@exulu/backend 3.2.0 → 3.3.1

package/dist/{chunk-CVQTDG37.js → chunk-5FTX543Z.js}

@@ -1733,7 +1733,7 @@ var ExuluTool = class _ExuluTool {
     if (!agent) {
       throw new Error("Agent not found.");
     }
-    const { convertExuluToolsToAiSdkTools: convertExuluToolsToAiSdkTools2 } = await import("./convert-exulu-tools-to-ai-sdk-tools-QG7E6UX5.js");
+    const { convertExuluToolsToAiSdkTools: convertExuluToolsToAiSdkTools2 } = await import("./convert-exulu-tools-to-ai-sdk-tools-WQWYMU7G.js");
     const tools = await convertExuluToolsToAiSdkTools2(
       [this],
       [],
@@ -3008,7 +3008,7 @@ function neutralResult(question, keywords, importantKeyword, steps = []) {
   return {
     memoryChunksForAnswer: [],
     memoryOverride: { active: false, chunks: [], reason: "" },
-    memoryPinnedItemIds: /* @__PURE__ */ new Set(),
+    memoryPinnedItemIdsByContext: /* @__PURE__ */ new Map(),
     updatedQuestion: question,
     updatedKeywords: keywords,
     updatedImportantKeyword: importantKeyword,
@@ -3109,7 +3109,7 @@ async function runMemoryPhase({
       chunks: [],
       reason: ""
     };
-    let memoryPinnedItemIds = /* @__PURE__ */ new Set();
+    const memoryPinnedItemIdsByContext = /* @__PURE__ */ new Map();
     let updatedQuestion = question;
     let updatedKeywords = keywords;
     let updatedImportantKeyword = importantKeyword;
@@ -3272,25 +3272,30 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
       if (fileResult.output?.shouldPrioritizeFiles && fileResult.output?.fileNameHints?.length) {
         const hints = fileResult.output.fileNameHints;
         const pinResults = await Promise.all(
-          documentContexts.map(
-            (ctx) => fuzzyPrefilter({
+          documentContexts.map(async (ctx) => ({
+            ctxId: ctx.id,
+            matches: await fuzzyPrefilter({
               cacheKey: `memory-pin:${ctx.id}`,
               relevantKeywords: hints,
               context: ctx,
               fields: ["name", "id", "external_id"],
               normalize: (item) => item.external_id ? normalizeFileName(item.external_id) : item.name
             }).catch(() => [])
-          )
+          }))
         );
-        for (const results of pinResults) {
-          for (const r of results) {
-            memoryPinnedItemIds.add(r.id);
+        const pinnedNames = [];
+        for (const { ctxId, matches } of pinResults) {
+          if (!matches.length) continue;
+          const set = memoryPinnedItemIdsByContext.get(ctxId) ?? /* @__PURE__ */ new Set();
+          for (const m of matches) {
+            set.add(m.id);
+            pinnedNames.push(m.name);
           }
+          memoryPinnedItemIdsByContext.set(ctxId, set);
         }
-        if (memoryPinnedItemIds.size > 0) {
-          const names = pinResults.flat().map((i) => i.name).join(", ");
+        if (pinnedNames.length > 0) {
           steps.push({
-            text: `Memory prioritizes specific document(s); pinning ${memoryPinnedItemIds.size} file(s) into the search: ${names}`
+            text: `Memory prioritizes specific document(s); pinning ${pinnedNames.length} file(s) into the search: ${pinnedNames.join(", ")}`
           });
         }
       }
@@ -3313,7 +3318,7 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
     return {
       memoryChunksForAnswer,
       memoryOverride,
-      memoryPinnedItemIds,
+      memoryPinnedItemIdsByContext,
       updatedQuestion,
       updatedKeywords,
       updatedImportantKeyword,
@@ -3420,7 +3425,7 @@ async function searchContexts(opts) {
     preselectedItems,
     scopedItemsByContext,
     identifierPinsByContext,
-    memoryPinnedItemIds,
+    memoryPinnedItemIdsByContext,
     userPinnedItemIdsByContext,
     rewrites,
     styleHint,
@@ -3451,7 +3456,8 @@ async function searchContexts(opts) {
           const identifierPins = identifierPinsByContext.get(ctxId) ?? /* @__PURE__ */ new Set();
           let pins = new Set(identifierPins);
           if (kind === "documents") {
-            for (const id of memoryPinnedItemIds) pins.add(id);
+            const memPins = memoryPinnedItemIdsByContext.get(ctxId);
+            if (memPins) for (const id of memPins) pins.add(id);
           }
           const userPins = userPinnedItemIdsByContext.get(ctxId);
           if (userPins && userPins.size > 0) {
@@ -3963,7 +3969,7 @@ ${projectScope.customInstructions}` : ""
           updatedQuestion,
           updatedKeywords,
           updatedImportantKeyword,
-          memoryPinnedItemIds,
+          memoryPinnedItemIdsByContext,
           memoryOverride
         } = memResult;
         const { pinsByContext: identifierPinsByContext, exactPinsByContext, steps: pinSteps } = await resolveIdentifierPins({
@@ -3996,7 +4002,7 @@ ${projectScope.customInstructions}` : ""
             model: utilityModel,
             preselectedItems,
             identifierPinsByContext,
-            memoryPinnedItemIds,
+            memoryPinnedItemIdsByContext,
             userPinnedItemIdsByContext,
             scopedItemsByContext: resolvedProject?.scopedItemsByContext,
             rewrites: cfg.vocabulary.rewrites,
@@ -4016,7 +4022,7 @@ ${projectScope.customInstructions}` : ""
             model: utilityModel,
             preselectedItems,
             identifierPinsByContext,
-            memoryPinnedItemIds,
+            memoryPinnedItemIdsByContext,
             userPinnedItemIdsByContext,
             scopedItemsByContext: resolvedProject?.scopedItemsByContext,
             rewrites: cfg.vocabulary.rewrites,
@@ -4026,7 +4032,9 @@ ${projectScope.customInstructions}` : ""
           }) : Promise.resolve({ chunks: [] })
         ]);
         const pinnedItemIds = /* @__PURE__ */ new Set([
-          ...memoryPinnedItemIds,
+          ...(function* () {
+            for (const s of memoryPinnedItemIdsByContext.values()) yield* s;
+          })(),
           ...(function* () {
             for (const s of exactPinsByContext.values()) yield* s;
           })(),
@@ -7483,6 +7491,7 @@ var buildToolCallEvent = async (ctx, opts) => {
       toolCallId: ctx.toolCallId
     },
     target: { kind: "tool", id: ctx.tool.id, name: ctx.tool.name, category: ctx.tool.category, builtin: ctx.builtin },
+    ...ctx.client ? { client: ctx.client } : {},
     ...credential ? { credential } : {},
     status,
     ...status === "error" ? { error: { name: err?.name, message: String(err?.message ?? err ?? "unknown error") } } : {},
@@ -7599,6 +7608,25 @@ var emitToolCallAudit = async (logger, ctx) => {
   );
 };
 
+// src/exulu/audit/client-info.ts
+var firstHeader = (v) => Array.isArray(v) ? v[0] : v ?? void 0;
+function extractClientInfo(req) {
+  if (!req) return void 0;
+  const headers = req.headers ?? {};
+  const forwardedFor = firstHeader(headers["x-forwarded-for"]);
+  const ip = (forwardedFor ? forwardedFor.split(",")[0]?.trim() : void 0) || req.ip || req.socket?.remoteAddress || void 0;
+  const userAgent = firstHeader(headers["user-agent"]);
+  const referer = firstHeader(headers["referer"]);
+  const origin = firstHeader(headers["origin"]);
+  const client = {};
+  if (ip) client.ip = ip;
+  if (userAgent) client.userAgent = userAgent;
+  if (referer) client.referer = referer;
+  if (origin) client.origin = origin;
+  if (forwardedFor) client.forwardedFor = forwardedFor;
+  return Object.keys(client).length > 0 ? client : void 0;
+}
+
 // src/templates/tools/convert-exulu-tools-to-ai-sdk-tools.ts
 var OUTPUT_OFFLOAD_EXEMPT_TOOL_IDS = /* @__PURE__ */ new Set(["agentic_context_search"]);
 var generateS3Key = (filename) => `${randomUUID5()}-${filename}`;
@@ -8080,7 +8108,8 @@ var convertExuluToolsToAiSdkTools = async (currentTools, currentSkills, approved
                   input: inputs,
                   output: __auditOutput,
                   status: __auditStatus,
-                  error: __auditError
+                  error: __auditError,
+                  client: extractClientInfo(req)
                 });
                 if (__auditLogger.failClosed) {
                   await __emit;

package/dist/{convert-exulu-tools-to-ai-sdk-tools-QG7E6UX5.js → convert-exulu-tools-to-ai-sdk-tools-WQWYMU7G.js}

@@ -2,7 +2,7 @@ import "dotenv/config";
 import {
   convertExuluToolsToAiSdkTools,
   hydrateVariables
-} from "./chunk-CVQTDG37.js";
+} from "./chunk-5FTX543Z.js";
 import "./chunk-7CCMW3IW.js";
 export {
   convertExuluToolsToAiSdkTools,

package/dist/index.cjs

@@ -5699,6 +5699,7 @@ var init_tool_call = __esm({
           toolCallId: ctx.toolCallId
         },
         target: { kind: "tool", id: ctx.tool.id, name: ctx.tool.name, category: ctx.tool.category, builtin: ctx.builtin },
+        ...ctx.client ? { client: ctx.client } : {},
         ...credential ? { credential } : {},
         status,
         ...status === "error" ? { error: { name: err?.name, message: String(err?.message ?? err ?? "unknown error") } } : {},
@@ -5834,6 +5835,32 @@ var init_emit_tool_call = __esm({
   }
 });
 
+// src/exulu/audit/client-info.ts
+function extractClientInfo(req) {
+  if (!req) return void 0;
+  const headers = req.headers ?? {};
+  const forwardedFor = firstHeader(headers["x-forwarded-for"]);
+  const ip = (forwardedFor ? forwardedFor.split(",")[0]?.trim() : void 0) || req.ip || req.socket?.remoteAddress || void 0;
+  const userAgent = firstHeader(headers["user-agent"]);
+  const referer = firstHeader(headers["referer"]);
+  const origin = firstHeader(headers["origin"]);
+  const client2 = {};
+  if (ip) client2.ip = ip;
+  if (userAgent) client2.userAgent = userAgent;
+  if (referer) client2.referer = referer;
+  if (origin) client2.origin = origin;
+  if (forwardedFor) client2.forwardedFor = forwardedFor;
+  return Object.keys(client2).length > 0 ? client2 : void 0;
+}
+var firstHeader;
+var init_client_info = __esm({
+  "src/exulu/audit/client-info.ts"() {
+    "use strict";
+    init_cjs_shims();
+    firstHeader = (v) => Array.isArray(v) ? v[0] : v ?? void 0;
+  }
+});
+
 // src/templates/tools/convert-exulu-tools-to-ai-sdk-tools.ts
 var convert_exulu_tools_to_ai_sdk_tools_exports = {};
 __export(convert_exulu_tools_to_ai_sdk_tools_exports, {
@@ -5869,6 +5896,7 @@ var init_convert_exulu_tools_to_ai_sdk_tools = __esm({
     init_context_budget();
     init_logger();
     init_emit_tool_call();
+    init_client_info();
     OUTPUT_OFFLOAD_EXEMPT_TOOL_IDS = /* @__PURE__ */ new Set(["agentic_context_search"]);
     generateS3Key = (filename) => `${(0, import_node_crypto4.randomUUID)()}-${filename}`;
     getMimeType = (type) => {
@@ -6348,7 +6376,8 @@ var init_convert_exulu_tools_to_ai_sdk_tools = __esm({
                       input: inputs,
                       output: __auditOutput,
                       status: __auditStatus,
-                      error: __auditError
+                      error: __auditError,
+                      client: extractClientInfo(req)
                     });
                     if (__auditLogger.failClosed) {
                       await __emit;
@@ -7580,7 +7609,7 @@ function neutralResult(question, keywords, importantKeyword, steps = []) {
   return {
     memoryChunksForAnswer: [],
     memoryOverride: { active: false, chunks: [], reason: "" },
-    memoryPinnedItemIds: /* @__PURE__ */ new Set(),
+    memoryPinnedItemIdsByContext: /* @__PURE__ */ new Map(),
     updatedQuestion: question,
     updatedKeywords: keywords,
     updatedImportantKeyword: importantKeyword,
@@ -7681,7 +7710,7 @@ async function runMemoryPhase({
       chunks: [],
       reason: ""
     };
-    let memoryPinnedItemIds = /* @__PURE__ */ new Set();
+    const memoryPinnedItemIdsByContext = /* @__PURE__ */ new Map();
     let updatedQuestion = question;
     let updatedKeywords = keywords;
     let updatedImportantKeyword = importantKeyword;
@@ -7844,25 +7873,30 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
       if (fileResult.output?.shouldPrioritizeFiles && fileResult.output?.fileNameHints?.length) {
         const hints = fileResult.output.fileNameHints;
         const pinResults = await Promise.all(
-          documentContexts.map(
-            (ctx) => fuzzyPrefilter({
+          documentContexts.map(async (ctx) => ({
+            ctxId: ctx.id,
+            matches: await fuzzyPrefilter({
               cacheKey: `memory-pin:${ctx.id}`,
               relevantKeywords: hints,
               context: ctx,
               fields: ["name", "id", "external_id"],
               normalize: (item) => item.external_id ? normalizeFileName(item.external_id) : item.name
             }).catch(() => [])
-          )
+          }))
         );
-        for (const results of pinResults) {
-          for (const r of results) {
-            memoryPinnedItemIds.add(r.id);
+        const pinnedNames = [];
+        for (const { ctxId, matches } of pinResults) {
+          if (!matches.length) continue;
+          const set = memoryPinnedItemIdsByContext.get(ctxId) ?? /* @__PURE__ */ new Set();
+          for (const m of matches) {
+            set.add(m.id);
+            pinnedNames.push(m.name);
           }
+          memoryPinnedItemIdsByContext.set(ctxId, set);
         }
-        if (memoryPinnedItemIds.size > 0) {
-          const names = pinResults.flat().map((i) => i.name).join(", ");
+        if (pinnedNames.length > 0) {
           steps.push({
-            text: `Memory prioritizes specific document(s); pinning ${memoryPinnedItemIds.size} file(s) into the search: ${names}`
+            text: `Memory prioritizes specific document(s); pinning ${pinnedNames.length} file(s) into the search: ${pinnedNames.join(", ")}`
           });
         }
       }
@@ -7885,7 +7919,7 @@ ${glossary.map((g) => `${g.term} : ${g.meaning}`).join("\n")}` : "";
     return {
       memoryChunksForAnswer,
       memoryOverride,
-      memoryPinnedItemIds,
+      memoryPinnedItemIdsByContext,
       updatedQuestion,
       updatedKeywords,
       updatedImportantKeyword,
@@ -8016,7 +8050,7 @@ async function searchContexts(opts) {
     preselectedItems,
     scopedItemsByContext,
     identifierPinsByContext,
-    memoryPinnedItemIds,
+    memoryPinnedItemIdsByContext,
     userPinnedItemIdsByContext,
     rewrites,
     styleHint,
@@ -8047,7 +8081,8 @@ async function searchContexts(opts) {
           const identifierPins = identifierPinsByContext.get(ctxId) ?? /* @__PURE__ */ new Set();
           let pins = new Set(identifierPins);
           if (kind === "documents") {
-            for (const id of memoryPinnedItemIds) pins.add(id);
+            const memPins = memoryPinnedItemIdsByContext.get(ctxId);
+            if (memPins) for (const id of memPins) pins.add(id);
           }
           const userPins = userPinnedItemIdsByContext.get(ctxId);
           if (userPins && userPins.size > 0) {
@@ -8580,7 +8615,7 @@ ${projectScope.customInstructions}` : ""
           updatedQuestion,
           updatedKeywords,
           updatedImportantKeyword,
-          memoryPinnedItemIds,
+          memoryPinnedItemIdsByContext,
           memoryOverride
         } = memResult;
         const { pinsByContext: identifierPinsByContext, exactPinsByContext, steps: pinSteps } = await resolveIdentifierPins({
@@ -8613,7 +8648,7 @@ ${projectScope.customInstructions}` : ""
             model: utilityModel,
             preselectedItems,
             identifierPinsByContext,
-            memoryPinnedItemIds,
+            memoryPinnedItemIdsByContext,
             userPinnedItemIdsByContext,
             scopedItemsByContext: resolvedProject?.scopedItemsByContext,
             rewrites: cfg.vocabulary.rewrites,
@@ -8633,7 +8668,7 @@ ${projectScope.customInstructions}` : ""
             model: utilityModel,
             preselectedItems,
             identifierPinsByContext,
-            memoryPinnedItemIds,
+            memoryPinnedItemIdsByContext,
             userPinnedItemIdsByContext,
             scopedItemsByContext: resolvedProject?.scopedItemsByContext,
             rewrites: cfg.vocabulary.rewrites,
@@ -8643,7 +8678,9 @@ ${projectScope.customInstructions}` : ""
           }) : Promise.resolve({ chunks: [] })
         ]);
         const pinnedItemIds = /* @__PURE__ */ new Set([
-          ...memoryPinnedItemIds,
+          ...(function* () {
+            for (const s of memoryPinnedItemIdsByContext.values()) yield* s;
+          })(),
           ...(function* () {
             for (const s of exactPinsByContext.values()) yield* s;
           })(),
@@ -14452,8 +14489,6 @@ var addProviderFields = async (args, requestedFields, result, tools, user, conte
   let litellmEntry;
   if (isLiteLLMEnabled() && result?.model) {
     litellmEntry = await findLiteLLMModel(result.model);
-  } else {
-    throw new Error("Could not load modal for: " + result?.model);
   }
   if (requestedFields.includes("providerName")) {
     result.providerName = isLiteLLMEnabled() ? "LiteLLM" : "";
@@ -16421,6 +16456,40 @@ function createMutations(table, contexts, tools, config) {
       }
       return await ctx.entityLayer.detachItem(args.item);
     };
+    if (table.RBAC) {
+      mutations[`${tableNamePlural}BulkUpdateRBAC`] = async (_, args, context) => {
+        const { db: db2 } = context;
+        const { ids, rights_mode, RBAC } = args;
+        if (!Array.isArray(ids) || ids.length === 0) {
+          throw new Error("ids is required and must be a non-empty array.");
+        }
+        if (!VALID_RIGHTS_MODES.includes(rights_mode)) {
+          throw new Error(
+            `Invalid rights_mode "${rights_mode}" \u2014 expected one of: ${VALID_RIGHTS_MODES.join(", ")}`
+          );
+        }
+        for (const id of ids) {
+          await validateWriteAccess(id, context);
+        }
+        await db2.transaction(async (trx) => {
+          await trx(tableNamePlural).whereIn("id", ids).update({ rights_mode, updatedAt: /* @__PURE__ */ new Date() });
+          for (const id of ids) {
+            const existingRbacRecords = await trx.from("rbac").where({ entity: table.name.singular, target_resource_id: id }).select("*");
+            await handleRBACUpdate(
+              trx,
+              table.name.singular,
+              id,
+              RBAC ?? {},
+              existingRbacRecords
+            );
+          }
+        });
+        return {
+          message: `Access updated for ${ids.length} item${ids.length === 1 ? "" : "s"}.`,
+          itemCount: ids.length
+        };
+      };
+    }
   }
   return mutations;
 }
@@ -21392,6 +21461,17 @@ function createSDL(tables, contexts, tools, config, evals) {
     ${tableNameSingular}ExtractEntities(item: ID!): ${tableNameSingular}EntityExtractPayload
     ${tableNameSingular}DetachEntities(item: ID!): ${tableNameSingular}EntityDetachPayload
     `;
+      if (table.RBAC) {
+        mutationDefs += `
+    ${tableNamePlural}BulkUpdateRBAC(ids: [ID!]!, rights_mode: String!, RBAC: RBACInput): ${tableNameSingular}BulkUpdateRBACPayload
+    `;
+        modelDefs += `
+    type ${tableNameSingular}BulkUpdateRBACPayload {
+      message: String!
+      itemCount: Int!
+    }
+    `;
+      }
       if (table.processor) {
         mutationDefs += `
     ${tableNameSingular}ProcessItem(item: ID!): ${tableNameSingular}ProcessItemFieldReturnPayload

package/dist/index.d.cts

@@ -986,6 +986,13 @@ type AuditConfig = {
     };
 };
 
+type AuditClient = {
+    ip?: string;
+    userAgent?: string;
+    referer?: string;
+    origin?: string;
+    forwardedFor?: string;
+};
 type AuditEvent = {
     v: 1;
     ts: string;
@@ -1025,6 +1032,7 @@ type AuditEvent = {
     data?: Record<string, unknown>;
     durationMs?: number;
     truncated?: Record<string, boolean>;
+    client?: AuditClient;
 };
 type AuditToolCallInput = {
     durationMs: number;
@@ -1054,6 +1062,7 @@ type AuditToolCallInput = {
     output: unknown;
     status: "ok" | "error" | "auth_required";
     error?: unknown;
+    client?: AuditClient;
 };
 
 interface AuditLogger {

package/dist/index.d.ts

@@ -986,6 +986,13 @@ type AuditConfig = {
     };
 };
 
+type AuditClient = {
+    ip?: string;
+    userAgent?: string;
+    referer?: string;
+    origin?: string;
+    forwardedFor?: string;
+};
 type AuditEvent = {
     v: 1;
     ts: string;
@@ -1025,6 +1032,7 @@ type AuditEvent = {
     data?: Record<string, unknown>;
     durationMs?: number;
     truncated?: Record<string, boolean>;
+    client?: AuditClient;
 };
 type AuditToolCallInput = {
     durationMs: number;
@@ -1054,6 +1062,7 @@ type AuditToolCallInput = {
     output: unknown;
     status: "ok" | "error" | "auth_required";
     error?: unknown;
+    client?: AuditClient;
 };
 
 interface AuditLogger {

package/dist/index.js

@@ -88,7 +88,7 @@ import {
   verifyCredentialNonce,
   waitForLiteLLMReady,
   withRetry
-} from "./chunk-CVQTDG37.js";
+} from "./chunk-5FTX543Z.js";
 import {
   findLiteLLMModel
 } from "./chunk-7CCMW3IW.js";
@@ -5576,8 +5576,6 @@ var addProviderFields = async (args, requestedFields, result, tools, user, conte
   let litellmEntry;
   if (isLiteLLMEnabled() && result?.model) {
     litellmEntry = await findLiteLLMModel(result.model);
-  } else {
-    throw new Error("Could not load modal for: " + result?.model);
   }
   if (requestedFields.includes("providerName")) {
     result.providerName = isLiteLLMEnabled() ? "LiteLLM" : "";
@@ -7523,6 +7521,40 @@ function createMutations(table, contexts, tools, config) {
       }
       return await ctx.entityLayer.detachItem(args.item);
     };
+    if (table.RBAC) {
+      mutations[`${tableNamePlural}BulkUpdateRBAC`] = async (_, args, context) => {
+        const { db } = context;
+        const { ids, rights_mode, RBAC } = args;
+        if (!Array.isArray(ids) || ids.length === 0) {
+          throw new Error("ids is required and must be a non-empty array.");
+        }
+        if (!VALID_RIGHTS_MODES.includes(rights_mode)) {
+          throw new Error(
+            `Invalid rights_mode "${rights_mode}" \u2014 expected one of: ${VALID_RIGHTS_MODES.join(", ")}`
+          );
+        }
+        for (const id of ids) {
+          await validateWriteAccess(id, context);
+        }
+        await db.transaction(async (trx) => {
+          await trx(tableNamePlural).whereIn("id", ids).update({ rights_mode, updatedAt: /* @__PURE__ */ new Date() });
+          for (const id of ids) {
+            const existingRbacRecords = await trx.from("rbac").where({ entity: table.name.singular, target_resource_id: id }).select("*");
+            await handleRBACUpdate(
+              trx,
+              table.name.singular,
+              id,
+              RBAC ?? {},
+              existingRbacRecords
+            );
+          }
+        });
+        return {
+          message: `Access updated for ${ids.length} item${ids.length === 1 ? "" : "s"}.`,
+          itemCount: ids.length
+        };
+      };
+    }
   }
   return mutations;
 }
@@ -12412,6 +12444,17 @@ function createSDL(tables, contexts, tools, config, evals) {
     ${tableNameSingular}ExtractEntities(item: ID!): ${tableNameSingular}EntityExtractPayload
     ${tableNameSingular}DetachEntities(item: ID!): ${tableNameSingular}EntityDetachPayload
     `;
+      if (table.RBAC) {
+        mutationDefs += `
+    ${tableNamePlural}BulkUpdateRBAC(ids: [ID!]!, rights_mode: String!, RBAC: RBACInput): ${tableNameSingular}BulkUpdateRBACPayload
+    `;
+        modelDefs += `
+    type ${tableNameSingular}BulkUpdateRBACPayload {
+      message: String!
+      itemCount: Int!
+    }
+    `;
+      }
       if (table.processor) {
         mutationDefs += `
     ${tableNameSingular}ProcessItem(item: ID!): ${tableNameSingular}ProcessItemFieldReturnPayload

package/ee/agentic-retrieval/pipeline/index.test.ts

@@ -4,13 +4,13 @@ import { createAgenticRetrievalTool, parsePreselectedItems } from "./index";
 jest.mock("@EE/entitlements", () => ({ checkLicense: () => ({ "agentic-retrieval": true }) }));
 jest.mock("@SRC/exulu/resolve-reranker", () => ({ resolveReranker: jest.fn(async () => ({ model: "m", rerank: async (_q: any, c: any) => c })) }));
 jest.mock("@SRC/exulu/resolve-model", () => ({ resolveModel: jest.fn() }));
-jest.mock("@SRC/exulu/app/singleton", () => ({ exuluApp: { get: () => () } }));
+jest.mock("@SRC/exulu/app/singleton", () => ({ exuluApp: { get: () => ({}) } }));
 jest.mock("./routing", () => ({ runRoutingPhase: jest.fn(async () => ({
   mainContexts: ["docs"], fallbackContexts: [], userPinnedItemIdsByContext: new Map(),
   userRequestedPage: null, hasExplicitDocAndPage: false, steps: [{ text: "routed" }] })) }));
 jest.mock("./memory", () => ({ runMemoryPhase: jest.fn(async () => ({
   memoryChunksForAnswer: [], memoryOverride: { active: false, chunks: [], reason: "" },
-  memoryPinnedItemIds: new Set(), updatedQuestion: "q", updatedKeywords: ["k"],
+  memoryPinnedItemIdsByContext: new Map(), updatedQuestion: "q", updatedKeywords: ["k"],
   updatedImportantKeyword: "k", steps: [] })) }));
 jest.mock("./prefilter", () => ({ resolveIdentifierPins: jest.fn(async () => ({
   pinsByContext: new Map(), exactPinsByContext: new Map(), steps: [] })) }));
@@ -75,7 +75,7 @@ describe("createAgenticRetrievalTool", () => {
     runMemoryPhase.mockResolvedValueOnce({
       memoryChunksForAnswer: [{ chunk_id: "m1" }],
       memoryOverride: { active: false, chunks: [], reason: "" },
-      memoryPinnedItemIds: new Set(),
+      memoryPinnedItemIdsByContext: new Map(),
       updatedQuestion: "q",
       updatedKeywords: ["k"],
       updatedImportantKeyword: "k",
@@ -114,7 +114,7 @@ describe("payload deduplication", () => {
     runMemoryPhase.mockResolvedValueOnce({
       memoryChunksForAnswer: [memChunk],
       memoryOverride: { active: false, chunks: [], reason: "" },
-      memoryPinnedItemIds: new Set(), updatedQuestion: "q", updatedKeywords: ["k"],
+      memoryPinnedItemIdsByContext: new Map(), updatedQuestion: "q", updatedKeywords: ["k"],
       updatedImportantKeyword: "k",
       steps: [{ text: "memory step", chunks: [memChunk] }],
     });

package/ee/agentic-retrieval/pipeline/index.ts

@@ -425,7 +425,7 @@ export function createAgenticRetrievalTool(opts: {
         updatedQuestion,
         updatedKeywords,
         updatedImportantKeyword,
-        memoryPinnedItemIds,
+        memoryPinnedItemIdsByContext,
         memoryOverride,
       } = memResult;
 
@@ -464,7 +464,7 @@ export function createAgenticRetrievalTool(opts: {
           model: utilityModel,
           preselectedItems,
           identifierPinsByContext,
-          memoryPinnedItemIds,
+          memoryPinnedItemIdsByContext,
           userPinnedItemIdsByContext,
           scopedItemsByContext: resolvedProject?.scopedItemsByContext,
           rewrites: cfg.vocabulary.rewrites,
@@ -485,7 +485,7 @@ export function createAgenticRetrievalTool(opts: {
               model: utilityModel,
               preselectedItems,
               identifierPinsByContext,
-              memoryPinnedItemIds,
+              memoryPinnedItemIdsByContext,
               userPinnedItemIdsByContext,
               scopedItemsByContext: resolvedProject?.scopedItemsByContext,
               rewrites: cfg.vocabulary.rewrites,
@@ -499,7 +499,9 @@ export function createAgenticRetrievalTool(opts: {
       // ── Build rerank state ────────────────────────────────────────────────
       // pinnedItemIds = memory ∪ exact identifier pins ∪ user pins ∪ project pins
       const pinnedItemIds = new Set<string>([
-        ...memoryPinnedItemIds,
+        ...(function* () {
+          for (const s of memoryPinnedItemIdsByContext.values()) yield* s;
+        })(),
         ...(function* () {
           for (const s of exactPinsByContext.values()) yield* s;
         })(),

package/ee/agentic-retrieval/pipeline/memory.test.ts

@@ -74,7 +74,7 @@ describe("runMemoryPhase", () => {
     expect(r.updatedImportantKeyword).toBe("FST-2XT");
   });
 
-  it("resolves file-prioritization pins across all document contexts", async () => {
+  it("resolves file-prioritization pins keyed by their document context", async () => {
     (generateText as jest.Mock)
       .mockResolvedValueOnce({ output: { relevantChunkIds: ["1"] } })
       .mockResolvedValueOnce({ output: { shouldPrioritizeFiles: true, fileNameHints: ["PROJECT_NOTES"] } });
@@ -82,7 +82,9 @@ describe("runMemoryPhase", () => {
     const r = await runMemoryPhase({ ...baseOpts, memoryChunks: [memChunk("1", "always check PROJECT_NOTES")],
       memoryContext: undefined, documentContexts: [{ id: "docs" }],
       memoryConfig: { enabled: true, override: false, filePrioritization: true, queryAugmentation: false } });
-    expect([...r.memoryPinnedItemIds]).toEqual(["d1"]);
+    // Pins are keyed by the context they were resolved in, so a consumer can apply them
+    // only to that context (no cross-context leak). See search.ts rule 2b.
+    expect([...(r.memoryPinnedItemIdsByContext.get("docs") ?? [])]).toEqual(["d1"]);
   });
 
   it("never throws even when post-Promise.all processing encounters runtime errors", async () => {

package/ee/agentic-retrieval/pipeline/memory.ts

@@ -129,7 +129,7 @@ function neutralResult(
   return {
     memoryChunksForAnswer: [],
     memoryOverride: { active: false, chunks: [], reason: "" },
-    memoryPinnedItemIds: new Set(),
+    memoryPinnedItemIdsByContext: new Map(),
     updatedQuestion: question,
     updatedKeywords: keywords,
     updatedImportantKeyword: importantKeyword,
@@ -272,7 +272,7 @@ export async function runMemoryPhase({
       chunks: [],
       reason: "",
     };
-    let memoryPinnedItemIds = new Set<string>();
+    const memoryPinnedItemIdsByContext = new Map<string, Set<string>>();
     let updatedQuestion = question;
     let updatedKeywords = keywords;
     let updatedImportantKeyword = importantKeyword;
@@ -466,12 +466,15 @@ export async function runMemoryPhase({
         };
       }
 
-      // File prioritization: resolve hints via fuzzyPrefilter against EVERY documentContexts entry
+      // File prioritization: resolve hints via fuzzyPrefilter against EVERY documentContexts entry.
+      // Pins are kept keyed by the context they were resolved in, so the search phase can apply a
+      // pin only to its home context — a tech_doc file must never filter a software-docs search to 0.
       if (fileResult.output?.shouldPrioritizeFiles && fileResult.output?.fileNameHints?.length) {
         const hints = fileResult.output.fileNameHints;
         const pinResults = await Promise.all(
-          documentContexts.map((ctx) =>
-            fuzzyPrefilter({
+          documentContexts.map(async (ctx) => ({
+            ctxId: ctx.id as string,
+            matches: await fuzzyPrefilter({
               cacheKey: `memory-pin:${ctx.id}`,
               relevantKeywords: hints,
               context: ctx,
@@ -479,17 +482,21 @@ export async function runMemoryPhase({
               normalize: (item: any) =>
                 item.external_id ? normalizeFileName(item.external_id) : item.name,
             }).catch(() => []),
-          ),
+          })),
         );
-        for (const results of pinResults) {
-          for (const r of results) {
-            memoryPinnedItemIds.add(r.id);
+        const pinnedNames: string[] = [];
+        for (const { ctxId, matches } of pinResults) {
+          if (!matches.length) continue;
+          const set = memoryPinnedItemIdsByContext.get(ctxId) ?? new Set<string>();
+          for (const m of matches) {
+            set.add(m.id);
+            pinnedNames.push(m.name);
           }
+          memoryPinnedItemIdsByContext.set(ctxId, set);
         }
-        if (memoryPinnedItemIds.size > 0) {
-          const names = pinResults.flat().map((i) => i.name).join(", ");
+        if (pinnedNames.length > 0) {
           steps.push({
-            text: `Memory prioritizes specific document(s); pinning ${memoryPinnedItemIds.size} file(s) into the search: ${names}`,
+            text: `Memory prioritizes specific document(s); pinning ${pinnedNames.length} file(s) into the search: ${pinnedNames.join(", ")}`,
           });
         }
       }
@@ -520,7 +527,7 @@ export async function runMemoryPhase({
     return {
       memoryChunksForAnswer,
       memoryOverride,
-      memoryPinnedItemIds,
+      memoryPinnedItemIdsByContext,
       updatedQuestion,
       updatedKeywords,
       updatedImportantKeyword,

package/ee/agentic-retrieval/pipeline/search.test.ts

@@ -20,7 +20,7 @@ const base = {
   } as any,
   question: "how to fix door error E42", keywords: ["door", "E42"], importantKeyword: "E42",
   user: {}, role: "r", model: {},
-  preselectedItems: new Map(), identifierPinsByContext: new Map(), memoryPinnedItemIds: new Set<string>(),
+  preselectedItems: new Map(), identifierPinsByContext: new Map(), memoryPinnedItemIdsByContext: new Map<string, Set<string>>(),
   userPinnedItemIdsByContext: new Map(), rewrites: [{ find: "fix", replace: "repair" }],
   styleHint: "", maxQueries: 5, skipPrefilter: false,
 };
@@ -55,7 +55,7 @@ describe("searchContexts", () => {
     await searchContexts({
       ...base, contextIds: ["docs"],
       identifierPinsByContext: new Map([["docs", new Set(["i1"])]]),
-      memoryPinnedItemIds: new Set(["m1"]),
+      memoryPinnedItemIdsByContext: new Map([["docs", new Set(["m1"])]]),
     });
     expect(new Set((multiQuerySearch as jest.Mock).mock.calls[0][0].pinnedItemIds)).toEqual(new Set(["i1", "m1"]));
 
@@ -63,12 +63,27 @@ describe("searchContexts", () => {
     await searchContexts({
       ...base, contextIds: ["docs"],
       identifierPinsByContext: new Map([["docs", new Set(["i1"])]]),
-      memoryPinnedItemIds: new Set(["m1"]),
+      memoryPinnedItemIdsByContext: new Map([["docs", new Set(["m1"])]]),
       userPinnedItemIdsByContext: new Map([["docs", new Set(["u1"])]]),
     });
     expect((multiQuerySearch as jest.Mock).mock.calls[0][0].pinnedItemIds).toEqual(["u1"]);
   });
 
+  it("memory pins apply ONLY to their own context (no cross-context leak)", async () => {
+    // Regression: a memory pin resolved in another context (e.g. tech_doc's FST-Miscel-Secrets)
+    // must not become a hard id-whitelist on THIS context, which would filter it down to 0 chunks.
+    await searchContexts({
+      ...base, contextIds: ["docs"],
+      memoryPinnedItemIdsByContext: new Map([
+        ["docs", new Set(["m_docs"])],
+        ["other", new Set(["m_other"])],
+      ]),
+    });
+    const pins = (multiQuerySearch as jest.Mock).mock.calls[0][0].pinnedItemIds;
+    expect(pins).toEqual(["m_docs"]);        // own-context pin applied
+    expect(pins).not.toContain("m_other");   // foreign-context pin did NOT leak in
+  });
+
   it("preselected items win over everything and skip prefilters", async () => {
     await searchContexts({
       ...base, contextIds: ["docs"],
@@ -95,7 +110,7 @@ describe("searchContexts", () => {
     await searchContexts({
       ...base, contextIds: ["docs"], skipPrefilter: true,
       identifierPinsByContext: new Map([["docs", new Set(["i1"])]]),
-      memoryPinnedItemIds: new Set(["m1"]),
+      memoryPinnedItemIdsByContext: new Map([["docs", new Set(["m1"])]]),
     });
     expect((multiQuerySearch as jest.Mock).mock.calls[0][0].pinnedItemIds).toEqual([]);
   });

package/ee/agentic-retrieval/pipeline/search.ts

@@ -25,7 +25,7 @@ export async function searchContexts(opts: {
   preselectedItems: Map<string, string[] | null>;
   scopedItemsByContext?: Map<string, string[] | null>;  // Project-added sources: hard item filter per context (null = whole context).
   identifierPinsByContext: Map<string, Set<string>>;   // from resolveIdentifierPins
-  memoryPinnedItemIds: Set<string>;                     // from memory phase (documents kind only)
+  memoryPinnedItemIdsByContext: Map<string, Set<string>>; // from memory phase (documents kind only), keyed by home context
   userPinnedItemIdsByContext: Map<string, Set<string>>; // from routing phase
   rewrites: { find: string; replace: string }[];
   styleHint: string;
@@ -45,7 +45,7 @@ export async function searchContexts(opts: {
     preselectedItems,
     scopedItemsByContext,
     identifierPinsByContext,
-    memoryPinnedItemIds,
+    memoryPinnedItemIdsByContext,
     userPinnedItemIdsByContext,
     rewrites,
     styleHint,
@@ -94,9 +94,13 @@ export async function searchContexts(opts: {
           const identifierPins = identifierPinsByContext.get(ctxId) ?? new Set<string>();
           let pins = new Set<string>(identifierPins);
 
-          // 2b: documents kind only — UNION with memoryPinnedItemIds
+          // 2b: documents kind only — UNION with memory pins that belong to THIS context.
+          // Memory pins are keyed by their home context so a pin resolved elsewhere (e.g. a
+          // tech_doc file) never becomes a hard id-whitelist on a context that lacks it, which
+          // would prefilter that context down to 0 chunks.
           if (kind === "documents") {
-            for (const id of memoryPinnedItemIds) pins.add(id);
+            const memPins = memoryPinnedItemIdsByContext.get(ctxId);
+            if (memPins) for (const id of memPins) pins.add(id);
           }
 
           // 2c: user pins REPLACE everything (authoritative)

package/ee/agentic-retrieval/pipeline/types.ts

@@ -21,7 +21,7 @@ export type RoutingPhaseResult = {
 export type MemoryPhaseResult = {
   memoryChunksForAnswer: ChunkWithScore[];
   memoryOverride: { active: boolean; chunks: ChunkWithScore[]; reason: string };
-  memoryPinnedItemIds: Set<string>;
+  memoryPinnedItemIdsByContext: Map<string, Set<string>>;
   updatedQuestion: string;
   updatedKeywords: string[];
   updatedImportantKeyword: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exulu/backend",
   "author": "Qventu Bv.",
-  "version": "3.2.0",
+  "version": "3.3.1",
   "main": "./dist/index.js",
   "private": false,
   "publishConfig": {