@skill-map/cli 0.45.1 → 0.47.0

package/dist/cli.js

@@ -1,5 +1,7 @@
 // cli/entry.ts
-import { existsSync as existsSync32 } from "fs";
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="926243f9-3707-54bc-9aa6-c68955118161")}catch(e){}}();
+import { existsSync as existsSync33 } from "fs";
 import { Builtins, Cli as Cli2 } from "clipanion";
 
 // kernel/adapters/in-memory-progress.ts
@@ -244,7 +246,7 @@ function bucketByKind(kind, instance, bag) {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.45.1",
+  version: "0.47.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -598,7 +600,7 @@ var claudeProvider = {
   read: { extensions: [".md"], parser: "frontmatter-yaml" },
   // Per spec § A.6, defaultRefreshAction values MUST be qualified action
   // ids. The summarize-* actions are not yet implemented as registry
-  // entries (they ship later under the Claude bundle), but the qualified
+  // entries (they ship later under the Claude plugin), but the qualified
   // form is the contract: when those actions land, they will register
   // under `claude/summarize-<kind>` and the Provider resolves them
   // deterministically.
@@ -1309,7 +1311,7 @@ var markdown_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://skill-map.ai/providers/core/v1/frontmatter/markdown.schema.json",
   title: "FrontmatterMarkdown",
-  description: "Frontmatter shape for nodes classified as `markdown` by the built-in `core/markdown` Provider, the universal fallback for any markdown file no vendor-specific Provider claims (Claude, OpenAI Codex, agent-skills, plus the metadata-only Antigravity bundle). The kind is named after the format because the file is a generic fallback; format-named kinds apply only as the generic fallback, a TOML file that IS a Codex agent still classifies as `agent`, not `toml`. Extends the spec's universal `frontmatter/base.schema.json` via $ref-by-$id with no additional fields. Ownership relocated from the Claude Provider in spec 0.18.0, markdown is provider-agnostic and lives under `core` so adding new vendor Providers does not require choosing which one owns the universal fallback.",
+  description: "Frontmatter shape for nodes classified as `markdown` by the built-in `core/markdown` Provider, the universal fallback for any markdown file no vendor-specific Provider claims (Claude, OpenAI Codex, agent-skills, plus the metadata-only Antigravity plugin). The kind is named after the format because the file is a generic fallback; format-named kinds apply only as the generic fallback, a TOML file that IS a Codex agent still classifies as `agent`, not `toml`. Extends the spec's universal `frontmatter/base.schema.json` via $ref-by-$id with no additional fields. Ownership relocated from the Claude Provider in spec 0.18.0, markdown is provider-agnostic and lives under `core` so adding new vendor Providers does not require choosing which one owns the universal fallback.",
   allOf: [
     { $ref: "https://skill-map.ai/spec/v0/frontmatter/base.schema.json" }
   ],
@@ -1340,7 +1342,7 @@ var coreMarkdownProvider = {
   read: { extensions: [".md"], parser: "frontmatter-yaml" },
   // Per spec § A.6, defaultRefreshAction values MUST be qualified
   // action ids. The summarize-markdown action is not yet implemented
-  // as a registry entry (it ships later under the core bundle), but
+  // as a registry entry (it ships later under the core plugin), but
   // the qualified form is the contract.
   //
   // UI presentation: same neutral teal that the per-vendor Providers
@@ -4464,7 +4466,7 @@ var jsonFormatter2 = { ...jsonFormatter, pluginId: "core", version: VERSION };
 var nodeBumpAction2 = { ...nodeBumpAction, pluginId: "core", version: VERSION };
 var nodeSupersedeAction2 = { ...nodeSupersedeAction, pluginId: "core", version: VERSION };
 var updateCheckHook2 = { ...updateCheckHook, pluginId: "core", version: VERSION };
-var builtInBundles = [
+var builtInPlugins = [
   {
     id: "claude",
     description: "Claude Code platform integration. Classifies files under `.claude/{agents,commands,skills}` and detects Claude-flavored slash commands and at-directives in their bodies.",
@@ -4539,8 +4541,8 @@ function builtIns() {
     actions: [],
     hooks: []
   };
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
       bucketBuiltIn(ext, out);
     }
   }
@@ -4548,8 +4550,8 @@ function builtIns() {
 }
 function listBuiltIns() {
   const out = [];
-  for (const bundle of builtInBundles) {
-    for (const x of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const x of plugin.extensions) {
       out.push(toExtensionRow(x));
     }
   }
@@ -4603,6 +4605,8 @@ var ENTRY_TEXTS = {
   parseErrorFlagSuggestion: "Did you mean '{{suggestion}}'?",
   parseErrorVerbSuggestion: "Did you mean {{suggestions}}?",
   parseErrorVerbHelpHint: "Run 'sm help {{verb}}' for usage.",
+  /** Footer for the incomplete-namespace error, points at that namespace's overview. */
+  parseErrorNamespaceHelpHint: "Run 'sm help {{name}}' to see all subcommands.",
   parseErrorFooter: "Run 'sm help' to see the full command list."
 };
 
@@ -4891,7 +4895,8 @@ function formatParseError(params) {
     const suggestion2 = tx(ENTRY_TEXTS.parseErrorSubcommandList, {
       suggestions: formatSuggestionList(subcommands)
     });
-    return renderError(headline, suggestion2);
+    const footer = tx(ENTRY_TEXTS.parseErrorNamespaceHelpHint, { name: firstToken });
+    return renderError(headline, suggestion2, footer);
   }
   const candidates = closestVerbs(firstToken, verbPaths);
   const suggestion = candidates.length > 0 ? tx(ENTRY_TEXTS.parseErrorVerbSuggestion, { suggestions: formatSuggestionList(candidates) }) : null;
@@ -4932,10 +4937,10 @@ function matchedVerbPrefix(args2, verbPaths) {
   }
   return best.join(" ");
 }
-function renderError(headline, suggestion) {
+function renderError(headline, suggestion, footer = ENTRY_TEXTS.parseErrorFooter) {
   const lines = [tx(ENTRY_TEXTS.parseErrorHeadline, { message: headline })];
   if (suggestion) lines.push(suggestion);
-  lines.push(ENTRY_TEXTS.parseErrorFooter);
+  lines.push(footer);
   return lines.join("\n") + "\n";
 }
 function extractOffendingFlag(message) {
@@ -5365,16 +5370,13 @@ function kernelLocalSettingsPath(scopeRoot) {
 // config/defaults.json
 var defaults_default = {
   schemaVersion: 1,
-  autoMigrate: true,
   allowEditSmFiles: false,
   tokenizer: "cl100k_base",
-  providers: [],
   roots: [],
   ignore: [],
   scan: {
     tokenize: true,
     strict: false,
-    followSymlinks: false,
     maxFileSizeBytes: 1048576,
     maxNodes: 256,
     watch: {
@@ -5383,9 +5385,6 @@ var defaults_default = {
     referencePaths: []
   },
   plugins: {},
-  history: {
-    share: false
-  },
   jobs: {
     ttlSeconds: 3600,
     graceMultiplier: 3,
@@ -5396,9 +5395,6 @@ var defaults_default = {
       completed: 2592e3,
       failed: null
     }
-  },
-  i18n: {
-    locale: "en"
   }
 };
 
@@ -6224,12 +6220,12 @@ var SmCommand = class extends Command {
 };
 
 // core/sqlite/with-sqlite.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 
 // kernel/adapters/sqlite/storage-adapter.ts
 import { mkdirSync as mkdirSync4 } from "fs";
 import { dirname as dirname8, resolve as resolve12 } from "path";
-import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 import { CamelCasePlugin, Kysely, sql as sql3 } from "kysely";
 
 // kernel/i18n/storage.texts.ts
@@ -7510,20 +7506,29 @@ async function loadScanResult(db) {
       version: metaRow.scannedByVersion,
       specVersion: metaRow.scannedBySpecVersion
     };
+    const oversizedFiles = parseJsonArray(metaRow.oversizedFilesJson);
     return {
       schemaVersion: 1,
       scannedAt: metaRow.scannedAt,
       roots: parseJsonArray(metaRow.rootsJson),
       providers: parseJsonArray(metaRow.providersJson),
       scannedBy,
+      // Resolved encoder of the prior scan (see project-config.schema.json
+      // §tokenizer). NULL column → `undefined` domain field; the
+      // orchestrator's tokenizer-change check compares this against the
+      // freshly-resolved encoder and treats a missing prior value as a
+      // change (forcing a token recompute).
+      ...metaRow.tokenizer !== null ? { tokenizer: metaRow.tokenizer } : {},
       recommendedNodeLimit: metaRow.recommendedNodeLimit,
       overrideMaxNodes: metaRow.overrideMaxNodes,
+      oversizedFiles,
       nodes,
       links,
       issues,
       stats: {
         filesWalked: metaRow.statsFilesWalked,
         filesSkipped: metaRow.statsFilesSkipped,
+        filesOversized: metaRow.filesOversized,
         nodesCount: nodes.length,
         linksCount: links.length,
         issuesCount: issues.length,
@@ -7546,12 +7551,14 @@ async function loadScanResult(db) {
     // scan overwrites scan_meta with the live values on next run.
     recommendedNodeLimit: 256,
     overrideMaxNodes: null,
+    oversizedFiles: [],
     nodes,
     links,
     issues,
     stats: {
       filesWalked: 0,
       filesSkipped: 0,
+      filesOversized: 0,
       nodesCount: nodes.length,
       linksCount: links.length,
       issuesCount: issues.length,
@@ -7845,6 +7852,58 @@ function rowToContribution(row) {
   };
 }
 
+// core/sqlite/schema-fingerprint.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+var memoized = null;
+function schemaFingerprint(files) {
+  if (files === void 0 && memoized !== null) return memoized;
+  const migrations = files ?? discoverMigrations();
+  const hash = createHash("sha256");
+  for (const m of migrations) {
+    const sql4 = existsSync10(m.filePath) ? readFileSync10(m.filePath, "utf8") : "";
+    hash.update(`${m.version}\0${m.description}\0${Buffer.byteLength(sql4)}\0`);
+    hash.update(sql4);
+  }
+  const digest = hash.digest("hex");
+  if (files === void 0) memoized = digest;
+  return digest;
+}
+function readStoredFingerprint(dbPath) {
+  if (dbPath === ":memory:" || !existsSync10(dbPath)) return { kind: "no-meta" };
+  let raw = null;
+  try {
+    raw = new DatabaseSync3(dbPath, { readOnly: true });
+    return readStoredFingerprintFrom(raw);
+  } catch {
+    return { kind: "no-meta" };
+  } finally {
+    raw?.close();
+  }
+}
+function readStoredFingerprintFrom(raw) {
+  if (!columnExists(raw, "scan_meta", "schema_fingerprint")) {
+    const hasRow = raw.prepare("SELECT 1 AS present FROM scan_meta LIMIT 1").get();
+    return hasRow ? { kind: "absent" } : { kind: "no-meta" };
+  }
+  const row = raw.prepare("SELECT schema_fingerprint AS fp FROM scan_meta LIMIT 1").get();
+  if (!row) return { kind: "no-meta" };
+  const fp = row.fp;
+  if (typeof fp !== "string" || fp.length === 0) return { kind: "absent" };
+  return { kind: "value", fingerprint: fp };
+}
+function columnExists(db, table, column) {
+  const rows = db.prepare(`PRAGMA table_info(${table})`).all();
+  return rows.some((r) => r.name === column);
+}
+function classifyFingerprint(dbPath) {
+  const stored = readStoredFingerprint(dbPath);
+  if (stored.kind === "no-meta") return { kind: "no-meta" };
+  if (stored.kind === "absent") return { kind: "drift" };
+  return stored.fingerprint === schemaFingerprint() ? { kind: "ok" } : { kind: "drift" };
+}
+
 // kernel/adapters/sqlite/tags.ts
 async function replaceAllScanTags(trx, records, livePaths = /* @__PURE__ */ new Set()) {
   if (livePaths.size > 0) {
@@ -8124,11 +8183,30 @@ function metaToRow(result) {
     scannedByName: result.scannedBy?.name ?? "skill-map",
     scannedByVersion: result.scannedBy?.version ?? "unknown",
     scannedBySpecVersion: result.scannedBy?.specVersion ?? "unknown",
+    // Schema-drift fingerprint: sha256 over the bundled migration DDL.
+    // Sibling of `scannedByVersion`, the second drift axis the next
+    // write-side open compares (see spec/db-schema.md §Schema drift
+    // (pre-1.0)). Internal DB metadata, never on the ScanResult wire.
+    schemaFingerprint: schemaFingerprint(),
     providersJson: JSON.stringify(result.providers),
     statsFilesWalked: result.stats.filesWalked,
     statsFilesSkipped: result.stats.filesSkipped,
     statsDurationMs: result.stats.durationMs,
-    ...projectNodeLimitColumns(result)
+    // Resolved encoder that produced the token counts (see
+    // project-config.schema.json §tokenizer). NULL on synthetic results
+    // that bypass the orchestrator / skip tokenization; a real scan always
+    // carries it. The next incremental scan reads this back to detect an
+    // encoder switch and force a token recompute.
+    tokenizer: result.tokenizer ?? null,
+    ...projectNodeLimitColumns(result),
+    ...projectOversizedColumns(result)
+  };
+}
+function projectOversizedColumns(result) {
+  const oversized = result.oversizedFiles ?? [];
+  return {
+    filesOversized: result.stats.filesOversized ?? oversized.length,
+    oversizedFilesJson: oversized.length > 0 ? JSON.stringify(oversized) : null
   };
 }
 function projectNodeLimitColumns(result) {
@@ -8254,7 +8332,7 @@ var SqliteStorageAdapter = class {
     if (this.#options.autoMigrate !== false) {
       const files = discoverMigrations();
       if (files.length > 0) {
-        const raw = new DatabaseSync3(path);
+        const raw = new DatabaseSync4(path);
         try {
           raw.exec("PRAGMA foreign_keys = ON");
           applyMigrations(
@@ -8641,7 +8719,7 @@ async function listFavoritePaths(db) {
   return new Set(rows.map((r) => r.nodePath));
 }
 function withRawDb(path, fn) {
-  const raw = new DatabaseSync3(path);
+  const raw = new DatabaseSync4(path);
   try {
     return fn(raw);
   } finally {
@@ -8720,7 +8798,14 @@ var DB_VERSION_TEXTS = {
   dbVersionMajorMismatch: "{{glyph}}  This DB was written by skill-map {{dbVersion}}; the CLI you are running ({{currentVersion}}) is on a different major series.\n   {{hint}}\n",
   dbVersionMajorMismatchHint: "Delete the `.skill-map/` directory and re-scan, or revert to a CLI in the {{dbMajor}}.x series.",
   dbVersionOlder: "{{glyph}}  This DB was last written by an older skill-map ({{dbVersion}}, you have {{currentVersion}}).\n   {{hint}}\n",
-  dbVersionOlderHint: "Behaviour may differ until the next `sm scan` rewrites the metadata; downstream parse errors are likely a symptom of this skew."
+  dbVersionOlderHint: "Behaviour may differ until the next `sm scan` rewrites the metadata; downstream parse errors are likely a symptom of this skew.",
+  // Schema-fingerprint drift on a same-version DB (pre-1.0 greenfield:
+  // a column was added inline to a migration with no version bump, so
+  // the version axis reads as compatible but the on-disk schema is
+  // older). WARN, `⚠` yellow, the read continues but a query may hit a
+  // missing column. Has no `dbVersion` placeholder, the version matched.
+  dbSchemaDrift: "{{glyph}}  This DB predates a schema change in skill-map {{currentVersion}} (same version, older columns).\n   {{hint}}\n",
+  dbSchemaDriftHint: "Run `sm scan` to rebuild the local cache (your .sm sidecars are untouched), or `sm db reset`; some columns may be missing until then."
   // The defensive wrapper for `parseConfidence` / `parseLinkKind` /
   // `parseSeverity` failures during `loadScanResult` (when the meta
   // row was wiped and the version check returned `no-meta`) lives in
@@ -8735,10 +8820,17 @@ var DB_VERSION_TEXTS = {
 // core/sqlite/db-version-runner.ts
 var WARN_SEEN = /* @__PURE__ */ new Set();
 async function runDbVersionCheck(db, opts) {
-  const outcome = await detectDbVersionSkew(db, opts.currentVersion);
+  const versionOutcome = await detectDbVersionSkew(db, opts.currentVersion);
+  const outcome = layerFingerprintOutcome(versionOutcome, opts);
   applyDbVersionOutcome(outcome, opts);
   return outcome;
 }
+function layerFingerprintOutcome(versionOutcome, opts) {
+  if (versionOutcome.kind !== "ok") return versionOutcome;
+  const fp = classifyFingerprint(opts.dbPath);
+  if (fp.kind === "drift") return { kind: "warn-schema", currentVersion: opts.currentVersion };
+  return versionOutcome;
+}
 function applyDbVersionOutcome(outcome, opts) {
   switch (outcome.kind) {
     case "ok":
@@ -8751,6 +8843,9 @@ function applyDbVersionOutcome(outcome, opts) {
     case "warn-older":
       renderWarnOlder(outcome, opts);
       break;
+    case "warn-schema":
+      renderWarnSchema(outcome, opts);
+      break;
   }
 }
 function renderErrorNewer(outcome, opts) {
@@ -8804,6 +8899,21 @@ function renderWarnOlder(outcome, opts) {
     })
   );
 }
+function renderWarnSchema(outcome, opts) {
+  const seen = opts.warnSeen ?? WARN_SEEN;
+  if (seen.has(opts.dbPath)) return;
+  seen.add(opts.dbPath);
+  if (!opts.printer) return;
+  const warnGlyph = opts.style?.warnGlyph ?? "\u26A0";
+  const dim = opts.style?.dim ?? ((s) => s);
+  opts.printer.warn(
+    tx(DB_VERSION_TEXTS.dbSchemaDrift, {
+      glyph: warnGlyph,
+      currentVersion: outcome.currentVersion,
+      hint: dim(DB_VERSION_TEXTS.dbSchemaDriftHint)
+    })
+  );
+}
 
 // core/sqlite/with-sqlite.ts
 async function withSqlite(options, fn) {
@@ -8823,7 +8933,7 @@ async function withSqlite(options, fn) {
   }
 }
 async function tryWithSqlite(options, fn) {
-  if (options.databasePath !== ":memory:" && !existsSync10(options.databasePath)) {
+  if (options.databasePath !== ":memory:" && !existsSync11(options.databasePath)) {
     return null;
   }
   return withSqlite(options, fn);
@@ -9424,6 +9534,19 @@ var CHECK_TEXTS = {
   unknownAnalyzerIds: "sm check: unknown analyzer id(s) in --analyzers: {{unknown}}.\nValid ids (qualified or short form accepted):\n{{known}}\n"
 };
 
+// cli/util/db-version-check.ts
+function buildReadVersionCheck(printer, stderrAnsi) {
+  return {
+    currentVersion: VERSION,
+    printer,
+    style: {
+      warnGlyph: stderrAnsi.yellow("\u26A0"),
+      errorGlyph: stderrAnsi.red("\u2715"),
+      dim: stderrAnsi.dim
+    }
+  };
+}
+
 // cli/util/conformance-env.ts
 var ENV_DISABLE_PROVIDERS = "SKILL_MAP_DISABLE_ALL_PROVIDERS";
 var ENV_DISABLE_EXTRACTORS = "SKILL_MAP_DISABLE_ALL_EXTRACTORS";
@@ -9452,6 +9575,7 @@ var PLUGIN_LOADER_TEXTS = {
   invalidManifestDirMismatch: "directory name '{{dirName}}' does not match manifest id '{{manifestId}}'. Rename the directory to match the id, or update the manifest id to match the directory.",
   idCollision: "Plugin '{{id}}' at {{pathA}} collides with the plugin at {{pathB}}. Rename one and rerun.",
   loadErrorPluginIdMismatch: "{{relEntry}}: extension declares pluginId '{{declared}}' but its plugin.json declares id '{{manifestId}}'. Remove the explicit pluginId from the extension; the loader injects it from plugin.json#/id.",
+  invalidManifestRedeclaredField: "{{relEntry}}: extension manifest declares {{fields}}, derived from the folder layout (structure-as-truth) and not a manifest field. Remove it: id is the leaf folder, kind the parent folder, provider kinds the `kinds/` catalog, formatter formatId the formatter folder name.",
   loadErrorStorageSchemaRead: "plugin '{{pluginId}}' failed to load schema for table '{{table}}': {{schemaPath}}: {{errDescription}}",
   loadErrorStorageSchemaCompile: "plugin '{{pluginId}}' failed to compile schema for table '{{table}}': {{schemaPath}}: {{errDescription}}",
   loadErrorStorageKvSchemaRead: "plugin '{{pluginId}}' failed to load KV schema: {{schemaPath}}: {{errDescription}}",
@@ -9467,7 +9591,7 @@ var PLUGIN_LOADER_TEXTS = {
 
 // kernel/adapters/plugin-loader/index.ts
 import { createRequire as createRequire5 } from "module";
-import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
 import { join as join8, resolve as resolve17 } from "path";
 import { pathToFileURL } from "url";
 import semver from "semver";
@@ -9556,7 +9680,7 @@ function extractDefault(mod) {
   if (!isRecord(mod)) return mod;
   return "default" in mod ? mod["default"] : mod;
 }
-var LOADER_INJECTED_KEYS = /* @__PURE__ */ new Set(["pluginId", "id", "kind", "kinds", "formatId"]);
+var LOADER_INJECTED_KEYS = /* @__PURE__ */ new Set(["pluginId"]);
 function stripFunctionsAndPluginId(input) {
   if (!isRecord(input)) return input;
   const out = {};
@@ -9570,7 +9694,7 @@ function stripFunctionsAndPluginId(input) {
 
 // kernel/adapters/plugin-loader/validation.ts
 import * as nodeFs from "fs";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { dirname as dirname9, join as join7 } from "path";
 import { Ajv2020 as Ajv20205 } from "ajv/dist/2020.js";
 
@@ -9696,7 +9820,7 @@ function validateActionFileConventions(pluginPath, pluginId, manifest, relEntry,
   const reportSchemaPath = join7(actionDir, "report.schema.json");
   const promptPath = join7(actionDir, "prompt.md");
   const mode = isRecord(manifestView) && typeof manifestView["mode"] === "string" ? manifestView["mode"] : "deterministic";
-  if (!existsSync11(reportSchemaPath)) {
+  if (!existsSync12(reportSchemaPath)) {
     return {
       ...fail(
         pluginPath,
@@ -9707,7 +9831,7 @@ function validateActionFileConventions(pluginPath, pluginId, manifest, relEntry,
       manifest
     };
   }
-  const promptExists = existsSync11(promptPath);
+  const promptExists = existsSync12(promptPath);
   if (mode === "probabilistic" && !promptExists) {
     return {
       ...fail(
@@ -9819,7 +9943,7 @@ function isDirectorySafe(path, statSync12) {
 }
 
 // kernel/adapters/plugin-loader/storage-schemas.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { resolve as resolve16 } from "path";
 import { Ajv2020 as Ajv20206 } from "ajv/dist/2020.js";
 
@@ -9887,7 +10011,7 @@ function compilePluginSchema(pluginPath, relPath) {
   const abs = resolve16(pluginPath, relPath);
   let raw;
   try {
-    raw = JSON.parse(readFileSync11(abs, "utf8"));
+    raw = JSON.parse(readFileSync12(abs, "utf8"));
   } catch (err) {
     return { ok: false, phase: "read", errDescription: describe(err) };
   }
@@ -9921,11 +10045,11 @@ var PluginLoader = class {
   discoverPaths() {
     const out = [];
     for (const root of this.#options.searchPaths) {
-      if (!existsSync12(root)) continue;
+      if (!existsSync13(root)) continue;
       for (const entry of readdirSync4(root, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         const candidate = join8(root, entry.name);
-        if (existsSync12(join8(candidate, "plugin.json"))) {
+        if (existsSync13(join8(candidate, "plugin.json"))) {
           out.push(resolve17(candidate));
         }
       }
@@ -10009,7 +10133,7 @@ var PluginLoader = class {
     const manifestPath = join8(pluginPath, "plugin.json");
     let raw;
     try {
-      raw = JSON.parse(readFileSync12(manifestPath, "utf8"));
+      raw = JSON.parse(readFileSync13(manifestPath, "utf8"));
     } catch (err) {
       return { ok: false, failure: fail(
         pluginPath,
@@ -10086,7 +10210,7 @@ var PluginLoader = class {
       } };
     }
     const abs = resolve17(pluginPath, relEntry);
-    if (!existsSync12(abs)) {
+    if (!existsSync13(abs)) {
       return { ok: false, failure: {
         ...fail(
           pluginPath,
@@ -10177,6 +10301,21 @@ var PluginLoader = class {
         manifest
       } };
     }
+    const redeclared = DERIVED_MANIFEST_KEYS.filter((field) => field in exported);
+    if (redeclared.length > 0) {
+      return { ok: false, failure: {
+        ...fail(
+          pluginPath,
+          pluginId,
+          "invalid-manifest",
+          tx(PLUGIN_LOADER_TEXTS.invalidManifestRedeclaredField, {
+            relEntry,
+            fields: redeclared.map((field) => `\`${field}\``).join(", ")
+          })
+        ),
+        manifest
+      } };
+    }
     const manifestView = stripFunctionsAndPluginId(exported);
     if (kind === "hook") {
       const hookFailure = validateHookTriggers(pluginPath, pluginId, manifest, relEntry, exported, manifestView);
@@ -10233,8 +10372,7 @@ var PluginLoader = class {
     const instance = { ...exported, pluginId, id: pathId2, kind };
     if (kind === "formatter") instance["formatId"] = pathId2;
     if (kind === "provider" && discoveredKinds) {
-      const inlineKinds = isRecord(exported["kinds"]) ? exported["kinds"] : {};
-      instance["kinds"] = { ...inlineKinds, ...discoveredKinds };
+      instance["kinds"] = discoveredKinds;
     }
     return { ok: true, extension: {
       kind,
@@ -10247,6 +10385,7 @@ var PluginLoader = class {
     } };
   }
 };
+var DERIVED_MANIFEST_KEYS = ["id", "kind", "kinds", "formatId"];
 var KIND_DIR_NAMES = [
   "providers",
   "extractors",
@@ -10269,7 +10408,7 @@ function discoverExtensionEntries(pluginPath) {
 }
 function collectKindEntries(pluginPath, kindDir, out) {
   const kindAbs = resolve17(pluginPath, kindDir);
-  if (!existsSync12(kindAbs)) return;
+  if (!existsSync13(kindAbs)) return;
   let entries;
   try {
     entries = readdirSync4(kindAbs);
@@ -10296,7 +10435,7 @@ function isDirectorySafe2(path) {
 }
 function findIndexCandidate(entryAbs) {
   for (const candidate of INDEX_CANDIDATES) {
-    if (existsSync12(resolve17(entryAbs, candidate))) return candidate;
+    if (existsSync13(resolve17(entryAbs, candidate))) return candidate;
   }
   return null;
 }
@@ -10304,7 +10443,7 @@ function installedSpecVersion() {
   const require2 = createRequire5(import.meta.url);
   const indexPath = require2.resolve("@skill-map/spec/index.json");
   const pkgPath = resolve17(indexPath, "..", "package.json");
-  const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
   return pkg.version;
 }
 
@@ -10365,11 +10504,11 @@ function makeEnabledResolver(cfg, dbOverrides) {
 function defaultResolveEnabled(_id) {
   return true;
 }
-function isBuiltInExtensionEnabled(bundle, ext, resolveEnabled) {
-  return isBundleEntryEnabled(bundle, ext.id, resolveEnabled);
+function isBuiltInExtensionEnabled(plugin, ext, resolveEnabled) {
+  return isPluginEntryEnabled(plugin, ext.id, resolveEnabled);
 }
-function isBundleEntryEnabled(bundle, extId, resolveEnabled) {
-  return resolveEnabled(qualifiedExtensionId(bundle.id, extId));
+function isPluginEntryEnabled(plugin, extId, resolveEnabled) {
+  return resolveEnabled(qualifiedExtensionId(plugin.id, extId));
 }
 function isPluginExtensionEnabled(ext, resolveEnabled) {
   return resolveEnabled(qualifiedExtensionId(ext.pluginId, ext.id));
@@ -10392,7 +10531,7 @@ import { readFile, readdir, lstat } from "fs/promises";
 import { join as join9, relative as relative2, sep as sep3 } from "path";
 
 // kernel/scan/ignore.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
 import { dirname as dirname10, resolve as resolve18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import ignoreFactory from "ignore";
@@ -10423,9 +10562,9 @@ function loadBundledIgnoreText() {
 }
 function readIgnoreFileText(scopeRoot) {
   const path = resolve18(scopeRoot, ".skillmapignore");
-  if (!existsSync13(path)) return void 0;
+  if (!existsSync14(path)) return void 0;
   try {
-    return readFileSync13(path, "utf8");
+    return readFileSync14(path, "utf8");
   } catch {
     return void 0;
   }
@@ -10458,9 +10597,9 @@ function readDefaultsFromDisk() {
     resolve18(here, "config/defaults/skillmapignore")
   ];
   for (const candidate of candidates) {
-    if (existsSync13(candidate)) {
+    if (existsSync14(candidate)) {
       try {
-        return readFileSync13(candidate, "utf8");
+        return readFileSync14(candidate, "utf8");
       } catch {
       }
     }
@@ -10568,8 +10707,9 @@ async function* walkContent(roots, options) {
   if (!parser) throw new UnknownParserError(options.parser);
   const filter = options.ignoreFilter ?? buildIgnoreFilter();
   const extensions = options.extensions;
+  const sizeLimit = buildSizeLimit(options);
   for (const root of roots) {
-    for await (const file of walkRoot(root, root, filter, extensions)) {
+    for await (const file of walkRoot(root, root, filter, extensions, sizeLimit)) {
       const relPath = relative2(root, file).split(sep3).join("/");
       let raw;
       try {
@@ -10592,7 +10732,15 @@ async function* walkContent(roots, options) {
     }
   }
 }
-async function* walkRoot(root, current, filter, extensions) {
+function buildSizeLimit(options) {
+  const sizeLimit = {};
+  if (options.maxFileSizeBytes !== void 0) {
+    sizeLimit.maxFileSizeBytes = options.maxFileSizeBytes;
+  }
+  if (options.onOversizedFile) sizeLimit.onOversizedFile = options.onOversizedFile;
+  return sizeLimit;
+}
+async function* walkRoot(root, current, filter, extensions, sizeLimit) {
   let entries;
   try {
     entries = await readdir(current, { withFileTypes: true, encoding: "utf8" });
@@ -10606,11 +10754,16 @@ async function* walkRoot(root, current, filter, extensions) {
     if (filter.ignores(rel)) continue;
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
-      yield* walkRoot(root, full, filter, extensions);
+      yield* walkRoot(root, full, filter, extensions, sizeLimit);
     } else if (entry.isFile() && hasMatchingExtension(name, extensions)) {
       try {
         const s = await lstat(full);
-        if (s.isFile()) yield full;
+        if (!s.isFile()) continue;
+        if (sizeLimit.maxFileSizeBytes !== void 0 && s.size > sizeLimit.maxFileSizeBytes) {
+          sizeLimit.onOversizedFile?.({ path: rel, bytes: s.size });
+          continue;
+        }
+        yield full;
       } catch {
       }
     }
@@ -10640,6 +10793,10 @@ function resolveProviderWalk(provider) {
       parser: read.parser
     };
     if (options?.ignoreFilter) walkOptions.ignoreFilter = options.ignoreFilter;
+    if (options?.maxFileSizeBytes !== void 0) {
+      walkOptions.maxFileSizeBytes = options.maxFileSizeBytes;
+    }
+    if (options?.onOversizedFile) walkOptions.onOversizedFile = options.onOversizedFile;
     return walkContent(roots, walkOptions);
   };
 }
@@ -10674,19 +10831,19 @@ function collectViewContributions(pluginId, extensionId, instance, out, options
 }
 
 // core/runtime/plugin-runtime/bucketing.ts
-function bucketLoaded(loaded, bundle) {
+function bucketLoaded(loaded, runtime) {
   for (const ext of loaded) {
     const instance = ext.instance;
     if (!isExtensionInstance(instance)) continue;
     bucketByKind(ext.kind, instance, {
-      provider: bundle.extensions.providers,
-      extractor: bundle.extensions.extractors,
-      analyzer: bundle.extensions.analyzers,
-      formatter: bundle.extensions.formatters,
-      hook: bundle.extensions.hooks
+      provider: runtime.extensions.providers,
+      extractor: runtime.extensions.extractors,
+      analyzer: runtime.extensions.analyzers,
+      formatter: runtime.extensions.formatters,
+      hook: runtime.extensions.hooks
       // `action` intentionally absent, see docstring.
     });
-    bundle.manifests.push({
+    runtime.manifests.push({
       id: ext.id,
       pluginId: ext.pluginId,
       kind: ext.kind,
@@ -10694,8 +10851,8 @@ function bucketLoaded(loaded, bundle) {
       description: instance.description ?? "",
       ...ext.entryPath ? { entry: ext.entryPath } : {}
     });
-    collectAnnotationContributions(ext.pluginId, instance, bundle.annotationContributions);
-    collectViewContributions(ext.pluginId, ext.id, instance, bundle.viewContributions);
+    collectAnnotationContributions(ext.pluginId, instance, runtime.annotationContributions);
+    collectViewContributions(ext.pluginId, ext.id, instance, runtime.viewContributions);
   }
 }
 function collectAnnotationContributions(pluginId, instance, out) {
@@ -10753,8 +10910,8 @@ var PLUGIN_RUNTIME_TEXTS = {
 // core/runtime/plugin-runtime/warnings.ts
 var PLUGIN_ID_DISPLAY_CAP = 200;
 var PLUGIN_REASON_DISPLAY_CAP = 1e3;
-function emitWarnings(bundle, printer) {
-  for (const warn of bundle.warnings) {
+function emitWarnings(runtime, printer) {
+  for (const warn of runtime.warnings) {
     printer.warn(`${warn}
 `);
   }
@@ -10793,7 +10950,7 @@ async function loadPluginRuntime(opts = {}) {
   if (resolveEnabled) loaderOpts.resolveEnabled = resolveEnabled;
   const loader = createPluginLoader(loaderOpts);
   const discovered = await loader.discoverAndLoadAll();
-  const bundle = {
+  const runtime = {
     extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [] },
     annotationContributions: [],
     viewContributions: [],
@@ -10807,14 +10964,14 @@ async function loadPluginRuntime(opts = {}) {
   };
   for (const plugin of discovered) {
     if (plugin.status === "enabled") {
-      bucketLoaded(plugin.extensions ?? [], bundle);
+      bucketLoaded(plugin.extensions ?? [], runtime);
       continue;
     }
     if (plugin.status === "disabled") continue;
-    bundle.warnings.push(formatWarning(plugin));
+    runtime.warnings.push(formatWarning(plugin));
   }
-  enforceRootExclusivity(bundle.annotationContributions);
-  return bundle;
+  enforceRootExclusivity(runtime.annotationContributions);
+  return runtime;
 }
 var AnnotationContributionConflictError = class extends Error {
   /** The colliding root-exclusive key. */
@@ -10848,7 +11005,7 @@ function enforceRootExclusivity(catalog) {
   }
 }
 function emptyPluginRuntime() {
-  const bundle = {
+  const runtime = {
     extensions: { providers: [], extractors: [], analyzers: [], formatters: [], hooks: [] },
     annotationContributions: [],
     viewContributions: [],
@@ -10860,7 +11017,7 @@ function emptyPluginRuntime() {
       emitWarnings(this, printer);
     }
   };
-  return bundle;
+  return runtime;
 }
 
 // core/runtime/plugin-runtime/catalogs.ts
@@ -10878,12 +11035,12 @@ function collectRegisteredContributionKeys(composed) {
   return keys;
 }
 function filterBuiltInManifests(manifests, resolveEnabled) {
-  const bundleByPluginId = /* @__PURE__ */ new Map();
-  for (const bundle of builtInBundles) bundleByPluginId.set(bundle.id, bundle);
+  const pluginById = /* @__PURE__ */ new Map();
+  for (const plugin of builtInPlugins) pluginById.set(plugin.id, plugin);
   return manifests.filter((m) => {
-    const bundle = bundleByPluginId.get(m.pluginId);
-    if (!bundle) return true;
-    return isBundleEntryEnabled(bundle, m.id, resolveEnabled);
+    const plugin = pluginById.get(m.pluginId);
+    if (!plugin) return true;
+    return isPluginEntryEnabled(plugin, m.id, resolveEnabled);
   });
 }
 
@@ -10926,9 +11083,9 @@ function composeScanExtensions(opts) {
   };
 }
 function accumulateBuiltInScanExtensions(buckets, resolveEnabled) {
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
-      if (!isBuiltInExtensionEnabled(bundle, ext, resolveEnabled)) continue;
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
+      if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
       switch (ext.kind) {
         case "provider":
           buckets.providers.push(ext);
@@ -10959,10 +11116,10 @@ function composeFormatters(opts) {
   const resolveEnabled = opts.resolveEnabled ?? opts.pluginRuntime.resolveEnabled;
   const out = [];
   if (!noBuiltIns) {
-    for (const bundle of builtInBundles) {
-      for (const ext of bundle.extensions) {
+    for (const plugin of builtInPlugins) {
+      for (const ext of plugin.extensions) {
         if (ext.kind !== "formatter") continue;
-        if (!isBuiltInExtensionEnabled(bundle, ext, resolveEnabled)) continue;
+        if (!isBuiltInExtensionEnabled(plugin, ext, resolveEnabled)) continue;
         out.push(ext);
       }
     }
@@ -10998,9 +11155,9 @@ function registerEnabledExtensions(kernel, pluginRuntime, options = {}) {
     );
     const merged = [...userContribs];
     if (!noBuiltIns) {
-      for (const bundle of builtInBundles) {
-        for (const ext of bundle.extensions) {
-          if (!isBundleEntryEnabled(bundle, ext.id, resolveEnabled)) continue;
+      for (const plugin of builtInPlugins) {
+        for (const ext of plugin.extensions) {
+          if (!isPluginEntryEnabled(plugin, ext.id, resolveEnabled)) continue;
           collectViewContributions(ext.pluginId, ext.id, ext, merged);
         }
       }
@@ -11060,27 +11217,35 @@ var CheckCommand = class extends SmCommand {
     const analyzerFilter = parseAnalyzersFlag(this.analyzers);
     const preflight = await this.#preflightAnalyzerCatalog(analyzerFilter);
     if (preflight.exit !== null) return preflight.exit;
-    return withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
-      let issues = await adapter.issues.listAll();
-      if (this.node !== void 0) {
-        const nodePath = this.node;
-        issues = issues.filter((i) => i.nodeIds.includes(nodePath));
-      }
-      if (analyzerFilter !== void 0) {
-        issues = issues.filter((i) => matchesAnalyzerFilter(i.analyzerId, analyzerFilter));
-      }
-      const ansi = this.ansiFor("stdout");
-      if (this.json) {
-        this.printer.data(JSON.stringify(issues) + "\n");
-      } else if (issues.length === 0) {
-        this.printer.data(
-          tx(CHECK_TEXTS.noIssues, { glyph: ansi.green("\u2713") })
-        );
-      } else {
-        this.printer.data(renderHuman(issues, ansi));
+    const stderrAnsi = this.ansiFor("stderr");
+    return withSqlite(
+      {
+        databasePath: dbPath,
+        autoBackup: false,
+        versionCheck: buildReadVersionCheck(this.printer, stderrAnsi)
+      },
+      async (adapter) => {
+        let issues = await adapter.issues.listAll();
+        if (this.node !== void 0) {
+          const nodePath = this.node;
+          issues = issues.filter((i) => i.nodeIds.includes(nodePath));
+        }
+        if (analyzerFilter !== void 0) {
+          issues = issues.filter((i) => matchesAnalyzerFilter(i.analyzerId, analyzerFilter));
+        }
+        const ansi = this.ansiFor("stdout");
+        if (this.json) {
+          this.printer.data(JSON.stringify(issues) + "\n");
+        } else if (issues.length === 0) {
+          this.printer.data(
+            tx(CHECK_TEXTS.noIssues, { glyph: ansi.green("\u2713") })
+          );
+        } else {
+          this.printer.data(renderHuman(issues, ansi));
+        }
+        return issues.some((i) => i.severity === "error") ? ExitCode.Issues : ExitCode.Ok;
       }
-      return issues.some((i) => i.severity === "error") ? ExitCode.Issues : ExitCode.Ok;
-    });
+    );
   }
   /**
    * Either an explicit `--analyzers` list or `--include-prob` forces a
@@ -11249,11 +11414,11 @@ function trimRedundantPath(message, primary) {
 }
 
 // cli/commands/config.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { Command as Command4, Option as Option4 } from "clipanion";
 
 // core/config/active-provider.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { join as join10 } from "path";
 function resolveActiveProvider(cwd, providers = []) {
   const detected = detectProvidersFromFilesystem(cwd, providers);
@@ -11273,7 +11438,7 @@ function detectProvidersFromFilesystem(cwd, providers) {
     if (seen.has(provider.id)) continue;
     const markers = provider.detect?.markers;
     if (!markers || markers.length === 0) continue;
-    if (!markers.some((marker) => existsSync14(join10(cwd, marker)))) continue;
+    if (!markers.some((marker) => existsSync15(join10(cwd, marker)))) continue;
     seen.add(provider.id);
     out.push(provider.id);
   }
@@ -11290,7 +11455,7 @@ function relativeIfBelow(path, cwd) {
 }
 
 // cli/util/scan-zone-drop.ts
-import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
+import { DatabaseSync as DatabaseSync5 } from "node:sqlite";
 
 // cli/commands/db/shared.ts
 var SAFE_SQL_IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
@@ -11302,7 +11467,7 @@ function assertSafeIdentifier(name) {
 
 // cli/util/scan-zone-drop.ts
 function dropScanZone(dbPath) {
-  const db = new DatabaseSync4(dbPath);
+  const db = new DatabaseSync5(dbPath);
   try {
     const rows = db.prepare(
       "SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'scan\\_%' ESCAPE '\\'"
@@ -11408,7 +11573,6 @@ var CONFIG_TEXTS = {
   listSectionScan: "Scan",
   listSectionJobs: "Jobs",
   listSectionRootsAndPlugins: "Roots & plugins",
-  listSectionHistory: "History",
   listSectionOther: "Other"
 };
 
@@ -11525,15 +11689,14 @@ var ConfigListCommand = class extends SmCommand {
 var SECTION_DEFS = [
   {
     title: CONFIG_TEXTS.listSectionGeneral,
-    exactKeys: ["autoMigrate", "schemaVersion", "tokenizer", "i18n.locale"]
+    exactKeys: ["schemaVersion", "tokenizer"]
   },
   { title: CONFIG_TEXTS.listSectionScan, prefix: "scan.", stripPrefix: true },
   { title: CONFIG_TEXTS.listSectionJobs, prefix: "jobs.", stripPrefix: true },
   {
     title: CONFIG_TEXTS.listSectionRootsAndPlugins,
-    exactKeys: ["roots", "providers", "plugins", "ignore"]
-  },
-  { title: CONFIG_TEXTS.listSectionHistory, prefix: "history.", stripPrefix: true }
+    exactKeys: ["roots", "plugins", "ignore"]
+  }
 ];
 function renderConfigSections(rows, ansi) {
   const out = [];
@@ -11895,7 +12058,7 @@ var ConfigSetCommand = class extends SmCommand {
   announceLensSwitch(cwd, ansi) {
     const dbPath = resolveDbPath({ db: void 0, cwd });
     const okGlyph = ansi.green("\u2713");
-    if (!existsSync15(dbPath)) {
+    if (!existsSync16(dbPath)) {
       this.printer.info(tx(CONFIG_TEXTS.lensSwitchedNoDb, { glyph: okGlyph }));
       return;
     }
@@ -11935,7 +12098,7 @@ var ConfigResetCommand = class extends SmCommand {
     const path = targetSettingsPath2(target, ctx.cwd);
     const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
-    if (!existsSync15(path)) {
+    if (!existsSync16(path)) {
       this.printer.data(
         tx(CONFIG_TEXTS.unsetNoOverride, {
           glyph: okGlyph,
@@ -12010,14 +12173,14 @@ var CONFIG_COMMANDS = [
 ];
 
 // cli/commands/conformance.ts
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
 import { dirname as dirname12, resolve as resolve22 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command as Command5, Option as Option5 } from "clipanion";
 
 // conformance/index.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync16, mkdtempSync, readdirSync as readdirSync5, readFileSync as readFileSync14, rmSync, statSync as statSync3 } from "fs";
+import { cpSync, existsSync as existsSync17, mkdtempSync, readdirSync as readdirSync5, readFileSync as readFileSync15, rmSync, statSync as statSync3 } from "fs";
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute5, join as join11, relative as relative3, resolve as resolve20 } from "path";
 
@@ -12099,7 +12262,7 @@ function pickSafeEnv(source) {
   return out;
 }
 function runConformanceCase(options) {
-  const raw = readFileSync14(options.casePath, "utf8");
+  const raw = readFileSync15(options.casePath, "utf8");
   const c = JSON.parse(raw);
   const fixturesRoot = options.fixturesRoot ?? join11(options.specRoot, "conformance", "fixtures");
   const safeId = c.id.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 32);
@@ -12214,7 +12377,7 @@ function evaluateAssertion(a, ctx) {
         return { ok: false, type: a.type, reason: formatErrorMessage(err) };
       }
       const abs = resolve20(ctx.scope, a.path);
-      return existsSync16(abs) ? { ok: true, type: a.type } : {
+      return existsSync17(abs) ? { ok: true, type: a.type } : {
         ok: false,
         type: a.type,
         reason: tx(CONFORMANCE_RUNNER_TEXTS.fileNotFound, { path: a.path })
@@ -12229,15 +12392,15 @@ function evaluateAssertion(a, ctx) {
       }
       const fixturePath = join11(ctx.fixturesRoot, a.fixture);
       const targetPath = resolve20(ctx.scope, a.path);
-      if (!existsSync16(targetPath)) {
+      if (!existsSync17(targetPath)) {
         return {
           ok: false,
           type: a.type,
           reason: tx(CONFORMANCE_RUNNER_TEXTS.targetNotFound, { path: a.path })
         };
       }
-      const needle = readFileSync14(fixturePath);
-      const haystack = readFileSync14(targetPath);
+      const needle = readFileSync15(fixturePath);
+      const haystack = readFileSync15(targetPath);
       return haystack.includes(needle) ? { ok: true, type: a.type } : {
         ok: false,
         type: a.type,
@@ -12410,7 +12573,7 @@ var CONFORMANCE_TEXTS = {
 };
 
 // cli/util/conformance-scopes.ts
-import { existsSync as existsSync17, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { dirname as dirname11, resolve as resolve21 } from "path";
 import { createRequire as createRequire6 } from "module";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -12430,7 +12593,7 @@ function resolveCliWorkspaceRoot() {
   let cursor = here;
   for (let depth = 0; depth < 6; depth += 1) {
     const candidate = resolve21(cursor, "plugins");
-    if (existsSync17(candidate) && statSync4(candidate).isDirectory()) {
+    if (existsSync18(candidate) && statSync4(candidate).isDirectory()) {
       return cursor;
     }
     const parent = dirname11(cursor);
@@ -12450,32 +12613,32 @@ function collectProviderScopes(specRoot) {
     return out;
   }
   const pluginsRoot = resolve21(workspaceRoot, "plugins");
-  if (!existsSync17(pluginsRoot)) return out;
-  for (const bundleEntry of readdirSync6(pluginsRoot)) {
-    const bundleDir = resolve21(pluginsRoot, bundleEntry);
-    if (!isDir(bundleDir)) continue;
-    const providersRoot = resolve21(bundleDir, "providers");
+  if (!existsSync18(pluginsRoot)) return out;
+  for (const pluginEntry of readdirSync6(pluginsRoot)) {
+    const pluginDir = resolve21(pluginsRoot, pluginEntry);
+    if (!isDir(pluginDir)) continue;
+    const providersRoot = resolve21(pluginDir, "providers");
     if (!isDir(providersRoot)) continue;
-    collectBundleProviderScopes(providersRoot, specRoot, out);
+    collectPluginProviderScopes(providersRoot, specRoot, out);
   }
   return out;
 }
 function isDir(path) {
   try {
-    return existsSync17(path) && statSync4(path).isDirectory();
+    return existsSync18(path) && statSync4(path).isDirectory();
   } catch {
     return false;
   }
 }
-function collectBundleProviderScopes(providersRoot, specRoot, out) {
+function collectPluginProviderScopes(providersRoot, specRoot, out) {
   for (const entry of readdirSync6(providersRoot)) {
     const providerDir = resolve21(providersRoot, entry);
     if (!isDir(providerDir)) continue;
     const conformanceDir = resolve21(providerDir, "conformance");
-    if (!existsSync17(conformanceDir)) continue;
+    if (!existsSync18(conformanceDir)) continue;
     const casesDir = resolve21(conformanceDir, "cases");
     const fixturesDir = resolve21(conformanceDir, "fixtures");
-    if (!existsSync17(casesDir) || !existsSync17(fixturesDir)) continue;
+    if (!existsSync18(casesDir) || !existsSync18(fixturesDir)) continue;
     out.push({
       id: `provider:${entry}`,
       kind: "provider",
@@ -12513,7 +12676,7 @@ function selectConformanceScopes(scope) {
   return [match];
 }
 function listCaseFiles(scope) {
-  if (!existsSync17(scope.casesDir)) return [];
+  if (!existsSync18(scope.casesDir)) return [];
   return readdirSync6(scope.casesDir).filter((entry) => entry.endsWith(".json")).sort().map((entry) => resolve21(scope.casesDir, entry));
 }
 
@@ -12532,7 +12695,7 @@ function resolveBinary() {
   let cursor = here;
   for (let depth = 0; depth < 6; depth += 1) {
     const candidate = resolve22(cursor, "bin", "sm.js");
-    if (existsSync18(candidate)) return candidate;
+    if (existsSync19(candidate)) return candidate;
     const parent = dirname12(cursor);
     if (parent === cursor) break;
     cursor = parent;
@@ -12598,7 +12761,7 @@ var ConformanceRunCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const binary = resolveBinary();
-    if (!existsSync18(binary)) {
+    if (!existsSync19(binary)) {
       if (this.json) {
         this.#emitJsonError(
           "internal",
@@ -12772,7 +12935,7 @@ function projectAssertionFailures(assertions) {
 }
 function readCaseId(casePath) {
   try {
-    const raw = readFileSync15(casePath, "utf8");
+    const raw = readFileSync16(casePath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.id === "string") return parsed.id;
   } catch {
@@ -13027,18 +13190,18 @@ var DbRestoreCommand = class extends SmCommand {
 };
 
 // cli/commands/db/reset.ts
-import { DatabaseSync as DatabaseSync5 } from "node:sqlite";
+import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
 import { Command as Command8, Option as Option8 } from "clipanion";
 
 // core/sqlite/db-files.ts
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { rm as rm2 } from "fs/promises";
 var DB_FILE_SUFFIXES = ["", "-wal", "-shm"];
 async function removeDbFiles(dbPath) {
   if (dbPath === ":memory:") return;
   for (const suffix of DB_FILE_SUFFIXES) {
     const p = `${dbPath}${suffix}`;
-    if (existsSync19(p)) await rm2(p);
+    if (existsSync20(p)) await rm2(p);
   }
 }
 
@@ -13124,7 +13287,7 @@ var DbResetCommand = class extends SmCommand {
         return ExitCode.Error;
       }
     }
-    const db = new DatabaseSync5(path);
+    const db = new DatabaseSync6(path);
     try {
       const rows = db.prepare(
         "SELECT name FROM sqlite_master WHERE type='table' AND (name LIKE 'scan\\_%' ESCAPE '\\'" + (this.state ? " OR name LIKE 'state\\_%' ESCAPE '\\'" : "") + ")"
@@ -13267,7 +13430,7 @@ var DbBrowserCommand = class extends SmCommand {
 };
 
 // cli/commands/db/dump.ts
-import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
+import { DatabaseSync as DatabaseSync7 } from "node:sqlite";
 import { Command as Command11, Option as Option10 } from "clipanion";
 var DbDumpCommand = class extends SmCommand {
   static paths = [["db", "dump"]];
@@ -13309,7 +13472,7 @@ var DbDumpCommand = class extends SmCommand {
   }
 };
 function dumpDatabaseToStream(dbPath, out, tables) {
-  const db = new DatabaseSync6(dbPath, { readOnly: true });
+  const db = new DatabaseSync7(dbPath, { readOnly: true });
   try {
     out.write("PRAGMA foreign_keys=OFF;\n");
     out.write("BEGIN TRANSACTION;\n");
@@ -14157,7 +14320,7 @@ var GraphCommand = class extends SmCommand {
 };
 
 // cli/commands/help.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 import { createRequire as createRequire7 } from "module";
 import { resolve as resolve26 } from "path";
 import { Command as Command15, Option as Option14 } from "clipanion";
@@ -14214,6 +14377,22 @@ var HELP_TEXTS = {
   /** Trailing fragment for `humanFlagRow`'s `{{required}}` slot. */
   humanFlagRowRequiredFragment: " (required)",
   humanFooter: "Run `sm help {{name}} --format md` for the full reference.",
+  // --- human group renderer (sm <namespace> --help, sm help <namespace>) ---
+  /**
+   * USAGE row for a command namespace (a prefix that owns subcommands but
+   * is not itself a runnable verb, e.g. `plugins`, `db`). Mirrors
+   * `humanUsageRow` but advertises the `<command>` slot instead of
+   * positionals.
+   */
+  humanGroupUsageRow: "  sm {{name}} <command> [options]",
+  /** Section heading listing the subcommands of a namespace. */
+  humanCommandsHeading: "COMMANDS",
+  /** Aligned subcommand row; `{{name}}` is the subcommand relative to the namespace. */
+  humanCommandRow: "  {{name}}{{padding}}  {{description}}",
+  /** Footer for the namespace overview, points at per-subcommand help. */
+  humanGroupFooter: "Run `sm {{name}} <command> --help` for flags and arguments.",
+  /** Fallback header description when a namespace has no curated entry in `HELP_GROUPS`. */
+  groupFallbackDescription: "{{category}} commands",
   // --- human compact overview (sm / sm --help / sm help, no verb) ---------
   /**
    * Compact-overview header. Replaces the Clipanion default ANSI banner.
@@ -14244,6 +14423,40 @@ var HELP_TEXTS = {
   compactExampleRow: "  {{command}}{{padding}}  {{description}}",
   compactFooter: "Run `sm <command> --help` for flags and arguments."
 };
+var HELP_GROUPS = {
+  plugins: {
+    description: "Discover, inspect, and toggle plugins",
+    details: "A plugin is a directory of extensions (extractors, analyzers, actions,\nhooks, formatters, providers) discovered under the project plugins dir.\n\nUse `list` and `show` to inspect what loaded, `doctor` to diagnose load\nfailures, `enable` / `disable` to toggle extensions (persisted in the DB),\nand `create` / `upgrade` to scaffold and migrate your own."
+  },
+  config: {
+    description: "Read and write project configuration",
+    details: "Configuration is a layered merge: library defaults, the committed\n`settings.json`, the gitignored `settings.local.json`, env vars, then\nCLI flags, with later layers winning.\n\nUse `list` / `get` to read the effective values, `show --source` to see\nwhich layer set a key, and `set` / `reset` to write or revert one.\nPrivacy-sensitive keys (paths outside the project) require `--yes`."
+  },
+  db: {
+    description: "Inspect and maintain the project database",
+    details: "The project database is a single SQLite file at\n`.skill-map/skill-map.db`, holding the scan graph and plugin state.\n\nUse `backup` / `restore` around risky operations, `migrate` to apply\npending kernel and plugin migrations, `reset` to drop tables (or the\nwhole file), and `dump` / `shell` / `browser` to inspect the data."
+  },
+  job: {
+    description: "Manage the background job queue",
+    details: "Probabilistic and long-running work runs as jobs: queued, persisted in\nthe database, and resumable across restarts.\n\nUse `submit` to enqueue (or `--all` to fan out across nodes), `run` to\nexecute the claim-spawn-record loop, `status` / `list` / `show` to\ninspect, `preview` to render a job without executing it, and\n`cancel` / `prune` to clean up."
+  },
+  actions: {
+    description: "Inspect the registered Action catalog",
+    details: "An Action operates on one or more nodes and is either deterministic\n(in-process code) or probabilistic (a rendered prompt a runner executes).\n\nUse `list` for the catalog of registered action types and `show` for a\nsingle action's full manifest, including its preconditions and expected\nduration."
+  },
+  sidecar: {
+    description: "Manage `.sm` annotation sidecars",
+    details: "Skill-map's annotation layer lives in co-located `.sm` YAML sidecars\nnext to each node, leaving the vendor file untouched.\n\nUse `annotate` to scaffold an empty sidecar ready for editing, `refresh`\nto realign its drift hashes with the live node, and `prune` to delete\nsidecars whose `.md` no longer exists."
+  },
+  hooks: {
+    description: "Install git hooks for sidecar drift",
+    details: "Git hooks keep your sidecars in sync with the repo as you commit.\n\n`install` writes a pre-commit hook that auto-bumps staged sidecar drift\nbefore each commit."
+  },
+  conformance: {
+    description: "Run the spec conformance suite",
+    details: "The conformance suite checks an implementation against the spec.\n\n`run` executes the spec-owned cases plus every built-in Provider and\nreports the results."
+  }
+};
 
 // cli/commands/help.ts
 var HelpCommand = class extends Command15 {
@@ -14282,18 +14495,23 @@ var HelpCommand = class extends Command15 {
     const verb = this.verbParts.join(" ").trim();
     if (verb) {
       const target = verbs.find((v) => v.name === verb);
-      if (!target) {
-        this.context.stderr.write(
-          tx(HELP_TEXTS.unknownVerb, {
-            glyph: errGlyph,
-            verb,
-            hint: ansi.dim(HELP_TEXTS.unknownVerbHint)
-          })
-        );
-        return ExitCode.NotFound;
+      if (target) {
+        this.context.stdout.write(renderSingle(target, format));
+        return ExitCode.Ok;
       }
-      this.context.stdout.write(renderSingle(target, format));
-      return ExitCode.Ok;
+      const subcommands = verbs.filter((v) => v.name.startsWith(verb + " "));
+      if (subcommands.length > 0) {
+        this.context.stdout.write(renderGroup(verb, subcommands, format));
+        return ExitCode.Ok;
+      }
+      this.context.stderr.write(
+        tx(HELP_TEXTS.unknownVerb, {
+          glyph: errGlyph,
+          verb,
+          hint: ansi.dim(HELP_TEXTS.unknownVerbHint)
+        })
+      );
+      return ExitCode.NotFound;
     }
     if (format === "human") {
       this.context.stdout.write(renderCompactOverview(verbs));
@@ -14403,7 +14621,7 @@ function resolveSpecVersion() {
     const req = createRequire7(import.meta.url);
     const indexPath = req.resolve("@skill-map/spec/index.json");
     const pkgPath = resolve26(indexPath, "..", "package.json");
-    const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync17(pkgPath, "utf8"));
     return pkg.version;
   } catch {
     return "unknown";
@@ -14480,6 +14698,51 @@ function renderSingle(verb, format) {
   }
   return renderSingleHuman(verb);
 }
+function renderGroup(group, subcommands, format) {
+  if (format === "json" || format === "md") {
+    const doc = {
+      cliVersion: VERSION,
+      specVersion: resolveSpecVersion(),
+      globalFlags: [],
+      verbs: subcommands
+    };
+    return format === "json" ? JSON.stringify(doc, null, 2) + "\n" : renderMarkdown2(doc);
+  }
+  return renderGroupHuman(group, subcommands);
+}
+function renderGroupHuman(group, subcommands) {
+  const meta = HELP_GROUPS[group];
+  const description = meta?.description ?? tx(HELP_TEXTS.groupFallbackDescription, { category: subcommands[0]?.category ?? "Other" });
+  const out = [];
+  out.push(tx(HELP_TEXTS.humanVerbHeader, { name: group, description }));
+  out.push("");
+  out.push(HELP_TEXTS.humanUsageHeading);
+  out.push(tx(HELP_TEXTS.humanGroupUsageRow, { name: group }));
+  if (meta?.details) out.push(...renderHumanDescription(meta.details));
+  out.push(...renderGroupCommands(group, subcommands));
+  out.push("");
+  out.push(tx(HELP_TEXTS.humanGroupFooter, { name: group }));
+  return out.join("\n") + "\n";
+}
+function renderGroupCommands(group, subcommands) {
+  const out = ["", HELP_TEXTS.humanCommandsHeading];
+  const sorted = [...subcommands].sort((a, b) => a.name.localeCompare(b.name));
+  const labels = sorted.map((v) => v.name.slice(group.length + 1));
+  const width = Math.max(...labels.map((l) => l.length));
+  for (let i = 0; i < sorted.length; i++) {
+    const verb = sorted[i];
+    const label = labels[i];
+    const { isStub, clean } = classifyDescription(verb.description);
+    const description = (isStub ? HELP_TEXTS.compactStubMarker : "") + firstSentence(clean);
+    const row = tx(HELP_TEXTS.humanCommandRow, {
+      name: label,
+      padding: padRight("", width - label.length),
+      description
+    });
+    out.push(truncate2(row, COMPACT_ROW_MAX));
+  }
+  return out;
+}
 function renderSingleHuman(verb) {
   const out = [];
   out.push(buildHumanHeader(verb));
@@ -14611,7 +14874,7 @@ function routeHelpArgs(args2, cli2) {
   if (!shouldRouteHelp(args2)) return args2;
   const leading = leadingPositionals(args2);
   if (leading.length === 0) return args2;
-  const verbPath = longestVerbPrefix(leading, registeredVerbPaths(cli2));
+  const verbPath = longestVerbOrGroupPrefix(leading, registeredVerbPaths(cli2));
   if (verbPath.length === 0) return args2;
   return ["help", ...verbPath];
 }
@@ -14630,14 +14893,15 @@ function leadingPositionals(args2) {
   }
   return out;
 }
-function longestVerbPrefix(positionals, verbPaths) {
-  let best = [];
-  for (const path of verbPaths) {
-    if (path.length > positionals.length) continue;
-    const matches = path.every((tok, i) => positionals[i] === tok);
-    if (matches && path.length > best.length) best = path;
+function longestVerbOrGroupPrefix(positionals, verbPaths) {
+  for (let len = positionals.length; len >= 1; len--) {
+    const prefix = positionals.slice(0, len);
+    const matches = verbPaths.some(
+      (path) => path.length >= len && prefix.every((tok, i) => path[i] === tok)
+    );
+    if (matches) return prefix;
   }
-  return best;
+  return [];
 }
 function registeredVerbPaths(cli2) {
   const rawDefs = cli2.definitions();
@@ -14842,10 +15106,9 @@ import { join as join17 } from "path";
 import { Command as Command17, Option as Option16 } from "clipanion";
 
 // kernel/orchestrator/index.ts
-import { existsSync as existsSync22, statSync as statSync6 } from "fs";
+import { existsSync as existsSync23, statSync as statSync6 } from "fs";
 import { isAbsolute as isAbsolute7, resolve as resolve28 } from "path";
 import { Tiktoken as Tiktoken2 } from "js-tiktoken/lite";
-import cl100k_base from "js-tiktoken/ranks/cl100k_base";
 
 // kernel/i18n/orchestrator.texts.ts
 var ORCHESTRATOR_TEXTS = {
@@ -15889,7 +16152,7 @@ function computeDriftStatus(args2) {
 }
 
 // kernel/sidecar/discover-orphans.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
+import { existsSync as existsSync21, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
 import { join as join13, relative as relative4, sep as sep4 } from "path";
 function discoverOrphanSidecars(roots, shouldSkip) {
   const out = [];
@@ -15917,7 +16180,7 @@ function walk2(root, current, shouldSkip, out) {
     if (!entry.isFile()) continue;
     if (!entry.name.endsWith(".sm")) continue;
     const expectedMd = `${full.slice(0, -".sm".length)}.md`;
-    if (existsSync20(expectedMd) && safeIsFile(expectedMd)) continue;
+    if (existsSync21(expectedMd) && safeIsFile(expectedMd)) continue;
     out.push({ sidecarPath: full, relativePath: rel, expectedMdPath: expectedMd });
   }
 }
@@ -15930,8 +16193,8 @@ function safeIsFile(path) {
 }
 
 // kernel/orchestrator/node-build.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync21 } from "fs";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync22 } from "fs";
 import { isAbsolute as isAbsolute6, resolve as resolvePath } from "path";
 import "js-tiktoken/lite";
 import yaml4 from "js-yaml";
@@ -16018,7 +16281,7 @@ function countTokens(encoder, frontmatterRaw, body) {
   return { frontmatter, body: bodyTokens, total: frontmatter + bodyTokens };
 }
 function sha256(input) {
-  return createHash("sha256").update(input, "utf8").digest("hex");
+  return createHash2("sha256").update(input, "utf8").digest("hex");
 }
 function canonicalFrontmatter(parsed, raw) {
   const hasParsedKeys = Object.keys(parsed).length > 0;
@@ -16095,11 +16358,11 @@ function resolveSidecarOverlay(relativePath2, nodePathForIssue, roots, liveBodyH
 }
 function resolveAbsoluteMdPath(relativePath2, roots) {
   if (isAbsolute6(relativePath2)) {
-    return existsSync21(relativePath2) ? relativePath2 : null;
+    return existsSync22(relativePath2) ? relativePath2 : null;
   }
   for (const root of roots) {
     const candidate = resolvePath(root, relativePath2);
-    if (existsSync21(candidate)) return candidate;
+    if (existsSync22(candidate)) return candidate;
   }
   return null;
 }
@@ -16157,7 +16420,18 @@ async function walkAndExtract(opts) {
   const accum = createWalkAccumulators();
   const wctx = buildWalkContext(opts);
   const claimedPaths = /* @__PURE__ */ new Set();
-  const walkOptions = opts.ignoreFilter ? { ignoreFilter: opts.ignoreFilter } : {};
+  const oversizedFiles = [];
+  const oversizedSeen = /* @__PURE__ */ new Set();
+  const onOversizedFile = (info) => {
+    if (oversizedSeen.has(info.path)) return;
+    oversizedSeen.add(info.path);
+    oversizedFiles.push(info);
+  };
+  const walkOptions = {
+    ...opts.ignoreFilter ? { ignoreFilter: opts.ignoreFilter } : {},
+    onOversizedFile,
+    ...opts.maxFileSizeBytes !== void 0 ? { maxFileSizeBytes: opts.maxFileSizeBytes } : {}
+  };
   let filesWalked = 0;
   let index = 0;
   const effectiveMaxNodes = opts.overrideMaxNodes ?? opts.recommendedNodeLimit;
@@ -16190,6 +16464,7 @@ async function walkAndExtract(opts) {
     cachedPaths: accum.cachedPaths,
     frontmatterIssues: accum.frontmatterIssues,
     filesWalked,
+    oversizedFiles,
     recommendedNodeLimit: opts.recommendedNodeLimit,
     overrideMaxNodes: opts.overrideMaxNodes,
     capReached,
@@ -16240,7 +16515,11 @@ async function processRawNode(raw, provider, wctx, accum, claimedPaths, nextInde
   }
   claimedPaths.add(raw.path);
   const priorNode = wctx.priorNodesByPath.get(raw.path);
-  const nodeHashCacheEligible = wctx.opts.enableCache && wctx.opts.prior !== null && priorNode !== void 0 && priorNode.bodyHash === bodyHash && priorNode.frontmatterHash === frontmatterHash;
+  const nodeHashCacheEligible = wctx.opts.enableCache && // Tokenizer-change invalidation: when the resolved encoder differs
+  // from the one that produced the prior snapshot's counts, no node is
+  // cache-eligible, every node rebuilds so `buildNode` re-tokenizes
+  // with the current encoder. See `tokenizerChanged` on the options.
+  !wctx.opts.tokenizerChanged && wctx.opts.prior !== null && priorNode !== void 0 && priorNode.bodyHash === bodyHash && priorNode.frontmatterHash === frontmatterHash;
   const sidecarResolution = resolveSidecarOverlay(
     raw.path,
     raw.path,
@@ -16442,6 +16721,16 @@ function resolveSpecVersionSafe() {
     return "unknown";
   }
 }
+var DEFAULT_TOKENIZER = "cl100k_base";
+function resolveTokenizerName(name) {
+  return name === "o200k_base" ? "o200k_base" : DEFAULT_TOKENIZER;
+}
+async function loadTokenizerRanks(name) {
+  if (name === "o200k_base") {
+    return (await import("js-tiktoken/ranks/o200k_base")).default;
+  }
+  return (await import("js-tiktoken/ranks/cl100k_base")).default;
+}
 async function runScanWithRenames(_kernel, options) {
   return runScanInternal(_kernel, options);
 }
@@ -16451,7 +16740,7 @@ async function runScan(_kernel, options) {
 }
 async function runScanInternal(_kernel, options) {
   validateRoots(options.roots);
-  const setup = buildScanSetup(options);
+  const setup = await buildScanSetup(options);
   const { emitter, exts, hookDispatcher, encoder, prior, start } = setup;
   const scanStartedEvent = makeEvent("scan.started", { roots: options.roots });
   emitter.emit(scanStartedEvent);
@@ -16461,6 +16750,7 @@ async function runScanInternal(_kernel, options) {
     options.roots,
     exts.providers
   );
+  const tokenizerChanged = encoder !== null && prior !== null && prior.tokenizer !== setup.tokenizer;
   const walked = await walkAndExtract({
     providers: exts.providers,
     extractors: exts.extractors,
@@ -16470,6 +16760,7 @@ async function runScanInternal(_kernel, options) {
     encoder,
     strict: setup.strict,
     enableCache: setup.enableCache,
+    tokenizerChanged,
     prior,
     priorIndex: setup.priorIndex,
     priorExtractorRuns: setup.priorExtractorRuns,
@@ -16477,7 +16768,8 @@ async function runScanInternal(_kernel, options) {
     pluginStores: options.pluginStores,
     activeProvider: activeProviderId,
     recommendedNodeLimit: options.recommendedNodeLimit ?? 256,
-    overrideMaxNodes: options.overrideMaxNodes ?? null
+    overrideMaxNodes: options.overrideMaxNodes ?? null,
+    ...options.maxFileSizeBytes !== void 0 ? { maxFileSizeBytes: options.maxFileSizeBytes } : {}
   });
   const activeProvider = activeProviderId ? exts.providers.find((p) => p.id === activeProviderId) ?? null : null;
   const resolved = resolveSignals({
@@ -16584,13 +16876,14 @@ function buildReservedNodePaths(nodes, kindRegistry, reservedNamesByProviderKind
 function hasEntries(set) {
   return set !== void 0 && set.size > 0;
 }
-function buildScanSetup(options) {
+async function buildScanSetup(options) {
   const start = Date.now();
   const emitter = options.emitter ?? new InMemoryProgressEmitter();
   const exts = options.extensions ?? { providers: [], extractors: [], analyzers: [] };
   const hookDispatcher = makeHookDispatcher(exts.hooks ?? [], emitter);
   const tokenize = options.tokenize !== false;
-  const encoder = tokenize ? new Tiktoken2(cl100k_base) : null;
+  const tokenizer = resolveTokenizerName(options.tokenizer);
+  const encoder = tokenize ? new Tiktoken2(await loadTokenizerRanks(tokenizer)) : null;
   const prior = options.priorSnapshot ?? null;
   const priorIndex = indexPriorSnapshot(prior);
   const providerFrontmatter = buildProviderFrontmatterValidator(exts.providers);
@@ -16601,6 +16894,7 @@ function buildScanSetup(options) {
     exts,
     hookDispatcher,
     encoder,
+    tokenizer,
     prior,
     priorIndex,
     priorExtractorRuns: options.priorExtractorRuns,
@@ -16636,6 +16930,7 @@ function buildScanStats(walked, issues, start) {
     // Providers compete.
     filesWalked: walked.filesWalked,
     filesSkipped: 0,
+    filesOversized: walked.oversizedFiles.length,
     nodesCount: walked.nodes.length,
     linksCount: walked.internalLinks.length,
     issuesCount: issues.length,
@@ -16650,8 +16945,10 @@ function buildScanReturn(walked, issues, renameOps, stats, options, setup) {
       roots: options.roots,
       providers: setup.exts.providers.map((a) => a.id),
       scannedBy: SCANNED_BY,
+      tokenizer: setup.tokenizer,
       recommendedNodeLimit: walked.recommendedNodeLimit,
       overrideMaxNodes: walked.overrideMaxNodes,
+      oversizedFiles: walked.oversizedFiles,
       nodes: walked.nodes,
       links: walked.internalLinks,
       issues,
@@ -16669,7 +16966,7 @@ function validateRoots(roots) {
     throw new Error(ORCHESTRATOR_TEXTS.runScanRootEmptyArray);
   }
   for (const root of roots) {
-    if (!existsSync22(root) || !statSync6(root).isDirectory()) {
+    if (!existsSync23(root) || !statSync6(root).isDirectory()) {
       throw new Error(tx(ORCHESTRATOR_TEXTS.runScanRootMissing, { root }));
     }
   }
@@ -16678,7 +16975,7 @@ function resolveActiveProviderOption(optionValue, roots, providers) {
   if (optionValue !== void 0) return optionValue;
   for (const root of roots) {
     const absRoot = isAbsolute7(root) ? root : resolve28(root);
-    if (!existsSync22(absRoot)) continue;
+    if (!existsSync23(absRoot)) continue;
     const detected = resolveActiveProvider(absRoot, providers).resolved;
     if (detected !== null) return detected;
   }
@@ -17047,13 +17344,13 @@ var SCAN_RUNNER_TEXTS = {
   activeProviderAmbiguousUnderYes: "{{glyph}}  Multiple provider markers detected ({{candidates}}) and --yes is set.\n   {{hint}}\n",
   activeProviderAmbiguousUnderYesHint: "Set the lens explicitly with `sm config set activeProvider <id>` and re-run, or omit --yes for interactive selection.",
   /**
-   * Active lens points at a bundle the operator has disabled (via
+   * Active lens points at a plugin the operator has disabled (via
    * `sm plugins disable <id>` or the Settings UI). Classification keeps
    * running because it's provider-driven, but the lens-gated extractors
-   * for the disabled bundle silently no-op. Without this warning the
+   * for the disabled plugin silently no-op. Without this warning the
    * graph quietly differs from what the lens implies.
    */
-  activeProviderBundleDisabledWarning: 'activeProvider = "{{id}}" but the "{{id}}" plugin bundle is currently disabled; provider-specific extractors will not run. Re-enable the bundle with `sm plugins enable {{id}}` or switch the lens with `sm config set activeProvider <id>` to silence this warning.',
+  activeProviderPluginDisabledWarning: 'activeProvider = "{{id}}" but the "{{id}}" plugin is currently disabled; provider-specific extractors will not run. Re-enable the plugin with `sm plugins enable {{id}}` or switch the lens with `sm config set activeProvider <id>` to silence this warning.',
   /**
    * Active-provider drift: the snapshot of provider markers persisted
    * when `activeProvider` was set (`activeProviderMarkers`) no longer
@@ -17222,7 +17519,6 @@ function persistActiveProvider(cwd, id, markers, printer) {
       target: "project",
       cwd
     });
-    printer.info(tx(SCAN_RUNNER_TEXTS.activeProviderAutodetected, { id }));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     printer.warn(
@@ -17279,11 +17575,11 @@ function diffMarkers(snapshot, current) {
   }
   return { added, removed };
 }
-function warnIfLensBundleDisabled(args2) {
+function warnIfLensPluginDisabled(args2) {
   if (args2.activeProvider === null) return;
   if (args2.resolveEnabled(args2.activeProvider)) return;
   args2.printer.warn(
-    tx(SCAN_RUNNER_TEXTS.activeProviderBundleDisabledWarning, {
+    tx(SCAN_RUNNER_TEXTS.activeProviderPluginDisabledWarning, {
       id: args2.activeProvider
     })
   );
@@ -17319,45 +17615,61 @@ async function promptForLens(detected, stdin, stderr, warnGlyph) {
 }
 
 // core/sqlite/db-drift-reset.ts
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { createInterface as createInterface4 } from "readline";
-import { DatabaseSync as DatabaseSync7 } from "node:sqlite";
+import { DatabaseSync as DatabaseSync8 } from "node:sqlite";
 
 // core/sqlite/i18n/db-drift.texts.ts
 var DB_DRIFT_TEXTS = {
   // Interactive confirm (TTY `sm scan`, no `--yes`). The block is
   // written to stderr, then the question line drives `readline`.
-  driftPrompt: "{{glyph}}  The local cache was built by skill-map {{dbVersion}} and you are on {{currentVersion}}.\n   {{hint}}\n",
-  driftPromptHint: "Pre-1.0 the DB is a derived cache (your .sm sidecars hold the real data); it cannot be carried across a version change and has to be rebuilt.",
+  // `{{reason}}` is one of the `driftReason*` strings below so the
+  // operator sees WHY the cache is being rebuilt (version skew vs an
+  // inline schema change the version did not bump).
+  driftPrompt: "{{glyph}}  The local cache was built by skill-map {{dbVersion}} and you are on {{currentVersion}} ({{reason}}).\n   {{hint}}\n",
+  driftPromptHint: "Pre-1.0 the DB is a derived cache (your .sm sidecars hold the real data); it cannot be carried across a schema change and has to be rebuilt.",
   driftPromptQuestion: "Delete the local cache and rebuild it on this scan? [y/N] ",
   // Receipt after the rebuild (printed by the scan / refresh path).
-  driftReset: "{{glyph}}  Local cache rebuilt: it was written by skill-map {{dbVersion}}, you are on {{currentVersion}}.\n   {{hint}}\n",
+  driftReset: "{{glyph}}  Local cache rebuilt ({{reason}}): it was written by skill-map {{dbVersion}}, you are on {{currentVersion}}.\n   {{hint}}\n",
   driftResetHint: "The DB was deleted and is being regenerated by this scan; .sm sidecars were not touched.",
   // Abort headline when the operator declines (wrapped by the caller's
   // `sm scan: {message}` shell, so it carries no glyph / verb prefix).
-  driftAborted: "cache rebuild declined: the {{dbVersion}} cache cannot be reused on {{currentVersion}}. {{hint}}",
-  driftAbortedHint: "Re-run with --yes, or run `sm db reset --hard` then `sm scan`."
+  driftAborted: "cache rebuild declined: the {{dbVersion}} cache cannot be reused on {{currentVersion}} ({{reason}}). {{hint}}",
+  driftAbortedHint: "Re-run with --yes, or run `sm db reset --hard` then `sm scan`.",
+  // Drift reason fragments, interpolated as `{{reason}}` above. Version
+  // skew = the recorded scanned_by_version differs at major.minor.
+  // Schema fingerprint = an inline migration edit (no version bump,
+  // greenfield posture) changed the DDL.
+  driftReasonVersion: "version skew",
+  driftReasonSchema: "schema change in this version"
 };
 
 // core/sqlite/db-drift-reset.ts
 async function maybeResetOnDrift(dbPath, policy) {
-  const dbVersion = readScannedByVersion(dbPath);
-  if (dbVersion === null) return { kind: "no-drift" };
-  const skew = classifyVersionSkew(dbVersion, policy.currentVersion);
-  if (skew.kind === "ok" || skew.kind === "no-meta") return { kind: "no-drift" };
-  const confirmed = await confirmDriftReset(dbVersion, policy);
+  const reason = detectDriftReason(dbPath, policy.currentVersion);
+  if (reason === null) return { kind: "no-drift" };
+  const dbVersion = readScannedByVersion(dbPath) ?? "unknown";
+  const confirmed = await confirmDriftReset(dbVersion, reason, policy);
   if (!confirmed) {
-    return { kind: "aborted", dbVersion, currentVersion: policy.currentVersion };
+    return { kind: "aborted", dbVersion, currentVersion: policy.currentVersion, reason };
   }
   await removeDbFiles(dbPath);
-  renderResetReceipt(dbVersion, policy);
-  return { kind: "reset", dbVersion, currentVersion: policy.currentVersion };
+  renderResetReceipt(dbVersion, reason, policy);
+  return { kind: "reset", dbVersion, currentVersion: policy.currentVersion, reason };
+}
+function detectDriftReason(dbPath, currentVersion) {
+  const dbVersion = readScannedByVersion(dbPath);
+  if (dbVersion !== null) {
+    const skew = classifyVersionSkew(dbVersion, currentVersion);
+    if (skew.kind !== "ok" && skew.kind !== "no-meta") return "version";
+  }
+  return classifyFingerprint(dbPath).kind === "drift" ? "schema" : null;
 }
 function readScannedByVersion(dbPath) {
-  if (dbPath === ":memory:" || !existsSync23(dbPath)) return null;
+  if (dbPath === ":memory:" || !existsSync24(dbPath)) return null;
   let raw = null;
   try {
-    raw = new DatabaseSync7(dbPath, { readOnly: true });
+    raw = new DatabaseSync8(dbPath, { readOnly: true });
     const row = raw.prepare("SELECT scanned_by_version AS v FROM scan_meta LIMIT 1").get();
     const v = row?.v;
     return typeof v === "string" && v.length > 0 ? v : null;
@@ -17367,16 +17679,19 @@ function readScannedByVersion(dbPath) {
     raw?.close();
   }
 }
-async function confirmDriftReset(dbVersion, policy) {
+async function confirmDriftReset(dbVersion, reason, policy) {
   if (!shouldPromptForReset(policy)) return true;
-  return askDriftReset(dbVersion, policy);
+  return askDriftReset(dbVersion, reason, policy);
+}
+function reasonText(reason) {
+  return reason === "version" ? DB_DRIFT_TEXTS.driftReasonVersion : DB_DRIFT_TEXTS.driftReasonSchema;
 }
 function shouldPromptForReset(policy) {
   if (policy.assumeYes) return false;
   if (!policy.stdin || !policy.stderr) return false;
   return policy.stdin.isTTY === true;
 }
-async function askDriftReset(dbVersion, policy) {
+async function askDriftReset(dbVersion, reason, policy) {
   const warnGlyph = policy.style?.warnGlyph ?? "\u26A0";
   const dim = policy.style?.dim ?? ((s) => s);
   policy.stderr.write(
@@ -17384,6 +17699,7 @@ async function askDriftReset(dbVersion, policy) {
       glyph: warnGlyph,
       dbVersion,
       currentVersion: policy.currentVersion,
+      reason: reasonText(reason),
       hint: dim(DB_DRIFT_TEXTS.driftPromptHint)
     })
   );
@@ -17397,7 +17713,7 @@ async function askDriftReset(dbVersion, policy) {
     rl.close();
   }
 }
-function renderResetReceipt(dbVersion, policy) {
+function renderResetReceipt(dbVersion, reason, policy) {
   if (!policy.printer) return;
   const warnGlyph = policy.style?.warnGlyph ?? "\u26A0";
   const dim = policy.style?.dim ?? ((s) => s);
@@ -17406,6 +17722,7 @@ function renderResetReceipt(dbVersion, policy) {
       glyph: warnGlyph,
       dbVersion,
       currentVersion: policy.currentVersion,
+      reason: reasonText(reason),
       hint: dim(DB_DRIFT_TEXTS.driftResetHint)
     })
   );
@@ -17448,10 +17765,13 @@ async function runScanForCommand(opts) {
     referenceablePaths,
     ctx.cwd,
     activeProvider,
-    cfg.scan.maxNodes
+    cfg.scan.maxNodes,
+    cfg.scan.maxFileSizeBytes,
+    cfg.tokenizer
   );
   const willPersist = !opts.noBuiltIns && !opts.dryRun;
-  return willPersist ? runPersistPath(opts, dbPath, jobsDir, strict, loadPrior, runScanWith, extensions) : runEphemeralPath(opts, dbPath, strict, loadPrior, runScanWith);
+  const scanned = await (willPersist ? runPersistPath(opts, dbPath, jobsDir, strict, loadPrior, runScanWith, extensions) : runEphemeralPath(opts, dbPath, strict, loadPrior, runScanWith));
+  return scanned.kind === "ok" ? { ...scanned, lensAutoDetected: lens.autoDetected } : scanned;
 }
 function detectionProviders(extensions) {
   return extensions?.providers ?? [];
@@ -17480,12 +17800,20 @@ async function resolveActiveLens(opts, ctx, effectiveRoots, pluginRuntime, provi
       })
     };
   }
-  warnIfLensBundleDisabled({
+  warnIfLensPluginDisabled({
     activeProvider: bootstrap.activeProvider,
     resolveEnabled: opts.resolveEnabledOverride ?? pluginRuntime.resolveEnabled,
     printer: opts.printer
   });
-  return { kind: "ok", activeProvider: bootstrap.activeProvider };
+  return {
+    kind: "ok",
+    activeProvider: bootstrap.activeProvider,
+    // Only when the lens was freshly auto-detected (not read from
+    // config) does the caller announce it. The bootstrap no longer
+    // prints it itself, to avoid interleaving stderr with the
+    // stdout scan summary on a tty.
+    autoDetected: bootstrap.source === "autodetect" ? bootstrap.activeProvider : null
+  };
 }
 function emitReferenceWalkAdvisory(walk3, opts) {
   if (walk3.truncated) {
@@ -17553,7 +17881,7 @@ function makePriorLoader(noBuiltIns, strict) {
     return loaded;
   };
 }
-function makeScanRunner(kernel, opts, effectiveRoots, ignoreFilter, strict, extensions, referenceablePaths, scanCwd, activeProvider, recommendedNodeLimit) {
+function makeScanRunner(kernel, opts, effectiveRoots, ignoreFilter, strict, extensions, referenceablePaths, scanCwd, activeProvider, recommendedNodeLimit, maxFileSizeBytes, tokenizer) {
   return async (prior, priorExtractorRuns, orphanJobFiles) => {
     if (opts.changed && prior === null) {
       opts.stderr.write(SCAN_RUNNER_TEXTS.changedNoPriorWarning);
@@ -17569,6 +17897,8 @@ function makeScanRunner(kernel, opts, effectiveRoots, ignoreFilter, strict, exte
       prior,
       activeProvider,
       recommendedNodeLimit,
+      maxFileSizeBytes,
+      tokenizer,
       ...priorExtractorRuns ? { priorExtractorRuns } : {},
       ...orphanJobFiles ? { orphanJobFiles } : {}
     });
@@ -17580,6 +17910,7 @@ function buildRunScanOptions(args2) {
   const runOptions = {
     roots: args2.effectiveRoots.slice(),
     tokenize: !opts.noTokens,
+    tokenizer: args2.tokenizer,
     ignoreFilter: args2.ignoreFilter,
     strict: args2.strict,
     emitter: buildRunScanEmitter(opts),
@@ -17590,7 +17921,8 @@ function buildRunScanOptions(args2) {
     orphanJobFiles: orphanJobFiles ?? [],
     activeProvider: args2.activeProvider,
     recommendedNodeLimit: args2.recommendedNodeLimit,
-    overrideMaxNodes: opts.maxNodes ?? null
+    overrideMaxNodes: opts.maxNodes ?? null,
+    maxFileSizeBytes: args2.maxFileSizeBytes
   };
   if (args2.extensions) runOptions.extensions = args2.extensions;
   if (prior) {
@@ -17624,6 +17956,7 @@ async function rebuildOnDrift(opts, dbPath) {
     message: tx(DB_DRIFT_TEXTS.driftAborted, {
       dbVersion: drift.dbVersion,
       currentVersion: drift.currentVersion,
+      reason: drift.reason === "version" ? DB_DRIFT_TEXTS.driftReasonVersion : DB_DRIFT_TEXTS.driftReasonSchema,
       hint: dim(DB_DRIFT_TEXTS.driftAbortedHint)
     })
   };
@@ -17962,6 +18295,11 @@ async function runFirstScan(scopeRoot, strict, printer, stderr, stdin, ansi) {
     return ExitCode.Ok;
   }
   const result = outcome.result;
+  if (outcome.lensAutoDetected) {
+    printer.info(
+      tx(SCAN_RUNNER_TEXTS.activeProviderAutodetected, { id: outcome.lensAutoDetected })
+    );
+  }
   const hasErrors = result.issues.some((i) => i.severity === "error");
   printer.info(
     tx(INIT_TEXTS.firstScanSummary, {
@@ -18788,7 +19126,11 @@ var ListCommand = class extends SmCommand {
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
     return withSqlite(
-      { databasePath: dbPath, autoBackup: false },
+      {
+        databasePath: dbPath,
+        autoBackup: false,
+        versionCheck: buildReadVersionCheck(this.printer, stderrAnsi)
+      },
       (adapter) => this.#runQuery(adapter, flags)
     );
   }
@@ -19480,10 +19822,10 @@ var PLUGINS_TEXTS = {
   pluginNotFoundHint: "Run `sm plugins list` for discovered ids and the qualified extension ids.",
   pluginLocked: '{{glyph}}  Plugin "{{id}}" is locked by the host and cannot be toggled.\n   {{hint}}\n',
   pluginLockedHint: "Locked plugins are mandatory for correct operation. To remove the lock, edit `src/kernel/config/locked-plugins.ts`.",
-  qualifiedIdNotFound: "{{glyph}}  Qualified extension id not found: {{id}}\n   The owning bundle '{{bundleId}}' does not declare an extension with id '{{extId}}'.\n   {{hint}}\n",
-  qualifiedIdNotFoundHint: "Run `sm plugins list` to see what each bundle ships.",
-  qualifiedIdUnknownBundle: "{{glyph}}  Qualified extension id references unknown bundle: {{bundleId}}\n   {{hint}}\n",
-  qualifiedIdUnknownBundleHint: "Run `sm plugins list` for known bundle ids.",
+  qualifiedIdNotFound: "{{glyph}}  Qualified extension id not found: {{id}}\n   The owning plugin '{{pluginId}}' does not declare an extension with id '{{extId}}'.\n   {{hint}}\n",
+  qualifiedIdNotFoundHint: "Run `sm plugins list` to see what each plugin ships.",
+  qualifiedIdUnknownPlugin: "{{glyph}}  Qualified extension id references unknown plugin: {{pluginId}}\n   {{hint}}\n",
+  qualifiedIdUnknownPluginHint: "Run `sm plugins list` for known plugin ids.",
   // Spec § A.10, `applicableKinds` filter on Extractors. When an extractor
   // declares a kind that no installed Provider emits, the load succeeds
   // (the Provider may arrive later) but `sm plugins doctor` surfaces a
@@ -19508,7 +19850,7 @@ var PLUGINS_TEXTS = {
   // --- doctor verb -----------------------------------------------------
   /**
    * One-line summary that opens the human doctor output. `enabled` is
-   * the count of enabled extensions across every bundle (every
+   * the count of enabled extensions across every plugin (every
    * extension is independently toggle-able by its qualified id); the
    * value matches the row count rendered by `sm plugins list` once
    * disabled extensions are filtered out.
@@ -19552,10 +19894,10 @@ var PLUGINS_TEXTS = {
   /**
    * Macro expansion summary printed on stderr before the confirm
    * prompt (or before the `--yes` rejection). The block lists every
-   * qualified extension id the bare bundle id resolves to, so the
+   * qualified extension id the bare plugin id resolves to, so the
    * user sees the exact set that would flip.
    */
-  bundleMacroHeader: "sm plugins {{verb}} {{bundleId}}: this will affect {{count}} extensions:\n",
+  bundleMacroHeader: "sm plugins {{verb}} {{pluginId}}: this will affect {{count}} extensions:\n",
   bundleMacroRow: "  - {{id}}\n",
   /**
    * Interactive prompt rendered to a TTY by the macro path. The
@@ -19575,7 +19917,7 @@ var PLUGINS_TEXTS = {
    * the directed re-run hint.
    */
   bundleMacroRequiresYes: "{{glyph}}  Refusing to {{verb}} multiple extensions without confirmation.\n   {{hint}}\n",
-  bundleMacroRequiresYesHint: "Re-run with --yes to apply, or pass a qualified id `<bundle>/<extension>` for a single extension.",
+  bundleMacroRequiresYesHint: "Re-run with --yes to apply, or pass a qualified id `<plugin>/<extension>` for a single extension.",
   // --- list / show renderers ------------------------------------------
   rowStatusOk: "ok",
   rowStatusOff: "off",
@@ -19588,18 +19930,18 @@ var PLUGINS_TEXTS = {
   sourceBuiltIn: "built-in",
   sourceUser: "user",
   /**
-   * Compact bundle row: `  GLYPH  ID(pad)  N ext   SOURCE`.
+   * Compact plugin row: `  GLYPH  ID(pad)  N ext   SOURCE`.
    * Padding for `id` and `count` is computed at render time so all rows
    * align regardless of length. The glyph is wrapped in color before the
    * template substitution.
    */
-  bundleRow: "  {{glyph}}  {{id}}{{count}} ext   {{source}}",
+  pluginRow: "  {{glyph}}  {{id}}{{count}} ext   {{source}}",
   /**
-   * Indent applied to the names / reason lines under each bundle row.
+   * Indent applied to the names / reason lines under each plugin row.
    * Kept as a single source of truth so the wrap math (`wrapNames`) and
    * the visible output stay in sync.
    */
-  bundleSubIndent: "       ",
+  pluginSubIndent: "       ",
   listTipShow: "\nTip: `sm plugins show <id>` for kinds, versions, and per-extension status.\n",
   /** Show command, built-in header (no version row, no path). */
   detailHeaderBuiltIn: "  {{glyph}}  {{id}}   {{source}}   {{count}} extension{{plural}}\n",
@@ -19621,11 +19963,11 @@ var PLUGINS_TEXTS = {
   /** Extensions block heading, separated from the header by a blank line. */
   detailExtensionsBlock: "\n",
   /**
-   * Extension row inside the bundle detail. Every extension is
+   * Extension row inside the plugin detail. Every extension is
    * independently toggle-able, so every row carries its own glyph
    * (✓ / ✕). Padding for {{kind}} and {{name}} is computed at render
    * time so columns align inside the block. `{{versionSuffix}}` is
-   * either `  v<x.y.z>` (user plugins) or empty (built-in bundles,
+   * either `  v<x.y.z>` (user plugins) or empty (built-in plugins,
    * which inherit the CLI version and do not maintain per-extension
    * versions of their own).
    */
@@ -19633,7 +19975,7 @@ var PLUGINS_TEXTS = {
   detailVersionUnknown: "?",
   detailCompatUnknown: "?",
   /**
-   * Show command, single-extension header (qualified `<bundle>/<ext>` id
+   * Show command, single-extension header (qualified `<plugin>/<ext>` id
    * shape). Mirrors `detailHeaderBuiltIn` but the count slot is replaced
    * by the kind so the reader sees at a glance whether they are looking
    * at an extractor, analyzer, etc. Version moves down into the field
@@ -19680,19 +20022,19 @@ var PLUGINS_TEXTS = {
 };
 
 // plugins/presentation-order.ts
-var BUILT_IN_BUNDLE_PRESENTATION_ORDER = [
+var BUILT_IN_PLUGIN_PRESENTATION_ORDER = [
   "core",
   "claude",
   "antigravity",
   "openai",
   "agent-skills"
 ];
-function sortBundlesForPresentation(bundles) {
+function sortPluginsForPresentation(plugins) {
   const orderIndex = (id) => {
-    const idx = BUILT_IN_BUNDLE_PRESENTATION_ORDER.indexOf(id);
-    return idx >= 0 ? idx : BUILT_IN_BUNDLE_PRESENTATION_ORDER.length;
+    const idx = BUILT_IN_PLUGIN_PRESENTATION_ORDER.indexOf(id);
+    return idx >= 0 ? idx : BUILT_IN_PLUGIN_PRESENTATION_ORDER.length;
   };
-  return [...bundles].sort((a, b) => {
+  return [...plugins].sort((a, b) => {
     const ai = orderIndex(a.id);
     const bi = orderIndex(b.id);
     if (ai !== bi) return ai - bi;
@@ -19729,24 +20071,24 @@ async function loadAll(opts) {
   return loader.discoverAndLoadAll();
 }
 function builtInRows(resolveEnabled) {
-  return sortBundlesForPresentation(builtInBundles).map((bundle) => {
-    const extensions = bundle.extensions.map((ext) => extensionRowFromBuiltIn(ext, bundle, resolveEnabled));
-    const manifestSummary = bundle.extensions.map((ext) => `${ext.kind}:${qualifiedExtensionId(bundle.id, ext.id)}@${ext.version}`).join(", ");
+  return sortPluginsForPresentation(builtInPlugins).map((plugin) => {
+    const extensions = plugin.extensions.map((ext) => extensionRowFromBuiltIn(ext, plugin, resolveEnabled));
+    const manifestSummary = plugin.extensions.map((ext) => `${ext.kind}:${qualifiedExtensionId(plugin.id, ext.id)}@${ext.version}`).join(", ");
     return {
-      id: bundle.id,
+      id: plugin.id,
       enabled: extensions.some((e) => e.enabled),
-      description: bundle.description,
+      description: plugin.description,
       extensions,
       manifestSummary
     };
   });
 }
-function extensionRowFromBuiltIn(ext, bundle, resolveEnabled) {
+function extensionRowFromBuiltIn(ext, plugin, resolveEnabled) {
   const row = {
     id: ext.id,
     kind: ext.kind,
     version: ext.version,
-    enabled: resolveEnabled(qualifiedExtensionId(bundle.id, ext.id)),
+    enabled: resolveEnabled(qualifiedExtensionId(plugin.id, ext.id)),
     description: ext.description ?? ""
   };
   if (ext.entry !== void 0) row.entry = ext.entry;
@@ -19782,7 +20124,7 @@ var PluginsListCommand = class extends SmCommand {
   static usage = Command22.Usage({
     category: "Plugins",
     description: "List discovered plugins and their load status.",
-    details: "Scans <cwd>/.skill-map/plugins (or --plugin-dir <path>). Built-in bundles (claude, core) are listed alongside user plugins."
+    details: "Scans <cwd>/.skill-map/plugins (or --plugin-dir <path>). Built-in plugins (claude, core) are listed alongside user plugins."
   });
   pluginDir = Option21.String("--plugin-dir", { required: false });
   async run() {
@@ -19819,14 +20161,14 @@ function renderListHuman(builtIns2, plugins, resolveEnabled, ansi) {
     const idCol = row.id.padEnd(idWidth);
     const countCol = String(row.names.length).padStart(countWidth);
     lines.push(
-      tx(PLUGINS_TEXTS.bundleRow, {
+      tx(PLUGINS_TEXTS.pluginRow, {
         glyph,
         id: idCol,
         count: ` ${countCol}`,
         source: ansi.dim(row.source)
       })
     );
-    const indent = PLUGINS_TEXTS.bundleSubIndent;
+    const indent = PLUGINS_TEXTS.pluginSubIndent;
     if (row.reason) {
       lines.push(`${indent}${ansi.dim(row.reason)}`);
     } else if (row.names.length > 0) {
@@ -19890,11 +20232,11 @@ var PluginsShowCommand = class extends SmCommand {
     category: "Plugins",
     description: "Show a single plugin's manifest + loaded extensions.",
     details: `
-      Accepts a bundle / plugin id (\`core\`, \`claude\`, \`my-plugin\`)
+      Accepts a plugin id (\`core\`, \`claude\`, \`my-plugin\`)
       or a qualified extension id (\`core/<ext-id>\`,
       \`<plugin>/<ext-id>\`). When given a qualified id, validates the
       extension exists and renders a single-extension detail block.
-      The bare form renders the parent bundle's detail with per-extension
+      The bare form renders the parent plugin's detail with per-extension
       status. The same id shapes \`sm plugins enable\` and
       \`sm plugins disable\` accept resolve cleanly here too.
     `
@@ -19911,9 +20253,9 @@ var PluginsShowCommand = class extends SmCommand {
       this.printer.error(lookupResult.error);
       return ExitCode.NotFound;
     }
-    const { bundleId, extId } = lookupResult;
-    const builtIn = builtIns2.find((b) => b.id === bundleId);
-    const match = plugins.find((p) => p.id === bundleId);
+    const { pluginId, extId } = lookupResult;
+    const builtIn = builtIns2.find((b) => b.id === pluginId);
+    const match = plugins.find((p) => p.id === pluginId);
     if (!builtIn && !match) {
       this.printer.error(
         tx(PLUGINS_TEXTS.pluginNotFound, {
@@ -19925,7 +20267,7 @@ var PluginsShowCommand = class extends SmCommand {
       return ExitCode.NotFound;
     }
     if (extId !== void 0) {
-      return this.renderExtensionDetail({ extId, bundleId, builtIn, match });
+      return this.renderExtensionDetail({ extId, pluginId, builtIn, match });
     }
     if (this.json) {
       const payload = builtIn ?? match;
@@ -19939,23 +20281,23 @@ var PluginsShowCommand = class extends SmCommand {
   }
   /**
    * Render the single-extension detail block, the path taken when the
-   * user supplies a qualified `<bundle>/<ext>` id. `--json` emits the
-   * single extension row (no surrounding bundle envelope) so tooling
+   * user supplies a qualified `<plugin>/<ext>` id. `--json` emits the
+   * single extension row (no surrounding plugin envelope) so tooling
    * can pipe straight into `jq`; human mode renders a focused header
    * plus a Kind / Version / Stability / Description / Preconditions /
    * Entry field block.
    */
   renderExtensionDetail(args2) {
-    const { extId, bundleId, builtIn, match } = args2;
+    const { extId, pluginId, builtIn, match } = args2;
     const ansi = this.ansiFor("stdout");
     if (builtIn) {
       const ext = builtIn.extensions.find((e) => e.id === extId);
       if (!ext) return ExitCode.NotFound;
       if (this.json) {
-        this.printer.data(JSON.stringify({ pluginId: bundleId, ...ext }, omitModule, 2) + "\n");
+        this.printer.data(JSON.stringify({ pluginId, ...ext }, omitModule, 2) + "\n");
         return ExitCode.Ok;
       }
-      this.printer.data(renderBuiltInExtensionDetail(bundleId, ext, ansi));
+      this.printer.data(renderBuiltInExtensionDetail(pluginId, ext, ansi));
       return ExitCode.Ok;
     }
     const userExt = match?.extensions?.find((e) => e.id === extId);
@@ -19964,53 +20306,53 @@ var PluginsShowCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(userExt, omitModule, 2) + "\n");
       return ExitCode.Ok;
     }
-    this.printer.data(renderUserExtensionDetail(bundleId, userExt, ansi));
+    this.printer.data(renderUserExtensionDetail(pluginId, userExt, ansi));
     return ExitCode.Ok;
   }
 };
 function resolveShowLookupId(id, builtIns2, plugins, ansi) {
-  if (!id.includes("/")) return { bundleId: id };
+  if (!id.includes("/")) return { pluginId: id };
   const parsed = parseQualifiedId(id);
   if ("error" in parsed) return { error: malformedQualifiedError(id, ansi) };
-  const { bundleId, extId } = parsed;
-  const knownExts = collectKnownExtensions(bundleId, builtIns2, plugins);
-  if (knownExts === null) return { error: unknownBundleError(bundleId, ansi) };
+  const { pluginId, extId } = parsed;
+  const knownExts = collectKnownExtensions(pluginId, builtIns2, plugins);
+  if (knownExts === null) return { error: unknownPluginError(pluginId, ansi) };
   if (!knownExts.includes(extId)) {
-    return { error: unknownExtensionError(id, bundleId, extId, ansi) };
+    return { error: unknownExtensionError(id, pluginId, extId, ansi) };
   }
-  return { bundleId, extId };
+  return { pluginId, extId };
 }
 function parseQualifiedId(id) {
-  const [bundleId, extId, ...rest] = id.split("/");
-  if (!bundleId || !extId || rest.length > 0) return { error: true };
-  return { bundleId, extId };
+  const [pluginId, extId, ...rest] = id.split("/");
+  if (!pluginId || !extId || rest.length > 0) return { error: true };
+  return { pluginId, extId };
 }
-function collectKnownExtensions(bundleId, builtIns2, plugins) {
-  const builtIn = builtIns2.find((b) => b.id === bundleId);
+function collectKnownExtensions(pluginId, builtIns2, plugins) {
+  const builtIn = builtIns2.find((b) => b.id === pluginId);
   if (builtIn) return builtIn.extensions.map((e) => e.id);
-  const userPlugin = plugins.find((p) => p.id === bundleId);
+  const userPlugin = plugins.find((p) => p.id === pluginId);
   if (userPlugin) return userPlugin.extensions?.map((e) => e.id) ?? [];
   return null;
 }
 function malformedQualifiedError(id, ansi) {
-  return tx(PLUGINS_TEXTS.qualifiedIdUnknownBundle, {
+  return tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
     glyph: ansi.red("\u2715"),
-    bundleId: sanitizeForTerminal(id),
-    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownBundleHint)
+    pluginId: sanitizeForTerminal(id),
+    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
   });
 }
-function unknownBundleError(bundleId, ansi) {
-  return tx(PLUGINS_TEXTS.qualifiedIdUnknownBundle, {
+function unknownPluginError(pluginId, ansi) {
+  return tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
     glyph: ansi.red("\u2715"),
-    bundleId: sanitizeForTerminal(bundleId),
-    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownBundleHint)
+    pluginId: sanitizeForTerminal(pluginId),
+    hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
   });
 }
-function unknownExtensionError(id, bundleId, extId, ansi) {
+function unknownExtensionError(id, pluginId, extId, ansi) {
   return tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
     glyph: ansi.red("\u2715"),
     id: sanitizeForTerminal(id),
-    bundleId: sanitizeForTerminal(bundleId),
+    pluginId: sanitizeForTerminal(pluginId),
     extId: sanitizeForTerminal(extId),
     hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdNotFoundHint)
   });
@@ -20101,18 +20443,18 @@ function renderPluginDetailFields(match) {
 function collectPluginExtensionItems(match, ansi) {
   const enabled = match.status === "enabled";
   if (!enabled || !match.extensions) return [];
-  const safeBundleId = sanitizeForTerminal(match.id);
+  const safePluginId = sanitizeForTerminal(match.id);
   const sorted = sortExtensionsCanonical(match.extensions);
   return sorted.map((ext) => {
     const safeExtId = sanitizeForTerminal(ext.id);
     return {
       // User plugins surfaced via `loadAll` already filter on the
       // resolver, so a reachable extension on this surface is enabled
-      // by construction. The disabled path goes through the bundle
+      // by construction. The disabled path goes through the plugin
       // status header above (✕ on the row).
       glyph: ansi.green(PLUGINS_TEXTS.rowGlyphOk),
       kind: sanitizeForTerminal(ext.kind),
-      name: `${safeBundleId}/${safeExtId}`,
+      name: `${safePluginId}/${safeExtId}`,
       version: sanitizeForTerminal(ext.version)
     };
   });
@@ -20138,11 +20480,11 @@ function renderExtensionItems(items) {
   }
   return out.join("");
 }
-function renderBuiltInExtensionDetail(bundleId, ext, ansi) {
+function renderBuiltInExtensionDetail(pluginId, ext, ansi) {
   const glyph = ext.enabled ? ansi.green(PLUGINS_TEXTS.rowGlyphOk) : ansi.red(PLUGINS_TEXTS.rowGlyphOff);
   const header = tx(PLUGINS_TEXTS.detailHeaderExtensionBuiltIn, {
     glyph,
-    qualifiedId: sanitizeForTerminal(`${bundleId}/${ext.id}`),
+    qualifiedId: sanitizeForTerminal(`${pluginId}/${ext.id}`),
     source: ansi.dim(PLUGINS_TEXTS.sourceBuiltIn)
   });
   const meta = { kind: ext.kind };
@@ -20150,11 +20492,11 @@ function renderBuiltInExtensionDetail(bundleId, ext, ansi) {
   if (ext.entry !== void 0) meta.entry = ext.entry;
   return header + "\n" + renderExtensionFields(meta);
 }
-function renderUserExtensionDetail(bundleId, ext, ansi) {
+function renderUserExtensionDetail(pluginId, ext, ansi) {
   const glyph = ansi.green(PLUGINS_TEXTS.rowGlyphOk);
   const header = tx(PLUGINS_TEXTS.detailHeaderExtensionUser, {
     glyph,
-    qualifiedId: sanitizeForTerminal(`${bundleId}/${ext.id}`),
+    qualifiedId: sanitizeForTerminal(`${pluginId}/${ext.id}`),
     source: ansi.dim(PLUGINS_TEXTS.sourceUser)
   });
   const meta = readInstanceMeta(ext.instance);
@@ -20408,13 +20750,13 @@ function forEachProviderInstance(plugins, callback) {
   forEachUserPluginProvider(plugins, callback);
 }
 function forEachBuiltInProvider(callback) {
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
       if (ext.kind !== "provider") continue;
       const provider = ext;
       callback({
         id: provider.id,
-        pluginId: bundle.id,
+        pluginId: plugin.id,
         instance: provider
       });
     }
@@ -20457,15 +20799,15 @@ function collectApplicableKindWarnings(plugins, knownKinds) {
   return out;
 }
 function collectBuiltInApplicableKindWarnings(out, knownKinds) {
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
       if (ext.kind !== "extractor") continue;
       const extractor = ext;
       const kinds = extractor.precondition?.kind;
       if (!kinds || kinds.length === 0) continue;
       appendUnknownKindWarnings(
         out,
-        qualifiedExtensionId(bundle.id, extractor.id),
+        qualifiedExtensionId(plugin.id, extractor.id),
         kinds,
         knownKinds
       );
@@ -20508,11 +20850,11 @@ function collectUnknownSlotWarnings(plugins, knownSlots) {
   return out;
 }
 function collectBuiltInUnknownSlotWarnings(out, knownSlots) {
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
       const vc = ext.viewContributions;
       if (!vc) continue;
-      appendUnknownSlotWarnings(out, qualifiedExtensionId(bundle.id, ext.id), vc, knownSlots);
+      appendUnknownSlotWarnings(out, qualifiedExtensionId(plugin.id, ext.id), vc, knownSlots);
     }
   }
 }
@@ -20594,7 +20936,7 @@ import { Command as Command25, Option as Option24 } from "clipanion";
 var TogglePluginsBase = class extends SmCommand {
   all = Option24.Boolean("--all", false);
   yes = Option24.Boolean("--yes,-y", false, {
-    description: "Skip the interactive confirm when a bare bundle id (or --all) fans the toggle out across multiple extensions."
+    description: "Skip the interactive confirm when a bare plugin id (or --all) fans the toggle out across multiple extensions."
   });
   ids = Option24.Rest({ name: "ids" });
   async toggle(enabled) {
@@ -20603,7 +20945,7 @@ var TogglePluginsBase = class extends SmCommand {
     const argError = this.#validateArgs(stderrAnsi, verb);
     if (argError !== null) return argError;
     const plugins = await loadAll({ pluginDir: void 0 });
-    const catalogue = bundleCatalogue(plugins);
+    const catalogue = pluginCatalogue(plugins);
     const targetsResult = this.#pickTargets(catalogue, stderrAnsi);
     if (typeof targetsResult === "number") return targetsResult;
     let targets = targetsResult;
@@ -20661,7 +21003,7 @@ var TogglePluginsBase = class extends SmCommand {
     if (this.all) {
       return catalogue.map((b) => ({
         origin: "bare",
-        bundleId: b.id,
+        pluginId: b.id,
         keys: b.extensionIds.map((extId) => qualifiedExtensionId(b.id, extId))
       }));
     }
@@ -20682,8 +21024,8 @@ var TogglePluginsBase = class extends SmCommand {
   }
   /**
    * Macro gate: when the request would fan a single user input out
-   * across more than one extension (either `--all` or a bare bundle
-   * id whose bundle holds ≥2 extensions), confirm the intent.
+   * across more than one extension (either `--all` or a bare plugin
+   * id whose plugin holds ≥2 extensions), confirm the intent.
    *
    * Resolution order:
    *   1. `--yes` flag: skip the prompt entirely.
@@ -20692,7 +21034,7 @@ var TogglePluginsBase = class extends SmCommand {
    *      message that names the extensions and points at `--yes`.
    *
    * Returns `true` when the verb should proceed, `false` when it
-   * should abort. Single-extension targets (bare bundle id mapping to
+   * should abort. Single-extension targets (bare plugin id mapping to
    * one child, or qualified ids) skip the gate uniformly.
    */
   // Cyclomatic count comes from the three-stage gate (--yes shortcut,
@@ -20706,11 +21048,11 @@ var TogglePluginsBase = class extends SmCommand {
     if (this.yes) return true;
     const isTty = Boolean(this.context.stdin && "isTTY" in this.context.stdin && this.context.stdin.isTTY);
     for (const target of macroTargets) {
-      const bundleLabel = target.origin === "bare" ? target.bundleId ?? "--all" : "--all";
+      const pluginLabel = target.origin === "bare" ? target.pluginId ?? "--all" : "--all";
       this.printer.info(
         tx(PLUGINS_TEXTS.bundleMacroHeader, {
           verb,
-          bundleId: sanitizeForTerminal(bundleLabel),
+          pluginId: sanitizeForTerminal(pluginLabel),
           count: target.keys.length
         })
       );
@@ -20766,7 +21108,7 @@ var TogglePluginsBase = class extends SmCommand {
    * Persist every qualified id in `config_plugins`. On disable, also
    * purge the plugin's `scan_contributions` rows immediately (matches
    * the BFF route, see `server/routes/plugins.ts:applyChangeToAdapter`).
-   * Every key is `<bundle>/<ext>` shape so the contribution purge can
+   * Every key is `<plugin>/<ext>` shape so the contribution purge can
    * split into `(pluginId, extensionId)` cleanly.
    */
   async #persistKeys(keys, enabled) {
@@ -20829,11 +21171,11 @@ var PluginsEnableCommand = class extends TogglePluginsBase {
       flip; sm config reset plugins.<id>.enabled drops the settings.json
       baseline.
 
-      Accepts qualified ids (\`claude/at-directive\`) and bare bundle
+      Accepts qualified ids (\`claude/at-directive\`) and bare plugin
       ids (\`claude\`, which fans the toggle out across every extension
-      inside the bundle). Multi-extension bundles need --yes (or an
+      inside the plugin). Multi-extension plugins need --yes (or an
       interactive TTY confirm) to avoid flipping 27 core extensions by
-      accident. Single-extension bundles (openai, agent-skills,
+      accident. Single-extension plugins (openai, agent-skills,
       antigravity) apply without prompting.
 
       Batches are all-or-nothing: a single unknown id aborts before
@@ -20856,11 +21198,11 @@ var PluginsDisableCommand = class extends TogglePluginsBase {
       sm plugins list, but with status=disabled; the kernel will not
       run any of its disabled extensions.
 
-      Accepts qualified ids (\`core/markdown-link\`) and bare bundle
+      Accepts qualified ids (\`core/markdown-link\`) and bare plugin
       ids (\`core\`, which fans the toggle out across every extension
-      inside the bundle). Multi-extension bundles need --yes (or an
+      inside the plugin). Multi-extension plugins need --yes (or an
       interactive TTY confirm) to avoid flipping 27 core extensions by
-      accident. Single-extension bundles (openai, agent-skills,
+      accident. Single-extension plugins (openai, agent-skills,
       antigravity) apply without prompting.
 
       Batches are all-or-nothing: a single unknown id aborts before
@@ -20872,12 +21214,12 @@ var PluginsDisableCommand = class extends TogglePluginsBase {
     return this.toggle(false);
   }
 };
-function bundleCatalogue(plugins) {
+function pluginCatalogue(plugins) {
   const out = [];
-  for (const bundle of builtInBundles) {
+  for (const plugin of builtInPlugins) {
     out.push({
-      id: bundle.id,
-      extensionIds: bundle.extensions.map((e) => e.id)
+      id: plugin.id,
+      extensionIds: plugin.extensions.map((e) => e.id)
     });
   }
   for (const p of plugins) {
@@ -20893,32 +21235,32 @@ function resolveToggleTarget(id, catalogue, ansi) {
 }
 function resolveQualifiedToggle(id, catalogue, ansi) {
   const errGlyph = ansi.red("\u2715");
-  const [bundleId, extId, ...rest] = id.split("/");
-  if (!bundleId || !extId || rest.length > 0) {
+  const [pluginId, extId, ...rest] = id.split("/");
+  if (!pluginId || !extId || rest.length > 0) {
     return {
-      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownBundle, {
+      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
         glyph: errGlyph,
-        bundleId: sanitizeForTerminal(id),
-        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownBundleHint)
+        pluginId: sanitizeForTerminal(id),
+        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
       })
     };
   }
-  const bundle = catalogue.find((b) => b.id === bundleId);
-  if (!bundle) {
+  const plugin = catalogue.find((b) => b.id === pluginId);
+  if (!plugin) {
     return {
-      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownBundle, {
+      error: tx(PLUGINS_TEXTS.qualifiedIdUnknownPlugin, {
         glyph: errGlyph,
-        bundleId: sanitizeForTerminal(bundleId),
-        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownBundleHint)
+        pluginId: sanitizeForTerminal(pluginId),
+        hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdUnknownPluginHint)
       })
     };
   }
-  if (!bundle.extensionIds.includes(extId)) {
+  if (!plugin.extensionIds.includes(extId)) {
     return {
       error: tx(PLUGINS_TEXTS.qualifiedIdNotFound, {
         glyph: errGlyph,
         id: sanitizeForTerminal(id),
-        bundleId: sanitizeForTerminal(bundleId),
+        pluginId: sanitizeForTerminal(pluginId),
         extId: sanitizeForTerminal(extId),
         hint: ansi.dim(PLUGINS_TEXTS.qualifiedIdNotFoundHint)
       })
@@ -20926,12 +21268,12 @@ function resolveQualifiedToggle(id, catalogue, ansi) {
   }
   return {
     origin: "qualified",
-    keys: [qualifiedExtensionId(bundleId, extId)]
+    keys: [qualifiedExtensionId(pluginId, extId)]
   };
 }
 function resolveBareToggle(id, catalogue) {
-  const bundle = catalogue.find((b) => b.id === id);
-  if (!bundle) {
+  const plugin = catalogue.find((b) => b.id === id);
+  if (!plugin) {
     return {
       error: tx(PLUGINS_TEXTS.pluginNotFound, {
         glyph: "\u2715",
@@ -20942,13 +21284,13 @@ function resolveBareToggle(id, catalogue) {
   }
   return {
     origin: "bare",
-    bundleId: bundle.id,
-    keys: bundle.extensionIds.map((extId) => qualifiedExtensionId(bundle.id, extId))
+    pluginId: plugin.id,
+    keys: plugin.extensionIds.map((extId) => qualifiedExtensionId(plugin.id, extId))
   };
 }
 
 // cli/commands/plugins/create.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync5, writeFileSync } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync5, writeFileSync } from "fs";
 import { join as join18, resolve as resolve33 } from "path";
 import { Command as Command26, Option as Option25 } from "clipanion";
 var PluginsCreateCommand = class extends SmCommand {
@@ -20977,7 +21319,7 @@ var PluginsCreateCommand = class extends SmCommand {
     const ctx = defaultRuntimeContext();
     const baseDir = defaultProjectPluginsDir(ctx);
     const targetDir = this.at ? resolve33(this.at) : join18(baseDir, this.pluginId);
-    if (existsSync24(targetDir) && !this.force) {
+    if (existsSync25(targetDir) && !this.force) {
       this.printer.error(
         tx(PLUGINS_TEXTS.createRefuseOverwrite, {
           glyph: errGlyph,
@@ -20991,20 +21333,10 @@ var PluginsCreateCommand = class extends SmCommand {
     mkdirSync5(join18(targetDir, "extractors", extractorName), { recursive: true });
     const specVersion = installedSpecVersion();
     const manifest = {
-      id: this.pluginId,
       version: "0.1.0",
       specCompat: `^${specVersion}`,
       catalogCompat: "^1.0.0",
-      description: "Generated by `sm plugins create`. Edit to taste.",
-      settings: {
-        keywords: {
-          type: "string-list",
-          label: "Keywords to track",
-          description: "Words counted across each scanned node body.",
-          default: ["TODO", "FIXME"],
-          min: 1
-        }
-      }
+      description: "Generated by `sm plugins create`. Edit to taste."
     };
     writeFileSync(
       join18(targetDir, "plugin.json"),
@@ -21029,36 +21361,44 @@ function scaffolderExtractorStub(extractorId) {
  * Generated by \`sm plugins create\`. Edit the extract() body.
  *
  * Loader contract: the plugin loader resolves the extension via the
- * MODULE'S DEFAULT EXPORT (\`export default { ... }\`). Renaming or
- * splitting into a named export will surface as \`load-error: default
- * export missing a string \\\`kind\\\` field\`.
+ * MODULE'S DEFAULT EXPORT (\`export default { ... }\`). It must be an
+ * object literal; renaming or splitting into a named export surfaces as
+ * a \`load-error\`.
  *
  * Folder convention: this file lives at
- * \`extractors/${extractorId}/index.js\`. The bundle's plugin.json#/id
- * provides the qualified id \`<plugin-id>/${extractorId}\`; the loader
- * injects \`pluginId\` automatically, do NOT hardcode it here.
+ * \`extractors/${extractorId}/index.js\`. The folder layout is the
+ * source of truth (structure-as-truth): the loader derives \`kind\`
+ * (\`extractor\`) from the parent folder and the id (\`${extractorId}\`)
+ * from the leaf folder, and injects \`pluginId\` from the plugin, so none
+ * of them are declared here. Re-declaring \`kind\` / \`id\` is rejected as
+ * \`invalid-manifest\`.
  *
- * Declared view contributions (in plugin.json):
+ * Declared view contributions (\`ui\`):
  *   - 'count' \u2192 slot \`card.footer.left\` (renders as a chip
  *     in the left footer of the node card)
  *
- * Declared settings:
+ * Declared settings (\`settings\`):
  *   - 'keywords' (string-list) \u2192 exposed as ctx.settings.keywords
  *
  * See: spec/plugin-author-guide.md \xA7View contributions
  *      spec/view-slots.md
  */
 export default {
-  id: '${extractorId}',
-  kind: 'extractor',
   version: '0.1.0',
   description: 'Counts configured keywords per node.',
-  stability: 'experimental',
-  emitsLinkKinds: [],
-  defaultConfidence: 'high',
   scope: 'body',
 
-  viewContributions: {
+  settings: {
+    keywords: {
+      type: 'string-list',
+      label: 'Keywords to track',
+      description: 'Words counted across each scanned node body.',
+      default: ['TODO', 'FIXME'],
+      min: 1,
+    },
+  },
+
+  ui: {
     count: {
       slot: 'card.footer.left',
       icon: '\u{1F50D}',
@@ -21084,7 +21424,7 @@ export default {
 function scaffolderReadme(pluginId) {
   return `# ${pluginId}
 
-Generated by \`sm plugins create\`. Edit \`extensions/extractor.js\` to taste.
+Generated by \`sm plugins create\`. Edit \`extractors/${pluginId}-extractor/index.js\` to taste.
 
 ## Verbs
 
@@ -21604,6 +21944,31 @@ var IntentionalFailCommand = class extends SmCommand {
 // cli/commands/scan.ts
 import { Command as Command31, Option as Option29 } from "clipanion";
 
+// kernel/util/format-bytes.ts
+var UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB"];
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes <= 0) return "0 B";
+  if (bytes < 1024) return `${Math.round(bytes)} B`;
+  let value = bytes;
+  let unitIndex = 0;
+  while (value >= 1024 && unitIndex < UNITS.length - 1) {
+    value /= 1024;
+    unitIndex += 1;
+  }
+  const rounded = Math.round(value * 10) / 10;
+  const text = Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+  return `${text} ${UNITS[unitIndex]}`;
+}
+
+// kernel/util/format-oversized.ts
+function formatOversizedFilePair(file) {
+  return `${file.path} (${formatBytes(file.bytes)})`;
+}
+function formatOversizedFileRows(files) {
+  return files.map((file) => `     - ${formatOversizedFilePair(file)}
+`);
+}
+
 // cli/i18n/scan.texts.ts
 var SCAN_TEXTS = {
   // --- scan command ----------------------------------------------------
@@ -21651,6 +22016,20 @@ var SCAN_TEXTS = {
    */
   scanCappedNotice: "{{glyph}}  Scan capped at {{limit}} nodes ({{source}}).\n     {{hint}}\n",
   scanCappedNoticeHint: "Trim .skillmapignore to exclude noisy paths (preferred), or re-run with --max-nodes <N> to raise the cap. Past the recommended limit the graph is hard to read and analyzer signal drops.",
+  /**
+   * File-size skip notice, printed (WARN, stderr) when the walker
+   * skipped one or more files for exceeding `scan.maxFileSizeBytes`.
+   * `{{glyph}}` is the yellow warning glyph, `{{count}}`/`{{noun}}` the
+   * skipped-file tally, `{{files}}` the pre-rendered list of
+   * `path (size)` rows, `{{hint}}` the dim escape-route line.
+   */
+  scanSkippedFilesNotice: "{{glyph}}  Skipped {{count}} {{noun}} over the size limit (scan.maxFileSizeBytes):\n{{files}}     {{hint}}\n",
+  // The per-file `     - path (size)\n` rows that fill `{{files}}` are
+  // rendered by `kernel/util/format-oversized.ts:formatOversizedFileRows`,
+  // shared with `sm watch` / `sm serve` so the three surfaces never drift.
+  scanSkippedFileNounSingular: "file",
+  scanSkippedFileNounPlural: "files",
+  scanSkippedFilesNoticeHint: "Raise scan.maxFileSizeBytes to include these, or add them to .skillmapignore to skip them on purpose.",
   /**
    * Validation message for an invalid `--max-nodes` value. Surfaced as a
    * §3.1b two-line block.
@@ -21825,11 +22204,13 @@ function createWatcherRuntime(opts) {
       const runOptions = {
         roots: opts.roots,
         tokenize,
+        tokenizer: cfg.tokenizer,
         ignoreFilter,
         strict,
         emitter,
         recommendedNodeLimit: cfg.scan.maxNodes,
-        overrideMaxNodes: opts.maxNodesOverride ?? null
+        overrideMaxNodes: opts.maxNodesOverride ?? null,
+        maxFileSizeBytes: cfg.scan.maxFileSizeBytes
       };
       if (cfg.scan.referencePaths.length > 0) {
         const walk3 = walkReferencePaths(cfg.scan.referencePaths, cwd);
@@ -22047,7 +22428,20 @@ var WATCH_TEXTS = {
    * §3.1b two-line block. Validation rejection for `--max-nodes`.
    */
   maxNodesInvalid: "{{glyph}}  sm watch: --max-nodes must be an integer >= 1 (got {{raw}}).\n   {{hint}}\n",
-  maxNodesInvalidHint: "Pass a positive integer, e.g. --max-nodes 256."
+  maxNodesInvalidHint: "Pass a positive integer, e.g. --max-nodes 256.",
+  /**
+   * File-size skip WARN, emitted per batch (stderr) when the walker
+   * skipped one or more files for exceeding `scan.maxFileSizeBytes`.
+   * Mirrors `sm scan`'s notice. `{{files}}` is the pre-rendered list of
+   * `path (size)` rows.
+   */
+  skippedFilesNotice: "{{glyph}}  Skipped {{count}} {{noun}} over the size limit (scan.maxFileSizeBytes):\n{{files}}     {{hint}}\n",
+  // The per-file `     - path (size)\n` rows that fill `{{files}}` are
+  // rendered by `kernel/util/format-oversized.ts:formatOversizedFileRows`,
+  // shared with `sm scan` / `sm serve` so the three surfaces never drift.
+  skippedFileNounSingular: "file",
+  skippedFileNounPlural: "files",
+  skippedFilesNoticeHint: "Raise scan.maxFileSizeBytes to include these, or add them to .skillmapignore to skip them on purpose."
 };
 
 // cli/commands/watch.ts
@@ -22088,6 +22482,21 @@ async function runWatchLoop(opts) {
         })
       );
     }
+    renderOversizedWarning(result);
+  };
+  const renderOversizedWarning = (result) => {
+    const oversized = result.oversizedFiles ?? [];
+    if ((result.stats.filesOversized ?? oversized.length) <= 0) return;
+    const files = formatOversizedFileRows(oversized).join("");
+    context.stderr.write(
+      tx(WATCH_TEXTS.skippedFilesNotice, {
+        glyph: stderrAnsi.yellow("\u26A0"),
+        count: oversized.length,
+        noun: oversized.length === 1 ? WATCH_TEXTS.skippedFileNounSingular : WATCH_TEXTS.skippedFileNounPlural,
+        files,
+        hint: stderrAnsi.dim(WATCH_TEXTS.skippedFilesNoticeHint)
+      })
+    );
   };
   const runtimeOpts = {
     dbPath,
@@ -22414,7 +22823,13 @@ var ScanCommand = class extends SmCommand {
     });
     if (outcome.kind === "ok") {
       setScanExtensions(buildScanExtensionSet(outcome.executedExtensionIds));
-      return this.renderOutcome(outcome.result, outcome.persistedTo, outcome.dbPath, outcome.strict);
+      return this.renderOutcome(
+        outcome.result,
+        outcome.persistedTo,
+        outcome.dbPath,
+        outcome.strict,
+        outcome.lensAutoDetected
+      );
     }
     return this.renderFailure(outcome);
   }
@@ -22523,12 +22938,13 @@ var ScanCommand = class extends SmCommand {
    * the exit code. Exit 1 only when at least one issue is at `error`
    * severity (mirrors `sm check`, per spec § Exit codes).
    */
-  renderOutcome(result, persistedTo, dbPath, strict) {
+  renderOutcome(result, persistedTo, dbPath, strict, lensAutoDetected) {
     const exitCode2 = result.issues.some((i) => i.severity === "error") ? ExitCode.Issues : ExitCode.Ok;
     if (this.json) {
       return this.#renderJsonOutcome(result, exitCode2, strict);
     }
     const ansi = this.ansiFor("stdout");
+    this.#announceAutoDetectedLens(lensAutoDetected);
     const cwd = defaultRuntimeContext().cwd;
     const hasErrors = exitCode2 === ExitCode.Issues;
     const severityCounts = countBySeverity(result.issues);
@@ -22558,8 +22974,32 @@ var ScanCommand = class extends SmCommand {
       );
     }
     this.maybePrintCapNotice(result, ansi);
+    this.maybePrintSkippedFilesNotice(result, ansi);
     return exitCode2;
   }
+  /**
+   * Surface a WARN when the walker skipped one or more files for
+   * exceeding `scan.maxFileSizeBytes`. Lists every skipped file as
+   * `path (humanSize)` and points the user at the two levers
+   * (`scan.maxFileSizeBytes` to raise the limit, `.skillmapignore` to
+   * exclude the path). Routed through `printer.warn` (stderr) because a
+   * silently dropped file is degraded state the operator should read,
+   * not a mid-flight progress line.
+   */
+  maybePrintSkippedFilesNotice(result, ansi) {
+    const oversized = result.oversizedFiles ?? [];
+    if ((result.stats.filesOversized ?? oversized.length) <= 0) return;
+    const lines = formatOversizedFileRows(oversized).join("");
+    this.printer.warn(
+      tx(SCAN_TEXTS.scanSkippedFilesNotice, {
+        glyph: ansi.yellow("\u26A0"),
+        count: String(oversized.length),
+        noun: oversized.length === 1 ? SCAN_TEXTS.scanSkippedFileNounSingular : SCAN_TEXTS.scanSkippedFileNounPlural,
+        files: lines,
+        hint: ansi.dim(SCAN_TEXTS.scanSkippedFilesNoticeHint)
+      })
+    );
+  }
   /**
    * Surface the §Node cap notice when the walker actually stopped
    * accepting files because of the cap. Derivation: `filesWalked >
@@ -22583,6 +23023,21 @@ var ScanCommand = class extends SmCommand {
       })
     );
   }
+  /**
+   * Print the lens auto-detect line on stdout (the SAME stream as the
+   * scan summary) so the two never interleave on a tty. The bootstrap
+   * deliberately no longer prints this to stderr; the runner threads
+   * `lensAutoDetected` through so the CLI announces it here, in order,
+   * right before the summary. The text ends in a newline, so the
+   * summary lands cleanly on its own line. No-op when the lens came
+   * from config or no marker matched (`null` / `undefined`).
+   */
+  #announceAutoDetectedLens(lensAutoDetected) {
+    if (!lensAutoDetected) return;
+    this.printer.data(
+      tx(SCAN_RUNNER_TEXTS.activeProviderAutodetected, { id: lensAutoDetected })
+    );
+  }
   /**
    * `--json` output path. Under `--strict` (H4) self-validates the
    * ScanResult against `scan-result.schema.json` before emitting it,
@@ -22900,7 +23355,7 @@ function renderDeltaIssues(issues) {
 
 // cli/commands/serve.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 import { Command as Command33, Option as Option31 } from "clipanion";
 
 // kernel/util/dev-mode.ts
@@ -23055,6 +23510,12 @@ var SERVER_TEXTS = {
   // watcher loop continues, a transient FS error must not kill the
   // broadcaster.
   watcherBatchFailed: "skill-map server: watcher batch failed ({{message}}).\n",
+  // Logged on the server pane when a scan batch (initial or follow-up)
+  // skipped one or more files for exceeding `scan.maxFileSizeBytes`.
+  // `{{files}}` is the comma-separated `path (size)` list. The SPA
+  // raises its own banner from the persisted `oversizedFiles`, so this
+  // is log-only (no WS advisory).
+  watcherFilesOversized: "skill-map server: skipped {{count}} file(s) over the size limit (scan.maxFileSizeBytes): {{files}}. Raise the limit or add them to .skillmapignore.\n",
   // Logged once when the pre-1.0 schema-drift check rebuilt the DB on
   // watcher boot (the on-disk cache was written by a different
   // major.minor). The scan that follows repopulates it; .sm sidecars
@@ -23140,19 +23601,19 @@ var SERVER_TEXTS = {
   // 400, cascade route rejects qualified ids: the bare-id PATCH is the
   // bundle macro endpoint. Anything containing `/` needs the dedicated
   // per-extension route below.
-  pluginsCascadeRouteQualifiedRejected: 'Plugin id "{{id}}" contains "/"; toggle individual extensions via PATCH /api/plugins/<bundle>/extensions/<extensionId>.',
+  pluginsCascadeRouteQualifiedRejected: 'Plugin id "{{id}}" contains "/"; toggle individual extensions via PATCH /api/plugins/<plugin>/extensions/<extensionId>.',
   // 404, unknown plugin / extension.
   pluginsUnknown: 'No plugin with id "{{id}}".',
-  pluginsExtensionUnknown: 'Plugin "{{bundleId}}" has no extension named "{{extensionId}}".',
+  pluginsExtensionUnknown: 'Plugin "{{pluginId}}" has no extension named "{{extensionId}}".',
   // 500, DB missing on a write path. Read paths degrade to empty
   // shapes, but mutations cannot persist without a DB so they fail fast.
   pluginsDbMissing: "Cannot persist plugin override: project DB not found at {{path}}. Run `sm scan` first or pass --db <path>.",
   // 403, host-enforced lock from `src/server/locked-plugins.ts`. The
-  // bundle (or qualified extension) is in the hardcoded lock-list and
+  // plugin (or qualified extension) is in the hardcoded lock-list and
   // its enabled state is fixed; the UI mirrors the same rule by
   // disabling the toggle.
   pluginsLocked: 'Plugin "{{id}}" is locked by the host and cannot be toggled.',
-  pluginsExtensionLocked: 'Extension "{{bundleId}}/{{extensionId}}" is locked by the host and cannot be toggled.',
+  pluginsExtensionLocked: 'Extension "{{pluginId}}/{{extensionId}}" is locked by the host and cannot be toggled.',
   // 400 envelopes specific to the bulk `PATCH /api/plugins` endpoint.
   // The single-id variants above still apply for per-entry validation
   // (unknown id, granularity mismatch, lock); these cover the
@@ -23691,7 +24152,7 @@ function contentTypeFor(format) {
 }
 
 // server/health.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 var FALLBACK_SCHEMA_VERSION = "1";
 function buildHealth(deps) {
   const dev = isDevBuild();
@@ -23700,7 +24161,7 @@ function buildHealth(deps) {
     schemaVersion: FALLBACK_SCHEMA_VERSION,
     specVersion: deps.specVersion,
     implVersion: VERSION,
-    db: existsSync25(deps.dbPath) ? "present" : "missing",
+    db: existsSync26(deps.dbPath) ? "present" : "missing",
     cwd: deps.cwd,
     dbPath: deps.dbPath,
     // Only emit when truthy so a published install keeps the wire
@@ -24219,28 +24680,28 @@ function registerPluginsRoute(app, deps) {
       });
     }
     const body = await parsePatchBody(c.req.raw);
-    const childIds = bundleExtensionIds(handle).map((extId) => qualifiedExtensionId(id, extId));
+    const childIds = pluginExtensionIds(handle).map((extId) => qualifiedExtensionId(id, extId));
     const writable = childIds.filter((q) => !isPluginLocked(q));
     return await persistManyAndProject(c, deps, writable, body.enabled);
   });
-  app.patch("/api/plugins/:bundleId/extensions/:extensionId", async (c) => {
-    const bundleId = c.req.param("bundleId");
+  app.patch("/api/plugins/:pluginId/extensions/:extensionId", async (c) => {
+    const pluginId = c.req.param("pluginId");
     const extensionId = c.req.param("extensionId");
-    const handle = findHandle(bundleId, deps);
+    const handle = findHandle(pluginId, deps);
     if (!handle) {
       throw new HTTPException9(404, {
-        message: tx(SERVER_TEXTS.pluginsUnknown, { id: bundleId })
+        message: tx(SERVER_TEXTS.pluginsUnknown, { id: pluginId })
       });
     }
     if (!hasExtension(handle, extensionId)) {
       throw new HTTPException9(404, {
-        message: tx(SERVER_TEXTS.pluginsExtensionUnknown, { bundleId, extensionId })
+        message: tx(SERVER_TEXTS.pluginsExtensionUnknown, { pluginId, extensionId })
       });
     }
-    const qualified = qualifiedExtensionId(bundleId, extensionId);
-    if (isPluginLocked(qualified) || isPluginLocked(bundleId)) {
+    const qualified = qualifiedExtensionId(pluginId, extensionId);
+    if (isPluginLocked(qualified) || isPluginLocked(pluginId)) {
       throw new HTTPException9(403, {
-        message: tx(SERVER_TEXTS.pluginsExtensionLocked, { bundleId, extensionId })
+        message: tx(SERVER_TEXTS.pluginsExtensionLocked, { pluginId, extensionId })
       });
     }
     const body = await parsePatchBody(c.req.raw);
@@ -24269,11 +24730,11 @@ function listItems(deps, resolveEnabled) {
   ];
 }
 function buildBuiltInItems(resolveEnabled) {
-  return sortBundlesForPresentation(builtInBundles).map((bundle) => {
-    const bundleLocked = isPluginLocked(bundle.id);
-    const extensions = bundle.extensions.map((ext) => {
-      const qualified = qualifiedExtensionId(bundle.id, ext.id);
-      const extLocked = bundleLocked || isPluginLocked(qualified);
+  return sortPluginsForPresentation(builtInPlugins).map((plugin) => {
+    const pluginLocked = isPluginLocked(plugin.id);
+    const extensions = plugin.extensions.map((ext) => {
+      const qualified = qualifiedExtensionId(plugin.id, ext.id);
+      const extLocked = pluginLocked || isPluginLocked(qualified);
       return {
         id: ext.id,
         kind: ext.kind,
@@ -24283,17 +24744,17 @@ function buildBuiltInItems(resolveEnabled) {
         ...extLocked ? { locked: true } : {}
       };
     });
-    const bundleEnabled = extensions.some((e) => e.enabled);
+    const pluginEnabled = extensions.some((e) => e.enabled);
     return {
-      id: bundle.id,
-      version: firstVersion(bundle.extensions),
-      kinds: uniqueKinds(bundle.extensions.map((e) => e.kind)),
-      status: bundleEnabled ? "enabled" : "disabled",
+      id: plugin.id,
+      version: firstVersion(plugin.extensions),
+      kinds: uniqueKinds(plugin.extensions.map((e) => e.kind)),
+      status: pluginEnabled ? "enabled" : "disabled",
       reason: null,
       source: "built-in",
-      description: bundle.description,
+      description: plugin.description,
       ...extensions.length > 0 ? { extensions } : {},
-      ...bundleLocked ? { locked: true } : {}
+      ...pluginLocked ? { locked: true } : {}
     };
   });
 }
@@ -24301,8 +24762,8 @@ function buildDiscoveredItems(discovered, deps, resolveEnabled) {
   return discovered.map((plugin) => buildDiscoveredItem(plugin, deps, resolveEnabled));
 }
 function buildDiscoveredItem(plugin, deps, resolveEnabled) {
-  const bundleLocked = isPluginLocked(plugin.id);
-  const extensions = projectExtensionRows(plugin, resolveEnabled, bundleLocked);
+  const pluginLocked = isPluginLocked(plugin.id);
+  const extensions = projectExtensionRows(plugin, resolveEnabled, pluginLocked);
   const optional = optionalDiscoveredFields(plugin, extensions);
   return {
     id: plugin.id,
@@ -24312,7 +24773,7 @@ function buildDiscoveredItem(plugin, deps, resolveEnabled) {
     reason: plugin.reason ?? null,
     source: classifyPluginSource(plugin.path, deps),
     ...optional,
-    ...bundleLocked ? { locked: true } : {},
+    ...pluginLocked ? { locked: true } : {},
     ...plugin.status === "disabled" ? { startsAsDisabled: true } : {}
   };
 }
@@ -24323,12 +24784,12 @@ function optionalDiscoveredFields(plugin, extensions) {
   if (extensions) out.extensions = extensions;
   return out;
 }
-function projectExtensionRows(plugin, resolveEnabled, bundleLocked) {
+function projectExtensionRows(plugin, resolveEnabled, pluginLocked) {
   if (!plugin.extensions || plugin.extensions.length === 0) return void 0;
   return plugin.extensions.map((ext) => {
     const description = readInstanceDescription(ext.instance);
     const qualified = qualifiedExtensionId(plugin.id, ext.id);
-    const extLocked = bundleLocked || isPluginLocked(qualified);
+    const extLocked = pluginLocked || isPluginLocked(qualified);
     return {
       id: ext.id,
       kind: ext.kind,
@@ -24437,28 +24898,28 @@ function validateBulkChange(change, deps) {
     }
     return null;
   }
-  const bundleId = change.id.slice(0, slash);
+  const pluginId = change.id.slice(0, slash);
   const extensionId = change.id.slice(slash + 1);
-  const handle = findHandle(bundleId, deps);
+  const handle = findHandle(pluginId, deps);
   if (!handle) {
     return {
       status: 404,
       code: "not-found",
-      message: tx(SERVER_TEXTS.pluginsUnknown, { id: bundleId })
+      message: tx(SERVER_TEXTS.pluginsUnknown, { id: pluginId })
     };
   }
   if (!hasExtension(handle, extensionId)) {
     return {
       status: 404,
       code: "not-found",
-      message: tx(SERVER_TEXTS.pluginsExtensionUnknown, { bundleId, extensionId })
+      message: tx(SERVER_TEXTS.pluginsExtensionUnknown, { pluginId, extensionId })
     };
   }
-  if (isPluginLocked(change.id) || isPluginLocked(bundleId)) {
+  if (isPluginLocked(change.id) || isPluginLocked(pluginId)) {
     return {
       status: 403,
       code: "locked",
-      message: tx(SERVER_TEXTS.pluginsExtensionLocked, { bundleId, extensionId })
+      message: tx(SERVER_TEXTS.pluginsExtensionLocked, { pluginId, extensionId })
     };
   }
   return null;
@@ -24482,7 +24943,7 @@ function expandBulkChangeKeys(change, deps) {
   if (change.id.includes("/")) return [change.id];
   const handle = findHandle(change.id, deps);
   if (!handle) return [];
-  return bundleExtensionIds(handle).map((extId) => qualifiedExtensionId(change.id, extId)).filter((q) => !isPluginLocked(q));
+  return pluginExtensionIds(handle).map((extId) => qualifiedExtensionId(change.id, extId)).filter((q) => !isPluginLocked(q));
 }
 async function buildFreshResolver2(deps) {
   return buildFreshResolver({
@@ -24495,21 +24956,21 @@ function composeResolver2(deps, overrides) {
   return composeResolver(deps.configService.effective(), overrides);
 }
 function findHandle(id, deps) {
-  const builtIn = builtInBundles.find((b) => b.id === id);
-  if (builtIn) return { kind: "built-in", bundle: builtIn };
+  const builtIn = builtInPlugins.find((b) => b.id === id);
+  if (builtIn) return { kind: "built-in", plugin: builtIn };
   const discovered = deps.pluginRuntime.discovered.find((p) => p.id === id);
   if (discovered) return { kind: "discovered", plugin: discovered };
   return null;
 }
-function bundleExtensionIds(handle) {
+function pluginExtensionIds(handle) {
   if (handle.kind === "built-in") {
-    return handle.bundle.extensions.map((e) => e.id);
+    return handle.plugin.extensions.map((e) => e.id);
   }
   return (handle.plugin.extensions ?? []).map((e) => e.id);
 }
 function hasExtension(handle, extensionId) {
   if (handle.kind === "built-in") {
-    return handle.bundle.extensions.some((e) => e.id === extensionId);
+    return handle.plugin.extensions.some((e) => e.id === extensionId);
   }
   return (handle.plugin.extensions ?? []).some((e) => e.id === extensionId);
 }
@@ -24609,15 +25070,15 @@ var parsePatchBody2 = makeBodyValidator(PATCH_BODY_SCHEMA, {
 import { HTTPException as HTTPException11 } from "hono/http-exception";
 
 // server/util/skillmapignore-io.ts
-import { existsSync as existsSync26, readFileSync as readFileSync17, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync18, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve35 } from "path";
 var IGNORE_FILENAME2 = ".skillmapignore";
 function readPatterns(cwd) {
   const path = resolve35(cwd, IGNORE_FILENAME2);
-  if (!existsSync26(path)) return [];
+  if (!existsSync27(path)) return [];
   let raw;
   try {
-    raw = readFileSync17(path, "utf8");
+    raw = readFileSync18(path, "utf8");
   } catch {
     return [];
   }
@@ -24625,13 +25086,13 @@ function readPatterns(cwd) {
 }
 function writePatterns(cwd, nextPatterns) {
   const path = resolve35(cwd, IGNORE_FILENAME2);
-  const prior = existsSync26(path) ? safeRead(path) : "";
+  const prior = existsSync27(path) ? safeRead(path) : "";
   const content = buildContent(prior, nextPatterns);
   writeFileSync2(path, content, "utf8");
 }
 function safeRead(path) {
   try {
-    return readFileSync17(path, "utf8");
+    return readFileSync18(path, "utf8");
   } catch {
     return "";
   }
@@ -24975,7 +25436,7 @@ var parsePatchBody4 = makeBodyValidator(PATCH_BODY_SCHEMA3, {
 });
 
 // server/routes/active-provider.ts
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { HTTPException as HTTPException13 } from "hono/http-exception";
 function registerActiveProviderRoute(app, deps) {
   app.get("/api/active-provider", (c) => {
@@ -25008,7 +25469,7 @@ function applyLensSwitch(deps, newValue) {
     });
   }
   const dbPath = resolveDbPath({ db: void 0, cwd });
-  if (!existsSync27(dbPath)) return { dropped: null };
+  if (!existsSync28(dbPath)) return { dropped: null };
   const dropResult = dropScanZone(dbPath);
   return {
     dropped: {
@@ -25116,7 +25577,9 @@ function createWatcherService(opts) {
                 message: sanitizeForTerminal(outcome.message)
               })
             );
+            return;
           }
+          warnOversizedFiles(outcome.result);
         },
         onWatcherError: (message) => {
           log.warn(
@@ -25179,6 +25642,17 @@ function createWatcherService(opts) {
     }
   };
 }
+function warnOversizedFiles(result) {
+  const oversized = result.oversizedFiles ?? [];
+  if ((result.stats.filesOversized ?? oversized.length) <= 0) return;
+  const files = oversized.map((f) => formatOversizedFilePair({ path: sanitizeForTerminal(f.path), bytes: f.bytes })).join(", ");
+  log.warn(
+    tx(SERVER_TEXTS.watcherFilesOversized, {
+      count: String(oversized.length),
+      files
+    })
+  );
+}
 function buildBroadcasterEmitter(broadcaster) {
   return {
     emit(event) {
@@ -25262,7 +25736,16 @@ async function buildBffResolverOverride(deps) {
 }
 async function loadPersistedScan(deps) {
   const opened = await tryWithSqlite(
-    { databasePath: deps.options.dbPath, autoBackup: false },
+    {
+      databasePath: deps.options.dbPath,
+      autoBackup: false,
+      // Read-side drift advisory (version skew + schema fingerprint).
+      // The BFF has no TTY, warnings go to the server log; a newer /
+      // different-major DB throws `DbVersionMismatchError`, which the
+      // global `app.onError` maps to a 500 so the SPA surfaces it
+      // rather than crashing on a cryptic missing-column read.
+      versionCheck: { currentVersion: VERSION, printer: bffVersionCheckPrinter }
+    },
     async (adapter) => {
       const [loaded, favSet] = await Promise.all([
         adapter.scans.load(),
@@ -25357,6 +25840,13 @@ var bffScanRunnerPrinter = {
   warn: (text) => log.warn(sanitizeForTerminal(text.trimEnd())),
   error: (text) => log.warn(sanitizeForTerminal(text.trimEnd()))
 };
+var bffVersionCheckPrinter = {
+  data: () => {
+  },
+  info: (text) => log.warn(sanitizeForTerminal(text.trimEnd())),
+  warn: (text) => log.warn(sanitizeForTerminal(text.trimEnd())),
+  error: (text) => log.warn(sanitizeForTerminal(text.trimEnd()))
+};
 function emptyScanResult() {
   return {
     schemaVersion: 1,
@@ -25543,7 +26033,7 @@ function registerUpdateStatusRoute(app, deps) {
 }
 
 // server/static.ts
-import { existsSync as existsSync28 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 import { readFile as readFile6 } from "fs/promises";
 import { extname, join as join19 } from "path";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -25598,7 +26088,7 @@ function createSpaFallback(opts) {
     if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.notFound();
     if (opts.uiDist === null) return htmlResponse(c, placeholder);
     const indexPath = join19(opts.uiDist, INDEX_HTML);
-    if (!existsSync28(indexPath)) return htmlResponse(c, placeholder);
+    if (!existsSync29(indexPath)) return htmlResponse(c, placeholder);
     return fileResponse(c, indexPath);
   };
 }
@@ -26208,7 +26698,7 @@ function validateNoUi(noUi, uiDist) {
 }
 
 // server/paths.ts
-import { existsSync as existsSync29, statSync as statSync10 } from "fs";
+import { existsSync as existsSync30, statSync as statSync10 } from "fs";
 import { dirname as dirname18, isAbsolute as isAbsolute11, join as join20, resolve as resolve37 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var DEFAULT_UI_REL = join20("ui", "dist", "ui", "browser");
@@ -26223,10 +26713,10 @@ function resolveExplicitUiDist(ctx, raw) {
   return isAbsolute11(raw) ? raw : resolve37(ctx.cwd, raw);
 }
 function isUiBundleDir(path) {
-  if (!existsSync29(path)) return false;
+  if (!existsSync30(path)) return false;
   try {
     if (!statSync10(path).isDirectory()) return false;
-    return existsSync29(join20(path, INDEX_HTML2));
+    return existsSync30(join20(path, INDEX_HTML2));
   } catch {
     return false;
   }
@@ -26354,8 +26844,8 @@ function assembleKernel(pluginRuntime, noBuiltIns) {
         (c) => `${c.pluginId}/${c.extensionId}/${c.contributionId}`
       )
     );
-    for (const bundle of builtInBundles) {
-      for (const ext of bundle.extensions) {
+    for (const plugin of builtInPlugins) {
+      for (const ext of plugin.extensions) {
         collectViewContributions(ext.pluginId, ext.id, ext, mergedViewContributions, {
           excludeQualifiedIds: userKey
         });
@@ -26368,8 +26858,8 @@ function assembleKernel(pluginRuntime, noBuiltIns) {
 }
 function collectBuiltInProviders() {
   const out = [];
-  for (const bundle of builtInBundles) {
-    for (const ext of bundle.extensions) {
+  for (const plugin of builtInPlugins) {
+    for (const ext of plugin.extensions) {
       if (ext.kind === "provider") {
         out.push(ext);
       }
@@ -26520,7 +27010,14 @@ var SERVE_TEXTS = {
   // Shutdown trace, printed once the listener has closed. Informational
   // (`ℹ` cyan) per §3.1: no failure, no action; just a marker that the
   // long-running daemon has wound down cleanly.
-  shutdown: "{{glyph}}  sm serve: shutdown complete.\n"
+  shutdown: "{{glyph}}  sm serve: shutdown complete.\n",
+  /**
+   * §3.1b error block when the operator declines the pre-boot
+   * schema-drift rebuild (TTY, no `--yes`). The server never starts;
+   * the cache is left untouched. `{{reason}}` names the drift axis
+   * (version skew vs an inline schema change).
+   */
+  driftDeclined: "{{glyph}}  sm serve: cache rebuild declined; the {{dbVersion}} cache cannot be reused on {{currentVersion}} ({{reason}}).\n   {{hint}}\n"
 };
 
 // cli/util/serve-banner.ts
@@ -26747,6 +27244,9 @@ var ServeCommand = class extends SmCommand {
   noWatcher = Option31.Boolean("--no-watcher", false, {
     description: "Disable the chokidar-fed scan-and-broadcast loop. Use only for CI / read-only deployments."
   });
+  yes = Option31.Boolean("--yes", false, {
+    description: "Skip the interactive prompt and rebuild the local cache when the on-disk DB has drifted (version skew or an inline schema change). Non-TTY invocations rebuild without asking regardless of this flag."
+  });
   // `--watcher-debounce-ms` is undocumented sugar for advanced users
   // who want to tighten / relax the watcher's batching window without
   // editing settings.json. Hidden flag, the Usage block omits it.
@@ -26781,7 +27281,7 @@ var ServeCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const dbPath = resolveDbPath({ db: this.db, ...runtimeCtx });
-    if (this.db !== void 0 && !existsSync30(dbPath)) {
+    if (this.db !== void 0 && !existsSync31(dbPath)) {
       this.printer.info(
         tx(SERVE_TEXTS.dbNotFound, {
           glyph: errGlyph,
@@ -26863,6 +27363,8 @@ var ServeCommand = class extends SmCommand {
       this.printer.info(formatValidationError(validation.error, stderrAnsi));
       return ExitCode.Error;
     }
+    const driftAbort = await this.#rebuildOnDrift(dbPath, stderrAnsi, warnGlyph);
+    if (driftAbort !== null) return driftAbort;
     await initSentryBff(VERSION);
     let handle;
     try {
@@ -26915,6 +27417,35 @@ var ServeCommand = class extends SmCommand {
     this.printer.info(tx(SERVE_TEXTS.shutdown, { glyph: infoGlyph }));
     return ExitCode.Ok;
   }
+  /**
+   * Pre-1.0 schema-drift rebuild for `sm serve`, run before boot. Reuses
+   * the shared `maybeResetOnDrift` (same prompt / `--yes` / non-TTY
+   * policy as `sm scan`), threading the verb's stdin / stderr so a TTY
+   * operator is asked y/N. Returns `null` to proceed (no drift, or the
+   * cache was rebuilt) or an `ExitCode` to abort boot when the operator
+   * declines the rebuild.
+   */
+  async #rebuildOnDrift(dbPath, stderrAnsi, warnGlyph) {
+    const outcome = await maybeResetOnDrift(dbPath, {
+      currentVersion: VERSION,
+      assumeYes: this.yes,
+      stdin: this.context.stdin,
+      stderr: this.context.stderr,
+      printer: this.printer,
+      style: { warnGlyph, dim: stderrAnsi.dim }
+    });
+    if (outcome.kind !== "aborted") return null;
+    this.printer.error(
+      tx(SERVE_TEXTS.driftDeclined, {
+        glyph: stderrAnsi.red("\u2715"),
+        dbVersion: outcome.dbVersion,
+        currentVersion: outcome.currentVersion,
+        reason: outcome.reason === "version" ? DB_DRIFT_TEXTS.driftReasonVersion : DB_DRIFT_TEXTS.driftReasonSchema,
+        hint: stderrAnsi.dim(DB_DRIFT_TEXTS.driftAbortedHint)
+      })
+    );
+    return ExitCode.Error;
+  }
 };
 function parsePort(raw) {
   if (raw === void 0) return { ok: true, port: void 0 };
@@ -27130,26 +27661,34 @@ var ShowCommand = class extends SmCommand {
     const dbPath = resolveDbPath({ db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
-    return withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
-      const bundle = await adapter.scans.findNode(this.nodePath);
-      if (!bundle) {
-        this.printer.error(tx(SHOW_TEXTS.nodeNotFound, { nodePath: this.nodePath }));
-        return ExitCode.NotFound;
-      }
-      const doc = {
-        node: bundle.node,
-        linksOut: bundle.linksOut,
-        linksIn: bundle.linksIn,
-        issues: bundle.issues
-      };
-      if (this.json) {
-        this.printer.data(JSON.stringify(doc) + "\n");
+    const stderrAnsi = this.ansiFor("stderr");
+    return withSqlite(
+      {
+        databasePath: dbPath,
+        autoBackup: false,
+        versionCheck: buildReadVersionCheck(this.printer, stderrAnsi)
+      },
+      async (adapter) => {
+        const bundle = await adapter.scans.findNode(this.nodePath);
+        if (!bundle) {
+          this.printer.error(tx(SHOW_TEXTS.nodeNotFound, { nodePath: this.nodePath }));
+          return ExitCode.NotFound;
+        }
+        const doc = {
+          node: bundle.node,
+          linksOut: bundle.linksOut,
+          linksIn: bundle.linksIn,
+          issues: bundle.issues
+        };
+        if (this.json) {
+          this.printer.data(JSON.stringify(doc) + "\n");
+          return ExitCode.Ok;
+        }
+        const ansi = this.ansiFor("stdout");
+        this.printer.data(renderHuman2(doc, ansi));
         return ExitCode.Ok;
       }
-      const ansi = this.ansiFor("stdout");
-      this.printer.data(renderHuman2(doc, ansi));
-      return ExitCode.Ok;
-    });
+    );
   }
 };
 function renderHuman2(doc, ansi) {
@@ -28047,7 +28586,7 @@ var STUB_COMMANDS = [
 ];
 
 // cli/commands/tutorial.ts
-import { cpSync as cpSync2, existsSync as existsSync31, mkdirSync as mkdirSync6, readdirSync as readdirSync10, rmSync as rmSync2, statSync as statSync11 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync32, mkdirSync as mkdirSync6, readdirSync as readdirSync10, rmSync as rmSync2, statSync as statSync11 } from "fs";
 import { dirname as dirname19, join as join21, resolve as resolve39 } from "path";
 import { createInterface as createInterface5 } from "readline";
 import { fileURLToPath as fileURLToPath7 } from "url";
@@ -28391,7 +28930,7 @@ function resolveSkillSourceDir(variant) {
     resolve39(here, "../cli/tutorial", spec.slug)
   ];
   for (const candidate of candidates) {
-    if (existsSync31(candidate) && statSync11(candidate).isDirectory()) {
+    if (existsSync32(candidate) && statSync11(candidate).isDirectory()) {
       cachedSourceDirs.set(variant, candidate);
       return candidate;
     }
@@ -28592,7 +29131,7 @@ function resolveBareInvocation(rawArgs) {
   if (first !== void 0 && first.startsWith("-") && !passthrough.has(first)) {
     const isSingleDashLong = !first.startsWith("--") && first.length > 2;
     if (isSingleDashLong) return null;
-    if (existsSync32(defaultProjectDbPath(defaultRuntimeContext()))) {
+    if (existsSync33(defaultProjectDbPath(defaultRuntimeContext()))) {
       return ["serve", ...rawArgs];
     }
     return resolveBareDefault();
@@ -28601,7 +29140,7 @@ function resolveBareInvocation(rawArgs) {
 }
 function resolveBareDefault() {
   const ctx = defaultRuntimeContext();
-  if (existsSync32(defaultProjectDbPath(ctx))) {
+  if (existsSync33(defaultProjectDbPath(ctx))) {
     return ["serve"];
   }
   const stderr = process.stderr;
@@ -28615,4 +29154,5 @@ function resolveBareDefault() {
   );
   process.exit(ExitCode.Error);
 }
-//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map
+//# debugId=926243f9-3707-54bc-9aa6-c68955118161