@schift-io/knowledge-scope 0.1.0 → 0.2.0

package/dist/index.js

@@ -4199,6 +4199,10 @@ var SearchProviderSchema = exports_external.object({
   kind: exports_external.literal("schift_search"),
   indexRef: KnowledgeScopeIdentifierSchema
 }).strict();
+var LocalDocumentsProviderSchema = exports_external.object({
+  kind: exports_external.literal("local_documents"),
+  indexRef: KnowledgeScopeIdentifierSchema
+}).strict();
 var WebProviderSchema = exports_external.object({
   kind: exports_external.literal("web_search"),
   provider: exports_external.enum(["customer", "schift"])
@@ -4207,6 +4211,7 @@ var QueryProviderSchema = exports_external.discriminatedUnion("kind", [
   RecordsProviderSchema,
   ConnectorProviderSchema,
   SearchProviderSchema,
+  LocalDocumentsProviderSchema,
   WebProviderSchema
 ]).readonly();
 var QueryCapabilitySchema = exports_external.object({
@@ -4315,6 +4320,7 @@ var CandidateProviderEvidenceSchema = exports_external.discriminatedUnion("kind"
     auditPersisted: exports_external.boolean()
   }).strict(),
   SearchProviderSchema,
+  LocalDocumentsProviderSchema,
   WebProviderSchema
 ]).readonly();
 var CandidateEnvelopeSchema = exports_external.object({
@@ -4416,6 +4422,7 @@ var bindingMatchesCapability = (binding, capability) => {
     case "open_connector_action":
       return binding.providerRef === capability.provider.actionId && binding.connectorRef === capability.provider.connectorRef;
     case "schift_search":
+    case "local_documents":
       return binding.providerRef === capability.provider.indexRef && binding.connectorRef === undefined;
     case "web_search":
       return binding.providerRef === capability.provider.provider && binding.connectorRef === undefined;
@@ -4559,6 +4566,10 @@ var ProviderEvidenceSchema = exports_external.discriminatedUnion("kind", [
     kind: exports_external.literal("schift_search"),
     indexRef: KnowledgeScopeIdentifierSchema
   }).strict(),
+  exports_external.object({
+    kind: exports_external.literal("local_documents"),
+    indexRef: KnowledgeScopeIdentifierSchema
+  }).strict(),
   exports_external.object({
     kind: exports_external.literal("web_search"),
     provider: exports_external.enum(["customer", "schift"])
@@ -4688,6 +4699,8 @@ var providerEvidenceDenial = (capability, binding, candidate) => {
       return evidence.auditPersisted ? undefined : "connector_audit_missing";
     case "schift_search":
       return evidence.kind === "schift_search" && evidence.indexRef === capability.provider.indexRef ? undefined : "provider_evidence_mismatch";
+    case "local_documents":
+      return evidence.kind === "local_documents" && evidence.indexRef === capability.provider.indexRef ? undefined : "provider_evidence_mismatch";
     case "web_search":
       return evidence.kind === "web_search" && evidence.provider === capability.provider.provider ? undefined : "provider_evidence_mismatch";
   }
@@ -5595,21 +5608,170 @@ var createHttpProviderExecutionPort = (options) => ({
           return parsed.data;
         });
       }
+      case "local_documents":
       case "web_search":
         throw new HttpProviderAdapterError("invalid_configuration");
     }
   }
 });
 
+// src/local-documents/files.ts
+import { constants } from "node:fs";
+import { lstat, open, opendir, realpath } from "node:fs/promises";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
+class LocalDocumentError extends Error {
+  code;
+  name = "LocalDocumentError";
+  constructor(code) {
+    super({
+      local_source_invalid: "Select regular UTF-8 Markdown (.md) or text (.txt) files; symlinks, hardlinks and binary files are unsupported.",
+      local_limit_exceeded: "Local documents exceed the supported file, byte, or chunk limits.",
+      local_snapshot_invalid: "Local document snapshot is missing, unsafe, or corrupt; ingest the source again.",
+      local_scope_invalid: "Local documents require the mounted tenant and document binding; filters and narrowed scopes are unsupported."
+    }[code]);
+    this.code = code;
+  }
+}
+var LOCAL_LIMITS = { files: 100, fileBytes: 1048576, totalBytes: 8388608, snapshotBytes: 16777216, chunks: 4000, entries: 2000, depth: 16, chunkCharacters: 2000 };
+var identityMatches = (left, right) => left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs && right.nlink === 1;
+var checkDirectories = async (directories) => {
+  for (const directory of directories) {
+    const current = await lstat(directory.path);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino || await realpath(directory.path) !== directory.path)
+      throw new LocalDocumentError("local_source_invalid");
+  }
+};
+var mapLocalFileError = (error, ownerOnly) => {
+  if (error instanceof Error && "code" in error && typeof error.code === "string" && ["ENOENT", "ELOOP", "EACCES", "EPERM", "ENOTDIR", "EISDIR"].includes(error.code)) {
+    throw new LocalDocumentError(ownerOnly ? "local_snapshot_invalid" : "local_source_invalid");
+  }
+  throw error;
+};
+var readBounded = async (source, maxBytes, ownerOnly = false) => {
+  try {
+    return await readFileContents(source, maxBytes, ownerOnly);
+  } catch (error) {
+    return mapLocalFileError(error, ownerOnly);
+  }
+};
+var readFileContents = async (source, maxBytes, ownerOnly) => {
+  if (!constants.O_NOFOLLOW)
+    throw new LocalDocumentError("local_source_invalid");
+  const path = typeof source === "string" ? source : source.path;
+  if (typeof source !== "string") {
+    await checkDirectories(source.ancestors);
+    const currentPath = await realpath(path);
+    const inside = relative(source.root, currentPath);
+    if (currentPath !== path || inside === ".." || inside.startsWith(`..${sep}`))
+      throw new LocalDocumentError("local_source_invalid");
+  }
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const before = await handle.stat();
+    if (typeof source !== "string") {
+      if (!identityMatches(source.identity, before))
+        throw new LocalDocumentError("local_source_invalid");
+      await checkDirectories(source.ancestors);
+    }
+    if (!before.isFile() || ownerOnly && ((before.mode & 63) !== 0 || process.getuid !== undefined && before.uid !== process.getuid()))
+      throw new LocalDocumentError("local_snapshot_invalid");
+    if (before.size > maxBytes)
+      throw new LocalDocumentError("local_limit_exceeded");
+    const buffer = Buffer.alloc(maxBytes + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+      if (bytesRead === 0)
+        break;
+      length += bytesRead;
+    }
+    const after = await handle.stat();
+    if (length > maxBytes)
+      throw new LocalDocumentError("local_limit_exceeded");
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || typeof source !== "string" && !identityMatches(source.identity, after))
+      throw new LocalDocumentError("local_source_invalid");
+    if (typeof source !== "string")
+      await checkDirectories(source.ancestors);
+    const text = decodeUtf8Strict(buffer.subarray(0, length));
+    if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/u.test(text))
+      throw new LocalDocumentError("local_source_invalid");
+    return text;
+  } finally {
+    await handle.close();
+  }
+};
+var collectFiles = async (source) => {
+  try {
+    return await collectSourceFiles(source);
+  } catch (error) {
+    return mapLocalFileError(error, false);
+  }
+};
+var collectSourceFiles = async (source) => {
+  const selected = resolve(source);
+  const selectedMetadata = await lstat(selected);
+  if (selectedMetadata.isSymbolicLink())
+    throw new LocalDocumentError("local_source_invalid");
+  const root = await realpath(selected);
+  const rootMetadata = await lstat(root);
+  if (selectedMetadata.dev !== rootMetadata.dev || selectedMetadata.ino !== rootMetadata.ino)
+    throw new LocalDocumentError("local_source_invalid");
+  const boundary = rootMetadata.isDirectory() ? root : dirname(root);
+  const parentMetadata = await lstat(dirname(boundary));
+  const parents = [{ path: dirname(boundary), dev: parentMetadata.dev, ino: parentMetadata.ino }];
+  const files = [];
+  let entries = 1;
+  const visit = async (path, depth, ancestors) => {
+    await checkDirectories(ancestors);
+    if (entries > LOCAL_LIMITS.entries || depth > LOCAL_LIMITS.depth)
+      throw new LocalDocumentError("local_limit_exceeded");
+    const metadata = await lstat(path);
+    if (metadata.isSymbolicLink())
+      throw new LocalDocumentError("local_source_invalid");
+    if (metadata.isDirectory()) {
+      const directories = [...ancestors, { path, dev: metadata.dev, ino: metadata.ino }];
+      await checkDirectories(directories);
+      const directory = await opendir(path);
+      for await (const child of directory) {
+        entries += 1;
+        if (entries > LOCAL_LIMITS.entries)
+          throw new LocalDocumentError("local_limit_exceeded");
+        if (child.name.startsWith(".") || child.name === "node_modules")
+          continue;
+        await visit(join(path, child.name), depth + 1, directories);
+      }
+      await checkDirectories(directories);
+      return;
+    }
+    if (!metadata.isFile())
+      throw new LocalDocumentError("local_source_invalid");
+    if (![".md", ".txt"].includes(extname(path).toLowerCase())) {
+      if (depth === 0)
+        throw new LocalDocumentError("local_source_invalid");
+      return;
+    }
+    if (metadata.nlink !== 1 || await realpath(path) !== path)
+      throw new LocalDocumentError("local_source_invalid");
+    files.push({ path, root: boundary, identity: metadata, ancestors });
+    if (files.length > LOCAL_LIMITS.files)
+      throw new LocalDocumentError("local_limit_exceeded");
+  };
+  const boundaryMetadata = await lstat(boundary);
+  await visit(root, 0, rootMetadata.isDirectory() ? parents : [...parents, { path: boundary, dev: boundaryMetadata.dev, ino: boundaryMetadata.ino }]);
+  if (files.length === 0)
+    throw new LocalDocumentError("local_source_invalid");
+  return files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+};
+
 // src/application.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/authorization.ts
 import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { constants } from "node:fs";
-import { chmod, link, lstat, mkdir, open, rm } from "node:fs/promises";
+import { constants as constants2 } from "node:fs";
+import { chmod, link, lstat as lstat2, mkdir, open as open2, rm } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 var AuthorizationSubjectSchema = CandidateEnvelopeSchema.unwrap().pick({
   srn: true,
   sourceId: true,
@@ -5652,18 +5814,18 @@ var authorizationSubjectFromCandidate = (candidate) => AuthorizationSubjectSchem
 });
 var hasCode = (value, code) => value !== null && typeof value === "object" && ("code" in value) && value.code === code;
 var assertOwnerOnly = async (path, directory) => {
-  const metadata = await lstat(path);
+  const metadata = await lstat2(path);
   if (metadata.isSymbolicLink() || (metadata.mode & 63) !== 0 || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
     throw productError("state_permissions_invalid");
   }
 };
 var readOwnerOnlyKey = async (path) => {
-  if (typeof constants.O_NOFOLLOW !== "number" || constants.O_NOFOLLOW === 0) {
+  if (typeof constants2.O_NOFOLLOW !== "number" || constants2.O_NOFOLLOW === 0) {
     throw productError("state_permissions_invalid");
   }
   let handle;
   try {
-    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    handle = await open2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
   } catch (error) {
     if (hasCode(error, "ELOOP"))
       throw productError("state_permissions_invalid");
@@ -5688,8 +5850,8 @@ class KnowledgeScopeAuthorization {
   faults;
   constructor(options = {}) {
     const environment = options.environment ?? process.env;
-    this.home = options.home ?? environment["SCHIFT_KS_HOME"] ?? join(homedir(), ".schift", "knowledge-scope");
-    this.keyPath = join(this.home, "authorization.key");
+    this.home = options.home ?? environment["SCHIFT_KS_HOME"] ?? join2(homedir(), ".schift", "knowledge-scope");
+    this.keyPath = join2(this.home, "authorization.key");
     this.faults = options.faults;
   }
   async issue(subject) {
@@ -5727,8 +5889,8 @@ class KnowledgeScopeAuthorization {
     return key;
   }
   async installKeyIfAbsent() {
-    const temporaryPath = join(this.home, `.authorization-key-${process.pid}-${randomUUID()}.tmp`);
-    const handle = await open(temporaryPath, "wx", 384);
+    const temporaryPath = join2(this.home, `.authorization-key-${process.pid}-${randomUUID()}.tmp`);
+    const handle = await open2(temporaryPath, "wx", 384);
     try {
       await handle.writeFile(randomBytes(32));
       await handle.sync();
@@ -5741,7 +5903,7 @@ class KnowledgeScopeAuthorization {
           throw error;
         return;
       }
-      const directory = await open(this.home, "r");
+      const directory = await open2(this.home, "r");
       try {
         await directory.sync();
       } finally {
@@ -6108,6 +6270,8 @@ var providerReference = (capability) => {
       return capability.provider.actionId;
     case "schift_search":
       return capability.provider.indexRef;
+    case "local_documents":
+      return capability.provider.indexRef;
     case "web_search":
       return capability.provider.provider;
   }
@@ -6454,6 +6618,8 @@ var createKnowledgeScopeApi = (options) => {
         return errorResponse(error.code, error.status);
       if (error instanceof HttpProviderAdapterError)
         return errorResponse(error.code, 502);
+      if (error instanceof LocalDocumentError)
+        return errorResponse(error.code, error.code === "local_snapshot_invalid" ? 503 : 400);
       if (error instanceof KnowledgeScopeProductError)
         return errorResponse(error.code, 400);
       if (error instanceof SyntaxError || error instanceof URIError)
@@ -6513,11 +6679,11 @@ var serveKnowledgeScopeApi = async (options) => {
       writeNodeResponse(outgoing, errorResponse(code, status));
     });
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
     server.listen(options.port ?? 8787, host, () => {
       server.off("error", reject);
-      resolve();
+      resolve2();
     });
   });
   const address = server.address();
@@ -6594,8 +6760,8 @@ var createRemoteKnowledgeScopeApplication = (apiUrl, request = globalThis.fetch,
 };
 var isJsonObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 // src/cli.ts
-import { mkdir as mkdir3, open as open2 } from "node:fs/promises";
-import { basename, resolve as resolve2 } from "node:path";
+import { mkdir as mkdir5, open as open4 } from "node:fs/promises";
+import { basename as basename2, resolve as resolve4 } from "node:path";
 
 // src/cli-options.ts
 class CliUsageError extends Error {
@@ -6612,12 +6778,13 @@ var specifications = {
   lock: { count: 1, values: [] },
   mount: { count: 1, values: ["--bindings", "--api-url"] },
   inspect: { count: 1, values: ["--api-url"] },
+  query: { count: 1, values: ["--query", "--api-url"] },
   run: { count: 2, values: ["--input", "--api-url"] },
   "run-batch": { count: 1, values: ["--input", "--api-url"] },
   admit: { count: 1, values: ["--candidate", "--api-url"] },
   unmount: { count: 1, values: ["--expected-revision", "--api-url"] },
   serve: { count: 0, values: ["--host", "--port"] },
-  quickstart: { count: 1, values: ["--index", "--tenant", "--query"] },
+  quickstart: { count: 1, values: ["--source", "--index", "--tenant", "--query"] },
   doctor: { count: 1, values: ["--query"], flags: ["--probe"] }
 };
 var parseCliOptions = (command, args) => {
@@ -6652,12 +6819,14 @@ var parseCliOptions = (command, args) => {
     throw new CliUsageError("argument_invalid");
   if (command === "doctor" && seen.has("--probe") !== seen.has("--query"))
     throw new CliUsageError("argument_invalid");
+  if (command === "quickstart" && seen.has("--source") && seen.has("--index"))
+    throw new CliUsageError("argument_invalid");
   return positional;
 };
 
 // src/quickstart.ts
 import { mkdir as mkdir2, writeFile } from "node:fs/promises";
-import { join as join2, resolve } from "node:path";
+import { join as join3, resolve as resolve2 } from "node:path";
 
 // src/onboarding-config.ts
 class OnboardingError extends Error {
@@ -6704,7 +6873,7 @@ var quickstart = async (request, dependencies, environment) => {
   });
   if (!definition.success)
     throw new OnboardingError("argument_invalid");
-  const directory = resolve(request.directory);
+  const directory = resolve2(request.directory);
   try {
     await mkdir2(directory, { mode: 448 });
   } catch (error) {
@@ -6712,20 +6881,20 @@ var quickstart = async (request, dependencies, environment) => {
       throw new OnboardingError("directory_exists");
     throw error;
   }
-  const pack = join2(directory, "pack");
-  const bindingsPath = join2(directory, "bindings.json");
-  const inputPath = join2(directory, "input.json");
+  const pack = join3(directory, "pack");
+  const bindingsPath = join3(directory, "bindings.json");
+  const inputPath = join3(directory, "input.json");
   let installationId;
   let artifactsComplete = false;
   const recovery = () => installationId === undefined ? ["schift-ks", "mount", pack, "--bindings", bindingsPath] : ["schift-ks", "run", installationId, "search", "--input", inputPath];
   try {
-    await mkdir2(join2(pack, "schemas"), { recursive: true, mode: 448 });
+    await mkdir2(join3(pack, "schemas"), { recursive: true, mode: 448 });
     const bindings = { scopeAuthority: scopeAuthority.data, sourceBindings: [{ sourceId: "project-documents", sourceClass: "document", authority: "approved", permissionMode: "mirrored", providerRef: request.index, operationIds: ["search"] }] };
     const input = { effectiveScope: { tenant: request.tenant }, input: { query: request.query } };
     const files = {
-      [join2(pack, "scope.json")]: json(definition.data),
-      [join2(pack, "schemas/input.json")]: { type: "object", required: ["query"], properties: { query: { type: "string", minLength: 1, maxLength: 8192 } }, additionalProperties: false },
-      [join2(pack, "schemas/result.json")]: { type: "object", required: ["text"], properties: { text: { type: "string", minLength: 1 } }, additionalProperties: true },
+      [join3(pack, "scope.json")]: json(definition.data),
+      [join3(pack, "schemas/input.json")]: { type: "object", required: ["query"], properties: { query: { type: "string", minLength: 1, maxLength: 8192 } }, additionalProperties: false },
+      [join3(pack, "schemas/result.json")]: { type: "object", required: ["text"], properties: { text: { type: "string", minLength: 1 } }, additionalProperties: true },
       [bindingsPath]: json(bindings),
       [inputPath]: input
     };
@@ -6736,7 +6905,7 @@ var quickstart = async (request, dependencies, environment) => {
     artifactsComplete = true;
     const mounted = KnowledgeScopeMountSchema.parse(await dependencies.embedded.mount(await dependencies.authoring.mountPayload(pack, bindingsPath)));
     installationId = mounted.installationId;
-    await writeFile(join2(directory, "installation.json"), `${JSON.stringify(mounted)}
+    await writeFile(join3(directory, "installation.json"), `${JSON.stringify(mounted)}
 `, { flag: "wx", mode: 384 });
     const result = await dependencies.embedded.run({ installationId, operationId: "search", ...input });
     return { directory, installationId, operationId: "search", result, recovery: recovery(), status: "completed" };
@@ -6746,6 +6915,266 @@ var quickstart = async (request, dependencies, environment) => {
   }
 };
 
+// src/local-quickstart.ts
+import { mkdir as mkdir4, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join5, resolve as resolve3 } from "node:path";
+
+// src/local-documents/index.ts
+import { mkdir as mkdir3, lstat as lstat3, open as open3, link as link2, rm as rm2 } from "node:fs/promises";
+import { basename, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir as homedir2 } from "node:os";
+import { randomUUID as randomUUID3 } from "node:crypto";
+
+// src/local-documents/snapshot.ts
+import { createHash as createHash3 } from "node:crypto";
+import { pathToFileURL } from "node:url";
+var DocumentSchema = exports_external.object({ uri: exports_external.string().url(), text: exports_external.string().max(LOCAL_LIMITS.fileBytes), revision: exports_external.string().regex(/^sha256:[a-f0-9]{64}$/) }).strict().readonly();
+var SnapshotSchema = exports_external.object({ version: exports_external.literal(1), capturedAt: exports_external.string().datetime(), documents: exports_external.array(DocumentSchema).min(1).max(LOCAL_LIMITS.files).readonly() }).strict().readonly();
+var digest2 = (value) => createHash3("sha256").update(value).digest("hex");
+var snapshotId = (snapshot) => `local:${digest2(canonicalJson2(snapshot))}`;
+var buildSnapshot = async (source) => {
+  const documents = [];
+  let bytes = 0;
+  for (const file of await collectFiles(source)) {
+    const text = await readBounded(file, LOCAL_LIMITS.fileBytes);
+    bytes += Buffer.byteLength(text);
+    if (bytes > LOCAL_LIMITS.totalBytes)
+      throw new LocalDocumentError("local_limit_exceeded");
+    documents.push({ uri: pathToFileURL(file.path).href, text, revision: `sha256:${digest2(text)}` });
+  }
+  return { version: 1, capturedAt: new Date().toISOString(), documents };
+};
+var chunksFor = (snapshot) => {
+  const chunks = [];
+  let bytes = 0;
+  for (const document of snapshot.documents) {
+    const uri = new URL(document.uri);
+    if (uri.protocol !== "file:" || uri.host !== "" || uri.search !== "" || uri.hash !== "" || document.revision !== `sha256:${digest2(document.text)}`)
+      throw new LocalDocumentError("local_snapshot_invalid");
+    bytes += Buffer.byteLength(document.text);
+    if (bytes > LOCAL_LIMITS.totalBytes)
+      throw new LocalDocumentError("local_limit_exceeded");
+    const lines = document.text.split(/\r?\n/u);
+    let text = "";
+    let start = 1;
+    let end = 1;
+    const flush = () => {
+      if (text.trim().length > 0)
+        chunks.push({ document, text, lineStart: start, lineEnd: end, id: `chunk:${digest2(`${document.uri}:${start}:${end}:${text}`)}` });
+      text = "";
+      if (chunks.length > LOCAL_LIMITS.chunks)
+        throw new LocalDocumentError("local_limit_exceeded");
+    };
+    lines.forEach((line, offset) => {
+      if (line.length > LOCAL_LIMITS.chunkCharacters)
+        throw new LocalDocumentError("local_limit_exceeded");
+      if (text.length + line.length + 1 > LOCAL_LIMITS.chunkCharacters)
+        flush();
+      if (text.length === 0)
+        start = offset + 1;
+      text += `${text.length === 0 ? "" : `
+`}${line}`;
+      end = offset + 1;
+    });
+    flush();
+  }
+  return chunks;
+};
+var lexicalTerms = (text) => {
+  const words = text.normalize("NFKC").toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+  return [...new Set(words.flatMap((word) => /[가-힣]/u.test(word) && word.length > 2 ? [word, ...Array.from({ length: word.length - 1 }, (_, index) => word.slice(index, index + 2))] : [word]))];
+};
+
+// src/local-documents/index.ts
+var QuerySchema = exports_external.object({ query: exports_external.string().min(1).max(8192) }).strict();
+var assertPrivateDirectory = async (path) => {
+  await mkdir3(path, { recursive: true, mode: 448 });
+  const info = await lstat3(path);
+  if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 63) !== 0 || process.getuid !== undefined && info.uid !== process.getuid())
+    throw new LocalDocumentError("local_snapshot_invalid");
+};
+
+class LocalDocumentStore {
+  home;
+  constructor(options = {}) {
+    this.home = options.home ?? (options.environment ?? process.env)["SCHIFT_KS_HOME"] ?? join4(homedir2(), ".schift", "knowledge-scope");
+  }
+  async directory() {
+    try {
+      await assertPrivateDirectory(this.home);
+      const directory = join4(this.home, "local-documents");
+      await assertPrivateDirectory(directory);
+      return directory;
+    } catch (error) {
+      return mapLocalFileError(error, true);
+    }
+  }
+  async ingest(sourcePath) {
+    const snapshot = await buildSnapshot(sourcePath);
+    const chunks = chunksFor(snapshot);
+    if (chunks.length === 0)
+      throw new LocalDocumentError("local_source_invalid");
+    const indexRef = snapshotId(snapshot);
+    const directory = await this.directory();
+    const temporary = join4(directory, `.ingest-${randomUUID3()}`);
+    const serialized = canonicalJson2(snapshot);
+    if (Buffer.byteLength(serialized) > LOCAL_LIMITS.snapshotBytes)
+      throw new LocalDocumentError("local_limit_exceeded");
+    const handle = await open3(temporary, "wx", 384);
+    try {
+      await handle.writeFile(serialized, "utf8");
+      await handle.sync();
+      try {
+        await link2(temporary, join4(directory, `${indexRef.slice(6)}.json`));
+      } catch (error) {
+        if (!(error instanceof Error && ("code" in error) && error.code === "EEXIST"))
+          throw error;
+      }
+    } finally {
+      await handle.close();
+      await rm2(temporary, { force: true });
+    }
+    return { indexRef, documentCount: snapshot.documents.length, chunkCount: chunks.length };
+  }
+  async read(indexRef) {
+    if (!/^local:[a-f0-9]{64}$/u.test(indexRef))
+      throw new LocalDocumentError("local_snapshot_invalid");
+    const directory = await this.directory();
+    const text = await readBounded(join4(directory, `${indexRef.slice(6)}.json`), LOCAL_LIMITS.snapshotBytes, true);
+    const parsed = SnapshotSchema.safeParse(parseJsonText(text, "local snapshot", { maxBytes: LOCAL_LIMITS.snapshotBytes }));
+    if (!parsed.success || snapshotId(parsed.data) !== indexRef)
+      throw new LocalDocumentError("local_snapshot_invalid");
+    return parsed.data;
+  }
+  async execute(context) {
+    const { capability, binding, request, mount } = context;
+    if (mount.state !== "mounted" || !mount.sourceBindings.some((entry) => canonicalJson2(entry) === canonicalJson2(binding)) || capability.provider.kind !== "local_documents" || binding.sourceClass !== "document" || binding.providerRef !== capability.provider.indexRef || binding.connectorRef !== undefined || binding.permissionMode !== "static" || !binding.operationIds.includes(capability.operationId) || request.operationId !== capability.operationId || request.installationId !== mount.installationId || request.effectiveScope.tenant !== mount.scopeAuthority.tenant || request.effectiveScope.namespace !== undefined || request.effectiveScope.subject !== undefined || request.effectiveScope.session !== undefined || (capability.requiredProviderScopes?.length ?? 0) > 0 || Object.keys(request.filters ?? {}).length > 0)
+      throw new LocalDocumentError("local_scope_invalid");
+    const query = QuerySchema.safeParse(request.input);
+    if (!query.success || !context.validateInput(request.input).valid)
+      throw new LocalDocumentError("local_source_invalid");
+    const snapshot = await this.read(capability.provider.indexRef);
+    const terms = lexicalTerms(query.data.query);
+    const ranked = chunksFor(snapshot).map((chunk) => {
+      const tokens = new Set(lexicalTerms(chunk.text));
+      return { chunk, score: terms.filter((term) => tokens.has(term)).length };
+    }).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score || a.chunk.id.localeCompare(b.chunk.id));
+    const results = [];
+    let bytes = 0;
+    for (const { chunk, score } of ranked.slice(0, Math.min(capability.limits?.maxRows ?? 8, 100))) {
+      const sourcePath = fileURLToPath(chunk.document.uri);
+      const documentId = `doc:${digest2(chunk.document.uri)}`;
+      const payload = { text: chunk.text, sourceId: binding.sourceId, documentId, sourcePath, chunkId: chunk.id, lineStart: chunk.lineStart, lineEnd: chunk.lineEnd, score };
+      if (!context.validateResult(payload).valid)
+        throw new LocalDocumentError("local_source_invalid");
+      const result = ProviderResultSchema.parse({
+        resultId: chunk.id,
+        srn: `srn:local:${chunk.id.slice(6)}`,
+        revision: chunk.document.revision,
+        freshness: snapshot.capturedAt,
+        payload,
+        citation: { uri: `schift://local-documents/${capability.provider.indexRef}/${documentId}#L${chunk.lineStart}-L${chunk.lineEnd}`, label: `${basename(sourcePath)}:L${chunk.lineStart}-L${chunk.lineEnd}` },
+        providerScopes: [],
+        providerEvidence: { kind: "local_documents", indexRef: capability.provider.indexRef }
+      });
+      bytes += Buffer.byteLength(canonicalJson2(result));
+      if (bytes > Math.min(capability.limits?.maxResultBytes ?? 1048576, 8388608))
+        throw new LocalDocumentError("local_limit_exceeded");
+      results.push(result);
+    }
+    return results;
+  }
+}
+
+// src/local-quickstart.ts
+var localQuickstart = async (request, dependencies) => {
+  const importer = dependencies.localDocuments;
+  if (importer === undefined)
+    throw new OnboardingError("local_import_unavailable");
+  const scopeAuthority = ScopeAuthoritySchema.safeParse({ organizationId: "local-organization", tenant: request.tenant });
+  if (!scopeAuthority.success || request.query.trim().length === 0 || request.query.length > 8192)
+    throw new OnboardingError("argument_invalid");
+  const directory = resolve3(request.directory);
+  try {
+    await mkdir4(directory, { mode: 448 });
+  } catch (error) {
+    if (error !== null && typeof error === "object" && "code" in error && error.code === "EEXIST")
+      throw new OnboardingError("directory_exists", { nextAction: "Choose a new workspace directory; your existing files were not changed." });
+    throw error;
+  }
+  const pack = join5(directory, "pack");
+  const bindingsPath = join5(directory, "bindings.json");
+  let installationId;
+  let artifactsComplete = false;
+  try {
+    const imported = await importer.ingest(request.source);
+    const definition = KnowledgeScopeDefinitionSchema.parse({
+      packId: "local-project",
+      version: "0.1.0",
+      responsibility: "project-context",
+      scope: { root: "tenant", descendants: ["namespace", "subject", "session"] },
+      authority: { allowed: ["read", "draft"], forbidden: ["send", "approve", "mutate_source", "workflow"], precedence: ["primary", "operational", "approved", "observed", "derived"] },
+      capabilities: [{ operationId: "search", provider: { kind: "local_documents", indexRef: imported.indexRef }, inputSchemaRef: "schemas/input.json", resultSchemaRef: "schemas/result.json", limits: { maxRows: 8, maxResultBytes: 131072 } }],
+      contextPolicy: { mustConsider: [{ id: "project-evidence", minEvidence: 1, selector: { sourceClasses: ["document"] } }], mayConsider: [], mustNotUse: [{ id: "derived-context", selector: { authorities: ["derived"] } }] },
+      evidence: { requireCitation: true, freshness: { defaultMaxAgeSeconds: 86400 }, coverageAssertions: ["project-evidence"] }
+    });
+    const bindings = { scopeAuthority: scopeAuthority.data, sourceBindings: [{ sourceId: "project-documents", sourceClass: "document", authority: "approved", permissionMode: "static", providerRef: imported.indexRef, operationIds: ["search"] }] };
+    const input = { effectiveScope: { tenant: request.tenant }, input: { query: request.query } };
+    await mkdir4(join5(pack, "schemas"), { recursive: true, mode: 448 });
+    const files = {
+      [join5(pack, "scope.json")]: parseJsonText(JSON.stringify(definition), "local definition"),
+      [join5(pack, "schemas/input.json")]: { type: "object", required: ["query"], properties: { query: { type: "string", minLength: 1, maxLength: 8192 } }, additionalProperties: false },
+      [join5(pack, "schemas/result.json")]: { type: "object", required: ["text"], properties: { text: { type: "string", minLength: 1 } }, additionalProperties: true },
+      [bindingsPath]: bindings,
+      [join5(directory, "input.json")]: input
+    };
+    for (const [path, value] of Object.entries(files))
+      await writeFile2(path, `${canonicalJson2(value)}
+`, { flag: "wx", mode: 384 });
+    await dependencies.authoring.lock(pack);
+    artifactsComplete = true;
+    const mounted = KnowledgeScopeMountSchema.parse(await dependencies.embedded.mount(await dependencies.authoring.mountPayload(pack, bindingsPath)));
+    installationId = mounted.installationId;
+    await writeFile2(join5(directory, "installation.json"), `${JSON.stringify(mounted)}
+`, { flag: "wx", mode: 384 });
+    const result = await dependencies.embedded.run({ installationId, operationId: "search", expectedRevision: mounted.revision, ...input });
+    return {
+      directory,
+      installationId,
+      tenant: request.tenant,
+      operationId: "search",
+      documentCount: imported.documentCount,
+      chunkCount: imported.chunkCount,
+      result,
+      nextQuery: ["schift-ks", "query", installationId, "--query", "Your next question"],
+      status: "completed",
+      storage: "local_snapshot",
+      note: "Documents stay on this computer. Search uses keywords, not semantic embeddings. Re-import into a new workspace to refresh the snapshot."
+    };
+  } catch (error) {
+    const code = error instanceof LocalDocumentError || error instanceof OnboardingError || error instanceof KnowledgeScopeProductError || error instanceof KnowledgeScopeApiError ? error.code : "local_quickstart_failed";
+    const recovery = installationId !== undefined ? ["schift-ks", "query", installationId, "--query", request.query] : artifactsComplete ? ["schift-ks", "mount", pack, "--bindings", bindingsPath] : ["schift-ks", "quickstart", "<new-workspace>", "--source", "<file-or-directory>", "--query", "<question>"];
+    throw new OnboardingError(code, { directory, artifactsComplete, recovery, nextAction: artifactsComplete ? "Use the recovery command to retry; your source files were not changed." : "Check that your source contains readable .md or .txt files, then retry with a new workspace. Your source files were not changed.", ...installationId === undefined ? {} : { installationId } });
+  }
+};
+
+// src/local-query.ts
+var queryProject = async (request, application) => {
+  if (request.query.trim().length === 0 || request.query.length > 8192)
+    throw new OnboardingError("argument_invalid");
+  const { mount } = exports_external.object({ mount: KnowledgeScopeMountSchema }).parse(await application.inspect(request.installationId));
+  if (mount.installationId !== request.installationId)
+    throw new OnboardingError("installation_mismatch");
+  return application.run({
+    installationId: mount.installationId,
+    operationId: "search",
+    effectiveScope: { tenant: mount.scopeAuthority.tenant },
+    expectedRevision: mount.revision,
+    input: { query: request.query }
+  });
+};
+
 // src/doctor-config.ts
 var ActionsSchema = exports_external.array(exports_external.object({ connectorRef: exports_external.string().min(1), connectorAlias: exports_external.string().min(1), actionId: exports_external.string().min(1) }).strict()).min(1);
 var doctorConfiguration = (inspection, environment) => {
@@ -6754,6 +7183,10 @@ var doctorConfiguration = (inspection, environment) => {
   for (const capability of definition.capabilities.filter((entry) => mount.sourceBindings.some((binding) => binding.operationIds.includes(entry.operationId)))) {
     let scopeEnvironment;
     switch (capability.provider.kind) {
+      case "local_documents":
+        if ((capability.requiredProviderScopes?.length ?? 0) > 0)
+          issues.push("local_documents_provider_scopes_unsupported");
+        break;
       case "schift_search":
         issues.push(...searchConfiguration(environment));
         if (environment["SCHIFT_KS_SEARCH_ORGANIZATION_ID"] !== mount.scopeAuthority.organizationId)
@@ -6804,8 +7237,8 @@ var doctor = async (request, application, environment) => {
     throw new OnboardingError("argument_invalid");
   const inspection = InspectionSchema.parse(await application.inspect(request.installationId));
   const { definition, lock, mount } = inspection;
-  const digest2 = await digestKnowledgeScopeDefinition(definition);
-  const integrity = lock.definitionDigest === digest2 && mount.definitionDigest === digest2 && mount.installationId === request.installationId;
+  const digest3 = await digestKnowledgeScopeDefinition(definition);
+  const integrity = lock.definitionDigest === digest3 && mount.definitionDigest === digest3 && mount.installationId === request.installationId;
   const issues = doctorConfiguration(inspection, environment);
   const configured = integrity && mount.state === "mounted" && issues.length === 0;
   const report = { installationId: mount.installationId, integrity, state: mount.state, environment: [...new Set(issues)], configured };
@@ -6813,7 +7246,7 @@ var doctor = async (request, application, environment) => {
     return { ...report, status: configured ? "configured" : "attention_required", evidenceVerified: false };
   if (!configured)
     throw new OnboardingError("configuration_invalid", { ...report });
-  const capability = definition.capabilities.find((entry) => entry.provider.kind === "schift_search" && mount.sourceBindings.some((binding) => binding.operationIds.includes(entry.operationId)));
+  const capability = definition.capabilities.find((entry) => (entry.provider.kind === "schift_search" || entry.provider.kind === "local_documents") && mount.sourceBindings.some((binding) => binding.operationIds.includes(entry.operationId)));
   if (capability === undefined)
     throw new OnboardingError("probe_operation_unavailable");
   const result = await application.run({ installationId: mount.installationId, operationId: capability.operationId, effectiveScope: { tenant: mount.scopeAuthority.tenant }, expectedRevision: mount.revision, input: { query: request.query } });
@@ -6821,10 +7254,12 @@ var doctor = async (request, application, environment) => {
 };
 
 // src/cli.ts
-var COMMANDS = ["init", "validate", "lock", "mount", "inspect", "run", "run-batch", "admit", "unmount", "serve", "quickstart", "doctor"];
+var COMMANDS = ["init", "validate", "lock", "mount", "inspect", "run", "run-batch", "admit", "unmount", "serve", "quickstart", "query", "doctor"];
 var HELP = {
   bin: "schift-ks",
   commands: COMMANDS,
+  start: { example: "schift-ks quickstart ./my-project --source ./notes.md --query 'What is the refund policy?'", supported: [".md", ".txt", "directory"], accountRequired: false, behavior: "Imports a local snapshot; no upload or model calls." },
+  followUp: "schift-ks query <installation-id> --query 'Your next question'",
   serve: { apiTokenEnvironment: "SCHIFT_KS_API_TOKEN", loopbackOnly: true, tokenRequired: true }
 };
 var option = (args, name) => {
@@ -6865,7 +7300,7 @@ var candidateBatch = (value) => {
   throw new CliUsageError("input_invalid");
 };
 var initialDefinition = (directory) => {
-  const inferred = basename(resolve2(directory)).toLowerCase().replace(/[^a-z0-9._:-]+/g, "-").replace(/^-+|-+$/g, "");
+  const inferred = basename2(resolve4(directory)).toLowerCase().replace(/[^a-z0-9._:-]+/g, "-").replace(/^-+|-+$/g, "");
   const packId = inferred.length >= 2 ? inferred.slice(0, 128) : "example-scope";
   return {
     authority: {
@@ -6891,8 +7326,8 @@ var initialDefinition = (directory) => {
   };
 };
 var initialize = async (directory) => {
-  await mkdir3(directory, { recursive: true, mode: 448 });
-  const file = await open2(resolve2(directory, "scope.json"), "wx", 384);
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  const file = await open4(resolve4(directory, "scope.json"), "wx", 384);
   try {
     await file.writeFile(`${canonicalJson2(initialDefinition(directory))}
 `, "utf8");
@@ -6913,8 +7348,14 @@ var execute = async (argv, dependencies) => {
   const apiUrl = option(args, "--api-url");
   const application = apiUrl === undefined ? dependencies.embedded : dependencies.remote(apiUrl);
   switch (command) {
-    case "quickstart":
+    case "quickstart": {
+      const source = option(args, "--source");
+      if (source !== undefined)
+        return localQuickstart({ directory: positional[0] ?? "", source, tenant: option(args, "--tenant") ?? "local-tenant", query: requiredOption(args, "--query") }, dependencies);
       return quickstart({ directory: positional[0] ?? "", index: requiredOption(args, "--index"), tenant: requiredOption(args, "--tenant"), query: requiredOption(args, "--query") }, dependencies, dependencies.environment ?? {});
+    }
+    case "query":
+      return queryProject({ installationId: positional[0] ?? "", query: requiredOption(args, "--query") }, application);
     case "doctor":
       return doctor({ installationId: positional[0] ?? "", ...args.includes("--probe") ? { query: requiredOption(args, "--query") } : {} }, application, dependencies.environment ?? {});
     case "init":
@@ -6995,7 +7436,7 @@ var execute = async (argv, dependencies) => {
   }
 };
 var errorCode = (error) => {
-  if (error instanceof OnboardingError || error instanceof CliUsageError || error instanceof KnowledgeScopeApiError || error instanceof KnowledgeScopeProductError || error instanceof HttpProviderAdapterError) {
+  if (error instanceof LocalDocumentError || error instanceof OnboardingError || error instanceof CliUsageError || error instanceof KnowledgeScopeApiError || error instanceof KnowledgeScopeProductError || error instanceof HttpProviderAdapterError) {
     return error.code;
   }
   return "internal_error";
@@ -7010,16 +7451,16 @@ var runKnowledgeScopeCli = async (argv, dependencies, streams) => {
   }
 };
 // src/main.ts
-import { constants as constants4 } from "node:fs";
-import { open as open5 } from "node:fs/promises";
+import { constants as constants5 } from "node:fs";
+import { open as open7 } from "node:fs/promises";
 
 // src/portable.ts
-import { constants as constants2 } from "node:fs";
-import { lstat as lstat2, mkdir as mkdir4, open as open3, readdir, rename, rm as rm2 } from "node:fs/promises";
-import { dirname, join as join3, relative, resolve as resolve3, sep } from "node:path";
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { constants as constants3 } from "node:fs";
+import { lstat as lstat4, mkdir as mkdir6, open as open5, readdir, rename, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname2, join as join6, relative as relative2, resolve as resolve5, sep as sep2 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var normalizeRelativePath = (path) => {
-  const normalized = path.split(sep).join("/");
+  const normalized = path.split(sep2).join("/");
   if (normalized.length === 0 || normalized.startsWith("/") || normalized.includes("\\") || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
     throw productError("path_invalid");
   }
@@ -7027,12 +7468,12 @@ var normalizeRelativePath = (path) => {
 };
 var hasCode2 = (value, code) => value !== null && typeof value === "object" && ("code" in value) && value.code === code;
 var readNoFollowText = async (path, maxBytes = DEFAULT_MAX_JSON_BYTES) => {
-  if (typeof constants2.O_NOFOLLOW !== "number" || constants2.O_NOFOLLOW === 0) {
+  if (typeof constants3.O_NOFOLLOW !== "number" || constants3.O_NOFOLLOW === 0) {
     throw productError("path_invalid");
   }
   let handle;
   try {
-    handle = await open3(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    handle = await open5(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
   } catch (error) {
     if (hasCode2(error, "ELOOP"))
       throw productError("path_invalid");
@@ -7062,18 +7503,18 @@ var readNoFollowText = async (path, maxBytes = DEFAULT_MAX_JSON_BYTES) => {
   }
 };
 var walkJsonFiles = async (root, current = root) => {
-  const metadata = await lstat2(current);
+  const metadata = await lstat4(current);
   if (metadata.isSymbolicLink())
     throw productError("path_invalid");
   if (!metadata.isDirectory())
     throw productError("path_invalid");
   const paths = [];
   for (const entry of await readdir(current, { withFileTypes: true })) {
-    const absolute = join3(current, entry.name);
-    const entryMetadata = await lstat2(absolute);
+    const absolute = join6(current, entry.name);
+    const entryMetadata = await lstat4(absolute);
     if (entryMetadata.isSymbolicLink())
       throw productError("path_invalid");
-    const path = normalizeRelativePath(relative(root, absolute));
+    const path = normalizeRelativePath(relative2(root, absolute));
     if (entryMetadata.isDirectory()) {
       if (path !== ".schift")
         paths.push(...await walkJsonFiles(root, absolute));
@@ -7088,8 +7529,8 @@ var walkJsonFiles = async (root, current = root) => {
 };
 var readJsonFile = async (root, path) => {
   const normalized = normalizeRelativePath(path);
-  const absolute = resolve3(root, normalized);
-  const prefix = `${resolve3(root)}${sep}`;
+  const absolute = resolve5(root, normalized);
+  const prefix = `${resolve5(root)}${sep2}`;
   if (!absolute.startsWith(prefix))
     throw productError("path_invalid");
   const text = await readNoFollowText(absolute).catch((error) => {
@@ -7108,7 +7549,7 @@ var declaredPaths = (definition) => [
   ]))
 ].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
 var loadPortableScope = async (directory, options = {}) => {
-  const root = resolve3(directory);
+  const root = resolve5(directory);
   const discovered = await walkJsonFiles(root);
   if (!discovered.includes("scope.json"))
     throw productError("portable_file_missing");
@@ -7128,7 +7569,7 @@ var loadPortableScope = async (directory, options = {}) => {
     compileSchemaSubset(files[path]);
   if (options.readLock === false)
     return { directory: root, definition: parsedDefinition.data, files };
-  const lockPath = join3(root, "scope.lock.json");
+  const lockPath = join6(root, "scope.lock.json");
   try {
     const rawLock = parseJsonText(await readNoFollowText(lockPath), "scope.lock.json");
     const parsedLock = KnowledgeScopeLockSchema.safeParse(rawLock);
@@ -7145,10 +7586,10 @@ var loadPortableScope = async (directory, options = {}) => {
 var createPortableLock = async (directory) => {
   const portable = await loadPortableScope(directory, { readLock: false });
   const lock = await buildKnowledgeScopeLock(portable.definition, portable.files);
-  const lockPath = join3(portable.directory, "scope.lock.json");
-  const temporaryPath = join3(dirname(lockPath), `.scope-lock-${randomUUID3()}.tmp`);
-  await mkdir4(dirname(lockPath), { recursive: true });
-  const handle = await open3(temporaryPath, "wx", 420);
+  const lockPath = join6(portable.directory, "scope.lock.json");
+  const temporaryPath = join6(dirname2(lockPath), `.scope-lock-${randomUUID4()}.tmp`);
+  await mkdir6(dirname2(lockPath), { recursive: true });
+  const handle = await open5(temporaryPath, "wx", 420);
   try {
     await handle.writeFile(`${canonicalJson2(lock)}
 `, "utf8");
@@ -7156,7 +7597,7 @@ var createPortableLock = async (directory) => {
     await rename(temporaryPath, lockPath);
   } finally {
     await handle.close();
-    await rm2(temporaryPath, { force: true });
+    await rm3(temporaryPath, { force: true });
   }
   return lock;
 };
@@ -7168,11 +7609,11 @@ var verifyPortableLock = async (directory) => {
 };
 
 // src/state-store.ts
-import { constants as constants3 } from "node:fs";
-import { chmod as chmod2, link as link2, lstat as lstat3, mkdir as mkdir5, open as open4, rename as rename2, rm as rm3 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join4 } from "node:path";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { constants as constants4 } from "node:fs";
+import { chmod as chmod2, link as link3, lstat as lstat5, mkdir as mkdir7, open as open6, rename as rename2, rm as rm4 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, join as join7 } from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/state-contract.ts
 var StateJsonValueSchema = exports_external.lazy(() => exports_external.union([
@@ -7238,21 +7679,21 @@ var hasCode3 = (value, code) => {
   return value.code === code;
 };
 var assertOwnerOnly2 = async (path, expectedDirectory) => {
-  const metadata = await lstat3(path);
+  const metadata = await lstat5(path);
   if (metadata.isSymbolicLink() || (metadata.mode & 63) !== 0 || (expectedDirectory ? !metadata.isDirectory() : !metadata.isFile())) {
     throw productError("state_permissions_invalid");
   }
 };
 var noFollowReadFlags = () => {
-  if (typeof constants3.O_NOFOLLOW !== "number" || constants3.O_NOFOLLOW === 0) {
+  if (typeof constants4.O_NOFOLLOW !== "number" || constants4.O_NOFOLLOW === 0) {
     throw productError("state_permissions_invalid");
   }
-  return constants3.O_RDONLY | constants3.O_NOFOLLOW;
+  return constants4.O_RDONLY | constants4.O_NOFOLLOW;
 };
 var readOwnerOnlyFile = async (path, maxBytes) => {
   let handle;
   try {
-    handle = await open4(path, noFollowReadFlags());
+    handle = await open6(path, noFollowReadFlags());
   } catch (error) {
     if (hasCode3(error, "ELOOP"))
       throw productError("state_permissions_invalid");
@@ -7290,13 +7731,13 @@ class KnowledgeScopeStateStore {
   faults;
   constructor(options = {}) {
     const environment = options.environment ?? process.env;
-    this.home = options.home ?? environment["SCHIFT_KS_HOME"] ?? join4(homedir2(), ".schift", "knowledge-scope");
-    this.statePath = join4(this.home, "state.json");
-    this.lockPath = join4(this.home, "state.lock");
+    this.home = options.home ?? environment["SCHIFT_KS_HOME"] ?? join7(homedir3(), ".schift", "knowledge-scope");
+    this.statePath = join7(this.home, "state.json");
+    this.lockPath = join7(this.home, "state.lock");
     this.faults = options.faults;
   }
   async initialize() {
-    const created = await mkdir5(this.home, { recursive: true, mode: 448 });
+    const created = await mkdir7(this.home, { recursive: true, mode: 448 });
     if (created === undefined)
       await assertOwnerOnly2(this.home, true);
     else
@@ -7314,21 +7755,21 @@ class KnowledgeScopeStateStore {
     }
   }
   async createInitialState() {
-    const temporaryPath = join4(dirname2(this.statePath), `.state-init-${process.pid}-${randomUUID4()}.tmp`);
-    const handle = await open4(temporaryPath, "wx", 384);
+    const temporaryPath = join7(dirname3(this.statePath), `.state-init-${process.pid}-${randomUUID5()}.tmp`);
+    const handle = await open6(temporaryPath, "wx", 384);
     try {
       await handle.writeFile(serializeState(EMPTY_KNOWLEDGE_SCOPE_STATE), "utf8");
       await handle.sync();
       if (this.faults !== undefined)
         await this.faults.beforeRename();
       try {
-        await link2(temporaryPath, this.statePath);
+        await link3(temporaryPath, this.statePath);
       } catch (error) {
         if (!hasCode3(error, "EEXIST"))
           throw error;
         return;
       }
-      const directory = await open4(this.home, "r");
+      const directory = await open6(this.home, "r");
       try {
         await directory.sync();
       } finally {
@@ -7336,7 +7777,7 @@ class KnowledgeScopeStateStore {
       }
     } finally {
       await handle.close();
-      await rm3(temporaryPath, { force: true });
+      await rm4(temporaryPath, { force: true });
     }
   }
   async read() {
@@ -7368,13 +7809,13 @@ class KnowledgeScopeStateStore {
       return mutation.value;
     } finally {
       await lockHandle.close();
-      await rm3(this.lockPath, { force: true });
+      await rm4(this.lockPath, { force: true });
     }
   }
   async acquireLock() {
     let handle;
     try {
-      handle = await open4(this.lockPath, "wx", 384);
+      handle = await open6(this.lockPath, "wx", 384);
     } catch (error) {
       if (!hasCode3(error, "EEXIST"))
         throw error;
@@ -7390,28 +7831,28 @@ class KnowledgeScopeStateStore {
       throw productError("lock_conflict");
     }
     try {
-      const owner = { pid: process.pid, createdAt: Date.now(), nonce: randomUUID4() };
+      const owner = { pid: process.pid, createdAt: Date.now(), nonce: randomUUID5() };
       await handle.writeFile(`${canonicalJson2(owner)}
 `, "utf8");
       await handle.sync();
       return handle;
     } catch (error) {
       await handle.close();
-      await rm3(this.lockPath, { force: true });
+      await rm4(this.lockPath, { force: true });
       throw error;
     }
   }
   async writeAtomically(state) {
     const serialized = serializeState(state);
-    const temporaryPath = join4(dirname2(this.statePath), `.state-${process.pid}-${randomUUID4()}.tmp`);
-    const handle = await open4(temporaryPath, "wx", 384);
+    const temporaryPath = join7(dirname3(this.statePath), `.state-${process.pid}-${randomUUID5()}.tmp`);
+    const handle = await open6(temporaryPath, "wx", 384);
     try {
       await handle.writeFile(serialized, "utf8");
       await handle.sync();
       if (this.faults !== undefined)
         await this.faults.beforeRename();
       await rename2(temporaryPath, this.statePath);
-      const directory = await open4(this.home, "r");
+      const directory = await open6(this.home, "r");
       try {
         await directory.sync();
       } finally {
@@ -7420,7 +7861,7 @@ class KnowledgeScopeStateStore {
       await chmod2(this.statePath, 384);
     } finally {
       await handle.close();
-      await rm3(temporaryPath, { force: true });
+      await rm4(temporaryPath, { force: true });
     }
   }
 }
@@ -7435,11 +7876,11 @@ var toJsonValue = (value) => {
 var isJsonObject3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var hasCode4 = (value, code) => value !== null && typeof value === "object" && ("code" in value) && value.code === code;
 var readNoFollowText2 = async (path) => {
-  if (typeof constants4.O_NOFOLLOW !== "number" || constants4.O_NOFOLLOW === 0)
+  if (typeof constants5.O_NOFOLLOW !== "number" || constants5.O_NOFOLLOW === 0)
     throw productError("path_invalid");
   let handle;
   try {
-    handle = await open5(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+    handle = await open7(path, constants5.O_RDONLY | constants5.O_NOFOLLOW);
   } catch (error) {
     if (hasCode4(error, "ELOOP"))
       throw productError("path_invalid");
@@ -7582,16 +8023,21 @@ var createCliDependencies = (options = {}) => {
   const apiToken = environment["SCHIFT_KS_API_TOKEN"];
   const storageOptions = { environment, ...options.home === undefined ? {} : { home: options.home } };
   const store = new KnowledgeScopeStateStore(storageOptions);
+  const localDocuments = new LocalDocumentStore(storageOptions);
+  const httpProvider = environmentProvider(environment);
   const authorization = new KnowledgeScopeAuthorization(storageOptions);
   const application = new KnowledgeScopeApplication({
     store,
     authorization,
-    provider: options.provider ?? environmentProvider(environment)
+    provider: options.provider ?? {
+      execute: (context) => context.capability.provider.kind === "local_documents" ? localDocuments.execute(context) : httpProvider.execute(context)
+    }
   });
   const embedded = applicationPort(application);
   return {
     environment,
     authoring,
+    localDocuments,
     embedded,
     remote: (apiUrl) => createRemoteKnowledgeScopeApplication(apiUrl, globalThis.fetch, apiToken),
     readJson,
@@ -7824,11 +8270,11 @@ var createKnowledgeScopeClient = (options) => {
   };
 };
 // src/evaluation.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 
 // src/evaluation/contracts.ts
 var id = exports_external.string().min(1).max(256);
-var digest2 = exports_external.string().regex(/^sha256:[a-f0-9]{64}$/);
+var digest3 = exports_external.string().regex(/^sha256:[a-f0-9]{64}$/);
 var decision = exports_external.enum(["ready", "insufficient_evidence"]);
 var evidence = exports_external.object({ evidenceId: id, citation: exports_external.string().min(1).max(4096) }).strict();
 var unique = (values) => new Set(values).size === values.length;
@@ -7836,7 +8282,7 @@ var evidenceList = exports_external.array(evidence).max(100).refine((rows) => un
 var capturedEvidenceList = exports_external.array(evidence.extend({ citation: exports_external.string().max(4096).nullable() })).max(100).refine((rows) => unique(rows.map((row) => row.evidenceId)), "Duplicate captured evidence IDs");
 var question = exports_external.object({
   questionId: id,
-  inputFingerprint: digest2,
+  inputFingerprint: digest3,
   expectedDecision: decision,
   expectedEvidence: evidenceList,
   forbiddenEvidenceIds: exports_external.array(id).max(100).refine(unique, "Duplicate forbidden evidence IDs")
@@ -7844,18 +8290,18 @@ var question = exports_external.object({
 var retrievalDatasetSchema = exports_external.object({
   datasetId: id,
   provenance: exports_external.enum(["synthetic", "customer_provided"]),
-  packDigest: digest2,
-  sourceSnapshotDigest: digest2,
+  packDigest: digest3,
+  sourceSnapshotDigest: digest3,
   questions: exports_external.array(question).min(1).max(1000).refine((rows) => unique(rows.map((row) => row.questionId)), "Duplicate question IDs")
 }).strict();
 var retrievalCaptureSchema = exports_external.object({
   adapter: id,
-  datasetFingerprint: digest2,
-  packDigest: digest2,
-  sourceSnapshotDigest: digest2,
+  datasetFingerprint: digest3,
+  packDigest: digest3,
+  sourceSnapshotDigest: digest3,
   results: exports_external.array(exports_external.object({
     questionId: id,
-    inputFingerprint: digest2,
+    inputFingerprint: digest3,
     decision,
     items: capturedEvidenceList
   }).strict()).max(1000).refine((rows) => unique(rows.map((row) => row.questionId)), "Duplicate captured question IDs")
@@ -7868,7 +8314,7 @@ var retrievalEvaluationSchema = exports_external.object({
 var count = exports_external.number().int().min(0).max(1e5);
 var evaluationQuestionReportSchema = exports_external.object({
   questionId: id,
-  inputFingerprint: digest2,
+  inputFingerprint: digest3,
   expectedEvidenceCount: count,
   retrievedAtKCount: count,
   matchedAtKCount: count,
@@ -7883,10 +8329,10 @@ var retrievalReportSchema = exports_external.object({
   datasetId: id,
   provenance: exports_external.enum(["synthetic", "customer_provided"]),
   adapter: id,
-  datasetFingerprint: digest2,
-  inputFingerprint: digest2,
-  packDigest: digest2,
-  sourceSnapshotDigest: digest2,
+  datasetFingerprint: digest3,
+  inputFingerprint: digest3,
+  packDigest: digest3,
+  sourceSnapshotDigest: digest3,
   topK: exports_external.number().int().min(1).max(100),
   questions: exports_external.array(evaluationQuestionReportSchema).min(1).max(1000).refine((rows) => unique(rows.map((row) => row.questionId)), "Duplicate report question IDs"),
   metrics: exports_external.object({
@@ -7907,7 +8353,7 @@ class RetrievalEvaluationError extends Error {
 }
 
 // src/evaluation.ts
-var hash = (value) => `sha256:${createHash3("sha256").update(canonicalJson2(value)).digest("hex")}`;
+var hash = (value) => `sha256:${createHash4("sha256").update(canonicalJson2(value)).digest("hex")}`;
 var byId = (left, right) => left.questionId < right.questionId ? -1 : left.questionId > right.questionId ? 1 : 0;
 var ratio = (numerator, denominator) => denominator === 0 ? null : numerator / denominator;
 function datasetFingerprint(dataset) {
@@ -8030,6 +8476,9 @@ export {
   RetrievalEvaluationError,
   MAX_CANDIDATES,
   MAX_BINDINGS,
+  LocalDocumentStore,
+  LocalDocumentError,
+  LOCAL_LIMITS,
   KnowledgeScopeStateStore,
   KnowledgeScopeProductError,
   KnowledgeScopeClientError,