@williamthorsen/kb 0.7.0 → 0.8.0

package/README.md

@@ -1,3 +1,5 @@
+<!-- readme-type: library -->
+
 # @williamthorsen/kb
 
 Foundation library for knowledge-base tooling.
@@ -5,32 +7,29 @@ Provides knowledge-base discovery, registry loading, frontmatter parsing and wri
 It underpins the knowledge-base skills — among them `kb-retrieve` (assertion recall) and `kb-retrieve-events` (event recall), `kb-add`, `kb-curate`, `capture-event`, and `kb-update-events` — and the planned `@williamthorsen/kb-mcp` server.
 
 <!-- section:release-notes -->
-## Release notes — v0.7.0 (2026-09-08)
+## Release notes — v0.8.0 (2026-09-13)
 
 ### 🎉 Features
 
-- 🚨 **Breaking:** Add kb scaffold to back-fill canonical files into an existing store (#1584)
-
-  - Adds the `kb scaffold` command, which writes the canonical files (`.kb/config.yaml` and `.kb/tag-aliases.yaml`) into a knowledge base. Files are created if missing, or replaced if `--force` is used.
-  - Narrows what `kb create` reports to the paths that it actually created.
+- Resolve wikilinks from a private store into a shared one (#1617)
 
-  Migration: import `renderAliasesSeed` and `renderConfigSeed` from `@williamthorsen/kb/scaffold` instead of `@williamthorsen/kb/create`.
+  - Adds the store-qualified wikilink `[[store:Note title]]`, whose prefix names an entry in the merged `kb.yaml` registry, so that `kb check` resolves the link against that store rather than reporting `wikilinks.unresolved`.
+  - Adds `visibility` to `.kb/config.yaml`, taking `shared` or `private` and defaulting to `private`, which sets the permitted direction: a link may point at a store as shareable as its own or more so.
+  - Adds three findings for a qualified link that does not resolve, `wikilinks.unknown-store` and `wikilinks.disallowed-store` as errors and `wikilinks.store-unavailable` as a warning, so that a correct link into a store that this machine has not cloned is reported as unverifiable rather than broken.
 
-- Add canonical formatting configs so a store formats without a toolchain (#1586)
+- Add a second-person rule to the writing preferences (#1634)
 
-  - Adds `.editorconfig` and `.prettierrc.yaml` to the canonical file set, so that `kb create` writes them into a new store and `kb scaffold` back-fills them into an existing one.
-  - Puts width, indentation, and line endings in `.editorconfig`, which editors read as well as Prettier.
-  - Sets `embeddedLanguageFormatting: off` in `.prettierrc.yaml`, which keeps Prettier from reflowing note frontmatter that the kb's note writer would flatten again.
+  - Bans the use of the 2nd person in user- and developer-facing documentation prose.
+  - Adds `second-person` to the rule names that `revise-prose` and `prose-reviser` accept, alongside `plain-speech`, so a sweep repairs a site or records a rejection under it though no detector reports its sites.
+  - Moves the rulebook's `version` to `3`, so that a bound repository re-sweeps and re-adjudicates the rejections recorded under the old version.
 
-### 🐛 Bug fixes
+### 🪦 Removed
 
-- Stop checking gitignored notes (#1587)
+- 🚨 **Breaking:** Remove the wikilink-parse primitives from the vault-integrity subpath (#1680)
 
-  - Stops `kb check` from checking notes matching patterns in `.gitignore`. It now checks only those files that are tracked by git or new and not gitignored.
-  - Makes a link pointing at a gitignored note report `wikilinks.unresolved`, since such a link is broken for every clone but the author's.
-  - Fixes `kb check <path>` and `kb check --vs <ref>` for a note with an accented name, which on macOS matched nothing and could select unrelated files in its place.
+  - Removes `countNewlines`, `extractTarget`, `hasNonMarkdownExtension`, `maskFencedCode`, `maskInlineCode`, and `WIKILINK` from `@williamthorsen/kb/vault-integrity`.
 
-  Migration: Track a gitignored note that other notes link to, or remove the wikilinks pointing at it.
+  Migration: Call `scanWikilinks` to find the wikilinks in a note body and their targets, in place of a scan assembled from the removed primitives.
 <!-- /section:release-notes -->
 
 ## Exports
@@ -45,17 +44,14 @@ The package exposes thirteen subpath entries plus a root barrel:
 | `./create`          | `create`: scaffold a new store and register it in `kb.yaml`                    |
 | `./discovery`       | KB root discovery and `kb.yaml` registry loading, merging, and writing         |
 | `./filesystem`      | Filesystem-existence helpers with an explicit absence policy                   |
-| `./frontmatter`     | Note parsing into typed frontmatter and writing it back to YAML                |
+| `./frontmatter`     | Note parsing into typed frontmatter                                            |
 | `./layout`          | The store's on-disk layout: every path inside a `.kb/` store derives from here |
 | `./note-io`         | Type-blind note read/write as an ordered frontmatter field map                 |
 | `./records`         | The typed `assertion`/`event` record parsers and renderers                     |
 | `./scaffold`        | The canonical set held by a store, and the idempotent writer over it           |
 | `./tags`            | `.kb/tag-aliases.yaml` loading and tag canonicalization                        |
 | `./taxonomy`        | `.kb/taxonomy.yaml` loading, comment-preserving declaration, and path mapping  |
-| `./vault-integrity` | Type-blind `[[link]]` resolution and basename-uniqueness over a note set       |
-
-Every public function takes a single plain-object input so a future MCP wrapper can mechanically bind Zod-validated payloads.
-The library throws on errors; success/failure shaping is left to consumers.
+| `./vault-integrity` | Type-blind `[[link]]` scanning, resolution, and basename-uniqueness checks     |
 
 ## Knowledge-base discovery
 
@@ -97,6 +93,8 @@ Configuration keys, per KB entry under `kbs.<name>`:
 | `description` | no       | Human-readable description                                                                              |
 | `readonly`    | no       | Marks the KB as read-only                                                                               |
 
+An entry's name is also what a [store-qualified wikilink](#linking-into-another-store) names: `[[coding:Note title]]` resolves against the KB registered as `coding`.
+
 ### Merge semantics
 
 `loadKbRegistry` merges the two registries by KB name:
@@ -126,23 +124,24 @@ The relation is many-to-many (one response can address many problems, and one pr
 
 `parseNote({ path })` (or `parseNoteContent({ content })`) parses a note into a `ParsedNote` carrying typed `Frontmatter`:
 The `title`, `recordType`, `created`, `updated`, and `tags` fields are strongly typed and any other fields are preserved in an `extra` map.
-`writeFrontmatter({ frontmatter, body })` renders it back to a note string with a fixed field order and flow-style tags; the round trip is idempotent.
 
 Date fields surface as strings, never JS `Date` objects. YAML parse errors are recorded in `ParsedNote.frontmatterRaw.parseError` rather than thrown;
 missing files (when a path is given) throw.
 
+Writing is type-blind and lives in `@williamthorsen/kb/note-io`. `readNote(path)` (or `readNoteContent(content)`) splits a note into an insertion-ordered frontmatter field map and a body, and `writeNote(path, fields, body)` (or `renderNote(fields, body)`) renders them back, with string lists in flow style. A note written this way reads back to the same fields and body.
+
 ## Tags
 
 `loadAliases({ kbRoot })` reads `.kb/tag-aliases.yaml` into an `AliasMap`, rejecting collisions and self-aliases at load time; an absent file yields an empty map.
 `canonicalize(tag, aliases)` resolves a tag to its canonical form; `findAliasFor(tag, aliases)` returns the canonical form only when the input is a known alias.
 
-## Vault integrity and lints
+## Vault integrity
 
 `checkVaultIntegrity(notes)` runs whole-vault, type-blind checks over a `{ path, body, bodyStartLine }[]` note set: an unresolved `[[link]]` is an error (`wikilinks.unresolved`), and a basename shared by two or more notes is one vault-wide warning (`wikilinks.basename`). `buildVaultIndex(notes)` builds the basename → paths index the layer and curate's wikilink rewriter share.
 
-The type-blind per-note lints — `tagAliasFindings(note, aliases)` (`tag-alias`, warning) and `pathsFindings(note)` (`paths.user-home`, error) — catch what write-time record validation can't: alias-vocabulary drift and hardcoded `/Users/{name}/` paths in captured content.
+A second argument, `{ foreignStores, sourceVisibility }`, resolves [store-qualified links](#linking-into-another-store) against the stores they name; supplied none, the layer treats every target as store-local, which is what `buildVaultIndex`'s other consumers get.
 
-`taxonomyFindings({ notes, taxonomy, config, taxonomyPath })` reports where a store's assertion folders and its declared taxonomy disagree (see [`.kb/taxonomy.yaml`](#the-declared-structure-kbtaxonomyyaml)). Its findings carry `scope: 'vault'`: they describe the store rather than any one note, so a consumer that narrows a report to selected notes must keep them rather than filter them out by path.
+`scanWikilinks(body)` yields each link in a note body, with its store qualifier and target separated, and is the single definition of what counts as a link. `lookupKey(target)` reduces a target to the key that `VaultIndex` uses. The subpath exports `checkVaultIntegrity`, `buildVaultIndex`, `scanWikilinks`, and `lookupKey`, and not the parse primitives from which they are built: A consumer that detects or rewrites links calls `scanWikilinks`.
 
 ```ts
 import { checkVaultIntegrity } from '@williamthorsen/kb/vault-integrity';
@@ -152,7 +151,7 @@ const findings = checkVaultIntegrity(notes);
 
 ## Checking a store
 
-`check({ kbRoot })` runs a store's full check in one call: it loads `.kb/config.yaml`, `.kb/tag-aliases.yaml`, and `.kb/taxonomy.yaml`, enumerates the notes that the config selects (narrowed by [the git dimension](#the-git-dimension) inside a working tree), and composes whole-vault integrity and taxonomy drift with the `tag-alias` and `paths` lints. It performs no frontmatter validation — record types own that at write time. It returns **both** the enumerated notes and the findings, so a consumer can layer its own detectors over the same enumeration without walking the store twice.
+`check({ kbRoot })` runs a store's full check in one call: it loads `.kb/config.yaml`, `.kb/tag-aliases.yaml`, and `.kb/taxonomy.yaml`, enumerates the notes that the config selects (inside a git working tree, the enumeration drops [ignored notes](#ignored-notes)), and composes whole-vault integrity and taxonomy drift with the `tag-alias` and `paths` lints. It performs no frontmatter validation — record types own that at write time. It returns **both** the enumerated notes and the findings, so a consumer can layer its own detectors over the same enumeration without walking the store twice.
 
 ```ts
 import { check } from '@williamthorsen/kb/check';
@@ -160,13 +159,15 @@ import { check } from '@williamthorsen/kb/check';
 const { notes, findings } = await check({ kbRoot });
 ```
 
+No subpath exports the lints, so `check`, and the `kb check` command built on it, is the only way to run them. Two type-blind per-note lints catch what write-time record validation can't: `tag-alias` (warning) reports alias-vocabulary drift, and `paths.user-home` (error) reports a hardcoded `/Users/{name}/` path in captured content. The `taxonomy.*` rules, all warnings, report where a store's assertion folders and its declared taxonomy disagree (see [`.kb/taxonomy.yaml`](#the-declared-structure-kbtaxonomyyaml)). Their findings carry `scope: 'vault'`: they describe the store rather than any one note, so a consumer that narrows a report to selected notes must keep them rather than filter them out by path.
+
 A structural defect in any loaded file throws a `KbLoaderError` (see below). Any other error from enumeration or the checks propagates unchanged.
 
 `enumerateNotes({ kbRoot, config })` performs the enumeration on its own, and `enumerateNotePaths({ kbRoot, config })` returns the same note set as store-root-relative paths without opening a single note. Both are exported from `@williamthorsen/kb/check`; the paths-only variant serves a caller that needs the note set's shape rather than its content.
 
 ### Which notes are checked: `.kb/config.yaml`
 
-`.kb/config.yaml` configures which notes a check enumerates. Both keys are optional; an absent file or an omitted key falls back to the default.
+`.kb/config.yaml` configures which notes a check enumerates and how widely the store is published. Every key is optional; an absent file or an omitted key falls back to the default.
 
 ```yaml
 # .kb/config.yaml
@@ -174,20 +175,44 @@ targets:
   - 'content/**/*.md'
 exclude:
   - '**/node_modules/**'
+visibility: private
 ```
 
-| Key       | Default                  | Meaning                                                                      |
-| --------- | ------------------------ | ---------------------------------------------------------------------------- |
-| `targets` | `['content/**/*.md']`    | Glob patterns (store-root-relative) selecting which notes a check enumerates |
-| `exclude` | `['**/node_modules/**']` | Glob patterns excluded from enumeration even when a target matches           |
+| Key          | Default                  | Meaning                                                                      |
+| ------------ | ------------------------ | ---------------------------------------------------------------------------- |
+| `targets`    | `['content/**/*.md']`    | Glob patterns (store-root-relative) selecting which notes a check enumerates |
+| `exclude`    | `['**/node_modules/**']` | Glob patterns excluded from enumeration even when a target matches           |
+| `visibility` | `private`                | `shared` or `private`; decides which stores may link into this one           |
+
+`visibility` belongs here rather than in the registry entry because it is intrinsic to the store: one store cloned on two machines has one visibility, where a per-machine declaration could let the two disagree silently. It governs [linking into another store](#linking-into-another-store).
 
 Matching uses dotfile-insensitive globbing, so dot-directories (`.kb`, `.git`, `.agents`) are skipped without naming them. The default targets the `content/`-scoped layout; a store with a different layout overrides `targets` to match. `loadKbConfig({ kbRoot })` returns the effective config and is exported from `@williamthorsen/kb/config`.
 
-#### The git dimension
+#### Ignored notes
+
+Where the store sits in a git working tree, the repository's ignore rules narrow the selection further. A note is enumerated when git tracks it, or when no ignore rule covers it. A note that the repository ignores is therefore neither checked nor available as a wikilink target, so a link pointing at one reports `wikilinks.unresolved`. That is the correct reading: such a link is broken for every clone but the author's. This is what lets a store gitignore a scratch area (`local/`, `*.local.md`) and keep uncommitted notes there without the store's lints gating them.
 
-Where the store sits in a git working tree, `targets`/`exclude` is not the whole of note scope: what git accounts for narrows it further. A note is enumerated when git tracks it, or when git would track it, meaning no ignore rule covers it. A note that the repository ignores is therefore neither checked nor available as a wikilink target, so a link pointing at one reports `wikilinks.unresolved`. That is the correct reading: such a link is broken for every clone but the author's. This is what lets a store gitignore a scratch area (`local/`, `*.local.md`) and keep uncommitted notes there without the store's lints gating them.
+A store outside a git working tree, or a machine carrying no git, keeps the filesystem walk alone. Where the repository ignores every note that the walk found, which happens when a parent repository ignores the store's own directory, the run says so on stderr rather than reporting a clean bill over an empty note set.
 
-A store outside a git working tree, or a machine carrying no git, keeps the filesystem walk alone. Where git accounts for none of the notes that the walk found, which happens when a parent repository ignores the store's own directory, the run says so on stderr rather than reporting a clean bill over an empty note set.
+### Linking into another store
+
+A wikilink names a store by qualifying its target: `[[fde:Note title]]` resolves `Note title` in the store registered as `fde`, where a bare `[[Note title]]` stays inside the store being checked. A qualifier is recognized only when the text before the first colon is non-empty and carries no whitespace and no `/`, so a title that happens to contain a colon resolves whole.
+
+Direction is decided by `visibility`: a link may point at a store as shareable as its own or more so, never at a less shareable one. A private note may therefore link to the share-safe assertion its detail was stripped from, while the reverse is refused, because a note's title tends to be its claim and a link into a private store discloses that claim through the link itself.
+
+Only the stores that a run's own links name are consulted, and each is enumerated under its own `targets`/`exclude` and its own repository's ignore rules, reading note paths alone. A run whose links qualify no store reads no registry.
+
+| Rule                            | Severity | Reported when                                                                       |
+| ------------------------------- | -------- | ----------------------------------------------------------------------------------- |
+| `wikilinks.disallowed-store`    | error    | The named store is less shareable than the one being checked                        |
+| `wikilinks.registry-unloadable` | error    | A run with qualified links could not load `kb.yaml`; vault-scoped, reported once    |
+| `wikilinks.store-unavailable`   | warning  | The named store is registered but could not be read here, so the link is unverified |
+| `wikilinks.unknown-store`       | error    | No `kb.yaml` entry declares the named store                                         |
+| `wikilinks.unresolved`          | error    | The named store carries no note of that basename                                    |
+
+`wikilinks.store-unavailable` is a warning rather than an error because a store absent from this machine leaves its links unverifiable rather than broken: a correct link should not fail a check run on a machine that has not cloned the target.
+
+A run that reports `wikilinks.registry-unloadable` reports nothing per link. No store was looked up, so whether one is registered is undetermined, and naming each link would send the reader to fix a registration that may already be correct.
 
 ### The declared structure: `.kb/taxonomy.yaml`
 
@@ -248,7 +273,7 @@ The check config is serialized from the in-package `defaultKbConfig` and the Pre
 
 The name defaults to the directory's base name; `--name` overrides it and `--no-register` scaffolds without writing the registry. `--description` sets the new entry's description, and requires registration: combining it with `--no-register` is a usage error. The registry write preserves any existing comments in `kb.yaml` and leaves the `kbs:` entries alphabetically ordered, so a registry that has drifted out of order is tidied as stores are added. `kb create` refuses to clobber: it exits 2 if the directory already contains a `.kb/` store, or if the chosen name is already registered. Use `kb scaffold` to add canonical files to a store that already exists.
 
-`kb create` also keeps a default knowledge base set. When the registry's top-level `default_kb` pointer is unset and the new store is the only registered KB, it becomes the default. When other KBs are already registered with no default, `kb create` prompts you to choose one on an interactive terminal — or, when stdin is not interactive, points you to `kb set-default`. An existing `default_kb` is never overwritten.
+`kb create` also keeps a default knowledge base set. When the registry's top-level `default_kb` pointer is unset and the new store is the only registered KB, it becomes the default. When other KBs are already registered with no default, `kb create` prompts for one on an interactive terminal, and points to `kb set-default` where stdin is not interactive. An existing `default_kb` is never overwritten.
 
 ### kb scaffold
 
@@ -293,7 +318,7 @@ kb check --vs=main             # check only the notes changed since a ref
 
 `kb check` resolves the store from the nearest ancestor `.kb/` directory, or from a `--kb <name>` entry in the merged `kb.yaml` registry (project-local entries join the user-global registry). The default output groups findings by file; `--json` emits `{ store, summary, findings }`. The command is read-only and never writes to the store.
 
-**Targeting.** Path arguments and `--vs` each scope the run to a subset of notes; they are mutually exclusive, and both compose with `--kb` and `--json`. Cross-note rules always resolve against the whole vault, so a targeted run never false-flags a link to an unselected note; only the report and the exit code narrow to the selection.
+**Targeting.** Path arguments and `--vs` each scope the run to a subset of notes; they are mutually exclusive, and both compose with `--kb` and `--json`. Cross-note rules always resolve against the whole store, and a store-qualified link against the whole store it names, so a targeted run never false-flags a link to an unselected note; only the report and the exit code narrow to the selection.
 
 - **`[paths...]`**: one or more glob patterns, files, or directories (store-root-relative). The command expands globs itself, so a quoted glob behaves the same as a shell-expanded one. A directory checks every note beneath it. A path that matches no note is a usage error, unless it names a real non-note (a README, a triage note, or a file that `exclude` or git rules out), which is skipped silently.
 - **`--vs <ref>`**: the notes changed between the working tree and the merge-base of `<ref>` and HEAD. The diff follows renames (checking the destination), includes uncommitted edits to tracked notes, and excludes deletions, so a `git mv`-heavy migration batch reports the notes it actually touched.
@@ -365,7 +390,7 @@ The `[*.md]` exemption is the one entry that is not self-explanatory. Two traili
 embeddedLanguageFormatting: off
 ```
 
-It is not stylistic, and the scaffolded file carries this reasoning in its own header so it travels with the store. `embeddedLanguageFormatting: off` leaves a note's YAML frontmatter unformatted. Formatted, a long `tags` or `addressed-by` list breaks across several lines, which `writeFrontmatter` puts back onto one the next time anything writes the note. Without this option the formatter and the note writer rewrite each other's output without end, and every note carrying a list past the print width churns on each pass.
+It is not stylistic, and the scaffolded file carries this reasoning in its own header so it travels with the store. `embeddedLanguageFormatting: off` leaves a note's YAML frontmatter unformatted. Formatted, a long `tags` or `addressed-by` list breaks across several lines, which `renderNote` puts back onto one the next time anything writes the note. Without this option the formatter and the note writer rewrite each other's output without end, and every note carrying a list past the print width churns on each pass.
 
 A store that must keep a file that it cannot format, such as a lockfile or a fixture whose defect is the point, names it in a `.prettierignore`. That file is the escape hatch and is not scaffolded, since a fresh store has nothing to put in it.
 
@@ -388,7 +413,3 @@ A store with no `package.json` runs steps 1, 2, and 7, and skips 3 through 6: it
 ## Error and exception model
 
 The checks **return** findings; they never throw. Loaders (`loadKbConfig`, `loadAliases`, `loadTaxonomy`) **throw** a typed `KbLoaderError` on structural defects or malformed YAML, with the offending file path named in the message. `KbLoaderError` (exported from `@williamthorsen/kb/config`) carries a `kind: 'KbLoaderError'` discriminant — and an `isKbLoaderError` type guard — so a caller can distinguish a recoverable config or alias defect from any other throw. An underlying failure, such as a YAML parse error, is attached as the thrown error's `cause`. `loadKbRegistry` throws a plain `Error` on its own structural defects. I/O errors other than a missing optional file propagate.
-
-## MCP wrappability
-
-Every public function input is a plain object with primitive or `unknown`-typed fields, and no function takes a callback. A future `kb-mcp` server can bind Zod-validated request payloads directly onto these inputs without refactoring.

package/dist/esm/check/check.d.ts

@@ -5,7 +5,10 @@ import { type EnumeratedNote } from './enumerate.js';
 export interface CheckResult {
     /** The effective `KbConfig` the run used — loaded from `.kb/config.yaml`, or `defaultKbConfig` when absent. */
     config: KbConfig;
-    /** Every note that the store's `config.targets` and, inside a git working tree, its git scope admit, in walk order. */
+    /**
+     * Every note selected by the store's `config.targets` and, inside a git working tree, not ignored by the repository,
+     * in walk order.
+     */
     notes: readonly EnumeratedNote[];
     /**
      * Findings from whole-vault integrity (unresolved links, basename collisions), taxonomy drift, and the tag-alias and
@@ -19,9 +22,14 @@ export interface CheckResult {
  * the type-blind per-note lints across them. Frontmatter validity is owned by the record types at write time, so no
  * frontmatter re-validation runs here.
  *
- * Inside a git working tree the enumeration narrows to what git accounts for, so a note the repository ignores is
+ * Inside a git working tree the enumeration also drops the notes that the repository ignores, so such a note is
  * neither checked nor available as a wikilink target; see {@link enumerateNotes} for the rule.
  *
+ * A `[[store:Target]]` link resolves against the store its prefix names rather than this one. Those stores are looked
+ * up in the merged `kb.yaml` registry, which is read from `~/.agents/kb.yaml` and from `cwd`'s project-local registry;
+ * `cwd` defaults to the store root, so a caller that supplies none still resolves against the user-global registry.
+ * Only the stores this store's own links name are consulted.
+ *
  * Returns the effective config alongside the enumerated notes and findings, so a consumer (e.g. `kb-curate`) can layer
  * its own detectors over the same enumeration without walking the tree twice, and can read the resolved
  * `targets`/`exclude` without re-loading `.kb/config.yaml`.
@@ -32,4 +40,6 @@ export interface CheckResult {
  */
 export declare function check(input: {
     kbRoot: string;
+    cwd?: string;
+    home?: string;
 }): Promise<CheckResult>;

package/dist/esm/check/check.js

@@ -1,5 +1,6 @@
 import { join } from 'node:path';
 import { loadKbConfig } from "../config/load-config.js";
+import { tryLoadKbRegistry } from "../discovery/load-registry.js";
 import { resolveKbDir, TAXONOMY_FILE } from "../layout/index.js";
 import { pathsFindings } from "../lints/paths.js";
 import { tagAliasFindings } from "../lints/tag-alias.js";
@@ -8,6 +9,7 @@ import { loadAliases } from "../tags/load-aliases.js";
 import { loadTaxonomy } from "../taxonomy/load-taxonomy.js";
 import { checkVaultIntegrity } from "../vault-integrity/check-vault-integrity.js";
 import { enumerateNotes } from "./enumerate.js";
+import { collectStorePrefixes, resolveForeignStores } from "./resolve-foreign-stores.js";
 export async function check(input) {
     const kbRoot = { path: input.kbRoot, kbDir: resolveKbDir(input.kbRoot) };
     const [config, aliases, taxonomy] = await Promise.all([
@@ -16,10 +18,48 @@ export async function check(input) {
         loadTaxonomy({ kbRoot }),
     ]);
     const notes = await enumerateNotes({ kbRoot: input.kbRoot, config });
+    const qualified = await resolveQualifiedStores({
+        notes,
+        projectDir: input.cwd ?? input.kbRoot,
+        sourceVisibility: config.visibility,
+        ...(input.home !== undefined && { home: input.home }),
+    });
     const findings = [
-        ...checkVaultIntegrity(notes),
+        ...registryFindings(qualified.registryError),
+        ...checkVaultIntegrity(notes, { foreignStores: qualified.foreignStores, sourceVisibility: config.visibility }),
         ...taxonomyFindings({ notes, taxonomy, config, taxonomyPath: join(input.kbRoot, TAXONOMY_FILE) }),
         ...notes.flatMap((note) => [...tagAliasFindings(note, aliases), ...pathsFindings(note)]),
     ];
     return { config, notes, findings };
 }
+function registryFindings(error) {
+    if (error === undefined)
+        return [];
+    return [
+        {
+            path: KB_REGISTRY_LABEL,
+            scope: 'vault',
+            rule: 'wikilinks.registry-unloadable',
+            severity: 'error',
+            message: `no store-qualified link can resolve: ${error}`,
+        },
+    ];
+}
+async function resolveQualifiedStores(input) {
+    const prefixes = collectStorePrefixes(input.notes);
+    if (prefixes.size === 0)
+        return { foreignStores: new Map() };
+    const registry = await tryLoadKbRegistry({
+        projectDir: input.projectDir,
+        ...(input.home !== undefined && { home: input.home }),
+    });
+    if (registry.error !== undefined)
+        return { foreignStores: new Map(), registryError: registry.error };
+    const foreignStores = await resolveForeignStores({
+        prefixes,
+        registry: registry.config,
+        sourceVisibility: input.sourceVisibility,
+    });
+    return { foreignStores };
+}
+const KB_REGISTRY_LABEL = 'kb.yaml';

package/dist/esm/check/enumerate.d.ts

@@ -39,10 +39,10 @@ export declare function enumerateNotePaths(input: {
  * (`content/**` descends only into `content/`); a target with no leading literal (e.g. `**\/*.md`) falls back to a
  * full walk. Excludes are honored during descent so an excluded subtree is never entered.
  *
- * Where the store sits in a git working tree, scope narrows further to what git accounts for: tracked notes plus
- * untracked ones that no ignore rule covers. A note that the repository ignores is therefore neither enumerated nor available
+ * If the store sits in a git working tree, the enumeration keeps only the notes that git tracks and the untracked
+ * notes that no ignore rule covers. A note that the repository ignores is therefore neither enumerated nor available
  * as a wikilink target, so a link pointing at one resolves to nothing. A store outside a working tree, or a machine
- * carrying no git, keeps the walk's own scope.
+ * carrying no git, keeps what the walk alone found.
  *
  * Notes with malformed or absent frontmatter are kept — `readNoteContent` records the parse error in `error` and
  * returns an empty field map rather than throwing, so they remain valid wikilink targets. A note that cannot be read,

package/dist/esm/check/resolve-foreign-stores.d.ts

@@ -0,0 +1,24 @@
+import { type StoreVisibility } from '../config/config-schema.js';
+import type { KbRegistry } from '../types.js';
+import type { ForeignStore } from '../vault-integrity/check-vault-integrity.js';
+/**
+ * Collects the distinct store names that a note set's wikilinks qualify, so a check run consults only the stores its
+ * own links reach. It reads {@link scanWikilinks}, the same walk that later evaluates the links, so a store-shaped
+ * prefix inside a code sample pulls in no store and the two cannot disagree on what counts as a qualified link.
+ */
+export declare function collectStorePrefixes(notes: readonly {
+    body: string;
+}[]): Set<string>;
+/**
+ * Resolves each store name a run's links qualify against the merged registry, reading only note paths and each store's
+ * own `.kb/config.yaml`: a foreign store is enumerated under its own `targets`/`exclude` and its own repository's
+ * ignore rules, as it would be under its own check run, and no foreign note is opened.
+ *
+ * A store that cannot be read — absent from this machine, or carrying a config file that will not load — resolves
+ * `unavailable` rather than throwing, so one unrelated store cannot fail the run.
+ */
+export declare function resolveForeignStores(input: {
+    prefixes: Iterable<string>;
+    registry: KbRegistry;
+    sourceVisibility: StoreVisibility;
+}): Promise<Map<string, ForeignStore>>;

package/dist/esm/check/resolve-foreign-stores.js

@@ -0,0 +1,50 @@
+import { stat } from 'node:fs/promises';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { isAtLeastAsShareable } from "../config/config-schema.js";
+import { loadKbConfig } from "../config/load-config.js";
+import { resolveKbDir } from "../layout/index.js";
+import { buildVaultIndex } from "../vault-integrity/build-vault-index.js";
+import { scanWikilinks } from "../vault-integrity/wikilink-parse.js";
+import { enumerateNotePaths } from "./enumerate.js";
+export function collectStorePrefixes(notes) {
+    const prefixes = new Set();
+    for (const note of notes) {
+        for (const { store } of scanWikilinks(note.body)) {
+            if (store !== undefined)
+                prefixes.add(store);
+        }
+    }
+    return prefixes;
+}
+export async function resolveForeignStores(input) {
+    const resolved = new Map();
+    for (const prefix of input.prefixes) {
+        resolved.set(prefix, await resolveOne(prefix, input.registry, input.sourceVisibility));
+    }
+    return resolved;
+}
+async function resolveOne(prefix, registry, sourceVisibility) {
+    const entry = registry.entries.find((candidate) => candidate.name === prefix);
+    if (entry === undefined)
+        return { status: 'unknown' };
+    try {
+        const stats = await stat(entry.path);
+        if (!stats.isDirectory())
+            return { status: 'unavailable', reason: `${entry.path} is not a directory` };
+    }
+    catch (error) {
+        return { status: 'unavailable', reason: `${entry.path} could not be read: ${describeError(error)}` };
+    }
+    let config;
+    try {
+        config = await loadKbConfig({ kbRoot: { path: entry.path, kbDir: resolveKbDir(entry.path) } });
+    }
+    catch (error) {
+        return { status: 'unavailable', reason: describeError(error) };
+    }
+    if (!isAtLeastAsShareable({ source: sourceVisibility, target: config.visibility })) {
+        return { status: 'disallowed', visibility: config.visibility };
+    }
+    const paths = await enumerateNotePaths({ kbRoot: entry.path, config });
+    return { status: 'resolved', index: buildVaultIndex(paths.map((path) => ({ path }))) };
+}

package/dist/esm/cli/commands/check.d.ts

@@ -6,7 +6,7 @@ export interface CommandOutput {
     stderr: string;
 }
 /** Usage text for `kb check`. */
-export declare const CHECK_HELP = "Usage: kb check [paths...] [options]\n\nValidate notes in a knowledge base against its tag aliases and cross-note\nlink and path rules. With no path arguments, every note is checked.\nCross-note rules always resolve against the whole vault.\n\nTargeting (mutually exclusive):\n  [paths...]    Check only the notes matching the given glob patterns, files,\n                or directories. Quote globs so kb expands them itself. A\n                directory checks every note beneath it. A path that matches no\n                note is a usage error unless it names a real non-note.\n  --vs <ref>    Check only the notes changed between the working tree and the\n                merge-base of <ref> and HEAD: follows renames, includes\n                uncommitted edits, excludes deletions.\n\nOptions:\n  --kb <name>   Check the named store from the kb.yaml registry. Without it,\n                the nearest ancestor .kb/ directory is used.\n  --json        Emit a JSON report instead of human-readable output.\n  -h, --help    Show this help.\n\nExit codes:\n  0  no error-severity findings in the checked notes (warnings allowed)\n  1  one or more error-severity findings in the checked notes\n  2  usage error, unresolvable store or --vs ref, a path matching no note, or\n     malformed config or aliases\n";
+export declare const CHECK_HELP = "Usage: kb check [paths...] [options]\n\nValidate notes in a knowledge base against its tag aliases and cross-note\nlink and path rules. With no path arguments, every note is checked.\nCross-note rules always resolve against the whole store; a [[store:Target]]\nlink resolves against the store its prefix names in the kb.yaml registry.\n\nTargeting (mutually exclusive):\n  [paths...]    Check only the notes matching the given glob patterns, files,\n                or directories. Quote globs so kb expands them itself. A\n                directory checks every note beneath it. A path that matches no\n                note is a usage error unless it names a real non-note.\n  --vs <ref>    Check only the notes changed between the working tree and the\n                merge-base of <ref> and HEAD: follows renames, includes\n                uncommitted edits, excludes deletions.\n\nOptions:\n  --kb <name>   Check the named store from the kb.yaml registry. Without it,\n                the nearest ancestor .kb/ directory is used.\n  --json        Emit a JSON report instead of human-readable output.\n  -h, --help    Show this help.\n\nExit codes:\n  0  no error-severity findings in the checked notes (warnings allowed)\n  1  one or more error-severity findings in the checked notes\n  2  usage error, unresolvable store or --vs ref, a path matching no note, or\n     malformed config or aliases\n";
 /**
  * Runs `kb check`: parses options, resolves the store, runs the shared `check`, and formats the report.
  *

package/dist/esm/cli/commands/check.js

@@ -10,7 +10,8 @@ export const CHECK_HELP = `Usage: kb check [paths...] [options]
 
 Validate notes in a knowledge base against its tag aliases and cross-note
 link and path rules. With no path arguments, every note is checked.
-Cross-note rules always resolve against the whole vault.
+Cross-note rules always resolve against the whole store; a [[store:Target]]
+link resolves against the store its prefix names in the kb.yaml registry.
 
 Targeting (mutually exclusive):
   [paths...]    Check only the notes matching the given glob patterns, files,
@@ -55,7 +56,11 @@ export async function runCheck(input) {
     const store = resolved.store;
     let result;
     try {
-        result = await check({ kbRoot: store.path });
+        result = await check({
+            kbRoot: store.path,
+            cwd: input.cwd,
+            ...(input.home !== undefined && { home: input.home }),
+        });
     }
     catch (error) {
         if (isKbLoaderError(error)) {

package/dist/esm/config/config-schema.d.ts

@@ -1,22 +1,39 @@
 import { z } from 'zod';
 /**
- * The on-disk `.kb/config.yaml` shape. Both fields are optional so a file may override only the dimension it cares
- * about; an absent field falls back to {@link defaultKbConfig}.
+ * The on-disk `.kb/config.yaml` shape. Every field is optional so a file may override only the key it cares about; an
+ * absent field falls back to {@link defaultKbConfig}.
  */
 export declare const configFileShape: z.ZodObject<{
     targets: z.ZodOptional<z.ZodArray<z.ZodString>>;
     exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    visibility: z.ZodOptional<z.ZodEnum<{
+        private: "private";
+        shared: "shared";
+    }>>;
 }, z.core.$strip>;
-/** The effective check configuration: the glob target set and the glob exclude set. */
+/**
+ * The configuration applied when `.kb/config.yaml` is absent or omits a field. Targets the `content/`-scoped layout
+ * the owner's stores use; with `picomatch` `dot:false`, dot-directories (`.kb`, `.git`, `.agents`) are excluded
+ * implicitly, so the default exclude only names `node_modules`. Visibility defaults to the safer of the two values, so
+ * a store that has not declared itself never widens what may link into it.
+ */
+export declare const defaultKbConfig: KbConfig;
+/**
+ * Whether a link from a store of `source` visibility may resolve into one of `target` visibility. A link never
+ * increases disclosure: it may point at a store as shareable as its own or more so, never at a less shareable one.
+ */
+export declare function isAtLeastAsShareable(input: {
+    source: StoreVisibility;
+    target: StoreVisibility;
+}): boolean;
+/** The effective check configuration: the glob target set, the glob exclude set, and the store's visibility. */
 export interface KbConfig {
     /** Glob patterns (slash-separated, kbRoot-relative) selecting which notes `check` enumerates. */
     targets: readonly string[];
     /** Glob patterns excluded from enumeration even when a target matches. */
     exclude: readonly string[];
+    /** How widely the store is published, which decides what may link into it. */
+    visibility: StoreVisibility;
 }
-/**
- * The configuration applied when `.kb/config.yaml` is absent or omits a field. Targets the `content/`-scoped layout
- * the owner's stores use; with `picomatch` `dot:false`, dot-directories (`.kb`, `.git`, `.agents`) are excluded
- * implicitly, so the default exclude only names `node_modules`.
- */
-export declare const defaultKbConfig: KbConfig;
+/** How widely a store is published: `shared` reaches collaborators through a remote, `private` reaches nobody else. */
+export type StoreVisibility = NonNullable<z.infer<typeof configFileShape>['visibility']>;

package/dist/esm/config/config-schema.js

@@ -3,8 +3,17 @@ import { CONTENT_DIR } from "../layout/index.js";
 export const configFileShape = z.object({
     targets: z.array(z.string()).optional(),
     exclude: z.array(z.string()).optional(),
+    visibility: z.enum(['private', 'shared']).optional(),
 });
 export const defaultKbConfig = {
     targets: [`${CONTENT_DIR}/**/*.md`],
     exclude: ['**/node_modules/**'],
+    visibility: 'private',
+};
+export function isAtLeastAsShareable(input) {
+    return VISIBILITY_RANK[input.target] >= VISIBILITY_RANK[input.source];
+}
+const VISIBILITY_RANK = {
+    private: 0,
+    shared: 1,
 };

package/dist/esm/config/index.d.ts

@@ -1,4 +1,4 @@
-export { configFileShape, defaultKbConfig, type KbConfig } from './config-schema.js';
+export { configFileShape, defaultKbConfig, isAtLeastAsShareable, type KbConfig, type StoreVisibility, } from './config-schema.js';
 export { isKbLoaderError, KbLoaderError } from './kb-loader-error.js';
 export { loadKbConfig } from './load-config.js';
 export { createNoteScopeMatcher, type NoteScopeMatcher } from './note-scope.js';

package/dist/esm/config/index.js

@@ -1,4 +1,4 @@
-export { configFileShape, defaultKbConfig } from "./config-schema.js";
+export { configFileShape, defaultKbConfig, isAtLeastAsShareable, } from "./config-schema.js";
 export { isKbLoaderError, KbLoaderError } from "./kb-loader-error.js";
 export { loadKbConfig } from "./load-config.js";
 export { createNoteScopeMatcher } from "./note-scope.js";

package/dist/esm/config/load-config.d.ts

@@ -2,7 +2,7 @@ import type { KbRoot } from '../types.js';
 import { type KbConfig } from './config-schema.js';
 /**
  * Loads the effective check configuration for a KB root. Returns {@link defaultKbConfig} verbatim when no
- * `.kb/config.yaml` exists; a file present but omitting `targets` or `exclude` inherits that field's default.
+ * `.kb/config.yaml` exists; a file present but omitting a field inherits that field's default.
  *
  * Mirrors {@link loadAliases}: a single plain-object input, structural defects (malformed YAML, wrong types) throw a
  * {@link KbLoaderError} naming the file. I/O errors other than a missing file propagate.

package/dist/esm/config/load-config.js

@@ -32,5 +32,6 @@ export async function loadKbConfig(input) {
     return {
         targets: result.data.targets ?? defaultKbConfig.targets,
         exclude: result.data.exclude ?? defaultKbConfig.exclude,
+        visibility: result.data.visibility ?? defaultKbConfig.visibility,
     };
 }

package/dist/esm/config/note-scope.d.ts

@@ -15,6 +15,6 @@ export interface NoteScopeMatcher {
  *
  * The `.md` extension gate is deliberately left to the caller: `enumerateNotes` applies its own `.endsWith('.md')`
  * during the walk, and `kb-retrieve` constrains ripgrep with `--glob '*.md'`. Keeping it out of `isNote` lets this
- * matcher govern only the `targets`/`exclude` dimension, the one place the two tools previously disagreed.
+ * matcher govern `targets`/`exclude` alone, the one place the two tools previously disagreed.
  */
 export declare function createNoteScopeMatcher(config: KbConfig): NoteScopeMatcher;

package/dist/esm/git/list-git-scope.d.ts

@@ -1,6 +1,6 @@
 /**
- * Returns every path git accounts for under `root` as an NFC-normalized set of root-relative, slash-separated paths:
- * tracked files, plus untracked ones that no ignore rule covers. Returns `undefined` where git holds no opinion,
+ * Returns every path that git tracks under `root`, plus every untracked path that no ignore rule covers, as an
+ * NFC-normalized set of root-relative, slash-separated paths. Returns `undefined` where git holds no opinion,
  * because `root` lies outside a working tree or git cannot be run at all, so a caller keeps its own scope instead of
  * reading an empty set as "git ignores everything".
  *

package/dist/esm/scaffold/render-seeds.js

@@ -9,9 +9,11 @@ const ALIASES_HEADER = `# Tag aliases for this knowledge store.
 `;
 const CONFIG_HEADER = `# Check configuration for this knowledge store.
 #
-# Both keys are optional and fall back to the defaults shown below; an absent file uses these defaults too. Uncomment
+# Every key is optional and falls back to the default shown below; an absent file uses these defaults too. Uncomment
 # and edit to override. \`targets\` selects which notes \`kb check\` enumerates and \`exclude\` removes matches;
-# patterns are slash-separated and relative to the store root.
+# patterns are slash-separated and relative to the store root. \`visibility\` declares how widely the store is
+# published, which decides what may link into it: a \`[[store:Note title]]\` link resolves only into a store as
+# shareable as its own or more so.
 #
 `;
 const EDITORCONFIG_SEED = `root = true

package/dist/esm/vault-integrity/check-vault-integrity.d.ts

@@ -1,13 +1,6 @@
+import type { StoreVisibility } from '../config/config-schema.js';
 import type { Finding } from '../types.js';
-/** A note reduced to what vault integrity inspects: its path, its body, and the file line the body begins on. */
-export interface VaultIntegrityNote {
-    /** Path or label the note was read from; used as the index value and the finding path. */
-    path: string;
-    /** The note body (everything after the frontmatter block). */
-    body: string;
-    /** 1-based file line where the body begins, so link findings report file-absolute lines. */
-    bodyStartLine: number;
-}
+import { type VaultIndex } from './build-vault-index.js';
 /**
  * Checks whole-vault integrity over a type-blind note set: unresolved `[[link]]` targets and basename collisions.
  * Projects no records and reads no frontmatter — a note is just its path and body.
@@ -16,5 +9,46 @@ export interface VaultIntegrityNote {
  * file-absolute line. A basename shared by two or more notes is a single vault-wide warning (`wikilinks.basename`),
  * reported once per basename independent of whether any link references it. An ambiguous link (a basename that several
  * notes share) is not flagged per-link — the vault-wide basename warning subsumes it.
+ *
+ * A `[[store:Target]]` resolves against `options.foreignStores` instead, and never joins this store's own basename
+ * index, so the basename warning stays store-scoped. Without `options`, a qualified target is treated as a bare one,
+ * which is the behavior every caller had before cross-store resolution existed.
  */
-export declare function checkVaultIntegrity(notes: readonly VaultIntegrityNote[]): Finding[];
+export declare function checkVaultIntegrity(notes: readonly VaultIntegrityNote[], options?: VaultIntegrityOptions): Finding[];
+/** What a check run found when it looked up a store one of its links names. */
+export type ForeignStore = 
+/** The name matches no entry in the merged registry. */
+{
+    status: 'unknown';
+}
+/** The store is registered but cannot be read on this machine, so its links are unverifiable rather than broken. */
+ | {
+    status: 'unavailable';
+    reason: string;
+}
+/** The store is less shareable than the source, so a link into it would widen disclosure. */
+ | {
+    status: 'disallowed';
+    visibility: StoreVisibility;
+}
+/** The store was read; `index` holds its basenames. */
+ | {
+    status: 'resolved';
+    index: VaultIndex;
+};
+/** A note reduced to what vault integrity inspects: its path, its body, and the file line the body begins on. */
+export interface VaultIntegrityNote {
+    /** Path or label the note was read from; used as the index value and the finding path. */
+    path: string;
+    /** The note body (everything after the frontmatter block). */
+    body: string;
+    /** 1-based file line where the body begins, so link findings report file-absolute lines. */
+    bodyStartLine: number;
+}
+/** What a run needs to evaluate a store-qualified link. */
+export interface VaultIntegrityOptions {
+    /** What the run found for each store name its links qualify, keyed by that name. */
+    foreignStores: ReadonlyMap<string, ForeignStore>;
+    /** The visibility of the store being checked, which decides the direction a qualified link may take. */
+    sourceVisibility: StoreVisibility;
+}

package/dist/esm/vault-integrity/check-vault-integrity.js

@@ -1,8 +1,8 @@
 import { buildVaultIndex } from "./build-vault-index.js";
-import { countNewlines, extractTarget, hasNonMarkdownExtension, lookupKey, maskFencedCode, maskInlineCode, WIKILINK, } from "./wikilink-parse.js";
-export function checkVaultIntegrity(notes) {
+import { countNewlines, lookupKey, scanWikilinks } from "./wikilink-parse.js";
+export function checkVaultIntegrity(notes, options) {
     const vaultIndex = buildVaultIndex(notes);
-    return [...unresolvedLinkFindings(notes, vaultIndex), ...basenameFindings(vaultIndex)];
+    return [...linkFindings(notes, vaultIndex, options), ...basenameFindings(vaultIndex)];
 }
 function basenameFindings(vaultIndex) {
     const findings = [];
@@ -20,28 +20,67 @@ function basenameFindings(vaultIndex) {
     }
     return findings;
 }
-function unresolvedLinkFindings(notes, vaultIndex) {
+function describeForeignDefect(store, target, options) {
+    const link = `[[${store}:${target}]]`;
+    const foreignStore = options.foreignStores.get(store);
+    if (foreignStore === undefined)
+        return undefined;
+    if (foreignStore.status === 'unknown') {
+        return {
+            rule: 'wikilinks.unknown-store',
+            severity: 'error',
+            message: `${link} names the store "${store}", which no kb.yaml registry entry declares`,
+        };
+    }
+    if (foreignStore.status === 'unavailable') {
+        return {
+            rule: 'wikilinks.store-unavailable',
+            severity: 'warning',
+            message: `${link} targets the store "${store}", which could not be read here: ${foreignStore.reason}`,
+        };
+    }
+    if (foreignStore.status === 'disallowed') {
+        return {
+            rule: 'wikilinks.disallowed-store',
+            severity: 'error',
+            message: `${link} targets "${store}", a ${foreignStore.visibility} store, which a ${options.sourceVisibility} store may not link into: the link discloses the target's title`,
+        };
+    }
+    const resolved = foreignStore.index.get(lookupKey(target));
+    if (resolved !== undefined && resolved.size > 0)
+        return undefined;
+    return {
+        rule: 'wikilinks.unresolved',
+        severity: 'error',
+        message: `${link} does not resolve to any note in the store "${store}"`,
+    };
+}
+function describeLocalDefect(target, vaultIndex) {
+    const resolved = vaultIndex.get(lookupKey(target));
+    if (resolved !== undefined && resolved.size > 0)
+        return undefined;
+    return {
+        rule: 'wikilinks.unresolved',
+        severity: 'error',
+        message: `[[${target}]] does not resolve to any vault note`,
+    };
+}
+function joinTarget(link) {
+    return link.store === undefined ? link.target : `${link.store}:${link.target}`;
+}
+function linkFindings(notes, vaultIndex, options) {
     const findings = [];
     for (const note of notes) {
-        const body = maskInlineCode(maskFencedCode(note.body));
-        for (const match of body.matchAll(WIKILINK)) {
-            const inner = match[1];
-            if (inner === undefined)
-                continue;
-            const target = extractTarget(inner);
-            if (target === null)
-                continue;
-            if (hasNonMarkdownExtension(target))
-                continue;
-            const resolved = vaultIndex.get(lookupKey(target));
-            if (resolved !== undefined && resolved.size > 0)
+        for (const link of scanWikilinks(note.body)) {
+            const defect = link.store === undefined || options === undefined
+                ? describeLocalDefect(joinTarget(link), vaultIndex)
+                : describeForeignDefect(link.store, link.target, options);
+            if (defect === undefined)
                 continue;
             findings.push({
                 path: note.path,
-                line: note.bodyStartLine + countNewlines(body, match.index),
-                rule: 'wikilinks.unresolved',
-                severity: 'error',
-                message: `[[${target}]] does not resolve to any vault note`,
+                line: note.bodyStartLine + countNewlines(note.body, link.offset),
+                ...defect,
             });
         }
     }

package/dist/esm/vault-integrity/index.d.ts

@@ -1,3 +1,3 @@
 export { buildVaultIndex, type VaultIndex } from './build-vault-index.js';
-export { checkVaultIntegrity, type VaultIntegrityNote } from './check-vault-integrity.js';
-export { countNewlines, extractTarget, hasNonMarkdownExtension, lookupKey, maskFencedCode, maskInlineCode, WIKILINK, } from './wikilink-parse.js';
+export { checkVaultIntegrity, type ForeignStore, type VaultIntegrityNote, type VaultIntegrityOptions, } from './check-vault-integrity.js';
+export { lookupKey, type ScannedWikilink, scanWikilinks } from './wikilink-parse.js';

package/dist/esm/vault-integrity/index.js

@@ -1,3 +1,3 @@
 export { buildVaultIndex } from "./build-vault-index.js";
-export { checkVaultIntegrity } from "./check-vault-integrity.js";
-export { countNewlines, extractTarget, hasNonMarkdownExtension, lookupKey, maskFencedCode, maskInlineCode, WIKILINK, } from "./wikilink-parse.js";
+export { checkVaultIntegrity, } from "./check-vault-integrity.js";
+export { lookupKey, scanWikilinks } from "./wikilink-parse.js";

package/dist/esm/vault-integrity/wikilink-parse.d.ts

@@ -1,8 +1,3 @@
-/**
- * Match `[[Target]]` and `![[Target]]` (embeds). A backslash-escaped `\[[…]]` is excluded. Scan the body so that
- * frontmatter wikilink-looking text (e.g. inside a description) is not flagged.
- */
-export declare const WIKILINK: RegExp;
 /** Counts the newlines in `text` before byte offset `upTo`, used to locate a match's source line. */
 export declare function countNewlines(text: string, upTo: number): number;
 /**
@@ -10,20 +5,46 @@ export declare function countNewlines(text: string, upTo: number): number;
  * links like `[[#heading]]`, which carry no target.
  */
 export declare function extractTarget(inner: string): string | null;
-/** Whether a target carries a known non-Markdown extension (an embed the vault index cannot resolve). */
-export declare function hasNonMarkdownExtension(target: string): boolean;
 /** Reduces a wikilink target to the basename key the vault index is keyed on (drops any directory prefix and `.md`). */
 export declare function lookupKey(target: string): string;
+/** A wikilink target separated into the store it names, where it names one, and the target within that store. */
+export interface QualifiedTarget {
+    /** The store the link names, or `undefined` when the target is store-local. */
+    store?: string;
+    /** The target with any store qualifier removed. */
+    target: string;
+}
+/** One wikilink a body scan accepted, with its target already split into an optional store qualifier and a target. */
+export interface ScannedWikilink {
+    /** The whole matched link, including any `!` embed prefix. */
+    match: string;
+    /** The text between the brackets, with alias and anchor intact. */
+    inner: string;
+    /** Offset of the match within the body. */
+    offset: number;
+    /** The store the link names, or `undefined` when the target is store-local. */
+    store?: string;
+    /** The target within that store, with alias, anchor, and any store qualifier stripped. */
+    target: string;
+}
 /**
- * Replaces the content of fenced code blocks with spaces so wikilink-shaped text inside code (e.g., a bash
- * `[[ -n "$x" ]]` conditional) is not flagged. Offsets and line counts are preserved by substituting same-length
- * whitespace.
+ * Walks a note body and yields every wikilink that carries a resolvable target: fenced and inline code are masked
+ * first, and backslash-escaped links, intra-doc anchors, and non-Markdown embeds are skipped. This is the single
+ * definition of what counts as a link and what its target is, so a consumer that detects links and one that rewrites
+ * them cannot drift apart on either question.
+ *
+ * `offset` indexes the body as passed in. Masking substitutes same-length whitespace, which this function asserts, so
+ * a consumer may slice the unmasked body at the offsets yielded here. It also leaves every newline where it was, so a
+ * consumer may count lines in the unmasked body at those offsets; nothing asserts that at runtime, so a masker that
+ * moved a newline while keeping the length would shift reported line numbers rather than fail.
  */
-export declare function maskFencedCode(body: string): string;
+export declare function scanWikilinks(body: string): Generator<ScannedWikilink>;
 /**
- * Replaces inline backtick spans (e.g., TOML `[[plugins]]` mentioned in prose) with same-length whitespace so
- * wikilink-shaped text inside inline code is not flagged. Matches single or multi-backtick runs whose content
- * contains no backticks or newlines — the common case; complex spans with embedded backticks fall through and are
- * still parsed for wikilinks.
+ * Separates a leading `store:` qualifier from a wikilink target, so `fde:Note title` names the note `Note title` in
+ * the store `fde`. A qualifier is recognized only when the text before the first colon is non-empty and carries no
+ * whitespace and no `/`, and something follows the colon; every other target passes through store-local, which leaves
+ * a title that happens to contain a colon resolving as it always has.
+ *
+ * Call it on the output of {@link extractTarget}, which has already stripped any alias and anchor.
  */
-export declare function maskInlineCode(body: string): string;
+export declare function splitStoreQualifier(target: string): QualifiedTarget;

package/dist/esm/vault-integrity/wikilink-parse.js

@@ -1,4 +1,4 @@
-export const WIKILINK = /(?<!\\)!?\[\[([^\]\n]+?)\]\]/g;
+const WIKILINK = /(?<!\\)!?\[\[([^\]\n]+?)\]\]/g;
 const NON_MD_EXTENSIONS = new Set([
     '.png',
     '.jpg',
@@ -26,7 +26,40 @@ export function extractTarget(inner) {
     const trimmed = beforeAnchor.trim();
     return trimmed === '' ? null : trimmed;
 }
-export function hasNonMarkdownExtension(target) {
+export function lookupKey(target) {
+    const withoutExtension = target.endsWith('.md') ? target.slice(0, -3) : target;
+    const segments = withoutExtension.split('/');
+    return segments.at(-1) ?? withoutExtension;
+}
+export function* scanWikilinks(body) {
+    const masked = maskInlineCode(maskFencedCode(body));
+    if (masked.length !== body.length) {
+        throw new Error('code masking changed body length; wikilink offsets would be invalid');
+    }
+    for (const match of masked.matchAll(WIKILINK)) {
+        const inner = match[1];
+        if (inner === undefined)
+            continue;
+        const extracted = extractTarget(inner);
+        if (extracted === null)
+            continue;
+        if (hasNonMarkdownExtension(extracted))
+            continue;
+        const { store, target } = splitStoreQualifier(extracted);
+        yield { match: match[0], inner, offset: match.index, ...(store !== undefined && { store }), target };
+    }
+}
+export function splitStoreQualifier(target) {
+    const colonIndex = target.indexOf(':');
+    if (colonIndex <= 0)
+        return { target };
+    const store = target.slice(0, colonIndex);
+    const remainder = target.slice(colonIndex + 1);
+    if (remainder === '' || /[\s/]/.test(store))
+        return { target };
+    return { store, target: remainder };
+}
+function hasNonMarkdownExtension(target) {
     const dotIndex = target.lastIndexOf('.');
     if (dotIndex === -1)
         return false;
@@ -35,12 +68,7 @@ export function hasNonMarkdownExtension(target) {
         return false;
     return NON_MD_EXTENSIONS.has(ext);
 }
-export function lookupKey(target) {
-    const withoutExtension = target.endsWith('.md') ? target.slice(0, -3) : target;
-    const segments = withoutExtension.split('/');
-    return segments.at(-1) ?? withoutExtension;
-}
-export function maskFencedCode(body) {
+function maskFencedCode(body) {
     const lines = body.split('\n');
     let inFence = false;
     let fenceChar = '';
@@ -69,7 +97,7 @@ export function maskFencedCode(body) {
     }
     return lines.join('\n');
 }
-export function maskInlineCode(body) {
+function maskInlineCode(body) {
     return body.replace(/`+[^`\n]+?`+/g, (match) => ' '.repeat(match.length));
 }
 const FENCE_LINE = /^\s{0,3}(`{3,}|~{3,})/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/kb",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Knowledge-base foundation: discovery, config, frontmatter parsing, records, tags, and vault-integrity checks",
   "keywords": [
     "frontmatter",
@@ -110,7 +110,7 @@
   "devDependencies": {
     "@types/node": "24.13.3",
     "@types/picomatch": "4.0.3",
-    "eslint": "10.9.1",
+    "eslint": "10.10.0",
     "prettier": "3.9.6",
     "vitest": "4.1.11"
   },