daftari 1.29.0 → 1.31.0

package/dist/utils/redos.js

@@ -0,0 +1,101 @@
+// Best-effort static screen for regular expressions prone to catastrophic
+// backtracking (ReDoS). Config-declared `pattern` fields are compiled and run
+// against caller-supplied frontmatter on the write path; JS regex is
+// synchronous, so a single pathological pattern (e.g. `(a+)+$`) can wedge the
+// event loop for seconds-to-hours. We screen such patterns out at config load.
+//
+// ReDoS detection is undecidable in general — this is a conservative heuristic,
+// not a proof. It catches the two footguns that account for virtually all
+// real-world cases:
+//   1. star height >= 2 — an unbounded quantifier applied to a group whose body
+//      itself contains an unbounded quantifier: `(a+)+`, `(a*)*`, `([a-z]+)*`.
+//   2. a quantified group over an alternation with overlapping branches:
+//      `(a|a)*`, `(a|ab)*` — but NOT a disjoint set like `(cat|dog)+`.
+// It is paired with a length cap on the value the regex runs against
+// (frontmatter/schema.ts) as defense-in-depth against anything it misses.
+// Removes escaped pairs (`\+`, `\.`) and character classes (`[a-z]`) so a
+// literal quantifier char or a `+` inside a class isn't mistaken for a real
+// quantifier. Both replacements are themselves linear-time.
+function stripClassesAndEscapes(src) {
+    return src.replace(/\\./g, "").replace(/\[[^\]]*\]/g, "C");
+}
+// Splits an alternation body on top-level `|`, ignoring `|` nested inside groups.
+function splitTopLevelAlternation(body) {
+    const branches = [];
+    let depth = 0;
+    let current = "";
+    for (const ch of body) {
+        if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth = Math.max(0, depth - 1);
+        if (ch === "|" && depth === 0) {
+            branches.push(current);
+            current = "";
+        }
+        else {
+            current += ch;
+        }
+    }
+    branches.push(current);
+    return branches;
+}
+// True when a quantified group's body would let the same input be consumed more
+// than one way, the precondition for exponential backtracking.
+function bodyIsRisky(body) {
+    const stripped = stripClassesAndEscapes(body);
+    // Inner unbounded quantifier → star height >= 2.
+    if (/[*+]/.test(stripped))
+        return true;
+    if (/\{\d+,\}/.test(stripped))
+        return true;
+    // Overlapping alternation: a duplicate branch, or one branch a prefix of
+    // another (a|a, a|ab). Disjoint branches (cat|dog) are linear and allowed.
+    if (stripped.includes("|")) {
+        const branches = splitTopLevelAlternation(stripped).map((b) => b.trim());
+        for (let i = 0; i < branches.length; i++) {
+            for (let j = i + 1; j < branches.length; j++) {
+                const a = branches[i];
+                const b = branches[j];
+                if (a.length === 0 || b.length === 0)
+                    continue;
+                if (a === b || a.startsWith(b) || b.startsWith(a))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+// Returns true if `pattern` applies an unbounded quantifier (`*`, `+`, `{n,}`)
+// to a group whose body is itself risky (see bodyIsRisky). Walks the pattern
+// tracking group spans on a stack so nested groups are checked too.
+export function hasCatastrophicBacktracking(pattern) {
+    const openStack = [];
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "\\") {
+            i++; // skip the escaped char
+            continue;
+        }
+        if (ch === "(") {
+            openStack.push(i);
+        }
+        else if (ch === ")" && openStack.length > 0) {
+            const start = openStack.pop();
+            const next = pattern[i + 1];
+            let quantified = next === "*" || next === "+";
+            if (!quantified && next === "{") {
+                // Unbounded upper bound `{n,}` — bounded `{n,m}` is not flagged.
+                quantified = /^\{\d+,\}/.test(pattern.slice(i + 1));
+            }
+            if (quantified) {
+                // Strip a leading group prefix like `?:`, `?=`, `?<name>`.
+                const body = pattern.slice(start + 1, i).replace(/^\?[:=!]|^\?<[^>]*>/, "");
+                if (bodyIsRisky(body))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=redos.js.map

package/dist/utils/redos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redos.js","sourceRoot":"","sources":["../../src/utils/redos.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,0EAA0E;AAC1E,oBAAoB;AACpB,gFAAgF;AAChF,+EAA+E;AAC/E,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,0EAA0E;AAE1E,0EAA0E;AAC1E,4EAA4E;AAC5E,4DAA4D;AAC5D,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,kFAAkF;AAClF,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,+DAA+D;AAC/D,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,iDAAiD;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,CAAC,EAAE,CAAC,CAAC,wBAAwB;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAY,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,UAAU,GAAG,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;YAC9C,IAAI,CAAC,UAAU,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAChC,iEAAiE;gBACjE,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;gBAC5E,IAAI,WAAW,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/utils/run-id.d.ts

@@ -0,0 +1,3 @@
+import { type Result } from "../frontmatter/types.js";
+export declare function readRunId(args: Record<string, unknown>, tool: string): Result<string | undefined, Error>;
+//# sourceMappingURL=run-id.d.ts.map

package/dist/utils/run-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-id.d.ts","sourceRoot":"","sources":["../../src/utils/run-id.ts"],"names":[],"mappings":"AAQA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAE/D,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,CAQnC"}

package/dist/utils/run-id.js

@@ -0,0 +1,19 @@
+// Shared parser for the optional `run_id` trace identifier (#235/#233).
+//
+// A run id correlates one agent run's reads and writes: stamped into the
+// provenance log on writes, the read log on reads, and staged-action
+// proposals — the consumes-graph producer (#233) joins on it. Free text,
+// caller-supplied; absent, null, or blank all resolve to `undefined`, and a
+// non-string value is a hard error.
+import { err, ok } from "../frontmatter/types.js";
+export function readRunId(args, tool) {
+    const v = args.run_id;
+    if (v === undefined || v === null)
+        return ok(undefined);
+    if (typeof v !== "string") {
+        return err(new Error(`${tool}: 'run_id' must be a string`));
+    }
+    const trimmed = v.trim();
+    return ok(trimmed.length === 0 ? undefined : trimmed);
+}
+//# sourceMappingURL=run-id.js.map

package/dist/utils/run-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-id.js","sourceRoot":"","sources":["../../src/utils/run-id.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,4EAA4E;AAC5E,oCAAoC;AAEpC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAE/D,MAAM,UAAU,SAAS,CACvB,IAA6B,EAC7B,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC"}

package/dist/utils/vault-gitignore.d.ts

@@ -1,3 +1,3 @@
-export declare const VAULT_GITIGNORE = "# Daftari rebuilds these from the markdown files \u2014 never commit them.\n.daftari/index.db\n.daftari/index.db-journal\n.daftari/index.db-wal\n.daftari/index.db-shm\n.daftari/locks.db\n.daftari/locks.db-journal\n.daftari/locks.db-wal\n.daftari/locks.db-shm\n# Local audit state \u2014 advisory, not vault content. Matters most when a vault\n# runs with auto_commit: false inside a larger repo: keeps the host repo's\n# git status clean of Daftari's per-write log churn.\n.daftari/curation-log.jsonl\n.daftari/staged-actions.jsonl\n.daftari/edges.jsonl\n.daftari/shadow-actions.jsonl\n.daftari/consolidate-state.json\n# Transient backfill staging surface (daftari backfill --plan). The apply\n# commit is the durable audit trail \u2014 the plan itself is never committed.\n.daftari/backfill-plan.jsonl\n";
+export declare const VAULT_GITIGNORE = "# Daftari rebuilds these from the markdown files \u2014 never commit them.\n.daftari/index.db\n.daftari/index.db-journal\n.daftari/index.db-wal\n.daftari/index.db-shm\n.daftari/locks.db\n.daftari/locks.db-journal\n.daftari/locks.db-wal\n.daftari/locks.db-shm\n# Local audit state \u2014 advisory, not vault content. Matters most when a vault\n# runs with auto_commit: false inside a larger repo: keeps the host repo's\n# git status clean of Daftari's per-write log churn.\n.daftari/curation-log.jsonl\n.daftari/staged-actions.jsonl\n.daftari/edges.jsonl\n.daftari/read-log.jsonl\n.daftari/consumes.jsonl\n.daftari/tier2-verdicts.jsonl\n.daftari/shadow-actions.jsonl\n.daftari/consolidate-state.json\n# Transient backfill staging surface (daftari backfill --plan). The apply\n# commit is the durable audit trail \u2014 the plan itself is never committed.\n.daftari/backfill-plan.jsonl\n# Nightly wake-queue snapshot (daftari sleep) \u2014 regenerated each cycle.\n.daftari/wake-queue.jsonl\n";
 export declare function ensureVaultGitignore(vaultRoot: string): Promise<"created" | "appended" | "present">;
 //# sourceMappingURL=vault-gitignore.d.ts.map

package/dist/utils/vault-gitignore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe,yyBAoB3B,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAqB7C"}
+{"version":3,"file":"vault-gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe,m+BAyB3B,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAqB7C"}

package/dist/utils/vault-gitignore.js

@@ -22,11 +22,16 @@ export const VAULT_GITIGNORE = `# Daftari rebuilds these from the markdown files
 .daftari/curation-log.jsonl
 .daftari/staged-actions.jsonl
 .daftari/edges.jsonl
+.daftari/read-log.jsonl
+.daftari/consumes.jsonl
+.daftari/tier2-verdicts.jsonl
 .daftari/shadow-actions.jsonl
 .daftari/consolidate-state.json
 # Transient backfill staging surface (daftari backfill --plan). The apply
 # commit is the durable audit trail — the plan itself is never committed.
 .daftari/backfill-plan.jsonl
+# Nightly wake-queue snapshot (daftari sleep) — regenerated each cycle.
+.daftari/wake-queue.jsonl
 `;
 // A stable line guaranteed to appear in VAULT_GITIGNORE; used as the marker to
 // detect whether an existing .gitignore already carries the Daftari block.
@@ -53,7 +58,7 @@ export async function ensureVaultGitignore(vaultRoot) {
     // Separate the user's content from our block so it doesn't glue onto their
     // last line. A leading "\n" guarantees a clean break whether or not the file
     // ends in a newline.
-    await appendFile(path, "\n" + VAULT_GITIGNORE);
+    await appendFile(path, `\n${VAULT_GITIGNORE}`);
     return "appended";
 }
 //# sourceMappingURL=vault-gitignore.js.map

package/dist/utils/vault-gitignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gitignore.js","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,YAAY;AAEZ,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;CAoB9B,CAAC;AAEF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,+EAA+E;AAC/E,+DAA+D;AAC/D,sEAAsE;AACtE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"vault-gitignore.js","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,YAAY;AAEZ,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAEF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,+EAA+E;AAC/E,+DAA+D;AAC/D,sEAAsE;AACtE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,eAAe,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/witness/track-record.d.ts

@@ -0,0 +1,42 @@
+import { type AccessContext } from "../access/rbac.js";
+import { type Result } from "../frontmatter/types.js";
+export declare const WAGER_STAKES: Record<string, number>;
+export declare const WAGER_SURVIVAL_CREDIT = 1;
+export declare const WAGER_GONE_STAKE = 1;
+export declare const FLAT_CURVE_SHARE = 0.95;
+export declare function stakeFor(confidence: string): number;
+export interface PrincipalRecord {
+    principal: string;
+    writes: number;
+    firstWriteAt: string | null;
+    lastWriteAt: string | null;
+    docsAuthored: number;
+    liveClaims: number;
+    openExposure: number;
+    contestedOpen: number;
+    stakeAtRisk: number;
+    lost: number;
+    burnedStake: number;
+    survived: number;
+    creditEarned: number;
+    balance: number;
+    proposals: {
+        total: number;
+        ratified: number;
+        rejected: number;
+        expired: number;
+        pending: number;
+    };
+    tensionsLogged: number;
+}
+export interface WitnessResult {
+    principals: PrincipalRecord[];
+    unattributedDocs: number;
+    concentration: {
+        topPrincipal: string | null;
+        topShare: number;
+    };
+    flatCurveWarning: boolean;
+}
+export declare function buildWitness(vaultRoot: string, now?: Date, access?: AccessContext): Promise<Result<WitnessResult, Error>>;
+//# sourceMappingURL=track-record.d.ts.map

package/dist/witness/track-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-record.d.ts","sourceRoot":"","sources":["../../src/witness/track-record.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,KAAK,aAAa,EAAW,MAAM,mBAAmB,CAAC;AAMhE,OAAO,EAAM,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAK1D,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAkC,CAAC;AAEnF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAGvC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAGlC,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IAEpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE;QACT,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAMD,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,EACtB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CA+IvC"}

package/dist/witness/track-record.js

@@ -0,0 +1,189 @@
+// The vault as witness — per-principal track records, priced by the wager
+// schedule. (Positioning ideas 4 + 9, gated on and cleared by the CB7
+// result.)
+//
+// Every write already carries an identity (§11.6), every proposal an
+// outcome, every tension a logger and a resolution. This module aggregates
+// what the ledger already recorded into a reliability curve per principal —
+// and prices it: writing a claim at a confidence level stakes wager points;
+// a claim later corrected or retired by someone else burns the stake; a
+// claim maintained through a full TTL cycle earns credit. Everything is
+// computed at read time from the logs — no new persistent state, no
+// enforcement, nothing minted. The constants are provisional and exported:
+// they are the thing being calibrated, exactly like the §11.5 impact table.
+//
+// Kill-condition instrumentation (stated in the positioning doc):
+//   idea 4 — if one principal does ~all the writing, the curves are flat and
+//   track records are uninformative: `concentration` reports it, and the
+//   caller sees `flatCurveWarning` instead of a false signal.
+//   idea 9 — if stake-fear suppresses true claims, write volume drops:
+//   `firstWriteAt`/`lastWriteAt`/`writes` give the longitudinal series an
+//   external monitor needs.
+import { canRead } from "../access/rbac.js";
+import { readProvenanceLog } from "../curation/provenance.js";
+import { listStagedActions } from "../curation/staged-actions.js";
+import { ageInDays, computeStaleness } from "../curation/staleness.js";
+import { listTensions } from "../curation/tension.js";
+import { loadDocuments } from "../curation/vault-docs.js";
+import { ok } from "../frontmatter/types.js";
+// The wager schedule (provisional; exported for calibration). Confidence is
+// free to claim — the stake makes it cost something. `low` is deliberately
+// free: hedged claims are the honest default and must never be taxed.
+export const WAGER_STAKES = { low: 0, medium: 1, high: 3 };
+// Credit for a claim maintained through at least one full TTL cycle.
+export const WAGER_SURVIVAL_CREDIT = 1;
+// A claim whose document has since been deleted burns at the medium stake —
+// its confidence at write time is no longer recoverable without a ledger.
+export const WAGER_GONE_STAKE = 1;
+// Write-share above which track records are declared uninformative (idea 4's
+// kill condition: one author, flat curves).
+export const FLAT_CURVE_SHARE = 0.95;
+export function stakeFor(confidence) {
+    return WAGER_STAKES[confidence] ?? WAGER_GONE_STAKE;
+}
+function topCollection(relPath) {
+    return relPath.split("/")[0] ?? "";
+}
+export async function buildWitness(vaultRoot, now = new Date(), access) {
+    const log = await readProvenanceLog(vaultRoot);
+    if (!log.ok)
+        return log;
+    const docs = await loadDocuments(vaultRoot);
+    if (!docs.ok)
+        return docs;
+    const tensions = await listTensions(vaultRoot);
+    if (!tensions.ok)
+        return tensions;
+    const actions = await listStagedActions(vaultRoot);
+    if (!actions.ok)
+        return actions;
+    // RBAC: with an access context, everything is scoped to readable
+    // collections (the vault_status precedent) — a witness report never leaks
+    // activity counts from a denied collection.
+    const readable = (path, fmCollection) => !access || canRead(access.role, fmCollection || topCollection(path));
+    const visibleLog = log.value.filter((e) => readable(e.file));
+    const visibleDocs = docs.value.filter((d) => readable(d.path, d.frontmatter.collection));
+    const docByPath = new Map(visibleDocs.map((d) => [d.path, d]));
+    const visibleTensions = tensions.value.filter((t) => readable(t.sourceA) && readable(t.sourceB));
+    const visibleActions = actions.value.filter((a) => readable(a.targetPath));
+    // Authorship: the identity on a file's FIRST provenance entry. The
+    // principal (authenticated, §11.6) outranks the free-text agent claim.
+    const authorOf = new Map();
+    const identityOf = (e) => e.principal ?? e.agent;
+    for (const e of visibleLog) {
+        if (!authorOf.has(e.file))
+            authorOf.set(e.file, identityOf(e));
+    }
+    // Contested / corrected doc sets from the tension log.
+    const contestedDocs = new Set();
+    const correctedDocs = new Set();
+    for (const t of visibleTensions) {
+        if (!t.resolved) {
+            contestedDocs.add(t.sourceA);
+            contestedDocs.add(t.sourceB);
+        }
+        else if (t.resolution?.kind === "corrected") {
+            correctedDocs.add(t.sourceA);
+            correctedDocs.add(t.sourceB);
+        }
+    }
+    const records = new Map();
+    const recordFor = (principal) => {
+        let r = records.get(principal);
+        if (!r) {
+            r = {
+                principal,
+                writes: 0,
+                firstWriteAt: null,
+                lastWriteAt: null,
+                docsAuthored: 0,
+                liveClaims: 0,
+                openExposure: 0,
+                contestedOpen: 0,
+                stakeAtRisk: 0,
+                lost: 0,
+                burnedStake: 0,
+                survived: 0,
+                creditEarned: 0,
+                balance: 0,
+                proposals: { total: 0, ratified: 0, rejected: 0, expired: 0, pending: 0 },
+                tensionsLogged: 0,
+            };
+            records.set(principal, r);
+        }
+        return r;
+    };
+    for (const e of visibleLog) {
+        const r = recordFor(identityOf(e));
+        r.writes += 1;
+        if (r.firstWriteAt === null || e.timestamp < r.firstWriteAt)
+            r.firstWriteAt = e.timestamp;
+        if (r.lastWriteAt === null || e.timestamp > r.lastWriteAt)
+            r.lastWriteAt = e.timestamp;
+    }
+    for (const [path, author] of authorOf) {
+        const r = recordFor(author);
+        r.docsAuthored += 1;
+        const doc = docByPath.get(path);
+        if (!doc) {
+            // The claim's document is gone — settled against the author.
+            r.lost += 1;
+            r.burnedStake += WAGER_GONE_STAKE;
+            continue;
+        }
+        const fm = doc.frontmatter;
+        const stake = stakeFor(fm.confidence);
+        const retired = fm.status === "deprecated" || fm.status === "superseded";
+        if (retired || correctedDocs.has(path)) {
+            r.lost += 1;
+            r.burnedStake += stake;
+            continue;
+        }
+        if (fm.status !== "canonical")
+            continue; // drafts/archived: no live claim, no wager
+        r.liveClaims += 1;
+        r.openExposure += stake;
+        if (contestedDocs.has(path)) {
+            r.contestedOpen += 1;
+            r.stakeAtRisk += stake;
+        }
+        // Survived: maintained through at least one full TTL cycle — old enough
+        // to have needed re-verification, and not currently expired.
+        const s = computeStaleness({ updated: fm.updated, ttl_days: fm.ttl_days }, now);
+        if (fm.ttl_days !== null && ageInDays(fm.created, now) >= fm.ttl_days && !s.expired) {
+            r.survived += 1;
+            r.creditEarned += WAGER_SURVIVAL_CREDIT;
+        }
+    }
+    for (const a of visibleActions) {
+        const r = recordFor(a.proposedBy);
+        r.proposals.total += 1;
+        if (a.status === "ratified" || a.status === "ratified-pending-tool")
+            r.proposals.ratified += 1;
+        else if (a.status === "rejected")
+            r.proposals.rejected += 1;
+        else if (a.status === "expired")
+            r.proposals.expired += 1;
+        else
+            r.proposals.pending += 1;
+    }
+    for (const t of visibleTensions) {
+        if (t.loggedBy)
+            recordFor(t.loggedBy).tensionsLogged += 1;
+    }
+    const principals = [...records.values()];
+    for (const r of principals)
+        r.balance = r.creditEarned - r.burnedStake;
+    principals.sort((a, b) => b.writes - a.writes || a.principal.localeCompare(b.principal));
+    const totalWrites = principals.reduce((n, r) => n + r.writes, 0);
+    const top = principals[0];
+    const topShare = totalWrites > 0 && top ? top.writes / totalWrites : 0;
+    const unattributedDocs = visibleDocs.filter((d) => !authorOf.has(d.path)).length;
+    return ok({
+        principals,
+        unattributedDocs,
+        concentration: { topPrincipal: top?.principal ?? null, topShare },
+        flatCurveWarning: totalWrites > 0 && topShare >= FLAT_CURVE_SHARE,
+    });
+}
+//# sourceMappingURL=track-record.js.map

package/dist/witness/track-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"track-record.js","sourceRoot":"","sources":["../../src/witness/track-record.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,sEAAsE;AACtE,WAAW;AACX,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,4EAA4E;AAC5E,EAAE;AACF,kEAAkE;AAClE,6EAA6E;AAC7E,yEAAyE;AACzE,8DAA8D;AAC9D,uEAAuE;AACvE,0EAA0E;AAC1E,4BAA4B;AAE5B,OAAO,EAAsB,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAE1D,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAA2B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,6EAA6E;AAC7E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,MAAM,UAAU,QAAQ,CAAC,UAAkB;IACzC,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC;AACtD,CAAC;AAsCD,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,MAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,iEAAiE;IACjE,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,YAAqB,EAAW,EAAE,CAChE,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAE3E,mEAAmE;IACnE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAwC,EAAU,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,uDAAuD;IACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9C,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAmB,EAAE;QACvD,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG;gBACF,SAAS;gBACT,MAAM,EAAE,CAAC;gBACT,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,CAAC;gBACf,UAAU,EAAE,CAAC;gBACb,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,WAAW,EAAE,CAAC;gBACd,IAAI,EAAE,CAAC;gBACP,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,CAAC;gBACX,YAAY,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;gBACzE,cAAc,EAAE,CAAC;aAClB,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,YAAY;YAAE,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,WAAW;YAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,6DAA6D;YAC7D,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC,CAAC,WAAW,IAAI,gBAAgB,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,KAAK,YAAY,IAAI,EAAE,CAAC,MAAM,KAAK,YAAY,CAAC;QAEzE,IAAI,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW;YAAE,SAAS,CAAC,2CAA2C;QAEpF,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;QACxB,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;QACzB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAChF,IAAI,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,uBAAuB;YAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC;aAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;;YACrD,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,QAAQ;YAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC;IACvE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEzF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAEjF,OAAO,EAAE,CAAC;QACR,UAAU;QACV,gBAAgB;QAChB,aAAa,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI,EAAE,QAAQ,EAAE;QACjE,gBAAgB,EAAE,WAAW,GAAG,CAAC,IAAI,QAAQ,IAAI,gBAAgB;KAClE,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "daftari",
-  "version": "1.29.0",
+  "version": "1.31.0",
   "description": "An open-source, multi-user knowledge vault exposed to AI agents via an MCP server.",
+  "mcpName": "io.github.mavaali/daftari",
   "license": "MIT",
   "author": "Mihir Wagle / mavaali",
   "type": "module",
@@ -35,6 +36,7 @@
     "lint:fix": "biome check --write src test",
     "format": "biome format --write src test",
     "pack:mcpb": "node scripts/pack-mcpb.mjs",
+    "regression:update-baseline": "node scripts/regression-update-baseline.mjs",
     "prepublishOnly": "npm run build",
     "prepare": "husky"
   },
@@ -53,13 +55,14 @@
     ]
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.100.1",
+    "@anthropic-ai/sdk": "^0.110.0",
     "@huggingface/transformers": "^4.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^4.0.3",
     "glob": "^13.0.6",
     "gray-matter": "^4.0.3",
+    "jose": "^6.2.4",
     "js-yaml": "^4.1.1",
     "sqlite-vec": "^0.1.9"
   },
@@ -68,10 +71,32 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.8.0",
+    "@types/pg": "^8.20.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
+    "pg": "^8.22.0",
     "tsx": "^4.22.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.6"
+  },
+  "overrides": {
+    "protobufjs": "^7.6.1",
+    "hono": "^4.12.25"
+  },
+  "peerDependencies": {
+    "pg": ">=8",
+    "@aws-sdk/client-s3": "^3.600.0",
+    "@azure/storage-blob": "^12.24.0"
+  },
+  "peerDependenciesMeta": {
+    "pg": {
+      "optional": true
+    },
+    "@aws-sdk/client-s3": {
+      "optional": true
+    },
+    "@azure/storage-blob": {
+      "optional": true
+    }
   }
 }

package/templates/config.yaml

@@ -32,3 +32,11 @@ roles:
     write: ["*"]
     promote: true
     ratify: true
+  # A propose-only role (#235): its vault_write calls land as staged 'write'
+  # proposals awaiting vault_ratify, and every other direct write tool is
+  # denied. The write list still scopes which collections it may propose into.
+  # This is the recommended role shape for autonomous agents.
+  agent-proposer:
+    read: ["*"]
+    write: ["*"]
+    propose_only: true