@debian777/kairos-mcp 3.0.1-beta.14

package/dist/cli/config.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CLI Configuration
+ */
+/**
+ * Get the KAIROS API base URL
+ * Defaults to http://localhost:3000 if not set
+ */
+export declare function getApiUrl(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH;;;GAGG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/cli/config.js

@@ -0,0 +1,14 @@
+/**
+ * CLI Configuration
+ */
+function getEnvString(key, defaultValue) {
+    return process.env[key] || defaultValue;
+}
+/**
+ * Get the KAIROS API base URL
+ * Defaults to http://localhost:3000 if not set
+ */
+export function getApiUrl() {
+    return getEnvString('KAIROS_API_URL', 'http://localhost:3000');
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,SAAS,YAAY,CAAC,GAAW,EAAE,YAAoB;IACnD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACrB,OAAO,YAAY,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * KAIROS CLI - Command-line interface for interacting with KAIROS REST API
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/cli/index.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+/**
+ * KAIROS CLI - Command-line interface for interacting with KAIROS REST API
+ */
+import { Command } from 'commander';
+import { createRequire } from 'module';
+import { searchCommand } from './commands/search.js';
+import { beginCommand } from './commands/begin.js';
+import { nextCommand } from './commands/next.js';
+import { mintCommand } from './commands/mint.js';
+import { updateCommand } from './commands/update.js';
+import { deleteCommand } from './commands/delete.js';
+import { attestCommand } from './commands/attest.js';
+import { getApiUrl } from './config.js';
+const require = createRequire(import.meta.url);
+const { version } = require('../../package.json');
+const program = new Command();
+program
+    .name('kairos')
+    .description('CLI tool for interacting with KAIROS REST API')
+    .version(version)
+    .option('-u, --url <url>', 'KAIROS API base URL', getApiUrl())
+    .hook('preAction', (thisCommand) => {
+    // Store the URL option globally for use in commands
+    const opts = thisCommand.opts();
+    if (opts['url']) {
+        process.env['KAIROS_API_URL'] = opts['url'];
+    }
+});
+// Register commands (matching MCP tool names 1:1)
+searchCommand(program); // kairos_search
+beginCommand(program); // kairos_begin (step 1)
+nextCommand(program); // kairos_next (steps 2+)
+mintCommand(program); // kairos_mint
+updateCommand(program); // kairos_update
+deleteCommand(program); // kairos_delete
+attestCommand(program); // kairos_attest
+// Parse arguments
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAEzE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACF,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,+CAA+C,CAAC;KAC5D,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;KAC7D,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE;IAC/B,oDAAoD;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,kDAAkD;AAClD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAE,gBAAgB;AACzC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAG,wBAAwB;AACjD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAI,yBAAyB;AAClD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAK,cAAc;AACxC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAG,gBAAgB;AAC1C,aAAa,CAAC,OAAO,CAAC,CAAC,CAAE,gBAAgB;AACzC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAG,gBAAgB;AAE1C,kBAAkB;AAClB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/cli/output.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CLI Output Utility
+ * Uses process.stdout/stderr directly to avoid console.* linting restrictions
+ */
+export declare function writeStdout(message: string): void;
+export declare function writeStderr(message: string): void;
+export declare function writeError(message: string): void;
+export declare function writeJson(data: any): void;
+export declare function writeMarkdown(content: string): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAEzC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD"}

package/dist/cli/output.js

@@ -0,0 +1,20 @@
+/**
+ * CLI Output Utility
+ * Uses process.stdout/stderr directly to avoid console.* linting restrictions
+ */
+export function writeStdout(message) {
+    process.stdout.write(message + '\n');
+}
+export function writeStderr(message) {
+    process.stderr.write(message + '\n');
+}
+export function writeError(message) {
+    writeStderr(`Error: ${message}`);
+}
+export function writeJson(data) {
+    writeStdout(JSON.stringify(data, null, 2));
+}
+export function writeMarkdown(content) {
+    writeStdout(content);
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,WAAW,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAS;IAC/B,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IACzC,WAAW,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Centralized configuration for environment variables.
+ * This file contains all environment variable parsing logic.
+ * REDIS_URL: when set (non-empty) → Redis backend; when unset or empty → in-memory backend. QDRANT_URL is always required.
+ */
+export declare const REDIS_URL: string;
+export declare const USE_REDIS: boolean;
+export declare const KAIROS_REDIS_PREFIX: string;
+export declare const OPENAI_EMBEDDING_MODEL: string;
+export declare const OPENAI_API_KEY: string;
+export declare const EMBEDDING_PROVIDER: string;
+export declare const TEI_BASE_URL: string;
+export declare const TEI_MODEL: string;
+export declare const TEI_API_KEY: string;
+export declare const LOG_LEVEL: string;
+export declare const LOG_FORMAT: string;
+export declare const QDRANT_API_KEY: string;
+export declare const QDRANT_COLLECTION_CURRENT: string;
+export declare const TEI_URL: string;
+export declare const KAIROS_SEARCH_OVERFETCH_FACTOR: string;
+export declare const KAIROS_SEARCH_MAX_FETCH: string;
+export declare const KAIROS_ENABLE_GROUP_COLLAPSE: string;
+export declare const AUTH_ENABLED: boolean;
+export declare const KEYCLOAK_URL: string;
+/** When set, used for server-side calls (e.g. token exchange). When unset, KEYCLOAK_URL is used. Use keycloak:8080 in Docker. */
+export declare const KEYCLOAK_INTERNAL_URL: string;
+export declare const KEYCLOAK_REALM: string;
+export declare const KEYCLOAK_CLIENT_ID: string;
+/** Base URL for redirect_uri (e.g. http://localhost:3500). Must match Keycloak client redirect URIs. */
+export declare const AUTH_CALLBACK_BASE_URL: string;
+export declare const SESSION_SECRET: string;
+/** Session cookie and payload exp lifetime in seconds; default 7 days. */
+export declare const SESSION_MAX_AGE_SEC: number;
+/** When set to oidc_bearer, Bearer tokens are validated (issuer, audience, exp); when unset, Bearer presence only (backward compat). */
+export declare const AUTH_MODE: string;
+/** Comma-separated list of trusted JWT issuers (e.g. http://keycloak:8080/realms/kairos-dev). Required when AUTH_MODE=oidc_bearer. */
+export declare const AUTH_TRUSTED_ISSUERS_STRING: string;
+/** Comma-separated list of allowed JWT audiences (e.g. kairos-mcp). Required when AUTH_MODE=oidc_bearer. */
+export declare const AUTH_ALLOWED_AUDIENCES_STRING: string;
+export declare const PORT: number;
+export declare const QDRANT_RESCORE_STRING: string;
+/** When non-empty, backup/snapshot is enabled; app creates dir if missing. Empty = not configured → 503 on POST /api/snapshot. */
+export declare const QDRANT_SNAPSHOT_ON_START: boolean;
+export declare const QDRANT_SNAPSHOT_DIR: string;
+export declare const METRICS_PORT: number;
+export declare const SCORE_THRESHOLD: number;
+/** Mint: score >= this value triggers SIMILAR_MEMORY_FOUND. Set SIMILAR_MEMORY_THRESHOLD=1 to effectively disable. */
+export declare const SIMILAR_MEMORY_THRESHOLD: number;
+export declare const TRANSPORT_TYPE: 'stdio' | 'http';
+export declare function getQdrantUrl(): string;
+export declare function getQdrantCollection(defaultValue?: string): string;
+export declare function getEmbeddingDimension(defaultValue?: number): number;
+export declare function getTeiDimension(defaultValue?: number): number;
+export declare const AUTH_TRUSTED_ISSUERS: string[];
+export declare const AUTH_ALLOWED_AUDIENCES: string[];
+/** Space for embedded mem docs and default when AUTH_ENABLED=false. Included in search scope for all users. Must follow space model (e.g. space:kairos-app). */
+export declare const KAIROS_APP_SPACE_ID: string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwCH,eAAO,MAAM,SAAS,QAAyC,CAAC;AAChE,eAAO,MAAM,SAAS,SAAuB,CAAC;AAC9C,eAAO,MAAM,mBAAmB,QAAiD,CAAC;AAClF,eAAO,MAAM,sBAAsB,QAA6C,CAAC;AACjF,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,eAAO,MAAM,kBAAkB,QAA6C,CAAC;AAC7E,eAAO,MAAM,YAAY,QAAmC,CAAC;AAC7D,eAAO,MAAM,SAAS,QAAgC,CAAC;AACvD,eAAO,MAAM,WAAW,QAAkC,CAAC;AAC3D,eAAO,MAAM,SAAS,QAAoC,CAAC;AAC3D,eAAO,MAAM,UAAU,QAAqC,CAAC;AAC7D,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAAgD,CAAC;AACvF,eAAO,MAAM,OAAO,QAA8B,CAAC;AACnD,eAAO,MAAM,8BAA8B,QAAsD,CAAC;AAClG,eAAO,MAAM,uBAAuB,QAAiD,CAAC;AACtF,eAAO,MAAM,4BAA4B,QAAuD,CAAC;AAIjG,eAAO,MAAM,YAAY,SAAuC,CAAC;AACjE,eAAO,MAAM,YAAY,QAAmC,CAAC;AAC7D,iIAAiI;AACjI,eAAO,MAAM,qBAAqB,QAA4C,CAAC;AAC/E,eAAO,MAAM,cAAc,QAA+C,CAAC;AAC3E,eAAO,MAAM,kBAAkB,QAAmD,CAAC;AACnF,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,QAA6C,CAAC;AACjF,eAAO,MAAM,cAAc,QAAqC,CAAC;AACjE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAE5E,wIAAwI;AACxI,eAAO,MAAM,SAAS,QAAgC,CAAC;AACvD,sIAAsI;AACtI,eAAO,MAAM,2BAA2B,QAA2C,CAAC;AACpF,4GAA4G;AAC5G,eAAO,MAAM,6BAA6B,QAA6C,CAAC;AAGxF,eAAO,MAAM,IAAI,QAA0B,CAAC;AAe5C,eAAO,MAAM,qBAAqB,QAAyC,CAAC;AAC5E,kIAAkI;AAClI,eAAO,MAAM,wBAAwB,SAAmD,CAAC;AAEzF,eAAO,MAAM,mBAAmB,QAKa,CAAC;AAG9C,eAAO,MAAM,YAAY,QAAkC,CAAC;AAG5D,eAAO,MAAM,eAAe,QAAsC,CAAC;AACnE,sHAAsH;AACtH,eAAO,MAAM,wBAAwB,QAA+C,CAAC;AAIrF,eAAO,MAAM,cAAc,EAAE,OAAO,GAAG,MACW,CAAC;AAGnD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,mBAAmB,CAAC,YAAY,SAAW,GAAG,MAAM,CAEnE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,SAAO,GAAG,MAAM,CAEjE;AAED,wBAAgB,eAAe,CAAC,YAAY,SAAI,GAAG,MAAM,CAExD;AAuBD,eAAO,MAAM,oBAAoB,UAAuB,CAAC;AAazD,eAAO,MAAM,sBAAsB,UAGjB,CAAC;AACnB,gKAAgK;AAChK,eAAO,MAAM,mBAAmB,QAA0D,CAAC"}

package/dist/config.js

@@ -0,0 +1,165 @@
+/**
+ * Centralized configuration for environment variables.
+ * This file contains all environment variable parsing logic.
+ * REDIS_URL: when set (non-empty) → Redis backend; when unset or empty → in-memory backend. QDRANT_URL is always required.
+ */
+import path from 'path';
+/** Throws if key is missing or empty (after trim). Use for vars that must be set. */
+function getEnvRequired(key, errorMessage) {
+    const val = process.env[key];
+    const trimmed = typeof val === 'string' ? val.trim() : '';
+    if (!trimmed) {
+        const msg = errorMessage ?? `KAIROS requires ${key} to be set. Set it in .env or environment.`;
+        throw new Error(msg);
+    }
+    return trimmed;
+}
+function getEnvString(key, defaultValue) {
+    return process.env[key] || defaultValue;
+}
+function getEnvInt(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    const parsed = parseInt(val, 10);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+function getEnvFloat(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    const parsed = parseFloat(val);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+function getEnvBoolean(key, defaultValue) {
+    const val = process.env[key];
+    if (val === undefined)
+        return defaultValue;
+    return val !== 'false';
+}
+// REDIS_URL set (non-empty) → Redis; unset or empty → in-memory backend
+export const REDIS_URL = (getEnvString('REDIS_URL', '')).trim();
+export const USE_REDIS = REDIS_URL.length > 0;
+export const KAIROS_REDIS_PREFIX = getEnvString('KAIROS_REDIS_PREFIX', 'kairos:');
+export const OPENAI_EMBEDDING_MODEL = getEnvString('OPENAI_EMBEDDING_MODEL', '');
+export const OPENAI_API_KEY = getEnvString('OPENAI_API_KEY', '');
+export const EMBEDDING_PROVIDER = getEnvString('EMBEDDING_PROVIDER', 'auto');
+export const TEI_BASE_URL = getEnvString('TEI_BASE_URL', '');
+export const TEI_MODEL = getEnvString('TEI_MODEL', '');
+export const TEI_API_KEY = getEnvString('TEI_API_KEY', '');
+export const LOG_LEVEL = getEnvString('LOG_LEVEL', 'info');
+export const LOG_FORMAT = getEnvString('LOG_FORMAT', 'text');
+export const QDRANT_API_KEY = getEnvString('QDRANT_API_KEY', '');
+export const QDRANT_COLLECTION_CURRENT = getEnvString('QDRANT_COLLECTION_CURRENT', '');
+export const TEI_URL = getEnvString('TEI_URL', '');
+export const KAIROS_SEARCH_OVERFETCH_FACTOR = getEnvString('KAIROS_SEARCH_OVERFETCH_FACTOR', '4');
+export const KAIROS_SEARCH_MAX_FETCH = getEnvString('KAIROS_SEARCH_MAX_FETCH', '200');
+export const KAIROS_ENABLE_GROUP_COLLAPSE = getEnvString('KAIROS_ENABLE_GROUP_COLLAPSE', 'true');
+// Auth (Keycloak OIDC). One Keycloak per env: each env file sets KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID.
+// When AUTH_ENABLED=true these must be set (no empty string); startup will throw otherwise.
+export const AUTH_ENABLED = getEnvBoolean('AUTH_ENABLED', false);
+export const KEYCLOAK_URL = getEnvString('KEYCLOAK_URL', '');
+/** When set, used for server-side calls (e.g. token exchange). When unset, KEYCLOAK_URL is used. Use keycloak:8080 in Docker. */
+export const KEYCLOAK_INTERNAL_URL = getEnvString('KEYCLOAK_INTERNAL_URL', '');
+export const KEYCLOAK_REALM = getEnvString('KEYCLOAK_REALM', 'kairos-dev');
+export const KEYCLOAK_CLIENT_ID = getEnvString('KEYCLOAK_CLIENT_ID', 'kairos-mcp');
+/** Base URL for redirect_uri (e.g. http://localhost:3500). Must match Keycloak client redirect URIs. */
+export const AUTH_CALLBACK_BASE_URL = getEnvString('AUTH_CALLBACK_BASE_URL', '');
+export const SESSION_SECRET = getEnvString('SESSION_SECRET', '');
+/** Session cookie and payload exp lifetime in seconds; default 7 days. */
+export const SESSION_MAX_AGE_SEC = getEnvInt('SESSION_MAX_AGE_SEC', 604800);
+/** When set to oidc_bearer, Bearer tokens are validated (issuer, audience, exp); when unset, Bearer presence only (backward compat). */
+export const AUTH_MODE = getEnvString('AUTH_MODE', '');
+/** Comma-separated list of trusted JWT issuers (e.g. http://keycloak:8080/realms/kairos-dev). Required when AUTH_MODE=oidc_bearer. */
+export const AUTH_TRUSTED_ISSUERS_STRING = getEnvString('AUTH_TRUSTED_ISSUERS', '');
+/** Comma-separated list of allowed JWT audiences (e.g. kairos-mcp). Required when AUTH_MODE=oidc_bearer. */
+export const AUTH_ALLOWED_AUDIENCES_STRING = getEnvString('AUTH_ALLOWED_AUDIENCES', '');
+// Int configurations
+export const PORT = getEnvInt('PORT', 3000);
+if (AUTH_ENABLED) {
+    const missing = [];
+    if (!KEYCLOAK_URL.trim())
+        missing.push('KEYCLOAK_URL');
+    if (!KEYCLOAK_REALM.trim())
+        missing.push('KEYCLOAK_REALM');
+    if (!KEYCLOAK_CLIENT_ID.trim())
+        missing.push('KEYCLOAK_CLIENT_ID');
+    if (!AUTH_CALLBACK_BASE_URL.trim())
+        missing.push('AUTH_CALLBACK_BASE_URL');
+    if (!SESSION_SECRET.trim())
+        missing.push('SESSION_SECRET');
+    if (missing.length > 0) {
+        throw new Error(`AUTH_ENABLED=true requires non-empty env: ${missing.join(', ')}. Set them in .env. See docs/install/README.md.`);
+    }
+}
+export const QDRANT_RESCORE_STRING = getEnvString('QDRANT_RESCORE', 'true');
+/** When non-empty, backup/snapshot is enabled; app creates dir if missing. Empty = not configured → 503 on POST /api/snapshot. */
+export const QDRANT_SNAPSHOT_ON_START = getEnvBoolean('QDRANT_SNAPSHOT_ON_START', false);
+const QDRANT_SNAPSHOT_DIR_RAW = getEnvString('QDRANT_SNAPSHOT_DIR', '').trim();
+export const QDRANT_SNAPSHOT_DIR = QDRANT_SNAPSHOT_DIR_RAW === ''
+    ? ''
+    : path.isAbsolute(QDRANT_SNAPSHOT_DIR_RAW)
+        ? QDRANT_SNAPSHOT_DIR_RAW
+        : path.resolve(QDRANT_SNAPSHOT_DIR_RAW);
+// Int configurations
+export const METRICS_PORT = getEnvInt('METRICS_PORT', 9090);
+// Float configurations (tunable via env; relaxed defaults so more results pass into choices)
+export const SCORE_THRESHOLD = getEnvFloat('SCORE_THRESHOLD', 0.3);
+/** Mint: score >= this value triggers SIMILAR_MEMORY_FOUND. Set SIMILAR_MEMORY_THRESHOLD=1 to effectively disable. */
+export const SIMILAR_MEMORY_THRESHOLD = getEnvFloat('SIMILAR_MEMORY_THRESHOLD', 0.9);
+// Transport: stdio | http. Logging and server use this single source.
+const TRANSPORT_TYPE_RAW = getEnvString('TRANSPORT_TYPE', 'stdio');
+export const TRANSPORT_TYPE = TRANSPORT_TYPE_RAW === 'http' ? 'http' : 'stdio';
+// Required (throw at startup if missing)
+export function getQdrantUrl() {
+    return getEnvRequired('QDRANT_URL');
+}
+export function getQdrantCollection(defaultValue = 'kairos') {
+    return getEnvString('QDRANT_COLLECTION', defaultValue);
+}
+export function getEmbeddingDimension(defaultValue = 1024) {
+    return getEnvInt('EMBEDDING_DIMENSION', defaultValue);
+}
+export function getTeiDimension(defaultValue = 0) {
+    return getEnvInt('TEI_DIMENSION', defaultValue);
+}
+// Trusted issuers: from env, or from KEYCLOAK_URL/REALM when unset. Add loopback alias (localhost <-> 127.0.0.1) so tokens match either.
+const _authIssuersFromEnv = AUTH_TRUSTED_ISSUERS_STRING.split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const _authIssuersBase = _authIssuersFromEnv.length > 0
+    ? _authIssuersFromEnv
+    : KEYCLOAK_URL && KEYCLOAK_REALM
+        ? [`${KEYCLOAK_URL.replace(/\/$/, '')}/realms/${KEYCLOAK_REALM}`]
+        : [];
+const _authIssuersExpanded = [];
+for (const iss of _authIssuersBase) {
+    _authIssuersExpanded.push(iss);
+    if (iss.includes('localhost')) {
+        const other = iss.replace(/localhost/g, '127.0.0.1');
+        if (!_authIssuersExpanded.includes(other))
+            _authIssuersExpanded.push(other);
+    }
+    else if (iss.includes('127.0.0.1')) {
+        const other = iss.replace(/127\.0\.0\.1/g, 'localhost');
+        if (!_authIssuersExpanded.includes(other))
+            _authIssuersExpanded.push(other);
+    }
+}
+export const AUTH_TRUSTED_ISSUERS = _authIssuersExpanded;
+// Allowed audiences: from env, or from KEYCLOAK_CLIENT_ID when unset. Add "account" for Keycloak access tokens when we have realm issuers.
+const _authAudFromEnv = AUTH_ALLOWED_AUDIENCES_STRING.split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const _authAudBase = _authAudFromEnv.length > 0
+    ? _authAudFromEnv
+    : KEYCLOAK_CLIENT_ID
+        ? [KEYCLOAK_CLIENT_ID]
+        : [];
+const _hasKeycloakRealm = _authIssuersBase.some((u) => u.includes('/realms/'));
+export const AUTH_ALLOWED_AUDIENCES = _hasKeycloakRealm && !_authAudBase.includes('account')
+    ? [..._authAudBase, 'account']
+    : _authAudBase;
+/** Space for embedded mem docs and default when AUTH_ENABLED=false. Included in search scope for all users. Must follow space model (e.g. space:kairos-app). */
+export const KAIROS_APP_SPACE_ID = getEnvString('KAIROS_APP_SPACE_ID', 'space:kairos-app');
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,qFAAqF;AACrF,SAAS,cAAc,CAAC,GAAW,EAAE,YAAqB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,IAAI,mBAAmB,GAAG,4CAA4C,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,YAAoB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,YAAoB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,YAAoB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,YAAqB;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,OAAO,GAAG,KAAK,OAAO,CAAC;AACzB,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;AAEjG,mHAAmH;AACnH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,iIAAiI;AACjI,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AACnF,wGAAwG;AACxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AACjE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE5E,wIAAwI;AACxI,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACvD,sIAAsI;AACtI,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACpF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AAExF,qBAAqB;AACrB,MAAM,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE5C,IAAI,YAAY,EAAE,CAAC;IACjB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnE,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CACjH,CAAC;IACJ,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC5E,kIAAkI;AAClI,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AACzF,MAAM,uBAAuB,GAAG,YAAY,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAC9B,uBAAuB,KAAK,EAAE;IAC5B,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;QACxC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAE9C,qBAAqB;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAE5D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACnE,sHAAsH;AACtH,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;AAErF,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,cAAc,GACzB,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAEnD,yCAAyC;AACzC,MAAM,UAAU,YAAY;IAC1B,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAY,GAAG,QAAQ;IACzD,OAAO,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAY,GAAG,IAAI;IACvD,OAAO,SAAS,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAY,GAAG,CAAC;IAC9C,OAAO,SAAS,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,yIAAyI;AACzI,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC;KAC/D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,MAAM,gBAAgB,GACpB,mBAAmB,CAAC,MAAM,GAAG,CAAC;IAC5B,CAAC,CAAC,mBAAmB;IACrB,CAAC,CAAC,YAAY,IAAI,cAAc;QAC9B,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,cAAc,EAAE,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;AACX,MAAM,oBAAoB,GAAa,EAAE,CAAC;AAC1C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACnC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,2IAA2I;AAC3I,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC;KAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,MAAM,YAAY,GAChB,eAAe,CAAC,MAAM,GAAG,CAAC;IACxB,CAAC,CAAC,eAAe;IACjB,CAAC,CAAC,kBAAkB;QAClB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtB,CAAC,CAAC,EAAE,CAAC;AACX,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GACjC,iBAAiB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;IACpD,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,SAAS,CAAC;IAC9B,CAAC,CAAC,YAAY,CAAC;AACnB,gKAAgK;AAChK,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC"}