@frontmcp/adapters 1.3.0 → 1.4.1

package/skills/index.js

@@ -33,6 +33,7 @@ __export(skills_exports, {
   BundlePinnedError: () => BundlePinnedError,
   BundlePushJwtVerifier: () => BundlePushJwtVerifier,
   BundleStore: () => BundleStore,
+  ClassificationRegistry: () => ClassificationRegistry,
   FilesystemSkillsSource: () => FilesystemSkillsSource,
   Hs256AuditSigner: () => Hs256AuditSigner,
   MemoryAuditStore: () => MemoryAuditStore,
@@ -52,15 +53,25 @@ __export(skills_exports, {
   StaticSource: () => StaticSource,
   StorageAdapterAuditStore: () => StorageAdapterAuditStore,
   WebhookReplayGuard: () => WebhookReplayGuard,
+  applyClassificationOverrides: () => applyClassificationOverrides,
+  applyEnvironmentOverlay: () => applyEnvironmentOverlay,
+  buildKnownOps: () => buildKnownOps,
+  buildResourceChangeNotification: () => buildResourceChangeNotification,
   bundleDigest: () => bundleDigest,
   bundleSkillToActions: () => bundleSkillToActions,
   bundleSourceSchema: () => bundleSourceSchema,
   canonicalize: () => canonicalize,
   canonicalizeRecordForSigning: () => canonicalizeRecordForSigning,
+  classifyOne: () => classifyOne,
+  classifyOperations: () => classifyOperations,
   createBundleSource: () => createBundleSource,
   crossValidate: () => crossValidate,
+  crossValidateManifest: () => crossValidateManifest,
+  dedupeOpReferences: () => dedupeOpReferences,
   defaultAuditSignatureVerifier: () => defaultAuditSignatureVerifier,
+  deployManifestSchema: () => deployManifestSchema,
   diffBundles: () => diffBundles,
+  extractOpReferences: () => extractOpReferences,
   formatDiffSummary: () => formatDiffSummary,
   hasSkillAuditFactory: () => import_sdk.hasSkillAuditFactory,
   linkRecord: () => linkRecord,
@@ -69,12 +80,14 @@ __export(skills_exports, {
   npmSourceSchema: () => npmSourceSchema,
   parseOverlay: () => parseOverlay,
   parseSkillFrontmatter: () => parseSkillFrontmatter,
+  renderResourceUri: () => renderResourceUri,
   resolveSkillLoadOrder: () => resolveSkillLoadOrder,
   resolvedBundleSchema: () => resolvedBundleSchema,
   saasSourceSchema: () => saasSourceSchema,
   setSkillAuditFactory: () => import_sdk.setSkillAuditFactory,
   signatureKeySchema: () => signatureKeySchema,
   staticSourceSchema: () => staticSourceSchema,
+  validateOpReferences: () => validateOpReferences,
   verifyBundleSignature: () => verifyBundleSignature,
   verifyChain: () => verifyChain
 });
@@ -784,8 +797,7 @@ var NpmSource = class {
 };
 
 // libs/adapters/src/skills/sources/saas-pull.source.ts
-var import_node_fs = require("node:fs");
-var path = __toESM(require("node:path"));
+var import_utils = require("@frontmcp/utils");
 var DEFAULT_CACHE_DIR = ".frontmcp/skilled-openapi";
 var DEFAULT_PULL_TIMEOUT_MS = 3e4;
 var SaasPullSource = class {
@@ -887,13 +899,13 @@ var SaasPullSource = class {
   }
   cachePath() {
     const dir = this.cacheDir ?? DEFAULT_CACHE_DIR;
-    return path.resolve(dir, `${this.options.expectedAudience.replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`);
+    return (0, import_utils.pathResolve)(dir, `${this.options.expectedAudience.replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`);
   }
   async persistCache(bundle) {
     try {
       const filePath = this.cachePath();
-      await import_node_fs.promises.mkdir(path.dirname(filePath), { recursive: true });
-      await import_node_fs.promises.writeFile(filePath, JSON.stringify(bundle), "utf8");
+      await (0, import_utils.ensureDir)((0, import_utils.dirname)(filePath));
+      await (0, import_utils.writeFile)(filePath, JSON.stringify(bundle));
     } catch (e) {
       this.logger.warn(`[saas-source] cache persist failed: ${e.message}`);
     }
@@ -901,7 +913,7 @@ var SaasPullSource = class {
   async loadCache() {
     try {
       const filePath = this.cachePath();
-      const raw = await import_node_fs.promises.readFile(filePath, "utf8");
+      const raw = await (0, import_utils.readFile)(filePath, "utf8");
       return parseOverlay({ kind: "json", content: raw });
     } catch {
       return void 0;
@@ -919,9 +931,7 @@ var SaasPullSource = class {
 };
 
 // libs/adapters/src/skills/sources/static.source.ts
-var import_node_fs2 = require("node:fs");
-var path2 = __toESM(require("node:path"));
-var import_utils = require("@frontmcp/utils");
+var import_utils2 = require("@frontmcp/utils");
 var StaticSource = class {
   constructor(options, logger) {
     this.options = options;
@@ -959,9 +969,9 @@ var StaticSource = class {
     this.listeners.clear();
   }
   async fetchOnce() {
-    const absPath = path2.resolve(this.options.path);
-    const raw = await (0, import_utils.readFile)(absPath, "utf8");
-    const ext = path2.extname(absPath).toLowerCase();
+    const absPath = (0, import_utils2.pathResolve)(this.options.path);
+    const raw = await (0, import_utils2.readFile)(absPath, "utf8");
+    const ext = (0, import_utils2.extname)(absPath).toLowerCase();
     let input;
     if (ext === ".json") {
       input = { kind: "json", content: raw };
@@ -983,9 +993,9 @@ var StaticSource = class {
     }
   }
   beginWatch() {
-    const absPath = path2.resolve(this.options.path);
+    const absPath = (0, import_utils2.pathResolve)(this.options.path);
     try {
-      this.watcher = (0, import_node_fs2.watch)(absPath, { persistent: false }, () => this.scheduleRefresh());
+      this.watcher = (0, import_utils2.watchFile)(absPath, () => this.scheduleRefresh());
     } catch (e) {
       this.logger.warn(`[static-source] fs.watch failed (${e.message}); polling at 2s instead`);
       const tick = () => {
@@ -1024,9 +1034,7 @@ function createBundleSource(source, cacheDir, logger) {
 }
 
 // libs/adapters/src/skills/sources/filesystem-skills.source.ts
-var import_node_fs3 = require("node:fs");
-var import_node_path = require("node:path");
-var import_utils2 = require("@frontmcp/utils");
+var import_utils3 = require("@frontmcp/utils");
 var DEFAULT_OPTIONS = {
   skillsDir: "./skills",
   watch: true,
@@ -1056,9 +1064,9 @@ var FilesystemSkillsSource = class {
     };
   }
   async start() {
-    const absRoot = (0, import_utils2.pathResolve)(this.options.skillsDir);
+    const absRoot = (0, import_utils3.pathResolve)(this.options.skillsDir);
     try {
-      this.rootResolved = await (0, import_utils2.realpath)(absRoot);
+      this.rootResolved = await (0, import_utils3.realpath)(absRoot);
     } catch {
       this.rootResolved = absRoot;
     }
@@ -1094,7 +1102,7 @@ var FilesystemSkillsSource = class {
   async listSkillSubdirs() {
     let entries;
     try {
-      entries = await (0, import_utils2.readdir)(this.rootResolved);
+      entries = await (0, import_utils3.readdir)(this.rootResolved);
     } catch (e) {
       this.logger.warn(`[fs-skills] cannot read ${this.rootResolved}: ${e.message}`);
       return [];
@@ -1102,19 +1110,19 @@ var FilesystemSkillsSource = class {
     const out = [];
     for (const name of entries) {
       if (name.startsWith(".")) continue;
-      const abs = (0, import_utils2.joinPath)(this.rootResolved, name);
+      const abs = (0, import_utils3.joinPath)(this.rootResolved, name);
       let resolved;
       try {
-        resolved = await (0, import_utils2.realpath)(abs);
+        resolved = await (0, import_utils3.realpath)(abs);
       } catch {
         continue;
       }
-      if (!resolved.startsWith(this.rootResolved + import_node_path.sep) && resolved !== this.rootResolved) {
+      if (!resolved.startsWith(this.rootResolved + import_utils3.sep) && resolved !== this.rootResolved) {
         this.logger.warn(`[fs-skills] skipping ${name}: realpath escapes skillsDir`);
         continue;
       }
       try {
-        const st = await (0, import_utils2.stat)(resolved);
+        const st = await (0, import_utils3.stat)(resolved);
         if (st.isDirectory()) out.push(resolved);
       } catch {
       }
@@ -1126,7 +1134,7 @@ var FilesystemSkillsSource = class {
     if (this.stopped) return;
     let exists = false;
     try {
-      const st = await (0, import_utils2.stat)(absDir);
+      const st = await (0, import_utils3.stat)(absDir);
       exists = st.isDirectory();
     } catch {
       exists = false;
@@ -1164,18 +1172,22 @@ var FilesystemSkillsSource = class {
   }
   beginWatch() {
     try {
-      this.watcher = (0, import_node_fs3.watch)(this.rootResolved, { recursive: true, persistent: false }, (_eventType, filename) => {
-        if (this.stopped) return;
-        if (!filename) {
-          this.scheduleRescan();
-          return;
-        }
-        const first = filename.split(import_node_path.sep)[0];
-        if (!first || first.startsWith(".")) return;
-        const absDir = (0, import_utils2.joinPath)(this.rootResolved, first);
-        this.scheduleRefresh(absDir);
-      });
-      this.watcher.on("error", (e) => {
+      this.watcher = (0, import_utils3.watchFile)(
+        this.rootResolved,
+        (_eventType, filename) => {
+          if (this.stopped) return;
+          if (!filename) {
+            this.scheduleRescan();
+            return;
+          }
+          const first = filename.split(import_utils3.sep)[0];
+          if (!first || first.startsWith(".")) return;
+          const absDir = (0, import_utils3.joinPath)(this.rootResolved, first);
+          this.scheduleRefresh(absDir);
+        },
+        { recursive: true }
+      );
+      this.watcher.onError((e) => {
         this.logger.warn(`[fs-skills] fs.watch error: ${e.message}; falling back to polling`);
         this.watcher?.close();
         this.watcher = void 0;
@@ -1243,10 +1255,10 @@ var FilesystemSkillsSource = class {
   }
 };
 async function loadFilesystemSkill(absDir) {
-  const skillMdPath = (0, import_utils2.joinPath)(absDir, "SKILL.md");
-  const raw = await (0, import_utils2.readFile)(skillMdPath, "utf8");
+  const skillMdPath = (0, import_utils3.joinPath)(absDir, "SKILL.md");
+  const raw = await (0, import_utils3.readFile)(skillMdPath, "utf8");
   const { frontmatter, body } = parseSkillFrontmatter(raw);
-  const dirName = (0, import_utils2.basename)(absDir);
+  const dirName = (0, import_utils3.basename)(absDir);
   const name = frontmatter["name"] ?? dirName;
   const description = frontmatter["description"] ?? "";
   if (!description) {
@@ -1259,9 +1271,9 @@ async function loadFilesystemSkill(absDir) {
   const tools = parseToolList(frontmatter["tools"]);
   const resources = {};
   for (const sub of ["scripts", "references", "examples", "assets"]) {
-    const subAbs = (0, import_utils2.joinPath)(absDir, sub);
+    const subAbs = (0, import_utils3.joinPath)(absDir, sub);
     try {
-      const st = await (0, import_utils2.stat)(subAbs);
+      const st = await (0, import_utils3.stat)(subAbs);
       if (st.isDirectory()) resources[sub] = subAbs;
     } catch {
     }
@@ -1334,7 +1346,7 @@ function skillContentEqual(a, b) {
 }
 
 // libs/adapters/src/skills/security/bundle-signature.ts
-var import_utils3 = require("@frontmcp/utils");
+var import_utils4 = require("@frontmcp/utils");
 function classifyReason(reason) {
   if (reason.includes("missing integrity")) return "missing_integrity";
   if (reason.includes("digest mismatch")) return "digest_mismatch";
@@ -1360,11 +1372,11 @@ function canonicalize(value) {
 function bundleDigest(bundle) {
   const { integrity: _drop, ...rest } = bundle;
   void _drop;
-  return (0, import_utils3.sha256Hex)(canonicalize(rest));
+  return (0, import_utils4.sha256Hex)(canonicalize(rest));
 }
 function decodeSignatureBytes(signatureBase64Url) {
   try {
-    return (0, import_utils3.base64urlDecode)(signatureBase64Url);
+    return (0, import_utils4.base64urlDecode)(signatureBase64Url);
   } catch {
     return void 0;
   }
@@ -1400,7 +1412,7 @@ function verifyBundleSignature(bundle, trustedKeys, telemetry) {
   }
   let publicJwk;
   try {
-    publicJwk = (0, import_utils3.pemToPublicJwk)(trusted.publicKeyPem);
+    publicJwk = (0, import_utils4.pemToPublicJwk)(trusted.publicKeyPem);
   } catch (e) {
     return fail(`failed to parse public key for "${keyId}": ${e.message}`);
   }
@@ -1411,7 +1423,7 @@ function verifyBundleSignature(bundle, trustedKeys, telemetry) {
   const { integrity: _drop, ...rest } = bundle;
   void _drop;
   const canonicalBytes = new TextEncoder().encode(canonicalize(rest));
-  const verified = (0, import_utils3.rsaVerifySync)(alg, canonicalBytes, publicJwk, sigBytes);
+  const verified = (0, import_utils4.rsaVerifySync)(alg, canonicalBytes, publicJwk, sigBytes);
   if (!verified) {
     return fail("signature verification failed");
   }
@@ -1488,7 +1500,7 @@ var BundlePushJwtVerifier = class {
 };
 
 // libs/adapters/src/skills/security/webhook-replay-guard.ts
-var import_utils4 = require("@frontmcp/utils");
+var import_utils5 = require("@frontmcp/utils");
 function classifyReplayReason(reason) {
   if (reason.includes("not finite")) return "invalid_timestamp";
   if (reason.includes("too short")) return "invalid_nonce";
@@ -1551,7 +1563,7 @@ var WebhookReplayGuard = class {
     if (Math.abs(now - timestampMs) > this.windowMs) {
       return reject(`timestamp outside ${this.windowMs}ms window`);
     }
-    const key = (0, import_utils4.sha256Hex)(nonce);
+    const key = (0, import_utils5.sha256Hex)(nonce);
     const expiresAt = this.seen.get(key);
     if (expiresAt !== void 0 && expiresAt >= now) {
       return reject("nonce replay detected within freshness window");
@@ -1602,7 +1614,7 @@ var SKILL_AUDIT_KEYS = {
 };
 
 // libs/adapters/src/skills/audit/audit-chain.ts
-var import_utils5 = require("@frontmcp/utils");
+var import_utils6 = require("@frontmcp/utils");
 function canonicalizeRecordForSigning(record) {
   const { signature: _drop, ...rest } = record;
   void _drop;
@@ -1610,7 +1622,7 @@ function canonicalizeRecordForSigning(record) {
 }
 function nextPrevHash(prev) {
   if (!prev) return SKILL_AUDIT_GENESIS_PREV_HASH;
-  return (0, import_utils5.sha256Hex)(canonicalizeRecordForSigning(prev));
+  return (0, import_utils6.sha256Hex)(canonicalizeRecordForSigning(prev));
 }
 function linkRecord(prev, partial) {
   return {
@@ -1664,7 +1676,7 @@ function verifyChain(records, trustedKeys, verifier) {
 }
 
 // libs/adapters/src/skills/audit/audit-signer.ts
-var import_utils6 = require("@frontmcp/utils");
+var import_utils7 = require("@frontmcp/utils");
 var Hs256AuditSigner = class {
   key;
   keyId;
@@ -1699,9 +1711,9 @@ var Hs256AuditSigner = class {
         signatureAlg: "HS256"
       })
     );
-    const mac = (0, import_utils6.hmacSha256)(this.key, canonicalBytes);
+    const mac = (0, import_utils7.hmacSha256)(this.key, canonicalBytes);
     return {
-      signature: (0, import_utils6.base64urlEncode)(mac),
+      signature: (0, import_utils7.base64urlEncode)(mac),
       keyId: this.keyId,
       alg: "HS256"
     };
@@ -1741,7 +1753,7 @@ var Rs256AuditSigner = class {
         signatureAlg: "RS256"
       })
     );
-    const signature = (0, import_utils6.rsaSignBase64Url)("RS256", canonicalBytes, this.privateJwk);
+    const signature = (0, import_utils7.rsaSignBase64Url)("RS256", canonicalBytes, this.privateJwk);
     return {
       signature,
       keyId: this.keyId,
@@ -1766,31 +1778,31 @@ var defaultAuditSignatureVerifier = ({
   if (!trusted) return false;
   if (alg === "HS256") {
     if (!trusted.secret) return false;
-    const expected = (0, import_utils6.hmacSha256)(trusted.secret, data);
+    const expected = (0, import_utils7.hmacSha256)(trusted.secret, data);
     let actual;
     try {
-      actual = (0, import_utils6.base64urlDecode)(signatureBase64Url);
+      actual = (0, import_utils7.base64urlDecode)(signatureBase64Url);
     } catch {
       return false;
     }
     if (actual.length !== expected.length) return false;
-    return (0, import_utils6.timingSafeEqual)(actual, expected);
+    return (0, import_utils7.timingSafeEqual)(actual, expected);
   }
   if (alg === "RS256") {
     if (!trusted.publicKeyPem && !trusted.publicJwk) return false;
     let publicJwk;
     try {
-      publicJwk = trusted.publicJwk ?? (0, import_utils6.pemToPublicJwk)(trusted.publicKeyPem);
+      publicJwk = trusted.publicJwk ?? (0, import_utils7.pemToPublicJwk)(trusted.publicKeyPem);
     } catch {
       return false;
     }
     let sigBytes;
     try {
-      sigBytes = (0, import_utils6.base64urlDecode)(signatureBase64Url);
+      sigBytes = (0, import_utils7.base64urlDecode)(signatureBase64Url);
     } catch {
       return false;
     }
-    return (0, import_utils6.rsaVerifySync)("RS256", data, publicJwk, sigBytes);
+    return (0, import_utils7.rsaVerifySync)("RS256", data, publicJwk, sigBytes);
   }
   const _exhaustive = alg;
   void _exhaustive;
@@ -1890,7 +1902,7 @@ var StorageAdapterAuditStore = class {
 };
 
 // libs/adapters/src/skills/audit/audit-writer.ts
-var import_utils7 = require("@frontmcp/utils");
+var import_utils8 = require("@frontmcp/utils");
 var SKILL_AUDIT_ERROR_MESSAGE_MAX = 500;
 var SKILL_AUDIT_QUEUE_MAX = 1e3;
 var SkillAuditWriter = class {
@@ -1997,7 +2009,7 @@ var SkillAuditWriter = class {
     }
     let inputHash;
     try {
-      inputHash = (0, import_utils7.sha256Hex)(canonicalize(ctx.input ?? null));
+      inputHash = (0, import_utils8.sha256Hex)(canonicalize(ctx.input ?? null));
     } catch (e) {
       this.logger.warn(`[skill-audit] failed to canonicalize input: ${e.message}`);
       this.metrics?.incrementWriteFailure("unexpected");
@@ -2012,7 +2024,7 @@ var SkillAuditWriter = class {
       return;
     }
     const partial = {
-      id: (0, import_utils7.randomUUID)(),
+      id: (0, import_utils8.randomUUID)(),
       sequence,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       subject: this.applySubjectMode(ctx.subject || "anonymous"),
@@ -2077,8 +2089,8 @@ var SkillAuditWriter = class {
   applySubjectMode(subject) {
     if (this.subjectMode === "plain") return subject;
     if (this.subjectMode === "omit") return "redacted";
-    const mac = (0, import_utils7.hmacSha256)(this.subjectHashSecret, new TextEncoder().encode(subject));
-    const hex = (0, import_utils7.bytesToHex)(mac);
+    const mac = (0, import_utils8.hmacSha256)(this.subjectHashSecret, new TextEncoder().encode(subject));
+    const hex = (0, import_utils8.bytesToHex)(mac);
     return `hashed:${hex.slice(0, 32)}`;
   }
   /**
@@ -2105,9 +2117,9 @@ var SkillAuditWriter = class {
    */
   safeHash(value) {
     try {
-      return (0, import_utils7.sha256Hex)(canonicalize(value ?? null));
+      return (0, import_utils8.sha256Hex)(canonicalize(value ?? null));
     } catch {
-      return (0, import_utils7.sha256Hex)("audit:non-canonicalizable-output");
+      return (0, import_utils8.sha256Hex)("audit:non-canonicalizable-output");
     }
   }
   /** Truncate + sanitize an error to fit in the record. */
@@ -2140,11 +2152,700 @@ var SkillAuditWriterToken = /* @__PURE__ */ Symbol.for(
 
 // libs/adapters/src/skills/index.ts
 var import_sdk = require("@frontmcp/sdk");
+
+// libs/adapters/src/skills/harvester/op-reference.ts
+var SPEC_ID_RE = "[A-Za-z0-9][A-Za-z0-9_.-]*";
+var OPERATION_ID_RE = "[A-Za-z_][A-Za-z0-9_]*";
+var TRAILING_BOUNDARY = String.raw`(?![A-Za-z0-9_\-])(?!\.[A-Za-z0-9_])`;
+var REFERENCE_RE = new RegExp(
+  String.raw`(?<![A-Za-z0-9])op:\/\/(${SPEC_ID_RE})\/(${OPERATION_ID_RE})${TRAILING_BOUNDARY}` + `|` + String.raw`\[\[op:\s?(${SPEC_ID_RE})\/(${OPERATION_ID_RE})\]\]`,
+  "g"
+);
+function extractOpReferences(markdown) {
+  if (typeof markdown !== "string" || markdown.length === 0) return [];
+  const refs = [];
+  const lineStarts = computeLineStarts(markdown);
+  REFERENCE_RE.lastIndex = 0;
+  let match;
+  while ((match = REFERENCE_RE.exec(markdown)) !== null) {
+    const offset = match.index;
+    const [raw, uriSpec, uriOp, wikiSpec, wikiOp] = match;
+    const isWikilink = wikiSpec !== void 0 && wikiOp !== void 0;
+    const spec = isWikilink ? wikiSpec : uriSpec;
+    const operationId = isWikilink ? wikiOp : uriOp;
+    refs.push({
+      spec,
+      operationId,
+      syntax: isWikilink ? "wikilink" : "uri",
+      raw,
+      location: offsetToLocation(offset, lineStarts)
+    });
+  }
+  return refs;
+}
+function buildKnownOps(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const slash = entry.indexOf("/");
+    if (slash <= 0 || slash === entry.length - 1) continue;
+    const spec = entry.slice(0, slash);
+    const op = entry.slice(slash + 1);
+    let set = map.get(spec);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      map.set(spec, set);
+    }
+    set.add(op);
+  }
+  return map;
+}
+function validateOpReferences(refs, knownOps) {
+  const diagnostics = [];
+  for (const ref of refs) {
+    const specOps = knownOps.get(ref.spec);
+    if (!specOps) {
+      diagnostics.push({
+        ref,
+        kind: "unknown-spec",
+        message: `Unknown OpenAPI spec "${ref.spec}" referenced as ${ref.raw}`,
+        suggestions: Array.from(knownOps.keys()).sort()
+      });
+      continue;
+    }
+    if (!specOps.has(ref.operationId)) {
+      diagnostics.push({
+        ref,
+        kind: "unknown-operation",
+        message: `Unknown operationId "${ref.operationId}" in spec "${ref.spec}" (${ref.raw})`,
+        suggestions: suggestSimilarOps(ref.operationId, specOps)
+      });
+    }
+  }
+  return diagnostics;
+}
+function dedupeOpReferences(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const ref of refs) {
+    const key = `${ref.spec}/${ref.operationId}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push({ spec: ref.spec, operationId: ref.operationId });
+  }
+  return result;
+}
+function computeLineStarts(source) {
+  const starts = [0];
+  for (let i = 0; i < source.length; i++) {
+    if (source.charCodeAt(i) === 10) starts.push(i + 1);
+  }
+  return starts;
+}
+function offsetToLocation(offset, lineStarts) {
+  let lo = 0;
+  let hi = lineStarts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >>> 1;
+    if (lineStarts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  const line = lo + 1;
+  const column = offset - lineStarts[lo] + 1;
+  return { line, column, offset };
+}
+function suggestSimilarOps(query, known) {
+  if (known.size === 0) return [];
+  const q = query.toLowerCase();
+  const candidates = Array.from(known);
+  const prefix = candidates.filter((c) => c.toLowerCase().startsWith(q));
+  const substring = candidates.filter((c) => !prefix.includes(c) && c.toLowerCase().includes(q));
+  const close = candidates.filter((c) => !prefix.includes(c) && !substring.includes(c)).filter((c) => levenshtein(q, c.toLowerCase()) <= Math.max(2, Math.floor(q.length / 4)));
+  return [...prefix, ...substring, ...close].slice(0, 3);
+}
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  let prev = new Array(b.length + 1);
+  let curr = new Array(b.length + 1);
+  for (let j = 0; j <= b.length; j++) prev[j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    curr[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    [prev, curr] = [curr, prev];
+  }
+  return prev[b.length];
+}
+
+// libs/adapters/src/skills/deploy/deploy-manifest.schema.ts
+var import_lazy_zod3 = require("@frontmcp/lazy-zod");
+var IDENT_RE = /^[A-Za-z][A-Za-z0-9_-]*$/;
+var SPEC_ID_RE2 = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+var BINDING_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var serverInfoSchema = import_lazy_zod3.z.object({
+  name: import_lazy_zod3.z.string().min(1).max(128),
+  version: import_lazy_zod3.z.string().min(1).max(64),
+  title: import_lazy_zod3.z.string().min(1).max(256).optional()
+}).strict();
+var serverSchema = import_lazy_zod3.z.object({
+  info: serverInfoSchema,
+  /**
+   * Top-level server instructions injected at `initialize` time. Picked up
+   * by the existing `skillsConfig.injectInstructions` machinery (defaults
+   * to `append` so the skill catalog summary follows).
+   */
+  instructions: import_lazy_zod3.z.string().max(16 * 1024).optional()
+}).strict();
+var runtimeSchema = import_lazy_zod3.z.object({
+  /** Only `cloudflare-worker` in v1. Future: `vercel-edge`, `deno-deploy`. */
+  target: import_lazy_zod3.z.literal("cloudflare-worker"),
+  compatibilityDate: import_lazy_zod3.z.string().regex(ISO_DATE_RE, "compatibilityDate must be ISO-8601 (YYYY-MM-DD)"),
+  /** Worker compatibility flags (e.g. `nodejs_compat`). */
+  compatibilityFlags: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1).max(128)).max(32).optional()
+}).strict();
+var specSourceSchema = import_lazy_zod3.z.union([
+  /** Local file path or HTTPS URL to a single spec. Spec id = filename stem. */
+  import_lazy_zod3.z.string().min(1).max(2048),
+  import_lazy_zod3.z.object({
+    id: import_lazy_zod3.z.string().min(1).max(128).regex(SPEC_ID_RE2, "spec id must be a URI-safe identifier"),
+    spec: import_lazy_zod3.z.string().min(1).max(2048),
+    baseUrl: import_lazy_zod3.z.string().url("baseUrl must be a valid URL").optional(),
+    /** Optional namespace override for AgentScript bindings (default = `id`). */
+    bindingName: import_lazy_zod3.z.string().min(1).max(64).regex(IDENT_RE).optional()
+  }).strict()
+]);
+var specsSchema = import_lazy_zod3.z.union([
+  /** Single directory path; the loader auto-discovers `*.yaml` / `*.json`. */
+  import_lazy_zod3.z.string().min(1).max(2048),
+  /** Explicit list (mixed strings and detail objects allowed). */
+  import_lazy_zod3.z.array(specSourceSchema).max(64)
+]);
+var skillsSchema = import_lazy_zod3.z.object({
+  /** Directory under the manifest. Defaults to `./skills/`. */
+  source: import_lazy_zod3.z.string().min(1).max(2048).default("./skills/"),
+  /**
+   * IDs of skills the worker pre-loads into every `execute()` regardless
+   * of which skills the agent passed. Mirrors the per-skill
+   * `alwaysLoad: true` frontmatter, but lets the server force it.
+   */
+  alwaysLoad: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1).max(128)).max(32).optional(),
+  /** Optional tag filter applied at deploy time. */
+  tags: import_lazy_zod3.z.object({
+    include: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1).max(64)).max(64).optional(),
+    exclude: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1).max(64)).max(64).optional()
+  }).strict().optional()
+}).strict();
+var tagSchema = import_lazy_zod3.z.object({
+  name: import_lazy_zod3.z.string().min(1).max(64),
+  description: import_lazy_zod3.z.string().min(1).max(512).optional()
+}).strict();
+var classificationRuleSchema = import_lazy_zod3.z.object({
+  /**
+   * Match pattern: METHOD followed by a path-glob, e.g.
+   * `POST <star>/reset-<star>` (where <star> is the literal `*` glob).
+   * Written this way to avoid prematurely closing the JSDoc with star-slash.
+   */
+  match: import_lazy_zod3.z.string().min(1).max(256),
+  /**
+   * Override the MCP surface for matching operations: tool (default for
+   * mutations), resource (default for GET list / GET path-param), or both
+   * (default for GET path-param). Omit to leave the classifier's default.
+   */
+  expose: import_lazy_zod3.z.enum(["tool", "resource", "both"]).optional(),
+  /**
+   * Resource-update emit target. `self` (mutation on its own resource),
+   * `parent` (mutation that affects the parent collection / parent path),
+   * or `none` (suppress). Defaults from the HTTP-semantics classifier.
+   */
+  emits: import_lazy_zod3.z.enum(["self", "parent", "none"]).optional()
+}).strict();
+var classificationSchema = import_lazy_zod3.z.object({
+  rules: import_lazy_zod3.z.array(classificationRuleSchema).max(64).optional()
+}).strict();
+var durableObjectBindingSchema = import_lazy_zod3.z.object({
+  binding: import_lazy_zod3.z.string().min(1).max(128).regex(BINDING_NAME_RE),
+  className: import_lazy_zod3.z.string().min(1).max(128).regex(IDENT_RE),
+  scriptName: import_lazy_zod3.z.string().min(1).max(128).optional()
+}).strict();
+var d1BindingSchema = import_lazy_zod3.z.object({
+  binding: import_lazy_zod3.z.string().min(1).max(128).regex(BINDING_NAME_RE),
+  databaseName: import_lazy_zod3.z.string().min(1).max(256),
+  databaseId: import_lazy_zod3.z.string().min(1).max(128)
+}).strict();
+var kvBindingSchema = import_lazy_zod3.z.object({
+  binding: import_lazy_zod3.z.string().min(1).max(128).regex(BINDING_NAME_RE),
+  id: import_lazy_zod3.z.string().min(1).max(128)
+}).strict();
+var r2BindingSchema = import_lazy_zod3.z.object({
+  binding: import_lazy_zod3.z.string().min(1).max(128).regex(BINDING_NAME_RE),
+  bucketName: import_lazy_zod3.z.string().min(1).max(256)
+}).strict();
+var bindingsSchema = import_lazy_zod3.z.object({
+  durableObjects: import_lazy_zod3.z.array(durableObjectBindingSchema).max(32).optional(),
+  d1Databases: import_lazy_zod3.z.array(d1BindingSchema).max(16).optional(),
+  kvNamespaces: import_lazy_zod3.z.array(kvBindingSchema).max(32).optional(),
+  r2Buckets: import_lazy_zod3.z.array(r2BindingSchema).max(16).optional(),
+  /** Plaintext vars surfaced as `env.<name>` on the Worker. */
+  vars: import_lazy_zod3.z.record(import_lazy_zod3.z.string().min(1).max(128), import_lazy_zod3.z.string().max(4096)).optional()
+}).strict();
+var trustRootSchema = import_lazy_zod3.z.object({
+  /** Key id — matches the JWS `kid` header on the signed bundle. */
+  kid: import_lazy_zod3.z.string().min(1).max(128),
+  /** Name of the secret binding holding the PEM-encoded public key. */
+  publicKeySecret: import_lazy_zod3.z.string().min(1).max(128).regex(SECRET_NAME_RE)
+}).strict();
+var replayGuardSchema = import_lazy_zod3.z.object({
+  /** Acceptable clock skew; rejects bundles older than this. */
+  windowSeconds: import_lazy_zod3.z.number().int().min(10).max(3600).default(300),
+  /** KV binding name that stores nonces for replay protection. */
+  nonceKv: import_lazy_zod3.z.string().min(1).max(128).regex(BINDING_NAME_RE)
+}).strict();
+var signingSchema = import_lazy_zod3.z.object({
+  algorithm: import_lazy_zod3.z.enum(["ed25519", "rs256"]),
+  trustRoots: import_lazy_zod3.z.array(trustRootSchema).min(1).max(8),
+  replay: replayGuardSchema
+}).strict();
+var fronteggAuthSchema = import_lazy_zod3.z.object({
+  tenantResolver: import_lazy_zod3.z.enum(["subdomain", "header", "jwt-claim"]).default("subdomain"),
+  audience: import_lazy_zod3.z.string().min(1).max(256),
+  /** Secret name holding the issuer URL. */
+  issuerSecret: import_lazy_zod3.z.string().min(1).max(128).regex(SECRET_NAME_RE)
+}).strict();
+var oauthAuthSchema = import_lazy_zod3.z.object({
+  issuer: import_lazy_zod3.z.string().url(),
+  audience: import_lazy_zod3.z.string().min(1).max(256),
+  /** Optional secret name for client credentials (machine-to-machine). */
+  credentialsSecret: import_lazy_zod3.z.string().min(1).max(128).regex(SECRET_NAME_RE).optional()
+}).strict();
+var apiKeyAuthSchema = import_lazy_zod3.z.object({
+  /** Header name carrying the key (e.g. `X-API-Key`). */
+  header: import_lazy_zod3.z.string().min(1).max(64).default("X-API-Key"),
+  /** Secret name holding the allowlist (newline-separated keys). */
+  allowlistSecret: import_lazy_zod3.z.string().min(1).max(128).regex(SECRET_NAME_RE)
+}).strict();
+var authSchema = import_lazy_zod3.z.discriminatedUnion("provider", [
+  import_lazy_zod3.z.object({ provider: import_lazy_zod3.z.literal("none") }).strict(),
+  import_lazy_zod3.z.object({ provider: import_lazy_zod3.z.literal("frontegg"), frontegg: fronteggAuthSchema }).strict(),
+  import_lazy_zod3.z.object({ provider: import_lazy_zod3.z.literal("oauth"), oauth: oauthAuthSchema }).strict(),
+  import_lazy_zod3.z.object({ provider: import_lazy_zod3.z.literal("apiKey"), apiKey: apiKeyAuthSchema }).strict()
+]);
+var secretSchema = import_lazy_zod3.z.object({
+  name: import_lazy_zod3.z.string().min(1).max(128).regex(SECRET_NAME_RE),
+  required: import_lazy_zod3.z.boolean().default(true),
+  description: import_lazy_zod3.z.string().min(1).max(512).optional()
+}).strict();
+var environmentOverlaySchema = import_lazy_zod3.z.object({
+  server: serverSchema.partial().optional(),
+  specs: specsSchema.optional(),
+  skills: skillsSchema.partial().optional(),
+  classification: classificationSchema.optional(),
+  bindings: bindingsSchema.optional(),
+  auth: authSchema.optional(),
+  vars: import_lazy_zod3.z.record(import_lazy_zod3.z.string().min(1).max(128), import_lazy_zod3.z.string().max(4096)).optional()
+}).strict();
+var deployManifestSchema = import_lazy_zod3.z.object({
+  /** Optional JSON Schema URL — accepted for editor autocompletion. */
+  $schema: import_lazy_zod3.z.string().url().optional(),
+  /** Schema version. Only `1` accepted in v1.3. */
+  version: import_lazy_zod3.z.literal(1),
+  /** Project name (for logs + the Worker's `worker.name`). */
+  name: import_lazy_zod3.z.string().min(1).max(128).regex(IDENT_RE),
+  runtime: runtimeSchema,
+  server: serverSchema,
+  specs: specsSchema,
+  skills: skillsSchema.default({ source: "./skills/" }),
+  tags: import_lazy_zod3.z.array(tagSchema).max(64).optional(),
+  classification: classificationSchema.optional(),
+  bindings: bindingsSchema,
+  signing: signingSchema,
+  auth: authSchema,
+  secrets: import_lazy_zod3.z.array(secretSchema).max(64).optional(),
+  environments: import_lazy_zod3.z.record(import_lazy_zod3.z.string().min(1).max(64).regex(IDENT_RE), environmentOverlaySchema).optional()
+}).strict();
+function applyEnvironmentOverlay(base, overlay) {
+  const effectiveBindings = overlay.bindings ?? base.bindings;
+  const mergedBindings = overlay.vars !== void 0 ? { ...effectiveBindings, vars: { ...effectiveBindings.vars ?? {}, ...overlay.vars } } : effectiveBindings;
+  return {
+    ...base,
+    server: overlay.server ? { ...base.server, ...overlay.server } : base.server,
+    specs: overlay.specs ?? base.specs,
+    skills: overlay.skills ? { ...base.skills, ...overlay.skills } : base.skills,
+    classification: overlay.classification ?? base.classification,
+    bindings: mergedBindings,
+    auth: overlay.auth ?? base.auth
+  };
+}
+function validateEffectiveManifest(manifest, label, errors) {
+  const declaredSecrets = new Set((manifest.secrets ?? []).map((s) => s.name));
+  const refs = [];
+  if (manifest.auth.provider === "frontegg") {
+    refs.push({ where: "auth.frontegg.issuerSecret", name: manifest.auth.frontegg.issuerSecret });
+  } else if (manifest.auth.provider === "oauth" && manifest.auth.oauth.credentialsSecret) {
+    refs.push({ where: "auth.oauth.credentialsSecret", name: manifest.auth.oauth.credentialsSecret });
+  } else if (manifest.auth.provider === "apiKey") {
+    refs.push({ where: "auth.apiKey.allowlistSecret", name: manifest.auth.apiKey.allowlistSecret });
+  }
+  for (const root of manifest.signing.trustRoots) {
+    refs.push({ where: `signing.trustRoots[kid=${root.kid}].publicKeySecret`, name: root.publicKeySecret });
+  }
+  for (const ref of refs) {
+    if (!declaredSecrets.has(ref.name)) {
+      errors.push(`${label}Secret "${ref.name}" referenced at ${ref.where} is not declared in secrets[]`);
+    }
+  }
+  const declaredKv = new Set((manifest.bindings.kvNamespaces ?? []).map((kv) => kv.binding));
+  if (!declaredKv.has(manifest.signing.replay.nonceKv)) {
+    errors.push(
+      `${label}signing.replay.nonceKv "${manifest.signing.replay.nonceKv}" does not match any bindings.kvNamespaces[].binding`
+    );
+  }
+  for (const id of manifest.skills.alwaysLoad ?? []) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(id)) {
+      errors.push(`${label}skills.alwaysLoad entry "${id}" is not a valid kebab-case skill id`);
+    }
+  }
+  if (manifest.tags) {
+    const declaredTags = new Set(manifest.tags.map((t) => t.name));
+    const tagFilter = manifest.skills.tags;
+    for (const t of [...tagFilter?.include ?? [], ...tagFilter?.exclude ?? []]) {
+      if (!declaredTags.has(t)) {
+        errors.push(`${label}skills.tags references unknown tag "${t}" (not in tags[])`);
+      }
+    }
+  }
+}
+function crossValidateManifest(manifest) {
+  const errors = [];
+  validateEffectiveManifest(manifest, "", errors);
+  for (const [envName, overlay] of Object.entries(manifest.environments ?? {})) {
+    const effective = applyEnvironmentOverlay(manifest, overlay);
+    validateEffectiveManifest(effective, `environments.${envName}: `, errors);
+  }
+  return errors.length === 0 ? { ok: true } : { ok: false, errors };
+}
+
+// libs/adapters/src/skills/classifier/openapi-classify.ts
+function classifyOperations(specId, ops) {
+  if (!specId || specId.length === 0) {
+    throw new Error("classifyOperations: specId is required");
+  }
+  if (!Array.isArray(ops)) return [];
+  const pathsWithGet = /* @__PURE__ */ new Set();
+  for (const op of ops) {
+    if (op && typeof op.path === "string" && typeof op.method === "string" && op.method.toUpperCase() === "GET") {
+      pathsWithGet.add(op.path);
+    }
+  }
+  return ops.map((op) => classifyOne(specId, op, pathsWithGet));
+}
+function classifyOne(specId, op, pathsWithGet) {
+  const method = normaliseMethod(op.method);
+  const path = op.path;
+  const hasTerminalParam = pathHasTerminalParam(path);
+  const parent = parentPath(path);
+  const thisIsResource = pathsWithGet.has(path);
+  const parentIsResource = parent !== null && pathsWithGet.has(parent);
+  const selfUri = pathToResourceUri(specId, path);
+  const parentUri = parent !== null ? pathToResourceUri(specId, parent) : null;
+  if (method === "GET") {
+    if (hasTerminalParam) {
+      return {
+        operationId: op.operationId,
+        method,
+        path,
+        specId,
+        expose: "both",
+        resourceUriTemplate: selfUri
+      };
+    }
+    return {
+      operationId: op.operationId,
+      method,
+      path,
+      specId,
+      expose: "resource",
+      resourceUriTemplate: selfUri
+    };
+  }
+  const base = {
+    operationId: op.operationId,
+    method,
+    path,
+    specId,
+    expose: "tool"
+    // `resourceUriTemplate` left undefined for mutations — the emit target
+    // is the authoritative thing to look at.
+  };
+  if (method === "POST") {
+    if (thisIsResource && !hasTerminalParam) {
+      return { ...base, emit: { kind: "listChanged", pathTemplate: path, resourceUriTemplate: selfUri } };
+    }
+    if (thisIsResource && hasTerminalParam) {
+      return { ...base, emit: { kind: "updated", pathTemplate: path, resourceUriTemplate: selfUri } };
+    }
+    if (parentIsResource && parentUri !== null && parent !== null) {
+      return { ...base, emit: { kind: "updated", pathTemplate: parent, resourceUriTemplate: parentUri } };
+    }
+    return base;
+  }
+  if (method === "PUT" || method === "PATCH") {
+    if (thisIsResource) {
+      return { ...base, emit: { kind: "updated", pathTemplate: path, resourceUriTemplate: selfUri } };
+    }
+    if (parentIsResource && parentUri !== null && parent !== null) {
+      return { ...base, emit: { kind: "updated", pathTemplate: parent, resourceUriTemplate: parentUri } };
+    }
+    return base;
+  }
+  if (method === "DELETE") {
+    if (hasTerminalParam && parentIsResource && parentUri !== null && parent !== null) {
+      return { ...base, emit: { kind: "listChanged", pathTemplate: parent, resourceUriTemplate: parentUri } };
+    }
+    if (!hasTerminalParam && thisIsResource) {
+      return { ...base, emit: { kind: "listChanged", pathTemplate: path, resourceUriTemplate: selfUri } };
+    }
+    return base;
+  }
+  return base;
+}
+function applyClassificationOverrides(classified, rules) {
+  if (!Array.isArray(rules) || rules.length === 0) return classified.slice();
+  const compiled = rules.map((rule) => ({ rule, matcher: compileMatcher(rule.match) }));
+  return classified.map((op) => {
+    for (const { rule, matcher } of compiled) {
+      if (!matcher(op)) continue;
+      return applyOne(op, rule);
+    }
+    return op;
+  });
+}
+var KNOWN_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"]);
+function normaliseMethod(m) {
+  const up = (m ?? "").toUpperCase();
+  return KNOWN_METHODS.has(up) ? up : up;
+}
+function pathHasTerminalParam(path) {
+  if (typeof path !== "string" || path.length === 0) return false;
+  const segments = path.split("/").filter((s) => s.length > 0);
+  if (segments.length === 0) return false;
+  const last = segments[segments.length - 1];
+  return last.startsWith("{") && last.endsWith("}") && last.length >= 3;
+}
+function parentPath(path) {
+  if (typeof path !== "string" || path.length === 0) return null;
+  const segments = path.split("/").filter((s) => s.length > 0);
+  if (segments.length <= 1) return null;
+  return "/" + segments.slice(0, -1).join("/");
+}
+function pathToResourceUri(specId, path) {
+  const cleaned = path.startsWith("/") ? path.slice(1) : path;
+  return `mcp+op://${specId}/${cleaned}`;
+}
+function compileMatcher(match) {
+  const trimmed = (match ?? "").trim();
+  const sep2 = trimmed.indexOf(" ");
+  if (sep2 <= 0 || sep2 === trimmed.length - 1) {
+    return () => false;
+  }
+  const methodPattern = trimmed.slice(0, sep2).toUpperCase();
+  const pathPattern = trimmed.slice(sep2 + 1);
+  const pathRe = globToRegExp(pathPattern);
+  return (op) => {
+    if (methodPattern !== "*" && methodPattern !== op.method) return false;
+    return pathRe.test(op.path);
+  };
+}
+function globToRegExp(glob) {
+  const STAR_STAR = "\0";
+  const STAR = "
";
+  const replaced = glob.replace(/\*\*/g, STAR_STAR).replace(/\*/g, STAR);
+  const escaped = replaced.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const expanded = escaped.split(STAR_STAR).join(".*").split(STAR).join("[^/]*");
+  return new RegExp(`^${expanded}$`);
+}
+function defaultEmitKindForMethod(method) {
+  return method === "DELETE" ? "listChanged" : "updated";
+}
+function applyOne(op, rule) {
+  let next = { ...op };
+  if (rule.expose !== void 0) {
+    next = { ...next, expose: rule.expose };
+  }
+  if (rule.emits !== void 0) {
+    if (rule.emits === "none") {
+      const { emit: _drop, ...rest } = next;
+      next = rest;
+    } else if (rule.emits === "self") {
+      const target = pathToResourceUri(op.specId, op.path);
+      next = {
+        ...next,
+        emit: {
+          // Preserve the classifier's original kind if it set one; otherwise
+          // derive from the HTTP method so a DELETE override doesn't end up
+          // emitting `updated` on its own (now-gone) URI.
+          kind: next.emit?.kind ?? defaultEmitKindForMethod(op.method),
+          pathTemplate: op.path,
+          resourceUriTemplate: target
+        }
+      };
+    } else if (rule.emits === "parent") {
+      const parent = parentPath(op.path);
+      if (parent !== null) {
+        next = {
+          ...next,
+          emit: {
+            kind: next.emit?.kind ?? defaultEmitKindForMethod(op.method),
+            pathTemplate: parent,
+            resourceUriTemplate: pathToResourceUri(op.specId, parent)
+          }
+        };
+      } else {
+        const { emit: _drop, ...rest } = next;
+        next = rest;
+      }
+    }
+  }
+  return next;
+}
+
+// libs/adapters/src/skills/classifier/render-resource-uri.ts
+var TEMPLATE_PLACEHOLDER_RE = /\{([^{}]+)\}/g;
+function renderResourceUri(template, args) {
+  if (typeof template !== "string" || template.length === 0) {
+    return { ok: false, missing: [] };
+  }
+  const argObj = args !== null && typeof args === "object" ? args : {};
+  const missing = [];
+  const uri = template.replace(TEMPLATE_PLACEHOLDER_RE, (_match, name) => {
+    const value = argObj[name];
+    if (value === void 0 || value === null) {
+      missing.push(name);
+      return "";
+    }
+    if (typeof value === "object") {
+      missing.push(name);
+      return "";
+    }
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      missing.push(name);
+      return "";
+    }
+    return encodeURIComponent(String(value));
+  });
+  if (missing.length > 0) return { ok: false, missing };
+  return { ok: true, uri };
+}
+
+// libs/adapters/src/skills/classifier/resource-change-notification.ts
+function buildResourceChangeNotification(classification, args) {
+  const emit = classification.emit;
+  if (!emit) return { notification: null, reason: "no-emit" };
+  if (emit.kind === "listChanged") {
+    const rendered2 = renderResourceUri(emit.resourceUriTemplate, args);
+    if (!rendered2.ok) {
+      return { notification: null, reason: "unresolved-template", missing: rendered2.missing };
+    }
+    return { notification: { method: "notifications/resources/list_changed" } };
+  }
+  const rendered = renderResourceUri(emit.resourceUriTemplate, args);
+  if (!rendered.ok) {
+    return { notification: null, reason: "unresolved-template", missing: rendered.missing };
+  }
+  return {
+    notification: {
+      method: "notifications/resources/updated",
+      params: { uri: rendered.uri }
+    }
+  };
+}
+
+// libs/adapters/src/skills/classifier/classification-registry.ts
+var ClassificationRegistry = class {
+  byToolName = /* @__PURE__ */ new Map();
+  /**
+   * Register (or replace) a classification for a tool name. Returns the
+   * previous classification if one existed.
+   *
+   * Useful for hot-reload: the deploy pipeline re-builds classifications
+   * from the new bundle and overwrites in place.
+   */
+  register(toolName, classification) {
+    if (typeof toolName !== "string" || toolName.length === 0) {
+      throw new Error("ClassificationRegistry.register: toolName must be a non-empty string");
+    }
+    const prev = this.byToolName.get(toolName);
+    this.byToolName.set(toolName, classification);
+    return prev;
+  }
+  /**
+   * Bulk-register an array of classifications keyed by `${specId}.${operationId}`.
+   * Returns the count of newly-added entries (existing entries are overwritten
+   * but not counted toward `added`).
+   */
+  registerAll(classifications) {
+    let added = 0;
+    let replaced = 0;
+    for (const c of classifications) {
+      const toolName = `${c.specId}.${c.operationId}`;
+      const prev = this.byToolName.get(toolName);
+      this.byToolName.set(toolName, c);
+      if (prev) replaced++;
+      else added++;
+    }
+    return { added, replaced };
+  }
+  /** Look up the classification for a tool. */
+  lookup(toolName) {
+    return this.byToolName.get(toolName);
+  }
+  /** Remove a single classification. Returns true if it was present. */
+  unregister(toolName) {
+    return this.byToolName.delete(toolName);
+  }
+  /** Drop every registration; used by the loader on full re-deploy. */
+  clear() {
+    this.byToolName.clear();
+  }
+  /** Current size — handy for tests and metrics. */
+  size() {
+    return this.byToolName.size;
+  }
+  /** Snapshot of every (toolName, classification) pair in insertion order. */
+  getAll() {
+    const out = [];
+    for (const [toolName, classification] of this.byToolName.entries()) {
+      out.push({ toolName, classification });
+    }
+    return out;
+  }
+  /**
+   * Convenience: in one step, look up the classification for `toolName`
+   * and build the resource-change notification it should produce after a
+   * successful call with `args`. Returns `{ notification: null }` when the
+   * tool has no classification (e.g. it's not an openapi-derived tool) or
+   * when its classification has no `emit`.
+   *
+   * The dispatcher is expected to call this from a successful-call hook
+   * and forward the resulting notification through whichever notification
+   * channel the host provides.
+   */
+  buildNotificationForCall(toolName, args) {
+    const classification = this.byToolName.get(toolName);
+    if (!classification) return { notification: null, reason: "no-emit" };
+    return buildResourceChangeNotification(classification, args);
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BundlePinnedError,
   BundlePushJwtVerifier,
   BundleStore,
+  ClassificationRegistry,
   FilesystemSkillsSource,
   Hs256AuditSigner,
   MemoryAuditStore,
@@ -2164,15 +2865,25 @@ var import_sdk = require("@frontmcp/sdk");
   StaticSource,
   StorageAdapterAuditStore,
   WebhookReplayGuard,
+  applyClassificationOverrides,
+  applyEnvironmentOverlay,
+  buildKnownOps,
+  buildResourceChangeNotification,
   bundleDigest,
   bundleSkillToActions,
   bundleSourceSchema,
   canonicalize,
   canonicalizeRecordForSigning,
+  classifyOne,
+  classifyOperations,
   createBundleSource,
   crossValidate,
+  crossValidateManifest,
+  dedupeOpReferences,
   defaultAuditSignatureVerifier,
+  deployManifestSchema,
   diffBundles,
+  extractOpReferences,
   formatDiffSummary,
   hasSkillAuditFactory,
   linkRecord,
@@ -2181,12 +2892,14 @@ var import_sdk = require("@frontmcp/sdk");
   npmSourceSchema,
   parseOverlay,
   parseSkillFrontmatter,
+  renderResourceUri,
   resolveSkillLoadOrder,
   resolvedBundleSchema,
   saasSourceSchema,
   setSkillAuditFactory,
   signatureKeySchema,
   staticSourceSchema,
+  validateOpReferences,
   verifyBundleSignature,
   verifyChain
 });