a.id} ${D_(a.title,80)} ${a.created_at}${a.url?` ${D_(a.url,90)}`:""}${a.tags?.length?` ${D_(`[${a.tags.join(", ")}]`,80)}`:""}`);console.log(`Page ${P}/${I_} | showing ${g_.length} of ${q.length} | sort=${K} ${Z} | search=${X||"none"} | tag=${R}`),console.log("Hint: use `knowledge get --id <id> --json` for full item content.")}return}if(U==="get"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);r({ok:!0,item:J,store_exists:L.exists,message:`${J.id}: ${J.title}`},D.json,D);return}if(U==="versions"){_0(D);let J=Number.isFinite(D.page)&&D.page>0?D.page:1,P=Number.isFinite(D.limit)&&D.limit>0?D.limit:void 0,S=await L.listVersions(D.id,{limit:P,offset:(J-1)*(P??50)});if(!S)throw Error(`Item not found: ${D.id}`);let X={ok:!0,id:S.item_id,current_version:S.current_version,total:S.total,page:J,store:L.location,versions:S.items,message:S.total===0?`${S.item_id} is at version ${S.current_version} with no retained prior versions`:`${S.item_id} is at version ${S.current_version}; ${S.total} prior version(s) retained`};if(D.json||D.verbose){r(X,D.json,D);return}console.log(X.message);for(let G of S.items){let R=G.actor?` by ${G.actor}`:"",V=G.reason?` (${G.reason})`:"";console.log(`v${G.version} ${G.valid_to}${R}${V} ${G.content_bytes} bytes ${G.content_hash.slice(0,12)}`)}if(S.items.length>0)console.log("Hint: `knowledge diff --id <id> --rev <n>` shows what changed.");return}if(U==="diff"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);if(D.rev!==void 0&&(D.from!==void 0||D.to!==void 0))throw Error("Use either --rev <n> or --from <a> --to <b>, not both.");let P=()=>({title:J.title,content:J.content,url:J.url,tags:J.tags??[],metadata:J.metadata??{},archived:J.archived??!1}),S=`v${J.version??"?"} (current)`,X=async(q)=>{if(q==="current")return{label:S,snapshot:P()};let K=Number(q);if(!Number.isInteger(K)||K<1)throw Error(`Not a version number: ${q}`);if(J.version!==void 0&&K===J.version)return{label:S,snapshot:P()};let Z=await L.getVersion(J.id,K);if(!Z)throw Error(`No version ${K} retained for ${J.id} (it is at version ${J.version??"?"}). Run \`knowledge versions --id <id>\` to see what is retained.`);return{label:`v${Z.version}`,snapshot:{title:Z.title,content:Z.content,url:Z.url,tags:Z.tags,metadata:Z.metadata,archived:Z.archived}}},G,R;if(D.rev!==void 0){if(!Number.isInteger(D.rev)||D.rev<1)throw Error("--rev must be a positive version number.");if(D.rev===1)throw Error("Version 1 has no predecessor to diff against.");G=String(D.rev-1),R=String(D.rev)}else if(D.from!==void 0||D.to!==void 0){if(D.from===void 0||D.to===void 0)throw Error("--from and --to must be given together.");G=D.from,R=D.to}else{let q=await L.listVersions(J.id,{limit:1});if(!q)throw Error(`Item not found: ${D.id}`);if(q.items.length===0)throw Error(`${J.id} is at version ${q.current_version} with no retained prior versions to diff against.`);G=String(q.items[0].version),R="current"}let V=await X(G),Q=await X(R),T=PS(V.snapshot,Q.snapshot);if(D.json||D.verbose){r({ok:!0,id:J.id,from:V.label,to:Q.label,...T},D.json,D);return}console.log(zS(T,`${J.id} ${V.label}`,`${J.id} ${Q.label}`));return}if(U==="update"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);if(D.ifVersion!==void 0&&(!Number.isInteger(D.ifVersion)||D.ifVersion<1))throw Error(`Invalid --if-version ${JSON.stringify(String(D.ifVersion))}: must be a positive integer version number, e.g. the "version" field from a prior 'knowledge get'.`);let P={};if(D.title!==void 0)P.title=D.title;if(D.content!==void 0)P.content=D.content;if(D.url!==void 0)P.url=D.url;let S;if(D.tag!==void 0){if(S=d8(J.tags,D.tag),S.length>0)P.tags=[...J.tags??[],...S]}let X=D.ifVersion!==void 0?D.ifVersion:J.version,G=await L.update(J.id,P,{expectedVersion:X});r(Az({ok:!0,item:G},`Updated ${G?.id??J.id}`,S),D.json,D);return}if(U==="archive"||U==="restore"){_0(D);let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);let P=await L.update(J.id,{archived:U==="archive"},{expectedVersion:J.version});r({ok:!0,item:P,message:`${U==="archive"?"Archived":"Restored"} ${P?.id??J.id}`},D.json,D);return}if(U==="untag"){if(_0(D),!D.tag?.length)throw Error("Missing required --tag. Example: knowledge untag --id <id> -t <tag>");let J=await L.get(D.id);if(!J)throw Error(`Item not found: ${D.id}`);let P=J.tags??[],S=new Set(P.map((K)=>K.toLowerCase())),X=new Set;for(let K of D.tagRaw??D.tag){let Z=K.trim().toLowerCase();if(Z.length>0&&S.has(Z)){X.add(Z);continue}for(let e of K.split(",").map((g_)=>g_.trim().toLowerCase()).filter((g_)=>g_.length>0))X.add(e)}let G=P.filter((K)=>!X.has(K.toLowerCase())),R=P.length-G.length,V=[...X].filter((K)=>!S.has(K));if(R===0)throw Error(`No matching tag on ${J.id}: ${V.map((K)=>JSON.stringify(K)).join(", ")} not in [${P.map((K)=>JSON.stringify(K)).join(", ")}]`);let Q=await L.update(J.id,{tags:G},{expectedVersion:J.version}),T=V.length>0?` (not found: ${V.map((K)=>JSON.stringify(K)).join(", ")})`:"",q={ok:!0,item:Q,removed:R,message:`Removed ${R} tag${R===1?"":"s"} from ${Q?.id??J.id}${T}`};if(V.length>0)q.not_found=V;r(q,D.json,D);return}if(U==="upsert"){let J=D.title??$[1],P=D.content??$[2],S=D.id?await L.get(D.id):null;if(!S){if(!J||!P)throw Error("New item requires title and content. Example: knowledge upsert <title> <content> [--id <id>]");let V=await L.create({id:D.id,title:J,content:P,url:D.url??null,tags:D.tag??[]});r(Az({ok:!0,created:!0,item:V},`Upserted ${V.id}`,D.tag),D.json,D);return}let X={};if(J!==void 0)X.title=J;if(P!==void 0)X.content=P;if(D.url!==void 0)X.url=D.url;let G;if(D.tag!==void 0){if(G=d8(S.tags,D.tag),G.length>0)X.tags=[...S.tags??[],...G]}let R=await L.update(S.id,X,{expectedVersion:S.version});r(Az({ok:!0,created:!1,item:R},`Upserted ${R?.id??S.id}`,G),D.json,D);return}if(U==="delete"){if(_0(D),!D.yes)throw Error("Refusing delete without --yes. Re-run with: knowledge delete --id <id> --yes");if(!await L.delete(D.id))throw Error(`Item not found: ${D.id}`);$0("info","Item deleted",{id:D.id,transport:L.kind}),r({ok:!0,deleted_id:D.id,message:`Deleted ${D.id}`},D.json,D);return}if(U==="export"){let J=D.format??"json";if(J!=="json"&&J!=="jsonl")throw Error("Invalid --format. Use 'json' or 'jsonl'.");let P=await L.listAll();if(J==="jsonl")for(let S of P.items)console.log(JSON.stringify(S));else if(D.json||D.format==="json"||D.verbose)r({ok:!0,items:P.items,store_exists:P.exists},D.json||D.format==="json",D);else r(ff(P.items,J),!1);return}if(U==="prune"){if(!D.yes)throw Error("Refusing prune without --yes. Re-run with: knowledge prune --yes [--older-than <days>] [--empty]");let{items:J}=await L.listAll(),P=D.olderThan!==void 0?new Date(Date.now()-D.olderThan*86400000):null,S=J.filter((R)=>P!==null&&new Date(R.created_at)<P||D.empty&&R.content.trim().length===0),X=await L.deleteMany(S.map((R)=>R.id)),G=J.length-X;$0("info","Prune completed",{pruned:X,remaining:G,transport:L.kind}),r({ok:!0,pruned:X,remaining:G,message:`Pruned ${X} item(s)`},D.json,D);return}if(U==="dedupe"){if(!D.yes)throw Error("Refusing dedupe without --yes. Re-run with: knowledge dedupe --yes [--json]");let{items:J}=await L.listAll(),P=new Set,S=[];for(let R of J){let V=`${R.title}\x00${R.content}`;if(P.has(V))S.push(R);else P.add(V)}let X=await L.deleteMany(S.map((R)=>R.id)),G=J.length-X;$0("info","Dedupe completed",{removed:X,remaining:G,transport:L.kind}),r({ok:!0,removed:X,remaining:G,message:`Dedupe removed ${X} duplicate(s)`},D.json,D);return}if(U==="stats"){let J=await L.listAll(),P=J.items.filter((K)=>!K.archived),S=P.length,X=J.items.length-S,G=P.filter((K)=>K.url).length,R=P.filter((K)=>K.tags&&K.tags.length>0).length,V=S>0?P.map((K)=>K.created_at).sort()[0]:null,Q=S>0?P.map((K)=>K.created_at).sort()[S-1]:null,T={};for(let K of P)for(let Z of K.tags||[])T[Z]=(T[Z]||0)+1;let q=Object.entries(T).sort((K,Z)=>Z[1]-K[1]).slice(0,5).map(([K,Z])=>({tag:K,count:Z}));r({ok:!0,total:S,archived:X,with_url:G,with_tags:R,oldest:V,newest:Q,top_tags:q,store_exists:J.exists,message:`${S} items | ${G} with URL | ${R} with tags`},D.json,D);return}let z=zf($[0]),W=z?` Did you mean '${z}'?`:"";throw $0("warn","Unknown command",{input:$[0],suggestion:z}),Error(`Unknown command: ${$[0]}.${W} Run 'knowledge --help' for available commands.`)}function xf(_,$){let D=_ instanceof Error?_.message:String(_);$0("debug","CLI error",{message:D,stack:_ instanceof Error?_.stack:void 0}),console.error(`Error: ${D}`);let U=_ instanceof L0?_:null;if($.includes("--json"))r({ok:!1,error:D,message:D,...U?{code:"version_conflict",expected:U.expected,current:U.current}:{}},!0);process.exitCode=U?2:1}if(import.meta.main){let _=process.argv.slice(2);uf(_).catch(($)=>xf($,_))}export{zf as suggestCommand,wf as sortItems,uf as run,Lf as parseArgs,xf as emitCliError}; diff --git a/src/cli.ts b/src/cli.ts index 4e03c09..d7a4da3 100755 --- a/src/cli.ts +++ b/src/cli.ts @@ -937,7 +937,7 @@ async function run(argv: string[]): Promise<void> { private_input: true, private_result: true, exact_title_lookup: true, - public_body_output: false, + private_transport_body_output: false, }, flags.json, flags); return; } diff --git a/tests/cli.test.ts b/tests/cli.test.ts index 52c460d..15c726b 100644 --- a/tests/cli.test.ts +++ b/tests/cli.test.ts @@ -384,7 +384,7 @@ describe('knowledge cli', () => { private_input: true, private_result: true, exact_title_lookup: true, - public_body_output: false, + private_transport_body_output: false, }); });