akm-cli 0.10.261014-beta → 0.10.261016-beta

package/docs/guides/getting-started.md

@@ -34,23 +34,24 @@ Or download a standalone binary directly from the
 Hitting a PowerShell execution-policy error on Windows? See
 [Troubleshooting](#troubleshooting) at the end of this guide.
 
-### Standalone binary and semantic search
-
-Local semantic search (`semanticSearchMode: auto`) runs its embedding model on
-ONNX Runtime. A standalone binary carries the library for its platform. The
-first time it embeds, it copies that library once into akm's cache directory,
-under `onnxruntime/<version>-<platform>-<arch>/` (18 to 34 MB depending on the
-platform; `akm info` prints the cache directory), and loads it from there. Two
-limits follow:
-
-- A standalone binary writes its native addon to the system temp directory and
-  loads it from there, so a temp directory mounted `noexec` blocks semantic
-  search (`akm index` reports it `blocked`; keyword search works). Set `TMPDIR`
-  to a writable, executable directory. The cache directory must be on
-  an executable mount too.
-- Alpine/musl and Intel macOS have no native ONNX Runtime library. Semantic
-  search is unavailable there: `akm index` reports it `blocked` with the reason
-  and search stays keyword-only. A remote `embedding.endpoint` still works.
+### Local semantic search
+
+Local semantic search runs its embedding model on ONNX Runtime, and akm offers
+it on Linux x64 (glibc) and Apple-silicon macOS; on every other
+platform search is keyword-only or uses an embedding endpoint you configure. Choosing the built-in embedder in
+`akm setup` (or `akm setup --yes --embedding local`) downloads what it needs once
+into akm's cache directory (`akm info` prints it): ONNX Runtime for your platform,
+under `onnxruntime/<version>-<platform>-<arch>/` (about 86 MB downloaded,
+about 36 MB kept), and the model (about 127 MB). Nothing is installed with the npm
+package or carried in a standalone binary, and the first `akm index` downloads
+what setup did not. Two notes:
+
+- The cache directory must be on a mount that allows executing files: the
+  runtime is loaded from there, and on a `noexec` mount `akm index` reports
+  semantic search `blocked` (keyword search works).
+- On a platform without local embeddings, `akm setup` offers an embedding
+  endpoint or keyword search only, and `akm setup --embedding local` warns and
+  keeps keyword search.
 
 ### akm's own agent runtime
 
@@ -60,7 +61,8 @@ is the same for the npm package and the standalone binary: nothing of OpenCode
 is installed with akm, and the first time the runtime runs, akm downloads the
 OpenCode binary for your platform from the npm registry (one package, about
 114 MB, 240 MB on disk), checks it against the registry's integrity hash and
-keeps it in the cache directory under `opencode/<version>/`. It is fetched once.
+keeps it in the cache directory under `opencode/<version>/`. It is fetched once;
+the `akm setup` wizard offers to fetch it then, when agent work runs there.
 Three limits follow:
 
 - That step needs the npm registry. Without network access for it, enable the
@@ -196,8 +198,9 @@ akm show <ref>            # e.g. akm show workflows/deploy
 
 **Success check:** structured JSON with everything an agent needs to use the
 asset — a `run` command plus optional `cwd` and `setup` for scripts, a
-`prompt` payload for agents, or the document `content` for knowledge (append
-`#<heading-slug>` to a ref for one section).
+`prompt` payload for agents, or the document `content` for knowledge (with
+`--detail brief`, just its outline `toc`; append `#<slug>` to a ref for one
+section).
 
 AKM retrieves every supported capability type. It directly orchestrates
 defined execution surfaces such as workflows, agent dispatch, tasks, and

package/docs/guides/recipes/headless-install.md

@@ -54,19 +54,24 @@ it and never appears on the command line:
 akm setup --yes --endpoint https://api.example.com/v1 --api-key-env EXAMPLE_API_KEY
 ```
 
-`--no-probe` keeps the run offline (the endpoint's model list is not fetched), so a
-new connection has no model until `akm models set` names one.
+`--no-probe` keeps the run offline: nothing is contacted or downloaded (the
+endpoint's model list is not fetched, so a new connection has no model until
+`akm models set` names one).
 For the full set of flags, see `akm setup --help`; for the config they write,
 see [configuration.md](../../reference/configuration.md).
 
-**Semantic search.** Headless setups (`--yes` or `--from`, no wizard
-prompts) defer the embedding-model download to the first `akm index` run,
-unlike the interactive wizard which downloads immediately during `akm
-setup`. Set the mode explicitly rather than relying on the implicit default:
+**Semantic search.** `--embedding local` chooses the built-in embedder, offered
+on Linux x64 (glibc) and Apple-silicon macOS; elsewhere it warns and
+keeps keyword search. Once the config is saved, a headless setup (`--yes` or
+`--from`) downloads the embedder's runtime and model into akm's cache and
+reports `semanticAssets` in its result (`ready`, `blocked: <reason>`, or
+`skipped` with `--no-probe`, which leaves the download to the first
+`akm index`). Without the flag, semantic search stays as the config has it
+(`off` by default):
 
 ```sh
-akm config set semanticSearchMode auto   # local embeddings, downloaded on first index
-akm config set semanticSearchMode off    # skip embeddings entirely
+akm setup --yes --embedding local          # local embeddings, downloaded now
+akm config set semanticSearchMode off      # skip embeddings entirely
 ```
 
 For resource requirements and remote-embedding alternatives, see

package/docs/guides/use-with-any-agent.md

@@ -52,7 +52,10 @@ akm feedback workflows/deploy-to-prod --positive --reason "Completed without iss
 
 **Get refs from search.** Agents should call `akm search --detail agent` or
 `akm curate` to discover refs — not guess them. The `ref` field in search
-results is the stable token to pass to `akm show`. Feedback closes the loop.
+results is the stable token to pass to `akm show`. For a long document,
+`akm show <ref> --detail brief` returns its outline (`toc`, no body), and
+`akm show <ref>#<slug>` then loads only the sections the task needs. Feedback
+closes the loop.
 Record `--negative` only when the asset's content is wrong or stale; a note that
 simply did not fit the task is not negative feedback, so record nothing for it.
 `akm feedback <ref> --negative --reason "<what is wrong and what should change>"`

package/docs/maintainers/release-checklist.md

@@ -19,7 +19,8 @@ next):
    the `package.json` version (`tests/workflow-release.test.ts`).
 3. Add a migration note if the release needs one (see
    [CONTRIBUTING](https://github.com/itlackey/akm/blob/main/.github/CONTRIBUTING.md#shipping-a-release--migration-notes)).
-4. Commit `release: <version>`, push it to the branch, and let CI run on it.
+4. Commit `release: <version>`, push it to the branch and dispatch the release
+   (next section); the workflow waits for CI on that commit.
 
 ## 2. Release akm
 
@@ -31,13 +32,19 @@ The Release workflow, on the pushed commit:
 
 1. runs Gated CI: semantic search with real embeddings, the Docker install
    matrix, and the native schedulers on Linux, macOS and Windows;
-2. requires CI to have passed on the same commit (it does not run lint, the
-   typecheck or the test suites again);
-3. runs `tests/release-check.sh --skip-docker`: the packaged artifact's bin
-   targets and migrator, package acceptance, and the upgrade rehearsal against
-   the packed tarball;
-4. builds the package and standalone binaries, publishes to npm (`latest` for
-   a stable version, `next` for a prerelease) and creates the GitHub release.
+2. runs `tests/release-check.sh --skip-docker`: the packaged artifact's bin
+   targets and migrator, and package acceptance;
+3. builds the package and standalone binaries;
+4. requires CI to pass on the same commit, waiting up to 25 minutes for the run
+   to finish: the newest push or manual run counts, a pull request's does not
+   (it does not run lint, the typecheck, the test suites or the upgrade
+   rehearsal again);
+5. publishes to npm (`latest` for a stable version, `next` for a prerelease)
+   and creates the GitHub release.
+
+Push nothing else to the branch until the Release finishes: a push cancels the
+release commit's CI run (`ci.yml` cancels an in-progress run on the same ref),
+and the Release then fails.
 
 If a job fails on a flake, rerun the failed jobs. If the fix needs a code
 change, commit it and release that commit. npm can take several minutes to show

package/docs/migration/v0.9-to-v0.10.md

@@ -609,6 +609,23 @@ yours to run it, and its runs are in your OpenCode history, which improve reads.
 - **A transient reflect failure** (transport error, timeout, crash) no longer
   uses up the feedback that planned it; the ref is retried next run.
 
+### Local semantic search and installs
+
+- **akm no longer installs ONNX Runtime through npm.** `akm setup` with the
+  built-in embedder (`--embedding local`), or the first `akm index` after the
+  upgrade, downloads ONNX Runtime 1.24.3 once (about 86 MB) into akm's cache.
+  The vectors are unchanged, so no re-index is needed.
+- **Local embeddings are offered on Linux x64 (glibc) and
+  Apple-silicon macOS.** Every other platform uses keyword search or an
+  embedding endpoint, and `akm setup` offers only those there.
+- **Standalone binaries are up to 36 MB smaller**, and a `noexec` temp directory
+  no longer matters; akm's cache directory must still allow executing files.
+- **On Node, the SQLite driver ships prebuilt for every supported Node
+  version**, so `npm install -g akm-cli` works where npm skips install scripts
+  (npm 12 does by default), and a Node upgrade no longer needs `npm rebuild`.
+  Nothing in the package runs an install script, the Node.js version check
+  included: akm checks the version when it starts.
+
 ### The environment programs run in
 
 A harness (agent tasks and workflow agent steps included) and an `exec` unit's

package/docs/reference/cli.md

@@ -218,9 +218,16 @@ The wizard asks, in order:
    the config as this run will save it: a further `--name` connection does not
    serve embeddings, its models are not offered, and with several connections
    none called `default`, `--embedding <model>` refuses and asks you to name one
-   default or pass `--embedding-endpoint`.
+   default or pass `--embedding-endpoint`. The built-in embedder is offered on
+   Linux x64 (glibc) and Apple-silicon macOS only; elsewhere the step
+   says so in one sentence and offers an endpoint or off, and `--embedding local`
+   warns and saves off.
 5. **Save.** The config is written, the bundle directory initialized, and a
-   summary says what runs where.
+   summary says what runs where. With the built-in embedder chosen, setup then
+   downloads its runtime (ONNX Runtime, about 86 MB) and model (about 127 MB)
+   into akm's cache and loads them; the wizard asks first. When agent work runs
+   on akm's own runtime, the wizard also offers to download its OpenCode binary
+   (about 114 MB) now rather than on the first agent run.
 
 Flags answer one question each; `--yes` takes the detected default for every
 question left, so nothing is prompted. Without a terminal, `akm setup` refuses
@@ -236,7 +243,7 @@ unless `--yes` or `--from` is given.
 | `--embedding-endpoint <url>`, `--embedding-api-key-env <NAME>` | Another endpoint serving the embedding model |
 | `--from <file>` | A config file (JSON or YAML) to merge |
 | `--dir <path>`, `--no-init` | The bundle directory; skip scaffolding it |
-| `--no-probe` | Offline: the endpoint is not contacted and its models are not listed; a connection added this way has no model until `akm models set` names one |
+| `--no-probe` | Offline: nothing is contacted or downloaded. The endpoint's models are not listed, so a connection added this way has no model until `akm models set` names one, and the built-in embedder's runtime and model are downloaded by the first `akm index` |
 
 The detected defaults are: when no agent program is configured yet, every one
 found on `PATH` is enabled and the first found is the default. If no connection
@@ -249,7 +256,11 @@ whose endpoint lists an embedding model.
 
 The wizard also lets you review registries and add bundle sources. A scripted run
 prints its result with a `runs` object saying what runs where: `modelCalls`,
-`agentWork` and `embeddings`.
+`agentWork` and `embeddings`. When the saved config uses the built-in embedder,
+the result also has `semanticAssets`: `ready` once its runtime and model are
+downloaded and load, `blocked: <reason>` when they do not (the config is saved
+all the same), or `skipped` with `--no-probe`. A scripted run does not download
+akm's own agent runtime; its first agent run does.
 
 ### index
 
@@ -424,6 +435,10 @@ to each connection's endpoint, one probe per distinct endpoint, checks the
 installed akm-cli version against the latest GitHub release (`cli-version`),
 runs the scheduler's recorded akm binary with `--version` to check it
 against the running CLI (`scheduler-binary`).
+The `plugin-version` advisory compares the installed Claude Code plugin with the
+channel its marketplace clone follows: the newest stable tag on the remote's
+default branch, the release tag on the branch head for another branch such as
+`next`, and the pinned tag for a marketplace added at a tag.
 
 Primary result fields:
 
@@ -464,13 +479,13 @@ search, with the index's entry and vector counts read now. It loads no model and
 sends no request. It `pass`es when every entry has a vector (and a local model
 embedded on `onnxruntime-node`) or `semanticSearchMode` is `off`; `warn`s when
 vectors lag the entries (`akm index` embeds the rest), local embeddings ran on
-another runtime, or this platform has no native ONNX Runtime library
-(Alpine/musl, Intel macOS: keyword search is all there is, so the message says to
-set `semanticSearchMode` to `off` or `embedding.endpoint` to a remote service);
+another runtime, or akm offers no local embeddings on this platform (keyword
+search or an endpoint is the default there, so the message names
+`akm setup --embedding off` and `akm setup --embedding <model> --embedding-endpoint <url>`);
 `fail`s, with the recorded reason, when the last index found semantic search
 `blocked` (an embedding endpoint or model download failed) or `unavailable` for
-a cause that can be fixed (the library is there but did not load: a missing
-package or addon, a `noexec` temp or cache directory); and is `unknown` before
+a cause that can be fixed (the runtime could not be downloaded or did not load,
+for example from a `noexec` cache directory); and is `unknown` before
 the first index. Search never reads this record: a query still
 tries semantic search and falls back to keyword search on its own. A fix shows
 here after the next `akm index`. `evidence` carries the recorded `status`,
@@ -811,7 +826,10 @@ contends with a full `akm index` rebuild in progress.
 
 Display an asset by ref. On a markdown document `#fragment` selects one
 section by heading slug (falling back to case-insensitive heading text); an
-unmatched fragment lists the available slugs.
+unmatched fragment lists the available slugs. For a large document, read the
+outline first and then only the sections you need: `akm show <ref> --detail
+brief` returns the document's `toc` without the body, and `akm show
+<ref>#<slug>` returns one section.
 
 ```sh
 akm show scripts/deploy.sh
@@ -819,7 +837,8 @@ akm show skills/code-review
 akm show agents/architect
 akm show commands/release
 akm show workflows/ship-release
-akm show knowledge/guide                 # the whole document
+akm show knowledge/guide                 # the whole document, plus its toc
+akm show knowledge/guide --detail brief  # the outline (toc), no body
 akm show knowledge/guide#authentication  # just that section
 akm show '<search-result-ref>' --context lead --max-tokens 800
 akm show knowledge/guide#nope            # lists the available fragment slugs
@@ -868,6 +887,17 @@ reduced metadata-first view without `content`/`template`/`prompt`;
 including `ref`/`path`/`editable`, plus the optional fragment metadata
 described below.
 
+`toc` is the outline of a whole Markdown document (knowledge, and every other
+Markdown asset whose `#fragment` selects a section): one
+`{ "level", "text", "slug", "startLine" }` entry per heading, in order, at every
+`--detail` level, `brief` and `agent` included. `slug` is exactly what
+`<ref>#<slug>` selects, duplicate headings included (`notes`, `notes-1`, ...),
+and `startLine` is the heading's 1-based line in the file. It is read from the
+same file the section is cut from, so it never lists a slug the show cannot
+resolve. It is omitted for non-Markdown assets, for documents with no headings,
+and for a fragment show (`<ref>#<slug>`). `--format text` prints it as a
+`toc:` block.
+
 `links` lists the asset's declared links, grouped by kind: `outgoing` (the
 assets its own `xrefs:`, `supersededBy:`, `contradictedBy:`,
 `currentBeliefRefs:`, wiki `sources:`, `.derived` parent, page links, or
@@ -933,7 +963,7 @@ Returns type-specific payloads:
 | skill | `content` (full SKILL.md) |
 | command | `template`, `description` |
 | agent | `prompt`, `description`, `modelHint` |
-| knowledge | `content` — the whole document, or one section via `#fragment` |
+| knowledge | `content` — the whole document, or one section via `#fragment`; `toc` on a whole document |
 | workflow | `workflowTitle`, `workflowParameters`, `steps` (each step's `orchestration` summary names its `engine` (the connection or harness it runs on) and model, or — for an [exec step](https://github.com/itlackey/akm/blob/main/docs/reference/workflow-schema.md#what-akm-show-reports-for-an-exec-step) — its `exec.command` and no engine at all) |
 | memory | `content` |
 | env | `keys` (key names only — values and comment text never returned) |

package/docs/reference/configuration.md

@@ -690,21 +690,43 @@ semantic search is disabled or has not been built. A read-only sandbox that
 cannot record best-effort usage telemetry does not by itself mark search as
 degraded.
 The local embedder runs its model (`Xenova/bge-small-en-v1.5` unless
-`embedding.localModel` names another) on `onnxruntime-node`, with
-`@huggingface/tokenizers` for the token ids. Both are normal dependencies of the
-package, imported directly; AKM does not carry a copied runtime under `src/` or
-`dist/`. The model's four files (about 127 MB) are fetched from the Hugging Face
-Hub on first use into `$HF_HOME/<repo>/` (default `<cache dir>/models`), and
-`HF_HUB_OFFLINE=1` forbids the fetch. `akm index --format json` reports the
-runtime it embedded with as `verification.embeddingRuntime`.
-If the runtime cannot load, because the dependency is missing or the platform
-has no native ONNX Runtime library (Alpine/musl, Intel macOS), the index reports
-semantic search `blocked` with the reason and search stays keyword-only:
-reinstall `akm-cli` for a missing dependency, or configure a remote
-`embedding.endpoint`. A standalone binary copies the library it embeds once into
-`<cache dir>/onnxruntime/` (see
-[Getting Started](../guides/getting-started.md#standalone-binary-and-semantic-search)).
-Setup does not mutate a global installation to add runtime packages.
+`embedding.localModel` names another) on ONNX Runtime, through
+`onnxruntime-node`'s native binding, with `@huggingface/tokenizers` for the token
+ids. akm offers local embeddings on Linux x64 (glibc) and Apple-silicon
+macOS; on every other platform semantic search uses an embedding endpoint or
+stays keyword-only. akm does not install `onnxruntime-node`:
+`akm setup --embedding local` (or the wizard's built-in embedder) downloads that
+package's binding and library for this platform once from the npm registry
+(about 86 MB; the registry's sha512 integrity is checked before anything is
+extracted) into `<cache dir>/onnxruntime/<version>-<platform>-<arch>/`, and the
+first local embedding downloads them when setup did not. The model's four files
+(about 127 MB) come from the Hugging Face Hub the same way, into
+`$HF_HOME/<repo>/` (default `<cache dir>/models`); `HF_HUB_OFFLINE=1` forbids
+that download. `akm index --format json` reports the runtime it embedded with as
+`verification.embeddingRuntime`. If the runtime cannot be downloaded or does not
+load (the cache directory is mounted `noexec`), the index reports semantic search
+`blocked` with the reason and search stays keyword-only. On a platform without
+local embeddings, `akm setup` offers an endpoint or keyword search,
+`--embedding local` warns and saves keyword search, and a config that turns
+semantic search on anyway gets it reported unavailable for the platform by the
+index and a warning from `akm health`.
+
+**Without network access**, fill akm's cache directory (`akm info` prints
+`cacheDir`; `AKM_CACHE_DIR` moves it) before the first `akm index`:
+
+- `onnxruntime/<version>-<platform>-<arch>/` (for example
+  `onnxruntime/1.24.3-linux-x64/`) holding `onnxruntime_binding.node` and the
+  library it links (`libonnxruntime.so.1` on Linux,
+  `libonnxruntime.1.24.3.dylib` on macOS). Take both from
+  `package/bin/napi-v6/<platform>/<arch>/` in the `onnxruntime-node@1.24.3`
+  tarball (`npm pack onnxruntime-node@1.24.3`), or copy the folder from a
+  connected machine of the same platform after
+  `akm setup --yes --embedding local`.
+- `models/Xenova/bge-small-en-v1.5/` holding `tokenizer.json`,
+  `tokenizer_config.json`, `config.json` and `onnx/model.onnx`, or set `HF_HOME`
+  to a directory that holds them and `HF_HUB_OFFLINE=1`.
+- `opencode/2.1.4/opencode` (`opencode.exe` on Windows) for akm's own agent
+  runtime.
 The default is `"off"` so a bare or headless install (`akm bundle create`, `--yes`,
 `--config`) never silently downloads the local embedding model on first
 index. A config that has an `embedding` block and sets no `semanticSearchMode`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.10.261014-beta",
+  "version": "0.10.261016-beta",
   "type": "module",
   "description": "akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cursor.",
   "keywords": [
@@ -34,9 +34,8 @@
   },
   "license": "MPL-2.0",
   "pinNotes": {
-    "better-sqlite3@12.11.1": "Exact pin (#790). This is the SQLite driver akm loads on Node (src/storage/database.ts); Bun never touches it. The pin is about PREBUILT BINARIES, not API surface. better-sqlite3 ships one prebuild per Node ABI as a GitHub release asset and its install script is `prebuild-install || node-gyp rebuild` — so any (version, Node ABI) pair with no prebuild silently COMPILES FROM SOURCE against the headers of whatever Node is on the machine that day. The 11.x line predates Node 24 and declares no `engines` at all: its newest release (11.10.0, 2025-05-08) publishes ABI 108/115/127/131 (Node 18/20/22/23) and nothing for ABI 137 (Node 24). Node 24.19.0 then changed the public `node_object_wrap.h` so `node::ObjectWrap`'s ctor/dtor register and unregister an environment cleanup hook; a from-source 11.x build against those headers aborts at teardown in `Statement::~Statement()` with `RemoveEnvironmentCleanupHook ... Assertion (env) != nullptr`, intermittently, depending on GC timing. 12.11.1 publishes ABI 127/137/141/147 (Node 22/24/25/26) and declares `engines: 20.x || 22.x || 23.x || 24.x || 25.x || 26.x`, so every Node akm supports installs a prebuilt binary and never compiles. Before bumping: confirm the target version publishes a prebuild for EVERY Node major in `engines` (probe https://github.com/WiseLibs/better-sqlite3/releases/download/vX.Y.Z/better-sqlite3-vX.Y.Z-node-vABI-linux-x64.tar.gz), not just that the version is newer. 13.x is the eventual destination — it moved to node-addon-api/N-API with prebuilds bundled in the npm tarball and no install script, which retires this failure mode entirely — but it is a fresh major rewrite of the binding, so it wants its own soak, not a patch release. The CI node-smoke job installs this exact string by reading it back out of this file (.github/workflows/ci.yml), so the two cannot drift.",
+    "better-sqlite3@13.0.3": "Exact pin. The SQLite driver akm loads on Node (src/storage/database.ts); Bun uses bun:sqlite and never loads it. 13.x is built on N-API (node-addon-api), so one binding per platform serves every Node version, and the npm tarball carries those bindings prebuilt in prebuilds/ for Linux (glibc and musl) and macOS on x64 and arm64 and for Windows on x64 and arm64. It declares no install script and sets gypfile: false, so it installs the same where npm runs install scripts and where it does not (npm 12 blocks dependency scripts by default). Not covered: 32-bit ARM Linux (linux-arm, linuxmusl-arm), which 12.x served only through its install script; akm under Node has no SQLite driver there. `bun install` tries to build it anyway (Bun ignores gypfile: false for a trusted package) and, as an optional dependency, drops it silently when that fails, which is why CI installs it with npm. This replaced 12.11.1, whose binding came per Node ABI from its install script (`prebuild-install || node-gyp rebuild`, #790); the earlier note asked for a soak before 13.x, and 13.0.3 soaks through the 0.10 betas instead. Before bumping: the tarball must still carry prebuilds/ for every platform above and declare no install script, and the CI node-smoke job, which installs this exact string read back out of this file (.github/workflows/ci.yml), must pass on every Node major in engines.",
     "@huggingface/tokenizers@0.1.3": "Exact pin: the tokenizer of the local embedding model (src/llm/embedders/local.ts). Pure JS with no dependencies. A different release can change the token ids and with them every stored vector, so re-run the real-model semantic gate (tests/integration/semantic-search-e2e.test.ts, which compares the vectors with tests/fixtures/embedder-reference-vectors.json) before changing it.",
-    "onnxruntime-node@1.24.3": "Exact pin: the local embedding runtime. The standalone binary embeds this version's native library from node_modules/onnxruntime-node/bin/napi-v6/ (src/standalone/native/) and its addon is bound to exactly that library, so a bump moves this pin, the library file names in src/standalone/native/ (the macOS one carries the version), the list of platforms it ships a library for in src/llm/embedders/local.ts and the real-model semantic gate together.",
     "ajv@8.20.0": "Exact pin (devDependency, used only by tests: tests/tasks-schema.test.ts validates task sources against schemas/akm-task.json, tests/contracts/config-schema-drift.test.ts checks schemas/akm-config.json). Pinned in 4d7d77992 without a recorded reason; keep exact until the pin is next reviewed.",
     "cmd-shim@9.0.2": "Exact pin (devDependency), from cd5a3be12 \"pin cmd-shim for launcher tests\": tests/integration/install/package-launcher.test.ts writes the Windows shims npm would write with this package, where it used to load the copy inside the installed npm's own node_modules. That commit records no reason for an exact version over a range; keep exact until the pin is next reviewed."
   },
@@ -72,11 +71,11 @@
     "akm-migrate": "dist/akm-migrate"
   },
   "scripts": {
-    "preinstall": "node -e \"var v=(process.versions.node||'0').split('.').map(function(n){return parseInt(n,10)||0});var ok=v[0]>=22;if(ok){process.exit(0)}console.error('\\n  ERROR: the akm-cli npm package requires Node.js >= 22.\\n  A working Bun >= 1.0 on PATH is optional and preferred for akm and akm-migrate.\\n  Upgrade Node.js (https://nodejs.org), or install the runtime-free standalone binary:\\n    curl -fsSL https://github.com/itlackey/akm/releases/latest/download/install.sh | bash\\n');process.exit(1)\"",
     "build": "rm -rf dist && bun scripts/gen-config-schema.ts &&bun run tsc --project ./tsconfig.build.json && bun scripts/copy-assets.ts && bun scripts/fix-esm-extensions.ts",
     "check": "bun run lint && bunx tsc --noEmit && bun run test:unit && bun run test:integration",
     "check:fast": "bun run lint && bunx tsc --noEmit && bun run test:unit",
     "check:changed": "bun run lint && bunx tsc --noEmit && bun test tests/integration/output-baseline.test.ts tests/integration/registry/registry-search.test.ts tests/integration/show-argv-entrypoint.test.ts tests/output-shapes-unit.test.ts",
+    "check:ci": "bash scripts/check-like-ci.sh",
     "sweep:tmp": "bun scripts/sweep-test-tmp.ts",
     "test": "bash scripts/test-unit.sh",
     "test:unit": "bash scripts/test-unit.sh",
@@ -105,11 +104,10 @@
     "ajv": "8.20.0",
     "bun-types": "^1.3.13",
     "cmd-shim": "9.0.2",
-    "typescript": "^5.9.3",
-    "zod-to-json-schema": "^3.23.0"
+    "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "better-sqlite3": "12.11.1",
+    "better-sqlite3": "13.0.3",
     "sqlite-vec": "^0.1.9"
   },
   "engines": {
@@ -123,10 +121,9 @@
     "fast-xml-parser": "^5.10.1",
     "marked": "^18.1.1",
     "node-html-parser": "^9.0.1",
-    "onnxruntime-node": "1.24.3",
     "semver": "^7.6.0",
     "turndown": "^7.2.4",
     "yaml": "^2.8.4",
-    "zod": "^3.23.0"
+    "zod": "^4.6.6"
   }
 }