akm-cli 0.9.7 → 0.9.8-beta.1

package/dist/commands/proposal/repository.js

@@ -563,9 +563,6 @@ export function listProposalsReadOnly(stashDir, options = {}, ctx) {
             }
         });
     }
-    catch {
-        return [];
-    }
     finally {
         db?.close();
     }
@@ -1013,7 +1010,6 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
             paths: [commitPath],
             snapshots: p.gitSnapshots ?? {},
             onCommitRecorded: (commit) => {
-                // biome-ignore lint/style/noNonNullAssertion: publishWriteTargetTransaction throws when absent
                 const publication = p.gitPublication;
                 if (publication.commit !== commit) {
                     publication.commit = commit;

package/dist/commands/proposal/validators/proposal-quality-validators.js

@@ -190,12 +190,6 @@ export function hasHotCaptureMode(frontmatter) {
     return frontmatter?.captureMode === "hot";
 }
 // ── Consolidate merge size gate ──────────────────────────────────────────────
-/**
- * Ratio lower-bound for merged body vs. the larger source body.
- * Lower than reflect (0.5) because deduplication is expected — two memories
- * with 80-90% overlap legitimately compress to well under 50% of the larger.
- */
-export const MERGE_SHRINK_RATIO_MIN = 0.3;
 // ── Reflect size gate ────────────────────────────────────────────────────────
 /** Ratio lower-bound: proposed body must be at least this fraction of source. */
 export const REFLECT_SHRINK_RATIO_MIN = 0.5;

package/dist/commands/read/curate.js

@@ -52,7 +52,9 @@ export const CURATE_SEARCH_LIMIT_MULTIPLIER = 4;
 export const MIN_CURATE_SEARCH_LIMIT = 12;
 const DEFAULT_CURATE_LIMIT = 4;
 const CURATE_CLOSE_SCORE_BAND = 0.12;
-const CURATE_TAIL_SCORE_FLOOR = 0.35;
+// Used by `shouldRunCurateFallback` to judge whether the initial search
+// already returned strong results (a different purpose from ranking/keeping
+// hits — see that function for its own rationale).
 const CURATE_RELATIVE_SCORE_FLOOR = 0.7;
 const CURATE_FALLBACK_TOP_SCORE_THRESHOLD = 0.8;
 const CURATE_FALLBACK_STRONG_SCORE_FLOOR = 0.35;
@@ -577,11 +579,6 @@ function compareCurateHits(a, b) {
         return rawDiff;
     return a.originalIndex - b.originalIndex;
 }
-function passesCurateScoreFloor(hit, leaderScore) {
-    if (leaderScore === undefined)
-        return true;
-    return hit.rawScore >= Math.max(CURATE_TAIL_SCORE_FLOOR, leaderScore * CURATE_RELATIVE_SCORE_FLOOR);
-}
 function isNarrowReferenceFamilyQuery(query, family) {
     if (!family || family.role !== "reference")
         return false;
@@ -602,19 +599,8 @@ function selectCuratedStashHits(query, hits, limit) {
     const ranked = collapsed.hits
         .map(({ hit, originalIndex }) => annotateCurateHit(query, hit, originalIndex, intent))
         .sort(compareCurateHits);
-    const selected = [];
     const supportRefsByRef = collapsed.supportRefsByRef;
-    let leaderScore;
-    for (const candidate of ranked) {
-        if (!passesCurateScoreFloor(candidate, leaderScore))
-            continue;
-        selected.push(candidate);
-        if (leaderScore === undefined)
-            leaderScore = candidate.rawScore;
-        if (selected.length >= limit)
-            break;
-    }
-    return { selected: selected.map((entry) => entry.hit), supportRefsByRef };
+    return { selected: ranked.slice(0, limit).map((entry) => entry.hit), supportRefsByRef };
 }
 function collapseCurateFamilies(query, hits) {
     const passthrough = [];

package/dist/commands/read/show.js

@@ -27,7 +27,7 @@ import { displayRef, typeNameFromConceptId } from "../../core/asset/resolve-ref.
 import { META_DIR, parseMetaRef, readMetaFile } from "../../core/asset/stash-meta.js";
 import { asNonEmptyString, isWithin } from "../../core/common.js";
 import { getIndexPassConfig, loadConfig } from "../../core/config/config.js";
-import { NotFoundError, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
+import { NotFoundError, rethrowIfDataDirUnreadable, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { SCRIPT_EXTENSIONS } from "../../core/recognition-util.js";
 import { presentationFor } from "../../core/type-presentation.js";
@@ -292,6 +292,7 @@ export async function showLocal(input) {
             }
             catch (err) {
                 rethrowIfTestIsolationError(err);
+                rethrowIfDataDirUnreadable(err);
                 return { total: 0, hits: [] };
             }
         })(),

package/dist/commands/sources/installed-stashes.js

@@ -47,7 +47,11 @@ function canonicalJson(value) {
     if (value && typeof value === "object") {
         const entries = Object.entries(value)
             .filter(([, entry]) => entry !== undefined)
-            .sort(([left], [right]) => left.localeCompare(right));
+            // Codepoint order, NOT localeCompare: this string feeds sha256Hex for the
+            // bundle-audit generation, and localeCompare is ICU/locale-dependent — the
+            // same object could hash differently on two machines. Matches the other
+            // canonicalJson implementations (workflows/ir/plan-hash.ts).
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
         return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
     }
     return JSON.stringify(value);

package/dist/commands/sources/self-update.js

@@ -333,7 +333,7 @@ function runPostUpgradeTasks(akmBin, opts, upgradeState) {
             ok: false,
             skipped: opts.skip,
             message: `Upgrade completed, but the state schema was not prepared (${detail}). ` +
-                "Preserve state.db and run `akm upgrade --force` before other AKM commands.",
+                "Preserve state.db and run `akm upgrade --state-only` before other AKM commands (the binary is already current).",
         };
     }
     const stateNote = stateUpgrade.safetyCopyPath ? ` Historical state safety copy: ${stateUpgrade.safetyCopyPath}.` : "";
@@ -520,3 +520,40 @@ export function getPackageManagerUpgradeCommand(installMethod, packageName = get
     }
     return undefined;
 }
+/**
+ * Apply pending historical destructive state.db migrations WITHOUT installing a
+ * new akm — the body of `akm upgrade --state-only`.
+ *
+ * Migrations flagged `historical-destructive` are refused during an ordinary
+ * managed open: they need a verified sibling safety copy taken under the
+ * migration writer lock, and that is deliberate, so an unattended `akm index`
+ * can never quietly drop operator state.
+ *
+ * The bug this fixes is not the guard but its reachability (#895). The only
+ * code path that set `allowHistoricalDestructiveStateUpgrade` ran as a
+ * POST-INSTALL step of a real upgrade, so it sat behind an npm install. Where
+ * akm is installed globally by an image and the runtime user is unprivileged,
+ * that install fails EACCES and throws long before the migration is reached —
+ * leaving the documented remedy impossible to run and `akm index --full`
+ * permanently blocked. Nothing about the migration itself needs the network,
+ * root, or a new binary; it is local, offline, and already verified.
+ *
+ * The safety copy is NOT skipped here. This changes only who may ask for the
+ * migration, never what it does.
+ */
+export function upgradeStateOnly(currentVersion, dependencies) {
+    const upgradeState = dependencies?.upgradeHistoricalStateDatabase ?? upgradeHistoricalStateDatabase;
+    const result = upgradeState();
+    return {
+        currentVersion,
+        newVersion: currentVersion,
+        upgraded: false,
+        installMethod: detectInstallMethod(),
+        message: result.upgraded
+            ? `Applied pending state.db migrations. Safety copy: ${result.safetyCopyPath}`
+            : "state.db is already current; no migration was needed",
+        stateUpgrade: result.safetyCopyPath
+            ? { applied: result.upgraded, safetyCopyPath: result.safetyCopyPath }
+            : { applied: result.upgraded },
+    };
+}

package/dist/commands/sources/sources-cli.js

@@ -33,7 +33,7 @@ import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { resolveWritableOverride, saveGitStash } from "../../sources/providers/git.js";
 import { pkgVersion } from "../../version.js";
-import { checkForUpdate, performUpgrade } from "./self-update.js";
+import { checkForUpdate, performUpgrade, upgradeStateOnly } from "./self-update.js";
 import { akmClone } from "./source-clone.js";
 export const upgradeCommand = defineJsonCommand({
     meta: { name: "upgrade", description: "Upgrade akm to the latest release" },
@@ -45,8 +45,24 @@ export const upgradeCommand = defineJsonCommand({
             description: "Skip the post-upgrade index rebuild",
             default: false,
         },
+        "state-only": {
+            type: "boolean",
+            description: "Apply pending state.db migrations without installing a new akm",
+            default: false,
+        },
     },
     async run({ args }) {
+        // Applying a historical destructive state migration used to be reachable
+        // ONLY as a post-install step of a real upgrade, so an install akm cannot
+        // rewrite -- a global npm install owned by root, an image that ships the
+        // CLI -- had no route to it at all: the npm step fails EACCES and throws
+        // long before the migration runs (#895). The migration is a local,
+        // offline, already-verified operation; it does not need the network or a
+        // new binary, and coupling it to one was the bug.
+        if (args["state-only"]) {
+            output("upgrade", upgradeStateOnly(pkgVersion));
+            return;
+        }
         const check = await checkForUpdate(pkgVersion);
         if (args.check) {
             output("upgrade", check);

package/dist/commands/tasks/tasks.js

@@ -875,14 +875,6 @@ function warnIneligibleRebind(runtime, explicitRebind, warnings) {
         return;
     warnings.push(`--rebind bound scheduled tasks to an ineligible ${runtime.kind ?? "unknown"} invocation (${runtime.binding.join(" ")}); scheduled runs will invoke a mutable, unproven binary. Install akm via \`npm install --global akm-cli\` or a standalone release, then re-run \`akm task sync --rebind\`.`);
 }
-export function prepareSchedulerRuntime(explicitRebind, operation, deps = {}) {
-    const invocation = (deps.resolveInvocation ?? resolveAkmInvocation)();
-    if (!invocation.eligible && !explicitRebind) {
-        throw new UsageError(`Refusing to ${operation} from an ineligible ${invocation.kind ?? "unknown"} invocation (${invocation.argv.join(" ")}).`, "INVALID_FLAG_VALUE", "npm-global ownership could not be verified. Run `npm install --global akm-cli` and use that launcher, use a standalone installation, or explicitly repeat the operation with --rebind.");
-    }
-    const contextPath = (deps.writeDescriptor ?? writeSchedulerContextDescriptor)(schedulerContextDescriptor());
-    return { binding: invocation.argv, contextPath, eligible: invocation.eligible, kind: invocation.kind };
-}
 function groupInstalledBindings(entries, invocation) {
     const groups = new Map();
     for (const entry of entries) {

package/dist/commands/url-checker.js

@@ -2,40 +2,32 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 const URL_RE = /https?:\/\/[^\s"'<>)\]]+/g;
-const TIMEOUT_MS = 5000;
-const MAX_URLS = 20;
+/**
+ * Check every URL in `entries` and report the ones that are dead.
+ *
+ * No cap, no per-entry slice, no ceiling option. There used to be a
+ * `MAX_URLS = 20` plus an undocumented `slice(0, 3)` per entry, so this
+ * examined at most twenty links in a bundle holding thousands and reported
+ * success. The first attempt at fixing that kept the cap and layered a
+ * coverage report, a warning, and an override on top — a constraint plus more
+ * code to explain the constraint. Both are gone. It checks what you asked it
+ * to check.
+ *
+ * A request that fails, times out, or cannot resolve surfaces as a `DeadUrl`
+ * rather than being swallowed, so a network problem is visible instead of
+ * looking like a clean bill of health.
+ */
 export async function checkDeadUrls(_stashDir, entries) {
-    const urlsToCheck = [];
-    for (const entry of entries) {
-        if (urlsToCheck.length >= MAX_URLS)
-            break;
-        const matches = entry.body.match(URL_RE) ?? [];
-        for (const url of matches.slice(0, 3)) {
-            urlsToCheck.push({ ref: entry.ref, url });
-            if (urlsToCheck.length >= MAX_URLS)
-                break;
-        }
-    }
+    const urlsToCheck = entries.flatMap((entry) => (entry.body.match(URL_RE) ?? []).map((url) => ({ ref: entry.ref, url })));
     const results = [];
     await Promise.allSettled(urlsToCheck.map(async ({ ref, url }) => {
         try {
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-            const res = await fetch(url, {
-                method: "HEAD",
-                signal: controller.signal,
-                redirect: "follow",
-            });
-            clearTimeout(timer);
-            if (res.status >= 400) {
+            const res = await fetch(url, { method: "HEAD", redirect: "follow" });
+            if (res.status >= 400)
                 results.push({ ref, url, status: res.status });
-            }
         }
-        catch (e) {
-            if (e.name === "AbortError") {
-                results.push({ ref, url, status: "timeout" });
-            }
-            // network errors (ENOTFOUND etc.) — skip, don't report as dead
+        catch {
+            results.push({ ref, url, status: "error" });
         }
     }));
     return results;

package/dist/core/adapter/adapters/agent-skills-adapter.js

@@ -44,6 +44,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { hashContent, nonEmptyString, readTags } from "./shared.js";
 /** A skills collection is a single-component bundle; its one component is `main`. */
 const COMPONENT_ID = "main";
@@ -56,11 +57,6 @@ const DESCRIPTION_MAX = 1024;
 const RESERVED_NAME_WORDS = ["anthropic", "claude"];
 /** name charset/shape rule (spec §4.5). */
 const NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** conceptId + package-dir name for a `<name>/SKILL.md` file, or null when the file is not a skill manifest. */
 function skillPackage(relPath) {
     const posix = toPosix(relPath);
@@ -95,7 +91,7 @@ function recognize(c, file) {
         adapterId: "agent-skills",
         type: "skill",
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (description !== undefined)
         doc.description = description;

package/dist/core/adapter/adapters/akm-adapter.js

@@ -88,7 +88,7 @@ import { executionDefaultsFromFrontmatter, renderMarkdownExecutionSource } from
 import { recognizeMatch } from "../recognize-match.js";
 import { perTypeValidateChecks, skillDirectoryDiagnostics, workflowYamlSourceDiagnostics } from "./akm-lint.js";
 import { applyFoldedMetadata, foldRecognizedMetadata } from "./akm-metadata.js";
-import { hashContent, runBaseValidateChecks } from "./shared.js";
+import { hashContent, RESERVED_FILES, runBaseValidateChecks } from "./shared.js";
 // `recognizeMatch` + the builtin matcher list moved to the cycle-free leaf
 // `../recognize-match` (Chunk 5 M-b) so both this adapter AND the indexer
 // metadata pass import it without closing a metadata ↔ adapter cycle. Re-exported
@@ -99,12 +99,11 @@ export { recognizeMatch } from "../recognize-match.js";
  * OKF reserved structural files (ref-grammar decision D-R6, spec §5.1 /
  * adapter-spec §5.1/§6): `index.md` (directory listing) and `log.md` (update
  * history) are bundle structure at EVERY depth — never a concept document. The
- * `okf` / `llm-wiki` adapters already exclude them (`okf-adapter.ts`
+ * `okf` / `llm-wiki` adapters already exclude them (`shared.ts`'s
  * `RESERVED_FILES`); this brings the `akm` adapter into conformance so a
  * `knowledge/index.md` never classifies as a `knowledge` item. Case-insensitive,
  * matched on the bare filename so the exclusion holds at any depth.
  */
-const RESERVED_FILES = new Set(["index.md", "log.md"]);
 /** True when `name` (a bare file name) is an OKF reserved file, case-insensitively (D-R6). */
 function isReservedFileName(name) {
     return RESERVED_FILES.has(name.toLowerCase());

package/dist/core/adapter/adapters/akm-lint.js

@@ -57,7 +57,7 @@ import { taskSourceErrorDetail } from "../../../tasks/source-v3.js";
 import { compileWorkflowPlan } from "../../../workflows/ir/compile.js";
 import { compileWorkflowSource } from "../../../workflows/source-ir/compile.js";
 import { conceptIdForStashFile } from "../../asset/resolve-ref.js";
-import { isAkmRegistryCachePath } from "../../common.js";
+import { isAkmRegistryCachePath, scanEnvKeyNames } from "../../common.js";
 /** Recommended `category` values for facts — `commands/lint/fact-linter.ts:9`. */
 const KNOWN_CATEGORIES = new Set(["personal", "team", "project", "convention", "meta"]);
 /** Placeholder markers a workflow stub carries — `commands/lint/workflow-linter.ts:10`. */
@@ -118,24 +118,6 @@ export function nameOrTypeDiagnostics(relPath, data, frontmatter, allowedTypes)
     return [];
 }
 // ── env dangerous-key scan (content-based port of env-key-rules.ts) ──────────
-/** Matches a KEY=value assignment line, capturing only the key — `commands/env/env.ts:62`. */
-const ASSIGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-/** Port of `commands/env/env.ts#scanKeys` (`:65-77`) — content-based (overlay `raw`, not disk). */
-function scanKeys(text) {
-    const keys = [];
-    const seen = new Set();
-    for (const line of text.split(/\r?\n/)) {
-        const m = line.match(ASSIGN_RE);
-        if (!m)
-            continue;
-        const key = m[1];
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        keys.push(key);
-    }
-    return keys;
-}
 /** Port of `env-key-rules.ts#collectSuppressedKeys` (`:144-164`) — content-based. */
 function collectSuppressedKeys(raw) {
     const suppressed = new Set();
@@ -171,7 +153,7 @@ export function dangerousEnvKeyDiagnostics(type, relPath, raw) {
         return []; // NARROWNESS: collectEnvFiles only visits *.env
     // `relPath` is already stash-root-relative, so "." IS the stash root here.
     const ref = conceptIdForStashFile(type, ".", relPath);
-    const keys = scanKeys(raw);
+    const keys = scanEnvKeyNames(raw);
     const suppressed = collectSuppressedKeys(raw);
     const diagnostics = [];
     for (const key of keys) {

package/dist/core/adapter/adapters/akm-task-adapter.js

@@ -35,16 +35,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { parseTaskSource } from "../../../tasks/source/parse-task-source.js";
 import { TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskSourceErrorDetail, } from "../../../tasks/source-v3.js";
+import { toPosix } from "../../common.js";
 import { hashContent } from "./shared.js";
 /** A native task bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
 /** The task YAML extension (spec §6 task row). */
 const TASK_EXT = TASK_EXTENSION;
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 function recognize(c, file) {
     if (file.ext !== TASK_EXT)
         return null;
@@ -61,7 +57,7 @@ function recognize(c, file) {
         adapterId: "akm-task",
         type: "task",
         name,
-        content: raw.length > MAX_CONTENT_CHARS ? raw.slice(0, MAX_CONTENT_CHARS) : raw,
+        content: raw,
     };
 }
 async function validate(c, changes, ctx) {

package/dist/core/adapter/adapters/akm-workflow-adapter.js

@@ -23,17 +23,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { looksLikeGithubWorkflowSource } from "../../../workflows/source-ir/compile.js";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { perTypeValidateChecks, workflowYamlSourceDiagnostics } from "./akm-lint.js";
 import { hashContent, nonEmptyString, readTags, runBaseValidateChecks } from "./shared.js";
 /** A native workflow bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
 /** The two authoritative workflow source formats. `.yaml` is deliberately not accepted. */
 const WORKFLOW_EXTS = new Set([".md", ".yml"]);
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** Strip the recognized workflow extension from a component-root-relative path → conceptId. */
 function conceptIdOf(relPath) {
     return toPosix(relPath).replace(/\.(?:md|yml)$/i, "");
@@ -78,7 +74,7 @@ function recognize(c, file) {
         adapterId: "akm-workflow",
         type: "workflow",
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (description !== undefined)
         doc.description = description;

package/dist/core/adapter/adapters/dotenv-adapter.js

@@ -30,6 +30,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { assetPathCandidatesForName, assetPathForName, typeForStashDir } from "../../asset/asset-placement.js";
+import { scanEnvKeyNames, toPosix } from "../../common.js";
 import { dangerousEnvKeyDiagnostics } from "./akm-lint.js";
 import { hashContent } from "./shared.js";
 /** A dotenv bundle is single-component; its one component is `main`. */
@@ -40,11 +41,6 @@ const ENV_DIR = "env";
 const SECRETS_DIR = "secrets";
 /** Non-secret marker suffixes under `secrets/` (spec §6 secret row). */
 const SECRET_SKIP_SUFFIXES = [".lock", ".sensitive"];
-/** Matches a KEY=value assignment line, capturing only the key (mirrors akm-lint scanKeys). */
-const ASSIGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** Classify a component-root-relative file as env / secret, or null (abstain). */
 function classify(relPath) {
     const posix = toPosix(relPath);
@@ -80,22 +76,6 @@ function hasSensitiveMarker(absPath, type) {
     const marker = type === "env" ? absPath.replace(/\.env$/i, ".sensitive") : `${absPath}.sensitive`;
     return marker !== absPath && fs.existsSync(marker);
 }
-/** Extract KEY NAMES (never values) from an env file's raw content, first-appearance order, deduped. */
-function scanKeyNames(raw) {
-    const keys = [];
-    const seen = new Set();
-    for (const line of raw.split(/\r?\n/)) {
-        const m = line.match(ASSIGN_RE);
-        if (!m)
-            continue;
-        const key = m[1];
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        keys.push(key);
-    }
-    return keys;
-}
 function conceptIdForPath(type, relativePath) {
     const posix = toPosix(relativePath);
     if (type === "secret")
@@ -115,7 +95,7 @@ function recognize(c, file) {
         // env: strip `.env`; surface KEY NAMES only (never values/comments/content).
         const conceptId = conceptIdForPath(type, posix);
         const name = (conceptId.split("/").pop() ?? conceptId) || "default";
-        const keys = scanKeyNames(raw);
+        const keys = scanEnvKeyNames(raw);
         const doc = {
             ref: `${c.id}//${conceptId}`,
             bundle: c.id,

package/dist/core/adapter/adapters/generic-files-adapter.js

@@ -23,19 +23,13 @@
  */
 import path from "node:path";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { SCRIPT_EXTENSIONS } from "../../recognition-util.js";
-import { hashContent, nonEmptyString, readTags, runBaseValidateChecks } from "./shared.js";
+import { hashContent, nonEmptyString, RESERVED_FILES, readTags, runBaseValidateChecks } from "./shared.js";
 /** A generic-files bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
 /** Markdown / plain-text extensions classified as `document`. */
 const DOCUMENT_EXTENSIONS = new Set([".md", ".markdown", ".txt", ".text"]);
-/** OKF reserved structural files (D-R6) — excluded from the catch-all, case-insensitive. */
-const RESERVED_FILES = new Set(["index.md", "log.md"]);
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 function isReserved(base) {
     return RESERVED_FILES.has(base.toLowerCase());
 }
@@ -69,7 +63,7 @@ function recognize(c, file) {
         adapterId: "generic-files",
         type,
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (type !== "script")
         doc.ownsPresentation = true;

package/dist/core/adapter/adapters/llm-wiki-adapter.js

@@ -73,6 +73,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { parseFrontmatter, parseFrontmatterBlock } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { hashContent, nonEmptyString } from "./shared.js";
 /** A wiki is a single-component bundle; its one component is conventionally `main` (recognition golden). */
 const WIKI_COMPONENT_ID = "main";
@@ -86,12 +87,7 @@ const RESERVED_ROOT_FILES = new Set(["schema.md", "index.md", "log.md"]);
 const RAW_SUBDIR = "raw";
 /** Content subdirectory holding agent-authored pages. */
 const PAGES_SUBDIR = "pages";
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
 /** POSIX-normalize separators. */
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** conceptId = component-root-relative path minus `.md`. */
 function conceptIdOf(relPath) {
     return toPosix(relPath).replace(/\.md$/i, "");
@@ -280,7 +276,7 @@ function recognize(c, file) {
         ownsPresentation: true,
         type: isRaw ? WIKI_SOURCE_TYPE : (fm.pageKind ?? DEFAULT_PAGE_KIND),
         name: lastSegment,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (fm.description !== undefined)
         doc.description = fm.description;

package/dist/core/adapter/adapters/okf-adapter.js

@@ -31,7 +31,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
-import { hashContent, nonEmptyString, readTags, runBaseValidateChecks } from "./shared.js";
+import { isRecord, toPosix } from "../../common.js";
+import { hashContent, nonEmptyString, RESERVED_FILES, readTags, runBaseValidateChecks } from "./shared.js";
 /** v0.2 frontmatter keys consumed into first-class fields below (§0.1) — excluded from the generic `documentJson` extras fold alongside the v0.1 five, so nothing is duplicated between a first-class field and the opaque extras bag. */
 const CONSUMED_FRONTMATTER_KEYS = [
     "type",
@@ -46,17 +47,13 @@ const CONSUMED_FRONTMATTER_KEYS = [
     "stale_after",
     "okf_version",
 ];
-/** True for a plain (non-null, non-array) object — the shape every v0.2 mapping (`generated`, one `verified`/`sources` entry) must have. */
-function isPlainObject(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
  * Parse one `verified:` actor mapping (`{by, at?}`). Tolerant: a missing/blank
  * `by` yields `undefined` (the entry is dropped, never rejecting the document
  * — OKF conformance leniency); `at` is independently optional.
  */
 function parseActorMapping(value) {
-    if (!isPlainObject(value))
+    if (!isRecord(value))
         return undefined;
     const by = nonEmptyString(value.by);
     if (by === undefined)
@@ -96,7 +93,7 @@ function parseOkfSources(value) {
         return undefined;
     const out = [];
     for (const item of value) {
-        if (!isPlainObject(item))
+        if (!isRecord(item))
             continue;
         const resource = nonEmptyString(item.resource);
         if (resource === undefined)
@@ -125,15 +122,7 @@ function parseOkfSources(value) {
 function parseLifecycleStatus(value) {
     return value === "draft" || value === "stable" || value === "deprecated" ? value : undefined;
 }
-/** Reserved OKF files (case-insensitive) — recognized, never indexed as concepts (§5, OKF §1.4). */
-const RESERVED_FILES = new Set(["index.md", "log.md"]);
-/** Upper bound on the bounded `content` FTS field (§3: "content: FTS 1 (bounded)"). Small fixtures are never truncated. */
-const MAX_CONTENT_CHARS = 100_000;
-/** POSIX-normalize separators without importing a cycle-participant helper. */
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
-/** True when `name` (a bare file name) is a reserved OKF file, case-insensitively. */
+/** True when `name` (a bare file name) is a reserved OKF file, case-insensitively (§5, OKF §1.4). */
 function isReservedFileName(name) {
     return RESERVED_FILES.has(name.toLowerCase());
 }
@@ -237,7 +226,7 @@ function recognize(c, file) {
     // `generated.at` — v0.2's replacement for `timestamp` — takes precedence;
     // `timestamp` remains a fully valid fallback (the v0.2-permitted legacy
     // reading, not merely tolerated). Both stay fully optional (never rejects).
-    const generatedMapping = isPlainObject(data.generated) ? data.generated : undefined;
+    const generatedMapping = isRecord(data.generated) ? data.generated : undefined;
     const generatedAt = generatedMapping ? nonEmptyString(generatedMapping.at) : undefined;
     const generatedBy = generatedMapping ? nonEmptyString(generatedMapping.by) : undefined;
     const legacyTimestamp = nonEmptyString(data.timestamp);
@@ -272,7 +261,7 @@ function recognize(c, file) {
         ownsPresentation: true,
         type,
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (description !== undefined)
         doc.description = description;

package/dist/core/adapter/adapters/shared.js

@@ -69,6 +69,8 @@ export function readTags(value) {
     const tags = value.filter((tag) => typeof tag === "string" && tag.trim().length > 0);
     return tags.length > 0 ? tags : undefined;
 }
+/** Reserved files (case-insensitive) every concrete adapter recognizes but never indexes as a concept. */
+export const RESERVED_FILES = new Set(["index.md", "log.md"]);
 // ── Base validate checks (port of `BaseLinter.runBaseChecks`) ────────────────
 function checkMissingUpdated(data, frontmatterText) {
     return frontmatterText !== null && !("updated" in data);