skillwiki 0.10.111 → 0.10.113

package/dist/cli.js

@@ -1,8 +1,4 @@
 #!/usr/bin/env node
-import {
-  runFetchGuard,
-  runFetchGuardSync
-} from "./chunk-I2J3IJB7.js";
 import {
   buildDeleteIntent,
   normalizeVaultRelPath,
@@ -16,9 +12,6 @@ import {
   DEFAULT_MCP_URL,
   DEFAULT_NO_DECISION_STREAK,
   GateError,
-  MCP_HOST_ID_ENV,
-  MCP_TOKEN_ENV,
-  MCP_URL_ENV,
   PUSH_NOT_IN_PROFILE,
   SATELLITE_STALE_MS,
   buildVectorIndex,
@@ -31,17 +24,13 @@ import {
   guardProtectedVaultWrite,
   isEventLedgerPath,
   isFailedRunStatus,
-  mcpAuthFromEnv,
   measureDirtyVolume,
   memoryAuthorityTiersRank,
-  mergeMcpAuthIntoEnv,
-  nonEmptyEnvValue,
   pruneVectorIndex,
   readCliPackageJson,
   readSatelliteLatestRunAt,
   readSatelliteLatestRunFromText,
   readVaultSyncConfig,
-  redactMcpSecret,
   reindexPageInVectorIndex,
   renderIndexUpsert,
   renderProjectIndex,
@@ -75,7 +64,7 @@ import {
   upsertIndexEntry,
   vectorIndexStatus,
   withMcpClient
-} from "./chunk-OJJBZDPR.js";
+} from "./chunk-5RHR4FEK.js";
 import {
   applySourceDisposition,
   decodeSourceActionApproval,
@@ -83,7 +72,7 @@ import {
   inventorySources,
   planSourceDisposition,
   runSourcesPending
-} from "./chunk-JQV5KNPT.js";
+} from "./chunk-CBT35FAW.js";
 import {
   normalizeDistTag,
   readCache,
@@ -96,7 +85,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-MRPJ7X7W.js";
+} from "./chunk-IJWZDQDH.js";
 import {
   FLEET_REL_PATH,
   REDACTED_MALFORMED_REFERENCE,
@@ -124,6 +113,7 @@ import {
   gitStrict,
   hasActiveGitSequencer,
   hasUnmergedPaths,
+  isAdvisoryLintWarning,
   isValidRemoteDeleteCap,
   isWorktreeClean,
   listJournalOpIds,
@@ -184,7 +174,7 @@ import {
   stageVaultContentChanges,
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage
-} from "./chunk-HBJLFPQP.js";
+} from "./chunk-FQERKMD7.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -201,11 +191,11 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-5IBLXGLY.js";
+} from "./chunk-K3YZESND.js";
 import {
   assertTargetInsideVault,
   prepareTypedPage
-} from "./chunk-I6IRJCUJ.js";
+} from "./chunk-3TKNAOJH.js";
 import {
   extractFrontmatter,
   mapWithConcurrency,
@@ -217,25 +207,38 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-X5GL2FCU.js";
+} from "./chunk-JL2SCLXT.js";
+import {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret
+} from "./chunk-OGEAFXON.js";
 import {
   CLIP_MIGRATION_HINT,
   refreshInstalledClipPlist
-} from "./chunk-TDBUJUYH.js";
+} from "./chunk-XJ5VEIH7.js";
+import {
+  atomicWriteText
+} from "./chunk-6VUK2FTX.js";
 import {
   CLIP_NOT_CONFIGURED,
   loadClipOutboxConfig
-} from "./chunk-6OQLBNKR.js";
+} from "./chunk-OWWWO2XS.js";
+import {
+  runFetchGuard,
+  runFetchGuardSync
+} from "./chunk-5D5HFQ76.js";
 import {
   parseDotenvFile,
   parseDotenvText,
   profileKey,
   resolveSkillwikiHome,
   writeDotenv
-} from "./chunk-PYPPG7RF.js";
-import {
-  atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-IJKJGQKL.js";
 import {
   ExitCode,
   MetaSchema,
@@ -245,10 +248,10 @@ import {
   err,
   ok,
   resolveSessionKind
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-VNSZCK5V.js";
 
 // src/cli.ts
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -1599,21 +1602,21 @@ function rollbackPath(vault, path, stage2, stage3) {
 function hasMarkers(path, text) {
   const lines = text.split(/\r?\n/);
   let open2 = false;
-  let sep5 = false;
+  let sep6 = false;
   for (const line of lines) {
     if (line.startsWith("<<<<<<< ")) {
       open2 = true;
-      sep5 = false;
+      sep6 = false;
       continue;
     }
     if (line === "=======" && open2) {
-      sep5 = true;
+      sep6 = true;
       continue;
     }
-    if (line.startsWith(">>>>>>> ") && open2 && sep5) return true;
+    if (line.startsWith(">>>>>>> ") && open2 && sep6) return true;
     if (line.startsWith(">>>>>>> ")) {
       open2 = false;
-      sep5 = false;
+      sep6 = false;
     }
   }
   return false;
@@ -3476,7 +3479,11 @@ async function runHealth(input) {
     checks: doctor.result.data.checks.map((check) => ({ id: check.id, status: check.status, detail: check.detail }))
   };
   const lintComponent = {
-    status: statusFromCounts({ error: lint.result.data.summary.errors, warnings: lint.result.data.summary.warnings, info: lint.result.data.summary.info }),
+    status: statusFromCounts({
+      error: lint.result.data.summary.errors,
+      warnings: lint.result.data.buckets.filter((bucket) => bucket.severity === "warning" && !isAdvisoryLintWarning(bucket.kind)).reduce((n, bucket) => n + bucket.count, 0),
+      info: lint.result.data.summary.info
+    }),
     blocking: true,
     summary: lint.result.data.summary,
     buckets: lint.result.data.buckets,
@@ -3583,7 +3590,7 @@ async function runClipOutboxStatus(home) {
       result: ok({ enabled: false, humanHint: CLIP_NOT_CONFIGURED })
     };
   }
-  const { readJournal: readJournal2 } = await import("./journal-QU5IDXQF.js");
+  const { readJournal: readJournal2 } = await import("./journal-V5XHBEI5.js");
   let queue;
   try {
     queue = (await readJournal2(resolved.config.stateRoot)).map(({ captureId, state, reason, attempts }) => ({ captureId, state, reason, attempts }));
@@ -3601,7 +3608,7 @@ async function runClipOutboxStatus(home) {
 }
 async function runClipOutboxInstall(input) {
   try {
-    const { migrateClipOutbox } = await import("./migrate-PIB4QA54.js");
+    const { migrateClipOutbox } = await import("./migrate-SRRCXI2K.js");
     return { exitCode: ExitCode.OK, result: ok(await migrateClipOutbox(input)) };
   } catch (e) {
     return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: e instanceof Error ? e.message : "clip migration failed" }) };
@@ -3614,10 +3621,10 @@ async function runClipOutboxWatch(home) {
   let client;
   try {
     const { S3Client: S3Client3 } = await import("@aws-sdk/client-s3");
-    const { loadClipCredentials, validateRuntime } = await import("./runtime-GLMI5OCT.js");
+    const { loadClipCredentials, validateRuntime } = await import("./runtime-LQZIG3XN.js");
     const { createS3CreateOnlyPut, parseDestination } = await import("./upload-HTE62TOV.js");
     const { postReadyHint } = await import("./ready-S7F53Q2D.js");
-    const { startClipWorker } = await import("./watcher-MHG46J3R.js");
+    const { startClipWorker } = await import("./watcher-VJ3TOU6J.js");
     const cfg = resolved.config;
     const credentials = await loadClipCredentials(home, cfg);
     await validateRuntime(home, cfg, credentials.s3.endpoint);
@@ -3653,6 +3660,47 @@ async function runClipOutboxWatch(home) {
     client?.destroy();
   }
 }
+async function runClipOutboxMirrorWatch(home) {
+  const resolved = await loadClipOutboxConfig(home);
+  if (!resolved.ok || !resolved.enabled) return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { message: resolved.ok ? CLIP_NOT_CONFIGURED : resolved.message }) };
+  let client;
+  const abort = new AbortController();
+  try {
+    const { S3Client: S3Client3 } = await import("@aws-sdk/client-s3");
+    const { loadClipCredentials, validateRuntime } = await import("./runtime-LQZIG3XN.js");
+    const { createS3GetObject, eventsUrlFromMcp, parseDestinationForMirror, startMirrorListener } = await import("./mirror-H5BTBAON.js");
+    const { resolveMcpAuthEnv } = await import("./mcp-auth-env-QONKW4EO.js");
+    const cfg = resolved.config;
+    const credentials = await loadClipCredentials(home, cfg);
+    await validateRuntime(home, cfg, credentials.s3.endpoint);
+    const auth = await resolveMcpAuthEnv({ home });
+    if (!auth.url || !auth.token) throw new Error("MCP bearer required for inbound SSE");
+    const destination = parseDestinationForMirror(cfg.destination);
+    client = new S3Client3({ endpoint: credentials.s3.endpoint, region: credentials.s3.region, credentials: credentials.s3, forcePathStyle: true, maxAttempts: 1 });
+    const done = new Promise((resolve10) => {
+      abort.signal.addEventListener("abort", () => resolve10(), { once: true });
+    });
+    process.once("SIGTERM", () => abort.abort());
+    process.once("SIGINT", () => abort.abort());
+    await Promise.race([
+      startMirrorListener({
+        home,
+        config: cfg,
+        eventsUrl: eventsUrlFromMcp(auth.url),
+        mcpToken: auth.token,
+        getObject: createS3GetObject({ client, bucket: destination.bucket, prefix: destination.prefix, maxBytes: cfg.maxBundleBytes }),
+        signal: abort.signal
+      }),
+      done
+    ]);
+    return { exitCode: ExitCode.OK, result: ok({ humanHint: "Inbound SSE listener stopped." }) };
+  } catch {
+    return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err("PREFLIGHT_FAILED", { message: "inbound SSE listener startup failed; check MCP bearer, clip credentials, frozen mirror and wiki-push isolation" }) };
+  } finally {
+    abort.abort();
+    client?.destroy();
+  }
+}
 
 // src/commands/connect.ts
 import { chmod, mkdir as mkdir5, readFile as readFile6, stat as stat3 } from "fs/promises";
@@ -4132,7 +4180,7 @@ ${fmRewritten}
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-RQSOEDXM.js");
     const before = await readFile7(join19(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -4253,10 +4301,10 @@ async function runRemove(input) {
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
   await unlink2(join20(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile23 } = await import("fs/promises");
+    const { readFile: readFile24 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-2K672CBO.js");
-    const before = await readFile23(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-RQSOEDXM.js");
+    const before = await readFile24(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -6839,8 +6887,8 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
   if (!strategy.usesJournal || !phaseAtLeast(currentPhase, "page")) {
     if (strategy.publisherKind === "project-page") {
       try {
-        const { mkdir: mkdir13 } = await import("fs/promises");
-        await mkdir13(dirname7(prepared.targetPath), { recursive: true });
+        const { mkdir: mkdir14 } = await import("fs/promises");
+        await mkdir14(dirname7(prepared.targetPath), { recursive: true });
       } catch (error) {
         return {
           ok: false,
@@ -7647,7 +7695,7 @@ function buildRawContent(sourceUrl, ingested, sha2562, body) {
   ];
   return lines.join("\n");
 }
-function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance) {
+function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance, html) {
   const aliases = [];
   const sourcesYaml = `  - ${rawRelPath}`;
   const tagsYaml = tags.length > 0 ? tags.map((t) => `  - ${t}`).join("\n") : "  []";
@@ -7670,6 +7718,10 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
   if (provenance) {
     fmLines.push(`provenance: ${provenance}`);
   }
+  fmLines.push("output_standard: v2");
+  if (html) {
+    fmLines.push("html_render: true");
+  }
   fmLines.push("---");
   fmLines.push("");
   const body = [
@@ -7753,7 +7805,7 @@ async function acquireRawCaptureLock(path) {
       if (error.code !== "EEXIST") {
         return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: String(error) });
       }
-      await new Promise((resolve9) => setTimeout(resolve9, 10));
+      await new Promise((resolve10) => setTimeout(resolve10, 10));
     }
   }
   return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: "raw capture lock held" });
@@ -7892,7 +7944,8 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     input.type,
     tags,
     rawRelPath,
-    input.provenance
+    input.provenance,
+    input.html
   );
   if (!input.dryRun) {
     try {
@@ -7983,7 +8036,8 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
           input.type,
           tags,
           rawRelPath,
-          input.provenance
+          input.provenance,
+          input.html
         );
         const refreshedPublication = preparePagePublicationFromContent({
           vault: input.vault,
@@ -8386,14 +8440,412 @@ async function runTagReconcile(input) {
   };
 }
 
+// src/commands/page-render-html.ts
+import { lstat, mkdir as mkdir11, readFile as readFile17, realpath } from "fs/promises";
+import { basename, dirname as dirname9, join as join33, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var SAFE_HREF_RE = /^(https?:\/\/|mailto:|#)/i;
+function escapeAttr(text) {
+  return escapeHtml(text).replace(/'/g, "&#39;");
+}
+function slugifyHeading(text, used) {
+  const base = text.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "section";
+  const n = used.get(base) ?? 0;
+  used.set(base, n + 1);
+  return n === 0 ? base : `${base}-${n + 1}`;
+}
+function renderInlineMarkdown(raw) {
+  const re = /(`[^`]+`)|(\[\[(?:[^\]]+)\]\])|(!\[[^\]]*\]\([^)]+\))|(\[[^\]]+\]\([^)]+\))|(\*\*[^*]+\*\*)|(\*[^*]+\*)/g;
+  const parts = [];
+  let last = 0;
+  let match;
+  while ((match = re.exec(raw)) !== null) {
+    parts.push(escapeHtml(raw.slice(last, match.index)));
+    const token = match[0];
+    if (token.startsWith("`")) {
+      parts.push(`<code>${escapeHtml(token.slice(1, -1))}</code>`);
+    } else if (token.startsWith("[[")) {
+      const inner = token.slice(2, -2);
+      const pipe = inner.indexOf("|");
+      const label = pipe === -1 ? inner : inner.slice(pipe + 1);
+      parts.push(escapeHtml(label.trim()));
+    } else if (token.startsWith("![")) {
+      const alt = token.match(/^!\[([^\]]*)\]/)?.[1] ?? "";
+      parts.push(escapeHtml(alt));
+    } else if (token.startsWith("[")) {
+      const linked = token.match(/^\[([^\]]+)\]\(([^)]+)\)$/);
+      if (linked && SAFE_HREF_RE.test(linked[2])) {
+        parts.push(`<a href="${escapeAttr(linked[2])}">${escapeHtml(linked[1])}</a>`);
+      } else if (linked) {
+        parts.push(escapeHtml(linked[1]));
+      } else {
+        parts.push(escapeHtml(token));
+      }
+    } else if (token.startsWith("**")) {
+      parts.push(`<strong>${escapeHtml(token.slice(2, -2))}</strong>`);
+    } else {
+      parts.push(`<em>${escapeHtml(token.slice(1, -1))}</em>`);
+    }
+    last = match.index + token.length;
+  }
+  parts.push(escapeHtml(raw.slice(last)));
+  return parts.join("");
+}
+function parseTableRow(line) {
+  const trimmed = line.trim();
+  const inner = trimmed.startsWith("|") ? trimmed.slice(1) : trimmed;
+  const withoutEnd = inner.endsWith("|") ? inner.slice(0, -1) : inner;
+  return withoutEnd.split("|").map((cell) => cell.trim());
+}
+function isTableSeparator(line) {
+  return /^\s*\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)+\|?\s*$/.test(line);
+}
+function parseMarkdownBlocks(body) {
+  const lines = body.split(/\r?\n/);
+  const blocks = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const fence = line.match(/^(\s*)(`{3,}|~{3,})(.*)$/);
+    if (fence) {
+      const marker = fence[2];
+      const language = fence[3].trim();
+      const content = [];
+      i++;
+      while (i < lines.length) {
+        const close = lines[i].match(/^(\s*)(`{3,}|~{3,})\s*$/);
+        if (close && close[2][0] === marker[0] && close[2].length >= marker.length) break;
+        content.push(lines[i]);
+        i++;
+      }
+      blocks.push({ kind: "code", language, text: content.join("\n") });
+      i++;
+      continue;
+    }
+    const heading = line.match(/^(#{1,6})\s+(\S.*)$/);
+    if (heading) {
+      blocks.push({ kind: "heading", level: heading[1].length, text: heading[2].trim() });
+      i++;
+      continue;
+    }
+    if (/^\s*\|.*\|\s*$/.test(line) && i + 1 < lines.length && isTableSeparator(lines[i + 1])) {
+      const rows = [parseTableRow(line)];
+      i += 2;
+      while (i < lines.length && /^\s*\|.*\|\s*$/.test(lines[i]) && !isTableSeparator(lines[i])) {
+        rows.push(parseTableRow(lines[i]));
+        i++;
+      }
+      blocks.push({ kind: "table", rows });
+      continue;
+    }
+    const ordered = line.match(/^\s*\d+\.\s+(.*)$/);
+    const unordered = line.match(/^\s*[-*+]\s+(.*)$/);
+    if (ordered || unordered) {
+      const isOrdered = Boolean(ordered);
+      const itemRe = isOrdered ? /^\s*\d+\.\s+(.*)$/ : /^\s*[-*+]\s+(.*)$/;
+      const items = [];
+      while (i < lines.length) {
+        const item = lines[i].match(itemRe);
+        if (!item) break;
+        const chunks = [item[1]];
+        i++;
+        while (i < lines.length && /^\s+\S/.test(lines[i]) && !itemRe.test(lines[i]) && !/^(#{1,6})\s+/.test(lines[i])) {
+          chunks.push(lines[i].trim());
+          i++;
+        }
+        items.push(chunks.join(" "));
+      }
+      blocks.push({ kind: "list", ordered: isOrdered, items });
+      continue;
+    }
+    if (!line.trim()) {
+      i++;
+      continue;
+    }
+    const para = [line.trim()];
+    i++;
+    while (i < lines.length) {
+      const next = lines[i];
+      if (!next.trim()) break;
+      if (/^(#{1,6})\s+/.test(next) || /^(\s*)(`{3,}|~{3,})/.test(next) || /^\s*\|.*\|\s*$/.test(next) || /^\s*\d+\.\s+/.test(next) || /^\s*[-*+]\s+/.test(next)) {
+        break;
+      }
+      para.push(next.trim());
+      i++;
+    }
+    blocks.push({ kind: "paragraph", text: para.join(" ") });
+  }
+  return blocks;
+}
+function renderBlock(block) {
+  switch (block.kind) {
+    case "heading": {
+      const tag = `h${Math.min(block.level, 6)}`;
+      return `<${tag}>${renderInlineMarkdown(block.text)}</${tag}>`;
+    }
+    case "paragraph":
+      return `<p>${renderInlineMarkdown(block.text)}</p>`;
+    case "list": {
+      const tag = block.ordered ? "ol" : "ul";
+      const items = block.items.map((item) => `<li>${renderInlineMarkdown(item)}</li>`).join("");
+      return `<${tag}>${items}</${tag}>`;
+    }
+    case "table": {
+      if (block.rows.length === 0) return "";
+      const [header, ...body] = block.rows;
+      const thead = `<thead><tr>${header.map((cell) => `<th>${renderInlineMarkdown(cell)}</th>`).join("")}</tr></thead>`;
+      const tbody = body.length > 0 ? `<tbody>${body.map((row) => `<tr>${row.map((cell) => `<td>${renderInlineMarkdown(cell)}</td>`).join("")}</tr>`).join("")}</tbody>` : "";
+      return `<table>${thead}${tbody}</table>`;
+    }
+    case "code": {
+      const cls = block.language.toLowerCase() === "mermaid" ? ' class="mermaid"' : "";
+      return `<pre${cls}><code>${escapeHtml(block.text)}</code></pre>`;
+    }
+  }
+}
+function groupSections(blocks) {
+  const used = /* @__PURE__ */ new Map();
+  let title = "Page";
+  const intro = [];
+  const sections = [];
+  let current = null;
+  for (const block of blocks) {
+    if (block.kind === "heading" && block.level === 1 && title === "Page") {
+      title = block.text;
+      continue;
+    }
+    if (block.kind === "heading" && block.level === 2) {
+      current = { id: slugifyHeading(block.text, used), title: block.text, blocks: [] };
+      sections.push(current);
+      continue;
+    }
+    if (current) current.blocks.push(block);
+    else intro.push(block);
+  }
+  return { title, intro, sections };
+}
+function renderPageHtml(title, body) {
+  const parsed = parseMarkdownBlocks(body);
+  const grouped = groupSections(parsed);
+  const pageTitle = grouped.title !== "Page" ? grouped.title : title;
+  const sections = grouped.sections.length > 0 ? grouped.sections : [{ id: "content", title: pageTitle, blocks: grouped.intro }];
+  const introHtml = grouped.sections.length > 0 && grouped.intro.length > 0 ? grouped.intro.map(renderBlock).join("\n") : "";
+  const toc = sections.map((section) => `<li><a href="#${escapeAttr(section.id)}">${escapeHtml(section.title)}</a></li>`).join("");
+  const tabs = sections.map(
+    (section, index) => `<button type="button" role="tab" aria-selected="${index === 0 ? "true" : "false"}" aria-controls="${escapeAttr(section.id)}" data-tab="${escapeAttr(section.id)}">${escapeHtml(section.title)}</button>`
+  ).join("");
+  const panels = sections.map((section, index) => {
+    const inner = section.blocks.map(renderBlock).join("\n");
+    return `<section id="${escapeAttr(section.id)}" class="tab-panel" role="tabpanel"${index === 0 ? "" : " hidden"}><details open><summary>${escapeHtml(section.title)}</summary>
+${inner}
+</details></section>`;
+  }).join("\n");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(pageTitle)}</title>
+<style>
+:root { color-scheme: light dark; --bg: #f7f5f0; --fg: #1b1b1b; --accent: #355c7d; --line: #cfc8bc; }
+body { margin: 0 auto; max-width: 52rem; padding: 1.5rem; font: 16px/1.5 system-ui, sans-serif; background: var(--bg); color: var(--fg); }
+nav.toc { border: 1px solid var(--line); padding: 0.75rem 1rem; margin-bottom: 1rem; }
+nav.toc ol { margin: 0; padding-left: 1.25rem; }
+.tabs { display: flex; flex-wrap: wrap; gap: 0.35rem; margin: 1rem 0; }
+.tabs button { border: 1px solid var(--line); background: transparent; color: inherit; padding: 0.35rem 0.7rem; cursor: pointer; }
+.tabs button[aria-selected="true"] { background: var(--accent); color: #fff; }
+.tab-panel { border: 1px solid var(--line); padding: 0.75rem; }
+details { margin: 0; }
+summary { cursor: pointer; font-weight: 600; }
+pre { overflow: auto; padding: 0.75rem; background: #111; color: #f5f5f5; }
+pre.mermaid { white-space: pre-wrap; }
+table { border-collapse: collapse; width: 100%; }
+th, td { border: 1px solid var(--line); padding: 0.35rem 0.5rem; text-align: left; }
+a { color: var(--accent); }
+</style>
+</head>
+<body>
+<nav class="toc" id="toc"><strong>Contents</strong><ol>${toc}</ol></nav>
+${introHtml}
+<div class="tabs" role="tablist">${tabs}</div>
+${panels}
+<script>
+(function () {
+  var tabs = document.querySelectorAll('[role="tab"]');
+  var panels = document.querySelectorAll('.tab-panel');
+  function activate(id) {
+    if (!id) return;
+    var found = false;
+    panels.forEach(function (panel) { if (panel.id === id) found = true; });
+    if (!found) return;
+    tabs.forEach(function (tab) {
+      tab.setAttribute("aria-selected", tab.getAttribute("data-tab") === id ? "true" : "false");
+    });
+    panels.forEach(function (panel) { panel.hidden = panel.id !== id; });
+  }
+  tabs.forEach(function (tab) {
+    tab.addEventListener("click", function () {
+      activate(tab.getAttribute("data-tab"));
+    });
+  });
+  document.querySelectorAll("nav.toc a[href^='#']").forEach(function (link) {
+    link.addEventListener("click", function () {
+      activate((link.getAttribute("href") || "").replace(/^#/, ""));
+    });
+  });
+  function fromHash() {
+    activate((location.hash || "").replace(/^#/, ""));
+  }
+  window.addEventListener("hashchange", fromHash);
+  fromHash();
+})();
+</script>
+</body>
+</html>
+`;
+}
+function isInsideCanonical(root, candidate) {
+  const rel = relative2(root, candidate).split(sep2).join("/");
+  return rel === "" || rel !== ".." && !rel.startsWith("../");
+}
+function outInsideVaultError(vault, out, message) {
+  return err("HTML_RENDER_OUT_INSIDE_VAULT", { vault, out, message });
+}
+async function canonicalizeWithMissingSuffix(abs) {
+  try {
+    await lstat(abs);
+    return await realpath(abs);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const missing = [];
+  let current = abs;
+  while (true) {
+    missing.unshift(basename(current));
+    const parent = dirname9(current);
+    try {
+      await lstat(parent);
+      return join33(await realpath(parent), ...missing);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (parent === current) return join33(parent, ...missing);
+      current = parent;
+    }
+  }
+}
+async function resolveOutOutsideVault(vault, out) {
+  let vaultReal;
+  try {
+    vaultReal = await realpath(vault);
+  } catch (error) {
+    return err("VAULT_PATH_INVALID", { message: "vault realpath failed", cause: String(error) });
+  }
+  const abs = resolve5(out);
+  try {
+    const info = await lstat(abs);
+    if (info.isSymbolicLink()) {
+      return outInsideVaultError(vault, out, "--out must be a regular path outside the vault");
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("WRITE_FAILED", { path: abs, message: String(error) });
+    }
+  }
+  let canonical;
+  try {
+    canonical = await canonicalizeWithMissingSuffix(abs);
+  } catch (error) {
+    return err("WRITE_FAILED", { path: abs, message: String(error) });
+  }
+  if (isInsideCanonical(vaultReal, canonical)) {
+    return outInsideVaultError(vault, out, "--out must be outside the vault");
+  }
+  return ok(canonical);
+}
+async function runPageRenderHtml(input) {
+  if (!input.out || input.out.trim().length === 0) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "--out is required" })
+    };
+  }
+  const pagePath = await resolveExistingRegularFileInsideVault(input.vault, input.page);
+  if (!pagePath.ok) {
+    return {
+      exitCode: pagePath.error === "FILE_NOT_FOUND" ? ExitCode.FILE_NOT_FOUND : ExitCode.VAULT_PATH_INVALID,
+      result: pagePath
+    };
+  }
+  const outPath = await resolveOutOutsideVault(input.vault, input.out);
+  if (!outPath.ok) {
+    const exitCode = outPath.error === "HTML_RENDER_OUT_INSIDE_VAULT" ? ExitCode.SCHEME_REJECTED : outPath.error === "WRITE_FAILED" ? ExitCode.WRITE_FAILED : ExitCode.VAULT_PATH_INVALID;
+    return { exitCode, result: outPath };
+  }
+  let text;
+  try {
+    text = await readFile17(pagePath.data, "utf8");
+  } catch {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { path: input.page })
+    };
+  }
+  const fm = extractFrontmatter(text);
+  if (!fm.ok) {
+    return {
+      exitCode: ExitCode.INVALID_FRONTMATTER,
+      result: fm
+    };
+  }
+  if (fm.data.html_render !== true) {
+    return {
+      exitCode: ExitCode.HTML_RENDER_NOT_OPTED_IN,
+      result: err("HTML_RENDER_NOT_OPTED_IN", {
+        page: input.page,
+        message: "page frontmatter must set html_render: true"
+      })
+    };
+  }
+  const split = splitFrontmatter(text);
+  if (!split.ok) {
+    return { exitCode: ExitCode.MISSING_CLOSING_DELIMITER, result: split };
+  }
+  const title = typeof fm.data.title === "string" ? fm.data.title : input.page;
+  const html = renderPageHtml(title, split.data.body);
+  const outAbs = outPath.data;
+  try {
+    await mkdir11(dirname9(outAbs), { recursive: true });
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { path: outAbs, message: String(error) })
+    };
+  }
+  const written = await atomicWriteText(outAbs, html);
+  if (!written.ok) {
+    return { exitCode: ExitCode.WRITE_FAILED, result: written };
+  }
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      page: input.page,
+      out: outAbs,
+      bytes: Buffer.byteLength(html, "utf8"),
+      humanHint: `Wrote ${outAbs} (${Buffer.byteLength(html, "utf8")} bytes)`
+    })
+  };
+}
+
 // src/commands/project-page-publish.ts
 import { realpathSync as realpathSync4 } from "fs";
-import { mkdir as mkdir11, readFile as readFile17 } from "fs/promises";
-import { dirname as dirname10, join as join33, resolve as resolve6 } from "path";
+import { mkdir as mkdir12, readFile as readFile18 } from "fs/promises";
+import { dirname as dirname11, join as join34, resolve as resolve7 } from "path";
 
 // src/utils/architecture-page.ts
 import { lstatSync, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname9, posix as posix2, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
+import { dirname as dirname10, posix as posix2, relative as relative3, resolve as resolve6, sep as sep3 } from "path";
 var PROJECT_SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 var ARCH_TARGET_RE = /^projects\/([a-z0-9][a-z0-9-]*)\/architecture\/([a-z0-9][a-z0-9._-]*\.md)$/;
 function invalidFrontmatter(target, issues) {
@@ -8439,15 +8891,15 @@ function assertArchitectureTargetInsideVault(vault, target, project) {
   } catch {
     return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
   }
-  const absolutePath = resolve5(vaultReal, target);
-  const parent = dirname9(absolutePath);
+  const absolutePath = resolve6(vaultReal, target);
+  const parent = dirname10(absolutePath);
   let parentReal;
   try {
     parentReal = realpathSync3(parent);
   } catch {
     return err("VAULT_PATH_INVALID", { target, message: "target parent realpath failed" });
   }
-  const parentRelative = relative2(vaultReal, parentReal).split(sep2).join("/");
+  const parentRelative = relative3(vaultReal, parentReal).split(sep3).join("/");
   if (parentRelative === ".." || parentRelative.startsWith("../")) {
     return err("VAULT_PATH_INVALID", { target, message: "target parent escapes vault" });
   }
@@ -8561,7 +9013,7 @@ function validateLogNote(logNote) {
 async function prepareProjectPagePublication(input) {
   let content;
   try {
-    content = await readFile17(input.draftPath, "utf8");
+    content = await readFile18(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -8576,7 +9028,7 @@ async function prepareProjectPagePublication(input) {
   }
   const target = assertArchitectureTargetInsideVault(input.vault, input.target, input.project);
   if (!target.ok) return target;
-  if (resolve6(input.draftPath) === target.data.absolutePath || target.data.existingRealPath !== void 0 && draftRealPath === target.data.existingRealPath) {
+  if (resolve7(input.draftPath) === target.data.absolutePath || target.data.existingRealPath !== void 0 && draftRealPath === target.data.existingRealPath) {
     return err("VAULT_PATH_INVALID", { message: "draft must not alias the final target" });
   }
   const isNew = target.data.existingRealPath === void 0;
@@ -8694,9 +9146,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
   async updateIndicesLocked(prepared, vault, state, observe) {
     const rendered = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
     if (!rendered.ok) return rendered;
-    const knowledgePath = join33(vault, rendered.data.index_path);
+    const knowledgePath = join34(vault, rendered.data.index_path);
     try {
-      await mkdir11(dirname10(knowledgePath), { recursive: true });
+      await mkdir12(dirname11(knowledgePath), { recursive: true });
     } catch (error) {
       return err("WRITE_FAILED", { message: String(error) });
     }
@@ -8705,7 +9157,7 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     state.projectIndexUpdated = knowledgeWrite.data.changed;
     if (state.projectIndexUpdated) state.changed.add(rendered.data.index_path);
     try {
-      const visibleIndex = await readFile17(knowledgePath, "utf8");
+      const visibleIndex = await readFile18(knowledgePath, "utf8");
       if (visibleIndex !== rendered.data.text) {
         return err("WRITE_FAILED", { message: "project knowledge.md verification failed" });
       }
@@ -8725,9 +9177,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     }
     let projectIndexChanged = true;
     if (projectIndex.ok) {
-      const indexPath = join33(vault, projectIndex.data.index_path);
+      const indexPath = join34(vault, projectIndex.data.index_path);
       try {
-        const existing = await readFile17(indexPath, "utf8");
+        const existing = await readFile18(indexPath, "utf8");
         projectIndexChanged = existing !== projectIndex.data.text || pageChanged;
       } catch {
         projectIndexChanged = true;
@@ -8887,7 +9339,7 @@ import { existsSync as existsSync11, writeFileSync as writeFileSync6, mkdirSync
 import { createHash as createHash6 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
-import { join as join34, resolve as resolvePath } from "path";
+import { join as join35, resolve as resolvePath } from "path";
 var MAINTENANCE_SCHEMA_VERSION = 1;
 var MAINTENANCE_COMMAND = "snapshot-maintenance journal clear-stale";
 var REPAIR_COMMAND = "snapshot-maintenance projection-conflict repair";
@@ -8952,7 +9404,7 @@ async function runSnapshotMaintenanceDryRun(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -9032,14 +9484,14 @@ async function resolveLiveVault(input) {
   return resolved.ok ? canonicalize(resolved.data.path) : void 0;
 }
 function snapshotMaintenanceAuditLogPath(home) {
-  const stateDir = platform2() === "darwin" ? join34(home, "Library", "Application Support", "vault-sync") : join34(home, ".local", "state", "vault-sync");
-  return join34(stateDir, "snapshot-maintenance-audit.jsonl");
+  const stateDir = platform2() === "darwin" ? join35(home, "Library", "Application Support", "vault-sync") : join35(home, ".local", "state", "vault-sync");
+  return join35(stateDir, "snapshot-maintenance-audit.jsonl");
 }
 function defaultAuditSink(home) {
   return (event) => {
     try {
       const logPath = snapshotMaintenanceAuditLogPath(home);
-      mkdirSync4(join34(logPath, ".."), { recursive: true });
+      mkdirSync4(join35(logPath, ".."), { recursive: true });
       appendFileSync(logPath, JSON.stringify(event) + "\n", { encoding: "utf8" });
     } catch {
     }
@@ -9187,9 +9639,9 @@ function nonMergeSequencerActive(repo) {
   const gitDir = git(repo, ["rev-parse", "--absolute-git-dir"]);
   if (!gitDir) return false;
   for (const m of ["CHERRY_PICK_HEAD", "REVERT_HEAD"]) {
-    if (existsSync11(join34(gitDir, m))) return true;
+    if (existsSync11(join35(gitDir, m))) return true;
   }
-  return existsSync11(join34(gitDir, "rebase-merge")) || existsSync11(join34(gitDir, "rebase-apply"));
+  return existsSync11(join35(gitDir, "rebase-merge")) || existsSync11(join35(gitDir, "rebase-apply"));
 }
 function extraUnmergedPaths(unmerged) {
   const allow = new Set(PROJECTION_CONFLICT_ALLOWLIST);
@@ -9228,7 +9680,7 @@ async function authorizeRepairContext(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -9329,8 +9781,8 @@ async function performProjectionRepair(input, plan, audit, now) {
     return { exitCode: ExitCode.WRITE_FAILED, result: rendered };
   }
   try {
-    writeFileSync6(join34(plan.snapshot_worktree, "index.md"), rendered.data.index);
-    writeFileSync6(join34(plan.snapshot_worktree, "log.md"), rendered.data.log);
+    writeFileSync6(join35(plan.snapshot_worktree, "index.md"), rendered.data.index);
+    writeFileSync6(join35(plan.snapshot_worktree, "log.md"), rendered.data.log);
     gitStrict(plan.snapshot_worktree, ["add", "--", "index.md", "log.md"]);
     gitStrict(plan.snapshot_worktree, [
       "commit",
@@ -9438,7 +9890,7 @@ function releaseSnapshotFlock(handle) {
 
 // src/commands/backup.ts
 import { statSync as statSync3, readdirSync as readdirSync2, readFileSync as readFileSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join35, relative as relative3, dirname as dirname11 } from "path";
+import { join as join36, relative as relative4, dirname as dirname12 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -9462,11 +9914,11 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join35(dir, entry.name);
+    const full = join36(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
-      yield relative3(base, full).replace(/\\/g, "/");
+      yield relative4(base, full).replace(/\\/g, "/");
     }
   }
 }
@@ -9485,7 +9937,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join35(input.vault, relPath);
+    const absPath = join36(input.vault, relPath);
     const localStat = statSync3(absPath);
     let needsUpload = true;
     try {
@@ -9561,7 +10013,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join35(target, obj.Key);
+      const localPath = join36(target, obj.Key);
       try {
         const localStat = statSync3(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -9574,7 +10026,7 @@ async function runBackupRestore(input) {
         const resp = await client.send(new GetObjectCommand({ Bucket: input.bucket, Key: obj.Key }));
         const body = await resp.Body?.transformToByteArray();
         if (body) {
-          mkdirSync5(dirname11(localPath), { recursive: true });
+          mkdirSync5(dirname12(localPath), { recursive: true });
           writeFileSync7(localPath, Buffer.from(body));
           downloaded++;
         }
@@ -9608,8 +10060,8 @@ async function runBackupRestore(input) {
 
 // src/commands/status.ts
 import { existsSync as existsSync12, statSync as statSync4 } from "fs";
-import { readFile as readFile18 } from "fs/promises";
-import { join as join36 } from "path";
+import { readFile as readFile19 } from "fs/promises";
+import { join as join37 } from "path";
 var FUSE_NO_MIRROR_NOTE = "FUSE vault with no read mirror - status scan may be slow";
 async function runStatus(input) {
   if (!existsSync12(input.vault)) {
@@ -9648,7 +10100,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile18(join36(scanRoot, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile19(join37(scanRoot, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -9716,25 +10168,25 @@ async function runStatus(input) {
 
 // src/commands/copy-status.ts
 import { existsSync as existsSync13, realpathSync as realpathSync5 } from "fs";
-import { isAbsolute as isAbsolute2, join as join38, relative as relative5, resolve as resolve8 } from "path";
+import { isAbsolute as isAbsolute2, join as join39, relative as relative6, resolve as resolve9 } from "path";
 
 // src/utils/fetch-projection.ts
-import { isAbsolute, join as join37, resolve as resolve7 } from "path";
+import { isAbsolute, join as join38, resolve as resolve8 } from "path";
 function inspectConfiguredFetchProjection(home) {
   if (!home) return { configured: false };
-  const config = readSkillWikiConfig(join37(home, ".skillwiki", ".env"));
+  const config = readSkillWikiConfig(join38(home, ".skillwiki", ".env"));
   const configured = config["vault_sync.fetch_projection"];
   if (!configured || configured === "none") return { configured: false };
   if (!isAbsolute(configured)) {
     return { configured: true, invalidDetail: "configured fetch projection path must be absolute" };
   }
-  return { configured: true, path: resolve7(configured) };
+  return { configured: true, path: resolve8(configured) };
 }
 
 // src/utils/live-drift.ts
 import { createHash as createHash7 } from "crypto";
-import { readFile as readFile19 } from "fs/promises";
-import { relative as relative4, sep as sep3 } from "path";
+import { readFile as readFile20 } from "fs/promises";
+import { relative as relative5, sep as sep4 } from "path";
 
 // src/utils/git-promotion.ts
 function normalizedRelativePath(path) {
@@ -9775,10 +10227,10 @@ async function measureAuthoritativeLiveDrift(liveVault, projection) {
   let content = 0;
   const livePromotable = /* @__PURE__ */ new Set();
   for (const page of scan.data.allMarkdown) {
-    const rel = relative4(liveVault, page.absPath).split(sep3).join("/");
+    const rel = relative5(liveVault, page.absPath).split(sep4).join("/");
     if (!isGitPromotablePath(rel)) continue;
     livePromotable.add(rel);
-    const bytes = await readFile19(page.absPath);
+    const bytes = await readFile20(page.absPath);
     if (projectionBlobs.get(rel) !== gitBlobOid(bytes)) content += 1;
   }
   for (const rel of projectionBlobs.keys()) {
@@ -9953,11 +10405,11 @@ function comparablePath(path) {
   try {
     return realpathSync5(path);
   } catch {
-    return resolve8(path);
+    return resolve9(path);
   }
 }
 function pathsAreNested(left, right) {
-  const rel = relative5(comparablePath(left), comparablePath(right));
+  const rel = relative6(comparablePath(left), comparablePath(right));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function defaultCopyStatusDeps(input) {
@@ -9973,7 +10425,7 @@ function defaultCopyStatusDeps(input) {
   const projectionWarning = selection.configured ? `configured fetch projection ignored for Git status; using live vault${projectionProblem ? ` (${projectionProblem})` : ""}` : void 0;
   const invalidProjectionDetail = projectionProblem ?? "configured fetch projection is not a git repository";
   const gitRootProblem = () => {
-    if (!existsSync13(join38(gitVault, ".git"))) {
+    if (!existsSync13(join39(gitVault, ".git"))) {
       return "vault is not a git repository";
     }
     return void 0;
@@ -10053,7 +10505,7 @@ function defaultCopyStatusDeps(input) {
           detail: projectionProblem ?? "live drift requires a configured fetch projection"
         };
       }
-      if (!existsSync13(join38(configuredProjection, ".git"))) {
+      if (!existsSync13(join39(configuredProjection, ".git"))) {
         return {
           unknown: true,
           reason_code: "fetch_projection_invalid",
@@ -10073,8 +10525,8 @@ async function runCopyStatusCommand(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir12, writeFile as writeFile7, stat as stat5 } from "fs/promises";
-import { join as join39 } from "path";
+import { mkdir as mkdir13, writeFile as writeFile7, stat as stat5 } from "fs/promises";
+import { join as join40 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -10143,29 +10595,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat5(join39(input.vault, "SCHEMA.md"));
+    await stat5(join40(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join39(input.vault, relPath);
+    const absPath = join40(input.vault, relPath);
     try {
       await stat5(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir12(join39(absPath, ".."), { recursive: true });
+      await mkdir13(join40(absPath, ".."), { recursive: true });
       await writeFile7(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join39(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join40(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat5(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir12(join39(rawPath, ".."), { recursive: true });
+    await mkdir13(join40(rawPath, ".."), { recursive: true });
     await writeFile7(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -10188,9 +10640,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile20, writeFile as writeFile8 } from "fs/promises";
+import { readFile as readFile21, writeFile as writeFile8 } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -10268,7 +10720,7 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join40(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join41(input.vault, ".skillwiki", "graph.json");
   if (!existsSync14(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -10280,7 +10732,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile20(graphPath, "utf8");
+    raw = await readFile21(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -10306,7 +10758,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join40(input.vault, "vault-graph.canvas");
+  const outPath = join41(input.vault, "vault-graph.canvas");
   try {
     await writeFile8(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -10451,11 +10903,11 @@ async function runSourceDisposition(input) {
 
 // src/utils/source-disposal.ts
 import { createHash as createHash8 } from "crypto";
-import { readFile as readFile22, unlink as unlink5 } from "fs/promises";
+import { readFile as readFile23, unlink as unlink5 } from "fs/promises";
 
 // src/utils/raw-asset-reference-index.ts
-import { readdir as readdir6, readFile as readFile21 } from "fs/promises";
-import { join as join41, relative as relative6, sep as sep4 } from "path";
+import { readdir as readdir6, readFile as readFile22 } from "fs/promises";
+import { join as join42, relative as relative7, sep as sep5 } from "path";
 var PREVIEW_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "avif", "pdf", "mp3", "wav", "m4a", "mp4", "webm"]);
 async function walkFiles(root, dir = root) {
   let entries;
@@ -10466,9 +10918,9 @@ async function walkFiles(root, dir = root) {
   }
   const out = [];
   for (const entry of entries) {
-    const path = join41(dir, entry.name);
+    const path = join42(dir, entry.name);
     if (entry.isDirectory()) out.push(...await walkFiles(root, path));
-    else if (entry.isFile()) out.push(relative6(root, path).split(sep4).join("/"));
+    else if (entry.isFile()) out.push(relative7(root, path).split(sep5).join("/"));
   }
   return out;
 }
@@ -10482,7 +10934,7 @@ function addInbound(map, target, source) {
   map.set(target, refs);
 }
 async function buildRawAssetReferenceIndex(vault) {
-  const assetRoot = join41(vault, "raw", "assets");
+  const assetRoot = join42(vault, "raw", "assets");
   const relativeAssets = await walkFiles(assetRoot);
   const assets = relativeAssets.map((path) => `raw/assets/${path}`).sort((a, b) => a.localeCompare(b));
   const assetSet = new Set(assets);
@@ -10498,7 +10950,7 @@ async function buildRawAssetReferenceIndex(vault) {
   for (const page of scan.data.allMarkdown) {
     let text;
     try {
-      text = await readFile21(page.absPath, "utf8");
+      text = await readFile22(page.absPath, "utf8");
     } catch {
       continue;
     }
@@ -10558,7 +11010,7 @@ async function planSourceDisposal(input) {
   if (sensitive.length > 0) return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
   const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
   if (!target.ok) return err("RAW_DISPOSAL_TARGET_INVALID", { path: input.rawPath, cause: target });
-  const bytes = await readFile22(target.data);
+  const bytes = await readFile23(target.data);
   const size = bytes.byteLength;
   let typedReferences = [];
   let otherReferences = [];
@@ -10682,7 +11134,7 @@ async function runSourceDisposal(input) {
 import { existsSync as existsSync15, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -10912,7 +11364,7 @@ async function runFleetHealth(input) {
   const home = resolveSkillwikiHome(input.home, env);
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join42(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join43(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -10997,7 +11449,7 @@ async function runFleetHealth(input) {
 
 // src/utils/auto-commit.ts
 import { existsSync as existsSync16 } from "fs";
-import { isAbsolute as isAbsolute3, join as join43, normalize } from "path";
+import { isAbsolute as isAbsolute3, join as join44, normalize } from "path";
 function isValidLastOpPath(file) {
   if (!file || typeof file !== "string") return false;
   const trimmed = file.trim();
@@ -11018,7 +11470,7 @@ async function postCommit(vault, exitCode) {
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync16(join43(vault, ".git"))) return;
+  if (!existsSync16(join44(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -11066,7 +11518,7 @@ function preflight(error) {
 }
 async function runMcpAuthIssueHost(input) {
   const isTty = input.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  const readFile23 = input.readFile ?? readFileSync17;
+  const readFile24 = input.readFile ?? readFileSync17;
   const writeFile9 = input.writeFile ?? writeFileSync8;
   const stderrWrite = input.stderrWrite ?? ((s) => {
     process.stderr.write(s);
@@ -11081,7 +11533,7 @@ async function runMcpAuthIssueHost(input) {
   if (write && !isTty) return preflight("NO_TTY");
   let yamlText = "";
   try {
-    yamlText = readFile23(mapPath, "utf8");
+    yamlText = readFile24(mapPath, "utf8");
   } catch (error) {
     if (!isEnoent(error)) throw error;
   }
@@ -11199,8 +11651,8 @@ async function emit(r, vault, opts) {
     printJson(r.result);
   }
   if (vault && opts?.postCommit !== false) await postCommit(vault, r.exitCode);
-  await new Promise((resolve9, reject) => {
-    process.stdout.write("", (error) => error ? reject(error) : resolve9());
+  await new Promise((resolve10, reject) => {
+    process.stdout.write("", (error) => error ? reject(error) : resolve10());
   });
   process.exit(r.exitCode);
 }
@@ -11263,7 +11715,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-GRSHQYKC.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-2BMHZWVJ.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -11293,7 +11745,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join44(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join45(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -11637,6 +12089,15 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     { postCommit: false }
   );
 });
+pageCmd.command("render-html <page> [vault]").description("render an opted-in typed page to a self-contained HTML file").requiredOption("--out <file>", "output HTML path (must be outside the vault)").option("--wiki <name>", "wiki profile name").action(async (page, vault, opts) => {
+  const resolved = await resolveVaultArg(vault, opts.wiki);
+  if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
+  return emit(await runPageRenderHtml({
+    vault: resolved.vault,
+    page,
+    out: opts.out
+  }), resolved.vault, { postCommit: false });
+});
 var projectPageCmd = program.command("project-page").description("publish project-local architecture pages");
 projectPageCmd.command("publish <draft> [vault]").description("preview or publish a Layer-3 architecture page under projects/{slug}/architecture/").requiredOption("--project <slug>", "project slug").requiredOption("--target <path>", "vault-relative architecture target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, project knowledge index, and log", false).option("--approve <token>", "required with --write; token from a prior dry-run").option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
   const resolved = await resolveVaultArg(vault, opts.wiki);
@@ -11910,7 +12371,8 @@ program.command("doctor").description("diagnose skillwiki setup issues").option(
 var clipOutboxCmd = program.command("clip-outbox").description("dedicated file-level web-clip outbox");
 clipOutboxCmd.command("status").description("show whether the clip-outbox channel is configured").action(async () => emit(await runClipOutboxStatus(resolveSkillwikiHome())));
 clipOutboxCmd.command("watch").description("run the enabled dedicated outbox worker using macOS FSEvents").action(async () => emit(await runClipOutboxWatch(resolveSkillwikiHome())));
-clipOutboxCmd.command("install-or-migrate").description("refresh the packaged launchd plist without enabling the channel").option("--load", "attended launchd bootstrap; requires existing enabled=true", false).option("--conditional-create-proven", "attest the deployed SeaweedFS If-None-Match:* race test passed", false).action(async (opts) => emit(await runClipOutboxInstall({ home: resolveSkillwikiHome(), load: opts.load, conditionalCreateProven: opts.conditionalCreateProven })));
+clipOutboxCmd.command("mirror-watch").description("copy admitted raw/articles and raw/assets from storage into the frozen mirror using MCP SSE").action(async () => emit(await runClipOutboxMirrorWatch(resolveSkillwikiHome())));
+clipOutboxCmd.command("install-or-migrate").description("refresh the packaged launchd plist without enabling the channel").option("--load", "attended clip watcher bootstrap; requires existing enabled=true", false).option("--load-mirror", "attended inbound SSE bootstrap; requires existing enabled=true; never auto-loaded on upgrade", false).option("--conditional-create-proven", "attest the deployed SeaweedFS If-None-Match:* race test passed", false).action(async (opts) => emit(await runClipOutboxInstall({ home: resolveSkillwikiHome(), load: opts.load, loadMirror: opts.loadMirror, conditionalCreateProven: opts.conditionalCreateProven })));
 program.command("connect").description(CONNECT_DESCRIPTION).option("--from-file <path>", "chat-attached env file (not Drive / \u4E91\u76D8)").option("--from-stdin", "read env file from stdin (no echo)").option("--dry-run", "validate without writing ~/.skillwiki/.env").option("--force", "overwrite a different existing token").action(async (opts) => emit(await runConnect({
   home: resolveSkillwikiHome(),
   fromFile: opts.fromFile,
@@ -12409,7 +12871,7 @@ memoryCmd.command("import [vault]").description("preview or apply local memory i
     maxBytes: opts.maxBytes
   }), v.vault, { postCommit: false });
 });
-program.command("ingest <source>").description("ingest a source URL or local file into the vault").requiredOption("--vault <path>", "vault root directory").requiredOption("--type <type>", "typed-knowledge type (entity|concept|comparison|query)").requiredOption("--title <title>", "page title").option("--tags <csv>", "comma-separated tags").option("--provenance <provenance>", "provenance (research|project)").option("--dry-run", "preview without writing files", false).action(async (source, opts) => {
+program.command("ingest <source>").description("ingest a source URL or local file into the vault").requiredOption("--vault <path>", "vault root directory").requiredOption("--type <type>", "typed-knowledge type (entity|concept|comparison|query)").requiredOption("--title <title>", "page title").option("--tags <csv>", "comma-separated tags").option("--provenance <provenance>", "provenance (research|project)").option("--html", "stamp html_render: true on the typed stub", false).option("--dry-run", "preview without writing files", false).action(async (source, opts) => {
   const tags = typeof opts.tags === "string" ? opts.tags.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : [];
   if (opts.dryRun) {
     emit(await runIngest({
@@ -12419,6 +12881,7 @@ program.command("ingest <source>").description("ingest a source URL or local fil
       title: opts.title,
       tags,
       provenance: opts.provenance,
+      html: !!opts.html,
       dryRun: true
     }), opts.vault);
     return;
@@ -12433,6 +12896,7 @@ program.command("ingest <source>").description("ingest a source URL or local fil
       title: opts.title,
       tags,
       provenance: opts.provenance,
+      html: !!opts.html,
       dryRun: false
     })
   );