@hraness/wordcell 0.21.3 → 0.22.1

package/dist/{index-0rfcqab6.js → index-810nfzdj.js}

@@ -3,22 +3,28 @@ import {
   backfillSavedUrlMetadata,
   createRustMetadataSearchProvider
 } from "./index-bcknqxrq.js";
+import {
+  main as main2
+} from "./index-054mb7d3.js";
 import {
   MAX_AUTHORIZED_VAULTS,
   auditKnowledgePortfolio,
   loadPortfolioRegistry,
   openKnowledgePortfolio,
   snapshotPortfolioRegistry
-} from "./index-51bap0mq.js";
-import {
-  main as main2
-} from "./index-054mb7d3.js";
+} from "./index-bqtqeak3.js";
 import {
   diffCaptureBundle
 } from "./index-j4zgmzjr.js";
+import {
+  main
+} from "./index-de2w8crk.js";
 import {
   verifyCaptureBundle
 } from "./index-npg9z1a4.js";
+import {
+  redactSensitiveText
+} from "./index-mxxxytys.js";
 import {
   initVault
 } from "./index-23z4zxgg.js";
@@ -27,18 +33,22 @@ import {
   MAX_SOURCE_INBOX_RESULTS,
   sourceInbox
 } from "./index-pj501bh1.js";
+import {
+  createTypeSafeReranker
+} from "./index-9rf81m0p.js";
 import {
   knowledgeBaseEvaluationRetrieverIds,
   openKnowledgeBaseEvaluation
-} from "./index-pbr6rv47.js";
+} from "./index-1k595z6v.js";
 import {
   DEFAULT_SEARCH_RESULTS,
   MAX_SEARCH_CANDIDATES,
   MAX_SEARCH_NOTE_REFERENCE_BYTES,
   MAX_SEARCH_RELATED_SEEDS,
   MAX_SEARCH_RESULTS,
-  openKnowledgeBase
-} from "./index-vdw5yjfa.js";
+  openKnowledgeBase,
+  searchEvidenceRank
+} from "./index-q7tbg07z.js";
 import {
   MAX_SEARCH_RULE_CONFIG_BYTES,
   parseSearchRules
@@ -49,50 +59,55 @@ import {
   recommendedEmbeddingModel,
   recommendedEmbeddingModelSha256,
   sha256EmbeddingModelFile
-} from "./index-115b07ap.js";
+} from "./index-rr9kzq4n.js";
 import {
-  percolateWithGraph
-} from "./index-bgfzwt4h.js";
+  MAX_RERANK_CANDIDATES
+} from "./index-j70m75wd.js";
 import {
-  queryGraph,
-  rebuildGraph,
-  verifyGraph
-} from "./index-bcfn9xah.js";
-import {
-  validateGraphQueryRequest
-} from "./index-11621h23.js";
+  MAX_EVALUATION_RESULTS_PER_QUERY,
+  MAX_EVALUATION_TIMEOUT_MS,
+  buildRetrievalEvaluationReport,
+  parseRetrievalEvaluationCorpus,
+  runRetrievalEvaluation
+} from "./index-b88v3vtm.js";
 import {
-  refreshVault,
-  scanVault
-} from "./index-0k2x4nn9.js";
+  percolateWithGraph
+} from "./index-djrcc1yf.js";
 import {
   MAX_PERCOLATION_MENTIONS,
   MAX_PERCOLATION_MENTION_PAIRS,
   MAX_PERCOLATION_NOTES,
   MAX_SCOPED_PERCOLATION_MENTION_PAIRS,
   percolateVault
-} from "./index-nd6nynv2.js";
+} from "./index-jk1sgx36.js";
 import {
-  MAX_EVALUATION_RESULTS_PER_QUERY,
-  MAX_EVALUATION_TIMEOUT_MS,
-  buildRetrievalEvaluationReport,
-  parseRetrievalEvaluationCorpus,
-  runRetrievalEvaluation
-} from "./index-b88v3vtm.js";
+  queryGraph,
+  rebuildGraph,
+  verifyGraph
+} from "./index-xv80vzfp.js";
 import {
-  auditAgentGuideRepository
-} from "./index-hya40gb2.js";
+  validateGraphQueryRequest
+} from "./index-tf4wzjew.js";
 import {
-  validateMarkdownAttachments
-} from "./index-x3fthpsc.js";
+  validateSearchQuery
+} from "./index-vnybgywh.js";
 import {
-  addNoteRelation,
-  createNote,
-  removeNoteRelation
-} from "./index-6sw24nvv.js";
+  sanitizeTerminalLine,
+  sanitizeTerminalText
+} from "./index-1xxnjn0d.js";
 import {
-  validateSearchQuery
-} from "./index-why54q5p.js";
+  DEFAULT_PUBLISH_LIST_LIMIT,
+  MAX_PUBLISH_LIST_LIMIT,
+  publishVault,
+  renderPublishReportText
+} from "./index-hmw17zaa.js";
+import {
+  refreshVault,
+  scanVault
+} from "./index-233z9wmn.js";
+import {
+  navigateLinks
+} from "./index-d13v9ckt.js";
 import {
   MAX_QUERY_FILTERS,
   MAX_QUERY_TAGS,
@@ -100,13 +115,18 @@ import {
   validateQueryOptions
 } from "./index-48pz4jpc.js";
 import {
+  MAX_REPOSITORY_MEMORY_DETAIL_LIMIT,
   MAX_REPOSITORY_SCOPES,
+  auditRepositoryMemoryScopes,
   buildRepositoryMemoryContext,
   repositoryMemoryGroupKeys
 } from "./index-06c9ctr6.js";
 import {
-  navigateLinks
-} from "./index-d13v9ckt.js";
+  findKbPackageRoot
+} from "./index-4knsp9qj.js";
+import {
+  auditAgentGuideRepository
+} from "./index-hya40gb2.js";
 import {
   agentContextGuidePath,
   agentContextMarkerForScope,
@@ -116,24 +136,19 @@ import {
   inspectAgentContextRepository,
   normalizeRepositoryScope
 } from "./index-5vwpzb5a.js";
+import {
+  validateMarkdownAttachments
+} from "./index-x3fthpsc.js";
+import {
+  addNoteRelation,
+  createNote,
+  removeNoteRelation
+} from "./index-ecqpgr5y.js";
 import {
   lookupNote,
   parseVaultKey,
   renderCatalog
-} from "./index-ekpwvbra.js";
-import {
-  main
-} from "./index-9zcpdbjg.js";
-import {
-  findKbPackageRoot
-} from "./index-jzcws0zn.js";
-import {
-  redactSensitiveText
-} from "./index-mxxxytys.js";
-import {
-  sanitizeTerminalLine,
-  sanitizeTerminalText
-} from "./index-1xxnjn0d.js";
+} from "./index-qbssx940.js";
 
 // src/clip/url-metadata-cli.ts
 import { resolve as resolve2 } from "path";
@@ -800,7 +815,7 @@ function terminalIntro(terminal) {
 }
 
 // src/cli-program.ts
-import { open } from "fs/promises";
+import { open as open2 } from "fs/promises";
 import { cpus, release, totalmem } from "os";
 import { relative, resolve as resolve3 } from "path";
 import { format } from "util";
@@ -905,13 +920,197 @@ Snapshot: ${value.revision}
   };
 }
 
+// src/serve.ts
+import { realpath, stat } from "fs/promises";
+import { join as join2, sep } from "path";
+var MAX_PATH_BYTES = 8 * 1024;
+var CONTENT_TYPES = Object.freeze({
+  ".avif": "image/avif",
+  ".css": "text/css; charset=utf-8",
+  ".gif": "image/gif",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".wav": "audio/wav",
+  ".webm": "video/webm",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".xml": "application/xml; charset=utf-8"
+});
+function contentType(path) {
+  const extension = path.slice(path.lastIndexOf("."));
+  return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+async function regularFileUnder(rootReal, candidate) {
+  let resolved;
+  try {
+    resolved = await realpath(candidate);
+  } catch {
+    return null;
+  }
+  if (resolved !== rootReal && !resolved.startsWith(`${rootReal}${sep}`))
+    return null;
+  try {
+    return (await stat(resolved)).isFile() ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveRequest(rootReal, pathname) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  if (decoded.includes("\x00") || decoded.includes("\\"))
+    return null;
+  const segments = decoded.split("/").filter((segment) => segment !== "" && segment !== ".");
+  if (segments.some((segment) => segment === ".."))
+    return null;
+  const relative = segments.join("/");
+  const candidates = [
+    join2(rootReal, relative),
+    join2(rootReal, relative, "index.html")
+  ];
+  for (const candidate of candidates) {
+    const file = await regularFileUnder(rootReal, candidate);
+    if (file !== null)
+      return file;
+  }
+  return null;
+}
+async function createServeHandler(root) {
+  const rootReal = await realpath(root);
+  return async (request) => {
+    const method = request.method.toUpperCase();
+    if (method !== "GET" && method !== "HEAD") {
+      return new Response("Method not allowed", { status: 405 });
+    }
+    let pathname;
+    try {
+      pathname = new URL(request.url).pathname;
+    } catch {
+      return new Response("Bad request", { status: 400 });
+    }
+    if (pathname.length > MAX_PATH_BYTES) {
+      return new Response("URI too long", { status: 414 });
+    }
+    const head = method === "HEAD";
+    const file = await resolveRequest(rootReal, pathname);
+    if (file !== null) {
+      const body = Bun.file(file);
+      return new Response(head ? null : body, {
+        headers: {
+          "Cache-Control": "no-store",
+          "Content-Length": String(body.size),
+          "Content-Type": contentType(file)
+        }
+      });
+    }
+    const notFound = await regularFileUnder(rootReal, join2(rootReal, "404.html"));
+    if (notFound !== null) {
+      const body = Bun.file(notFound);
+      return new Response(head ? null : body, {
+        status: 404,
+        headers: {
+          "Cache-Control": "no-store",
+          "Content-Length": String(body.size),
+          "Content-Type": "text/html; charset=utf-8"
+        }
+      });
+    }
+    return new Response(head ? null : "Not found", {
+      status: 404,
+      headers: { "Cache-Control": "no-store" }
+    });
+  };
+}
+async function serveSite(options, io = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 8080;
+  if (!Number.isSafeInteger(port) || port < 0 || port > 65535) {
+    throw new Error("Port must be an integer from 0 through 65535");
+  }
+  const rootReal = await realpath(options.root);
+  if (!(await stat(rootReal)).isDirectory()) {
+    throw new Error(`Site root is not a directory: ${options.root}`);
+  }
+  const listen = io.listen ?? ((init) => Bun.serve(init));
+  const server = listen({
+    hostname: host,
+    port,
+    fetch: await createServeHandler(rootReal)
+  });
+  const boundPort = server.port ?? port;
+  return Object.freeze({
+    root: rootReal,
+    host,
+    port: boundPort,
+    url: `http://${host}:${String(boundPort)}/`,
+    close: () => server.stop()
+  });
+}
+
+// src/rerank-credentials.ts
+import { constants as constants2 } from "fs";
+import { open } from "fs/promises";
+import { homedir } from "os";
+import { isAbsolute as isAbsolute2, join as join3 } from "path";
+function unavailable(message) {
+  return { id: "typesafe", rerank: async () => ({ status: "unavailable", message }) };
+}
+async function createCliTypeSafeReranker(environment = process.env, homeDirectory = homedir()) {
+  if (Object.hasOwn(environment, "TYPESAFE_API_KEY")) {
+    return createTypeSafeReranker({ environment: { TYPESAFE_API_KEY: environment["TYPESAFE_API_KEY"] } });
+  }
+  const explicitFile = environment["TYPESAFE_API_KEY_FILE"];
+  const configDirectory = environment["XDG_CONFIG_HOME"];
+  if (explicitFile !== undefined && !isAbsolute2(explicitFile) || configDirectory !== undefined && configDirectory !== "" && !isAbsolute2(configDirectory)) {
+    return unavailable("TypeSafe credential file configuration requires absolute paths.");
+  }
+  const path = explicitFile ?? join3(configDirectory || join3(homeDirectory, ".config"), "wordcell", "typesafe-api-key");
+  let handle;
+  try {
+    handle = await open(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+    const metadata = await handle.stat();
+    const uid = process.getuid?.();
+    if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size < 1 || metadata.size > 514 || process.platform !== "win32" && ((metadata.mode & 63) !== 0 || metadata.uid !== uid)) {
+      return unavailable("TypeSafe credential file must be an owner-only regular file containing one API key.");
+    }
+    const bytes = Buffer.alloc(515);
+    const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+    const key = bytes.subarray(0, bytesRead).toString("utf8").replace(/\r?\n$/u, "");
+    if (!/^[\x21-\x7e]{1,512}$/u.test(key)) {
+      return unavailable("TypeSafe credential file must contain one valid API key.");
+    }
+    return createTypeSafeReranker({ environment: { TYPESAFE_API_KEY: key } });
+  } catch {
+    return unavailable("TypeSafe credentials are unavailable; set TYPESAFE_API_KEY or an owner-only TYPESAFE_API_KEY_FILE.");
+  } finally {
+    await handle?.close();
+  }
+}
+
 // src/cli-program.ts
 var defaultOutput2 = {
   stdout: (value) => process.stdout.write(value),
   stderr: (value) => process.stderr.write(value)
 };
 async function readBoundedUtf8(path, maximumBytes, label) {
-  const handle = await open(path, "r");
+  const handle = await open2(path, "r");
   try {
     const bytes = new Uint8Array(maximumBytes + 1);
     let offset = 0;
@@ -943,7 +1142,16 @@ async function loadSearchRulesFile(path) {
   }
   return parseSearchRules(input);
 }
-var usage = `wordcell \u2014 auditable capture and derived links for Markdown vaults
+var usage = `wordcell \u2014 a local knowledge base for coding agents
+
+Start here (no account or model needed):
+  wordcell init kb
+  wordcell note create notes/decision --title "A decision" --body "Keep retries bounded." --root kb
+  wordcell search "retries" --root kb --mode exact
+
+Already have Markdown? Search it with --root <your-notes-directory>.
+Use --mode exact for model-free search; optional hybrid search needs a local index.
+Quick start and examples: https://wordcell.io/docs
 
 Usage:
   wordcell init [directory] [--json]
@@ -956,7 +1164,7 @@ Usage:
   wordcell inspect <url> [capture options]
   wordcell pdf <file-or-url> [PDF options]
   wordcell refresh [--root <directory>] [--index <path>] [--json]
-  wordcell check [--root <directory>] [--index <path>] [--no-catalog] [--json]
+  wordcell check [--root <directory>] [--index <path>] [--no-catalog] [--repo <repository>] [--json]
   wordcell catalog [--root <directory>] [--index <path>] [--json]
   wordcell graph [--root <directory>] [--index <path>] [--json]
   wordcell graph rebuild [--fresh] [--root <directory>] [--index <path>] [--json]
@@ -971,12 +1179,14 @@ Usage:
   wordcell percolate [note] [--proofs] [--root <directory>] [--min-support <count>] [--limit <count>] [--json]
   wordcell list [--root <directory>] [--where <path=value>] [--has <path>] [--tag <tag>] [--scope <repository-path>] [--sort <field>] [--order <asc|desc>] [--limit <count>] [--json]
   wordcell index [--root <directory>] [--database <path>] [--force] [--json]
-  wordcell search <query> [--root <directory>] [--repo <repository>] [--database <path>] [--mode <hybrid|exact|keyword|semantic>] [--rules <file>] [--priority] [--where <path=value>] [--has <path>] [--tag <tag>] [--scope <repository-path>] [--related <note>] [--graph-depth <1|2>] [--no-graph] [--history | --no-history | --require-history] [--limit <count>] [--candidate-limit <count>] [--min-score <score>] [--json]
+  wordcell search <query> [--root <directory>] [--repo <repository>] [--database <path>] [--mode <hybrid|exact|keyword|semantic>] [--rules <file>] [--priority] [--where <path=value>] [--has <path>] [--tag <tag>] [--scope <repository-path>] [--related <note>] [--graph-depth <1|2>] [--no-graph] [--history | --no-history | --require-history] [--limit <count>] [--candidate-limit <count>] [--min-score <score>] [--rerank <typesafe>] [--rerank-limit <2..25>] [--json]
   wordcell history <note> [--root <directory>] [--repo <repository>] [--limit <count>] [--cochanged-limit <count>] [--json]
   wordcell history search <query-or-path> [--root <directory>] [--repo <repository>] [--limit <count>] [--commit-limit <count>] [--cochanged-limit <count>] [--json]
   wordcell evaluate <manifest.json> [--root <directory>] [--repo <repository>] [--database <path>] [--retriever <id>] [--split <development|test|all>] [--limit <count>] [--cutoff <count>] [--timeout <milliseconds>] [--baseline <id>] [--model-file <path>] [--cache-state <cold|mixed|warm>] [--json]
   wordcell portfolio search <query> --registry <file> --workspace <directory> (--shared | --vault <owner/id>...) [--mode <hybrid|exact|keyword|semantic>] [--rules <file>] [--priority] [--limit <count>] [--require-all] [--json]
   wordcell portfolio audit --registry <file> --workspace <directory> (--all | --shared | --vault <owner/id>...) [--strict] [--json]
+  wordcell publish --out <directory> [--root <directory>] [--index <path>] [--include <path>]... [--exclude <path>]... [--include-glob <pattern>]... [--exclude-glob <pattern>]... [--where <path=value>]... [--has <path>]... [--tag <tag>]... [--scope <repository-path>]... [--from <note> [--depth <count>] [--direction <in|out|both>]] [--title <title>] [--description <text>] [--base-path <path>] [--base-url <url>] [--noindex] [--no-index-content] [--deterministic] [--dry-run] [--list-limit <0-1000>] [--force] [--json]
+  wordcell serve --root <directory> [--host <host>] [--port <port>] [--json]
   wordcell inbox [--root <directory>] [--source-prefix <directory>] [--limit <count>] [--json]
   wordcell context <repository-path> [--root <vault>] [--repo <repository>] [--kind <auto|file|directory>] [--json]
   wordcell agents identity <repository-scope> [--json]
@@ -1084,6 +1294,7 @@ function parseVaultCommand(command, arguments_) {
   let depth = 1;
   let limit;
   let noCatalog = false;
+  let repository;
   const positional = [];
   for (let cursor = 0;cursor < arguments_.length; cursor += 1) {
     const argument = arguments_[cursor];
@@ -1097,6 +1308,14 @@ function parseVaultCommand(command, arguments_) {
       noCatalog = true;
       continue;
     }
+    if (argument === "--repo" && command === "check") {
+      const value = readValue(arguments_, cursor);
+      if (value === null)
+        return { ok: false, message: "--repo requires a value" };
+      repository = value;
+      cursor += 1;
+      continue;
+    }
     if (argument === "--root" || argument === "--index") {
       const value = readValue(arguments_, cursor);
       if (value === null)
@@ -1163,7 +1382,8 @@ function parseVaultCommand(command, arguments_) {
       root,
       options: index === undefined ? {} : { index },
       json,
-      ...command === "check" && noCatalog ? { noCatalog: true } : {}
+      ...command === "check" && noCatalog ? { noCatalog: true } : {},
+      ...command === "check" && repository !== undefined ? { repository } : {}
     }
   };
 }
@@ -1367,6 +1587,220 @@ function parseListCommand(arguments_) {
     }
   };
 }
+function parsePublishCommand(arguments_) {
+  let root = ".";
+  let out;
+  let index;
+  let title;
+  let description;
+  let basePath;
+  let baseUrl;
+  let noindex = false;
+  let indexContent = true;
+  let deterministic = false;
+  let dryRun = false;
+  let listLimit = DEFAULT_PUBLISH_LIST_LIMIT;
+  let force = false;
+  let json = false;
+  let from;
+  let depth = 1;
+  let direction = "both";
+  const includes = [];
+  const excludes = [];
+  const includeGlobs = [];
+  const excludeGlobs = [];
+  const filters = [];
+  const tags = [];
+  const repositoryScopes = [];
+  for (let cursor = 0;cursor < arguments_.length; cursor += 1) {
+    const argument = arguments_[cursor];
+    if (argument === undefined)
+      continue;
+    if (argument === "--json") {
+      json = true;
+      continue;
+    }
+    if (argument === "--noindex") {
+      noindex = true;
+      continue;
+    }
+    if (argument === "--no-index-content") {
+      indexContent = false;
+      continue;
+    }
+    if (argument === "--deterministic") {
+      deterministic = true;
+      continue;
+    }
+    if (argument === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (argument === "--force") {
+      force = true;
+      continue;
+    }
+    if (argument === "--root" || argument === "--out" || argument === "--index" || argument === "--title" || argument === "--description" || argument === "--base-path" || argument === "--base-url" || argument === "--include" || argument === "--exclude" || argument === "--include-glob" || argument === "--exclude-glob" || argument === "--list-limit" || argument === "--where" || argument === "--has" || argument === "--tag" || argument === "--scope" || argument === "--repository-scope" || argument === "--from" || argument === "--depth" || argument === "--direction") {
+      const value = readValue(arguments_, cursor);
+      if (value === null)
+        return { ok: false, message: `${argument} requires a value` };
+      if (argument === "--root")
+        root = value;
+      else if (argument === "--out")
+        out = value;
+      else if (argument === "--index")
+        index = value;
+      else if (argument === "--title")
+        title = value;
+      else if (argument === "--description")
+        description = value;
+      else if (argument === "--base-path")
+        basePath = value;
+      else if (argument === "--base-url")
+        baseUrl = value;
+      else if (argument === "--include")
+        includes.push(value);
+      else if (argument === "--exclude")
+        excludes.push(value);
+      else if (argument === "--include-glob")
+        includeGlobs.push(value);
+      else if (argument === "--exclude-glob")
+        excludeGlobs.push(value);
+      else if (argument === "--list-limit") {
+        if (!/^(0|[1-9][0-9]*)$/u.test(value) || Number(value) > MAX_PUBLISH_LIST_LIMIT) {
+          return { ok: false, message: `--list-limit must be an integer from 0 through ${MAX_PUBLISH_LIST_LIMIT}` };
+        }
+        listLimit = Number(value);
+      } else if (argument === "--from")
+        from = value;
+      else if (argument === "--depth") {
+        const parsed = Number(value);
+        if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 10) {
+          return { ok: false, message: "--depth must be an integer from 1 through 10" };
+        }
+        depth = parsed;
+      } else if (argument === "--direction") {
+        if (value !== "in" && value !== "out" && value !== "both") {
+          return { ok: false, message: "--direction must be in, out, or both" };
+        }
+        direction = value;
+      } else if (argument === "--tag") {
+        if (tags.length >= MAX_QUERY_TAGS) {
+          return { ok: false, message: `Query tags may contain at most ${MAX_QUERY_TAGS} entries.` };
+        }
+        tags.push(value);
+      } else if (argument === "--scope" || argument === "--repository-scope") {
+        if (repositoryScopes.length >= MAX_REPOSITORY_SCOPES) {
+          return { ok: false, message: `Repository scope filters may contain at most ${MAX_REPOSITORY_SCOPES} entries.` };
+        }
+        repositoryScopes.push(value);
+      } else if (argument === "--has") {
+        if (value.trim() === "")
+          return { ok: false, message: "--has requires a metadata path" };
+        if (filters.length >= MAX_QUERY_FILTERS) {
+          return { ok: false, message: `Query filters may contain at most ${MAX_QUERY_FILTERS} entries.` };
+        }
+        filters.push({ kind: "exists", path: value });
+      } else {
+        const equals = value.indexOf("=");
+        const path = equals === -1 ? "" : value.slice(0, equals).trim();
+        if (path === "")
+          return { ok: false, message: "--where requires path=value" };
+        const scalar = metadataScalar(value.slice(equals + 1));
+        if (!scalar.ok)
+          return scalar;
+        if (filters.length >= MAX_QUERY_FILTERS) {
+          return { ok: false, message: `Query filters may contain at most ${MAX_QUERY_FILTERS} entries.` };
+        }
+        filters.push({ kind: "equals", path, value: scalar.value });
+      }
+      cursor += 1;
+      continue;
+    }
+    return {
+      ok: false,
+      message: argument.startsWith("--") ? "unknown publish option" : "publish does not accept positional arguments"
+    };
+  }
+  if (out === undefined)
+    return { ok: false, message: "publish requires --out <directory>" };
+  try {
+    validateQueryOptions({ filters, tags, repositoryScopes });
+  } catch (error) {
+    return { ok: false, message: error instanceof Error ? error.message : String(error) };
+  }
+  const selection = {
+    includes,
+    excludes,
+    includeGlobs,
+    excludeGlobs,
+    filters,
+    tags,
+    repositoryScopes,
+    ...from === undefined ? {} : { from: { note: from, depth, direction } }
+  };
+  return {
+    ok: true,
+    value: {
+      kind: "publish",
+      root,
+      out,
+      noindex,
+      indexContent,
+      deterministic,
+      dryRun,
+      listLimit,
+      force,
+      selection,
+      json,
+      ...index === undefined ? {} : { index },
+      ...title === undefined ? {} : { title },
+      ...description === undefined ? {} : { description },
+      ...basePath === undefined ? {} : { basePath },
+      ...baseUrl === undefined ? {} : { baseUrl }
+    }
+  };
+}
+function parseServeCommand(arguments_) {
+  let root;
+  let host = "127.0.0.1";
+  let port = 8080;
+  let json = false;
+  for (let cursor = 0;cursor < arguments_.length; cursor += 1) {
+    const argument = arguments_[cursor];
+    if (argument === undefined)
+      continue;
+    if (argument === "--json") {
+      json = true;
+      continue;
+    }
+    if (argument === "--root" || argument === "--host" || argument === "--port") {
+      const value = readValue(arguments_, cursor);
+      if (value === null)
+        return { ok: false, message: `${argument} requires a value` };
+      if (argument === "--root")
+        root = value;
+      else if (argument === "--host")
+        host = value;
+      else {
+        const parsed = Number(value);
+        if (!Number.isSafeInteger(parsed) || parsed < 0 || parsed > 65535) {
+          return { ok: false, message: "--port must be an integer from 0 through 65535" };
+        }
+        port = parsed;
+      }
+      cursor += 1;
+      continue;
+    }
+    return {
+      ok: false,
+      message: argument.startsWith("--") ? "unknown serve option" : "serve does not accept positional arguments"
+    };
+  }
+  if (root === undefined)
+    return { ok: false, message: "serve requires --root <directory>" };
+  return { ok: true, value: { kind: "serve", root, host, port, json } };
+}
 function parseInboxCommand(arguments_) {
   let root = ".";
   let index;
@@ -1439,6 +1873,8 @@ function parseSemanticCommand(command, arguments_) {
   let limit;
   let candidateLimit;
   let minScore;
+  let rerank;
+  let rerankLimit;
   let graphDepth;
   let noGraph = false;
   let history = false;
@@ -1496,7 +1932,7 @@ function parseSemanticCommand(command, arguments_) {
       cursor += 1;
       continue;
     }
-    if (command === "search" && (argument === "--mode" || argument === "--limit" || argument === "--candidate-limit" || argument === "--min-score" || argument === "--where" || argument === "--has" || argument === "--tag" || argument === "--scope" || argument === "--repository-scope" || argument === "--related" || argument === "--graph-depth")) {
+    if (command === "search" && (argument === "--mode" || argument === "--limit" || argument === "--candidate-limit" || argument === "--min-score" || argument === "--rerank" || argument === "--rerank-limit" || argument === "--where" || argument === "--has" || argument === "--tag" || argument === "--scope" || argument === "--repository-scope" || argument === "--related" || argument === "--graph-depth")) {
       const value = readValue(arguments_, cursor);
       if (value === null)
         return { ok: false, message: `${argument} requires a value` };
@@ -1505,6 +1941,17 @@ function parseSemanticCommand(command, arguments_) {
           return { ok: false, message: "--mode must be hybrid, exact, keyword, or semantic" };
         }
         mode = value;
+      } else if (argument === "--rerank") {
+        if (value !== "typesafe") {
+          return { ok: false, message: "--rerank must be typesafe" };
+        }
+        rerank = value;
+      } else if (argument === "--rerank-limit") {
+        const parsed = Number(value);
+        if (!Number.isSafeInteger(parsed) || parsed < 2 || parsed > MAX_RERANK_CANDIDATES) {
+          return { ok: false, message: `--rerank-limit must be an integer from 2 through ${MAX_RERANK_CANDIDATES}` };
+        }
+        rerankLimit = parsed;
       } else if (argument === "--where") {
         const equals = value.indexOf("=");
         const path = equals === -1 ? "" : value.slice(0, equals).trim();
@@ -1637,6 +2084,9 @@ function parseSemanticCommand(command, arguments_) {
       message: "Search minimum score applies only to hybrid, keyword, or semantic mode."
     };
   }
+  if (rerankLimit !== undefined && rerank === undefined) {
+    return { ok: false, message: "--rerank-limit requires --rerank typesafe" };
+  }
   if (priority && rulesPath === undefined) {
     return { ok: false, message: "--priority requires --rules" };
   }
@@ -1674,6 +2124,8 @@ function parseSemanticCommand(command, arguments_) {
       ...limit === undefined ? {} : { limit },
       ...candidateLimit === undefined ? {} : { candidateLimit },
       ...minScore === undefined ? {} : { minScore },
+      ...rerank === undefined ? {} : { rerank },
+      ...rerankLimit === undefined ? {} : { rerankLimit },
       query,
       json
     }
@@ -2420,6 +2872,10 @@ function parseArguments(arguments_) {
     return parseRelationCommand(arguments_.slice(1));
   if (command === "percolate")
     return parsePercolateCommand(arguments_.slice(1));
+  if (command === "publish")
+    return parsePublishCommand(arguments_.slice(1));
+  if (command === "serve")
+    return parseServeCommand(arguments_.slice(1));
   return { ok: false, message: "unknown command" };
 }
 function embeddingCount(result) {
@@ -2440,11 +2896,23 @@ function renderKnowledgeBaseSearch(result) {
   const lines = [
     `${result.mode[0]?.toLocaleUpperCase("en-US") ?? ""}${result.mode.slice(1)} results for \u201C${safe(result.query)}\u201D (${result.results.length})${result.partial ? " [partial]" : ""}`
   ];
+  const rerankLane = result.diagnostics.lanes.find(({ lane }) => lane === "rerank");
+  if (rerankLane !== undefined) {
+    lines.push(`  Rerank: typesafe over ${rerankLane.results} candidates (${rerankLane.status})` + (rerankLane.message === undefined ? "" : ` \u2014 ${safe(rerankLane.message)}`));
+    const receipt = rerankLane.rerank;
+    if (receipt?.accounting !== undefined) {
+      const { attempted, candidates, completed, elapsedMs, usageComplete } = receipt.accounting;
+      lines.push(`  Rerank requests: ${attempted}/${candidates} attempted, ${completed} settled; ${elapsedMs.toFixed(0)} ms` + (usageComplete ? "; usage complete" : "; usage incomplete, additional charges may be unknown"));
+      if (rerankLane.status !== "ready" && receipt.usage !== undefined) {
+        lines.push(`  Known rerank usage: ${receipt.usage.inputTokens ?? 0} input tokens, ${receipt.usage.outputTokens ?? 0} output tokens`);
+      }
+    }
+  }
   if (result.results.length === 0)
     lines.push("  None.");
   for (const hit of result.results) {
     const location = `${safe(hit.path)}${hit.line === undefined ? "" : `:${hit.line}`}`;
-    const evidence = hit.evidence.map((item) => `${item.kind}#${item.rank}`).join(", ");
+    const evidence = hit.evidence.map((item) => `${item.kind}#${searchEvidenceRank(item)}`).join(", ");
     lines.push(`  ${hit.rank}. ${hit.score.toFixed(3)}  ${location} \u2014 ${safe(hit.title)} [${safe(evidence)}]`);
     if (hit.snippet !== "")
       lines.push(`    ${safe(hit.snippet)}`);
@@ -2476,7 +2944,7 @@ async function runSemantic(command, output, dependencies) {
     repository: command.repository,
     ...command.database === undefined ? {} : { database: command.database },
     ...searchRules === undefined ? {} : { searchRules }
-  });
+  }, ...command.rerank === undefined ? [] : [{ rerankers: dependencies.rerankers ?? [await createCliTypeSafeReranker()] }]);
   try {
     const result = await kb.search({
       query: command.query,
@@ -2489,7 +2957,13 @@ async function runSemantic(command, output, dependencies) {
       history: command.history,
       ...command.limit === undefined ? {} : { limit: command.limit },
       ...command.candidateLimit === undefined ? {} : { candidateLimit: command.candidateLimit },
-      ...command.minScore === undefined ? {} : { minScore: command.minScore }
+      ...command.minScore === undefined ? {} : { minScore: command.minScore },
+      ...command.rerank === undefined ? {} : {
+        rerank: {
+          engine: command.rerank,
+          ...command.rerankLimit === undefined ? {} : { limit: command.rerankLimit }
+        }
+      }
     });
     output.stdout(command.json ? terminalSafeJson(result) : sanitizeTerminalText(renderKnowledgeBaseSearch(result)));
     return 0;
@@ -2744,7 +3218,8 @@ function summary(snapshot, options = {}) {
         truncated: options.attachments.truncated,
         issues: options.attachments.issues
       }
-    }
+    },
+    ...options.repositoryScopes === undefined ? {} : { repositoryScopes: options.repositoryScopes }
   };
 }
 function renderIssue(issue) {
@@ -2777,6 +3252,38 @@ function renderAdvisories(analysis) {
   }
   return lines;
 }
+function renderRepositoryScopeAuditError(error) {
+  if (error.kind === "invalid-record") {
+    return `${safe(error.path)}: ${error.issues.map(safe).join(" ")}`;
+  }
+  const declared = error.recordPaths.map(safe).join(", ") + (error.recordPathsTruncated ? ", \u2026" : "");
+  return `${safe(error.scope)}: ${safe(error.state.reason)} at ${safe(error.state.path)}` + ` (declared by ${declared})`;
+}
+function renderRepositoryScopeAudit(audit) {
+  const { counts } = audit;
+  const lines = [
+    `Repository scopes: ${counts.authoredRecords} declaring note${counts.authoredRecords === 1 ? "" : "s"}; ` + `${counts.distinctScopes} distinct scope${counts.distinctScopes === 1 ? "" : "s"} ` + `(${counts.presentScopes} present, ${counts.absentScopes} absent, ${counts.invalidScopes} unusable).`
+  ];
+  if (audit.advisories.total > 0) {
+    lines.push(audit.advisories.total === 1 ? "Advisory: 1 current note declares a repository path that no longer exists." : `Advisory: ${audit.advisories.total} current notes declare repository paths that no longer exist.`);
+    for (const advisory of audit.advisories.details) {
+      lines.push(`  ${safe(advisory.path)} declares absent scope ${safe(advisory.scope)}`);
+    }
+    if (audit.advisories.truncated) {
+      lines.push(`  \u2026 ${audit.advisories.total - audit.advisories.returned} more; rerun with --json for the complete audit.`);
+    }
+  }
+  if (audit.errors.total > 0) {
+    lines.push(`Advisory: ${audit.errors.total} repository scope declaration problem${audit.errors.total === 1 ? "" : "s"}.`);
+    for (const error of audit.errors.details) {
+      lines.push(`  ${renderRepositoryScopeAuditError(error)}`);
+    }
+    if (audit.errors.truncated) {
+      lines.push(`  \u2026 ${audit.errors.total - audit.errors.returned} more; rerun with --json for the complete audit.`);
+    }
+  }
+  return lines;
+}
 function checkExitCode(snapshot, noCatalog = false, attachments) {
   return !noCatalog && snapshot.index === "stale" || snapshot.analysis.issues.length > 0 || snapshot.analysis.relationIssues.length > 0 || (attachments?.issues.length ?? 0) > 0 || attachments?.truncated === true ? 3 : 0;
 }
@@ -2784,7 +3291,7 @@ function renderAttachmentIssue(issue) {
   const candidates = issue.candidates === undefined ? "" : ` (${issue.candidates.map(safe).join(", ")})`;
   return `${safe(issue.source)}:${issue.line}: ${safe(issue.kind)} attachment ${safe(issue.target)}: ${safe(issue.message)}${candidates}`;
 }
-function renderSnapshot(command, snapshot, noCatalog = false, attachments) {
+function renderSnapshot(command, snapshot, noCatalog = false, attachments, repositoryScopes) {
   const lines = [
     `${command === "refresh" ? "Refreshed" : "Checked"} ${safe(snapshot.root)}`,
     `Index: ${noCatalog ? `not required (${snapshot.index})` : snapshot.index}; notes: ${snapshot.analysis.noteCount}; contextual links: ${snapshot.analysis.contextualLinks.length}; typed relationships: ${snapshot.analysis.authoredRelations.length}.`
@@ -2804,6 +3311,8 @@ function renderSnapshot(command, snapshot, noCatalog = false, attachments) {
     lines.push("error: attachment validation was truncated by a resource limit");
   }
   lines.push(...renderAdvisories(snapshot.analysis));
+  if (repositoryScopes !== undefined)
+    lines.push(...renderRepositoryScopeAudit(repositoryScopes));
   return `${lines.join(`
 `)}
 `;
@@ -3104,6 +3613,36 @@ async function runList(command, output, dependencies) {
   output.stdout(command.json ? terminalSafeJson({ root: snapshot.root, count: rows.length, notes: rows }) : sanitizeTerminalText(renderList(rows)));
   return 0;
 }
+async function runPublish(command, output, dependencies) {
+  const result = await (dependencies.publishVault ?? publishVault)({
+    root: command.root,
+    out: command.out,
+    noindex: command.noindex,
+    indexContent: command.indexContent,
+    deterministic: command.deterministic,
+    dryRun: command.dryRun,
+    listLimit: command.listLimit,
+    force: command.force,
+    selection: command.selection,
+    ...command.index === undefined ? {} : { index: command.index },
+    ...command.title === undefined ? {} : { title: command.title },
+    ...command.description === undefined ? {} : { description: command.description },
+    ...command.basePath === undefined ? {} : { basePath: command.basePath },
+    ...command.baseUrl === undefined ? {} : { baseUrl: command.baseUrl }
+  });
+  output.stdout(command.json ? terminalSafeJson(result.report) : sanitizeTerminalText(renderPublishReportText(result.report, command.dryRun)));
+  return 0;
+}
+async function runServe(command, output, dependencies) {
+  const site = await (dependencies.serveSite ?? serveSite)({
+    root: command.root,
+    host: command.host,
+    port: command.port
+  });
+  output.stdout(command.json ? terminalSafeJson({ root: site.root, host: site.host, port: site.port, url: site.url }) : `Serving ${safe(site.root)} at ${safe(site.url)}
+`);
+  return 0;
+}
 async function runCatalog(command, output, dependencies) {
   const snapshot = await (dependencies.scanVault ?? scanVault)(command.root, command.options);
   const relativeIndex = relative(snapshot.root, snapshot.indexPath).split("\\").join("/");
@@ -3558,7 +4097,15 @@ async function runVault(command, output, dependencies) {
       root: snapshot.root,
       documents: snapshot.notes.map(({ path, content }) => ({ path, content }))
     }) : undefined;
-    output.stdout(command.json ? terminalSafeJson(summary(snapshot, { noCatalog, ...attachments === undefined ? {} : { attachments } })) : sanitizeTerminalText(renderSnapshot(command.kind, snapshot, noCatalog, attachments)));
+    const repositoryScopes = command.kind === "check" && command.repository !== undefined ? await (dependencies.auditRepositoryMemoryScopes ?? auditRepositoryMemoryScopes)(snapshot.notes, {
+      repositoryRoot: command.repository,
+      detailLimit: MAX_REPOSITORY_MEMORY_DETAIL_LIMIT
+    }) : undefined;
+    output.stdout(command.json ? terminalSafeJson(summary(snapshot, {
+      noCatalog,
+      ...attachments === undefined ? {} : { attachments },
+      ...repositoryScopes === undefined ? {} : { repositoryScopes }
+    })) : sanitizeTerminalText(renderSnapshot(command.kind, snapshot, noCatalog, attachments, repositoryScopes)));
     return checkExitCode(snapshot, noCatalog, attachments);
   }
   if (command.kind === "graph") {
@@ -3673,6 +4220,10 @@ ${sanitizeTerminalText(usage)}`);
       return await runPercolate(command, output, dependencies);
     if (command.kind === "list")
       return await runList(command, output, dependencies);
+    if (command.kind === "publish")
+      return await runPublish(command, output, dependencies);
+    if (command.kind === "serve")
+      return await runServe(command, output, dependencies);
     if (command.kind === "inbox")
       return await runInbox(command, output, dependencies);
     if (command.kind === "catalog")