kibi-cli 2.0.0 → 2.1.0

package/dist/plugins/compose-ontology-packs.js

@@ -0,0 +1,257 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+import { validateOntologyMatchCandidate, validatePredicateSchema, } from "kibi-plugin-sdk";
+import { PluginResolutionError } from "./resolve-package.js";
+function candidateKey(candidate, claimKey) {
+    return [
+        claimKey ?? "",
+        candidate.schemaId,
+        candidate.polarity,
+        ...candidate.arguments,
+    ].join("\0");
+}
+function packOwnedSchemas(binding) {
+    const schemas = binding.capability
+        .schemas()
+        .map((schema) => validatePredicateSchema(schema));
+    const owned = new Set(schemas.map((schema) => schema.schemaId));
+    return { schemas, owned };
+}
+function tryPackOwnedSchemas(binding, diagnostics) {
+    try {
+        return packOwnedSchemas(binding);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        diagnostics.push(`ontology pack '${binding.capability.id}' schemas() failed: ${message}`);
+        return null;
+    }
+}
+/**
+ * Collect active ontology schemas with replace / augment / shadow semantics.
+ * Schema id collisions across packs are rejected. Shadow packs do not alter
+ * the canonical catalog.
+ *
+ * Replace semantics:
+ * - A successful replace pack *replaces* the builtin provider catalog.
+ * - Provider exception / invalid catalog construction falls back to builtin.
+ * - Shadow packs are never merged into the canonical catalog.
+ */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function composeOntologyCatalog(resolution) {
+    const stamps = [];
+    const ownership = new Map();
+    const schemasById = new Map();
+    const diagnostics = [];
+    let replaced = false;
+    const addPack = (binding) => {
+        const { schemas, owned } = packOwnedSchemas(binding);
+        for (const schema of schemas) {
+            const existing = schemasById.get(schema.schemaId);
+            if (existing && existing.predicateName !== schema.predicateName) {
+                throw new PluginResolutionError("ONTOLOGY_SCHEMA_COLLISION", `Ontology schema id '${schema.schemaId}' collides across packs`);
+            }
+            if (!existing) {
+                schemasById.set(schema.schemaId, schema);
+            }
+            owned.add(schema.schemaId);
+        }
+        ownership.set(binding.capability.id, owned);
+        stamps.push(binding.stamp);
+    };
+    if (resolution.replace) {
+        try {
+            addPack(resolution.replace);
+            replaced = true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            diagnostics.push(`replace ontology pack '${resolution.replace.pluginId}' failed catalog construction (${message}); falling back to builtin`);
+            addPack(resolution.builtin);
+        }
+    }
+    else {
+        addPack(resolution.builtin);
+        for (const augment of resolution.augment) {
+            addPack(augment);
+        }
+    }
+    for (const shadow of resolution.shadow) {
+        stamps.push(shadow.stamp);
+    }
+    return {
+        schemas: [...schemasById.values()],
+        stamps,
+        ownership,
+        replaced,
+        diagnostics,
+    };
+}
+function runPackMatches(binding, context, ownedSchemaIds, packSchemas, target, seen, diagnostics) {
+    let raw;
+    try {
+        raw = binding.capability.match(context);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        diagnostics.push(`ontology pack '${binding.capability.id}' match() threw: ${message}`);
+        return "failed";
+    }
+    if (!Array.isArray(raw)) {
+        diagnostics.push(`ontology pack '${binding.capability.id}' match() returned a non-array; treating as provider failure`);
+        return "failed";
+    }
+    let accepted = 0;
+    for (const entry of raw) {
+        try {
+            if (entry &&
+                typeof entry === "object" &&
+                "schemaId" in entry &&
+                typeof entry.schemaId === "string" &&
+                !ownedSchemaIds.has(entry.schemaId)) {
+                diagnostics.push(`ontology pack '${binding.capability.id}' returned schema '${entry.schemaId}' it does not own; rejected`);
+                continue;
+            }
+            const candidate = validateOntologyMatchCandidate(entry, packSchemas);
+            if (!ownedSchemaIds.has(candidate.schemaId)) {
+                diagnostics.push(`ontology pack '${binding.capability.id}' returned schema '${candidate.schemaId}' it does not own; rejected`);
+                continue;
+            }
+            const key = candidateKey(candidate, context.claimKey);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            target.push({
+                ...candidate,
+                claimKey: context.claimKey,
+                packId: binding.capability.id,
+                stamp: binding.stamp,
+            });
+            accepted += 1;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            diagnostics.push(`ontology pack '${binding.capability.id}' produced an invalid candidate: ${message}`);
+        }
+    }
+    if (raw.length === 0) {
+        diagnostics.push(`ontology pack '${binding.capability.id}' abstained (valid empty match)`);
+        return "abstained";
+    }
+    if (accepted === 0 && raw.length > 0) {
+        // Every candidate was invalid → treat as provider failure for replace fallback.
+        diagnostics.push(`ontology pack '${binding.capability.id}' returned only invalid candidates`);
+        return "failed";
+    }
+    return "ok";
+}
+/**
+ * Match ontology candidates across the active catalog.
+ *
+ * Replace abstention (`[]`) is *not* failure: it means the replacement pack
+ * found no match and builtin must not run. Builtin fallback happens only on
+ * provider exception / malformed output / invalid catalog construction.
+ *
+ * Shadow packs validate against their own schemas and use a separate dedupe
+ * set so a canonical candidate never suppresses the corresponding shadow
+ * comparison.
+ */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export function composeOntologyMatches(resolution, context) {
+    const catalog = composeOntologyCatalog(resolution);
+    const diagnostics = [...catalog.diagnostics];
+    const canonical = [];
+    const shadow = [];
+    const canonicalSeen = new Set();
+    const shadowSeen = new Set();
+    const ownedFor = (binding) => {
+        // Prefer the already-validated catalog schemas so we never re-invoke
+        // schemas() for packs that survived catalog construction (and so a
+        // replace pack that already failed catalog cannot crash matching).
+        const fromCatalog = catalog.ownership.get(binding.capability.id);
+        if (fromCatalog) {
+            const schemas = catalog.schemas.filter((schema) => fromCatalog.has(schema.schemaId));
+            return { owned: fromCatalog, schemas };
+        }
+        // Shadow packs (and replace packs that failed catalog construction) are
+        // not in the canonical catalog; load their schemas with containment.
+        return tryPackOwnedSchemas(binding, diagnostics);
+    };
+    if (resolution.replace) {
+        const replaceOwned = ownedFor(resolution.replace);
+        if (!replaceOwned) {
+            diagnostics.push(`replace ontology pack '${resolution.replace.pluginId}' schemas unavailable for match; falling back to builtin`);
+            const builtin = ownedFor(resolution.builtin);
+            if (builtin) {
+                runPackMatches(resolution.builtin, context, builtin.owned, builtin.schemas, canonical, canonicalSeen, diagnostics);
+            }
+        }
+        else {
+            const outcome = runPackMatches(resolution.replace, context, replaceOwned.owned, replaceOwned.schemas, canonical, canonicalSeen, diagnostics);
+            if (outcome === "failed") {
+                diagnostics.push(`replace ontology pack '${resolution.replace.pluginId}' match failed; falling back to builtin`);
+                const builtin = ownedFor(resolution.builtin);
+                if (builtin) {
+                    runPackMatches(resolution.builtin, context, builtin.owned, builtin.schemas, canonical, canonicalSeen, diagnostics);
+                }
+            }
+            else if (outcome === "abstained") {
+                diagnostics.push(`replace ontology pack '${resolution.replace.pluginId}' abstained; builtin match not consulted`);
+            }
+        }
+    }
+    else {
+        const builtin = ownedFor(resolution.builtin);
+        if (builtin) {
+            runPackMatches(resolution.builtin, context, builtin.owned, builtin.schemas, canonical, canonicalSeen, diagnostics);
+        }
+        for (const augment of resolution.augment) {
+            const pack = ownedFor(augment);
+            if (!pack)
+                continue;
+            runPackMatches(augment, context, pack.owned, pack.schemas, canonical, canonicalSeen, diagnostics);
+        }
+    }
+    for (const shadowBinding of resolution.shadow) {
+        const pack = ownedFor(shadowBinding);
+        if (!pack) {
+            // Shadow must never fail the host operation; skip this pack.
+            continue;
+        }
+        runPackMatches(shadowBinding, context, pack.owned, pack.schemas, shadow, shadowSeen, diagnostics);
+    }
+    canonical.sort((a, b) => {
+        const pack = a.packId.localeCompare(b.packId);
+        if (pack !== 0)
+            return pack;
+        const schema = a.schemaId.localeCompare(b.schemaId);
+        if (schema !== 0)
+            return schema;
+        const polarity = a.polarity.localeCompare(b.polarity);
+        if (polarity !== 0)
+            return polarity;
+        return a.arguments.join("\0").localeCompare(b.arguments.join("\0"));
+    });
+    return {
+        canonical,
+        shadow,
+        stamps: catalog.stamps,
+        replaced: catalog.replaced,
+        diagnostics,
+    };
+}

package/dist/plugins/compose-semantic-classifier.d.ts

@@ -0,0 +1,42 @@
+import { type PluginMode, type PluginProviderStamp, type SemanticClassificationDecision, type SemanticClassifierInput, type SemanticClassifierV1 } from "kibi-plugin-sdk";
+import type { CapabilityModeResolution } from "./registry.js";
+export type SemanticClassifierDiagnostic = Readonly<{
+    pluginId: string;
+    packageName: string | null;
+    mode: PluginMode | "builtin";
+    code: string;
+    message: string;
+    model?: string;
+}>;
+export type ComposedSemanticClassifierResult = Readonly<{
+    decisions: readonly SemanticClassificationDecision[];
+    stamps: readonly PluginProviderStamp[];
+    shadowComparisons: readonly {
+        readonly stamp: PluginProviderStamp;
+        readonly decisions: readonly SemanticClassificationDecision[];
+    }[];
+    fallbackUsed: boolean;
+    diagnostics: readonly SemanticClassifierDiagnostic[];
+}>;
+/** Bounded provenance copied onto advisor and compile-intent results. */
+export declare function publicCapabilityStamp(stamp: PluginProviderStamp): {
+    pluginId: string;
+    pluginVersion: string;
+    capability: string;
+    mode: string;
+    external: boolean;
+    network: boolean;
+    metered: boolean;
+    fallbackUsed?: boolean;
+    model?: string;
+};
+/**
+ * Compose semantic classifiers according to replace / augment / shadow modes.
+ *
+ * External providers are skipped unless `operationName` is on the allowlist
+ * (`kb_semantic_advisor`, `kb_compile_intent`).
+ */
+export declare function composeSemanticClassification(resolution: CapabilityModeResolution<SemanticClassifierV1>, input: SemanticClassifierInput, options: Readonly<{
+    operationName: string;
+}>): Promise<ComposedSemanticClassifierResult>;
+//# sourceMappingURL=compose-semantic-classifier.d.ts.map

package/dist/plugins/compose-semantic-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-semantic-classifier.d.ts","sourceRoot":"","sources":["../../src/plugins/compose-semantic-classifier.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,UAAU,EACf,KAAK,mBAAmB,EAExB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAE5B,KAAK,oBAAoB,EAE1B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;IACrD,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACvC,iBAAiB,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,8BAA8B,EAAE,CAAC;KAC/D,EAAE,CAAC;IACJ,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtD,CAAC,CAAC;AAMH,yEAAyE;AAEzE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAYA;AAyGD;;;;;GAKG;AAEH,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,wBAAwB,CAAC,oBAAoB,CAAC,EAC1D,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CA0G3C"}

package/dist/plugins/compose-semantic-classifier.js

@@ -0,0 +1,211 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+import { PluginValidationError, validateSemanticClassifierResult, } from "kibi-plugin-sdk";
+import { allowsExternalSemanticClassifier } from "./external-allowlist.js";
+/** Bounded provenance copied onto advisor and compile-intent results. */
+// implements REQ-capability-plugin-activation-disclosure-v1, REQ-capability-plugin-observable-behavior-v1
+export function publicCapabilityStamp(stamp) {
+    return {
+        pluginId: stamp.pluginId,
+        pluginVersion: stamp.pluginVersion,
+        capability: stamp.capability,
+        mode: stamp.mode,
+        external: stamp.external,
+        network: stamp.network,
+        metered: stamp.metered,
+        ...(stamp.fallbackUsed === true ? { fallbackUsed: true } : {}),
+        ...(stamp.model !== undefined ? { model: stamp.model } : {}),
+    };
+}
+function withFallback(stamp, fallbackUsed) {
+    return fallbackUsed ? { ...stamp, fallbackUsed: true } : stamp;
+}
+function isUnresolved(decision) {
+    if (!decision)
+        return true;
+    if (decision.lane === "none")
+        return true;
+    if (decision.ambiguity?.ambiguous === true)
+        return true;
+    return false;
+}
+function redactClassifierMessage(message) {
+    return message
+        .replace(/sk-[A-Za-z0-9_-]+/g, "[redacted]")
+        .replace(/(api[_-]?key\s*[:=]\s*)\S+/gi, "$1[redacted]")
+        .slice(0, 300);
+}
+function diagnosticFromError(binding, error) {
+    const message = redactClassifierMessage(error instanceof Error ? error.message : String(error));
+    let code = "unknown";
+    let model;
+    if (error instanceof PluginValidationError) {
+        code = error.code;
+    }
+    else if (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string") {
+        code = error.code;
+    }
+    if (typeof error === "object" &&
+        error !== null &&
+        "model" in error &&
+        typeof error.model === "string") {
+        model = error.model;
+    }
+    return {
+        pluginId: binding.pluginId,
+        packageName: binding.packageName,
+        mode: binding.mode,
+        code,
+        message,
+        ...(model !== undefined ? { model } : {}),
+    };
+}
+async function runClassifier(binding, input) {
+    try {
+        const raw = await binding.capability.classify(input);
+        return {
+            ok: true,
+            result: validateSemanticClassifierResult(raw, {
+                expectedClaimKeys: input.propositions.map((proposition) => proposition.claimKey),
+            }),
+        };
+    }
+    catch (error) {
+        return { ok: false, diagnostic: diagnosticFromError(binding, error) };
+    }
+}
+function fillMissingDecisions(input, decisions, builtin) {
+    const byKey = new Map(decisions.map((decision) => [decision.claimKey, decision]));
+    const builtinByKey = new Map((builtin?.decisions ?? []).map((decision) => [decision.claimKey, decision]));
+    return input.propositions.map((proposition) => {
+        const existing = byKey.get(proposition.claimKey);
+        if (existing)
+            return existing;
+        const fallback = builtinByKey.get(proposition.claimKey);
+        if (fallback)
+            return fallback;
+        return {
+            claimKey: proposition.claimKey,
+            lane: "none",
+            confidence: 0,
+        };
+    });
+}
+/**
+ * Compose semantic classifiers according to replace / augment / shadow modes.
+ *
+ * External providers are skipped unless `operationName` is on the allowlist
+ * (`kb_semantic_advisor`, `kb_compile_intent`).
+ */
+// implements REQ-capability-plugin-activation-disclosure-v1, REQ-capability-plugin-observable-behavior-v1
+export async function composeSemanticClassification(resolution, input, options) {
+    const allowExternal = allowsExternalSemanticClassifier(options.operationName);
+    const stamps = [];
+    const diagnostics = [];
+    const shadowComparisons = [];
+    let fallbackUsed = false;
+    let decisions = [];
+    if (allowExternal && resolution.replace) {
+        const replaced = await runClassifier(resolution.replace, input);
+        if (replaced.ok) {
+            // Replace success: missing decisions get conservative `none`, not builtin
+            // fill. Valid empty decisions[] is abstention (same as ontology replace).
+            decisions = fillMissingDecisions(input, replaced.result.decisions, null);
+            stamps.push(resolution.replace.stamp);
+        }
+        else {
+            diagnostics.push(replaced.diagnostic);
+            const builtinResult = await runClassifier(resolution.builtin, input);
+            if (builtinResult.ok) {
+                decisions = [...builtinResult.result.decisions];
+                stamps.push(withFallback(resolution.builtin.stamp, true));
+            }
+            else {
+                diagnostics.push(builtinResult.diagnostic);
+                decisions = [];
+            }
+            fallbackUsed = true;
+        }
+    }
+    else {
+        const builtinResult = await runClassifier(resolution.builtin, input);
+        if (builtinResult.ok) {
+            decisions = [...builtinResult.result.decisions];
+            stamps.push(resolution.builtin.stamp);
+        }
+        else {
+            diagnostics.push(builtinResult.diagnostic);
+            decisions = [];
+        }
+        if (allowExternal) {
+            for (const augment of resolution.augment) {
+                const unresolvedKeys = new Set(input.propositions
+                    .filter((proposition) => {
+                    const current = decisions.find((decision) => decision.claimKey === proposition.claimKey);
+                    return isUnresolved(current);
+                })
+                    .map((proposition) => proposition.claimKey));
+                if (unresolvedKeys.size === 0)
+                    break;
+                const subset = {
+                    propositions: input.propositions.filter((proposition) => unresolvedKeys.has(proposition.claimKey)),
+                };
+                const augmentResult = await runClassifier(augment, subset);
+                if (!augmentResult.ok) {
+                    diagnostics.push(augmentResult.diagnostic);
+                    continue;
+                }
+                stamps.push(augment.stamp);
+                const byKey = new Map(decisions.map((decision) => [decision.claimKey, decision]));
+                for (const decision of augmentResult.result.decisions) {
+                    if (!unresolvedKeys.has(decision.claimKey))
+                        continue;
+                    if (decision.lane === "none")
+                        continue;
+                    byKey.set(decision.claimKey, decision);
+                }
+                decisions = fillMissingDecisions(input, [...byKey.values()], builtinResult.ok ? builtinResult.result : null);
+            }
+        }
+    }
+    decisions = fillMissingDecisions(input, decisions, null);
+    if (allowExternal) {
+        for (const shadow of resolution.shadow) {
+            const shadowResult = await runClassifier(shadow, input);
+            if (!shadowResult.ok) {
+                diagnostics.push(shadowResult.diagnostic);
+                continue;
+            }
+            stamps.push(shadow.stamp);
+            shadowComparisons.push({
+                stamp: shadow.stamp,
+                decisions: shadowResult.result.decisions,
+            });
+        }
+    }
+    return {
+        decisions,
+        stamps,
+        shadowComparisons,
+        fallbackUsed,
+        diagnostics,
+    };
+}

package/dist/plugins/external-allowlist.d.ts

@@ -0,0 +1,10 @@
+/**
+ * External capability plugins may be imported only from these operation
+ * boundaries. sync / check / validate-upsert / upsert / migration / status /
+ * proof / doctor / coverage / suggest-predicates must never import a
+ * third-party plugin module — allowlisting the classifier call is not enough.
+ */
+export declare const EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS: readonly ["kb_semantic_advisor", "kb_compile_intent"];
+export type ExternalSemanticClassifierOperation = (typeof EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS)[number];
+export declare function allowsExternalSemanticClassifier(operationName: string): boolean;
+//# sourceMappingURL=external-allowlist.d.ts.map

package/dist/plugins/external-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-allowlist.d.ts","sourceRoot":"","sources":["../../src/plugins/external-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,uCAAuC,uDAG1C,CAAC;AAGX,MAAM,MAAM,mCAAmC,GAC7C,CAAC,OAAO,uCAAuC,CAAC,CAAC,MAAM,CAAC,CAAC;AAK3D,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET"}

package/dist/plugins/external-allowlist.js

@@ -0,0 +1,16 @@
+/**
+ * External capability plugins may be imported only from these operation
+ * boundaries. sync / check / validate-upsert / upsert / migration / status /
+ * proof / doctor / coverage / suggest-predicates must never import a
+ * third-party plugin module — allowlisting the classifier call is not enough.
+ */
+// implements REQ-capability-plugin-activation-disclosure-v1
+export const EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS = [
+    "kb_semantic_advisor",
+    "kb_compile_intent",
+];
+const ALLOWED = new Set(EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS);
+// implements REQ-capability-plugin-activation-disclosure-v1, REQ-capability-plugin-observable-behavior-v1
+export function allowsExternalSemanticClassifier(operationName) {
+    return ALLOWED.has(operationName);
+}

package/dist/plugins/index.d.ts

@@ -0,0 +1,9 @@
+export { describeConfiguredCapabilityPlugins, readProjectKibiConfig, readProjectPackageJson, type ConfiguredCapabilityPluginDiagnostic, type ProjectPackageManifest, } from "./project-config.js";
+export { PluginResolutionError, PluginValidationError, assertBarePackageName, assertResolvedEntryInsidePackageRoot, hasConsumerNodeModulesLink, hasDeclaredProjectDependency, isBarePackageName, isProjectScopedPackage, packageJsonForResolvedFile, resolveProjectLocalPackage, type ResolvedProjectPackage, } from "./resolve-package.js";
+export { loadPluginPackage, type LoadPluginOptions, type LoadedPlugin, } from "./load-plugin.js";
+export { CapabilityRegistry, CapabilityRegistryCache, createCapabilityRegistry, createCapabilityRegistryCache, createStubBuiltinPlugin, ensureCapabilityRegistry, type BuiltinPluginFactory, type CapabilityModeResolution, type CapabilityProviderBinding, type CapabilityRegistryOptions, type EnsureCapabilityRegistryOptions, } from "./registry.js";
+export { composeSemanticClassification, publicCapabilityStamp, type ComposedSemanticClassifierResult, type SemanticClassifierDiagnostic, } from "./compose-semantic-classifier.js";
+export { composeOntologyCatalog, composeOntologyMatches, type ComposedOntologyCatalog, type StampedOntologyCandidate, } from "./compose-ontology-packs.js";
+export { SourceAnalysisService, analyzeWithResolution, createConservativeFallbackAnalysis, createSourceAnalysisService, type HostSourceAnalysisResult, type SourceAnalysisServiceOptions, } from "./source-analysis-service.js";
+export { EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS, allowsExternalSemanticClassifier, type ExternalSemanticClassifierOperation, } from "./external-allowlist.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,oCAAoC,EACzC,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,GAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kCAAkC,EAClC,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uCAAuC,EACvC,gCAAgC,EAChC,KAAK,mCAAmC,GACzC,MAAM,yBAAyB,CAAC"}

package/dist/plugins/index.js

@@ -0,0 +1,33 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { describeConfiguredCapabilityPlugins, readProjectKibiConfig, readProjectPackageJson, } from "./project-config.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { PluginResolutionError, PluginValidationError, assertBarePackageName, assertResolvedEntryInsidePackageRoot, hasConsumerNodeModulesLink, hasDeclaredProjectDependency, isBarePackageName, isProjectScopedPackage, packageJsonForResolvedFile, resolveProjectLocalPackage, } from "./resolve-package.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { loadPluginPackage, } from "./load-plugin.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { CapabilityRegistry, CapabilityRegistryCache, createCapabilityRegistry, createCapabilityRegistryCache, createStubBuiltinPlugin, ensureCapabilityRegistry, } from "./registry.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { composeSemanticClassification, publicCapabilityStamp, } from "./compose-semantic-classifier.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { composeOntologyCatalog, composeOntologyMatches, } from "./compose-ontology-packs.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { SourceAnalysisService, analyzeWithResolution, createConservativeFallbackAnalysis, createSourceAnalysisService, } from "./source-analysis-service.js";
+// implements REQ-capability-plugin-activation-disclosure-v1
+export { EXTERNAL_SEMANTIC_CLASSIFIER_OPERATIONS, allowsExternalSemanticClassifier, } from "./external-allowlist.js";

package/dist/plugins/load-plugin.d.ts

@@ -0,0 +1,19 @@
+import { type KibiPluginV1 } from "kibi-plugin-sdk";
+import { type ResolvedProjectPackage } from "./resolve-package.js";
+export type LoadedPlugin = Readonly<{
+    packageName: string;
+    resolved: ResolvedProjectPackage;
+    plugin: KibiPluginV1;
+}>;
+export type LoadPluginOptions = Readonly<{
+    /** Injectable dynamic import for tests. */
+    importModule?: (url: string) => Promise<unknown>;
+    /** Injectable package resolver for tests. */
+    resolvePackage?: (workspaceRoot: string, packageName: string) => ResolvedProjectPackage;
+}>;
+/**
+ * Dynamically import a project-local plugin package and validate the named
+ * `kibiPlugin` export against kibi.plugin.v1.
+ */
+export declare function loadPluginPackage(workspaceRoot: string, packageName: string, options?: LoadPluginOptions): Promise<LoadedPlugin>;
+//# sourceMappingURL=load-plugin.d.ts.map

package/dist/plugins/load-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/load-plugin.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,2CAA2C;IAC3C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,6CAA6C;IAC7C,cAAc,CAAC,EAAE,CACf,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,KAChB,sBAAsB,CAAC;CAC7B,CAAC,CAAC;AAMH;;;GAGG;AAEH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,YAAY,CAAC,CA8CvB"}