@prismer/sdk 1.7.3 → 1.7.4

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+export { AIPIdentity, DIDDocument, SignedPayload } from '@prismer/aip-sdk';
+
 /**
  * Prismer Cloud Real-Time Client — WebSocket & SSE transports.
  *
@@ -1621,8 +1623,17 @@ declare class E2EEncryption {
     /**
      * Initialize encryption with user passphrase.
      * Derives a master key via PBKDF2 and generates an ECDH key pair.
+     *
+     * @param passphrase - User passphrase for master key derivation
+     * @param salt - Optional Base64-encoded salt. If omitted, a random 16-byte salt is generated.
+     *               Store the salt (via exportSalt()) so you can re-derive the same master key later.
+     */
+    init(passphrase: string, salt?: string): Promise<void>;
+    /**
+     * Export the salt as Base64 string for persistent storage.
+     * You must store this and pass it back to init() to re-derive the same master key.
      */
-    init(passphrase: string): Promise<void>;
+    exportSalt(): string;
     /**
      * Export public key for sharing with conversation peers.
      */
@@ -1664,6 +1675,45 @@ declare class E2EEncryption {
      * Clear all keys and reset state.
      */
     destroy(): void;
+    private messageCount;
+    private static readonly KEY_ROTATION_THRESHOLD;
+    private static readonly KEY_ROTATION_INTERVAL_MS;
+    private lastRotation;
+    /**
+     * High-level encrypt-for-send pipeline.
+     * Encrypts content, builds metadata, and handles key rotation.
+     *
+     * Returns { encryptedContent, metadata } ready to send.
+     */
+    encryptForSend(conversationId: string, content: string): Promise<{
+        encryptedContent: string;
+        metadata: Record<string, any>;
+    }>;
+    /**
+     * High-level decrypt-on-receive pipeline.
+     * Decrypts content and validates metadata.
+     */
+    decryptOnReceive(conversationId: string, encryptedContent: string, metadata?: Record<string, any>): Promise<string>;
+    /**
+     * High-level file encryption pipeline.
+     */
+    encryptFile(conversationId: string, fileData: ArrayBuffer): Promise<{
+        encryptedData: string;
+        metadata: Record<string, any>;
+    }>;
+    /**
+     * High-level file decryption pipeline.
+     */
+    decryptFile(conversationId: string, encryptedData: string): Promise<ArrayBuffer>;
+    /**
+     * Check if key rotation is needed (1000 messages or 24 hours).
+     */
+    private shouldRotateKey;
+    /**
+     * Perform key rotation: generate new ECDH keypair and reset counters.
+     * The caller is responsible for re-exchanging keys with peers.
+     */
+    rotateKeys(): Promise<JsonWebKey>;
 }
 
 /**
@@ -2340,6 +2390,22 @@ declare class EvolutionClient {
     installedSkills(): Promise<IMResult<IMAgentSkillRecord[]>>;
     /** Get full skill content (SKILL.md + package info) */
     getSkillContent(slugOrId: string): Promise<IMResult<IMSkillContent>>;
+    /** Create/submit a community skill */
+    createSkill(input: {
+        name: string;
+        description: string;
+        category: string;
+        tags?: string[];
+        content?: string;
+        signals?: Array<{
+            type: string;
+        }>;
+        author?: string;
+    }): Promise<IMResult<any>>;
+    /** Star a skill (increment community rating) */
+    starSkill(skillId: string): Promise<IMResult<{
+        stars: number;
+    }>>;
     /**
      * Install a skill and write SKILL.md to local filesystem.
      * Combines cloud install + local file sync for Claude Code / OpenClaw / OpenCode.
@@ -2400,6 +2466,10 @@ declare class EvolutionClient {
         pullSince?: number;
     }): Promise<IMResult<any>>;
 }
+/** Sanitize a slug/id to prevent path traversal (removes slashes, .., and null bytes) */
+declare function safeSlug(input: string): string;
+/** Map file extension to MIME type (no external deps) */
+declare function guessMimeType(fileName: string): string;
 /** File upload management (presign → upload → confirm) */
 declare class FilesClient {
     private _r;
@@ -2530,4 +2600,4 @@ declare class PrismerClient {
 
 declare function createClient(config: PrismerConfig): PrismerClient;
 
-export { AccountClient, AttachmentQueue, type AuthenticatedPayload, type BatchSummary, type BatchUrlCost, BindingsClient, ContactsClient, ConversationsClient, CreditsClient, type DecryptResult, type DerivationMode, DirectClient, type DisconnectedPayload, E2EEncryption, ENVIRONMENTS, type EncryptedContextResult, type EncryptedFileResult, type EncryptedMessage, type Environment, type ErrorPayload, EvolutionCache, EvolutionClient, EvolutionRuntime, type EvolutionRuntimeConfig, type EvolutionSession, type EvolutionSyncDelta, type EvolutionSyncSnapshot, type ExecutionContext, type FileInput, FilesClient, type GeneCategory, type GeneSelectionResult, type GeneVisibility, GroupsClient, type IMAgentCard, type IMAgentPersonality, type IMAgentSkillRecord, type IMAnalyzeOptions, type IMAnalyzeResult, type IMAutocompleteResult, type IMBinding, type IMBindingData, type IMCapsule, IMClient, type IMCompactOptions, type IMCompactionSummary, type IMCompleteTaskOptions, type IMConfirmResult, type IMContact, type IMConversation, type IMConversationsOptions, type IMCreateBindingOptions, type IMCreateGeneOptions, type IMCreateGroupOptions, type IMCreateMemoryFileOptions, type IMCreateTaskOptions, type IMCreditsData, type IMDiscoverAgent, type IMDiscoverOptions, type IMEvolutionEdge, type IMEvolutionStats, type IMFileQuota, type IMForkGeneOptions, type IMGene, type IMGeneListOptions, type IMGroupData, type IMGroupMember, type IMIdentityKey, type IMKeyAuditEntry, type IMKeyVerifyResult, type IMMeData, type IMMemoryFile, type IMMemoryFileDetail, type IMMemoryLoadResult, type IMMessage, type IMMessageData, type IMMultipartInitResult, type IMPaginationOptions, type IMPresignOptions, type IMPresignResult, IMRealtimeClient, type IMRecordOutcomeOptions, type IMRegisterData, type IMRegisterKeyOptions, type IMRegisterOptions, type IMResult, type IMRouting, type IMSendOptions, type IMSkillContent, type IMSkillInfo, type IMSkillInstallResult, type IMTask, type IMTaskDetail, type IMTaskListOptions, type IMTaskLog, type IMTokenData, type IMTransaction, type IMUpdateMemoryFileOptions, type IMUpdateTaskOptions, type IMUser, type IMWorkspaceData, type IMWorkspaceInitGroupOptions, type IMWorkspaceInitOptions, IdentityClient, IndexedDBStorage, type LoadOptions, type LoadResult, type LoadResultItem, MemoryClient, MemoryStorage, type MessageDeletedPayload, type MessageEditPayload, type MessageNewPayload, MessagesClient, type OfflineConfig, type OfflineEventMap, type OfflineEventType, OfflineManager, type OutboxOperation, type ParseCost, type ParseCostBreakdown, type ParseDocument, type ParseDocumentImage, type ParseOptions, type ParseResult, type ParseUsage, type PongPayload, type PresenceChangedPayload, PrismerClient, type PrismerConfig, type QueryCost, type QuerySummary, type QueuedAttachment, type RankingFactors, type RealtimeCommand, type RealtimeConfig, type RealtimeEventMap, type RealtimeEventType, RealtimeSSEClient, type RealtimeState, RealtimeWSClient, type ReconnectingPayload, type RequestFn, SQLiteStorage, type SaveBatchOptions, type SaveOptions, type SaveResult, type ScheduleType, SecurityClient, type SendFileOptions, type SendFileResult, type SessionMetrics, type SignalEnrichmentConfig, type SignalTag, type SingleUrlCost, type StorageAdapter, type StoredContact, type StoredConversation, type StoredMessage, type Suggestion, type SyncEvent, type SyncResult, TabCoordinator, type TaskStatus, TasksClient, type TypingIndicatorPayload, type UploadOptions, type UploadResult, WorkspaceClient, createClient, createEnrichedExtractor, decryptContext, decryptFile, decryptMessages, decryptOnReceive, PrismerClient as default, encryptContext, encryptFile, encryptForSend, extractSignals };
+export { AccountClient, AttachmentQueue, type AuthenticatedPayload, type BatchSummary, type BatchUrlCost, BindingsClient, ContactsClient, ConversationsClient, CreditsClient, type DecryptResult, type DerivationMode, DirectClient, type DisconnectedPayload, E2EEncryption, ENVIRONMENTS, type EncryptedContextResult, type EncryptedFileResult, type EncryptedMessage, type Environment, type ErrorPayload, EvolutionCache, EvolutionClient, EvolutionRuntime, type EvolutionRuntimeConfig, type EvolutionSession, type EvolutionSyncDelta, type EvolutionSyncSnapshot, type ExecutionContext, type FileInput, FilesClient, type GeneCategory, type GeneSelectionResult, type GeneVisibility, GroupsClient, type IMAgentCard, type IMAgentPersonality, type IMAgentSkillRecord, type IMAnalyzeOptions, type IMAnalyzeResult, type IMAutocompleteResult, type IMBinding, type IMBindingData, type IMCapsule, IMClient, type IMCompactOptions, type IMCompactionSummary, type IMCompleteTaskOptions, type IMConfirmResult, type IMContact, type IMConversation, type IMConversationsOptions, type IMCreateBindingOptions, type IMCreateGeneOptions, type IMCreateGroupOptions, type IMCreateMemoryFileOptions, type IMCreateTaskOptions, type IMCreditsData, type IMDiscoverAgent, type IMDiscoverOptions, type IMEvolutionEdge, type IMEvolutionStats, type IMFileQuota, type IMForkGeneOptions, type IMGene, type IMGeneListOptions, type IMGroupData, type IMGroupMember, type IMIdentityKey, type IMKeyAuditEntry, type IMKeyVerifyResult, type IMMeData, type IMMemoryFile, type IMMemoryFileDetail, type IMMemoryLoadResult, type IMMessage, type IMMessageData, type IMMultipartInitResult, type IMPaginationOptions, type IMPresignOptions, type IMPresignResult, IMRealtimeClient, type IMRecordOutcomeOptions, type IMRegisterData, type IMRegisterKeyOptions, type IMRegisterOptions, type IMResult, type IMRouting, type IMSendOptions, type IMSkillContent, type IMSkillInfo, type IMSkillInstallResult, type IMTask, type IMTaskDetail, type IMTaskListOptions, type IMTaskLog, type IMTokenData, type IMTransaction, type IMUpdateMemoryFileOptions, type IMUpdateTaskOptions, type IMUser, type IMWorkspaceData, type IMWorkspaceInitGroupOptions, type IMWorkspaceInitOptions, IdentityClient, IndexedDBStorage, type LoadOptions, type LoadResult, type LoadResultItem, MemoryClient, MemoryStorage, type MessageDeletedPayload, type MessageEditPayload, type MessageNewPayload, MessagesClient, type OfflineConfig, type OfflineEventMap, type OfflineEventType, OfflineManager, type OutboxOperation, type ParseCost, type ParseCostBreakdown, type ParseDocument, type ParseDocumentImage, type ParseOptions, type ParseResult, type ParseUsage, type PongPayload, type PresenceChangedPayload, PrismerClient, type PrismerConfig, type QueryCost, type QuerySummary, type QueuedAttachment, type RankingFactors, type RealtimeCommand, type RealtimeConfig, type RealtimeEventMap, type RealtimeEventType, RealtimeSSEClient, type RealtimeState, RealtimeWSClient, type ReconnectingPayload, type RequestFn, SQLiteStorage, type SaveBatchOptions, type SaveOptions, type SaveResult, type ScheduleType, SecurityClient, type SendFileOptions, type SendFileResult, type SessionMetrics, type SignalEnrichmentConfig, type SignalTag, type SingleUrlCost, type StorageAdapter, type StoredContact, type StoredConversation, type StoredMessage, type Suggestion, type SyncEvent, type SyncResult, TabCoordinator, type TaskStatus, TasksClient, type TypingIndicatorPayload, type UploadOptions, type UploadResult, WorkspaceClient, createClient, createEnrichedExtractor, decryptContext, decryptFile, decryptMessages, decryptOnReceive, PrismerClient as default, encryptContext, encryptFile, encryptForSend, extractSignals, guessMimeType, safeSlug };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+export { AIPIdentity, DIDDocument, SignedPayload } from '@prismer/aip-sdk';
+
 /**
  * Prismer Cloud Real-Time Client — WebSocket & SSE transports.
  *
@@ -1621,8 +1623,17 @@ declare class E2EEncryption {
     /**
      * Initialize encryption with user passphrase.
      * Derives a master key via PBKDF2 and generates an ECDH key pair.
+     *
+     * @param passphrase - User passphrase for master key derivation
+     * @param salt - Optional Base64-encoded salt. If omitted, a random 16-byte salt is generated.
+     *               Store the salt (via exportSalt()) so you can re-derive the same master key later.
+     */
+    init(passphrase: string, salt?: string): Promise<void>;
+    /**
+     * Export the salt as Base64 string for persistent storage.
+     * You must store this and pass it back to init() to re-derive the same master key.
      */
-    init(passphrase: string): Promise<void>;
+    exportSalt(): string;
     /**
      * Export public key for sharing with conversation peers.
      */
@@ -1664,6 +1675,45 @@ declare class E2EEncryption {
      * Clear all keys and reset state.
      */
     destroy(): void;
+    private messageCount;
+    private static readonly KEY_ROTATION_THRESHOLD;
+    private static readonly KEY_ROTATION_INTERVAL_MS;
+    private lastRotation;
+    /**
+     * High-level encrypt-for-send pipeline.
+     * Encrypts content, builds metadata, and handles key rotation.
+     *
+     * Returns { encryptedContent, metadata } ready to send.
+     */
+    encryptForSend(conversationId: string, content: string): Promise<{
+        encryptedContent: string;
+        metadata: Record<string, any>;
+    }>;
+    /**
+     * High-level decrypt-on-receive pipeline.
+     * Decrypts content and validates metadata.
+     */
+    decryptOnReceive(conversationId: string, encryptedContent: string, metadata?: Record<string, any>): Promise<string>;
+    /**
+     * High-level file encryption pipeline.
+     */
+    encryptFile(conversationId: string, fileData: ArrayBuffer): Promise<{
+        encryptedData: string;
+        metadata: Record<string, any>;
+    }>;
+    /**
+     * High-level file decryption pipeline.
+     */
+    decryptFile(conversationId: string, encryptedData: string): Promise<ArrayBuffer>;
+    /**
+     * Check if key rotation is needed (1000 messages or 24 hours).
+     */
+    private shouldRotateKey;
+    /**
+     * Perform key rotation: generate new ECDH keypair and reset counters.
+     * The caller is responsible for re-exchanging keys with peers.
+     */
+    rotateKeys(): Promise<JsonWebKey>;
 }
 
 /**
@@ -2340,6 +2390,22 @@ declare class EvolutionClient {
     installedSkills(): Promise<IMResult<IMAgentSkillRecord[]>>;
     /** Get full skill content (SKILL.md + package info) */
     getSkillContent(slugOrId: string): Promise<IMResult<IMSkillContent>>;
+    /** Create/submit a community skill */
+    createSkill(input: {
+        name: string;
+        description: string;
+        category: string;
+        tags?: string[];
+        content?: string;
+        signals?: Array<{
+            type: string;
+        }>;
+        author?: string;
+    }): Promise<IMResult<any>>;
+    /** Star a skill (increment community rating) */
+    starSkill(skillId: string): Promise<IMResult<{
+        stars: number;
+    }>>;
     /**
      * Install a skill and write SKILL.md to local filesystem.
      * Combines cloud install + local file sync for Claude Code / OpenClaw / OpenCode.
@@ -2400,6 +2466,10 @@ declare class EvolutionClient {
         pullSince?: number;
     }): Promise<IMResult<any>>;
 }
+/** Sanitize a slug/id to prevent path traversal (removes slashes, .., and null bytes) */
+declare function safeSlug(input: string): string;
+/** Map file extension to MIME type (no external deps) */
+declare function guessMimeType(fileName: string): string;
 /** File upload management (presign → upload → confirm) */
 declare class FilesClient {
     private _r;
@@ -2530,4 +2600,4 @@ declare class PrismerClient {
 
 declare function createClient(config: PrismerConfig): PrismerClient;
 
-export { AccountClient, AttachmentQueue, type AuthenticatedPayload, type BatchSummary, type BatchUrlCost, BindingsClient, ContactsClient, ConversationsClient, CreditsClient, type DecryptResult, type DerivationMode, DirectClient, type DisconnectedPayload, E2EEncryption, ENVIRONMENTS, type EncryptedContextResult, type EncryptedFileResult, type EncryptedMessage, type Environment, type ErrorPayload, EvolutionCache, EvolutionClient, EvolutionRuntime, type EvolutionRuntimeConfig, type EvolutionSession, type EvolutionSyncDelta, type EvolutionSyncSnapshot, type ExecutionContext, type FileInput, FilesClient, type GeneCategory, type GeneSelectionResult, type GeneVisibility, GroupsClient, type IMAgentCard, type IMAgentPersonality, type IMAgentSkillRecord, type IMAnalyzeOptions, type IMAnalyzeResult, type IMAutocompleteResult, type IMBinding, type IMBindingData, type IMCapsule, IMClient, type IMCompactOptions, type IMCompactionSummary, type IMCompleteTaskOptions, type IMConfirmResult, type IMContact, type IMConversation, type IMConversationsOptions, type IMCreateBindingOptions, type IMCreateGeneOptions, type IMCreateGroupOptions, type IMCreateMemoryFileOptions, type IMCreateTaskOptions, type IMCreditsData, type IMDiscoverAgent, type IMDiscoverOptions, type IMEvolutionEdge, type IMEvolutionStats, type IMFileQuota, type IMForkGeneOptions, type IMGene, type IMGeneListOptions, type IMGroupData, type IMGroupMember, type IMIdentityKey, type IMKeyAuditEntry, type IMKeyVerifyResult, type IMMeData, type IMMemoryFile, type IMMemoryFileDetail, type IMMemoryLoadResult, type IMMessage, type IMMessageData, type IMMultipartInitResult, type IMPaginationOptions, type IMPresignOptions, type IMPresignResult, IMRealtimeClient, type IMRecordOutcomeOptions, type IMRegisterData, type IMRegisterKeyOptions, type IMRegisterOptions, type IMResult, type IMRouting, type IMSendOptions, type IMSkillContent, type IMSkillInfo, type IMSkillInstallResult, type IMTask, type IMTaskDetail, type IMTaskListOptions, type IMTaskLog, type IMTokenData, type IMTransaction, type IMUpdateMemoryFileOptions, type IMUpdateTaskOptions, type IMUser, type IMWorkspaceData, type IMWorkspaceInitGroupOptions, type IMWorkspaceInitOptions, IdentityClient, IndexedDBStorage, type LoadOptions, type LoadResult, type LoadResultItem, MemoryClient, MemoryStorage, type MessageDeletedPayload, type MessageEditPayload, type MessageNewPayload, MessagesClient, type OfflineConfig, type OfflineEventMap, type OfflineEventType, OfflineManager, type OutboxOperation, type ParseCost, type ParseCostBreakdown, type ParseDocument, type ParseDocumentImage, type ParseOptions, type ParseResult, type ParseUsage, type PongPayload, type PresenceChangedPayload, PrismerClient, type PrismerConfig, type QueryCost, type QuerySummary, type QueuedAttachment, type RankingFactors, type RealtimeCommand, type RealtimeConfig, type RealtimeEventMap, type RealtimeEventType, RealtimeSSEClient, type RealtimeState, RealtimeWSClient, type ReconnectingPayload, type RequestFn, SQLiteStorage, type SaveBatchOptions, type SaveOptions, type SaveResult, type ScheduleType, SecurityClient, type SendFileOptions, type SendFileResult, type SessionMetrics, type SignalEnrichmentConfig, type SignalTag, type SingleUrlCost, type StorageAdapter, type StoredContact, type StoredConversation, type StoredMessage, type Suggestion, type SyncEvent, type SyncResult, TabCoordinator, type TaskStatus, TasksClient, type TypingIndicatorPayload, type UploadOptions, type UploadResult, WorkspaceClient, createClient, createEnrichedExtractor, decryptContext, decryptFile, decryptMessages, decryptOnReceive, PrismerClient as default, encryptContext, encryptFile, encryptForSend, extractSignals };
+export { AccountClient, AttachmentQueue, type AuthenticatedPayload, type BatchSummary, type BatchUrlCost, BindingsClient, ContactsClient, ConversationsClient, CreditsClient, type DecryptResult, type DerivationMode, DirectClient, type DisconnectedPayload, E2EEncryption, ENVIRONMENTS, type EncryptedContextResult, type EncryptedFileResult, type EncryptedMessage, type Environment, type ErrorPayload, EvolutionCache, EvolutionClient, EvolutionRuntime, type EvolutionRuntimeConfig, type EvolutionSession, type EvolutionSyncDelta, type EvolutionSyncSnapshot, type ExecutionContext, type FileInput, FilesClient, type GeneCategory, type GeneSelectionResult, type GeneVisibility, GroupsClient, type IMAgentCard, type IMAgentPersonality, type IMAgentSkillRecord, type IMAnalyzeOptions, type IMAnalyzeResult, type IMAutocompleteResult, type IMBinding, type IMBindingData, type IMCapsule, IMClient, type IMCompactOptions, type IMCompactionSummary, type IMCompleteTaskOptions, type IMConfirmResult, type IMContact, type IMConversation, type IMConversationsOptions, type IMCreateBindingOptions, type IMCreateGeneOptions, type IMCreateGroupOptions, type IMCreateMemoryFileOptions, type IMCreateTaskOptions, type IMCreditsData, type IMDiscoverAgent, type IMDiscoverOptions, type IMEvolutionEdge, type IMEvolutionStats, type IMFileQuota, type IMForkGeneOptions, type IMGene, type IMGeneListOptions, type IMGroupData, type IMGroupMember, type IMIdentityKey, type IMKeyAuditEntry, type IMKeyVerifyResult, type IMMeData, type IMMemoryFile, type IMMemoryFileDetail, type IMMemoryLoadResult, type IMMessage, type IMMessageData, type IMMultipartInitResult, type IMPaginationOptions, type IMPresignOptions, type IMPresignResult, IMRealtimeClient, type IMRecordOutcomeOptions, type IMRegisterData, type IMRegisterKeyOptions, type IMRegisterOptions, type IMResult, type IMRouting, type IMSendOptions, type IMSkillContent, type IMSkillInfo, type IMSkillInstallResult, type IMTask, type IMTaskDetail, type IMTaskListOptions, type IMTaskLog, type IMTokenData, type IMTransaction, type IMUpdateMemoryFileOptions, type IMUpdateTaskOptions, type IMUser, type IMWorkspaceData, type IMWorkspaceInitGroupOptions, type IMWorkspaceInitOptions, IdentityClient, IndexedDBStorage, type LoadOptions, type LoadResult, type LoadResultItem, MemoryClient, MemoryStorage, type MessageDeletedPayload, type MessageEditPayload, type MessageNewPayload, MessagesClient, type OfflineConfig, type OfflineEventMap, type OfflineEventType, OfflineManager, type OutboxOperation, type ParseCost, type ParseCostBreakdown, type ParseDocument, type ParseDocumentImage, type ParseOptions, type ParseResult, type ParseUsage, type PongPayload, type PresenceChangedPayload, PrismerClient, type PrismerConfig, type QueryCost, type QuerySummary, type QueuedAttachment, type RankingFactors, type RealtimeCommand, type RealtimeConfig, type RealtimeEventMap, type RealtimeEventType, RealtimeSSEClient, type RealtimeState, RealtimeWSClient, type ReconnectingPayload, type RequestFn, SQLiteStorage, type SaveBatchOptions, type SaveOptions, type SaveResult, type ScheduleType, SecurityClient, type SendFileOptions, type SendFileResult, type SessionMetrics, type SignalEnrichmentConfig, type SignalTag, type SingleUrlCost, type StorageAdapter, type StoredContact, type StoredConversation, type StoredMessage, type Suggestion, type SyncEvent, type SyncResult, TabCoordinator, type TaskStatus, TasksClient, type TypingIndicatorPayload, type UploadOptions, type UploadResult, WorkspaceClient, createClient, createEnrichedExtractor, decryptContext, decryptFile, decryptMessages, decryptOnReceive, PrismerClient as default, encryptContext, encryptFile, encryptForSend, extractSignals, guessMimeType, safeSlug };

package/dist/index.js

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AIPIdentity: () => import_aip_sdk.AIPIdentity,
   AccountClient: () => AccountClient,
   AttachmentQueue: () => AttachmentQueue,
   BindingsClient: () => BindingsClient,
@@ -70,7 +71,9 @@ __export(index_exports, {
   encryptContext: () => encryptContext,
   encryptFile: () => encryptFile,
   encryptForSend: () => encryptForSend,
-  extractSignals: () => extractSignals
+  extractSignals: () => extractSignals,
+  guessMimeType: () => guessMimeType,
+  safeSlug: () => safeSlug
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1279,6 +1282,12 @@ var ENVIRONMENTS = {
   production: "https://prismer.cloud"
 };
 
+// src/aip.ts
+var import_aip_sdk = require("@prismer/aip-sdk");
+var import_aip_sdk2 = require("@prismer/aip-sdk");
+var import_aip_sdk3 = require("@prismer/aip-sdk");
+var import_aip_sdk4 = require("@prismer/aip-sdk");
+
 // src/storage.ts
 var MemoryStorage = class {
   constructor() {
@@ -2163,20 +2172,27 @@ var PBKDF2_ITERATIONS = 1e5;
 var SALT_LENGTH = 16;
 var IV_LENGTH = 12;
 var KEY_LENGTH = 256;
-var E2EEncryption = class {
+var _E2EEncryption = class _E2EEncryption {
   constructor() {
     this.masterKey = null;
     this.keyPair = null;
     this.sessionKeys = /* @__PURE__ */ new Map();
     // conversationId → AES key
     this.salt = null;
+    // ─── Pipeline Functions ──────────────────────────────────
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
   }
   /**
    * Initialize encryption with user passphrase.
    * Derives a master key via PBKDF2 and generates an ECDH key pair.
+   *
+   * @param passphrase - User passphrase for master key derivation
+   * @param salt - Optional Base64-encoded salt. If omitted, a random 16-byte salt is generated.
+   *               Store the salt (via exportSalt()) so you can re-derive the same master key later.
    */
-  async init(passphrase) {
-    this.salt = getRandomValues(new Uint8Array(SALT_LENGTH));
+  async init(passphrase, salt) {
+    this.salt = salt ? new Uint8Array(base64ToArrayBuffer(salt)) : getRandomValues(new Uint8Array(SALT_LENGTH));
     const passphraseKey = await subtle().importKey(
       "raw",
       new TextEncoder().encode(passphrase),
@@ -2187,7 +2203,7 @@ var E2EEncryption = class {
     this.masterKey = await subtle().deriveKey(
       {
         name: "PBKDF2",
-        salt: this.salt,
+        salt: new Uint8Array(this.salt.buffer, this.salt.byteOffset, this.salt.byteLength).buffer,
         iterations: PBKDF2_ITERATIONS,
         hash: "SHA-256"
       },
@@ -2202,6 +2218,14 @@ var E2EEncryption = class {
       ["deriveKey"]
     );
   }
+  /**
+   * Export the salt as Base64 string for persistent storage.
+   * You must store this and pass it back to init() to re-derive the same master key.
+   */
+  exportSalt() {
+    if (!this.salt) throw new Error("E2E not initialized. Call init() first.");
+    return arrayBufferToBase64(this.salt.buffer);
+  }
   /**
    * Export public key for sharing with conversation peers.
    */
@@ -2314,8 +2338,93 @@ var E2EEncryption = class {
     this.keyPair = null;
     this.sessionKeys.clear();
     this.salt = null;
+    this.messageCount = 0;
+  }
+  /**
+   * High-level encrypt-for-send pipeline.
+   * Encrypts content, builds metadata, and handles key rotation.
+   *
+   * Returns { encryptedContent, metadata } ready to send.
+   */
+  async encryptForSend(conversationId, content) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    const needsRotation = this.shouldRotateKey();
+    const encryptedContent = await this.encrypt(conversationId, content);
+    this.messageCount++;
+    return {
+      encryptedContent,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        ...needsRotation && { keyRotationRequested: true }
+      }
+    };
+  }
+  /**
+   * High-level decrypt-on-receive pipeline.
+   * Decrypts content and validates metadata.
+   */
+  async decryptOnReceive(conversationId, encryptedContent, metadata) {
+    if (!this.hasSessionKey(conversationId)) {
+      throw new Error("No session key for this conversation. Call deriveSessionKey() first.");
+    }
+    return this.decrypt(conversationId, encryptedContent);
+  }
+  /**
+   * High-level file encryption pipeline.
+   */
+  async encryptFile(conversationId, fileData) {
+    const base64Data = arrayBufferToBase64(fileData);
+    const encryptedData = await this.encrypt(conversationId, base64Data);
+    return {
+      encryptedData,
+      metadata: {
+        encrypted: true,
+        encryptionVersion: 1,
+        fileEncrypted: true
+      }
+    };
+  }
+  /**
+   * High-level file decryption pipeline.
+   */
+  async decryptFile(conversationId, encryptedData) {
+    const base64Data = await this.decrypt(conversationId, encryptedData);
+    return base64ToArrayBuffer(base64Data);
+  }
+  /**
+   * Check if key rotation is needed (1000 messages or 24 hours).
+   */
+  shouldRotateKey() {
+    if (this.messageCount >= _E2EEncryption.KEY_ROTATION_THRESHOLD) {
+      return true;
+    }
+    if (Date.now() - this.lastRotation >= _E2EEncryption.KEY_ROTATION_INTERVAL_MS) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Perform key rotation: generate new ECDH keypair and reset counters.
+   * The caller is responsible for re-exchanging keys with peers.
+   */
+  async rotateKeys() {
+    this.keyPair = await subtle().generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      ["deriveKey"]
+    );
+    this.messageCount = 0;
+    this.lastRotation = Date.now();
+    this.sessionKeys.clear();
+    return this.exportPublicKey();
   }
 };
+_E2EEncryption.KEY_ROTATION_THRESHOLD = 1e3;
+_E2EEncryption.KEY_ROTATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var E2EEncryption = _E2EEncryption;
 function arrayBufferToBase64(buffer) {
   if (typeof btoa !== "undefined") {
     const bytes = new Uint8Array(buffer);
@@ -3364,11 +3473,11 @@ var EvolutionClient = class {
   }
   /** Delete a gene */
   async deleteGene(geneId) {
-    return this._r("DELETE", `/api/im/evolution/genes/${geneId}`);
+    return this._r("DELETE", `/api/im/evolution/genes/${encodeURIComponent(geneId)}`);
   }
   /** Publish a gene. Pass skipCanary=true to bypass canary validation (MVP/admin). */
   async publishGene(geneId, options) {
-    return this._r("POST", `/api/im/evolution/genes/${geneId}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
+    return this._r("POST", `/api/im/evolution/genes/${encodeURIComponent(geneId)}/publish`, options?.skipCanary ? { skipCanary: true } : void 0);
   }
   /** Import a published gene */
   async importGene(geneId) {
@@ -3454,6 +3563,14 @@ var EvolutionClient = class {
   async getSkillContent(slugOrId) {
     return this._r("GET", `/api/im/skills/${encodeURIComponent(slugOrId)}/content`);
   }
+  /** Create/submit a community skill */
+  async createSkill(input) {
+    return this._r("POST", "/api/im/skills", input);
+  }
+  /** Star a skill (increment community rating) */
+  async starSkill(skillId) {
+    return this._r("POST", `/api/im/skills/${encodeURIComponent(skillId)}/star`);
+  }
   /**
    * Install a skill and write SKILL.md to local filesystem.
    * Combines cloud install + local file sync for Claude Code / OpenClaw / OpenCode.
@@ -3516,8 +3633,8 @@ var EvolutionClient = class {
   async uninstallSkillLocal(slugOrId) {
     const result = await this.uninstallSkill(slugOrId);
     const removedPaths = [];
-    const safeSlug = slugOrId.replace(/[\/\\]/g, "").replace(/\.\./g, "");
-    if (!safeSlug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
+    const slug = safeSlug(slugOrId);
+    if (!slug) return { ...result, data: { uninstalled: result.data?.uninstalled ?? false, removedPaths } };
     try {
       const fs = await import("fs");
       const path = await import("path");
@@ -3525,10 +3642,10 @@ var EvolutionClient = class {
       const home = os.homedir();
       const pluginBase = process.env.PRISMER_PLUGIN_DIR || path.join(home, ".claude", "plugins", "prismer");
       const dirs = [
-        path.join(home, ".claude", "skills", safeSlug),
-        path.join(home, ".openclaw", "skills", safeSlug),
-        path.join(home, ".config", "opencode", "skills", safeSlug),
-        path.join(pluginBase, "skills", safeSlug)
+        path.join(home, ".claude", "skills", slug),
+        path.join(home, ".openclaw", "skills", slug),
+        path.join(home, ".config", "opencode", "skills", slug),
+        path.join(pluginBase, "skills", slug)
       ];
       for (const dir of dirs) {
         try {
@@ -3638,6 +3755,9 @@ var EvolutionClient = class {
     return this._r("POST", "/api/im/evolution/sync", body);
   }
 };
+function safeSlug(input) {
+  return input.replace(/[\/\\]/g, "").replace(/\.\./g, "").replace(/\0/g, "");
+}
 function guessMimeType(fileName) {
   const ext = fileName.split(".").pop()?.toLowerCase() || "";
   const map = {
@@ -4055,6 +4175,7 @@ function createClient(config) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AIPIdentity,
   AccountClient,
   AttachmentQueue,
   BindingsClient,
@@ -4094,5 +4215,7 @@ function createClient(config) {
   encryptContext,
   encryptFile,
   encryptForSend,
-  extractSignals
+  extractSignals,
+  guessMimeType,
+  safeSlug
 });