@bartolli/kmd 0.5.1 → 0.7.0

package/dist/kmd.mjs

@@ -27,9 +27,11 @@ function openDatabase(dbPath) {
   db.exec(SCHEMA);
   return db;
 }
+function kmdHome() {
+  return process.env.KMD_HOME ?? join(homedir(), ".kmd");
+}
 function indexRootDir() {
-  const home = process.env.KMD_HOME ?? join(homedir(), ".kmd");
-  return join(home, "db");
+  return join(kmdHome(), "db");
 }
 function canonicalVaultRoot(vaultRoot2) {
   try {
@@ -114,14 +116,24 @@ CREATE TABLE IF NOT EXISTS meta (
   }
 });
 
-// ../cli/src/config.ts
+// ../db/src/vault-config.ts
 import { readFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { parse } from "yaml";
 import { z } from "zod";
+function isValidRegex(pattern) {
+  try {
+    return Boolean(new RegExp(pattern));
+  } catch {
+    return false;
+  }
+}
 function kindName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
+function configJsonSchema() {
+  return z.toJSONSchema(VaultConfigSchema, { target: "draft-7" });
+}
 async function loadVaultConfig(vaultRoot2) {
   const path = join2(vaultRoot2, "vault.yaml");
   let raw;
@@ -138,37 +150,106 @@ ${issues}`);
   }
   return parsed.data;
 }
-var ScopeSchema, KindEntrySchema, VaultConfigSchema, BUILT_IN_KINDS;
-var init_config = __esm({
-  "../cli/src/config.ts"() {
+var ScopeSchema, KindEntrySchema, WhenSchema, TriggerSchema, TriggersSchema, VaultConfigSchema, BUILT_IN_KINDS;
+var init_vault_config = __esm({
+  "../db/src/vault-config.ts"() {
     "use strict";
-    ScopeSchema = z.object({
-      repo: z.string().optional(),
-      methodology: z.string().optional(),
-      status: z.string()
+    ScopeSchema = z.strictObject({
+      repo: z.string().optional().describe(
+        "Consumer repo path (~ expands). Load-bearing for kmd hook: the active scope resolves by matching the session cwd against it."
+      ),
+      methodology: z.string().optional().describe("Must appear in the methodologies list."),
+      status: z.string().describe("Free string; keep within statuses by convention.")
     });
     KindEntrySchema = z.union([
       z.string(),
-      z.object({
+      z.strictObject({
         name: z.string(),
-        signal: z.string(),
-        where: z.string()
+        signal: z.string().describe("When to pick this kind."),
+        where: z.string().describe("Path pattern pages of this kind follow.")
+      })
+    ]);
+    WhenSchema = z.union([
+      z.string(),
+      z.strictObject({
+        name: z.enum(["newer-than"]),
+        fresh: z.array(z.string().min(1)).min(1),
+        than: z.array(z.string().min(1)).min(1)
       })
     ]);
-    VaultConfigSchema = z.object({
-      scopes: z.record(z.string(), ScopeSchema),
-      kinds: z.array(KindEntrySchema),
-      statuses: z.array(z.string()),
-      methodologies: z.array(z.string()),
-      tags: z.object({
-        canonical: z.array(z.string()),
-        aliases: z.record(z.string(), z.string())
+    TriggerSchema = z.strictObject({
+      id: z.string().min(1).describe("Unique per scope list; duplicates keep the first occurrence."),
+      on: z.enum(["prompt", "pretool"]),
+      enforce: z.enum(["inject", "warn", "block"]).describe("inject: context line \xB7 warn: stderr \xB7 block: deny with reason."),
+      keywords: z.array(z.string().min(1)).optional().describe("Word-boundary, porter-stemmed match. Prompt triggers need keywords or intent."),
+      intent: z.array(z.string()).optional().describe("Case-insensitive regexes over the raw prompt \u2014 the stemming escape hatch."),
+      tool: z.string().optional().describe("Exact tool name; pretool matchers AND-compose."),
+      args_match: z.string().optional().describe("Regex over the serialized tool input."),
+      files: z.array(z.string().min(1)).optional().describe("Globs against the paths the tool touches; pretool triggers only."),
+      when: WhenSchema.optional().describe(
+        "Precondition \u2014 the gate fires only when it is UNMET. newer-than: the newest page matching fresh must carry frontmatter updated at or after the newest matching than."
+      ),
+      text: z.string().optional().describe("Required for inject and warn \u2014 the line emitted."),
+      reason: z.string().optional().describe("Required for block \u2014 the denial the agent reads.")
+    }).superRefine((trigger, ctx) => {
+      if (trigger.on === "prompt" && !trigger.keywords?.length && !trigger.intent?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `prompt trigger "${trigger.id}" needs keywords or intent`
+        });
+      }
+      if (trigger.on === "pretool" && trigger.tool === void 0 && trigger.args_match === void 0 && !trigger.files?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `pretool trigger "${trigger.id}" needs a tool, args_match, or files matcher`
+        });
+      }
+      if (trigger.on === "prompt" && trigger.files !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: `trigger "${trigger.id}": files applies to pretool triggers only`
+        });
+      }
+      if (trigger.enforce === "block" ? trigger.reason === void 0 : trigger.text === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: trigger.enforce === "block" ? `block trigger "${trigger.id}" needs a reason` : `${trigger.enforce} trigger "${trigger.id}" needs a text`
+        });
+      }
+      const patterns = [...trigger.intent ?? []];
+      if (trigger.args_match !== void 0) patterns.push(trigger.args_match);
+      for (const pattern of patterns) {
+        if (!isValidRegex(pattern)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `trigger "${trigger.id}" has an invalid regex: ${pattern}`
+          });
+        }
+      }
+    });
+    TriggersSchema = z.record(z.string(), z.array(TriggerSchema));
+    VaultConfigSchema = z.strictObject({
+      scopes: z.record(z.string(), ScopeSchema).describe("Scope name \u2192 entry; key = directory name under projects/."),
+      kinds: z.array(KindEntrySchema).describe(
+        "Page kind vocabulary; validate-enforced. Object form adds a kind-selector row to wiki://authoring."
+      ),
+      statuses: z.array(z.string()).describe("Page status vocabulary; validate-enforced."),
+      methodologies: z.array(z.string()).describe("Methodology vocabulary for pages and scope entries."),
+      tags: z.strictObject({
+        canonical: z.array(z.string()).describe("Approved tags."),
+        aliases: z.record(z.string(), z.string()).describe("Alias \u2192 canonical; validate warns on alias use.")
       }),
-      authoring_rules: z.string().optional(),
-      authoring_rules_extra: z.string().optional(),
-      sync_protocol: z.string().optional(),
-      sync_protocol_extra: z.string().optional()
-    }).superRefine((config, ctx) => {
+      authoring_rules: z.string().optional().describe("Replaces the served \xA7 Authoring rules entirely \u2014 escape hatch."),
+      authoring_rules_extra: z.string().optional().describe("Appended after the served \xA7 Authoring rules."),
+      sync_protocol: z.string().optional().describe("Replaces the served \xA7 Resync protocol entirely \u2014 escape hatch."),
+      sync_protocol_extra: z.string().optional().describe("Appended after the served \xA7 Resync protocol."),
+      triggers: TriggersSchema.optional().describe(
+        'Full-replace of the trigger base per scope \u2014 escape hatch. "_all" is reserved for triggers_extra.'
+      ),
+      triggers_extra: TriggersSchema.optional().describe(
+        'Appended per scope after the engine defaults; the reserved "_all" key fires in every session.'
+      )
+    }).describe("kmd vault.yaml \u2014 controlled vocabulary and gate triggers.").superRefine((config, ctx) => {
       for (const [name, scope] of Object.entries(config.scopes)) {
         if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
           ctx.addIssue({
@@ -178,6 +259,28 @@ var init_config = __esm({
           });
         }
       }
+      if (config.triggers?._all !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["triggers", "_all"],
+          message: '"_all" is reserved for triggers_extra'
+        });
+      }
+      for (const field of ["triggers", "triggers_extra"]) {
+        for (const [scope, list] of Object.entries(config[field] ?? {})) {
+          const seen = /* @__PURE__ */ new Set();
+          for (const trigger of list) {
+            if (seen.has(trigger.id)) {
+              ctx.addIssue({
+                code: "custom",
+                path: [field, scope],
+                message: `duplicate trigger id "${trigger.id}"`
+              });
+            }
+            seen.add(trigger.id);
+          }
+        }
+      }
     });
     BUILT_IN_KINDS = /* @__PURE__ */ new Set([
       "project",
@@ -220,11 +323,287 @@ var init_frontmatter = __esm({
   }
 });
 
+// ../cli/src/init-templates.ts
+var VAULT_TEMPLATES;
+var init_init_templates = __esm({
+  "../cli/src/init-templates.ts"() {
+    "use strict";
+    VAULT_TEMPLATES = {
+      "note.md": '---\ntitle: {{title}}\ntags: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n',
+      "project-adr.md": '---\ntitle: {{title}}\nkind: adr\nscope:\nstatus: active\nsummary:\ntags: []\nsupersedes:\nsuperseded_by:\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Status\n\n> [!info] Active\n\n## Context\n\nThe forces in tension \u2014 what made this a decision rather than an\nobvious step. Name the constraints; skip the history recap.\n\n## Decision\n\nWhat was decided, precisely. Predicates only \u2014 falsifiable, not\naspirational.\n\n## Rationale\n\nWhy this side won: which alternatives were live, and what killed each.\nAn ADR with no rejected alternative is a spec in disguise.\n\n## Consequences\n\nWhat this commits the project to going forward \u2014 including the costs\naccepted, not just the benefits claimed.\n\n## Links\n\n-\n',
+      "project-index.md": `---
+title: {{title}}
+kind: project
+methodology: sdd
+phase: 1
+repo:
+scope:
+status: active
+tags: []
+summary:
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+One paragraph. What this project is and what it delivers.
+
+## Current Phase
+
+What's in flight right now. 1\u20133 sentences.
+
+## Links
+
+- [[projects/{{title}}/primer]]
+
+## Sources
+
+-
+`,
+      "project-ops.md": `---
+title: {{title}}
+kind: ops
+scope:
+status: active
+summary:
+tags: []
+sources: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+What this runbook operates and when it runs.
+
+## Context
+
+What triggers this flow; what breaks when it's skipped.
+
+## Details
+
+Numbered steps executable without asking: exact commands, expected
+output, failure modes and their recovery. Predicates only \u2014 if a step
+needs judgment, say whose.
+
+## Links
+
+-
+
+## Sources
+
+-
+`,
+      "project-plan.md": `---
+title: {{title}}
+kind: plan
+scope:
+status: active
+summary:
+tags: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Goal
+
+One sentence: what this phase delivers. If it needs two, it's two
+plans.
+
+## Scope
+
+What's in and \u2014 more important \u2014 what's out. Out-of-scope lines stop
+scope creep better than in-scope lines define it.
+
+## Milestones
+
+Checkable outcomes, not activities. Tick here; don't cascade ticks to
+index.md unless phase or status changed.
+
+1.
+2.
+
+## Dependencies
+
+-
+
+## Status Log
+
+Dated one-liners, newest first. This is the only history surface \u2014
+primer and index stay clean.
+
+- {{date}}: Phase started.
+`,
+      "project-primer.md": "---\ncreated: \"{{date}}\"\nupdated: {{date}}\n---\n\n# Primer\n\n## Current Focus\n\nWhat we're working on right now. 1\u20133 sentences. Not a history log \u2014\nprogress lives in plan checkboxes; history lives in git.\n\n## Open Questions\n\nCurrently-open questions only. Strip on resolution; reflect the\nresolution in the relevant ADR or spec, not here.\n\n-\n\n## Blocked On\n\nNothing currently. List only items genuinely blocking forward\nprogress.\n\n## Load-bearing invariants (optional)\n\nFacts not derivable from code or commits \u2014 pipeline orderings, sync\nconstraints, file-location rationales. The kind of fact a fresh-context\nagent would otherwise re-derive incorrectly. Durable across sessions.\n\n## Read Order (optional)\n\n\u22645 entries. Wiki/doc pointers \u2014 what to read to orient. Each entry\none line: `[[wikilink]] \u2014 why`.\n\n1.\n\n## Working set (optional)\n\n\u226410 entries. File pointers (code, fixtures, configs) for the\nimmediate Next Steps, with one-line context. Lets a fresh-context\nagent skip the discovery loop. Task-scoped \u2014 refresh when focus\nshifts. Most valuable when transitioning phases or starting a new\nfeature; can be skipped mid-slice when the immediate context already\ncarries it.\n\n- `path/to/file` \u2014 why it's relevant for the next steps.\n",
+      "project-spec.md": `---
+title: {{title}}
+kind: spec
+scope:
+status: active
+summary:
+tags: []
+sources: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+One paragraph, in predicates \u2014 the system's current shape, not its
+history. If you're recording a *choice* between alternatives, stop:
+that's an ADR.
+
+## Context
+
+The question this spec answers and who asks it. One paragraph, no
+narrative arc.
+
+## Details
+
+The actual contract: inputs, outputs, invariants, failure modes. Use
+subsections per concern. Present tense \u2014 the spec describes what IS
+and must match current code at every commit.
+
+## Links
+
+-
+
+## Sources
+
+-
+`,
+      "project-story.md": '---\ntitle: {{title}}\nkind: story\nscope:\nparent:\nstatus: active\ntriage_state: needs-triage\ncategory: enhancement\nblocked_by: []\ntags: []\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## User Story\n\nAs a {{actor}}, I want {{capability}}, so that {{benefit}}.\n\n## Scenarios\n\nScenarios are the test specification \u2014 each becomes a failing test\nbefore implementation. Write observable outcomes, not implementation\nsteps.\n\n**Scenario: {{scenario name}}**\n- Given {{precondition}}\n- When {{action}}\n- Then {{expected outcome}}\n\n**Scenario: {{edge case name}}**\n- Given {{precondition}}\n- When {{action}}\n- Then {{expected outcome}}\n\n## Slices\n\nVertical tracer bullets: each slice ships signature + implementation +\ntests + wiring, independently committable. `AFK` = agent works alone;\n`HITL` = human in the loop.\n\n- [ ] **Slice 1** \u2014 {{description}} \xB7 `AFK` \xB7 [[spec-{{topic}}]]\n- [ ] **Slice 2** \u2014 {{description}} \xB7 `HITL` \xB7 [[adr-{{decision}}]]\n\n## References\n\n- [[spec-{{related-spec}}]]\n- [[adr-{{related-adr}}]]\n',
+      "research-article.md": '---\ntitle: {{title}}\nkind: article\ntopic:\nstatus: active\nsummary:\ntags: []\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nOne paragraph. What this page covers and why it matters.\n\n## Context\n\nWhy this page exists. The problem or question it addresses.\n\n## Details\n\nThe actual content. Use subsections as needed.\n\n## Links\n\n-\n\n## Sources\n\n-\n',
+      "research-index.md": '---\ntitle: {{title}}\nkind: topic\nstatus: active\nsummary:\nconfidence: medium\nsource_count: 0\ntags: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nOne paragraph. What this research topic covers.\n\n## Confidence\n\nWhy the confidence level is what it is. What would raise or lower it.\n\n## Pages\n\n-\n\n## Sources\n\n-\n',
+      "research-src.md": '---\ntitle: {{title}}\nkind: src\ntopic:\nstatus: active\nsummary:\ntags: []\nsource_url:\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nWhat this source is. Author, origin, year.\n\n## Key Points\n\n-\n\n## Quotes\n\n>\n\n## Relevance\n\nWhy this source matters to the topic.\n\n## Citation\n\n`{author, year, title, url}`\n'
+    };
+  }
+});
+
+// ../cli/src/init.ts
+import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import { join as join3, resolve as resolve2 } from "node:path";
+import { stringify } from "yaml";
+async function refreshSchemaFile(root) {
+  const path = join3(root, SCHEMA_FILE);
+  const next = `${JSON.stringify(configJsonSchema(), null, 2)}
+`;
+  try {
+    if (await readFile2(path, "utf8") === next) return false;
+  } catch {
+  }
+  await writeFile(path, next);
+  return true;
+}
+async function scaffoldVault(dir) {
+  const root = resolve2(dir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  if (entries.includes("vault.yaml")) {
+    throw new Error(`already a vault: ${root} (vault.yaml exists)`);
+  }
+  if (entries.length > 0) {
+    throw new Error(
+      `target is not empty: ${root}
+  found: ${entries.join(", ")}
+  delete it or pick another directory`
+    );
+  }
+  for (const domain of DOMAIN_DIRS) {
+    await mkdir(join3(root, domain), { recursive: true });
+  }
+  await mkdir(join3(root, "templates"), { recursive: true });
+  for (const [file, content] of Object.entries(VAULT_TEMPLATES)) {
+    await writeFile(join3(root, "templates", file), content);
+  }
+  await refreshSchemaFile(root);
+  await writeFile(join3(root, "vault.yaml"), SCHEMA_MODELINE + stringify(STARTER_CONFIG));
+  return root;
+}
+async function promptYesNo(question, input = process.stdin, output = process.stderr) {
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input, output });
+  try {
+    const answer = await rl.question(question);
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+async function runInit(dir, yes = false) {
+  let target = dir;
+  if (!target) {
+    if (yes) {
+      target = ".";
+    } else if (process.stdin.isTTY) {
+      const ok = await promptYesNo(`initialize a vault in ${resolve2(".")}? [y/N] `);
+      if (!ok) {
+        console.error("init: aborted");
+        process.exit(1);
+      }
+      target = ".";
+    } else {
+      console.error("usage: kmd init <dir>  (or --yes to scaffold the current directory)");
+      process.exit(2);
+    }
+  }
+  let root;
+  try {
+    root = await scaffoldVault(target);
+  } catch (err) {
+    console.error(`init: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+  const templateCount = Object.keys(VAULT_TEMPLATES).length;
+  console.log(`initialized empty vault at ${root}
+
+  vault.yaml           starter vocabulary \u2014 add your first scope under scopes:
+  vault.schema.json    IDE validation via the yaml-language-server modeline
+  templates/           ${templateCount} built-in templates (served at wiki://template/...)
+  projects/  research/  notes/
+
+next steps:
+  export WIKI_VAULT=${root}
+  kmd mcp ${root}    # stdio MCP server (prime, search)`);
+}
+var SCHEMA_FILE, SCHEMA_MODELINE, STARTER_CONFIG, DOMAIN_DIRS;
+var init_init = __esm({
+  "../cli/src/init.ts"() {
+    "use strict";
+    init_vault_config();
+    init_init_templates();
+    SCHEMA_FILE = "vault.schema.json";
+    SCHEMA_MODELINE = `# yaml-language-server: $schema=./${SCHEMA_FILE}
+`;
+    STARTER_CONFIG = {
+      scopes: {},
+      kinds: ["project", "spec", "adr", "plan", "story", "ops", "topic", "article", "src", "note"],
+      statuses: ["draft", "active", "superseded", "archived"],
+      methodologies: ["sdd", "tdd", "hybrid"],
+      tags: { canonical: [], aliases: {} }
+    };
+    DOMAIN_DIRS = ["projects", "research", "notes"];
+  }
+});
+
 // ../cli/src/sync.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync } from "node:fs";
-import { readdir, readFile as readFile2 } from "node:fs/promises";
-import { dirname, join as join3, relative, sep } from "node:path";
+import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
+import { dirname, join as join4, relative, sep } from "node:path";
 import { z as z2 } from "zod";
 function loadEnv() {
   const parsed = EnvSchema.safeParse({
@@ -240,18 +619,18 @@ function loadEnv() {
 async function walkMarkdown(root, domain) {
   const out = [];
   async function recurse(dir) {
-    const entries = await readdir(dir, { withFileTypes: true }).catch(() => null);
+    const entries = await readdir2(dir, { withFileTypes: true }).catch(() => null);
     if (!entries) return;
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
       if (entry.isDirectory()) {
-        await recurse(join3(dir, entry.name));
+        await recurse(join4(dir, entry.name));
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push(join3(dir, entry.name));
+        out.push(join4(dir, entry.name));
       }
     }
   }
-  await recurse(join3(root, domain));
+  await recurse(join4(root, domain));
   return out;
 }
 function toRelativePath(root, absolute) {
@@ -373,26 +752,24 @@ function syncPage(db, fields) {
   }
   return "changed";
 }
-async function runSync() {
-  const env = loadEnv();
-  const dbPath = resolveIndexPath(env.WIKI_VAULT);
-  console.log(`sync: ${env.WIKI_VAULT} \u2192 ${dbPath}`);
-  const vaultConfig = await loadVaultConfig(env.WIKI_VAULT);
+async function syncVault(vaultRoot2) {
+  const dbPath = resolveIndexPath(vaultRoot2);
+  const vaultConfig = await loadVaultConfig(vaultRoot2);
   const scopes = new Set(Object.keys(vaultConfig.scopes));
   mkdirSync(dirname(dbPath), { recursive: true });
   const db = openDatabase(dbPath);
   try {
     const files = [];
     for (const domain of SCAN_DOMAINS) {
-      files.push(...await walkMarkdown(env.WIKI_VAULT, domain));
+      files.push(...await walkMarkdown(vaultRoot2, domain));
     }
     const indexedPaths = [];
     let changed = 0;
     let unchanged = 0;
     let skipped = 0;
     for (const file of files) {
-      const path = toRelativePath(env.WIKI_VAULT, file);
-      const raw = await readFile2(file, "utf8");
+      const path = toRelativePath(vaultRoot2, file);
+      const raw = await readFile3(file, "utf8");
       const parsed = parseFrontmatter(raw);
       const fields = buildPageFields(path, raw, parsed, scopes);
       if (!fields) {
@@ -415,26 +792,44 @@ async function runSync() {
       pagesDeleted = Number(pageResult.changes);
       const linkResult = db.prepare("DELETE FROM links WHERE source_path NOT IN (SELECT path FROM pages)").run();
       linksDeleted = Number(linkResult.changes);
-    } else {
-      console.warn("no indexable pages found; skipping orphan deletion (safety)");
     }
     db.exec("INSERT INTO pages_fts(pages_fts) VALUES('rebuild')");
-    setMeta(db, "vault_root", canonicalVaultRoot(env.WIKI_VAULT));
+    setMeta(db, "vault_root", canonicalVaultRoot(vaultRoot2));
     setMeta(db, "last_synced", (/* @__PURE__ */ new Date()).toISOString());
-    console.log(
-      `done: ${changed} changed, ${unchanged} unchanged, ${skipped} skipped, ${pagesDeleted} pages deleted, ${linksDeleted} link orphans cleared`
-    );
+    if (await refreshSchemaFile(vaultRoot2)) {
+      console.error("sync: vault.schema.json refreshed to the running engine");
+    }
+    return {
+      changed,
+      unchanged,
+      skipped,
+      pagesDeleted,
+      linksDeleted,
+      noPages: indexedPaths.length === 0
+    };
   } finally {
     db.close();
   }
 }
+async function runSync() {
+  const env = loadEnv();
+  console.log(`sync: ${env.WIKI_VAULT} \u2192 ${resolveIndexPath(env.WIKI_VAULT)}`);
+  const stats = await syncVault(env.WIKI_VAULT);
+  if (stats.noPages) {
+    console.warn("no indexable pages found; skipping orphan deletion (safety)");
+  }
+  console.log(
+    `done: ${stats.changed} changed, ${stats.unchanged} unchanged, ${stats.skipped} skipped, ${stats.pagesDeleted} pages deleted, ${stats.linksDeleted} link orphans cleared`
+  );
+}
 var EnvSchema, SCAN_DOMAINS, WIKILINK_RE, INDEXED_FRONTMATTER_KEYS;
 var init_sync = __esm({
   "../cli/src/sync.ts"() {
     "use strict";
     init_database();
-    init_config();
+    init_vault_config();
     init_frontmatter();
+    init_init();
     EnvSchema = z2.object({
       WIKI_VAULT: z2.string().min(1)
     });
@@ -454,8 +849,8 @@ var init_sync = __esm({
 });
 
 // ../cli/src/validate.ts
-import { readFile as readFile3, stat } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { readFile as readFile4, stat } from "node:fs/promises";
+import { join as join5 } from "node:path";
 function hasIndexableTitle(data) {
   return typeof data.title === "string" && data.title.trim() !== "";
 }
@@ -813,7 +1208,7 @@ async function validateVault(root) {
   const pages = [];
   const linkPages = [];
   for (const { relPath, abs } of files) {
-    const raw = await readFile3(abs, "utf8");
+    const raw = await readFile4(abs, "utf8");
     findings.push(...validatePage(relPath, raw, cfg, refIndex));
     try {
       const parsed = parseFrontmatter(raw);
@@ -827,7 +1222,7 @@ async function validateVault(root) {
   for (const name of customKindNames(cfg)) {
     const file = `templates/${name}.md`;
     try {
-      await stat(join4(root, file));
+      await stat(join5(root, file));
     } catch {
       findings.push({
         path: file,
@@ -843,7 +1238,7 @@ var REQUIRED_FIELDS, TAG_OPTIONAL_KINDS, FOLDER_PATTERNS, UNIVERSAL_FLOOR;
 var init_validate = __esm({
   "../cli/src/validate.ts"() {
     "use strict";
-    init_config();
+    init_vault_config();
     init_frontmatter();
     init_sync();
     REQUIRED_FIELDS = {
@@ -901,12 +1296,13 @@ __export(cli_exports, {
   resolveCli: () => resolveCli,
   runConfig: () => runConfig,
   runDbReset: () => runDbReset,
+  runInit: () => runInit,
   runSyncCommand: () => runSyncCommand,
   runValidate: () => runValidate,
   vaultRoot: () => vaultRoot
 });
 import { existsSync, readdirSync, rmSync } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { dirname as dirname2, join as join6 } from "node:path";
 import { parseArgs } from "node:util";
 function resolveCli(argv) {
   const { positionals: positionals2 } = parseArgs({ args: argv, allowPositionals: true, strict: false });
@@ -976,7 +1372,7 @@ function knownVaults() {
   const known = [];
   for (const entry of readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const index = join5(root, entry.name, "index.db");
+    const index = join6(root, entry.name, "index.db");
     if (!existsSync(index)) continue;
     const db = openDatabase(index);
     try {
@@ -1039,6 +1435,7 @@ var init_cli = __esm({
     init_database();
     init_sync();
     init_validate();
+    init_init();
   }
 });
 
@@ -1059,7 +1456,7 @@ ${issues}`);
   };
 }
 var EnvSchema2;
-var init_config2 = __esm({
+var init_config = __esm({
   "../mcp/src/config.ts"() {
     "use strict";
     EnvSchema2 = z3.object({
@@ -1091,7 +1488,7 @@ var init_db = __esm({
 // ../mcp/src/lib/diag.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function diag(msg, data) {
   try {
     const line = data ? `${(/* @__PURE__ */ new Date()).toISOString()} pid=${process.pid} ${msg} ${JSON.stringify(data)}
@@ -1105,8 +1502,8 @@ var DIAG_DIR, DIAG_LOG_PATH;
 var init_diag = __esm({
   "../mcp/src/lib/diag.ts"() {
     "use strict";
-    DIAG_DIR = join6(homedir2(), ".local", "state", "wiki-mcp");
-    DIAG_LOG_PATH = join6(DIAG_DIR, "server.log");
+    DIAG_DIR = join7(homedir2(), ".local", "state", "wiki-mcp");
+    DIAG_LOG_PATH = join7(DIAG_DIR, "server.log");
     try {
       mkdirSync3(DIAG_DIR, { recursive: true });
     } catch {
@@ -1133,88 +1530,6 @@ var init_logger = __esm({
   }
 });
 
-// ../mcp/src/vault-config.ts
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join7 } from "node:path";
-import { parse as parse2 } from "yaml";
-import { z as z4 } from "zod";
-function kindName2(entry) {
-  return typeof entry === "string" ? entry : entry.name;
-}
-async function loadVaultConfig2(vaultRoot2) {
-  const path = join7(vaultRoot2, "vault.yaml");
-  let raw;
-  try {
-    raw = await readFile4(path, "utf8");
-  } catch (err) {
-    throw new Error(`vault.yaml not found at ${path}`, { cause: err });
-  }
-  const parsed = VaultConfigSchema2.safeParse(parse2(raw));
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-    throw new Error(`Invalid vault.yaml at ${path}:
-${issues}`);
-  }
-  return parsed.data;
-}
-var ScopeSchema2, KindEntrySchema2, VaultConfigSchema2, BUILT_IN_KINDS2;
-var init_vault_config = __esm({
-  "../mcp/src/vault-config.ts"() {
-    "use strict";
-    ScopeSchema2 = z4.object({
-      repo: z4.string().optional(),
-      methodology: z4.string().optional(),
-      status: z4.string()
-    });
-    KindEntrySchema2 = z4.union([
-      z4.string(),
-      z4.object({
-        name: z4.string(),
-        signal: z4.string(),
-        where: z4.string()
-      })
-    ]);
-    VaultConfigSchema2 = z4.object({
-      scopes: z4.record(z4.string(), ScopeSchema2),
-      kinds: z4.array(KindEntrySchema2),
-      statuses: z4.array(z4.string()),
-      methodologies: z4.array(z4.string()),
-      tags: z4.object({
-        canonical: z4.array(z4.string()),
-        aliases: z4.record(z4.string(), z4.string())
-      }),
-      authoring_rules: z4.string().optional(),
-      authoring_rules_extra: z4.string().optional(),
-      sync_protocol: z4.string().optional(),
-      sync_protocol_extra: z4.string().optional()
-    }).superRefine((config, ctx) => {
-      for (const [name, scope] of Object.entries(config.scopes)) {
-        if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["scopes", name, "methodology"],
-            message: `"${scope.methodology}" is not in the methodologies list`
-          });
-        }
-      }
-    });
-    BUILT_IN_KINDS2 = /* @__PURE__ */ new Set([
-      "project",
-      "spec",
-      "adr",
-      "plan",
-      "story",
-      "ops",
-      "topic",
-      "article",
-      "src",
-      "note",
-      "artifact",
-      "prompt"
-    ]);
-  }
-});
-
 // ../mcp/src/resources/authoring.ts
 function buildAuthoringRules(config) {
   const parts = [(config.authoring_rules ?? DEFAULT_AUTHORING_RULES).trim()];
@@ -1229,13 +1544,13 @@ function buildSyncProtocol(config) {
 function buildKindSelector(kinds) {
   const lines = ["## Kind selector", "", "| Signal | Kind | Where |", "|---|---|---|"];
   for (const entry of kinds) {
-    const name = kindName2(entry);
+    const name = kindName(entry);
     const pedagogy = typeof entry === "string" ? KIND_PEDAGOGY.get(entry) : entry;
     const signal = pedagogy?.signal ?? "\u2014";
     const where = pedagogy?.where ?? "\u2014";
     lines.push(`| ${signal} | **${name}** | ${where} |`);
   }
-  const names = kinds.map(kindName2);
+  const names = kinds.map(kindName);
   const hasNote = names.includes("note");
   const hasAdrAndSpec = names.includes("adr") && names.includes("spec");
   if (hasNote || hasAdrAndSpec) {
@@ -1258,7 +1573,7 @@ function buildVocabulary(config) {
   const lines = [
     "## Controlled vocabulary",
     "",
-    `**Kinds:** ${config.kinds.map(kindName2).join(", ")}`,
+    `**Kinds:** ${config.kinds.map(kindName).join(", ")}`,
     buildStatusLine(config.statuses),
     `**Methodologies:** ${config.methodologies.join(", ")}`,
     `**Canonical tags:** ${config.tags.canonical.join(", ")}`
@@ -1434,7 +1749,7 @@ import { join as join8 } from "node:path";
 function customTemplates(config) {
   const specs = [];
   for (const entry of config.kinds) {
-    if (typeof entry === "string" || BUILT_IN_KINDS2.has(entry.name)) continue;
+    if (typeof entry === "string" || BUILT_IN_KINDS.has(entry.name)) continue;
     specs.push({
       uri: `wiki://template/${entry.name}`,
       name: entry.name.charAt(0).toUpperCase() + entry.name.slice(1),
@@ -1635,7 +1950,7 @@ var init_toolResponse = __esm({
 });
 
 // ../mcp/src/tools/search.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 function search(deps, input) {
   const ftsQuery = sanitizeFtsQuery(input.query);
   if (!ftsQuery) return { results: [] };
@@ -1682,15 +1997,15 @@ var init_search = __esm({
     "use strict";
     init_fts();
     init_toolResponse();
-    SearchInputSchema = z5.object({
-      query: z5.string().min(1).describe(
+    SearchInputSchema = z4.object({
+      query: z4.string().min(1).describe(
         "Natural-language search query. Matched against title, summary, and body via SQLite FTS5."
       ),
-      scope: z5.string().optional().describe('Optional: restrict to a project scope (e.g. "ontology", "sotto").'),
-      kind: z5.string().optional().describe(
+      scope: z4.string().optional().describe('Optional: restrict to a project scope (e.g. "ontology", "sotto").'),
+      kind: z4.string().optional().describe(
         "Optional: restrict to a kind. Project kinds: spec, adr, plan, ops. Research kinds: article, src. Misc: note."
       ),
-      limit: z5.number().int().min(1).max(50).default(5).describe("Maximum number of ranked results to return. Default 5.")
+      limit: z4.number().int().min(1).max(50).default(5).describe("Maximum number of ranked results to return. Default 5.")
     });
     FTS_RANK = "bm25(pages_fts, 10.0, 5.0, 1.0)";
   }
@@ -1699,7 +2014,7 @@ var init_search = __esm({
 // ../mcp/src/tools/prime.ts
 import { readFile as readFile6 } from "node:fs/promises";
 import { basename as basename3, join as join9 } from "node:path";
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 function pathSlug(p) {
   return basename3(p).replace(/\.md$/, "");
 }
@@ -1842,7 +2157,7 @@ function renderMarkdown(d, config, task) {
     lines.push(countEntries.map(([k, n]) => `${k}: ${n}`).join(" | "));
   }
   lines.push("", "## Vocabulary");
-  lines.push(`kinds: ${config.kinds.map(kindName2).join(", ")}`);
+  lines.push(`kinds: ${config.kinds.map(kindName).join(", ")}`);
   lines.push(`statuses: ${config.statuses.join(", ")}`);
   lines.push(`tags: ${config.tags.canonical.join(", ")}`);
   if (d.top_tags.length > 0) {
@@ -1903,14 +2218,14 @@ var init_prime = __esm({
   "../mcp/src/tools/prime.ts"() {
     "use strict";
     init_database();
+    init_vault_config();
     init_frontmatter2();
     init_fts();
     init_toolResponse();
-    init_vault_config();
     init_search();
-    PrimeInputSchema = z6.object({
-      scope: z6.string().min(1).describe("Project scope to prime (matches projects/{scope}/ in the vault)."),
-      task: z6.string().optional().describe("Optional task description; surfaces top-3 tsvector-ranked relevant pages.")
+    PrimeInputSchema = z5.object({
+      scope: z5.string().min(1).describe("Project scope to prime (matches projects/{scope}/ in the vault)."),
+      task: z5.string().optional().describe("Optional task description; surfaces top-3 tsvector-ranked relevant pages.")
     });
   }
 });
@@ -1962,7 +2277,7 @@ async function startMcpServer() {
   diag("main entered");
   const config = loadConfig();
   diag("config loaded", { vault: config.wikiVault, level: config.logLevel });
-  const vaultConfig = await loadVaultConfig2(config.wikiVault);
+  const vaultConfig = await loadVaultConfig(config.wikiVault);
   diag("vault config loaded", {
     scopes: Object.keys(vaultConfig.scopes).length,
     kinds: vaultConfig.kinds.length,
@@ -2005,36 +2320,594 @@ async function startMcpServer() {
 var init_start = __esm({
   "../mcp/src/start.ts"() {
     "use strict";
-    init_config2();
+    init_vault_config();
+    init_config();
     init_db();
     init_diag();
     init_logger();
     init_server();
+  }
+});
+
+// ../cli/src/hook.ts
+var hook_exports = {};
+__export(hook_exports, {
+  dedupeMatches: () => dedupeMatches,
+  dedupePretoolMatches: () => dedupePretoolMatches,
+  effectiveTriggers: () => effectiveTriggers,
+  evaluateMatches: () => evaluateMatches,
+  hookStateDir: () => hookStateDir,
+  kiroIdePromptEvent: () => kiroIdePromptEvent,
+  loadTriggerFile: () => loadTriggerFile,
+  matchPretoolTriggers: () => matchPretoolTriggers,
+  matchPromptTriggers: () => matchPromptTriggers,
+  parsePretoolEvent: () => parsePretoolEvent,
+  parsePromptEvent: () => parsePromptEvent,
+  renderPosttool: () => renderPosttool,
+  renderPretool: () => renderPretool,
+  resolveScope: () => resolveScope,
+  runHookPosttool: () => runHookPosttool,
+  runHookPretool: () => runHookPretool,
+  runHookPrompt: () => runHookPrompt,
+  vaultPathTouched: () => vaultPathTouched
+});
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, rmSync as rmSync2, statSync, writeFileSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join10, resolve as resolve3, sep as sep2 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { parseArgs as parseArgs2 } from "node:util";
+import { parse as parseYaml3 } from "yaml";
+import { z as z6 } from "zod";
+function eventFields(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof data !== "object" || data === null) return null;
+  return data;
+}
+function parsePromptEvent(raw) {
+  const fields = eventFields(raw);
+  if (fields === null) return null;
+  const { session_id, prompt, cwd } = fields;
+  if (typeof session_id !== "string" || typeof prompt !== "string") return null;
+  return { session_id, prompt, ...typeof cwd === "string" && { cwd } };
+}
+function kiroIdePromptEvent(now = Date.now()) {
+  const prompt = process.env.USER_PROMPT;
+  if (prompt === void 0 || prompt === "") return null;
+  const cwd = process.cwd();
+  return { session_id: `kiro:${cwd}:${Math.floor(now / KIRO_IDE_BUCKET_MS)}`, prompt, cwd };
+}
+function loadTriggerFile(path) {
+  try {
+    const result = z6.array(TriggerSchema).safeParse(parseYaml3(readFileSync(path, "utf8")));
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+function effectiveTriggers(config, scope, fileTriggers = []) {
+  const replace = scope === void 0 ? void 0 : config.triggers?.[scope];
+  const base = replace ?? [...DEFAULT_TRIGGERS, ...fileTriggers];
+  const allExtras = config.triggers_extra?.[ALL_SCOPES_KEY] ?? [];
+  const scopeExtras = scope === void 0 || scope === ALL_SCOPES_KEY ? [] : config.triggers_extra?.[scope] ?? [];
+  const seen = /* @__PURE__ */ new Set();
+  const triggers = [];
+  const duplicates = [];
+  for (const trigger of [...base, ...allExtras, ...scopeExtras]) {
+    if (seen.has(trigger.id)) {
+      duplicates.push(trigger.id);
+      continue;
+    }
+    seen.add(trigger.id);
+    triggers.push(trigger);
+  }
+  return { triggers, duplicates };
+}
+function expandHome(path) {
+  if (path === "~") return homedir3();
+  return path.startsWith("~/") ? join10(homedir3(), path.slice(2)) : path;
+}
+function resolveScope(config, cwd) {
+  if (cwd === void 0 || cwd === "") return void 0;
+  let best;
+  let bestLength = -1;
+  for (const [name, scope] of Object.entries(config.scopes)) {
+    if (scope.repo === void 0) continue;
+    const repo = expandHome(scope.repo).replace(/\/+$/, "");
+    if (!repo.startsWith("/")) continue;
+    if (cwd !== repo && !cwd.startsWith(`${repo}/`)) continue;
+    if (repo.length > bestLength) {
+      best = name;
+      bestLength = repo.length;
+    }
+  }
+  return best;
+}
+function keywordQuery(keywords) {
+  return keywords.map((keyword) => `"${keyword.replaceAll('"', '""')}"`).join(" OR ");
+}
+function openPromptIndex(prompt) {
+  const db = new DatabaseSync2(":memory:");
+  db.exec(`CREATE VIRTUAL TABLE prompt_doc USING fts5(text, tokenize = 'porter unicode61')`);
+  db.prepare("INSERT INTO prompt_doc (text) VALUES (?)").run(prompt);
+  return db;
+}
+function matchPromptTriggers(prompt, triggers) {
+  const candidates = triggers.filter(
+    (trigger) => trigger.on === "prompt" && trigger.enforce === "inject" && trigger.text !== void 0
+  );
+  if (candidates.length === 0) return [];
+  const matches = [];
+  let db = null;
+  try {
+    for (const trigger of candidates) {
+      let hit = false;
+      if (trigger.keywords !== void 0 && trigger.keywords.length > 0) {
+        db ??= openPromptIndex(prompt);
+        const row = db.prepare("SELECT count(*) AS n FROM prompt_doc WHERE prompt_doc MATCH ?").get(keywordQuery(trigger.keywords));
+        hit = row.n > 0;
+      }
+      if (!hit && trigger.intent !== void 0) {
+        hit = trigger.intent.some((pattern) => new RegExp(pattern, "i").test(prompt));
+      }
+      if (hit) {
+        matches.push({ id: trigger.id, text: trigger.text });
+      }
+    }
+  } finally {
+    db?.close();
+  }
+  return matches;
+}
+function parsePretoolEvent(raw) {
+  const fields = eventFields(raw);
+  if (fields === null) return null;
+  const { session_id, tool_name, tool_input, cwd } = fields;
+  if (typeof session_id !== "string" || typeof tool_name !== "string") return null;
+  return { session_id, tool_name, tool_input, ...typeof cwd === "string" && { cwd } };
+}
+function globToRegExp(glob) {
+  let source = "^";
+  let i = 0;
+  while (i < glob.length) {
+    const char = glob[i];
+    if (char === "*") {
+      if (glob.startsWith("**/", i)) {
+        source += "(?:.*/)?";
+        i += 3;
+      } else if (glob.startsWith("**", i)) {
+        source += ".*";
+        i += 2;
+      } else {
+        source += "[^/]*";
+        i += 1;
+      }
+    } else if (char === "?") {
+      source += "[^/]";
+      i += 1;
+    } else {
+      source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+      i += 1;
+    }
+  }
+  return new RegExp(`${source}$`);
+}
+function pathCandidates(toolInput, cwd) {
+  if (typeof toolInput !== "object" || toolInput === null) return [];
+  const fields = toolInput;
+  const candidates = [];
+  for (const key of ["file_path", "notebook_path", "path"]) {
+    const value = fields[key];
+    if (typeof value === "string" && value !== "") {
+      candidates.push(value);
+      if (cwd !== void 0 && value.startsWith(`${cwd}/`)) {
+        candidates.push(value.slice(cwd.length + 1));
+      }
+    }
+  }
+  return candidates;
+}
+function matchPretoolTriggers(toolName, toolInput, triggers, cwd) {
+  const matches = [];
+  for (const trigger of triggers) {
+    if (trigger.on !== "pretool") continue;
+    if (trigger.tool !== void 0 && trigger.tool !== toolName) continue;
+    if (trigger.args_match !== void 0) {
+      const serialized = JSON.stringify(toolInput ?? {});
+      if (!new RegExp(trigger.args_match).test(serialized)) continue;
+    }
+    if (trigger.files !== void 0 && trigger.files.length > 0) {
+      const candidates = pathCandidates(toolInput, cwd);
+      const hit = trigger.files.some((glob) => {
+        const regex = globToRegExp(glob);
+        return candidates.some((candidate) => regex.test(candidate));
+      });
+      if (!hit) continue;
+    }
+    const text = trigger.enforce === "block" ? trigger.reason : trigger.text;
+    if (text === void 0) continue;
+    matches.push({
+      id: trigger.id,
+      enforce: trigger.enforce,
+      text,
+      ...trigger.when !== void 0 && { when: trigger.when }
+    });
+  }
+  return matches;
+}
+function evaluateMatches(matches, vaultRoot2) {
+  const fired = [];
+  const skipped = [];
+  for (const match of matches) {
+    if (match.when === void 0) {
+      fired.push(match);
+      continue;
+    }
+    const verdict = evaluateWhen(match.when, vaultRoot2);
+    if (verdict === null) skipped.push(match.id);
+    else if (!verdict) fired.push(match);
+  }
+  return { fired, skipped };
+}
+function evaluateWhen(when, vaultRoot2) {
+  if (typeof when === "string") return null;
+  try {
+    const than = newestUpdated(vaultRoot2, when.than);
+    if (than === null) return true;
+    const fresh = newestUpdated(vaultRoot2, when.fresh);
+    if (fresh === null) return false;
+    return fresh >= than;
+  } catch {
+    return null;
+  }
+}
+function newestUpdated(vaultRoot2, globs) {
+  const regexes = globs.map(globToRegExp);
+  let newest = null;
+  for (const entry of readdirSync2(vaultRoot2, { recursive: true })) {
+    const rel = entry.split(sep2).join("/");
+    if (!rel.endsWith(".md")) continue;
+    if (rel.startsWith(".") || rel.includes("/.")) continue;
+    if (!regexes.some((regex) => regex.test(rel))) continue;
+    const updated = readUpdated(join10(vaultRoot2, entry));
+    if (updated !== null && (newest === null || updated > newest)) {
+      newest = updated;
+    }
+  }
+  return newest;
+}
+function readUpdated(path) {
+  try {
+    const { data } = parseFrontmatter(readFileSync(path, "utf8"));
+    const updated = data.updated;
+    if (typeof updated === "string") return updated;
+    if (updated instanceof Date) return updated.toISOString().slice(0, 10);
+  } catch {
+  }
+  return null;
+}
+function renderPretool(matches, format) {
+  const block = matches.find((match) => match.enforce === "block");
+  const context = matches.filter((match) => match.enforce === "inject").map((match) => match.text);
+  const warnings = matches.filter((match) => match.enforce === "warn").map((match) => match.text);
+  if (format === "claude") {
+    const hookSpecificOutput = { hookEventName: "PreToolUse" };
+    if (block !== void 0) {
+      hookSpecificOutput.permissionDecision = "deny";
+      hookSpecificOutput.permissionDecisionReason = block.text;
+    }
+    if (context.length > 0) {
+      hookSpecificOutput.additionalContext = context.join("\n");
+    }
+    const decided = block !== void 0 || context.length > 0;
+    return { stdout: decided ? JSON.stringify({ hookSpecificOutput }) : null, stderr: warnings };
+  }
+  if (matches.length === 0) return { stdout: null, stderr: [] };
+  return {
+    stdout: JSON.stringify({
+      decision: block !== void 0 ? "deny" : "none",
+      ...block !== void 0 && { reason: block.text },
+      context,
+      warnings
+    }),
+    stderr: []
+  };
+}
+function patchPaths(toolInput) {
+  const fields = typeof toolInput === "object" && toolInput !== null ? toolInput : {};
+  const sources = [toolInput, fields.patch, fields.input, fields.command].filter(
+    (value) => typeof value === "string"
+  );
+  const paths = [];
+  for (const source of sources) {
+    for (const match of source.matchAll(PATCH_FILE_RE)) {
+      paths.push(match[1].trim());
+    }
+  }
+  return paths;
+}
+function vaultPathTouched(toolInput, vaultRoot2, cwd) {
+  const root = resolve3(vaultRoot2);
+  const candidates = [...pathCandidates(toolInput, cwd), ...patchPaths(toolInput)];
+  return candidates.some((candidate) => {
+    const absolute = resolve3(cwd ?? ".", candidate);
+    return absolute === root || absolute.startsWith(`${root}/`);
+  });
+}
+function renderPosttool(findings, synced, format) {
+  if (findings.length === 0 && synced) return null;
+  const lines = findings.map((f) => `${f.severity}: ${f.path} [${f.rule}] ${f.message}`);
+  if (format === "claude") {
+    if (hasErrors(findings)) {
+      return JSON.stringify({
+        decision: "block",
+        reason: `kmd validate failed \u2014 fix before the index syncs:
+${lines.join("\n")}`
+      });
+    }
+    const hookSpecificOutput = { hookEventName: "PostToolUse" };
+    const notes = [...lines];
+    if (!synced) notes.push("kmd sync failed \u2014 index not updated; see hook stderr");
+    hookSpecificOutput.additionalContext = notes.join("\n");
+    return JSON.stringify({ hookSpecificOutput });
+  }
+  return JSON.stringify({ findings, synced });
+}
+function dedupePretoolMatches(stateDir, sessionId, matches) {
+  const blocks = matches.filter((match) => match.enforce === "block");
+  const rest = matches.filter((match) => match.enforce !== "block");
+  const fresh = dedupeMatches(stateDir, sessionId, rest);
+  return matches.filter((match) => blocks.includes(match) || fresh.includes(match));
+}
+function hookStateDir() {
+  return join10(kmdHome(), "state", "hook");
+}
+function dedupeMatches(stateDir, sessionId, matches) {
+  if (matches.length === 0) return [];
+  const file = join10(stateDir, `${sessionId.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+  const fired = readFired(file);
+  const fresh = matches.filter((match) => !fired.has(match.id));
+  if (fresh.length > 0) {
+    mkdirSync4(stateDir, { recursive: true });
+    for (const match of fresh) {
+      fired.add(match.id);
+    }
+    writeFileSync(file, JSON.stringify([...fired]));
+    pruneStale(stateDir, file);
+  }
+  return fresh;
+}
+function readFired(file) {
+  try {
+    const data = JSON.parse(readFileSync(file, "utf8"));
+    if (Array.isArray(data)) {
+      return new Set(data.filter((entry) => typeof entry === "string"));
+    }
+  } catch {
+  }
+  return /* @__PURE__ */ new Set();
+}
+function pruneStale(stateDir, keep) {
+  try {
+    const cutoff = Date.now() - SESSION_STATE_MAX_AGE_MS;
+    for (const entry of readdirSync2(stateDir)) {
+      const path = join10(stateDir, entry);
+      if (path !== keep && statSync(path).mtimeMs < cutoff) {
+        rmSync2(path, { force: true });
+      }
+    }
+  } catch {
+  }
+}
+function hookInvocation() {
+  const { values: values2, positionals: positionals2 } = parseArgs2({
+    args: process.argv.slice(2),
+    allowPositionals: true,
+    strict: false,
+    options: {
+      scope: { type: "string" },
+      harness: { type: "string" },
+      triggers: { type: "string" }
+    }
+  });
+  const vaultRoot2 = positionals2[2] ?? process.env.WIKI_VAULT;
+  if (vaultRoot2 === void 0 || vaultRoot2 === "") {
+    diag2("no vault root (positional or $WIKI_VAULT)");
+    return null;
+  }
+  return {
+    vaultRoot: vaultRoot2,
+    scope: typeof values2.scope === "string" ? values2.scope : process.env.WIKI_SCOPE,
+    harness: values2.harness,
+    triggersFile: values2.triggers
+  };
+}
+function resolveFileTriggers(invocation) {
+  if (typeof invocation.triggersFile !== "string") return [];
+  const loaded = loadTriggerFile(invocation.triggersFile);
+  if (loaded === null) {
+    diag2(`triggers file unreadable or invalid: ${invocation.triggersFile}`);
+    return [];
+  }
+  return loaded;
+}
+async function runHookPrompt() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    const { vaultRoot: vaultRoot2 } = invocation;
+    let event = null;
+    if (invocation.harness === "kiro-ide") {
+      event = kiroIdePromptEvent();
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 reading the neutral stdin event`);
+    }
+    event ??= parsePromptEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a prompt event ({session_id, prompt})");
+      return;
+    }
+    const config = await loadVaultConfig(vaultRoot2);
+    const scope = invocation.scope ?? resolveScope(config, event.cwd);
+    const { triggers, duplicates } = effectiveTriggers(
+      config,
+      scope,
+      resolveFileTriggers(invocation)
+    );
+    for (const id of duplicates) {
+      diag2(`duplicate trigger id "${id}" \u2014 later occurrence ignored`);
+    }
+    const matches = matchPromptTriggers(event.prompt, triggers);
+    for (const match of dedupeMatches(hookStateDir(), event.session_id, matches)) {
+      console.log(match.text);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function runHookPretool() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    const { vaultRoot: vaultRoot2 } = invocation;
+    let format = "neutral";
+    if (invocation.harness === "claude") {
+      format = "claude";
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 emitting the neutral contract`);
+    }
+    const event = parsePretoolEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a pretool event ({session_id, tool_name})");
+      return;
+    }
+    const config = await loadVaultConfig(vaultRoot2);
+    const scope = invocation.scope ?? resolveScope(config, event.cwd);
+    const { triggers, duplicates } = effectiveTriggers(
+      config,
+      scope,
+      resolveFileTriggers(invocation)
+    );
+    for (const id of duplicates) {
+      diag2(`duplicate trigger id "${id}" \u2014 later occurrence ignored`);
+    }
+    const matches = matchPretoolTriggers(event.tool_name, event.tool_input, triggers, event.cwd);
+    const { fired, skipped } = evaluateMatches(matches, vaultRoot2);
+    for (const id of skipped) {
+      diag2(`trigger "${id}": unknown or unevaluable predicate \u2014 skipped`);
+    }
+    const rendered = renderPretool(
+      dedupePretoolMatches(hookStateDir(), event.session_id, fired),
+      format
+    );
+    for (const line of rendered.stderr) {
+      console.error(line);
+    }
+    if (rendered.stdout !== null) {
+      console.log(rendered.stdout);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function runHookPosttool() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    let format = "neutral";
+    if (invocation.harness === "claude") {
+      format = "claude";
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 emitting the neutral contract`);
+    }
+    const event = parsePretoolEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a posttool event ({session_id, tool_name})");
+      return;
+    }
+    if (!vaultPathTouched(event.tool_input, invocation.vaultRoot, event.cwd)) return;
+    const findings = await validateVault(invocation.vaultRoot);
+    let synced = false;
+    if (!hasErrors(findings)) {
+      try {
+        await syncVault(invocation.vaultRoot);
+        synced = true;
+      } catch (err) {
+        diag2(`sync failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const rendered = renderPosttool(findings, synced, format);
+    if (rendered !== null) {
+      console.log(rendered);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function readStdin() {
+  process.stdin.setEncoding("utf8");
+  let input = "";
+  for await (const chunk of process.stdin) {
+    input += chunk;
+  }
+  return input;
+}
+function diag2(message) {
+  console.error(`kmd hook: ${message}`);
+}
+var DEFAULT_TRIGGERS, SESSION_STATE_MAX_AGE_MS, KIRO_IDE_BUCKET_MS, ALL_SCOPES_KEY, PATCH_FILE_RE;
+var init_hook = __esm({
+  "../cli/src/hook.ts"() {
+    "use strict";
+    init_database();
     init_vault_config();
+    init_frontmatter();
+    init_sync();
+    init_validate();
+    DEFAULT_TRIGGERS = [];
+    SESSION_STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+    KIRO_IDE_BUCKET_MS = 30 * 60 * 1e3;
+    ALL_SCOPES_KEY = "_all";
+    PATCH_FILE_RE = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm;
   }
 });
 
 // bin/kmd.ts
-import { parseArgs as parseArgs2 } from "node:util";
+import { parseArgs as parseArgs3 } from "node:util";
+process.removeAllListeners("warning");
+process.on("warning", (warning) => {
+  if (warning.name !== "ExperimentalWarning") {
+    console.error(warning.stack ?? `${warning.name}: ${warning.message}`);
+  }
+});
 var USAGE = `usage: kmd <command> [options]
 
 commands:
+  init [<dir>] [-y]        scaffold a fresh vault (no dir: current directory \u2014 TTY prompt, or -y)
   sync                     vault \u2192 index sync (runs validate first)
   validate [<path>]        deterministic vault checker (default: $WIKI_VAULT)
   mcp [<vault-root>]       start the stdio MCP server (default: $WIKI_VAULT)
   config [<vault-root>]    print vault + index resolution; with no vault, list known vaults
   db reset [<vault-root>]  delete the vault's index (default: $WIKI_VAULT)
+  hook <prompt|pretool|posttool> [<vault-root>] [--scope <s>] [--harness <claude|kiro-ide>] [--triggers <file>]
+                           harness gate engine: JSON event on stdin, decision/context on stdout;
+                           posttool auto-runs validate + sync after a vault write
 
 options:
   --version   print version
   --help      show this help`;
-var { positionals, values } = parseArgs2({
+var { positionals, values } = parseArgs3({
   args: process.argv.slice(2),
   allowPositionals: true,
   strict: false,
   options: {
     version: { type: "boolean", short: "v" },
-    help: { type: "boolean", short: "h" }
+    help: { type: "boolean", short: "h" },
+    yes: { type: "boolean", short: "y" }
   }
 });
 var command = values.version ? "--version" : values.help ? "--help" : positionals[0];
@@ -2046,6 +2919,11 @@ function applyVaultRoot(positionalIndex) {
 }
 async function run() {
   switch (command) {
+    case "init": {
+      const { runInit: runInit2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+      await runInit2(positionals[1], Boolean(values.yes));
+      break;
+    }
     case "sync": {
       const { runSyncCommand: runSyncCommand2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
       await runSyncCommand2();
@@ -2081,13 +2959,34 @@ async function run() {
       }
       break;
     }
+    case "hook": {
+      const sub = positionals[1];
+      if (sub === "prompt") {
+        const { runHookPrompt: runHookPrompt2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPrompt2();
+      } else if (sub === "pretool") {
+        const { runHookPretool: runHookPretool2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPretool2();
+      } else if (sub === "posttool") {
+        const { runHookPosttool: runHookPosttool2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPosttool2();
+      } else if (sub) {
+        console.error(`kmd hook: unknown event: ${sub}`);
+      } else {
+        console.error(
+          "usage: kmd hook <prompt|pretool|posttool> [<vault-root>] [--scope <scope>] [--harness <claude|kiro-ide>]"
+        );
+        process.exit(2);
+      }
+      break;
+    }
     case "--version":
     case "-v": {
-      const { readFileSync } = await import("node:fs");
-      const { join: join10, dirname: dirname4 } = await import("node:path");
+      const { readFileSync: readFileSync2 } = await import("node:fs");
+      const { join: join11, dirname: dirname4 } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
       const pkgDir = dirname4(dirname4(fileURLToPath(import.meta.url)));
-      const pkg = JSON.parse(readFileSync(join10(pkgDir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync2(join11(pkgDir, "package.json"), "utf8"));
       console.log(pkg.version);
       break;
     }
@@ -2099,6 +2998,11 @@ async function run() {
       break;
     }
     default: {
+      const tail = positionals[1];
+      if (tail === "prompt" || tail === "pretool" || tail === "posttool") {
+        console.error(`kmd: unknown command: ${command}`);
+        break;
+      }
       console.error(`unknown command: ${command}
 
 ${USAGE}`);