@knowzai/cli 0.1.0 → 0.3.0

package/dist/commands/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkCjD;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,OAAgB,WAAW,SACgE;IAC3F,OAAgB,QAAQ,WAOtB;IACF,OAAgB,KAAK;;;;;;;;MAiBnB;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;YAcf,SAAS;IA8DvB,mGAAmG;YACrF,WAAW;IAiDzB,uFAAuF;IACvF,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,WAAW;CAGpB"}

package/dist/commands/export.js

@@ -0,0 +1,155 @@
+import { Flags } from '@oclif/core';
+import { KnowzError, ExitCode } from '@knowzai/core';
+import { ApiError } from '@knowzai/api-client';
+import { BaseCommand } from '../base-command.js';
+import { resolveVaultRef } from '../lib/vault.js';
+import { pollUntilTerminal } from '../lib/poll.js';
+import { inferExportScope, resolveExportOutPath, partOutPath, shouldSkipExistingPart, isJobComplete, isJobFailed, makeDownloadProgress, assertPortabilityKeyKind, mapPortabilityAuthError, } from '../lib/portability-shared.js';
+/**
+ * CLI_PortabilityTransfer — `knowz export`: sync export streamed to disk, with
+ * automatic fall-forward to the async job path on 413 (R5), `--async` to force
+ * job mode, and `--job <id>` to resume an existing job with part-level resume.
+ */
+export default class Export extends BaseCommand {
+    static description = 'Export knowledge data to a portable package (Full ZIP with file bytes, or Light JSON).';
+    static examples = [
+        '<%= config.bin %> export',
+        '<%= config.bin %> export --mode light --out backup.json',
+        '<%= config.bin %> export --vault "Family Memories" --out exports/',
+        '<%= config.bin %> export --items 3f2a9c1e 7be10d44',
+        '<%= config.bin %> export --async',
+        '<%= config.bin %> export --job 7f3d2c1b --out backup.zip',
+    ];
+    static flags = {
+        out: Flags.string({ description: 'Output file or existing directory' }),
+        mode: Flags.string({
+            options: ['full', 'light'],
+            default: 'full',
+            description: 'full = ZIP incl. file bytes (default — a silent metadata-only export would be dishonest); light = JSON metadata only',
+        }),
+        items: Flags.string({ multiple: true, description: 'Knowledge item id(s) to export' }),
+        scope: Flags.string({
+            options: ['tenant', 'vault', 'vault-with-children', 'items'],
+            description: 'Explicit export scope (inferred from --vault/--items when omitted)',
+        }),
+        async: Flags.boolean({ description: 'Force the async multi-part export job path' }),
+        job: Flags.string({ description: 'Resume an existing export job by id (part-level resume)' }),
+        'acknowledge-share-caution': Flags.string({
+            description: 'Share-caution acknowledgement copy version (passed through verbatim)',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(Export);
+        const client = await this.apiClient(flags);
+        // Smoke MED — portability resolves a USER identity; a tenant kz_ key would
+        // 401 despite the profile being logged in. Reject locally with the fix named.
+        const auth = await this.authState(flags);
+        assertPortabilityKeyKind(await auth.store.getSecret(auth.profile), auth.profile);
+        try {
+            return await this.runExport(client, flags);
+        }
+        catch (e) {
+            throw mapPortabilityAuthError(e) ?? e; // opaque credential → map the 401 to the same guidance
+        }
+    }
+    async runExport(client, flags) {
+        const mode = flags.mode === 'light' ? 'Light' : 'Full';
+        const schema = await client.portability.getSchema();
+        if (schema.dialect === 'selfhosted') {
+            const rejected = [
+                flags.vault && '--vault',
+                flags.items?.length && '--items',
+                flags.scope && '--scope',
+                flags.async && '--async',
+                flags.job && '--job',
+                // L2 — the selfhosted GET export has no body, so the acknowledgement could
+                // only be silently dropped; refuse instead.
+                flags['acknowledge-share-caution'] && '--acknowledge-share-caution',
+            ].filter(Boolean);
+            if (rejected.length) {
+                throw new KnowzError(`The selfhosted portability dialect exports the whole tenant only — ${rejected.join(', ')} ` +
+                    'are not supported there.', ExitCode.Usage);
+            }
+        }
+        const vaultId = flags.vault ? await resolveVaultRef(client, flags.vault) : undefined;
+        const scope = inferExportScope({ scope: flags.scope, vaultId, itemIds: flags.items });
+        const outPath = resolveExportOutPath(flags.out, mode);
+        const onProgress = makeDownloadProgress(this.jsonEnabled());
+        const ack = flags['acknowledge-share-caution'];
+        if (flags.job)
+            return this.downloadJob(client, flags.job, outPath, onProgress);
+        if (flags.async) {
+            const job = await client.portability.createExportJob({ ...scope, mode, acknowledgementCopyVersion: ack });
+            this.note(`Export job ${job.jobId} queued (${job.estimatedItems} item(s) estimated).`);
+            return this.downloadJob(client, job.jobId, outPath, onProgress);
+        }
+        try {
+            const result = await client.portability.exportToFile({
+                ...scope,
+                mode,
+                outPath,
+                acknowledgementCopyVersion: ack,
+                onProgress,
+            });
+            this.endProgress();
+            if (!this.jsonEnabled())
+                this.log(`Exported to ${result.path} (${result.bytes} bytes, ${result.kind}).`);
+            return { mode, ...result };
+        }
+        catch (e) {
+            this.endProgress();
+            // R5 — 413 means "too big for a single download": fall forward to the job path and say so.
+            if (e instanceof ApiError && e.status === 413) {
+                this.note('Export exceeds the single-download limit — falling forward to a multi-part export job.');
+                const job = await client.portability.createExportJob({ ...scope, mode, acknowledgementCopyVersion: ack });
+                this.note(`Export job ${job.jobId} queued (${job.estimatedItems} item(s) estimated).`);
+                return this.downloadJob(client, job.jobId, outPath, onProgress);
+            }
+            throw e; // 409 lock / 403 / share-caution rejection surface the server's message verbatim (R11)
+        }
+    }
+    /** Poll the job to terminal, then download every part sequentially with part-level resume (R5). */
+    async downloadJob(client, jobId, outPath, onProgress) {
+        const status = await pollUntilTerminal(() => client.portability.getExportJob(jobId), (s) => isJobComplete(s.status) || isJobFailed(s.status), { max: 900, intervalMs: 2000, label: `export job ${jobId}` });
+        if (isJobFailed(status.status)) {
+            throw new KnowzError(`Export job ${jobId} ${status.status}${status.errorMessage ? `: ${status.errorMessage}` : '.'}`, ExitCode.Api);
+        }
+        const parts = [...(status.parts ?? [])].sort((a, b) => a.partNumber - b.partNumber);
+        if (!parts.length) {
+            throw new KnowzError(`Export job ${jobId} completed but reported no downloadable parts.`, ExitCode.Api);
+        }
+        const results = [];
+        for (const part of parts) {
+            const path = partOutPath(outPath, part.partNumber);
+            if (shouldSkipExistingPart(path, part.sizeBytes)) {
+                this.note(`Part ${part.partNumber}: ${path} already complete (${part.sizeBytes} bytes) — skipped (resume).`);
+                results.push({ partNumber: part.partNumber, path, bytes: part.sizeBytes, skipped: true });
+                continue;
+            }
+            const dl = await client.portability.downloadExportPart({
+                jobId,
+                partNumber: part.partNumber,
+                outPath: path,
+                onProgress,
+            });
+            this.endProgress();
+            this.note(`Part ${part.partNumber}: ${path} (${dl.bytes} bytes).`);
+            results.push({ partNumber: part.partNumber, path, bytes: dl.bytes, skipped: false });
+        }
+        if (!this.jsonEnabled()) {
+            this.log(`Export job ${jobId} downloaded: ${results.length} part(s).`);
+            for (const r of results)
+                this.log(`  ${r.path}${r.skipped ? ' (resumed/skipped)' : ''}`);
+        }
+        return { jobId, totalItems: status.totalItems, parts: results };
+    }
+    /** Progress + notices go to stderr so `--json` stdout stays a single document (R4). */
+    note(message) {
+        process.stderr.write(`${message}\n`);
+    }
+    endProgress() {
+        if (!this.jsonEnabled() && process.stderr.isTTY)
+            process.stderr.write('\r');
+    }
+}
+//# sourceMappingURL=export.js.map

package/dist/commands/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,QAAQ,EAA2C,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AAqBtC;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,MAAM,CAAU,WAAW,GACzB,wFAAwF,CAAC;IAC3F,MAAM,CAAU,QAAQ,GAAG;QACzB,0BAA0B;QAC1B,yDAAyD;QACzD,mEAAmE;QACnE,oDAAoD;QACpD,kCAAkC;QAClC,0DAA0D;KAC3D,CAAC;IACF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;QACvE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1B,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,sHAAsH;SACpI,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;QACtF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC;YAC5D,WAAW,EAAE,oEAAoE;SAClF,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;QACnF,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;QAC7F,2BAA2B,EAAE,KAAK,CAAC,MAAM,CAAC;YACxC,WAAW,EAAE,sEAAsE;SACpF,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,wBAAwB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uDAAuD;QAChG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAsB,EAAE,KAAqB;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,MAAgB,CAAC;QAE7E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG;gBACf,KAAK,CAAC,KAAK,IAAI,SAAS;gBACxB,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,SAAS;gBAChC,KAAK,CAAC,KAAK,IAAI,SAAS;gBACxB,KAAK,CAAC,KAAK,IAAI,SAAS;gBACxB,KAAK,CAAC,GAAG,IAAI,OAAO;gBACpB,2EAA2E;gBAC3E,4CAA4C;gBAC5C,KAAK,CAAC,2BAA2B,CAAC,IAAI,6BAA6B;aACpE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,sEAAsE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC1F,0BAA0B,EAC5B,QAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAE/E,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,cAAc,sBAAsB,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC;gBACnD,GAAG,KAAK;gBACR,IAAI;gBACJ,OAAO;gBACP,0BAA0B,EAAE,GAAG;gBAC/B,UAAU;aACX,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,2FAA2F;YAC3F,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;gBACpG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1G,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,cAAc,sBAAsB,CAAC,CAAC;gBACvF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,uFAAuF;QAClG,CAAC;IACH,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,WAAW,CACvB,MAAsB,EACtB,KAAa,EACb,OAAe,EACf,UAAiE;QAEjE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EACvD,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,KAAK,EAAE,EAAE,CAC7D,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAClB,cAAc,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAC/F,QAAQ,CAAC,GAAG,CACb,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC,cAAc,KAAK,gDAAgD,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,KAAK,IAAI,sBAAsB,IAAI,CAAC,SAAS,6BAA6B,CAAC,CAAC;gBAC7G,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC;gBACrD,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU;aACX,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,KAAK,IAAI,KAAK,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,gBAAgB,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,uFAAuF;IAC/E,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC"}

package/dist/commands/import.d.ts

@@ -0,0 +1,27 @@
+import { BaseCommand } from '../base-command.js';
+/**
+ * CLI_PortabilityTransfer — `knowz import`: validate-first, honest about
+ * conflicts (R8), honest about results (R9). Payload kind is detected by magic
+ * bytes, never by extension. Default strategy is `skip` — the only choice that
+ * cannot destroy or mutate existing destination data.
+ */
+export default class Import extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        file: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        strategy: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'target-vault': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'validate-only': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+    private runImport;
+    private importJson;
+    private importZip;
+    /** VERIFY-7 — non-TTY/--json with conflicts and no --yes exits non-zero WITHOUT importing. */
+    private gate;
+}
+//# sourceMappingURL=import.d.ts.map

package/dist/commands/import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAcjD;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,OAAgB,WAAW,SAAwE;IACnG,OAAgB,QAAQ,WAKtB;IACF,OAAgB,IAAI;;MAElB;IACF,OAAgB,KAAK;;;;;MASnB;IAEI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;YAgBf,SAAS;YAkCT,UAAU;YAsCV,SAAS;IAiBvB,8FAA8F;YAChF,IAAI;CAkBnB"}

package/dist/commands/import.js

@@ -0,0 +1,124 @@
+import { readFileSync, statSync } from 'node:fs';
+import { Args, Flags } from '@oclif/core';
+import { KnowzError, ExitCode } from '@knowzai/core';
+import { BaseCommand } from '../base-command.js';
+import { resolveVaultRef } from '../lib/vault.js';
+import { isInteractiveTty } from '../lib/onboarding.js';
+import { detectPackageKind, decideImportGate, totalConflicts, renderValidationPreview, renderImportOutcome, shouldWarnLargeJson, assertPortabilityKeyKind, mapPortabilityAuthError, } from '../lib/portability-shared.js';
+/**
+ * CLI_PortabilityTransfer — `knowz import`: validate-first, honest about
+ * conflicts (R8), honest about results (R9). Payload kind is detected by magic
+ * bytes, never by extension. Default strategy is `skip` — the only choice that
+ * cannot destroy or mutate existing destination data.
+ */
+export default class Import extends BaseCommand {
+    static description = 'Import a portable export package (JSON or ZIP) into this instance.';
+    static examples = [
+        '<%= config.bin %> import knowz-export-20260831-120000.zip',
+        '<%= config.bin %> import backup.json --strategy merge',
+        '<%= config.bin %> import backup.json --target-vault "Restored" --yes',
+        '<%= config.bin %> import backup.json --validate-only',
+    ];
+    static args = {
+        file: Args.string({ required: true, description: 'Package file (JSON or ZIP; detected by content)' }),
+    };
+    static flags = {
+        strategy: Flags.string({
+            options: ['skip', 'overwrite', 'merge'],
+            default: 'skip',
+            description: 'Conflict strategy (skip = keep existing, overwrite = replace, merge = fill missing fields)',
+        }),
+        'target-vault': Flags.string({ description: 'Import everything into this vault (id or name)' }),
+        'validate-only': Flags.boolean({ description: 'Stop after the server-side dry-run preview' }),
+        yes: Flags.boolean({ description: 'Skip the conflict confirmation' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(Import);
+        const strategy = flags.strategy;
+        const kind = detectPackageKind(args.file);
+        const client = await this.apiClient(flags);
+        // Smoke MED — portability resolves a USER identity; reject a tenant kz_ key
+        // locally (actionable copy) instead of letting the server 401 "while logged in".
+        const auth = await this.authState(flags);
+        assertPortabilityKeyKind(await auth.store.getSecret(auth.profile), auth.profile);
+        try {
+            return await this.runImport(client, args.file, kind, strategy, flags);
+        }
+        catch (e) {
+            throw mapPortabilityAuthError(e) ?? e; // opaque credential → map the 401 to the same guidance
+        }
+    }
+    async runImport(client, file, kind, strategy, flags) {
+        const schema = await client.portability.getSchema();
+        let targetVaultId;
+        if (flags['target-vault']) {
+            if (schema.dialect === 'selfhosted') {
+                throw new KnowzError('The selfhosted portability dialect has no --target-vault — imports land in their original vaults.', ExitCode.Usage);
+            }
+            targetVaultId = await resolveVaultRef(client, flags['target-vault']);
+        }
+        const interactive = isInteractiveTty() && !this.jsonEnabled();
+        const outcome = kind === 'json'
+            ? await this.importJson(client, file, { strategy, targetVaultId, interactive, yes: flags.yes, validateOnly: flags['validate-only'] })
+            : await this.importZip(client, file, { strategy, targetVaultId, interactive, yes: flags.yes, validateOnly: flags['validate-only'] });
+        if (outcome && typeof outcome === 'object' && 'success' in outcome) {
+            for (const line of renderImportOutcome(outcome))
+                this.log(line);
+            if (!outcome.success)
+                process.exitCode = ExitCode.Api; // R9 — never a cheerful partial
+        }
+        return outcome;
+    }
+    async importJson(client, file, opts) {
+        // R10 — central /import runs under Kestrel's ~28 MB default body cap.
+        if (shouldWarnLargeJson(statSync(file).size)) {
+            process.stderr.write('Warning: this JSON package exceeds 25 MB — the server may reject it. ' +
+                'Prefer a Full (ZIP) export/import, which allows up to 500 MB.\n');
+        }
+        let pkg;
+        try {
+            pkg = JSON.parse(readFileSync(file, 'utf8'));
+        }
+        catch (e) {
+            throw new KnowzError(`${file} is not valid JSON: ${e instanceof Error ? e.message : String(e)}`, ExitCode.Usage);
+        }
+        // R8 — validate first, always.
+        const validation = await client.portability.validateImport(pkg);
+        for (const line of renderValidationPreview(validation))
+            this.log(line);
+        if (opts.validateOnly) {
+            if (!validation.isValid)
+                process.exitCode = ExitCode.Api;
+            return validation;
+        }
+        const conflicts = totalConflicts(validation);
+        const confirmationRequired = conflicts > 0 || !validation.isValid;
+        await this.gate(confirmationRequired, opts, () => conflicts > 0
+            ? `${conflicts} conflict(s) will be resolved with strategy '${opts.strategy}'. Continue?`
+            : `Validation FAILED — the server will likely refuse this import. Attempt it anyway?`);
+        return client.portability.importPackage(pkg, { strategy: opts.strategy, targetVaultId: opts.targetVaultId });
+    }
+    async importZip(client, file, opts) {
+        if (opts.validateOnly) {
+            throw new KnowzError('Dry-run is unavailable for ZIP packages (the server has no /import/zip validate twin).', ExitCode.Usage);
+        }
+        // R8 — no server-side dry-run exists for ZIP; be honest and require consent.
+        this.log(`Dry-run unavailable for ZIP packages; conflicts will be resolved with strategy '${opts.strategy}'.`);
+        await this.gate(true, opts, () => `Import ${file} with strategy '${opts.strategy}'?`);
+        return client.portability.importZip({ path: file, strategy: opts.strategy, targetVaultId: opts.targetVaultId });
+    }
+    /** VERIFY-7 — non-TTY/--json with conflicts and no --yes exits non-zero WITHOUT importing. */
+    async gate(confirmationRequired, opts, message) {
+        const decision = decideImportGate({ confirmationRequired, interactive: opts.interactive, yes: opts.yes });
+        if (decision === 'proceed')
+            return;
+        if (decision === 'refuse') {
+            throw new KnowzError('Refusing to import without confirmation in a non-interactive run — re-run with --yes to consent.', ExitCode.Usage);
+        }
+        const { confirm } = await import('@inquirer/prompts');
+        if (!(await confirm({ message: message(), default: false }))) {
+            throw new KnowzError('Import cancelled.', ExitCode.Usage);
+        }
+    }
+}
+//# sourceMappingURL=import.js.map

package/dist/commands/import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../src/commands/import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,MAAM,CAAU,WAAW,GAAG,oEAAoE,CAAC;IACnG,MAAM,CAAU,QAAQ,GAAG;QACzB,2DAA2D;QAC3D,uDAAuD;QACvD,sEAAsE;QACtE,sDAAsD;KACvD,CAAC;IACF,MAAM,CAAU,IAAI,GAAG;QACrB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;KACtG,CAAC;IACF,MAAM,CAAU,KAAK,GAAG;QACtB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC;YACvC,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,4FAA4F;SAC1G,CAAC;QACF,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;QAC/F,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;QAC7F,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;KACtE,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA4B,CAAC;QACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,wBAAwB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uDAAuD;QAChG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAsB,EACtB,IAAY,EACZ,IAAoB,EACpB,QAA0B,EAC1B,KAA0E;QAE1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,aAAiC,CAAC;QACtC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,IAAI,UAAU,CAClB,mGAAmG,EACnG,QAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAE9D,MAAM,OAAO,GACX,IAAI,KAAK,MAAM;YACb,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YACrI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAEzI,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,IAAK,OAAmC,EAAE,CAAC;YAChG,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,OAAwB,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjF,IAAI,CAAE,OAAyB,CAAC,OAAO;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,gCAAgC;QAC5G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAsB,EACtB,IAAY,EACZ,IAAuH;QAEvH,sEAAsE;QACtE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;gBACrE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnH,CAAC;QAED,+BAA+B;QAC/B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,uBAAuB,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,UAAU,CAAC,OAAO;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;YACzD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,oBAAoB,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAClE,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,CAC/C,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,GAAG,SAAS,gDAAgD,IAAI,CAAC,QAAQ,cAAc;YACzF,CAAC,CAAC,mFAAmF,CACxF,CAAC;QAEF,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/G,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAsB,EACtB,IAAY,EACZ,IAAuH;QAEvH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,wFAAwF,EACxF,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC,GAAG,CAAC,mFAAmF,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC/G,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,UAAU,IAAI,mBAAmB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,IAAI,CAChB,oBAA6B,EAC7B,IAA4C,EAC5C,OAAqB;QAErB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAClB,kGAAkG,EAClG,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC"}

package/dist/commands/index/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/commands/index/scan.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,EAAE,SAAgB;IAClC,OAAgB,WAAW,SACgE;IAC3F,OAAgB,QAAQ,WAAoF;IAC5G,OAAgB,IAAI;;MAA6E;IACjG,OAAgB,KAAK;;;MAGnB;IAEI,GAAG,IAAI,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CA8BtI"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/commands/index/scan.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,EAAE,SAAgB;IAClC,OAAgB,WAAW,SACgE;IAC3F,OAAgB,QAAQ,WAAoF;IAC5G,OAAgB,IAAI;;MAA6E;IACjG,OAAgB,KAAK;;;MAGnB;IAEI,GAAG,IAAI,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CtI"}

package/dist/commands/index/scan.js

@@ -6,6 +6,7 @@ import { graphPath } from '@knowzai/local-store';
 import { loadConfig, resolveProfileName } from '@knowzai/core';
 import { BaseCommand } from '../../base-command.js';
 import { isGuid } from '../../lib/vault.js';
+import { isSafeToIndex } from '../../lib/safe-file.js';
 export default class IndexScan extends BaseCommand {
     static id = 'index:scan';
     static description = 'Index local code into the local store (tree-sitter intelligent chunking + code graph).';
@@ -19,17 +20,35 @@ export default class IndexScan extends BaseCommand {
         const { args, flags } = await this.parse(IndexScan);
         const cfg = loadConfig();
         const profile = resolveProfileName({ profileFlag: flags.profile }, cfg);
-        const indexer = new TreeSitterIndexer();
+        // H7 — a denied path is SKIPPED rather than fatal: a scan over a large tree
+        // should step over one credential file, not abort.
+        const indexer = new TreeSitterIndexer({ pathFilter: isSafeToIndex });
         const store = await this.localStore(flags, { db: flags.db, dim: indexer.dim });
         const vaultId = flags.vault && !isGuid(flags.vault)
             ? await this.resolveVaultId(await this.apiClient(flags), flags)
             : flags.vault;
-        const report = await indexer.indexDirectory(args.path, store, { vaultId, force: flags.force });
-        await store.close();
+        let report;
+        let graphJson;
+        let stats;
+        try {
+            report = await indexer.indexDirectory(args.path, store, { vaultId, force: flags.force });
+            if (vaultId) {
+                graphJson = await store.exportGraphJson(vaultId);
+                const committed = await store.graphStats(vaultId);
+                stats = { nodes: committed.nodeCount, edges: committed.edgeCount };
+            }
+            else {
+                graphJson = report.graph.toJSON();
+                const delta = report.graph.stats();
+                stats = { nodes: delta.nodes, edges: delta.edges };
+            }
+        }
+        finally {
+            await store.close();
+        }
         const gpath = graphPath(profile, flags.db);
         mkdirSync(dirname(gpath), { recursive: true }); // dir may not exist in Postgres mode
-        writeFileSync(gpath, JSON.stringify(report.graph.toJSON()));
-        const stats = report.graph.stats();
+        writeFileSync(gpath, JSON.stringify(graphJson));
         const out = {
             filesIndexed: report.filesIndexed,
             filesSkipped: report.filesSkipped,

package/dist/commands/index/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/index/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,EAAE,GAAG,YAAY,CAAC;IAClC,MAAM,CAAU,WAAW,GACzB,wFAAwF,CAAC;IAC3F,MAAM,CAAU,QAAQ,GAAG,CAAC,oCAAoC,EAAE,wCAAwC,CAAC,CAAC;IAC5G,MAAM,CAAU,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjG,MAAM,CAAU,KAAK,GAAG;QACtB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;QACjE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;KACpD,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GACX,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAC/D,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,qCAAqC;QACrF,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,MAAM,sBAAsB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QAC/G,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,KAAK,YAAY,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/index/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,EAAE,GAAG,YAAY,CAAC;IAClC,MAAM,CAAU,WAAW,GACzB,wFAAwF,CAAC;IAC3F,MAAM,CAAU,QAAQ,GAAG,CAAC,oCAAoC,EAAE,wCAAwC,CAAC,CAAC;IAC5G,MAAM,CAAU,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjG,MAAM,CAAU,KAAK,GAAG;QACtB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;QACjE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;KACpD,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GACX,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAC/D,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAClB,IAAI,MAAM,CAAC;QACX,IAAI,SAAkB,CAAC;QACvB,IAAI,KAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzF,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAClD,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACnC,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,qCAAqC;QACrF,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,MAAM,sBAAsB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QAC/G,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,KAAK,YAAY,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC"}

package/dist/commands/knowledge/amend.d.ts

@@ -10,6 +10,7 @@ export default class KnowledgeAmend extends BaseCommand {
     };
     static flags: {
         wait: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        passphrase: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<AmendStatus | {
         amendRequestId: string;

package/dist/commands/knowledge/amend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"amend.d.ts","sourceRoot":"","sources":["../../../src/commands/knowledge/amend.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IACrD,OAAgB,EAAE,SAAqB;IACvC,OAAgB,WAAW,SAA0F;IACrH,OAAgB,QAAQ,WAAuF;IAC/G,OAAgB,IAAI;;;MAGlB;IACF,OAAgB,KAAK;;MAAiF;IAEhG,GAAG,IAAI,OAAO,CAAC,WAAW,GAAG;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAe/E"}
+{"version":3,"file":"amend.d.ts","sourceRoot":"","sources":["../../../src/commands/knowledge/amend.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IACrD,OAAgB,EAAE,SAAqB;IACvC,OAAgB,WAAW,SAGkF;IAC7G,OAAgB,QAAQ,WAAuF;IAC/G,OAAgB,IAAI;;;MAGlB;IACF,OAAgB,KAAK;;;MAGnB;IAEI,GAAG,IAAI,OAAO,CAAC,WAAW,GAAG;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAkB/E"}

package/dist/commands/knowledge/amend.js

@@ -1,17 +1,26 @@
 import { Args, Flags } from '@oclif/core';
 import { BaseCommand } from '../../base-command.js';
+import { assertNoCloudAmendUnderCmek } from '../../lib/cmek-guard.js';
 import { pollUntilTerminal, isTerminalStatus } from '../../lib/poll.js';
 export default class KnowledgeAmend extends BaseCommand {
     static id = 'knowledge:amend';
-    static description = 'Amend a knowledge item with a natural-language instruction (async; optionally wait).';
+    static description = 'Amend a knowledge item with a natural-language instruction (async; optionally wait). ' +
+        'Blocked on CMEK-enabled profiles: the cloud applies the amendment and holds only ciphertext, ' +
+        'and no encrypted-amendment envelope format exists yet — edit locally and use `knowledge update` instead.';
     static examples = ['<%= config.bin %> knowledge amend <id> "fix the dates and add a summary" --wait'];
     static args = {
         id: Args.string({ description: 'Knowledge id', required: true }),
         instruction: Args.string({ description: 'Amendment instruction', required: true }),
     };
-    static flags = { wait: Flags.boolean({ description: 'Poll until the amendment finishes' }) };
+    static flags = {
+        wait: Flags.boolean({ description: 'Poll until the amendment finishes' }),
+        passphrase: Flags.string({ description: 'CMEK passphrase (if the profile is CMEK-enabled)' }),
+    };
     async run() {
         const { args, flags } = await this.parse(KnowledgeAmend);
+        // H4 — the cloud applies this amendment to stored content it cannot read
+        // under CMEK. Refuse rather than downgrade the ciphertext-only guarantee.
+        assertNoCloudAmendUnderCmek(this.cmekEncryptor(flags), 'knowledge amend');
         const client = await this.apiClient(flags);
         const env = await client.amend.request(args.id, args.instruction);
         if (!this.jsonEnabled())

package/dist/commands/knowledge/amend.js.map

@@ -1 +1 @@
-{"version":3,"file":"amend.js","sourceRoot":"","sources":["../../../src/commands/knowledge/amend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IACrD,MAAM,CAAU,EAAE,GAAG,iBAAiB,CAAC;IACvC,MAAM,CAAU,WAAW,GAAG,sFAAsF,CAAC;IACrH,MAAM,CAAU,QAAQ,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/G,MAAM,CAAU,IAAI,GAAG;QACrB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACnF,CAAC;IACF,MAAM,CAAU,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC,EAAE,CAAC;IAEtG,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QAE5B,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,EACtD,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,CAAC,EACnC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACX,CAAC"}
+{"version":3,"file":"amend.js","sourceRoot":"","sources":["../../../src/commands/knowledge/amend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IACrD,MAAM,CAAU,EAAE,GAAG,iBAAiB,CAAC;IACvC,MAAM,CAAU,WAAW,GACzB,uFAAuF;QACvF,+FAA+F;QAC/F,0GAA0G,CAAC;IAC7G,MAAM,CAAU,QAAQ,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/G,MAAM,CAAU,IAAI,GAAG;QACrB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACnF,CAAC;IACF,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;QACzE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;KAC9F,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,yEAAyE;QACzE,0EAA0E;QAC1E,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QAE5B,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,EACtD,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,CAAC,EACnC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACX,CAAC"}

package/dist/commands/knowledge/attach.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command.js';
+import { type AttachResult } from '../../lib/attach.js';
+export default class KnowledgeAttach extends BaseCommand {
+    static id: string;
+    static description: string;
+    static strict: boolean;
+    static usage: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        files: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        'content-type': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        passphrase: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<AttachResult[]>;
+}
+//# sourceMappingURL=attach.d.ts.map

package/dist/commands/knowledge/attach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach.d.ts","sourceRoot":"","sources":["../../../src/commands/knowledge/attach.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IACtD,OAAgB,EAAE,SAAsB;IACxC,OAAgB,WAAW,SAC2C;IACtE,OAAgB,MAAM,UAAS;IAC/B,OAAgB,KAAK,SAAsC;IAC3D,OAAgB,QAAQ,WAItB;IAEF,OAAgB,IAAI;;;MAGlB;IACF,OAAgB,KAAK;;;MAKnB;IAEI,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;CAwBrC"}

package/dist/commands/knowledge/attach.js

@@ -0,0 +1,51 @@
+import { Args, Flags } from '@oclif/core';
+import { KnowzError, ExitCode } from '@knowzai/core';
+import { BaseCommand } from '../../base-command.js';
+import { uploadAndAttach, assertReadableFiles, applyAttachExitCode, } from '../../lib/attach.js';
+import { assertNoRawUploadUnderCmek } from '../../lib/cmek-guard.js';
+export default class KnowledgeAttach extends BaseCommand {
+    static id = 'knowledge:attach';
+    static description = 'Upload local files and attach them to an existing knowledge item.';
+    static strict = false; // accept variadic file paths
+    static usage = 'knowledge attach <id> <files...>';
+    static examples = [
+        '<%= config.bin %> knowledge attach 3f2a9c1e report.pdf',
+        '<%= config.bin %> knowledge attach 3f2a9c1e slide-1.png slide-2.png',
+        '<%= config.bin %> knowledge attach 3f2a9c1e capture.bin --content-type audio/mp4',
+    ];
+    // Declared for `--help`; presence is validated below so a bad invocation exits 2.
+    static args = {
+        id: Args.string({ description: 'Knowledge item id to attach to' }),
+        files: Args.string({ description: 'One or more local file paths (files...)' }),
+    };
+    static flags = {
+        'content-type': Flags.string({
+            description: 'Override the inferred MIME type for every file',
+        }),
+        passphrase: Flags.string({ description: 'CMEK passphrase (if the profile is CMEK-enabled)' }),
+    };
+    async run() {
+        const { argv, flags } = await this.parse(KnowledgeAttach);
+        const [id, ...paths] = argv;
+        if (!id)
+            throw new KnowzError('A knowledge item id is required.', ExitCode.Usage);
+        if (!paths.length) {
+            throw new KnowzError('Provide at least one file path to attach.', ExitCode.Usage);
+        }
+        // H4 — raw bytes have no CMEK envelope format; refuse rather than upload
+        // plaintext under a feature that promises the cloud only sees ciphertext.
+        assertNoRawUploadUnderCmek(this.cmekEncryptor(flags), 'knowledge attach');
+        assertReadableFiles(paths);
+        const client = await this.apiClient(flags);
+        const results = await uploadAndAttach(client, id, paths, {
+            contentType: flags['content-type'],
+        });
+        applyAttachExitCode(results);
+        if (this.jsonEnabled())
+            return results;
+        const attached = results.filter((r) => r.ok).length;
+        this.log(`attached ${attached}/${results.length} file(s) to ${id}`);
+        return results;
+    }
+}
+//# sourceMappingURL=attach.js.map

package/dist/commands/knowledge/attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach.js","sourceRoot":"","sources":["../../../src/commands/knowledge/attach.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IACtD,MAAM,CAAU,EAAE,GAAG,kBAAkB,CAAC;IACxC,MAAM,CAAU,WAAW,GACzB,mEAAmE,CAAC;IACtE,MAAM,CAAU,MAAM,GAAG,KAAK,CAAC,CAAC,6BAA6B;IAC7D,MAAM,CAAU,KAAK,GAAG,kCAAkC,CAAC;IAC3D,MAAM,CAAU,QAAQ,GAAG;QACzB,wDAAwD;QACxD,qEAAqE;QACrE,kFAAkF;KACnF,CAAC;IACF,kFAAkF;IAClF,MAAM,CAAU,IAAI,GAAG;QACrB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;QAClE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;KAC/E,CAAC;IACF,MAAM,CAAU,KAAK,GAAG;QACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,gDAAgD;SAC9D,CAAC;QACF,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;KAC9F,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,IAAgB,CAAC;QACxC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,kCAAkC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC1E,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE;YACvD,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC;SACnC,CAAC,CAAC;QAEH,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC;QAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,YAAY,QAAQ,IAAI,OAAO,CAAC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC;IACjB,CAAC"}

package/dist/commands/knowledge/create.d.ts

@@ -1,5 +1,10 @@
 import type { KnowledgeDetail, KnowledgeStatus } from '@knowzai/types';
 import { BaseCommand } from '../../base-command.js';
+import { type AttachResult } from '../../lib/attach.js';
+/** `attachments` is present only when `--attach` was used, so the plain create output is unchanged. */
+type CreateResult = (KnowledgeDetail | KnowledgeStatus) & {
+    attachments?: AttachResult[];
+};
 export default class KnowledgeCreate extends BaseCommand {
     static description: string;
     static args: {
@@ -11,8 +16,11 @@ export default class KnowledgeCreate extends BaseCommand {
         file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         type: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         tag: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        attach: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        passphrase: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         wait: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    run(): Promise<KnowledgeDetail | KnowledgeStatus>;
+    run(): Promise<CreateResult>;
 }
+export {};
 //# sourceMappingURL=create.d.ts.map

package/dist/commands/knowledge/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/knowledge/create.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMpD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IACtD,OAAgB,WAAW,SAAyE;IACpG,OAAgB,IAAI;;MAA8D;IAClF,OAAgB,KAAK;;;;;;;MAOnB;IAEI,GAAG,IAAI,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;CA+BxD"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/knowledge/create.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAiB,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAK7B,uGAAuG;AACvG,KAAK,YAAY,GAAG,CAAC,eAAe,GAAG,eAAe,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC;AAE3F,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IACtD,OAAgB,WAAW,SAAyE;IACpG,OAAgB,IAAI;;MAA8D;IAClF,OAAgB,KAAK;;;;;;;;;MAanB;IAEI,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;CA8CnC"}