@agentxm/client-core 0.22.0 → 0.22.2

package/dist/src/unstable/files/refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../../../src/unstable/files/refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,GACjF,mBAAmB,CAAC;AACtB,oBAAoB;AACpB,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,GAC9E,kBAAkB,CAAC;AACrB,oBAAoB;AACpB,MAAM,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,eAAe,CAAC;AAC1F,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,WAAW,EAAE,eAAe,CAAC,GACjF,mBAAmB,CAAC;AAEtB,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GACzB,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,iBAAiB,CAAC"}
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../../../src/unstable/files/refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,GACjF,mBAAmB,CAAC;AACtB,oBAAoB;AACpB,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,GAC9E,kBAAkB,CAAC;AACrB,oBAAoB;AACpB,MAAM,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,eAAe,CAAC;AAC1F,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,WAAW,EAAE,eAAe,CAAC,GACjF,mBAAmB,CAAC;AAEtB,oBAAoB;AACpB,MAAM,MAAM,iBAAiB,GAC3B,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,GAAG,iBAAiB,CAAC"}

package/dist/src/unstable/knowledge/index.d.ts

@@ -1,5 +1,5 @@
 export { KNOWLEDGE_EXTENSION_DIR, KNOWLEDGE_MANIFEST_FILENAME, KNOWLEDGE_MANIFEST_SCHEMA_URL, KNOWLEDGE_SOURCE_DIR, KnowledgeManifestSchema, type KnowledgeManifest, } from "./manifest-schema.js";
-export { inspectKnowledgeBundle, openKnowledgeConcept, searchKnowledgeConcepts, type KnowledgeConcept, type KnowledgeDiagnostic, type KnowledgeInspection, } from "./okf.js";
+export { inspectKnowledgeBundle, inspectKnowledgeEntries, openKnowledgeConcept, searchKnowledgeConcepts, type KnowledgeBundleEntry, type KnowledgeConcept, type KnowledgeDiagnostic, type KnowledgeInspection, } from "./okf.js";
 export type { GitHostedKnowledgeRef, KnowledgeExtensionRef, LocalKnowledgeRef, RegistryKnowledgeRef, WorkspaceKnowledgeRef, } from "./refs.js";
 export { KnowledgeManager, KnowledgeManagerLive, type KnowledgeManagerService } from "./manager.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/unstable/knowledge/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/unstable/knowledge/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/unstable/knowledge/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}

package/dist/src/unstable/knowledge/index.js

@@ -1,4 +1,4 @@
 export { KNOWLEDGE_EXTENSION_DIR, KNOWLEDGE_MANIFEST_FILENAME, KNOWLEDGE_MANIFEST_SCHEMA_URL, KNOWLEDGE_SOURCE_DIR, KnowledgeManifestSchema, } from "./manifest-schema.js";
-export { inspectKnowledgeBundle, openKnowledgeConcept, searchKnowledgeConcepts, } from "./okf.js";
+export { inspectKnowledgeBundle, inspectKnowledgeEntries, openKnowledgeConcept, searchKnowledgeConcepts, } from "./okf.js";
 export { KnowledgeManager, KnowledgeManagerLive } from "./manager.js";
 //# sourceMappingURL=index.js.map

package/dist/src/unstable/knowledge/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/unstable/knowledge/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GAIxB,MAAM,UAAU,CAAC;AAQlB,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAgC,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/unstable/knowledge/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,GAKxB,MAAM,UAAU,CAAC;AAQlB,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAgC,MAAM,cAAc,CAAC"}

package/dist/src/unstable/knowledge/okf.d.ts

@@ -8,23 +8,32 @@ export interface KnowledgeConcept {
     readonly type?: string;
     readonly description?: string;
     readonly tags?: ReadonlyArray<string>;
+    readonly resource?: string;
+    readonly timestamp?: string;
     readonly relativePath: string;
     readonly body: string;
 }
 export interface KnowledgeDiagnostic {
-    readonly code: "bundle-too-large" | "file-too-large" | "invalid-tags" | "missing-root-index" | "missing-okf-version" | "missing-title" | "missing-description" | "missing-tags" | "suspicious-instruction" | "symbolic-link" | "too-many-files" | "unsupported-okf-version" | "missing-type" | "invalid-frontmatter";
+    readonly code: "bundle-too-large" | "file-too-large" | "invalid-tags" | "missing-root-index" | "missing-okf-version" | "missing-title" | "missing-description" | "missing-tags" | "symbolic-link" | "too-many-files" | "unsupported-okf-version" | "missing-type" | "invalid-frontmatter" | "case-collision" | "dangerous-uri" | "detected-secret" | "unsafe-path" | "invalid-index" | "invalid-log" | "invalid-resource" | "invalid-timestamp" | "broken-internal-link" | "escaping-link" | "unreachable-concept" | "missing-index-entry" | "stale-index-entry" | "embedded-html" | "malformed-citation" | "duplicate-resource" | "inconsistent-type" | "large-concept" | "large-index" | "unreferenced-asset";
     readonly severity: "error" | "warning";
     readonly relativePath: string;
+    readonly line?: number;
     readonly message: string;
 }
 export interface KnowledgeInspection {
     readonly concepts: ReadonlyArray<KnowledgeConcept>;
     readonly diagnostics: ReadonlyArray<KnowledgeDiagnostic>;
 }
+export interface KnowledgeBundleEntry {
+    readonly relativePath: string;
+    readonly type: FileSystem.File.Type;
+    readonly size: bigint;
+}
 /**
  * Inspect an OKF bundle. The root index requirement is an explicit AgentXM
  * profile constraint; upstream OKF 0.1 itself permits a root without it.
  */
+export declare const inspectKnowledgeEntries: <E>(entries: ReadonlyArray<KnowledgeBundleEntry>, readMarkdown: (relativePath: string) => Effect.Effect<string, E>) => Effect.Effect<KnowledgeInspection, E>;
 export declare const inspectKnowledgeBundle: (sourceRoot: string) => Effect.Effect<KnowledgeInspection, unknown, FileSystem.FileSystem | Path.Path>;
 export declare const searchKnowledgeConcepts: (concepts: ReadonlyArray<KnowledgeConcept>, query: string) => ReadonlyArray<KnowledgeConcept>;
 export declare const openKnowledgeConcept: (concepts: ReadonlyArray<KnowledgeConcept>, id: string) => KnowledgeConcept | undefined;

package/dist/src/unstable/knowledge/okf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"okf.d.ts","sourceRoot":"","sources":["../../../../src/unstable/knowledge/okf.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAIpC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EACT,kBAAkB,GAClB,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,wBAAwB,GACxB,eAAe,GACf,gBAAgB,GAChB,yBAAyB,GACzB,cAAc,GACd,qBAAqB,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC1D;AAkDD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GACjC,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAsK5E,CAAC;AAEL,eAAO,MAAM,uBAAuB,GAClC,UAAU,aAAa,CAAC,gBAAgB,CAAC,EACzC,OAAO,MAAM,KACZ,aAAa,CAAC,gBAAgB,CAQhC,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,UAAU,aAAa,CAAC,gBAAgB,CAAC,EACzC,IAAI,MAAM,KACT,gBAAgB,GAAG,SAA0D,CAAC"}
+{"version":3,"file":"okf.d.ts","sourceRoot":"","sources":["../../../../src/unstable/knowledge/okf.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAIpC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EACT,kBAAkB,GAClB,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,eAAe,GACf,gBAAgB,GAChB,yBAAyB,GACzB,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,aAAa,GACb,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,eAAe,GACf,qBAAqB,GACrB,qBAAqB,GACrB,mBAAmB,GACnB,eAAe,GACf,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,oBAAoB,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC1D;AAQD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAqJD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,CAAC,EACvC,SAAS,aAAa,CAAC,oBAAoB,CAAC,EAC5C,cAAc,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAC/D,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CA2enC,CAAC;AAEL,eAAO,MAAM,sBAAsB,GACjC,YAAY,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAQ5E,CAAC;AAEL,eAAO,MAAM,uBAAuB,GAClC,UAAU,aAAa,CAAC,gBAAgB,CAAC,EACzC,OAAO,MAAM,KACZ,aAAa,CAAC,gBAAgB,CAQhC,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,UAAU,aAAa,CAAC,gBAAgB,CAAC,EACzC,IAAI,MAAM,KACT,gBAAgB,GAAG,SAA0D,CAAC"}

package/dist/src/unstable/knowledge/okf.js

@@ -8,7 +8,8 @@ const RESERVED_BASENAMES = new Set(["index.md", "log.md"]);
 const MAX_FILE_BYTES = 1024n * 1024n;
 const MAX_BUNDLE_BYTES = 10n * 1024n * 1024n;
 const MAX_BUNDLE_FILES = 1_000;
-const SUSPICIOUS_INSTRUCTION = /\b(?:ignore|disregard|override)\b.{0,80}\b(?:previous|prior|system|developer|user|workspace)\b.{0,40}\b(?:instruction|prompt|message|rule)s?\b/is;
+const LARGE_CONCEPT_BYTES = 128n * 1024n;
+const LARGE_INDEX_BYTES = 256n * 1024n;
 const bundleEntries = (root, current) => Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
@@ -22,7 +23,7 @@ const bundleEntries = (root, current) => Effect.gen(function* () {
         }
         else {
             files.push({
-                relativePath: path.relative(root, absolute),
+                relativePath: path.relative(root, absolute).replace(/\\/g, "/"),
                 type: stat.type,
                 size: stat.size,
             });
@@ -39,19 +40,119 @@ const firstHeading = (body) => {
     return undefined;
 };
 const conceptId = (relativePath) => relativePath.replace(/\.md$/i, "");
+const markdownLinks = (body) => {
+    const links = [];
+    const pattern = /!?\[[^\]]*\]\(([^)\s]+)(?:\s+["'][^"']*["'])?\)/g;
+    for (const match of body.matchAll(pattern)) {
+        const target = match[1];
+        if (target === undefined)
+            continue;
+        const offset = match.index ?? 0;
+        links.push({
+            target,
+            line: body.slice(0, offset).split(/\r?\n/).length,
+        });
+    }
+    return links;
+};
+const metadataField = (metadata, key) => {
+    if (typeof metadata !== "object" || metadata === null)
+        return undefined;
+    return Object.entries(metadata).find(([entryKey]) => entryKey === key)?.[1];
+};
+const normalizedPath = (sourcePath, target) => {
+    const pathOnly = (target.split("#", 1)[0] ?? "").split("?", 1)[0] ?? "";
+    if (pathOnly.length === 0 || pathOnly.startsWith("//") || /^[a-z][a-z0-9+.-]*:/i.test(pathOnly)) {
+        return null;
+    }
+    const decoded = (() => {
+        try {
+            return decodeURIComponent(pathOnly);
+        }
+        catch {
+            return pathOnly;
+        }
+    })();
+    const sourceSegments = sourcePath.split("/").slice(0, -1);
+    const segments = decoded.startsWith("/")
+        ? decoded.slice(1).split("/")
+        : [...sourceSegments, ...decoded.split("/")];
+    const resolved = [];
+    let escaped = false;
+    for (const segment of segments) {
+        if (segment.length === 0 || segment === ".")
+            continue;
+        if (segment === "..") {
+            if (resolved.length === 0)
+                escaped = true;
+            else
+                resolved.pop();
+        }
+        else {
+            resolved.push(segment);
+        }
+    }
+    return { path: resolved.join("/"), escaped };
+};
+const activeScheme = (target) => /^(?:javascript|vbscript|data):/i.test(target.trim());
+const validIsoTimestamp = (value) => /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) &&
+    !Number.isNaN(Date.parse(value));
+const validResource = (value) => {
+    if (activeScheme(value))
+        return false;
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol.length > 1;
+    }
+    catch {
+        return false;
+    }
+};
+const secretPatterns = [
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    /\bAKIA[0-9A-Z]{16}\b/,
+    /\b(?:ghp|github_pat)_[A-Za-z0-9_]{20,}\b/,
+    /\b(?:sk_live|rk_live)_[A-Za-z0-9]{20,}\b/,
+];
+const secretLine = (raw) => {
+    const lines = raw.split(/\r?\n/);
+    const index = lines.findIndex((line) => secretPatterns.some((pattern) => pattern.test(line)));
+    return index === -1 ? undefined : index + 1;
+};
+const isReserved = (relativePath) => {
+    const baseName = relativePath.replace(/\\/g, "/").split("/").at(-1)?.toLowerCase();
+    return baseName !== undefined && RESERVED_BASENAMES.has(baseName);
+};
+const resolvedMarkdownTarget = (sourcePath, target, markdownPaths) => {
+    const normalized = normalizedPath(sourcePath, target);
+    if (normalized === null || normalized.escaped)
+        return normalized;
+    const candidates = normalized.path.toLowerCase().endsWith(".md")
+        ? [normalized.path]
+        : [normalized.path, `${normalized.path}.md`, `${normalized.path}/index.md`];
+    return {
+        path: candidates.find((candidate) => markdownPaths.has(candidate)) ??
+            candidates[0] ??
+            normalized.path,
+        escaped: false,
+    };
+};
 /**
  * Inspect an OKF bundle. The root index requirement is an explicit AgentXM
  * profile constraint; upstream OKF 0.1 itself permits a root without it.
  */
-export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const entries = yield* bundleEntries(sourceRoot, sourceRoot);
+export const inspectKnowledgeEntries = (entries, readMarkdown) => Effect.gen(function* () {
     const files = entries
         .filter((entry) => entry.type === "File" && entry.relativePath.toLowerCase().endsWith(".md"))
-        .map((entry) => entry.relativePath);
+        .map((entry) => entry.relativePath)
+        .sort((left, right) => left.localeCompare(right));
+    const markdownPaths = new Set(files);
+    const allFilePaths = new Set(entries.filter((entry) => entry.type === "File").map((entry) => entry.relativePath));
     const diagnostics = [];
     const concepts = [];
+    const linksByPath = new Map();
+    const resources = new Map();
+    const types = new Map();
     if (entries.length > MAX_BUNDLE_FILES) {
         diagnostics.push({
             code: "too-many-files",
@@ -69,7 +170,24 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
             message: "Knowledge bundle exceeds the 10 MiB uncompressed safety limit.",
         });
     }
+    const pathsByCase = new Map();
     for (const entry of entries) {
+        const segments = entry.relativePath.split("/");
+        if (entry.relativePath.startsWith("/") ||
+            entry.relativePath.includes("\\") ||
+            entry.relativePath.includes("\0") ||
+            segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+            diagnostics.push({
+                code: "unsafe-path",
+                severity: "error",
+                relativePath: entry.relativePath,
+                message: `${entry.relativePath} is not a safe bundle-relative path.`,
+            });
+        }
+        const folded = entry.relativePath.normalize("NFC").toLocaleLowerCase();
+        const colliding = pathsByCase.get(folded) ?? [];
+        colliding.push(entry.relativePath);
+        pathsByCase.set(folded, colliding);
         if (entry.type === "SymbolicLink") {
             diagnostics.push({
                 code: "symbolic-link",
@@ -86,6 +204,38 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
                 message: `${entry.relativePath} exceeds the 1 MiB per-file safety limit.`,
             });
         }
+        if (entry.type === "File" &&
+            entry.relativePath.toLowerCase().endsWith(".md") &&
+            isReserved(entry.relativePath) &&
+            entry.relativePath.toLowerCase().endsWith("index.md") &&
+            entry.size > LARGE_INDEX_BYTES) {
+            diagnostics.push({
+                code: "large-index",
+                severity: "warning",
+                relativePath: entry.relativePath,
+                message: `${entry.relativePath} is unusually large for progressive discovery.`,
+            });
+        }
+        else if (entry.type === "File" &&
+            entry.relativePath.toLowerCase().endsWith(".md") &&
+            entry.size > LARGE_CONCEPT_BYTES) {
+            diagnostics.push({
+                code: "large-concept",
+                severity: "warning",
+                relativePath: entry.relativePath,
+                message: `${entry.relativePath} is unusually large and may be expensive to consume.`,
+            });
+        }
+    }
+    for (const colliding of pathsByCase.values()) {
+        if (new Set(colliding).size > 1) {
+            diagnostics.push({
+                code: "case-collision",
+                severity: "error",
+                relativePath: colliding[0] ?? ".",
+                message: `Bundle paths collide on case-insensitive filesystems: ${colliding.join(", ")}.`,
+            });
+        }
     }
     if (!files.includes("index.md")) {
         diagnostics.push({
@@ -96,7 +246,48 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
         });
     }
     for (const relativePath of files) {
-        const raw = yield* fs.readFileString(path.join(sourceRoot, relativePath));
+        const raw = yield* readMarkdown(relativePath);
+        const links = markdownLinks(raw);
+        linksByPath.set(relativePath, links);
+        const foundSecretLine = secretLine(raw);
+        if (foundSecretLine !== undefined) {
+            diagnostics.push({
+                code: "detected-secret",
+                severity: "error",
+                relativePath,
+                line: foundSecretLine,
+                message: `${relativePath} contains a high-confidence credential or private key pattern.`,
+            });
+        }
+        for (const link of links) {
+            if (activeScheme(link.target)) {
+                diagnostics.push({
+                    code: "dangerous-uri",
+                    severity: "error",
+                    relativePath,
+                    line: link.line,
+                    message: `${relativePath} contains a dangerous active URI scheme.`,
+                });
+            }
+        }
+        const activeHtmlUri = /\b(?:href|src)\s*=\s*["']\s*(?:javascript|vbscript|data):/i.exec(raw);
+        if (activeHtmlUri !== null) {
+            diagnostics.push({
+                code: "dangerous-uri",
+                severity: "error",
+                relativePath,
+                line: raw.slice(0, activeHtmlUri.index).split(/\r?\n/).length,
+                message: `${relativePath} contains a dangerous active URI scheme.`,
+            });
+        }
+        if (/<\/?(?:script|iframe|object|embed|form|style|video|audio|svg|math)\b[^>]*>/i.test(raw)) {
+            diagnostics.push({
+                code: "embedded-html",
+                severity: "warning",
+                relativePath,
+                message: `${relativePath} contains embedded HTML; consumers must sanitize it.`,
+            });
+        }
         const parsed = yield* parseFrontmatterEffect(raw).pipe(Effect.option);
         if (Option.isNone(parsed)) {
             diagnostics.push({
@@ -107,9 +298,65 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
             });
             continue;
         }
-        const baseName = path.basename(relativePath).toLowerCase();
+        const baseName = (relativePath.replace(/\\/g, "/").split("/").at(-1) ?? relativePath).toLowerCase();
         const metadata = parsed.value.frontmatter;
         const isMetadata = typeof metadata === "object" && metadata !== null;
+        if (baseName === "index.md") {
+            if (relativePath !== "index.md" && metadata !== undefined) {
+                diagnostics.push({
+                    code: "invalid-index",
+                    severity: "error",
+                    relativePath,
+                    message: `${relativePath} is a reserved index and must not contain frontmatter.`,
+                });
+            }
+            if (firstHeading(parsed.value.body) === undefined) {
+                diagnostics.push({
+                    code: "invalid-index",
+                    severity: "error",
+                    relativePath,
+                    message: `${relativePath} must contain at least one level-one section heading.`,
+                });
+            }
+        }
+        if (baseName === "log.md") {
+            if (metadata !== undefined) {
+                diagnostics.push({
+                    code: "invalid-log",
+                    severity: "error",
+                    relativePath,
+                    message: `${relativePath} is a reserved log and must not contain frontmatter.`,
+                });
+            }
+            const dateHeadings = parsed.value.body
+                .split(/\r?\n/)
+                .map((line, index) => ({ line, number: index + 1 }))
+                .filter(({ line }) => /^##\s+/.test(line));
+            if (dateHeadings.some(({ line }) => !/^##\s+\d{4}-\d{2}-\d{2}\s*$/.test(line)) ||
+                dateHeadings.some(({ line }) => {
+                    const value = line.replace(/^##\s+/, "").trim();
+                    const parsedDate = Date.parse(`${value}T00:00:00Z`);
+                    return Number.isNaN(parsedDate);
+                })) {
+                const invalid = dateHeadings.find(({ line }) => !/^##\s+\d{4}-\d{2}-\d{2}\s*$/.test(line));
+                diagnostics.push({
+                    code: "invalid-log",
+                    severity: "error",
+                    relativePath,
+                    ...(invalid === undefined ? {} : { line: invalid.number }),
+                    message: `${relativePath} date headings must use valid ISO 8601 YYYY-MM-DD dates.`,
+                });
+            }
+            const dates = dateHeadings.map(({ line }) => line.replace(/^##\s+/, "").trim());
+            if (dates.some((date, index) => index > 0 && date > (dates[index - 1] ?? date))) {
+                diagnostics.push({
+                    code: "invalid-log",
+                    severity: "error",
+                    relativePath,
+                    message: `${relativePath} date headings must be newest first.`,
+                });
+            }
+        }
         const type = isMetadata &&
             "type" in metadata &&
             typeof metadata.type === "string" &&
@@ -125,6 +372,10 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
             metadata.tags.every((tag) => typeof tag === "string")
             ? metadata.tags
             : undefined;
+        const resourceValue = metadataField(metadata, "resource");
+        const resource = typeof resourceValue === "string" ? resourceValue : undefined;
+        const timestampValue = metadataField(metadata, "timestamp");
+        const timestamp = typeof timestampValue === "string" ? timestampValue : undefined;
         if (isMetadata && "tags" in metadata && metadata.tags !== undefined && tags === undefined) {
             diagnostics.push({
                 code: "invalid-tags",
@@ -152,6 +403,26 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
                 });
             }
         }
+        if (!RESERVED_BASENAMES.has(baseName) &&
+            resourceValue !== undefined &&
+            (resource === undefined || !validResource(resource))) {
+            diagnostics.push({
+                code: "invalid-resource",
+                severity: "error",
+                relativePath,
+                message: `${relativePath} resource must be a safe absolute URI.`,
+            });
+        }
+        if (!RESERVED_BASENAMES.has(baseName) &&
+            timestampValue !== undefined &&
+            (timestamp === undefined || !validIsoTimestamp(timestamp))) {
+            diagnostics.push({
+                code: "invalid-timestamp",
+                severity: "error",
+                relativePath,
+                message: `${relativePath} timestamp must be an ISO 8601 date-time with a timezone.`,
+            });
+        }
         if (!RESERVED_BASENAMES.has(baseName) && type === undefined) {
             diagnostics.push({
                 code: "missing-type",
@@ -185,13 +456,31 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
                 message: `${relativePath} should include frontmatter tags for discovery.`,
             });
         }
-        if (SUSPICIOUS_INSTRUCTION.test(parsed.value.body)) {
-            diagnostics.push({
-                code: "suspicious-instruction",
-                severity: "warning",
-                relativePath,
-                message: `${relativePath} contains instruction-like text that may be prompt injection; review it before publishing.`,
-            });
+        if (!RESERVED_BASENAMES.has(baseName) && resource !== undefined && validResource(resource)) {
+            const matching = resources.get(resource) ?? [];
+            matching.push(relativePath);
+            resources.set(resource, matching);
+        }
+        if (!RESERVED_BASENAMES.has(baseName) && type !== undefined) {
+            const spellings = types.get(type.toLocaleLowerCase()) ?? new Set();
+            spellings.add(type);
+            types.set(type.toLocaleLowerCase(), spellings);
+        }
+        const citationHeading = parsed.value.body.search(/^#\s+Citations\s*$/im);
+        if (citationHeading >= 0) {
+            const citationBody = parsed.value.body.slice(citationHeading).split(/\r?\n/).slice(1);
+            const malformedIndex = citationBody.findIndex((line) => /^\s*\[\d+\]/.test(line) && !/^\s*\[\d+\]\s+\[[^\]]+\]\([^)]+\)/.test(line));
+            if (malformedIndex >= 0) {
+                diagnostics.push({
+                    code: "malformed-citation",
+                    severity: "warning",
+                    relativePath,
+                    line: parsed.value.body.slice(0, citationHeading).split(/\r?\n/).length +
+                        malformedIndex +
+                        2,
+                    message: `${relativePath} contains a malformed numbered citation.`,
+                });
+            }
         }
         concepts.push({
             id: conceptId(relativePath),
@@ -199,12 +488,129 @@ export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
             ...(type === undefined ? {} : { type }),
             ...(description === undefined ? {} : { description }),
             ...(tags === undefined ? {} : { tags }),
+            ...(resource === undefined ? {} : { resource }),
+            ...(timestamp === undefined ? {} : { timestamp }),
             relativePath,
             body: parsed.value.body,
         });
     }
+    const outgoing = new Map();
+    const referencedFiles = new Set();
+    for (const [sourcePath, links] of linksByPath) {
+        const targets = new Set();
+        for (const link of links) {
+            const normalized = normalizedPath(sourcePath, link.target);
+            if (normalized === null)
+                continue;
+            if (normalized.escaped) {
+                diagnostics.push({
+                    code: "escaping-link",
+                    severity: "warning",
+                    relativePath: sourcePath,
+                    line: link.line,
+                    message: `${sourcePath} links outside the Knowledge bundle.`,
+                });
+                continue;
+            }
+            const resolved = resolvedMarkdownTarget(sourcePath, link.target, markdownPaths);
+            const targetPath = resolved?.path ?? normalized.path;
+            if (allFilePaths.has(targetPath))
+                referencedFiles.add(targetPath);
+            if (markdownPaths.has(targetPath)) {
+                targets.add(targetPath);
+            }
+            else if (!allFilePaths.has(targetPath)) {
+                diagnostics.push({
+                    code: sourcePath.toLowerCase().endsWith("index.md")
+                        ? "stale-index-entry"
+                        : "broken-internal-link",
+                    severity: "warning",
+                    relativePath: sourcePath,
+                    line: link.line,
+                    message: `${sourcePath} links to missing bundle path ${link.target}.`,
+                });
+            }
+        }
+        outgoing.set(sourcePath, targets);
+    }
+    const reachable = new Set();
+    const hasRootIndex = files.includes("index.md");
+    const pending = hasRootIndex ? ["index.md"] : [];
+    while (pending.length > 0) {
+        const current = pending.shift();
+        if (current === undefined || reachable.has(current))
+            continue;
+        reachable.add(current);
+        for (const target of outgoing.get(current) ?? [])
+            pending.push(target);
+    }
+    for (const concept of concepts) {
+        if (hasRootIndex &&
+            !isReserved(concept.relativePath) &&
+            !reachable.has(concept.relativePath)) {
+            diagnostics.push({
+                code: "unreachable-concept",
+                severity: "warning",
+                relativePath: concept.relativePath,
+                message: `${concept.relativePath} is not reachable from the root index.`,
+            });
+        }
+        if (!isReserved(concept.relativePath)) {
+            const directory = concept.relativePath.split("/").slice(0, -1).join("/");
+            const nearestIndex = directory.length === 0 ? "index.md" : `${directory}/index.md`;
+            if (markdownPaths.has(nearestIndex) &&
+                !(outgoing.get(nearestIndex) ?? new Set()).has(concept.relativePath)) {
+                diagnostics.push({
+                    code: "missing-index-entry",
+                    severity: "warning",
+                    relativePath: nearestIndex,
+                    message: `${nearestIndex} does not link to ${concept.relativePath}.`,
+                });
+            }
+        }
+    }
+    for (const entry of entries) {
+        if (entry.type === "File" &&
+            !entry.relativePath.toLowerCase().endsWith(".md") &&
+            !referencedFiles.has(entry.relativePath)) {
+            diagnostics.push({
+                code: "unreferenced-asset",
+                severity: "warning",
+                relativePath: entry.relativePath,
+                message: `${entry.relativePath} is not referenced by any Markdown document.`,
+            });
+        }
+    }
+    for (const [resource, matching] of resources) {
+        if (matching.length > 1) {
+            for (const relativePath of matching) {
+                diagnostics.push({
+                    code: "duplicate-resource",
+                    severity: "warning",
+                    relativePath,
+                    message: `${relativePath} shares canonical resource ${resource} with another concept.`,
+                });
+            }
+        }
+    }
+    for (const spellings of types.values()) {
+        if (spellings.size > 1) {
+            diagnostics.push({
+                code: "inconsistent-type",
+                severity: "warning",
+                relativePath: ".",
+                message: `Concept type spellings differ only by casing: ${[...spellings].sort().join(", ")}.`,
+            });
+        }
+    }
     return { concepts, diagnostics };
 });
+export const inspectKnowledgeBundle = (sourceRoot) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const entries = yield* bundleEntries(sourceRoot, sourceRoot);
+    return yield* inspectKnowledgeEntries(entries, (relativePath) => fs.readFileString(path.join(sourceRoot, relativePath)));
+});
 export const searchKnowledgeConcepts = (concepts, query) => {
     const needle = query.trim().toLocaleLowerCase();
     if (needle.length === 0)