skillwiki 0.10.110 → 0.10.111

package/dist/chunk-OSL4J7GF.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+// src/clip-outbox/ready.ts
+function buildReadyHint(vaultId, files) {
+  const assets = files.filter((f) => f.path.startsWith("raw/assets/"));
+  const articles = files.filter((f) => f.path.startsWith("raw/articles/"));
+  return { vault_id: vaultId, files: [...assets, ...articles] };
+}
+async function postReadyHint(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const body = JSON.stringify(opts.hint);
+  if (Buffer.byteLength(body) > 32768) return { ok: false, status: 413 };
+  const res = await fetchImpl(opts.url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${opts.token}`,
+      "Content-Type": "application/json"
+    },
+    body,
+    signal: AbortSignal.timeout(1e4),
+    redirect: "error"
+  });
+  if (!res.ok) return { ok: false, status: res.status };
+  const result = await res.json();
+  const paths = result.paths;
+  return result.ok === true && Array.isArray(paths) && opts.hint.files.every((f) => paths.includes(f.path)) ? { ok: true } : { ok: false, status: 503 };
+}
+
+export {
+  buildReadyHint,
+  postReadyHint
+};

package/dist/chunk-PYPPG7RF.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+import {
+  isClipOutboxKey,
+  isVaultSyncKey
+} from "./chunk-UIEQIJXP.js";
+
+// src/utils/home.ts
+import { homedir } from "os";
+import { resolve } from "path";
+function resolveSkillwikiHome(home, env = process.env) {
+  for (const candidate of [home, env.HOME, env.USERPROFILE]) {
+    if (candidate?.trim()) return resolve(candidate);
+  }
+  try {
+    const fallback = homedir();
+    if (fallback?.trim()) return resolve(fallback);
+  } catch {
+    throw new Error("Could not resolve SkillWiki home directory");
+  }
+  throw new Error("Could not resolve SkillWiki home directory");
+}
+
+// src/utils/dotenv.ts
+import { readFile, writeFile, mkdir } from "fs/promises";
+import { dirname } from "path";
+var CONFIG_KEYS = [
+  "WIKI_PATH",
+  "WIKI_LANG",
+  "SKILLWIKI_HOST_ID",
+  "AUTO_COMMIT",
+  "BACKUP_ENDPOINT",
+  "BACKUP_BUCKET",
+  "BACKUP_REGION",
+  "BACKUP_ACCESS_KEY_ID",
+  "BACKUP_SECRET_ACCESS_KEY"
+];
+var MCP_AUTH_KEYS = ["SKILLWIKI_MCP_TOKEN", "SKILLWIKI_MCP_URL"];
+var _whitelist = /* @__PURE__ */ new Set([...CONFIG_KEYS, ...MCP_AUTH_KEYS]);
+var PROFILE_PATH_RE = /^WIKI_([A-Z][A-Z0-9_]{0,31})_PATH$/;
+var PROFILE_LANG_RE = /^WIKI_([A-Z][A-Z0-9_]{0,31})_LANG$/;
+var PROFILE_DEFAULT_RE = /^WIKI_DEFAULT$/;
+function isValidWikiProfileKey(key) {
+  if (key === "WIKI_PATH" || key === "WIKI_LANG") return false;
+  return PROFILE_PATH_RE.test(key) || PROFILE_LANG_RE.test(key) || PROFILE_DEFAULT_RE.test(key);
+}
+function profileKey(name, suffix) {
+  return `WIKI_${name.toUpperCase().replace(/-/g, "_").replace(/[^A-Z0-9_]/g, "")}_${suffix}`;
+}
+function parseDotenvText(text) {
+  const out = {};
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (!_whitelist.has(key) && !isValidWikiProfileKey(key) && !isVaultSyncKey(key) && !isClipOutboxKey(key)) continue;
+    if (value.length === 0) continue;
+    out[key] = value;
+  }
+  return out;
+}
+async function parseDotenvFile(path) {
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch {
+    return {};
+  }
+  return parseDotenvText(text);
+}
+async function writeDotenv(filePath, entries, originalContent) {
+  const lines = originalContent !== void 0 ? updateLines(originalContent, entries) : freshLines(entries);
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, lines.join("\n") + "\n", "utf8");
+}
+function freshLines(entries) {
+  const out = [];
+  for (const [key, value] of Object.entries(entries)) {
+    if (value !== void 0) out.push(`${key}=${value}`);
+  }
+  return out;
+}
+function updateLines(originalContent, entries) {
+  let rawLines = originalContent.split(/\r?\n/);
+  if (rawLines.length > 0 && rawLines[rawLines.length - 1] === "") {
+    rawLines = rawLines.slice(0, -1);
+  }
+  const keysToWrite = new Set(Object.keys(entries));
+  const out = [];
+  for (const line of rawLines) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) {
+      out.push(line);
+      continue;
+    }
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) {
+      out.push(line);
+      continue;
+    }
+    const key = trimmed.slice(0, eq).trim();
+    if (keysToWrite.has(key)) {
+      out.push(`${key}=${entries[key]}`);
+      keysToWrite.delete(key);
+    } else {
+      out.push(line);
+    }
+  }
+  for (const key of keysToWrite) {
+    const value = entries[key];
+    if (value !== void 0) out.push(`${key}=${value}`);
+  }
+  return out;
+}
+
+export {
+  resolveSkillwikiHome,
+  CONFIG_KEYS,
+  isValidWikiProfileKey,
+  profileKey,
+  parseDotenvText,
+  parseDotenvFile,
+  writeDotenv
+};

package/dist/chunk-QESNTTVY.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// src/utils/delete-intent.ts
+import { mkdir, writeFile, readdir, readFile } from "fs/promises";
+import { join } from "path";
+var DELETE_INTENT_SCHEMA = "vault-delete-intent/v1";
+var DELETE_INTENT_DIR = "meta/delete-intents";
+function normalizeVaultRelPath(path) {
+  const p = path.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (!p || p.includes("..") || p.startsWith(".git/")) {
+    throw new Error(`invalid vault-relative path: ${path}`);
+  }
+  return p;
+}
+function pathToIntentFilename(path) {
+  const p = normalizeVaultRelPath(path);
+  return `${p.replace(/\//g, "__")}.json`;
+}
+function intentHostId() {
+  return process.env.SKILLWIKI_HOST_ID ?? process.env.AGENT_HOST_ID ?? "unknown";
+}
+function buildDeleteIntent(input) {
+  return {
+    schema: DELETE_INTENT_SCHEMA,
+    path: normalizeVaultRelPath(input.path),
+    action: input.action,
+    created: input.created ?? (/* @__PURE__ */ new Date()).toISOString(),
+    host: input.host ?? intentHostId(),
+    actor: input.actor,
+    reason: input.reason,
+    source: input.source,
+    expires: input.expires ?? null
+  };
+}
+async function writeDeleteIntent(vault, intent) {
+  const dir = join(vault, DELETE_INTENT_DIR);
+  await mkdir(dir, { recursive: true });
+  const rel = `${DELETE_INTENT_DIR}/${pathToIntentFilename(intent.path)}`;
+  await writeFile(join(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
+  return rel;
+}
+
+export {
+  DELETE_INTENT_SCHEMA,
+  DELETE_INTENT_DIR,
+  normalizeVaultRelPath,
+  pathToIntentFilename,
+  buildDeleteIntent,
+  writeDeleteIntent
+};

package/dist/chunk-TDBUJUYH.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import {
+  PRODUCTION_WATCHER_LABEL,
+  evidencePath,
+  expandUserPath,
+  loadClipCredentials,
+  nestedOrEqual,
+  resolveClipOutboxConfig,
+  validateRuntime
+} from "./chunk-6OQLBNKR.js";
+import {
+  parseDotenvFile
+} from "./chunk-PYPPG7RF.js";
+import {
+  atomicWriteText
+} from "./chunk-GQWCTJTU.js";
+
+// src/clip-outbox/migrate.ts
+import { access, mkdir, readFile } from "fs/promises";
+import { constants } from "fs";
+import { basename, dirname, isAbsolute, join } from "path";
+import { execFileSync } from "child_process";
+var CLIP_MIGRATION_HINT = "Clip channel requires attended setup: run skillwiki clip-outbox install-or-migrate, then skillwiki doctor. Installation/update never sets clip_outbox.enabled=true or loads launchd. Prove deployed SeaweedFS If-None-Match:* create-only before operator enablement.";
+var xml = (s) => s.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+async function packagedPlist() {
+  for (const rel of ["../templates/launchd/", "../../templates/launchd/"]) {
+    try {
+      return await readFile(new URL(`${rel}${PRODUCTION_WATCHER_LABEL}.plist`, import.meta.url), "utf8");
+    } catch {
+    }
+  }
+  throw new Error("packaged clip launchd template missing");
+}
+async function stableCliBinary(argvPath = process.argv[1]) {
+  const candidates = [argvPath, ...[dirname(process.execPath), ...(process.env.PATH ?? "").split(":")].map((dir) => join(dir, "skillwiki"))];
+  for (const candidate of candidates) {
+    if (!candidate || !isAbsolute(candidate) || basename(candidate) !== "skillwiki") continue;
+    try {
+      await access(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  throw new Error("global npm skillwiki binary not found; install/link the CLI before migrating");
+}
+async function migrateClipOutbox(input) {
+  const map = await parseDotenvFile(join(input.home, ".skillwiki", ".env"));
+  const resolved = resolveClipOutboxConfig(map, input.home);
+  if (!resolved.ok) throw new Error(resolved.message);
+  if (input.load && (!resolved.enabled || !input.conditionalCreateProven)) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
+  if ((input.platform ?? process.platform) !== "darwin") throw new Error("clip launchd migration requires macOS");
+  const rawRoot = map["clip_outbox.root"] ?? "~/Obsidian/clip-outbox";
+  const root = resolved.enabled ? resolved.config.root : expandUserPath(rawRoot, input.home);
+  if (!isAbsolute(root) || root.includes("\0") || rawRoot.split("/").includes("..")) throw new Error("invalid outbox root");
+  const mirror = resolved.enabled ? resolved.config.mirrorRoot : expandUserPath(map["clip_outbox.mirror_root"] ?? join(input.home, "wiki"), input.home);
+  if (nestedOrEqual(root, mirror)) throw new Error("outbox must be disjoint from mirror");
+  const binary = input.binaryPath ?? await stableCliBinary();
+  if (!isAbsolute(binary) || !isAbsolute(input.nodePath ?? process.execPath)) throw new Error("absolute executable paths required");
+  const logRoot = join(input.home, "Library", "Logs", "SkillWiki");
+  const plistPath = join(input.home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);
+  const template = await packagedPlist();
+  let plist = template;
+  for (const [key, value] of Object.entries({ NODE_BINARY: input.nodePath ?? process.execPath, CLI_BINARY: binary, OUTBOX_ROOT: root, HOME: input.home, LOG_ROOT: logRoot })) plist = plist.replaceAll(`@${key}@`, xml(value));
+  if (input.load) {
+    if (!resolved.enabled) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
+    const creds = await loadClipCredentials(input.home, resolved.config);
+    await mkdir(resolved.config.stateRoot, { recursive: true, mode: 448 });
+    const proof = await atomicWriteText(evidencePath(resolved.config), JSON.stringify({ verified: true, destination: resolved.config.destination, endpoint: creds.s3.endpoint, testedAt: (/* @__PURE__ */ new Date()).toISOString(), basis: "operator-attested deployed If-None-Match:* race test" }));
+    if (!proof.ok) throw new Error("cannot record operator conditional-create attestation");
+    await validateRuntime(input.home, resolved.config, creds.s3.endpoint);
+  }
+  await mkdir(dirname(plistPath), { recursive: true });
+  await mkdir(logRoot, { recursive: true });
+  const result = await atomicWriteText(plistPath, plist);
+  if (!result.ok) throw new Error("cannot refresh clip plist");
+  if (input.load) {
+    if (typeof process.getuid !== "function") throw new Error("clip launchd load requires macOS");
+    const domain = `gui/${process.getuid()}`;
+    const launch = input.launch ?? ((args) => {
+      execFileSync("launchctl", args, { stdio: "ignore", timeout: 5e3 });
+    });
+    try {
+      launch(["bootout", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
+    } catch {
+    }
+    launch(["enable", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
+    launch(["bootstrap", domain, plistPath]);
+  }
+  return { plistPath, loaded: !!input.load, enabled: resolved.enabled, humanHint: `${result.data.changed ? "Refreshed" : "Current"} clip launchd plist: ${plistPath}. ${input.load ? "Operator-gated launchd bootstrap requested." : CLIP_MIGRATION_HINT}` };
+}
+async function refreshInstalledClipPlist(home, opts) {
+  const plistPath = join(home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);
+  try {
+    await access(plistPath, constants.F_OK);
+  } catch {
+    return void 0;
+  }
+  const result = await migrateClipOutbox({ ...opts, home, load: false });
+  return result.humanHint;
+}
+
+export {
+  CLIP_MIGRATION_HINT,
+  xml,
+  packagedPlist,
+  stableCliBinary,
+  migrateClipOutbox,
+  refreshInstalledClipPlist
+};

package/dist/{chunk-R2DJ7IJ5.js → chunk-UIEQIJXP.js}

@@ -555,6 +555,9 @@ function inRange(ip, baseStr, prefix) {
   const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
   return (ipN & mask) === (baseN & mask);
 }
+function ipv4InCidr(ip, base, prefix) {
+  return inRange(ip, base, prefix);
+}
 function isBlockedHost(host) {
   const lower = host.toLowerCase();
   if (METADATA_HOSTS.has(lower)) return true;
@@ -598,330 +601,6 @@ function systemdPropertyFor(semantic) {
   return SYSTEMD_PROPERTY_CATALOG[semantic];
 }
 
-// src/parsers/frontmatter.ts
-import yaml from "js-yaml";
-var FM_OPEN = /^---\r?\n/;
-function splitFrontmatter(text) {
-  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
-  const afterOpen = text.replace(FM_OPEN, "");
-  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
-  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
-  const rawFrontmatter = afterOpen.slice(0, closeIdx);
-  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
-  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
-  const body = text.slice(bodyStart);
-  return ok({ rawFrontmatter, body, bodyStart });
-}
-function extractFrontmatter(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return split;
-  if (!split.data.rawFrontmatter) return ok({});
-  try {
-    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
-    return ok(parsed);
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
-  }
-}
-
-// src/utils/sensitive-content.ts
-import { createHash } from "crypto";
-var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
-var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
-var MATCHERS = [
-  {
-    kind: "private_key",
-    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
-  },
-  {
-    kind: "authorization_header",
-    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "cookie",
-    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "jwt",
-    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "provider_key",
-    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "api_key",
-    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "password",
-    re: /\b(?:password|passwd)["']?\s*[:=]\s*[`"']?([^\s`"']{8,})[`"']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "secret",
-    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "token",
-    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  }
-];
-function fingerprint(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function lineFor(text, offset) {
-  return text.slice(0, offset).split(/\r?\n/).length;
-}
-function redactMarker(kind, value) {
-  return `[REDACTED:${kind}:${fingerprint(value)}]`;
-}
-function isSyntheticPlaceholder(value) {
-  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
-}
-function isInsideRedactedMarker(text, start, end) {
-  for (const marker of text.matchAll(new RegExp(REDACTED_RE.source, "gi"))) {
-    const markerStart = marker.index ?? 0;
-    const markerEnd = markerStart + marker[0].length;
-    if (start >= markerStart && end <= markerEnd) return true;
-  }
-  return false;
-}
-function isNonSecretTokenCapture(value) {
-  if (value.startsWith("//")) return true;
-  if (value.includes("/")) return true;
-  if (/^[a-z0-9.]+(?:-[a-z0-9.]+)+$/.test(value) && !/^[0-9a-f]+(?:-[0-9a-f]+)+$/.test(value)) return true;
-  return false;
-}
-var PASSWORD_PROSE_SENTINELS = /* @__PURE__ */ new Set([
-  "generated",
-  "configured",
-  "required",
-  "optional",
-  "provided",
-  "disabled",
-  "enabled",
-  "undefined",
-  "unspecified",
-  "unknown"
-]);
-function isNonSecretPasswordCapture(value) {
-  return PASSWORD_PROSE_SENTINELS.has(value.toLowerCase());
-}
-function collectMatches(text) {
-  const matches = [];
-  for (const matcher of MATCHERS) {
-    matcher.re.lastIndex = 0;
-    for (const m of text.matchAll(matcher.re)) {
-      const whole = m[0];
-      const start = m.index ?? 0;
-      if (REDACTED_RE.test(whole) || isInsideRedactedMarker(text, start, start + whole.length)) continue;
-      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
-      if (isSyntheticPlaceholder(value)) continue;
-      if (matcher.kind === "token" && isNonSecretTokenCapture(value)) continue;
-      if (matcher.kind === "password" && isNonSecretPasswordCapture(value)) continue;
-      const valueOffset = whole.lastIndexOf(value);
-      const valueStart = start + Math.max(0, valueOffset);
-      matches.push({
-        start,
-        end: start + whole.length,
-        valueStart,
-        valueEnd: valueStart + value.length,
-        kind: matcher.kind
-      });
-    }
-  }
-  return matches.sort((a, b) => {
-    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
-    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
-  });
-}
-function collapseOverlaps(matches) {
-  const kept = [];
-  for (const match of matches) {
-    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
-    if (!overlaps) kept.push(match);
-  }
-  return kept;
-}
-function scanSensitiveContent(text, opts = {}) {
-  return collapseOverlaps(collectMatches(text)).map((match) => {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    const marker = redactMarker(match.kind, value);
-    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
-    const preview = rawPreview.replace(value, marker);
-    return {
-      file: opts.file,
-      line: lineFor(text, match.valueStart),
-      kind: match.kind,
-      preview,
-      fingerprint: fingerprint(value)
-    };
-  });
-}
-function redactSensitiveContent(text, opts = {}) {
-  const matches = collapseOverlaps(collectMatches(text));
-  if (matches.length === 0) return { text, changed: false, findings: [] };
-  let out = "";
-  let cursor = 0;
-  for (const match of matches) {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    out += text.slice(cursor, match.valueStart);
-    out += redactMarker(match.kind, value);
-    cursor = match.valueEnd;
-  }
-  out += text.slice(cursor);
-  return {
-    text: out,
-    changed: out !== text,
-    findings: scanSensitiveContent(text, opts)
-  };
-}
-
-// src/utils/vault.ts
-import { existsSync, readFileSync } from "fs";
-import { readFile, readdir, stat } from "fs/promises";
-import { join, relative, sep } from "path";
-import { execFileSync } from "child_process";
-var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var DEFAULT_IO_CONCURRENCY = 1;
-function vaultIoConcurrency() {
-  const raw = Number.parseInt(process.env.SKILLWIKI_VAULT_IO_CONCURRENCY ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, 64) : DEFAULT_IO_CONCURRENCY;
-}
-function decodeProcMountPath(value) {
-  return value.replace(/\\040/g, " ");
-}
-function isRcloneFuseVaultFromMounts(root, mounts) {
-  return mounts.split(/\r?\n/).some((line) => {
-    const parts = line.split(" ");
-    if (parts.length < 3) return false;
-    const mountPoint = decodeProcMountPath(parts[1]);
-    const fsType = parts[2];
-    return fsType === "fuse.rclone" && (root === mountPoint || root.startsWith(`${mountPoint}/`));
-  });
-}
-function resolveReadOnlyVaultRootWithMounts(root, mounts) {
-  if (/^(1|true|yes)$/i.test(process.env.SKILLWIKI_DISABLE_VAULT_READ_MIRROR ?? "")) {
-    return { root, mirrored: false };
-  }
-  const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
-  if (explicitMirror && existsSync(join(explicitMirror, "SCHEMA.md"))) {
-    return { root: explicitMirror, mirrored: explicitMirror !== root };
-  }
-  const siblingMirror = `${root}-git`;
-  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync(join(siblingMirror, "SCHEMA.md"))) {
-    return { root: siblingMirror, mirrored: true };
-  }
-  return { root, mirrored: false };
-}
-function resolveReadOnlyVaultRoot(root) {
-  let mounts = "";
-  try {
-    mounts = readFileSync("/proc/mounts", "utf8");
-  } catch {
-  }
-  return resolveReadOnlyVaultRootWithMounts(root, mounts);
-}
-async function mapWithConcurrency(items, limit, mapper) {
-  const out = new Array(items.length);
-  let next = 0;
-  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
-    for (; ; ) {
-      const index = next++;
-      if (index >= items.length) return;
-      out[index] = await mapper(items[index], index);
-    }
-  });
-  await Promise.all(workers);
-  return out;
-}
-function filterGitIgnoredRelativePaths(root, relPaths) {
-  if (relPaths.length === 0 || !existsSync(join(root, ".git"))) {
-    return /* @__PURE__ */ new Set();
-  }
-  try {
-    const input = relPaths.join("\0") + "\0";
-    const stdout = execFileSync("git", ["check-ignore", "-z", "--stdin"], {
-      cwd: root,
-      input,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const ignored = stdout.split("\0").filter(Boolean);
-    return new Set(ignored);
-  } catch (error) {
-    if (error && typeof error === "object" && error.status === 1) {
-      return /* @__PURE__ */ new Set();
-    }
-    return /* @__PURE__ */ new Set();
-  }
-}
-async function scanVault(root) {
-  try {
-    await stat(join(root, "SCHEMA.md"));
-  } catch {
-    return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
-  }
-  const all = await walk(root);
-  const rawRels = all.map((p) => ({ absPath: p, relPath: relative(root, p).split(sep).join("/") }));
-  const ignored = filterGitIgnoredRelativePaths(root, rawRels.map((p) => p.relPath));
-  const rels = ignored.size > 0 ? rawRels.filter((p) => !ignored.has(p.relPath)) : rawRels;
-  return ok({
-    root,
-    allMarkdown: rels,
-    typedKnowledge: rels.filter((p) => TYPED_DIRS.some((d) => p.relPath.startsWith(d + "/"))),
-    raw: rels.filter((p) => p.relPath.startsWith("raw/")),
-    workItems: rels.filter((p) => /^projects\/[^/]+\/work\/[^/]+\/(spec|plan|log)\.md$/.test(p.relPath)),
-    compound: rels.filter((p) => /^projects\/[^/]+\/compound\//.test(p.relPath))
-  });
-}
-async function walk(dir) {
-  const entries = await readdir(dir, { withFileTypes: true });
-  const out = [];
-  const subdirs = [];
-  for (const e of entries) {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) {
-      if (SKIP_DIRS.has(e.name)) continue;
-      subdirs.push(p);
-    } else if (e.isFile() && e.name.endsWith(".md")) out.push(p);
-  }
-  const nested = await mapWithConcurrency(subdirs, Math.min(8, vaultIoConcurrency()), walk);
-  for (const files of nested) out.push(...files);
-  return out;
-}
-async function readPage(p) {
-  return readFile(p.absPath, "utf8");
-}
-async function readPageCached(p, cache) {
-  if (!cache) return readPage(p);
-  const existing = cache.get(p.absPath);
-  if (existing) return existing;
-  const pending = readPage(p);
-  cache.set(p.absPath, pending);
-  return pending;
-}
-
 export {
   ExitCode,
   ok,
@@ -938,19 +617,9 @@ export {
   isClipOutboxKey,
   parseClipOutboxKeyValue,
   detectSchema,
+  ipv4InCidr,
   isBlockedHost,
   getErrorMessage,
   resolveSessionKind,
-  systemdPropertyFor,
-  splitFrontmatter,
-  extractFrontmatter,
-  scanSensitiveContent,
-  redactSensitiveContent,
-  vaultIoConcurrency,
-  resolveReadOnlyVaultRoot,
-  mapWithConcurrency,
-  filterGitIgnoredRelativePaths,
-  scanVault,
-  readPage,
-  readPageCached
+  systemdPropertyFor
 };