skillwiki 0.10.98 → 0.10.102

package/dist/cli.js

@@ -3,8 +3,12 @@ import {
   CAPTURE_HYGIENE_CONTRACT,
   DEFAULT_CAPTURE_BUDGET,
   DEFAULT_DIRTY_VOLUME_THRESHOLD,
+  DEFAULT_MCP_URL,
   DEFAULT_NO_DECISION_STREAK,
   GateError,
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
   PUSH_NOT_IN_PROFILE,
   SATELLITE_STALE_MS,
   buildVectorIndex,
@@ -19,10 +23,13 @@ import {
   isFailedRunStatus,
   measureDirtyVolume,
   memoryAuthorityTiersRank,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
   pruneVectorIndex,
   readCliPackageJson,
   readSatelliteLatestRunFromText,
   readVaultSyncConfig,
+  redactMcpSecret,
   reindexPageInVectorIndex,
   renderIndexUpsert,
   renderProjectIndex,
@@ -55,7 +62,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-EEO2YDPX.js";
+} from "./chunk-PIXBNB74.js";
 import {
   normalizeDistTag,
   readCache,
@@ -160,7 +167,7 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-MRYWP5HY.js";
+} from "./chunk-7UK67FAZ.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
@@ -214,7 +221,7 @@ import {
 } from "./chunk-QM64LUEY.js";
 
 // src/cli.ts
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -3576,13 +3583,334 @@ async function runHealth(input) {
   return { exitCode, result: ok(report) };
 }
 
+// src/commands/connect.ts
+import { chmod, mkdir as mkdir5, readFile as readFile6, stat as stat3 } from "fs/promises";
+import { join as join18 } from "path";
+
+// src/utils/mcp-token-map.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+import yaml from "js-yaml";
+var HOST_ID_RE = /^[a-z][a-z0-9-]{1,62}$/;
+function writerIdFromValue(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const rec = value;
+    if (typeof rec.writer_id === "string" && rec.writer_id.length > 0) return rec.writer_id;
+    if (typeof rec.host_id === "string" && rec.host_id.length > 0) return rec.host_id;
+  }
+  return void 0;
+}
+function parseAllowedVaultIds(raw) {
+  if (!raw || raw.length === 0) return { vaults: [] };
+  const vaults = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    const id = item.trim();
+    if (!id) continue;
+    if (id.includes("*") || id.includes("/") || !HOST_ID_RE.test(id)) {
+      return { error: "INVALID_ALLOWED_VAULTS" };
+    }
+    if (seen.has(id)) continue;
+    seen.add(id);
+    vaults.push(id);
+  }
+  return { vaults };
+}
+function parseMcpTokenMap(yamlText) {
+  const parsed = yaml.load(yamlText);
+  const map = /* @__PURE__ */ new Map();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return map;
+  }
+  const records = parsed;
+  const nested = records.tokens;
+  const source = nested && typeof nested === "object" && !Array.isArray(nested) ? nested : records;
+  for (const [hash, value] of Object.entries(source)) {
+    if (hash === "tokens") continue;
+    const writerId = writerIdFromValue(value);
+    if (!writerId) continue;
+    const normalized = hash.trim().toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(normalized)) continue;
+    map.set(normalized, writerId);
+  }
+  return map;
+}
+function generateHostBearer(rng) {
+  const bytes = (rng ?? (() => randomBytes(32)))();
+  const raw = bytes.toString("base64url");
+  const hashHex = createHash2("sha256").update(raw, "utf8").digest("hex");
+  return { raw, hashHex };
+}
+function formatHostRow(hashHex, hostId, allowedVaults) {
+  if (allowedVaults.length === 0) {
+    return `${hashHex}: ${hostId}
+`;
+  }
+  return `${hashHex}:
+  writer_id: ${hostId}
+  allowed_vaults: [${allowedVaults.join(", ")}]
+`;
+}
+function appendHostHash(yamlText, hashHex, hostId, allowedVaults) {
+  if (!HOST_ID_RE.test(hostId)) {
+    return { error: "INVALID_HOST_ID" };
+  }
+  const granted = parseAllowedVaultIds(allowedVaults);
+  if ("error" in granted) return granted;
+  const map = parseMcpTokenMap(yamlText);
+  const normalizedHash = hashHex.trim().toLowerCase();
+  if ([...map.values()].includes(hostId)) {
+    return { error: "DUPLICATE_HOST_ID" };
+  }
+  if (map.has(normalizedHash)) {
+    return { error: "DUPLICATE_HASH" };
+  }
+  return { yaml: yamlText.replace(/\s*$/, "") + `
+${formatHostRow(normalizedHash, hostId, granted.vaults)}` };
+}
+
+// src/commands/connect.ts
+var CONNECT_DESCRIPTION = "HTTP MCP leaf connect: ingest a chat-attached env file into ~/.skillwiki/.env (mode 0600). Never runs skillwiki init. Cloud Drive / \u4E91\u76D8 is unsupported.";
+var RESERVED_HOST_IDS = ["msi", "doubao-linux-agent", "macos-dev"];
+var DEST_MODE = 384;
+function isUnsupportedSecretPath(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:Google Drive|OneDrive|iCloud Drive|CloudStorage|云盘|百度网盘|坚果云|Dropbox)(?:\/|$)/i.test(normalized) || /clouddrive|cloud-disk/i.test(normalized);
+}
+function fail(code, error, detail) {
+  return { exitCode: code, result: err(error, detail) };
+}
+async function defaultReadStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function looksLikeVaultInit(text) {
+  return /^#\s*Vault Schema/im.test(text) || /^\s*---\s*$/m.test(text) && /taxonomy:/i.test(text);
+}
+function tokenPresence(token) {
+  return token ? "TOKEN_SET" : "EMPTY";
+}
+function summaryHint(data) {
+  return [
+    data.token,
+    `auth=${data.auth}`,
+    `writer_id=${data.writer_id ?? "n/a"}`,
+    `ok=${data.ok ?? "n/a"}`,
+    `reconcile_ready=${data.reconcile_ready ?? "n/a"}`,
+    data.dry_run ? "dry-run" : data.written ? "wrote ~/.skillwiki/.env 0600" : "not written"
+  ].join(" ");
+}
+function redactConnectPayload(data, secret) {
+  return {
+    ...data,
+    handshake: data.handshake ? redactMcpSecret(data.handshake, secret) : data.handshake,
+    humanHint: redactMcpSecret(data.humanHint, secret)
+  };
+}
+async function readWikiStatus(fetchFn, url, token) {
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  try {
+    const initRes = await fetchFn(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-11-25",
+          capabilities: {},
+          clientInfo: { name: "skillwiki-connect", version: "0" }
+        }
+      })
+    });
+    const session = initRes.headers.get("mcp-session-id");
+    if (session) headers["mcp-session-id"] = session;
+    const statusRes = await fetchFn(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 2,
+        method: "tools/call",
+        params: { name: "wiki_status", arguments: {} }
+      })
+    });
+    const raw = await statusRes.text();
+    const parsed = JSON.parse(raw.startsWith("data:") ? raw.replace(/^data:\s*/m, "") : raw);
+    const structured = parsed.result?.structuredContent;
+    let body = structured;
+    if (!body) {
+      const text = parsed.result?.content?.find((c) => typeof c.text === "string")?.text;
+      if (text) {
+        try {
+          body = JSON.parse(text);
+        } catch {
+          body = void 0;
+        }
+      }
+    }
+    if (!body) return { writer_id: null, ok: null, reconcile_ready: null };
+    return {
+      writer_id: typeof body.writer_id === "string" ? body.writer_id : null,
+      ok: typeof body.ok === "boolean" ? body.ok : null,
+      reconcile_ready: typeof body.reconcile_ready === "boolean" ? body.reconcile_ready : null
+    };
+  } catch {
+    return { writer_id: null, ok: null, reconcile_ready: null };
+  }
+}
+async function runConnect(input) {
+  const dest = join18(input.home, ".skillwiki", ".env");
+  const fromFile = input.fromFile?.trim();
+  const fromStdin = Boolean(input.fromStdin);
+  if (fromFile && fromStdin) {
+    return fail(ExitCode.USAGE, "USAGE", { reason: "pass --from-file or --from-stdin, not both" });
+  }
+  if (!fromFile && !fromStdin) {
+    return fail(ExitCode.USAGE, "USAGE", {
+      reason: "pass --from-file <chat-attachment> or --from-stdin (Cloud Drive / \u4E91\u76D8 unsupported)"
+    });
+  }
+  if (fromFile && isUnsupportedSecretPath(fromFile)) {
+    return fail(ExitCode.PREFLIGHT_FAILED, "DRIVE_UNSUPPORTED", {
+      reason: "Cloud Drive / \u4E91\u76D8 is not a secret path. Attach the env file in chat, then skillwiki connect --from-file <attachment>."
+    });
+  }
+  let raw;
+  try {
+    raw = fromStdin ? await (input.readStdin ?? defaultReadStdin)() : await readFile6(fromFile, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return fail(ExitCode.FILE_NOT_FOUND, "FILE_NOT_FOUND", { path: fromFile });
+    }
+    if (code === "EISDIR") {
+      return fail(ExitCode.PREFLIGHT_FAILED, "NOT_ENV_FILE", { reason: "source is a directory, not an env file" });
+    }
+    return fail(ExitCode.PREFLIGHT_FAILED, "READ_FAILED", { reason: "could not read env source" });
+  }
+  if (looksLikeVaultInit(raw)) {
+    return fail(ExitCode.PREFLIGHT_FAILED, "REFUSE_INIT", {
+      reason: "source looks like a vault init; skillwiki connect never runs skillwiki init"
+    });
+  }
+  const parsed = parseDotenvText(raw);
+  const incomingToken = nonEmptyEnvValue(parsed[MCP_TOKEN_ENV]);
+  const incomingHost = nonEmptyEnvValue(parsed[MCP_HOST_ID_ENV]);
+  const incomingUrl = nonEmptyEnvValue(parsed[MCP_URL_ENV]);
+  if (!incomingToken) {
+    return fail(ExitCode.INVALID_CONFIG_VALUE, "TOKEN_EMPTY", {
+      reason: "SKILLWIKI_MCP_TOKEN missing or empty (value not shown)"
+    });
+  }
+  if (!incomingHost) {
+    return fail(ExitCode.INVALID_CONFIG_VALUE, "HOST_ID_REQUIRED", {
+      reason: "SKILLWIKI_HOST_ID missing; each machine needs a unique host-id"
+    });
+  }
+  if (!HOST_ID_RE.test(incomingHost)) {
+    return fail(ExitCode.PREFLIGHT_FAILED, "INVALID_HOST_ID", { reason: "host-id must match [a-z][a-z0-9-]{1,62}" });
+  }
+  if (RESERVED_HOST_IDS.includes(incomingHost) && !input.force) {
+    return fail(ExitCode.PREFLIGHT_FAILED, "RESERVED_HOST_ID", {
+      reason: `refuse copying reserved host-id ${incomingHost}; issue a unique id on metal or pass --force`
+    });
+  }
+  const existing = await parseDotenvFile(dest);
+  const existingToken = nonEmptyEnvValue(existing[MCP_TOKEN_ENV]);
+  if (existingToken && existingToken !== incomingToken && !input.force) {
+    return fail(ExitCode.ENV_WRITE_CONFLICT, "ENV_WRITE_CONFLICT", {
+      reason: "existing ~/.skillwiki/.env has a different token; pass --force to overwrite (value not shown)"
+    });
+  }
+  const entries = {
+    [MCP_TOKEN_ENV]: incomingToken,
+    [MCP_HOST_ID_ENV]: incomingHost
+  };
+  if (incomingUrl) entries[MCP_URL_ENV] = incomingUrl;
+  const dryRun = Boolean(input.dryRun);
+  if (!dryRun) {
+    await mkdir5(join18(input.home, ".skillwiki"), { recursive: true });
+    let original;
+    try {
+      original = await readFile6(dest, "utf8");
+    } catch {
+      original = void 0;
+    }
+    await writeDotenv(dest, entries, original);
+    await chmod(dest, DEST_MODE);
+    try {
+      const st = await stat3(dest);
+      if ((st.mode & 511) !== DEST_MODE) await chmod(dest, DEST_MODE);
+    } catch {
+    }
+  }
+  let writerId = null;
+  let statusOk = null;
+  let reconcileReady = null;
+  let handshake = null;
+  let doctorExit = ExitCode.OK;
+  const checkMcp = input.checkMcp ?? !dryRun;
+  if (checkMcp) {
+    const env = await mergeMcpAuthIntoEnv(input.home, input.env ?? {});
+    if (!nonEmptyEnvValue(env[MCP_TOKEN_ENV])) env[MCP_TOKEN_ENV] = incomingToken;
+    if (!nonEmptyEnvValue(env[MCP_HOST_ID_ENV])) env[MCP_HOST_ID_ENV] = incomingHost;
+    if (incomingUrl && !nonEmptyEnvValue(env[MCP_URL_ENV])) env[MCP_URL_ENV] = incomingUrl;
+    const doctor = await runDoctor({
+      home: input.home,
+      envValue: void 0,
+      argv: ["node", "skillwiki", "connect"],
+      currentVersion: input.currentVersion,
+      checkMcp: true,
+      env,
+      mcpFetch: input.mcpFetch
+    });
+    doctorExit = doctor.exitCode;
+    if (doctor.result.ok) {
+      handshake = doctor.result.data.checks.find((c) => c.id === "mcp_handshake")?.detail ?? null;
+    }
+    const url = incomingUrl ?? DEFAULT_MCP_URL;
+    const status = await readWikiStatus(input.mcpFetch ?? globalThis.fetch, url, incomingToken);
+    writerId = status.writer_id;
+    statusOk = status.ok;
+    reconcileReady = status.reconcile_ready;
+  }
+  const payload = {
+    dest,
+    written: !dryRun,
+    dry_run: dryRun,
+    mode: "0600",
+    token: tokenPresence(incomingToken),
+    auth: incomingToken ? "present" : "not set",
+    writer_id: writerId,
+    ok: statusOk,
+    reconcile_ready: reconcileReady,
+    handshake,
+    humanHint: ""
+  };
+  payload.humanHint = summaryHint(payload);
+  const safe = redactConnectPayload(payload, incomingToken);
+  if (!dryRun && checkMcp && doctorExit !== ExitCode.OK && doctorExit !== ExitCode.DOCTOR_HAS_WARNINGS) {
+    return { exitCode: doctorExit, result: ok(safe) };
+  }
+  return { exitCode: ExitCode.OK, result: ok(safe) };
+}
+
 // src/commands/archive.ts
-import { rename as rename2, mkdir as mkdir6, readFile as readFile7 } from "fs/promises";
-import { join as join19, dirname as dirname5 } from "path";
+import { rename as rename2, mkdir as mkdir7, readFile as readFile8 } from "fs/promises";
+import { join as join20, dirname as dirname5 } from "path";
 
 // src/utils/delete-intent.ts
-import { mkdir as mkdir5, writeFile as writeFile4, readdir as readdir4, readFile as readFile6 } from "fs/promises";
-import { join as join18 } from "path";
+import { mkdir as mkdir6, writeFile as writeFile4, readdir as readdir4, readFile as readFile7 } from "fs/promises";
+import { join as join19 } from "path";
 var DELETE_INTENT_SCHEMA = "vault-delete-intent/v1";
 var DELETE_INTENT_DIR = "meta/delete-intents";
 function normalizeVaultRelPath(path) {
@@ -3613,10 +3941,10 @@ function buildDeleteIntent(input) {
   };
 }
 async function writeDeleteIntent(vault, intent) {
-  const dir = join18(vault, DELETE_INTENT_DIR);
-  await mkdir5(dir, { recursive: true });
+  const dir = join19(vault, DELETE_INTENT_DIR);
+  await mkdir6(dir, { recursive: true });
   const rel = `${DELETE_INTENT_DIR}/${pathToIntentFilename(intent.path)}`;
-  await writeFile4(join18(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
+  await writeFile4(join19(vault, rel), JSON.stringify(intent, null, 2) + "\n", "utf8");
   return rel;
 }
 
@@ -3656,7 +3984,7 @@ async function runArchive(input) {
   const slug = relPath.replace(/\.md$/, "").split("/").pop();
   const rawArchive = isRaw ? lifecycleDestination(relPath, "archive") : void 0;
   if (rawArchive && !rawArchive.ok) return { exitCode: ExitCode.USAGE, result: rawArchive };
-  const archivePath = isRaw ? rawArchive.data : join19("_archive", relPath).replace(/\\/g, "/");
+  const archivePath = isRaw ? rawArchive.data : join20("_archive", relPath).replace(/\\/g, "/");
   const remoteRoot = normalizeRemoteRoot(input.remote);
   const remoteObjectPath = buildRemoteObjectPath(remoteRoot, relPath);
   let cascade;
@@ -3686,7 +4014,7 @@ async function runArchive(input) {
     const indexRefs = [];
     if (!isRaw) {
       try {
-        const idx = await readFile7(join19(input.vault, "index.md"), "utf8");
+        const idx = await readFile8(join20(input.vault, "index.md"), "utf8");
         idx.split("\n").forEach((line, i) => {
           if (line.includes(`[[${slug}]]`)) indexRefs.push({ line: i + 1, text: line });
         });
@@ -3744,8 +4072,8 @@ async function runArchive(input) {
   const rewrittenCascadePages = [];
   if ((input.cascade || isRaw) && input.apply && cascade) {
     for (const ref of cascade.source_array_refs) {
-      const absPath = join19(input.vault, ref.page);
-      const text = await readFile7(absPath, "utf8");
+      const absPath = join20(input.vault, ref.page);
+      const text = await readFile8(absPath, "utf8");
       if (!arraysEqual(ref.sources_after, ref.sources_before)) {
         let updated;
         if (isRaw) {
@@ -3771,8 +4099,8 @@ ${fmRewritten}
     if (isRaw) {
       for (const ref of cascade.citation_refs) {
         if (cascade.source_array_refs.some((sourceRef) => sourceRef.page === ref.page)) continue;
-        const absPath = join19(input.vault, ref.page);
-        const original = await readFile7(absPath, "utf8");
+        const absPath = join20(input.vault, ref.page);
+        const original = await readFile8(absPath, "utf8");
         const updated = rewriteRawSourceReferences(original, relPath, archivePath).text;
         if (updated !== original) {
           const write = await safeWritePage(absPath, updated);
@@ -3783,13 +4111,13 @@ ${fmRewritten}
     }
   }
   if (!isRaw) {
-    await mkdir6(dirname5(join19(input.vault, archivePath)), { recursive: true });
-    await rename2(join19(input.vault, relPath), join19(input.vault, archivePath));
+    await mkdir7(dirname5(join20(input.vault, archivePath)), { recursive: true });
+    await rename2(join20(input.vault, relPath), join20(input.vault, archivePath));
   }
   let indexUpdated = false;
   if (!isRaw) {
     const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-6OHDINHT.js");
-    const before = await readFile7(join19(input.vault, "index.md"), "utf8").catch(() => "");
+    const before = await readFile8(join20(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -3843,7 +4171,7 @@ ${fmRewritten}
 
 // src/commands/remove.ts
 import { unlink as unlink2, access } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 async function pathExists(abs) {
   try {
     await access(abs);
@@ -3869,7 +4197,7 @@ async function runRemove(input) {
   if (!relPath) {
     try {
       const candidate = normalizeVaultRelPath(input.page);
-      if (await pathExists(join20(input.vault, candidate))) {
+      if (await pathExists(join21(input.vault, candidate))) {
         relPath = candidate;
       }
     } catch {
@@ -3907,12 +4235,12 @@ async function runRemove(input) {
     reason: input.reason
   });
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
-  await unlink2(join20(input.vault, relPath));
+  await unlink2(join21(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile23 } = await import("fs/promises");
+    const { readFile: readFile24 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
     const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-6OHDINHT.js");
-    const before = await readFile23(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const before = await readFile24(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -3950,7 +4278,7 @@ async function runRemove(input) {
 }
 
 // src/commands/drift.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/utils/fetch.ts
 async function controlledFetch(url, opts) {
@@ -4029,7 +4357,7 @@ async function runDrift(input) {
       });
       continue;
     }
-    const currentHash = createHash2("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
+    const currentHash = createHash3("sha256").update(Buffer.from(resp.data.body, "utf8")).digest("hex");
     const identity = assessSourceIdentity({
       rawPath: raw.relPath,
       sourceUrl,
@@ -4261,7 +4589,7 @@ ${migratedBody}${newFooter}`;
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function parseCoreSemver(version) {
   const m = version.match(/^(\d+)\.(\d+)\.(\d+)/);
   if (!m) return null;
@@ -4313,7 +4641,7 @@ function resolveGlobalSkillsRoot() {
       encoding: "utf8",
       timeout: 5e3
     }).trim();
-    return join21(globalRoot, "skillwiki", "skills");
+    return join22(globalRoot, "skillwiki", "skills");
   } catch {
     return null;
   }
@@ -4341,7 +4669,7 @@ async function runUpdate(input) {
   const pkg2 = readCliPackageJson();
   const currentVersion = pkg2.version;
   const tag = normalizeDistTag(input.distTag);
-  const target = join21(input.home, ".claude", "skills");
+  const target = join22(input.home, ".claude", "skills");
   let latest;
   try {
     latest = execSync(`npm view skillwiki@${tag} version`, {
@@ -4422,13 +4750,13 @@ async function runUpdate(input) {
 // src/commands/self-update.ts
 import { execSync as execSync2 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var DEFAULT_SOURCE_ROOT_SUFFIX = "/Desktop/code/llm-wiki";
 async function runSelfUpdate(input) {
   const currentVersion = readCliPackageJson().version;
   const sourceRoot = input.sourceRoot ?? `${input.home}${DEFAULT_SOURCE_ROOT_SUFFIX}`;
   const distTag = normalizeDistTag(input.distTag);
-  const localPkgPath = join22(sourceRoot, "packages", "cli", "package.json");
+  const localPkgPath = join23(sourceRoot, "packages", "cli", "package.json");
   const hasLocalSource = existsSync8(localPkgPath);
   if (input.check) {
     let availableVersion = null;
@@ -4560,10 +4888,10 @@ async function runSelfUpdate(input) {
 }
 
 // src/commands/transcripts.ts
-import { readdir as readdir5, stat as stat3, readFile as readFile9 } from "fs/promises";
-import { join as join23 } from "path";
+import { readdir as readdir5, stat as stat4, readFile as readFile10 } from "fs/promises";
+import { join as join24 } from "path";
 async function runTranscripts(input) {
-  const dir = join23(input.vault, "raw", "transcripts");
+  const dir = join24(input.vault, "raw", "transcripts");
   let entries;
   try {
     entries = await readdir5(dir, { withFileTypes: true });
@@ -4573,13 +4901,13 @@ async function runTranscripts(input) {
   const transcripts = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const filePath = join23(dir, entry.name);
-    const content = await readFile9(filePath, "utf8");
+    const filePath = join24(dir, entry.name);
+    const content = await readFile10(filePath, "utf8");
     const fm = extractFrontmatter(content);
     if (!fm.ok) continue;
     const ingested = typeof fm.data.ingested === "string" ? fm.data.ingested : "";
     if (input.since && ingested && ingested < input.since) continue;
-    const s = await stat3(filePath);
+    const s = await stat4(filePath);
     transcripts.push({
       file: `raw/transcripts/${entry.name}`,
       ingested,
@@ -4591,8 +4919,8 @@ async function runTranscripts(input) {
 }
 
 // src/commands/claims-audit.ts
-import { readFile as readFile10 } from "fs/promises";
-import { join as join24 } from "path";
+import { readFile as readFile11 } from "fs/promises";
+import { join as join25 } from "path";
 function safeProjectPresentation(raw) {
   if (safeDiagnosticValue(raw) === REDACTED_MALFORMED_REFERENCE) {
     return REDACTED_MALFORMED_REFERENCE;
@@ -4632,9 +4960,9 @@ async function runClaimsAudit(input) {
     return !input.project || slugByDir.get(relDir) === input.project;
   });
   const claimSourceResults = await mapWithConcurrency(scopedSpecDirs, vaultIoConcurrency(), async (relDir) => {
-    const specPath = join24(input.vault, relDir, "spec.md");
+    const specPath = join25(input.vault, relDir, "spec.md");
     try {
-      const specText = await readFile10(specPath, "utf8");
+      const specText = await readFile11(specPath, "utf8");
       const fm = extractFrontmatter(specText);
       if (!fm.ok) return null;
       return {
@@ -4728,10 +5056,10 @@ async function runClaimsAudit(input) {
 }
 
 // src/commands/compound.ts
-import { writeFile as writeFile6, mkdir as mkdir7, readdir as readdir6, unlink as unlink3 } from "fs/promises";
-import { join as join25 } from "path";
+import { writeFile as writeFile6, mkdir as mkdir8, readdir as readdir6, unlink as unlink3 } from "fs/promises";
+import { join as join26 } from "path";
 import { existsSync as existsSync9 } from "fs";
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 var RETRO_HEADING_RE = /^## \[(\d{4}-\d{2}-\d{2})(?:\s+[^\]]+)?\] retro \| loop cycle(?: (\d+))?: (.+)$/;
 var FIELD_RE = {
   improve: /^-\s+\*?\*?Improve:?\*?\*?\s*(.+)$/m,
@@ -4829,17 +5157,17 @@ function extractRetroFields(date, cycleName, block) {
   };
 }
 async function runCompound(input) {
-  const logPath = join25(input.vault, "log.md");
+  const logPath = join26(input.vault, "log.md");
   let logText;
   try {
-    logText = await readFile11(logPath, "utf8");
+    logText = await readFile12(logPath, "utf8");
   } catch {
     return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: logPath }) };
   }
   const entries = parseRetroEntries(logText);
   const promoted = [];
   const skipped = [];
-  const compoundDir = join25(input.vault, "projects", input.project, "compound");
+  const compoundDir = join26(input.vault, "projects", input.project, "compound");
   for (const entry of entries) {
     const generalizeValue = entry.generalize.trim();
     if (!/^yes/i.test(generalizeValue)) {
@@ -4847,7 +5175,7 @@ async function runCompound(input) {
       continue;
     }
     const slug = slugify(entry.cycleName);
-    const compoundPath = join25(compoundDir, `${slug}.md`);
+    const compoundPath = join26(compoundDir, `${slug}.md`);
     if (existsSync9(compoundPath)) {
       skipped.push(entry.date);
       continue;
@@ -4887,7 +5215,7 @@ async function runCompound(input) {
     const content = frontmatter + "\n" + body;
     if (!input.dryRun) {
       if (!existsSync9(compoundDir)) {
-        await mkdir7(compoundDir, { recursive: true });
+        await mkdir8(compoundDir, { recursive: true });
       }
       await writeFile6(compoundPath, content, "utf8");
     }
@@ -4908,7 +5236,7 @@ async function runCompound(input) {
   };
 }
 async function runCompoundDelete(input) {
-  const projectDir = join25(input.vault, "projects", input.project);
+  const projectDir = join26(input.vault, "projects", input.project);
   if (!existsSync9(projectDir)) {
     return {
       exitCode: ExitCode.PROJECT_NOT_FOUND,
@@ -4916,7 +5244,7 @@ async function runCompoundDelete(input) {
     };
   }
   const entryName = input.entry.replace(/\.md$/, "");
-  const compoundPath = join25(projectDir, "compound", `${entryName}.md`);
+  const compoundPath = join26(projectDir, "compound", `${entryName}.md`);
   if (!existsSync9(compoundPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -4950,7 +5278,7 @@ knowledge.md regenerated`
   };
 }
 async function runCompoundList(input) {
-  const compoundDir = join25(input.vault, "projects", input.project, "compound");
+  const compoundDir = join26(input.vault, "projects", input.project, "compound");
   if (!existsSync9(compoundDir)) {
     return {
       exitCode: ExitCode.OK,
@@ -4981,10 +5309,10 @@ could not read compound directory`
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isFile() || !dirent.name.endsWith(".md")) continue;
-    const filePath = join25(compoundDir, dirent.name);
+    const filePath = join26(compoundDir, dirent.name);
     let text;
     try {
-      text = await readFile11(filePath, "utf8");
+      text = await readFile12(filePath, "utf8");
     } catch {
       continue;
     }
@@ -5013,8 +5341,8 @@ no compound entries found`;
 }
 
 // src/commands/session-brief.ts
-import { mkdir as mkdir8, readFile as readFile12, writeFile as writeFile7 } from "fs/promises";
-import { join as join26, relative, sep } from "path";
+import { mkdir as mkdir9, readFile as readFile13, writeFile as writeFile7 } from "fs/promises";
+import { join as join27, relative, sep } from "path";
 var MAX_WORDS = 900;
 async function runSessionBrief(input) {
   const { root: scanRoot } = resolveReadOnlyVaultRoot(input.vault);
@@ -5123,7 +5451,7 @@ async function resolveProject(input) {
   const envProject = input.env?.SKILLWIKI_PROJECT;
   if (envProject) return envProject;
   const cwd = input.cwd ?? process.cwd();
-  const projectDotenv = await readProjectSlug(join26(cwd, ".skillwiki", ".env"));
+  const projectDotenv = await readProjectSlug(join27(cwd, ".skillwiki", ".env"));
   if (projectDotenv) return projectDotenv;
   const inferred = inferProjectFromPath(input.vault, cwd);
   if (inferred) return inferred;
@@ -5132,7 +5460,7 @@ async function resolveProject(input) {
 async function readProjectSlug(file) {
   let text;
   try {
-    text = await readFile12(file, "utf8");
+    text = await readFile13(file, "utf8");
   } catch {
     return void 0;
   }
@@ -5223,7 +5551,7 @@ async function loadTrendDigests(typedPages) {
   return out;
 }
 async function loadSessionPins(vault, project) {
-  const text = await readIfExists(join26(vault, "meta", "session-pins.md"));
+  const text = await readIfExists(join27(vault, "meta", "session-pins.md"));
   if (!text) return [];
   const fm = extractFrontmatter(text);
   if (!fm.ok) return [];
@@ -5342,7 +5670,7 @@ function satelliteHealthWarnings(warning) {
   return warning ? [warning] : [];
 }
 async function loadHealthWarnings(vault) {
-  const text = await readIfExists(join26(vault, ".skillwiki", "health.json"));
+  const text = await readIfExists(join27(vault, ".skillwiki", "health.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -5355,7 +5683,7 @@ async function loadHealthWarnings(vault) {
   }
 }
 async function loadMemoryTopics(vault, project) {
-  const text = await readIfExists(join26(vault, ".skillwiki", "memory", project, "topics.json"));
+  const text = await readIfExists(join27(vault, ".skillwiki", "memory", project, "topics.json"));
   if (!text) return [];
   try {
     const parsed = JSON.parse(text);
@@ -5380,11 +5708,11 @@ async function loadMemoryTopics(vault, project) {
   }
 }
 async function writeBriefArtifacts(vault, input) {
-  const metaPath = join26(vault, "meta", "latest-session-brief.md");
-  const cacheMdPath = join26(vault, ".skillwiki", "session-brief.md");
-  const cacheJsonPath = join26(vault, ".skillwiki", "session-brief.json");
-  await mkdir8(join26(vault, "meta"), { recursive: true });
-  await mkdir8(join26(vault, ".skillwiki"), { recursive: true });
+  const metaPath = join27(vault, "meta", "latest-session-brief.md");
+  const cacheMdPath = join27(vault, ".skillwiki", "session-brief.md");
+  const cacheJsonPath = join27(vault, ".skillwiki", "session-brief.json");
+  await mkdir9(join27(vault, "meta"), { recursive: true });
+  await mkdir9(join27(vault, ".skillwiki"), { recursive: true });
   const committed = renderCommittedBrief(input);
   const previousComparable = comparableBrief(await readIfExists(metaPath));
   const nextComparable = comparableBrief(committed);
@@ -5457,7 +5785,7 @@ function renderCommittedBrief(input) {
   ].filter((line) => line !== "").join("\n");
 }
 async function rebuildRootIndexProjection(vault) {
-  const before = await readIfExists(join26(vault, "index.md"));
+  const before = await readIfExists(join27(vault, "index.md"));
   if (!before) return false;
   const projection = await renderRootIndex({ vault, currentText: before });
   if (!projection.ok) return false;
@@ -5467,7 +5795,7 @@ async function rebuildRootIndexProjection(vault) {
 }
 async function readIfExists(path) {
   try {
-    return await readFile12(path, "utf8");
+    return await readFile13(path, "utf8");
   } catch {
     return "";
   }
@@ -5509,23 +5837,23 @@ function dateFromPath(path) {
 }
 
 // src/commands/ingest.ts
-import { readFile as readFile15, open, unlink as unlink4, mkdir as mkdir10 } from "fs/promises";
-import { join as join31 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { readFile as readFile16, open, unlink as unlink4, mkdir as mkdir11 } from "fs/promises";
+import { join as join32 } from "path";
+import { createHash as createHash5 } from "crypto";
 
 // src/commands/page-publish.ts
 import { readFileSync as readFileSync13, realpathSync as realpathSync2 } from "fs";
-import { mkdir as mkdir9, readFile as readFile14 } from "fs/promises";
-import { dirname as dirname8, join as join30, resolve as resolve4 } from "path";
+import { mkdir as mkdir10, readFile as readFile15 } from "fs/promises";
+import { dirname as dirname8, join as join31, resolve as resolve4 } from "path";
 
 // src/utils/publication-approval.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var APPROVAL_CONTRACT = "skillwiki-publication-approval-v1";
 var APPROVAL_TOKEN_VERSION = "swpub1";
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var PUBLISHERS = /* @__PURE__ */ new Set(["page", "project-page"]);
 function sha256Hex(bytes) {
-  return createHash3("sha256").update(bytes).digest("hex");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 function normalizeLogNote(note) {
   if (note === void 0) return "";
@@ -5744,8 +6072,8 @@ function redactApprovalTokens(text) {
 }
 
 // src/publish/pipeline.ts
-import { readFile as readFile13 } from "fs/promises";
-import { dirname as dirname7, join as join29, resolve as resolve3 } from "path";
+import { readFile as readFile14 } from "fs/promises";
+import { dirname as dirname7, join as join30, resolve as resolve3 } from "path";
 
 // src/utils/publication-operation-journal.ts
 import {
@@ -5759,7 +6087,7 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname6, join as join27 } from "path";
+import { dirname as dirname6, join as join28 } from "path";
 var PUBLICATION_JOURNAL_SCHEMA = "skillwiki-publication-operation-v1";
 var PHASE_ORDER2 = [
   "locked",
@@ -5788,16 +6116,16 @@ function vaultIdentity(vaultPath) {
   return sha256Hex(real).slice(0, 16);
 }
 function publicationJournalRoot(home = process.env.HOME || homedir()) {
-  return join27(home, ".skillwiki", "publication-operations");
+  return join28(home, ".skillwiki", "publication-operations");
 }
 function resolveJournalPaths(vaultPath, operationId2, home = process.env.HOME || homedir()) {
   const identity = vaultIdentity(vaultPath);
   const rootDir = publicationJournalRoot(home);
-  const vaultDir = join27(rootDir, identity);
+  const vaultDir = join28(rootDir, identity);
   return {
     rootDir,
     vaultDir,
-    journalPath: join27(vaultDir, `${operationId2}.json`)
+    journalPath: join28(vaultDir, `${operationId2}.json`)
   };
 }
 function ensurePrivateDir(dir) {
@@ -6018,7 +6346,7 @@ function completePublicationJournal(input) {
 }
 
 // src/publish/hold-gates.ts
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function evaluateSchemaGate(content, target, publisherKind) {
   const frontmatter = extractFrontmatter(content);
   if (!frontmatter.ok) return false;
@@ -6054,7 +6382,7 @@ function evaluateSchemaGate(content, target, publisherKind) {
   return false;
 }
 function evaluateBrokenWikilinkGate(body, scan, ownTarget) {
-  const draftPage = { absPath: join28(scan.root, ownTarget), relPath: ownTarget };
+  const draftPage = { absPath: join29(scan.root, ownTarget), relPath: ownTarget };
   const resolver = buildWikilinkResolver([...scan.allMarkdown, draftPage]);
   const wikilinks = extractBodyWikilinks(body);
   for (const link of wikilinks) {
@@ -6241,7 +6569,7 @@ function phaseAtLeast(current, needed) {
 }
 async function readPageChanged(targetPath, content) {
   try {
-    return ok(await readFile13(targetPath, "utf8") !== content);
+    return ok(await readFile14(targetPath, "utf8") !== content);
   } catch (error) {
     if (error.code === "ENOENT") return ok(true);
     return err("WRITE_FAILED", { path: targetPath, message: String(error) });
@@ -6249,7 +6577,7 @@ async function readPageChanged(targetPath, content) {
 }
 async function readPriorTargetSha(targetPath) {
   try {
-    const text = await readFile13(targetPath, "utf8");
+    const text = await readFile14(targetPath, "utf8");
     return ok(sha256Hex(text));
   } catch (error) {
     if (error.code === "ENOENT") return ok("absent");
@@ -6282,10 +6610,10 @@ function successReceipt(strategy, prepared, details) {
   };
 }
 async function runPipelinePreview(strategy, prepared, vault) {
-  const schemaPath = join29(vault, "SCHEMA.md");
+  const schemaPath = join30(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile13(schemaPath, "utf8");
+    schemaText = await readFile14(schemaPath, "utf8");
   } catch (error) {
     const result = err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) });
     return { exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -6309,10 +6637,10 @@ async function runPipelinePreview(strategy, prepared, vault) {
   if (!indices.ok) {
     return { exitCode: indices.exitCode, result: indices.result };
   }
-  const logPath = join29(vault, "log.md");
+  const logPath = join30(vault, "log.md");
   let logAppended;
   try {
-    const logText = await readFile13(logPath, "utf8");
+    const logText = await readFile14(logPath, "utf8");
     const marker = strategy.publisherKind === "page" ? `<!-- skillwiki-page-publish:${prepared.operationId} -->` : `<!-- skillwiki-project-page-publish:${prepared.operationId} -->`;
     logAppended = !logText.includes(marker);
   } catch (error) {
@@ -6403,10 +6731,10 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
       return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "journal", state, cause: journalHook };
     }
   }
-  const schemaPath = join29(vault, "SCHEMA.md");
+  const schemaPath = join30(vault, "SCHEMA.md");
   let schemaText;
   try {
-    schemaText = await readFile13(schemaPath, "utf8");
+    schemaText = await readFile14(schemaPath, "utf8");
   } catch (error) {
     return {
       ok: false,
@@ -6455,8 +6783,8 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
   if (!strategy.usesJournal || !phaseAtLeast(currentPhase, "page")) {
     if (strategy.publisherKind === "project-page") {
       try {
-        const { mkdir: mkdir13 } = await import("fs/promises");
-        await mkdir13(dirname7(prepared.targetPath), { recursive: true });
+        const { mkdir: mkdir14 } = await import("fs/promises");
+        await mkdir14(dirname7(prepared.targetPath), { recursive: true });
       } catch (error) {
         return {
           ok: false,
@@ -6504,8 +6832,8 @@ async function runPipelineLockedPrimaryStages(strategy, prepared, vault, deps, j
     let visibleSchema;
     try {
       [visible, visibleSchema] = await Promise.all([
-        readFile13(prepared.targetPath, "utf8"),
-        readFile13(schemaPath, "utf8")
+        readFile14(prepared.targetPath, "utf8"),
+        readFile14(schemaPath, "utf8")
       ]);
     } catch (error) {
       return {
@@ -6897,16 +7225,16 @@ async function refreshProjectIndexForTarget(vault, projectSlugs, today) {
   for (const slug of projectSlugs) {
     const rendered = await renderProjectIndex(vault, slug, { today });
     if (!rendered.ok) return rendered;
-    const indexPath = join30(vault, rendered.data.index_path);
+    const indexPath = join31(vault, rendered.data.index_path);
     try {
-      await mkdir9(dirname8(indexPath), { recursive: true });
+      await mkdir10(dirname8(indexPath), { recursive: true });
     } catch (error) {
       return err("WRITE_FAILED", { path: indexPath, message: String(error) });
     }
     const written = await atomicWriteText(indexPath, rendered.data.text);
     if (!written.ok) return written;
     try {
-      const visible = await readFile14(indexPath, "utf8");
+      const visible = await readFile15(indexPath, "utf8");
       if (visible !== rendered.data.text) {
         return err("WRITE_FAILED", { path: indexPath, message: "project index verification failed" });
       }
@@ -7007,7 +7335,7 @@ function preparePagePublicationFromContent(input) {
 async function preparePagePublication(input) {
   let content;
   try {
-    content = await readFile14(input.draftPath, "utf8");
+    content = await readFile15(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -7095,10 +7423,10 @@ var PAGE_PUBLISH_STRATEGY = {
     return void 0;
   },
   async previewIndices(prepared, vault, pageChanged) {
-    const indexPath = join30(vault, "index.md");
+    const indexPath = join31(vault, "index.md");
     let indexText;
     try {
-      indexText = await readFile14(indexPath, "utf8");
+      indexText = await readFile15(indexPath, "utf8");
     } catch (error) {
       const result = err("FILE_NOT_FOUND", { path: indexPath, message: String(error) });
       return { ok: false, exitCode: ExitCode.FILE_NOT_FOUND, result };
@@ -7116,7 +7444,7 @@ var PAGE_PUBLISH_STRATEGY = {
       if (!renderedProject.ok) {
         return { ok: false, exitCode: errorExitCode(renderedProject.error), result: renderedProject };
       }
-      const projectIndexPath = join30(vault, renderedProject.data.index_path);
+      const projectIndexPath = join31(vault, renderedProject.data.index_path);
       const projectIndexChanged = await readPageChanged(projectIndexPath, renderedProject.data.text);
       if (!projectIndexChanged.ok) {
         return { ok: false, exitCode: errorExitCode(projectIndexChanged.error), result: projectIndexChanged };
@@ -7304,7 +7632,7 @@ function buildTypedContent(title, ingested, type, tags, rawRelPath, provenance)
 }
 async function resolveRawCapture(input) {
   try {
-    const existing = await readFile15(input.path, "utf8");
+    const existing = await readFile16(input.path, "utf8");
     const frontmatter = extractFrontmatter(existing);
     if (!frontmatter.ok) {
       return err("INGEST_VALIDATION_FAILED", {
@@ -7443,7 +7771,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     sourceContent = fetchResult.data.body;
   } else {
     try {
-      sourceContent = await readFile15(input.source, "utf8");
+      sourceContent = await readFile16(input.source, "utf8");
     } catch {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
@@ -7461,14 +7789,14 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       })
     };
   }
-  const sha2562 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sha2562 = createHash5("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify2(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
   const rawRelPath = `raw/articles/${slug}.md`;
   const typedDir = TYPE_DIR[input.type] ?? `${input.type}s`;
   const typedRelPath = `${typedDir}/${slug}.md`;
-  const rawAbsPath = join31(input.vault, rawRelPath);
+  const rawAbsPath = join32(input.vault, rawRelPath);
   const identity = assessSourceIdentity({
     rawPath: rawRelPath,
     sourceUrl: sourceUrl ?? void 0,
@@ -7512,11 +7840,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
   );
   if (!input.dryRun) {
     try {
-      await mkdir10(join31(input.vault, typedDir), { recursive: true });
+      await mkdir11(join32(input.vault, typedDir), { recursive: true });
     } catch (error) {
       return {
         exitCode: ExitCode.WRITE_FAILED,
-        result: err("WRITE_FAILED", { path: join31(input.vault, typedDir), message: String(error) })
+        result: err("WRITE_FAILED", { path: join32(input.vault, typedDir), message: String(error) })
       };
     }
   }
@@ -7570,11 +7898,11 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
     preflight: pagePublishDeps.preflight,
     mutate: async (receipt) => {
       try {
-        await mkdir10(join31(input.vault, "raw", "articles"), { recursive: true });
+        await mkdir11(join32(input.vault, "raw", "articles"), { recursive: true });
       } catch (error) {
         return {
           exitCode: ExitCode.WRITE_FAILED,
-          result: err("WRITE_FAILED", { path: join31(input.vault, "raw", "articles"), message: String(error) })
+          result: err("WRITE_FAILED", { path: join32(input.vault, "raw", "articles"), message: String(error) })
         };
       }
       const rawWrite = await writeResolvedRaw({
@@ -7810,8 +8138,8 @@ ${body}`;
 }
 
 // src/commands/tag-reconcile.ts
-import { readFile as readFile16 } from "fs/promises";
-import { join as join32, posix } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { join as join33, posix } from "path";
 var TYPED_TARGET_RE = /^(entities|concepts|comparisons|queries|meta)\/[a-z0-9][a-z0-9./_-]*\.md$/;
 function errorExitCode2(error) {
   switch (error) {
@@ -7854,7 +8182,7 @@ function asTagArray(frontmatter, path) {
 async function readTagsFromFile(path) {
   let text;
   try {
-    text = await readFile16(path, "utf8");
+    text = await readFile17(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path }) };
@@ -7875,7 +8203,7 @@ async function resolveRequestedTags(input, page) {
       result: err("INVALID_FRONTMATTER", { message: "explicit tags must be an array of strings" })
     };
   }
-  const source = input.from ?? (explicit.length === 0 ? join32(input.vault, page) : void 0);
+  const source = input.from ?? (explicit.length === 0 ? join33(input.vault, page) : void 0);
   if (!source) return { exitCode: ExitCode.OK, result: ok({ tags: [...new Set(explicit)].sort() }) };
   const sourced = await readTagsFromFile(source);
   if (!sourced.result.ok) return { exitCode: sourced.exitCode, result: sourced.result };
@@ -7886,7 +8214,7 @@ async function resolveRequestedTags(input, page) {
 }
 async function readSchema(schemaPath) {
   try {
-    return { exitCode: ExitCode.OK, result: ok(await readFile16(schemaPath, "utf8")) };
+    return { exitCode: ExitCode.OK, result: ok(await readFile17(schemaPath, "utf8")) };
   } catch (error) {
     if (error.code === "ENOENT") {
       return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND", { path: schemaPath }) };
@@ -7914,7 +8242,7 @@ function previewResult(page, tags, reconciled, dryRun, filesChanged) {
   };
 }
 async function reconcileTagsWhileLocked(input, page, tags, comment) {
-  const schemaPath = join32(input.vault, "SCHEMA.md");
+  const schemaPath = join33(input.vault, "SCHEMA.md");
   const current = await readSchema(schemaPath);
   if (!current.result.ok) return { exitCode: current.exitCode, result: current.result };
   const next = reconcileTaxonomyDocument(current.result.data, { tags, comment });
@@ -7925,7 +8253,7 @@ async function reconcileTagsWhileLocked(input, page, tags, comment) {
   }
   let verifiedText;
   try {
-    verifiedText = await readFile16(schemaPath, "utf8");
+    verifiedText = await readFile17(schemaPath, "utf8");
   } catch (error) {
     return {
       exitCode: ExitCode.WRITE_FAILED,
@@ -7951,7 +8279,7 @@ async function runTagReconcile(input) {
   const comment = taxonomyCommentForPage(page.data, date, input.reason);
   if (!comment.ok) return { exitCode: ExitCode.SCHEME_REJECTED, result: comment };
   if (!input.write) {
-    const schema = await readSchema(join32(input.vault, "SCHEMA.md"));
+    const schema = await readSchema(join33(input.vault, "SCHEMA.md"));
     if (!schema.result.ok) return { exitCode: schema.exitCode, result: schema.result };
     const preview = reconcileTaxonomyDocument(schema.result.data, { tags, comment: comment.data });
     return previewResult(page.data, tags, preview, true, []);
@@ -8004,8 +8332,8 @@ async function runTagReconcile(input) {
 
 // src/commands/project-page-publish.ts
 import { realpathSync as realpathSync4 } from "fs";
-import { mkdir as mkdir11, readFile as readFile17 } from "fs/promises";
-import { dirname as dirname10, join as join33, resolve as resolve6 } from "path";
+import { mkdir as mkdir12, readFile as readFile18 } from "fs/promises";
+import { dirname as dirname10, join as join34, resolve as resolve6 } from "path";
 
 // src/utils/architecture-page.ts
 import { lstatSync, realpathSync as realpathSync3 } from "fs";
@@ -8177,7 +8505,7 @@ function validateLogNote(logNote) {
 async function prepareProjectPagePublication(input) {
   let content;
   try {
-    content = await readFile17(input.draftPath, "utf8");
+    content = await readFile18(input.draftPath, "utf8");
   } catch (error) {
     return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
   }
@@ -8310,9 +8638,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
   async updateIndicesLocked(prepared, vault, state, observe) {
     const rendered = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
     if (!rendered.ok) return rendered;
-    const knowledgePath = join33(vault, rendered.data.index_path);
+    const knowledgePath = join34(vault, rendered.data.index_path);
     try {
-      await mkdir11(dirname10(knowledgePath), { recursive: true });
+      await mkdir12(dirname10(knowledgePath), { recursive: true });
     } catch (error) {
       return err("WRITE_FAILED", { message: String(error) });
     }
@@ -8321,7 +8649,7 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     state.projectIndexUpdated = knowledgeWrite.data.changed;
     if (state.projectIndexUpdated) state.changed.add(rendered.data.index_path);
     try {
-      const visibleIndex = await readFile17(knowledgePath, "utf8");
+      const visibleIndex = await readFile18(knowledgePath, "utf8");
       if (visibleIndex !== rendered.data.text) {
         return err("WRITE_FAILED", { message: "project knowledge.md verification failed" });
       }
@@ -8341,9 +8669,9 @@ var PROJECT_PAGE_PUBLISH_STRATEGY = {
     }
     let projectIndexChanged = true;
     if (projectIndex.ok) {
-      const indexPath = join33(vault, projectIndex.data.index_path);
+      const indexPath = join34(vault, projectIndex.data.index_path);
       try {
-        const existing = await readFile17(indexPath, "utf8");
+        const existing = await readFile18(indexPath, "utf8");
         projectIndexChanged = existing !== projectIndex.data.text || pageChanged;
       } catch {
         projectIndexChanged = true;
@@ -8500,10 +8828,10 @@ function runSyncJournalClearStale(input) {
 
 // src/commands/snapshot-maintenance.ts
 import { existsSync as existsSync11, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4, appendFileSync } from "fs";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
-import { join as join34, resolve as resolvePath } from "path";
+import { join as join35, resolve as resolvePath } from "path";
 var MAINTENANCE_SCHEMA_VERSION = 1;
 var MAINTENANCE_COMMAND = "snapshot-maintenance journal clear-stale";
 var REPAIR_COMMAND = "snapshot-maintenance projection-conflict repair";
@@ -8527,7 +8855,7 @@ function computeApprovalId(plan) {
     targets,
     normalizeReason(plan.operator_reason)
   ].join("|");
-  return "smap1-" + createHash5("sha256").update(payload).digest("hex").slice(0, 32);
+  return "smap1-" + createHash6("sha256").update(payload).digest("hex").slice(0, 32);
 }
 function normalizeReason(reason) {
   return reason.trim().replace(/\s+/g, " ");
@@ -8568,7 +8896,7 @@ async function runSnapshotMaintenanceDryRun(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -8648,14 +8976,14 @@ async function resolveLiveVault(input) {
   return resolved.ok ? canonicalize(resolved.data.path) : void 0;
 }
 function snapshotMaintenanceAuditLogPath(home) {
-  const stateDir = platform2() === "darwin" ? join34(home, "Library", "Application Support", "vault-sync") : join34(home, ".local", "state", "vault-sync");
-  return join34(stateDir, "snapshot-maintenance-audit.jsonl");
+  const stateDir = platform2() === "darwin" ? join35(home, "Library", "Application Support", "vault-sync") : join35(home, ".local", "state", "vault-sync");
+  return join35(stateDir, "snapshot-maintenance-audit.jsonl");
 }
 function defaultAuditSink(home) {
   return (event) => {
     try {
       const logPath = snapshotMaintenanceAuditLogPath(home);
-      mkdirSync4(join34(logPath, ".."), { recursive: true });
+      mkdirSync4(join35(logPath, ".."), { recursive: true });
       appendFileSync(logPath, JSON.stringify(event) + "\n", { encoding: "utf8" });
     } catch {
     }
@@ -8797,15 +9125,15 @@ function computeRepairApprovalId(plan) {
     paths,
     normalizeReason(plan.operator_reason)
   ].join("|");
-  return "smap1-" + createHash5("sha256").update(payload).digest("hex").slice(0, 32);
+  return "smap1-" + createHash6("sha256").update(payload).digest("hex").slice(0, 32);
 }
 function nonMergeSequencerActive(repo) {
   const gitDir = git(repo, ["rev-parse", "--absolute-git-dir"]);
   if (!gitDir) return false;
   for (const m of ["CHERRY_PICK_HEAD", "REVERT_HEAD"]) {
-    if (existsSync11(join34(gitDir, m))) return true;
+    if (existsSync11(join35(gitDir, m))) return true;
   }
-  return existsSync11(join34(gitDir, "rebase-merge")) || existsSync11(join34(gitDir, "rebase-apply"));
+  return existsSync11(join35(gitDir, "rebase-merge")) || existsSync11(join35(gitDir, "rebase-apply"));
 }
 function extraUnmergedPaths(unmerged) {
   const allow = new Set(PROJECTION_CONFLICT_ALLOWLIST);
@@ -8844,7 +9172,7 @@ async function authorizeRepairContext(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync11(requested) || !existsSync11(join34(requested, ".git"))) {
+  if (!existsSync11(requested) || !existsSync11(join35(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO", void 0, REPAIR_COMMAND));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -8945,8 +9273,8 @@ async function performProjectionRepair(input, plan, audit, now) {
     return { exitCode: ExitCode.WRITE_FAILED, result: rendered };
   }
   try {
-    writeFileSync6(join34(plan.snapshot_worktree, "index.md"), rendered.data.index);
-    writeFileSync6(join34(plan.snapshot_worktree, "log.md"), rendered.data.log);
+    writeFileSync6(join35(plan.snapshot_worktree, "index.md"), rendered.data.index);
+    writeFileSync6(join35(plan.snapshot_worktree, "log.md"), rendered.data.log);
     gitStrict(plan.snapshot_worktree, ["add", "--", "index.md", "log.md"]);
     gitStrict(plan.snapshot_worktree, [
       "commit",
@@ -9054,7 +9382,7 @@ function releaseSnapshotFlock(handle) {
 
 // src/commands/backup.ts
 import { statSync as statSync3, readdirSync as readdirSync2, readFileSync as readFileSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join35, relative as relative3, dirname as dirname11 } from "path";
+import { join as join36, relative as relative3, dirname as dirname11 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -9078,7 +9406,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join35(dir, entry.name);
+    const full = join36(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
@@ -9101,7 +9429,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join35(input.vault, relPath);
+    const absPath = join36(input.vault, relPath);
     const localStat = statSync3(absPath);
     let needsUpload = true;
     try {
@@ -9177,7 +9505,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join35(target, obj.Key);
+      const localPath = join36(target, obj.Key);
       try {
         const localStat = statSync3(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -9224,8 +9552,8 @@ async function runBackupRestore(input) {
 
 // src/commands/status.ts
 import { existsSync as existsSync12, statSync as statSync4 } from "fs";
-import { readFile as readFile18 } from "fs/promises";
-import { join as join36 } from "path";
+import { readFile as readFile19 } from "fs/promises";
+import { join as join37 } from "path";
 var FUSE_NO_MIRROR_NOTE = "FUSE vault with no read mirror - status scan may be slow";
 async function runStatus(input) {
   if (!existsSync12(input.vault)) {
@@ -9264,7 +9592,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile18(join36(scanRoot, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile19(join37(scanRoot, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -9332,13 +9660,13 @@ async function runStatus(input) {
 
 // src/commands/copy-status.ts
 import { existsSync as existsSync13, realpathSync as realpathSync5 } from "fs";
-import { isAbsolute as isAbsolute2, join as join38, relative as relative5, resolve as resolve8 } from "path";
+import { isAbsolute as isAbsolute2, join as join39, relative as relative5, resolve as resolve8 } from "path";
 
 // src/utils/fetch-projection.ts
-import { isAbsolute, join as join37, resolve as resolve7 } from "path";
+import { isAbsolute, join as join38, resolve as resolve7 } from "path";
 function inspectConfiguredFetchProjection(home) {
   if (!home) return { configured: false };
-  const config = readSkillWikiConfig(join37(home, ".skillwiki", ".env"));
+  const config = readSkillWikiConfig(join38(home, ".skillwiki", ".env"));
   const configured = config["vault_sync.fetch_projection"];
   if (!configured || configured === "none") return { configured: false };
   if (!isAbsolute(configured)) {
@@ -9348,8 +9676,8 @@ function inspectConfiguredFetchProjection(home) {
 }
 
 // src/utils/live-drift.ts
-import { createHash as createHash6 } from "crypto";
-import { readFile as readFile19 } from "fs/promises";
+import { createHash as createHash7 } from "crypto";
+import { readFile as readFile20 } from "fs/promises";
 import { relative as relative4, sep as sep3 } from "path";
 
 // src/utils/git-promotion.ts
@@ -9370,7 +9698,7 @@ function isGitPromotablePath(path) {
 // src/utils/live-drift.ts
 function gitBlobOid(bytes) {
   const header = Buffer.from(`blob ${bytes.length}\0`);
-  return createHash6("sha1").update(header).update(bytes).digest("hex");
+  return createHash7("sha1").update(header).update(bytes).digest("hex");
 }
 function headBlobOids(projection) {
   const output = git(projection, ["ls-tree", "-rz", "-r", "HEAD"]);
@@ -9394,7 +9722,7 @@ async function measureAuthoritativeLiveDrift(liveVault, projection) {
     const rel = relative4(liveVault, page.absPath).split(sep3).join("/");
     if (!isGitPromotablePath(rel)) continue;
     livePromotable.add(rel);
-    const bytes = await readFile19(page.absPath);
+    const bytes = await readFile20(page.absPath);
     if (projectionBlobs.get(rel) !== gitBlobOid(bytes)) content += 1;
   }
   for (const rel of projectionBlobs.keys()) {
@@ -9572,7 +9900,7 @@ function defaultCopyStatusDeps(input) {
   const projectionWarning = selection.configured ? `configured fetch projection ignored for Git status; using live vault${projectionProblem ? ` (${projectionProblem})` : ""}` : void 0;
   const invalidProjectionDetail = projectionProblem ?? "configured fetch projection is not a git repository";
   const gitRootProblem = () => {
-    if (!existsSync13(join38(gitVault, ".git"))) {
+    if (!existsSync13(join39(gitVault, ".git"))) {
       return "vault is not a git repository";
     }
     return void 0;
@@ -9640,7 +9968,7 @@ function defaultCopyStatusDeps(input) {
       if (!configuredProjection) {
         return { unknown: true, detail: projectionProblem ?? "live drift requires a configured fetch projection" };
       }
-      if (!existsSync13(join38(configuredProjection, ".git"))) {
+      if (!existsSync13(join39(configuredProjection, ".git"))) {
         return { unknown: true, detail: invalidProjectionDetail };
       }
       return measureAuthoritativeLiveDrift(input.vault, configuredProjection);
@@ -9656,8 +9984,8 @@ async function runCopyStatusCommand(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir12, writeFile as writeFile8, stat as stat4 } from "fs/promises";
-import { join as join39 } from "path";
+import { mkdir as mkdir13, writeFile as writeFile8, stat as stat5 } from "fs/promises";
+import { join as join40 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -9726,29 +10054,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat4(join39(input.vault, "SCHEMA.md"));
+    await stat5(join40(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join39(input.vault, relPath);
+    const absPath = join40(input.vault, relPath);
     try {
-      await stat4(absPath);
+      await stat5(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir12(join39(absPath, ".."), { recursive: true });
+      await mkdir13(join40(absPath, ".."), { recursive: true });
       await writeFile8(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join39(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join40(input.vault, "raw", "articles", "example-source.md");
   try {
-    await stat4(rawPath);
+    await stat5(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir12(join39(rawPath, ".."), { recursive: true });
+    await mkdir13(join40(rawPath, ".."), { recursive: true });
     await writeFile8(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -9771,9 +10099,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile20, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile21, writeFile as writeFile9 } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -9851,7 +10179,7 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join40(input.vault, ".skillwiki", "graph.json");
+  const graphPath = input.graphPath ?? join41(input.vault, ".skillwiki", "graph.json");
   if (!existsSync14(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9863,7 +10191,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile20(graphPath, "utf8");
+    raw = await readFile21(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -9889,7 +10217,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join40(input.vault, "vault-graph.canvas");
+  const outPath = join41(input.vault, "vault-graph.canvas");
   try {
     await writeFile9(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -10033,12 +10361,12 @@ async function runSourceDisposition(input) {
 }
 
 // src/utils/source-disposal.ts
-import { createHash as createHash7 } from "crypto";
-import { readFile as readFile22, unlink as unlink5 } from "fs/promises";
+import { createHash as createHash8 } from "crypto";
+import { readFile as readFile23, unlink as unlink5 } from "fs/promises";
 
 // src/utils/raw-asset-reference-index.ts
-import { readdir as readdir7, readFile as readFile21 } from "fs/promises";
-import { join as join41, relative as relative6, sep as sep4 } from "path";
+import { readdir as readdir7, readFile as readFile22 } from "fs/promises";
+import { join as join42, relative as relative6, sep as sep4 } from "path";
 var PREVIEW_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "avif", "pdf", "mp3", "wav", "m4a", "mp4", "webm"]);
 async function walkFiles(root, dir = root) {
   let entries;
@@ -10049,7 +10377,7 @@ async function walkFiles(root, dir = root) {
   }
   const out = [];
   for (const entry of entries) {
-    const path = join41(dir, entry.name);
+    const path = join42(dir, entry.name);
     if (entry.isDirectory()) out.push(...await walkFiles(root, path));
     else if (entry.isFile()) out.push(relative6(root, path).split(sep4).join("/"));
   }
@@ -10065,7 +10393,7 @@ function addInbound(map, target, source) {
   map.set(target, refs);
 }
 async function buildRawAssetReferenceIndex(vault) {
-  const assetRoot = join41(vault, "raw", "assets");
+  const assetRoot = join42(vault, "raw", "assets");
   const relativeAssets = await walkFiles(assetRoot);
   const assets = relativeAssets.map((path) => `raw/assets/${path}`).sort((a, b) => a.localeCompare(b));
   const assetSet = new Set(assets);
@@ -10081,7 +10409,7 @@ async function buildRawAssetReferenceIndex(vault) {
   for (const page of scan.data.allMarkdown) {
     let text;
     try {
-      text = await readFile21(page.absPath, "utf8");
+      text = await readFile22(page.absPath, "utf8");
     } catch {
       continue;
     }
@@ -10117,7 +10445,7 @@ async function buildRawAssetReferenceIndex(vault) {
 
 // src/utils/source-disposal.ts
 function sha256(bytes) {
-  return createHash7("sha256").update(bytes).digest("hex");
+  return createHash8("sha256").update(bytes).digest("hex");
 }
 function exactTarget(path) {
   if (/[?*\[\]{}]/.test(path) || !path.includes("/") || path.endsWith("/")) return err("RAW_DISPOSAL_TARGET_INVALID", { path, message: "exact file path required; globs, basenames, and directories are refused" });
@@ -10141,7 +10469,7 @@ async function planSourceDisposal(input) {
   if (sensitive.length > 0) return err("SENSITIVE_CONTENT_DETECTED", { findings: sensitive });
   const target = await resolveExistingRegularFileInsideVault(input.vault, input.rawPath);
   if (!target.ok) return err("RAW_DISPOSAL_TARGET_INVALID", { path: input.rawPath, cause: target });
-  const bytes = await readFile22(target.data);
+  const bytes = await readFile23(target.data);
   const size = bytes.byteLength;
   let typedReferences = [];
   let otherReferences = [];
@@ -10265,7 +10593,7 @@ async function runSourceDisposal(input) {
 import { existsSync as existsSync15, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -10495,7 +10823,7 @@ async function runFleetHealth(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join42(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join43(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -10580,7 +10908,7 @@ async function runFleetHealth(input) {
 
 // src/utils/auto-commit.ts
 import { existsSync as existsSync16 } from "fs";
-import { isAbsolute as isAbsolute3, join as join43, normalize } from "path";
+import { isAbsolute as isAbsolute3, join as join44, normalize } from "path";
 function isValidLastOpPath(file) {
   if (!file || typeof file !== "string") return false;
   const trimmed = file.trim();
@@ -10601,7 +10929,7 @@ async function postCommit(vault, exitCode) {
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync16(join43(vault, ".git"))) return;
+  if (!existsSync16(join44(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -10641,53 +10969,6 @@ async function postCommit(vault, exitCode) {
 
 // src/commands/mcp-auth.ts
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "fs";
-
-// src/utils/mcp-token-map.ts
-import { createHash as createHash8, randomBytes } from "crypto";
-import yaml from "js-yaml";
-var HOST_ID_RE = /^[a-z][a-z0-9-]{1,62}$/;
-function parseMcpTokenMap(yamlText) {
-  const parsed = yaml.load(yamlText);
-  const map = /* @__PURE__ */ new Map();
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return map;
-  }
-  const records = parsed;
-  const nested = records.tokens;
-  const source = nested && typeof nested === "object" && !Array.isArray(nested) ? nested : records;
-  for (const [hash, hostId] of Object.entries(source)) {
-    if (hash === "tokens") continue;
-    if (typeof hostId !== "string" || hostId.length === 0) continue;
-    const normalized = hash.trim().toLowerCase();
-    if (!/^[0-9a-f]{64}$/.test(normalized)) continue;
-    map.set(normalized, hostId);
-  }
-  return map;
-}
-function generateHostBearer(rng) {
-  const bytes = (rng ?? (() => randomBytes(32)))();
-  const raw = bytes.toString("base64url");
-  const hashHex = createHash8("sha256").update(raw, "utf8").digest("hex");
-  return { raw, hashHex };
-}
-function appendHostHash(yamlText, hashHex, hostId) {
-  if (!HOST_ID_RE.test(hostId)) {
-    return { error: "INVALID_HOST_ID" };
-  }
-  const map = parseMcpTokenMap(yamlText);
-  const normalizedHash = hashHex.trim().toLowerCase();
-  if ([...map.values()].includes(hostId)) {
-    return { error: "DUPLICATE_HOST_ID" };
-  }
-  if (map.has(normalizedHash)) {
-    return { error: "DUPLICATE_HASH" };
-  }
-  return { yaml: yamlText.replace(/\s*$/, "") + `
-${normalizedHash}: ${hostId}
-` };
-}
-
-// src/commands/mcp-auth.ts
 function isEnoent(error) {
   return error.code === "ENOENT";
 }
@@ -10696,7 +10977,7 @@ function preflight(error) {
 }
 async function runMcpAuthIssueHost(input) {
   const isTty = input.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  const readFile23 = input.readFile ?? readFileSync17;
+  const readFile24 = input.readFile ?? readFileSync17;
   const writeFile10 = input.writeFile ?? writeFileSync8;
   const stderrWrite = input.stderrWrite ?? ((s) => {
     process.stderr.write(s);
@@ -10706,10 +10987,12 @@ async function runMcpAuthIssueHost(input) {
   const hostId = input.hostId;
   if (!mapPath) return preflight("MAP_PATH_REQUIRED");
   if (!HOST_ID_RE.test(hostId)) return preflight("INVALID_HOST_ID");
+  const granted = parseAllowedVaultIds(input.allowedVaults);
+  if ("error" in granted) return preflight(granted.error);
   if (write && !isTty) return preflight("NO_TTY");
   let yamlText = "";
   try {
-    yamlText = readFile23(mapPath, "utf8");
+    yamlText = readFile24(mapPath, "utf8");
   } catch (error) {
     if (!isEnoent(error)) throw error;
   }
@@ -10722,12 +11005,13 @@ async function runMcpAuthIssueHost(input) {
         host_id: hostId,
         hash_prefix: "",
         map_path: mapPath,
-        wrote: false
+        wrote: false,
+        allowed_vaults: granted.vaults
       })
     };
   }
   const { raw, hashHex } = generateHostBearer(input.rng);
-  const appended = appendHostHash(yamlText, hashHex, hostId);
+  const appended = appendHostHash(yamlText, hashHex, hostId, granted.vaults);
   if ("error" in appended) return preflight(appended.error);
   try {
     writeFile10(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
@@ -10737,7 +11021,8 @@ async function runMcpAuthIssueHost(input) {
     }
     throw error;
   }
-  stderrWrite(`issued host_id=${hostId} copy once: ${raw}
+  const grantNote = granted.vaults.length > 0 ? ` allowed_vaults=${granted.vaults.join(",")}` : "";
+  stderrWrite(`issued host_id=${hostId}${grantNote} copy once: ${raw}
 `);
   return {
     exitCode: ExitCode.OK,
@@ -10745,7 +11030,8 @@ async function runMcpAuthIssueHost(input) {
       host_id: hostId,
       hash_prefix: hashHex.slice(0, 8),
       map_path: mapPath,
-      wrote: true
+      wrote: true,
+      allowed_vaults: granted.vaults
     })
   };
 }
@@ -10888,7 +11174,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-THGIM2U7.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-NS7OQ2Y7.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -10918,7 +11204,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join44(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join45(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -11529,7 +11815,18 @@ program.command("doctor").description("diagnose skillwiki setup issues").option(
   currentVersion: pkg.version,
   cwd: process.cwd(),
   checkSnapshotter: !!opts.checkSnapshotter,
-  checkMcp: !!opts.checkMcp
+  checkMcp: !!opts.checkMcp,
+  env: process.env
+})));
+program.command("connect").description(CONNECT_DESCRIPTION).option("--from-file <path>", "chat-attached env file (not Drive / \u4E91\u76D8)").option("--from-stdin", "read env file from stdin (no echo)").option("--dry-run", "validate without writing ~/.skillwiki/.env").option("--force", "overwrite a different existing token").action(async (opts) => emit(await runConnect({
+  home: process.env.HOME ?? "",
+  fromFile: opts.fromFile,
+  fromStdin: !!opts.fromStdin,
+  dryRun: !!opts.dryRun,
+  force: !!opts.force,
+  checkMcp: !opts.dryRun,
+  currentVersion: pkg.version,
+  env: process.env
 })));
 program.command("status [vault]").description("output vault diagnostics").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
@@ -12123,12 +12420,14 @@ program.command("mcp").description("start stdio Model Context Protocol server (r
   await runSkillwikiMcpStdio();
 });
 var mcpAuthCmd = program.command("mcp-auth").description("attended HTTP MCP host-id bearer issuance (metal)");
-mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
+mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--allowed-vaults <ids>", "comma-separated exact vault ids; omit for default vault only").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
   const mapPath = opts.map || process.env.SKILLWIKI_MCP_TOKEN_MAP || "";
+  const allowedVaults = String(opts.allowedVaults ?? "").split(/[,\s]+/).map((id) => id.trim()).filter(Boolean);
   emit(await runMcpAuthIssueHost({
     hostId: String(opts.hostId),
     mapPath,
-    write: !!opts.write
+    write: !!opts.write,
+    allowedVaults
   }));
 });
 for (const w of getDeprecatedWarnings(process.env.HOME ?? "")) {