@kwonye/mcpx 0.1.105 → 0.1.106

package/dist/core/adoption.d.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import { verifyUpstreams } from "./verify-upstreams.js";
+import type { UpstreamServerSpec } from "../types.js";
+import { SecretsManager } from "./secrets.js";
+declare const itemSchema: z.ZodObject<{
+    id: z.ZodString;
+    harness: z.ZodString;
+    kind: z.ZodEnum<{
+        mcp: "mcp";
+        skill: "skill";
+        package: "package";
+    }>;
+    name: z.ZodString;
+    path: z.ZodString;
+    nativeKey: z.ZodString;
+    fingerprint: z.ZodString;
+    action: z.ZodEnum<{
+        unsupported: "unsupported";
+        import: "import";
+        reuse: "reuse";
+        conflict: "conflict";
+    }>;
+    canonicalId: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    reload: z.ZodString;
+}, z.core.$strip>;
+export declare const adoptionPlanSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    createdAt: z.ZodString;
+    configHash: z.ZodString;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        harness: z.ZodString;
+        kind: z.ZodEnum<{
+            mcp: "mcp";
+            skill: "skill";
+            package: "package";
+        }>;
+        name: z.ZodString;
+        path: z.ZodString;
+        nativeKey: z.ZodString;
+        fingerprint: z.ZodString;
+        action: z.ZodEnum<{
+            unsupported: "unsupported";
+            import: "import";
+            reuse: "reuse";
+            conflict: "conflict";
+        }>;
+        canonicalId: z.ZodString;
+        reason: z.ZodOptional<z.ZodString>;
+        reload: z.ZodString;
+    }, z.core.$strip>>;
+    errors: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type AdoptionPlan = z.infer<typeof adoptionPlanSchema>;
+export type AdoptionItem = z.infer<typeof itemSchema>;
+export declare function protectServerSecrets(name: string, spec: UpstreamServerSpec, secrets?: SecretsManager): UpstreamServerSpec;
+/** Discovery is read-only; plans contain metadata and hashes, never credentials. */
+export declare function planAdoption(targets?: string[]): AdoptionPlan;
+export declare function applyAdoption(rawPlan: AdoptionPlan, selectedIds?: string[], verify?: typeof verifyUpstreams): Promise<import("./operations.js").Operation>;
+export {};
+//# sourceMappingURL=adoption.d.ts.map

package/dist/core/analytics.d.ts

@@ -0,0 +1,17 @@
+export declare function getMachineId(): string;
+/**
+ * Capture a named event with optional properties.
+ * The call is a no-op when PostHog is not configured so the CLI always works.
+ */
+export declare function capture(event: string, properties?: Record<string, unknown>): void;
+/**
+ * Capture an unhandled exception.
+ * The call is a no-op when PostHog is not configured.
+ */
+export declare function captureException(error: unknown, additionalProperties?: Record<string, unknown>): void;
+/**
+ * Flush all pending events and shut down the PostHog client.
+ * Must be awaited before the CLI process exits.
+ */
+export declare function shutdown(): Promise<void>;
+//# sourceMappingURL=analytics.d.ts.map

package/dist/core/consumers.d.ts

@@ -0,0 +1,8 @@
+import type { McpxConfig } from "../types.js";
+import { SecretsManager } from "./secrets.js";
+export declare function consumerToken(config: McpxConfig, id: string, projectPath?: string, secrets?: SecretsManager): string;
+export declare function resolveConsumer(config: McpxConfig, token: string, secrets?: SecretsManager): {
+    id: string;
+    projectPath?: string;
+} | null;
+//# sourceMappingURL=consumers.d.ts.map

package/dist/core/control.d.ts

@@ -0,0 +1,12 @@
+import { type Operation } from "./operations.js";
+export declare const CONTROL_VERSION = 1;
+export declare function controlSocketPath(): string;
+export declare function coordinate<T>(work: () => Promise<T>): Promise<T>;
+export declare function startControlServer(): Promise<() => Promise<void>>;
+export declare function controlRequest<T = unknown>(method: string, args?: unknown[]): Promise<T>;
+export declare function ensureControlService(cliPath: string): Promise<void>;
+export declare function subscribeControlEvents(listener: (event: {
+    type: string;
+    operation?: Operation;
+}) => void, onError?: (error: Error) => void): () => void;
+//# sourceMappingURL=control.d.ts.map

package/dist/core/daemon.d.ts

@@ -21,10 +21,10 @@ export declare function resolveGatewayPort(config: McpxConfig, secrets?: Secrets
 }>;
 export declare function getDaemonStatus(config: McpxConfig): DaemonStatus;
 export declare function startDaemon(config: McpxConfig, cliPath: string, secrets: SecretsManager): Promise<DaemonStartResult>;
-export declare function stopDaemon(): {
+export declare function stopDaemon(): Promise<{
     stopped: boolean;
     message: string;
-};
+}>;
 export declare function restartDaemon(config: McpxConfig, cliPath: string, secrets: SecretsManager): Promise<DaemonStartResult>;
 export declare function readDaemonLogs(maxLines?: number): string;
 export declare function runDaemonForeground(config: McpxConfig, port: number, secrets: SecretsManager): Promise<void>;

package/dist/core/file-state.d.ts

@@ -0,0 +1,5 @@
+/** Hash the directory entry itself; never traverse a symlink into another tree. */
+export declare function pathFingerprint(target: string): string | null;
+export declare function processAlive(pid: number): boolean;
+export declare function lockOwnerAlive(lockPath: string): boolean;
+//# sourceMappingURL=file-state.d.ts.map

package/dist/core/harnesses.d.ts

@@ -0,0 +1,25 @@
+import type { ClientAdapter, McpxConfig } from "../types.js";
+export type SyncMode = "observe" | "selected" | "automatic";
+export interface HarnessInstallation {
+    id: string;
+    harness: string;
+    label: string;
+    scope: "global" | "project";
+    projectPath?: string;
+    configPath: string | null;
+    skillPaths: string[];
+    detected: boolean;
+    mode: SyncMode;
+    transports: string[];
+    components: string[];
+    reload: string;
+    sync?: McpxConfig["clients"][string];
+}
+export declare function installationAdapters(config: McpxConfig): Array<{
+    installation: HarnessInstallation;
+    adapter: ClientAdapter;
+}>;
+export declare function listHarnesses(config: McpxConfig): HarnessInstallation[];
+/** The same target selection applies to previews and every sync entry point. */
+export declare function synchronizationTargets(config: McpxConfig, targets?: string[]): string[];
+//# sourceMappingURL=harnesses.d.ts.map

package/dist/core/index.d.ts

@@ -10,13 +10,14 @@ export { runOAuthLogin, getOAuthAccessToken, isOAuthReference, oauthReferenceSer
 export type { OAuthCodeReceiver, OAuthSupport, OAuthSupportProbe, OAuthSecretNames, OAuthCredentialStatus, OAuthProgressEvent, RunOAuthLoginOptions } from "./oauth.js";
 export { getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground } from "./daemon.js";
 export type { DaemonStatus, DaemonStartResult } from "./daemon.js";
-export { syncAllClients, getGatewayUrl, getGatewayInternalUrl, persistSyncState } from "./sync.js";
-export type { SyncSummary } from "./sync.js";
+export { synchronizeClients, syncAllClients, getGatewayUrl, getGatewayInternalUrl, persistSyncState } from "./sync.js";
+export type { SyncOptions, SyncSummary } from "./sync.js";
 export { addServer, removeServer, updateServer, setServerEnabled, setProjectServerEnabled, registerProject, unregisterProject, ensureGatewayToken, rotateGatewayToken } from "./registry.js";
 export { listSkills, getSkill, saveSkill, deleteSkill, customizeSkill, installSkillFromSource, validateSkillPackage, pinSkill, unpinSkill, updateSkill, rollbackSkill } from "./skills.js";
 export { exportEnvironment, importEnvironment } from "./share.js";
 export type { ShareEnvironment, ShareLock } from "./share.js";
-export { SecretsManager } from "./secrets.js";
+export { SecretsManager, describeSecretBackend, getSecretBackend, switchSecretBackend } from "./secrets.js";
+export type { SecretBackendSwitchResult } from "./secrets.js";
 export { applyAuthReference, removeAuthReference, listAuthBindings, resolveAuthTarget, defaultAuthSecretName, maybePrefixBearer, secretRefName, toSecretRef } from "./server-auth.js";
 export { buildStatusReport, STATUS_CLIENTS } from "./status.js";
 export type { StatusReport, StatusServerEntry, StatusClientMapping, StatusAuthBinding } from "./status.js";
@@ -39,5 +40,12 @@ export type { UpdateStatus, StagedUpdateInfo } from "./update.js";
 export { startBackgroundUpdateCheck, performUpdate, performRollback } from "./update-manager.js";
 export { fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec } from "./registry-client.js";
 export type { RequiredInput } from "./registry-client.js";
-export type { McpxConfig, ClientId, ClientStatus, UpstreamServerSpec, HttpServerSpec, StdioServerSpec, GatewayConfig, ClientSyncState, ManagedIndex, ManagedEntry, ManagedClientState, ClientImportCandidate, ClientImportScanResult, ClientImportSkippedEntry, SyncImportReport, SyncImportedEntry, SyncDuplicateImportEntry, SyncImportConflictEntry, SyncImportErrorEntry, SyncResult, ManagedGatewayEntry, ProjectConfig, ProjectScope, ManagedPlugin, ManagedMarketplace, MarketplaceListing, MarketplacePluginDetail, MarketplaceFormat, PluginManifest, PluginComponent, PluginSource, DiscoveredComponents, DiscoveredComponent, PluginSyncInput, PluginSyncResult, Skill } from "../types.js";
+export type { McpxConfig, ClientId, ClientStatus, UpstreamServerSpec, HttpServerSpec, StdioServerSpec, GatewayConfig, SecretBackendKind, ClientSyncState, ManagedIndex, ManagedEntry, ManagedClientState, ClientImportCandidate, ClientImportScanResult, ClientImportSkippedEntry, SyncImportReport, SyncImportedEntry, SyncDuplicateImportEntry, SyncImportConflictEntry, SyncImportErrorEntry, SyncResult, ManagedGatewayEntry, ProjectConfig, ProjectScope, ManagedPlugin, ManagedMarketplace, MarketplaceListing, MarketplacePluginDetail, MarketplaceFormat, PluginManifest, PluginComponent, PluginSource, DiscoveredComponents, DiscoveredComponent, PluginSyncInput, PluginSyncResult, Skill } from "../types.js";
+export { controlRequest, ensureControlService, subscribeControlEvents } from "./control.js";
+export { getManagementSnapshot } from "./management.js";
+export type { ManagementSnapshot } from "./management.js";
+export type { AdoptionPlan, AdoptionItem } from "./adoption.js";
+export type { HarnessInstallation, SyncMode } from "./harnesses.js";
+export type { Operation } from "./operations.js";
+export { registerHarness } from "../adapters/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.js

@@ -1,61 +1,56 @@
 import {
-  OAUTH_LOGIN_TIMEOUT_MS,
-  OAuthCancelledError,
-  OAuthLoginInProgressError,
+  extractRequiredInputs,
+  fetchRegistryServerDetail,
+  mapRegistryToSpec,
+  selectBestPackage
+} from "../chunk-1yq3yb66.js";
+import {
   STATUS_CLIENTS,
+  buildStatusReport
+} from "../chunk-nh6hhv29.js";
+import {
+  applyAuthReference,
+  defaultAuthSecretName,
+  listAuthBindings,
+  maybePrefixBearer,
+  removeAuthReference,
+  resolveAuthTarget,
+  secretRefName,
+  toSecretRef
+} from "../chunk-0xt563m1.js";
+import {
+  exportEnvironment,
+  importEnvironment
+} from "../chunk-qf8bj9y7.js";
+import {
   TELEMETRY_NOTICE_VERSION,
-  __resetOAuthSupportCache,
   acknowledgeTelemetryNotice,
-  applyAuthReference,
   architecture,
-  buildEnrichedPath,
-  buildStatusReport,
   captureTelemetryEvent,
   checkForUpdates,
-  clearOAuthCredentials,
   clearStagedUpdate,
   compareVersions,
   countBucket,
-  defaultAuthSecretName,
   defaultTelemetryPreferences,
   durationBucket,
-  exportEnvironment,
-  extractRequiredInputs,
-  fetchRegistryServerDetail,
   flushTelemetry,
   getDaemonStatus,
-  getOAuthAccessToken,
-  getOAuthCredentialStatus,
   getStagedCliPath,
   getStagedUpdate,
   getTelemetryStatus,
-  importEnvironment,
   initializeTelemetry,
-  isOAuthReference,
   isTelemetryEnvironmentDisabled,
-  listAuthBindings,
   loadTelemetryPreferences,
-  mapRegistryToSpec,
   markTelemetryMilestone,
-  maybePrefixBearer,
-  oauthReferenceServerName,
-  oauthSecretNames,
   performRollback,
   performUpdate,
   platformFamily,
-  probeHttpAuthRequirement,
-  probeOAuthSupport,
   readDaemonLogs,
-  removeAuthReference,
   reportTelemetryError,
   resetTelemetryInstallationId,
-  resolveAuthTarget,
   restartDaemon,
   runDaemonForeground,
   runMarketplaceAutoUpdate,
-  runOAuthLogin,
-  secretRefName,
-  selectBestPackage,
   setTelemetryErrorReporter,
   shouldUseStagedCli,
   shutdownTelemetry,
@@ -63,10 +58,9 @@ import {
   startDaemon,
   startMarketplaceAutoUpdater,
   stopDaemon,
-  toSecretRef,
   updateTelemetryPreferences,
   uptimeBucket
-} from "../chunk-t4hqf6yh.js";
+} from "../chunk-wvzap0na.js";
 import {
   addMarketplace,
   inspectMarketplacePlugin,
@@ -78,91 +72,126 @@ import {
   removeMarketplace,
   setMarketplaceAutoUpdate,
   updateMarketplaceInstalledPlugin
-} from "../chunk-btbww96n.js";
+} from "../chunk-1mrkz29t.js";
 import {
-  PluginCache,
   PluginDataManager,
   PluginLifecycle,
   PluginManager,
   approvePluginComponent,
-  customizeSkill,
-  deleteSkill,
   disablePlugin,
   discoverComponents,
   enablePlugin,
-  getGatewayInternalUrl,
-  getGatewayUrl,
   getPluginStatus,
-  getSkill,
   hasManifest,
   inspectPlugin,
   installPlugin,
-  installSkillFromSource,
   listPlugins,
-  listSkills,
-  loadManagedIndex,
-  mutateActiveConfig,
-  mutateConfig,
-  mutateProjectConfig,
-  parseSource,
-  persistSyncState,
   pinPlugin,
-  pinSkill,
   pluginConfigSet,
   pluginSync,
   preparePlugin,
-  pruneAllPluginProjections,
-  prunePluginProjections,
   readManifest,
   resetPluginProjectOverride,
   resolvePluginId,
   rollbackPlugin,
-  rollbackSkill,
-  saveSkill,
   setPluginProjectOverride,
-  syncAllClients,
-  syncPluginsToClient,
   uninstallPlugin,
   unpinPlugin,
-  unpinSkill,
-  updatePlugin,
-  updateSkill,
-  validateSkillPackage
-} from "../chunk-56whm3hm.js";
+  updatePlugin
+} from "../chunk-4aafp444.js";
 import {
-  ConfigLoadError,
-  defaultConfig,
-  loadConfig,
-  loadMergedConfig,
-  loadProjectConfig,
-  migrateProjectServers,
-  parseCliAddCommand,
-  saveConfig,
-  saveProjectConfig,
-  tokenizeCommandLine
-} from "../chunk-01s7rhx3.js";
+  controlRequest,
+  ensureControlService,
+  getManagementSnapshot,
+  probeHttpAuthRequirement,
+  subscribeControlEvents
+} from "../chunk-a2gen8bn.js";
+import {
+  OAUTH_LOGIN_TIMEOUT_MS,
+  OAuthCancelledError,
+  OAuthLoginInProgressError,
+  __resetOAuthSupportCache,
+  buildEnrichedPath,
+  clearOAuthCredentials,
+  getGatewayInternalUrl,
+  getGatewayUrl,
+  getOAuthAccessToken,
+  getOAuthCredentialStatus,
+  isOAuthReference,
+  oauthReferenceServerName,
+  oauthSecretNames,
+  persistSyncState,
+  probeOAuthSupport,
+  pruneAllPluginProjections,
+  prunePluginProjections,
+  registerHarness,
+  runOAuthLogin,
+  syncAllClients,
+  syncPluginsToClient,
+  synchronizeClients
+} from "../chunk-wztmp5b4.js";
 import {
   SecretNotFoundError,
   SecretsManager,
   UpstreamError,
   addServer,
   classifyUpstreamError,
+  describeSecretBackend,
   ensureGatewayToken,
+  getSecretBackend,
   registerProject,
   removeServer,
   rotateGatewayToken,
   setProjectServerEnabled,
   setServerEnabled,
+  switchSecretBackend,
   unregisterProject,
   updateServer
-} from "../chunk-fw8dyt89.js";
+} from "../chunk-8v13hqrp.js";
+import {
+  loadManagedIndex
+} from "../chunk-t20f49g3.js";
+import {
+  mutateActiveConfig,
+  mutateConfig,
+  mutateProjectConfig
+} from "../chunk-hahs24dv.js";
+import"../chunk-chaj8a8b.js";
+import {
+  PluginCache,
+  customizeSkill,
+  deleteSkill,
+  getSkill,
+  installSkillFromSource,
+  listSkills,
+  parseSource,
+  pinSkill,
+  rollbackSkill,
+  saveSkill,
+  unpinSkill,
+  updateSkill,
+  validateSkillPackage
+} from "../chunk-7rq88hb3.js";
+import {
+  ConfigLoadError,
+  defaultConfig,
+  loadConfig,
+  loadMergedConfig,
+  loadProjectConfig,
+  migrateProjectServers,
+  parseCliAddCommand,
+  saveConfig,
+  saveProjectConfig,
+  tokenizeCommandLine
+} from "../chunk-brxwa30j.js";
+import"../chunk-p7yzyt87.js";
 import {
   getConfigPath,
   getManagedIndexPath,
   getSkillPackagesRoot,
   getSkillsDir,
   getTelemetryPath
-} from "../chunk-4y0t0tfj.js";
+} from "../chunk-grkz21sq.js";
 import"../chunk-bjw71y54.js";
 import"../chunk-wj4tjacg.js";
 export {
@@ -194,16 +223,19 @@ export {
   clearOAuthCredentials,
   clearStagedUpdate,
   compareVersions,
+  controlRequest,
   countBucket,
   customizeSkill,
   defaultAuthSecretName,
   defaultConfig,
   defaultTelemetryPreferences,
   deleteSkill,
+  describeSecretBackend,
   disablePlugin,
   discoverComponents,
   durationBucket,
   enablePlugin,
+  ensureControlService,
   ensureGatewayToken,
   exportEnvironment,
   extractRequiredInputs,
@@ -214,9 +246,11 @@ export {
   getGatewayInternalUrl,
   getGatewayUrl,
   getManagedIndexPath,
+  getManagementSnapshot,
   getOAuthAccessToken,
   getOAuthCredentialStatus,
   getPluginStatus,
+  getSecretBackend,
   getSkill,
   getSkillPackagesRoot,
   getSkillsDir,
@@ -272,6 +306,7 @@ export {
   readManifest,
   refreshMarketplace,
   refreshMarketplaceWithPlugins,
+  registerHarness,
   registerProject,
   removeAuthReference,
   removeMarketplace,
@@ -304,8 +339,11 @@ export {
   startDaemon,
   startMarketplaceAutoUpdater,
   stopDaemon,
+  subscribeControlEvents,
+  switchSecretBackend,
   syncAllClients,
   syncPluginsToClient,
+  synchronizeClients,
   toSecretRef,
   tokenizeCommandLine,
   uninstallPlugin,
@@ -321,4 +359,4 @@ export {
   validateSkillPackage
 };
 
-//# debugId=AD72B7B7E74EB1E964756E2164756E21
+//# debugId=325E4BCB9AEB6D1564756E2164756E21

package/dist/core/managed-index-lock.d.ts

@@ -1,2 +1,2 @@
-export declare function withManagedIndexLock<T>(lockPath: string, fn: () => T): T;
+export declare function withManagedIndexLock<T>(lockPath: string, fn: () => T, timeoutMs?: number): T;
 //# sourceMappingURL=managed-index-lock.d.ts.map

package/dist/core/management.d.ts

@@ -0,0 +1,32 @@
+import { loadConfig } from "./config.js";
+import { listHarnesses } from "./harnesses.js";
+import { listOperations } from "./operations.js";
+export declare function syncManaged(targets?: string[]): Promise<import("./sync.js").SyncSummary>;
+export declare function managementCommand(method: string, raw: unknown[]): Promise<unknown>;
+export type ManagementSnapshot = Awaited<ReturnType<typeof getManagementSnapshot>>;
+export declare function getManagementSnapshot(): Promise<{
+    revision: number;
+    capturedAt: string;
+    harnesses: ReturnType<typeof listHarnesses>;
+    operations: ReturnType<typeof listOperations>;
+    servers: Array<{
+        name: string;
+        transport: string;
+        enabled: boolean;
+        scope?: string;
+    }>;
+    skills: Array<{
+        id: string;
+        source?: string;
+        readOnly?: boolean;
+    }>;
+    packages: NonNullable<ReturnType<typeof loadConfig>["packages"]>[string][];
+    plugins: Array<{
+        id: string;
+        name: string;
+        version: string;
+        status: string;
+        enabled: boolean;
+    }>;
+}>;
+//# sourceMappingURL=management.d.ts.map

package/dist/core/native-document.d.ts

@@ -0,0 +1,4 @@
+export declare function readNativeDocument(file: string): Record<string, any>;
+export declare function nativeServers(harness: string, document: Record<string, any>): Record<string, any>;
+export declare function writeNativeDocument(file: string, document: Record<string, any>): void;
+//# sourceMappingURL=native-document.d.ts.map

package/dist/core/operations.d.ts

@@ -0,0 +1,52 @@
+import { EventEmitter } from "node:events";
+import { z } from "zod";
+export interface Operation {
+    id: string;
+    label: string;
+    phase: "prepared" | "applying" | "complete" | "failed" | "rolled-back" | "recovery-required";
+    startedAt: string;
+    updatedAt: string;
+    progress: number;
+    message?: string;
+    undoable?: boolean;
+    details?: string[];
+}
+export declare const operationEvents: EventEmitter<any>;
+declare const snapshotSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        file: "file";
+        link: "link";
+        missing: "missing";
+        directory: "directory";
+    }>;
+    content: z.ZodOptional<z.ZodString>;
+    files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        kind: z.ZodEnum<{
+            file: "file";
+            link: "link";
+            directory: "directory";
+        }>;
+        content: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    mode: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type FileSnapshot = z.infer<typeof snapshotSchema>;
+export interface PlannedWrite {
+    path: string;
+    before: FileSnapshot;
+    after: FileSnapshot;
+}
+export declare function snapshot(target: string): FileSnapshot;
+export declare function snapshotHash(value: FileSnapshot): string;
+export declare function textSnapshot(content: string): FileSnapshot;
+export declare function snapshotText(value: FileSnapshot): string;
+export declare function writeSnapshot(target: string, state: FileSnapshot): void;
+export declare function saveOperation(operation: Operation): void;
+export declare function listOperations(): Operation[];
+/** Complete write intents are encrypted before the first filesystem mutation. */
+export declare function applyWrites(label: string, writes: PlannedWrite[], id?: string, details?: string[]): Operation;
+export declare function rollbackOperation(id: string): Operation;
+export declare function markInterruptedOperations(): void;
+export {};
+//# sourceMappingURL=operations.d.ts.map

package/dist/core/plugin-projections.d.ts

@@ -6,4 +6,5 @@ export declare function pruneAllPluginProjections(targetDir: string): void;
  */
 export declare function pruneUnlistedPlugins(targetDir: string, keepPluginIds: string[]): void;
 export declare function syncPluginsToClient(clientId: string, plugins: PluginSyncInput[]): PluginSyncResult;
+export declare function syncProjectPluginSkills(clientId: string, skillsBase: string, plugins: PluginSyncInput[]): PluginSyncResult;
 //# sourceMappingURL=plugin-projections.d.ts.map

package/dist/core/runtime-entry.d.ts

@@ -0,0 +1,6 @@
+export declare function localCliCommand(args: string[]): {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+};
+//# sourceMappingURL=runtime-entry.d.ts.map

package/dist/core/runtime-snapshot.d.ts

@@ -0,0 +1,6 @@
+import type { McpxConfig } from "../types.js";
+/** A gateway request sees one committed configuration revision throughout its work. */
+export declare function compileRuntimeSnapshot(): void;
+export declare function clearRuntimeSnapshot(): void;
+export declare function runtimeConfig(): McpxConfig;
+//# sourceMappingURL=runtime-snapshot.d.ts.map

package/dist/core/secret-keychain.d.ts

@@ -0,0 +1,31 @@
+/** Login-keychain item that holds the whole mcpx secret map for this user. */
+export declare const KEYCHAIN_SERVICE = "com.kwonye.mcpx";
+export declare const KEYCHAIN_ACCOUNT = "secrets";
+export declare const KEYCHAIN_LABEL = "mcpx secrets";
+/**
+ * `security -i` reads each command with readline() into a 4096-byte buffer
+ * (SecurityTool `MAX_LINE_LEN`) and keeps at most 4095 bytes. A line of exactly
+ * 4095 bytes leaves the trailing newline unread; the following empty command
+ * succeeds and becomes the process exit status. 4094 leaves room for that newline.
+ */
+export declare const SECURITY_INTERACTIVE_MAX_LINE = 4094;
+export interface SecretCommandRequest {
+    command: string;
+    args: string[];
+    input?: string;
+}
+export interface SecretCommandResult {
+    status: number;
+    stdout: string;
+    stderr: string;
+}
+export type SecretCommandRunner = (request: SecretCommandRequest) => SecretCommandResult;
+/** Test hook. Production code leaves the real `security` / `secret-tool` runner in place. */
+export declare function setSecretCommandRunnerForTests(runner: SecretCommandRunner | null): void;
+/** Test hook. `null` uses `process.platform`. */
+export declare function setSecretKeychainPlatformForTests(platform: NodeJS.Platform | null): void;
+export declare function keychainUnsupportedReason(platform?: NodeJS.Platform): string | null;
+export declare function readKeychainSecrets(): Record<string, string>;
+export declare function writeKeychainSecrets(secrets: Record<string, string>): void;
+export declare function clearKeychainSecrets(): void;
+//# sourceMappingURL=secret-keychain.d.ts.map

package/dist/core/secrets.d.ts

@@ -1,9 +1,19 @@
+import type { SecretBackendKind } from "../types.js";
+export interface SecretBackendSwitchResult {
+    backend: SecretBackendKind;
+    changed: boolean;
+    migrated: string[];
+    preserved: string[];
+    removedFrom: SecretBackendKind | null;
+}
+export declare function describeSecretBackend(backend: SecretBackendKind): string;
+export declare function getSecretBackend(configPath?: string): SecretBackendKind;
+export declare function switchSecretBackend(target: SecretBackendKind, configPath?: string): SecretBackendSwitchResult;
 export declare class SecretsManager {
     private readonly storePath;
     private readonly keyPath;
     constructor(storePath?: string, keyPath?: string);
-    private readStore;
-    private recoverCorruptStore;
+    get backend(): SecretBackendKind;
     listSecretNames(): string[];
     setSecret(name: string, value: string): void;
     removeSecret(name: string): void;