neotoma 0.13.0 → 0.14.0

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAqC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA+DpC,OAAO,EAgCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AAgCpC,eAAO,MAAM,GAAG,6CAAY,CAAC;AA+jB7B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAw4CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAuxFD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;cA6uBS,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBArNV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAzTX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;+BAuTF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BA8HlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA2J3B;AAw+FD,wBAAsB,eAAe;;;eA+HpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAqC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA+DpC,OAAO,EAgCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AAgCpC,eAAO,MAAM,GAAG,6CAAY,CAAC;AA+jB7B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAw4CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAyxFD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;cA6uBS,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBArNV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAzTX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;+BAuTF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BA8HlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA2J3B;AA2iGD,wBAAsB,eAAe;;;eA+HpC"}

package/dist/actions.js

@@ -2795,7 +2795,7 @@ app.post("/entities/query", async (req, res) => {
     try {
         // Get authenticated user_id (REQUIRED)
         const userId = await getAuthenticatedUserId(req, parsed.data.user_id);
-        const { entity_type, search, limit, offset, sort_by, sort_order, published, published_after, published_before, include_snapshots, include_merged, updated_since, created_since, identity_basis, } = parsed.data;
+        const { entity_type, search, limit, offset, sort_by, sort_order, published, published_after, published_before, include_snapshots, include_merged, updated_since, created_since, identity_basis, exclude_bookkeeping, } = parsed.data;
         const { entities, total } = await queryEntitiesWithCount({
             userId,
             entityType: entity_type,
@@ -2812,6 +2812,7 @@ app.post("/entities/query", async (req, res) => {
             updatedSince: updated_since,
             createdSince: created_since,
             identityBasis: identity_basis,
+            excludeBookkeeping: exclude_bookkeeping,
         });
         return res.json({
             entities,
@@ -6170,32 +6171,64 @@ app.post("/list_relationships", async (req, res) => {
         });
         return sendValidationError(res, parsed.error.issues);
     }
-    const { entity_id, direction = "both", relationship_type } = parsed.data;
-    const normalizedDirection = direction === "incoming" || direction === "inbound"
-        ? "incoming"
-        : direction === "outgoing" || direction === "outbound"
-            ? "outgoing"
-            : "both";
-    const { relationshipsService } = await import("./services/relationships.js");
+    const { entity_id, source_entity_id, target_entity_id, direction = "both", relationship_type, limit = 100, offset = 0, } = parsed.data;
     try {
-        let relationships;
+        // Tenant isolation: resolve authenticated user and scope all queries to
+        // their records. See docs/security/advisories/2026-05-21-relationship-
+        // endpoint-tenant-isolation.md for context.
+        const userId = await getAuthenticatedUserId(req, parsed.data.user_id);
+        // Flexible query supporting source_entity_id / target_entity_id in addition
+        // to the legacy entity_id + direction pattern.
+        let query = db.from("relationship_snapshots").select("*").eq("user_id", userId);
+        if (source_entity_id && target_entity_id) {
+            query = query
+                .eq("source_entity_id", source_entity_id)
+                .eq("target_entity_id", target_entity_id);
+        }
+        else if (source_entity_id) {
+            query = query.eq("source_entity_id", source_entity_id);
+        }
+        else if (target_entity_id) {
+            query = query.eq("target_entity_id", target_entity_id);
+        }
+        else if (entity_id) {
+            const normalizedDirection = direction === "incoming" || direction === "inbound"
+                ? "incoming"
+                : direction === "outgoing" || direction === "outbound"
+                    ? "outgoing"
+                    : "both";
+            if (normalizedDirection === "outgoing") {
+                query = query.eq("source_entity_id", entity_id);
+            }
+            else if (normalizedDirection === "incoming") {
+                query = query.eq("target_entity_id", entity_id);
+            }
+            else {
+                query = query.or(`source_entity_id.eq.${entity_id},target_entity_id.eq.${entity_id}`);
+            }
+        }
         if (relationship_type) {
-            relationships = await relationshipsService.getRelationshipsByType(relationship_type);
-            // Filter by entity_id
-            relationships = relationships.filter((rel) => rel.source_entity_id === entity_id || rel.target_entity_id === entity_id);
+            query = query.eq("relationship_type", relationship_type);
         }
-        else {
-            relationships = await relationshipsService.getRelationshipsForEntity(entity_id, normalizedDirection);
+        query = query.order("last_observation_at", { ascending: false });
+        const { data, error } = await query;
+        if (error) {
+            throw new Error(error.message);
         }
+        const all = data || [];
+        const paginated = all.slice(offset, offset + limit);
         logDebug("Success:list_relationships", req, {
             entity_id,
-            count: relationships.length,
+            source_entity_id,
+            target_entity_id,
+            relationship_type,
+            count: paginated.length,
+            total: all.length,
         });
-        return res.json({ relationships });
+        return res.json({ relationships: paginated, total: all.length, limit, offset });
     }
     catch (error) {
-        logError("RelationshipQueryError:list_relationships", req, error);
-        return sendError(res, 500, "DB_QUERY_FAILED", error instanceof Error ? error.message : "Failed to query relationships");
+        return handleApiError(req, res, error, "Failed to query relationships", "DB_QUERY_FAILED", "RelationshipQueryError:list_relationships");
     }
 });
 app.get("/get_file_url", async (req, res) => {
@@ -6340,7 +6373,11 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
         return sendValidationError(res, parsed.error.issues);
     }
     try {
-        const { node_id, node_type = "entity", include_relationships = true, include_sources = true, include_events: _include_events = true, include_observations = false, } = parsed.data;
+        const { node_id, node_type = "entity", include_relationships = true, include_sources = true, include_events: _include_events = true, include_observations = false, limit = 100, offset = 0, } = parsed.data;
+        // Tenant isolation: scope all queries to the authenticated user.
+        // See docs/security/advisories/2026-05-21-relationship-endpoint-
+        // tenant-isolation.md for context.
+        const userId = await getAuthenticatedUserId(req, parsed.data.user_id);
         const result = { node_id, node_type };
         if (node_type === "entity") {
             // Get entity
@@ -6348,16 +6385,28 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                 .from("entities")
                 .select("*")
                 .eq("id", node_id)
+                .eq("user_id", userId)
                 .single();
             if (!entityError && entity) {
                 result.entity = entity;
             }
             // Get relationships if requested
             if (include_relationships) {
+                // Count total relationships for pagination metadata
+                const { count: totalCount, error: countError } = await db
+                    .from("relationship_snapshots")
+                    .select("*", { count: "exact", head: true })
+                    .or(`source_entity_id.eq.${node_id},target_entity_id.eq.${node_id}`)
+                    .eq("user_id", userId);
+                const total = countError ? 0 : (totalCount ?? 0);
+                result.total_count = total;
+                result.has_more = offset + limit < total;
                 const { data: relationships, error: relError } = await db
                     .from("relationship_snapshots")
                     .select("*")
-                    .or(`source_entity_id.eq.${node_id},target_entity_id.eq.${node_id}`);
+                    .or(`source_entity_id.eq.${node_id},target_entity_id.eq.${node_id}`)
+                    .eq("user_id", userId)
+                    .range(offset, offset + limit - 1);
                 if (!relError) {
                     result.relationships = relationships || [];
                     const relatedEntityIds = Array.from(new Set((relationships || [])
@@ -6370,9 +6419,13 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                         const { data: relatedEntities, error: relatedEntitiesError } = await db
                             .from("entities")
                             .select("*")
-                            .in("id", relatedEntityIds);
+                            .in("id", relatedEntityIds)
+                            .eq("user_id", userId);
                         if (!relatedEntitiesError) {
-                            result.related_entities = relatedEntities || [];
+                            result.related_entities = (relatedEntities || []).map(({ id, ...rest }) => ({
+                                entity_id: id,
+                                ...rest,
+                            }));
                         }
                     }
                 }
@@ -6382,7 +6435,8 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                 const { data: observations, error: obsError } = await db
                     .from("observations")
                     .select("*")
-                    .eq("entity_id", node_id);
+                    .eq("entity_id", node_id)
+                    .eq("user_id", userId);
                 if (!obsError) {
                     result.observations = observations || [];
                 }
@@ -6394,7 +6448,8 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                     const { data: sources, error: srcError } = await db
                         .from("source")
                         .select("*")
-                        .in("id", sourceIds);
+                        .in("id", sourceIds)
+                        .eq("user_id", userId);
                     if (!srcError) {
                         result.sources = sources || [];
                     }
@@ -6407,6 +6462,7 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                 .from("source")
                 .select("*")
                 .eq("id", node_id)
+                .eq("user_id", userId)
                 .single();
             if (!srcError && source) {
                 result.source = source;
@@ -6416,7 +6472,8 @@ app.post("/retrieve_graph_neighborhood", async (req, res) => {
                 const { data: observations, error: obsError } = await db
                     .from("observations")
                     .select("*")
-                    .eq("source_id", node_id);
+                    .eq("source_id", node_id)
+                    .eq("user_id", userId);
                 if (!obsError) {
                     result.observations = observations || [];
                 }