@braidhq/server 0.1.0 → 0.2.0

package/dist/infrastructure/{fs/FsGraphSerializer.js → model/FsModelSerializer.js}

@@ -2,24 +2,24 @@ import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import process from 'node:process';
 import { GraphEdge, GraphNode } from '@braidhq/schema';
 import { z } from 'zod';
-import { graphJsonPath, workspaceArtifactsDir } from './paths.js';
-export const GRAPH_JSON_VERSION = 1;
-export const GraphJsonFile = z.object({
+import { graphJsonPath, workspaceArtifactsDir } from '../_shared/paths.js';
+export const MODEL_JSON_VERSION = 1;
+export const ModelJsonFile = z.object({
     version: z.number().int(),
     nodes: z.array(GraphNode),
     edges: z.array(GraphEdge),
 });
-export class FsGraphSerializer {
+export class FsModelSerializer {
     async write(workspace, snapshot) {
         const path = graphJsonPath(workspace.rootPath);
         await mkdir(workspaceArtifactsDir(workspace.rootPath), { recursive: true });
         const payload = {
-            version: GRAPH_JSON_VERSION,
+            version: MODEL_JSON_VERSION,
             nodes: [...snapshot.nodes].sort(byId),
             edges: [...snapshot.edges].sort(byId),
         };
-        // Atomic write so a crashed server can't leave a half-file that
-        // mis-hydrates Kùzu on restart.
+        // Atomic write. A crashed server must not leave a half-file behind,
+        // one that would mis-hydrate Kùzu on the next restart.
         const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
         await writeFile(tmp, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
         await rename(tmp, path);
@@ -34,9 +34,9 @@ export class FsGraphSerializer {
                 return null;
             throw error;
         }
-        const parsed = GraphJsonFile.parse(JSON.parse(raw));
-        if (parsed.version !== GRAPH_JSON_VERSION) {
-            throw new Error(`graph.json version mismatch in ${workspace.rootPath}: expected ${GRAPH_JSON_VERSION}, got ${parsed.version}`);
+        const parsed = ModelJsonFile.parse(JSON.parse(raw));
+        if (parsed.version !== MODEL_JSON_VERSION) {
+            throw new Error(`model.json version mismatch in ${workspace.rootPath}: expected ${MODEL_JSON_VERSION}, got ${parsed.version}`);
         }
         return { nodes: parsed.nodes, edges: parsed.edges };
     }
@@ -57,4 +57,4 @@ function byId(a, b) {
         return 1;
     return 0;
 }
-//# sourceMappingURL=FsGraphSerializer.js.map
+//# sourceMappingURL=FsModelSerializer.js.map

package/dist/infrastructure/model/FsModelSerializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsModelSerializer.js","sourceRoot":"","sources":["../../../src/infrastructure/model/FsModelSerializer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAEnC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;CAC1B,CAAC,CAAA;AAEF,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,KAAK,CAAC,SAAoB,EAAE,QAAuB;QACvD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,kBAAkB;YAC3B,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACtC,CAAA;QACD,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACtE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAoB;QAC7B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,IAAI,CAAA;YACb,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,kCAAkC,SAAS,CAAC,QAAQ,cAAc,kBAAkB,SAAS,MAAM,CAAC,OAAO,EAAE,CAC9G,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAoB;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC;YACL,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,IAAI,CAA2B,CAAI,EAAE,CAAI;IAChD,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACb,OAAO,CAAC,CAAC,CAAA;IACX,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACb,OAAO,CAAC,CAAA;IACV,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/infrastructure/oauth/GoogleOAuth.d.ts

@@ -1,6 +1,6 @@
 /**
- * Profile fields Braid needs after Google authn. `sub` is the stable
- * Google account id — used as the join key into `users.json`.
+ * Profile fields Braid needs after Google authn.
+ * `sub` is the stable Google account id, used as the join key into `users.json`.
  */
 export interface GoogleProfile {
     readonly sub: string;
@@ -9,31 +9,14 @@ export interface GoogleProfile {
     readonly emailVerified?: boolean;
 }
 export interface GoogleOAuthConfig {
-    /** OAuth client id from the user's GCP project. */
     readonly clientId: string;
-    /** OAuth client secret. */
     readonly clientSecret: string;
-    /**
-     * Redirect URI used by the Drive ingestion flow (existing OAuth
-     * router). Both paths must be registered in the GCP OAuth client's
-     * authorised redirect URIs list.
-     */
     readonly redirectUri: string;
-    /**
-     * Redirect URI used by the user-login flow. Optional — falls back
-     * to the Drive `redirectUri` if unset, which is what local dev
-     * wants (one path = one registered URI). Production usually points
-     * this at `${apiUrl}/auth/google/callback` so the two flows are
-     * mounted on different routes.
-     */
     readonly loginRedirectUri?: string;
 }
 export interface AuthorizationUrlInput {
-    /** OAuth scope(s) requested. Braid passes Drive read-only. */
     readonly scopes: readonly string[];
-    /** State token (CSRF + flow-restore). */
     readonly state: string;
-    /** PKCE verifier; the URL embeds its SHA-256 challenge. */
     readonly codeVerifier: string;
 }
 export interface TokenSet {
@@ -48,20 +31,19 @@ export interface RefreshedAccessToken {
     readonly expiresAt: string;
 }
 /**
- * Minimal Google OAuth 2.0 client for installed-app / web flow.
- *
- * Why not `openid-client` or `google-auth-library`: we only need 4 calls
- * (build URL, exchange code, refresh, revoke); avoiding a heavyweight
- * dependency keeps the server's install footprint small and the auth
- * surface auditable.
+ * Minimal Google OAuth 2.0 client for the installed-app or web flow.
+ * We skip `openid-client` and `google-auth-library`,
+ * because only four calls are needed (build URL, exchange code, refresh, revoke).
+ * Avoiding a heavyweight dependency keeps the server's install footprint small,
+ * and the auth surface auditable.
  */
 export declare class GoogleOAuth {
     private readonly config;
     constructor(config: GoogleOAuthConfig);
     /**
      * Build the URL the user's browser is sent to. `state` and `codeVerifier`
-     * MUST be unique per flow; the caller stores them in pending-state until
-     * the callback arrives.
+     * MUST be unique per flow,
+     * the caller stores them in pending-state until the callback arrives.
      */
     buildAuthorizationUrl(input: AuthorizationUrlInput): string;
     exchangeCode(input: {
@@ -69,11 +51,11 @@ export declare class GoogleOAuth {
         codeVerifier: string;
     }): Promise<TokenSet>;
     /**
-     * Login flow URL. Same client + redirect as the Drive flow but with
-     * `openid email profile` scopes and no `prompt=consent` — Google
-     * suppresses the consent screen when the user has already approved
-     * those scopes, which is what you want for login (not Drive where
-     * a refresh_token is required and `prompt=consent` is forced).
+     * Login flow URL. Same client and redirect as the Drive flow,
+     * but with `openid email profile` scopes and no `prompt=consent`.
+     * Google suppresses the consent screen when the user has already approved those scopes,
+     * which is what login wants,
+     * unlike Drive where a refresh_token is required and `prompt=consent` is forced.
      */
     buildLoginUrl(input: {
         state: string;
@@ -82,12 +64,12 @@ export declare class GoogleOAuth {
     /** Path Google sends the login callback to. Routed under `/auth/google/callback`. */
     loginRedirectUri(): string;
     /**
-     * Exchange an authorization code from the login flow for the user's
-     * profile. Does NOT require `refresh_token` (login is one-shot — the
-     * Braid server issues its own session afterwards, so Google's tokens
-     * are discarded after this call). Uses the userinfo endpoint instead
-     * of decoding the id_token, so we don't bring in a JWT verifier just
-     * to read 3 fields.
+     * Exchange an authorization code from the login flow for the user's profile.
+     * Does NOT require `refresh_token`, since login is one-shot.
+     * The Braid server issues its own session afterwards,
+     * so Google's tokens are discarded after this call.
+     * Uses the userinfo endpoint instead of decoding the id_token,
+     * so no JWT verifier is pulled in just to read 3 fields.
      */
     loginWithCode(input: {
         code: string;

package/dist/infrastructure/oauth/GoogleOAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleOAuth.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM;IAgBrD,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2BpF;;;;;;OAMG;IACH,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAerE,qFAAqF;IACrF,gBAAgB,IAAI,MAAM;IAI1B;;;;;;;OAOG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA0CpF,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAsB9E;AA4BD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}
+{"version":3,"file":"GoogleOAuth.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAG7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAM5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAElC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM;IAgBrD,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2BpF;;;;;;OAMG;IACH,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAerE,qFAAqF;IACrF,gBAAgB,IAAI,MAAM;IAI1B;;;;;;;OAOG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA0CpF,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAsB9E;AA4BD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/infrastructure/oauth/GoogleOAuth.js

@@ -3,12 +3,11 @@ const AUTH_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth';
 const TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token';
 const USERINFO_ENDPOINT = 'https://openidconnect.googleapis.com/v1/userinfo';
 /**
- * Minimal Google OAuth 2.0 client for installed-app / web flow.
- *
- * Why not `openid-client` or `google-auth-library`: we only need 4 calls
- * (build URL, exchange code, refresh, revoke); avoiding a heavyweight
- * dependency keeps the server's install footprint small and the auth
- * surface auditable.
+ * Minimal Google OAuth 2.0 client for the installed-app or web flow.
+ * We skip `openid-client` and `google-auth-library`,
+ * because only four calls are needed (build URL, exchange code, refresh, revoke).
+ * Avoiding a heavyweight dependency keeps the server's install footprint small,
+ * and the auth surface auditable.
  */
 export class GoogleOAuth {
     config;
@@ -17,8 +16,8 @@ export class GoogleOAuth {
     }
     /**
      * Build the URL the user's browser is sent to. `state` and `codeVerifier`
-     * MUST be unique per flow; the caller stores them in pending-state until
-     * the callback arrives.
+     * MUST be unique per flow,
+     * the caller stores them in pending-state until the callback arrives.
      */
     buildAuthorizationUrl(input) {
         const params = new URLSearchParams({
@@ -26,7 +25,7 @@ export class GoogleOAuth {
             redirect_uri: this.config.redirectUri,
             response_type: 'code',
             scope: input.scopes.join(' '),
-            access_type: 'offline', // → refresh_token in response
+            access_type: 'offline', // yields refresh_token in the response
             prompt: 'consent', // ensure refresh_token even on re-auth
             include_granted_scopes: 'true',
             state: input.state,
@@ -55,18 +54,18 @@ export class GoogleOAuth {
         }
         const payload = await response.json();
         if (!payload.refresh_token) {
-            // Google only returns refresh_token on first consent. If we don't have
-            // one, the caller can't store anything useful for next time.
+            // Google only returns refresh_token on first consent.
+            // Without one, the caller can't store anything useful for next time.
             throw new Error('Google did not return a refresh_token. Add prompt=consent and ensure access_type=offline.');
         }
         return tokenSetFromPayload(payload);
     }
     /**
-     * Login flow URL. Same client + redirect as the Drive flow but with
-     * `openid email profile` scopes and no `prompt=consent` — Google
-     * suppresses the consent screen when the user has already approved
-     * those scopes, which is what you want for login (not Drive where
-     * a refresh_token is required and `prompt=consent` is forced).
+     * Login flow URL. Same client and redirect as the Drive flow,
+     * but with `openid email profile` scopes and no `prompt=consent`.
+     * Google suppresses the consent screen when the user has already approved those scopes,
+     * which is what login wants,
+     * unlike Drive where a refresh_token is required and `prompt=consent` is forced.
      */
     buildLoginUrl(input) {
         const params = new URLSearchParams({
@@ -87,12 +86,12 @@ export class GoogleOAuth {
         return this.config.loginRedirectUri ?? this.config.redirectUri;
     }
     /**
-     * Exchange an authorization code from the login flow for the user's
-     * profile. Does NOT require `refresh_token` (login is one-shot — the
-     * Braid server issues its own session afterwards, so Google's tokens
-     * are discarded after this call). Uses the userinfo endpoint instead
-     * of decoding the id_token, so we don't bring in a JWT verifier just
-     * to read 3 fields.
+     * Exchange an authorization code from the login flow for the user's profile.
+     * Does NOT require `refresh_token`, since login is one-shot.
+     * The Braid server issues its own session afterwards,
+     * so Google's tokens are discarded after this call.
+     * Uses the userinfo endpoint instead of decoding the id_token,
+     * so no JWT verifier is pulled in just to read 3 fields.
      */
     async loginWithCode(input) {
         const body = new URLSearchParams({

package/dist/infrastructure/oauth/GoogleOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleOAuth.js","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,aAAa,GAAG,8CAA8C,CAAA;AACpE,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAC5D,MAAM,iBAAiB,GAAG,kDAAkD,CAAA;AAwD5E;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D;;;;OAIG;IACH,qBAAqB,CAAC,KAA4B;QAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,WAAW,EAAE,SAAS,EAAE,8BAA8B;YACtD,MAAM,EAAE,SAAS,EAAE,uCAAuC;YAC1D,sBAAsB,EAAE,MAAM;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6C;QAC9D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;QAC9G,CAAC;QACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAA8C;QAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,QAAQ;YACrB,sBAAsB,EAAE,MAAM;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,qFAAqF;IACrF,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,KAA6C;QAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACvD,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAA8B,CAAA;QAE/E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;SACrD,CAAC,CAAA;QACF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,CAAC,MAAM,IAAI,gBAAgB,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAM3C,CAAA;QACD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,KAAK;YACnE,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;SAC5D,CAAA;IACH,CAAC;CACF;AAUD,SAAS,mBAAmB,CAAC,CAAmB;IAC9C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAc;QAC9B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACrD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"GoogleOAuth.js","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,aAAa,GAAG,8CAA8C,CAAA;AACpE,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAC5D,MAAM,iBAAiB,GAAG,kDAAkD,CAAA;AAmD5E;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D;;;;OAIG;IACH,qBAAqB,CAAC,KAA4B;QAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,WAAW,EAAE,SAAS,EAAE,uCAAuC;YAC/D,MAAM,EAAE,SAAS,EAAE,uCAAuC;YAC1D,sBAAsB,EAAE,MAAM;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6C;QAC9D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,sDAAsD;YACtD,qEAAqE;YACrE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;QAC9G,CAAC;QACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAA8C;QAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,QAAQ;YACrB,sBAAsB,EAAE,MAAM;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,qFAAqF;IACrF,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,KAA6C;QAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACvD,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAA8B,CAAA;QAE/E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;SACrD,CAAC,CAAA;QACF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,CAAC,MAAM,IAAI,gBAAgB,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAM3C,CAAA;QACD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,KAAK;YACnE,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;SAC5D,CAAA;IACH,CAAC;CACF;AAUD,SAAS,mBAAmB,CAAC,CAAmB;IAC9C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAc;QAC9B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACrD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC"}

package/dist/infrastructure/reactor/FsReactorCycleRepository.d.ts

@@ -0,0 +1,29 @@
+import type { ReactorCycleRepository } from '@braidhq/core';
+import type { AbsolutePath, ReactorCycle, ReactorCycleId, WorkspaceId } from '@braidhq/schema';
+export interface FsReactorCycleRepositoryOptions {
+    /**
+     * Lookup of workspaceId to workspaceRoot. Shared with the other Fs repositories,
+     * so this repo doesn't introduce a separate dependency on `WorkspaceService`.
+     * `composeFs.ts` builds a single closure once and passes it to every fs repo.
+     */
+    readonly workspaceRoots: () => Promise<ReadonlyMap<WorkspaceId, AbsolutePath>>;
+}
+/**
+ * Filesystem-backed `ReactorCycleRepository`. One JSON file per cycle,
+ * at `artifacts/reactor-cycles/<cycleId>.json`.
+ * Each save is an atomic rename,
+ * so the Studio Activity page never reads a half-written file.
+ *
+ * The file body is exactly the `ReactorCycle` shape, no wrapper or envelope.
+ * A future SQLite or Postgres impl maps one file to one row keyed by `cycleId`,
+ * with `(workspaceId, startedAt)` indexed for the list query.
+ */
+export declare class FsReactorCycleRepository implements ReactorCycleRepository {
+    private readonly options;
+    constructor(options: FsReactorCycleRepositoryOptions);
+    save(cycle: ReactorCycle): Promise<void>;
+    load(workspaceId: WorkspaceId, cycleId: ReactorCycleId): Promise<ReactorCycle | undefined>;
+    listByWorkspace(workspaceId: WorkspaceId): Promise<readonly ReactorCycle[]>;
+    private resolveRoot;
+}
+//# sourceMappingURL=FsReactorCycleRepository.d.ts.map

package/dist/infrastructure/reactor/FsReactorCycleRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsReactorCycleRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/reactor/FsReactorCycleRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAU9F,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;CAC/E;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,+BAA+B;IAE/D,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAoB1F,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;YA0BnE,WAAW;CAO1B"}

package/dist/infrastructure/reactor/FsReactorCycleRepository.js

@@ -0,0 +1,94 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import process from 'node:process';
+import { NotFoundError } from '@braidhq/core';
+import { ReactorCycle as ReactorCycleSchema } from '@braidhq/schema';
+import { reactorCycleFilePath, reactorCyclesDir } from '../_shared/paths.js';
+/**
+ * Filesystem-backed `ReactorCycleRepository`. One JSON file per cycle,
+ * at `artifacts/reactor-cycles/<cycleId>.json`.
+ * Each save is an atomic rename,
+ * so the Studio Activity page never reads a half-written file.
+ *
+ * The file body is exactly the `ReactorCycle` shape, no wrapper or envelope.
+ * A future SQLite or Postgres impl maps one file to one row keyed by `cycleId`,
+ * with `(workspaceId, startedAt)` indexed for the list query.
+ */
+export class FsReactorCycleRepository {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async save(cycle) {
+        const root = await this.resolveRoot(cycle.workspaceId);
+        const file = reactorCycleFilePath(root, cycle.id);
+        await mkdir(reactorCyclesDir(root), { recursive: true });
+        // Random suffix so concurrent saves in the same ms don't collide.
+        const tmp = `${file}.tmp-${process.pid}-${randomUUID()}`;
+        await writeFile(tmp, `${JSON.stringify(cycle, null, 2)}\n`, 'utf-8');
+        await rename(tmp, file);
+    }
+    async load(workspaceId, cycleId) {
+        const root = await this.resolveRoot(workspaceId);
+        const file = reactorCycleFilePath(root, cycleId);
+        try {
+            const raw = await readFile(file, 'utf-8');
+            const parsed = ReactorCycleSchema.parse(JSON.parse(raw));
+            // The directory layout is per-workspace already,
+            // but double-check the body matches, guarding the case,
+            // where an operator copy-pasted in a file from another workspace.
+            if (parsed.workspaceId !== workspaceId)
+                return undefined;
+            return parsed;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    }
+    async listByWorkspace(workspaceId) {
+        const root = await this.resolveRoot(workspaceId);
+        const dir = reactorCyclesDir(root);
+        const entries = await safeReaddir(dir);
+        const cycles = [];
+        for (const entry of entries) {
+            if (!entry.isFile() || !entry.name.endsWith('.json'))
+                continue;
+            if (entry.name.includes('.tmp-'))
+                continue;
+            const raw = await readFile(join(dir, entry.name), 'utf-8');
+            try {
+                const parsed = ReactorCycleSchema.parse(JSON.parse(raw));
+                if (parsed.workspaceId === workspaceId)
+                    cycles.push(parsed);
+            }
+            catch {
+                // Skip files that fail validation, truncated half-writes,
+                // or manual edits gone wrong.
+                // Raising them as errors here would,
+                // in turn, block the Activity page from rendering recent cycles.
+            }
+        }
+        return cycles.sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+    }
+    async resolveRoot(workspaceId) {
+        const roots = await this.options.workspaceRoots();
+        const root = roots.get(workspaceId);
+        if (!root)
+            throw new NotFoundError(`Workspace "${workspaceId}" has no registered root path`);
+        return root;
+    }
+}
+async function safeReaddir(dir) {
+    try {
+        return await readdir(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+//# sourceMappingURL=FsReactorCycleRepository.js.map

package/dist/infrastructure/reactor/FsReactorCycleRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsReactorCycleRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/reactor/FsReactorCycleRepository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAW5E;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,OAAwC;QAAxC,YAAO,GAAP,OAAO,CAAiC;IAAG,CAAC;IAEzE,KAAK,CAAC,IAAI,CAAC,KAAmB;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,kEAAkE;QAClE,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAA;QACxD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAwB,EAAE,OAAuB;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACxD,iDAAiD;YACjD,wDAAwD;YACxD,kEAAkE;YAClE,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;gBACpC,OAAO,SAAS,CAAA;YAClB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,SAAS,CAAA;YAClB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAwB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,MAAM,GAAmB,EAAE,CAAA;QACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAClD,SAAQ;YACV,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC9B,SAAQ;YACV,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;gBACxD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;oBACpC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvB,CAAC;YACD,MAAM,CAAC;gBACL,0DAA0D;gBAC1D,8BAA8B;gBAC9B,qCAAqC;gBACrC,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACtE,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,WAAwB;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,cAAc,WAAW,+BAA+B,CAAC,CAAA;QACnF,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,OAAO,EAAE,CAAA;QACX,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/infrastructure/secrets/SecretStore.d.ts

@@ -1,20 +1,17 @@
 /**
- * Per-scope JSON secret storage on the local filesystem. One file per
- * `(namespace, key)` under `<root>/<namespace>/<key>.json`. Files are
- * written with mode 0600 so only the running user can read them; the
- * containing directory is mode 0700.
+ * Per-scope JSON secret storage on the local filesystem.
+ * One file per `(namespace, key)` under `<root>/<namespace>/<key>.json`.
+ * Files are written with mode 0600 so only the running user can read them,
+ * the containing directory is mode 0700.
  *
- * This is NOT an encrypted-at-rest store. It's appropriate for local /
- * single-user Braid installs (the OSS target). A hosted SaaS deployment
- * would swap this for a vault adapter (AWS Secrets Manager, Vault, …)
- * by implementing the same interface.
+ * This is NOT an encrypted-at-rest store.
+ * It suits local, single-user Braid installs (the OSS target).
+ * A hosted SaaS deployment would swap this for a vault adapter,
+ * such as AWS Secrets Manager or Vault, behind the same interface.
  *
- * Layout:
- *   <root>/
- *     oauth-google/
- *       <workspaceId>--<sourceId>.json  # one set of tokens per source
- *     oauth-github/
- *       <workspaceId>--<sourceId>.json
+ * Layout, one tokens file per source under a per-provider namespace,
+ * so Google tokens live at `<root>/oauth-google/<workspaceId>--<sourceId>.json`,
+ * and GitHub tokens at `<root>/oauth-github/<workspaceId>--<sourceId>.json`.
  */
 export interface SecretRecord {
     readonly value: unknown;

package/dist/infrastructure/secrets/SecretStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IACnE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED,qBAAa,aAAc,YAAW,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEnC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAc/D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D,OAAO,CAAC,OAAO;CAGhB"}
+{"version":3,"file":"SecretStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IACnE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED,qBAAa,aAAc,YAAW,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEnC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAc/D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D,OAAO,CAAC,OAAO;CAGhB"}

package/dist/infrastructure/secrets/SecretStore.js

@@ -23,8 +23,8 @@ export class FsSecretStore {
         await mkdir(dirname(path), { recursive: true, mode: 0o700 });
         const record = { value, updatedAt: new Date().toISOString() };
         await writeFile(path, JSON.stringify(record, null, 2), { encoding: 'utf-8', mode: 0o600 });
-        // mkdir's mode arg is ignored on some platforms; explicitly chmod the
-        // dir + file to keep the perms stable across reboots / restores.
+        // mkdir's mode arg is ignored on some platforms,
+        // so chmod the dir and file explicitly to keep perms stable across reboots and restores.
         await chmod(dirname(path), 0o700);
         await chmod(path, 0o600);
     }
@@ -36,8 +36,8 @@ export class FsSecretStore {
         return join(this.root, sanitize(namespace), `${sanitize(key)}.json`);
     }
 }
-// Conservative: only ASCII letters / digits / `-`, `_`, `.`. Anything else
-// is replaced with `_` so a hostile workspaceId can't escape the dir.
+// Conservative allowlist of ASCII letters, digits, `-`, `_`, and `.`.
+// Anything else becomes `_` so a hostile workspaceId can't escape the dir.
 function sanitize(input) {
     return input.replace(/[^\w.-]/g, '_');
 }

package/dist/infrastructure/secrets/SecretStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretStore.js","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA+BzC,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAI,SAAiB,EAAE,GAAW;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;YAC9C,OAAO,MAAM,CAAC,KAAU,CAAA;QAC1B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,SAAS,CAAA;YAClB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAc;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QAC3E,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1F,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,GAAW;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,GAAW;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtE,CAAC;CACF;AAED,2EAA2E;AAC3E,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC"}
+{"version":3,"file":"SecretStore.js","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA4BzC,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAI,SAAiB,EAAE,GAAW;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;YAC9C,OAAO,MAAM,CAAC,KAAU,CAAA;QAC1B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,SAAS,CAAA;YAClB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAc;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QAC3E,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1F,iDAAiD;QACjD,yFAAyF;QACzF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,GAAW;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,GAAW;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtE,CAAC;CACF;AAED,sEAAsE;AACtE,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC"}

package/dist/infrastructure/{fs → skill}/FsRunRepository.d.ts

@@ -7,9 +7,10 @@ import type { AbsolutePath, RunRecord, SessionMetadata, SkillEvent, SkillRunId }
  *     ├── index.jsonl                (append-only summary, last-wins per runId)
  *     └── <runId>.jsonl              (full SkillEvent stream for one run)
  *
- * Index is append-only because every concurrent write of a single workspace
- * goes through one server process today; if that changes we'd swap to
- * `mv tmp final` atomic rewrites or hand it to sqlite.
+ * The index is append-only because every write of one workspace goes,
+ * today, through a single server process.
+ * Should that ever change,
+ * we would swap to atomic `mv tmp final` rewrites, or hand it to sqlite.
  */
 export declare class FsRunRepository implements RunRepository {
     saveRecord(workspace: Workspace, record: RunRecord): Promise<void>;
@@ -20,5 +21,6 @@ export declare class FsRunRepository implements RunRepository {
     saveSessionMetadata(workspace: Workspace, metadata: SessionMetadata): Promise<void>;
     listSessionMetadata(workspace: Workspace): Promise<readonly SessionMetadata[]>;
 }
+/** Re-exported so callers don't need to thread AbsolutePath types around. */
 export type { AbsolutePath };
 //# sourceMappingURL=FsRunRepository.d.ts.map

package/dist/infrastructure/skill/FsRunRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsRunRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/skill/FsRunRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAQvG;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,aAAa;IAC7C,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlE,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtF,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAyB9D,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAkBhF,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCjF,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnF,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAsBrF;AA6BD,6EAA6E;AAC7E,YAAY,EAAE,YAAY,EAAE,CAAA"}

package/dist/infrastructure/{fs → skill}/FsRunRepository.js

@@ -3,7 +3,7 @@ import { appendFile, mkdir, readFile, rename, rm, writeFile } from 'node:fs/prom
 import process from 'node:process';
 import { createInterface } from 'node:readline/promises';
 import { RunRecord as RunRecordSchema, SessionMetadata as SessionMetadataSchema, SkillEvent as SkillEventSchema } from '@braidhq/schema';
-import { runEventsPath, runIndexPath, runsDir, runSessionsMetadataPath } from './paths.js';
+import { runEventsPath, runIndexPath, runsDir, runSessionsMetadataPath } from '../_shared/paths.js';
 /**
  * File-system adapter for skill-run recording.
  *
@@ -11,9 +11,10 @@ import { runEventsPath, runIndexPath, runsDir, runSessionsMetadataPath } from '.
  *     ├── index.jsonl                (append-only summary, last-wins per runId)
  *     └── <runId>.jsonl              (full SkillEvent stream for one run)
  *
- * Index is append-only because every concurrent write of a single workspace
- * goes through one server process today; if that changes we'd swap to
- * `mv tmp final` atomic rewrites or hand it to sqlite.
+ * The index is append-only because every write of one workspace goes,
+ * today, through a single server process.
+ * Should that ever change,
+ * we would swap to atomic `mv tmp final` rewrites, or hand it to sqlite.
  */
 export class FsRunRepository {
     async saveRecord(workspace, record) {
@@ -85,9 +86,10 @@ export class FsRunRepository {
             throw error;
         }
         // Rewrite the index excluding every line that names a target run.
-        // Last-wins reader semantics mean we must drop ALL occurrences, not
-        // just the latest one, otherwise an earlier entry would resurrect
-        // the run in `listRecords()`.
+        // Last-wins reader semantics mean we must drop ALL occurrences,
+        // not just the latest one.
+        // An earlier entry left behind would,
+        // otherwise resurrect the run when `listRecords()` next runs.
         const kept = [];
         for (const line of raw.split('\n')) {
             if (line.length === 0)
@@ -100,8 +102,8 @@ export class FsRunRepository {
         const tmp = `${indexPath}.tmp-${process.pid}-${Date.now()}`;
         await writeFile(tmp, kept.length === 0 ? '' : `${kept.join('\n')}\n`, 'utf-8');
         await rename(tmp, indexPath);
-        // Per-runId event files: best-effort removal. A missing file is
-        // fine (the run errored before any event was appended).
+        // Per-runId event files get best-effort removal.
+        // A missing file is fine, the run errored before any event landed.
         await Promise.all(runIds.map(id => rm(runEventsPath(root, id), { force: true })));
     }
     async saveSessionMetadata(workspace, metadata) {

package/dist/infrastructure/skill/FsRunRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsRunRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/skill/FsRunRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrF,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,eAAe,IAAI,qBAAqB,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACxI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAEnG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,UAAU,CAAC,SAAoB,EAAE,MAAiB;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAoB,EAAE,KAAiB,EAAE,KAAiB;QAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAA;QACzC,MAAM,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAoB;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,CAAA;YACX,MAAM,KAAK,CAAA;QACb,CAAC;QACD,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnB,SAAQ;YACV,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YACpC,IAAI,MAAM;gBACR,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;QACD,8EAA8E;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACzF,CAAC;IAED,KAAK,CAAC,CAAE,UAAU,CAAC,SAAoB,EAAE,KAAiB;QACxD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACtF,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBACnB,SAAQ;gBACV,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACnC,IAAI,MAAM;oBACR,MAAM,MAAM,CAAA;YAChB,CAAC;QACH,CAAC;gBACO,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAoB,EAAE,MAA6B;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACrB,OAAM;QACR,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,CAAA;QACvC,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAM;YACR,MAAM,KAAK,CAAA;QACb,CAAC;QACD,kEAAkE;QAClE,gEAAgE;QAChE,2BAA2B;QAC3B,sCAAsC;QACtC,8DAA8D;QAC9D,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnB,SAAQ;YACV,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YACpC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrC,SAAQ;YACV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QAC3D,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC9E,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC5B,iDAAiD;QACjD,mEAAmE;QACnE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAoB,EAAE,QAAyB;QACvE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAA;QAC5C,MAAM,UAAU,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAoB;QAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;QAC/B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,CAAA;YACX,MAAM,KAAK,CAAA;QACb,CAAC;QACD,+DAA+D;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAA;QAC/C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnB,SAAQ;YACV,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC7C,IAAI,MAAM;gBACR,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/infrastructure/{fs → skill}/FsSkillRegistry.d.ts

@@ -3,11 +3,10 @@ import { type PluginRegistry, SkillManifest, type SkillRegistry, type Workspace
 export interface FsSkillRegistryOptions {
     readonly builtinSkillsRoot: AbsolutePath;
     /**
-     * Optional plugin registry. When provided, skills declared by
-     * registered plugins are mounted under the `plugin` origin between
-     * builtins and workspace skills. Without it (e.g. in unit tests
-     * that don't compose a registry) only builtin / workspace /
-     * extension origins are discovered.
+     * Optional plugin registry. When provided, plugin-declared skills mount,
+     * between builtins and workspace skills, under the `plugin` origin.
+     * Without it, as in unit tests that compose no registry, only builtin,
+     * workspace, and extension origins are discovered.
      */
     readonly pluginRegistry?: PluginRegistry;
 }
@@ -18,14 +17,6 @@ export declare class FsSkillRegistry implements SkillRegistry {
     find(workspace: Workspace, skillId: SkillId): Promise<SkillManifest | undefined>;
     get(workspace: Workspace, skillId: SkillId): Promise<SkillManifest>;
     private scanSkillsRoot;
-    /**
-     * Resolve every PluginSkillRef in the registry to a parsed
-     * SkillManifest. Each ref's `directory` is converted to an absolute
-     * fs path (URL via fileURLToPath), then `SKILL.md` is read and
-     * parsed. Missing files at a plugin-declared path are an error,
-     * not a silent skip: a plugin that ships a broken ref deserves a
-     * loud startup failure, not a mysteriously-absent skill.
-     */
     private scanPluginSkills;
     private scanExtensionRoot;
     private readSkillFrontmatter;