@skill-map/cli 0.36.0 → 0.37.0

package/dist/kernel/index.d.ts

@@ -552,6 +552,55 @@ interface LinkLocation {
     column?: number;
     offset?: number;
 }
+/**
+ * One syntactic site in the source node's body that contributed to a
+ * `Link`. Multiple occurrences accumulate when the same edge is detected
+ * by more than one extractor (e.g. `@./foo.md` from `at-directive` and
+ * `[label](./foo.md)` from `markdown-link` both resolve to the same
+ * target), or when the same extractor walks an extractor-internal
+ * dedup boundary. Today the merged edge's `trigger` / `location`
+ * mirror the FIRST occurrence; the array carries every site so the
+ * `core/redundant-target-reference` analyzer can flag multi-form
+ * references and rename operations can find every author surface.
+ */
+interface LinkOccurrence {
+    /**
+     * Extractor id that observed this occurrence. Matches an entry of
+     * the parent `Link.sources[]` (extractor + occurrence are not 1:1,
+     * the same extractor can produce multiple occurrences when the
+     * intra-extractor dedup is relaxed in the future).
+     */
+    extractor: string;
+    /**
+     * Original substring as it appeared in the body (`@./real-agent.md`,
+     * `[deploy](./deploy.md)`, `/help`, `@team-lead`). Preserves author
+     * casing and the leading sigil so the analyzer can surface it
+     * verbatim in fix-up messages.
+     */
+    originalTrigger: string;
+    /**
+     * Position of the occurrence in the body. Optional, an extractor
+     * that does not track line numbers yet (legacy emit paths) omits
+     * this field; the analyzer falls back to "unknown line" in messages.
+     */
+    location?: LinkLocation | null;
+}
+/**
+ * External URL referenced from a node's body. Populated by the
+ * `core/external-url-counter` extractor and surfaced on the node so
+ * the inspector can list every outgoing http(s) reference without
+ * re-walking the body. Distinct from internal `Link` (which connects
+ * nodes inside the graph), external refs are leaf metadata: no
+ * counterparty node, no resolution.
+ */
+interface IExternalRef {
+    /** Normalised URL (lowercased host, fragment stripped). */
+    url: string;
+    /** 1-indexed line of the occurrence in the source body, when known. */
+    line?: number;
+    /** Verbatim author substring (sigil-free; usually equals `url`). */
+    originalTrigger?: string;
+}
 interface Node {
     path: string;
     /**
@@ -570,6 +619,15 @@ interface Node {
     linksOutCount: number;
     linksInCount: number;
     externalRefsCount: number;
+    /**
+     * Distinct external URLs referenced from this node's body, in
+     * extractor-order (first-seen wins, dedup is by normalised URL).
+     * Empty / absent when the body has no http(s) URLs. The denormalised
+     * `externalRefsCount` MUST equal `externalRefs.length` whenever
+     * both are present. Surfaced via `/api/nodes` so the inspector can
+     * list each URL without an extra round-trip.
+     */
+    externalRefs?: IExternalRef[];
     frontmatter?: Record<string, unknown>;
     tokens?: TripleSplit;
     /**
@@ -657,6 +715,30 @@ interface Link {
     sources: string[];
     trigger?: LinkTrigger | null;
     location?: LinkLocation | null;
+    /**
+     * Every syntactic site in the source body that contributed to this
+     * edge. Populated by extractors at emit time (one entry per emission)
+     * and accumulated by `dedupeLinks` when two extractors converge on the
+     * same `(source, target, kind, normalizedTrigger)` key. Empty / absent
+     * for legacy emits or for synthetic links (frontmatter-driven
+     * references, sidecar annotations) that have no body position. The
+     * `core/redundant-target-reference` analyzer walks this array to
+     * detect multi-form references to the same target from one body.
+     */
+    occurrences?: LinkOccurrence[];
+    /**
+     * Node path the link resolves to, when the post-walk
+     * `liftResolvedLinkConfidence` transform succeeded in matching the
+     * (trigger-style or path-style) target against the live graph. Equal
+     * to `link.target` for path-style links that hit a node directly;
+     * different from `link.target` for trigger-style links (a Claude
+     * `@real-agent` mention resolves to `.claude/agents/real-agent.md`,
+     * but `link.target` keeps the authored trigger). Absent when the
+     * link is unresolved (broken). The BFF `/api/links?to=<path>` uses
+     * this field to surface incoming edges that reach the node by name,
+     * not just by literal path.
+     */
+    resolvedTarget?: string | null;
     raw?: string | null;
 }
 /**
@@ -677,11 +759,16 @@ type SignalScope = 'body' | 'frontmatter' | 'sidecar';
 type SignalContext = 'code-block' | 'inline-code' | 'escaped';
 /**
  * Byte-range location for a body-scope `Signal`. `start` is inclusive,
- * `end` is exclusive (one past the last char).
+ * `end` is exclusive (one past the last char). `line` is the optional
+ * 1-indexed line number containing `start`, populated by extractors
+ * that already compute line tracking via `computeLineStarts` so the
+ * resolver's materialised `Link` preserves `link.location.line`
+ * without re-walking the body.
  */
 interface SignalRange {
     start: number;
     end: number;
+    line?: number;
 }
 /**
  * One alternative interpretation of a `Signal`. The resolver picks the
@@ -735,6 +822,59 @@ interface Signal {
     context?: SignalContext | null;
     /** One or more alternative interpretations. At least one. */
     candidates: SignalCandidate[];
+    /**
+     * Resolver outcome annotation, populated by `resolveSignals`. Absent on
+     * raw extractor emissions (before the resolver runs). When
+     * `outcome === 'materialised'`, `winnerIndex` points into `candidates[]`
+     * of the candidate the resolver chose; a corresponding `Link` was added
+     * to the graph. When `outcome === 'rejected'`, one of `rejectedBy` /
+     * `extractorDisabled` / `belowFloor` is set and no Link materialised.
+     * Both materialised and rejected Signals remain on
+     * `IAnalyzerContext.signals` so the `core/signal-collision` analyzer can
+     * surface losers as `warn` issues. Mirrors
+     * `signal.schema.json#/properties/resolution`.
+     */
+    resolution?: ISignalResolution;
+}
+/**
+ * Why the resolver chose to materialise or reject a `Signal`. Populated by
+ * `resolveSignals`; carries no meaning before that pass.
+ */
+interface ISignalResolution {
+    outcome: 'materialised' | 'rejected';
+    /** Index into `Signal.candidates[]` of the winner. Set when `outcome === 'materialised'`. */
+    winnerIndex?: number;
+    /**
+     * Set when the Signal lost a cross-extractor range-overlap collision
+     * against another Signal at the same `source`. Names the winning Signal
+     * so an analyzer (or the operator drilling into the sidecar) can see WHO
+     * won and WHY.
+     */
+    rejectedBy?: {
+        source: string;
+        range: SignalRange;
+        /** Qualified id (`<plugin>/<extractor>`) of the winning candidate's extractor. */
+        extractorId: string;
+        reason: 'kind-priority' | 'higher-confidence' | 'longer-range' | 'earlier-declaration';
+    };
+    /**
+     * Phase 4+ stub: populated when every candidate of this Signal came from
+     * an extractor the operator disabled via
+     * `plugins.<id>.extensions.<extId>.enabled`. Today the resolver never
+     * sets this; documented so analyzer surfaces can be built when the filter
+     * lands.
+     */
+    extractorDisabled?: {
+        extractorId: string;
+    };
+    /**
+     * Phase 4+ stub: populated when every candidate's `confidence` fell below
+     * the configured floor. Today the resolver materialises every Signal that
+     * survives overlap regardless of confidence.
+     */
+    belowFloor?: {
+        threshold: number;
+    };
 }
 interface IssueFix {
     summary?: string;
@@ -1969,6 +2109,34 @@ interface IProvider extends IExtensionBase {
      * confidence-lift contract, which runs against the merged Link graph.
      */
     resolution?: Record<string, string[]>;
+    /**
+     * Lens gating flag for vendor providers. When `true`, this Provider's
+     * `classify()` only runs (and the walker only iterates its territory)
+     * if `provider.id === activeProvider` (the project's active lens).
+     * When `false` or omitted (default), the Provider is universal and
+     * classifies unconditionally, regardless of the active lens.
+     *
+     * Vendor providers (`claude`, `openai`, `antigravity`) MUST set this
+     * to `true`: the actual runtimes never read each other's on-disk
+     * formats (Claude Code does not consume `.codex/`; Codex CLI does not
+     * consume `.claude/`), and offering every file to every provider
+     * fabricates cross-vendor graph edges the runtimes themselves reject.
+     *
+     * Universal providers (the open-standard `agent-skills`, the markdown
+     * fallback `core/markdown`, any future format-based fallback) keep
+     * this `false`: their territory is consumed by every vendor and they
+     * MUST run on every scan, regardless of the active lens.
+     *
+     * When `activeProvider === null` (no lens resolved, e.g. a project
+     * with no provider markers), the walker bypasses the gate entirely
+     * and every gated Provider runs, mirroring the permissive
+     * extractor-side fallback for unlensed projects.
+     *
+     * Default `undefined` ≡ `false` ≡ universal. The field affects
+     * classification ONLY; extractors continue to filter via their own
+     * `precondition.provider` allowlist and are unaffected by this flag.
+     */
+    gatedByActiveLens?: boolean;
     /**
      * Reserved invocation names this Provider's runtime owns for each
      * kind. Maps a `node.kind` to the set of normalised names the runtime
@@ -2004,6 +2172,44 @@ interface IProvider extends IExtensionBase {
      * consumes.
      */
     reservedNames?: Record<string, readonly string[]>;
+    /**
+     * Per-Provider ranking hints consumed by the Signal IR **resolver
+     * phase** (kernel `resolveSignals`). Drives intra-Signal candidate
+     * selection AND cross-Signal range-overlap tiebreaks.
+     *
+     * Optional, when absent the resolver uses the default tiebreak chain:
+     * `confidence` DESC → `range` length DESC → extractor declaration
+     * order. Most Providers do not need to declare this; the default chain
+     * is correct unless the Provider has a kind-specific preference (e.g.
+     * "treat `invokes` edges as more important than `mentions` of the
+     * same range").
+     *
+     * Distinct from the `resolution` field above: `resolverRules` ranks
+     * candidates INSIDE the Signal IR (the candidate that becomes a Link
+     * in the first place); `resolution` ranks Links AFTER they exist
+     * (confidence lift on already-emitted edges). The two surfaces share
+     * no mechanism and intentionally do not compose.
+     */
+    resolverRules?: IResolverRules;
+}
+/**
+ * Per-Provider Signal IR resolver ranking hints. Mirrors
+ * `extensions/provider.schema.json#/properties/resolverRules`.
+ */
+interface IResolverRules {
+    /**
+     * When present, the resolver ranks candidates whose `kind` appears
+     * earlier in this array ABOVE candidates whose `kind` appears later.
+     * Candidates whose `kind` is absent from the array drop to the end
+     * (after every listed kind). Ties inside the same `kindPriority`
+     * bucket fall through to the `confidence` → range-length → declaration
+     * order tiebreaks.
+     *
+     * Example: a Provider that wants `invokes` edges to win against
+     * `mentions` / `references` of the same byte range declares
+     * `['invokes', 'references', 'mentions']`.
+     */
+    kindPriority?: readonly LinkKind[];
 }
 /**
  * Declarative read config a Provider declares via `IProvider.read`.
@@ -4092,4 +4298,4 @@ interface Kernel {
 }
 declare function createKernel(): Kernel;
 
-export { type Confidence, DuplicateExtensionError, EXTENSION_KINDS, type ExecutionFailureReason, type ExecutionKind, type ExecutionRecord, type ExecutionRunner, type ExecutionStatus, ExportQueryError, type Extension, type ExtensionKind, type FilesystemPort, HOOK_TRIGGERS, type HistoryStats, type HistoryStatsErrorRates, type HistoryStatsExecutionsPerPeriod, type HistoryStatsPerActionRate, type HistoryStatsTokensPerAction, type HistoryStatsTopNode, type HistoryStatsTotals, type IAction, type IActionContext, type IActionPrecondition, type IActionResult, type IAnalyzer, type IAnalyzerContext, type IAnnotationContribution, type ICreateFsWatcherOptions, type IDedicatedStorePersist, type IDedicatedStoreWrapper, type IDiscoveredPlugin, type IEnrichmentRecord, type IExportQuery, type IExportSubset, type IExtensionBase, type IExtractor, type IExtractorCallbacks, type IExtractorContext, type IExtractorRunRecord, type IFormatter, type IFormatterContext, type IFsWatcher, type IHook, type IHookContext, type IHookDispatcher, type IIssueRow, type IKvStorePersist, type IKvStoreWrapper, type ILoadedExtension, type INodeBundle, type INodeChange, type INodeCounts, type INodeFilter, type IPersistOptions, type IPersistedEnrichment, type IPluginManifest, type IPluginStorageSchema, type IPluginStore, type IProvider, type IRawNode, type IRegisteredAnnotationKey, type IRegisteredViewContribution, type IRunOptions, type IRunResult, type IScanDelta, type ISettingDeclaration, type ITransactionalStorage, type IViewContribution, type IWalkOptions, type IWatchBatch, type IWatchEvent, InMemoryProgressEmitter, type Issue, type IssueFix, KV_SCHEMA_KEY, type Kernel, LOG_LEVELS, type Link, type LinkKind, type LinkLocation, type LinkTrigger, type LogRecord, type LoggerPort, type Node, type NodeKind, type NodeStat, type PluginLoaderPort, type ProgressEmitterPort, type ProgressEvent, Registry, type RenameOp, type RunScanOptions, type RunnerPort, type ScanResult, type ScanScannedBy, type ScanStats, type Severity, SilentLogger, type Stability, type StoragePort, type TActionWrite, type TExecutionMode, type TGranularity, type THookFilter, type THookTrigger, type TInputTypeName, type TLogLevel, type TLogMethodLevel, type TNodeChangeReason, type TPluginLoadStatus, type TPluginStorage, type TProgressListener, type TSettingValue, type TSeverity, type TSlotName, type TWatchEventKind, type TripleSplit, applyExportQuery, computeScanDelta, configureLogger, createChokidarWatcher, createKernel, detectRenamesAndOrphans, getActiveLogger, isEmptyDelta, isLogLevel, log, logLevelRank, makeDedicatedStoreWrapper, makeEvent, makeHookDispatcher, makeKvStoreWrapper, makePluginStore, mergeNodeWithEnrichments, parseExportQuery, parseLogLevel, qualifiedExtensionId, resetLogger, runExtractorsForNode, runScan, runScanWithRenames };
+export { type Confidence, DuplicateExtensionError, EXTENSION_KINDS, type ExecutionFailureReason, type ExecutionKind, type ExecutionRecord, type ExecutionRunner, type ExecutionStatus, ExportQueryError, type Extension, type ExtensionKind, type FilesystemPort, HOOK_TRIGGERS, type HistoryStats, type HistoryStatsErrorRates, type HistoryStatsExecutionsPerPeriod, type HistoryStatsPerActionRate, type HistoryStatsTokensPerAction, type HistoryStatsTopNode, type HistoryStatsTotals, type IAction, type IActionContext, type IActionPrecondition, type IActionResult, type IAnalyzer, type IAnalyzerContext, type IAnnotationContribution, type ICreateFsWatcherOptions, type IDedicatedStorePersist, type IDedicatedStoreWrapper, type IDiscoveredPlugin, type IEnrichmentRecord, type IExportQuery, type IExportSubset, type IExtensionBase, type IExternalRef, type IExtractor, type IExtractorCallbacks, type IExtractorContext, type IExtractorRunRecord, type IFormatter, type IFormatterContext, type IFsWatcher, type IHook, type IHookContext, type IHookDispatcher, type IIssueRow, type IKvStorePersist, type IKvStoreWrapper, type ILoadedExtension, type INodeBundle, type INodeChange, type INodeCounts, type INodeFilter, type IPersistOptions, type IPersistedEnrichment, type IPluginManifest, type IPluginStorageSchema, type IPluginStore, type IProvider, type IRawNode, type IRegisteredAnnotationKey, type IRegisteredViewContribution, type IRunOptions, type IRunResult, type IScanDelta, type ISettingDeclaration, type ITransactionalStorage, type IViewContribution, type IWalkOptions, type IWatchBatch, type IWatchEvent, InMemoryProgressEmitter, type Issue, type IssueFix, KV_SCHEMA_KEY, type Kernel, LOG_LEVELS, type Link, type LinkKind, type LinkLocation, type LinkOccurrence, type LinkTrigger, type LogRecord, type LoggerPort, type Node, type NodeKind, type NodeStat, type PluginLoaderPort, type ProgressEmitterPort, type ProgressEvent, Registry, type RenameOp, type RunScanOptions, type RunnerPort, type ScanResult, type ScanScannedBy, type ScanStats, type Severity, SilentLogger, type Stability, type StoragePort, type TActionWrite, type TExecutionMode, type TGranularity, type THookFilter, type THookTrigger, type TInputTypeName, type TLogLevel, type TLogMethodLevel, type TNodeChangeReason, type TPluginLoadStatus, type TPluginStorage, type TProgressListener, type TSettingValue, type TSeverity, type TSlotName, type TWatchEventKind, type TripleSplit, applyExportQuery, computeScanDelta, configureLogger, createChokidarWatcher, createKernel, detectRenamesAndOrphans, getActiveLogger, isEmptyDelta, isLogLevel, log, logLevelRank, makeDedicatedStoreWrapper, makeEvent, makeHookDispatcher, makeKvStoreWrapper, makePluginStore, mergeNodeWithEnrichments, parseExportQuery, parseLogLevel, qualifiedExtensionId, resetLogger, runExtractorsForNode, runScan, runScanWithRenames };

package/dist/kernel/index.js

@@ -101,7 +101,7 @@ import cl100k_base from "js-tiktoken/ranks/cl100k_base";
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.36.0",
+  version: "0.37.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -197,7 +197,7 @@ var package_default = {
     eslint: "10.2.1",
     "eslint-plugin-import-x": "4.16.2",
     tsup: "8.5.1",
-    tsx: "4.21.0",
+    tsx: "4.22.3",
     typescript: "5.9.3",
     "typescript-eslint": "8.59.1"
   },
@@ -1396,6 +1396,20 @@ function dedupeLinks(links) {
       if (link.confidence > existing.confidence) {
         existing.confidence = link.confidence;
       }
+      if (link.occurrences && link.occurrences.length > 0) {
+        const existingOccurrences = existing.occurrences ?? [];
+        const occKey = (o) => `${o.extractor}\0${o.originalTrigger}\0${o.location?.line ?? -1}`;
+        const occSeen = new Set(existingOccurrences.map(occKey));
+        const merged = [...existingOccurrences];
+        for (const occ of link.occurrences) {
+          const k = occKey(occ);
+          if (!occSeen.has(k)) {
+            occSeen.add(k);
+            merged.push(occ);
+          }
+        }
+        existing.occurrences = merged;
+      }
       continue;
     }
     out.set(key, link);
@@ -1419,12 +1433,23 @@ function recomputeLinkCounts(nodes, links) {
 function recomputeExternalRefsCount(nodes, externalLinks, cachedPaths) {
   const byPath2 = /* @__PURE__ */ new Map();
   for (const node of nodes) {
-    if (!cachedPaths.has(node.path)) node.externalRefsCount = 0;
+    if (!cachedPaths.has(node.path)) {
+      node.externalRefsCount = 0;
+      delete node.externalRefs;
+    }
     byPath2.set(node.path, node);
   }
   for (const link of externalLinks) {
     const source = byPath2.get(link.source);
-    if (source && !cachedPaths.has(source.path)) source.externalRefsCount += 1;
+    if (!source || cachedPaths.has(source.path)) continue;
+    source.externalRefsCount += 1;
+    const refs = source.externalRefs ?? [];
+    refs.push({
+      url: link.target,
+      ...link.location?.line !== void 0 ? { line: link.location.line } : {},
+      ...link.trigger?.originalTrigger ? { originalTrigger: link.trigger.originalTrigger } : {}
+    });
+    source.externalRefs = refs;
   }
 }
 var EXTERNAL_URL_SCHEME_RE = /^[a-z][a-z0-9+\-.]+:/i;
@@ -1435,7 +1460,7 @@ function isExternalUrlLink(link) {
 }
 
 // kernel/orchestrator/analyzers.ts
-async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths) {
+async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sidecarRoots, annotationContributions, viewContributions, orphanJobFiles, referenceablePaths, cwd, registeredActionIds, emitter, hookDispatcher, reservedNodePaths, signals) {
   const issues = [];
   const contributions = [];
   const validators = loadSchemaValidators();
@@ -1500,6 +1525,7 @@ async function runAnalyzers(analyzers, nodes, internalLinks, orphanSidecars, sid
       ...referenceablePaths ? { referenceablePaths } : {},
       ...cwd ? { cwd } : {},
       ...reservedNodePaths ? { reservedNodePaths } : {},
+      ...signals && signals.length > 0 ? { signals } : {},
       emitContribution
     });
     for (const issue of emitted) {
@@ -1780,6 +1806,7 @@ function liftResolvedLinkConfidence(links, nodes, ctx) {
     const resolution = resolve7(link, indexes, ctx);
     if (resolution === "none") continue;
     link.confidence = ctx.reservedNodePaths.has(resolution) ? RESERVED_TARGET_CONFIDENCE : 1;
+    link.resolvedTarget = resolution;
   }
 }
 function buildIndexes(nodes, ctx) {
@@ -1860,6 +1887,190 @@ function applyPostWalkTransforms(links, nodes, ctx, transforms = POST_WALK_TRANS
   return current;
 }
 
+// kernel/orchestrator/resolver.ts
+function resolveSignals(opts) {
+  const kindPriority = opts.activeProvider?.resolverRules?.kindPriority ?? [];
+  const extractorRank = buildExtractorRank(opts.extractorOrder);
+  for (const signal of opts.signals) {
+    signal.resolution = pickIntraWinner(signal, kindPriority, extractorRank);
+  }
+  const bySource = /* @__PURE__ */ new Map();
+  for (const signal of opts.signals) {
+    if (signal.resolution?.outcome !== "materialised") continue;
+    const bucket = bySource.get(signal.source) ?? [];
+    bucket.push(signal);
+    bySource.set(signal.source, bucket);
+  }
+  for (const [, signals] of bySource) {
+    const clusters = buildOverlapClusters(signals);
+    for (const cluster of clusters) {
+      if (cluster.length < 2) continue;
+      if (everyCandidateIsExternalUrl(cluster)) continue;
+      resolveCluster(cluster, kindPriority, extractorRank);
+    }
+  }
+  const links = [];
+  for (const signal of opts.signals) {
+    if (signal.resolution?.outcome !== "materialised") continue;
+    const winnerIndex = signal.resolution.winnerIndex ?? 0;
+    const winner = signal.candidates[winnerIndex];
+    if (!winner) continue;
+    links.push(materialise(signal, winner));
+  }
+  return { links, resolvedSignals: [...opts.signals] };
+}
+function buildExtractorRank(order) {
+  const rank = /* @__PURE__ */ new Map();
+  for (let i = 0; i < order.length; i += 1) rank.set(order[i], i);
+  return rank;
+}
+function pickIntraWinner(signal, kindPriority, extractorRank) {
+  let bestIndex = 0;
+  for (let i = 1; i < signal.candidates.length; i += 1) {
+    if (compareCandidates(signal.candidates[i], signal.candidates[bestIndex], kindPriority, extractorRank) < 0) {
+      bestIndex = i;
+    }
+  }
+  return { outcome: "materialised", winnerIndex: bestIndex };
+}
+function compareCandidates(a, b, kindPriority, extractorRank) {
+  const kindCmp = compareKindPriority(a.kind, b.kind, kindPriority);
+  if (kindCmp !== 0) return kindCmp;
+  if (a.confidence !== b.confidence) return b.confidence - a.confidence;
+  const aRank = extractorRank.get(a.extractorId) ?? Number.MAX_SAFE_INTEGER;
+  const bRank = extractorRank.get(b.extractorId) ?? Number.MAX_SAFE_INTEGER;
+  return aRank - bRank;
+}
+function compareKindPriority(aKind, bKind, kindPriority) {
+  if (kindPriority.length === 0) return 0;
+  const aIdx = kindPriority.indexOf(aKind);
+  const bIdx = kindPriority.indexOf(bKind);
+  const aEff = aIdx === -1 ? Number.MAX_SAFE_INTEGER : aIdx;
+  const bEff = bIdx === -1 ? Number.MAX_SAFE_INTEGER : bIdx;
+  return aEff - bEff;
+}
+function buildOverlapClusters(signals) {
+  const bodySignals = signals.filter((s) => s.scope === "body" && s.range);
+  const others = signals.filter((s) => !(s.scope === "body" && s.range));
+  const parent = bodySignals.map((_, i) => i);
+  const find = (i) => {
+    while (parent[i] !== i) {
+      parent[i] = parent[parent[i]];
+      i = parent[i];
+    }
+    return i;
+  };
+  const union = (a, b) => {
+    const ra = find(a);
+    const rb = find(b);
+    if (ra !== rb) parent[ra] = rb;
+  };
+  for (let i = 0; i < bodySignals.length; i += 1) {
+    for (let j = i + 1; j < bodySignals.length; j += 1) {
+      if (rangesOverlap(bodySignals[i].range, bodySignals[j].range)) {
+        union(i, j);
+      }
+    }
+  }
+  const byRoot = /* @__PURE__ */ new Map();
+  for (let i = 0; i < bodySignals.length; i += 1) {
+    const root = find(i);
+    const bucket = byRoot.get(root) ?? [];
+    bucket.push(bodySignals[i]);
+    byRoot.set(root, bucket);
+  }
+  return [...byRoot.values(), ...others.map((s) => [s])];
+}
+function rangesOverlap(a, b) {
+  return a.end > b.start && b.end > a.start;
+}
+function everyCandidateIsExternalUrl(cluster) {
+  for (const signal of cluster) {
+    const winnerIndex = signal.resolution?.winnerIndex ?? 0;
+    const winner = signal.candidates[winnerIndex];
+    if (!winner) return false;
+    if (!isExternalUrl(winner.target)) return false;
+  }
+  return true;
+}
+function isExternalUrl(target) {
+  return target.startsWith("http://") || target.startsWith("https://");
+}
+function resolveCluster(cluster, kindPriority, extractorRank) {
+  let winnerIdx = 0;
+  for (let i = 1; i < cluster.length; i += 1) {
+    const result = compareClusterMembers(cluster[i], cluster[winnerIdx], kindPriority, extractorRank);
+    if (result.winner === "challenger") winnerIdx = i;
+  }
+  const winner = cluster[winnerIdx];
+  const winnerCandidate = winner.candidates[winner.resolution?.winnerIndex ?? 0];
+  for (let i = 0; i < cluster.length; i += 1) {
+    if (i === winnerIdx) continue;
+    const loser = cluster[i];
+    loser.resolution = {
+      outcome: "rejected",
+      rejectedBy: {
+        source: winner.source,
+        range: winner.range,
+        extractorId: winnerCandidate.extractorId,
+        reason: whyLost(loser, winner, kindPriority, extractorRank)
+      }
+    };
+  }
+}
+function compareClusterMembers(challenger, champion, kindPriority, extractorRank) {
+  const cWinner = challenger.candidates[challenger.resolution?.winnerIndex ?? 0];
+  const xWinner = champion.candidates[champion.resolution?.winnerIndex ?? 0];
+  const kindCmp = compareKindPriority(cWinner.kind, xWinner.kind, kindPriority);
+  if (kindCmp < 0) return { winner: "challenger", reason: "kind-priority" };
+  if (kindCmp > 0) return { winner: "champion", reason: "kind-priority" };
+  if (cWinner.confidence !== xWinner.confidence) {
+    return cWinner.confidence > xWinner.confidence ? { winner: "challenger", reason: "higher-confidence" } : { winner: "champion", reason: "higher-confidence" };
+  }
+  const cLen = rangeLength(challenger.range);
+  const xLen = rangeLength(champion.range);
+  if (cLen !== xLen) {
+    return cLen > xLen ? { winner: "challenger", reason: "longer-range" } : { winner: "champion", reason: "longer-range" };
+  }
+  const cRank = extractorRank.get(cWinner.extractorId) ?? Number.MAX_SAFE_INTEGER;
+  const xRank = extractorRank.get(xWinner.extractorId) ?? Number.MAX_SAFE_INTEGER;
+  if (cRank !== xRank) {
+    return cRank < xRank ? { winner: "challenger", reason: "earlier-declaration" } : { winner: "champion", reason: "earlier-declaration" };
+  }
+  return { winner: "tie", reason: "earlier-declaration" };
+}
+function rangeLength(range) {
+  if (!range) return 0;
+  return range.end - range.start;
+}
+function whyLost(loser, winner, kindPriority, extractorRank) {
+  return compareClusterMembers(winner, loser, kindPriority, extractorRank).reason;
+}
+function materialise(signal, winner) {
+  const link = {
+    source: signal.source,
+    target: winner.target,
+    kind: winner.kind,
+    confidence: winner.confidence,
+    sources: [winner.extractorId],
+    raw: signal.raw
+  };
+  if (winner.trigger) link.trigger = winner.trigger;
+  if (signal.range) {
+    link.location = { line: signal.range.line ?? 1, offset: signal.range.start };
+  }
+  const occurrenceTrigger = winner.trigger?.originalTrigger ?? signal.raw;
+  const occurrenceLocation = signal.range ? { line: signal.range.line ?? 1 } : null;
+  link.occurrences = [
+    {
+      extractor: winner.extractorId,
+      originalTrigger: occurrenceTrigger,
+      location: occurrenceLocation
+    }
+  ];
+  return link;
+}
+
 // kernel/orchestrator/renames.ts
 function findHighConfidenceRenames(opts) {
   const ops = [];
@@ -2632,7 +2843,12 @@ async function walkAndExtract(opts) {
   const walkOptions = opts.ignoreFilter ? { ignoreFilter: opts.ignoreFilter } : {};
   let filesWalked = 0;
   let index = 0;
-  for (const provider of opts.providers) {
+  const activeProviders = opts.providers.filter((provider) => {
+    if (!provider.gatedByActiveLens) return true;
+    if (opts.activeProvider === null) return true;
+    return provider.id === opts.activeProvider;
+  });
+  for (const provider of activeProviders) {
     for await (const raw of resolveProviderWalk(provider)(opts.roots, walkOptions)) {
       filesWalked += 1;
       if (claimedPaths.has(raw.path)) continue;
@@ -2653,7 +2869,8 @@ async function walkAndExtract(opts) {
     contributions: accum.contributionsBuffer,
     freshlyRunTuples: accum.freshlyRunTuples,
     orphanSidecars,
-    sidecarRoots: accum.sidecarRoots
+    sidecarRoots: accum.sidecarRoots,
+    signals: accum.signals
   };
 }
 function createWalkAccumulators() {
@@ -2661,6 +2878,7 @@ function createWalkAccumulators() {
     nodes: [],
     internalLinks: [],
     externalLinks: [],
+    signals: [],
     cachedPaths: /* @__PURE__ */ new Set(),
     frontmatterIssues: [],
     enrichmentBuffer: /* @__PURE__ */ new Map(),
@@ -2806,6 +3024,7 @@ function recordFreshlyRunTuples(extractors, nodePath, accum) {
 function mergeExtractResult(extractResult, accum) {
   for (const link of extractResult.internalLinks) accum.internalLinks.push(link);
   for (const link of extractResult.externalLinks) accum.externalLinks.push(link);
+  for (const signal of extractResult.signals) accum.signals.push(signal);
   for (const enr of extractResult.enrichments) {
     accum.enrichmentBuffer.set(`${enr.nodePath}\0${enr.extractorId}`, enr);
   }
@@ -2908,6 +3127,7 @@ async function runScanInternal(_kernel, options) {
   const scanStartedEvent = makeEvent("scan.started", { roots: options.roots });
   emitter.emit(scanStartedEvent);
   await hookDispatcher.dispatch("scan.started", scanStartedEvent);
+  const activeProviderId = resolveActiveProviderOption(options.activeProvider, options.roots);
   const walked = await walkAndExtract({
     providers: exts.providers,
     extractors: exts.extractors,
@@ -2922,9 +3142,20 @@ async function runScanInternal(_kernel, options) {
     priorExtractorRuns: setup.priorExtractorRuns,
     providerFrontmatter: setup.providerFrontmatter,
     pluginStores: options.pluginStores,
-    activeProvider: resolveActiveProviderOption(options.activeProvider, options.roots)
+    activeProvider: activeProviderId
+  });
+  const activeProvider = activeProviderId ? exts.providers.find((p) => p.id === activeProviderId) ?? null : null;
+  const resolved = resolveSignals({
+    signals: walked.signals,
+    activeProvider,
+    extractorOrder: exts.extractors.map((e) => e.id)
   });
-  const postWalkCtx = buildPostWalkTransformCtx(_kernel, walked.nodes);
+  for (const link of resolved.links) {
+    if (isExternalUrlLink(link)) walked.externalLinks.push(link);
+    else walked.internalLinks.push(link);
+  }
+  walked.signals = resolved.resolvedSignals;
+  const postWalkCtx = buildPostWalkTransformCtx(exts.providers, walked.nodes);
   walked.internalLinks = applyPostWalkTransforms(walked.internalLinks, walked.nodes, postWalkCtx);
   recomputeLinkCounts(walked.nodes, walked.internalLinks);
   recomputeExternalRefsCount(walked.nodes, walked.externalLinks, walked.cachedPaths);
@@ -2946,7 +3177,8 @@ async function runScanInternal(_kernel, options) {
     registeredActionIds,
     emitter,
     hookDispatcher,
-    postWalkCtx.reservedNodePaths
+    postWalkCtx.reservedNodePaths,
+    walked.signals
   );
   mergeAnalyzerEmissions(walked, analyzerResult, exts.analyzers);
   const issues = analyzerResult.issues;
@@ -2959,8 +3191,8 @@ async function runScanInternal(_kernel, options) {
   await hookDispatcher.dispatch("scan.completed", scanCompletedEvent);
   return buildScanReturn(walked, issues, renameOps, stats, options, setup);
 }
-function buildPostWalkTransformCtx(kernel, nodes) {
-  const { kindRegistry, providerResolution, reservedNamesByProviderKind } = buildProviderIndexes(kernel);
+function buildPostWalkTransformCtx(providers, nodes) {
+  const { kindRegistry, providerResolution, reservedNamesByProviderKind } = buildProviderIndexes(providers);
   const reservedNodePaths = buildReservedNodePaths(
     nodes,
     kindRegistry,
@@ -2968,11 +3200,10 @@ function buildPostWalkTransformCtx(kernel, nodes) {
   );
   return { kindRegistry, providerResolution, reservedNodePaths };
 }
-function buildProviderIndexes(kernel) {
+function buildProviderIndexes(providers) {
   const kindRegistry = /* @__PURE__ */ new Map();
   const providerResolution = /* @__PURE__ */ new Map();
   const reservedNamesByProviderKind = /* @__PURE__ */ new Map();
-  const providers = kernel.registry.all("provider");
   for (const provider of providers) {
     if (provider.kinds) {
       for (const [kindName, descriptor] of Object.entries(provider.kinds)) {