@remnic/core 9.69.55 → 9.69.57

package/dist/chunk-MWZMVLXL.js

@@ -0,0 +1,415 @@
+import {
+  StorageManager
+} from "./chunk-S2OBXHMN.js";
+import {
+  keyring_exports,
+  secureStoreDir
+} from "./chunk-BJMBJZ2Y.js";
+import {
+  MutationSerializer
+} from "./chunk-FFAZ2XFU.js";
+import {
+  isSafeRouteNamespace
+} from "./chunk-PCXDUHQH.js";
+import {
+  namespaceIdentityLegacyToken,
+  namespaceIdentityToken,
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
+import {
+  resolveNamespaceCapabilities,
+  resolveRecallAuxiliaryCapabilities
+} from "./chunk-JUOZ62Y7.js";
+import {
+  ALL_CATEGORY_DIRS
+} from "./chunk-VS2IYZRU.js";
+
+// src/namespaces/storage.ts
+import path from "path";
+import { access, lstat, readdir } from "fs/promises";
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function hasStoredEntries(p) {
+  try {
+    const entry = await lstat(p);
+    if (entry.isSymbolicLink()) return true;
+    if (!entry.isDirectory()) return true;
+    const children = await readdir(p, { withFileTypes: true });
+    for (const child of children) {
+      const childPath = path.join(p, child.name);
+      if (child.isSymbolicLink() || child.isFile()) return true;
+      if (child.isDirectory() && await hasStoredEntries(childPath)) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function resolveNamespaceDir(memoryDir, segment) {
+  if (segment.length === 0 || segment.includes("/") || segment.includes("\\") || segment.includes("..") || path.isAbsolute(segment)) {
+    throw new Error(`unsafe namespace path segment: ${segment}`);
+  }
+  return path.join(memoryDir, "namespaces", segment);
+}
+var LEGACY_NAMESPACE_CONTENT_CHILDREN = [
+  ...ALL_CATEGORY_DIRS,
+  "entities",
+  "artifacts",
+  "identity",
+  "config",
+  "summaries",
+  "profile.md"
+];
+var LEGACY_NAMESPACE_RUNTIME_CHILDREN = ["state"];
+async function hasAnyLegacyData(rootDir, options = {}) {
+  const children = options.includeRuntimeState === true ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN] : LEGACY_NAMESPACE_CONTENT_CHILDREN;
+  for (const child of children) {
+    if (await hasStoredEntries(path.join(rootDir, child))) return true;
+  }
+  return false;
+}
+async function hasAnyNamespaceStorageMarker(rootDir, options = {}) {
+  const children = options.includeRuntimeState === true ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN] : LEGACY_NAMESPACE_CONTENT_CHILDREN;
+  for (const child of children) {
+    if (await exists(path.join(rootDir, child))) return true;
+  }
+  return false;
+}
+async function resolveDefaultNamespaceRoot(config) {
+  if (!resolveNamespaceCapabilities(config).namespaces) {
+    return config.memoryDir;
+  }
+  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
+  const defaultNfdIdentity = defaultIdentity.normalize("NFD");
+  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);
+  const legacyNfdNsDir = resolveNamespaceDir(config.memoryDir, defaultNfdIdentity);
+  const tokenizedNsDir = resolveNamespaceDir(
+    config.memoryDir,
+    namespaceIdentityToken(defaultIdentity)
+  );
+  const legacyTokenNsDir = resolveNamespaceDir(
+    config.memoryDir,
+    namespaceIdentityLegacyToken(defaultNfdIdentity)
+  );
+  const tokenizedHasData = await exists(tokenizedNsDir) && await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true });
+  const legacyTokenHasData = await exists(legacyTokenNsDir) && await hasAnyNamespaceStorageMarker(legacyTokenNsDir, { includeRuntimeState: true });
+  const legacyHasData = await exists(legacyNsDir) && await hasAnyNamespaceStorageMarker(legacyNsDir, { includeRuntimeState: true });
+  const legacyNfdHasData = legacyNfdNsDir !== legacyNsDir && await exists(legacyNfdNsDir) && await hasAnyNamespaceStorageMarker(legacyNfdNsDir, { includeRuntimeState: true });
+  const nsDir = tokenizedHasData ? tokenizedNsDir : legacyTokenHasData ? legacyTokenNsDir : legacyHasData ? legacyNsDir : legacyNfdHasData ? legacyNfdNsDir : await exists(legacyNsDir) ? legacyNsDir : legacyNfdNsDir !== legacyNsDir && await exists(legacyNfdNsDir) ? legacyNfdNsDir : tokenizedNsDir;
+  return await exists(nsDir) && !await hasAnyLegacyData(config.memoryDir) ? nsDir : config.memoryDir;
+}
+async function resolveNamespaceStorageRoot(config, namespace) {
+  if (!resolveNamespaceCapabilities(config).namespaces) return config.memoryDir;
+  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {
+    return resolveDefaultNamespaceRoot(config);
+  }
+  const normalized = normalizeNamespaceIdentity(namespace);
+  const legacyExactNamespace = namespace.trim();
+  const legacyNfdNamespace = normalized.normalize("NFD");
+  const legacyRoot = resolveNamespaceDir(config.memoryDir, normalized);
+  const legacyExactRoot = legacyExactNamespace !== normalized && isSafeRouteNamespace(legacyExactNamespace) ? resolveNamespaceDir(config.memoryDir, legacyExactNamespace) : null;
+  const legacyNfdRoot = legacyNfdNamespace !== normalized ? resolveNamespaceDir(config.memoryDir, legacyNfdNamespace) : null;
+  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(normalized));
+  const legacyTokenRoots = [
+    namespaceIdentityLegacyToken(legacyExactNamespace),
+    namespaceIdentityLegacyToken(legacyNfdNamespace)
+  ].filter((token, index, tokens) => tokens.indexOf(token) === index).map((token) => resolveNamespaceDir(config.memoryDir, token));
+  for (const candidate of [tokenizedRoot, ...legacyTokenRoots]) {
+    if (await exists(candidate) && await hasAnyNamespaceStorageMarker(candidate, { includeRuntimeState: true })) {
+      return candidate;
+    }
+  }
+  for (const candidate of [legacyRoot, legacyExactRoot, legacyNfdRoot]) {
+    if (candidate && await exists(candidate)) return candidate;
+  }
+  return tokenizedRoot;
+}
+var NamespaceStorageRouter = class {
+  constructor(config, hooks = {}, catalog) {
+    this.config = config;
+    this.hooks = hooks;
+    this.catalog = catalog;
+    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
+  }
+  config;
+  hooks;
+  catalog;
+  cache = /* @__PURE__ */ new Map();
+  defaultNsRootResolved = null;
+  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction
+  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +
+  // append) on every cache hit grows `namespaces.jsonl` without bound between
+  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new
+  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.
+  notifiedResolved = /* @__PURE__ */ new Map();
+  // Instance-scoped serializer for the resolve hook (issue #1524 adoption).
+  // Replaces the bespoke `inFlightResolved` marker-then-clear pattern: the
+  // serializer's per-key chain strictly orders concurrent notifications for the
+  // SAME namespace, and the task re-checks `notifiedResolved` once it runs, so a
+  // burst of cache hits before the first hook settles collapses to a single
+  // hook invocation (the once-per-namespace intent). Recovery is preserved —
+  // one rejected hook never poisons subsequent notifications for that key.
+  resolveSerializer = new MutationSerializer();
+  // (namespace, storageDir) pairs whose resolve hook is currently pending. Set SYNCHRONOUSLY in
+  // notifyResolved (before queueing) so a burst of concurrent storageFor()
+  // cache hits collapses onto the one in-flight hook instead of each enqueuing
+  // its own task. Cleared when the queued hook settles. Without this, a dropped
+  // hook (returns false on a rebuild-lock timeout) leaves notifiedResolved
+  // unset, so every queued sibling task would re-run the hook — N serial lock
+  // waits (cursor Medium 06f58a7c, codex P2).
+  inFlightResolveHooks = /* @__PURE__ */ new Set();
+  // Tracks every in-flight resolve-hook promise so callers can deterministically
+  // await the fire-and-forget registrations that `storageFor()` kicks off (see
+  // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the
+  // set holds at most one promise per concurrently-resolving namespace.
+  pendingResolveHooks = /* @__PURE__ */ new Set();
+  // Pending post-write catalog touch promises (#1522). Like pendingResolveHooks,
+  // lets tests await fire-and-forget write touches deterministically.
+  pendingWriteTouches = /* @__PURE__ */ new Set();
+  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`
+  // normalizes its input, so default-namespace branches must compare against the
+  // normalized config default too — otherwise a whitespace-padded configured
+  // default name routes the default namespace to a tokenized non-default root.
+  defaultNamespaceIdentity;
+  /** #2019: hook fired when a new namespace storage is created via storageFor. */
+  onStorageCreated;
+  async defaultNamespaceRoot() {
+    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);
+    return this.defaultNsRootResolved;
+  }
+  async namespaceRoot(namespace) {
+    if (!resolveNamespaceCapabilities(this.config).namespaces) return this.config.memoryDir;
+    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
+      return this.defaultNsRootResolved ?? this.config.memoryDir;
+    }
+    return resolveNamespaceStorageRoot(this.config, namespace);
+  }
+  async storageFor(namespace) {
+    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);
+    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {
+      throw new Error(`unsafe namespace: ${ns}`);
+    }
+    let root;
+    if (ns === this.defaultNamespaceIdentity) {
+      root = await this.defaultNamespaceRoot();
+      const cached = this.cache.get(ns);
+      if (cached && cached.dir === root) {
+        await this.applySecureStoreConfig(cached);
+        this.notifyResolved(ns, root);
+        return cached;
+      }
+    } else {
+      const cached = this.cache.get(ns);
+      root = await this.namespaceRoot(ns);
+      if (cached && cached.dir === root) {
+        await this.applySecureStoreConfig(cached);
+        this.notifyResolved(ns, root);
+        return cached;
+      }
+    }
+    const sm = new StorageManager(
+      root,
+      this.config.entitySchemas,
+      this.config.hotMemoriesCacheEnabled
+    );
+    StorageManager.setHotMemoriesCacheDefault(
+      root,
+      this.config.hotMemoriesCacheEnabled,
+      this.config.hotMemoriesCacheTtlMs
+    );
+    const { scopedCacheInvalidationEnabled } = this.config;
+    StorageManager.setScopedCacheInvalidationDefault(root, scopedCacheInvalidationEnabled);
+    sm.citationTemplate = this.config.inlineSourceAttributionFormat;
+    this.bindCatalogWriteHook(sm, ns);
+    this.applyTombstonesConfig(sm, ns);
+    await this.applySecureStoreConfig(sm);
+    this.cache.set(ns, sm);
+    this.onStorageCreated?.(sm, ns);
+    this.notifyResolved(ns, root);
+    return sm;
+  }
+  /**
+   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write
+   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.
+   *
+   * Issue #1524 adoption: hook invocations for the SAME namespace are now
+   * strictly ordered through the shared `MutationSerializer` rather than the
+   * bespoke `inFlightResolved` marker-then-clear pattern. The serializer
+   * guarantees one in-flight hook per namespace; a concurrent burst of
+   * `storageFor()` cache hits collapses to a single hook invocation because
+   * each queued task re-checks `notifiedResolved` before invoking the hook. A
+   * dropped (`false`) or rejected hook leaves `notifiedResolved` unset so the
+   * next `storageFor()` retries — the serializer recovers from the rejection,
+   * so a failed hook never poisons later notifications.
+   */
+  notifyResolved(namespace, storageDir) {
+    const hook = this.hooks.onResolve;
+    if (!hook) return;
+    if (this.notifiedResolved.get(namespace) === storageDir) return;
+    const inFlightKey = namespace + "\0" + storageDir;
+    if (this.inFlightResolveHooks.has(inFlightKey)) return;
+    this.inFlightResolveHooks.add(inFlightKey);
+    const task = async () => {
+      if (this.notifiedResolved.get(namespace) === storageDir) return;
+      try {
+        const persisted = await Promise.resolve(hook(namespace, storageDir));
+        if (persisted !== false) {
+          this.notifiedResolved.set(namespace, storageDir);
+        }
+      } catch {
+      }
+    };
+    const queued = this.resolveSerializer.serialize(namespace, task);
+    this.pendingResolveHooks.add(queued);
+    const cleanup = () => {
+      this.inFlightResolveHooks.delete(inFlightKey);
+      this.pendingResolveHooks.delete(queued);
+    };
+    void queued.then(cleanup, cleanup);
+  }
+  /**
+   * Install the post-write catalog touch hook on an externally-constructed
+   * StorageManager (issue #1522). Used by the orchestrator for the legacy
+   * default-namespace storage (`this.storage`) that bypasses the router.
+   */
+  bindCatalogWriteHook(sm, namespace) {
+    sm.touchStateWrites = this.config.namespacesCatalogTouchStateWrites === true;
+    sm.onCatalogWrite = () => this.touchCatalogWrite(namespace, sm.dir);
+  }
+  /**
+   * Install the tombstone config on an externally-constructed StorageManager
+   * (issue #1579). Mirrors `bindCatalogWriteHook` — used for the legacy
+   * default-namespace storage that bypasses the router. Router-created
+   * storages are wired inline in `storageFor()` via `applyTombstonesConfig`.
+   */
+  bindTombstonesConfig(sm, namespace, config) {
+    this.tombstonesGlobalConfig = { ...config };
+    sm.setTombstonesConfig({ ...config, namespace });
+  }
+  tombstonesGlobalConfig = { enabled: false, semanticMatch: false, semanticThreshold: 0.9 };
+  /**
+   * Apply the tombstone config to a router-created StorageManager. Called
+   * inline in `storageFor()` so every namespace storage enforces the
+   * non-resurrection invariant, namespace-scoped (rule 42).
+   */
+  applyTombstonesConfig(sm, namespace) {
+    sm.setTombstonesConfig({ ...this.tombstonesGlobalConfig, namespace });
+  }
+  /**
+   * Install the at-rest secure-store context on a router-created StorageManager
+   * (#2033). Mirrors the orchestrator's primary-storage setup: mark the store
+   * required so a locked store throws instead of silently writing plaintext, and
+   * install the master key when the process-local keyring already holds it (the
+   * operator unlocked). The secure store is one key per memory ROOT (single
+   * header + per-file path-bound AAD), so every namespace store keys off the
+   * root keyring id — exactly the id the orchestrator and `secure-store unlock`
+   * register under. No-op when secure-store is disabled.
+   */
+  async applySecureStoreConfig(sm) {
+    if (!resolveRecallAuxiliaryCapabilities(this.config).secureStore) return;
+    sm.setSecureStoreRequired(true);
+    const existingKey = keyring_exports.getKey(secureStoreDir(this.config.memoryDir));
+    if (existingKey) {
+      await sm.setSecureStoreKeyAndWait(existingKey, this.config.secureStoreEncryptOnWrite);
+    }
+  }
+  /**
+   * Post-write catalog touch (issue #1522 chokepoint). Called by every
+   * StorageManager's post-write hook AFTER a successful write. Best-effort
+   * and failure-tolerant — a catalog error MUST NOT affect the primary write
+   * (gotcha #13, rule #40). Fire-and-forget by design.
+   */
+  touchCatalogWrite(namespace, storageDir) {
+    if (!this.catalog) return;
+    const touch = this.catalog.markWrite(namespace, { discoveredBy: "write", storageDir }).catch(() => void 0);
+    this.pendingWriteTouches.add(touch);
+    void touch.then(
+      () => {
+        this.pendingWriteTouches.delete(touch);
+      },
+      () => {
+        this.pendingWriteTouches.delete(touch);
+      }
+    );
+  }
+  /**
+   * Record a namespace read in the catalog (issue #1522 chokepoint move).
+   * Best-effort and failure-tolerant. Used by recall paths so the read touch
+   * lives in the storage layer, not at the caller.
+   */
+  recordRead(namespace, storageDir) {
+    if (!this.catalog) return;
+    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);
+    void this.catalog.markRead(ns, { discoveredBy: "read", storageDir }).catch(() => void 0);
+  }
+  /**
+   * Record a namespace write touch in the catalog (issue #1522). Best-effort
+   * and failure-tolerant. Used by consolidation/cleanup passes that may mutate
+   * the store via delete-only paths (e.g. entity-file merges, TTL cleanup) so
+   * the namespace's lastWriteAt stays fresh even when no explicit write went
+   * through the storage chokepoint. This is NOT a substitute for the chokepoint
+   * — it's a belt-and-suspenders for paths the chokepoint doesn't cover.
+   */
+  recordWrite(namespace, storageDir) {
+    if (!this.catalog) return;
+    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);
+    const touch = this.catalog.markWrite(ns, { discoveredBy: "write", storageDir }).catch(() => void 0);
+    this.pendingWriteTouches.add(touch);
+    void touch.then(
+      () => {
+        this.pendingWriteTouches.delete(touch);
+      },
+      () => {
+        this.pendingWriteTouches.delete(touch);
+      }
+    );
+  }
+  /**
+   * Resolve once every in-flight post-write catalog touch has settled (#1522).
+   * Mirrors `whenResolveHooksSettled()`: the StorageManager's post-write hook
+   * fires the catalog touch fire-and-forget, so tests asserting lastWriteAt
+   * moved should await this instead of racing a timer.
+   */
+  async whenWriteTouchesSettled() {
+    await this.catalog?.flushPendingTouches().catch(() => void 0);
+    while (this.pendingWriteTouches.size > 0) {
+      await Promise.allSettled([...this.pendingWriteTouches]);
+    }
+  }
+  /**
+   * Resolve once every in-flight `onResolve` registration has settled.
+   *
+   * `storageFor()` fires the resolve hook fire-and-forget, so its catalog side
+   * effect (e.g. `registerResolved(...)`) is not observable the moment
+   * `storageFor()` returns. Callers that must act on that side effect — notably
+   * tests asserting the catalog was updated — should await this instead of
+   * racing a timer. Resolves immediately when no hook is registered or nothing
+   * is in flight. The loop re-checks because a settling hook could, in
+   * principle, trigger a follow-on resolution.
+   */
+  async whenResolveHooksSettled() {
+    while (this.pendingResolveHooks.size > 0) {
+      await Promise.allSettled([...this.pendingResolveHooks]);
+    }
+  }
+  /**
+   * #2019: iterate the currently cached router storages with their namespace so
+   * callers can wire hooks on stores resolved before the hook was installed.
+   */
+  forEachCachedStorage(fn) {
+    for (const [namespace, storage] of this.cache) fn(storage, namespace);
+  }
+};
+
+export {
+  resolveDefaultNamespaceRoot,
+  resolveNamespaceStorageRoot,
+  NamespaceStorageRouter
+};
+//# sourceMappingURL=chunk-MWZMVLXL.js.map

package/dist/chunk-MZUQVWVC.js

@@ -0,0 +1,72 @@
+// src/mcp-read-only-tools.ts
+var MCP_READ_ONLY_TOOL_SUFFIXES = {
+  recall: true,
+  recall_explain: true,
+  recall_tier_explain: true,
+  recall_xray: true,
+  recall_why: true,
+  who_knows: true,
+  promotion_candidates: true,
+  briefing: true,
+  wearables_status: true,
+  transcript_day: true,
+  transcript_search: true,
+  transcript_memories: true,
+  location_status: true,
+  location_day: true,
+  meetings_list: true,
+  meetings_get: true,
+  deep_recall: true,
+  memory_expand: true,
+  memory_traverse: true,
+  memory_ls: true,
+  memory_tree: true,
+  memory_find: true,
+  standup: true,
+  action_confidence: true,
+  capsule_list: true,
+  procedural_stats: true,
+  memory_get: true,
+  memory_timeline: true,
+  entity_get: true,
+  review_queue_list: true,
+  lcm_search: true,
+  continuity_incident_list: true,
+  identity_anchor_get: true,
+  memory_identity: true,
+  memory_search: true,
+  external_wiki_search: true,
+  memory_profile: true,
+  memory_entities_list: true,
+  memory_questions: true,
+  memory_last_recall: true,
+  memory_intent_debug: true,
+  memory_qmd_debug: true,
+  memory_graph_explain: true,
+  graph_snapshot: true,
+  review_list: true,
+  profiling_report: true,
+  peer_list: true,
+  peer_get: true,
+  peer_profile_get: true,
+  console_state: true,
+  dreams_status: true,
+  codegraph_list_projects: true,
+  codegraph_index_status: true,
+  codegraph_search_graph: true,
+  codegraph_trace_path: true,
+  codegraph_detect_changes: true,
+  codegraph_query_graph: true,
+  codegraph_get_schema: true,
+  codegraph_get_snippet: true,
+  codegraph_get_architecture: true,
+  codegraph_search_code: true,
+  support_passport_memory_preview: true,
+  support_passport_cards_list: true,
+  support_passport_grants_list: true
+};
+
+export {
+  MCP_READ_ONLY_TOOL_SUFFIXES
+};
+//# sourceMappingURL=chunk-MZUQVWVC.js.map

package/dist/chunk-MZUQVWVC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp-read-only-tools.ts"],"sourcesContent":["/**\n * Conservative allowlist of canonical MCP tool suffixes that are\n * unambiguously read-only. Tools in this set are tagged with\n * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP\n * clients that honor the hint) can skip per-call confirmation.\n *\n * The list is suffix-based so it covers both the `remnic.*` and\n * `engram.*` naming forms. Anything not on it stays unannotated:\n * uncertainty is resolved as \"might mutate\".\n *\n * Excluded by construction: anything that writes, runs a pipeline,\n * flushes, applies, records, imports, or destructively deletes.\n */\nexport const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {\n  recall: true,\n  recall_explain: true,\n  recall_tier_explain: true,\n  recall_xray: true,\n  recall_why: true,\n  who_knows: true,\n  promotion_candidates: true,\n  briefing: true,\n  wearables_status: true,\n  transcript_day: true,\n  transcript_search: true,\n  transcript_memories: true,\n  location_status: true,\n  location_day: true,\n  meetings_list: true,\n  meetings_get: true,\n  deep_recall: true,\n  memory_expand: true,\n  memory_traverse: true,\n  memory_ls: true,\n  memory_tree: true,\n  memory_find: true,\n  standup: true,\n  action_confidence: true,\n  capsule_list: true,\n  procedural_stats: true,\n  memory_get: true,\n  memory_timeline: true,\n  entity_get: true,\n  review_queue_list: true,\n  lcm_search: true,\n  continuity_incident_list: true,\n  identity_anchor_get: true,\n  memory_identity: true,\n  memory_search: true,\n  external_wiki_search: true,\n  memory_profile: true,\n  memory_entities_list: true,\n  memory_questions: true,\n  memory_last_recall: true,\n  memory_intent_debug: true,\n  memory_qmd_debug: true,\n  memory_graph_explain: true,\n  graph_snapshot: true,\n  review_list: true,\n  profiling_report: true,\n  peer_list: true,\n  peer_get: true,\n  peer_profile_get: true,\n  console_state: true,\n  dreams_status: true,\n  codegraph_list_projects: true,\n  codegraph_index_status: true,\n  codegraph_search_graph: true,\n  codegraph_trace_path: true,\n  codegraph_detect_changes: true,\n  codegraph_query_graph: true,\n  codegraph_get_schema: true,\n  codegraph_get_snippet: true,\n  codegraph_get_architecture: true,\n  codegraph_search_code: true,\n  support_passport_memory_preview: true,\n  support_passport_cards_list: true,\n  support_passport_grants_list: true,\n};\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,eAAe;AAAA,EACf,cAAc;AAAA,EACd,aAAa;AAAA,EACb,eAAe;AAAA,EACf,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,SAAS;AAAA,EACT,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,YAAY;AAAA,EACZ,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,iCAAiC;AAAA,EACjC,6BAA6B;AAAA,EAC7B,8BAA8B;AAChC;","names":[]}

package/dist/chunk-N4VCHRLD.js

@@ -0,0 +1,29 @@
+import {
+  searchExternalWikis
+} from "./chunk-7T4TOGMS.js";
+import {
+  defineOperation
+} from "./chunk-4ALOINQ4.js";
+
+// src/external-wiki-access.ts
+import { z } from "zod";
+var externalWikiSearchSchema = z.object({
+  query: z.string().trim().min(1, "query is required").max(2048),
+  limit: z.number().int().min(1).max(20).optional(),
+  wikiId: z.string().trim().min(1).max(256).optional(),
+  maxCharsPerHit: z.number().int().min(1).max(8e3).optional()
+}).strict();
+var externalWikiSearchOperation = defineOperation({
+  name: "external_wiki_search",
+  description: "Search configured external compiled-wiki roots and return cited snippets.",
+  schema: externalWikiSearchSchema,
+  fleetWide: true,
+  handler: async (input, ctx) => ({
+    result: await searchExternalWikis(ctx.service.configRef.externalWikis, input)
+  })
+});
+
+export {
+  externalWikiSearchOperation
+};
+//# sourceMappingURL=chunk-N4VCHRLD.js.map