@konglx/rotom 2.21.0

package/dist/master/api/sessions.js

@@ -0,0 +1,158 @@
+/**
+ * Session management API
+ *
+ * Surfaces the executor-side SessionStore (keyed `${cliTool}:${groupId}`)
+ * to the dashboard. Every endpoint forwards a WS request to the right
+ * worker(s) via WSHub.routeToExecutor and returns the first response.
+ *
+ * Endpoints:
+ *   GET    /sessions?groupId=<id>
+ *   GET    /sessions/:cliTool/:groupId/:sessionId?tail=<lines>
+ *   DELETE /sessions/:cliTool/:groupId/:sessionId
+ */
+import { randomUUID } from "node:crypto";
+import { createLogger } from "../../shared/logger.js";
+const log = createLogger("mesh-api-sessions");
+/** Hex / uuid / dash-only sessionId — keeps URL paths from being abused. */
+const SAFE_ID = /^[A-Za-z0-9_-]+$/;
+/** Known CLI backends; matches the switch in src/executor/index.ts. */
+const SAFE_CLI = /^(claude|codex|hermes|openclaw)$/;
+export function registerSessionRoutes(apiRouter, db, _auth, hub) {
+    if (!hub) {
+        log.warn("[sessions] hub unavailable; routes registered as no-ops");
+        return;
+    }
+    // ── List sessions for a group ──────────────────────────────────────────
+    // Reads from master DB (`agent_sessions` table), which workers keep fresh
+    // via `session_snapshot` pushes (master upserts on receipt). Includes
+    // invalidated sessions (full history). `online` is computed by joining
+    // against the in-memory `connections` map.
+    apiRouter.get("/sessions", async (req, res) => {
+        const groupId = typeof req.query.groupId === "string" ? req.query.groupId : "";
+        if (!groupId) {
+            res.status(400).json({ error: "groupId is required" });
+            return;
+        }
+        if (!SAFE_ID.test(groupId)) {
+            res.status(400).json({ error: "invalid groupId" });
+            return;
+        }
+        const sessions = hub.listSessionsByGroup(groupId);
+        res.json({ sessions });
+    });
+    // ── Session usage / model / online (from DB) ──────────────────────────
+    // Debug 视图 SessionPanel 用它把每个 chat session 自己的 token 用量 / 模型名
+    // 拉出来展示。数据源是 master DB 的 agent_sessions 表(由 worker 的
+    // session_snapshot 推送写入)。online 由 connections 内存表 join 算出。
+    //
+    // 这条路径返回的就是该 chat session 自己的消耗,跟 issue 执行的 session 是
+    // 两个独立 session(issue 有自己的 session_id,不共享)。
+    apiRouter.get("/sessions/:cliTool/:groupId/:sessionId/usage", (req, res) => {
+        const { cliTool, groupId, sessionId } = req.params;
+        if (!SAFE_CLI.test(cliTool)) {
+            res.status(400).json({ error: `invalid cliTool: ${cliTool}` });
+            return;
+        }
+        if (!SAFE_ID.test(groupId) || !SAFE_ID.test(sessionId)) {
+            res.status(400).json({ error: "invalid groupId or sessionId" });
+            return;
+        }
+        void db; // DB 通过 hub.findSessionEntry 内部访问;这里保留签名兼容
+        const entry = hub.findSessionEntry(sessionId);
+        if (!entry) {
+            res.json({
+                cliTool, sessionId, usage: null, model: null,
+                cumulativeCostUsd: null,
+                cumulativeInputTokens: null,
+                cumulativeOutputTokens: null,
+                cumulativeCacheReadTokens: null,
+                cumulativeCacheCreationTokens: null,
+                online: false, invalidatedAt: null,
+            });
+            return;
+        }
+        res.json({
+            cliTool,
+            sessionId,
+            usage: entry.usage ?? null,
+            model: entry.model ?? null,
+            cumulativeCostUsd: typeof entry.cumulativeCostUsd === "number" ? entry.cumulativeCostUsd : null,
+            cumulativeInputTokens: entry.cumulativeInputTokens ?? null,
+            cumulativeOutputTokens: entry.cumulativeOutputTokens ?? null,
+            cumulativeCacheReadTokens: entry.cumulativeCacheReadTokens ?? null,
+            cumulativeCacheCreationTokens: entry.cumulativeCacheCreationTokens ?? null,
+            online: entry.online ?? false,
+            invalidatedAt: entry.invalidatedAt ?? null,
+        });
+    });
+    // ── View session content ───────────────────────────────────────────────
+    apiRouter.get("/sessions/:cliTool/:groupId/:sessionId", async (req, res) => {
+        const { cliTool, groupId, sessionId } = req.params;
+        if (!SAFE_CLI.test(cliTool)) {
+            res.status(400).json({ error: `invalid cliTool: ${cliTool}` });
+            return;
+        }
+        if (!SAFE_ID.test(groupId) || !SAFE_ID.test(sessionId)) {
+            res.status(400).json({ error: "invalid groupId or sessionId" });
+            return;
+        }
+        const tailLines = Math.min(Math.max(parseInt(req.query.tail || "200", 10) || 200, 1), 2000);
+        const requestId = randomUUID();
+        try {
+            const resp = await hub.routeToExecutor((c) => c.cliTool === cliTool, { type: "session_view_request", requestId, groupId, sessionId, tailLines });
+            if (resp.type !== "session_view_response") {
+                res.status(502).json({ error: "unexpected response from executor" });
+                return;
+            }
+            res.json({
+                cliTool,
+                groupId,
+                sessionId,
+                format: resp.format,
+                content: resp.content,
+                error: resp.error,
+            });
+        }
+        catch (err) {
+            const msg = err?.message || String(err);
+            log.warn(`[sessions] view failed: ${msg}`);
+            const code = /timeout/.test(msg) ? 504 : 502;
+            res.status(code).json({ error: msg });
+        }
+    });
+    // ── Delete a session ───────────────────────────────────────────────────
+    // Worker is selected by cliTool (the worker that owns this session).
+    // On success, the next chat / issue run for (cliTool, groupId) will
+    // start a fresh session instead of --resume'ing the deleted one.
+    apiRouter.delete("/sessions/:cliTool/:groupId/:sessionId", async (req, res) => {
+        const { cliTool, groupId, sessionId } = req.params;
+        if (!SAFE_CLI.test(cliTool)) {
+            res.status(400).json({ error: `invalid cliTool: ${cliTool}` });
+            return;
+        }
+        if (!SAFE_ID.test(groupId) || !SAFE_ID.test(sessionId)) {
+            res.status(400).json({ error: "invalid groupId or sessionId" });
+            return;
+        }
+        const requestId = randomUUID();
+        try {
+            const resp = await hub.routeToExecutor((c) => c.cliTool === cliTool, { type: "session_delete_request", requestId, groupId, sessionId });
+            if (resp.type !== "session_delete_response") {
+                res.status(502).json({ error: "unexpected response from executor" });
+                return;
+            }
+            if (!resp.ok) {
+                res.status(404).json({ error: resp.error || "session not found" });
+                return;
+            }
+            log.info(`[sessions] deleted ${cliTool}:${groupId}:${sessionId}`);
+            res.json({ ok: true });
+        }
+        catch (err) {
+            const msg = err?.message || String(err);
+            log.warn(`[sessions] delete failed: ${msg}`);
+            const code = /timeout/.test(msg) ? 504 : 502;
+            res.status(code).json({ error: msg });
+        }
+    });
+}

package/dist/master/api/share.js

@@ -0,0 +1,269 @@
+/**
+ * Digital Employee Mesh — Share / Visitor API
+ *
+ * Two surfaces:
+ *
+ *  1. Management (requires Bearer mesh_xxx):
+ *     - POST   /api/groups/:groupId/shares    mint a visitor token for a group
+ *     - DELETE /api/shares/:token              revoke a visitor token
+ *
+ *  2. Visitor read-only (token in URL, no Bearer). Path shape mirrors the
+ *     existing Dashboard routes so the frontend can keep using its existing
+ *     `groupsApi.getById(id)` etc. — the api client just prepends
+ *     `/share/:token` to the path:
+ *     - GET /api/share/:token/groups/:id                      group info + members
+ *     - GET /api/share/:token/groups/:id/messages             group messages
+ *     - GET /api/share/:token/groups/:groupId/issues          issues in the group
+ *     - GET /api/share/:token/issues/:id                      one issue + events
+ *     - GET /api/share/:token/issues/:id/messages             issue comments
+ *     - GET /api/share/:token/issues/:id/events               issue event timeline
+ *     - GET /api/share/:token/groups/:groupId/artifacts       artifact tree
+ *     - GET /api/share/:token/groups/:groupId/artifacts/content  single file
+ *     - GET /api/share/:token/groups/:groupId/notes           group notes
+ *
+ * Every visitor endpoint resolves the token via ShareTokenStore and 401s if
+ * the token is unknown / revoked. Scope is implicit: a token is bound to one
+ * groupId at mint time, so visitors cannot escape their group.
+ */
+import fs from "node:fs";
+import { resolveGroupArtifactRoot } from "../group-paths.js";
+import { createLogger } from "../../shared/logger.js";
+import { readFileSafely, walkDir } from "../util/fs.js";
+const log = createLogger("mesh-api");
+function requireAgent(req, res) {
+    const auth = req.agentAuth;
+    if (!auth) {
+        res.status(401).json({ error: "Authentication required" });
+        return null;
+    }
+    return auth;
+}
+/** Resolve a share token; 401 if not found. Returns the resolved record. */
+function requireToken(store, token, res) {
+    const record = store.resolve(token);
+    if (!record) {
+        res.status(401).json({ error: "Invalid or expired share token" });
+        return null;
+    }
+    return record;
+}
+export function registerShareRoutes(apiRouter, db, store) {
+    // ── Management endpoints (require agent auth) ────────────────────────
+    apiRouter.post("/groups/:groupId/shares", (req, res) => {
+        const auth = requireAgent(req, res);
+        if (!auth)
+            return;
+        const group = db.getGroupById(req.params.groupId);
+        if (!group) {
+            res.status(404).json({ error: "Group not found" });
+            return;
+        }
+        const record = store.create(req.params.groupId, auth.name);
+        log.info(`Share token minted for group ${req.params.groupId} by ${auth.name}`);
+        res.status(201).json({
+            token: record.token,
+            groupId: record.groupId,
+            createdBy: record.createdBy,
+            createdAt: record.createdAt,
+        });
+    });
+    apiRouter.delete("/shares/:token", (req, res) => {
+        const auth = requireAgent(req, res);
+        if (!auth)
+            return;
+        const record = store.resolve(req.params.token);
+        if (!record) {
+            // Idempotent: unknown tokens are already "gone", don't 404.
+            res.json({ ok: true });
+            return;
+        }
+        const removed = store.revoke(req.params.token);
+        log.info(`Share token ${removed ? "revoked" : "not found"} by ${auth.name}`);
+        res.json({ ok: true });
+    });
+    // ── Visitor read-only endpoints (token in URL) ───────────────────────
+    apiRouter.get("/share/:token/groups", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        // Visitors can only see the single group their token grants scope to.
+        const group = db.getGroupById(record.groupId);
+        if (!group) {
+            res.json([]);
+            return;
+        }
+        const members = db.getGroupMembers(record.groupId);
+        res.json([{ ...group, members }]);
+    });
+    // Visitors don't have their own agent list — return only the agents that are
+    // members of the shared group, so the chat UI can resolve @mentions and
+    // group member names without leaking agents from other groups.
+    apiRouter.get("/share/:token/agents", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        const members = db.getGroupMembers(record.groupId);
+        const memberNames = new Set(members.map((m) => m.agent_name));
+        const scoped = db.listAgents().filter((a) => a.name && memberNames.has(a.name));
+        res.json(scoped);
+    });
+    apiRouter.get("/share/:token/groups/:id", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        // Hard scope guard: a token only grants access to its bound group.
+        if (req.params.id !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        const group = db.getGroupById(record.groupId);
+        if (!group) {
+            res.status(404).json({ error: "Group not found" });
+            return;
+        }
+        const members = db.getGroupMembers(record.groupId);
+        res.json({ ...group, members });
+    });
+    apiRouter.get("/share/:token/groups/:id/messages", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        if (req.params.id !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        if (Object.prototype.hasOwnProperty.call(req.query, "limit")) {
+            const total = Math.min(parseInt(req.query.limit) || 300, 500);
+            res.json(db.getGroupMessages(record.groupId, 5, Math.max(total - 5, 0)));
+        }
+        else {
+            res.json(db.getGroupMessages(record.groupId));
+        }
+    });
+    apiRouter.get("/share/:token/groups/:groupId/issues", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        if (req.params.groupId !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        const status = req.query.status;
+        const type = req.query.type;
+        res.json(db.listIssuesByGroup(record.groupId, status, type));
+    });
+    apiRouter.get("/share/:token/issues/:id", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        const issue = db.getIssueById(req.params.id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        // Hard scope guard: visitors can only see issues in their shared group.
+        if (issue.group_id !== record.groupId) {
+            res.status(403).json({ error: "Issue not in shared group" });
+            return;
+        }
+        const events = db.getIssueEvents(req.params.id);
+        res.json({ ...issue, events });
+    });
+    apiRouter.get("/share/:token/issues/:id/messages", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        const issue = db.getIssueById(req.params.id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        if (issue.group_id !== record.groupId) {
+            res.status(403).json({ error: "Issue not in shared group" });
+            return;
+        }
+        res.json(db.getIssueMessages(req.params.id));
+    });
+    apiRouter.get("/share/:token/issues/:id/events", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        const issue = db.getIssueById(req.params.id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        if (issue.group_id !== record.groupId) {
+            res.status(403).json({ error: "Issue not in shared group" });
+            return;
+        }
+        res.json(db.getIssueEvents(req.params.id));
+    });
+    apiRouter.get("/share/:token/groups/:groupId/notes", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        if (req.params.groupId !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        res.json(db.listNotesByGroup(record.groupId));
+    });
+    // ── Visitor artifact endpoints ───────────────────────────────────────
+    // Mirrors src/master/api/artifacts.ts but scoped to the visitor's group.
+    // Path traversal guard and 500KB cap are kept identical.
+    apiRouter.get("/share/:token/groups/:groupId/artifacts", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        if (req.params.groupId !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        const groupDir = resolveGroupArtifactRoot(db, record.groupId);
+        if (!fs.existsSync(groupDir)) {
+            res.json({ root: groupDir, files: [] });
+            return;
+        }
+        res.json({ root: groupDir, files: walkDir(groupDir, groupDir) });
+    });
+    apiRouter.get("/share/:token/groups/:groupId/artifacts/content", (req, res) => {
+        const record = requireToken(store, req.params.token, res);
+        if (!record)
+            return;
+        if (req.params.groupId !== record.groupId) {
+            res.status(403).json({ error: "Group not in shared scope" });
+            return;
+        }
+        const filePath = req.query.path;
+        if (!filePath) {
+            res.status(400).json({ error: "path query parameter is required" });
+            return;
+        }
+        const groupDir = resolveGroupArtifactRoot(db, record.groupId);
+        const result = readFileSafely(groupDir, filePath);
+        if (result.kind === "outside-base") {
+            res.status(403).json({ error: "Invalid path" });
+            return;
+        }
+        if (result.kind === "missing") {
+            res.status(404).json({ error: "File not found" });
+            return;
+        }
+        if (result.kind === "too-large") {
+            res.json({
+                path: filePath,
+                content: `[File too large: ${(result.size / 1024).toFixed(1)}KB]`,
+                size: result.size,
+                type: "text",
+            });
+            return;
+        }
+        res.json({
+            path: filePath,
+            content: result.content,
+            size: result.size,
+            type: result.type,
+        });
+    });
+}

package/dist/master/api/skills.js

@@ -0,0 +1,190 @@
+/**
+ * Skill REST API —— 全局 skill 知识库 + (group, agent, skill) 绑定关系。
+ *
+ * Dashboard 端点开放(无登录),与 memory/notes 一致。
+ * skill 本身无可见性;可见性靠 /groups/:id/skills/:agent/bind 端点绑定。
+ */
+import { randomUUID } from "node:crypto";
+import { createLogger } from "../../shared/logger.js";
+const log = createLogger("mesh-api");
+// ── 校验(对齐 Claude Code SKILL.md 规范)───────────────────────────────
+// name: 小写字母/数字/短横线,首字符非短横线,长度 1-64。禁中文/空格/斜杠。
+const NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const MAX_NAME = 64;
+const MAX_DESCRIPTION = 1024; // Claude Code 合计 1536,留余量给 when_to_use
+function validateSkillFields(input) {
+    if (input.name !== undefined) {
+        const n = input.name.trim();
+        if (!n)
+            return "name 不能为空";
+        if (n.length > MAX_NAME)
+            return `name 长度超过 ${MAX_NAME}`;
+        if (!NAME_RE.test(n))
+            return "name 只能用小写字母/数字/短横线,首字符非短横线(对齐 Claude Code skill 命名,禁中文/空格/斜杠)";
+    }
+    if (input.description !== undefined) {
+        const d = input.description.trim();
+        if (!d)
+            return "description 不能为空";
+        if (d.length > MAX_DESCRIPTION)
+            return `description 长度超过 ${MAX_DESCRIPTION}(建议说明「做什么 + 何时用」)`;
+    }
+    if (input.content !== undefined) {
+        if (!input.content.trim())
+            return "content 不能为空";
+    }
+    return null;
+}
+export function registerSkillRoutes(apiRouter, db) {
+    // ── 全局 skill CRUD ──────────────────────────────────────────────────
+    apiRouter.get("/skills", (req, res) => {
+        const category = typeof req.query.category === "string" ? req.query.category : undefined;
+        res.json(db.listSkills({ category }));
+    });
+    apiRouter.get("/skills/search", (req, res) => {
+        const q = typeof req.query.q === "string" ? req.query.q.trim() : "";
+        if (!q) {
+            res.status(400).json({ error: "q is required" });
+            return;
+        }
+        res.json(db.searchSkills(q));
+    });
+    apiRouter.get("/skills/:name", (req, res) => {
+        const row = db.getSkillByName(req.params.name);
+        if (!row) {
+            res.status(404).json({ error: "Skill not found" });
+            return;
+        }
+        // getSkillByName 不计 view_count;手动 +1
+        const full = db.getSkill(row.id);
+        res.json(full);
+    });
+    apiRouter.post("/skills", (req, res) => {
+        const { name, description, content, category, createdBy } = req.body;
+        if (!name || !description || !content || !createdBy) {
+            res.status(400).json({ error: "name, description, content, createdBy are required" });
+            return;
+        }
+        const validationErr = validateSkillFields({ name, description, content });
+        if (validationErr) {
+            res.status(400).json({ error: validationErr });
+            return;
+        }
+        const existing = db.getSkillByName(String(name).trim());
+        if (existing) {
+            res.status(409).json({ error: `skill "${name}" already exists` });
+            return;
+        }
+        const id = randomUUID();
+        db.createSkill({
+            id, name: String(name).trim(), description: String(description).trim(),
+            content: String(content), category: category ?? null, createdBy,
+        });
+        log.info(`Skill created: "${name}" (${id})`);
+        res.status(201).json({ id, name });
+    });
+    apiRouter.patch("/skills/:name", (req, res) => {
+        const row = db.getSkillByName(req.params.name);
+        if (!row) {
+            res.status(404).json({ error: "Skill not found" });
+            return;
+        }
+        const { name, description, content, category } = req.body;
+        const validationErr = validateSkillFields({ name, description, content });
+        if (validationErr) {
+            res.status(400).json({ error: validationErr });
+            return;
+        }
+        const fields = {};
+        if (name !== undefined)
+            fields.name = String(name).trim();
+        if (description !== undefined)
+            fields.description = String(description).trim();
+        if (content !== undefined)
+            fields.content = String(content);
+        if (category !== undefined)
+            fields.category = category == null ? null : String(category);
+        db.updateSkill(row.id, fields);
+        res.json({ ok: true });
+    });
+    apiRouter.delete("/skills/:name", (req, res) => {
+        const row = db.getSkillByName(req.params.name);
+        if (!row) {
+            res.status(404).json({ error: "Skill not found" });
+            return;
+        }
+        db.deactivateSkill(row.id);
+        res.json({ ok: true });
+    });
+    // ── 绑定关系 ──────────────────────────────────────────────────────────
+    // 该 agent 在该群绑定的 skill 索引(供 agent `rotom skill mine` + prompt count)
+    apiRouter.get("/groups/:groupId/skills/:agentName", (req, res) => {
+        res.json(db.listSkillsForAgent(req.params.groupId, req.params.agentName));
+    });
+    apiRouter.post("/groups/:groupId/skills/:agentName/bind", (req, res) => {
+        const { skillName, createdBy } = req.body;
+        if (!skillName || !createdBy) {
+            res.status(400).json({ error: "skillName, createdBy are required" });
+            return;
+        }
+        const skill = db.getSkillByName(String(skillName));
+        if (!skill) {
+            res.status(404).json({ error: `skill "${skillName}" not found` });
+            return;
+        }
+        const created = db.bindSkill({
+            groupId: req.params.groupId,
+            agentName: req.params.agentName,
+            skillId: skill.id,
+            createdBy,
+        });
+        res.json({ ok: true, created });
+    });
+    apiRouter.delete("/groups/:groupId/skills/:agentName/bind/:skillName", (req, res) => {
+        const skill = db.getSkillByName(req.params.skillName);
+        if (!skill) {
+            res.json({ ok: true, removed: false });
+            return;
+        }
+        const removed = db.unbindSkill({
+            groupId: req.params.groupId,
+            agentName: req.params.agentName,
+            skillId: skill.id,
+        });
+        res.json({ ok: true, removed });
+    });
+    // 群内所有绑定(群设置 modal 用)
+    apiRouter.get("/groups/:groupId/skill-bindings", (req, res) => {
+        const bindings = db.listBindings({ groupId: req.params.groupId });
+        res.json(bindings.map(b => ({
+            ...b,
+            skill_name: db.getSkill(b.skill_id)?.name ?? null,
+        })));
+    });
+    // 全局绑定总览(工具箱管理用)
+    apiRouter.get("/skills/bindings/all", (req, res) => {
+        const groupId = typeof req.query.groupId === "string" ? req.query.groupId : undefined;
+        const agentName = typeof req.query.agentName === "string" ? req.query.agentName : undefined;
+        const bindings = db.listBindings({ groupId, agentName });
+        res.json(bindings.map(b => ({
+            ...b,
+            skill_name: db.getSkill(b.skill_id)?.name ?? null,
+        })));
+    });
+    // ── playbook memory → skill ───────────────────────────────────────────
+    apiRouter.post("/memory/:id/promote-to-skill", (req, res) => {
+        const { name, description, createdBy } = req.body;
+        if (!createdBy) {
+            res.status(400).json({ error: "createdBy is required" });
+            return;
+        }
+        try {
+            const result = db.promoteMemoryToSkill(req.params.id, { name, description, createdBy });
+            log.info(`Memory ${req.params.id} promoted to skill "${result.name}" (${result.skillId})`);
+            res.status(201).json(result);
+        }
+        catch (e) {
+            res.status(400).json({ error: e.message });
+        }
+    });
+}