daftari 1.30.0 → 1.32.0

package/dist/utils/run-id.js

@@ -0,0 +1,19 @@
+// Shared parser for the optional `run_id` trace identifier (#235/#233).
+//
+// A run id correlates one agent run's reads and writes: stamped into the
+// provenance log on writes, the read log on reads, and staged-action
+// proposals — the consumes-graph producer (#233) joins on it. Free text,
+// caller-supplied; absent, null, or blank all resolve to `undefined`, and a
+// non-string value is a hard error.
+import { err, ok } from "../frontmatter/types.js";
+export function readRunId(args, tool) {
+    const v = args.run_id;
+    if (v === undefined || v === null)
+        return ok(undefined);
+    if (typeof v !== "string") {
+        return err(new Error(`${tool}: 'run_id' must be a string`));
+    }
+    const trimmed = v.trim();
+    return ok(trimmed.length === 0 ? undefined : trimmed);
+}
+//# sourceMappingURL=run-id.js.map

package/dist/utils/run-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-id.js","sourceRoot":"","sources":["../../src/utils/run-id.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,4EAA4E;AAC5E,oCAAoC;AAEpC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAE/D,MAAM,UAAU,SAAS,CACvB,IAA6B,EAC7B,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC"}

package/dist/utils/vault-gitignore.d.ts

@@ -1,3 +1,3 @@
-export declare const VAULT_GITIGNORE = "# Daftari rebuilds these from the markdown files \u2014 never commit them.\n.daftari/index.db\n.daftari/index.db-journal\n.daftari/index.db-wal\n.daftari/index.db-shm\n.daftari/locks.db\n.daftari/locks.db-journal\n.daftari/locks.db-wal\n.daftari/locks.db-shm\n# Local audit state \u2014 advisory, not vault content. Matters most when a vault\n# runs with auto_commit: false inside a larger repo: keeps the host repo's\n# git status clean of Daftari's per-write log churn.\n.daftari/curation-log.jsonl\n.daftari/staged-actions.jsonl\n.daftari/edges.jsonl\n.daftari/shadow-actions.jsonl\n.daftari/consolidate-state.json\n# Transient backfill staging surface (daftari backfill --plan). The apply\n# commit is the durable audit trail \u2014 the plan itself is never committed.\n.daftari/backfill-plan.jsonl\n# Nightly wake-queue snapshot (daftari sleep) \u2014 regenerated each cycle.\n.daftari/wake-queue.jsonl\n";
+export declare const VAULT_GITIGNORE = "# Daftari rebuilds these from the markdown files \u2014 never commit them.\n.daftari/index.db\n.daftari/index.db-journal\n.daftari/index.db-wal\n.daftari/index.db-shm\n.daftari/locks.db\n.daftari/locks.db-journal\n.daftari/locks.db-wal\n.daftari/locks.db-shm\n# Local audit state \u2014 advisory, not vault content. Matters most when a vault\n# runs with auto_commit: false inside a larger repo: keeps the host repo's\n# git status clean of Daftari's per-write log churn.\n.daftari/curation-log.jsonl\n.daftari/staged-actions.jsonl\n.daftari/edges.jsonl\n.daftari/read-log.jsonl\n.daftari/consumes.jsonl\n.daftari/tier2-verdicts.jsonl\n.daftari/shadow-actions.jsonl\n.daftari/consolidate-state.json\n# Transient backfill staging surface (daftari backfill --plan). The apply\n# commit is the durable audit trail \u2014 the plan itself is never committed.\n.daftari/backfill-plan.jsonl\n# Nightly wake-queue snapshot (daftari sleep) \u2014 regenerated each cycle.\n.daftari/wake-queue.jsonl\n";
 export declare function ensureVaultGitignore(vaultRoot: string): Promise<"created" | "appended" | "present">;
 //# sourceMappingURL=vault-gitignore.d.ts.map

package/dist/utils/vault-gitignore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe,k5BAsB3B,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAqB7C"}
+{"version":3,"file":"vault-gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe,m+BAyB3B,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC,CAqB7C"}

package/dist/utils/vault-gitignore.js

@@ -22,6 +22,9 @@ export const VAULT_GITIGNORE = `# Daftari rebuilds these from the markdown files
 .daftari/curation-log.jsonl
 .daftari/staged-actions.jsonl
 .daftari/edges.jsonl
+.daftari/read-log.jsonl
+.daftari/consumes.jsonl
+.daftari/tier2-verdicts.jsonl
 .daftari/shadow-actions.jsonl
 .daftari/consolidate-state.json
 # Transient backfill staging surface (daftari backfill --plan). The apply
@@ -55,7 +58,7 @@ export async function ensureVaultGitignore(vaultRoot) {
     // Separate the user's content from our block so it doesn't glue onto their
     // last line. A leading "\n" guarantees a clean break whether or not the file
     // ends in a newline.
-    await appendFile(path, "\n" + VAULT_GITIGNORE);
+    await appendFile(path, `\n${VAULT_GITIGNORE}`);
     return "appended";
 }
 //# sourceMappingURL=vault-gitignore.js.map

package/dist/utils/vault-gitignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-gitignore.js","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,YAAY;AAEZ,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsB9B,CAAC;AAEF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,+EAA+E;AAC/E,+DAA+D;AAC/D,sEAAsE;AACtE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"vault-gitignore.js","sourceRoot":"","sources":["../../src/utils/vault-gitignore.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,YAAY;AAEZ,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAEF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,+EAA+E;AAC/E,+DAA+D;AAC/D,sEAAsE;AACtE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE3C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,2EAA2E;IAC3E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,eAAe,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "daftari",
-  "version": "1.30.0",
+  "version": "1.32.0",
   "description": "An open-source, multi-user knowledge vault exposed to AI agents via an MCP server.",
+  "mcpName": "io.github.mavaali/daftari",
   "license": "MIT",
   "author": "Mihir Wagle / mavaali",
   "type": "module",
@@ -61,6 +62,7 @@
     "chokidar": "^4.0.3",
     "glob": "^13.0.6",
     "gray-matter": "^4.0.3",
+    "jose": "^6.2.4",
     "js-yaml": "^4.1.1",
     "sqlite-vec": "^0.1.9"
   },
@@ -69,8 +71,10 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.8.0",
+    "@types/pg": "^8.20.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
+    "pg": "^8.22.0",
     "tsx": "^4.22.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.6"
@@ -78,5 +82,21 @@
   "overrides": {
     "protobufjs": "^7.6.1",
     "hono": "^4.12.25"
+  },
+  "peerDependencies": {
+    "pg": ">=8",
+    "@aws-sdk/client-s3": "^3.600.0",
+    "@azure/storage-blob": "^12.24.0"
+  },
+  "peerDependenciesMeta": {
+    "pg": {
+      "optional": true
+    },
+    "@aws-sdk/client-s3": {
+      "optional": true
+    },
+    "@azure/storage-blob": {
+      "optional": true
+    }
   }
 }

package/templates/config.yaml

@@ -32,3 +32,11 @@ roles:
     write: ["*"]
     promote: true
     ratify: true
+  # A propose-only role (#235): its vault_write calls land as staged 'write'
+  # proposals awaiting vault_ratify, and every other direct write tool is
+  # denied. The write list still scopes which collections it may propose into.
+  # This is the recommended role shape for autonomous agents.
+  agent-proposer:
+    read: ["*"]
+    write: ["*"]
+    propose_only: true