@hasna/knowledge 0.2.21 → 0.2.23

package/bin/open-knowledge-mcp.js

@@ -120,7 +120,7 @@ var MCP_HTTP_SERVICE_NAME = "knowledge", DEFAULT_MCP_HTTP_PORT = 8819;
 var init_mcp_http = () => {};
 
 // src/mcp.js
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // node_modules/zod/v4/classic/external.js
@@ -13660,7 +13660,7 @@ import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync
 // package.json
 var package_default = {
   name: "@hasna/knowledge",
-  version: "0.2.21",
+  version: "0.2.23",
   description: "Agent-friendly local knowledge CLI with JSON output, pagination, and safe destructive actions",
   type: "module",
   bin: {
@@ -13723,9 +13723,8 @@ var package_default = {
   }
 };
 
-// src/store.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, renameSync, unlinkSync } from "fs";
-import { randomUUID } from "crypto";
+// src/knowledge-db.ts
+import { Database } from "bun:sqlite";
 
 // src/workspace.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -13855,414 +13854,37 @@ function writeKnowledgeConfig(path, config2) {
 `);
 }
 
-// src/store.ts
-function defaultStorePath() {
-  return workspaceForHome(globalKnowledgeHome()).jsonStorePath;
-}
-function ensureStore(path) {
-  if (!existsSync2(path)) {
-    ensureParentDir(path);
-    if (path === defaultStorePath() && existsSync2(legacyGlobalStorePath())) {
-      writeFileSync2(path, readFileSync2(legacyGlobalStorePath(), "utf8"));
-    } else {
-      writeFileSync2(path, JSON.stringify({ items: [] }, null, 2));
-    }
-  }
-}
-function lockPath(path) {
-  return `${path}.lock`;
-}
-function acquireLock(lockPath2, ownerId) {
-  const maxWait = 5000;
-  const interval = 50;
-  const start = Date.now();
-  while (Date.now() - start < maxWait) {
-    try {
-      if (!existsSync2(lockPath2)) {
-        writeFileSync2(lockPath2, JSON.stringify({ owner: ownerId, ts: Date.now() }));
-        return;
-      }
-      const lock = JSON.parse(readFileSync2(lockPath2, "utf8"));
-      if (Date.now() - lock.ts > 1e4) {
-        unlinkSync(lockPath2);
-      }
-    } catch {}
-    const start2 = Date.now();
-    while (Date.now() - start2 < interval) {}
-  }
-  throw new Error(`Could not acquire lock on ${lockPath2} after ${maxWait}ms`);
-}
-function releaseLock(lockPath2, ownerId) {
-  try {
-    if (existsSync2(lockPath2)) {
-      const lock = JSON.parse(readFileSync2(lockPath2, "utf8"));
-      if (lock.owner === ownerId) {
-        unlinkSync(lockPath2);
-      }
-    }
-  } catch {}
-}
-function loadStore(path) {
-  ensureStore(path);
-  const raw = readFileSync2(path, "utf8");
-  const parsed = JSON.parse(raw);
-  if (!parsed || !Array.isArray(parsed.items)) {
-    return { items: [] };
-  }
-  return parsed;
-}
-function saveStore(path, store) {
-  const tmp = `${path}.tmp.${randomUUID()}`;
-  writeFileSync2(tmp, JSON.stringify(store, null, 2));
-  renameSync(tmp, path);
-}
-function withLock(path, fn) {
-  const owner = randomUUID();
-  const lpath = lockPath(path);
-  acquireLock(lpath, owner);
-  try {
-    return fn();
-  } finally {
-    releaseLock(lpath, owner);
-  }
-}
-function makeId() {
-  return `k_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-}
+// src/knowledge-db.ts
+var MIGRATION_1 = `
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
 
-// src/source-ref.ts
-function assertNonEmpty(value, message) {
-  if (!value)
-    throw new Error(message);
-  return value;
-}
-function parseOpenFilesRef(uri) {
-  const withoutScheme = uri.slice("open-files://".length);
-  const parts = withoutScheme.split("/").filter(Boolean);
-  const entity = parts[0];
-  if (entity !== "file" && entity !== "source") {
-    throw new Error("Invalid open-files ref. Expected open-files://file/<id>, open-files://file/<id>/revision/<revision_id>, or open-files://source/<id>/path/<path>.");
-  }
-  const id = assertNonEmpty(parts[1], "Invalid open-files ref. Missing id.");
-  if (entity === "file") {
-    if (parts.length === 2)
-      return { kind: "open-files", uri, entity, id };
-    if (parts[2] === "revision" && parts[3] && parts.length === 4) {
-      return { kind: "open-files", uri, entity, id, revision_id: decodeURIComponent(parts[3]) };
-    }
-    throw new Error("Invalid open-files file ref. Expected open-files://file/<id>/revision/<revision_id>.");
-  }
-  const pathIndex = parts.indexOf("path");
-  const path = pathIndex >= 0 ? decodeURIComponent(parts.slice(pathIndex + 1).join("/")) : undefined;
-  return { kind: "open-files", uri, entity, id, path };
-}
-function parseS3Ref(uri) {
-  const parsed = new URL(uri);
-  const bucket = assertNonEmpty(parsed.hostname, "Invalid s3 ref. Missing bucket.");
-  const key = decodeURIComponent(parsed.pathname.replace(/^\/+/, ""));
-  if (!key)
-    throw new Error("Invalid s3 ref. Missing object key.");
-  return { kind: "s3", uri, bucket, key };
-}
-function parseFileRef(uri) {
-  const parsed = new URL(uri);
-  return { kind: "file", uri, path: decodeURIComponent(parsed.pathname) };
-}
-function parseWebRef(uri) {
-  const parsed = new URL(uri);
-  return { kind: "web", uri, url: parsed.toString() };
-}
-function parseSourceRef(uri) {
-  if (uri.startsWith("open-files://"))
-    return parseOpenFilesRef(uri);
-  if (uri.startsWith("s3://"))
-    return parseS3Ref(uri);
-  if (uri.startsWith("file://"))
-    return parseFileRef(uri);
-  if (uri.startsWith("https://") || uri.startsWith("http://"))
-    return parseWebRef(uri);
-  throw new Error(`Unsupported source ref scheme: ${uri}`);
-}
-function catalogSourceUriForRef(uri, parsed = parseSourceRef(uri)) {
-  if (parsed.kind === "open-files" && parsed.entity === "file" && parsed.revision_id) {
-    return uri.replace(/\/revision\/[^/]+$/, "");
-  }
-  return uri;
-}
-function revisionIdForSourceRef(uri) {
-  const parsed = parseSourceRef(uri);
-  return parsed.kind === "open-files" && parsed.entity === "file" ? parsed.revision_id ?? null : null;
-}
+CREATE TABLE IF NOT EXISTS schema_versions (
+  version INTEGER PRIMARY KEY,
+  applied_at TEXT NOT NULL
+);
 
-// src/artifact-store.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join2, relative, sep } from "path";
-function normalizeArtifactKey(key) {
-  const raw = key.replace(/\\/g, "/").trim();
-  if (!raw || raw.startsWith("/")) {
-    throw new Error(`Invalid artifact key: ${key}`);
-  }
-  const segments = raw.split("/").filter(Boolean);
-  if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) {
-    throw new Error(`Invalid artifact key: ${key}`);
-  }
-  return segments.join("/");
-}
-function assertInside(root, target) {
-  const rel = relative(root, target);
-  if (rel.startsWith("..") || rel === ".." || rel.startsWith(`..${sep}`)) {
-    throw new Error(`Artifact path escapes root: ${target}`);
-  }
-}
+CREATE TABLE IF NOT EXISTS sources (
+  id TEXT PRIMARY KEY,
+  uri TEXT NOT NULL UNIQUE,
+  kind TEXT NOT NULL,
+  title TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  acl_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
 
-class LocalArtifactStore {
-  root;
-  type = "local";
-  canRead = true;
-  canWrite = true;
-  constructor(root) {
-    this.root = root;
-    mkdirSync2(root, { recursive: true });
-  }
-  async put(entry) {
-    const key = normalizeArtifactKey(entry.key);
-    const path = join2(this.root, key);
-    assertInside(this.root, path);
-    mkdirSync2(dirname2(path), { recursive: true });
-    writeFileSync3(path, entry.body);
-    return { key, uri: `file://${path}` };
-  }
-  async getText(key) {
-    const normalizedKey = normalizeArtifactKey(key);
-    const path = join2(this.root, normalizedKey);
-    assertInside(this.root, path);
-    return readFileSync3(path, "utf8");
-  }
-  async exists(key) {
-    const normalizedKey = normalizeArtifactKey(key);
-    const path = join2(this.root, normalizedKey);
-    assertInside(this.root, path);
-    return existsSync3(path);
-  }
-}
-
-class S3ArtifactStore {
-  options;
-  type = "s3";
-  canRead = true;
-  canWrite = true;
-  client;
-  constructor(options) {
-    this.options = options;
-    this.client = options.client;
-  }
-  async getClient() {
-    if (this.client)
-      return this.client;
-    const [{ S3Client }, { fromIni }] = await Promise.all([
-      import("@aws-sdk/client-s3"),
-      import("@aws-sdk/credential-providers")
-    ]);
-    this.client = new S3Client({
-      region: this.options.region,
-      credentials: this.options.profile ? fromIni({ profile: this.options.profile }) : undefined,
-      maxAttempts: this.options.max_attempts
-    });
-    return this.client;
-  }
-  objectKey(key) {
-    const normalizedKey = normalizeArtifactKey(key);
-    const prefix = this.options.prefix ? normalizeArtifactKey(this.options.prefix) : "";
-    return prefix ? `${prefix}/${normalizedKey}` : normalizedKey;
-  }
-  async put(entry) {
-    const [{ PutObjectCommand }, client] = await Promise.all([
-      import("@aws-sdk/client-s3"),
-      this.getClient()
-    ]);
-    const key = this.objectKey(entry.key);
-    await client.send(new PutObjectCommand({
-      Bucket: this.options.bucket,
-      Key: key,
-      Body: entry.body,
-      ContentType: entry.content_type,
-      Metadata: entry.metadata,
-      ServerSideEncryption: this.options.server_side_encryption,
-      SSEKMSKeyId: this.options.kms_key_id
-    }));
-    return { key, uri: `s3://${this.options.bucket}/${key}` };
-  }
-  async getText(key) {
-    const [{ GetObjectCommand }, client] = await Promise.all([
-      import("@aws-sdk/client-s3"),
-      this.getClient()
-    ]);
-    const objectKey = this.objectKey(key);
-    const response = await client.send(new GetObjectCommand({
-      Bucket: this.options.bucket,
-      Key: objectKey
-    }));
-    if (!response.Body)
-      return "";
-    return await response.Body.transformToString();
-  }
-  async exists(key) {
-    const [{ HeadObjectCommand }, client] = await Promise.all([
-      import("@aws-sdk/client-s3"),
-      this.getClient()
-    ]);
-    const objectKey = this.objectKey(key);
-    try {
-      await client.send(new HeadObjectCommand({
-        Bucket: this.options.bucket,
-        Key: objectKey
-      }));
-      return true;
-    } catch (error48) {
-      const name = error48 instanceof Error ? error48.name : "";
-      if (name === "NotFound" || name === "NoSuchKey" || name === "NotFoundError")
-        return false;
-      throw error48;
-    }
-  }
-}
-function createArtifactStore(config2, workspace) {
-  if (config2.storage.type === "s3") {
-    if (!config2.storage.s3?.bucket)
-      throw new Error("S3 artifact storage requires storage.s3.bucket");
-    return new S3ArtifactStore({
-      bucket: config2.storage.s3.bucket,
-      prefix: config2.storage.s3.prefix,
-      region: config2.storage.s3.region,
-      profile: config2.storage.s3.profile,
-      max_attempts: config2.storage.s3.max_attempts,
-      server_side_encryption: config2.storage.s3.server_side_encryption,
-      kms_key_id: config2.storage.s3.kms_key_id
-    });
-  }
-  return new LocalArtifactStore(workspace.artifactsDir);
-}
-
-// src/auth.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
-var DEFAULT_KNOWLEDGE_API_URL = "https://knowledge.hasna.xyz";
-function normalizeKnowledgeApiOrigin(apiUrl) {
-  const url2 = new URL(apiUrl);
-  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
-    throw new Error("Knowledge API URL must use http or https.");
-  }
-  const pathname = url2.pathname.replace(/\/+$/, "");
-  if (pathname === "/api" || pathname === "/api/v1") {
-    url2.pathname = "/";
-  } else if (pathname.endsWith("/api/v1")) {
-    url2.pathname = pathname.slice(0, -"/api/v1".length) || "/";
-  } else if (pathname.endsWith("/api")) {
-    url2.pathname = pathname.slice(0, -"/api".length) || "/";
-  }
-  return url2.toString().replace(/\/+$/, "");
-}
-function knowledgeAuthPath(env = process.env) {
-  if (env.HASNA_KNOWLEDGE_AUTH_PATH)
-    return env.HASNA_KNOWLEDGE_AUTH_PATH;
-  const root = env.HASNA_KNOWLEDGE_AUTH_DIR ?? join3(homedir2(), ".hasna", "knowledge");
-  return join3(root, "auth.json");
-}
-function resolveKnowledgeApiUrl(config2, env = process.env) {
-  return normalizeKnowledgeApiOrigin(env.KNOWLEDGE_API_URL ?? config2?.hosted?.api_url ?? DEFAULT_KNOWLEDGE_API_URL);
-}
-function getKnowledgeAuth(env = process.env) {
-  try {
-    const path = knowledgeAuthPath(env);
-    if (!existsSync4(path))
-      return null;
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    return typeof parsed.api_key === "string" && parsed.api_key.length > 0 ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function saveKnowledgeAuth(auth, env = process.env) {
-  const path = knowledgeAuthPath(env);
-  const stored = {
-    ...auth,
-    api_url: auth.api_url ? normalizeKnowledgeApiOrigin(auth.api_url) : undefined,
-    created_at: auth.created_at ?? new Date().toISOString()
-  };
-  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
-  writeFileSync4(path, `${JSON.stringify(stored, null, 2)}
-`, { mode: 384 });
-  return stored;
-}
-function clearKnowledgeAuth(env = process.env) {
-  try {
-    unlinkSync2(knowledgeAuthPath(env));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getKnowledgeApiKey(env = process.env) {
-  if (env.KNOWLEDGE_API_KEY)
-    return { apiKey: env.KNOWLEDGE_API_KEY, source: "env" };
-  if (env.HASNA_KNOWLEDGE_API_KEY)
-    return { apiKey: env.HASNA_KNOWLEDGE_API_KEY, source: "env" };
-  const auth = getKnowledgeAuth(env);
-  return auth?.api_key ? { apiKey: auth.api_key, source: "file" } : { apiKey: null, source: "none" };
-}
-function knowledgeAuthStatus(config2, env = process.env) {
-  const auth = getKnowledgeAuth(env);
-  const key = getKnowledgeApiKey(env);
-  const apiUrl = env.KNOWLEDGE_API_URL ? resolveKnowledgeApiUrl(config2, env) : auth?.api_url ? normalizeKnowledgeApiOrigin(auth.api_url) : resolveKnowledgeApiUrl(config2, env);
-  return {
-    authenticated: Boolean(key.apiKey),
-    source: key.source,
-    api_url: apiUrl,
-    auth_path: knowledgeAuthPath(env),
-    email: key.source === "file" ? auth?.email ?? null : null,
-    org_id: key.source === "file" ? auth?.org_id ?? null : null,
-    org_slug: key.source === "file" ? auth?.org_slug ?? null : null,
-    user_id: key.source === "file" ? auth?.user_id ?? null : null,
-    api_key_present: Boolean(key.apiKey)
-  };
-}
-
-// src/agent.ts
-import { randomUUID as randomUUID3 } from "crypto";
-
-// src/knowledge-db.ts
-import { Database } from "bun:sqlite";
-var MIGRATION_1 = `
-PRAGMA journal_mode = WAL;
-PRAGMA foreign_keys = ON;
-
-CREATE TABLE IF NOT EXISTS schema_versions (
-  version INTEGER PRIMARY KEY,
-  applied_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS sources (
-  id TEXT PRIMARY KEY,
-  uri TEXT NOT NULL UNIQUE,
-  kind TEXT NOT NULL,
-  title TEXT,
-  metadata_json TEXT NOT NULL DEFAULT '{}',
-  acl_json TEXT NOT NULL DEFAULT '{}',
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS source_revisions (
-  id TEXT PRIMARY KEY,
-  source_id TEXT NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
-  revision TEXT NOT NULL,
-  hash TEXT,
-  extracted_text_uri TEXT,
-  metadata_json TEXT NOT NULL DEFAULT '{}',
-  created_at TEXT NOT NULL,
-  UNIQUE(source_id, revision)
-);
+CREATE TABLE IF NOT EXISTS source_revisions (
+  id TEXT PRIMARY KEY,
+  source_id TEXT NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
+  revision TEXT NOT NULL,
+  hash TEXT,
+  extracted_text_uri TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL,
+  UNIQUE(source_id, revision)
+);
 
 CREATE TABLE IF NOT EXISTS chunks (
   id TEXT PRIMARY KEY,
@@ -14525,39 +14147,417 @@ function migrateKnowledgeDb(path) {
     db.close();
   }
 }
-function getSchemaVersion(db) {
-  const row = db.query("SELECT MAX(version) AS version FROM schema_versions").get();
-  return row?.version ?? 0;
+function getSchemaVersion(db) {
+  const row = db.query("SELECT MAX(version) AS version FROM schema_versions").get();
+  return row?.version ?? 0;
+}
+function count(db, table) {
+  const row = db.query(`SELECT COUNT(*) AS n FROM ${table}`).get();
+  return row?.n ?? 0;
+}
+function getKnowledgeDbStats(path) {
+  const db = openKnowledgeDb(path);
+  try {
+    return {
+      schema_version: getSchemaVersion(db),
+      sources: count(db, "sources"),
+      source_revisions: count(db, "source_revisions"),
+      chunks: count(db, "chunks"),
+      wiki_pages: count(db, "wiki_pages"),
+      citations: count(db, "citations"),
+      indexes: count(db, "knowledge_indexes"),
+      runs: count(db, "runs"),
+      run_events: count(db, "run_events"),
+      redaction_findings: count(db, "redaction_findings"),
+      audit_events: count(db, "audit_events"),
+      approval_gates: count(db, "approval_gates"),
+      storage_objects: count(db, "storage_objects"),
+      embeddings: count(db, "chunk_embeddings"),
+      vector_entries: count(db, "vector_index_entries"),
+      reindex_queue: count(db, "reindex_queue")
+    };
+  } finally {
+    db.close();
+  }
+}
+
+// src/store.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, renameSync, unlinkSync } from "fs";
+import { randomUUID } from "crypto";
+function defaultStorePath() {
+  return workspaceForHome(globalKnowledgeHome()).jsonStorePath;
+}
+function ensureStore(path) {
+  if (!existsSync2(path)) {
+    ensureParentDir(path);
+    if (path === defaultStorePath() && existsSync2(legacyGlobalStorePath())) {
+      writeFileSync2(path, readFileSync2(legacyGlobalStorePath(), "utf8"));
+    } else {
+      writeFileSync2(path, JSON.stringify({ items: [] }, null, 2));
+    }
+  }
+}
+function lockPath(path) {
+  return `${path}.lock`;
+}
+function acquireLock(lockPath2, ownerId) {
+  const maxWait = 5000;
+  const interval = 50;
+  const start = Date.now();
+  while (Date.now() - start < maxWait) {
+    try {
+      if (!existsSync2(lockPath2)) {
+        writeFileSync2(lockPath2, JSON.stringify({ owner: ownerId, ts: Date.now() }));
+        return;
+      }
+      const lock = JSON.parse(readFileSync2(lockPath2, "utf8"));
+      if (Date.now() - lock.ts > 1e4) {
+        unlinkSync(lockPath2);
+      }
+    } catch {}
+    const start2 = Date.now();
+    while (Date.now() - start2 < interval) {}
+  }
+  throw new Error(`Could not acquire lock on ${lockPath2} after ${maxWait}ms`);
+}
+function releaseLock(lockPath2, ownerId) {
+  try {
+    if (existsSync2(lockPath2)) {
+      const lock = JSON.parse(readFileSync2(lockPath2, "utf8"));
+      if (lock.owner === ownerId) {
+        unlinkSync(lockPath2);
+      }
+    }
+  } catch {}
+}
+function loadStore(path) {
+  ensureStore(path);
+  const raw = readFileSync2(path, "utf8");
+  const parsed = JSON.parse(raw);
+  if (!parsed || !Array.isArray(parsed.items)) {
+    return { items: [] };
+  }
+  return parsed;
+}
+function saveStore(path, store) {
+  const tmp = `${path}.tmp.${randomUUID()}`;
+  writeFileSync2(tmp, JSON.stringify(store, null, 2));
+  renameSync(tmp, path);
+}
+function withLock(path, fn) {
+  const owner = randomUUID();
+  const lpath = lockPath(path);
+  acquireLock(lpath, owner);
+  try {
+    return fn();
+  } finally {
+    releaseLock(lpath, owner);
+  }
+}
+function makeId() {
+  return `k_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
+// src/source-ref.ts
+function assertNonEmpty(value, message) {
+  if (!value)
+    throw new Error(message);
+  return value;
+}
+function parseOpenFilesRef(uri) {
+  const withoutScheme = uri.slice("open-files://".length);
+  const parts = withoutScheme.split("/").filter(Boolean);
+  const entity = parts[0];
+  if (entity !== "file" && entity !== "source") {
+    throw new Error("Invalid open-files ref. Expected open-files://file/<id>, open-files://file/<id>/revision/<revision_id>, or open-files://source/<id>/path/<path>.");
+  }
+  const id = assertNonEmpty(parts[1], "Invalid open-files ref. Missing id.");
+  if (entity === "file") {
+    if (parts.length === 2)
+      return { kind: "open-files", uri, entity, id };
+    if (parts[2] === "revision" && parts[3] && parts.length === 4) {
+      return { kind: "open-files", uri, entity, id, revision_id: decodeURIComponent(parts[3]) };
+    }
+    throw new Error("Invalid open-files file ref. Expected open-files://file/<id>/revision/<revision_id>.");
+  }
+  const pathIndex = parts.indexOf("path");
+  const path = pathIndex >= 0 ? decodeURIComponent(parts.slice(pathIndex + 1).join("/")) : undefined;
+  return { kind: "open-files", uri, entity, id, path };
+}
+function parseS3Ref(uri) {
+  const parsed = new URL(uri);
+  const bucket = assertNonEmpty(parsed.hostname, "Invalid s3 ref. Missing bucket.");
+  const key = decodeURIComponent(parsed.pathname.replace(/^\/+/, ""));
+  if (!key)
+    throw new Error("Invalid s3 ref. Missing object key.");
+  return { kind: "s3", uri, bucket, key };
+}
+function parseFileRef(uri) {
+  const parsed = new URL(uri);
+  return { kind: "file", uri, path: decodeURIComponent(parsed.pathname) };
+}
+function parseWebRef(uri) {
+  const parsed = new URL(uri);
+  return { kind: "web", uri, url: parsed.toString() };
+}
+function parseSourceRef(uri) {
+  if (uri.startsWith("open-files://"))
+    return parseOpenFilesRef(uri);
+  if (uri.startsWith("s3://"))
+    return parseS3Ref(uri);
+  if (uri.startsWith("file://"))
+    return parseFileRef(uri);
+  if (uri.startsWith("https://") || uri.startsWith("http://"))
+    return parseWebRef(uri);
+  throw new Error(`Unsupported source ref scheme: ${uri}`);
+}
+function catalogSourceUriForRef(uri, parsed = parseSourceRef(uri)) {
+  if (parsed.kind === "open-files" && parsed.entity === "file" && parsed.revision_id) {
+    return uri.replace(/\/revision\/[^/]+$/, "");
+  }
+  return uri;
+}
+function revisionIdForSourceRef(uri) {
+  const parsed = parseSourceRef(uri);
+  return parsed.kind === "open-files" && parsed.entity === "file" ? parsed.revision_id ?? null : null;
+}
+
+// src/artifact-store.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, join as join2, relative, sep } from "path";
+function normalizeArtifactKey(key) {
+  const raw = key.replace(/\\/g, "/").trim();
+  if (!raw || raw.startsWith("/")) {
+    throw new Error(`Invalid artifact key: ${key}`);
+  }
+  const segments = raw.split("/").filter(Boolean);
+  if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) {
+    throw new Error(`Invalid artifact key: ${key}`);
+  }
+  return segments.join("/");
+}
+function assertInside(root, target) {
+  const rel = relative(root, target);
+  if (rel.startsWith("..") || rel === ".." || rel.startsWith(`..${sep}`)) {
+    throw new Error(`Artifact path escapes root: ${target}`);
+  }
+}
+
+class LocalArtifactStore {
+  root;
+  type = "local";
+  canRead = true;
+  canWrite = true;
+  constructor(root) {
+    this.root = root;
+    mkdirSync2(root, { recursive: true });
+  }
+  async put(entry) {
+    const key = normalizeArtifactKey(entry.key);
+    const path = join2(this.root, key);
+    assertInside(this.root, path);
+    mkdirSync2(dirname2(path), { recursive: true });
+    writeFileSync3(path, entry.body);
+    return { key, uri: `file://${path}` };
+  }
+  async getText(key) {
+    const normalizedKey = normalizeArtifactKey(key);
+    const path = join2(this.root, normalizedKey);
+    assertInside(this.root, path);
+    return readFileSync3(path, "utf8");
+  }
+  async exists(key) {
+    const normalizedKey = normalizeArtifactKey(key);
+    const path = join2(this.root, normalizedKey);
+    assertInside(this.root, path);
+    return existsSync3(path);
+  }
+}
+
+class S3ArtifactStore {
+  options;
+  type = "s3";
+  canRead = true;
+  canWrite = true;
+  client;
+  constructor(options) {
+    this.options = options;
+    this.client = options.client;
+  }
+  async getClient() {
+    if (this.client)
+      return this.client;
+    const [{ S3Client }, { fromIni }] = await Promise.all([
+      import("@aws-sdk/client-s3"),
+      import("@aws-sdk/credential-providers")
+    ]);
+    this.client = new S3Client({
+      region: this.options.region,
+      credentials: this.options.profile ? fromIni({ profile: this.options.profile }) : undefined,
+      maxAttempts: this.options.max_attempts
+    });
+    return this.client;
+  }
+  objectKey(key) {
+    const normalizedKey = normalizeArtifactKey(key);
+    const prefix = this.options.prefix ? normalizeArtifactKey(this.options.prefix) : "";
+    return prefix ? `${prefix}/${normalizedKey}` : normalizedKey;
+  }
+  async put(entry) {
+    const [{ PutObjectCommand }, client] = await Promise.all([
+      import("@aws-sdk/client-s3"),
+      this.getClient()
+    ]);
+    const key = this.objectKey(entry.key);
+    await client.send(new PutObjectCommand({
+      Bucket: this.options.bucket,
+      Key: key,
+      Body: entry.body,
+      ContentType: entry.content_type,
+      Metadata: entry.metadata,
+      ServerSideEncryption: this.options.server_side_encryption,
+      SSEKMSKeyId: this.options.kms_key_id
+    }));
+    return { key, uri: `s3://${this.options.bucket}/${key}` };
+  }
+  async getText(key) {
+    const [{ GetObjectCommand }, client] = await Promise.all([
+      import("@aws-sdk/client-s3"),
+      this.getClient()
+    ]);
+    const objectKey = this.objectKey(key);
+    const response = await client.send(new GetObjectCommand({
+      Bucket: this.options.bucket,
+      Key: objectKey
+    }));
+    if (!response.Body)
+      return "";
+    return await response.Body.transformToString();
+  }
+  async exists(key) {
+    const [{ HeadObjectCommand }, client] = await Promise.all([
+      import("@aws-sdk/client-s3"),
+      this.getClient()
+    ]);
+    const objectKey = this.objectKey(key);
+    try {
+      await client.send(new HeadObjectCommand({
+        Bucket: this.options.bucket,
+        Key: objectKey
+      }));
+      return true;
+    } catch (error48) {
+      const name = error48 instanceof Error ? error48.name : "";
+      if (name === "NotFound" || name === "NoSuchKey" || name === "NotFoundError")
+        return false;
+      throw error48;
+    }
+  }
+}
+function createArtifactStore(config2, workspace) {
+  if (config2.storage.type === "s3") {
+    if (!config2.storage.s3?.bucket)
+      throw new Error("S3 artifact storage requires storage.s3.bucket");
+    return new S3ArtifactStore({
+      bucket: config2.storage.s3.bucket,
+      prefix: config2.storage.s3.prefix,
+      region: config2.storage.s3.region,
+      profile: config2.storage.s3.profile,
+      max_attempts: config2.storage.s3.max_attempts,
+      server_side_encryption: config2.storage.s3.server_side_encryption,
+      kms_key_id: config2.storage.s3.kms_key_id
+    });
+  }
+  return new LocalArtifactStore(workspace.artifactsDir);
+}
+
+// src/auth.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, join as join3 } from "path";
+var DEFAULT_KNOWLEDGE_API_URL = "https://knowledge.hasna.xyz";
+function normalizeKnowledgeApiOrigin(apiUrl) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error("Knowledge API URL must use http or https.");
+  }
+  const pathname = url2.pathname.replace(/\/+$/, "");
+  if (pathname === "/api" || pathname === "/api/v1") {
+    url2.pathname = "/";
+  } else if (pathname.endsWith("/api/v1")) {
+    url2.pathname = pathname.slice(0, -"/api/v1".length) || "/";
+  } else if (pathname.endsWith("/api")) {
+    url2.pathname = pathname.slice(0, -"/api".length) || "/";
+  }
+  return url2.toString().replace(/\/+$/, "");
+}
+function knowledgeAuthPath(env = process.env) {
+  if (env.HASNA_KNOWLEDGE_AUTH_PATH)
+    return env.HASNA_KNOWLEDGE_AUTH_PATH;
+  const root = env.HASNA_KNOWLEDGE_AUTH_DIR ?? join3(homedir2(), ".hasna", "knowledge");
+  return join3(root, "auth.json");
+}
+function resolveKnowledgeApiUrl(config2, env = process.env) {
+  return normalizeKnowledgeApiOrigin(env.KNOWLEDGE_API_URL ?? config2?.hosted?.api_url ?? DEFAULT_KNOWLEDGE_API_URL);
 }
-function count(db, table) {
-  const row = db.query(`SELECT COUNT(*) AS n FROM ${table}`).get();
-  return row?.n ?? 0;
+function getKnowledgeAuth(env = process.env) {
+  try {
+    const path = knowledgeAuthPath(env);
+    if (!existsSync4(path))
+      return null;
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return typeof parsed.api_key === "string" && parsed.api_key.length > 0 ? parsed : null;
+  } catch {
+    return null;
+  }
 }
-function getKnowledgeDbStats(path) {
-  const db = openKnowledgeDb(path);
+function saveKnowledgeAuth(auth, env = process.env) {
+  const path = knowledgeAuthPath(env);
+  const stored = {
+    ...auth,
+    api_url: auth.api_url ? normalizeKnowledgeApiOrigin(auth.api_url) : undefined,
+    created_at: auth.created_at ?? new Date().toISOString()
+  };
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  writeFileSync4(path, `${JSON.stringify(stored, null, 2)}
+`, { mode: 384 });
+  return stored;
+}
+function clearKnowledgeAuth(env = process.env) {
   try {
-    return {
-      schema_version: getSchemaVersion(db),
-      sources: count(db, "sources"),
-      source_revisions: count(db, "source_revisions"),
-      chunks: count(db, "chunks"),
-      wiki_pages: count(db, "wiki_pages"),
-      citations: count(db, "citations"),
-      indexes: count(db, "knowledge_indexes"),
-      runs: count(db, "runs"),
-      run_events: count(db, "run_events"),
-      redaction_findings: count(db, "redaction_findings"),
-      audit_events: count(db, "audit_events"),
-      approval_gates: count(db, "approval_gates"),
-      storage_objects: count(db, "storage_objects"),
-      embeddings: count(db, "chunk_embeddings"),
-      vector_entries: count(db, "vector_index_entries"),
-      reindex_queue: count(db, "reindex_queue")
-    };
-  } finally {
-    db.close();
+    unlinkSync2(knowledgeAuthPath(env));
+    return true;
+  } catch {
+    return false;
   }
 }
+function getKnowledgeApiKey(env = process.env) {
+  if (env.KNOWLEDGE_API_KEY)
+    return { apiKey: env.KNOWLEDGE_API_KEY, source: "env" };
+  if (env.HASNA_KNOWLEDGE_API_KEY)
+    return { apiKey: env.HASNA_KNOWLEDGE_API_KEY, source: "env" };
+  const auth = getKnowledgeAuth(env);
+  return auth?.api_key ? { apiKey: auth.api_key, source: "file" } : { apiKey: null, source: "none" };
+}
+function knowledgeAuthStatus(config2, env = process.env) {
+  const auth = getKnowledgeAuth(env);
+  const key = getKnowledgeApiKey(env);
+  const apiUrl = env.KNOWLEDGE_API_URL ? resolveKnowledgeApiUrl(config2, env) : auth?.api_url ? normalizeKnowledgeApiOrigin(auth.api_url) : resolveKnowledgeApiUrl(config2, env);
+  return {
+    authenticated: Boolean(key.apiKey),
+    source: key.source,
+    api_url: apiUrl,
+    auth_path: knowledgeAuthPath(env),
+    email: key.source === "file" ? auth?.email ?? null : null,
+    org_id: key.source === "file" ? auth?.org_id ?? null : null,
+    org_slug: key.source === "file" ? auth?.org_slug ?? null : null,
+    user_id: key.source === "file" ? auth?.user_id ?? null : null,
+    api_key_present: Boolean(key.apiKey)
+  };
+}
+
+// src/agent.ts
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/providers.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -18062,6 +18062,9 @@ async function runProviderWebSearch(options) {
   };
 }
 
+// src/wiki-compiler.ts
+import { createHash as createHash10, randomUUID as randomUUID9 } from "crypto";
+
 // src/storage-contract.ts
 import { createHash as createHash9, randomUUID as randomUUID8 } from "crypto";
 var GENERATED_ARTIFACTS = [
@@ -18223,44 +18226,582 @@ function validateStorageConfig(config2, workspace) {
     warnings
   };
 }
-function recordStorageObjects(db, objects, now = new Date) {
-  const timestamp = now.toISOString();
-  const statement = db.prepare(`
-    INSERT INTO storage_objects (
-      id, artifact_uri, kind, content_type, hash, size_bytes, metadata_json, created_at, updated_at
-    )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(artifact_uri) DO UPDATE SET
-      kind = excluded.kind,
-      content_type = excluded.content_type,
-      hash = excluded.hash,
-      size_bytes = excluded.size_bytes,
-      metadata_json = excluded.metadata_json,
-      updated_at = excluded.updated_at
-  `);
-  const insert = db.transaction((entries) => {
-    for (const entry of entries) {
-      statement.run(randomUUID8(), entry.uri, entry.kind, entry.content_type ?? null, entry.hash ?? null, entry.size_bytes ?? null, JSON.stringify({
-        key: entry.key,
-        ...entry.metadata ?? {}
-      }), timestamp, timestamp);
+function recordStorageObjects(db, objects, now = new Date) {
+  const timestamp = now.toISOString();
+  const statement = db.prepare(`
+    INSERT INTO storage_objects (
+      id, artifact_uri, kind, content_type, hash, size_bytes, metadata_json, created_at, updated_at
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(artifact_uri) DO UPDATE SET
+      kind = excluded.kind,
+      content_type = excluded.content_type,
+      hash = excluded.hash,
+      size_bytes = excluded.size_bytes,
+      metadata_json = excluded.metadata_json,
+      updated_at = excluded.updated_at
+  `);
+  const insert = db.transaction((entries) => {
+    for (const entry of entries) {
+      statement.run(randomUUID8(), entry.uri, entry.kind, entry.content_type ?? null, entry.hash ?? null, entry.size_bytes ?? null, JSON.stringify({
+        key: entry.key,
+        ...entry.metadata ?? {}
+      }), timestamp, timestamp);
+    }
+  });
+  insert(objects);
+}
+
+// src/wiki-compiler.ts
+function stableId6(prefix, value) {
+  return `${prefix}_${createHash10("sha256").update(value).digest("hex").slice(0, 20)}`;
+}
+function slugify2(value) {
+  const slug = value.normalize("NFKC").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+  return slug || "knowledge-page";
+}
+function todayParts(now) {
+  return {
+    year: String(now.getUTCFullYear()),
+    month: String(now.getUTCMonth() + 1).padStart(2, "0"),
+    day: String(now.getUTCDate()).padStart(2, "0")
+  };
+}
+function estimateTokenCount2(text) {
+  const words = text.trim().split(/\s+/).filter(Boolean).length;
+  return Math.max(1, Math.ceil(words * 1.25));
+}
+function parseJsonObject4(value) {
+  if (!value)
+    return {};
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function queryTerms3(query) {
+  return Array.from(new Set((query ?? "").toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? [])).slice(0, 12);
+}
+function escapeLike(value) {
+  return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+}
+function selectSourceChunks(db, options) {
+  const limit = Math.max(1, Math.min(options.limit ?? 10, 50));
+  const sourceRefs = options.sourceRefs ?? [];
+  const terms = queryTerms3(options.query);
+  const where = ["c.kind = 'source'"];
+  const params = [];
+  if (sourceRefs.length > 0) {
+    where.push(`(${sourceRefs.map(() => "(s.uri = ? OR c.metadata_json LIKE ?)").join(" OR ")})`);
+    for (const ref of sourceRefs) {
+      params.push(ref, `%${escapeLike(ref)}%`);
+    }
+  }
+  if (terms.length > 0) {
+    where.push(`(${terms.map(() => "lower(c.text) LIKE ? ESCAPE '\\'").join(" OR ")})`);
+    for (const term of terms)
+      params.push(`%${escapeLike(term)}%`);
+  }
+  params.push(limit);
+  return db.query(`SELECT
+       c.id AS chunk_id,
+       c.text,
+       c.start_offset,
+       c.end_offset,
+       c.metadata_json,
+       c.source_revision_id,
+       sr.revision,
+       sr.hash,
+       s.uri AS source_uri,
+       s.title AS source_title
+     FROM chunks c
+     JOIN source_revisions sr ON sr.id = c.source_revision_id
+     JOIN sources s ON s.id = sr.source_id
+     WHERE ${where.join(" AND ")}
+     ORDER BY c.created_at ASC, c.ordinal ASC
+     LIMIT ?`).all(...params);
+}
+function excerpt(text, max = 420) {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  return normalized.length <= max ? normalized : `${normalized.slice(0, max - 1).trim()}...`;
+}
+function titleFor(options, rows) {
+  if (options.title?.trim())
+    return options.title.trim();
+  if (options.query?.trim())
+    return options.query.trim();
+  return rows[0]?.source_title ?? "Compiled Knowledge";
+}
+function compileBody(title, rows, now) {
+  const sourceLines = rows.map((row, index) => {
+    const label = `S${index + 1}`;
+    return `- [${label}] ${row.source_title ?? row.source_uri ?? "Source"} (${row.source_uri ?? "unknown"}, revision ${row.revision ?? "unknown"}, hash ${row.hash ?? "unknown"})`;
+  });
+  const noteLines = rows.map((row, index) => {
+    const label = `S${index + 1}`;
+    return [
+      `## ${row.source_title ?? `Source ${index + 1}`}`,
+      "",
+      excerpt(row.text),
+      "",
+      `Citation: [${label}]`
+    ].join(`
+`);
+  });
+  return [
+    `# ${title}`,
+    "",
+    `Generated at: ${now}`,
+    "",
+    "## Sources",
+    "",
+    ...sourceLines,
+    "",
+    ...noteLines,
+    ""
+  ].join(`
+`);
+}
+async function writeArtifact(store, entry) {
+  const written = await store.put(entry);
+  return {
+    key: written.key,
+    uri: written.uri,
+    kind: entry.key.startsWith("logs/") ? "log" : "wiki_page",
+    content_type: entry.content_type,
+    ...hashArtifactBody(entry.body),
+    metadata: {
+      ...entry.metadata ?? {}
+    }
+  };
+}
+async function appendLog(store, event, now) {
+  const { year, month, day } = todayParts(now);
+  const key = `logs/${year}/${month}/${day}.jsonl`;
+  let existing = "";
+  try {
+    existing = await store.getText(key);
+  } catch {
+    existing = "";
+  }
+  return writeArtifact(store, {
+    key,
+    body: `${existing}${JSON.stringify(event)}
+`,
+    content_type: "application/x-ndjson"
+  });
+}
+function upsertWikiPage(db, input) {
+  db.run(`INSERT INTO wiki_pages (id, path, title, artifact_uri, content_hash, status, metadata_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(path) DO UPDATE SET
+       title = excluded.title,
+       artifact_uri = excluded.artifact_uri,
+       content_hash = excluded.content_hash,
+       status = excluded.status,
+       metadata_json = excluded.metadata_json,
+       updated_at = excluded.updated_at`, [
+    input.pageId,
+    input.path,
+    input.title,
+    input.artifactUri,
+    input.contentHash,
+    "active",
+    JSON.stringify({
+      artifact_key: input.path,
+      provenance: input.provenance
+    }),
+    input.now,
+    input.now
+  ]);
+  const existing = db.query("SELECT id FROM chunks WHERE wiki_page_id = ?").all(input.pageId);
+  for (const row of existing)
+    db.run("DELETE FROM chunks_fts WHERE chunk_id = ?", [row.id]);
+  db.run("DELETE FROM chunks WHERE wiki_page_id = ?", [input.pageId]);
+  const chunkId = stableId6("chk", `${input.pageId}\x00${input.contentHash}`);
+  db.run(`INSERT INTO chunks (id, wiki_page_id, kind, ordinal, text, token_count, start_offset, end_offset, metadata_json, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+    chunkId,
+    input.pageId,
+    "wiki",
+    0,
+    input.body,
+    estimateTokenCount2(input.body),
+    0,
+    input.body.length,
+    JSON.stringify({
+      artifact_key: input.path,
+      artifact_uri: input.artifactUri,
+      content_hash: input.contentHash,
+      provenance: input.provenance
+    }),
+    input.now
+  ]);
+  db.run("INSERT INTO chunks_fts (chunk_id, text, title, source_uri) VALUES (?, ?, ?, ?)", [
+    chunkId,
+    input.body,
+    input.title,
+    input.artifactUri
+  ]);
+}
+function replacePageCitations(db, pageId, citations, now) {
+  db.run("DELETE FROM citations WHERE wiki_page_id = ?", [pageId]);
+  for (const citation of citations) {
+    db.run(`INSERT INTO citations (id, wiki_page_id, chunk_id, source_uri, quote, start_offset, end_offset, metadata_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      stableId6("cit", `${pageId}\x00${citation.source_uri}\x00${citation.chunk_id ?? randomUUID9()}`),
+      pageId,
+      citation.chunk_id,
+      citation.source_uri,
+      citation.quote,
+      citation.start_offset,
+      citation.end_offset,
+      JSON.stringify(citation.metadata),
+      now
+    ]);
+  }
+  return citations.length;
+}
+function upsertIndex(db, input) {
+  db.run(`INSERT INTO knowledge_indexes (id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(kind, name, shard_key) DO UPDATE SET
+       artifact_uri = excluded.artifact_uri,
+       metadata_json = excluded.metadata_json,
+       updated_at = excluded.updated_at`, [
+    stableId6("idx", `wiki-topic\x00${input.path}`),
+    "wiki_topic",
+    input.title,
+    input.artifactUri,
+    input.path,
+    JSON.stringify({
+      artifact_key: input.path,
+      content_hash: input.contentHash
+    }),
+    input.now,
+    input.now
+  ]);
+  return 1;
+}
+function firstConcept(title) {
+  return title.toLowerCase().match(/[a-z0-9][a-z0-9-]{2,}/)?.[0] ?? "knowledge";
+}
+async function compileWikiPage(options) {
+  const nowDate = options.now ?? new Date;
+  const now = nowDate.toISOString();
+  migrateKnowledgeDb(options.dbPath);
+  const readDb = openKnowledgeDb(options.dbPath);
+  let rows;
+  try {
+    rows = selectSourceChunks(readDb, options);
+  } finally {
+    readDb.close();
+  }
+  if (rows.length === 0)
+    throw new Error("No source chunks matched wiki compile input.");
+  const title = titleFor(options, rows);
+  const slug = slugify2(title);
+  const path = `wiki/generated/${slug}.md`;
+  const body = compileBody(title, rows, now);
+  const sourceRefs = rows.map((row) => {
+    const metadata = parseJsonObject4(row.metadata_json);
+    return typeof metadata.source_ref === "string" ? metadata.source_ref : row.source_uri;
+  }).filter((ref) => Boolean(ref));
+  const provenance = generatedArtifactProvenance({
+    generated_from: "wiki_compile",
+    artifact_key: path,
+    source_refs: sourceRefs
+  });
+  const pageArtifact = await writeArtifact(options.store, {
+    key: path,
+    body,
+    content_type: "text/markdown",
+    metadata: { generated_from: "wiki_compile" }
+  });
+  const pageId = stableId6("wiki", path);
+  const citations = rows.map((row) => ({
+    chunk_id: row.chunk_id,
+    source_uri: row.source_uri ?? "unknown",
+    quote: excerpt(row.text, 240),
+    start_offset: row.start_offset,
+    end_offset: row.end_offset,
+    metadata: {
+      source_revision_id: row.source_revision_id,
+      revision: row.revision,
+      hash: row.hash,
+      source_ref: parseJsonObject4(row.metadata_json).source_ref ?? row.source_uri
+    }
+  }));
+  const concept = firstConcept(title);
+  const conceptPath = `wiki/concepts/${slugify2(concept)}.md`;
+  const conceptBody = [`# ${concept}`, "", `Related page: [[${path}]]`, ""].join(`
+`);
+  const conceptProvenance = generatedArtifactProvenance({
+    generated_from: "wiki_compile_concept",
+    artifact_key: conceptPath,
+    source_refs: sourceRefs
+  });
+  const conceptArtifact = await writeArtifact(options.store, {
+    key: conceptPath,
+    body: conceptBody,
+    content_type: "text/markdown",
+    metadata: { generated_from: "wiki_compile_concept" }
+  });
+  const conceptPageId = stableId6("wiki", conceptPath);
+  const log = await appendLog(options.store, {
+    ts: now,
+    event: "wiki_compile_completed",
+    page_key: path,
+    source_refs: sourceRefs,
+    chunks_seen: rows.length
+  }, nowDate);
+  const db = openKnowledgeDb(options.dbPath);
+  try {
+    recordStorageObjects(db, [pageArtifact, conceptArtifact, log], nowDate);
+    upsertWikiPage(db, {
+      pageId,
+      path,
+      title,
+      artifactUri: pageArtifact.uri,
+      contentHash: pageArtifact.hash ?? "",
+      body,
+      provenance,
+      now
+    });
+    upsertWikiPage(db, {
+      pageId: conceptPageId,
+      path: conceptPath,
+      title: concept,
+      artifactUri: conceptArtifact.uri,
+      contentHash: conceptArtifact.hash ?? "",
+      body: conceptBody,
+      provenance: conceptProvenance,
+      now
+    });
+    db.run(`INSERT OR REPLACE INTO wiki_backlinks (from_page_id, to_page_id, label, created_at)
+       VALUES (?, ?, ?, ?)`, [pageId, conceptPageId, "concept", now]);
+    const citationsWritten = replacePageCitations(db, pageId, citations, now);
+    const indexesUpdated = upsertIndex(db, {
+      title,
+      path,
+      artifactUri: pageArtifact.uri,
+      contentHash: pageArtifact.hash ?? "",
+      now
+    });
+    return {
+      page_id: pageId,
+      path,
+      artifact_uri: pageArtifact.uri,
+      content_hash: pageArtifact.hash ?? "",
+      chunks_seen: rows.length,
+      citations_written: citationsWritten,
+      concept_page_id: conceptPageId,
+      indexes_updated: indexesUpdated,
+      log_key: log.key,
+      warnings: []
+    };
+  } finally {
+    db.close();
+  }
+}
+async function fileAnswerToWiki(options) {
+  if (!options.approveWrite) {
+    return {
+      approved: false,
+      durable_writes_performed: false,
+      page_id: null,
+      path: null,
+      artifact_uri: null,
+      citations_written: 0,
+      log_key: null,
+      message: "Dry-run: answer filing requires --approve-write."
+    };
+  }
+  const nowDate = options.now ?? new Date;
+  const now = nowDate.toISOString();
+  const title = options.prompt.length > 80 ? `${options.prompt.slice(0, 77)}...` : options.prompt;
+  const slug = slugify2(title);
+  const path = `wiki/answers/${slug}.md`;
+  const citations = options.context.citations;
+  const body = [
+    `# ${title}`,
+    "",
+    options.answer,
+    "",
+    "## Citations",
+    "",
+    ...citations.map((citation, index) => `- [C${index + 1}] ${citation.source_ref ?? citation.source_uri ?? citation.artifact_path ?? citation.artifact_uri ?? "unknown"} ${citation.hash ? `(hash ${citation.hash})` : ""}`),
+    ""
+  ].join(`
+`);
+  const sourceRefs = citations.map((citation) => citation.source_ref ?? citation.source_uri).filter((ref) => Boolean(ref));
+  const provenance = generatedArtifactProvenance({
+    generated_from: "knowledge_answer",
+    artifact_key: path,
+    source_refs: sourceRefs
+  });
+  const artifact = await writeArtifact(options.store, {
+    key: path,
+    body,
+    content_type: "text/markdown",
+    metadata: { generated_from: "knowledge_answer" }
+  });
+  const log = await appendLog(options.store, {
+    ts: now,
+    event: "wiki_answer_filed",
+    page_key: path,
+    prompt: options.prompt,
+    citations: citations.length
+  }, nowDate);
+  const pageId = stableId6("wiki", path);
+  const db = openKnowledgeDb(options.dbPath);
+  try {
+    recordStorageObjects(db, [artifact, log], nowDate);
+    upsertWikiPage(db, {
+      pageId,
+      path,
+      title,
+      artifactUri: artifact.uri,
+      contentHash: artifact.hash ?? "",
+      body,
+      provenance,
+      now
+    });
+    const written = replacePageCitations(db, pageId, citations.map((citation) => ({
+      chunk_id: citation.chunk_id,
+      source_uri: citation.source_uri ?? citation.artifact_uri ?? "unknown",
+      quote: citation.quote,
+      start_offset: citation.start_offset,
+      end_offset: citation.end_offset,
+      metadata: {
+        source_ref: citation.source_ref,
+        artifact_path: citation.artifact_path,
+        revision: citation.revision,
+        hash: citation.hash
+      }
+    })), now);
+    upsertIndex(db, {
+      title,
+      path,
+      artifactUri: artifact.uri,
+      contentHash: artifact.hash ?? "",
+      now
+    });
+    return {
+      approved: true,
+      durable_writes_performed: true,
+      page_id: pageId,
+      path,
+      artifact_uri: artifact.uri,
+      citations_written: written,
+      log_key: log.key,
+      message: `Filed answer to ${path}`
+    };
+  } finally {
+    db.close();
+  }
+}
+function addIssue(issues, issue2) {
+  issues.push(issue2);
+}
+function lintWiki(options) {
+  migrateKnowledgeDb(options.dbPath);
+  const db = openKnowledgeDb(options.dbPath);
+  const issues = [];
+  try {
+    const activePages = db.query("SELECT COUNT(*) AS n FROM wiki_pages WHERE status = 'active'").get()?.n ?? 0;
+    const citationCount = db.query("SELECT COUNT(*) AS n FROM citations").get()?.n ?? 0;
+    const backlinkCount = db.query("SELECT COUNT(*) AS n FROM wiki_backlinks").get()?.n ?? 0;
+    const missingCitations = db.query(`SELECT wp.id, wp.path
+       FROM wiki_pages wp
+       LEFT JOIN citations c ON c.wiki_page_id = wp.id
+       WHERE wp.status = 'active' AND wp.path LIKE 'wiki/generated/%'
+       GROUP BY wp.id
+       HAVING COUNT(c.id) = 0`).all();
+    for (const page of missingCitations) {
+      addIssue(issues, { type: "missing_citation", severity: "error", page_id: page.id, path: page.path, message: "Generated wiki page has no citations." });
+    }
+    const stale = db.query(`SELECT wp.id AS page_id, wp.path, c.source_uri, c.chunk_id
+       FROM citations c
+       JOIN wiki_pages wp ON wp.id = c.wiki_page_id
+       LEFT JOIN chunks ch ON ch.id = c.chunk_id
+       WHERE ch.metadata_json LIKE '%"stale":true%' OR ch.metadata_json LIKE '%"status":"stale"%' OR ch.metadata_json LIKE '%"status":"deleted"%'`).all();
+    for (const row of stale) {
+      addIssue(issues, { type: "stale_citation", severity: "warn", page_id: row.page_id, path: row.path, source_uri: row.source_uri, chunk_id: row.chunk_id ?? undefined, message: "Page cites a stale or deleted source chunk." });
+    }
+    const duplicates = db.query(`SELECT lower(title) AS title, COUNT(*) AS n
+       FROM wiki_pages
+       WHERE status = 'active'
+       GROUP BY lower(title)
+       HAVING COUNT(*) > 1`).all();
+    for (const row of duplicates) {
+      addIssue(issues, { type: "duplicate_page", severity: "warn", message: `Duplicate active wiki title: ${row.title} (${row.n} pages).` });
+    }
+    const orphans = db.query(`SELECT wp.id, wp.path
+       FROM wiki_pages wp
+       LEFT JOIN wiki_backlinks wb1 ON wb1.from_page_id = wp.id
+       LEFT JOIN wiki_backlinks wb2 ON wb2.to_page_id = wp.id
+       WHERE wp.status = 'active'
+         AND wp.path NOT IN ('wiki/README.md')
+       GROUP BY wp.id
+       HAVING COUNT(wb1.to_page_id) = 0 AND COUNT(wb2.from_page_id) = 0`).all();
+    for (const page of orphans) {
+      addIssue(issues, { type: "orphan_page", severity: "info", page_id: page.id, path: page.path, message: "Wiki page has no backlinks." });
+    }
+    const unresolved = db.query(`SELECT wp.id AS page_id, wp.path, c.source_uri
+       FROM citations c
+       JOIN wiki_pages wp ON wp.id = c.wiki_page_id
+       LEFT JOIN sources s ON s.uri = c.source_uri
+       WHERE s.id IS NULL AND c.source_uri NOT LIKE 'file://%' AND c.source_uri NOT LIKE 's3://%' AND c.source_uri NOT LIKE 'https://%' AND c.source_uri NOT LIKE 'open-files://%'`).all();
+    for (const row of unresolved) {
+      addIssue(issues, { type: "unresolved_source_ref", severity: "error", page_id: row.page_id, path: row.path, source_uri: row.source_uri, message: "Citation source URI cannot be resolved to a known or allowed source ref." });
+    }
+    const contradictions = db.query(`SELECT id, path FROM wiki_pages WHERE lower(metadata_json) LIKE '%contradiction%'`).all();
+    for (const page of contradictions) {
+      addIssue(issues, { type: "contradiction_marker", severity: "warn", page_id: page.id, path: page.path, message: "Page metadata contains a contradiction marker." });
+    }
+    const newArticleCandidates = db.query(`SELECT c.id AS chunk_id, s.uri AS source_uri
+       FROM chunks c
+       JOIN source_revisions sr ON sr.id = c.source_revision_id
+       JOIN sources s ON s.id = sr.source_id
+       LEFT JOIN citations cit ON cit.chunk_id = c.id
+       WHERE c.kind = 'source'
+       GROUP BY c.id
+       HAVING COUNT(cit.id) = 0
+       LIMIT 25`).all();
+    for (const row of newArticleCandidates) {
+      addIssue(issues, { type: "new_article_candidate", severity: "info", chunk_id: row.chunk_id, source_uri: row.source_uri ?? undefined, message: "Source chunk is indexed but not cited by any wiki page yet." });
     }
-  });
-  insert(objects);
+    return {
+      ok: issues.every((issue2) => issue2.severity !== "error"),
+      issue_count: issues.length,
+      issues,
+      counts: {
+        active_pages: activePages,
+        citations: citationCount,
+        backlinks: backlinkCount,
+        new_article_candidates: newArticleCandidates.length
+      }
+    };
+  } finally {
+    db.close();
+  }
 }
 
 // src/wiki-layout.ts
-import { createHash as createHash10 } from "crypto";
-function todayParts(now) {
+import { createHash as createHash11 } from "crypto";
+function todayParts2(now) {
   const year = String(now.getUTCFullYear());
   const month = String(now.getUTCMonth() + 1).padStart(2, "0");
   const day = String(now.getUTCDate()).padStart(2, "0");
   return { year, month, day };
 }
-function stableId6(prefix, value) {
-  return `${prefix}_${createHash10("sha256").update(value).digest("hex").slice(0, 20)}`;
+function stableId7(prefix, value) {
+  return `${prefix}_${createHash11("sha256").update(value).digest("hex").slice(0, 20)}`;
 }
-function estimateTokenCount2(text) {
+function estimateTokenCount3(text) {
   const words = text.trim().split(/\s+/).filter(Boolean).length;
   return Math.max(1, Math.ceil(words * 1.25));
 }
@@ -18319,7 +18860,7 @@ Pages should be concise, cited, and organized for both humans and agents.
 `;
 }
 async function initializeWikiLayout(store, now = new Date) {
-  const { year, month, day } = todayParts(now);
+  const { year, month, day } = todayParts2(now);
   const schemaKey = "schemas/v1.md";
   const rootIndexKey = "indexes/root.md";
   const wikiReadmeKey = "wiki/README.md";
@@ -18376,7 +18917,7 @@ function provenanceFor(artifact) {
 }
 function recordWikiChunk(db, pageId, title, artifact, body, now) {
   const provenance = provenanceFor(artifact);
-  const chunkId = stableId6("chk", `${pageId}\x00${artifact.hash ?? artifact.uri}`);
+  const chunkId = stableId7("chk", `${pageId}\x00${artifact.hash ?? artifact.uri}`);
   const existing = db.query("SELECT id FROM chunks WHERE wiki_page_id = ?").all(pageId);
   for (const row of existing)
     db.run("DELETE FROM chunks_fts WHERE chunk_id = ?", [row.id]);
@@ -18388,7 +18929,7 @@ function recordWikiChunk(db, pageId, title, artifact, body, now) {
     "wiki",
     0,
     body,
-    estimateTokenCount2(body),
+    estimateTokenCount3(body),
     0,
     body.length,
     JSON.stringify({
@@ -18412,7 +18953,7 @@ function recordWikiLayoutCatalog(db, artifacts, now = new Date) {
          artifact_uri = excluded.artifact_uri,
          metadata_json = excluded.metadata_json,
          updated_at = excluded.updated_at`, [
-      stableId6("idx", "root:indexes/root.md"),
+      stableId7("idx", "root:indexes/root.md"),
       "root",
       "root",
       rootIndex.uri,
@@ -18427,7 +18968,7 @@ function recordWikiLayoutCatalog(db, artifacts, now = new Date) {
     ]);
   }
   if (wikiReadme) {
-    const wikiPageId = stableId6("wiki", "wiki/README.md");
+    const wikiPageId = stableId7("wiki", "wiki/README.md");
     db.run(`INSERT INTO wiki_pages (id, path, title, artifact_uri, content_hash, status, metadata_json, created_at, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(path) DO UPDATE SET
@@ -18599,6 +19140,37 @@ class KnowledgeService {
     }
     return result;
   }
+  async compileWiki(options = {}) {
+    const workspace = this.ensureWorkspace();
+    return compileWikiPage({
+      ...options,
+      dbPath: workspace.knowledgeDbPath,
+      store: this.artifactStore()
+    });
+  }
+  async fileAnswer(options) {
+    const workspace = this.ensureWorkspace();
+    const context = await this.retrieveContext({
+      query: options.prompt,
+      limit: options.limit,
+      semantic: options.semantic,
+      modelRef: options.modelRef,
+      dimensions: options.dimensions,
+      fake: options.fake
+    });
+    return fileAnswerToWiki({
+      dbPath: workspace.knowledgeDbPath,
+      store: this.artifactStore(),
+      prompt: options.prompt,
+      answer: options.answer,
+      context,
+      approveWrite: options.approveWrite
+    });
+  }
+  lintWiki() {
+    const workspace = this.ensureWorkspace();
+    return lintWiki({ dbPath: workspace.knowledgeDbPath });
+  }
   async ingestManifest(input) {
     const workspace = this.ensureWorkspace();
     return ingestOpenFilesManifest({
@@ -18772,14 +19344,520 @@ function sortItems(items, sort = "created", desc = false) {
 function activeItems(items, includeArchived) {
   return includeArchived ? items : items.filter((item) => !item.archived);
 }
+function limitNumber(value, fallback = 20, max = 100) {
+  if (!Number.isFinite(value) || value <= 0)
+    return fallback;
+  return Math.min(Math.floor(value), max);
+}
+function parseJsonObject5(value) {
+  if (!value)
+    return {};
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function jsonResource(uri, data) {
+  return {
+    contents: [{
+      uri: uri.toString(),
+      mimeType: "application/json",
+      text: JSON.stringify(data, null, 2)
+    }]
+  };
+}
 function registerTool(server, name, title, description, inputSchema, handler) {
   server.registerTool(name, { title, description, inputSchema }, handler);
 }
+function registerJsonResource(server, name, uri, title, description, read) {
+  server.registerResource(name, uri, {
+    title,
+    description,
+    mimeType: "application/json"
+  }, async (resourceUri) => jsonResource(resourceUri, await read(resourceUri)));
+}
+function registerJsonTemplate(server, name, template, title, description, list, read) {
+  server.registerResource(name, new ResourceTemplate(template, { list }), {
+    title,
+    description,
+    mimeType: "application/json"
+  }, async (resourceUri, variables) => jsonResource(resourceUri, await read(resourceUri, variables)));
+}
+function projectService() {
+  return createKnowledgeService({ scope: "project" });
+}
+function openProjectDb(service = projectService()) {
+  const workspace = service.ensureWorkspace();
+  migrateKnowledgeDb(workspace.knowledgeDbPath);
+  return openKnowledgeDb(workspace.knowledgeDbPath);
+}
+function itemResources(storePath = createKnowledgeService({ scope: "project" }).jsonStorePath()) {
+  return readStoreLocked(storePath, (db) => activeItems(db.items, false).slice(0, 100).map((item) => ({
+    uri: `knowledge://project/items/${encodeURIComponent(item.id)}`,
+    name: item.title,
+    description: `Knowledge item ${item.id}`,
+    mimeType: "application/json"
+  })));
+}
+function listRows(db, sql, params = []) {
+  return db.query(sql).all(...params);
+}
+function rowWithJson(row, fields = ["metadata_json", "acl_json"]) {
+  if (!row)
+    return null;
+  const next = { ...row };
+  for (const field of fields) {
+    if (field in next) {
+      const name = field.endsWith("_json") ? field.slice(0, -5) : field;
+      next[name] = parseJsonObject5(next[field]);
+      delete next[field];
+    }
+  }
+  return next;
+}
+function dbStatsSnapshot(service = projectService()) {
+  const stats = service.dbStats();
+  const db = openProjectDb(service);
+  try {
+    return {
+      ok: true,
+      scope: "project",
+      path: service.workspace.knowledgeDbPath,
+      stats,
+      schema_versions: listRows(db, "SELECT version, applied_at FROM schema_versions ORDER BY version ASC")
+    };
+  } finally {
+    db.close();
+  }
+}
+function storageSnapshot(service = projectService()) {
+  const validation = service.validateStorage();
+  return {
+    ok: validation.ok,
+    scope: "project",
+    paths: service.paths(),
+    storage: service.storageContract(),
+    validation
+  };
+}
+function configSnapshot(service = projectService()) {
+  return {
+    ok: true,
+    scope: "project",
+    package: {
+      name: package_default.name,
+      version: package_default.version
+    },
+    paths: service.paths(),
+    storage: service.storageContract(),
+    provider_status: service.providerStatus(),
+    model_registry: service.modelRegistry()
+  };
+}
+function sourceRows(limit = 50, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    return listRows(db, `
+      SELECT
+        s.id,
+        s.uri,
+        s.kind,
+        s.title,
+        s.metadata_json,
+        s.acl_json,
+        s.created_at,
+        s.updated_at,
+        COUNT(DISTINCT sr.id) AS revisions,
+        COUNT(DISTINCT c.id) AS chunks
+      FROM sources s
+      LEFT JOIN source_revisions sr ON sr.source_id = s.id
+      LEFT JOIN chunks c ON c.source_revision_id = sr.id
+      GROUP BY s.id
+      ORDER BY s.updated_at DESC
+      LIMIT ?
+    `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row));
+  } finally {
+    db.close();
+  }
+}
+function sourceSnapshot(id, { limit = 10, service = projectService() } = {}) {
+  const db = openProjectDb(service);
+  try {
+    const source = rowWithJson(db.query(`
+      SELECT id, uri, kind, title, metadata_json, acl_json, created_at, updated_at
+      FROM sources
+      WHERE id = ? OR uri = ?
+    `).get(id, id));
+    if (!source)
+      return null;
+    const revisions = listRows(db, `
+      SELECT id, revision, hash, extracted_text_uri, metadata_json, created_at
+      FROM source_revisions
+      WHERE source_id = ?
+      ORDER BY created_at DESC
+      LIMIT ?
+    `, [source.id, limitNumber(limit, 10, 100)]).map((row) => rowWithJson(row, ["metadata_json"]));
+    const chunks = listRows(db, `
+      SELECT c.id, c.kind, c.ordinal, c.text, c.token_count, c.start_offset, c.end_offset, c.metadata_json, c.created_at,
+             sr.revision, sr.hash
+      FROM chunks c
+      JOIN source_revisions sr ON sr.id = c.source_revision_id
+      WHERE sr.source_id = ?
+      ORDER BY sr.created_at DESC, c.ordinal ASC
+      LIMIT ?
+    `, [source.id, limitNumber(limit, 10, 50)]).map((row) => rowWithJson(row, ["metadata_json"]));
+    return { source, revisions, chunks };
+  } finally {
+    db.close();
+  }
+}
+function openFilesSnapshot(service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    const rows = listRows(db, `
+      SELECT
+        s.id,
+        s.uri,
+        s.title,
+        sr.revision,
+        sr.hash,
+        c.metadata_json,
+        COUNT(c.id) AS chunks
+      FROM sources s
+      JOIN source_revisions sr ON sr.source_id = s.id
+      LEFT JOIN chunks c ON c.source_revision_id = sr.id
+      WHERE s.uri LIKE 'open-files://%'
+      GROUP BY s.id, sr.id
+      ORDER BY s.updated_at DESC
+      LIMIT 100
+    `);
+    return {
+      ok: true,
+      scope: "project",
+      source_ownership: "open-files",
+      raw_source_bytes_exposed: false,
+      refs: rows.map((row) => {
+        const metadata = parseJsonObject5(row.metadata_json);
+        return {
+          id: row.id,
+          uri: row.uri,
+          source_ref: typeof metadata.source_ref === "string" ? metadata.source_ref : row.uri,
+          title: row.title,
+          revision: row.revision,
+          hash: row.hash,
+          chunks: row.chunks
+        };
+      })
+    };
+  } finally {
+    db.close();
+  }
+}
+function wikiRows(limit = 50, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    return listRows(db, `
+      SELECT id, path, title, artifact_uri, content_hash, status, metadata_json, created_at, updated_at
+      FROM wiki_pages
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"]));
+  } finally {
+    db.close();
+  }
+}
+async function wikiSnapshot(id, { includeContent = true, service = projectService() } = {}) {
+  const db = openProjectDb(service);
+  try {
+    const page = rowWithJson(db.query(`
+      SELECT id, path, title, artifact_uri, content_hash, status, metadata_json, created_at, updated_at
+      FROM wiki_pages
+      WHERE id = ? OR path = ?
+    `).get(id, id), ["metadata_json"]);
+    if (!page)
+      return null;
+    const citations = listRows(db, `
+      SELECT id, chunk_id, source_uri, quote, start_offset, end_offset, metadata_json, created_at
+      FROM citations
+      WHERE wiki_page_id = ?
+      ORDER BY created_at ASC
+      LIMIT 100
+    `, [page.id]).map((row) => rowWithJson(row, ["metadata_json"]));
+    let content = null;
+    if (includeContent) {
+      const artifactKey = page.metadata?.artifact_key ?? page.path;
+      if (typeof artifactKey === "string") {
+        try {
+          content = await service.artifactStore().getText(artifactKey);
+        } catch {
+          content = null;
+        }
+      }
+    }
+    return { page, citations, content };
+  } finally {
+    db.close();
+  }
+}
+function indexRows(limit = 50, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    return listRows(db, `
+      SELECT id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at
+      FROM knowledge_indexes
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"]));
+  } finally {
+    db.close();
+  }
+}
+function indexSnapshot(id, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    const index = rowWithJson(db.query(`
+      SELECT id, kind, name, artifact_uri, shard_key, metadata_json, created_at, updated_at
+      FROM knowledge_indexes
+      WHERE id = ? OR name = ? OR shard_key = ?
+    `).get(id, id, id), ["metadata_json"]);
+    if (!index)
+      return null;
+    const vector_counts = listRows(db, `
+      SELECT provider, model, dimensions, status, COUNT(*) AS entries
+      FROM vector_index_entries
+      GROUP BY provider, model, dimensions, status
+      ORDER BY entries DESC
+      LIMIT 50
+    `);
+    return { index, vector_counts };
+  } finally {
+    db.close();
+  }
+}
+function runRows(limit = 50, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    return listRows(db, `
+      SELECT id, type, prompt, status, provider, model, cost_tokens, cost_usd, metadata_json, created_at, updated_at
+      FROM runs
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"]));
+  } finally {
+    db.close();
+  }
+}
+function runSnapshot(id, { limit = 50, service = projectService() } = {}) {
+  const db = openProjectDb(service);
+  try {
+    const run = rowWithJson(db.query(`
+      SELECT id, type, prompt, status, provider, model, cost_tokens, cost_usd, metadata_json, created_at, updated_at
+      FROM runs
+      WHERE id = ?
+    `).get(id), ["metadata_json"]);
+    if (!run)
+      return null;
+    const events = listRows(db, `
+      SELECT id, level, event, metadata_json, created_at
+      FROM run_events
+      WHERE run_id = ?
+      ORDER BY created_at ASC
+      LIMIT ?
+    `, [id, limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"]));
+    const usage = listRows(db, `
+      SELECT id, provider, model, input_tokens, output_tokens, cost_usd, metadata_json, created_at
+      FROM provider_usage
+      WHERE run_id = ?
+      ORDER BY created_at ASC
+      LIMIT 100
+    `, [id]).map((row) => rowWithJson(row, ["metadata_json"]));
+    return { run, events, usage };
+  } finally {
+    db.close();
+  }
+}
+function decisionsSnapshot(limit = 50, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    return {
+      ok: true,
+      scope: "project",
+      approval_gates: listRows(db, `
+        SELECT id, action, target_uri, status, reason, approved_by, metadata_json, created_at, updated_at
+        FROM approval_gates
+        ORDER BY updated_at DESC
+        LIMIT ?
+      `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"])),
+      audit_events: listRows(db, `
+        SELECT id, event_type, action, target_uri, decision, metadata_json, created_at
+        FROM audit_events
+        ORDER BY created_at DESC
+        LIMIT ?
+      `, [limitNumber(limit, 50, 200)]).map((row) => rowWithJson(row, ["metadata_json"]))
+    };
+  } finally {
+    db.close();
+  }
+}
+function decisionSnapshot(id, service = projectService()) {
+  const db = openProjectDb(service);
+  try {
+    const approval = rowWithJson(db.query(`
+      SELECT id, action, target_uri, status, reason, approved_by, metadata_json, created_at, updated_at
+      FROM approval_gates
+      WHERE id = ? OR target_uri = ?
+    `).get(id, id), ["metadata_json"]);
+    if (approval)
+      return { kind: "approval_gate", decision: approval };
+    const audit = rowWithJson(db.query(`
+      SELECT id, event_type, action, target_uri, decision, metadata_json, created_at
+      FROM audit_events
+      WHERE id = ? OR target_uri = ?
+    `).get(id, id), ["metadata_json"]);
+    return audit ? { kind: "audit_event", decision: audit } : null;
+  } finally {
+    db.close();
+  }
+}
+async function getKnowledgeRecord(kind, id, options = {}) {
+  const normalized = kind ?? "auto";
+  const service = createKnowledgeService({ scope: options.scope });
+  const attempts = normalized === "auto" ? ["item", "source", "wiki_page", "run", "index", "decision"] : [normalized];
+  for (const entry of attempts) {
+    if (entry === "item") {
+      const storePath = resolveStorePath(options.store_path, options.scope);
+      const item = readStoreLocked(storePath, (db) => findItem(db, id));
+      if (item)
+        return { kind: "item", item, store_path: storePath };
+    }
+    if (entry === "source") {
+      const source = sourceSnapshot(id, { limit: options.limit, service });
+      if (source)
+        return { kind: "source", ...source };
+    }
+    if (entry === "wiki_page") {
+      const page = await wikiSnapshot(id, { includeContent: options.include_content !== false, service });
+      if (page)
+        return { kind: "wiki_page", ...page };
+    }
+    if (entry === "run") {
+      const run = runSnapshot(id, { limit: options.limit, service });
+      if (run)
+        return { kind: "run", ...run };
+    }
+    if (entry === "index") {
+      const index = indexSnapshot(id, service);
+      if (index)
+        return { kind: "index", ...index };
+    }
+    if (entry === "decision") {
+      const decision = decisionSnapshot(id, service);
+      if (decision)
+        return { kind: "decision", ...decision };
+    }
+  }
+  return null;
+}
+function registerKnowledgeResources(server) {
+  registerJsonResource(server, "knowledge-project-config", "knowledge://project/config", "Project knowledge config", "Resolved project workspace config, provider registry, and storage contract", async () => configSnapshot());
+  registerJsonResource(server, "knowledge-project-storage", "knowledge://project/storage", "Project knowledge storage", "Artifact storage contract and validation for project knowledge", async () => storageSnapshot());
+  registerJsonResource(server, "knowledge-project-schema", "knowledge://project/schema", "Project knowledge schema", "SQLite schema version and table counts for project knowledge", async () => dbStatsSnapshot());
+  registerJsonResource(server, "knowledge-project-sources", "knowledge://project/sources", "Project knowledge sources", "Indexed source refs and revision/chunk counts without raw source bytes", async () => ({ ok: true, scope: "project", sources: sourceRows() }));
+  registerJsonResource(server, "knowledge-project-open-files", "knowledge://project/open-files", "Project open-files refs", "Open-files source refs known to the project knowledge catalog", async () => openFilesSnapshot());
+  registerJsonResource(server, "knowledge-project-wiki-pages", "knowledge://project/wiki/pages", "Project wiki pages", "Generated wiki pages and citation artifact metadata", async () => ({ ok: true, scope: "project", pages: wikiRows() }));
+  registerJsonResource(server, "knowledge-project-indexes", "knowledge://project/indexes", "Project knowledge indexes", "Sharded knowledge indexes and vector-index status", async () => ({
+    ok: true,
+    scope: "project",
+    indexes: indexRows(),
+    embeddings: projectService().embeddingStatus()
+  }));
+  registerJsonResource(server, "knowledge-project-runs", "knowledge://project/runs", "Project knowledge runs", "Recent prompt, ingestion, web search, and reindex run ledger entries", async () => ({ ok: true, scope: "project", runs: runRows() }));
+  registerJsonResource(server, "knowledge-project-decisions", "knowledge://project/decisions", "Project knowledge decisions", "Approval gates and audit decisions for generated knowledge operations", async () => decisionsSnapshot());
+  registerJsonTemplate(server, "knowledge-project-items", "knowledge://project/items/{id}", "Project knowledge item", "Read a compatibility JSON-store item by id", async () => ({ resources: itemResources() }), async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = await getKnowledgeRecord("item", id, { scope: "project" });
+    return record2 ? { ok: true, ...record2 } : { ok: false, error: `Item not found: ${id}` };
+  });
+  registerJsonTemplate(server, "knowledge-project-source", "knowledge://project/sources/{id}", "Project source", "Read indexed source metadata, revisions, and derived chunks", async () => ({
+    resources: sourceRows().map((source) => ({
+      uri: `knowledge://project/sources/${encodeURIComponent(source.id)}`,
+      name: source.title ?? source.uri,
+      description: `${source.kind} source with ${source.chunks} chunk(s)`,
+      mimeType: "application/json"
+    }))
+  }), async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = sourceSnapshot(id);
+    return record2 ? { ok: true, kind: "source", ...record2 } : { ok: false, error: `Source not found: ${id}` };
+  });
+  registerJsonTemplate(server, "knowledge-project-wiki-page", "knowledge://project/wiki/pages/{id}", "Project wiki page", "Read generated wiki page metadata, citations, and artifact text", async () => ({
+    resources: wikiRows().map((page) => ({
+      uri: `knowledge://project/wiki/pages/${encodeURIComponent(page.id)}`,
+      name: page.title,
+      description: page.path,
+      mimeType: "application/json"
+    }))
+  }), async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = await wikiSnapshot(id);
+    return record2 ? { ok: true, kind: "wiki_page", ...record2 } : { ok: false, error: `Wiki page not found: ${id}` };
+  });
+  registerJsonTemplate(server, "knowledge-project-index", "knowledge://project/indexes/{id}", "Project knowledge index", "Read a knowledge index row and vector-count snapshot", async () => ({
+    resources: indexRows().map((index) => ({
+      uri: `knowledge://project/indexes/${encodeURIComponent(index.id)}`,
+      name: index.name,
+      description: `${index.kind} index${index.shard_key ? ` shard ${index.shard_key}` : ""}`,
+      mimeType: "application/json"
+    }))
+  }), async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = indexSnapshot(id);
+    return record2 ? { ok: true, kind: "index", ...record2 } : { ok: false, error: `Index not found: ${id}` };
+  });
+  registerJsonTemplate(server, "knowledge-project-run", "knowledge://project/runs/{id}", "Project run", "Read a knowledge run ledger entry with events and usage", async () => ({
+    resources: runRows().map((run) => ({
+      uri: `knowledge://project/runs/${encodeURIComponent(run.id)}`,
+      name: `${run.type}: ${run.status}`,
+      description: run.prompt ?? run.id,
+      mimeType: "application/json"
+    }))
+  }), async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = runSnapshot(id);
+    return record2 ? { ok: true, kind: "run", ...record2 } : { ok: false, error: `Run not found: ${id}` };
+  });
+  registerJsonTemplate(server, "knowledge-project-decision", "knowledge://project/decisions/{id}", "Project decision", "Read an approval gate or audit decision", async () => {
+    const decisions = decisionsSnapshot();
+    return {
+      resources: [
+        ...decisions.approval_gates.map((entry) => ({
+          uri: `knowledge://project/decisions/${encodeURIComponent(entry.id)}`,
+          name: `${entry.action}: ${entry.status}`,
+          description: entry.target_uri ?? entry.id,
+          mimeType: "application/json"
+        })),
+        ...decisions.audit_events.map((entry) => ({
+          uri: `knowledge://project/decisions/${encodeURIComponent(entry.id)}`,
+          name: `${entry.action}: ${entry.decision}`,
+          description: entry.target_uri ?? entry.id,
+          mimeType: "application/json"
+        }))
+      ]
+    };
+  }, async (_uri, variables) => {
+    const id = decodeURIComponent(String(variables.id));
+    const record2 = decisionSnapshot(id);
+    return record2 ? { ok: true, ...record2 } : { ok: false, error: `Decision not found: ${id}` };
+  });
+}
 function buildServer() {
   const server = new McpServer({
     name: "open-knowledge",
     version: package_default.version
   });
+  registerKnowledgeResources(server);
   registerTool(server, "ok_paths", "Knowledge workspace paths", "Show resolved workspace and store paths", {
     scope: scopeField
   }, async ({ scope }) => {
@@ -18960,6 +20038,150 @@ function buildServer() {
       return errorText(error48 instanceof Error ? error48.message : String(error48));
     }
   });
+  registerTool(server, "knowledge_get", "Get knowledge record", "Read a knowledge item, indexed source, wiki page, run, index, or decision by id without raw source-byte access", {
+    scope: scopeField,
+    kind: exports_external.enum(["auto", "item", "source", "wiki_page", "run", "index", "decision"]).optional().describe("Record kind; auto tries all supported kinds"),
+    id: exports_external.string().describe("Record id, short id, source URI, wiki path, index shard/name, or decision target URI"),
+    include_content: exports_external.boolean().optional().describe("Include generated wiki artifact text when reading wiki pages"),
+    limit: exports_external.number().optional().describe("Maximum related chunks/events to return"),
+    store_path: storePathField
+  }, async ({ scope, kind, id, include_content, limit, store_path }) => {
+    try {
+      const record2 = await getKnowledgeRecord(kind ?? "auto", id, {
+        scope,
+        include_content,
+        limit,
+        store_path
+      });
+      return record2 ? jsonText({ ok: true, ...record2 }) : errorText(`Knowledge record not found: ${id}`);
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_ingest", "Ingest knowledge source", "Ingest an open-files/S3/file/web source ref or open-files manifest into the derived knowledge catalog", {
+    scope: scopeField,
+    source_ref: exports_external.string().optional().describe("Source reference URI to ingest, e.g. open-files://file/<id>/revision/<rev>"),
+    manifest: exports_external.string().optional().describe("Manifest file path or s3:// URI to ingest"),
+    purpose: exports_external.string().optional().describe("Read-only purpose label, default knowledge_answer")
+  }, async ({ scope, source_ref, manifest, purpose }) => {
+    if (!source_ref && !manifest)
+      return errorText("Missing input. Provide source_ref or manifest.");
+    if (source_ref && manifest)
+      return errorText("Use either source_ref or manifest, not both.");
+    const service = createKnowledgeService({ scope });
+    try {
+      const result = source_ref ? await service.ingestSource(source_ref, purpose) : await service.ingestManifest(manifest);
+      return jsonText({ ok: true, mode: source_ref ? "source" : "manifest", ...result });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_build", "Build knowledge answer", "Run the knowledge prompt flow and optionally file the cited answer into generated wiki artifacts after approval", {
+    scope: scopeField,
+    prompt: exports_external.string().describe("Prompt to answer and build durable knowledge from"),
+    limit: exports_external.number().optional().describe("Maximum context results"),
+    semantic: exports_external.boolean().optional().describe("Include vector semantic results"),
+    generate: exports_external.boolean().optional().describe("Call AI SDK text generation; omitted returns a local citation draft"),
+    approve_write: exports_external.boolean().optional().describe("Approve durable wiki filing for this call"),
+    file_answer: exports_external.boolean().optional().describe("Attempt wiki answer filing; writes only with approve_write=true"),
+    model: exports_external.string().optional().describe("Model alias/ref, default configured provider default"),
+    dimensions: exports_external.number().optional().describe("Embedding dimensions for deterministic fake mode"),
+    fake: exports_external.boolean().optional().describe("Use deterministic fake embeddings/generation for local tests")
+  }, async ({ scope, prompt, limit, semantic, generate, approve_write, file_answer, model, dimensions, fake }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      const result = await service.runPrompt({ prompt, limit, semantic, generate, approveWrite: approve_write, modelRef: model, dimensions, fake });
+      let wiki_file = null;
+      if (file_answer === true || approve_write === true) {
+        wiki_file = await service.fileAnswer({
+          prompt,
+          answer: result.answer,
+          approveWrite: approve_write,
+          limit,
+          semantic,
+          modelRef: model,
+          dimensions,
+          fake
+        });
+      }
+      return jsonText({ ok: true, ...result, wiki_file });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_web_search", "Knowledge web search", "Run safety-gated provider-native web search and optionally file snippets as web source refs", {
+    scope: scopeField,
+    query: exports_external.string().describe("Web search query"),
+    limit: exports_external.number().optional().describe("Maximum sources"),
+    provider: exports_external.enum(["openai", "anthropic", "deepseek"]).optional().describe("Provider override"),
+    model: exports_external.string().optional().describe("Model alias/ref"),
+    domains: exports_external.array(exports_external.string()).optional().describe("Allowed domains"),
+    fake: exports_external.boolean().optional().describe("Use deterministic fake web results"),
+    file_results: exports_external.boolean().optional().describe("File web snippets as web source refs")
+  }, async ({ scope, query, limit, provider, model, domains, fake, file_results }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      return jsonText({ ok: true, ...await service.webSearch({ query, limit, provider, modelRef: model, domains, fake, fileResults: file_results }) });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_lint", "Lint knowledge wiki", "Check generated wiki pages for missing citations, stale citations, duplicates, or source issues", {
+    scope: scopeField
+  }, async ({ scope }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      return jsonText({ ok: true, ...service.lintWiki() });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_run_status", "Knowledge run status", "List recent runs or inspect one run ledger with events and provider usage", {
+    scope: scopeField,
+    run_id: exports_external.string().optional().describe("Run id to inspect; omitted lists recent runs"),
+    limit: exports_external.number().optional().describe("Maximum runs or events to return")
+  }, async ({ scope, run_id, limit }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      if (run_id) {
+        const run = runSnapshot(run_id, { limit, service });
+        return run ? jsonText({ ok: true, kind: "run", ...run }) : errorText(`Run not found: ${run_id}`);
+      }
+      return jsonText({ ok: true, runs: runRows(limit, service) });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_storage", "Knowledge storage contract", "Inspect local/S3 artifact storage, source ownership, and hosted/SaaS boundary metadata", {
+    scope: scopeField
+  }, async ({ scope }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      const validation = service.validateStorage();
+      return jsonText({
+        ok: validation.ok,
+        ...service.storageContract(),
+        validation,
+        remote_contract: service.remoteContract()
+      });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
+  registerTool(server, "knowledge_resolve_source", "Resolve knowledge source", "Resolve indexed source chunks through the read-only open-files/source boundary with citation evidence", {
+    source_ref: exports_external.string().describe("Source reference URI, preferably open-files://..."),
+    purpose: exports_external.string().optional().describe("Read-only purpose label, default knowledge_answer"),
+    limit: exports_external.number().optional().describe("Maximum chunks to return, default 10"),
+    scope: scopeField
+  }, async ({ source_ref, purpose, limit, scope }) => {
+    const service = createKnowledgeService({ scope });
+    try {
+      const result = await service.resolveSource(source_ref, { purpose, limit });
+      return jsonText({ ok: true, ...result });
+    } catch (error48) {
+      return errorText(error48 instanceof Error ? error48.message : String(error48));
+    }
+  });
   registerTool(server, "ok_web_search", "Provider web search", "Run safety-gated provider-native web search and return citations/sources", {
     scope: scopeField,
     query: exports_external.string().describe("Web search query"),