vault-go 0.21.0 → 0.22.0

package/README.md

@@ -6,6 +6,8 @@ Para trocar a conta: `bunx --bun vault-go@latest login --force`. Para chave de A
 
 # vault-go
 
+[Idiomas AST e awareness local do Grok](docs/ast-and-awareness.md): catálogo de disponibilidade real das grammars, configuração opt-in, filtros e limites do writer mensal.
+
 Servidor MCP em Bun para pesquisar, contextualizar e registrar memória na
 plataforma Vault. A persistência fica no PostgreSQL do serviço Rust executado
 no EasyPanel; o painel local mantém um cache privado das consultas recentes.
@@ -92,6 +94,13 @@ Clientes suportados:
 - Roo Code;
 - OpenCode.
 
+O Crystal do Vault Desktop usa este mesmo servidor MCP. Ative **Crystal → MCP →
+Ativar no Vault MCP** no Desktop atualizado e reconecte o cliente MCP. As ferramentas
+`vault_go_crystal_list`, `read`, `search`, `write`, `delete`, `sync` e `status` ficam
+disponíveis junto às ferramentas de memória. O Desktop deve permanecer aberto no
+mesmo computador; a conexão local é configurada automaticamente, sem copiar um
+segredo ou cadastrar um segundo servidor. Desativar a integração revoga essa conexão.
+
 Comandos explícitos:
 
 ```sh
@@ -183,6 +192,8 @@ O seletor oferece Codex (Terra, Luna ou Sol pela assinatura ChatGPT), Claude (CL
 
 Na instalação, o Vault Go registra hooks no Claude Code, no Codex, no Grok, no Agy e no Gemini CLI. Eles carregam contexto e capturam os eventos oferecidos pelo cliente; o serviço local (`http://localhost:38850`) gera memórias com o motor escolhido, persistindo no Vault. No OpenCode 1.x, um plugin acrescenta contexto ao sistema antes das chamadas do modelo; esse adaptador não adiciona captura automática.
 
+Também há [captura persistente opt-in de transcripts Claude/Codex e contexto entre projetos](docs/transcripts-and-context.md), com comandos CLI e MCP, checkpoints privados e consentimento por workspace/conta. Ativar esses recursos preserva o motor/modelo escolhido.
+
 O recurso `vault-go://status` fornece o resumo sanitizado em JSON.
 
 Para reduzir o uso de contexto, prefira a recuperação em três camadas:
@@ -396,7 +407,10 @@ reiniciar o serviço; a atualização automática espera o processamento termina
 A comparação usa o código do claude-mem 13.25.2, commit
 `adce0fdfaf1cd46646bbd0b22ae74cbd460ed787`. A matriz acessível em
 `vault_go_capabilities` e no recurso `vault-go://capabilities` distingue funções
-implementadas, parciais e ausentes. Não se afirma paridade integral.
+implementadas e suas dependências. `deploymentVerified` resulta de consultas aos
+contratos da API/engine conectados, com cache privado de cinco minutos por conta;
+não presume autenticação dos provedores nem entrega de notificações. O recurso
+MCP lê somente o cache; a ferramenta verifica por padrão.
 
 Além das ferramentas acima, o MCP inclui:
 
@@ -413,10 +427,22 @@ Além das ferramentas acima, o MCP inclui:
   `filePattern` é glob. As ferramentas informam linguagens suportadas e truncamento,
   limitam leitura ao workspace e bloqueiam caminhos privados e escapes por symlink.
 
-Diferenças restantes incluem sessões persistentes de perguntas sobre corpora,
-herança de modos de captura/taxonomias, formatos nativos de importação SQLite,
-réplica offline completa, Telegram, CCS Align e watchers de transcrições dos
-clientes sem hooks nativos. O [scan completo](docs/claude-mem-upstream-scan.md)
+A busca aceita `query` opcional, `offset` e `orderBy`. A timeline também pode
+localizar a âncora por consulta. `vault_go_job` consulta um job individual.
+`vault_go_prime_corpus`, `vault_go_query_corpus` e `vault_go_reprime_corpus`
+respondem com o modelo escolhido, citações e histórico local cifrado de até 12 turnos.
+
+`vault_go_backup_create` salva todas as páginas de um snapshot consistente em
+arquivo privado, com SHA-256 e cobertura declarada. `vault_go_backup_restore`
+valida hash e proprietário antes de alterar preferências ou dados. Snapshots têm
+TTL de uma hora e limite explícito de 100 mil registros; exceder limites retorna
+erro, sem apresentar um backup truncado como completo. O formato é próprio do
+Vault; não equivale ao SQLite upstream nem a uma réplica offline.
+
+Telegram, CCS Align e taxonomias herdadas têm integrações locais próprias; veja
+[integrações de modos](docs/mode-integrations.md). Watchers de Claude/Codex e
+contexto entre projetos são configuráveis com consentimento; veja
+[transcripts e contexto](docs/transcripts-and-context.md). O [scan completo](docs/claude-mem-upstream-scan.md)
 registra os contratos upstream; a matriz MCP descreve a implementação atual.
 
 
@@ -440,6 +466,10 @@ pathfinder, design-is, what-the, version-bump, oh-my-issues, cloud-sync,
 mode-creator, ccs-align e wowerpoint.
 
 Babysit exige acesso do cliente ao GitHub por `gh` ou conector e acompanha o PR
-enquanto a solicitação está ativa. Modos de apresentação, CCS Align e cmem.ai
-informam as partes não implementadas no Vault. Ações externas seguem a autorização
-da tarefa; carregar um prompt não envia mensagens, publica versões ou faz merge.
+enquanto a solicitação está ativa. `mode-creator` instala taxonomias herdadas e
+`ccs-align` mantém cache, exclusões e relatório de regras por viewer. Wowerpoint
+ainda depende de um renderer de apresentação do cliente, e cmem.ai continua sendo
+um serviço distinto. Ações externas seguem a autorização da tarefa; carregar um
+prompt não envia mensagens, publica versões ou faz merge.
+
+A validação e as diferenças de arquitetura estão na [revisão de implantação](docs/parity-deployment-review.md).

package/dist/awareness-tools.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { VaultMemoryApi } from './cloud.js';
+export declare function registerAwarenessTools(server: McpServer, home: string, cloud: VaultMemoryApi): void;
+export declare function registerSmartLanguageTool(server: McpServer): void;

package/dist/awareness-tools.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { run } from './mcp-result.js';
+import { awarenessAccountBinding, awarenessStatus, configureAwareness, pushAwareness } from './grok-awareness.js';
+export function registerAwarenessTools(server, home, cloud) {
+    server.registerTool('vault_go_grok_awareness_status', { description: 'Estado do push local opt-in de fatos para agents/<UUID>/memory/log/YYYY-MM.md. Usa allowlist, filtros e a conta atual; não envia Telegram.', inputSchema: {}, annotations: { readOnlyHint: true, openWorldHint: false } }, () => run(async () => awarenessStatus(home)));
+    server.registerTool('vault_go_grok_awareness_configure', {
+        description: 'Configura escrita mensal local de awareness para agentes Grok explicitamente permitidos. Ativar exige consent=true, raiz absoluta existente e filtros; não altera profile.md. Jobs novos com agentId correspondente usam a mesma configuração.',
+        inputSchema: { enabled: z.boolean(), consent: z.boolean().default(false), agentDataRoot: z.string().min(1).max(2000).optional(), agentIds: z.array(z.string().uuid()).min(1).max(50).optional(), triggerTypes: z.array(z.string().min(1).max(100)).max(50).optional(), triggerConcepts: z.array(z.string().min(1).max(100)).max(50).optional() },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+    }, ({ enabled, consent, agentDataRoot, agentIds, triggerTypes, triggerConcepts }) => run(async () => configureAwareness(home, { enabled, consent, ...(agentDataRoot ? { agentDataRoot } : {}), ...(agentIds ? { agentIds } : {}), ...(triggerTypes ? { triggerTypes } : {}), ...(triggerConcepts ? { triggerConcepts } : {}) })));
+    server.registerTool('vault_go_grok_awareness_push', {
+        description: 'Lê memórias da conta por UUID e publica somente fatos que correspondem aos filtros para o agente permitido indicado. Exige configuração/consentimento prévio; mantém idempotência por corpo da linha no mês.',
+        inputSchema: { agentId: z.string().uuid(), memoryIds: z.array(z.string().uuid()).min(1).max(100) },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, ({ agentId, memoryIds }) => run(async () => {
+        const config = awarenessStatus(home);
+        if (!config.enabled || !config.agentIds.includes(agentId))
+            throw new Error('Awareness não habilitado para este agente.');
+        const binding = awarenessAccountBinding(home), records = await cloud.observations(memoryIds);
+        if (awarenessAccountBinding(home) !== binding)
+            throw new Error('Conta alterada durante leitura das memórias.');
+        if (!Array.isArray(records))
+            throw new Error('Resposta de memórias inválida.');
+        const strings = (value) => Array.isArray(value) ? value.filter((v) => typeof v === 'string').slice(0, 100) : [];
+        const observations = records.filter(r => r && typeof r === 'object' && typeof r.id === 'string' && memoryIds.includes(r.id)).map(r => ({
+            type: typeof r.memoryType === 'string' ? r.memoryType : typeof r.type === 'string' ? r.type : 'discovery',
+            title: typeof r.title === 'string' ? r.title : '', subtitle: typeof r.subtitle === 'string' ? r.subtitle : '', facts: strings(r.facts), concepts: strings(r.concepts),
+            private: r.private === true || r.isPrivate === true || r.is_private === true || /<(private|vault-private)\b/i.test(typeof r.content === 'string' ? r.content : ''),
+        }));
+        const result = await pushAwareness(home, { agentId, observations });
+        if (result.error)
+            throw new Error(result.error);
+        return result;
+    }));
+}
+export function registerSmartLanguageTool(server) {
+    server.registerTool('vault_go_smart_languages', { description: 'Lista idiomas/extensões AST, pacote da grammar e disponibilidade real neste sistema. Indisponibilidade nunca usa regex como fallback.', inputSchema: {}, annotations: { readOnlyHint: true, openWorldHint: false } }, () => run(async () => (await import('./smart-code.js')).smartLanguageStatus()));
+}

package/dist/backup.d.ts

@@ -0,0 +1,41 @@
+import type { VaultMemoryApi } from './cloud.js';
+interface EngineBackupPage {
+    version: number;
+    sourceOwnerId: string;
+    snapshotEpoch: number;
+    manifest: Record<string, unknown>;
+    records: unknown[];
+    nextCursor?: string | null;
+    hasMore: boolean;
+}
+interface LocalBackupV2 {
+    format: 'vault-go-private-backup-v2';
+    createdAtEpoch: number;
+    coverage: {
+        included: string[];
+        omitted: string[];
+        customTypes: string;
+        consistency: string;
+        snapshotLimits: string;
+        upstreamCompatible: false;
+    };
+    preferences: unknown;
+    pages: EngineBackupPage[];
+}
+export interface BackupFileResult {
+    backupId: string;
+    path: string;
+    sha256: string;
+    bytes: number;
+    pages: number;
+    records: number;
+    coverage: LocalBackupV2['coverage'];
+}
+export declare function createPrivateBackup(cloud: VaultMemoryApi, home?: string): Promise<BackupFileResult>;
+export declare function restorePrivateBackup(cloud: VaultMemoryApi, backupId: string, expectedSha256?: string, home?: string): Promise<{
+    backupId: string;
+    sha256: string;
+    pages: number;
+    records: number;
+}>;
+export {};

package/dist/backup.js

@@ -0,0 +1,117 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { captureCredential, captureOwner } from './transcript-config.js';
+import { vaultHome } from './config.js';
+function accountGuard(home) {
+    const owner = captureOwner(home), credential = captureCredential(home);
+    return () => { if (captureOwner(home) !== owner || captureCredential(home) !== credential)
+        throw new Error('A conta mudou durante o backup; operação interrompida.'); };
+}
+function backupDirectory(home) {
+    return join(home, 'backups');
+}
+function atomicPrivateWrite(path, value) {
+    const directory = dirname(path);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    chmodSync(directory, 0o700);
+    const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+}
+function parsePage(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Resposta de backup inválida.');
+    const page = value;
+    if (page.version !== 2 || !Array.isArray(page.records) || typeof page.hasMore !== 'boolean' || typeof page.sourceOwnerId !== 'string' || typeof page.snapshotEpoch !== 'number') {
+        throw new Error('Resposta de backup v2 inválida.');
+    }
+    return page;
+}
+export async function createPrivateBackup(cloud, home = vaultHome()) {
+    if (!cloud.preferences || !cloud.exportBackupPage)
+        throw new Error('A API não oferece backup completo.');
+    // Fetch gateway-owned preferences first. Failure stops before any archive is claimed complete.
+    const assertAccount = accountGuard(home);
+    const preferences = await cloud.preferences();
+    assertAccount();
+    const pages = [];
+    let cursor;
+    let sourceOwnerId;
+    let snapshotEpoch;
+    for (let count = 0; count < 100_000; count += 1) {
+        assertAccount();
+        const page = parsePage(await cloud.exportBackupPage({ limit: 50, ...(cursor ? { cursor } : {}) }));
+        assertAccount();
+        if (sourceOwnerId !== undefined && page.sourceOwnerId !== sourceOwnerId)
+            throw new Error('O proprietário mudou durante o backup.');
+        if (snapshotEpoch !== undefined && page.snapshotEpoch !== snapshotEpoch)
+            throw new Error('O snapshot mudou durante o backup.');
+        sourceOwnerId = page.sourceOwnerId;
+        snapshotEpoch = page.snapshotEpoch;
+        pages.push(page);
+        if (!page.hasMore)
+            break;
+        if (!page.nextCursor || page.nextCursor === cursor)
+            throw new Error('A paginação do backup não avançou.');
+        cursor = page.nextCursor;
+        if (count === 99_999)
+            throw new Error('O backup excedeu o limite de páginas.');
+    }
+    const coverage = {
+        included: ['preferences', 'projects', 'sessions', 'events', 'memories', 'graphLinks', 'graphPresets', 'knowledgeBases', 'knowledgeItems'],
+        omitted: ['embeddings (regenerable)', 'generationJobs (transient)', 'credentials', 'auditLogs', 'binaryBlobs'],
+        customTypes: 'Preserved inline through each memory kind and memory_type; no separate taxonomy table exists.',
+        consistency: 'Every engine page is read from one server-materialized tenant snapshot.',
+        snapshotLimits: 'The engine manifest declares snapshot TTL, maximum records, and active snapshots.',
+        upstreamCompatible: false,
+    };
+    const archive = { format: 'vault-go-private-backup-v2', createdAtEpoch: Date.now(), coverage, preferences, pages };
+    const directory = backupDirectory(home);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    chmodSync(directory, 0o700);
+    const backupId = `vault-go-backup-${new Date().toISOString().replace(/[:.]/gu, '-')}-${randomUUID()}.json`;
+    const path = join(directory, backupId);
+    atomicPrivateWrite(path, archive);
+    const bytes = readFileSync(path);
+    return { backupId, path, sha256: createHash('sha256').update(bytes).digest('hex'), bytes: statSync(path).size, pages: pages.length, records: pages.reduce((sum, page) => sum + page.records.length, 0), coverage };
+}
+export async function restorePrivateBackup(cloud, backupId, expectedSha256, home = vaultHome()) {
+    if (basename(backupId) !== backupId || !backupId.endsWith('.json'))
+        throw new Error('Identificador de backup inválido.');
+    if (!cloud.updatePreferences || !cloud.importBackupPage || !cloud.backupStatus)
+        throw new Error('A API não oferece restauração completa.');
+    const path = join(backupDirectory(home), backupId);
+    const bytes = readFileSync(path);
+    const sha256 = createHash('sha256').update(bytes).digest('hex');
+    if (expectedSha256 && expectedSha256.toLowerCase() !== sha256)
+        throw new Error('O hash SHA-256 do backup não confere.');
+    const archive = JSON.parse(bytes.toString('utf8'));
+    if (archive.format !== 'vault-go-private-backup-v2' || !Array.isArray(archive.pages) || archive.preferences === undefined)
+        throw new Error('Arquivo de backup v2 inválido.');
+    const assertAccount = accountGuard(home);
+    const status = await cloud.backupStatus();
+    assertAccount();
+    const pages = archive.pages.map(parsePage);
+    if (status?.version !== 2 || !status.ownerId || !pages.length || pages.some(page => page.sourceOwnerId !== status.ownerId))
+        throw new Error('O backup pertence a outra conta ou o serviço não confirmou o proprietário.');
+    if (pages.at(-1).hasMore || pages.some(page => page.snapshotEpoch !== pages[0].snapshotEpoch))
+        throw new Error('O arquivo não contém um snapshot completo e consistente.');
+    // Validate every page and the authenticated owner before the first mutation.
+    const preferenceKeys = ['captureMode', 'language', 'automaticCapture', 'includeToolResults', 'summaryMode', 'summaryMaxChars', 'contextItems', 'contextMaxChars'];
+    if (!archive.preferences || typeof archive.preferences !== 'object' || Array.isArray(archive.preferences))
+        throw new Error('Preferências inválidas no backup.');
+    const preferences = Object.fromEntries(Object.entries(archive.preferences).filter(([key]) => preferenceKeys.includes(key)));
+    if (!Object.keys(preferences).length)
+        throw new Error('O backup não contém preferências restauráveis.');
+    await cloud.updatePreferences(preferences);
+    let records = 0;
+    for (const page of pages) {
+        assertAccount();
+        await cloud.importBackupPage({ version: 2, sourceOwnerId: page.sourceOwnerId, records: page.records });
+        assertAccount();
+        records += page.records.length;
+    }
+    return { backupId, sha256, pages: archive.pages.length, records };
+}

package/dist/capabilities.d.ts

@@ -1,32 +1,225 @@
+import type { VaultMemoryApi } from './cloud.js';
+import { type DeploymentVerification } from './deployment-verification.js';
 /** Audited against source, not the upstream README's stale tool count. */
 export declare const CAPABILITIES: {
-    reference: {
-        repository: string;
-        version: string;
-        commit: string;
-        auditedAt: string;
+    readonly reference: {
+        readonly repository: "https://github.com/thedotmack/claude-mem";
+        readonly version: "13.25.2";
+        readonly commit: "adce0fdfaf1cd46646bbd0b22ae74cbd460ed787";
+        readonly auditedAt: "2026-09-20";
     };
-    deploymentVerified: boolean;
-    capabilities: ({
-        upstream: string[];
-        status: string;
-        tools: string[];
-        difference?: never;
-        requires?: never;
-    } | {
-        upstream: string[];
-        status: string;
-        tools: string[];
-        difference: string;
-        requires?: never;
-    } | {
-        upstream: string[];
-        status: string;
-        tools: string[];
-        requires: string;
-        difference?: never;
-    })[];
+    readonly verification: {
+        readonly capabilityVersion: "2026-09-20.1";
+        readonly cacheTtlMs: number;
+        readonly scope: "Authenticated Vault API and memory-engine contracts only. Provider logins, model quality, Telegram delivery and local watcher configuration are separate runtime dependencies.";
+        readonly interpretation: "A passing check confirms that the authenticated route and response contract were available at probe time; it does not certify full behavior or external-service configuration.";
+    };
+    readonly capabilities: readonly [{
+        readonly upstream: readonly ["important_workflow"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_workflow"];
+    }, {
+        readonly upstream: readonly ["search", "get_observations", "timeline"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_search_index", "vault_go_observations", "vault_go_timeline", "vault_go_feed"];
+        readonly difference: "Vault uses UUID identifiers. Search accepts an optional query, offset and date ordering; timeline accepts an explicit UUID or resolves an anchor from a query; feed uses stable cursor pagination.";
+    }, {
+        readonly upstream: readonly ["get_tool_uses"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_tool_uses"];
+        readonly requires: "Verified POST /memory/events/batch contract. Historical output exists only when captured; private fields and secrets are redacted from retrieval.";
+    }, {
+        readonly upstream: readonly ["session_start_context", "multi-project context"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_session_start_context", "vault_go_context", "vault_go_file_context", "vault_go_context_chain", "vault_go_context_chain_configure"];
+        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini; OpenCode 1.x remains context-only.";
+    }, {
+        readonly upstream: readonly ["smart_search", "smart_outline", "smart_unfold"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_smart_search", "vault_go_smart_outline", "vault_go_smart_unfold", "vault_go_smart_languages"];
+        readonly requires: "Real grammars for all 24 upstream languages plus HTML. Availability is reported per running platform; SCSS has no Linux ARM64 prebuild. Workspace reads and results are bounded.";
+    }, {
+        readonly upstream: readonly ["observation_add", "observation_record_event", "observation_search", "observation_context"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_remember", "vault_go_event", "vault_go_search", "vault_go_context"];
+        readonly requires: "generate:false prevents duplicate server processing on an updated engine. summaryMode=off preserves captured text without model extraction.";
+    }, {
+        readonly upstream: readonly ["automatic updates"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_update_status", "vault_go_update_check", "vault_go_update_install", "vault_go_update_configure"];
+        readonly requires: "Local worker running, npm installed and official registry reachable. Activation waits for idle state and rolls back failed runtimes.";
+    }, {
+        readonly upstream: readonly ["observation_generation_status"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_jobs", "vault_go_job", "vault_go_processing_status"];
+        readonly difference: "Cloud generation jobs and the local selected-model queue are intentionally reported as separate queues.";
+    }, {
+        readonly upstream: readonly ["build_corpus", "list_corpora", "rebuild_corpus"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_knowledge_build", "vault_go_knowledge_bases", "vault_go_knowledge_rebuild"];
+    }, {
+        readonly upstream: readonly ["prime_corpus", "query_corpus", "reprime_corpus"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_prime_corpus", "vault_go_query_corpus", "vault_go_reprime_corpus"];
+        readonly requires: "Uses the selected authenticated model. Conversation history is encrypted locally, isolated by account and corpus, bounded to 12 turns, and factual answers must cite retrieved memory IDs. Corpus loading is limited to an 8 MiB HTTP response; selected source JSON is limited to 16,000 characters.";
+    }, {
+        readonly upstream: readonly ["provider selection", "automatic observation processing"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_engines", "vault_go_engine_select", "vault_go_generate_context", "vault_go_processing_status"];
+        readonly requires: "Local worker running and the selected provider authenticated. Model availability and subscription or API billing are not covered by deployment verification.";
+    }, {
+        readonly upstream: readonly ["privacy", "capture modes", "context settings"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_preferences", "vault_go_preferences_update", "vault_go_custom_modes", "vault_go_custom_mode_get", "vault_go_custom_mode_save", "vault_go_custom_mode_select", "vault_go_custom_mode_delete"];
+        readonly requires: "Private-tag redaction and inherited custom taxonomies apply to future local processing. Preference updates require session authentication.";
+    }, {
+        readonly upstream: readonly ["import", "export"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_backup_create", "vault_go_backup_restore"];
+        readonly difference: "Legacy bounded batches remain available. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not the upstream SQLite format and is not an offline replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
+    }, {
+        readonly upstream: readonly ["cloud sync"];
+        readonly status: "partial";
+        readonly tools: readonly [];
+        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. This does not implement cmem.ai Pro synchronization or a complete offline SQLite replica.";
+    }, {
+        readonly upstream: readonly ["Telegram"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_telegram_status", "vault_go_telegram_configure", "vault_go_telegram_disable", "vault_go_telegram_test"];
+        readonly requires: "Explicit configuration, private bot credential environment and user-authorized test delivery. Deployment verification does not contact Telegram.";
+    }, {
+        readonly upstream: readonly ["CCS Align"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_ccs_align_health", "vault_go_ccs_align_cycle", "vault_go_ccs_align_exclude", "vault_go_ccs_align_restore", "vault_go_ccs_align_rules_check"];
+        readonly requires: "Local private middle cache and explicit cycle execution; rule checks report conflicts without modifying source rules.";
+    }, {
+        readonly upstream: readonly ["transcript watchers"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_transcripts_status", "vault_go_transcripts_configure", "vault_go_transcripts_poll"];
+        readonly difference: "Persistent, consented and resumable watchers are implemented for Claude and Codex transcripts. Other client transcript formats are not claimed.";
+    }, {
+        readonly upstream: readonly ["Grok awareness push"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_grok_awareness_status", "vault_go_grok_awareness_configure", "vault_go_grok_awareness_push"];
+        readonly requires: "Explicit consent, an allowlisted agent UUID and a local agent-data root. Monthly awareness logs are bounded, private and separate from Telegram.";
+    }, {
+        readonly upstream: readonly ["development/report/presentation skills", "babysit"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_modes", "vault_go_mode"];
+        readonly difference: "Vault workflow prompts expose requirements and runtime dependencies. Loading a mode does not itself start agents, publish, message or perform external actions.";
+    }];
 };
+/** API tools verify by default. Resources pass verify=false and never perform network I/O. */
+export declare function getCapabilities(home: string, cloud: VaultMemoryApi, verify?: boolean): Promise<{
+    deploymentVerified: boolean;
+    deploymentVerification: DeploymentVerification;
+    reference: {
+        readonly repository: "https://github.com/thedotmack/claude-mem";
+        readonly version: "13.25.2";
+        readonly commit: "adce0fdfaf1cd46646bbd0b22ae74cbd460ed787";
+        readonly auditedAt: "2026-09-20";
+    };
+    verification: {
+        readonly capabilityVersion: "2026-09-20.1";
+        readonly cacheTtlMs: number;
+        readonly scope: "Authenticated Vault API and memory-engine contracts only. Provider logins, model quality, Telegram delivery and local watcher configuration are separate runtime dependencies.";
+        readonly interpretation: "A passing check confirms that the authenticated route and response contract were available at probe time; it does not certify full behavior or external-service configuration.";
+    };
+    capabilities: readonly [{
+        readonly upstream: readonly ["important_workflow"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_workflow"];
+    }, {
+        readonly upstream: readonly ["search", "get_observations", "timeline"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_search_index", "vault_go_observations", "vault_go_timeline", "vault_go_feed"];
+        readonly difference: "Vault uses UUID identifiers. Search accepts an optional query, offset and date ordering; timeline accepts an explicit UUID or resolves an anchor from a query; feed uses stable cursor pagination.";
+    }, {
+        readonly upstream: readonly ["get_tool_uses"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_tool_uses"];
+        readonly requires: "Verified POST /memory/events/batch contract. Historical output exists only when captured; private fields and secrets are redacted from retrieval.";
+    }, {
+        readonly upstream: readonly ["session_start_context", "multi-project context"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_session_start_context", "vault_go_context", "vault_go_file_context", "vault_go_context_chain", "vault_go_context_chain_configure"];
+        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini; OpenCode 1.x remains context-only.";
+    }, {
+        readonly upstream: readonly ["smart_search", "smart_outline", "smart_unfold"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_smart_search", "vault_go_smart_outline", "vault_go_smart_unfold", "vault_go_smart_languages"];
+        readonly requires: "Real grammars for all 24 upstream languages plus HTML. Availability is reported per running platform; SCSS has no Linux ARM64 prebuild. Workspace reads and results are bounded.";
+    }, {
+        readonly upstream: readonly ["observation_add", "observation_record_event", "observation_search", "observation_context"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_remember", "vault_go_event", "vault_go_search", "vault_go_context"];
+        readonly requires: "generate:false prevents duplicate server processing on an updated engine. summaryMode=off preserves captured text without model extraction.";
+    }, {
+        readonly upstream: readonly ["automatic updates"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_update_status", "vault_go_update_check", "vault_go_update_install", "vault_go_update_configure"];
+        readonly requires: "Local worker running, npm installed and official registry reachable. Activation waits for idle state and rolls back failed runtimes.";
+    }, {
+        readonly upstream: readonly ["observation_generation_status"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_jobs", "vault_go_job", "vault_go_processing_status"];
+        readonly difference: "Cloud generation jobs and the local selected-model queue are intentionally reported as separate queues.";
+    }, {
+        readonly upstream: readonly ["build_corpus", "list_corpora", "rebuild_corpus"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_knowledge_build", "vault_go_knowledge_bases", "vault_go_knowledge_rebuild"];
+    }, {
+        readonly upstream: readonly ["prime_corpus", "query_corpus", "reprime_corpus"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_prime_corpus", "vault_go_query_corpus", "vault_go_reprime_corpus"];
+        readonly requires: "Uses the selected authenticated model. Conversation history is encrypted locally, isolated by account and corpus, bounded to 12 turns, and factual answers must cite retrieved memory IDs. Corpus loading is limited to an 8 MiB HTTP response; selected source JSON is limited to 16,000 characters.";
+    }, {
+        readonly upstream: readonly ["provider selection", "automatic observation processing"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_engines", "vault_go_engine_select", "vault_go_generate_context", "vault_go_processing_status"];
+        readonly requires: "Local worker running and the selected provider authenticated. Model availability and subscription or API billing are not covered by deployment verification.";
+    }, {
+        readonly upstream: readonly ["privacy", "capture modes", "context settings"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_preferences", "vault_go_preferences_update", "vault_go_custom_modes", "vault_go_custom_mode_get", "vault_go_custom_mode_save", "vault_go_custom_mode_select", "vault_go_custom_mode_delete"];
+        readonly requires: "Private-tag redaction and inherited custom taxonomies apply to future local processing. Preference updates require session authentication.";
+    }, {
+        readonly upstream: readonly ["import", "export"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_backup_create", "vault_go_backup_restore"];
+        readonly difference: "Legacy bounded batches remain available. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not the upstream SQLite format and is not an offline replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
+    }, {
+        readonly upstream: readonly ["cloud sync"];
+        readonly status: "partial";
+        readonly tools: readonly [];
+        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. This does not implement cmem.ai Pro synchronization or a complete offline SQLite replica.";
+    }, {
+        readonly upstream: readonly ["Telegram"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_telegram_status", "vault_go_telegram_configure", "vault_go_telegram_disable", "vault_go_telegram_test"];
+        readonly requires: "Explicit configuration, private bot credential environment and user-authorized test delivery. Deployment verification does not contact Telegram.";
+    }, {
+        readonly upstream: readonly ["CCS Align"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_ccs_align_health", "vault_go_ccs_align_cycle", "vault_go_ccs_align_exclude", "vault_go_ccs_align_restore", "vault_go_ccs_align_rules_check"];
+        readonly requires: "Local private middle cache and explicit cycle execution; rule checks report conflicts without modifying source rules.";
+    }, {
+        readonly upstream: readonly ["transcript watchers"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_transcripts_status", "vault_go_transcripts_configure", "vault_go_transcripts_poll"];
+        readonly difference: "Persistent, consented and resumable watchers are implemented for Claude and Codex transcripts. Other client transcript formats are not claimed.";
+    }, {
+        readonly upstream: readonly ["Grok awareness push"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_grok_awareness_status", "vault_go_grok_awareness_configure", "vault_go_grok_awareness_push"];
+        readonly requires: "Explicit consent, an allowlisted agent UUID and a local agent-data root. Monthly awareness logs are bounded, private and separate from Telegram.";
+    }, {
+        readonly upstream: readonly ["development/report/presentation skills", "babysit"];
+        readonly status: "available";
+        readonly tools: readonly ["vault_go_modes", "vault_go_mode"];
+        readonly difference: "Vault workflow prompts expose requirements and runtime dependencies. Loading a mode does not itself start agents, publish, message or perform external actions.";
+    }];
+}>;
 export declare const WORKFLOW: {
     steps: string[];
     guidance: string;