skillwiki 0.10.26 → 0.10.28

package/dist/{index-projection-FRWTZB5Y.js → index-projection-64WW36N3.js}

@@ -4,9 +4,9 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-QBZYEEBD.js";
-import "./chunk-6ZDKTNLA.js";
-import "./chunk-C2DKFJFA.js";
+} from "./chunk-OJVIND5D.js";
+import "./chunk-UI4SOWI2.js";
+import "./chunk-RQARJ6HB.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{managed-write-preflight-4LPVMP42.js → managed-write-preflight-2FU5F56H.js}

@@ -2,9 +2,11 @@
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-BASWDOQB.js";
-import "./chunk-PQG26AGJ.js";
-import "./chunk-C2DKFJFA.js";
+} from "./chunk-NOXDRIHM.js";
+import "./chunk-5XQWYC5K.js";
+import "./chunk-UI4SOWI2.js";
+import "./chunk-SGZPIGGX.js";
+import "./chunk-RQARJ6HB.js";
 export {
   runManagedWritePreflight,
   runManagedWriteTransaction

package/dist/skillwiki-mcp.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-VXMHHXVP.js";
+} from "./chunk-W7NPTDIU.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-QBZYEEBD.js";
-import "./chunk-PQG26AGJ.js";
-import "./chunk-QNTBNNEL.js";
-import "./chunk-6ZDKTNLA.js";
-import "./chunk-C2DKFJFA.js";
+import "./chunk-OJVIND5D.js";
+import "./chunk-5XQWYC5K.js";
+import "./chunk-UI4SOWI2.js";
+import "./chunk-SGZPIGGX.js";
+import "./chunk-RQARJ6HB.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-7UC6PJEV.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-23CR4YPL.js";
+import "./chunk-SGZPIGGX.js";
+import "./chunk-RQARJ6HB.js";
+export {
+  runSourcesPending
+};

package/dist/vault-sync/scripts/lib/platform.sh

@@ -147,6 +147,270 @@ platform_job_status() {
   printf '{"enabled": %s, "running": %s, "last_exit": %d}\n' "$_enabled" "$_running" "$_last_exit"
 }
 
+# macOS LaunchAgent plist validation. Callers inspect the non-empty
+# PLATFORM_LAUNCHD_PLIST_REASON when this returns non-zero. The generated
+# vault-sync units are XML plists, but use plutil to canonicalize a valid
+# binary plist before applying the same structural checks. The validated first
+# argument is exported for installer-only executable preflight warnings.
+PLATFORM_LAUNCHD_PLIST_REASON=""
+PLATFORM_LAUNCHD_PLIST_PROGRAM=""
+
+platform_launchd_plist_validate() {
+  _platform_expected_label="${1:-}"
+  _platform_plist="${2:-}"
+  _platform_xml=""
+  _platform_fields=""
+  _platform_document_kind=""
+  _platform_label_kind=""
+  _platform_program_kind=""
+  _platform_actual_label=""
+  _platform_program=""
+  PLATFORM_LAUNCHD_PLIST_REASON=""
+  PLATFORM_LAUNCHD_PLIST_PROGRAM=""
+
+  if [ -z "$_platform_expected_label" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="expected Label is empty"
+    return 1
+  fi
+  if [ -z "$_platform_plist" ] || [ ! -f "$_platform_plist" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="plist file missing: ${_platform_plist:-unknown}"
+    return 1
+  fi
+  if [ ! -r "$_platform_plist" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="plist file is not readable: $_platform_plist"
+    return 1
+  fi
+
+  if command -v plutil >/dev/null 2>&1; then
+    if ! plutil -lint "$_platform_plist" >/dev/null 2>&1; then
+      PLATFORM_LAUNCHD_PLIST_REASON="plutil -lint failed"
+      return 1
+    fi
+    if ! _platform_xml="$(plutil -convert xml1 -o - "$_platform_plist" 2>/dev/null)"; then
+      PLATFORM_LAUNCHD_PLIST_REASON="plutil could not render plist as XML"
+      return 1
+    fi
+  else
+    # Keep status useful on non-macOS CI hosts that lack plutil. This fallback
+    # intentionally supports structural XML only; macOS uses plutil above for
+    # syntactic validation and binary-plist conversion.
+    _platform_xml="$(cat "$_platform_plist")"
+  fi
+
+  # Parse the root plist dictionary structurally rather than searching for
+  # text. In particular, a Label-like string inside ProgramArguments must not
+  # satisfy Label validation, and ProgramArguments[0] must actually be a
+  # non-empty <string>, not merely a scalar which plutil can render as raw.
+  _platform_fields="$(
+    printf '%s\n' "$_platform_xml" | awk '
+      BEGIN {
+        label_kind = "missing"
+        program_kind = "missing"
+      }
+      function trim(value) {
+        sub(/^[[:space:]]+/, "", value)
+        sub(/[[:space:]]+$/, "", value)
+        return value
+      }
+      function string_value(value) {
+        sub(/^[[:space:]]*<string>/, "", value)
+        sub(/<\/string>[[:space:]]*$/, "", value)
+        return value
+      }
+      function invalid() {
+        invalid_token = 1
+      }
+      function open_container(kind) {
+        if (!plist_seen || plist_closed) {
+          invalid()
+          return
+        }
+        if (container_depth == 0) {
+          if (kind != "dict" || root_dict_seen) {
+            invalid()
+            return
+          }
+          root_dict_seen = 1
+        }
+        container_depth++
+        container_stack[container_depth] = kind
+        if (kind == "dict") dict_depth++
+      }
+      function close_container(kind) {
+        if (container_depth == 0 || container_stack[container_depth] != kind) {
+          invalid()
+          return
+        }
+        if (kind == "dict") {
+          if (dict_depth == 1) root_dict_closed = 1
+          dict_depth--
+        }
+        delete container_stack[container_depth]
+        container_depth--
+      }
+      function process(line) {
+        line = trim(line)
+        if (line == "") return
+        if (line ~ /^<!--.*-->$/) return
+        if (line ~ /^<\?xml[[:space:]][^>]*\?>$/) {
+          if (plist_seen || xml_declaration_seen) invalid()
+          xml_declaration_seen = 1
+          return
+        }
+        if (line ~ /^<!DOCTYPE[[:space:]].*>$/) {
+          if (plist_seen || doctype_seen) invalid()
+          doctype_seen = 1
+          return
+        }
+        if (line ~ /^<plist([[:space:]][^>]*)?>$/) {
+          if (plist_seen || plist_closed || container_depth != 0 || root_dict_seen) {
+            invalid()
+          } else {
+            plist_seen = 1
+          }
+          return
+        }
+        if (line == "</plist>") {
+          if (!plist_seen || plist_closed || !root_dict_closed || container_depth != 0) {
+            invalid()
+          } else {
+            plist_closed = 1
+          }
+          return
+        }
+
+        if (label_wait) {
+          if (line ~ /^<string>[^<]*<\/string>$/) {
+            label_value = string_value(line)
+            label_kind = "string"
+            label_wait = 0
+            return
+          }
+          label_kind = "not-string"
+          label_wait = 0
+        }
+
+        if (program_wait_array) {
+          if (line == "<array>") {
+            program_wait_array = 0
+            program_wait_first = 1
+            open_container("array")
+            return
+          }
+          program_kind = "not-array"
+          program_wait_array = 0
+        }
+
+        if (program_wait_first) {
+          if (line ~ /^<string>[^<]*<\/string>$/) {
+            program_value = string_value(line)
+            program_kind = (program_value == "" ? "empty" : "string")
+            program_wait_first = 0
+            return
+          }
+          program_kind = (line == "</array>" ? "missing" : "not-string")
+          program_wait_first = 0
+        }
+
+        if (line == "<dict>") {
+          open_container("dict")
+          return
+        }
+        if (line == "</dict>") {
+          close_container("dict")
+          return
+        }
+        if (line == "<array>") {
+          open_container("array")
+          return
+        }
+        if (line == "</array>") {
+          close_container("array")
+          return
+        }
+        if (line ~ /^<key>Label<\/key>$/ && dict_depth == 1 && container_depth == 1 && label_kind == "missing") {
+          label_wait = 1
+          return
+        }
+        if (line ~ /^<key>ProgramArguments<\/key>$/ && dict_depth == 1 && container_depth == 1 && program_kind == "missing") {
+          program_wait_array = 1
+          return
+        }
+        if (line ~ /^<key>[^<]*<\/key>$/ ||
+            line ~ /^<string>[^<]*<\/string>$/ ||
+            line ~ /^<integer>[^<]*<\/integer>$/ ||
+            line ~ /^<real>[^<]*<\/real>$/ ||
+            line ~ /^<date>[^<]*<\/date>$/ ||
+            line ~ /^<data>[^<]*<\/data>$/ ||
+            line == "<true/>" || line == "<false/>") {
+          if (!plist_seen || plist_closed || container_depth == 0) invalid()
+          return
+        }
+        invalid()
+      }
+      {
+        content = $0
+        gsub(/></, ">\n<", content)
+        count = split(content, chunks, "\n")
+        for (chunk_index = 1; chunk_index <= count; chunk_index++) process(chunks[chunk_index])
+      }
+      END {
+        if (label_wait && label_kind == "missing") label_kind = "not-string"
+        if (program_wait_array) program_kind = "not-array"
+        if (program_wait_first) program_kind = "missing"
+        document_kind = (plist_seen && plist_closed && root_dict_seen && root_dict_closed &&
+                         dict_depth == 0 && container_depth == 0 && !invalid_token ? "valid" : "invalid")
+        printf "DOCUMENT_KIND=%s\n", document_kind
+        printf "LABEL_KIND=%s\n", label_kind
+        printf "LABEL_VALUE=%s\n", label_value
+        printf "PROGRAM_KIND=%s\n", program_kind
+        printf "PROGRAM_VALUE=%s\n", program_value
+      }
+    '
+  )"
+  _platform_document_kind="$(printf '%s\n' "$_platform_fields" | awk 'sub(/^DOCUMENT_KIND=/, "") { print; exit }')"
+  _platform_label_kind="$(printf '%s\n' "$_platform_fields" | awk 'sub(/^LABEL_KIND=/, "") { print; exit }')"
+  _platform_actual_label="$(printf '%s\n' "$_platform_fields" | awk 'sub(/^LABEL_VALUE=/, "") { print; exit }')"
+  _platform_program_kind="$(printf '%s\n' "$_platform_fields" | awk 'sub(/^PROGRAM_KIND=/, "") { print; exit }')"
+  _platform_program="$(printf '%s\n' "$_platform_fields" | awk 'sub(/^PROGRAM_VALUE=/, "") { print; exit }')"
+
+  if [ "$_platform_document_kind" != "valid" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="plist XML structure is invalid"
+    return 1
+  fi
+  if [ "$_platform_label_kind" != "string" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="Label missing or is not a string"
+    return 1
+  fi
+
+  if [ "$_platform_actual_label" != "$_platform_expected_label" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="Label is '${_platform_actual_label:-missing}', expected '$_platform_expected_label'"
+    return 1
+  fi
+  case "$_platform_program_kind" in
+    missing)
+      PLATFORM_LAUNCHD_PLIST_REASON="ProgramArguments[0] missing"
+      return 1
+      ;;
+    empty)
+      PLATFORM_LAUNCHD_PLIST_REASON="ProgramArguments[0] is empty"
+      return 1
+      ;;
+    string)
+      ;;
+    *)
+      PLATFORM_LAUNCHD_PLIST_REASON="ProgramArguments[0] must be a string"
+      return 1
+      ;;
+  esac
+  if [ -z "$_platform_program" ]; then
+    PLATFORM_LAUNCHD_PLIST_REASON="ProgramArguments[0] missing"
+    return 1
+  fi
+  PLATFORM_LAUNCHD_PLIST_PROGRAM="$_platform_program"
+  return 0
+}
+
 # Feature prerequisite check:
 # exit 1 with message if not available
 platform_require() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.26",
+  "version": "0.10.28",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.26",
+  "version": "0.10.28",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 19 prompt-only skills (wiki-*, proj-*, using-skillwiki) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.26",
+  "version": "0.10.28",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 19 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.26",
+  "version": "0.10.28",
   "private": true,
   "files": [
     "wiki-*",

package/dist/chunk-6ZDKTNLA.js

@@ -1,294 +0,0 @@
-#!/usr/bin/env node
-import {
-  err,
-  getErrorMessage,
-  ok
-} from "./chunk-C2DKFJFA.js";
-
-// src/parsers/frontmatter.ts
-import yaml from "js-yaml";
-var FM_OPEN = /^---\r?\n/;
-function splitFrontmatter(text) {
-  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
-  const afterOpen = text.replace(FM_OPEN, "");
-  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
-  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
-  const rawFrontmatter = afterOpen.slice(0, closeIdx);
-  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
-  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
-  const body = text.slice(bodyStart);
-  return ok({ rawFrontmatter, body, bodyStart });
-}
-function extractFrontmatter(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return split;
-  if (!split.data.rawFrontmatter) return ok({});
-  try {
-    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
-    return ok(parsed);
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
-  }
-}
-
-// src/utils/sensitive-content.ts
-import { createHash } from "crypto";
-var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
-var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
-var MATCHERS = [
-  {
-    kind: "private_key",
-    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
-  },
-  {
-    kind: "authorization_header",
-    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "cookie",
-    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "jwt",
-    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "provider_key",
-    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "api_key",
-    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "password",
-    re: /\b(?:pass(?:word|wd)?)["']?\s*[:=]\s*["']?([^\s`"']{8,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "secret",
-    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "token",
-    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  }
-];
-function fingerprint(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function lineFor(text, offset) {
-  return text.slice(0, offset).split(/\r?\n/).length;
-}
-function redactMarker(kind, value) {
-  return `[REDACTED:${kind}:${fingerprint(value)}]`;
-}
-function isSyntheticPlaceholder(value) {
-  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
-}
-function isNonSecretTokenCapture(value) {
-  if (value.startsWith("//")) return true;
-  if (/^[a-z]{2,}(?:-[a-z]{2,})+$/.test(value)) return true;
-  return false;
-}
-function collectMatches(text) {
-  const matches = [];
-  for (const matcher of MATCHERS) {
-    matcher.re.lastIndex = 0;
-    for (const m of text.matchAll(matcher.re)) {
-      const whole = m[0];
-      const start = m.index ?? 0;
-      if (REDACTED_RE.test(whole)) continue;
-      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
-      if (isSyntheticPlaceholder(value)) continue;
-      if (matcher.kind === "token" && isNonSecretTokenCapture(value)) continue;
-      const valueOffset = whole.lastIndexOf(value);
-      const valueStart = start + Math.max(0, valueOffset);
-      matches.push({
-        start,
-        end: start + whole.length,
-        valueStart,
-        valueEnd: valueStart + value.length,
-        kind: matcher.kind
-      });
-    }
-  }
-  return matches.sort((a, b) => {
-    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
-    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
-  });
-}
-function collapseOverlaps(matches) {
-  const kept = [];
-  for (const match of matches) {
-    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
-    if (!overlaps) kept.push(match);
-  }
-  return kept;
-}
-function scanSensitiveContent(text, opts = {}) {
-  return collapseOverlaps(collectMatches(text)).map((match) => {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    const marker = redactMarker(match.kind, value);
-    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
-    const preview = rawPreview.replace(value, marker);
-    return {
-      file: opts.file,
-      line: lineFor(text, match.valueStart),
-      kind: match.kind,
-      preview,
-      fingerprint: fingerprint(value)
-    };
-  });
-}
-function redactSensitiveContent(text, opts = {}) {
-  const matches = collapseOverlaps(collectMatches(text));
-  if (matches.length === 0) return { text, changed: false, findings: [] };
-  let out = "";
-  let cursor = 0;
-  for (const match of matches) {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    out += text.slice(cursor, match.valueStart);
-    out += redactMarker(match.kind, value);
-    cursor = match.valueEnd;
-  }
-  out += text.slice(cursor);
-  return {
-    text: out,
-    changed: out !== text,
-    findings: scanSensitiveContent(text, opts)
-  };
-}
-
-// src/utils/vault.ts
-import { existsSync, readFileSync } from "fs";
-import { readFile, readdir, stat } from "fs/promises";
-import { join, relative, sep } from "path";
-var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var DEFAULT_IO_CONCURRENCY = 1;
-function vaultIoConcurrency() {
-  const raw = Number.parseInt(process.env.SKILLWIKI_VAULT_IO_CONCURRENCY ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, 64) : DEFAULT_IO_CONCURRENCY;
-}
-function decodeProcMountPath(value) {
-  return value.replace(/\\040/g, " ");
-}
-function isRcloneFuseVaultFromMounts(root, mounts) {
-  return mounts.split(/\r?\n/).some((line) => {
-    const parts = line.split(" ");
-    if (parts.length < 3) return false;
-    const mountPoint = decodeProcMountPath(parts[1]);
-    const fsType = parts[2];
-    return fsType === "fuse.rclone" && (root === mountPoint || root.startsWith(`${mountPoint}/`));
-  });
-}
-function resolveReadOnlyVaultRootWithMounts(root, mounts) {
-  if (/^(1|true|yes)$/i.test(process.env.SKILLWIKI_DISABLE_VAULT_READ_MIRROR ?? "")) {
-    return { root, mirrored: false };
-  }
-  const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
-  if (explicitMirror && existsSync(join(explicitMirror, "SCHEMA.md"))) {
-    return { root: explicitMirror, mirrored: explicitMirror !== root };
-  }
-  const siblingMirror = `${root}-git`;
-  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync(join(siblingMirror, "SCHEMA.md"))) {
-    return { root: siblingMirror, mirrored: true };
-  }
-  return { root, mirrored: false };
-}
-function resolveReadOnlyVaultRoot(root) {
-  let mounts = "";
-  try {
-    mounts = readFileSync("/proc/mounts", "utf8");
-  } catch {
-  }
-  return resolveReadOnlyVaultRootWithMounts(root, mounts);
-}
-async function mapWithConcurrency(items, limit, mapper) {
-  const out = new Array(items.length);
-  let next = 0;
-  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
-    for (; ; ) {
-      const index = next++;
-      if (index >= items.length) return;
-      out[index] = await mapper(items[index], index);
-    }
-  });
-  await Promise.all(workers);
-  return out;
-}
-async function scanVault(root) {
-  try {
-    await stat(join(root, "SCHEMA.md"));
-  } catch {
-    return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
-  }
-  const all = await walk(root);
-  const rels = all.map((p) => ({ absPath: p, relPath: relative(root, p).split(sep).join("/") }));
-  return ok({
-    root,
-    allMarkdown: rels,
-    typedKnowledge: rels.filter((p) => TYPED_DIRS.some((d) => p.relPath.startsWith(d + "/"))),
-    raw: rels.filter((p) => p.relPath.startsWith("raw/")),
-    workItems: rels.filter((p) => /^projects\/[^/]+\/work\/[^/]+\/(spec|plan|log)\.md$/.test(p.relPath)),
-    compound: rels.filter((p) => /^projects\/[^/]+\/compound\//.test(p.relPath))
-  });
-}
-async function walk(dir) {
-  const entries = await readdir(dir, { withFileTypes: true });
-  const out = [];
-  const subdirs = [];
-  for (const e of entries) {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) {
-      if (SKIP_DIRS.has(e.name)) continue;
-      subdirs.push(p);
-    } else if (e.isFile() && e.name.endsWith(".md")) out.push(p);
-  }
-  const nested = await mapWithConcurrency(subdirs, Math.min(8, vaultIoConcurrency()), walk);
-  for (const files of nested) out.push(...files);
-  return out;
-}
-async function readPage(p) {
-  return readFile(p.absPath, "utf8");
-}
-async function readPageCached(p, cache) {
-  if (!cache) return readPage(p);
-  const existing = cache.get(p.absPath);
-  if (existing) return existing;
-  const pending = readPage(p);
-  cache.set(p.absPath, pending);
-  return pending;
-}
-
-export {
-  splitFrontmatter,
-  extractFrontmatter,
-  scanSensitiveContent,
-  redactSensitiveContent,
-  vaultIoConcurrency,
-  resolveReadOnlyVaultRoot,
-  mapWithConcurrency,
-  scanVault,
-  readPage,
-  readPageCached
-};