skillwiki 0.9.62 → 0.10.0

package/dist/chunk-5TBIMLTZ.js

@@ -0,0 +1,343 @@
+#!/usr/bin/env node
+import {
+  loadFleetManifestAndHost
+} from "./chunk-S5ABQCXQ.js";
+import {
+  ExitCode,
+  err,
+  ok
+} from "./chunk-C5OLZRRM.js";
+
+// src/utils/managed-write-preflight.ts
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/utils/git.ts
+import { execFileSync } from "child_process";
+function git(cwd, args) {
+  try {
+    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function gitStrict(cwd, args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+}
+
+// src/utils/managed-write-lock.ts
+import { randomBytes } from "crypto";
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+function managedWriteLockPath(vault) {
+  const gitPath = git(vault, ["rev-parse", "--git-path", "vault-sync/managed-write.lock"]);
+  if (gitPath) return gitPath.startsWith("/") ? gitPath : join(vault, gitPath);
+  return join(vault, ".skillwiki", "managed-write.lock");
+}
+function acquireManagedWriteLock(vault, command) {
+  const path = managedWriteLockPath(vault);
+  const ownerToken = randomBytes(16).toString("hex");
+  const acquired = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(
+      path,
+      `${JSON.stringify({ pid: process.pid, owner_token: ownerToken, acquired, command })}
+`,
+      { flag: "wx" }
+    );
+    return ok({ vault, path, ownerToken, acquired });
+  } catch (error) {
+    if (error.code === "EEXIST") return err("SYNC_LOCK_HELD", { path });
+    return err("WRITE_FAILED", { path, message: String(error) });
+  }
+}
+function releaseManagedWriteLock(handle) {
+  try {
+    const parsed = JSON.parse(readFileSync(handle.path, "utf8"));
+    if (parsed.owner_token !== handle.ownerToken || parsed.acquired !== handle.acquired) {
+      return err("SYNC_LOCK_HELD", {
+        path: handle.path,
+        message: "managed-write lock ownership changed"
+      });
+    }
+    unlinkSync(handle.path);
+    return ok({ released: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { path: handle.path, message: String(error) });
+  }
+}
+
+// src/utils/vault-sync-helper.ts
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+function candidateHelperPaths(input) {
+  const env = input.env ?? process.env;
+  const paths = [];
+  if (input.helperPath) paths.push(input.helperPath);
+  if (env.SKILLWIKI_VAULT_SYNC_PULL_HELPER) paths.push(env.SKILLWIKI_VAULT_SYNC_PULL_HELPER);
+  try {
+    const here = dirname2(fileURLToPath(import.meta.url));
+    paths.push(join2(here, "..", "vault-sync", "scripts", "wiki-pull-with-auto-resolve.sh"));
+    paths.push(join2(here, "..", "..", "vault-sync", "scripts", "wiki-pull-with-auto-resolve.sh"));
+    paths.push(join2(here, "..", "..", "..", "vault-sync", "scripts", "wiki-pull-with-auto-resolve.sh"));
+  } catch {
+  }
+  return paths;
+}
+function resolveVaultSyncPullHelper(input) {
+  for (const p of candidateHelperPaths(input)) {
+    if (p && existsSync(p)) return p;
+  }
+  return null;
+}
+async function runVaultSyncPullHelper(input) {
+  const helperPath = resolveVaultSyncPullHelper(input);
+  if (!helperPath) {
+    return err("GIT_PULL_FAILED", { message: "canonical vault-sync pull helper not found" });
+  }
+  const remote = input.remote ?? "origin";
+  const branch = input.branch ?? "main";
+  const beforeOid = git(input.vault, ["rev-parse", "HEAD"]);
+  if (!beforeOid) {
+    return err("GIT_PULL_FAILED", { message: "could not read HEAD before pull" });
+  }
+  const env = {
+    ...process.env,
+    ...input.env ?? {},
+    WIKI_DIR: input.vault
+  };
+  if (input.lockToken) {
+    env.VAULT_SYNC_MANAGED_LOCK_TOKEN = input.lockToken;
+  }
+  const result = spawnSync("bash", [helperPath, remote, branch], {
+    env,
+    encoding: "utf8",
+    cwd: input.vault
+  });
+  const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+  const status = result.status ?? 1;
+  if (status === 2) {
+    return err("PREFLIGHT_FAILED", { reason: "existing-handoff", output, helper_path: helperPath });
+  }
+  if (status !== 0) {
+    return err("GIT_PULL_FAILED", {
+      message: result.error ? String(result.error) : `helper exited ${status}`,
+      output,
+      helper_path: helperPath
+    });
+  }
+  const afterOid = git(input.vault, ["rev-parse", "HEAD"]);
+  if (!afterOid) {
+    return err("GIT_PULL_FAILED", { message: "could not read HEAD after pull", helper_path: helperPath });
+  }
+  return ok({
+    before_oid: beforeOid,
+    after_oid: afterOid,
+    changed: beforeOid !== afterOid,
+    helper_path: helperPath
+  });
+}
+
+// src/utils/managed-write-preflight.ts
+var DEFAULT_DEPS = {
+  converge: (input) => runVaultSyncPullHelper(input)
+};
+function journalDir(vault) {
+  const gitPath = git(vault, ["rev-parse", "--git-path", "vault-sync/operations"]);
+  if (!gitPath) return null;
+  return gitPath.startsWith("/") ? gitPath : join3(vault, gitPath);
+}
+function findReviewRequiredOp(vault) {
+  const dir = journalDir(vault);
+  if (!dir) return void 0;
+  let files;
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith(".env"));
+  } catch {
+    return void 0;
+  }
+  const currentGitDir = git(vault, ["rev-parse", "--absolute-git-dir"]);
+  for (const file of files) {
+    let text;
+    try {
+      text = readFileSync2(join3(dir, file), "utf8");
+    } catch {
+      continue;
+    }
+    const fields = Object.fromEntries(
+      text.split("\n").filter((line) => line.includes("=")).map((line) => {
+        const i = line.indexOf("=");
+        return [line.slice(0, i), line.slice(i + 1)];
+      })
+    );
+    if (fields.phase !== "review-required" || fields.handoff !== "1") continue;
+    const journalGitDir = fields.worktree_git_dir ?? "";
+    if (!journalGitDir || !currentGitDir || journalGitDir === currentGitDir) {
+      return file.replace(/\.env$/, "");
+    }
+  }
+  return void 0;
+}
+function preflightBlocker(vault) {
+  const unmergedRaw = git(vault, ["diff", "--name-only", "--diff-filter=U"]);
+  const unmerged = unmergedRaw ? unmergedRaw.split("\n").map((s) => s.trim()).filter(Boolean) : [];
+  if (unmerged.length > 0) {
+    return {
+      reason: "unmerged-paths",
+      operation_id: findReviewRequiredOp(vault),
+      unmerged_paths: unmerged
+    };
+  }
+  const gitDir = git(vault, ["rev-parse", "--absolute-git-dir"]);
+  if (gitDir) {
+    const markers = ["MERGE_HEAD", "CHERRY_PICK_HEAD", "REVERT_HEAD"];
+    for (const m of markers) {
+      try {
+        readFileSync2(join3(gitDir, m));
+        return { reason: "git-operation-in-progress" };
+      } catch {
+      }
+    }
+  }
+  const op = findReviewRequiredOp(vault);
+  if (op) return { reason: "review-required", operation_id: op };
+  return null;
+}
+async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
+  const vault = input.vault;
+  const blocker = preflightBlocker(vault);
+  if (blocker) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", {
+        reason: blocker.reason,
+        operation_id: blocker.operation_id,
+        unmerged_paths: blocker.unmerged_paths
+      })
+    };
+  }
+  const fleet = await loadFleetManifestAndHost({
+    vault,
+    hostId: input.hostId,
+    env: input.env,
+    home: input.home,
+    osHostname: input.osHostname
+  });
+  if (!fleet) {
+    const head = git(vault, ["rev-parse", "HEAD"]) || null;
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        mode: "standalone",
+        base_oid: head,
+        converged: false
+      })
+    };
+  }
+  if (fleet.identityStatus === "unknown" || fleet.identityStatus === "invalid" || !fleet.hostId) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", {
+        reason: "fleet-identity-unresolved",
+        identity_status: fleet.identityStatus,
+        host_id: fleet.hostId
+      })
+    };
+  }
+  const host = fleet.manifest.hosts[fleet.hostId];
+  if (!host) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", { reason: "fleet-host-missing", host_id: fleet.hostId })
+    };
+  }
+  const writesGithub = host.writes_to.includes("github");
+  if (!writesGithub) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        mode: "immutable-record",
+        host_id: fleet.hostId,
+        base_oid: null,
+        converged: false
+      })
+    };
+  }
+  const converge = await deps.converge({
+    vault,
+    lockToken: input.lockToken,
+    env: input.env
+  });
+  if (!converge.ok) {
+    const exitCode = converge.error === "PREFLIGHT_FAILED" ? ExitCode.PREFLIGHT_FAILED : ExitCode.SYNC_PULL_FAILED;
+    return { exitCode, result: converge };
+  }
+  const baseOid = git(vault, ["rev-parse", "HEAD"]);
+  if (!baseOid) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", { reason: "missing-head-after-converge" })
+    };
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      mode: "git-writer",
+      host_id: fleet.hostId,
+      base_oid: baseOid,
+      converged: true,
+      helper_path: converge.data.helper_path
+    })
+  };
+}
+async function runManagedWriteTransaction(input, deps = DEFAULT_DEPS) {
+  const lock = acquireManagedWriteLock(input.vault, input.command);
+  if (!lock.ok) {
+    return { exitCode: ExitCode.SYNC_LOCK_HELD, result: lock };
+  }
+  let handle = lock.data;
+  try {
+    const preflight = await runManagedWritePreflight(
+      {
+        vault: input.vault,
+        command: input.command,
+        hostId: input.hostId,
+        lockToken: handle.ownerToken,
+        env: input.env,
+        home: input.home,
+        osHostname: input.osHostname
+      },
+      deps
+    );
+    if (!preflight.result.ok) {
+      return { exitCode: preflight.exitCode, result: preflight.result };
+    }
+    const receipt = preflight.result.data;
+    if (receipt.mode === "immutable-record" && !input.allowImmutableRecord) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "immutable-record-not-enabled",
+          message: "Release A rejects immutable-record mode; event mode arrives in Release B",
+          host_id: receipt.host_id
+        })
+      };
+    }
+    return await input.mutate(receipt);
+  } finally {
+    releaseManagedWriteLock(handle);
+  }
+}
+
+export {
+  git,
+  gitStrict,
+  acquireManagedWriteLock,
+  releaseManagedWriteLock,
+  runVaultSyncPullHelper,
+  runManagedWritePreflight,
+  runManagedWriteTransaction
+};

package/dist/chunk-C5OLZRRM.js

@@ -0,0 +1,357 @@
+#!/usr/bin/env node
+
+// ../shared/src/exit-codes.ts
+var ExitCode = {
+  OK: 0,
+  INTERNAL_ERROR: 1,
+  FILE_NOT_FOUND: 2,
+  MISSING_CLOSING_DELIMITER: 3,
+  SCHEME_REJECTED: 4,
+  HOST_BLOCKED: 5,
+  MALFORMED_URL: 6,
+  INVALID_FRONTMATTER: 7,
+  SCHEMA_NOT_DETECTED: 8,
+  VAULT_PATH_INVALID: 9,
+  WRITE_FAILED: 10,
+  UNRESOLVED_MARKERS: 11,
+  SOURCES_INCONSISTENT: 12,
+  PREFLIGHT_FAILED: 13,
+  ATOMIC_COPY_FAILED: 14,
+  INIT_TARGET_NOT_EMPTY: 15,
+  BROKEN_WIKILINKS: 16,
+  TAG_NOT_IN_TAXONOMY: 17,
+  INDEX_INCOMPLETE: 18,
+  STALE_PAGE: 19,
+  PAGE_TOO_LARGE: 20,
+  LOG_ROTATE_NEEDED: 21,
+  LINT_HAS_WARNINGS: 22,
+  LINT_HAS_ERRORS: 23,
+  ENV_WRITE_CONFLICT: 24,
+  NO_VAULT_CONFIGURED: 25,
+  INVALID_CONFIG_KEY: 26,
+  CONFIG_WRITE_FAILED: 27,
+  DOCTOR_HAS_WARNINGS: 28,
+  DOCTOR_HAS_ERRORS: 29,
+  ARCHIVE_TARGET_NOT_FOUND: 30,
+  ARCHIVE_ALREADY_ARCHIVED: 31,
+  DRIFT_DETECTED: 32,
+  RAW_DEDUP_DETECTED: 33,
+  MIGRATION_APPLIED: 34,
+  UNKNOWN_WIKI_PROFILE: 35,
+  DEDUP_APPLIED: 36,
+  PROJECT_NOT_FOUND: 37,
+  SYMLINK_FAILED: 38,
+  COMPOUND_PROMOTED: 39,
+  SKILL_VERSION_MISMATCH: 40,
+  INGEST_VALIDATION_FAILED: 41,
+  SYNC_PUSH_FAILED: 42,
+  SYNC_PULL_FAILED: 43,
+  BACKUP_SYNC_FAILED: 44,
+  BACKUP_RESTORE_CONFLICTS: 45,
+  USAGE: 46,
+  BODY_TRUNCATION_GUARD: 47,
+  SYNC_LOCK_HELD: 48,
+  LOG_APPEND_LOCK_HELD: 49,
+  FLEET_MANIFEST_INVALID: 50,
+  SENSITIVE_CONTENT_DETECTED: 51,
+  FLEET_SATELLITE_HEALTH_FAILED: 52,
+  PROTECTED_SNAPSHOTTER_WRITE_BLOCKED: 53
+};
+
+// ../shared/src/json-output.ts
+function ok(data) {
+  return { ok: true, data };
+}
+function err(error, detail) {
+  return detail === void 0 ? { ok: false, error } : { ok: false, error, detail };
+}
+
+// ../shared/src/schemas.ts
+import { z } from "zod";
+var isoDate = z.string().refine((s) => {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(s)) return false;
+  const d = /* @__PURE__ */ new Date(s + "T00:00:00Z");
+  return !Number.isNaN(d.getTime()) && s === d.toISOString().slice(0, 10);
+}, { message: "must be YYYY-MM-DD" });
+var wikilink = z.string().regex(/^\[\[[^\[\]]+\]\]$/, 'must be "[[name]]"');
+var TypedKnowledgeSchema = z.object({
+  title: z.string().min(1),
+  aliases: z.array(z.string()).optional(),
+  created: isoDate,
+  updated: isoDate,
+  type: z.enum(["entity", "concept", "comparison", "query"]),
+  tags: z.array(z.string()),
+  sources: z.array(z.string()).min(1),
+  confidence: z.enum(["high", "medium", "low"]).optional(),
+  contested: z.boolean().optional(),
+  contradictions: z.array(z.string()).optional(),
+  provenance: z.enum(["research", "project", "mixed"]).optional(),
+  provenance_projects: z.array(wikilink).optional(),
+  work_items: z.array(wikilink).optional(),
+  stale_ttl: z.number().int().positive().optional()
+}).superRefine((v, ctx) => {
+  if (v.provenance && v.provenance !== "research" && (!v.provenance_projects || v.provenance_projects.length === 0)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "required when provenance != research" });
+  }
+});
+var sha256Hex = z.string().regex(/^[0-9a-f]{64}$/);
+var RawSourceSchema = z.object({
+  title: z.string().min(1).optional(),
+  source_url: z.string().nullable(),
+  created: isoDate.optional(),
+  ingested: isoDate,
+  ingested_by: z.enum(["wiki-ingest", "proj-work", "manual"]).optional(),
+  sha256: sha256Hex.optional(),
+  project: wikilink.optional(),
+  work_item: wikilink.optional(),
+  kind: z.enum(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]).optional()
+}).superRefine((v, ctx) => {
+  if (v.work_item !== void 0 && (v.project === void 0 || v.kind === void 0)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "project and kind are required when work_item is set" });
+  }
+});
+var WorkItemSchema = z.object({
+  title: z.string().min(1),
+  aliases: z.array(z.string()).optional(),
+  created: isoDate,
+  updated: isoDate,
+  started: isoDate,
+  completed: isoDate.optional(),
+  kind: z.enum(["feature", "issue", "refactor", "decision"]),
+  status: z.enum(["planned", "in-progress", "completed", "abandoned"]),
+  priority: z.enum(["high", "medium", "low"]),
+  project: wikilink,
+  owner: wikilink.optional(),
+  parent: wikilink.optional(),
+  related: z.array(wikilink).optional(),
+  sources: z.array(z.string()).optional()
+}).superRefine((v, ctx) => {
+  if (v.status === "completed" && !v.completed) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["completed"], message: "required when status is completed" });
+  }
+});
+var CompoundSchema = z.object({
+  title: z.string().min(1),
+  aliases: z.array(z.string()).optional(),
+  created: isoDate,
+  updated: isoDate,
+  type: z.enum(["lesson", "pattern", "antipattern", "gotcha"]),
+  tags: z.array(z.string()),
+  confidence: z.enum(["high", "medium", "low"]),
+  contradicts: z.array(z.string()).optional(),
+  project: wikilink,
+  work_items: z.array(wikilink).min(1),
+  promoted_to: wikilink.optional(),
+  cssclasses: z.array(z.string()).optional()
+});
+var sessionPinPath = z.string().regex(
+  /^(entities|concepts|comparisons|queries|meta)\/.+\.md$/,
+  "must reference a typed-knowledge markdown page"
+);
+var SessionPinSchema = z.object({
+  title: z.string().min(1),
+  path: sessionPinPath,
+  scope: z.enum(["global", "project"]),
+  project: wikilink.optional(),
+  summary: z.string().min(1).optional(),
+  updated: isoDate.optional()
+}).superRefine((v, ctx) => {
+  if (v.scope === "project" && v.project === void 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["project"],
+      message: "project is required when scope is project"
+    });
+  }
+});
+var MetaSchema = z.object({
+  title: z.string().min(1),
+  aliases: z.array(z.string()).optional(),
+  created: isoDate,
+  updated: isoDate,
+  type: z.literal("meta"),
+  tags: z.array(z.string()),
+  confidence: z.enum(["high", "medium", "low"]).optional(),
+  provenance: z.enum(["research", "project", "mixed"]).optional(),
+  provenance_projects: z.array(wikilink).optional(),
+  generated_by: z.string().min(1).optional(),
+  generated_at: z.string().datetime().optional(),
+  generated_kind: z.enum(["session-brief"]).optional(),
+  meta_kind: z.enum(["session-pins"]).optional(),
+  stale_ttl: z.number().int().positive().optional(),
+  pins: z.array(SessionPinSchema).optional()
+}).superRefine((v, ctx) => {
+  const isGeneratedSessionBrief = v.generated_kind === "session-brief";
+  const isSessionPins = v.meta_kind === "session-pins";
+  if (isSessionPins && (!v.pins || v.pins.length === 0)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["pins"], message: "required when meta_kind is session-pins" });
+  }
+  if (!isGeneratedSessionBrief && !isSessionPins && (!v.provenance_projects || v.provenance_projects.length < 2)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "meta pages must reference \u22652 projects" });
+  }
+  if (v.provenance && v.provenance !== "research" && (!v.provenance_projects || v.provenance_projects.length === 0)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["provenance_projects"], message: "required when provenance != research" });
+  }
+});
+var hostId = z.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "must be a lowercase host id");
+var endpointName = z.string().min(1).regex(/^[A-Za-z0-9_.-]+$/, "must be a hostname-like token");
+var ipAddress = z.string().min(1).regex(/^[0-9a-fA-F:.]+$/, "must be an IP address token");
+var sshAlias = z.string().min(1).regex(/^[A-Za-z0-9_.@-]+$/, "must be an SSH alias token");
+var sshUser = z.string().min(1).regex(/^[A-Za-z0-9_.-]+$/, "must be an SSH user token");
+var absolutePath = z.string().min(1).regex(/^\//, "must be an absolute path");
+var FleetAccessProfileSchema = z.object({
+  status: z.enum(["local", "configured", "planned", "absent", "unknown"]),
+  ssh_aliases: z.array(sshAlias).optional(),
+  users: z.array(sshUser).optional(),
+  transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1)
+}).strict();
+var FleetHostIdentitySchema = z.object({
+  hostnames: z.array(endpointName).min(1),
+  public_addresses: z.array(ipAddress).optional(),
+  private_addresses: z.array(ipAddress).optional(),
+  tailscale: z.object({
+    node_names: z.array(endpointName).optional(),
+    magicdns_names: z.array(endpointName).optional(),
+    addresses: z.array(ipAddress).optional()
+  }).strict().optional()
+}).strict();
+var FleetSkillwikiSatelliteSchema = z.object({
+  enabled: z.boolean(),
+  user: sshUser,
+  vault_path: absolutePath,
+  repo_path: absolutePath,
+  ssh_alias: sshAlias,
+  scheduler: z.enum(["systemd"]),
+  timezone: z.string().min(1).optional(),
+  jobs: z.array(z.enum([
+    "self-update-check",
+    "vault-sync-preflight",
+    "agent-memory-trends-daily",
+    "session-brief-refresh",
+    "health-summary"
+  ])).min(1),
+  cadence: z.object({
+    self_update_check: z.literal("every-4-hours").optional(),
+    daily_window: z.string().min(1).optional()
+  }).strict().optional()
+}).strict();
+var FleetHostSchema = z.object({
+  class: z.enum(["dev-macos", "dev-linux", "prod-linux", "unknown"]),
+  role: z.enum(["leaf", "snapshotter"]),
+  writes_to: z.array(z.enum(["s3", "github"])).min(1),
+  protected: z.boolean().optional(),
+  identity: FleetHostIdentitySchema,
+  access: z.object({
+    from: z.record(hostId, FleetAccessProfileSchema).optional()
+  }).strict().optional(),
+  maintenance: z.object({
+    skillwiki_satellite: FleetSkillwikiSatelliteSchema.optional()
+  }).strict().optional()
+}).strict();
+var FleetManifestSchema = z.object({
+  "$schema": z.string().url().optional(),
+  schema_version: z.literal(1),
+  vault_remote: z.string().min(1),
+  s3_remote: z.string().min(1).optional(),
+  /** Optional host-id allowed to materialize root index.md/log.md projections. */
+  projection_authority: hostId.optional(),
+  hosts: z.record(hostId, FleetHostSchema)
+}).strict().superRefine((v, ctx) => {
+  const entries = Object.entries(v.hosts);
+  if (entries.length === 0) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["hosts"], message: "must contain at least one host" });
+  }
+  const snapshotters = entries.filter(([, host]) => host.role === "snapshotter").map(([id]) => id);
+  if (snapshotters.length !== 1) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["hosts"],
+      message: `must contain exactly one snapshotter host, found ${snapshotters.length}`
+    });
+  }
+  if (v.projection_authority) {
+    if (!v.hosts[v.projection_authority]) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["projection_authority"],
+        message: `projection_authority host \`${v.projection_authority}\` is not in hosts`
+      });
+    } else if (snapshotters.length === 1 && v.projection_authority !== snapshotters[0]) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["projection_authority"],
+        message: "projection_authority must be the sole snapshotter host"
+      });
+    }
+  }
+});
+function detectSchema(fm) {
+  const COMPOUND_TYPES = /* @__PURE__ */ new Set(["lesson", "pattern", "antipattern", "gotcha"]);
+  if (typeof fm.type === "string" && COMPOUND_TYPES.has(fm.type) && "project" in fm) return { schema: "compound" };
+  if (fm.type === "meta") return { schema: "meta" };
+  if ("type" in fm && "sources" in fm) return { schema: "typed-knowledge" };
+  if ("ingested" in fm && ("source_url" in fm || "sha256" in fm)) return { schema: "raw" };
+  const RAW_KINDS = /* @__PURE__ */ new Set(["postmortem", "session-log", "meeting-notes", "other", "idea", "bug", "task", "note"]);
+  if ("ingested" in fm && typeof fm.kind === "string" && RAW_KINDS.has(fm.kind)) return { schema: "raw" };
+  if ("kind" in fm && "status" in fm) return { schema: "work-item" };
+  return { schema: null };
+}
+
+// ../shared/src/blocked-hosts.ts
+var METADATA_HOSTS = /* @__PURE__ */ new Set([
+  "metadata.google.internal",
+  "metadata"
+]);
+var METADATA_IPS = /* @__PURE__ */ new Set(["169.254.169.254"]);
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const p of parts) {
+    const v = Number(p);
+    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
+    n = (n << 8) + v;
+  }
+  return n >>> 0;
+}
+function inRange(ip, baseStr, prefix) {
+  const ipN = ipv4ToInt(ip);
+  const baseN = ipv4ToInt(baseStr);
+  if (ipN === null || baseN === null) return false;
+  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
+  return (ipN & mask) === (baseN & mask);
+}
+function isBlockedHost(host) {
+  const lower = host.toLowerCase();
+  if (METADATA_HOSTS.has(lower)) return true;
+  if (METADATA_IPS.has(host)) return true;
+  if (lower === "::1") return true;
+  if (lower.startsWith("fe80:")) return true;
+  if (ipv4ToInt(host) === null) return false;
+  if (inRange(host, "10.0.0.0", 8)) return true;
+  if (inRange(host, "172.16.0.0", 12)) return true;
+  if (inRange(host, "192.168.0.0", 16)) return true;
+  if (inRange(host, "169.254.0.0", 16)) return true;
+  if (inRange(host, "127.0.0.0", 8)) return true;
+  return false;
+}
+
+// ../shared/src/error-message.ts
+function getErrorMessage(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+
+export {
+  ExitCode,
+  ok,
+  err,
+  TypedKnowledgeSchema,
+  RawSourceSchema,
+  WorkItemSchema,
+  CompoundSchema,
+  MetaSchema,
+  FleetManifestSchema,
+  detectSchema,
+  isBlockedHost,
+  getErrorMessage
+};