kontexta 4.3.1

package/bundle/standalone/node_modules/kxta-core/dist/util/paths.js

@@ -0,0 +1,179 @@
+import * as os from "node:os";
+import * as path from "node:path";
+import * as fs from "node:fs";
+// @vercel/nft — Next's build-time file tracer — statically evaluates
+// os.homedir() and process.env.* inside fs-call arguments and expands any
+// unresolved remainder into a recursive glob rooted at the evaluated
+// prefix. On Windows that means walking C:\Users\<user>\** through
+// protected junctions ("Application Data"), which fails `next build` with
+// EPERM/EACCES. Routing the values through this opaque identity makes the
+// prefix statically unknown, so the tracer skips the expression instead
+// of globbing the user profile. Zero runtime cost.
+const opaque = (v) => v;
+/**
+ * Resolves the absolute path to the system default data directory.
+ * Falls back to OS-specific standards if KONTEXTA_DATA_DIR is not set.
+ *
+ * Exported so webpack-bundled consumers (apps/web) never re-implement this
+ * with raw os.homedir()/process.env reads — bundled+minified copies of this
+ * logic are exactly what @vercel/nft re-folds into user-profile globs.
+ */
+export function defaultDataDir() {
+    const home = opaque(os.homedir());
+    switch (process.platform) {
+        case "darwin":
+            return path.join(home, "Library", "Application Support", "kontexta");
+        case "win32":
+            return path.join(opaque(process.env.APPDATA) ?? path.join(home, "AppData", "Roaming"), "kontexta");
+        default:
+            return path.join(opaque(process.env.XDG_DATA_HOME) ?? path.join(home, ".local", "share"), "kontexta");
+    }
+}
+/**
+ * Returns the active Kontexta data directory.
+ * Centralizes path resolution and ensures synchronization between components.
+ *
+ * Priority Rules:
+ * 1. Web UI Override: If the process is detected as the Web UI and has an override, it WINS.
+ * 2. Cached Override: If a path was previously persisted to ~/.kontexta_datadir (e.g. by the Web UI), it WINS.
+ * 3. Local Override: If the current process (e.g. MCP) has an override and no cache exists, it is used and cached.
+ * 4. OS Default: Fall back to the system standard.
+ */
+let _resolvedDataDir = null;
+function isWebContext() {
+    return (process.env.npm_package_name === "kxta-web" ||
+        !!process.env.NEXT_RUNTIME ||
+        !!process.env.__NEXT_PAGES_DIR);
+}
+/** True when a resolved path looks like a temp/test location that must not be persisted to cache. */
+function isTempOrTestPath(p) {
+    const lower = p.toLowerCase();
+    const tmp = os.tmpdir().toLowerCase();
+    const segments = p.split(path.sep).map((s) => s.toLowerCase());
+    return (lower.startsWith("/tmp") ||
+        lower.startsWith(tmp) ||
+        segments.includes("tmp") ||
+        segments.includes("test") ||
+        lower.includes("-tmp-") ||
+        (process.platform === "win32" && segments.includes("temp")));
+}
+/** Resets the in-process data-dir cache. Call in test teardown after changing KONTEXTA_DATA_DIR. */
+export function resetDataDirCache() {
+    _resolvedDataDir = null;
+}
+export function getDataDir() {
+    if (_resolvedDataDir)
+        return _resolvedDataDir;
+    const home = opaque(os.homedir());
+    const cacheFile = path.join(home, ".kontexta_datadir");
+    const envOverride = process.env.KONTEXTA_DATA_DIR;
+    const isWeb = isWebContext();
+    // 1. Web UI Override takes absolute priority and updates the cache —
+    //    but never persist temp/test paths so test runs don't poison the cache.
+    if (isWeb && envOverride) {
+        _resolvedDataDir = path.resolve(envOverride);
+        if (!isTempOrTestPath(_resolvedDataDir)) {
+            try {
+                fs.writeFileSync(cacheFile, _resolvedDataDir, "utf8");
+            }
+            catch { }
+        }
+        return _resolvedDataDir;
+    }
+    // 2. Explicit local override (KONTEXTA_DATA_DIR set on this process).
+    //    Wins over cache for non-web contexts. Don't persist temp/test paths.
+    if (envOverride) {
+        _resolvedDataDir = path.resolve(envOverride);
+        const isTestEnv = !!process.env.VITEST || process.env.NODE_ENV === "test";
+        if (!isTempOrTestPath(_resolvedDataDir) && !isTestEnv) {
+            try {
+                fs.writeFileSync(cacheFile, _resolvedDataDir, "utf8");
+            }
+            catch { }
+        }
+        return _resolvedDataDir;
+    }
+    // 3. Check for a persisted "Source of Truth" from a previous run (usually Web UI).
+    //    Only consulted when no local override exists. Skip stale temp-dir entries.
+    const isTestEnv = !!process.env.VITEST || process.env.NODE_ENV === "test";
+    if (!isTestEnv && fs.existsSync(cacheFile)) {
+        try {
+            const cached = fs.readFileSync(cacheFile, "utf8").trim();
+            if (cached && path.isAbsolute(cached) && !isTempOrTestPath(cached)) {
+                _resolvedDataDir = cached;
+                return _resolvedDataDir;
+            }
+            // Cached path is a temp/test path — remove the stale entry.
+            try {
+                fs.unlinkSync(cacheFile);
+            }
+            catch { }
+        }
+        catch { }
+    }
+    // 4. Default fallthrough to OS-standard directory.
+    _resolvedDataDir = defaultDataDir();
+    return _resolvedDataDir;
+}
+/**
+ * Returns the active SQLite database path.
+ * Respects the KONTEXTA_DB_PATH environment variable override,
+ * falling back to the data directory + 'kontexta.db'.
+ */
+export function getDbPath() {
+    return process.env.KONTEXTA_DB_PATH || path.join(getDataDir(), "kontexta.db");
+}
+/** Human-readable tilde-abbreviated version of the OS default data dir. */
+export function defaultDataDirDisplay() {
+    const full = defaultDataDir();
+    const home = opaque(os.homedir());
+    return full.startsWith(home) ? `~${full.slice(home.length)}` : full;
+}
+/**
+ * Sensitive home-relative directories that user-supplied paths must never
+ * resolve into. Lives here (not in webpack-bundled app code) so os.homedir()
+ * never appears in a minified server chunk — see the `opaque` note above.
+ */
+export function homeSensitivePrefixes() {
+    const home = opaque(os.homedir());
+    return [".ssh", ".aws", ".gnupg", ".kube", ".config/gcloud", ".docker"].map((p) => `${home}/${p}`);
+}
+function safeMkdir(dir) {
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch (e) {
+        if (e?.code === "EACCES" || e?.code === "EPERM" || e?.code === "EROFS") {
+            throw new Error(`Kontexta cannot write to data directory: ${dir} (${e.code}). ` +
+                `Set KONTEXTA_DATA_DIR to a writable path, or fix permissions on ${dir}.`);
+        }
+        throw e;
+    }
+}
+/**
+ * Ensures the data directory and essential subdirectories exist and are writable.
+ */
+export function ensureDataDir() {
+    const dataDir = getDataDir();
+    if (!fs.existsSync(dataDir)) {
+        safeMkdir(dataDir);
+    }
+    try {
+        fs.accessSync(dataDir, fs.constants.W_OK);
+    }
+    catch {
+        throw new Error(`Kontexta data directory ${dataDir} is not writable. ` +
+            `Set KONTEXTA_DATA_DIR to a writable path, or fix permissions.`);
+    }
+    const dirsToCreate = [
+        path.join(dataDir, "knowledge"),
+        path.join(dataDir, "backups"),
+        path.join(dataDir, "projects")
+    ];
+    for (const dir of dirsToCreate) {
+        if (!fs.existsSync(dir)) {
+            safeMkdir(dir);
+        }
+    }
+}
+//# sourceMappingURL=paths.js.map

package/bundle/standalone/node_modules/kxta-core/dist/util/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,MAAM,GAAG,CAAI,CAAI,EAAK,EAAE,CAAC,CAAC,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;QACvE,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EACpE,UAAU,CACX,CAAC;QACJ;YACE,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EACvE,UAAU,CACX,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,SAAS,YAAY;IACnB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,UAAU;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAC/B,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QACxB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB;IAC/B,gBAAgB,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAClD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAE7B,qEAAqE;IACrE,4EAA4E;IAC5E,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;QACzB,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACzE,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,WAAW,EAAE,CAAC;QAChB,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;QAC1E,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC;gBAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACzE,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IAC1E,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,gBAAgB,GAAG,MAAM,CAAC;gBAC1B,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YACD,4DAA4D;YAC5D,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,mDAAmD;IACnD,gBAAgB,GAAG,cAAc,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC,GAAG,CACzE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;gBAC7D,mEAAmE,GAAG,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,oBAAoB;YACpD,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;KAC/B,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC"}

package/bundle/standalone/node_modules/kxta-core/dist/util/safety.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Throws if `name` resolves outside `base`. Rejects absolute paths, ".."
+ * traversal, and null bytes. Returns the resolved absolute path on success.
+ */
+export declare function assertPathInside(base: string, name: string): string;
+/** Escape SQL LIKE metacharacters (%, _, \). Use with `ESCAPE '\'`. */
+export declare function escapeLike(input: string): string;
+/**
+ * Lock key for serialising writes to a single KB file path against the
+ * watcher's add/change/unlink handlers. resolve() normalises so callers
+ * that pass relative-or-absolute, with-or-without trailing slash, all
+ * agree on the same key.
+ */
+export declare function fileLockKey(filePath: string): string;
+/**
+ * Wrap a promise with in-flight bookkeeping. Use for any long-running op
+ * that doesn't already go through `withLock`.
+ */
+export declare function track<T>(p: Promise<T>): Promise<T>;
+/** Current count of in-flight tracked operations. */
+export declare function inFlightCount(): number;
+/** Whether `gracefulShutdown` has been initiated. */
+export declare function isShuttingDown(): boolean;
+/**
+ * Mark the process as shutting down. New calls to `withLock` and `track`
+ * still execute (they're already in flight when the signal arrives), but
+ * external callers can check `isShuttingDown()` to refuse new work.
+ */
+export declare function setShuttingDown(value: boolean): void;
+/**
+ * Resolve once `_inFlight === 0` or `timeoutMs` elapses. Returns the count
+ * of still-in-flight operations at resolve time (0 = clean drain;
+ * positive = timeout reached with work still pending).
+ */
+export declare function awaitDrain(timeoutMs: number): Promise<number>;
+export declare function withLock<T>(key: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=safety.d.ts.map

package/bundle/standalone/node_modules/kxta-core/dist/util/safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/util/safety.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBnE;AAED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAgBD;;;GAGG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAWxD;AAED,qDAAqD;AACrD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB7D;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAqCzE"}

package/bundle/standalone/node_modules/kxta-core/dist/util/safety.js

@@ -0,0 +1,156 @@
+/**
+ * Shared safety helpers: path containment validation, SQL LIKE escaping,
+ * per-key async mutex.
+ */
+import { resolve, sep, isAbsolute } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+/**
+ * Throws if `name` resolves outside `base`. Rejects absolute paths, ".."
+ * traversal, and null bytes. Returns the resolved absolute path on success.
+ */
+export function assertPathInside(base, name) {
+    if (typeof name !== "string" || name.length === 0) {
+        throw new Error("Invalid path: empty");
+    }
+    if (name.includes("\0")) {
+        throw new Error("Invalid path: null byte");
+    }
+    if (isAbsolute(name)) {
+        throw new Error("Invalid path: absolute paths are not allowed");
+    }
+    const baseResolved = resolve(base);
+    const target = resolve(baseResolved, name);
+    if (target !== baseResolved && !target.startsWith(baseResolved + sep)) {
+        throw new Error("Invalid path: escapes base directory");
+    }
+    return target;
+}
+/** Escape SQL LIKE metacharacters (%, _, \). Use with `ESCAPE '\'`. */
+export function escapeLike(input) {
+    return input.replace(/[\\%_]/g, (ch) => "\\" + ch);
+}
+/**
+ * Lock key for serialising writes to a single KB file path against the
+ * watcher's add/change/unlink handlers. resolve() normalises so callers
+ * that pass relative-or-absolute, with-or-without trailing slash, all
+ * agree on the same key.
+ */
+export function fileLockKey(filePath) {
+    return `file:${resolve(filePath)}`;
+}
+/**
+ * Per-key serial async mutex. All callers with the same key run one at a time.
+ */
+const _locks = new Map();
+const _heldKeys = new AsyncLocalStorage();
+/* ────────────────────────────────────────────────────────────────────────── */
+/* In-flight tracking + graceful shutdown.                                    */
+/* ────────────────────────────────────────────────────────────────────────── */
+let _inFlight = 0;
+let _shuttingDown = false;
+const _drainWaiters = [];
+/**
+ * Wrap a promise with in-flight bookkeeping. Use for any long-running op
+ * that doesn't already go through `withLock`.
+ */
+export async function track(p) {
+    _inFlight++;
+    try {
+        return await p;
+    }
+    finally {
+        _inFlight--;
+        if (_inFlight === 0 && _drainWaiters.length > 0) {
+            const waiters = _drainWaiters.splice(0);
+            for (const w of waiters)
+                w();
+        }
+    }
+}
+/** Current count of in-flight tracked operations. */
+export function inFlightCount() {
+    return _inFlight;
+}
+/** Whether `gracefulShutdown` has been initiated. */
+export function isShuttingDown() {
+    return _shuttingDown;
+}
+/**
+ * Mark the process as shutting down. New calls to `withLock` and `track`
+ * still execute (they're already in flight when the signal arrives), but
+ * external callers can check `isShuttingDown()` to refuse new work.
+ */
+export function setShuttingDown(value) {
+    _shuttingDown = value;
+}
+/**
+ * Resolve once `_inFlight === 0` or `timeoutMs` elapses. Returns the count
+ * of still-in-flight operations at resolve time (0 = clean drain;
+ * positive = timeout reached with work still pending).
+ */
+export function awaitDrain(timeoutMs) {
+    return new Promise((resolve) => {
+        if (_inFlight === 0) {
+            resolve(0);
+            return;
+        }
+        let settled = false;
+        const onDrain = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(0);
+        };
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            const idx = _drainWaiters.indexOf(onDrain);
+            if (idx >= 0)
+                _drainWaiters.splice(idx, 1);
+            resolve(_inFlight);
+        }, timeoutMs);
+        timer.unref?.();
+        _drainWaiters.push(onDrain);
+    });
+}
+export function withLock(key, fn) {
+    // Re-entering the same key would queue behind its own tail → deadlock.
+    const held = _heldKeys.getStore();
+    if (held?.has(key)) {
+        return Promise.reject(new Error(`withLock: re-entrant acquisition of "${key}" would deadlock`));
+    }
+    const prev = _locks.get(key) ?? Promise.resolve();
+    const childHeld = new Set(held ?? []);
+    childHeld.add(key);
+    const wrapped = () => _heldKeys.run(childHeld, fn);
+    // (wrapped, wrapped): proceed regardless of prev's outcome — ordering, not propagation.
+    const next = prev.then(wrapped, wrapped);
+    // tail swallows rejection only on the chain stored in _locks; callers still see `next`.
+    const tail = next.catch(() => { });
+    _locks.set(key, tail);
+    tail.finally(() => {
+        if (_locks.get(key) === tail)
+            _locks.delete(key);
+    });
+    // In-flight bookkeeping: count this as a tracked op.
+    _inFlight++;
+    next.then(() => {
+        _inFlight--;
+        if (_inFlight === 0 && _drainWaiters.length > 0) {
+            const waiters = _drainWaiters.splice(0);
+            for (const w of waiters)
+                w();
+        }
+    }, () => {
+        _inFlight--;
+        if (_inFlight === 0 && _drainWaiters.length > 0) {
+            const waiters = _drainWaiters.splice(0);
+            for (const w of waiters)
+                w();
+        }
+    });
+    return next;
+}
+//# sourceMappingURL=safety.js.map

package/bundle/standalone/node_modules/kxta-core/dist/util/safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/util/safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACzD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,QAAQ,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;AACnD,MAAM,SAAS,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEvD,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,IAAI,aAAa,GAAG,KAAK,CAAC;AAC1B,MAAM,aAAa,GAAsB,EAAE,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAI,CAAa;IAC1C,SAAS,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,GAAG,IAAI,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAI,GAAW,EAAE,EAAoB;IAC3D,uEAAuE;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAI,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,GAAG,kBAAkB,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,wFAAwF;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,wFAAwF;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,qDAAqD;IACrD,SAAS,EAAE,CAAC;IACZ,IAAI,CAAC,IAAI,CACP,GAAG,EAAE;QACH,SAAS,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC,EACD,GAAG,EAAE;QACH,SAAS,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,CAAC,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/bundle/standalone/node_modules/kxta-core/dist/util/tokens.d.ts

@@ -0,0 +1,3 @@
+export declare function estimateTokensFromBuffer(buf: Buffer): number;
+export declare function estimateTokensFromString(s: string): number;
+//# sourceMappingURL=tokens.d.ts.map

package/bundle/standalone/node_modules/kxta-core/dist/util/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/util/tokens.ts"],"names":[],"mappings":"AAIA,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/bundle/standalone/node_modules/kxta-core/dist/util/tokens.js

@@ -0,0 +1,13 @@
+// packages/core/src/util/tokens.ts
+// Heuristic token count: ~4 bytes/token for ASCII-ish text, ~3 for multi-byte.
+// Same approach used by the MCP server before this was hoisted into core.
+export function estimateTokensFromBuffer(buf) {
+    if (buf.length === 0)
+        return 1;
+    const mostlyAscii = buf.toString("utf-8").length > buf.length * 0.7;
+    return Math.max(1, Math.ceil(buf.length / (mostlyAscii ? 4 : 3)));
+}
+export function estimateTokensFromString(s) {
+    return estimateTokensFromBuffer(Buffer.from(s, "utf-8"));
+}
+//# sourceMappingURL=tokens.js.map

package/bundle/standalone/node_modules/kxta-core/dist/util/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/util/tokens.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+EAA+E;AAC/E,0EAA0E;AAE1E,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAS;IAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/bundle/standalone/node_modules/kxta-core/dist/watcher/index.d.ts

@@ -0,0 +1,9 @@
+import { type FSWatcher } from "chokidar";
+export interface WatcherEvent {
+    type: "change" | "add" | "unlink";
+    path: string;
+}
+/** Close every watcher created by createFileWatcher in this process. */
+export declare function closeAllFileWatchers(): Promise<void>;
+export declare function createFileWatcher(watchPaths: string[], onEvent: (event: WatcherEvent) => void): FSWatcher;
+//# sourceMappingURL=index.d.ts.map

package/bundle/standalone/node_modules/kxta-core/dist/watcher/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/watcher/index.ts"],"names":[],"mappings":"AAAA,OAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAQpD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAgCD,wEAAwE;AACxE,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOpD;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GACrC,SAAS,CAuEX"}

package/bundle/standalone/node_modules/kxta-core/dist/watcher/index.js

@@ -0,0 +1,214 @@
+import chokidar from "chokidar";
+import { getDatabase } from "../db/index.js";
+import { isIndexedFile, stripIndexedExt } from "../util/extensions.js";
+import { withLock, fileLockKey } from "../util/safety.js";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+/** True when filePath is exactly under baseDir (not a sibling like /foo vs /foo2). */
+function isUnder(filePath, baseDir) {
+    const rel = path.relative(baseDir, filePath);
+    return !!rel && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+/**
+ * Active watchers — registered so a global shutdown can close them all
+ * without each caller wiring its own SIGINT handler. Without this, pending
+ * chokidar events fired after the DB was torn down, surfacing as
+ * "Database not initialized" noise (filtered above) but still leaking FDs
+ * and polling intervals.
+ */
+const _activeWatchers = new Set();
+let _shutdownHooksRegistered = false;
+function registerShutdownHooks() {
+    if (_shutdownHooksRegistered)
+        return;
+    _shutdownHooksRegistered = true;
+    const closeAll = () => {
+        for (const w of _activeWatchers) {
+            try {
+                void w.close();
+            }
+            catch { }
+        }
+        _activeWatchers.clear();
+    };
+    process.once("beforeExit", closeAll);
+    // Don't add SIGINT/SIGTERM here — db/index.ts already owns those and will
+    // call closeAllWatchers() via the shutdown chain below if wired in.
+}
+/** Close every watcher created by createFileWatcher in this process. */
+export function closeAllFileWatchers() {
+    const promises = [];
+    for (const w of _activeWatchers) {
+        try {
+            promises.push(Promise.resolve(w.close()));
+        }
+        catch { }
+    }
+    _activeWatchers.clear();
+    return Promise.all(promises).then(() => undefined);
+}
+export function createFileWatcher(watchPaths, onEvent) {
+    registerShutdownHooks();
+    // Auto-ingest scope: files under <dataDir>/knowledge/ or a registered
+    // project. Anything else is ignored (stray files would otherwise be
+    // adopted as KB and could then be unlinked from disk on UI delete).
+    const knowledgeDirs = watchPaths.map((wp) => path.join(wp, "knowledge"));
+    const watcher = chokidar.watch(watchPaths, {
+        // Skip the same set discoverFiles skips, plus build-output / cache /
+        // virtualenv directories that commonly contain throw-away .md/.mmd files,
+        // plus the backup tree owned by syncBackup. The previous regex
+        // excluded ANY dot-prefixed segment, which silently dropped all
+        // changes under .claude/, .github/, .cursor/ — exactly where
+        // AI-context lives. Also ignore the tmp files produced by
+        // restoreVersion (`<file>.kontexta-restore-<pid>-<ts>`) so the
+        // atomic-rename dance doesn't generate spurious add/unlink events.
+        ignored: (p) => /[\/\\](node_modules|\.git|\.next|\.nuxt|\.cache|\.venv|\.tox|\.gradle|\.idea|dist|build|out|target)([\/\\]|$)/.test(p) ||
+            /[\/\\]backups[\/\\]/.test(p) ||
+            /\.kontexta-restore-\d+-\d+$/.test(p),
+        persistent: true,
+        ignoreInitial: true,
+        awaitWriteFinish: { stabilityThreshold: 300, pollInterval: 100 },
+    });
+    // Per-path lock around every handler so a watcher event fired during a
+    // createFile/updateFile (which hold the same key) queues until the
+    // in-flight write commits. The handlers themselves no-op when the
+    // already-stored hash matches, so the queued run after our own write
+    // is a cheap re-check rather than a duplicate UPSERT.
+    const runLocked = (filePath, fn) => {
+        void withLock(fileLockKey(filePath), async () => fn()).catch((e) => {
+            console.error(`[watcher] locked handler failed for ${filePath}:`, e);
+        });
+    };
+    watcher.on("change", (filePath) => {
+        if (!isIndexedFile(filePath))
+            return;
+        runLocked(filePath, () => {
+            // If the row was deleted (e.g. via Time-Travel restore of a previously
+            // unlinked file) and the file is back on disk, treat the change as an
+            // add so FTS gets repopulated instead of silently no-op'ing.
+            updateFileHash(filePath, knowledgeDirs);
+            onEvent({ type: "change", path: filePath });
+        });
+    });
+    watcher.on("add", (filePath) => {
+        if (!isIndexedFile(filePath))
+            return;
+        runLocked(filePath, () => {
+            handleWatcherAdd(filePath, knowledgeDirs);
+            onEvent({ type: "add", path: filePath });
+        });
+    });
+    watcher.on("unlink", (filePath) => {
+        if (!isIndexedFile(filePath))
+            return;
+        runLocked(filePath, () => {
+            handleWatcherUnlink(filePath);
+            onEvent({ type: "unlink", path: filePath });
+        });
+    });
+    _activeWatchers.add(watcher);
+    // Auto-deregister on close so the set doesn't leak references.
+    const origClose = watcher.close.bind(watcher);
+    watcher.close = (() => {
+        _activeWatchers.delete(watcher);
+        return origClose();
+    });
+    return watcher;
+}
+function handleWatcherAdd(filePath, knowledgeDirs) {
+    try {
+        const db = getDatabase();
+        // Check if already in DB
+        const existing = db.prepare("SELECT id FROM files WHERE path = ?").get(filePath);
+        if (existing)
+            return;
+        let projectId = null;
+        const projects = db.prepare("SELECT id, path FROM projects WHERE path IS NOT NULL").all();
+        for (const p of projects) {
+            if (isUnder(filePath, p.path)) {
+                projectId = p.id;
+                break;
+            }
+        }
+        const isKnowledge = knowledgeDirs.some((kd) => isUnder(filePath, kd));
+        if (projectId === null && !isKnowledge)
+            return;
+        const storageType = projectId !== null ? "reference" : "local";
+        const content = fs.readFileSync(filePath, "utf-8");
+        const hash = crypto.createHash("sha256").update(content).digest("hex");
+        const basename = filePath.split(/[/\\]/).pop() || "";
+        const title = stripIndexedExt(basename) || "Untitled";
+        // OR IGNORE + skip-FTS-on-no-change covers the discoverFiles race.
+        const insertStmt = db.prepare("INSERT OR IGNORE INTO files (path, title, project_id, storage_type, content_hash) VALUES (?, ?, ?, ?, ?)");
+        const ftsDel = db.prepare("DELETE FROM fts_index WHERE rowid = ?");
+        const ftsStmt = db.prepare("INSERT INTO fts_index (rowid, title, content) VALUES (?, ?, ?)");
+        db.transaction(() => {
+            const result = insertStmt.run(filePath, title, projectId, storageType, hash);
+            if (result.changes > 0) {
+                // Defensive pre-delete: a stale fts_index row at this rowid (from
+                // a crash mid-transaction) would otherwise UNIQUE-fail the insert.
+                ftsDel.run(result.lastInsertRowid);
+                ftsStmt.run(result.lastInsertRowid, title, content);
+            }
+        })();
+    }
+    catch (e) {
+        if (e?.message !== "Database not initialized. Call createDatabase() first.") {
+            console.error(`[watcher] handleWatcherAdd failed for ${filePath}:`, e);
+        }
+    }
+}
+function handleWatcherUnlink(filePath) {
+    try {
+        const db = getDatabase();
+        const file = db.prepare("SELECT id FROM files WHERE path = ?").get(filePath);
+        if (file) {
+            const deleteFtsStmt = db.prepare("DELETE FROM fts_index WHERE rowid = ?");
+            const deleteFileStmt = db.prepare("DELETE FROM files WHERE id = ?");
+            db.transaction(() => {
+                deleteFtsStmt.run(file.id);
+                deleteFileStmt.run(file.id);
+            })();
+        }
+    }
+    catch (e) {
+        if (e?.message !== "Database not initialized. Call createDatabase() first.") {
+            console.error(`[watcher] handleWatcherUnlink failed for ${filePath}:`, e);
+        }
+    }
+}
+function updateFileHash(filePath, knowledgeDirs = []) {
+    try {
+        const db = getDatabase();
+        const content = fs.readFileSync(filePath, "utf-8");
+        const hash = crypto.createHash("sha256").update(content).digest("hex");
+        const file = db.prepare("SELECT id, title, content_hash FROM files WHERE path = ?").get(filePath);
+        if (file) {
+            // Short-circuit when the row already reflects this content. Common
+            // case: the watcher event was triggered by a createFile/updateFile
+            // we just ran — the row is already up to date and rewriting FTS
+            // is wasted work plus an extra write-lock acquisition.
+            if (file.content_hash === hash)
+                return;
+            const updateStmt = db.prepare("UPDATE files SET content_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?");
+            const deleteFtsStmt = db.prepare("DELETE FROM fts_index WHERE rowid = ?");
+            const insertFtsStmt = db.prepare("INSERT INTO fts_index (rowid, title, content) VALUES (?, ?, ?)");
+            db.transaction(() => {
+                updateStmt.run(hash, file.id);
+                deleteFtsStmt.run(file.id);
+                insertFtsStmt.run(file.id, file.title, content);
+            })();
+        }
+        else {
+            // Row missing — fall back to the add path so a restored file shows up.
+            handleWatcherAdd(filePath, knowledgeDirs);
+        }
+    }
+    catch (e) {
+        if (e?.message !== "Database not initialized. Call createDatabase() first.") {
+            console.error(`[watcher] updateFileHash failed for ${filePath}:`, e);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map