kibi-cli 2.27.0 → 2.28.1

package/dist/operations/mutation/symbol-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-refresh.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/symbol-refresh.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAgBjF,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAGhB,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC;CACnD,CAAC;AAGF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,IAAI,IAAI,CAAC;CAClB,CAAC;AAEF,KAAK,qBAAqB,GAAG,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,aAAa,CAAC,CAAC;AAsD5B,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAMN;AAiPD,4EAA4E;AAC5E,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED,yEAAyE;AAEzE,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;;GAGG;AAEH,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAOxB;AAGD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,GACzC,IAAI,CAEN"}
+{"version":3,"file":"symbol-refresh.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/symbol-refresh.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAiBjF,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAGhB,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC;CACnD,CAAC;AAGF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,IAAI,IAAI,CAAC;CAClB,CAAC;AAEF,KAAK,qBAAqB,GAAG,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,aAAa,CAAC,CAAC;AAqD5B,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAMN;AAiPD,4EAA4E;AAC5E,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED,yEAAyE;AAEzE,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;;GAGG;AAEH,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAOxB;AAGD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,GACzC,IAAI,CAEN"}

package/dist/operations/mutation/symbol-refresh.js

@@ -6,6 +6,7 @@ import { CoordinateArtifactError, coarseCoordinateSpan, coordinateIdentityHash,
 import { enrichSymbolCoordinates } from "../../public/extractors/symbols-coordinator.js";
 import { isCoarseGranularityReason } from "../../public/symbol-granularity.js";
 import { CANONICAL_ENTITY_PATHS } from "../../utils/kb-paths.js";
+import { resolveWorkspaceSourceAbsolute } from "../../utils/repo-relative-path.js";
 import { withSymbolCompilerLock } from "./symbol-compiler-lock.js";
 function record(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -29,9 +30,9 @@ function artifactPathFor(manifest) {
     return path.join(path.dirname(manifest), "symbol-coordinates.yaml");
 }
 function sourceTextFor(sourceFile, workspaceRoot) {
-    const absolute = path.isAbsolute(sourceFile)
-        ? sourceFile
-        : path.resolve(workspaceRoot, sourceFile);
+    const absolute = resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile);
+    if (absolute === null)
+        return null;
     try {
         return readFileSync(absolute, "utf8");
     }

package/dist/operations/mutation/upsert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/upsert.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAexE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AA6B3E,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAsEhC,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,IAAI,CAkBN;AA8CD;;;;;;;GAOG;AAEH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAmCxD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAgCvC;AAmCD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GAAG;IACrB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtD,GACA,sBAAsB,CASxB;AAGD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;CAC3C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CA+H3B;AAgDD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C;;;;;;OAMG;IAEH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAyBH,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAiiBzC"}
+{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../../src/operations/mutation/upsert.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAexE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AA6B3E,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAsEhC,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,IAAI,CAkBN;AA8CD;;;;;;;GAOG;AAEH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAmCxD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAgCvC;AAmCD,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GAAG;IACrB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtD,GACA,sBAAsB,CASxB;AAGD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;CAC3C,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CA+H3B;AAgDD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C;;;;;;OAMG;IAEH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC,CAAC;AAyBH,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAkiBzC"}

package/dist/operations/mutation/upsert.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { OperationError } from "../../cli-errors.js";
+import { InputError, OperationError } from "../../cli-errors.js";
 import { DEFAULT_FIRMNESS, carriesFirmness, firmnessRef, isFirmness, } from "../../decision-firmness.js";
 import { readManifestWithCoordinateOverlay } from "../../extractors/manifest.js";
 import { extractManifestSymbolRecords } from "../../extractors/manifest.js";
@@ -784,7 +784,8 @@ export async function executeUpsert(input, context, options = {}) {
             operationFailure = { error: failure };
             throw failure;
         }
-        if (error instanceof OperationError) {
+        // A coded refusal keeps its code and message for the error envelope.
+        if (error instanceof OperationError || error instanceof InputError) {
             const failure = withPlanRecoveryNotes(error, planRecoveryWarnings);
             operationFailure = { error: failure };
             throw failure;

package/dist/operations/mutation/validation.js

@@ -228,6 +228,9 @@ export { isAllowedGranularityReason };
  * artifact, but the engine never merges coordinates for KB-internal paths —
  * coverage then reports missing_symbol_coordinates forever with no signal.
  * Reject the configuration at upsert time instead.
+ *
+ * Also reject absolute paths and `..` escapes so coordinate refresh cannot be
+ * used as a workspace-escape oracle against files outside the repository.
  */
 function validateSymbolSourceFile(entity) {
     if (entity.type !== "symbol")
@@ -239,6 +242,14 @@ function validateSymbolSourceFile(entity) {
     if (normalized === ".kb" || normalized.startsWith(".kb/")) {
         throw new Error(`Entity validation failed: symbol sourceFile must point at a real code file in the workspace, not into the knowledge base ('${sourceFile}'). Coordinates for .kb/ paths are never merged into the engine, so coverage would report missing_symbol_coordinates permanently. Point the symbol at the implementing or verifying code file instead.`);
     }
+    // Lexical confinement (no workspace root needed): absolute paths and `..`
+    // segments are never valid authored sourceFile values.
+    if (normalized.startsWith("/") ||
+        /^[A-Za-z]:\//.test(normalized) ||
+        normalized.startsWith("//") ||
+        normalized.split("/").includes("..")) {
+        throw new Error(`Entity validation failed: symbol sourceFile must be a workspace-relative path ('${sourceFile}'). Absolute paths and '..' escapes are rejected so coordinate refresh cannot read files outside the repository.`);
+    }
 }
 /**
  * proof_exempt parks a current requirement outside E2E-proof scope. Without a

package/dist/plugins/approved-source-analyzers.generated.d.ts

@@ -1,8 +1,8 @@
 export declare const qualifiedSourceAnalyzers: readonly [{
     readonly packageName: "kibi-plugin-treesitter";
-    readonly version: "2.0.0";
+    readonly version: "2.0.1";
     readonly files: {
-        readonly "SBOM.spdx.json": "579e1574f09042cf85d9fa76837555c06a15f133f321fc0800fadd2f9539c52c";
+        readonly "SBOM.spdx.json": "8e7136ff7d28e8acb32e864baa9f4e69eee02620550ed7f0551c115759de8561";
         readonly "THIRD_PARTY_NOTICES.md": "0b1ede96cb261dab73fd1ec8c51d7bb5b2492eed0502f6c10ed071736daa263c";
         readonly "assets/queries/bash.scm": "6ca535e8fe652b51203ac272831881dab001f7ac508e50551bc2cdc4a15d7b6c";
         readonly "assets/queries/c.scm": "774ca67cfe23b0e0d1d3a4f01788049a822beb1311feee72b20a595a37be1e28";
@@ -32,13 +32,13 @@ export declare const qualifiedSourceAnalyzers: readonly [{
         readonly "assets/tree-sitter-ruby.wasm": "09a96427d7c72f0613ed470cd9812223fc4a91d6a9c025c0235cc6bd59ff96f4";
         readonly "assets/tree-sitter-rust.wasm": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57";
         readonly "assets/tree-sitter-terraform.release.wasm": "59dbcbb0f08eb78b78f37510834559a48ce5c9d4866c978d62c6390796461cb5";
-        readonly "catalog.json": "6c1101d0e831ea11f1002edf4baeca88521ac6f4c18a2e1c64f2f030f8bf6bba";
-        readonly "dist/analysis-worker.js": "75a1e646f636c1d1ace9ae22a9141a51e94bddc70203bed08de7bd13dae1764e";
+        readonly "catalog.json": "af91adedf93039b54471c99fdd4bbf10a2f3ce716324be6935a6dbdd4aee2d0b";
+        readonly "dist/analysis-worker.js": "7e87c177a5893e7edd5b6fb2b2798aadf22831c092af96026a2de130034116f5";
         readonly "dist/catalog.js": "460243c48cb6a03b8c7971273729d8a1134955186978b6c0d04182c71960ebff";
         readonly "dist/extractor.js": "1d8cd819e7ec8fcc291a44e5ffe4ccfe77099301677913fcfe0d92e7ce971f33";
         readonly "dist/index.js": "adc03d77d94c0133b3188950b35f79db19e447cf7bfa1f7e1cf1f5c97a582a44";
         readonly "dist/performance-timing.js": "56cce530f627c8fd079e8ec070322f84378ae50c40a6765d88b418850692940b";
-        readonly "integrity.json": "a77eb4b614452f158202b3f8aa91b91750dd2ad94693cc9c375460ec5b80c48b";
+        readonly "integrity.json": "d203e1e7b1e25264a56ce85a1d99b4b09ddcb093ffd4a21d591045dc3deeff3f";
         readonly "licenses/tree-sitter-bash-MIT.txt": "49bf33cf78ef5897e4e161ce1517df7de1ae5042a65b6bcfd44401e0fc606559";
         readonly "licenses/tree-sitter-c-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1";
         readonly "licenses/tree-sitter-c-sharp-MIT.txt": "778fb7d63b8c1844da315648c02f325c4713a6f4a5d19644fd413421422776d3";
@@ -51,7 +51,7 @@ export declare const qualifiedSourceAnalyzers: readonly [{
         readonly "licenses/tree-sitter-ruby-MIT.txt": "9c99b99e93d3c6461bef9f6bac45d17b8bf014172625c24f76319bbd235a7b80";
         readonly "licenses/tree-sitter-rust-MIT.txt": "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36";
         readonly "licenses/web-tree-sitter-MIT.txt": "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78";
-        readonly "package.json": "db0277b9bfd47a242dd457bd1d4fb29bf126121734c9b393ffe6b91af5e5919b";
+        readonly "package.json": "094ab574489d2d0994b12acdf5d70a227f7b37cf8a9b40965d7ee5c440b5aae0";
     };
     readonly dependencies: readonly [{
         readonly packageName: "web-tree-sitter";

package/dist/plugins/approved-source-analyzers.generated.js

@@ -4,9 +4,9 @@
 export const qualifiedSourceAnalyzers = [
     {
         packageName: "kibi-plugin-treesitter",
-        version: "2.0.0",
+        version: "2.0.1",
         files: {
-            "SBOM.spdx.json": "579e1574f09042cf85d9fa76837555c06a15f133f321fc0800fadd2f9539c52c",
+            "SBOM.spdx.json": "8e7136ff7d28e8acb32e864baa9f4e69eee02620550ed7f0551c115759de8561",
             "THIRD_PARTY_NOTICES.md": "0b1ede96cb261dab73fd1ec8c51d7bb5b2492eed0502f6c10ed071736daa263c",
             "assets/queries/bash.scm": "6ca535e8fe652b51203ac272831881dab001f7ac508e50551bc2cdc4a15d7b6c",
             "assets/queries/c.scm": "774ca67cfe23b0e0d1d3a4f01788049a822beb1311feee72b20a595a37be1e28",
@@ -36,13 +36,13 @@ export const qualifiedSourceAnalyzers = [
             "assets/tree-sitter-ruby.wasm": "09a96427d7c72f0613ed470cd9812223fc4a91d6a9c025c0235cc6bd59ff96f4",
             "assets/tree-sitter-rust.wasm": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57",
             "assets/tree-sitter-terraform.release.wasm": "59dbcbb0f08eb78b78f37510834559a48ce5c9d4866c978d62c6390796461cb5",
-            "catalog.json": "6c1101d0e831ea11f1002edf4baeca88521ac6f4c18a2e1c64f2f030f8bf6bba",
-            "dist/analysis-worker.js": "75a1e646f636c1d1ace9ae22a9141a51e94bddc70203bed08de7bd13dae1764e",
+            "catalog.json": "af91adedf93039b54471c99fdd4bbf10a2f3ce716324be6935a6dbdd4aee2d0b",
+            "dist/analysis-worker.js": "7e87c177a5893e7edd5b6fb2b2798aadf22831c092af96026a2de130034116f5",
             "dist/catalog.js": "460243c48cb6a03b8c7971273729d8a1134955186978b6c0d04182c71960ebff",
             "dist/extractor.js": "1d8cd819e7ec8fcc291a44e5ffe4ccfe77099301677913fcfe0d92e7ce971f33",
             "dist/index.js": "adc03d77d94c0133b3188950b35f79db19e447cf7bfa1f7e1cf1f5c97a582a44",
             "dist/performance-timing.js": "56cce530f627c8fd079e8ec070322f84378ae50c40a6765d88b418850692940b",
-            "integrity.json": "a77eb4b614452f158202b3f8aa91b91750dd2ad94693cc9c375460ec5b80c48b",
+            "integrity.json": "d203e1e7b1e25264a56ce85a1d99b4b09ddcb093ffd4a21d591045dc3deeff3f",
             "licenses/tree-sitter-bash-MIT.txt": "49bf33cf78ef5897e4e161ce1517df7de1ae5042a65b6bcfd44401e0fc606559",
             "licenses/tree-sitter-c-MIT.txt": "2e0110e07abef7c2548b26ec9d6969775617ca539a0dc8dbeeb14d6452c711d1",
             "licenses/tree-sitter-c-sharp-MIT.txt": "778fb7d63b8c1844da315648c02f325c4713a6f4a5d19644fd413421422776d3",
@@ -55,7 +55,7 @@ export const qualifiedSourceAnalyzers = [
             "licenses/tree-sitter-ruby-MIT.txt": "9c99b99e93d3c6461bef9f6bac45d17b8bf014172625c24f76319bbd235a7b80",
             "licenses/tree-sitter-rust-MIT.txt": "31d5b6f4243d5c7c6e1c4ebbbb9f6407bd1457a08bcc4f706521710341acba36",
             "licenses/web-tree-sitter-MIT.txt": "c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78",
-            "package.json": "db0277b9bfd47a242dd457bd1d4fb29bf126121734c9b393ffe6b91af5e5919b",
+            "package.json": "094ab574489d2d0994b12acdf5d70a227f7b37cf8a9b40965d7ee5c440b5aae0",
         },
         dependencies: [
             {

package/dist/public/operations/migration-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration-plan.d.ts","sourceRoot":"","sources":["../../../src/public/operations/migration-plan.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,sBAAsB,EAAG,wBAAiC,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAC;AACvD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;AAChF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,CAAC;IACP,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C,CAAC,GACF,QAAQ,CAAC;IACP,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC,GACF,QAAQ,CAAC;IACP,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEP,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EACJ,SAAS,GACT,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,WAAW,GACX,cAAc,GACd,QAAQ,GACR,UAAU,GACV,OAAO,GACP,SAAS,CAAC;IACd,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,mBAAmB,CAAC;IAChC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC7D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,OAAO,EAAE,OAAO,sBAAsB,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,QAAQ,EAAE,QAAQ,CAAC;QACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,KAAK,EAAE,QAAQ,CAAC;QACd,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,KAAK,SAAS,GAAG,QAAQ,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAuBH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIxD;AAeD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,GACzC,MAAM,CAOR;AAuED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,SAAc,GAAG,aAAa,CAsCvE;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,aAAa,CA0Bf;AAED,eAAO,MAAM,6BAA6B,EACxC,+BAAwC,CAAC;AAE3C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,OAAO,EAAE,OAAO,6BAA6B,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,YAAY,EAAE,SAAS,QAAQ,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,eAAe,CAAC;QACxB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,EAAE,CAAC;IACL,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,mBAAmB,CAkD5E;AAED;;;GAGG;AAEH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,aAAa,CASf;AA6BD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,CAAC,GACrE,eAAe,CAEjB;AAkDD,uEAAuE;AACvE,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AA4D9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC1D,kBAAkB,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;CACnE,GAAG,eAAe,EAAE,CAqEpB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD,GAAG,eAAe,EAAE,CAgFpB;AAED,qFAAqF;AACrF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,kFAAkF;IAClF,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CAAC;AAEH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,GACpB,qBAAqB,CA8BvB;AAwBD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAcnD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,KAChC,0BAA0B,CAAC;CACjC,GAAG,aAAa,CA0VhB"}
+{"version":3,"file":"migration-plan.d.ts","sourceRoot":"","sources":["../../../src/public/operations/migration-plan.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,sBAAsB,EAAG,wBAAiC,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,SAAS,CAAC;AACvD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;AAChF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,CAAC;IACP,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1C,CAAC,GACF,QAAQ,CAAC;IACP,IAAI,EAAE,KAAK,CAAC;IACZ,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC,GACF,QAAQ,CAAC;IACP,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEP,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EACJ,SAAS,GACT,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,WAAW,GACX,cAAc,GACd,QAAQ,GACR,UAAU,GACV,OAAO,GACP,SAAS,CAAC;IACd,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,mBAAmB,CAAC;IAChC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC7D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;IACnC,OAAO,EAAE,OAAO,sBAAsB,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,QAAQ,EAAE,QAAQ,CAAC;QACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,KAAK,EAAE,QAAQ,CAAC;QACd,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,KAAK,SAAS,GAAG,QAAQ,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAuBH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIxD;AAeD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,GACzC,MAAM,CAOR;AAuED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,SAAc,GAAG,aAAa,CAsCvE;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,aAAa,EAAE,GAC9B,aAAa,CA0Bf;AAED,eAAO,MAAM,6BAA6B,EACxC,+BAAwC,CAAC;AAE3C,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,OAAO,EAAE,OAAO,6BAA6B,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,YAAY,EAAE,SAAS,QAAQ,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,eAAe,CAAC;QACxB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,EAAE,CAAC;IACL,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AAEH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,mBAAmB,CAkD5E;AAED;;;GAGG;AAEH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,aAAa,CASf;AA6BD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,CAAC,GACrE,eAAe,CAEjB;AAkDD,uEAAuE;AACvE,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAE5E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AA4D9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC1D,kBAAkB,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;CACnE,GAAG,eAAe,EAAE,CAqEpB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD,GAAG,eAAe,EAAE,CAgFpB;AAED,qFAAqF;AACrF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,kFAAkF;IAClF,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CAAC;AAEH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAoCvB;AAwBD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAcnD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,KAChC,0BAA0B,CAAC;CACjC,GAAG,aAAa,CA0VhB"}

package/dist/public/operations/migration-plan.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
 import { planLegacyStorageMigration } from "../../commands/legacy-storage-migration.js";
 import { BRANCH_STORE_NOT_COMPILED } from "../../utils/branch-store.js";
-import { legacyConfigExists } from "../../utils/config.js";
+import { LEGACY_KB_MIGRATION_COMMAND, LEGACY_KB_MIGRATION_NOTE, legacyConfigExists, } from "../../utils/config.js";
 import { MTIME_SOURCE_REASON_CODES } from "../../utils/content-freshness.js";
 import { readKbManifestStatus } from "../../utils/kb-manifest.js";
 import { getSchemaVersionStatus, normalizeSchemaVersion, } from "../../utils/schema-version.js";
@@ -529,7 +529,12 @@ export function readMigrationConfigStatus(workspaceRoot) {
         ...schemaStatus,
         currentVersion: normalizeSchemaVersion(legacySchemaVersion),
         configHash: null,
-        warning: status.warning,
+        // implements REQ-legacy-kb-first-step-migrate
+        // A legacy KB is migrated, never initialized: name the step kb_status's
+        // bootstrap.nextAction and kibi doctor name.
+        warning: status.state === "missing" && legacyConfigExists(workspaceRoot)
+            ? `Kibi lifecycle manifest is missing because this KB was written by an older Kibi; run '${LEGACY_KB_MIGRATION_COMMAND}' (${LEGACY_KB_MIGRATION_NOTE}).`
+            : status.warning,
     };
 }
 /**

package/dist/public/skills/kibi-bootstrap/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-bootstrap
 name: kibi-bootstrap
 description: "Use for any Kibi bootstrap or onboarding task: seeding a new or thin knowledge base; reviewing a bootstrap or onboarding plan, preview, or evidence; judging approval readiness or coverage; diagnosing a blocked, partial, or failed bootstrap or its repair; applying an approved bootstrap plan; or asking the human which knowledge sources hold intent. Covers kb_status first, source interview, cited intent claims, read-only kb_plan_bootstrap preview, explicit approval, exact-plan kb_apply_plan, and repair-safe close-out."
-version: 3.15.0
+version: 3.16.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -37,7 +37,7 @@ Seed branch-local Kibi knowledge from cited product intent, without creating a p
 3. **Declare** `bootstrapContext`: `projectSummary`; `knowledgeSources` (id, kind, title, locator, authority, optional connector, optional `component`); `intentClaims` (statement, sourceId, reference, `excerpt` required for `intent` and `observation` claims and optional for `open_question`, optional `kind`, default `intent`, optional `component` overriding the source's, optional `rationale` with the reason the source or the human gave, never invented); `conflicts` (`claimReferences` naming two or more declared claims by sourceId and reference, plus a one-sentence `note`). Only intent claims can become requirements, and they are recorded as the people's rules: `origin.kind: import` with `sourceId:reference` as `origin.ref`, and `firmness: firm`, so a later agent asks before changing one (normative lines from repository Markdown get the same, citing `path#Lline`). Observations, open questions (tagged `review:open-question`) and conflicts (tagged `review:conflict`) become cited observation facts. Generated subject keys take the shape `component.aspect`: name the component each source or claim is about (for example `recorder`; set `component` on the knowledge source, or on a claim to override it; repository Markdown takes its file or directory name), because an intent claim whose subject is neither one word nor already dotted, with no component, is reported in the plan diagnostics and left as an authoring follow-up instead of a malformed key. The aspect is the claim's subject, or its constrained property when the subject is the component itself. An aspect over four words or 40 characters is shortened to a noun phrase (words before `when`, `while`, `for`, `and`, ...; `support_inbox.update_in_real_time_when_a_new_ticket_is_assigned...` becomes `support_inbox.update_in_real_time`) and reported as `subject-key-shortened:` with both keys; two different subjects that shorten alike get a third segment (`editor.discard_a_draft.leaving`) and a `subject-key-disambiguated:` diagnostic; claims about one subject share one subject fact, and a `subject-key-shared:` diagnostic names the key and its sources. Show these diagnostics to the human with the plan so they can rename a key before approval. Kibi never contacts these sources. It binds your declaration into the plan hash.
 4. **Preview** with `kb_plan_bootstrap` (or `plan-bootstrap --input`), read-only. On `needs_context`, ask only its bounded questions (four at most), then preview again. When `pluginOffers` is non-empty (for example `kibi-plugin-ui` because UI component files exist), ask the human once whether to enable each offered plugin, naming its evidence files. On yes, install it as a dev dependency and add it to `package.json` `kibi.plugins` with the offered capability in `augment` mode; on no, add its name to `kibi.declinedPlugins` so it is not offered again. Either way the human decides; never enable a plugin unasked. For `kibi-plugin-ui`, step 11 also captures the UI pattern inventory (see `kibi-usage` `resources/ui-requirements.md`).
 5. **Narrow with filters, not caps.** Read the `tldr` and the `Suppressed candidates by reason` diagnostic before individual rows. If the output is too large or mostly tooling or metadata, re-preview with `entityTypes` or declared `sourceOfTruthPaths`. Generic Markdown is off by default once you declare intent claims; set `includeGenericMarkdown: true` only for repository docs the human named. Keep confirmed intent claims: they are never capped and never use `maxCandidates`, which is the separate budget for candidates Kibi discovers (symbols, tests, repository docs). Raise it only when discovered candidates you need are `over_limit`, and never for provenance stubs: a provider entry with no claim (`Source module: …`, repository metadata, layout roots) is planned last as a `meta` fact tagged `bootstrap:provenance-stub`, `discoverySummary.provenanceStubs` counts them apart from `candidatesWithClaims`, and the `over_limit` diagnostic says how many suppressed candidates are stubs; they add no knowledge, so a plan that is mostly stubs needs `entityTypes` or declared sources, not a higher cap. Read the per-source `Knowledge source …` diagnostics: each splits the claims not planned by reason (suppressed by the activation mode, a `suppressedCandidates` row, a `sourceOnlySignals` follow-up). Report them per source and restate them before approval, or carry them to step 11 with their citation.
-6. **Request approval.** Show the complete `structuredContent.plan`, the full hash (never abbreviated), which candidates cite which sources, what was omitted, the open questions and declared conflicts it records for the human to decide, and any claim that contradicts code. If you find an undeclared contradiction now, add it to `conflicts` and preview again rather than resolving it. A `conflict-review:` diagnostic (and `review_against:<id>` evidence on the candidate) names current requirements Kibi could not check a planned claim against because they have no logic: compare each pair yourself and show any contradiction to the human with the plan; they decide whether to drop the claim or keep it and supersede the requirement after apply. With no answer, stop as "awaiting approval." If declined, replan and ask again with the new hash.
+6. **Request approval.** Show the complete `structuredContent.plan`, the full hash (never abbreviated), which candidates cite which sources, what was omitted, the open questions and declared conflicts it records for the human to decide, and any claim that contradicts code. If you find an undeclared contradiction now, add it to `conflicts` and preview again rather than resolving it. A `conflict-review:` diagnostic (and `review_against:<id>` evidence on the candidate) names current requirements Kibi could not check a planned claim against because they have no logic: compare each pair yourself and show any contradiction to the human with the plan; they decide whether to drop the claim or keep it and supersede the requirement after apply. A claim left for authoring gets the same diagnostic (and `review_against:<id>` evidence on its follow-up): when you compile it with `kb_compile_intent` in step 11, compare it with the named requirements and send your verdicts in `conflictReviews`. With no answer, stop as "awaiting approval." If declined, replan and ask again with the new hash.
 7. **Pre-apply check.** The plan you send must equal the returned plan: every top-level field, including `suppressedCandidates`, `diagnostics`, `candidates`, `actions`, and `expected`, with every array the same length and order. Never rebuild it from preview fields. If the host cannot pass the exact object, stop and say so.
 8. **Apply once** with `kb_apply_plan`, the exact plan, and `approvedPlanHash`. The operation owns dependency ordering, source-first writes, sequential mutation, and recovery journaling. A plan with hundreds of actions can run for minutes: pass a `progressToken` (Kibi sends progress after each action) with a client that resets its timeout on progress, or pass `async: true` and poll `kb_job_status` when the host has it. If the apply is cut off, call `kb_apply_plan` with only the `recoveryJournalId` from `kb_status` or the error; it resumes an action interrupted mid-write and reclaims a lock left by a dead process. Never edit or delete `.kb/recovery` files; if recovery is refused, stop and report it.
 9. **Read back** with `kb_query` and `kb_search` to confirm writes and citations.

package/dist/public/symbol-granularity.d.ts

@@ -16,6 +16,11 @@ export declare function isAllowedGranularityReason(value: unknown): value is Gra
 export declare function isCoarseGranularityReason(value: unknown): value is CoarseGranularityReason;
 export declare function getSymbolRole(candidate: GranularSymbolCandidate): SymbolRole;
 export declare function isBehavioralSymbol(candidate: GranularSymbolCandidate): boolean;
+/**
+ * The behavioral candidates' names, the place a coarse link should move to:
+ * functions, methods and accessors first, then properties (behavioral in the
+ * schema, but usually plain fields), each group sorted by name.
+ */
 export declare function getBehavioralSymbolNames(candidates: GranularSymbolCandidate[]): string[];
 /**
  * The candidates that are narrower than a manifest symbol: members of it

package/dist/public/symbol-granularity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symbol-granularity.d.ts","sourceRoot":"","sources":["../../src/public/symbol-granularity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,cAAc,EACd,YAAY,EACZ,KAAK,UAAU,EACf,+BAA+B,EAC/B,KAAK,4BAA4B,EAClC,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,cAAc,EACd,YAAY,EACZ,+BAA+B,GAChC,CAAC;AACF,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,WAAW,GACX,MAAM,GACN,UAAU,GACV,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE1C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAYD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE5D;AAED,eAAO,MAAM,uBAAuB,wBAAkB,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAIhE;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,4BAA4B,CAIvC;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAE5B;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,uBAAuB,CAElC;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,uBAAuB,GAAG,UAAU,CAI5E;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAET;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,uBAAuB,EAAE,GACpC,MAAM,EAAE,CAMV;AAED;;;;GAIG;AAEH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACxD,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,SAAS,CAAC,EAAE,EACxB,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GACzC,CAAC,EAAE,CASL;AAED;;;;;GAKG;AAEH,wBAAgB,yBAAyB,CACvC,kBAAkB,EAAE,MAAM,EAC1B,aAAa,EAAE,SAAS,uBAAuB,EAAE,GAChD,MAAM,EAAE,CAIV;AAED,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,uBAAuB,EAAE,GACpC,MAAM,EAAE,CAQV"}
+{"version":3,"file":"symbol-granularity.d.ts","sourceRoot":"","sources":["../../src/public/symbol-granularity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,cAAc,EACd,YAAY,EACZ,KAAK,UAAU,EACf,+BAA+B,EAC/B,KAAK,4BAA4B,EAClC,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,cAAc,EACd,YAAY,EACZ,+BAA+B,GAChC,CAAC;AACF,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,WAAW,GACX,MAAM,GACN,UAAU,GACV,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE1C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAYD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE5D;AAED,eAAO,MAAM,uBAAuB,wBAAkB,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAIhE;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,4BAA4B,CAIvC;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAE5B;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,uBAAuB,CAElC;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,uBAAuB,GAAG,UAAU,CAI5E;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,uBAAuB,GACjC,OAAO,CAET;AAED;;;;GAIG;AAEH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,uBAAuB,EAAE,GACpC,MAAM,EAAE,CAQV;AAED;;;;GAIG;AAEH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACxD,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,SAAS,CAAC,EAAE,EACxB,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GACzC,CAAC,EAAE,CASL;AAED;;;;;GAKG;AAEH,wBAAgB,yBAAyB,CACvC,kBAAkB,EAAE,MAAM,EAC1B,aAAa,EAAE,SAAS,uBAAuB,EAAE,GAChD,MAAM,EAAE,CAIV;AAED,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,uBAAuB,EAAE,GACpC,MAAM,EAAE,CAQV"}

package/dist/public/symbol-granularity.js

@@ -32,10 +32,19 @@ export function getSymbolRole(candidate) {
 export function isBehavioralSymbol(candidate) {
     return getSymbolRole(candidate) === "behavioral";
 }
+/**
+ * The behavioral candidates' names, the place a coarse link should move to:
+ * functions, methods and accessors first, then properties (behavioral in the
+ * schema, but usually plain fields), each group sorted by name.
+ */
+// implements REQ-kibi-symbol-link-guidance
 export function getBehavioralSymbolNames(candidates) {
-    return [
-        ...new Set(candidates.filter(isBehavioralSymbol).map((candidate) => candidate.name)),
-    ].sort();
+    const behavioral = candidates.filter(isBehavioralSymbol);
+    const names = (properties) => behavioral
+        .filter((candidate) => (candidate.kind === "property") === properties)
+        .map((candidate) => candidate.name)
+        .sort();
+    return [...new Set([...names(false), ...names(true)])];
 }
 /**
  * The candidates that are narrower than a manifest symbol: members of it

package/dist/traceability/staged-consistency.d.ts

@@ -20,6 +20,6 @@ export declare function stagesKnowledge(paths: readonly string[]): boolean;
  */
 export declare function collectIntroducedConsistencyViolations(snapshot: SnapshotReader, headKnowledge: ExtractionResult[]): Promise<Violation[]>;
 /** Text lines for introduced consistency violations, in `kibi check` form. */
-export declare function formatConsistencyViolations(violations: readonly Violation[]): string[];
+export declare function formatConsistencyViolations(violations: readonly Violation[], kind?: string): string[];
 export {};
 //# sourceMappingURL=staged-consistency.d.ts.map

package/dist/traceability/staged-consistency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staged-consistency.d.ts","sourceRoot":"","sources":["../../src/traceability/staged-consistency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAsB1D,KAAK,cAAc,GAAG,QAAQ,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjE,CAAC,CAAC;AAEH;;;;GAIG;AAEH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMjE;AAkDD;;;;;GAKG;AAEH,wBAAsB,sCAAsC,CAC1D,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAAE,GAChC,OAAO,CAAC,SAAS,EAAE,CAAC,CAYtB;AAED,8EAA8E;AAE9E,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,MAAM,EAAE,CAWV"}
+{"version":3,"file":"staged-consistency.d.ts","sourceRoot":"","sources":["../../src/traceability/staged-consistency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAsB1D,KAAK,cAAc,GAAG,QAAQ,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjE,CAAC,CAAC;AAEH;;;;GAIG;AAEH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMjE;AAkDD;;;;;GAKG;AAEH,wBAAsB,sCAAsC,CAC1D,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,gBAAgB,EAAE,GAChC,OAAO,CAAC,SAAS,EAAE,CAAC,CAYtB;AAED,8EAA8E;AAE9E,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,IAAI,SAAgB,GACnB,MAAM,EAAE,CAWV"}

package/dist/traceability/staged-consistency.js

@@ -77,9 +77,9 @@ export async function collectIntroducedConsistencyViolations(snapshot, headKnowl
 }
 /** Text lines for introduced consistency violations, in `kibi check` form. */
 // implements REQ-cli-staged-consistency
-export function formatConsistencyViolations(violations) {
+export function formatConsistencyViolations(violations, kind = "consistency") {
     const lines = [
-        `Found ${violations.length} consistency violation(s) introduced by the staged changes:`,
+        `Found ${violations.length} ${kind} violation(s) introduced by the staged changes:`,
         "",
     ];
     for (const violation of violations) {

package/dist/traceability/staged-entity-context.d.ts

@@ -0,0 +1,18 @@
+import type { ExtractionResult } from "../extractors/markdown.js";
+import type { Violation } from "../public/check-types.js";
+type TreeReader = Readonly<{
+    baseTree: string;
+    headTree: string;
+    readGit(args: readonly string[]): Buffer;
+}>;
+/**
+ * entity-context-missing findings on the entity documents a commit stages,
+ * that the same documents did not have at the base tree. The rule reads only
+ * the entity file, so no projection is needed. A document whose entity
+ * already lacked context at the base (legacy debt, or one the migration
+ * acknowledged) does not block the commit; full `kibi check` still reports
+ * it.
+ */
+export declare function collectIntroducedEntityContextViolations(snapshot: TreeReader, stagedPaths: readonly string[], headKnowledge: readonly ExtractionResult[]): Violation[];
+export {};
+//# sourceMappingURL=staged-entity-context.d.ts.map

package/dist/traceability/staged-entity-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-entity-context.d.ts","sourceRoot":"","sources":["../../src/traceability/staged-entity-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAO1D,KAAK,UAAU,GAAG,QAAQ,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC;CAC1C,CAAC,CAAC;AA8CH;;;;;;;GAOG;AAEH,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,UAAU,EACpB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,aAAa,EAAE,SAAS,gBAAgB,EAAE,GACzC,SAAS,EAAE,CA8Bb"}

package/dist/traceability/staged-entity-context.js

@@ -0,0 +1,66 @@
+import { CONTEXT_REQUIRED_TYPES } from "../entity-body-context.js";
+import { ENTITY_CONTEXT_MISSING_RULE, evaluateEntityContext, readAuthoredEntity, } from "../public/operations/entity-context.js";
+function readTreeFile(snapshot, tree, file) {
+    try {
+        return snapshot.readGit(["show", `${tree}:${file}`]).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The ids the schema 8 body-context migration acknowledged, from the KB
+ * manifest of one tree: they stay exempt, so a migration commit passes.
+ */
+// implements REQ-cli-staged-entity-context
+function acknowledgedIds(snapshot, tree) {
+    const text = readTreeFile(snapshot, tree, ".kb/manifest.json");
+    if (text === null)
+        return new Set();
+    try {
+        const parsed = JSON.parse(text);
+        return new Set(Array.isArray(parsed.contextAcknowledged)
+            ? parsed.contextAcknowledged.filter((id) => typeof id === "string")
+            : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+/** Ids another entity supersedes in the given compiled knowledge. */
+// implements REQ-cli-staged-entity-context
+function supersededIds(knowledge) {
+    const superseded = new Set();
+    for (const result of knowledge)
+        for (const relationship of result.relationships)
+            if (relationship.type === "supersedes")
+                superseded.add(relationship.to);
+    return superseded;
+}
+/**
+ * entity-context-missing findings on the entity documents a commit stages,
+ * that the same documents did not have at the base tree. The rule reads only
+ * the entity file, so no projection is needed. A document whose entity
+ * already lacked context at the base (legacy debt, or one the migration
+ * acknowledged) does not block the commit; full `kibi check` still reports
+ * it.
+ */
+// implements REQ-cli-staged-entity-context
+export function collectIntroducedEntityContextViolations(snapshot, stagedPaths, headKnowledge) {
+    const rules = new Set([ENTITY_CONTEXT_MISSING_RULE]);
+    const read = (tree) => stagedPaths.flatMap((file) => {
+        const content = readTreeFile(snapshot, tree, file);
+        const entity = content === null ? null : readAuthoredEntity(content, file);
+        return entity !== null &&
+            CONTEXT_REQUIRED_TYPES.includes(entity.type)
+            ? [entity]
+            : [];
+    });
+    const head = evaluateEntityContext(read(snapshot.headTree), supersededIds(headKnowledge), rules, acknowledgedIds(snapshot, snapshot.headTree));
+    if (head.length === 0)
+        return [];
+    // Without the base tree's supersessions the base reports at least what it
+    // had, so a finding the base already carried never blocks.
+    const base = new Set(evaluateEntityContext(read(snapshot.baseTree), new Set(), rules, acknowledgedIds(snapshot, snapshot.baseTree)).map((violation) => violation.entityId));
+    return head.filter((violation) => !base.has(violation.entityId));
+}

package/dist/utils/repo-relative-path.d.ts

@@ -15,4 +15,11 @@
  * (the workspace snapshot), the caller compares it in NFC.
  */
 export declare function normalizeRepoRelativePath(workspaceRoot: string, candidate: string): string | null;
+/**
+ * Resolve a recorded source path to an absolute path that is lexically (and,
+ * when the file exists, via realpath) confined under `workspaceRoot`.
+ * Returns null for escapes, empty input, or symlink targets outside the root.
+ * Callers must treat null as "do not read".
+ */
+export declare function resolveWorkspaceSourceAbsolute(workspaceRoot: string, sourceFile: string): string | null;
 //# sourceMappingURL=repo-relative-path.d.ts.map

package/dist/utils/repo-relative-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-relative-path.d.ts","sourceRoot":"","sources":["../../src/utils/repo-relative-path.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;;;;;;;GAeG;AAEH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAsBf"}
+{"version":3,"file":"repo-relative-path.d.ts","sourceRoot":"","sources":["../../src/utils/repo-relative-path.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;;;GAeG;AAEH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAsBf;AAED;;;;;GAKG;AAEH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAcf"}

package/dist/utils/repo-relative-path.js

@@ -15,6 +15,7 @@
  You should have received a copy of the GNU Affero General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
+import { realpathSync } from "node:fs";
 import path from "node:path";
 /**
  * Canonical repository-relative form of a recorded path, as proof freshness
@@ -56,3 +57,28 @@ export function normalizeRepoRelativePath(workspaceRoot, candidate) {
     }
     return normalized;
 }
+/**
+ * Resolve a recorded source path to an absolute path that is lexically (and,
+ * when the file exists, via realpath) confined under `workspaceRoot`.
+ * Returns null for escapes, empty input, or symlink targets outside the root.
+ * Callers must treat null as "do not read".
+ */
+// implements REQ-symbol-sourcefile-workspace-confinement
+export function resolveWorkspaceSourceAbsolute(workspaceRoot, sourceFile) {
+    const relative = normalizeRepoRelativePath(workspaceRoot, sourceFile);
+    if (relative === null)
+        return null;
+    const absolute = path.resolve(workspaceRoot, relative);
+    try {
+        const realRoot = realpathSync.native(path.resolve(workspaceRoot));
+        const realFile = realpathSync.native(absolute);
+        const confined = path.relative(realRoot, realFile);
+        if (confined.startsWith("..") || path.isAbsolute(confined))
+            return null;
+        return realFile;
+    }
+    catch {
+        // Missing path: lexical confinement from normalizeRepoRelativePath is enough.
+        return absolute;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-cli",
-  "version": "2.27.0",
+  "version": "2.28.1",
   "type": "module",
   "description": "Kibi CLI for knowledge base management",
   "engines": {
@@ -235,13 +235,13 @@
     "fast-glob": "^3.2.12",
     "gray-matter": "^4.0.3",
     "js-yaml": "^4.1.0",
-    "kibi-core": "^0.22.3",
-    "kibi-plugin-builtin": "^0.5.2",
+    "kibi-core": "^0.22.4",
+    "kibi-plugin-builtin": "^0.5.3",
     "kibi-plugin-sdk": "^0.5.0",
     "kibi-swipl": "^1.0.1",
     "saxes": "^6.0.0",
     "ignore": "^5.3.0",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
     "@types/node": "latest",

package/schema/entities.pl

@@ -29,7 +29,8 @@ entity_property(_, priority, atom).
 entity_property(_, severity, atom).
 entity_property(_, links, list).
 entity_property(_, text_ref, uri).
-entity_property(_, sourceFile, uri).
+% Workspace-relative source paths only (no absolute / .. escapes).
+entity_property(_, sourceFile, workspace_relpath).
 % Provenance of any authored entity: a JSON object (kind, ref, approved_by,
 % recorded_at) naming who authored it and on what authority.
 entity_property(_, origin, list_or_json).

package/schema/validation.pl

@@ -50,11 +50,26 @@ check_kind(datetime, V) :- string(V). % accept ISO strings for now
 check_kind(list, V) :- is_list(V).
 check_kind(list_or_json, V) :- is_list(V) ; string(V) ; atom(V).
 check_kind(uri, V) :- string(V).
+% Non-empty workspace-relative path: reject absolute forms and `..` segments.
+check_kind(workspace_relpath, V) :-
+    string(V),
+    string_length(V, Len),
+    Len > 0,
+    \+ workspace_relpath_absolute(V),
+    split_string(V, "/\\", "", Parts),
+    \+ member("..", Parts).
 check_kind(integer, V) :- integer(V).
 check_kind(number, V) :- number(V).
 check_kind(boolean, true).
 check_kind(boolean, false).
 
+workspace_relpath_absolute(V) :- sub_string(V, 0, 1, _, "/").
+workspace_relpath_absolute(V) :-
+    string_length(V, Len),
+    Len >= 2,
+    sub_string(V, 1, 1, _, ":").
+workspace_relpath_absolute(V) :- sub_string(V, 0, 2, _, "\\\\").
+
 % Fallback false
 check_kind(_, _) :- fail.
 

package/src/public/operations/migration-plan.ts

@@ -3,7 +3,11 @@ import { existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
 import { planLegacyStorageMigration } from "../../commands/legacy-storage-migration.js";
 import { BRANCH_STORE_NOT_COMPILED } from "../../utils/branch-store.js";
-import { legacyConfigExists } from "../../utils/config.js";
+import {
+  LEGACY_KB_MIGRATION_COMMAND,
+  LEGACY_KB_MIGRATION_NOTE,
+  legacyConfigExists,
+} from "../../utils/config.js";
 import { MTIME_SOURCE_REASON_CODES } from "../../utils/content-freshness.js";
 import { readKbManifestStatus } from "../../utils/kb-manifest.js";
 import {
@@ -743,7 +747,13 @@ export function readMigrationConfigStatus(
     ...schemaStatus,
     currentVersion: normalizeSchemaVersion(legacySchemaVersion),
     configHash: null,
-    warning: status.warning,
+    // implements REQ-legacy-kb-first-step-migrate
+    // A legacy KB is migrated, never initialized: name the step kb_status's
+    // bootstrap.nextAction and kibi doctor name.
+    warning:
+      status.state === "missing" && legacyConfigExists(workspaceRoot)
+        ? `Kibi lifecycle manifest is missing because this KB was written by an older Kibi; run '${LEGACY_KB_MIGRATION_COMMAND}' (${LEGACY_KB_MIGRATION_NOTE}).`
+        : status.warning,
   };
 }
 

package/src/public/skills/kibi-bootstrap/SKILL.md

@@ -2,7 +2,7 @@
 id: kibi-bootstrap
 name: kibi-bootstrap
 description: "Use for any Kibi bootstrap or onboarding task: seeding a new or thin knowledge base; reviewing a bootstrap or onboarding plan, preview, or evidence; judging approval readiness or coverage; diagnosing a blocked, partial, or failed bootstrap or its repair; applying an approved bootstrap plan; or asking the human which knowledge sources hold intent. Covers kb_status first, source interview, cited intent claims, read-only kb_plan_bootstrap preview, explicit approval, exact-plan kb_apply_plan, and repair-safe close-out."
-version: 3.15.0
+version: 3.16.0
 kibiCompatibility: ">=1.0.0"
 tags:
   - kibi
@@ -37,7 +37,7 @@ Seed branch-local Kibi knowledge from cited product intent, without creating a p
 3. **Declare** `bootstrapContext`: `projectSummary`; `knowledgeSources` (id, kind, title, locator, authority, optional connector, optional `component`); `intentClaims` (statement, sourceId, reference, `excerpt` required for `intent` and `observation` claims and optional for `open_question`, optional `kind`, default `intent`, optional `component` overriding the source's, optional `rationale` with the reason the source or the human gave, never invented); `conflicts` (`claimReferences` naming two or more declared claims by sourceId and reference, plus a one-sentence `note`). Only intent claims can become requirements, and they are recorded as the people's rules: `origin.kind: import` with `sourceId:reference` as `origin.ref`, and `firmness: firm`, so a later agent asks before changing one (normative lines from repository Markdown get the same, citing `path#Lline`). Observations, open questions (tagged `review:open-question`) and conflicts (tagged `review:conflict`) become cited observation facts. Generated subject keys take the shape `component.aspect`: name the component each source or claim is about (for example `recorder`; set `component` on the knowledge source, or on a claim to override it; repository Markdown takes its file or directory name), because an intent claim whose subject is neither one word nor already dotted, with no component, is reported in the plan diagnostics and left as an authoring follow-up instead of a malformed key. The aspect is the claim's subject, or its constrained property when the subject is the component itself. An aspect over four words or 40 characters is shortened to a noun phrase (words before `when`, `while`, `for`, `and`, ...; `support_inbox.update_in_real_time_when_a_new_ticket_is_assigned...` becomes `support_inbox.update_in_real_time`) and reported as `subject-key-shortened:` with both keys; two different subjects that shorten alike get a third segment (`editor.discard_a_draft.leaving`) and a `subject-key-disambiguated:` diagnostic; claims about one subject share one subject fact, and a `subject-key-shared:` diagnostic names the key and its sources. Show these diagnostics to the human with the plan so they can rename a key before approval. Kibi never contacts these sources. It binds your declaration into the plan hash.
 4. **Preview** with `kb_plan_bootstrap` (or `plan-bootstrap --input`), read-only. On `needs_context`, ask only its bounded questions (four at most), then preview again. When `pluginOffers` is non-empty (for example `kibi-plugin-ui` because UI component files exist), ask the human once whether to enable each offered plugin, naming its evidence files. On yes, install it as a dev dependency and add it to `package.json` `kibi.plugins` with the offered capability in `augment` mode; on no, add its name to `kibi.declinedPlugins` so it is not offered again. Either way the human decides; never enable a plugin unasked. For `kibi-plugin-ui`, step 11 also captures the UI pattern inventory (see `kibi-usage` `resources/ui-requirements.md`).
 5. **Narrow with filters, not caps.** Read the `tldr` and the `Suppressed candidates by reason` diagnostic before individual rows. If the output is too large or mostly tooling or metadata, re-preview with `entityTypes` or declared `sourceOfTruthPaths`. Generic Markdown is off by default once you declare intent claims; set `includeGenericMarkdown: true` only for repository docs the human named. Keep confirmed intent claims: they are never capped and never use `maxCandidates`, which is the separate budget for candidates Kibi discovers (symbols, tests, repository docs). Raise it only when discovered candidates you need are `over_limit`, and never for provenance stubs: a provider entry with no claim (`Source module: …`, repository metadata, layout roots) is planned last as a `meta` fact tagged `bootstrap:provenance-stub`, `discoverySummary.provenanceStubs` counts them apart from `candidatesWithClaims`, and the `over_limit` diagnostic says how many suppressed candidates are stubs; they add no knowledge, so a plan that is mostly stubs needs `entityTypes` or declared sources, not a higher cap. Read the per-source `Knowledge source …` diagnostics: each splits the claims not planned by reason (suppressed by the activation mode, a `suppressedCandidates` row, a `sourceOnlySignals` follow-up). Report them per source and restate them before approval, or carry them to step 11 with their citation.
-6. **Request approval.** Show the complete `structuredContent.plan`, the full hash (never abbreviated), which candidates cite which sources, what was omitted, the open questions and declared conflicts it records for the human to decide, and any claim that contradicts code. If you find an undeclared contradiction now, add it to `conflicts` and preview again rather than resolving it. A `conflict-review:` diagnostic (and `review_against:<id>` evidence on the candidate) names current requirements Kibi could not check a planned claim against because they have no logic: compare each pair yourself and show any contradiction to the human with the plan; they decide whether to drop the claim or keep it and supersede the requirement after apply. With no answer, stop as "awaiting approval." If declined, replan and ask again with the new hash.
+6. **Request approval.** Show the complete `structuredContent.plan`, the full hash (never abbreviated), which candidates cite which sources, what was omitted, the open questions and declared conflicts it records for the human to decide, and any claim that contradicts code. If you find an undeclared contradiction now, add it to `conflicts` and preview again rather than resolving it. A `conflict-review:` diagnostic (and `review_against:<id>` evidence on the candidate) names current requirements Kibi could not check a planned claim against because they have no logic: compare each pair yourself and show any contradiction to the human with the plan; they decide whether to drop the claim or keep it and supersede the requirement after apply. A claim left for authoring gets the same diagnostic (and `review_against:<id>` evidence on its follow-up): when you compile it with `kb_compile_intent` in step 11, compare it with the named requirements and send your verdicts in `conflictReviews`. With no answer, stop as "awaiting approval." If declined, replan and ask again with the new hash.
 7. **Pre-apply check.** The plan you send must equal the returned plan: every top-level field, including `suppressedCandidates`, `diagnostics`, `candidates`, `actions`, and `expected`, with every array the same length and order. Never rebuild it from preview fields. If the host cannot pass the exact object, stop and say so.
 8. **Apply once** with `kb_apply_plan`, the exact plan, and `approvedPlanHash`. The operation owns dependency ordering, source-first writes, sequential mutation, and recovery journaling. A plan with hundreds of actions can run for minutes: pass a `progressToken` (Kibi sends progress after each action) with a client that resets its timeout on progress, or pass `async: true` and poll `kb_job_status` when the host has it. If the apply is cut off, call `kb_apply_plan` with only the `recoveryJournalId` from `kb_status` or the error; it resumes an action interrupted mid-write and reclaims a lock left by a dead process. Never edit or delete `.kb/recovery` files; if recovery is refused, stop and report it.
 9. **Read back** with `kb_query` and `kb_search` to confirm writes and citations.