@skill-map/cli 0.32.0 → 0.33.0

package/dist/kernel/index.d.ts

@@ -501,7 +501,26 @@ interface IExtensionBase {
  */
 type NodeKind = 'skill' | 'agent' | 'command' | 'markdown';
 type LinkKind = 'invokes' | 'references' | 'mentions' | 'supersedes';
-type Confidence = 'high' | 'medium' | 'low';
+/**
+ * Extractor's self-assessed confidence, normalized to `[0..1]`. Drives
+ * UI edge opacity in the graph view (more confident = more opaque edge).
+ * Migrated from the legacy `'high' | 'medium' | 'low'` string union to
+ * a numeric range so callers can express finer granularity than three
+ * buckets. The named tiers below (`ConfidenceTier`) preserve the
+ * legacy buckets as constants for callers that prefer bucket-thinking.
+ *
+ * Reference scoring (guideline, not contract):
+ *
+ *   `1.0`  structured input (sidecar `supersedes`)
+ *   `0.95` unambiguous syntax (`[text](file.md)`, `https://…`)
+ *   `0.85` strong signal with one inference (`@file.md`)
+ *   `0.5`  genuine ambiguity (`@bare-handle`)
+ *
+ * Validation: the orchestrator's `validateLink` rejects values outside
+ * `[0..1]` with an `extension.error` event, mirroring the LinkKind
+ * enum check. Missing confidence defaults to `ConfidenceTier.MEDIUM`.
+ */
+type Confidence = number;
 type Severity = 'error' | 'warn' | 'info';
 type Stability = 'experimental' | 'stable' | 'deprecated';
 /**
@@ -569,6 +588,25 @@ interface Node {
      * truthy `isFavorite` only ever lands when the BFF set it.
      */
     isFavorite?: boolean;
+    /**
+     * When `true`, the node is synthetic / derived: it does not correspond
+     * to a single file on disk. Reconstructed on every scan from the
+     * file(s) listed in `derivedFrom`. Synthetic nodes use a non-filesystem
+     * path scheme (e.g. `mcp://github`) so the identifier is stable and
+     * visibly non-physical. See
+     * [`node.schema.json`](../../spec/schemas/node.schema.json) for the
+     * normative contract. Absent / `false` for ordinary filesystem-backed
+     * entities. Stability: experimental.
+     */
+    virtual?: boolean;
+    /**
+     * Paths of the source files this node was derived from. Required (and
+     * only meaningful) when `virtual === true`. Drives invalidation: any
+     * change to a listed source between scans propagates into the virtual
+     * node's hashes. Empty / absent when the node is a regular filesystem
+     * entity (the `path` itself is the source).
+     */
+    derivedFrom?: string[];
 }
 /**
  * Drift status of a co-located `.sm` sidecar relative to the live
@@ -621,6 +659,83 @@ interface Link {
     location?: LinkLocation | null;
     raw?: string | null;
 }
+/**
+ * Scope of a `Signal` within its originating node. Mirrors
+ * `signal.schema.json#/properties/scope`.
+ *
+ *   - `body` = markdown body or equivalent prose payload.
+ *   - `frontmatter` = parsed metadata block at the top of the file.
+ *   - `sidecar` = co-located `.sm` overlay.
+ */
+type SignalScope = 'body' | 'frontmatter' | 'sidecar';
+/**
+ * Surface context for a body-scope `Signal`. Mirrors
+ * `signal.schema.json#/properties/context/enum`. Null when the signal is in
+ * normal prose or when the context concept does not apply (frontmatter /
+ * sidecar scopes).
+ */
+type SignalContext = 'code-block' | 'inline-code' | 'escaped';
+/**
+ * Byte-range location for a body-scope `Signal`. `start` is inclusive,
+ * `end` is exclusive (one past the last char).
+ */
+interface SignalRange {
+    start: number;
+    end: number;
+}
+/**
+ * One alternative interpretation of a `Signal`. The resolver picks the
+ * winning candidate per Signal and materialises it as a `Link`; the
+ * rejected candidates remain on `IAnalyzerContext.signals` for
+ * collision-detection and conflict-visualisation analyzers.
+ *
+ * `confidence` is numeric `[0..1]`, identical shape to the `Link`'s
+ * `Confidence` type after the Phase 4 migration. No conversion needed
+ * when the resolver materialises a winning candidate.
+ */
+interface SignalCandidate {
+    extractorId: string;
+    kind: LinkKind;
+    target: string;
+    /** `[0..1]`. Reference scoring guideline lives in `signal.schema.json`. */
+    confidence: number;
+    rationale?: string;
+    trigger?: LinkTrigger | null;
+}
+/**
+ * Intermediate Representation (IR) emitted by extractors via
+ * `ctx.emitSignal(signal)`. The kernel's resolver phase consumes
+ * `Signal[]` and produces final `Link[]` per the active Provider's
+ * `resolverRules`. Opt-in: extractors with unambiguous detections keep
+ * using `ctx.emitLink(link)` directly. See
+ * [`signal.schema.json`](../../spec/schemas/signal.schema.json) for the
+ * normative contract.
+ */
+interface Signal {
+    /** `node.path` of the originating node. */
+    source: string;
+    scope: SignalScope;
+    /**
+     * Byte-range location within the source. Required for `scope: 'body'`,
+     * optional otherwise. Powers collision detection between extractors
+     * (overlapping ranges) and code-block awareness (the orchestrator can
+     * mark ranges that fall inside code spans).
+     */
+    range?: SignalRange | null;
+    /**
+     * Structured-data location for `frontmatter` / `sidecar` scopes. Each
+     * entry is a step of the path: object keys are strings, array indices
+     * are integers serialised as strings. Example: `['tools', '0']`. Null
+     * for body scope or when the extractor does not track field locations.
+     */
+    fieldPath?: string[] | null;
+    /** Verbatim matched text (body) or stringified value (frontmatter / sidecar). */
+    raw: string;
+    /** Surface context. Null when in normal prose or when not applicable. */
+    context?: SignalContext | null;
+    /** One or more alternative interpretations. At least one. */
+    candidates: SignalCandidate[];
+}
 interface IssueFix {
     summary?: string;
     autofixable?: boolean;
@@ -1828,6 +1943,36 @@ interface IProviderReadConfig {
  * Confidence is per-emit (no manifest-level default).
  */
 
+/**
+ * Payload accepted by `IExtractorCallbacks.emitNode`. A loose subset of
+ * `Node` because the kernel fills the rest from the emission context:
+ *
+ *   - `bodyHash`, `frontmatterHash` are computed from `derivedFrom` (the
+ *     hash of the sources concatenated in declared order, so the
+ *     virtual node's hashes drift when any source changes).
+ *   - `bytes`, `linksOutCount`, `linksInCount`, `externalRefsCount`
+ *     default to zero counts on emission; the orchestrator's
+ *     post-extraction recompute pass fills them in once links resolve.
+ *
+ * The emitter MUST supply `path` (canonical id), `kind` (registered in
+ * a Provider's catalog), `derivedFrom` (one or more existing-node paths
+ * the virtual node is derived from), and SHOULD supply `frontmatter`
+ * with the metadata the UI / analyzers will surface.
+ */
+interface IEmittedNode {
+    /** Synthetic identifier. Use a non-filesystem scheme (`mcp://`, etc). */
+    path: string;
+    /** Kind declared in some Provider's `kinds` catalog. */
+    kind: string;
+    /** Required for virtual nodes: paths of the source(s). */
+    derivedFrom: string[];
+    /** Always true on this surface; the kernel mirrors it to `Node.virtual`. */
+    virtual: true;
+    /** Provider id the node is attributed to (e.g. `'claude'`). */
+    provider: string;
+    /** Optional structured metadata the UI / analyzers read. */
+    frontmatter?: Record<string, unknown>;
+}
 /**
  * Output callbacks supplied by the kernel on the extractor context.
  */
@@ -1839,6 +1984,35 @@ interface IExtractorCallbacks {
      * `extension.error` event.
      */
     emitLink(link: Link): void;
+    /**
+     * Emit a multi-candidate `Signal` for the kernel's resolver phase to
+     * collapse into a single Link (or reject). Use this instead of
+     * `emitLink` when the detection carries genuine ambiguity (multiple
+     * plausible kinds / targets), needs byte-range awareness for
+     * collision detection, or needs numeric confidence with
+     * sub-tier granularity. Unambiguous detectors should keep using
+     * `emitLink` directly. See
+     * [`signal.schema.json`](../../../spec/schemas/signal.schema.json) for the
+     * normative contract. Validated against the same closed kind enum;
+     * off-spec Signals (no candidates, off-enum kind, confidence outside
+     * `[0..1]`) drop silently with an `extension.error` event.
+     */
+    emitSignal(signal: Signal): void;
+    /**
+     * Phase 5, emit a synthetic / virtual `Node` derived from the
+     * scanning context (frontmatter, sidecar, config). Used by the
+     * `core/mcp-tools` extractor to materialise an `mcp://<name>` node
+     * out of a `tools: [mcp__<name>__*]` frontmatter entry, and by the
+     * future Cursor / Codex MCP-config extractors that walk
+     * `.cursor/mcp.json` / `~/.codex/config.toml`. The kernel
+     * deduplicates by `node.path` against the walker's nodes AND across
+     * extractor emissions: the FIRST emission of a given path wins,
+     * subsequent emissions are silently ignored (idempotent semantics so
+     * N skills referencing the same MCP collapse into one node). Emitted
+     * nodes carry `virtual: true` and `derivedFrom: [...]` per
+     * [`node.schema.json`](../../../spec/schemas/node.schema.json).
+     */
+    emitNode(node: IEmittedNode): void;
     /**
      * Merge canonical, kernel-curated properties onto the current node's
      * enrichment layer. The author-supplied frontmatter stays untouched
@@ -2004,6 +2178,18 @@ interface IAnalyzerContext {
      * absolute path when present.
      */
     cwd?: string;
+    /**
+     * Signals emitted by extractors during the scan, before the resolver
+     * collapsed them into `links`. Populated when at least one extractor
+     * opted into the Signal IR path (`ctx.emitSignal` in
+     * `IExtractorCallbacks`). Empty / absent when every extractor used
+     * `emitLink` directly (legacy and unambiguous paths). Treat as
+     * read-only. Analyzers consume this for collision detection
+     * (overlapping `range` from different extractors), fragmentation
+     * detection, and conflict-visualisation; the resolved `links` remain
+     * the source of truth for graph-level analyses.
+     */
+    signals?: readonly Signal[];
     /**
      * Emit a per-node view contribution declared in this analyzer's
      * manifest `viewContributions` map. Sync, void return; the
@@ -2489,6 +2675,8 @@ declare function runExtractorsForNode(opts: {
     externalLinks: Link[];
     enrichments: IEnrichmentRecord[];
     contributions: IContributionRecord[];
+    signals: Signal[];
+    virtualNodes: Node[];
 }>;
 
 /**
@@ -2508,7 +2696,14 @@ declare function runExtractorsForNode(opts: {
 interface RenameOp {
     from: string;
     to: string;
-    confidence: 'high' | 'medium';
+    /**
+     * Rename-heuristic confidence as a numeric tier. Body-hash matches
+     * use `ConfidenceTier.HIGH` (`0.9`); frontmatter-hash matches use
+     * `ConfidenceTier.MEDIUM` (`0.6`). Consumers that surface the tier
+     * as a string (e.g. issue analyzerId `auto-rename-<tier>`) call
+     * `renameTierLabel(confidence)` to recover the legacy label.
+     */
+    confidence: number;
 }
 /**
  * Pure rename / orphan classification per `spec/db-schema.md` §Rename
@@ -2524,7 +2719,7 @@ interface RenameOp {
  *   2. **Medium-confidence (1:1)**: of the remaining deletions, pair
  *      each with the *unique* unclaimed `newPath` that shares its
  *      `frontmatterHash`. Emits `auto-rename-medium` (severity warn)
- *      with `data: { from, to, confidence: 'medium' }`.
+ *      with `data: { from, to, confidence: ConfidenceTier.MEDIUM }`.
  *   3. **Ambiguous (N:1)**: when a single `newPath` has more than one
  *      remaining frontmatter-matching candidate, emit ONE
  *      `auto-rename-ambiguous` issue per `newPath`, listing all

package/dist/kernel/index.js

@@ -100,7 +100,7 @@ import cl100k_base from "js-tiktoken/ranks/cl100k_base";
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.32.0",
+  version: "0.33.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -181,6 +181,7 @@ var package_default = {
     "js-yaml": "4.1.1",
     kysely: "0.28.17",
     semver: "7.7.4",
+    "smol-toml": "1.6.1",
     typanion: "3.14.0",
     ws: "8.20.0"
   },
@@ -692,12 +693,22 @@ var ORCHESTRATOR_TEXTS = {
   runScanRootMissing: "runScan: root path '{{root}}' does not exist or is not a directory"
 };
 
+// kernel/types.ts
+var ConfidenceTier = Object.freeze({
+  HIGH: 0.9,
+  MEDIUM: 0.6,
+  LOW: 0.3
+});
+
 // kernel/orchestrator/extractors.ts
 async function runExtractorsForNode(opts) {
   const internalLinks = [];
   const externalLinks = [];
   const enrichmentBuffer = /* @__PURE__ */ new Map();
   const contributions = [];
+  const signals = [];
+  const virtualNodes = [];
+  const virtualNodePaths = /* @__PURE__ */ new Set();
   const validators = loadSchemaValidators();
   for (const extractor of opts.extractors) {
     const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
@@ -769,6 +780,18 @@ async function runExtractorsForNode(opts) {
         emittedAt: Date.now()
       });
     };
+    const emitSignal = (signal) => {
+      const validated = validateSignal(extractor, signal, opts.emitter);
+      if (!validated) return;
+      signals.push(validated);
+    };
+    const emitNode = (emitted) => {
+      if (virtualNodePaths.has(emitted.path)) return;
+      const node = buildVirtualNode(extractor, emitted, opts.emitter);
+      if (!node) return;
+      virtualNodePaths.add(node.path);
+      virtualNodes.push(node);
+    };
     const store = opts.pluginStores?.get(extractor.pluginId);
     const ctx = buildExtractorContext(
       extractor,
@@ -778,6 +801,8 @@ async function runExtractorsForNode(opts) {
       emitLink,
       enrichNode,
       emitContribution,
+      emitSignal,
+      emitNode,
       store
     );
     await extractor.extract(ctx);
@@ -786,7 +811,9 @@ async function runExtractorsForNode(opts) {
     internalLinks,
     externalLinks,
     enrichments: Array.from(enrichmentBuffer.values()),
-    contributions
+    contributions,
+    signals,
+    virtualNodes
   };
 }
 function readDeclaredContributions(extension) {
@@ -811,7 +838,7 @@ function emitExtensionError(emitter, qualifiedId, nodePath, data) {
     })
   );
 }
-function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, store) {
+function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, emitSignal, emitNode, store) {
   const scope = extractor.scope ?? "both";
   const settings = extractor.resolvedSettings ?? {};
   return {
@@ -822,9 +849,62 @@ function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enr
     emitLink,
     enrichNode,
     emitContribution,
+    emitSignal,
+    emitNode,
     ...store !== void 0 ? { store } : {}
   };
 }
+var VIRTUAL_NODE_PLACEHOLDER_HASH = "0".repeat(64);
+function buildVirtualNode(extractor, emitted, emitter) {
+  const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
+  if (typeof emitted.path !== "string" || emitted.path.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-path",
+        extensionId: qualifiedId,
+        message: `Extractor ${qualifiedId} emitted a virtual node with no path; dropped.`
+      })
+    );
+    return null;
+  }
+  if (typeof emitted.kind !== "string" || emitted.kind.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-kind",
+        extensionId: qualifiedId,
+        virtualPath: emitted.path,
+        message: `Extractor ${qualifiedId} emitted a virtual node at '${emitted.path}' with no kind; dropped.`
+      })
+    );
+    return null;
+  }
+  if (!Array.isArray(emitted.derivedFrom) || emitted.derivedFrom.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-derived-from",
+        extensionId: qualifiedId,
+        virtualPath: emitted.path,
+        message: `Extractor ${qualifiedId} emitted a virtual node at '${emitted.path}' with empty derivedFrom; dropped.`
+      })
+    );
+    return null;
+  }
+  const node = {
+    path: emitted.path,
+    kind: emitted.kind,
+    provider: emitted.provider,
+    bodyHash: VIRTUAL_NODE_PLACEHOLDER_HASH,
+    frontmatterHash: VIRTUAL_NODE_PLACEHOLDER_HASH,
+    bytes: { frontmatter: 0, body: 0, total: 0 },
+    linksOutCount: 0,
+    linksInCount: 0,
+    externalRefsCount: 0,
+    virtual: true,
+    derivedFrom: [...emitted.derivedFrom]
+  };
+  if (emitted.frontmatter) node.frontmatter = emitted.frontmatter;
+  return node;
+}
 function validateLink(extractor, link, emitter) {
   const knownKinds = ["invokes", "references", "mentions", "supersedes"];
   if (!knownKinds.includes(link.kind)) {
@@ -845,9 +925,68 @@ function validateLink(extractor, link, emitter) {
     );
     return null;
   }
-  const confidence = link.confidence ?? "medium";
+  const c = link.confidence;
+  if (c !== void 0 && (typeof c !== "number" || !Number.isFinite(c) || c < 0 || c > 1)) {
+    const qualifiedId = `${extractor.pluginId}/${extractor.id}`;
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "link-confidence-out-of-range",
+        extensionId: qualifiedId,
+        confidence: c,
+        message: `Extractor ${qualifiedId} emitted a Link with confidence ${String(c)} outside [0..1]; dropped.`
+      })
+    );
+    return null;
+  }
+  const confidence = c ?? ConfidenceTier.MEDIUM;
   return { ...link, confidence };
 }
+var KNOWN_LINK_KINDS = ["invokes", "references", "mentions", "supersedes"];
+function validateSignal(extractor, signal, emitter) {
+  const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
+  if (!Array.isArray(signal.candidates) || signal.candidates.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-no-candidates",
+        extensionId: qualifiedId,
+        signal: { source: signal.source, scope: signal.scope },
+        message: `Extractor ${qualifiedId} emitted a Signal with no candidates; dropped.`
+      })
+    );
+    return null;
+  }
+  for (const candidate of signal.candidates) {
+    if (!isValidSignalCandidate(qualifiedId, candidate, emitter)) return null;
+  }
+  return signal;
+}
+function isValidSignalCandidate(qualifiedId, candidate, emitter) {
+  if (!KNOWN_LINK_KINDS.includes(candidate.kind)) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-candidate-kind-not-declared",
+        extensionId: qualifiedId,
+        candidateKind: candidate.kind,
+        declaredKinds: KNOWN_LINK_KINDS,
+        message: `Extractor ${qualifiedId} emitted a Signal candidate with off-enum kind '${String(candidate.kind)}'; dropped.`
+      })
+    );
+    return false;
+  }
+  const c = candidate.confidence;
+  if (typeof c !== "number" || !Number.isFinite(c) || c < 0 || c > 1) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-candidate-confidence-out-of-range",
+        extensionId: qualifiedId,
+        confidence: candidate.confidence,
+        message: `Extractor ${qualifiedId} emitted a Signal candidate with confidence ${String(c)} outside [0..1]; dropped.`
+      })
+    );
+    return false;
+  }
+  return true;
+}
 function dedupeLinks(links) {
   const out = /* @__PURE__ */ new Map();
   for (const link of links) {
@@ -894,7 +1033,9 @@ function recomputeExternalRefsCount(nodes, externalLinks, cachedPaths) {
   }
 }
 var EXTERNAL_URL_SCHEME_RE = /^[a-z][a-z0-9+\-.]+:/i;
+var VIRTUAL_NODE_SCHEME_RE = /^mcp:\/\//i;
 function isExternalUrlLink(link) {
+  if (VIRTUAL_NODE_SCHEME_RE.test(link.target)) return false;
   return EXTERNAL_URL_SCHEME_RE.test(link.target);
 }
 
@@ -1053,13 +1194,9 @@ function originatingNodeOf(link, priorNodePaths) {
 }
 function computeCacheDecision(opts) {
   const applicableExtractors = opts.extractors.filter((ex) => {
-    const kinds = ex.precondition?.kind;
-    if (!kinds || kinds.length === 0) return true;
-    return kinds.some((qualified) => {
-      const slashIdx = qualified.indexOf("/");
-      const kindOnly = slashIdx === -1 ? qualified : qualified.slice(slashIdx + 1);
-      return kindOnly === opts.kind;
-    });
+    if (!matchesKindPrecondition(ex, opts.kind)) return false;
+    if (!matchesProviderPrecondition(ex, opts.provider)) return false;
+    return true;
   });
   const applicableQualifiedIds = new Set(
     applicableExtractors.map((ex) => qualifiedExtensionId(ex.pluginId, ex.id))
@@ -1073,6 +1210,20 @@ function computeCacheDecision(opts) {
     fullCacheHit: opts.nodeHashCacheEligible && split.missingExtractors.length === 0
   };
 }
+function matchesKindPrecondition(ex, kind) {
+  const kinds = ex.precondition?.kind;
+  if (!kinds || kinds.length === 0) return true;
+  return kinds.some((qualified) => {
+    const slashIdx = qualified.indexOf("/");
+    const kindOnly = slashIdx === -1 ? qualified : qualified.slice(slashIdx + 1);
+    return kindOnly === kind;
+  });
+}
+function matchesProviderPrecondition(ex, provider) {
+  const providers = ex.precondition?.provider;
+  if (!providers || providers.length === 0) return true;
+  return providers.includes(provider);
+}
 function splitLegacy(applicableExtractors, applicableQualifiedIds, nodeHashCacheEligible) {
   const cachedQualifiedIds = /* @__PURE__ */ new Set();
   const missingExtractors = [];
@@ -1182,7 +1333,7 @@ function findHighConfidenceRenames(opts) {
       if (opts.claimedNew.has(toPath)) continue;
       const toNode = opts.currentByPath.get(toPath);
       if (toNode.bodyHash === fromNode.bodyHash) {
-        ops.push({ from: fromPath, to: toPath, confidence: "high" });
+        ops.push({ from: fromPath, to: toPath, confidence: ConfidenceTier.HIGH });
         opts.claimedDeleted.add(fromPath);
         opts.claimedNew.add(toPath);
         break;
@@ -1217,13 +1368,13 @@ function claimSingletonRenames(opts) {
     const remaining = candidates.filter((p) => !opts.claimedDeleted.has(p));
     if (remaining.length === 1) {
       const fromPath = remaining[0];
-      ops.push({ from: fromPath, to: toPath, confidence: "medium" });
+      ops.push({ from: fromPath, to: toPath, confidence: ConfidenceTier.MEDIUM });
       opts.issues.push({
         analyzerId: "auto-rename-medium",
         severity: "warn",
         nodeIds: [toPath],
         message: `Auto-rename (medium confidence): ${fromPath} \u2192 ${toPath}`,
-        data: { from: fromPath, to: toPath, confidence: "medium" }
+        data: { from: fromPath, to: toPath, confidence: ConfidenceTier.MEDIUM }
       });
       opts.claimedDeleted.add(fromPath);
       opts.claimedNew.add(toPath);
@@ -1427,10 +1578,45 @@ var plainParser = {
   }
 };
 
+// plugins/core/parsers/toml/index.ts
+import { parse as parseToml } from "smol-toml";
+var tomlParser = {
+  id: "toml",
+  parse(raw, _path) {
+    let parsed = {};
+    const issues = [];
+    try {
+      const doc = parseToml(raw);
+      if (doc && typeof doc === "object" && !Array.isArray(doc)) {
+        parsed = stripPrototypePollution(doc);
+      }
+    } catch (err) {
+      issues.push({
+        code: "frontmatter-parse-error",
+        message: sanitiseParseErrorMessage2(err)
+      });
+    }
+    const out = {
+      frontmatterRaw: raw,
+      frontmatter: parsed,
+      body: ""
+    };
+    if (issues.length > 0) {
+      return { ...out, issues };
+    }
+    return out;
+  }
+};
+function sanitiseParseErrorMessage2(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/[-]+/g, " ").replace(/\s+/g, " ").trim();
+}
+
 // kernel/scan/parsers/index.ts
 var REGISTRY = /* @__PURE__ */ new Map([
   [frontmatterYamlParser.id, frontmatterYamlParser],
-  [plainParser.id, plainParser]
+  [plainParser.id, plainParser],
+  [tomlParser.id, tomlParser]
 ]);
 var FROZEN_IDS = new Set(REGISTRY.keys());
 function getParser(id) {
@@ -2043,6 +2229,7 @@ async function processRawNode(raw, provider, wctx, accum, claimedPaths, nextInde
   const cacheDecision = computeCacheDecision({
     extractors: wctx.opts.extractors,
     kind,
+    provider: provider.id,
     nodePath: raw.path,
     bodyHash,
     sidecarAnnotationsHash,
@@ -2145,6 +2332,10 @@ function mergeExtractResult(extractResult, accum) {
     accum.enrichmentBuffer.set(`${enr.nodePath}\0${enr.extractorId}`, enr);
   }
   for (const c of extractResult.contributions) accum.contributionsBuffer.push(c);
+  for (const vn of extractResult.virtualNodes) {
+    if (accum.nodes.some((n) => n.path === vn.path)) continue;
+    accum.nodes.push(vn);
+  }
 }
 function isPartialCacheHit(ctx) {
   return ctx.nodeHashCacheEligible && ctx.cacheDecision.cachedQualifiedIds.size > 0 && ctx.priorNode !== void 0;