stellavault 0.8.4 → 0.8.5

package/dist/stellavault.js

@@ -159,6 +159,29 @@ function findMdFiles(dir, files = []) {
   }
   return files;
 }
+function scanFile(vaultPath, filePath) {
+  const rel = relative(vaultPath, filePath).replace(/\\/g, "/");
+  try {
+    const stat = statSync(filePath);
+    if (stat.size === 0)
+      return { skipped: { path: rel, reason: "empty" } };
+    if (stat.size > MAX_FILE_BYTES)
+      return { skipped: { path: rel, reason: "too-large", detail: `${stat.size}B` } };
+    const doc = parseDocument(vaultPath, filePath);
+    if (!doc.content || doc.content.trim().length === 0) {
+      return { skipped: { path: rel, reason: "empty", detail: "no content after frontmatter" } };
+    }
+    return { document: doc };
+  } catch (err) {
+    const msg = err?.message ?? String(err);
+    const reason = /ENOENT|EACCES|EPERM/.test(msg) ? "unreadable" : "parse-error";
+    return { skipped: { path: rel, reason, detail: msg.slice(0, 200) } };
+  }
+}
+function docIdForPath(vaultPath, filePath) {
+  const relativePath = relative(vaultPath, filePath).replace(/\\/g, "/");
+  return createHash("sha256").update(relativePath).digest("hex").slice(0, 16);
+}
 function parseDocument(vaultPath, filePath) {
   const raw = readFileSync2(filePath, "utf-8");
   const stat = statSync(filePath);
@@ -654,12 +677,25 @@ var init_retry = __esm({
 });
 
 // packages/core/dist/indexer/local-embedder.js
+import { mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 function getPipeline(modelName) {
   let p = pipelineCache.get(modelName);
   if (p)
     return p;
   p = (async () => {
-    const { pipeline: createPipeline } = await import("@xenova/transformers");
+    const { pipeline: createPipeline, env } = await import("@xenova/transformers");
+    const cacheOverride = process.env.STELLAVAULT_MODEL_CACHE;
+    if (cacheOverride) {
+      env.cacheDir = cacheOverride;
+    } else if (/\.asar[\\/]/.test(env.cacheDir ?? "")) {
+      env.cacheDir = join3(homedir2(), ".stellavault", "model-cache");
+    }
+    try {
+      mkdirSync2(env.cacheDir, { recursive: true });
+    } catch {
+    }
     return createPipeline("feature-extraction", `Xenova/${modelName}`, { quantized: true });
   })();
   pipelineCache.set(modelName, p);
@@ -675,6 +711,8 @@ function createLocalEmbedder(modelName = "nomic-embed-text-v1.5") {
       pipeline = await getPipeline(modelName);
     },
     async embed(text) {
+      if (!pipeline)
+        pipeline = await getPipeline(modelName);
       let output = await pipeline(text, { pooling: "mean", normalize: true });
       const result = Array.from(output.data).slice(0, dims);
       try {
@@ -685,6 +723,8 @@ function createLocalEmbedder(modelName = "nomic-embed-text-v1.5") {
       return result;
     },
     async embedBatch(texts, batchSize = 16) {
+      if (!pipeline)
+        pipeline = await getPipeline(modelName);
       const results = [];
       let processed = 0;
       for (let i = 0; i < texts.length; i += batchSize) {
@@ -793,10 +833,14 @@ __export(indexer_exports, {
   chunkDocument: () => chunkDocument,
   createLocalEmbedder: () => createLocalEmbedder,
   createWatcher: () => createWatcher,
+  docIdForPath: () => docIdForPath,
   estimateTokens: () => estimateTokens,
+  indexFiles: () => indexFiles,
   indexVault: () => indexVault,
+  scanFile: () => scanFile,
   scanVault: () => scanVault
 });
+import { existsSync as existsSync2 } from "node:fs";
 async function indexVault(vaultPath, options) {
   const start = Date.now();
   const { store, embedder, chunkOptions, onProgress } = options;
@@ -861,6 +905,80 @@ async function indexVault(vaultPath, options) {
     failedFiles
   };
 }
+async function indexFiles(vaultPath, filePaths, options) {
+  const start = Date.now();
+  const { store, embedder, chunkOptions, onProgress } = options;
+  const existingDocs = await store.getAllDocuments();
+  const existingMap = new Map(existingDocs.map((d) => [d.id, d.contentHash]));
+  let indexed = 0;
+  let skipped = 0;
+  let deleted = 0;
+  let failed = 0;
+  let totalChunks = 0;
+  const skippedFiles = [];
+  const failedFiles = [];
+  const uniquePaths = [...new Set(filePaths)];
+  for (let i = 0; i < uniquePaths.length; i++) {
+    const filePath = uniquePaths[i];
+    if (!existsSync2(filePath)) {
+      try {
+        await store.deleteByDocumentId(docIdForPath(vaultPath, filePath));
+        deleted++;
+      } catch (err) {
+        failed++;
+        failedFiles.push({ path: filePath, error: err?.message ?? String(err) });
+        console.error(errors.indexingFailed(filePath, err).format());
+      }
+      continue;
+    }
+    const result = scanFile(vaultPath, filePath);
+    if ("skipped" in result) {
+      skipped++;
+      skippedFiles.push(result.skipped);
+      continue;
+    }
+    const doc = result.document;
+    onProgress?.(i + 1, uniquePaths.length, doc);
+    if (existingMap.get(doc.id) === doc.contentHash) {
+      skipped++;
+      continue;
+    }
+    try {
+      const chunks = chunkDocument(doc.id, doc.content, chunkOptions);
+      const texts = chunks.map((c) => c.content);
+      const embeddings = await withRetry(() => embedder.embedBatch(texts), { maxRetries: 2, baseDelayMs: 1e3 });
+      const chunksWithEmbeddings = chunks.map((c, j) => ({
+        ...c,
+        embedding: embeddings[j],
+        entities: extractEntities({
+          content: c.content,
+          heading: c.heading,
+          title: doc.title,
+          tags: doc.tags
+        })
+      }));
+      await store.upsertDocument(doc);
+      await store.upsertChunks(chunksWithEmbeddings);
+      indexed++;
+      totalChunks += chunks.length;
+    } catch (err) {
+      failed++;
+      failedFiles.push({ path: doc.filePath, error: err?.message ?? String(err) });
+      console.error(errors.indexingFailed(doc.filePath, err).format());
+    }
+  }
+  return {
+    indexed,
+    skipped,
+    deleted,
+    failed,
+    totalChunks,
+    elapsedMs: Date.now() - start,
+    totalFiles: uniquePaths.length,
+    skippedFiles,
+    failedFiles
+  };
+}
 var init_indexer = __esm({
   "packages/core/dist/indexer/index.js"() {
     "use strict";
@@ -875,76 +993,52 @@ var init_indexer = __esm({
   }
 });
 
-// packages/core/dist/utils/math.js
-function cosineSimilarity(a, b) {
-  if (a.length !== b.length)
-    return 0;
-  let dot = 0, normA = 0, normB = 0;
-  for (let i = 0; i < a.length; i++) {
-    dot += a[i] * b[i];
-    normA += a[i] * a[i];
-    normB += b[i] * b[i];
-  }
-  const denom = Math.sqrt(normA) * Math.sqrt(normB);
-  return denom === 0 ? 0 : dot / denom;
-}
-function dotProduct(a, b) {
-  let sum = 0;
-  for (let i = 0; i < a.length; i++)
-    sum += a[i] * b[i];
-  return sum;
-}
-function normalizeVector(v) {
-  let norm = 0;
-  for (let i = 0; i < v.length; i++)
-    norm += v[i] * v[i];
-  norm = Math.sqrt(norm);
-  if (norm === 0)
-    return v;
-  for (let i = 0; i < v.length; i++)
-    v[i] /= norm;
-  return v;
-}
-function euclideanDist(a, b) {
-  let sum = 0;
-  for (let i = 0; i < a.length; i++) {
-    const diff = a[i] - b[i];
-    sum += diff * diff;
-  }
-  return Math.sqrt(sum);
-}
-var init_math = __esm({
-  "packages/core/dist/utils/math.js"() {
-    "use strict";
-  }
-});
-
 // packages/core/dist/api/graph-data.js
 var graph_data_exports = {};
 __export(graph_data_exports, {
+  buildClusteredGraph: () => buildClusteredGraph,
   buildGraphData: () => buildGraphData
 });
 import { createHash as createHash2 } from "node:crypto";
 async function buildGraphData(store, options = {}) {
-  const { edgeThreshold = 0.15, maxEdgesPerNode = 5 } = options;
-  const [docs, embeddings] = await Promise.all([
-    store.getAllDocuments(),
-    store.getDocumentEmbeddings()
-  ]);
+  const {
+    // 0.35: 384-dim 임베딩에서 의미있는 코사인 임계. 0.15는 사실상 모든 페어가 통과 →
+    // 중간 neighbor 배열이 수백만 객체로 폭증(빌드 지연) + 시각적으로 과밀한 엣지 거미줄.
+    edgeThreshold = 0.35,
+    maxEdgesPerNode = 5
+  } = options;
+  const docs = await store.getDocumentsMeta();
   const edges = [];
   const edgeCounts = /* @__PURE__ */ new Map();
-  const docsWithVecs = docs.filter((d) => embeddings.has(d.id));
-  const normalizedVecs = /* @__PURE__ */ new Map();
-  for (const doc of docsWithVecs) {
-    normalizedVecs.set(doc.id, normalizeVector([...embeddings.get(doc.id)]));
-  }
-  const docIds = [...normalizedVecs.keys()];
-  const vecArray = docIds.map((id) => normalizedVecs.get(id));
+  const NODE_CAP = Math.max(200, Math.floor(options.nodeCap ?? (Number(process.env.GRAPH_NODE_CAP) || 1500)));
+  const ranked = [...docs].sort((a, b) => String(b.lastModified ?? "").localeCompare(String(a.lastModified ?? "")));
+  if (docs.length > NODE_CAP) {
+    console.warn(`[graph] capped to ${NODE_CAP} most-recent notes (of ${docs.length}) \u2014 raise GRAPH_NODE_CAP to include more.`);
+  }
+  const embeddings = await store.getDocumentEmbeddingsByIds(ranked.slice(0, NODE_CAP).map((d) => d.id));
+  const docsWithVecs = ranked.filter((d) => embeddings.has(d.id)).slice(0, NODE_CAP);
+  const docIds = docsWithVecs.map((d) => d.id);
   const n = docIds.length;
+  const dim = n > 0 ? embeddings.get(docIds[0]).length : 0;
+  const flat = new Float32Array(n * dim);
+  for (let i = 0; i < n; i++) {
+    const v = embeddings.get(docIds[i]);
+    let mag = 0;
+    for (let d = 0; d < dim; d++)
+      mag += v[d] * v[d];
+    mag = Math.sqrt(mag) || 1;
+    const off = i * dim;
+    for (let d = 0; d < dim; d++)
+      flat[off + d] = v[d] / mag;
+  }
   const neighbors = Array.from({ length: n }, () => []);
   for (let i = 0; i < n; i++) {
+    const oi = i * dim;
     for (let j = i + 1; j < n; j++) {
-      const sim = dotProduct(vecArray[i], vecArray[j]);
+      const oj = j * dim;
+      let sim = 0;
+      for (let d = 0; d < dim; d++)
+        sim += flat[oi + d] * flat[oj + d];
       if (sim >= edgeThreshold) {
         neighbors[i].push({ peer: j, sim });
         neighbors[j].push({ peer: i, sim });
@@ -991,16 +1085,16 @@ async function buildGraphData(store, options = {}) {
       nodeCount: folderCounts.get(i) ?? 0
     }));
   } else {
-    const docIds2 = docs.filter((d) => embeddings.has(d.id)).map((d) => d.id);
-    const vectors = docIds2.map((id) => embeddings.get(id));
-    const k = Math.min(Math.max(5, Math.round(Math.sqrt(docIds2.length / 5))), 10);
-    const assignments = kMeans(vectors, k);
+    const clusterIds = docIds;
+    const k = options.clusterCount && options.clusterCount > 0 ? Math.floor(options.clusterCount) : Math.min(Math.max(5, Math.round(Math.sqrt(clusterIds.length / 5))), 10);
+    const assignments = kMeans(flat, n, dim, Math.min(k, clusterIds.length || 1), 10);
+    const docById = new Map(docsWithVecs.map((d) => [d.id, d]));
     const clusterDocInfos = /* @__PURE__ */ new Map();
-    for (let i = 0; i < docIds2.length; i++) {
+    for (let i = 0; i < clusterIds.length; i++) {
       const cId = assignments[i];
       if (!clusterDocInfos.has(cId))
         clusterDocInfos.set(cId, []);
-      const doc = docs.find((d) => d.id === docIds2[i]);
+      const doc = docById.get(clusterIds[i]);
       if (doc)
         clusterDocInfos.get(cId).push({ id: doc.id, title: doc.title });
     }
@@ -1021,8 +1115,8 @@ async function buildGraphData(store, options = {}) {
       });
     }
     assignmentMap = /* @__PURE__ */ new Map();
-    for (let i = 0; i < docIds2.length; i++) {
-      assignmentMap.set(docIds2[i], assignments[i]);
+    for (let i = 0; i < clusterIds.length; i++) {
+      assignmentMap.set(clusterIds[i], assignments[i]);
     }
   }
   const connectionCounts = /* @__PURE__ */ new Map();
@@ -1031,7 +1125,7 @@ async function buildGraphData(store, options = {}) {
     connectionCounts.set(edge.target, (connectionCounts.get(edge.target) ?? 0) + 1);
   }
   const maxConnections = Math.max(1, ...connectionCounts.values());
-  const nodes = docs.map((doc) => {
+  const nodes = docsWithVecs.map((doc) => {
     const conns = connectionCounts.get(doc.id) ?? 0;
     const ratio = conns / maxConnections;
     const size = 1 + 6 * Math.pow(ratio, 0.5);
@@ -1059,40 +1153,278 @@ async function buildGraphData(store, options = {}) {
     }
   };
 }
-function kMeans(vectors, k, maxIter = 50) {
-  if (vectors.length === 0)
+async function buildClusteredGraph(store, options = {}) {
+  const mode = options.mode ?? "semantic";
+  const clusterCap = Math.max(200, Math.floor(options.clusterCap ?? (Number(process.env.GRAPH_CLUSTER_CAP) || 3e3)));
+  const clusterCount = Math.max(1, Math.floor(options.clusterCount ?? Math.min(80, Math.max(6, Math.round(Math.sqrt(clusterCap / 2.5))))));
+  const data = await buildGraphData(store, {
+    mode,
+    nodeCap: clusterCap,
+    clusterCount,
+    edgeThreshold: options.edgeThreshold,
+    maxEdgesPerNode: options.maxEdgesPerNode
+  });
+  const nodeCluster = /* @__PURE__ */ new Map();
+  const byCluster = /* @__PURE__ */ new Map();
+  for (const node of data.nodes) {
+    const cid = node.clusterId ?? 0;
+    nodeCluster.set(node.id, cid);
+    (byCluster.get(cid) ?? byCluster.set(cid, []).get(cid)).push(node);
+  }
+  const degree = /* @__PURE__ */ new Map();
+  for (const e of data.edges) {
+    degree.set(e.source, (degree.get(e.source) ?? 0) + 1);
+    degree.set(e.target, (degree.get(e.target) ?? 0) + 1);
+  }
+  const intraByCluster = /* @__PURE__ */ new Map();
+  const metaMap = /* @__PURE__ */ new Map();
+  for (const e of data.edges) {
+    const ca = nodeCluster.get(e.source), cb = nodeCluster.get(e.target);
+    if (ca == null || cb == null)
+      continue;
+    if (ca === cb) {
+      (intraByCluster.get(ca) ?? intraByCluster.set(ca, []).get(ca)).push(e);
+    } else {
+      const lo = Math.min(ca, cb), hi = Math.max(ca, cb);
+      const key = `${lo}:${hi}`;
+      const m = metaMap.get(key);
+      if (m) {
+        m.weight += e.weight;
+        m.count += 1;
+      } else
+        metaMap.set(key, { sourceCluster: lo, targetCluster: hi, weight: e.weight, count: 1 });
+    }
+  }
+  const clusterLabel = /* @__PURE__ */ new Map();
+  for (const c of data.clusters)
+    clusterLabel.set(c.id, c.label);
+  const superNodes = [];
+  for (const [cid, mem] of byCluster) {
+    let rep = mem[0], repDeg = -1;
+    for (const m of mem) {
+      const d = degree.get(m.id) ?? 0;
+      if (d > repDeg) {
+        repDeg = d;
+        rep = m;
+      }
+    }
+    superNodes.push({
+      clusterId: cid,
+      // strip buildGraphData's trailing " (N)" — memberCount is a separate field.
+      label: (clusterLabel.get(cid) ?? `Cluster ${cid + 1}`).replace(/\s*\(\d+\)\s*$/, ""),
+      color: CLUSTER_COLORS[cid % CLUSTER_COLORS.length],
+      memberCount: mem.length,
+      position: [0, 0, 0],
+      // assigned below by Fibonacci rank
+      size: 2 + Math.min(12, Math.sqrt(mem.length)),
+      representativeId: rep?.id ?? ""
+    });
+  }
+  superNodes.sort((a, b) => b.memberCount - a.memberCount);
+  layoutSuperNodes(superNodes, metaMap);
+  const members = /* @__PURE__ */ new Map();
+  for (const [cid, mem] of byCluster) {
+    const boundaryEdges = [];
+    for (const e of data.edges) {
+      const ca = nodeCluster.get(e.source), cb = nodeCluster.get(e.target);
+      if (ca === cid && cb !== cid && cb != null)
+        boundaryEdges.push({ source: e.source, targetCluster: cb, weight: e.weight });
+      else if (cb === cid && ca !== cid && ca != null)
+        boundaryEdges.push({ source: e.target, targetCluster: ca, weight: e.weight });
+    }
+    members.set(cid, { clusterId: cid, members: mem, intraEdges: intraByCluster.get(cid) ?? [], boundaryEdges });
+  }
+  const META_PER_CLUSTER = 2;
+  const metaByCluster = /* @__PURE__ */ new Map();
+  for (const m of metaMap.values()) {
+    (metaByCluster.get(m.sourceCluster) ?? metaByCluster.set(m.sourceCluster, []).get(m.sourceCluster)).push(m);
+    (metaByCluster.get(m.targetCluster) ?? metaByCluster.set(m.targetCluster, []).get(m.targetCluster)).push(m);
+  }
+  const keptMeta = /* @__PURE__ */ new Set();
+  for (const list of metaByCluster.values()) {
+    list.sort((a, b) => b.weight - a.weight);
+    for (const m of list.slice(0, META_PER_CLUSTER))
+      keptMeta.add(m);
+  }
+  return {
+    clusterLevel: {
+      level: "galaxy",
+      superNodes,
+      metaEdges: [...keptMeta],
+      totalNodes: data.nodes.length,
+      totalEdges: data.edges.length,
+      layoutVersion: mode
+    },
+    members
+  };
+}
+function fibonacciSphere(i, n, radius) {
+  const phi = Math.acos(1 - 2 * (i + 0.5) / Math.max(1, n));
+  const theta = Math.PI * (1 + Math.sqrt(5)) * i;
+  return [
+    radius * Math.sin(phi) * Math.cos(theta),
+    radius * Math.sin(phi) * Math.sin(theta),
+    radius * Math.cos(phi)
+  ];
+}
+function layoutSuperNodes(superNodes, metaMap) {
+  const n = superNodes.length;
+  if (n === 0)
+    return;
+  if (n === 1) {
+    superNodes[0].position = [0, 0, 0];
+    return;
+  }
+  const idx = /* @__PURE__ */ new Map();
+  superNodes.forEach((s, i) => idx.set(s.clusterId, i));
+  const links = [];
+  let maxW = 0;
+  for (const m of metaMap.values()) {
+    const a = idx.get(m.sourceCluster), b = idx.get(m.targetCluster);
+    if (a == null || b == null || a === b)
+      continue;
+    links.push([a, b, m.weight]);
+    if (m.weight > maxW)
+      maxW = m.weight;
+  }
+  const wn = maxW > 0 ? 1 / maxW : 1;
+  const pos = new Float32Array(n * 3);
+  const vel = new Float32Array(n * 3);
+  for (let i = 0; i < n; i++) {
+    const p = fibonacciSphere(i, n, 100);
+    pos[i * 3] = p[0];
+    pos[i * 3 + 1] = p[1];
+    pos[i * 3 + 2] = p[2];
+  }
+  const REST = 42, CHARGE = 900, ITERS = 600, DAMP = 0.9, CENTER = 0.012;
+  for (let it = 0; it < ITERS; it++) {
+    const alpha = 1 - it / ITERS;
+    for (let i = 0; i < n; i++) {
+      const ix = pos[i * 3], iy = pos[i * 3 + 1], iz = pos[i * 3 + 2];
+      for (let j = i + 1; j < n; j++) {
+        let dx = pos[j * 3] - ix, dy = pos[j * 3 + 1] - iy, dz = pos[j * 3 + 2] - iz;
+        let d2 = dx * dx + dy * dy + dz * dz;
+        if (d2 < 0.01) {
+          dx = (i - j) % 3 * 0.1 || 0.1;
+          dy = 0.1;
+          dz = 0.1;
+          d2 = dx * dx + dy * dy + dz * dz;
+        }
+        const f = CHARGE * alpha / d2;
+        const fx = dx * f, fy = dy * f, fz = dz * f;
+        vel[i * 3] -= fx;
+        vel[i * 3 + 1] -= fy;
+        vel[i * 3 + 2] -= fz;
+        vel[j * 3] += fx;
+        vel[j * 3 + 1] += fy;
+        vel[j * 3 + 2] += fz;
+      }
+    }
+    for (const [a, b, w] of links) {
+      let dx = pos[b * 3] - pos[a * 3], dy = pos[b * 3 + 1] - pos[a * 3 + 1], dz = pos[b * 3 + 2] - pos[a * 3 + 2];
+      const dist = Math.sqrt(dx * dx + dy * dy + dz * dz) || 0.01;
+      const strength = 0.6 * (0.3 + 0.7 * w * wn);
+      const f = (dist - REST) / dist * alpha * strength;
+      const fx = dx * f, fy = dy * f, fz = dz * f;
+      vel[a * 3] += fx;
+      vel[a * 3 + 1] += fy;
+      vel[a * 3 + 2] += fz;
+      vel[b * 3] -= fx;
+      vel[b * 3 + 1] -= fy;
+      vel[b * 3 + 2] -= fz;
+    }
+    for (let i = 0; i < n; i++) {
+      vel[i * 3] -= pos[i * 3] * CENTER * alpha;
+      vel[i * 3 + 1] -= pos[i * 3 + 1] * CENTER * alpha;
+      vel[i * 3 + 2] -= pos[i * 3 + 2] * CENTER * alpha;
+      let vx = vel[i * 3] * DAMP, vy = vel[i * 3 + 1] * DAMP, vz = vel[i * 3 + 2] * DAMP;
+      const sp2 = vx * vx + vy * vy + vz * vz;
+      if (sp2 > 64) {
+        const k = 8 / Math.sqrt(sp2);
+        vx *= k;
+        vy *= k;
+        vz *= k;
+      }
+      vel[i * 3] = vx;
+      vel[i * 3 + 1] = vy;
+      vel[i * 3 + 2] = vz;
+      pos[i * 3] += vx;
+      pos[i * 3 + 1] += vy;
+      pos[i * 3 + 2] += vz;
+    }
+  }
+  let cx = 0, cy = 0, cz = 0;
+  for (let i = 0; i < n; i++) {
+    cx += pos[i * 3];
+    cy += pos[i * 3 + 1];
+    cz += pos[i * 3 + 2];
+  }
+  cx /= n;
+  cy /= n;
+  cz /= n;
+  let maxR = 0;
+  for (let i = 0; i < n; i++) {
+    const dx = pos[i * 3] - cx, dy = pos[i * 3 + 1] - cy, dz = pos[i * 3 + 2] - cz;
+    const r = Math.sqrt(dx * dx + dy * dy + dz * dz);
+    if (r > maxR)
+      maxR = r;
+  }
+  const scale = maxR > 1 ? 125 / maxR : 1;
+  for (let i = 0; i < n; i++) {
+    superNodes[i].position = [
+      (pos[i * 3] - cx) * scale,
+      (pos[i * 3 + 1] - cy) * scale,
+      (pos[i * 3 + 2] - cz) * scale
+    ];
+  }
+}
+function kMeans(flat, n, dims, k, maxIter = 50) {
+  if (n === 0 || dims === 0)
     return [];
-  const dims = vectors[0].length;
-  const centroids = [vectors[Math.floor(Math.random() * vectors.length)].slice()];
+  k = Math.max(1, Math.min(k, n));
+  const centroids = new Float32Array(k * dims);
+  centroids.set(flat.subarray(0, dims), 0);
+  const minDist = new Float64Array(n).fill(Infinity);
   for (let c = 1; c < k; c++) {
-    const dists = vectors.map((v) => {
-      let minD = Infinity;
-      for (const cent of centroids) {
-        const d = euclideanDist(v, cent);
-        if (d < minD)
-          minD = d;
-      }
-      return minD;
-    });
-    const totalDist = dists.reduce((a, b) => a + b, 0);
-    let r = Math.random() * totalDist;
-    for (let i = 0; i < dists.length; i++) {
-      r -= dists[i];
+    const ocPrev = (c - 1) * dims;
+    let total = 0;
+    for (let i = 0; i < n; i++) {
+      const oi = i * dims;
+      let d = 0;
+      for (let z = 0; z < dims; z++) {
+        const diff = flat[oi + z] - centroids[ocPrev + z];
+        d += diff * diff;
+      }
+      if (d < minDist[i])
+        minDist[i] = d;
+      total += minDist[i];
+    }
+    let r = Math.random() * total;
+    let pick = n - 1;
+    for (let i = 0; i < n; i++) {
+      r -= minDist[i];
       if (r <= 0) {
-        centroids.push(vectors[i].slice());
+        pick = i;
         break;
       }
     }
-    if (centroids.length <= c)
-      centroids.push(vectors[Math.floor(Math.random() * vectors.length)].slice());
+    centroids.set(flat.subarray(pick * dims, pick * dims + dims), c * dims);
   }
-  const assignments = new Array(vectors.length).fill(0);
+  const assignments = new Array(n).fill(0);
+  const sums = new Float64Array(k * dims);
+  const counts = new Uint32Array(k);
   for (let iter = 0; iter < maxIter; iter++) {
     let changed = false;
-    for (let i = 0; i < vectors.length; i++) {
+    for (let i = 0; i < n; i++) {
+      const oi = i * dims;
       let bestC = 0, bestD = Infinity;
       for (let c = 0; c < k; c++) {
-        const d = euclideanDist(vectors[i], centroids[c]);
+        const oc = c * dims;
+        let d = 0;
+        for (let z = 0; z < dims; z++) {
+          const diff = flat[oi + z] - centroids[oc + z];
+          d += diff * diff;
+        }
         if (d < bestD) {
           bestD = d;
           bestC = c;
@@ -1105,21 +1437,21 @@ function kMeans(vectors, k, maxIter = 50) {
     }
     if (!changed)
       break;
-    const sums = Array.from({ length: k }, () => new Float64Array(dims));
-    const counts = new Uint32Array(k);
-    for (let i = 0; i < vectors.length; i++) {
+    sums.fill(0);
+    counts.fill(0);
+    for (let i = 0; i < n; i++) {
       const c = assignments[i];
       counts[c]++;
-      const s = sums[c], v = vectors[i];
-      for (let d = 0; d < dims; d++)
-        s[d] += v[d];
+      const oi = i * dims, oc = c * dims;
+      for (let z = 0; z < dims; z++)
+        sums[oc + z] += flat[oi + z];
     }
     for (let c = 0; c < k; c++) {
       if (counts[c] === 0)
         continue;
-      const s = sums[c];
-      for (let d = 0; d < dims; d++)
-        centroids[c][d] = s[d] / counts[c];
+      const oc = c * dims;
+      for (let z = 0; z < dims; z++)
+        centroids[oc + z] = sums[oc + z] / counts[c];
     }
   }
   return assignments;
@@ -1128,7 +1460,6 @@ var CLUSTER_COLORS;
 var init_graph_data = __esm({
   "packages/core/dist/api/graph-data.js"() {
     "use strict";
-    init_math();
     CLUSTER_COLORS = [
       "#6366f1",
       "#ec4899",
@@ -1155,8 +1486,6 @@ __export(gap_detector_exports, {
   detectKnowledgeGaps: () => detectKnowledgeGaps
 });
 async function detectKnowledgeGaps(store, graphData) {
-  const docs = await store.getAllDocuments();
-  const embeddings = await store.getDocumentEmbeddings();
   let gd;
   if (!graphData) {
     const { buildGraphData: buildGraphData2 } = await Promise.resolve().then(() => (init_graph_data(), graph_data_exports));
@@ -1165,10 +1494,13 @@ async function detectKnowledgeGaps(store, graphData) {
     gd = graphData;
   }
   const { nodes, edges, clusters } = gd;
+  const nodeById = /* @__PURE__ */ new Map();
+  for (const n of nodes)
+    nodeById.set(n.id, n);
   const clusterEdges = /* @__PURE__ */ new Map();
   for (const edge of edges) {
-    const nodeA = nodes.find((n) => n.id === edge.source);
-    const nodeB = nodes.find((n) => n.id === edge.target);
+    const nodeA = nodeById.get(edge.source);
+    const nodeB = nodeById.get(edge.target);
     if (!nodeA || !nodeB || nodeA.clusterId === nodeB.clusterId)
       continue;
     const key = [
@@ -1229,10 +1561,10 @@ var ask_engine_exports = {};
 __export(ask_engine_exports, {
   askVault: () => askVault
 });
-import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, existsSync as existsSync4 } from "node:fs";
-import { join as join5, resolve as resolve5 } from "node:path";
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "node:fs";
+import { join as join6, resolve as resolve5 } from "node:path";
 async function askVault(searchEngine, question, options = {}) {
-  const { limit = 10, save = false, vaultPath, outputDir = "_stellavault/answers", mode = "default" } = options;
+  const { limit = 10, save = false, vaultPath, outputDir = "_stellavault/answers", mode = "default", synthesizer } = options;
   const results = await searchEngine.search({ query: question, limit });
   const sources = results.map((r) => ({
     title: r.document.title,
@@ -1240,7 +1572,16 @@ async function askVault(searchEngine, question, options = {}) {
     score: Math.round(r.score * 1e3) / 1e3,
     snippet: r.chunk?.content?.substring(0, 200) ?? ""
   }));
-  const answer = mode === "quotes" ? composeQuotes(question, results) : composeAnswer(question, results);
+  let answer;
+  if (synthesizer && results.length > 0 && mode !== "quotes") {
+    try {
+      answer = await synthesizer.synthesize({ question, sources, mode: "ask" });
+    } catch {
+      answer = composeAnswer(question, results);
+    }
+  } else {
+    answer = mode === "quotes" ? composeQuotes(question, results) : composeAnswer(question, results);
+  }
   let savedTo = null;
   if (save && vaultPath) {
     savedTo = saveAnswerToVault(question, answer, sources, vaultPath, outputDir);
@@ -1311,13 +1652,13 @@ function composeQuotes(question, results) {
 }
 function saveAnswerToVault(question, answer, sources, vaultPath, outputDir) {
   const dir = resolve5(vaultPath, outputDir);
-  if (!existsSync4(dir)) {
-    mkdirSync5(dir, { recursive: true });
+  if (!existsSync5(dir)) {
+    mkdirSync6(dir, { recursive: true });
   }
   const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const slug = question.toLowerCase().replace(/[^a-z0-9가-힣\s]/g, "").replace(/\s+/g, "-").substring(0, 60);
   const filename = `${date}-${slug}.md`;
-  const filePath = join5(outputDir, filename);
+  const filePath = join6(outputDir, filename);
   const fullPath = resolve5(vaultPath, filePath);
   if (!fullPath.startsWith(resolve5(vaultPath))) {
     throw new Error("Invalid output path");
@@ -1352,15 +1693,15 @@ __export(wiki_compiler_exports, {
   extractConcepts: () => extractConcepts,
   scanRawDirectory: () => scanRawDirectory
 });
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import { join as join6, resolve as resolve6, basename, extname as extname3 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync7, existsSync as existsSync6, statSync as statSync2 } from "node:fs";
+import { join as join7, resolve as resolve6, basename, extname as extname3 } from "node:path";
 function scanRawDirectory(rawPath) {
-  if (!existsSync5(rawPath))
+  if (!existsSync6(rawPath))
     return [];
   const docs = [];
   const files = readdirSync3(rawPath, { recursive: true });
   for (const file of files) {
-    const fullPath = join6(rawPath, file);
+    const fullPath = join7(rawPath, file);
     if (!statSync2(fullPath).isFile())
       continue;
     const ext = extname3(file).toLowerCase();
@@ -1420,8 +1761,8 @@ function compileWiki(rawPath, wikiPath, options = {}) {
   if (docs.length === 0) {
     return { rawDocCount: 0, wikiArticles: [], indexFile: "", concepts: [] };
   }
-  if (!existsSync5(wikiPath)) {
-    mkdirSync6(wikiPath, { recursive: true });
+  if (!existsSync6(wikiPath)) {
+    mkdirSync7(wikiPath, { recursive: true });
   }
   const concepts = extractConcepts(docs);
   const wikiArticles = [];
@@ -1542,9 +1883,9 @@ var init_wiki_compiler = __esm({
 
 // packages/core/dist/federation/identity.js
 import { createHash as createHash3, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
-import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join8 } from "node:path";
+import { chmodSync, existsSync as existsSync8, mkdirSync as mkdirSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join9 } from "node:path";
 function derivePeerId(publicKey) {
   return createHash3("sha256").update(publicKey).digest("hex").slice(0, 16);
 }
@@ -1562,7 +1903,7 @@ function generateIdentity(displayName) {
   };
 }
 function persistIdentity(identity) {
-  mkdirSync9(IDENTITY_DIR, { recursive: true });
+  mkdirSync10(IDENTITY_DIR, { recursive: true });
   const content = JSON.stringify({
     version: IDENTITY_VERSION,
     algorithm: IDENTITY_ALGORITHM,
@@ -1579,7 +1920,7 @@ function persistIdentity(identity) {
   }
 }
 function getOrCreateIdentity(displayName) {
-  if (existsSync7(IDENTITY_FILE)) {
+  if (existsSync8(IDENTITY_FILE)) {
     const raw = JSON.parse(readFileSync7(IDENTITY_FILE, "utf-8"));
     const isV2 = raw.version === IDENTITY_VERSION && raw.algorithm === IDENTITY_ALGORITHM;
     if (isV2) {
@@ -1618,8 +1959,8 @@ var IDENTITY_DIR, IDENTITY_FILE, IDENTITY_VERSION, IDENTITY_ALGORITHM;
 var init_identity = __esm({
   "packages/core/dist/federation/identity.js"() {
     "use strict";
-    IDENTITY_DIR = join8(homedir4(), ".stellavault", "federation");
-    IDENTITY_FILE = join8(IDENTITY_DIR, "identity.json");
+    IDENTITY_DIR = join9(homedir5(), ".stellavault", "federation");
+    IDENTITY_FILE = join9(IDENTITY_DIR, "identity.json");
     IDENTITY_VERSION = 2;
     IDENTITY_ALGORITHM = "ed25519";
   }
@@ -2088,18 +2429,18 @@ var init_privacy = __esm({
 });
 
 // packages/core/dist/federation/sharing.js
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync8, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join9 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync9, existsSync as existsSync9, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join10 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 function loadSharingConfig() {
-  if (existsSync8(SHARING_FILE)) {
+  if (existsSync9(SHARING_FILE)) {
     const raw = JSON.parse(readFileSync8(SHARING_FILE, "utf-8"));
     return { ...DEFAULT_CONFIG2, ...raw };
   }
   return { ...DEFAULT_CONFIG2 };
 }
 function saveSharingConfig(config) {
-  mkdirSync10(join9(homedir5(), ".stellavault", "federation"), { recursive: true });
+  mkdirSync11(join10(homedir6(), ".stellavault", "federation"), { recursive: true });
   writeFileSync9(SHARING_FILE, JSON.stringify(config, null, 2), "utf-8");
 }
 function getDocumentLevel(doc, config) {
@@ -2236,7 +2577,7 @@ var init_sharing = __esm({
       3: 5,
       4: 10
     };
-    SHARING_FILE = join9(homedir5(), ".stellavault", "federation", "sharing.json");
+    SHARING_FILE = join10(homedir6(), ".stellavault", "federation", "sharing.json");
     SENSITIVE_PATTERNS = [
       /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/,
       /\b\d{3}[-.]?\d{4}[-.]?\d{4}\b/,
@@ -2391,6 +2732,25 @@ var init_federation = __esm({
   }
 });
 
+// packages/core/dist/utils/math.js
+function cosineSimilarity(a, b) {
+  if (a.length !== b.length)
+    return 0;
+  let dot = 0, normA = 0, normB = 0;
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i];
+    normA += a[i] * a[i];
+    normB += b[i] * b[i];
+  }
+  const denom = Math.sqrt(normA) * Math.sqrt(normB);
+  return denom === 0 ? 0 : dot / denom;
+}
+var init_math = __esm({
+  "packages/core/dist/utils/math.js"() {
+    "use strict";
+  }
+});
+
 // packages/core/dist/intelligence/duplicate-detector.js
 var duplicate_detector_exports = {};
 __export(duplicate_detector_exports, {
@@ -2649,9 +3009,9 @@ async function extractTimedTranscriptFromHtml(html) {
 async function extractTimedTranscriptViaTool(videoId) {
   const { execSync: execSync3 } = await import("node:child_process");
   const { readdirSync: readdirSync9, readFileSync: readFileSync19, unlinkSync } = await import("node:fs");
-  const { join: join32 } = await import("node:path");
+  const { join: join33 } = await import("node:path");
   const tmpDir = (await import("node:os")).tmpdir();
-  const tmpBase = join32(tmpDir, `sv-sub-${videoId}`);
+  const tmpBase = join33(tmpDir, `sv-sub-${videoId}`);
   const url = `https://www.youtube.com/watch?v=${videoId}`;
   for (const lang of ["ko", "en"]) {
     try {
@@ -2662,10 +3022,10 @@ async function extractTimedTranscriptViaTool(videoId) {
     const files = readdirSync9(tmpDir).filter((f) => f.startsWith(`sv-sub-${videoId}`) && f.endsWith(".srv1"));
     if (files.length === 0)
       continue;
-    const xml = readFileSync19(join32(tmpDir, files[0]), "utf-8");
+    const xml = readFileSync19(join33(tmpDir, files[0]), "utf-8");
     for (const f of files) {
       try {
-        unlinkSync(join32(tmpDir, f));
+        unlinkSync(join33(tmpDir, f));
       } catch {
       }
     }
@@ -2860,18 +3220,18 @@ var init_youtube_extractor = __esm({
 });
 
 // packages/core/dist/intelligence/zettelkasten.js
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync10, existsSync as existsSync9, statSync as statSync3 } from "node:fs";
-import { join as join10, resolve as resolve8, extname as extname4 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync10, existsSync as existsSync10, statSync as statSync3 } from "node:fs";
+import { join as join11, resolve as resolve8, extname as extname4 } from "node:path";
 function scanFrontmatter(vaultPath, options) {
   const entries = [];
   const includeArchived = options?.includeArchived ?? false;
   function walkDir(dir, rel) {
-    if (!existsSync9(dir))
+    if (!existsSync10(dir))
       return;
     for (const name of readdirSync4(dir)) {
       if (name.startsWith(".") || name === "node_modules")
         continue;
-      const full = join10(dir, name);
+      const full = join11(dir, name);
       const relPath = rel ? `${rel}/${name}` : name;
       if (statSync3(full).isDirectory()) {
         walkDir(full, relPath);
@@ -2987,7 +3347,7 @@ function archiveFile(fullPath, vaultPath) {
   if (vaultPath && !resolved.startsWith(resolve8(vaultPath))) {
     throw new Error("Path traversal detected: file outside vault");
   }
-  if (!existsSync9(resolved))
+  if (!existsSync10(resolved))
     throw new Error(`File not found: ${fullPath}`);
   const content = readFileSync9(resolved, "utf-8");
   if (content.startsWith("---\n")) {
@@ -3008,20 +3368,20 @@ var init_zettelkasten = __esm({
 });
 
 // packages/core/dist/intelligence/auto-linker.js
-import { readdirSync as readdirSync5, readFileSync as readFileSync10, existsSync as existsSync10 } from "node:fs";
-import { join as join11, resolve as resolve9, extname as extname5 } from "node:path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync10, existsSync as existsSync11 } from "node:fs";
+import { join as join12, resolve as resolve9, extname as extname5 } from "node:path";
 function collectVaultTitles(vaultPath, folders = DEFAULT_FOLDERS) {
   const titles = /* @__PURE__ */ new Set();
   const dirs = [folders.fleeting, folders.literature, folders.permanent, folders.wiki, "_drafts"];
   for (const dir of dirs) {
     const fullDir = resolve9(vaultPath, dir);
-    if (!existsSync10(fullDir))
+    if (!existsSync11(fullDir))
       continue;
     try {
       const files = readdirSync5(fullDir).filter((f) => extname5(f) === ".md");
       for (const file of files) {
         try {
-          const content = readFileSync10(join11(fullDir, file), "utf-8");
+          const content = readFileSync10(join12(fullDir, file), "utf-8");
           const titleMatch = content.match(/^title:\s*"?([^"\n]+)"?\s*$/m);
           if (titleMatch && titleMatch[1].length > 2) {
             titles.add(titleMatch[1].trim());
@@ -3115,8 +3475,8 @@ __export(ingest_pipeline_exports, {
   ingestBatch: () => ingestBatch,
   promoteNote: () => promoteNote
 });
-import { writeFileSync as writeFileSync11, mkdirSync as mkdirSync11, existsSync as existsSync11, readFileSync as readFileSync11 } from "node:fs";
-import { join as join12, resolve as resolve10, basename as basename2 } from "node:path";
+import { writeFileSync as writeFileSync11, mkdirSync as mkdirSync12, existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
+import { join as join13, resolve as resolve10, basename as basename2 } from "node:path";
 function decodeHtmlEntities(text) {
   return text.replace(/&#39;/g, "'").replace(/&#x27;/g, "'").replace(/&quot;/g, '"').replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&nbsp;/g, " ");
 }
@@ -3138,13 +3498,13 @@ function ingest(vaultPath, input, folders = DEFAULT_FOLDERS) {
   };
   const folder = folderMap[autoStage];
   const dir = resolve10(vaultPath, folder);
-  if (!existsSync11(dir))
-    mkdirSync11(dir, { recursive: true });
+  if (!existsSync12(dir))
+    mkdirSync12(dir, { recursive: true });
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const slug = title.slice(0, 50).replace(/[^a-zA-Z0-9가-힣\s]/g, "").replace(/\s+/g, "-").toLowerCase();
   const filename = `${timestamp}-${slug}.md`;
-  const filePath = join12(folder, filename);
+  const filePath = join13(folder, filename);
   const fullPath = resolve10(vaultPath, filePath);
   if (!fullPath.startsWith(resolve10(vaultPath))) {
     throw new Error("Invalid path");
@@ -3182,7 +3542,7 @@ function ingest(vaultPath, input, folders = DEFAULT_FOLDERS) {
   try {
     const rawDir = resolve10(vaultPath, folders.fleeting);
     const wikiDir = resolve10(vaultPath, folders.wiki);
-    if (existsSync11(rawDir)) {
+    if (existsSync12(rawDir)) {
       compileWiki(rawDir, wikiDir);
     }
   } catch (err) {
@@ -3202,7 +3562,7 @@ function ingestBatch(vaultPath, inputs) {
 }
 function promoteNote(vaultPath, filePath, targetStage, folders = DEFAULT_FOLDERS) {
   const fullPath = resolve10(vaultPath, filePath);
-  if (!existsSync11(fullPath))
+  if (!existsSync12(fullPath))
     throw new Error(`File not found: ${filePath}`);
   const content = readFileSync11(fullPath, "utf-8");
   const updated = content.replace(/^type:\s*.+$/m, `type: ${targetStage}`);
@@ -3212,9 +3572,9 @@ function promoteNote(vaultPath, filePath, targetStage, folders = DEFAULT_FOLDERS
     permanent: folders.permanent
   };
   const newDir = resolve10(vaultPath, folderMap[targetStage]);
-  if (!existsSync11(newDir))
-    mkdirSync11(newDir, { recursive: true });
-  const newPath = join12(folderMap[targetStage], basename2(filePath));
+  if (!existsSync12(newDir))
+    mkdirSync12(newDir, { recursive: true });
+  const newPath = join13(folderMap[targetStage], basename2(filePath));
   const newFullPath = resolve10(vaultPath, newPath);
   if (!newFullPath.startsWith(resolve10(vaultPath))) {
     throw new Error("Invalid path");
@@ -3640,14 +4000,14 @@ var init_file_extractors = __esm({
 
 // packages/cli/dist/mcp-clients.js
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync16, readFileSync as readFileSync15, writeFileSync as writeFileSync16 } from "node:fs";
-import { dirname as dirname4, join as join21 } from "node:path";
-import { homedir as homedir13 } from "node:os";
+import { existsSync as existsSync16, mkdirSync as mkdirSync17, readFileSync as readFileSync15, writeFileSync as writeFileSync16 } from "node:fs";
+import { dirname as dirname4, join as join22 } from "node:path";
+import { homedir as homedir14 } from "node:os";
 function appData() {
-  return process.env.APPDATA ?? join21(homedir13(), "AppData", "Roaming");
+  return process.env.APPDATA ?? join22(homedir14(), "AppData", "Roaming");
 }
 function xdgConfig() {
-  return process.env.XDG_CONFIG_HOME ?? join21(homedir13(), ".config");
+  return process.env.XDG_CONFIG_HOME ?? join22(homedir14(), ".config");
 }
 function resolveServeCommand(override) {
   if (override?.command) {
@@ -3660,26 +4020,26 @@ function resolveServeCommand(override) {
 }
 function claudeDesktopPath() {
   if (isWin)
-    return join21(appData(), "Claude", "claude_desktop_config.json");
+    return join22(appData(), "Claude", "claude_desktop_config.json");
   if (isMac)
-    return join21(homedir13(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
-  return join21(xdgConfig(), "Claude", "claude_desktop_config.json");
+    return join22(homedir14(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  return join22(xdgConfig(), "Claude", "claude_desktop_config.json");
 }
 function vscodePath() {
   if (isWin)
-    return join21(appData(), "Code", "User", "mcp.json");
+    return join22(appData(), "Code", "User", "mcp.json");
   if (isMac)
-    return join21(homedir13(), "Library", "Application Support", "Code", "User", "mcp.json");
-  return join21(xdgConfig(), "Code", "User", "mcp.json");
+    return join22(homedir14(), "Library", "Application Support", "Code", "User", "mcp.json");
+  return join22(xdgConfig(), "Code", "User", "mcp.json");
 }
 function isDetected(client) {
-  return existsSync15(client.detectDir);
+  return existsSync16(client.detectDir);
 }
 function writeClientConfig(client, serve) {
   const path = client.configPath;
   try {
     let json = {};
-    if (existsSync15(path)) {
+    if (existsSync16(path)) {
       const raw = readFileSync15(path, "utf-8").trim();
       if (raw)
         json = JSON.parse(raw);
@@ -3689,7 +4049,7 @@ function writeClientConfig(client, serve) {
       json[key] = {};
     const already = Boolean(json[key].stellavault);
     json[key].stellavault = client.needsType ? { type: "stdio", command: serve.command, args: serve.args } : { command: serve.command, args: serve.args };
-    mkdirSync16(dirname4(path), { recursive: true });
+    mkdirSync17(dirname4(path), { recursive: true });
     writeFileSync16(path, JSON.stringify(json, null, 2) + "\n", "utf-8");
     return { client: client.label, status: already ? "updated" : "written", path };
   } catch (err) {
@@ -3733,16 +4093,16 @@ var init_mcp_clients = __esm({
       {
         id: "cursor",
         label: "Cursor",
-        configPath: join21(homedir13(), ".cursor", "mcp.json"),
-        detectDir: join21(homedir13(), ".cursor"),
+        configPath: join22(homedir14(), ".cursor", "mcp.json"),
+        detectDir: join22(homedir14(), ".cursor"),
         serversKey: "mcpServers",
         needsType: false
       },
       {
         id: "windsurf",
         label: "Windsurf",
-        configPath: join21(homedir13(), ".codeium", "windsurf", "mcp_config.json"),
-        detectDir: join21(homedir13(), ".codeium"),
+        configPath: join22(homedir14(), ".codeium", "windsurf", "mcp_config.json"),
+        detectDir: join22(homedir14(), ".codeium"),
         serversKey: "mcpServers",
         needsType: false
       },
@@ -3766,14 +4126,14 @@ __export(setup_cmd_exports, {
   setupCommand: () => setupCommand
 });
 import chalk4 from "chalk";
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join22 } from "node:path";
-import { homedir as homedir14 } from "node:os";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join23 } from "node:path";
+import { homedir as homedir15 } from "node:os";
 async function setupCommand(options) {
   console.log("");
   console.log(chalk4.bold("  \u2726 Stellavault \u2014 Connect to your AI clients"));
   console.log(chalk4.dim("  Registering Stellavault as an MCP server.\n"));
-  if (!existsSync16(join22(homedir14(), ".stellavault.json"))) {
+  if (!existsSync17(join23(homedir15(), ".stellavault.json"))) {
     console.log(chalk4.yellow("  \u26A0 No config found. Run ") + chalk4.cyan("stellavault init") + chalk4.yellow(" first to index your vault.\n"));
   }
   const serve = resolveServeCommand({ command: options.command, args: options.args });
@@ -3835,9 +4195,9 @@ import ora from "ora";
 import chalk from "chalk";
 import { createHash as createHash7 } from "node:crypto";
 import { writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join20 } from "node:path";
-import { homedir as homedir12 } from "node:os";
-import { mkdirSync as mkdirSync15 } from "node:fs";
+import { join as join21 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { mkdirSync as mkdirSync16 } from "node:fs";
 
 // packages/core/dist/index.js
 init_config();
@@ -3847,13 +4207,21 @@ import Database from "better-sqlite3";
 import * as sqliteVec from "sqlite-vec";
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
+function loadVecExtension(db) {
+  const loadablePath = sqliteVec.getLoadablePath();
+  if (/\.asar[\\/]/.test(loadablePath)) {
+    db.loadExtension(loadablePath.replace(/\.asar([\\/])/, ".asar.unpacked$1"));
+  } else {
+    sqliteVec.load(db);
+  }
+}
 function createSqliteVecStore(dbPath, dimensions = 384) {
   let db;
   return {
     async initialize() {
       mkdirSync(dirname(dbPath), { recursive: true });
       db = new Database(dbPath);
-      sqliteVec.load(db);
+      loadVecExtension(db);
       db.pragma("journal_mode = WAL");
       db.pragma("foreign_keys = ON");
       createTables(db, dimensions);
@@ -3989,6 +4357,19 @@ function createSqliteVecStore(dbPath, dimensions = 384) {
       const rows = db.prepare("SELECT * FROM documents ORDER BY last_modified DESC").all();
       return rows.map(rowToDocument);
     },
+    async getDocumentsMeta(maxDocs) {
+      const lim = typeof maxDocs === "number" && Number.isFinite(maxDocs) && maxDocs > 0 ? Math.floor(maxDocs) : 0;
+      const sql = "SELECT id, file_path, title, frontmatter, tags, last_modified FROM documents ORDER BY last_modified DESC" + (lim > 0 ? ` LIMIT ${lim}` : "");
+      const rows = db.prepare(sql).all();
+      return rows.map((r) => ({
+        id: r.id,
+        filePath: r.file_path,
+        title: r.title,
+        frontmatter: JSON.parse(r.frontmatter || "{}"),
+        tags: JSON.parse(r.tags || "[]"),
+        lastModified: r.last_modified
+      }));
+    },
     async getTopics() {
       const rows = db.prepare(`
         SELECT je.value as tag, COUNT(DISTINCT d.id) as count
@@ -4015,23 +4396,38 @@ function createSqliteVecStore(dbPath, dimensions = 384) {
       };
     },
     async getDocumentEmbeddings(maxDocs = 1e4) {
-      const BATCH_SIZE = 500;
       const result = /* @__PURE__ */ new Map();
-      const stmt = db.prepare(`
-        SELECT c.document_id, ce.embedding
+      const rows = db.prepare(`
+        SELECT c.document_id AS document_id, ce.embedding AS embedding
         FROM chunks c
         JOIN chunk_embeddings ce ON ce.chunk_id = c.id
-        WHERE c.id IN (
-          SELECT MIN(id) FROM chunks GROUP BY document_id
-        )
-        LIMIT ? OFFSET ?
-      `);
-      for (let offset = 0; offset < maxDocs; offset += BATCH_SIZE) {
-        const rows = stmt.all(Math.min(BATCH_SIZE, maxDocs - offset), offset);
-        if (rows.length === 0)
-          break;
-        for (const row of rows) {
-          result.set(row.document_id, bufferToFloat32(row.embedding));
+        WHERE c.id IN (SELECT MIN(id) FROM chunks GROUP BY document_id)
+        LIMIT ?
+      `).all(maxDocs);
+      for (const row of rows) {
+        result.set(row.document_id, bufferToFloat32(row.embedding));
+      }
+      return result;
+    },
+    async getDocumentEmbeddingsByIds(documentIds) {
+      const result = /* @__PURE__ */ new Map();
+      if (documentIds.length === 0)
+        return result;
+      const CHUNK = 800;
+      for (let off = 0; off < documentIds.length; off += CHUNK) {
+        const slice = documentIds.slice(off, off + CHUNK);
+        const ph = slice.map(() => "?").join(",");
+        const cidRows = db.prepare(`SELECT document_id AS d, MIN(id) AS cid FROM chunks WHERE document_id IN (${ph}) GROUP BY document_id`).all(...slice);
+        if (cidRows.length === 0)
+          continue;
+        const docByCid = new Map(cidRows.map((r) => [String(r.cid), r.d]));
+        const cids = cidRows.map((r) => r.cid);
+        const ph2 = cids.map(() => "?").join(",");
+        const embRows = db.prepare(`SELECT chunk_id AS cid, embedding FROM chunk_embeddings WHERE chunk_id IN (${ph2})`).all(...cids);
+        for (const row of embRows) {
+          const docId = docByCid.get(String(row.cid));
+          if (docId)
+            result.set(docId, bufferToFloat32(row.embedding));
         }
       }
       return result;
@@ -4583,10 +4979,10 @@ async function handleGenerateClaudeMd(searchEngine, store, args) {
 }
 
 // packages/core/dist/mcp/tools/snapshot.js
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join3, resolve as resolve2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
-var SNAPSHOT_DIR = join3(homedir2(), ".stellavault", "snapshots");
+import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join4, resolve as resolve2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+var SNAPSHOT_DIR = join4(homedir3(), ".stellavault", "snapshots");
 function sanitizeName(name) {
   const sanitized = name.replace(/[^a-zA-Z0-9가-힣_-]/g, "");
   if (!sanitized)
@@ -4624,7 +5020,7 @@ var loadSnapshotToolDef = {
   }
 };
 async function handleCreateSnapshot(searchEngine, args) {
-  mkdirSync2(SNAPSHOT_DIR, { recursive: true });
+  mkdirSync3(SNAPSHOT_DIR, { recursive: true });
   const results = [];
   for (const query of args.queries) {
     const hits = await searchEngine.search({ query, limit: 5 });
@@ -4659,15 +5055,15 @@ async function handleCreateSnapshot(searchEngine, args) {
 async function handleLoadSnapshot(args) {
   const safeName = sanitizeName(args.name);
   const filePath = ensureWithinDir(SNAPSHOT_DIR, `${safeName}.json`);
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     return { error: `Snapshot not found: ${args.name}` };
   }
   return JSON.parse(readFileSync3(filePath, "utf-8"));
 }
 
 // packages/core/dist/mcp/tools/decision-journal.js
-import { writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
+import { join as join5, resolve as resolve3 } from "node:path";
 var logDecisionToolDef = {
   name: "log-decision",
   description: '\uAE30\uC220\uC801 \uACB0\uC815\uC744 \uAD6C\uC870\uD654\uD558\uC5EC \uAE30\uB85D\uD569\uB2C8\uB2E4. \uB098\uC911\uC5D0 "\uC65C \uC774 \uC120\uD0DD\uC744 \uD588\uC9C0?"\uC5D0 \uB2F5\uBCC0\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4.',
@@ -4696,8 +5092,8 @@ var findDecisionsToolDef = {
   }
 };
 async function handleLogDecision(vaultPath, args) {
-  const decisionsDir = join4(vaultPath, "decisions");
-  mkdirSync3(decisionsDir, { recursive: true });
+  const decisionsDir = join5(vaultPath, "decisions");
+  mkdirSync4(decisionsDir, { recursive: true });
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const slug = args.title.replace(/[^a-zA-Z가-힣0-9\s-]/g, "").replace(/\s+/g, "-").slice(0, 50);
   if (!slug)
@@ -4738,13 +5134,13 @@ ${args.reasoning}
   return { saved: filePath, fileName };
 }
 async function handleFindDecisions(vaultPath, args) {
-  const decisionsDir = join4(vaultPath, "decisions");
-  if (!existsSync3(decisionsDir))
+  const decisionsDir = join5(vaultPath, "decisions");
+  if (!existsSync4(decisionsDir))
     return { decisions: [], message: "No decisions directory" };
   const files = readdirSync2(decisionsDir).filter((f) => f.endsWith(".md"));
   const query = args.query.toLowerCase();
   const matches = files.map((f) => {
-    const content = readFileSync4(join4(decisionsDir, f), "utf-8");
+    const content = readFileSync4(join5(decisionsDir, f), "utf-8");
     const score = content.toLowerCase().includes(query) ? 1 : 0;
     return { file: f, content: content.slice(0, 300), score };
   }).filter((m) => m.score > 0).slice(0, 10);
@@ -4752,11 +5148,11 @@ async function handleFindDecisions(vaultPath, args) {
 }
 
 // packages/core/dist/mcp/tools/export.js
-import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "node:fs";
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname2, resolve as resolve4 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 var ALLOWED_EXPORT_DIRS = [
-  resolve4(homedir3(), ".stellavault"),
+  resolve4(homedir4(), ".stellavault"),
   resolve4(".")
 ];
 function validateExportPath(outputPath) {
@@ -4784,7 +5180,7 @@ async function handleExport(store, args) {
   const stats = await store.getStats();
   const topics = await store.getTopics();
   const safePath = validateExportPath(args.outputPath);
-  mkdirSync4(dirname2(safePath), { recursive: true });
+  mkdirSync5(dirname2(safePath), { recursive: true });
   if (args.format === "csv") {
     const header = "id,filePath,title,tags,lastModified,contentHash";
     const rows = docs.map((d) => `"${d.id}","${d.filePath}","${d.title.replace(/"/g, '""')}","${d.tags.join(";")}","${d.lastModified}","${d.contentHash}"`);
@@ -4901,6 +5297,17 @@ function updateStability(currentS, difficulty, currentR) {
   const newS = currentS * (1 + Math.max(0, growth));
   return Math.min(newS, 365);
 }
+function updateStabilityGraded(currentS, difficulty, currentR, grade) {
+  if (grade === 1) {
+    const postLapse = FSRS_PARAMS.initialStability * 0.2 * Math.pow(difficulty, -FSRS_PARAMS.b);
+    return Math.max(0.1, Math.min(postLapse, currentS));
+  }
+  const good = updateStability(currentS, difficulty, currentR);
+  const baseGrowth = good - currentS;
+  const gradeFactor = grade === 2 ? 0.5 : grade === 4 ? 1.8 : 1;
+  const newS = currentS + baseGrowth * gradeFactor;
+  return Math.min(newS, 365);
+}
 function estimateInitialStability(contentLength, connectionCount) {
   const base = FSRS_PARAMS.initialStability;
   const sizeBonus = Math.min(contentLength / 1e3, 10) * FSRS_PARAMS.sizeFactor;
@@ -4956,7 +5363,7 @@ var DecayEngine = class {
     if (existing) {
       const elapsed = elapsedDays(existing.last_access, now);
       const currentR = computeRetrievability(existing.stability, elapsed);
-      const newS = updateStability(existing.stability, existing.difficulty, currentR);
+      const newS = event.grade ? updateStabilityGraded(existing.stability, existing.difficulty, currentR, event.grade) : updateStability(existing.stability, existing.difficulty, currentR);
       this.db.prepare(`
         UPDATE decay_state SET stability = ?, last_access = ?, retrievability = 1.0, updated_at = ?
         WHERE document_id = ?
@@ -5040,22 +5447,19 @@ var DecayEngine = class {
    * Get documents below decay threshold.
    */
   async getDecaying(threshold = 0.5, limit = 20) {
-    await this.computeAll();
     const rows = this.db.prepare(`
       SELECT ds.*, d.title FROM decay_state ds
       JOIN documents d ON d.id = ds.document_id
-      WHERE ds.retrievability < ?
-      ORDER BY ds.retrievability ASC
-      LIMIT ?
-    `).all(threshold, limit);
+    `).all();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
     return rows.map((r) => ({
       documentId: r.document_id,
       stability: r.stability,
       difficulty: r.difficulty,
       lastAccess: r.last_access,
-      retrievability: r.retrievability,
+      retrievability: computeRetrievability(r.stability, elapsedDays(r.last_access, now)),
       title: r.title
-    }));
+    })).filter((r) => r.retrievability < threshold).sort((a, b) => a.retrievability - b.retrievability).slice(0, limit);
   }
   /**
    * Design Ref: §B3.3.3 — read-only live retrievability for a set of documents.
@@ -5277,14 +5681,34 @@ function invalidateGapCache(db) {
   } catch {
   }
 }
+var EMPTY_REPORT = { totalClusters: 0, totalGaps: 0, gaps: [], isolatedNodes: [] };
+function readAnyCachedGapReport(db) {
+  try {
+    ensureGapCacheTable(db);
+    const row = db.prepare("SELECT * FROM gap_cache WHERE id = 1").get();
+    if (!row || row.version !== CACHE_VERSION)
+      return null;
+    return JSON.parse(row.payload);
+  } catch {
+    return null;
+  }
+}
+function triggerBackgroundCompute(store, db) {
+  void computeAndCacheGaps(store, db).catch((err) => {
+    console.warn("[gap-cache] background recompute failed:", err?.message ?? err);
+  });
+}
 async function getGapReport(store, db, opts = {}) {
   if (!opts.forceRefresh) {
-    const cached = readCachedGapReport(db, opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS);
-    if (cached)
-      return { report: cached, fromCache: true };
+    const fresh = readCachedGapReport(db, opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS);
+    if (fresh)
+      return { report: fresh, fromCache: true, computing: false };
   }
-  const fresh = await computeAndCacheGaps(store, db);
-  return { report: fresh, fromCache: false };
+  triggerBackgroundCompute(store, db);
+  const stale = readAnyCachedGapReport(db);
+  if (stale)
+    return { report: stale, fromCache: true, computing: true };
+  return { report: EMPTY_REPORT, fromCache: false, computing: true };
 }
 
 // packages/core/dist/mcp/tools/detect-gaps.js
@@ -5309,7 +5733,7 @@ function createDetectGapsTool(store, getDb) {
     handler: async (args) => {
       const minSeverity = args.minSeverity ?? "medium";
       const db = getDb();
-      const { report, fromCache } = await getGapReport(store, db, { forceRefresh: args.forceRefresh });
+      const { report, fromCache, computing } = await getGapReport(store, db, { forceRefresh: args.forceRefresh });
       const sevOrder = { high: 0, medium: 1, low: 2 };
       const threshold = sevOrder[minSeverity] ?? 1;
       const filtered = report.gaps.filter((g) => sevOrder[g.severity] <= threshold);
@@ -5327,8 +5751,8 @@ function createDetectGapsTool(store, getDb) {
               suggestedTopic: g.suggestedTopic
             })),
             isolatedNodes: report.isolatedNodes.slice(0, 10),
-            suggestion: filtered.length > 0 ? `${filtered[0].suggestedTopic} \uC8FC\uC81C\uB85C \uB178\uD2B8\uB97C \uC791\uC131\uD558\uBA74 \uC9C0\uC2DD \uAC2D\uC744 \uC904\uC77C \uC218 \uC788\uC2B5\uB2C8\uB2E4.` : "\uD604\uC7AC \uC2EC\uAC01\uD55C \uC9C0\uC2DD \uAC2D\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.",
-            cacheStatus: fromCache ? "cached" : "fresh"
+            suggestion: computing ? "\uAC2D \uBD84\uC11D\uC744 \uBC31\uADF8\uB77C\uC6B4\uB4DC\uC5D0\uC11C \uC7AC\uACC4\uC0B0 \uC911\uC785\uB2C8\uB2E4. \uC7A0\uC2DC \uD6C4 \uB2E4\uC2DC \uD638\uCD9C\uD558\uBA74 \uCD5C\uC2E0 \uACB0\uACFC\uAC00 \uB098\uC635\uB2C8\uB2E4." : filtered.length > 0 ? `${filtered[0].suggestedTopic} \uC8FC\uC81C\uB85C \uB178\uD2B8\uB97C \uC791\uC131\uD558\uBA74 \uC9C0\uC2DD \uAC2D\uC744 \uC904\uC77C \uC218 \uC788\uC2B5\uB2C8\uB2E4.` : "\uD604\uC7AC \uC2EC\uAC01\uD55C \uC9C0\uC2DD \uAC2D\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.",
+            cacheStatus: computing ? fromCache ? "stale (recomputing in background)" : "computing in background" : fromCache ? "cached" : "fresh"
           }, null, 2)
         }]
       };
@@ -5546,7 +5970,7 @@ function createAskTool(searchEngine, vaultPath) {
 init_wiki_compiler();
 init_config();
 import { resolve as resolve7 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 function createGenerateDraftTool(searchEngine, vaultPath) {
   return {
     name: "generate-draft",
@@ -5589,7 +6013,7 @@ function createGenerateDraftTool(searchEngine, vaultPath) {
       const allDocs = [];
       for (const dir of [folders.fleeting, folders.literature, folders.permanent, folders.wiki]) {
         const fullDir = resolve7(vaultPath, dir);
-        if (existsSync6(fullDir)) {
+        if (existsSync7(fullDir)) {
           const docs = scanRawDirectory(fullDir);
           allDocs.push(...docs);
         }
@@ -5645,8 +6069,8 @@ Please write the ${format} draft based on the context above. Save the result to
 }
 
 // packages/core/dist/mcp/tools/agentic-graph.js
-import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join7, resolve as resolvePath } from "node:path";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync8 } from "node:fs";
+import { join as join8, resolve as resolvePath } from "node:path";
 function createAgenticGraphTools(store, embedder, vaultPath) {
   let nodeCreationCount = 0;
   let nodeCreationWindowStart = Date.now();
@@ -5717,14 +6141,14 @@ function createAgenticGraphTools(store, embedder, vaultPath) {
 
 ${content}${relatedSection}`;
         const safeTitle = title.replace(/[<>:"/\\|?*]/g, "").replace(/\s+/g, " ").trim().slice(0, 80);
-        const dir = join7(vaultPath, folder);
-        const filePath = join7(dir, `${safeTitle}.md`);
+        const dir = join8(vaultPath, folder);
+        const filePath = join8(dir, `${safeTitle}.md`);
         const resolvedPath = resolvePath(filePath);
         const resolvedVault = resolvePath(vaultPath);
         if (!resolvedPath.startsWith(resolvedVault)) {
           return { content: [{ type: "text", text: "Error: invalid folder path." }] };
         }
-        mkdirSync7(dir, { recursive: true });
+        mkdirSync8(dir, { recursive: true });
         writeFileSync6(filePath, fullContent, "utf-8");
         const relatedCount = relatedSection ? relatedSection.split("\n").filter((l) => l.startsWith("- ")).length : 0;
         return {
@@ -5759,7 +6183,7 @@ The note will appear in the graph after next index.`
           return { content: [{ type: "text", text: `Source note "${args.sourceTitle}" not found.` }] };
         }
         const { readFileSync: readFileSync19 } = await import("node:fs");
-        const fullPath = join7(vaultPath, source.filePath);
+        const fullPath = join8(vaultPath, source.filePath);
         let existing = "";
         try {
           existing = readFileSync19(fullPath, "utf-8");
@@ -5821,6 +6245,14 @@ function createMcpServer(options) {
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     await ready;
     const { name, arguments: args } = request.params;
+    if (options.onToolCall) {
+      try {
+        const a = args ?? {};
+        const detail = String(a.query ?? a.topic ?? a.title ?? a.documentId ?? a.id ?? "").slice(0, 80);
+        options.onToolCall({ tool: name, detail });
+      } catch {
+      }
+    }
     try {
       let result;
       switch (name) {
@@ -5919,6 +6351,9 @@ function createMcpServer(options) {
       const transport = new StdioServerTransport();
       await server.connect(transport);
     },
+    // T3-3: returns a closable handle ({ port, close }) so an embedding host (the
+    // desktop "Agent Memory" toggle) can stop the server. Backward compatible —
+    // callers that ignore the return value are unaffected.
     async startHttp(port = 3334) {
       const { createServer } = await import("node:http");
       const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => `sv-${Date.now()}` });
@@ -5944,9 +6379,22 @@ function createMcpServer(options) {
         }
         await transport.handleRequest(req, res);
       });
-      httpServer.listen(port, "127.0.0.1", () => {
-        console.error(`\u{1F50C} MCP HTTP server running at http://127.0.0.1:${port}/mcp`);
+      await new Promise((resolveListen, rejectListen) => {
+        httpServer.once("error", rejectListen);
+        httpServer.listen(port, "127.0.0.1", () => {
+          httpServer.removeListener("error", rejectListen);
+          console.error(`\u{1F50C} MCP HTTP server running at http://127.0.0.1:${port}/mcp`);
+          resolveListen();
+        });
       });
+      return {
+        port,
+        close: () => new Promise((resolveClose) => {
+          httpServer.close(() => resolveClose());
+          void server.close().catch(() => {
+          });
+        })
+      };
     },
     server
   };
@@ -6074,10 +6522,10 @@ function extractPackTags(chunks) {
 }
 
 // packages/core/dist/pack/exporter.js
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync8 } from "node:fs";
+import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync9 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
 function exportPack(pack2, outputPath) {
-  mkdirSync8(dirname3(outputPath), { recursive: true });
+  mkdirSync9(dirname3(outputPath), { recursive: true });
   writeFileSync7(outputPath, JSON.stringify(pack2, null, 2), "utf-8");
 }
 function packToSummary(pack2) {
@@ -6300,10 +6748,10 @@ function createKnowledgeRouter(opts) {
         return;
       }
       const { readFileSync: readFileSync19, writeFileSync: writeFileSync23, unlinkSync } = await import("node:fs");
-      const { join: join32, resolve: resolve22 } = await import("node:path");
+      const { join: join33, resolve: resolve22 } = await import("node:path");
       const [keeper, removed] = docA.content.length >= docB.content.length ? [docA, docB] : [docB, docA];
-      const keeperPath = resolve22(join32(vaultPath, keeper.filePath));
-      const removedPath = resolve22(join32(vaultPath, removed.filePath));
+      const keeperPath = resolve22(join33(vaultPath, keeper.filePath));
+      const removedPath = resolve22(join33(vaultPath, removed.filePath));
       const vaultRoot = resolve22(vaultPath);
       if (!keeperPath.startsWith(vaultRoot) || !removedPath.startsWith(vaultRoot)) {
         res.status(400).json({ error: "Invalid file path" });
@@ -6340,8 +6788,8 @@ ${removed.content}`;
         res.status(400).json({ error: "clusterA, clusterB required" });
         return;
       }
-      const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync23 } = await import("node:fs");
-      const { join: join32, resolve: resolve22 } = await import("node:path");
+      const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync24 } = await import("node:fs");
+      const { join: join33, resolve: resolve22 } = await import("node:path");
       const nameA = clusterA.replace(/\s*\(\d+\)$/, "");
       const nameB = clusterB.replace(/\s*\(\d+\)$/, "");
       const resultsA = await searchEngine.search({ query: nameA, limit: 3 });
@@ -6381,13 +6829,13 @@ ${removed.content}`;
         ""
       ].join("\n");
       const safeTitle = title.replace(/[<>:"/\\|?*]/g, "").replace(/\s+/g, " ");
-      const dir = resolve22(join32(vaultPath, "01_Knowledge"));
+      const dir = resolve22(join33(vaultPath, "01_Knowledge"));
       if (!dir.startsWith(resolve22(vaultPath))) {
         res.status(400).json({ error: "Invalid path" });
         return;
       }
-      mkdirSync23(dir, { recursive: true });
-      const filePath = join32(dir, `${safeTitle}.md`);
+      mkdirSync24(dir, { recursive: true });
+      const filePath = join33(dir, `${safeTitle}.md`);
       writeFileSync23(filePath, content, "utf-8");
       res.json({ success: true, title: safeTitle, path: filePath });
     } catch (err) {
@@ -6402,7 +6850,7 @@ ${removed.content}`;
 import { Router as Router3 } from "express";
 import { createHash as createHash5 } from "node:crypto";
 function createIngestRouter(opts) {
-  const { store, vaultPath, requireAuth, assertNotPrivateUrl } = opts;
+  const { store, vaultPath, requireAuth, assertPublicUrl: assertPublicUrl2 } = opts;
   const router = Router3();
   router.post("/ingest", requireAuth, async (req, res) => {
     try {
@@ -6419,6 +6867,14 @@ function createIngestRouter(opts) {
       let autoTitle = title;
       let autoTags = tags ?? [];
       let autoStage = stage ?? "fleeting";
+      if (input.startsWith("http")) {
+        try {
+          await assertPublicUrl2(input);
+        } catch (e) {
+          res.status(400).json({ error: e.message });
+          return;
+        }
+      }
       const isYouTube = /youtube\.com\/watch|youtu\.be\//.test(input);
       if (isYouTube) {
         try {
@@ -6442,12 +6898,6 @@ function createIngestRouter(opts) {
           }
         }
       } else if (input.startsWith("http")) {
-        try {
-          assertNotPrivateUrl(input);
-        } catch (e) {
-          res.status(400).json({ error: e.message });
-          return;
-        }
         try {
           const resp = await fetch(input, { signal: AbortSignal.timeout(8e3) });
           const html = await resp.text();
@@ -6539,10 +6989,10 @@ function createIngestRouter(opts) {
         }
         try {
           const { writeFileSync: writeFileSync23, unlinkSync } = await import("node:fs");
-          const { join: join32 } = await import("node:path");
+          const { join: join33 } = await import("node:path");
           const { tmpdir } = await import("node:os");
           const safeName = (file.originalname ?? "upload").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 100);
-          const tmpPath = join32(tmpdir(), `sv-upload-${Date.now()}-${safeName}`);
+          const tmpPath = join33(tmpdir(), `sv-upload-${Date.now()}-${safeName}`);
           writeFileSync23(tmpPath, file.buffer);
           const { extractFileContent: extractFileContent2 } = await Promise.resolve().then(() => (init_file_extractors(), file_extractors_exports));
           const ext = file.originalname.split(".").pop()?.toLowerCase() ?? "";
@@ -6621,7 +7071,7 @@ function createIngestRouter(opts) {
         return;
       }
       try {
-        assertNotPrivateUrl(url);
+        await assertPublicUrl2(url);
       } catch (e) {
         res.status(400).json({ error: e.message });
         return;
@@ -6649,11 +7099,11 @@ ${desc}
         if (content.length > 1e4)
           content = content.slice(0, 1e4) + "\n\n...(truncated)";
       }
-      const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync23 } = await import("node:fs");
-      const { join: join32 } = await import("node:path");
+      const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync24 } = await import("node:fs");
+      const { join: join33 } = await import("node:path");
       const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-      const clipDir = join32(vaultPath || ".", "06_Research", "clips");
-      mkdirSync23(clipDir, { recursive: true });
+      const clipDir = join33(vaultPath || ".", "06_Research", "clips");
+      mkdirSync24(clipDir, { recursive: true });
       const fileName = `${date} ${safeTitle}.md`;
       const md = `---
 title: "${safeTitle}"
@@ -6667,8 +7117,8 @@ tags: [clip${isYT ? ", youtube" : ""}]
 > Source: ${url}
 
 ${content}`;
-      writeFileSync23(join32(clipDir, fileName), md, "utf-8");
-      res.json({ success: true, fileName, path: join32(clipDir, fileName) });
+      writeFileSync23(join33(clipDir, fileName), md, "utf-8");
+      res.json({ success: true, fileName, path: join33(clipDir, fileName) });
     } catch (err) {
       console.error(err);
       res.status(500).json({ error: "Clip failed" });
@@ -6921,6 +7371,123 @@ function createAnalyticsRouter(opts) {
   return router;
 }
 
+// packages/core/dist/api/ssrf-guard.js
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+var defaultResolver = async (host) => {
+  const records = await lookup(host, { all: true });
+  return records.map((r) => r.address);
+};
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4)
+    return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return null;
+    const octet = Number(part);
+    if (octet > 255)
+      return null;
+    value = value * 256 + octet;
+  }
+  return value >>> 0;
+}
+function isPrivateIpv4(ip) {
+  const value = ipv4ToInt(ip);
+  if (value === null)
+    return false;
+  const a = value >>> 24 & 255;
+  const b = value >>> 16 & 255;
+  if (a === 0 || a === 10 || a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  return false;
+}
+function extractMappedIpv4(ip) {
+  const lower = ip.toLowerCase();
+  const idx = lower.lastIndexOf("::ffff:");
+  if (idx === -1)
+    return null;
+  const tail = lower.slice(idx + "::ffff:".length);
+  if (isIP(tail) === 4)
+    return tail;
+  const hexMatch = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hexMatch) {
+    const high = parseInt(hexMatch[1], 16);
+    const low = parseInt(hexMatch[2], 16);
+    return [high >> 8 & 255, high & 255, low >> 8 & 255, low & 255].join(".");
+  }
+  return null;
+}
+function isPrivateIp(ip) {
+  const kind = isIP(ip);
+  if (kind === 4)
+    return isPrivateIpv4(ip);
+  if (kind !== 6) {
+    return true;
+  }
+  const lower = ip.toLowerCase();
+  const mapped = extractMappedIpv4(lower);
+  if (mapped !== null)
+    return isPrivateIpv4(mapped);
+  if (lower === "::" || lower === "0:0:0:0:0:0:0:0")
+    return true;
+  if (lower === "::1" || lower === "0:0:0:0:0:0:0:1")
+    return true;
+  const firstHextet = parseInt(lower.split(":")[0] || "0", 16);
+  if (firstHextet >= 65152 && firstHextet <= 65215)
+    return true;
+  if (firstHextet >= 64512 && firstHextet <= 65023)
+    return true;
+  return false;
+}
+async function assertPublicUrl(url, resolver = defaultResolver) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Internal or non-public URL not allowed");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("Only http/https URLs allowed");
+  }
+  let host = parsed.hostname;
+  if (host.startsWith("[") && host.endsWith("]")) {
+    host = host.slice(1, -1);
+  }
+  const lowerHost = host.toLowerCase();
+  const h = lowerHost.replace(/\.$/, "");
+  if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local")) {
+    throw new Error("Internal or non-public URL not allowed");
+  }
+  let addresses;
+  if (isIP(host) !== 0) {
+    addresses = [host];
+  } else {
+    try {
+      addresses = await resolver(host);
+    } catch {
+      throw new Error("Internal or non-public URL not allowed");
+    }
+  }
+  if (addresses.length === 0) {
+    throw new Error("Internal or non-public URL not allowed");
+  }
+  for (const addr of addresses) {
+    if (isPrivateIp(addr)) {
+      throw new Error("Internal or non-public URL not allowed");
+    }
+  }
+}
+
 // packages/core/dist/api/server.js
 function createApiServer(options) {
   const { store, searchEngine, port = 3333, vaultName = "", vaultPath = "", decayEngine, graphUiPath } = options;
@@ -6976,16 +7543,6 @@ function createApiServer(options) {
     }
     res.json({ token: authToken });
   });
-  function assertNotPrivateUrl(url) {
-    const parsed = new URL(url);
-    if (!["http:", "https:"].includes(parsed.protocol))
-      throw new Error("Only http/https URLs allowed");
-    const host = parsed.hostname.toLowerCase();
-    if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local") || host.startsWith("192.168.") || host.startsWith("10.") || // Fix: 172.16.0.0/12 covers 172.16.* through 172.31.*
-    /^172\.(1[6-9]|2\d|3[01])\./.test(host) || host.startsWith("169.254.") || host === "0.0.0.0") {
-      throw new Error("Internal URLs not allowed");
-    }
-  }
   if (graphUiPath) {
     app.use(express.static(graphUiPath, { index: "index.html", extensions: ["html"] }));
   }
@@ -7156,7 +7713,7 @@ function createApiServer(options) {
         res.status(404).json({ error: "Document not found" });
         return;
       }
-      const { resolve: resolve22, join: join32 } = await import("node:path");
+      const { resolve: resolve22, join: join33 } = await import("node:path");
       const { writeFileSync: writeFileSync23, readFileSync: readFileSync19 } = await import("node:fs");
       const fullPath = resolve22(vaultPath, doc.filePath);
       if (!fullPath.startsWith(resolve22(vaultPath))) {
@@ -7207,13 +7764,13 @@ function createApiServer(options) {
         return;
       }
       const { resolve: resolve22 } = await import("node:path");
-      const { unlinkSync, existsSync: existsSync27 } = await import("node:fs");
+      const { unlinkSync, existsSync: existsSync28 } = await import("node:fs");
       const fullPath = resolve22(vaultPath, doc.filePath);
       if (!fullPath.startsWith(resolve22(vaultPath))) {
         res.status(403).json({ error: "Access denied" });
         return;
       }
-      if (existsSync27(fullPath)) {
+      if (existsSync28(fullPath)) {
         unlinkSync(fullPath);
       }
       await store.deleteByDocumentId(id);
@@ -7242,7 +7799,7 @@ function createApiServer(options) {
       res.status(500).json({ error: "Ask failed" });
     }
   });
-  app.use("/api", createIngestRouter({ store, vaultPath, requireAuth, assertNotPrivateUrl }));
+  app.use("/api", createIngestRouter({ store, vaultPath, requireAuth, assertPublicUrl }));
   app.get("/api/recent", async (_req, res) => {
     try {
       const docs = await store.getAllDocuments();
@@ -7339,12 +7896,12 @@ function createApiServer(options) {
       const { resolve: resolve22 } = await import("node:path");
       const syncScript = resolve22(process.cwd(), "packages/sync/sync-to-obsidian.mjs");
       const syncDir = resolve22(process.cwd(), "packages/sync");
-      const { existsSync: existsSync27 } = await import("node:fs");
-      if (!existsSync27(syncScript)) {
+      const { existsSync: existsSync28 } = await import("node:fs");
+      if (!existsSync28(syncScript)) {
         res.json({ success: false, error: "sync script not found" });
         return;
       }
-      if (!existsSync27(resolve22(syncDir, ".env"))) {
+      if (!existsSync28(resolve22(syncDir, ".env"))) {
         res.json({ success: false, error: ".env not found" });
         return;
       }
@@ -7393,6 +7950,7 @@ function createApiServer(options) {
 }
 
 // packages/core/dist/index.js
+init_graph_data();
 init_duplicate_detector();
 init_gap_detector();
 
@@ -7511,6 +8069,7 @@ function cosineSim(a, b) {
 // packages/core/dist/index.js
 init_ask_engine();
 init_wiki_compiler();
+init_auto_linker();
 
 // packages/core/dist/intelligence/knowledge-lint.js
 init_gap_detector();
@@ -7632,18 +8191,30 @@ async function lintKnowledge(store) {
 init_zettelkasten();
 init_ingest_pipeline();
 
+// packages/core/dist/intelligence/classify/classify.js
+init_math();
+
+// packages/core/dist/intelligence/classify/cluster.js
+init_math();
+
+// packages/core/dist/intelligence/classify/discover.js
+init_math();
+
+// packages/core/dist/index.js
+init_file_extractors();
+
 // packages/core/dist/multi-vault/index.js
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync12, existsSync as existsSync12, mkdirSync as mkdirSync12 } from "node:fs";
-import { join as join13 } from "node:path";
-import { homedir as homedir6 } from "node:os";
-var VAULTS_FILE = join13(homedir6(), ".stellavault", "vaults.json");
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync12, existsSync as existsSync13, mkdirSync as mkdirSync13 } from "node:fs";
+import { join as join14 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+var VAULTS_FILE = join14(homedir7(), ".stellavault", "vaults.json");
 function loadVaults() {
-  if (!existsSync12(VAULTS_FILE))
+  if (!existsSync13(VAULTS_FILE))
     return [];
   return JSON.parse(readFileSync13(VAULTS_FILE, "utf-8"));
 }
 function saveVaults(vaults) {
-  mkdirSync12(join13(homedir6(), ".stellavault"), { recursive: true });
+  mkdirSync13(join14(homedir7(), ".stellavault"), { recursive: true });
   writeFileSync12(VAULTS_FILE, JSON.stringify(vaults, null, 2), "utf-8");
 }
 function addVault(id, name, vaultPath, dbPath, shared = false) {
@@ -7674,7 +8245,7 @@ async function searchAllVaults(query, embedder, createStore, options = {}) {
   const embedding = await embedder.embed(query);
   const searches = vaults.map(async (vault2) => {
     try {
-      if (!existsSync12(vault2.dbPath))
+      if (!existsSync13(vault2.dbPath))
         return;
       const store = createStore(vault2.dbPath);
       await store.initialize();
@@ -7703,8 +8274,8 @@ async function searchAllVaults(query, embedder, createStore, options = {}) {
 
 // packages/core/dist/capture/voice.js
 import { execFileSync, execSync } from "node:child_process";
-import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync13, existsSync as existsSync13 } from "node:fs";
-import { join as join14, basename as basename4 } from "node:path";
+import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync14, existsSync as existsSync14 } from "node:fs";
+import { join as join15, basename as basename4 } from "node:path";
 var ALLOWED_MODELS = ["tiny", "base", "small", "medium", "large"];
 var ALLOWED_LANGUAGES = ["auto", "en", "ko", "ja", "zh", "es", "fr", "de", "it", "pt", "ru", "ar", "hi"];
 function validateModel(model) {
@@ -7727,7 +8298,7 @@ function isWhisperAvailable() {
 }
 async function transcribeAudio(audioPath, options = {}) {
   const { model = "base", language } = options;
-  if (!existsSync13(audioPath)) {
+  if (!existsSync14(audioPath)) {
     throw new Error(`Audio file not found: ${audioPath}`);
   }
   if (isWhisperAvailable()) {
@@ -7735,12 +8306,12 @@ async function transcribeAudio(audioPath, options = {}) {
     const args = [audioPath, "--model", safeModel, "--output_format", "txt", "--output_dir", "/tmp/sv-whisper"];
     if (language)
       args.push("--language", validateLanguage(language));
-    mkdirSync13("/tmp/sv-whisper", { recursive: true });
+    mkdirSync14("/tmp/sv-whisper", { recursive: true });
     try {
       execFileSync("whisper", args, { stdio: "pipe", timeout: 3e5 });
       const outputName = basename4(audioPath).replace(/\.[^.]+$/, ".txt");
       const { readFileSync: readFileSync19 } = await import("node:fs");
-      return readFileSync19(join14("/tmp/sv-whisper", outputName), "utf-8").trim();
+      return readFileSync19(join15("/tmp/sv-whisper", outputName), "utf-8").trim();
     } catch (err) {
       throw new Error(`Whisper failed: ${err instanceof Error ? err.message : err}`);
     }
@@ -7797,9 +8368,9 @@ async function captureVoice(audioPath, options) {
       transcript,
       ""
     ].join("\n");
-    const dir = join14(vaultPath, folder);
-    mkdirSync13(dir, { recursive: true });
-    const filePath = join14(dir, `${date.slice(0, 10)} ${safeTitle}.md`);
+    const dir = join15(vaultPath, folder);
+    mkdirSync14(dir, { recursive: true });
+    const filePath = join15(dir, `${date.slice(0, 10)} ${safeTitle}.md`);
     writeFileSync13(filePath, content, "utf-8");
     return {
       title: safeTitle,
@@ -7822,12 +8393,12 @@ async function captureVoice(audioPath, options) {
 
 // packages/core/dist/cloud/sync.js
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, createHash as createHash6 } from "node:crypto";
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync14, existsSync as existsSync14, mkdirSync as mkdirSync14, chmodSync as chmodSync2 } from "node:fs";
-import { join as join15 } from "node:path";
-import { homedir as homedir7 } from "node:os";
-var CLOUD_DIR = join15(homedir7(), ".stellavault", "cloud");
-var KEY_FILE = join15(CLOUD_DIR, "encryption.key");
-var SYNC_STATE_FILE = join15(CLOUD_DIR, "sync-state.json");
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync14, existsSync as existsSync15, mkdirSync as mkdirSync15, chmodSync as chmodSync2 } from "node:fs";
+import { join as join16 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+var CLOUD_DIR = join16(homedir8(), ".stellavault", "cloud");
+var KEY_FILE = join16(CLOUD_DIR, "encryption.key");
+var SYNC_STATE_FILE = join16(CLOUD_DIR, "sync-state.json");
 function encrypt(data, key) {
   const iv = randomBytes4(16);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
@@ -7841,13 +8412,13 @@ function decrypt(encrypted, key, iv, tag) {
   return Buffer.concat([decipher.update(encrypted), decipher.final()]);
 }
 function getOrCreateEncryptionKey(userKey) {
-  mkdirSync14(CLOUD_DIR, { recursive: true });
+  mkdirSync15(CLOUD_DIR, { recursive: true });
   if (userKey) {
     const key2 = createHash6("sha256").update(userKey).digest();
     writeFileSync14(KEY_FILE, key2.toString("hex"), "utf-8");
     return key2;
   }
-  if (existsSync14(KEY_FILE)) {
+  if (existsSync15(KEY_FILE)) {
     return Buffer.from(readFileSync14(KEY_FILE, "utf-8").trim(), "hex");
   }
   const key = randomBytes4(32);
@@ -7897,7 +8468,7 @@ async function s3Get(config, objectKey) {
 async function syncToCloud(dbPath, config) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    if (!existsSync14(dbPath)) {
+    if (!existsSync15(dbPath)) {
       return { action: "upload", dbSize: 0, encryptedSize: 0, timestamp, success: false, error: "DB not found" };
     }
     const dbData = readFileSync14(dbPath);
@@ -7907,7 +8478,7 @@ async function syncToCloud(dbPath, config) {
     const objectKey = `stellavault/index.db.enc`;
     const success = await s3Put(config, objectKey, payload);
     const state = { lastSync: timestamp, dbSize: dbData.length, encryptedSize: payload.length, objectKey };
-    mkdirSync14(CLOUD_DIR, { recursive: true });
+    mkdirSync15(CLOUD_DIR, { recursive: true });
     writeFileSync14(SYNC_STATE_FILE, JSON.stringify(state, null, 2), "utf-8");
     return { action: "upload", dbSize: dbData.length, encryptedSize: payload.length, timestamp, success };
   } catch (err) {
@@ -7927,7 +8498,7 @@ async function restoreFromCloud(dbPath, config) {
     const tag = payload.subarray(16, 32);
     const encrypted = payload.subarray(32);
     const dbData = decrypt(encrypted, key, iv, tag);
-    if (existsSync14(dbPath)) {
+    if (existsSync15(dbPath)) {
       writeFileSync14(dbPath + ".backup", readFileSync14(dbPath));
     }
     writeFileSync14(dbPath, dbData);
@@ -7937,40 +8508,40 @@ async function restoreFromCloud(dbPath, config) {
   }
 }
 function getSyncState() {
-  if (!existsSync14(SYNC_STATE_FILE))
+  if (!existsSync15(SYNC_STATE_FILE))
     return null;
   return JSON.parse(readFileSync14(SYNC_STATE_FILE, "utf-8"));
 }
 
 // packages/core/dist/team/index.js
-import { join as join16 } from "node:path";
-import { homedir as homedir8 } from "node:os";
-var TEAM_DIR = join16(homedir8(), ".stellavault", "team");
-var TEAM_FILE = join16(TEAM_DIR, "team.json");
+import { join as join17 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+var TEAM_DIR = join17(homedir9(), ".stellavault", "team");
+var TEAM_FILE = join17(TEAM_DIR, "team.json");
 
 // packages/core/dist/index.js
 init_federation();
 
 // packages/core/dist/federation/trust.js
-import { join as join17 } from "node:path";
-import { homedir as homedir9 } from "node:os";
-var TRUST_FILE = join17(homedir9(), ".stellavault", "federation", "trust.json");
+import { join as join18 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+var TRUST_FILE = join18(homedir10(), ".stellavault", "federation", "trust.json");
 
 // packages/core/dist/index.js
 init_sharing();
 
 // packages/core/dist/federation/reputation.js
-import { join as join18 } from "node:path";
-import { homedir as homedir10 } from "node:os";
-var REP_FILE = join18(homedir10(), ".stellavault", "federation", "reputation.json");
+import { join as join19 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+var REP_FILE = join19(homedir11(), ".stellavault", "federation", "reputation.json");
 
 // packages/core/dist/index.js
 init_privacy();
 
 // packages/core/dist/federation/credits.js
-import { join as join19 } from "node:path";
-import { homedir as homedir11 } from "node:os";
-var CREDITS_FILE = join19(homedir11(), ".stellavault", "federation", "credits.json");
+import { join as join20 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+var CREDITS_FILE = join20(homedir12(), ".stellavault", "federation", "credits.json");
 
 // packages/core/dist/index.js
 init_retry();
@@ -8006,15 +8577,15 @@ function createKnowledgeHub(config, options = {}) {
     // B2.2 — cross-lingual/synonym groups
   });
   const mcpServer = createMcpServer({ store, searchEngine, vaultPath: config.vaultPath, ready: options.ready });
-  return { store, embedder, searchEngine, mcpServer, config };
+  return { store, embedder, searchEngine, mcpServer, config, getDecayEngine };
 }
 
 // packages/cli/dist/commands/index-cmd.js
 function getVaultDbPath(vaultPath) {
   const hash = createHash7("sha256").update(vaultPath).digest("hex").slice(0, 8);
-  const dir = join20(homedir12(), ".stellavault", "vaults");
-  mkdirSync15(dir, { recursive: true });
-  return join20(dir, `${hash}.db`);
+  const dir = join21(homedir13(), ".stellavault", "vaults");
+  mkdirSync16(dir, { recursive: true });
+  return join21(dir, `${hash}.db`);
 }
 function resolveDbPath(vault2, configDbPath) {
   const envDbPath = process.env.STELLAVAULT_DB_PATH?.trim();
@@ -8305,19 +8876,19 @@ async function statusCommand(_opts, cmd) {
 import chalk6 from "chalk";
 import { spawn } from "node:child_process";
 import { resolve as resolve11, dirname as dirname5 } from "node:path";
-import { existsSync as existsSync17 } from "node:fs";
+import { existsSync as existsSync18 } from "node:fs";
 import { fileURLToPath } from "node:url";
 function locateBundledGraphUi() {
   try {
     const here = dirname5(fileURLToPath(import.meta.url));
     const bundled = resolve11(here, "graph-ui");
-    if (existsSync17(resolve11(bundled, "index.html")))
+    if (existsSync18(resolve11(bundled, "index.html")))
       return bundled;
     const monorepoGraphDist = resolve11(here, "..", "..", "..", "graph", "dist");
-    if (existsSync17(resolve11(monorepoGraphDist, "index.html")))
+    if (existsSync18(resolve11(monorepoGraphDist, "index.html")))
       return monorepoGraphDist;
     const singleFileBundle = resolve11(here, "..", "dist", "graph-ui");
-    if (existsSync17(resolve11(singleFileBundle, "index.html")))
+    if (existsSync18(resolve11(singleFileBundle, "index.html")))
       return singleFileBundle;
   } catch {
   }
@@ -8368,7 +8939,7 @@ async function graphCommand() {
     return;
   }
   const devGraphDir = resolve11(process.cwd(), "packages/graph");
-  const hasDevGraph = existsSync17(resolve11(devGraphDir, "package.json"));
+  const hasDevGraph = existsSync18(resolve11(devGraphDir, "package.json"));
   if (hasDevGraph) {
     console.error(chalk6.dim("   \u{1F680} Starting Vite dev server..."));
     const vite = spawn(process.platform === "win32" ? "npx.cmd" : "npx", ["vite", "--host"], {
@@ -8430,10 +9001,10 @@ async function cardCommand(options) {
 
 // packages/cli/dist/commands/pack-cmd.js
 import chalk8 from "chalk";
-import { resolve as resolve13, join as join23 } from "node:path";
-import { readdirSync as readdirSync6, existsSync as existsSync18, readFileSync as readFileSync16, mkdirSync as mkdirSync17 } from "node:fs";
-import { homedir as homedir15 } from "node:os";
-var PACKS_DIR = join23(homedir15(), ".stellavault", "packs");
+import { resolve as resolve13, join as join24 } from "node:path";
+import { readdirSync as readdirSync6, existsSync as existsSync19, readFileSync as readFileSync16, mkdirSync as mkdirSync18 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
+var PACKS_DIR = join24(homedir16(), ".stellavault", "packs");
 async function packCreateCommand(name, options) {
   const config = loadConfig();
   const hub = createKnowledgeHub(config);
@@ -8449,8 +9020,8 @@ async function packCreateCommand(name, options) {
     description: options.description,
     limit: options.limit ? parseInt(options.limit) : 100
   });
-  mkdirSync17(PACKS_DIR, { recursive: true });
-  const outPath = join23(PACKS_DIR, `${name}.sv-pack`);
+  mkdirSync18(PACKS_DIR, { recursive: true });
+  const outPath = join24(PACKS_DIR, `${name}.sv-pack`);
   exportPack(pack2, outPath);
   console.error(chalk8.green(`\u2705 Pack created: ${name}`));
   console.error(`   \u{1F4E6} ${pack2.chunks.length} chunks`);
@@ -8461,8 +9032,8 @@ async function packCreateCommand(name, options) {
   await hub.store.close();
 }
 async function packExportCommand(name, options) {
-  const srcPath = join23(PACKS_DIR, `${name}.sv-pack`);
-  if (!existsSync18(srcPath)) {
+  const srcPath = join24(PACKS_DIR, `${name}.sv-pack`);
+  if (!existsSync19(srcPath)) {
     console.error(chalk8.red(`\u274C Pack not found: ${name}`));
     process.exit(1);
   }
@@ -8474,7 +9045,7 @@ async function packExportCommand(name, options) {
 }
 async function packImportCommand(filePath) {
   const absPath = resolve13(process.cwd(), filePath);
-  if (!existsSync18(absPath)) {
+  if (!existsSync19(absPath)) {
     console.error(chalk8.red(`\u274C File not found: ${absPath}`));
     process.exit(1);
   }
@@ -8493,7 +9064,7 @@ async function packImportCommand(filePath) {
   await hub.store.close();
 }
 async function packListCommand() {
-  mkdirSync17(PACKS_DIR, { recursive: true });
+  mkdirSync18(PACKS_DIR, { recursive: true });
   const files = readdirSync6(PACKS_DIR).filter((f) => f.endsWith(".sv-pack"));
   if (files.length === 0) {
     console.error(chalk8.dim("No packs found. Create one: stellavault pack create <name> --from-search <query>"));
@@ -8503,7 +9074,7 @@ async function packListCommand() {
 `));
   for (const file of files) {
     try {
-      const pack2 = JSON.parse(readFileSync16(join23(PACKS_DIR, file), "utf-8"));
+      const pack2 = JSON.parse(readFileSync16(join24(PACKS_DIR, file), "utf-8"));
       console.error(`  ${chalk8.bold(pack2.name)} v${pack2.version} \u2014 ${pack2.chunks.length} chunks (${pack2.license})`);
     } catch {
       console.error(`  ${file} (invalid)`);
@@ -8511,8 +9082,8 @@ async function packListCommand() {
   }
 }
 async function packInfoCommand(name) {
-  const filePath = join23(PACKS_DIR, `${name}.sv-pack`);
-  if (!existsSync18(filePath)) {
+  const filePath = join24(PACKS_DIR, `${name}.sv-pack`);
+  if (!existsSync19(filePath)) {
     console.error(chalk8.red(`\u274C Pack not found: ${name}`));
     process.exit(1);
   }
@@ -8570,24 +9141,24 @@ async function decayCommand(_opts, cmd) {
 import chalk10 from "chalk";
 import { spawn as spawn2 } from "node:child_process";
 import { resolve as resolve14 } from "node:path";
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 async function syncCommand(options) {
   const syncDir = resolve14(process.cwd(), "packages/sync");
   const syncScript = resolve14(syncDir, "sync-to-obsidian.mjs");
-  if (!existsSync19(syncScript)) {
+  if (!existsSync20(syncScript)) {
     console.error(chalk10.red("\u274C packages/sync/sync-to-obsidian.mjs not found"));
     console.error(chalk10.dim("   Run from project root: cd notion-obsidian-sync"));
     process.exit(1);
   }
   const envFile = resolve14(syncDir, ".env");
-  if (!existsSync19(envFile)) {
+  if (!existsSync20(envFile)) {
     console.error(chalk10.red("\u274C packages/sync/.env not found"));
     console.error(chalk10.dim("   Copy .env.example \u2192 .env and set NOTION_TOKEN"));
     process.exit(1);
   }
   if (options.upload) {
     const uploadScript = resolve14(syncDir, "upload-pdca-to-notion.mjs");
-    if (!existsSync19(uploadScript)) {
+    if (!existsSync20(uploadScript)) {
       console.error(chalk10.red("\u274C upload-pdca-to-notion.mjs not found"));
       process.exit(1);
     }
@@ -8839,8 +9410,8 @@ async function gapsCommand() {
 
 // packages/cli/dist/commands/clip-cmd.js
 import chalk14 from "chalk";
-import { writeFileSync as writeFileSync18, mkdirSync as mkdirSync18 } from "node:fs";
-import { join as join24 } from "node:path";
+import { writeFileSync as writeFileSync18, mkdirSync as mkdirSync19 } from "node:fs";
+import { join as join25 } from "node:path";
 async function clipCommand(url, options) {
   if (!url) {
     console.error(chalk14.red("\u274C Please provide a URL: stellavault clip <url>"));
@@ -8853,9 +9424,15 @@ async function clipCommand(url, options) {
     process.exit(1);
   }
   const folder = options.folder ?? "06_Research/clips";
-  const targetDir = join24(vaultPath, folder);
-  mkdirSync18(targetDir, { recursive: true });
+  const targetDir = join25(vaultPath, folder);
+  mkdirSync19(targetDir, { recursive: true });
   console.error(chalk14.dim(`\u{1F4CE} Clipping: ${url}`));
+  try {
+    await assertPublicUrl(url);
+  } catch {
+    console.error(chalk14.yellow("Private/local or non-public URLs are not allowed for security."));
+    process.exit(1);
+  }
   try {
     const isYouTube = /youtube\.com\/watch|youtu\.be\//.test(url);
     let title;
@@ -8872,7 +9449,7 @@ async function clipCommand(url, options) {
     const safeTitle = title.replace(/[<>:"/\\|?*]/g, "").replace(/\s+/g, " ").trim().slice(0, 80);
     const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     const fileName = `${date} ${safeTitle}.md`;
-    const filePath = join24(targetDir, fileName);
+    const filePath = join25(targetDir, fileName);
     const md = [
       "---",
       `title: "${safeTitle}"`,
@@ -9089,14 +9666,14 @@ async function digestCommand(options) {
 \u{1F9E0} Health: R=${report.averageR} | Decaying ${report.decayingCount} | Critical ${report.criticalCount}`);
   console.log(chalk16.dim("\n\u2550".repeat(50)));
   if (options.visual) {
-    const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync23, existsSync: existsSync27 } = await import("node:fs");
-    const { join: join32, resolve: resolve22 } = await import("node:path");
+    const { writeFileSync: writeFileSync23, mkdirSync: mkdirSync24, existsSync: existsSync28 } = await import("node:fs");
+    const { join: join33, resolve: resolve22 } = await import("node:path");
     const outputDir = resolve22(config.vaultPath, "_stellavault/digests");
-    if (!existsSync27(outputDir))
-      mkdirSync23(outputDir, { recursive: true });
+    if (!existsSync28(outputDir))
+      mkdirSync24(outputDir, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const filename = `digest-${date}.md`;
-    const outputPath = join32(outputDir, filename);
+    const outputPath = join33(outputDir, filename);
     const pieData = (typeStats.length > 0 ? typeStats : [{ type: "note", cnt: 1 }]).map((t2) => `    "${t2.type}" : ${t2.cnt}`).join("\n");
     const timelineData = dailyActivity.map((d) => `    ${d.day.slice(5)} : ${d.cnt}`).join("\n");
     const md = [
@@ -9143,9 +9720,9 @@ Visual digest saved: ${filename}`));
 
 // packages/cli/dist/commands/init-cmd.js
 import { createInterface as createInterface2 } from "node:readline";
-import { existsSync as existsSync20, mkdirSync as mkdirSync19, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join25 } from "node:path";
-import { homedir as homedir16 } from "node:os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync20, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join26 } from "node:path";
+import { homedir as homedir17 } from "node:os";
 import ora2 from "ora";
 import chalk17 from "chalk";
 function ask(rl, question, defaultVal) {
@@ -9171,8 +9748,8 @@ async function initCommand() {
         console.log(chalk17.yellow("  Please enter your vault path."));
         continue;
       }
-      const resolved = input.replace(/^~/, homedir16());
-      if (!existsSync20(resolved)) {
+      const resolved = input.replace(/^~/, homedir17());
+      if (!existsSync21(resolved)) {
         console.log(chalk17.yellow(`  Path not found: ${resolved}`));
         continue;
       }
@@ -9180,9 +9757,9 @@ async function initCommand() {
     }
     console.log(chalk17.green(`  \u2713 Vault: ${vaultPath}
 `));
-    const configDir = join25(homedir16(), ".stellavault");
-    mkdirSync19(configDir, { recursive: true });
-    const dbPath = join25(configDir, "index.db");
+    const configDir = join26(homedir17(), ".stellavault");
+    mkdirSync20(configDir, { recursive: true });
+    const dbPath = join26(configDir, "index.db");
     const configData = {
       vaultPath,
       dbPath,
@@ -9191,7 +9768,7 @@ async function initCommand() {
       search: { defaultLimit: 10, rrfK: 60 },
       mcp: { mode: "stdio", port: 3333 }
     };
-    writeFileSync19(join25(homedir16(), ".stellavault.json"), JSON.stringify(configData, null, 2), "utf-8");
+    writeFileSync19(join26(homedir17(), ".stellavault.json"), JSON.stringify(configData, null, 2), "utf-8");
     console.log(chalk17.dim(`  Config saved: ~/.stellavault.json`));
     console.log("");
     console.log(chalk17.cyan("  Step 2/3") + " \u2014 Indexing your vault");
@@ -9215,8 +9792,8 @@ async function initCommand() {
     spinner.succeed(chalk17.green(`  Indexed ${result.indexed} docs, ${result.totalChunks} chunks (${(result.elapsedMs / 1e3).toFixed(1)}s)`));
     if (result.indexed === 0) {
       console.log(chalk17.yellow("\n  Your vault is empty \u2014 creating 3 starter notes so you can explore.\n"));
-      const rawDir = join25(vaultPath, "raw");
-      mkdirSync19(rawDir, { recursive: true });
+      const rawDir = join26(vaultPath, "raw");
+      mkdirSync20(rawDir, { recursive: true });
       const samples = [
         {
           file: "welcome-to-stellavault.md",
@@ -9289,7 +9866,7 @@ Andrej Karpathy's approach: every session auto-compiles into structured knowledg
         }
       ];
       for (const s of samples) {
-        writeFileSync19(join25(rawDir, s.file), s.content, "utf-8");
+        writeFileSync19(join26(rawDir, s.file), s.content, "utf-8");
       }
       const reSpinner = ora2({ text: "  Indexing sample notes...", indent: 2 }).start();
       const reResult = await indexVault(vaultPath, {
@@ -9950,8 +10527,8 @@ import chalk26 from "chalk";
 // packages/core/dist/intelligence/draft-generator.js
 init_wiki_compiler();
 init_config();
-import { writeFileSync as writeFileSync20, mkdirSync as mkdirSync20, existsSync as existsSync21 } from "node:fs";
-import { join as join26, resolve as resolve16, basename as basename5, extname as extname7 } from "node:path";
+import { writeFileSync as writeFileSync20, mkdirSync as mkdirSync21, existsSync as existsSync22 } from "node:fs";
+import { join as join27, resolve as resolve16, basename as basename5, extname as extname7 } from "node:path";
 function generateDraft(vaultPath, options = {}, folders = DEFAULT_FOLDERS) {
   const { topic, format = "blog", maxSections = 8, blueprint } = options;
   const rawDir = resolve16(vaultPath, folders.fleeting);
@@ -9959,7 +10536,7 @@ function generateDraft(vaultPath, options = {}, folders = DEFAULT_FOLDERS) {
   const litDir = resolve16(vaultPath, folders.literature);
   const allDocs = [];
   for (const dir of [rawDir, wikiDir, litDir]) {
-    if (existsSync21(dir)) {
+    if (existsSync22(dir)) {
       allDocs.push(...scanRawDirectory(dir));
     }
   }
@@ -10027,12 +10604,12 @@ function generateDraft(vaultPath, options = {}, folders = DEFAULT_FOLDERS) {
   }
   const wordCount = body.split(/\s+/).filter(Boolean).length;
   const draftsDir = resolve16(vaultPath, "_drafts");
-  if (!existsSync21(draftsDir))
-    mkdirSync20(draftsDir, { recursive: true });
+  if (!existsSync22(draftsDir))
+    mkdirSync21(draftsDir, { recursive: true });
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const slug = (topic ?? "knowledge").replace(/[^a-zA-Z0-9가-힣\s]/g, "").replace(/\s+/g, "-").toLowerCase().slice(0, 40);
   const filename = `${timestamp}-${slug}.md`;
-  const filePath = join26("_drafts", filename);
+  const filePath = join27("_drafts", filename);
   const fullPath = resolve16(vaultPath, filePath);
   writeFileSync20(fullPath, body, "utf-8");
   return {
@@ -10284,8 +10861,8 @@ ${aiContent.text}
 
 // packages/cli/dist/commands/session-cmd.js
 import chalk27 from "chalk";
-import { writeFileSync as writeFileSync21, mkdirSync as mkdirSync21, existsSync as existsSync22, appendFileSync } from "node:fs";
-import { resolve as resolve17, join as join27 } from "node:path";
+import { writeFileSync as writeFileSync21, mkdirSync as mkdirSync22, existsSync as existsSync23, appendFileSync } from "node:fs";
+import { resolve as resolve17, join as join28 } from "node:path";
 async function sessionSaveCommand(options) {
   const config = loadConfig();
   if (!config.vaultPath) {
@@ -10294,12 +10871,12 @@ async function sessionSaveCommand(options) {
   }
   const folders = config.folders;
   const logDir = resolve17(config.vaultPath, folders.fleeting, "_daily-logs");
-  if (!existsSync22(logDir))
-    mkdirSync21(logDir, { recursive: true });
+  if (!existsSync23(logDir))
+    mkdirSync22(logDir, { recursive: true });
   const now = /* @__PURE__ */ new Date();
   const dateStr = now.toISOString().split("T")[0];
   const timeStr = now.toTimeString().split(" ")[0];
-  const logFile = join27(logDir, `daily-log-${dateStr}.md`);
+  const logFile = join28(logDir, `daily-log-${dateStr}.md`);
   let summary = options.summary ?? "";
   if (!summary && !process.stdin.isTTY) {
     const chunks = [];
@@ -10338,7 +10915,7 @@ async function sessionSaveCommand(options) {
     entry.push("### Action Items", options.actions, "");
   }
   entry.push("---", "");
-  if (!existsSync22(logFile)) {
+  if (!existsSync23(logFile)) {
     const header = [
       "---",
       `title: "Daily Log \u2014 ${dateStr}"`,
@@ -10370,8 +10947,8 @@ async function sessionSaveCommand(options) {
 
 // packages/cli/dist/commands/flush-cmd.js
 import chalk28 from "chalk";
-import { readdirSync as readdirSync7, readFileSync as readFileSync17, existsSync as existsSync23 } from "node:fs";
-import { resolve as resolve18, join as join28 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync17, existsSync as existsSync24 } from "node:fs";
+import { resolve as resolve18, join as join29 } from "node:path";
 async function flushCommand() {
   const config = loadConfig();
   if (!config.vaultPath) {
@@ -10380,7 +10957,7 @@ async function flushCommand() {
   }
   const folders = config.folders;
   const logDir = resolve18(config.vaultPath, folders.fleeting, "_daily-logs");
-  if (!existsSync23(logDir)) {
+  if (!existsSync24(logDir)) {
     console.log(chalk28.yellow("No daily logs found. Use `stellavault session-save` or let Claude Code hooks capture sessions."));
     return;
   }
@@ -10393,7 +10970,7 @@ async function flushCommand() {
   let totalSessions = 0;
   const allContent = [];
   for (const file of logFiles) {
-    const content = readFileSync17(join28(logDir, file), "utf-8");
+    const content = readFileSync17(join29(logDir, file), "utf-8");
     const sessions = content.split(/^## Session/m).slice(1);
     totalSessions += sessions.length;
     allContent.push(content);
@@ -10521,8 +11098,8 @@ async function lintCommand() {
 
 // packages/cli/dist/commands/fleeting-cmd.js
 import chalk31 from "chalk";
-import { writeFileSync as writeFileSync22, mkdirSync as mkdirSync22, existsSync as existsSync24 } from "node:fs";
-import { join as join29, resolve as resolve19 } from "node:path";
+import { writeFileSync as writeFileSync22, mkdirSync as mkdirSync23, existsSync as existsSync25 } from "node:fs";
+import { join as join30, resolve as resolve19 } from "node:path";
 async function fleetingCommand(text, options) {
   if (!text || text.trim().length < 2) {
     console.error(chalk31.yellow('Usage: stellavault fleeting "your idea here" [--tags tag1,tag2]'));
@@ -10530,13 +11107,13 @@ async function fleetingCommand(text, options) {
   }
   const config = loadConfig();
   const rawDir = resolve19(config.vaultPath, "raw");
-  if (!existsSync24(rawDir))
-    mkdirSync22(rawDir, { recursive: true });
+  if (!existsSync25(rawDir))
+    mkdirSync23(rawDir, { recursive: true });
   const now = /* @__PURE__ */ new Date();
   const timestamp = now.toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const slug = text.slice(0, 40).replace(/[^a-zA-Z0-9가-힣\s]/g, "").replace(/\s+/g, "-").toLowerCase();
   const filename = `${timestamp}-${slug}.md`;
-  const filePath = join29(rawDir, filename);
+  const filePath = join30(rawDir, filename);
   if (!resolve19(filePath).startsWith(resolve19(rawDir))) {
     console.error(chalk31.red("Invalid file path"));
     process.exit(1);
@@ -10563,15 +11140,15 @@ async function fleetingCommand(text, options) {
 
 // packages/cli/dist/commands/ingest-cmd.js
 import chalk32 from "chalk";
-import { readFileSync as readFileSync18, existsSync as existsSync25, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
-import { extname as extname8, resolve as resolve20, join as join30 } from "node:path";
+import { readFileSync as readFileSync18, existsSync as existsSync26, readdirSync as readdirSync8, statSync as statSync5 } from "node:fs";
+import { extname as extname8, resolve as resolve20, join as join31 } from "node:path";
 async function ingestCommand(input, options) {
   if (!input) {
     console.error(chalk32.yellow("Usage: stellavault ingest <url|file|text|folder/> [--tags t1,t2]"));
     process.exit(1);
   }
-  if (existsSync25(input) && statSync5(input).isDirectory()) {
-    const files = readdirSync8(input).filter((f) => /\.(md|txt|pdf|docx|pptx|xlsx|xls|csv|json|xml|html|htm|yaml|yml|rtf)$/i.test(f)).map((f) => join30(input, f));
+  if (existsSync26(input) && statSync5(input).isDirectory()) {
+    const files = readdirSync8(input).filter((f) => /\.(md|txt|pdf|docx|pptx|xlsx|xls|csv|json|xml|html|htm|yaml|yml|rtf)$/i.test(f)).map((f) => join31(input, f));
     if (files.length === 0) {
       console.error(chalk32.yellow(`No supported files found in ${input}`));
       process.exit(1);
@@ -10616,13 +11193,10 @@ async function ingestSingleFile(input, options) {
   if (/^https?:\/\//.test(input)) {
     const isYouTube = /youtube\.com\/watch|youtu\.be\//.test(input);
     try {
-      const url = new URL(input);
-      const host = url.hostname;
-      if (/^(127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|0\.|localhost|::1)/i.test(host)) {
-        console.error(chalk32.yellow("Private/local URLs are not allowed for security."));
-        process.exit(1);
-      }
+      await assertPublicUrl(input);
     } catch {
+      console.error(chalk32.yellow("Private/local or non-public URLs are not allowed for security."));
+      process.exit(1);
     }
     if (isYouTube) {
       try {
@@ -10668,7 +11242,7 @@ async function ingestSingleFile(input, options) {
         source: input
       };
     }
-  } else if (existsSync25(input)) {
+  } else if (existsSync26(input)) {
     const ext = extname8(input).toLowerCase();
     const binaryExts = /* @__PURE__ */ new Set([".pdf", ".docx", ".pptx", ".xlsx", ".xls"]);
     const structuredExts = /* @__PURE__ */ new Set([".json", ".csv", ".xml", ".html", ".htm", ".yaml", ".yml", ".rtf"]);
@@ -10826,9 +11400,9 @@ async function autopilotCommand(options) {
 
 // packages/cli/dist/commands/doctor-cmd.js
 import chalk34 from "chalk";
-import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
-import { join as join31 } from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { existsSync as existsSync27, statSync as statSync6 } from "node:fs";
+import { join as join32 } from "node:path";
+import { homedir as homedir18 } from "node:os";
 async function doctorCommand() {
   console.log("");
   console.log(chalk34.bold("  \u{1FA7A} Stellavault Doctor\n"));
@@ -10841,10 +11415,10 @@ async function doctorCommand() {
     fix: nodeVersion2 < 20 ? "Download Node.js 20+: https://nodejs.org" : void 0
   });
   const configPaths = [
-    join31(process.cwd(), ".stellavault.json"),
-    join31(homedir17(), ".stellavault.json")
+    join32(process.cwd(), ".stellavault.json"),
+    join32(homedir18(), ".stellavault.json")
   ];
-  const configPath = configPaths.find((p) => existsSync26(p));
+  const configPath = configPaths.find((p) => existsSync27(p));
   checks.push({
     name: "Config file",
     pass: !!configPath,
@@ -10869,7 +11443,7 @@ async function doctorCommand() {
     }
   }
   if (vaultPath) {
-    const vaultExists = existsSync26(vaultPath);
+    const vaultExists = existsSync27(vaultPath);
     checks.push({
       name: "Vault path",
       pass: vaultExists,
@@ -10898,7 +11472,7 @@ async function doctorCommand() {
     }
   }
   if (dbPath) {
-    const dbExists = existsSync26(dbPath);
+    const dbExists = existsSync27(dbPath);
     checks.push({
       name: "Database",
       pass: dbExists,
@@ -10913,20 +11487,20 @@ async function doctorCommand() {
       fix: "Re-run: stellavault init"
     });
   }
-  const cacheDir = join31(homedir17(), ".cache", "onnxruntime");
-  const hfCache = join31(homedir17(), ".cache", "huggingface");
-  const xenovaCache = join31(homedir17(), ".cache", "xenova");
-  const modelCached = existsSync26(cacheDir) || existsSync26(hfCache) || existsSync26(xenovaCache) || existsSync26(join31(homedir17(), ".cache", "transformers"));
+  const cacheDir = join32(homedir18(), ".cache", "onnxruntime");
+  const hfCache = join32(homedir18(), ".cache", "huggingface");
+  const xenovaCache = join32(homedir18(), ".cache", "xenova");
+  const modelCached = existsSync27(cacheDir) || existsSync27(hfCache) || existsSync27(xenovaCache) || existsSync27(join32(homedir18(), ".cache", "transformers"));
   checks.push({
     name: "Embedding model cached",
     pass: modelCached,
     detail: modelCached ? "local model files found" : "not downloaded yet",
     fix: !modelCached ? "Will download automatically on first index (~30MB)" : void 0
   });
-  const testDir = join31(homedir17(), ".stellavault");
+  const testDir = join32(homedir18(), ".stellavault");
   try {
-    const { mkdirSync: mkdirSync23 } = await import("node:fs");
-    mkdirSync23(testDir, { recursive: true });
+    const { mkdirSync: mkdirSync24 } = await import("node:fs");
+    mkdirSync24(testDir, { recursive: true });
     checks.push({ name: "Write permission (~/.stellavault)", pass: true, detail: "OK" });
   } catch {
     checks.push({
@@ -10976,7 +11550,7 @@ if (nodeVersion < 20) {
   process.exit(1);
 }
 var program = new Command();
-var SV_VERSION = true ? "0.8.4" : "0.0.0-dev";
+var SV_VERSION = true ? "0.8.5" : "0.0.0-dev";
 program.name("stellavault").description("Stellavault \u2014 Self-compiling knowledge base for your Obsidian vault").version(SV_VERSION).option("--json", "Output in JSON format (for scripting)").option("--quiet", "Suppress non-essential output");
 program.command("init").description("Interactive setup wizard \u2014 get started in 3 minutes").action(initCommand);
 program.command("doctor").description("Diagnose setup issues (config, vault, DB, model, Node version)").action(doctorCommand);