@saasontools/strauss-kb 0.1.4 → 0.1.6

package/dist/cli-main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   runKbCli
-} from "./chunk-Y5C7Z2HG.js";
-import "./chunk-EDH43Z7J.js";
+} from "./chunk-V7TRZ2ER.js";
+import "./chunk-PNSRTKYN.js";
 
 // src/cli-main.ts
 runKbCli(process.argv.slice(2)).catch((error) => {

package/dist/index.cjs

@@ -52,6 +52,7 @@ __export(index_exports, {
   KbPinsMalformedError: () => KbPinsMalformedError,
   KbRecordAlreadyExistsError: () => KbRecordAlreadyExistsError,
   KbRecordNotFoundError: () => KbRecordNotFoundError,
+  KbSelfVerificationError: () => KbSelfVerificationError,
   KbStore: () => KbStore,
   KbWriteConflictError: () => KbWriteConflictError,
   LOG_FILE: () => LOG_FILE,
@@ -82,6 +83,7 @@ __export(index_exports, {
   kbLogEntrySchema: () => kbLogEntrySchema,
   kbRecordFrontmatterSchema: () => kbRecordFrontmatterSchema,
   kbSourceSchema: () => kbSourceSchema,
+  kbVerifiedEventSchema: () => kbVerifiedEventSchema,
   listPins: () => listPins,
   loadQmd: () => loadQmd,
   matchToDiff: () => matchToDiff,
@@ -154,6 +156,11 @@ var kbActorStampSchema = import_zod.z.object({
   by: import_zod.z.string().min(1),
   at: import_zod.z.string().min(1)
 }).passthrough();
+var kbVerifiedEventSchema = kbActorStampSchema.extend({
+  note: import_zod.z.string().refine((s) => s.trim().length > 0, {
+    message: "note must say what the check found"
+  })
+});
 var kbAnchorSchema = import_zod.z.object({
   file: import_zod.z.string().min(1),
   symbol: import_zod.z.string().min(1).optional()
@@ -238,6 +245,7 @@ var ErrorTypes = /* @__PURE__ */ ((ErrorTypes2) => {
   ErrorTypes2["KbRecordAlreadyExists"] = "KbRecordAlreadyExists";
   ErrorTypes2["KbInvalidConceptId"] = "KbInvalidConceptId";
   ErrorTypes2["KbRecordNotFound"] = "KbRecordNotFound";
+  ErrorTypes2["KbSelfVerification"] = "KbSelfVerification";
   ErrorTypes2["KbWriteConflict"] = "KbWriteConflict";
   return ErrorTypes2;
 })(ErrorTypes || {});
@@ -306,6 +314,25 @@ var KbWriteConflictError = class extends BaseError {
   }
   conceptId;
 };
+var KbSelfVerificationError = class extends BaseError {
+  constructor(conceptId2, actor, generatedBy) {
+    super({
+      message: `kb: ${conceptId2} was generated by ${generatedBy}, and a record's generator cannot verify it \u2014 only a human or a different actor can`,
+      errorType: "KbSelfVerification" /* KbSelfVerification */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { conceptId: conceptId2, actor, generatedBy, action: "refused" }
+    });
+    this.conceptId = conceptId2;
+    this.actor = actor;
+    this.generatedBy = generatedBy;
+  }
+  conceptId;
+  actor;
+  generatedBy;
+};
 var KbInvalidConceptIdError = class extends BaseError {
   constructor(message, details) {
     super({
@@ -749,6 +776,40 @@ var KbStore = class {
       { operation: `status:${status}`, by: actor }
     );
   }
+  /**
+   * Appends one `verified[]` event: who checked the record, when, and what the
+   * check found. Append-only — prior events are history, and are spread into
+   * the new array untouched rather than reshaped through the write schema.
+   *
+   * A record's generator cannot verify its own record unless the actor is
+   * human: the generator re-reading its own output is not an independent
+   * check. The rule runs before the mutation so a refusal never publishes,
+   * and the refusal is logged under its own operation name — `mutate` only
+   * logs what it publishes.
+   */
+  async verify(bundlePath2, conceptId2, note, actor = "unknown", at = (/* @__PURE__ */ new Date()).toISOString()) {
+    const event = kbVerifiedEventSchema.parse({ by: actor, at, note });
+    const existing = await this.read(bundlePath2, conceptId2);
+    if (!existing) throw new KbRecordNotFoundError(conceptId2);
+    const generatedBy = existing.frontmatter.generated?.by;
+    if (generatedBy !== void 0 && actor.toLowerCase() === generatedBy.toLowerCase() && !normalizeActor(actor).startsWith("human:")) {
+      await this.record(this.root(bundlePath2), {
+        operation: "verify:refused",
+        conceptId: conceptId2,
+        by: actor
+      });
+      throw new KbSelfVerificationError(conceptId2, actor, generatedBy);
+    }
+    return this.mutate(
+      bundlePath2,
+      conceptId2,
+      (frontmatter) => ({
+        ...frontmatter,
+        verified: [...frontmatter.verified ?? [], event]
+      }),
+      { operation: "verify", by: actor }
+    );
+  }
   /**
    * Marks `conceptId` superseded by `replacementId`, and links both directions.
    *
@@ -852,6 +913,10 @@ ${answer}
    * Refuses rather than truncates when the base is too large. A truncated base
    * is indistinguishable from a complete one, so a caller would answer "that
    * was never decided" from a slice it did not know was a slice.
+   *
+   * That refusal is the default guardrail. `all` bypasses it outright and
+   * always hands back the whole bundle: an explicit, never-accidental escape
+   * hatch for an operator who has the budget to spend, not a wider default.
    */
   async load(bundlePath2, options = {}) {
     const budgetTokens = options.budgetTokens ?? DEFAULT_LOAD_BUDGET;
@@ -861,7 +926,7 @@ ${answer}
     const records = adjudicated.filter((hit) => hit.standing !== "superseded");
     const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
     const approxTokens2 = records.reduce((total, hit) => total + estimateTokens(hit.record), 0) + superseded.reduce((total, entry) => total + estimateStubTokens(entry), 0);
-    if (approxTokens2 > budgetTokens) {
+    if (!options.all && approxTokens2 > budgetTokens) {
       return {
         loaded: false,
         recordCount: wanted.length,
@@ -872,8 +937,8 @@ ${answer}
     return {
       loaded: true,
       recordCount: wanted.length,
-      approxTokens: approxTokens2,
-      budgetTokens,
+      tokensLoaded: approxTokens2,
+      budgetTokens: options.all ? null : budgetTokens,
       records,
       superseded
     };
@@ -1079,6 +1144,11 @@ function matches(record, needle) {
     (field) => field?.toLowerCase().includes(needle)
   );
 }
+function normalizeActor(id) {
+  const colon = id.indexOf(":");
+  if (colon === -1) return id.toLowerCase();
+  return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
+}
 function digest(contents) {
   return (0, import_node_crypto.createHash)("sha256").update(contents).digest("hex");
 }
@@ -2058,25 +2128,32 @@ var import_zod11 = require("zod");
 var loadCommand = define({
   name: "load",
   tool: "kb_load",
-  usage: "load [type] [--budget N]",
-  description: "Load the whole knowledge base at once, each record with its standing. Prefer this over searching: these bases run to a few thousand tokens, and a reader holding all of it has perfect recall and knows why it is asking, which no ranker does. Superseded records arrive under `superseded` as name, replacement and date only \u2014 their bodies no longer hold, and reading one later in a long session is the mistake this prevents; pass the id to kb_trace when you need the history. Rejected and unresolved records arrive whole: what was turned down, and what is still open, is the part a diff cannot show you. Refuses with a count rather than truncating when the base is too large \u2014 a truncated base is indistinguishable from a complete one, and would have you conclude something was never decided from a slice you did not know was a slice. Call at the point of use, not once per session: a base loaded early is summarised away by compaction, so if the visible context holds no records from this base and the question at hand is one it might govern, load before answering \u2014 never conclude nothing was decided from a context with no KB content in it. This tool (with kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.",
+  usage: "load [type] [--budget N | --all]",
+  description: "Load the whole knowledge base at once, each record with its standing. Prefer this over searching: these bases run to a few thousand tokens, and a reader holding all of it has perfect recall and knows why it is asking, which no ranker does. Superseded records arrive under `superseded` as name, replacement and date only \u2014 their bodies no longer hold, and reading one later in a long session is the mistake this prevents; pass the id to kb_trace when you need the history. Rejected and unresolved records arrive whole: what was turned down, and what is still open, is the part a diff cannot show you. Refuses with a count rather than truncating when the base is too large \u2014 a truncated base is indistinguishable from a complete one, and would have you conclude something was never decided from a slice you did not know was a slice. Call at the point of use, not once per session: a base loaded early is summarised away by compaction, so if the visible context holds no records from this base and the question at hand is one it might govern, load before answering \u2014 never conclude nothing was decided from a context with no KB content in it. This tool (with kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.\n\nThat refusal is the default guardrail, meant for an agent that would otherwise burn its whole context on one call. `all` bypasses it and loads everything regardless of size: a deliberate operator with the budget to spend, not something to reach for automatically. It is mutually exclusive with `budgetTokens`. When the reader does not need everything, kb_query or a narrower `type` filter is the better fit than either.",
   input: import_zod11.z.object({
     bundlePath,
     type: import_zod11.z.enum(KB_RECORD_TYPES).optional(),
-    budgetTokens: import_zod11.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000.")
+    budgetTokens: import_zod11.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
+    all: import_zod11.z.boolean().optional().describe(
+      "Load the entire base regardless of size. The deliberate-operator escape hatch; mutually exclusive with budgetTokens."
+    )
+  }).refine((value) => !(value.all && value.budgetTokens !== void 0), {
+    message: "all and budgetTokens are mutually exclusive: pass a ceiling or none, not both."
   }),
   fromArgv: (argv, path) => {
     const budget = argvFlag(argv, "--budget");
     return {
       bundlePath: path,
-      ...argv[1] && argv[1] !== "--budget" ? { type: argv[1] } : {},
-      ...budget ? { budgetTokens: Number(budget) } : {}
+      ...argv[1] && !argv[1].startsWith("--") ? { type: argv[1] } : {},
+      ...budget ? { budgetTokens: Number(budget) } : {},
+      ...argv.includes("--all") ? { all: true } : {}
     };
   },
-  run: async ({ store }, { bundlePath: path, type, budgetTokens }) => {
+  run: async ({ store }, { bundlePath: path, type, budgetTokens, all }) => {
     const result = await store.load(path, {
       ...type ? { type } : {},
-      ...budgetTokens ? { budgetTokens } : {}
+      ...budgetTokens ? { budgetTokens } : {},
+      ...all ? { all } : {}
     });
     if (!result.loaded) return result;
     return {
@@ -2389,8 +2466,37 @@ var validateCommand = define({
   failsWhen: (result) => Array.isArray(result) && result.length > 0
 });
 
-// src/commands/write.ts
+// src/commands/verify.ts
 var import_zod26 = require("zod");
+var verifyCommand = define({
+  name: "verify",
+  tool: "kb_verify",
+  usage: "verify <concept-id> --note <text>",
+  description: "Append one verified[] event \u2014 who checked the record, when, and what the check found. Appends only; prior events are never rewritten. A record's own generator is refused unless the actor is human: re-reading your own output is not an independent check.",
+  input: import_zod26.z.object({
+    bundlePath,
+    conceptId,
+    note: import_zod26.z.string().refine((s) => s.trim().length > 0, {
+      message: "note must say what the check found"
+    })
+  }),
+  fromArgv: (argv, path) => ({
+    bundlePath: path,
+    conceptId: argv[1],
+    note: argvFlag(argv, "--note")
+  }),
+  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, note }) => {
+    await assertBaseNotFrozen(process.cwd(), path);
+    const record = await store.verify(path, id, note, actor, now());
+    return {
+      conceptId: record.conceptId,
+      verified: record.frontmatter.verified?.length ?? 0
+    };
+  }
+});
+
+// src/commands/write.ts
+var import_zod27 = require("zod");
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
@@ -2404,9 +2510,9 @@ var writeCommand = define({
     "- Prefer a new record over overloading an existing one, and keep each short. A record nobody finishes reading is not durable memory.",
     "- Records are never deleted; supersede instead, so the earlier reasoning stays inspectable."
   ].join("\n"),
-  input: import_zod26.z.object({
+  input: import_zod27.z.object({
     bundlePath,
-    type: import_zod26.z.enum(KB_RECORD_TYPES),
+    type: import_zod27.z.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -2430,7 +2536,7 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-var import_zod27 = require("zod");
+var import_zod28 = require("zod");
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
@@ -2443,7 +2549,7 @@ var writeDecisionCommand = define({
     "- `alternative` is what you turned down and why, not a list of everything considered.",
     "- A reference to material you read goes in `sources`; a reference to code goes in `anchors`; a reference to another record goes in `relatedConceptIds`."
   ].join("\n"),
-  input: import_zod27.z.object({ bundlePath, input: decisionInputSchema }),
+  input: import_zod28.z.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -2471,6 +2577,7 @@ var KB_COMMANDS = [
   statusCommand,
   supersedeCommand,
   answerCommand,
+  verifyCommand,
   loadCommand,
   queryCommand,
   traceCommand,
@@ -2634,6 +2741,7 @@ function usage() {
   KbPinsMalformedError,
   KbRecordAlreadyExistsError,
   KbRecordNotFoundError,
+  KbSelfVerificationError,
   KbStore,
   KbWriteConflictError,
   LOG_FILE,
@@ -2664,6 +2772,7 @@ function usage() {
   kbLogEntrySchema,
   kbRecordFrontmatterSchema,
   kbSourceSchema,
+  kbVerifiedEventSchema,
   listPins,
   loadQmd,
   matchToDiff,