pi-vault-mind 0.8.0 → 0.8.3

package/dist/test/bridge-identity.test.js

@@ -0,0 +1,388 @@
+/**
+ * P0-F7: Integration tests for dispatch + identity gating.
+ *
+ * Covers:
+ *  1. isToolAllowed — registry allowlist enforcement
+ *  2. buildIdentityFromRole — per-role baseline tool + publish scopes
+ *  3. handleVmAppend — writeCollections guard (via bridge dispatch)
+ *  4. handleVmSync / handleVmPromote — canPublish guard (via bridge dispatch)
+ *
+ * No module mocks: the real exported functions are called directly (items 1–2)
+ * or reached through the real bridge dispatch (items 3–4) so that removing any
+ * guard breaks the corresponding assertion.
+ */
+import { strict as assert } from "node:assert";
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { after, afterEach, before, beforeEach, describe, it } from "node:test";
+import { MessageBus } from "../src/agent-bus/MessageBus.js";
+import { createBridge, isToolAllowed, registerAgentIdentity, unregisterAgentIdentity, } from "../src/bridge.js";
+import { buildIdentityFromRole } from "../src/engine.js";
+import { registerAllExtensionTools } from "../src/vm-handlers.js";
+// ── Shared bus + bridge (one per file — module-level handlers are singletons) ─
+const fakePi = {
+    sendUserMessage: () => { },
+};
+let bus;
+before(() => {
+    bus = new MessageBus();
+    // Register vm_* handlers into the bridge module's extensionToolHandlers map.
+    registerAllExtensionTools(bus);
+    // Subscribe the bridge to pi_tool_bridge_requests on this bus.
+    createBridge(fakePi, bus);
+});
+// ── Bridge dispatch helper ────────────────────────────────────────────────────
+/**
+ * Publish a tool request through the bridge and return the response payload.
+ * `response.error`  — set when isToolAllowed rejected the request
+ * `response.result` — ToolResult from the handler ({ content, details })
+ */
+async function callTool(agentId, toolName, args) {
+    const requestId = randomUUID();
+    const responseTopic = `bridge_resp_${requestId}`;
+    let response;
+    const responseHandler = (msg) => {
+        response = msg.payload;
+    };
+    bus.subscribe(responseTopic, responseHandler);
+    await bus.publish("pi_tool_bridge_requests", "test-client", {
+        requestId,
+        agentId,
+        toolName,
+        args,
+        responseTopic,
+    });
+    bus.unsubscribe(responseTopic, responseHandler);
+    if (response === undefined)
+        throw new Error(`No bridge response for ${toolName}`);
+    return response;
+}
+/**
+ * Extract the first text item from a ToolResult response.
+ * If the bridge rejected at the isToolAllowed level the error is prefixed "Error:".
+ */
+function getResultText(resp) {
+    if (resp.error)
+        return `Error: ${resp.error}`;
+    const r = resp.result;
+    return r?.content?.[0]?.text ?? "";
+}
+// ── Config fixture ────────────────────────────────────────────────────────────
+/** Write a minimal project config. dataDir must be an absolute path outside dir to avoid
+ *  cleanup races with the background upsertEntry call in handleVmAppend. */
+function writeProjectConfig(dir, dataDir) {
+    fs.writeFileSync(path.join(dir, "pi-vault-mind.config.json"), JSON.stringify({
+        version: 2,
+        collections: {
+            main: {
+                path: "collections/main.jsonl",
+                schema: ["id", "fact"],
+                dedupField: "fact",
+            },
+            research: {
+                path: "collections/research.jsonl",
+                schema: ["id", "fact"],
+                dedupField: "fact",
+            },
+        },
+        injectors: [],
+        vaultMind: {
+            dataDir,
+            embedding: { provider: "transformers" },
+            ftsEnabled: false,
+            graph: { enabled: false },
+        },
+    }), "utf-8");
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// 1. isToolAllowed — registry gating
+// ─────────────────────────────────────────────────────────────────────────────
+describe("isToolAllowed — registry gating", () => {
+    const agentId = `test-allow-${randomUUID()}`;
+    before(() => {
+        registerAgentIdentity({
+            id: agentId,
+            role: "test",
+            allowedTools: ["read", "vm_search"],
+            writeCollections: [],
+            canPublish: false,
+        });
+    });
+    after(() => {
+        unregisterAgentIdentity(agentId);
+    });
+    it("returns true for tools in the allowlist", () => {
+        assert.equal(isToolAllowed(agentId, "read"), true);
+        assert.equal(isToolAllowed(agentId, "vm_search"), true);
+    });
+    it("returns false for tools not in the allowlist", () => {
+        assert.equal(isToolAllowed(agentId, "vm_append"), false);
+        assert.equal(isToolAllowed(agentId, "vm_sync"), false);
+        assert.equal(isToolAllowed(agentId, "bash"), false);
+    });
+    it("returns false for an unknown agent id", () => {
+        assert.equal(isToolAllowed(`no-such-agent-${randomUUID()}`, "read"), false);
+    });
+    it("unregisterAgentIdentity removes the entry so isToolAllowed returns false", () => {
+        const ephId = `ephemeral-${randomUUID()}`;
+        registerAgentIdentity({
+            id: ephId,
+            role: "test",
+            allowedTools: ["read"],
+            writeCollections: [],
+            canPublish: false,
+        });
+        assert.equal(isToolAllowed(ephId, "read"), true, "should be allowed before unregister");
+        unregisterAgentIdentity(ephId);
+        assert.equal(isToolAllowed(ephId, "read"), false, "should be denied after unregister");
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// 2. Role baselines via buildIdentityFromRole
+// ─────────────────────────────────────────────────────────────────────────────
+describe("buildIdentityFromRole — per-role gating baselines", () => {
+    const ids = {
+        heavyLifter: `hl-${randomUUID()}`,
+        miner: `miner-${randomUUID()}`,
+        manager: `mgr-${randomUUID()}`,
+    };
+    before(() => {
+        registerAgentIdentity(buildIdentityFromRole("heavy-lifter", ids.heavyLifter));
+        registerAgentIdentity(buildIdentityFromRole("miner", ids.miner));
+        registerAgentIdentity(buildIdentityFromRole("manager", ids.manager));
+    });
+    after(() => {
+        for (const id of Object.values(ids))
+            unregisterAgentIdentity(id);
+    });
+    it("heavy-lifter: vm_append and vm_sync are NOT allowed", () => {
+        assert.equal(isToolAllowed(ids.heavyLifter, "vm_append"), false, "heavy-lifter must not get vm_append");
+        assert.equal(isToolAllowed(ids.heavyLifter, "vm_sync"), false, "heavy-lifter must not get vm_sync");
+    });
+    it("miner: vm_append is allowed; vm_sync is NOT", () => {
+        assert.equal(isToolAllowed(ids.miner, "vm_append"), true, "miner needs vm_append");
+        assert.equal(isToolAllowed(ids.miner, "vm_sync"), false, "miner must not get vm_sync");
+    });
+    it("manager: vm_sync is allowed AND canPublish===true", () => {
+        assert.equal(isToolAllowed(ids.manager, "vm_sync"), true, "manager needs vm_sync");
+        const mgr = buildIdentityFromRole("manager", "any");
+        assert.equal(mgr.canPublish, true, "manager canPublish must be true");
+    });
+    it("miner: writeCollections is exactly ['main', 'research']", () => {
+        const miner = buildIdentityFromRole("miner", "any");
+        assert.deepEqual(miner.writeCollections, ["main", "research"]);
+    });
+    it("heavy-lifter: writeCollections is empty", () => {
+        const hl = buildIdentityFromRole("heavy-lifter", "any");
+        assert.deepEqual(hl.writeCollections, []);
+        assert.equal(hl.canPublish, false);
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// 3. handleVmAppend — writeCollections guard (via bridge dispatch)
+// ─────────────────────────────────────────────────────────────────────────────
+describe("handleVmAppend — writeCollections guard", () => {
+    let testDir;
+    let lanceDir;
+    let origCwd;
+    let origHome;
+    const agentIdDenied = `vm-append-denied-${randomUUID()}`;
+    const agentIdAllowed = `vm-append-allowed-${randomUUID()}`;
+    beforeEach(() => {
+        origCwd = process.cwd();
+        origHome = process.env.HOME;
+        testDir = path.join(tmpdir(), `pvm-bridge-id-${randomUUID()}`);
+        // Keep lancedb data outside testDir so the background async upsert
+        // can't race with rmSync(testDir) during afterEach cleanup.
+        lanceDir = path.join(tmpdir(), `pvm-lance-${randomUUID()}`);
+        fs.mkdirSync(testDir, { recursive: true });
+        fs.mkdirSync(lanceDir, { recursive: true });
+        writeProjectConfig(testDir, lanceDir);
+        // Isolate from the user's global vault config so loadConfig only
+        // sees the project config we wrote above.
+        process.env.HOME = testDir;
+        process.env.USERPROFILE = testDir;
+        process.chdir(testDir);
+    });
+    afterEach(() => {
+        process.chdir(origCwd);
+        if (origHome !== undefined) {
+            process.env.HOME = origHome;
+            process.env.USERPROFILE = origHome;
+        }
+        unregisterAgentIdentity(agentIdDenied);
+        unregisterAgentIdentity(agentIdAllowed);
+        if (fs.existsSync(testDir))
+            fs.rmSync(testDir, { recursive: true, force: true });
+        if (fs.existsSync(lanceDir))
+            fs.rmSync(lanceDir, { recursive: true, force: true });
+    });
+    it("rejects when collection is not in writeCollections", async () => {
+        registerAgentIdentity({
+            id: agentIdDenied,
+            role: "heavy-lifter",
+            allowedTools: ["vm_append"],
+            writeCollections: [], // no write access — "main" excluded
+            canPublish: false,
+        });
+        const resp = await callTool(agentIdDenied, "vm_append", {
+            collection: "main",
+            entry: { id: "x1", fact: "guarded test" },
+        });
+        const text = getResultText(resp);
+        assert.ok(text.startsWith("Error:"), `Expected an error response, got: "${text}"`);
+        assert.ok(text.includes("not allowed"), `Expected "not allowed" in error, got: "${text}"`);
+    });
+    it("succeeds when collection is in writeCollections", async () => {
+        registerAgentIdentity({
+            id: agentIdAllowed,
+            role: "miner",
+            allowedTools: ["vm_append"],
+            writeCollections: ["main", "research"], // has write access
+            canPublish: false,
+        });
+        const resp = await callTool(agentIdAllowed, "vm_append", {
+            collection: "main",
+            entry: { id: "x2", fact: "allowed append" },
+        });
+        const text = getResultText(resp);
+        assert.ok(!text.startsWith("Error:"), `Expected success, got: "${text}"`);
+        assert.ok(text.includes("Appended"), `Expected "Appended" in success text, got: "${text}"`);
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// 4a. handleVmSync — canPublish guard (via bridge dispatch)
+// ─────────────────────────────────────────────────────────────────────────────
+describe("handleVmSync — canPublish guard", () => {
+    let testDir;
+    let lanceDir;
+    let origCwd;
+    let origHome;
+    const agentIdDenied = `vm-sync-denied-${randomUUID()}`;
+    const agentIdAllowed = `vm-sync-allowed-${randomUUID()}`;
+    beforeEach(() => {
+        origCwd = process.cwd();
+        origHome = process.env.HOME;
+        testDir = path.join(tmpdir(), `pvm-bridge-sync-${randomUUID()}`);
+        lanceDir = path.join(tmpdir(), `pvm-lance-${randomUUID()}`);
+        fs.mkdirSync(testDir, { recursive: true });
+        fs.mkdirSync(lanceDir, { recursive: true });
+        writeProjectConfig(testDir, lanceDir);
+        // Isolate from the user's global vault config.
+        process.env.HOME = testDir;
+        process.env.USERPROFILE = testDir;
+        process.chdir(testDir);
+    });
+    afterEach(() => {
+        process.chdir(origCwd);
+        if (origHome !== undefined) {
+            process.env.HOME = origHome;
+            process.env.USERPROFILE = origHome;
+        }
+        unregisterAgentIdentity(agentIdDenied);
+        unregisterAgentIdentity(agentIdAllowed);
+        if (fs.existsSync(testDir))
+            fs.rmSync(testDir, { recursive: true, force: true });
+        if (fs.existsSync(lanceDir))
+            fs.rmSync(lanceDir, { recursive: true, force: true });
+    });
+    it("rejects with authorization error when canPublish===false", async () => {
+        // Custom identity: vm_sync in allowlist so the bridge lets it through,
+        // but canPublish=false so the handler's guard fires.
+        registerAgentIdentity({
+            id: agentIdDenied,
+            role: "miner",
+            allowedTools: ["vm_sync"],
+            writeCollections: [],
+            canPublish: false,
+        });
+        const resp = await callTool(agentIdDenied, "vm_sync", {
+            vault: "default",
+        });
+        const text = getResultText(resp);
+        assert.ok(text.startsWith("Error:"), `Expected an auth error, got: "${text}"`);
+        assert.ok(text.includes("not authorized to publish"), `Expected "not authorized to publish", got: "${text}"`);
+    });
+    it("passes the canPublish guard when canPublish===true (manager role)", async () => {
+        const mgr = buildIdentityFromRole("manager", agentIdAllowed);
+        registerAgentIdentity(mgr);
+        const resp = await callTool(agentIdAllowed, "vm_sync", {
+            vault: "default",
+        });
+        const text = getResultText(resp);
+        // The auth guard must NOT fire. Any other error (e.g. no vaults
+        // configured) is acceptable; the important thing is the guard let
+        // the manager through.
+        assert.ok(!text.includes("not authorized to publish"), `Got unexpected auth error: "${text}"`);
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// 4b. handleVmPromote — canPublish guard (via bridge dispatch)
+// ─────────────────────────────────────────────────────────────────────────────
+describe("handleVmPromote — canPublish guard", () => {
+    let testDir;
+    let lanceDir;
+    let origCwd;
+    let origHome;
+    const agentIdDenied = `vm-promote-denied-${randomUUID()}`;
+    const agentIdAllowed = `vm-promote-allowed-${randomUUID()}`;
+    beforeEach(() => {
+        origCwd = process.cwd();
+        origHome = process.env.HOME;
+        testDir = path.join(tmpdir(), `pvm-bridge-promo-${randomUUID()}`);
+        lanceDir = path.join(tmpdir(), `pvm-lance-${randomUUID()}`);
+        fs.mkdirSync(testDir, { recursive: true });
+        fs.mkdirSync(lanceDir, { recursive: true });
+        writeProjectConfig(testDir, lanceDir);
+        process.env.HOME = testDir;
+        process.env.USERPROFILE = testDir;
+        process.chdir(testDir);
+    });
+    afterEach(() => {
+        process.chdir(origCwd);
+        if (origHome !== undefined) {
+            process.env.HOME = origHome;
+            process.env.USERPROFILE = origHome;
+        }
+        unregisterAgentIdentity(agentIdDenied);
+        unregisterAgentIdentity(agentIdAllowed);
+        if (fs.existsSync(testDir))
+            fs.rmSync(testDir, { recursive: true, force: true });
+        if (fs.existsSync(lanceDir))
+            fs.rmSync(lanceDir, { recursive: true, force: true });
+    });
+    it("rejects with authorization error when canPublish===false", async () => {
+        registerAgentIdentity({
+            id: agentIdDenied,
+            role: "miner",
+            allowedTools: ["vm_promote"],
+            writeCollections: [],
+            canPublish: false,
+        });
+        const resp = await callTool(agentIdDenied, "vm_promote", {
+            sourceCollection: "main",
+            targetCollection: "research",
+            entryIds: [],
+            reason: "test",
+        });
+        const text = getResultText(resp);
+        assert.ok(text.startsWith("Error:"), `Expected an auth error, got: "${text}"`);
+        assert.ok(text.includes("not authorized to publish"), `Expected "not authorized to publish", got: "${text}"`);
+    });
+    it("passes the canPublish guard when canPublish===true (manager role)", async () => {
+        const mgr = buildIdentityFromRole("manager", agentIdAllowed);
+        registerAgentIdentity(mgr);
+        const resp = await callTool(agentIdAllowed, "vm_promote", {
+            sourceCollection: "main",
+            targetCollection: "research",
+            entryIds: [],
+            reason: "test",
+        });
+        const text = getResultText(resp);
+        // Guard passed; handler may error for another reason (e.g. unknown
+        // collection) but must NOT be the canPublish auth error.
+        assert.ok(!text.includes("not authorized to publish"), `Got unexpected auth error: "${text}"`);
+    });
+});

package/dist/test/discover-schema.test.js

@@ -135,7 +135,7 @@ describe("discover-schema", () => {
         const cfgPath = path.join(testDir, "pi-vault-mind.config.json");
         fs.writeFileSync(cfgPath, JSON.stringify({
             version: 2,
-            wiki: { dataDir: ".lancedb" },
+            vaultMind: { dataDir: ".lancedb" },
             collections: {
                 main: { path: "collections/main.jsonl", schema: ["id", "fact"] },
             },
@@ -145,7 +145,7 @@ describe("discover-schema", () => {
         runDiscoverSchema(testDir, filePath, "new");
         const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf-8"));
         assert.equal(cfg.version, 2);
-        assert.equal(cfg.wiki.dataDir, ".lancedb");
+        assert.equal(cfg.vaultMind.dataDir, ".lancedb");
         assert.ok(cfg.collections.main);
         assert.ok(cfg.collections.new);
     });

package/dist/test/engine-identity.test.js

@@ -0,0 +1,119 @@
+import { strict as assert } from "node:assert";
+import { describe, it } from "node:test";
+import { buildIdentityFromRole, mergeIdentityProfiles } from "../src/engine.js";
+// IdentityConfig requires several fields but at runtime the merge consults
+// only allowedTools / writeCollections / canPublish. Tests deliberately pass
+// partials to mirror what users put in JSON.
+const profile = (over) => ({
+    role: "miner",
+    readCollections: [],
+    allowedVaultPaths: [],
+    ...over,
+});
+describe("engine identity profiles", () => {
+    describe("buildIdentityFromRole — hard-coded fallback baseline", () => {
+        it("miner has vm_append and main/research write scope", () => {
+            const id = buildIdentityFromRole("miner", "miner-1");
+            assert.equal(id.id, "miner-1");
+            assert.equal(id.role, "miner");
+            assert.deepEqual(id.writeCollections, ["main", "research"]);
+            assert.equal(id.canPublish, false);
+            assert.ok(id.allowedTools.includes("vm_append"));
+            assert.ok(!id.allowedTools.includes("vm_sync"));
+        });
+        it("heavy-lifter cannot vm_append or vm_sync (hand to Miner)", () => {
+            const id = buildIdentityFromRole("heavy-lifter", "hl-1");
+            assert.ok(!id.allowedTools.includes("vm_append"));
+            assert.ok(!id.allowedTools.includes("vm_sync"));
+            assert.ok(id.allowedTools.includes("bash"));
+            assert.deepEqual(id.writeCollections, []);
+            assert.equal(id.canPublish, false);
+        });
+        it("manager is the only role with vm_sync + canPublish", () => {
+            const id = buildIdentityFromRole("manager", "mgr-1");
+            assert.ok(id.allowedTools.includes("vm_sync"));
+            assert.equal(id.canPublish, true);
+        });
+        it("unknown role falls back to read-only baseline", () => {
+            const id = buildIdentityFromRole("nope", "x-1");
+            assert.deepEqual(id.allowedTools, ["read", "vm_search", "vm_fts_search"]);
+            assert.deepEqual(id.writeCollections, []);
+            assert.equal(id.canPublish, false);
+        });
+    });
+    describe("mergeIdentityProfiles — config-driven overrides", () => {
+        const baseMiner = () => buildIdentityFromRole("miner", "miner-1");
+        it("no config layers → identical to base (byte-equal today's behavior)", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, undefined, undefined);
+            assert.deepEqual(merged, base);
+            // must be a copy, not the same reference (callers may mutate).
+            assert.notEqual(merged, base);
+        });
+        it("defaultProfile overrides hard-coded allowedTools", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, profile({ allowedTools: ["read", "vm_search"] }), undefined);
+            assert.deepEqual(merged.allowedTools, ["read", "vm_search"]);
+            // fields the layer is silent on stay at the base value.
+            assert.deepEqual(merged.writeCollections, base.writeCollections);
+            assert.equal(merged.canPublish, base.canPublish);
+        });
+        it("roleProfile beats defaultProfile (last wins, per field)", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, profile({
+                allowedTools: ["read"],
+                writeCollections: ["from-default"],
+                canPublish: true,
+            }), profile({
+                writeCollections: ["from-role"],
+                canPublish: false,
+            }));
+            // defaultProfile won where roleProfile was silent.
+            assert.deepEqual(merged.allowedTools, ["read"]);
+            // roleProfile won where it was set.
+            assert.deepEqual(merged.writeCollections, ["from-role"]);
+            assert.equal(merged.canPublish, false);
+        });
+        it("acceptance: setting roles.miner.writeCollections rescopes Miner with no code change", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, undefined, profile({ writeCollections: ["custom-only"] }));
+            assert.deepEqual(merged.writeCollections, ["custom-only"]);
+            // other fields untouched — allowlist still has vm_append from the hard-coded base.
+            assert.ok(merged.allowedTools.includes("vm_append"));
+            assert.equal(merged.canPublish, false);
+        });
+        it("id and role are not overridable by config (always come from base)", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, profile({ role: "imposter" }), profile({ role: "still-imposter" }));
+            assert.equal(merged.id, "miner-1");
+            assert.equal(merged.role, "miner");
+        });
+        it("merges P2/P3 fields (readCollections, egressAllowlist) alongside P0-F4 fields", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, undefined, profile({
+                readCollections: ["secret"],
+                allowedVaultPaths: ["/etc"],
+                tokenRef: "PVM_TOKEN_MINER",
+                egressAllowlist: ["example.com"],
+            }));
+            assert.deepEqual(merged.allowedVaultPaths, ["/etc"]);
+            assert.deepEqual(merged.readCollections, ["secret"]);
+            assert.deepEqual(merged.egressAllowlist, ["example.com"]);
+            assert.deepEqual(Object.keys(merged).sort(), [
+                "allowedTools",
+                "allowedVaultPaths",
+                "canPublish",
+                "egressAllowlist",
+                "id",
+                "readCollections",
+                "role",
+                "writeCollections",
+            ]);
+        });
+        it("empty arrays in a layer override a non-empty base (intentional rescope, not silent skip)", () => {
+            const base = baseMiner();
+            const merged = mergeIdentityProfiles(base, undefined, profile({ writeCollections: [] }));
+            assert.deepEqual(merged.writeCollections, []);
+        });
+    });
+});

package/dist/test/index.test.js

@@ -69,12 +69,11 @@ describe("pi-vault-mind", () => {
                     },
                 },
                 injectors: [],
-                wiki: {
+                vaultMind: {
                     dataDir: ".lancedb",
                     embedding: {
-                        provider: "transformers",
-                        ollamaModel: "embeddinggemma",
-                        ollamaHost: "http://127.0.0.1:11434",
+                        model: "embeddinggemma",
+                        localUrl: "http://127.0.0.1:11434",
                     },
                     graph: { enabled: false, canvasSync: false },
                     ftsEnabled: false,
@@ -85,7 +84,7 @@ describe("pi-vault-mind", () => {
             assert.ok(cfg, "config should be loaded");
             assert.equal(cfg.version, 2);
             assert.ok(cfg.collections.main, "should have main collection");
-            assert.equal(cfg.wiki.embedding.provider, "transformers");
+            assert.equal(cfg.vaultMind.embedding.model, "embeddinggemma");
         }
         finally {
             process.chdir(cwd);
@@ -100,7 +99,7 @@ describe("pi-vault-mind", () => {
             assert.equal(types.DEFAULT_CONFIG.version, 2);
             assert.ok(types.DEFAULT_CONFIG.collections, "collections should exist");
             assert.ok(types.DEFAULT_CONFIG.collections.main, "should have main collection");
-            assert.equal(types.DEFAULT_CONFIG.wiki.embedding.provider, "transformers");
+            assert.equal(types.DEFAULT_CONFIG.vaultMind.embedding.model, "embeddinggemma");
         }
         finally {
             process.chdir(cwd);

package/dist/test/lance-modal.test.js

@@ -8,10 +8,10 @@ import { connect, resetConnection, searchFts, searchHybrid, upsertPrecomputed, }
 import { MODAL_TOKEN_ENV } from "../src/modal-config.js";
 const MODEL = "testmodel";
 const DIM = 3;
-const wiki = (dataDir) => ({
+const makeCfg = (dataDir) => ({
     dataDir,
     embedding: {
-        provider: "modal",
+        remoteUrl: "https://pvm.modal.run",
         modal: { baseUrl: "https://pvm.modal.run", model: MODEL },
         coalesce: { debounceMs: 5, maxBatchSize: 1, maxConcurrentFlushes: 1 },
     },
@@ -48,14 +48,14 @@ describe("Modal lance path (precomputed + search + fallback)", () => {
         resetConnection();
     });
     it("upsertPrecomputed imports rows into the namespaced table", async () => {
-        const cfg = wiki(dir);
+        const cfg = makeCfg(dir);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0]), syncRow("2", [0, 1, 0])], cfg);
         const conn = await connect(dir);
         const table = await conn.openTable(`col_main__${MODEL}__${DIM}`);
         assert.equal(await table.countRows(), 2);
     });
     it("upsertPrecomputed is idempotent (merge-insert by id)", async () => {
-        const cfg = wiki(dir);
+        const cfg = makeCfg(dir);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0])], cfg);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0])], cfg);
         const conn = await connect(dir);
@@ -63,7 +63,7 @@ describe("Modal lance path (precomputed + search + fallback)", () => {
         assert.equal(await table.countRows(), 1);
     });
     it("searchHybrid (modal) returns nearest results via the /embed query path", async () => {
-        const cfg = wiki(dir);
+        const cfg = makeCfg(dir);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0]), syncRow("2", [0, 1, 0]), syncRow("3", [0, 0, 1])], cfg);
         // Mock /embed to return a query vector matching row "1".
         globalThis.fetch = (async () => ({
@@ -77,7 +77,7 @@ describe("Modal lance path (precomputed + search + fallback)", () => {
         assert.equal(results[0].id, "1", "nearest neighbor is row 1");
     });
     it("searchHybrid degrades gracefully (no crash) when Modal is offline", async () => {
-        const cfg = wiki(dir);
+        const cfg = makeCfg(dir);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0], "authentication tokens")], cfg);
         // Offline: every fetch rejects.
         globalThis.fetch = (async () => {
@@ -87,7 +87,7 @@ describe("Modal lance path (precomputed + search + fallback)", () => {
         assert.ok(Array.isArray(results), "offline search returns an array, never throws");
     });
     it("searchFts (modal) targets the namespaced table without throwing", async () => {
-        const cfg = wiki(dir);
+        const cfg = makeCfg(dir);
         await upsertPrecomputed(dir, "main", MODEL, DIM, [syncRow("1", [1, 0, 0], "rare keyword match here")], cfg);
         const results = await searchFts(dir, "main", "rare", 5, cfg);
         assert.ok(Array.isArray(results));