chore(workspace): gate dead-code with knip production mode (#196)

* refactor(workspace): relocate @ktx/llm source into packages/cli/src/llm

* refactor(workspace): rewrite @ktx/llm imports to relative paths

* refactor(workspace): fold internal packages into cli

* chore(workspace): gate dead-code with knip production mode

Turn on production-mode knip plus an autofix run in pre-commit and the
`pnpm dead-code` script, document the `/** @internal */` convention for
test-only exports in AGENTS.md, annotate test-only exports across the
CLI with that JSDoc, and drop dead exports/wrappers the new gate
surfaced (e.g. `cli-project.ts`, `lookerRuntimeSourceToFileAdapterSource`,
`createLocalScanEnrichmentProvidersFromConfig`,
`PGLITE_OWNER_PROCESS_BACKEND_CAPABILITIES`, stale type re-exports).
Replace the loose `ignoreIssues` allowlist in `knip.json` with explicit
production entries so cross-package barrel leaks are caught.

* refactor(cli): delete internal barrel index.ts files

The 34 `index.ts` re-export barrels inside `packages/cli/src/` were
holdovers from the pre-fold multi-workspace structure. Post-fold-in they
served no production purpose: external consumers go through the single
package main entry, and in-repo callers mostly imported through them
only because the path was short. Internally, knip flagged most barrel
re-exports as production-dead (only reached via tests).

This change:
- Deletes every internal barrel except `packages/cli/src/index.ts`
  (the published package entry).
- Rewrites ~270 source/test files to import each name directly from
  the file that defines it.
- Moves `tools/warehouse-verification/index.ts` to
  `create-warehouse-verification-tools.ts` (the function it defined
  locally) and updates its single consumer.
- Renames `search/backend-conformance.ts` → `.test-utils.ts` to match
  the existing test-helper file convention.
- Deletes 13 dead test-only chains (dbt-descriptions/*,
  live-database/extracted-schema, live-database/structural-sync,
  relationship-* feedback/review chain) plus their tests and a
  cascading orphan integration test.
- Updates test mocks that pointed at deleted barrel paths
  (notion-client, connector barrels in scan/local-scan-connectors
  tests) to mock the source files instead.
- Points the maintainer benchmark script
  (`scripts/relationship-benchmark-report.mjs`) at source files
  instead of `dist/context/scan/index.js`.
- Drops the barrel `!` entries from `knip.json`; adds explicit
  production entries only for the benchmark code reached via dist by
  the maintainer script.

Net: 413 files changed, ~1.2k insertions, ~9.4k deletions.

`pnpm run dead-code` (Biome + knip default + knip production) and
`pnpm run type-check` are clean; 2277 tests pass.

* refactor(workspace): rename @ktx/cli to @kaelio/ktx and pack it directly

Promote the CLI workspace package to the public name `@kaelio/ktx` and
drop the separate `scripts/build-public-npm-package.mjs` wrapper. The
CLI package is now publishable in place (`publishConfig.access: public`,
`provenance: true`), so artifact packing uses `pnpm pack` against
`packages/cli/` instead of assembling a parallel package tree.

Updates all workspace filter invocations, docs, tests, and release
readiness checks to reference the new package name, and folds the
tarball-name helper into `scripts/public-npm-release-metadata.mjs`.

* docs: align "agent clients" and "data agents" terminology

Replace "client agents" with "agent clients" and "database agents" with
"data agents" across AGENTS.md, README.md, the docs-site copy, and the
matching setup-agents test description, matching the canonical
vocabulary in docs/terminology.md.

Also moves packages/cli/tsconfig.json's tsBuildInfoFile from
node_modules/.cache/ to dist/.tsbuildinfo so incremental builds survive
node_modules reinstalls.

* refactor(release): single source of truth for package version

Make packages/cli/package.json the single source of truth for the
@kaelio/ktx version. publicNpmPackageVersion() now reads it directly,
so artifact filenames, release-readiness checks, and the Python wheel
version all derive from one field. The duplicate
release-policy.json.publicNpmPackageVersion is removed.

Previously the two fields could drift: tarballs were named
kaelio-ktx-0.4.1.tgz while internally containing
@kaelio/ktx@0.0.0-private.

- update-public-release-version.mjs rewrites both Python pyproject.toml
  files (ktx-daemon, ktx-sl) alongside the npm package.jsons,
  normalizing the version for PEP 440 (e.g. 0.1.0-rc.2 -> 0.1.0rc2).
- semantic-release-config.cjs adds the two pyproject.toml files to
  @semantic-release/git assets so the release commit back to main
  carries every version source in lockstep.
- The six "?? '0.0.0-private'" fallback literals across the CLI are
  replaced with "?? getKtxCliPackageInfo().version", and
  createDefaultKtxMcpServer makes its version arg required.
- docs/release.md describes the actual commit-back model: the dev tree
  always reflects the most recent release; no sentinel pin to
  maintain.

Verified: pnpm run artifacts:build now produces
kaelio-ktx-0.4.1.tgz and kaelio_ktx-0.4.1-py3-none-any.whl with
@kaelio/ktx@0.4.1 inside. Full type-check, dead-code, and
2287 vitests + 173 script tests pass.

* refactor(cli): inject embedding provider resolution and detect sentence-transformers runtime

Make resolveProjectEmbeddingProvider and runtimeIo injectable in ingest and
scan command entrypoints so tests can stub them, and teach
resolvePublicIngestRuntimeRequirements to flag the local-embeddings runtime
feature when ktx.yaml selects sentence-transformers.

* chore(cli): mark buildLocalStatsStatus and LocalStatsStatus as @internal

Both symbols are consumed only by status-project.test.ts. Annotating with
/** @internal */ keeps knip's production-mode check clean without changing
runtime behavior.

* fix(cli): use real package metadata in print-command-tree

The stubbed package name embedded a forbidden product identifier that
tripped the boundary check in CI. Read the metadata from package.json
instead — keeps the rendered tree unchanged and removes a duplicate
source of truth.

* feat(cli): show embedding coverage in `ktx status`, drop duplicate disk counts

Inline `(N embedded)` next to the Wiki scope counts and Semantic-layer
source counts, computed with `SUM(embedding_json IS NOT NULL)` over
`knowledge_pages` and `local_sl_sources`. Rename the "Knowledge" label to
"Wiki" (canonical per `docs/terminology.md`) and rename the matching
`localStats.knowledgePages` field to `localStats.wikiPages`.

Drop `wiki=N md` and `semantic-layer=N yaml` from the Disk row — those
duplicated the per-surface rows above. Disk now reports only actual byte
usage (db, cache, raw-sources). The unused `wikiGlobalMarkdownCount` /
`semanticLayerYamlCount` fields, the `isMarkdownEntry` / `isYamlEntry`
helpers, and the `filter` arg on `summarizeDir` are removed.

packages/cli/src/context/sl/local-query.test.ts

@@ -0,0 +1,337 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { KtxSemanticLayerComputePort } from '../../context/daemon/semantic-layer-compute.js';
+import { initKtxProject, type KtxLocalProject } from '../../context/project/project.js';
+import { compileLocalSlQuery } from './local-query.js';
+
+describe('compileLocalSlQuery', () => {
+  let tempDir: string;
+  let project: KtxLocalProject;
+  let compute: KtxSemanticLayerComputePort;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'ktx-local-query-'));
+    project = await initKtxProject({ projectDir: join(tempDir, 'project') });
+    project.config.connections.warehouse = { driver: 'postgres' };
+    await project.fileStore.writeFile(
+      'semantic-layer/warehouse/orders.yaml',
+      `name: orders
+table: public.orders
+grain:
+  - id
+columns:
+  - name: id
+    type: number
+  - name: status
+    type: string
+measures:
+  - name: order_count
+    expr: count(*)
+joins: []
+`,
+      'ktx',
+      'ktx@example.com',
+      'Add orders source',
+    );
+    await project.fileStore.writeFile(
+      'semantic-layer/warehouse/orders_overlay.yaml',
+      `name: orders_overlay
+inherits_columns_from: orders
+columns:
+  - name: paid_at
+    type: timestamp
+joins: []
+measures: []
+grain: []
+`,
+      'ktx',
+      'ktx@example.com',
+      'Add overlay source',
+    );
+
+    compute = {
+      query: vi.fn(async (input) => ({
+        sql: 'select status, count(*) as order_count from public.orders group by status',
+        dialect: input.dialect,
+        columns: [{ name: 'orders.status' }, { name: 'orders.order_count' }],
+        plan: { measures: input.query.measures, dimensions: input.query.dimensions },
+      })),
+      validateSources: vi.fn(),
+      generateSources: vi.fn(),
+    };
+  });
+
+  afterEach(async () => {
+    await rm(tempDir, { recursive: true, force: true });
+  });
+
+  it('compiles a local semantic-layer query with computable sources only', async () => {
+    const result = await compileLocalSlQuery(project, {
+      connectionId: 'warehouse',
+      query: {
+        measures: ['orders.order_count'],
+        dimensions: ['orders.status'],
+        limit: 25,
+      },
+      compute,
+    });
+
+    expect(compute.query).toHaveBeenCalledWith({
+      sources: [
+        {
+          name: 'orders',
+          table: 'public.orders',
+          grain: ['id'],
+          columns: [
+            { name: 'id', type: 'number' },
+            { name: 'status', type: 'string' },
+          ],
+          measures: [{ name: 'order_count', expr: 'count(*)' }],
+          joins: [],
+        },
+      ],
+      dialect: 'postgres',
+      query: {
+        measures: ['orders.order_count'],
+        dimensions: ['orders.status'],
+        limit: 25,
+      },
+    });
+    expect(result).toEqual({
+      connectionId: 'warehouse',
+      dialect: 'postgres',
+      sql: 'select status, count(*) as order_count from public.orders group by status',
+      headers: ['orders.status', 'orders.order_count'],
+      rows: [],
+      totalRows: 0,
+      plan: {
+        measures: ['orders.order_count'],
+        dimensions: ['orders.status'],
+        execution: {
+          mode: 'compile_only',
+          reason: 'Local semantic-layer query compiled SQL but no data-source execution adapter is configured.',
+        },
+      },
+    });
+  });
+
+  it('compiles a local semantic-layer query from manifest-backed scan sources', async () => {
+    await project.fileStore.writeFile(
+      'semantic-layer/warehouse/_schema/public.yaml',
+      `tables:
+  payments:
+    table: public.payments
+    columns:
+      - name: payment_id
+        type: number
+        pk: true
+      - name: amount
+        type: number
+`,
+      'ktx',
+      'ktx@example.com',
+      'Add manifest shard',
+    );
+
+    await compileLocalSlQuery(project, {
+      connectionId: 'warehouse',
+      query: {
+        measures: ['sum(payments.amount)'],
+        dimensions: [],
+      },
+      compute,
+    });
+
+    expect(compute.query).toHaveBeenLastCalledWith({
+      sources: expect.arrayContaining([
+        {
+          name: 'payments',
+          table: 'public.payments',
+          grain: ['payment_id'],
+          columns: [
+            {
+              name: 'payment_id',
+              type: 'number',
+              role: undefined,
+              descriptions: undefined,
+              constraints: undefined,
+              enum_values: undefined,
+              tests: undefined,
+            },
+            {
+              name: 'amount',
+              type: 'number',
+              role: undefined,
+              descriptions: undefined,
+              constraints: undefined,
+              enum_values: undefined,
+              tests: undefined,
+            },
+          ],
+          joins: [],
+          measures: [],
+        },
+      ]),
+      dialect: 'postgres',
+      query: {
+        measures: ['sum(payments.amount)'],
+        dimensions: [],
+      },
+    });
+  });
+
+  it('strips authoring-only fields (usage, inherits_columns_from) before sending sources to the daemon', async () => {
+    await project.fileStore.writeFile(
+      'semantic-layer/warehouse/_schema/public.yaml',
+      `tables:
+  invoices:
+    table: public.invoices
+    columns:
+      - name: invoice_id
+        type: number
+        pk: true
+      - name: amount
+        type: number
+    usage:
+      narrative: Activation policy windows table for invoice analytics.
+      frequencyTier: mid
+      commonFilters:
+        - amount
+      commonGroupBys: []
+      commonJoins: []
+      staleSince: null
+`,
+      'ktx',
+      'ktx@example.com',
+      'Add manifest shard with usage',
+    );
+
+    await compileLocalSlQuery(project, {
+      connectionId: 'warehouse',
+      query: { measures: ['sum(invoices.amount)'], dimensions: [] },
+      compute,
+    });
+
+    const lastCall = (compute.query as ReturnType<typeof vi.fn>).mock.calls.at(-1)?.[0];
+    const invoices = lastCall?.sources.find((s: Record<string, unknown>) => s.name === 'invoices');
+    expect(invoices).toBeDefined();
+    expect(invoices).not.toHaveProperty('usage');
+    expect(invoices).not.toHaveProperty('inherits_columns_from');
+    expect(invoices).not.toHaveProperty('source_type');
+  });
+
+  it('resolves the only configured connection when connectionId is omitted', async () => {
+    await compileLocalSlQuery(project, {
+      query: { measures: ['orders.order_count'], dimensions: [] },
+      compute,
+    });
+
+    expect(compute.query).toHaveBeenCalledWith(
+      expect.objectContaining({
+        dialect: 'postgres',
+      }),
+    );
+  });
+
+  it('executes compiled SQL through a local query executor when requested', async () => {
+    const queryExecutor = {
+      execute: vi.fn(async () => ({
+        headers: ['status', 'order_count'],
+        rows: [['paid', 2]],
+        totalRows: 1,
+        command: 'SELECT',
+        rowCount: 1,
+      })),
+    };
+
+    const result = await compileLocalSlQuery(project, {
+      connectionId: 'warehouse',
+      query: {
+        measures: ['orders.order_count'],
+        dimensions: ['orders.status'],
+        limit: 25,
+      },
+      compute,
+      execute: true,
+      maxRows: 10,
+      queryExecutor,
+    });
+
+    expect(queryExecutor.execute).toHaveBeenCalledWith({
+      connectionId: 'warehouse',
+      projectDir: project.projectDir,
+      connection: { driver: 'postgres' },
+      sql: 'select status, count(*) as order_count from public.orders group by status',
+      maxRows: 10,
+    });
+    expect(result.rows).toEqual([['paid', 2]]);
+    expect(result.totalRows).toBe(1);
+    expect(result.plan.execution).toEqual({
+      mode: 'executed',
+      driver: 'postgres',
+      maxRows: 10,
+      rowCount: 1,
+    });
+  });
+
+  it('emits progress while compiling and executing a local semantic-layer query', async () => {
+    const progress: Array<{ progress: number; message: string }> = [];
+    const queryExecutor = {
+      execute: vi.fn(async () => ({
+        headers: ['status', 'order_count'],
+        rows: [['paid', 2]],
+        totalRows: 1,
+        command: 'SELECT',
+        rowCount: 1,
+      })),
+    };
+
+    const result = await compileLocalSlQuery(project, {
+      connectionId: 'warehouse',
+      query: {
+        measures: ['orders.order_count'],
+        dimensions: ['orders.status'],
+        limit: 25,
+      },
+      compute,
+      execute: true,
+      maxRows: 10,
+      queryExecutor,
+      onProgress: (event) => {
+        progress.push({ progress: event.progress, message: event.message });
+      },
+    });
+
+    expect(result.totalRows).toBe(1);
+    expect(progress).toEqual([
+      { progress: 0, message: 'Compiling query' },
+      { progress: 0.3, message: 'Generating SQL' },
+      { progress: 0.6, message: 'Executing' },
+      { progress: 1, message: 'Fetched 1 rows' },
+    ]);
+  });
+
+  it('requires a query executor for executed mode', async () => {
+    await expect(
+      compileLocalSlQuery(project, {
+        connectionId: 'warehouse',
+        query: { measures: ['orders.order_count'], dimensions: [] },
+        compute,
+        execute: true,
+      }),
+    ).rejects.toThrow('Local semantic-layer execution requires a query executor.');
+  });
+
+  it('requires connectionId when multiple connections are configured', async () => {
+    project.config.connections.analytics = { driver: 'bigquery' };
+
+    await expect(
+      compileLocalSlQuery(project, {
+        query: { measures: ['orders.order_count'], dimensions: [] },
+        compute,
+      }),
+    ).rejects.toThrow('connectionId is required when the local project has zero or multiple connections.');
+  });
+});