@tacitai/mcp-server 0.1.0

package/dist/tools/ingest.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Ingest tools:
+ *   tacit_ingest_file — POST /api/v1/portfolios/:id/ingest
+ *   tacit_ingest_url  — POST /api/v1/portfolios/:id/ingest-url
+ *
+ * Both require portfolio_id input.
+ *
+ * tacit_ingest_url SSRF guard (mandatory, runs BEFORE any network call):
+ *   1. Scheme must be https:// only.
+ *   2. Host must NOT be loopback (127.0.0.0/8, ::1, localhost) or RFC-1918 private
+ *      (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local (169.254.0.0/16).
+ *   Returns MCP error result (not a throw) on violation.
+ *
+ * The guard is synchronous and checks literal IPs/hostnames in the URL
+ * (no DNS resolution required for the guard to function).
+ */
+import { z } from 'zod';
+import { TacitClient } from '../client.js';
+export interface ToolRequest {
+    execute(): Promise<{
+        content: Array<{
+            type: 'text';
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+/**
+ * Synchronous SSRF guard for ingest_url.
+ * Returns { ok: true } if the URL is safe, or { ok: false, reason: string } if not.
+ *
+ * Exported as `validateIngestUrl` for direct use by tests (ssrf-guard.test.ts).
+ *
+ * SECURITY — DEFENSE IN DEPTH (M1, MV-1057c):
+ *   This guard inspects the LITERAL host string in the URL only (scheme +
+ *   literal-IP / hostname classification). It does NOT perform DNS resolution,
+ *   so it does NOT defend against DNS-rebinding: a public hostname that resolves
+ *   to a private/loopback IP (e.g. 169.254.169.254 via a rebind record) would
+ *   PASS this client-side check. This is intentional and accepted — this layer
+ *   is a fast client-side first line of defense, not the authoritative SSRF
+ *   boundary. DNS-rebinding and resolve-to-private-IP egress is mitigated at the
+ *   cell's egress network policy (the D-10 egress chokepoint), which enforces
+ *   destination-IP filtering at request time, after resolution. Do not rely on
+ *   this function alone for SSRF protection.
+ */
+export declare function validateIngestUrl(rawUrl: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare const ingestFileInputSchema: z.ZodObject<{
+    portfolio_id: z.ZodString;
+    path: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    portfolio_id: string;
+    title?: string | undefined;
+}, {
+    path: string;
+    portfolio_id: string;
+    title?: string | undefined;
+}>;
+export type IngestFileInput = z.infer<typeof ingestFileInputSchema>;
+export declare const INGEST_FILE_TOOL_DEF: {
+    name: "tacit_ingest_file";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            portfolio_id: {
+                type: string;
+                description: string;
+            };
+            path: {
+                type: string;
+                description: string;
+            };
+            title: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function buildIngestFileRequest(client: TacitClient, input: IngestFileInput): ToolRequest;
+export declare function handleIngestFile(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+export declare const ingestUrlInputSchema: z.ZodObject<{
+    portfolio_id: z.ZodString;
+    url: z.ZodString;
+    program_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    portfolio_id: string;
+    url: string;
+    program_id: string;
+}, {
+    portfolio_id: string;
+    url: string;
+    program_id: string;
+}>;
+export type IngestUrlInput = z.infer<typeof ingestUrlInputSchema>;
+export declare const INGEST_URL_TOOL_DEF: {
+    name: "tacit_ingest_url";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            portfolio_id: {
+                type: string;
+                description: string;
+            };
+            url: {
+                type: string;
+                description: string;
+            };
+            program_id: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export declare function buildIngestUrlRequest(client: TacitClient, input: IngestUrlInput): ToolRequest;
+export declare function handleIngestUrl(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/ingest.js

@@ -0,0 +1,259 @@
+"use strict";
+// SPDX-License-Identifier: MIT
+/**
+ * Ingest tools:
+ *   tacit_ingest_file — POST /api/v1/portfolios/:id/ingest
+ *   tacit_ingest_url  — POST /api/v1/portfolios/:id/ingest-url
+ *
+ * Both require portfolio_id input.
+ *
+ * tacit_ingest_url SSRF guard (mandatory, runs BEFORE any network call):
+ *   1. Scheme must be https:// only.
+ *   2. Host must NOT be loopback (127.0.0.0/8, ::1, localhost) or RFC-1918 private
+ *      (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local (169.254.0.0/16).
+ *   Returns MCP error result (not a throw) on violation.
+ *
+ * The guard is synchronous and checks literal IPs/hostnames in the URL
+ * (no DNS resolution required for the guard to function).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INGEST_URL_TOOL_DEF = exports.ingestUrlInputSchema = exports.INGEST_FILE_TOOL_DEF = exports.ingestFileInputSchema = void 0;
+exports.validateIngestUrl = validateIngestUrl;
+exports.buildIngestFileRequest = buildIngestFileRequest;
+exports.handleIngestFile = handleIngestFile;
+exports.buildIngestUrlRequest = buildIngestUrlRequest;
+exports.handleIngestUrl = handleIngestUrl;
+const zod_1 = require("zod");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const client_js_1 = require("../client.js");
+// ─── SSRF guard — synchronous IP/hostname check ───────────────────────────────
+/**
+ * Parse an IPv4 string into octets, returning null if invalid.
+ */
+function parseIPv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return null;
+    const octets = parts.map(Number);
+    if (octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255))
+        return null;
+    return octets;
+}
+/**
+ * Returns true if the host is a private/loopback/link-local address.
+ * Checks literal IPs and the "localhost" hostname.
+ */
+function isPrivateHost(host) {
+    // Strip brackets from IPv6 literals like [::1]
+    const raw = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    // localhost hostname
+    if (raw === 'localhost')
+        return true;
+    // IPv6 loopback
+    if (raw === '::1' || raw === '0:0:0:0:0:0:0:1')
+        return true;
+    // IPv4 checks
+    const octets = parseIPv4(raw);
+    if (octets) {
+        const [a, b] = octets;
+        if (a === 127)
+            return true; // 127.0.0.0/8 loopback
+        if (a === 10)
+            return true; // 10.0.0.0/8
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return true; // 192.168.0.0/16
+        if (a === 169 && b === 254)
+            return true; // 169.254.0.0/16 link-local (AWS IMDS)
+    }
+    return false;
+}
+/**
+ * Synchronous SSRF guard for ingest_url.
+ * Returns { ok: true } if the URL is safe, or { ok: false, reason: string } if not.
+ *
+ * Exported as `validateIngestUrl` for direct use by tests (ssrf-guard.test.ts).
+ *
+ * SECURITY — DEFENSE IN DEPTH (M1, MV-1057c):
+ *   This guard inspects the LITERAL host string in the URL only (scheme +
+ *   literal-IP / hostname classification). It does NOT perform DNS resolution,
+ *   so it does NOT defend against DNS-rebinding: a public hostname that resolves
+ *   to a private/loopback IP (e.g. 169.254.169.254 via a rebind record) would
+ *   PASS this client-side check. This is intentional and accepted — this layer
+ *   is a fast client-side first line of defense, not the authoritative SSRF
+ *   boundary. DNS-rebinding and resolve-to-private-IP egress is mitigated at the
+ *   cell's egress network policy (the D-10 egress chokepoint), which enforces
+ *   destination-IP filtering at request time, after resolution. Do not rely on
+ *   this function alone for SSRF protection.
+ */
+function validateIngestUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return { ok: false, reason: 'URL is not valid' };
+    }
+    // 1. Scheme must be https://
+    if (parsed.protocol !== 'https:') {
+        return { ok: false, reason: `URL scheme must be https:// (got ${parsed.protocol.replace(/:$/, '')})` };
+    }
+    // 2. Host must not be private/loopback/link-local
+    const hostname = parsed.hostname;
+    if (isPrivateHost(hostname)) {
+        return { ok: false, reason: `URL host "${hostname}" resolves to a private/loopback/link-local address` };
+    }
+    return { ok: true };
+}
+// ─── tacit_ingest_file ────────────────────────────────────────────────────────
+exports.ingestFileInputSchema = zod_1.z.object({
+    portfolio_id: zod_1.z.string().min(1).describe('Portfolio UUID to ingest into'),
+    path: zod_1.z.string().min(1).describe('Local file path to ingest'),
+    title: zod_1.z.string().optional().describe('Optional title override'),
+});
+exports.INGEST_FILE_TOOL_DEF = {
+    name: 'tacit_ingest_file',
+    description: 'Ingest a local file into a Tacit portfolio. Route: POST /api/v1/portfolios/:id/ingest.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            portfolio_id: { type: 'string', description: 'Portfolio UUID' },
+            path: { type: 'string', description: 'Local file path to ingest' },
+            title: { type: 'string', description: 'Optional title override' },
+        },
+        required: ['portfolio_id', 'path'],
+    },
+};
+function buildIngestFileRequest(client, input) {
+    return {
+        async execute() {
+            const { portfolio_id, path: filePath, title } = input;
+            try {
+                const resolvedPath = path.resolve(filePath);
+                // POST /api/v1/portfolios/:id/ingest expects JSON { content: string, title?: string }.
+                // Read the file content as text if the file exists; fall back to the path as content.
+                let content;
+                if (fs.existsSync(resolvedPath)) {
+                    content = fs.readFileSync(resolvedPath, 'utf8');
+                }
+                else {
+                    content = filePath;
+                }
+                const body = { content };
+                if (title)
+                    body['title'] = title;
+                // POST /api/v1/portfolios/:id/ingest
+                const result = await client.post(`/api/v1/portfolios/${portfolio_id}/ingest`, body);
+                return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+            }
+            catch (err) {
+                return apiErrorResult(err, `/api/v1/portfolios/:id/ingest`);
+            }
+        },
+    };
+}
+async function handleIngestFile(args) {
+    const parsed = exports.ingestFileInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return { content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }], isError: true };
+    }
+    return buildIngestFileRequest((0, client_js_1.getClient)(), parsed.data).execute();
+}
+// ─── tacit_ingest_url ─────────────────────────────────────────────────────────
+exports.ingestUrlInputSchema = zod_1.z.object({
+    portfolio_id: zod_1.z.string().min(1).describe('Portfolio UUID to ingest into'),
+    url: zod_1.z.string().min(1).describe('Public HTTPS URL to ingest (must be https://, no private/loopback hosts)'),
+    program_id: zod_1.z.string().min(1).describe('Program UUID within the portfolio'),
+});
+exports.INGEST_URL_TOOL_DEF = {
+    name: 'tacit_ingest_url',
+    description: 'Ingest a public URL into a Tacit portfolio. Route: POST /api/v1/portfolios/:id/ingest-url. ' +
+        'URL must use https:// scheme and must not resolve to private/loopback addresses (SSRF protection).',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            portfolio_id: { type: 'string', description: 'Portfolio UUID' },
+            url: { type: 'string', description: 'Public HTTPS URL to ingest' },
+            program_id: { type: 'string', description: 'Program UUID within the portfolio' },
+        },
+        required: ['portfolio_id', 'url', 'program_id'],
+    },
+};
+function buildIngestUrlRequest(client, input) {
+    return {
+        async execute() {
+            const { portfolio_id, url, program_id } = input;
+            // SSRF guard — synchronous check runs BEFORE any network call.
+            const guard = validateIngestUrl(url);
+            if (!guard.ok) {
+                return {
+                    content: [{ type: 'text', text: `SSRF guard rejected URL: ${guard.reason}` }],
+                    isError: true,
+                };
+            }
+            try {
+                // Backend IngestUrlRequest accepts only source_url + program_id (title is dropped).
+                const body = { source_url: url, program_id };
+                // POST /api/v1/portfolios/:id/ingest-url
+                const result = await client.post(`/api/v1/portfolios/${portfolio_id}/ingest-url`, body);
+                return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+            }
+            catch (err) {
+                return apiErrorResult(err, `/api/v1/portfolios/:id/ingest-url`);
+            }
+        },
+    };
+}
+async function handleIngestUrl(args) {
+    const parsed = exports.ingestUrlInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return { content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }], isError: true };
+    }
+    return buildIngestUrlRequest((0, client_js_1.getClient)(), parsed.data).execute();
+}
+// ─── Shared error helper ──────────────────────────────────────────────────────
+function apiErrorResult(err, endpoint) {
+    if (err instanceof client_js_1.TacitApiError) {
+        return {
+            content: [{ type: 'text', text: `API error ${err.statusCode} on ${endpoint}: ${err.body}` }],
+            isError: true,
+        };
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: [{ type: 'text', text: `Error: ${msg}` }], isError: true };
+}

package/dist/tools/recall.d.ts

@@ -0,0 +1,63 @@
+/**
+ * tacit_recall — Chronicle event recall (hybrid vector)
+ * Route: POST /api/v1/mind/recall
+ */
+import { z } from 'zod';
+import { TacitClient } from '../client.js';
+export declare const recallInputSchema: z.ZodObject<{
+    query: z.ZodString;
+    portfolio_id: z.ZodString;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    query: string;
+    portfolio_id: string;
+    limit?: number | undefined;
+}, {
+    query: string;
+    portfolio_id: string;
+    limit?: number | undefined;
+}>;
+export type RecallInput = z.infer<typeof recallInputSchema>;
+export declare const RECALL_TOOL_DEF: {
+    name: "tacit_recall";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            query: {
+                type: string;
+                description: string;
+            };
+            portfolio_id: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export interface ToolRequest {
+    execute(): Promise<{
+        content: Array<{
+            type: 'text';
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+/**
+ * Build a recall request object. Call .execute() to perform the HTTP call.
+ * Exported for testability (allows injecting a mock TacitClient).
+ */
+export declare function buildRecallRequest(client: TacitClient, input: RecallInput): ToolRequest;
+export declare function handleRecall(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/recall.js

@@ -0,0 +1,66 @@
+"use strict";
+// SPDX-License-Identifier: MIT
+/**
+ * tacit_recall — Chronicle event recall (hybrid vector)
+ * Route: POST /api/v1/mind/recall
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECALL_TOOL_DEF = exports.recallInputSchema = void 0;
+exports.buildRecallRequest = buildRecallRequest;
+exports.handleRecall = handleRecall;
+const zod_1 = require("zod");
+const client_js_1 = require("../client.js");
+exports.recallInputSchema = zod_1.z.object({
+    query: zod_1.z.string().min(1).describe('Recall query'),
+    portfolio_id: zod_1.z.string().min(1).describe('Portfolio UUID to scope the recall'),
+    limit: zod_1.z.number().int().positive().optional().describe('Maximum events to return'),
+});
+exports.RECALL_TOOL_DEF = {
+    name: 'tacit_recall',
+    description: 'Recall Chronicle events from Tacit workspace via hybrid vector search. Route: POST /api/v1/mind/recall.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            query: { type: 'string', description: 'Recall query' },
+            portfolio_id: { type: 'string', description: 'Portfolio UUID to scope the recall' },
+            limit: { type: 'number', description: 'Maximum events to return' },
+        },
+        required: ['query', 'portfolio_id'],
+    },
+};
+/**
+ * Build a recall request object. Call .execute() to perform the HTTP call.
+ * Exported for testability (allows injecting a mock TacitClient).
+ */
+function buildRecallRequest(client, input) {
+    return {
+        async execute() {
+            const { query, portfolio_id, limit } = input;
+            try {
+                const body = { query, portfolio_id };
+                if (limit !== undefined)
+                    body['limit'] = limit;
+                // POST /api/v1/mind/recall
+                const result = await client.post('/api/v1/mind/recall', body);
+                return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+            }
+            catch (err) {
+                if (err instanceof client_js_1.TacitApiError) {
+                    return { content: [{ type: 'text', text: `API error ${err.statusCode}: ${err.body}` }], isError: true };
+                }
+                const msg = err instanceof Error ? err.message : String(err);
+                return { content: [{ type: 'text', text: `Error: ${msg}` }], isError: true };
+            }
+        },
+    };
+}
+async function handleRecall(args) {
+    const parsed = exports.recallInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return {
+            content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }],
+            isError: true,
+        };
+    }
+    return buildRecallRequest((0, client_js_1.getClient)(), parsed.data).execute();
+}

package/dist/tools/search.d.ts

@@ -0,0 +1,77 @@
+/**
+ * tacit_search — hybrid BM25+ANN+RRF search
+ * Route: GET /api/v1/search?q=<term>
+ * JWT-scoped; workspace resolved by TacitClient.
+ */
+import { z } from 'zod';
+import { TacitClient } from '../client.js';
+export declare const searchInputSchema: z.ZodObject<{
+    query: z.ZodString;
+    limit: z.ZodOptional<z.ZodNumber>;
+    source_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    entity_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    query: string;
+    limit?: number | undefined;
+    source_types?: string[] | undefined;
+    entity_types?: string[] | undefined;
+}, {
+    query: string;
+    limit?: number | undefined;
+    source_types?: string[] | undefined;
+    entity_types?: string[] | undefined;
+}>;
+export type SearchInput = z.infer<typeof searchInputSchema>;
+export declare const SEARCH_TOOL_DEF: {
+    name: "tacit_search";
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: {
+            query: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+            source_types: {
+                type: string;
+                items: {
+                    type: string;
+                };
+                description: string;
+            };
+            entity_types: {
+                type: string;
+                items: {
+                    type: string;
+                };
+                description: string;
+            };
+        };
+        required: string[];
+    };
+};
+export interface ToolRequest {
+    execute(): Promise<{
+        content: Array<{
+            type: 'text';
+            text: string;
+        }>;
+        isError?: boolean;
+    }>;
+}
+/**
+ * Build a search request object. Call .execute() to perform the HTTP call.
+ * Exported for testability (allows injecting a mock TacitClient).
+ */
+export declare function buildSearchRequest(client: TacitClient, input: SearchInput): ToolRequest;
+export declare function handleSearch(args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;

package/dist/tools/search.js

@@ -0,0 +1,78 @@
+"use strict";
+// SPDX-License-Identifier: MIT
+/**
+ * tacit_search — hybrid BM25+ANN+RRF search
+ * Route: GET /api/v1/search?q=<term>
+ * JWT-scoped; workspace resolved by TacitClient.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEARCH_TOOL_DEF = exports.searchInputSchema = void 0;
+exports.buildSearchRequest = buildSearchRequest;
+exports.handleSearch = handleSearch;
+const zod_1 = require("zod");
+const client_js_1 = require("../client.js");
+exports.searchInputSchema = zod_1.z.object({
+    query: zod_1.z.string().min(1).describe('Search query string'),
+    limit: zod_1.z.number().int().positive().optional().describe('Maximum results to return'),
+    source_types: zod_1.z.array(zod_1.z.string()).optional().describe('Filter by source types (e.g. ["artifact","chronicle"])'),
+    entity_types: zod_1.z.array(zod_1.z.string()).optional().describe('Filter by entity types'),
+});
+exports.SEARCH_TOOL_DEF = {
+    name: 'tacit_search',
+    description: 'Search Tacit knowledge using hybrid BM25+ANN+RRF against /api/v1/search. Returns ranked results from the workspace corpus.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            query: { type: 'string', description: 'Search query string' },
+            limit: { type: 'number', description: 'Maximum results to return' },
+            source_types: { type: 'array', items: { type: 'string' }, description: 'Filter by source types' },
+            entity_types: { type: 'array', items: { type: 'string' }, description: 'Filter by entity types' },
+        },
+        required: ['query'],
+    },
+};
+/**
+ * Build a search request object. Call .execute() to perform the HTTP call.
+ * Exported for testability (allows injecting a mock TacitClient).
+ */
+function buildSearchRequest(client, input) {
+    return {
+        async execute() {
+            const { query, limit, source_types, entity_types } = input;
+            try {
+                const params = { q: query };
+                if (limit !== undefined)
+                    params['limit'] = limit;
+                if (source_types && source_types.length > 0)
+                    params['source_types'] = source_types.join(',');
+                if (entity_types && entity_types.length > 0)
+                    params['entity_types'] = entity_types.join(',');
+                // GET /api/v1/search?q=<term>
+                const result = await client.get('/api/v1/search', params);
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result) }],
+                };
+            }
+            catch (err) {
+                return apiErrorResult(err);
+            }
+        },
+    };
+}
+async function handleSearch(args) {
+    const parsed = exports.searchInputSchema.safeParse(args);
+    if (!parsed.success) {
+        return {
+            content: [{ type: 'text', text: `Invalid input: ${parsed.error.message}` }],
+            isError: true,
+        };
+    }
+    return buildSearchRequest((0, client_js_1.getClient)(), parsed.data).execute();
+}
+function apiErrorResult(err) {
+    if (err instanceof client_js_1.TacitApiError) {
+        return { content: [{ type: 'text', text: `API error ${err.statusCode}: ${err.body}` }], isError: true };
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: [{ type: 'text', text: `Error: ${msg}` }], isError: true };
+}