@skill-map/cli 0.32.0 → 0.34.0

package/dist/index.js

@@ -93,14 +93,15 @@ var Registry = class {
 };
 
 // kernel/orchestrator/index.ts
-import { existsSync as existsSync10, statSync as statSync4 } from "fs";
+import { existsSync as existsSync11, statSync as statSync4 } from "fs";
+import { isAbsolute as isAbsolute4, resolve as resolve10 } from "path";
 import { Tiktoken as Tiktoken2 } from "js-tiktoken/lite";
 import cl100k_base from "js-tiktoken/ranks/cl100k_base";
 
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.32.0",
+  version: "0.34.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -181,6 +182,7 @@ var package_default = {
     "js-yaml": "4.1.1",
     kysely: "0.28.17",
     semver: "7.7.4",
+    "smol-toml": "1.6.1",
     typanion: "3.14.0",
     ws: "8.20.0"
   },
@@ -692,12 +694,407 @@ var ORCHESTRATOR_TEXTS = {
   runScanRootMissing: "runScan: root path '{{root}}' does not exist or is not a directory"
 };
 
+// core/config/active-provider.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join6 } from "path";
+
+// core/config/helper.ts
+import { homedir as osHomedir } from "os";
+import { isAbsolute as isAbsolute2, join as join5, resolve as resolve6 } from "path";
+
+// kernel/config/loader.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+
+// kernel/i18n/config-loader.texts.ts
+var CONFIG_LOADER_TEXTS = {
+  readFailure: "[config:{{layer}}] failed to read {{path}}: {{message}}",
+  invalidJson: "[config:{{layer}}] invalid JSON in {{path}}: {{message}}",
+  expectedObject: "[config:{{layer}}] expected a JSON object, got {{type}}; ignored",
+  unknownKey: "[config:{{layer}}] unknown key {{key}} ignored",
+  invalidValue: "[config:{{layer}}] invalid value at {{path}}: {{message}}",
+  projectLocalOnlyStripped: "[config:{{layer}}] key {{key}} is project-local only; stripped from the committed project layer. Move it to .skill-map/settings.local.json (gitignored, per-checkout)."
+};
+
+// kernel/util/skill-map-paths.ts
+import { join as join4 } from "path";
+
+// core/paths/db-path.ts
+import { join as join3, resolve as resolve5 } from "path";
+var SKILL_MAP_DIR = ".skill-map";
+var DB_FILENAME = "skill-map.db";
+var LOCAL_SETTINGS_FILENAME = "settings.local.json";
+var DEFAULT_DB_REL = `${SKILL_MAP_DIR}/${DB_FILENAME}`;
+var GITIGNORE_ENTRIES = [
+  `${SKILL_MAP_DIR}/${LOCAL_SETTINGS_FILENAME}`,
+  `${SKILL_MAP_DIR}/${DB_FILENAME}`
+];
+
+// kernel/util/skill-map-paths.ts
+var KERNEL_SKILL_MAP_DIR = SKILL_MAP_DIR;
+var SETTINGS_FILENAME = "settings.json";
+var LOCAL_SETTINGS_FILENAME2 = "settings.local.json";
+function kernelSettingsPath(scopeRoot) {
+  return join4(scopeRoot, KERNEL_SKILL_MAP_DIR, SETTINGS_FILENAME);
+}
+function kernelLocalSettingsPath(scopeRoot) {
+  return join4(scopeRoot, KERNEL_SKILL_MAP_DIR, LOCAL_SETTINGS_FILENAME2);
+}
+
+// kernel/util/strip-prototype-pollution.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function stripPrototypePollution(value) {
+  return strip(value);
+}
+function strip(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(strip);
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (FORBIDDEN_KEYS.has(k)) continue;
+    out[k] = strip(v);
+  }
+  return out;
+}
+
+// config/defaults.json
+var defaults_default = {
+  schemaVersion: 1,
+  autoMigrate: true,
+  allowEditSmFiles: false,
+  tokenizer: "cl100k_base",
+  providers: [],
+  roots: [],
+  ignore: [],
+  scan: {
+    tokenize: true,
+    strict: false,
+    followSymlinks: false,
+    maxFileSizeBytes: 1048576,
+    watch: {
+      debounceMs: 300
+    },
+    referencePaths: []
+  },
+  plugins: {},
+  history: {
+    share: false
+  },
+  jobs: {
+    ttlSeconds: 3600,
+    graceMultiplier: 3,
+    minimumTtlSeconds: 60,
+    perActionTtl: {},
+    perActionPriority: {},
+    retention: {
+      completed: 2592e3,
+      failed: null
+    }
+  },
+  i18n: {
+    locale: "en"
+  }
+};
+
+// kernel/config/loader.ts
+var PROJECT_LOCAL_ONLY_KEYS = /* @__PURE__ */ new Set([
+  "allowEditSmFiles",
+  "scan.referencePaths"
+]);
+var DEFAULTS = defaults_default;
+function loadConfig(opts) {
+  const cwd = opts.cwd;
+  const strict = opts.strict ?? false;
+  const warnings = [];
+  const sources = /* @__PURE__ */ new Map();
+  const validators = loadSchemaValidators();
+  let effective = structuredClone(DEFAULTS);
+  recordSources("", effective, sources, "defaults");
+  const filePairs = [
+    { path: kernelSettingsPath(cwd), layer: "project" },
+    { path: kernelLocalSettingsPath(cwd), layer: "project-local" }
+  ];
+  for (const { path, layer } of filePairs) {
+    if (!existsSync3(path)) continue;
+    const partial = readJsonSafe(path, layer, warnings, strict);
+    if (partial === null) continue;
+    const cleaned = validateAndStrip(validators, partial, layer, warnings, strict);
+    if (layer !== "project-local") {
+      stripProjectLocalOnlyKeys(cleaned, layer, warnings, strict);
+    }
+    effective = deepMerge(effective, cleaned);
+    recordSources("", cleaned, sources, layer);
+  }
+  if (opts.overrides && Object.keys(opts.overrides).length > 0) {
+    const cleaned = validateAndStrip(validators, opts.overrides, "override", warnings, strict);
+    stripProjectLocalOnlyKeys(cleaned, "override", warnings, strict);
+    effective = deepMerge(effective, cleaned);
+    recordSources("", cleaned, sources, "override");
+  }
+  return { effective, sources, warnings };
+}
+function readJsonSafe(path, layer, warnings, strict) {
+  let text;
+  try {
+    text = readFileSync5(path, "utf8");
+  } catch (err) {
+    return reportAndSkip(
+      tx(CONFIG_LOADER_TEXTS.readFailure, { layer, path, message: formatErrorMessage(err) }),
+      warnings,
+      strict
+    );
+  }
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    return reportAndSkip(
+      tx(CONFIG_LOADER_TEXTS.invalidJson, { layer, path, message: formatErrorMessage(err) }),
+      warnings,
+      strict
+    );
+  }
+}
+function reportAndSkip(msg, warnings, strict) {
+  if (strict) throw new Error(msg);
+  warnings.push(msg);
+  return null;
+}
+function validateAndStrip(validators, raw, layer, warnings, strict) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    const msg = tx(CONFIG_LOADER_TEXTS.expectedObject, { layer, type: describeJsonType(raw) });
+    if (strict) throw new Error(msg);
+    warnings.push(msg);
+    return {};
+  }
+  const cloned = structuredClone(raw);
+  const validator = validators.getValidator("project-config");
+  if (validator(cloned)) return cloned;
+  for (const err of validator.errors ?? []) {
+    applyValidationError(cloned, err, layer, warnings, strict);
+  }
+  return cloned;
+}
+function applyValidationError(cloned, err, layer, warnings, strict) {
+  const path = err.instancePath ?? "";
+  if (err.keyword === "additionalProperties") {
+    const extra = err.params.additionalProperty;
+    deleteAtPath(cloned, path, extra);
+    const msg2 = tx(CONFIG_LOADER_TEXTS.unknownKey, { layer, key: joinSegments(path, extra) });
+    if (strict) throw new Error(msg2);
+    warnings.push(msg2);
+    return;
+  }
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length > 0) {
+    const last = segments.pop();
+    deleteAtPath(cloned, "/" + segments.join("/"), last);
+  }
+  const msg = tx(CONFIG_LOADER_TEXTS.invalidValue, {
+    layer,
+    path: path || "(root)",
+    message: err.message ?? err.keyword
+  });
+  if (strict) throw new Error(msg);
+  warnings.push(msg);
+}
+function describeJsonType(v) {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return "array";
+  return typeof v;
+}
+function deleteAtPath(root, parentPath, key) {
+  if (containsForbidden(parentPath, key)) return;
+  const segments = parentPath.split("/").filter(Boolean);
+  let cur = root;
+  for (const seg of segments) {
+    if (!isPlainObject(cur)) return;
+    cur = cur[seg];
+  }
+  if (isPlainObject(cur)) delete cur[key];
+}
+function stripProjectLocalOnlyKeys(cloned, layer, warnings, strict) {
+  for (const dotKey of PROJECT_LOCAL_ONLY_KEYS) {
+    const segments = dotKey.split(".").filter(Boolean);
+    if (segments.length === 0) continue;
+    const leaf = segments.pop();
+    if (!keyPresentAtPath(cloned, segments, leaf)) continue;
+    const parentPath = "/" + segments.join("/");
+    deleteAtPath(cloned, parentPath, leaf);
+    const msg = tx(CONFIG_LOADER_TEXTS.projectLocalOnlyStripped, {
+      layer,
+      key: dotKey
+    });
+    if (strict) throw new Error(msg);
+    warnings.push(msg);
+  }
+}
+function keyPresentAtPath(root, parentSegments, leaf) {
+  let cur = root;
+  for (const seg of parentSegments) {
+    if (!isPlainObject(cur)) return false;
+    cur = cur[seg];
+  }
+  return isPlainObject(cur) && Object.prototype.hasOwnProperty.call(cur, leaf);
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function containsForbidden(parentPath, leaf) {
+  if (FORBIDDEN_KEYS.has(leaf)) return true;
+  for (const seg of parentPath.split("/")) {
+    if (FORBIDDEN_KEYS.has(seg)) return true;
+  }
+  return false;
+}
+function joinSegments(instancePath, leaf) {
+  const segments = instancePath.split("/").filter(Boolean);
+  return [...segments, leaf].join(".");
+}
+function deepMerge(target, source) {
+  const out = { ...target };
+  for (const [k, v] of Object.entries(source)) {
+    if (FORBIDDEN_KEYS.has(k)) continue;
+    out[k] = mergeValue(out[k], v);
+  }
+  return out;
+}
+function mergeValue(target, source) {
+  if (source === null || typeof source !== "object" || Array.isArray(source)) {
+    return source;
+  }
+  const targetSlot = target !== null && typeof target === "object" && !Array.isArray(target) ? target : {};
+  return deepMerge(targetSlot, source);
+}
+function recordSources(prefix, value, map, layer) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    if (prefix) map.set(prefix, layer);
+    return;
+  }
+  const entries = Object.entries(value);
+  if (entries.length === 0 && prefix) {
+    map.set(prefix, layer);
+    return;
+  }
+  for (const [k, v] of entries) {
+    const next = prefix ? `${prefix}.${k}` : k;
+    recordSources(next, v, map, layer);
+  }
+}
+
+// core/config/dot-path.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var ForbiddenSegmentError = class extends Error {
+  constructor(segment, key) {
+    super(`forbidden config key segment "${segment}" in "${key}"`);
+    this.segment = segment;
+    this.key = key;
+  }
+  segment;
+  key;
+};
+function assertSafeSegments(segments, key) {
+  for (const seg of segments) {
+    if (FORBIDDEN_SEGMENTS.has(seg)) throw new ForbiddenSegmentError(seg, key);
+  }
+}
+function getAtPath(obj, dotPath) {
+  const segments = dotPath.split(".").filter(Boolean);
+  assertSafeSegments(segments, dotPath);
+  let cur = obj;
+  for (const seg of segments) {
+    if (cur && typeof cur === "object" && !Array.isArray(cur)) {
+      cur = cur[seg];
+      continue;
+    }
+    return void 0;
+  }
+  return cur;
+}
+
+// core/config/atomic-write.ts
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync4,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync6,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { dirname as dirname3 } from "path";
+
+// core/config/helper.ts
+function readConfigValue(key, opts) {
+  const loaded = loadConfigForScope(opts);
+  const value = getAtPath(loaded.effective, key);
+  if (value === void 0) return opts.default;
+  return value;
+}
+function loadConfigForScope(opts) {
+  return loadConfig({
+    cwd: opts.cwd,
+    ...opts.strict ? { strict: true } : {}
+  });
+}
+
+// core/config/active-provider.ts
+var DETECTION_RULES = [
+  { providerId: "claude", marker: ".claude" },
+  { providerId: "gemini", marker: ".gemini" },
+  { providerId: "openai", marker: ".codex" },
+  { providerId: "openai", marker: "AGENTS.md" },
+  { providerId: "cursor", marker: ".cursor" }
+];
+function resolveActiveProvider(cwd) {
+  const detected = detectProvidersFromFilesystem(cwd);
+  const fromConfig = readConfigValue("activeProvider", { cwd });
+  if (typeof fromConfig === "string" && fromConfig.length > 0) {
+    return { resolved: fromConfig, source: "config", detected };
+  }
+  if (detected.length > 0) {
+    return { resolved: detected[0], source: "autodetect", detected };
+  }
+  return { resolved: null, source: "none", detected };
+}
+function detectProvidersFromFilesystem(cwd) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const rule of DETECTION_RULES) {
+    if (seen.has(rule.providerId)) continue;
+    if (!existsSync5(join6(cwd, rule.marker))) continue;
+    seen.add(rule.providerId);
+    out.push(rule.providerId);
+  }
+  return out;
+}
+
+// kernel/types.ts
+var ConfidenceTier = Object.freeze({
+  HIGH: 0.9,
+  MEDIUM: 0.6,
+  LOW: 0.3
+});
+
 // kernel/orchestrator/extractors.ts
 async function runExtractorsForNode(opts) {
   const internalLinks = [];
   const externalLinks = [];
   const enrichmentBuffer = /* @__PURE__ */ new Map();
   const contributions = [];
+  const signals = [];
+  const virtualNodes = [];
+  const virtualNodePaths = /* @__PURE__ */ new Set();
   const validators = loadSchemaValidators();
   for (const extractor of opts.extractors) {
     const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
@@ -769,6 +1166,18 @@ async function runExtractorsForNode(opts) {
         emittedAt: Date.now()
       });
     };
+    const emitSignal = (signal) => {
+      const validated = validateSignal(extractor, signal, opts.emitter);
+      if (!validated) return;
+      signals.push(validated);
+    };
+    const emitNode = (emitted) => {
+      if (virtualNodePaths.has(emitted.path)) return;
+      const node = buildVirtualNode(extractor, emitted, opts.emitter);
+      if (!node) return;
+      virtualNodePaths.add(node.path);
+      virtualNodes.push(node);
+    };
     const store = opts.pluginStores?.get(extractor.pluginId);
     const ctx = buildExtractorContext(
       extractor,
@@ -778,6 +1187,8 @@ async function runExtractorsForNode(opts) {
       emitLink,
       enrichNode,
       emitContribution,
+      emitSignal,
+      emitNode,
       store
     );
     await extractor.extract(ctx);
@@ -786,7 +1197,9 @@ async function runExtractorsForNode(opts) {
     internalLinks,
     externalLinks,
     enrichments: Array.from(enrichmentBuffer.values()),
-    contributions
+    contributions,
+    signals,
+    virtualNodes
   };
 }
 function readDeclaredContributions(extension) {
@@ -811,7 +1224,7 @@ function emitExtensionError(emitter, qualifiedId, nodePath, data) {
     })
   );
 }
-function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, store) {
+function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enrichNode, emitContribution, emitSignal, emitNode, store) {
   const scope = extractor.scope ?? "both";
   const settings = extractor.resolvedSettings ?? {};
   return {
@@ -822,9 +1235,62 @@ function buildExtractorContext(extractor, node, body, frontmatter, emitLink, enr
     emitLink,
     enrichNode,
     emitContribution,
+    emitSignal,
+    emitNode,
     ...store !== void 0 ? { store } : {}
   };
 }
+var VIRTUAL_NODE_PLACEHOLDER_HASH = "0".repeat(64);
+function buildVirtualNode(extractor, emitted, emitter) {
+  const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
+  if (typeof emitted.path !== "string" || emitted.path.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-path",
+        extensionId: qualifiedId,
+        message: `Extractor ${qualifiedId} emitted a virtual node with no path; dropped.`
+      })
+    );
+    return null;
+  }
+  if (typeof emitted.kind !== "string" || emitted.kind.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-kind",
+        extensionId: qualifiedId,
+        virtualPath: emitted.path,
+        message: `Extractor ${qualifiedId} emitted a virtual node at '${emitted.path}' with no kind; dropped.`
+      })
+    );
+    return null;
+  }
+  if (!Array.isArray(emitted.derivedFrom) || emitted.derivedFrom.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "virtual-node-missing-derived-from",
+        extensionId: qualifiedId,
+        virtualPath: emitted.path,
+        message: `Extractor ${qualifiedId} emitted a virtual node at '${emitted.path}' with empty derivedFrom; dropped.`
+      })
+    );
+    return null;
+  }
+  const node = {
+    path: emitted.path,
+    kind: emitted.kind,
+    provider: emitted.provider,
+    bodyHash: VIRTUAL_NODE_PLACEHOLDER_HASH,
+    frontmatterHash: VIRTUAL_NODE_PLACEHOLDER_HASH,
+    bytes: { frontmatter: 0, body: 0, total: 0 },
+    linksOutCount: 0,
+    linksInCount: 0,
+    externalRefsCount: 0,
+    virtual: true,
+    derivedFrom: [...emitted.derivedFrom]
+  };
+  if (emitted.frontmatter) node.frontmatter = emitted.frontmatter;
+  return node;
+}
 function validateLink(extractor, link, emitter) {
   const knownKinds = ["invokes", "references", "mentions", "supersedes"];
   if (!knownKinds.includes(link.kind)) {
@@ -845,9 +1311,68 @@ function validateLink(extractor, link, emitter) {
     );
     return null;
   }
-  const confidence = link.confidence ?? "medium";
+  const c = link.confidence;
+  if (c !== void 0 && (typeof c !== "number" || !Number.isFinite(c) || c < 0 || c > 1)) {
+    const qualifiedId = `${extractor.pluginId}/${extractor.id}`;
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "link-confidence-out-of-range",
+        extensionId: qualifiedId,
+        confidence: c,
+        message: `Extractor ${qualifiedId} emitted a Link with confidence ${String(c)} outside [0..1]; dropped.`
+      })
+    );
+    return null;
+  }
+  const confidence = c ?? ConfidenceTier.MEDIUM;
   return { ...link, confidence };
 }
+var KNOWN_LINK_KINDS = ["invokes", "references", "mentions", "supersedes"];
+function validateSignal(extractor, signal, emitter) {
+  const qualifiedId = qualifiedExtensionId(extractor.pluginId, extractor.id);
+  if (!Array.isArray(signal.candidates) || signal.candidates.length === 0) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-no-candidates",
+        extensionId: qualifiedId,
+        signal: { source: signal.source, scope: signal.scope },
+        message: `Extractor ${qualifiedId} emitted a Signal with no candidates; dropped.`
+      })
+    );
+    return null;
+  }
+  for (const candidate of signal.candidates) {
+    if (!isValidSignalCandidate(qualifiedId, candidate, emitter)) return null;
+  }
+  return signal;
+}
+function isValidSignalCandidate(qualifiedId, candidate, emitter) {
+  if (!KNOWN_LINK_KINDS.includes(candidate.kind)) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-candidate-kind-not-declared",
+        extensionId: qualifiedId,
+        candidateKind: candidate.kind,
+        declaredKinds: KNOWN_LINK_KINDS,
+        message: `Extractor ${qualifiedId} emitted a Signal candidate with off-enum kind '${String(candidate.kind)}'; dropped.`
+      })
+    );
+    return false;
+  }
+  const c = candidate.confidence;
+  if (typeof c !== "number" || !Number.isFinite(c) || c < 0 || c > 1) {
+    emitter.emit(
+      makeEvent("extension.error", {
+        kind: "signal-candidate-confidence-out-of-range",
+        extensionId: qualifiedId,
+        confidence: candidate.confidence,
+        message: `Extractor ${qualifiedId} emitted a Signal candidate with confidence ${String(c)} outside [0..1]; dropped.`
+      })
+    );
+    return false;
+  }
+  return true;
+}
 function dedupeLinks(links) {
   const out = /* @__PURE__ */ new Map();
   for (const link of links) {
@@ -862,6 +1387,9 @@ function dedupeLinks(links) {
           existing.sources = [...existing.sources, src];
         }
       }
+      if (link.confidence > existing.confidence) {
+        existing.confidence = link.confidence;
+      }
       continue;
     }
     out.set(key, link);
@@ -894,7 +1422,9 @@ function recomputeExternalRefsCount(nodes, externalLinks, cachedPaths) {
   }
 }
 var EXTERNAL_URL_SCHEME_RE = /^[a-z][a-z0-9+\-.]+:/i;
+var VIRTUAL_NODE_SCHEME_RE = /^mcp:\/\//i;
 function isExternalUrlLink(link) {
+  if (VIRTUAL_NODE_SCHEME_RE.test(link.target)) return false;
   return EXTERNAL_URL_SCHEME_RE.test(link.target);
 }
 
@@ -1053,13 +1583,9 @@ function originatingNodeOf(link, priorNodePaths) {
 }
 function computeCacheDecision(opts) {
   const applicableExtractors = opts.extractors.filter((ex) => {
-    const kinds = ex.precondition?.kind;
-    if (!kinds || kinds.length === 0) return true;
-    return kinds.some((qualified) => {
-      const slashIdx = qualified.indexOf("/");
-      const kindOnly = slashIdx === -1 ? qualified : qualified.slice(slashIdx + 1);
-      return kindOnly === opts.kind;
-    });
+    if (!matchesKindPrecondition(ex, opts.kind)) return false;
+    if (!matchesProviderPrecondition(ex, opts.provider, opts.activeProvider)) return false;
+    return true;
   });
   const applicableQualifiedIds = new Set(
     applicableExtractors.map((ex) => qualifiedExtensionId(ex.pluginId, ex.id))
@@ -1073,6 +1599,22 @@ function computeCacheDecision(opts) {
     fullCacheHit: opts.nodeHashCacheEligible && split.missingExtractors.length === 0
   };
 }
+function matchesKindPrecondition(ex, kind) {
+  const kinds = ex.precondition?.kind;
+  if (!kinds || kinds.length === 0) return true;
+  return kinds.some((qualified) => {
+    const slashIdx = qualified.indexOf("/");
+    const kindOnly = slashIdx === -1 ? qualified : qualified.slice(slashIdx + 1);
+    return kindOnly === kind;
+  });
+}
+function matchesProviderPrecondition(ex, nodeProvider, activeProvider) {
+  const providers = ex.precondition?.provider;
+  if (!providers || providers.length === 0) return true;
+  if (!providers.includes(nodeProvider)) return false;
+  if (activeProvider === null) return false;
+  return providers.includes(activeProvider);
+}
 function splitLegacy(applicableExtractors, applicableQualifiedIds, nodeHashCacheEligible) {
   const cachedQualifiedIds = /* @__PURE__ */ new Set();
   const missingExtractors = [];
@@ -1172,6 +1714,75 @@ function classifyLinkSource(source, shortIdToQualified, cachedQualifiedIds, appl
   return "obsolete";
 }
 
+// kernel/trigger-normalize.ts
+function normalizeTrigger(source) {
+  let out = source.normalize("NFD");
+  out = out.replace(new RegExp("\\p{Mn}+", "gu"), "");
+  out = out.toLowerCase();
+  out = out.replace(/[-_\s]+/g, " ");
+  out = out.replace(/  +/g, " ");
+  return out.trim();
+}
+
+// kernel/orchestrator/lift-mention-confidence.ts
+function liftMentionConfidence(links, nodes) {
+  if (!links.some((l) => l.kind === "mentions")) return;
+  const byPath2 = /* @__PURE__ */ new Set();
+  for (const node of nodes) byPath2.add(node.path);
+  const byNormalizedName = indexByNormalizedName(nodes);
+  for (const link of links) {
+    if (link.kind !== "mentions") continue;
+    if (isResolved(link, byPath2, byNormalizedName)) {
+      link.confidence = 1;
+    }
+  }
+}
+function isResolved(link, byPath2, byNormalizedName) {
+  const normalized = link.trigger?.normalizedTrigger;
+  if (normalized) {
+    const withoutSigil = normalized.replace(/^[/@]/, "").trim();
+    if (byNormalizedName.has(withoutSigil)) return true;
+  }
+  if (byPath2.has(link.target)) return true;
+  return false;
+}
+function indexByNormalizedName(nodes) {
+  const out = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const raw = node.frontmatter?.["name"];
+    const name = typeof raw === "string" ? raw : "";
+    if (!name) continue;
+    out.set(normalizeTrigger(name), true);
+  }
+  return out;
+}
+
+// kernel/orchestrator/post-walk-transforms.ts
+var POST_WALK_TRANSFORMS = [
+  {
+    id: "dedupe-links",
+    description: "Collapse identical (source, target, kind, normalizedTrigger) edges across extractors; union sources[] and pick max confidence on merge.",
+    run(links) {
+      return dedupeLinks(links);
+    }
+  },
+  {
+    id: "lift-mention-confidence",
+    description: "Bump resolved `mentions` links to confidence 1.0 once the full node graph is known (post-merge polish).",
+    run(links, nodes) {
+      liftMentionConfidence(links, nodes);
+    }
+  }
+];
+function applyPostWalkTransforms(links, nodes, transforms = POST_WALK_TRANSFORMS) {
+  let current = links;
+  for (const transform of transforms) {
+    const next = transform.run(current, nodes);
+    if (next) current = next;
+  }
+  return current;
+}
+
 // kernel/orchestrator/renames.ts
 function findHighConfidenceRenames(opts) {
   const ops = [];
@@ -1182,7 +1793,7 @@ function findHighConfidenceRenames(opts) {
       if (opts.claimedNew.has(toPath)) continue;
       const toNode = opts.currentByPath.get(toPath);
       if (toNode.bodyHash === fromNode.bodyHash) {
-        ops.push({ from: fromPath, to: toPath, confidence: "high" });
+        ops.push({ from: fromPath, to: toPath, confidence: ConfidenceTier.HIGH });
         opts.claimedDeleted.add(fromPath);
         opts.claimedNew.add(toPath);
         break;
@@ -1217,13 +1828,13 @@ function claimSingletonRenames(opts) {
     const remaining = candidates.filter((p) => !opts.claimedDeleted.has(p));
     if (remaining.length === 1) {
       const fromPath = remaining[0];
-      ops.push({ from: fromPath, to: toPath, confidence: "medium" });
+      ops.push({ from: fromPath, to: toPath, confidence: ConfidenceTier.MEDIUM });
       opts.issues.push({
         analyzerId: "auto-rename-medium",
         severity: "warn",
         nodeIds: [toPath],
         message: `Auto-rename (medium confidence): ${fromPath} \u2192 ${toPath}`,
-        data: { from: fromPath, to: toPath, confidence: "medium" }
+        data: { from: fromPath, to: toPath, confidence: ConfidenceTier.MEDIUM }
       });
       opts.claimedDeleted.add(fromPath);
       opts.claimedNew.add(toPath);
@@ -1306,11 +1917,11 @@ function detectRenamesAndOrphans(prior, current, issues, silenced) {
 
 // kernel/scan/walk-content.ts
 import { readFile, readdir, lstat } from "fs/promises";
-import { join as join3, relative as relative2, sep } from "path";
+import { join as join7, relative as relative2, sep } from "path";
 
 // kernel/scan/ignore.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname3, resolve as resolve5 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname4, resolve as resolve7 } from "path";
 import { fileURLToPath } from "url";
 import ignoreFactory from "ignore";
 function buildIgnoreFilter(opts = {}) {
@@ -1342,18 +1953,18 @@ function loadDefaultsText() {
   return cachedDefaults;
 }
 function readDefaultsFromDisk() {
-  const here = dirname3(fileURLToPath(import.meta.url));
+  const here = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve5(here, "../../config/defaults/skillmapignore"),
+    resolve7(here, "../../config/defaults/skillmapignore"),
     // src/kernel/scan/ → src/config/defaults/
-    resolve5(here, "../config/defaults/skillmapignore"),
+    resolve7(here, "../config/defaults/skillmapignore"),
     // dist/cli.js → dist/config/defaults/ (siblings)
-    resolve5(here, "config/defaults/skillmapignore")
+    resolve7(here, "config/defaults/skillmapignore")
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate)) {
+    if (existsSync6(candidate)) {
       try {
-        return readFileSync5(candidate, "utf8");
+        return readFileSync7(candidate, "utf8");
       } catch {
       }
     }
@@ -1363,29 +1974,6 @@ function readDefaultsFromDisk() {
 
 // plugins/core/parsers/frontmatter-yaml/index.ts
 import yaml from "js-yaml";
-
-// kernel/util/strip-prototype-pollution.ts
-var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-function stripPrototypePollution(value) {
-  return strip(value);
-}
-function strip(value) {
-  if (value === null || value === void 0) return value;
-  if (typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(strip);
-  const out = {};
-  for (const [k, v] of Object.entries(value)) {
-    if (FORBIDDEN_KEYS.has(k)) continue;
-    out[k] = strip(v);
-  }
-  return out;
-}
-
-// plugins/core/parsers/frontmatter-yaml/index.ts
 var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 var frontmatterYamlParser = {
   id: "frontmatter-yaml",
@@ -1427,10 +2015,45 @@ var plainParser = {
   }
 };
 
+// plugins/core/parsers/toml/index.ts
+import { parse as parseToml } from "smol-toml";
+var tomlParser = {
+  id: "toml",
+  parse(raw, _path) {
+    let parsed = {};
+    const issues = [];
+    try {
+      const doc = parseToml(raw);
+      if (doc && typeof doc === "object" && !Array.isArray(doc)) {
+        parsed = stripPrototypePollution(doc);
+      }
+    } catch (err) {
+      issues.push({
+        code: "frontmatter-parse-error",
+        message: sanitiseParseErrorMessage2(err)
+      });
+    }
+    const out = {
+      frontmatterRaw: raw,
+      frontmatter: parsed,
+      body: ""
+    };
+    if (issues.length > 0) {
+      return { ...out, issues };
+    }
+    return out;
+  }
+};
+function sanitiseParseErrorMessage2(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/[-]+/g, " ").replace(/\s+/g, " ").trim();
+}
+
 // kernel/scan/parsers/index.ts
 var REGISTRY = /* @__PURE__ */ new Map([
   [frontmatterYamlParser.id, frontmatterYamlParser],
-  [plainParser.id, plainParser]
+  [plainParser.id, plainParser],
+  [tomlParser.id, tomlParser]
 ]);
 var FROZEN_IDS = new Set(REGISTRY.keys());
 function getParser(id) {
@@ -1482,7 +2105,7 @@ async function* walkRoot(root, current, filter, extensions) {
   }
   for (const entry of entries) {
     const name = entry.name;
-    const full = join3(current, name);
+    const full = join7(current, name);
     const rel = relative2(root, full).split(sep).join("/");
     if (filter.ignores(rel)) continue;
     if (entry.isSymbolicLink()) continue;
@@ -1526,19 +2149,19 @@ function resolveProviderWalk(provider) {
 }
 
 // kernel/sidecar/parse.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, resolve as resolve6 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname5, resolve as resolve8 } from "path";
 import { createRequire as createRequire3 } from "module";
 import { Ajv2020 as Ajv20204 } from "ajv/dist/2020.js";
 import yaml2 from "js-yaml";
 function readSidecarFor(mdAbsolutePath) {
   const sidecarPath = sidecarPathFor(mdAbsolutePath);
-  if (!existsSync4(sidecarPath)) {
+  if (!existsSync7(sidecarPath)) {
     return { parsed: null, present: false, issues: [] };
   }
   let raw;
   try {
-    raw = readFileSync6(sidecarPath, "utf8");
+    raw = readFileSync8(sidecarPath, "utf8");
   } catch (err) {
     return {
       parsed: null,
@@ -1557,7 +2180,7 @@ function readSidecarFor(mdAbsolutePath) {
     };
   }
   parsedYaml = stripPrototypePollution(parsedYaml);
-  if (!isPlainObject(parsedYaml)) {
+  if (!isPlainObject2(parsedYaml)) {
     return {
       parsed: null,
       present: true,
@@ -1576,7 +2199,7 @@ function readSidecarFor(mdAbsolutePath) {
   const root = parsedYaml;
   const identityBlock = root["identity"];
   const annotationsRaw = root["annotations"];
-  const annotations = isPlainObject(annotationsRaw) ? Object.keys(annotationsRaw).length === 0 ? null : annotationsRaw : null;
+  const annotations = isPlainObject2(annotationsRaw) ? Object.keys(annotationsRaw).length === 0 ? null : annotationsRaw : null;
   return {
     parsed: {
       filePath: sidecarPath,
@@ -1596,7 +2219,7 @@ function sidecarPathFor(mdAbsolutePath) {
   }
   return `${mdAbsolutePath}.sm`;
 }
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 var cachedSidecarValidator = null;
@@ -1606,10 +2229,10 @@ function getSidecarValidator() {
   applyAjvFormats(ajv);
   const specRoot = resolveSpecRoot2();
   const annotationsSchema = JSON.parse(
-    readFileSync6(resolve6(specRoot, "schemas/annotations.schema.json"), "utf8")
+    readFileSync8(resolve8(specRoot, "schemas/annotations.schema.json"), "utf8")
   );
   const sidecarSchema = JSON.parse(
-    readFileSync6(resolve6(specRoot, "schemas/sidecar.schema.json"), "utf8")
+    readFileSync8(resolve8(specRoot, "schemas/sidecar.schema.json"), "utf8")
   );
   ajv.addSchema(annotationsSchema);
   cachedSidecarValidator = ajv.compile(sidecarSchema);
@@ -1619,7 +2242,7 @@ function resolveSpecRoot2() {
   const require2 = createRequire3(import.meta.url);
   try {
     const indexPath = require2.resolve("@skill-map/spec/index.json");
-    return dirname4(indexPath);
+    return dirname5(indexPath);
   } catch {
     throw new Error(
       "@skill-map/spec not resolvable: sidecar reader cannot load schemas."
@@ -1638,8 +2261,8 @@ function computeDriftStatus(args) {
 }
 
 // kernel/sidecar/discover-orphans.ts
-import { existsSync as existsSync5, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { join as join4, relative as relative3, sep as sep2 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { join as join8, relative as relative3, sep as sep2 } from "path";
 function discoverOrphanSidecars(roots, shouldSkip) {
   const out = [];
   for (const root of roots) {
@@ -1655,7 +2278,7 @@ function walk(root, current, shouldSkip, out) {
     return;
   }
   for (const entry of entries) {
-    const full = join4(current, entry.name);
+    const full = join8(current, entry.name);
     const rel = relative3(root, full).split(sep2).join("/");
     if (shouldSkip(rel)) continue;
     if (entry.isSymbolicLink()) continue;
@@ -1666,7 +2289,7 @@ function walk(root, current, shouldSkip, out) {
     if (!entry.isFile()) continue;
     if (!entry.name.endsWith(".sm")) continue;
     const expectedMd = `${full.slice(0, -".sm".length)}.md`;
-    if (existsSync5(expectedMd) && safeIsFile(expectedMd)) continue;
+    if (existsSync8(expectedMd) && safeIsFile(expectedMd)) continue;
     out.push({ sidecarPath: full, relativePath: rel, expectedMdPath: expectedMd });
   }
 }
@@ -1679,51 +2302,15 @@ function safeIsFile(path) {
 }
 
 // kernel/sidecar/store.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
 import { dirname as dirname6, resolve as resolve9 } from "path";
 import { createRequire as createRequire4 } from "module";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 import yaml3 from "js-yaml";
 
-// core/config/atomic-write.ts
-import {
-  closeSync,
-  constants as fsConstants,
-  existsSync as existsSync6,
-  mkdirSync,
-  openSync,
-  readFileSync as readFileSync7,
-  renameSync,
-  unlinkSync,
-  writeSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { dirname as dirname5 } from "path";
-
-// core/config/helper.ts
-import { homedir as osHomedir } from "os";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve8 } from "path";
-
-// kernel/config/loader.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-
-// kernel/util/skill-map-paths.ts
-import { join as join6 } from "path";
-
-// core/paths/db-path.ts
-import { join as join5, resolve as resolve7 } from "path";
-var SKILL_MAP_DIR = ".skill-map";
-var DB_FILENAME = "skill-map.db";
-var LOCAL_SETTINGS_FILENAME = "settings.local.json";
-var DEFAULT_DB_REL = `${SKILL_MAP_DIR}/${DB_FILENAME}`;
-var GITIGNORE_ENTRIES = [
-  `${SKILL_MAP_DIR}/${LOCAL_SETTINGS_FILENAME}`,
-  `${SKILL_MAP_DIR}/${DB_FILENAME}`
-];
-
 // kernel/orchestrator/node-build.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { isAbsolute as isAbsolute3, resolve as resolvePath } from "path";
 import "js-tiktoken/lite";
 import yaml4 from "js-yaml";
@@ -1887,11 +2474,11 @@ function resolveSidecarOverlay(relativePath, nodePathForIssue, roots, liveBodyHa
 }
 function resolveAbsoluteMdPath(relativePath, roots) {
   if (isAbsolute3(relativePath)) {
-    return existsSync9(relativePath) ? relativePath : null;
+    return existsSync10(relativePath) ? relativePath : null;
   }
   for (const root of roots) {
     const candidate = resolvePath(root, relativePath);
-    if (existsSync9(candidate)) return candidate;
+    if (existsSync10(candidate)) return candidate;
   }
   return null;
 }
@@ -2043,6 +2630,8 @@ async function processRawNode(raw, provider, wctx, accum, claimedPaths, nextInde
   const cacheDecision = computeCacheDecision({
     extractors: wctx.opts.extractors,
     kind,
+    provider: provider.id,
+    activeProvider: wctx.opts.activeProvider,
     nodePath: raw.path,
     bodyHash,
     sidecarAnnotationsHash,
@@ -2145,6 +2734,10 @@ function mergeExtractResult(extractResult, accum) {
     accum.enrichmentBuffer.set(`${enr.nodePath}\0${enr.extractorId}`, enr);
   }
   for (const c of extractResult.contributions) accum.contributionsBuffer.push(c);
+  for (const vn of extractResult.virtualNodes) {
+    if (accum.nodes.some((n) => n.path === vn.path)) continue;
+    accum.nodes.push(vn);
+  }
 }
 function isPartialCacheHit(ctx) {
   return ctx.nodeHashCacheEligible && ctx.cacheDecision.cachedQualifiedIds.size > 0 && ctx.priorNode !== void 0;
@@ -2252,9 +2845,10 @@ async function runScanInternal(_kernel, options) {
     priorIndex: setup.priorIndex,
     priorExtractorRuns: setup.priorExtractorRuns,
     providerFrontmatter: setup.providerFrontmatter,
-    pluginStores: options.pluginStores
+    pluginStores: options.pluginStores,
+    activeProvider: resolveActiveProviderOption(options.activeProvider, options.roots)
   });
-  walked.internalLinks = dedupeLinks(walked.internalLinks);
+  walked.internalLinks = applyPostWalkTransforms(walked.internalLinks, walked.nodes);
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
   await dispatchExtractorCompleted(exts.extractors, emitter, hookDispatcher);
@@ -2370,17 +2964,27 @@ function validateRoots(roots) {
     throw new Error(ORCHESTRATOR_TEXTS.runScanRootEmptyArray);
   }
   for (const root of roots) {
-    if (!existsSync10(root) || !statSync4(root).isDirectory()) {
+    if (!existsSync11(root) || !statSync4(root).isDirectory()) {
       throw new Error(tx(ORCHESTRATOR_TEXTS.runScanRootMissing, { root }));
     }
   }
 }
+function resolveActiveProviderOption(optionValue, roots) {
+  if (optionValue !== void 0) return optionValue;
+  for (const root of roots) {
+    const absRoot = isAbsolute4(root) ? root : resolve10(root);
+    if (!existsSync11(absRoot)) continue;
+    const detected = resolveActiveProvider(absRoot).resolved;
+    if (detected !== null) return detected;
+  }
+  return null;
+}
 
 // kernel/scan/watcher.ts
-import { resolve as resolve10, relative as relative4, sep as sep3 } from "path";
+import { resolve as resolve11, relative as relative4, sep as sep3 } from "path";
 import chokidar from "chokidar";
 function createChokidarWatcher(opts) {
-  const absRoots = opts.roots.map((r) => resolve10(opts.cwd, r));
+  const absRoots = opts.roots.map((r) => resolve11(opts.cwd, r));
   const ignoreFilterOpt = opts.ignoreFilter;
   const getFilter = ignoreFilterOpt === void 0 ? void 0 : typeof ignoreFilterOpt === "function" ? ignoreFilterOpt : () => ignoreFilterOpt;
   const ignored = getFilter ? (path) => {