@qodo/sdk 0.13.4 → 2.0.0-next.0

package/dist/skills/inject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../src/skills/inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,eAAe,EAEf,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAmB,KAAK,aAAa,EAAqB,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,aAAkB,GACvB,eAAe,CAAC,eAAe,CAAC,CA0BlC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,aAAkB,GACvB,eAAe,CAAC,eAAe,CAAC,CAgClC"}

package/dist/skills/inject.js

@@ -0,0 +1,162 @@
+/**
+ * Slim-index injection.
+ *
+ * Couples the pure renderer (`./render.ts`) to the wire shapes:
+ * `InlineAgentSpec` (Pattern B) and `InlineGraphSpec` (Pattern C). The
+ * SDK 2.0 by-id path (`tasks.start({ agent_id })`) has no `instructions`
+ * field on the wire — the agent body lives on QAR's side — so the SDK
+ * cannot inject for that variant.
+ *
+ * The rendered text appends to the consumer's existing `instructions`
+ * content. Injection helpers are pure: input = spec + catalog, output =
+ * new spec. No side effects.
+ */
+import { renderSlimIndex } from './render.js';
+/**
+ * Append the rendered slim index to a single `InlineAgentSpec`'s
+ * `instructions` field. Mutates nothing; returns a new spec.
+ *
+ * For `Instructions === string`: append the rendered block on a new line.
+ * For `Instructions === InstructionsPreset`: append into the preset's
+ * `append` field (creating it if absent).
+ *
+ * Returns the original spec unchanged when the catalog is empty.
+ */
+export function injectIntoAgentSpec(spec, manager, opts = {}) {
+    const snapshot = manager.currentSnapshot;
+    if (snapshot === null) {
+        throw new Error('injectIntoAgentSpec called before SkillsManager.discover() resolved; await manager.discover() first');
+    }
+    const skills = collectLatestForRender(snapshot.skills);
+    const rendered = renderSlimIndex(skills, opts);
+    if (rendered.text.length === 0) {
+        return {
+            spec,
+            inserted: false,
+            included: [],
+            events: rendered.events,
+            omittedPinned: rendered.omittedPinned,
+        };
+    }
+    const updated = appendToInstructions(spec.instructions, rendered);
+    return {
+        spec: { ...spec, instructions: updated },
+        inserted: true,
+        included: rendered.included,
+        events: rendered.events,
+        omittedPinned: rendered.omittedPinned,
+    };
+}
+/**
+ * Walk every agent inside an `InlineGraphSpec` and apply the slim-index
+ * injection to nodes whose `spec` is an `InlineAgentSpec`. Static-ref
+ * nodes (`{ agent_id }`) and recursive sub-graphs are returned untouched
+ * (the static ref has no client-side instructions; sub-graphs recurse).
+ */
+export function injectIntoGraphSpec(graph, manager, opts = {}) {
+    const snapshot = manager.currentSnapshot;
+    if (snapshot === null) {
+        throw new Error('injectIntoGraphSpec called before SkillsManager.discover() resolved; await manager.discover() first');
+    }
+    const skills = collectLatestForRender(snapshot.skills);
+    const rendered = renderSlimIndex(skills, opts);
+    if (rendered.text.length === 0) {
+        return {
+            spec: graph,
+            inserted: false,
+            included: [],
+            events: rendered.events,
+            omittedPinned: rendered.omittedPinned,
+        };
+    }
+    const newAgents = {};
+    let inserted = false;
+    for (const [nodeName, agent] of Object.entries(graph.agents)) {
+        newAgents[nodeName] = injectIntoGraphAgent(agent, rendered, (didInsert) => {
+            if (didInsert)
+                inserted = true;
+        });
+    }
+    return {
+        spec: { ...graph, agents: newAgents },
+        inserted,
+        included: rendered.included,
+        events: rendered.events,
+        omittedPinned: rendered.omittedPinned,
+    };
+}
+function injectIntoGraphAgent(agent, rendered, markInserted) {
+    const inner = agent.spec;
+    if (typeof inner !== 'object' ||
+        inner === null ||
+        !('kind' in inner)) {
+        return agent;
+    }
+    if (inner.kind === 'AgentSpec') {
+        const updated = appendToInstructions(inner.instructions, rendered);
+        markInserted(true);
+        return { ...agent, spec: { ...inner, instructions: updated } };
+    }
+    if (inner.kind === 'GraphSpec') {
+        // Recurse into the sub-graph.
+        const newAgents = {};
+        for (const [nodeName, sub] of Object.entries(inner.agents)) {
+            newAgents[nodeName] = injectIntoGraphAgent(sub, rendered, markInserted);
+        }
+        return { ...agent, spec: { ...inner, agents: newAgents } };
+    }
+    return agent;
+}
+/**
+ * Append the rendered block to an `Instructions` field (string or
+ * preset). For preset: write to `append` so the QAR-side prompt builder
+ * concatenates after the preset body. Existing `append` content is
+ * preserved — the slim index lands BELOW the consumer's own append text.
+ */
+function appendToInstructions(current, rendered) {
+    if (typeof current === 'string') {
+        if (current.length === 0)
+            return rendered.text;
+        return `${current}\n\n${rendered.text}`;
+    }
+    // Preset form.
+    const existingAppend = current.append ?? '';
+    const newAppend = existingAppend.length === 0
+        ? rendered.text
+        : `${existingAppend}\n\n${rendered.text}`;
+    return { preset: current.preset, append: newAppend };
+}
+/**
+ * The renderer wants latest-version-per-FQN; the manager's snapshot
+ * carries every version. Trim here so the slim-index ordering /
+ * dedup logic stays self-contained.
+ */
+function collectLatestForRender(skills) {
+    // Reuse manager-style dedup: by `fqnNoVersion`, highest version wins.
+    const byFqnNoVersion = new Map();
+    for (const skill of skills) {
+        const existing = byFqnNoVersion.get(skill.fqnNoVersion);
+        if (existing === undefined) {
+            byFqnNoVersion.set(skill.fqnNoVersion, skill);
+            continue;
+        }
+        if (compareVersions(existing.version, skill.version) < 0) {
+            byFqnNoVersion.set(skill.fqnNoVersion, skill);
+        }
+    }
+    return [...byFqnNoVersion.values()];
+}
+function compareVersions(a, b) {
+    const am = /^(\d+)\.(\d+)\.(\d+)$/.exec(a);
+    const bm = /^(\d+)\.(\d+)\.(\d+)$/.exec(b);
+    if (am === null || bm === null)
+        return a.localeCompare(b);
+    for (let i = 1; i <= 3; i += 1) {
+        const an = Number(am[i]);
+        const bn = Number(bm[i]);
+        if (an !== bn)
+            return an - bn;
+    }
+    return 0;
+}
+//# sourceMappingURL=inject.js.map

package/dist/skills/inject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject.js","sourceRoot":"","sources":["../../src/skills/inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EAAE,eAAe,EAAyC,MAAM,aAAa,CAAC;AAyBrF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB,EACtB,OAAsB,EAAE;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE;QACxC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB,EACtB,OAAsB,EACtB,OAAsB,EAAE;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAqC,EAAE,CAAC;IACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,SAAS,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YACxE,IAAI,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;QACrC,QAAQ;QACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAuB,EACvB,QAAsB,EACtB,YAA0C;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IACzB,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnE,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,8BAA8B;QAC9B,MAAM,SAAS,GAAqC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,OAAqB,EACrB,QAAsB;IAEtB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;QAC/C,OAAO,GAAG,OAAO,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,eAAe;IACf,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,GAAG,cAAc,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAA8B;IAC5D,sEAAsE;IACtE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/skills/lockfile.browser.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `lockfile` — browser stub.
+ *
+ * The Node version of this module imports `node:crypto`, `node:fs`, and
+ * `node:path` to compute content hashes and read `qodo.lock.yaml` off
+ * disk. None of those APIs exist in the browser, and the lockfile is a
+ * server-side concern anyway: there's no reproducibility story for a
+ * browser bundle that holds no catalog.
+ *
+ * The stub preserves the type surface so `import type { Lockfile } from
+ * '@qodo/sdk'` resolves in both environments; runtime calls reject with
+ * a clear message. Wired via the `browser` field in `package.json`.
+ */
+import type { SkillSource } from './types.js';
+export declare const LOCKFILE_SCHEMA_VERSION = 1;
+export declare const LOCKFILE_BASENAME = "qodo.lock.yaml";
+export interface LockfileEntry {
+    readonly fqn: string;
+    readonly source: SkillSource;
+    readonly sha256: string;
+}
+export interface Lockfile {
+    readonly schemaVersion: number;
+    readonly skills: readonly LockfileEntry[];
+}
+export type LockfileValidation = {
+    readonly outcome: 'ok';
+    readonly actualSha256: string;
+} | {
+    readonly outcome: 'drift';
+    readonly actualSha256: string;
+    readonly expectedSha256: string;
+} | {
+    readonly outcome: 'unreachable';
+    readonly reason: string;
+};
+export declare class LockfileParseError extends Error {
+    constructor(message: string);
+}
+export declare class LockfileValidationError extends Error {
+    readonly fqn: string;
+    readonly kind: 'drift' | 'unreachable';
+    constructor(fqn: string, kind: 'drift' | 'unreachable', message: string);
+}
+export declare function findLockfile(_paths: readonly string[]): Promise<string | null>;
+export declare function loadLockfile(_path: string): Promise<Lockfile>;
+export declare function parseLockfile(_text: string): Lockfile;
+export declare function writeLockfile(_lockfile: Lockfile): string;
+export declare function computeSkillHash(_dir: string): Promise<{
+    readonly sha256: string;
+    readonly fileCount: number;
+    readonly skipped: readonly string[];
+}>;
+export declare function validateLockfileEntry(_entry: LockfileEntry, _skill: unknown): Promise<LockfileValidation>;
+export declare function buildLockfile(_skills: readonly unknown[]): Promise<Lockfile>;
+//# sourceMappingURL=lockfile.browser.d.ts.map

package/dist/skills/lockfile.browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.browser.d.ts","sourceRoot":"","sources":["../../src/skills/lockfile.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;gBAElC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,aAAa,EAAE,OAAO,EAAE,MAAM;CAMxE;AAMD,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE7D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAErD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAEzD;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAEvG;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE5E"}

package/dist/skills/lockfile.browser.js

@@ -0,0 +1,55 @@
+/**
+ * `lockfile` — browser stub.
+ *
+ * The Node version of this module imports `node:crypto`, `node:fs`, and
+ * `node:path` to compute content hashes and read `qodo.lock.yaml` off
+ * disk. None of those APIs exist in the browser, and the lockfile is a
+ * server-side concern anyway: there's no reproducibility story for a
+ * browser bundle that holds no catalog.
+ *
+ * The stub preserves the type surface so `import type { Lockfile } from
+ * '@qodo/sdk'` resolves in both environments; runtime calls reject with
+ * a clear message. Wired via the `browser` field in `package.json`.
+ */
+export const LOCKFILE_SCHEMA_VERSION = 1;
+export const LOCKFILE_BASENAME = 'qodo.lock.yaml';
+export class LockfileParseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LockfileParseError';
+    }
+}
+export class LockfileValidationError extends Error {
+    fqn;
+    kind;
+    constructor(fqn, kind, message) {
+        super(message);
+        this.name = 'LockfileValidationError';
+        this.fqn = fqn;
+        this.kind = kind;
+    }
+}
+const BROWSER_ERROR = 'Skill lockfile APIs require Node-only modules (node:crypto / node:fs / node:path) ' +
+    'and are not supported in the browser bundle. Run discovery + lock generation server-side.';
+export function findLockfile(_paths) {
+    return Promise.reject(new Error(BROWSER_ERROR));
+}
+export function loadLockfile(_path) {
+    return Promise.reject(new Error(BROWSER_ERROR));
+}
+export function parseLockfile(_text) {
+    throw new Error(BROWSER_ERROR);
+}
+export function writeLockfile(_lockfile) {
+    throw new Error(BROWSER_ERROR);
+}
+export function computeSkillHash(_dir) {
+    return Promise.reject(new Error(BROWSER_ERROR));
+}
+export function validateLockfileEntry(_entry, _skill) {
+    return Promise.reject(new Error(BROWSER_ERROR));
+}
+export function buildLockfile(_skills) {
+    return Promise.reject(new Error(BROWSER_ERROR));
+}
+//# sourceMappingURL=lockfile.browser.js.map

package/dist/skills/lockfile.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.browser.js","sourceRoot":"","sources":["../../src/skills/lockfile.browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAsBlD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChC,GAAG,CAAS;IACZ,IAAI,CAA0B;IAE9C,YAAY,GAAW,EAAE,IAA6B,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,aAAa,GACjB,oFAAoF;IACpF,2FAA2F,CAAC;AAE9F,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAmB;IAC/C,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAqB,EACrB,MAAe;IAEf,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA2B;IACvD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/skills/lockfile.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Skill catalog lockfile.
+ *
+ * The lockfile (`qodo.lock.yaml`) pins each catalog entry to a content
+ * hash, giving consumers reproducible boots when the catalog includes
+ * third-party skills. Without it the SDK behaves dynamically — discovery
+ * is authoritative.
+ *
+ * Spec: `knowledge/doc/skills-discovery.md` §5–6.
+ *
+ * ## Boot semantics
+ *
+ *   1. Manager looks for `qodo.lock.yaml` at the SDK construction CWD or
+ *      alongside `agent.toml`. Absence is silent.
+ *   2. For each entry, the manager re-hashes the on-disk skill directory
+ *      and compares against the lockfile's `sha256`.
+ *   3. Match → use as-is. Drift → emit `sdk.skill.lock_drift` and throw.
+ *      Unreachable → emit `sdk.skill.lock_unreachable` and throw.
+ *   4. Skills not in the lockfile are still discovered + included.
+ *
+ * ## File format
+ *
+ * The SDK ships no YAML serializer for skill bodies and runs zero
+ * runtime deps. The lockfile is therefore stored as a YAML subset the
+ * skill-frontmatter parser already handles plus a hand-rolled writer.
+ *
+ *     schemaVersion: 1
+ *     skills:
+ *       - fqn: anthropic-skills/code-review@1.2.0
+ *         source:
+ *           type: package
+ *           packageName: "@anthropic-skills/core"
+ *         sha256: "abc123...def"
+ *       - fqn: local/security@0.0.0
+ *         source:
+ *           type: project
+ *         sha256: "def456...abc"
+ *
+ * ## Hashing contract
+ *
+ * `computeSkillHash` produces a stable digest by:
+ *
+ *   1. Listing every file under the skill directory (recursive), sorted.
+ *   2. For each file: hash `relPath\0sha256(content)\0`.
+ *   3. Hash the concatenation; return its hex digest.
+ *
+ * Two skill directories with byte-identical files at identical paths
+ * produce identical hashes. Permissions, timestamps, inodes are out
+ * of scope — drifting timestamps alone would force needless re-locks.
+ */
+import type { ParsedSkill, SkillSource } from './types.js';
+/** Current lockfile schema version. */
+export declare const LOCKFILE_SCHEMA_VERSION = 1;
+/** Default lockfile basename. Manager looks beside `agent.toml` + at CWD. */
+export declare const LOCKFILE_BASENAME = "qodo.lock.yaml";
+/** One entry in the lockfile. */
+export interface LockfileEntry {
+    /** Fully-qualified `<vendor>/<name>@<version>` identifier. */
+    readonly fqn: string;
+    /** Discriminated source identity (matches the manager's `SkillSource`). */
+    readonly source: SkillSource;
+    /** Hex-encoded SHA-256 from {@link computeSkillHash}. */
+    readonly sha256: string;
+}
+export interface Lockfile {
+    readonly schemaVersion: number;
+    readonly skills: readonly LockfileEntry[];
+}
+/** Result of `validateLockfileEntry` for one record. */
+export type LockfileValidation = {
+    readonly outcome: 'ok';
+    readonly actualSha256: string;
+} | {
+    readonly outcome: 'drift';
+    readonly actualSha256: string;
+    readonly expectedSha256: string;
+} | {
+    readonly outcome: 'unreachable';
+    readonly reason: string;
+};
+export declare class LockfileParseError extends Error {
+    constructor(message: string);
+}
+export declare class LockfileValidationError extends Error {
+    readonly fqn: string;
+    readonly kind: 'drift' | 'unreachable';
+    constructor(fqn: string, kind: 'drift' | 'unreachable', message: string);
+}
+/**
+ * Find the lockfile at the manager's CWD or one of the supplied search
+ * paths. Returns the first match's path; `null` when none exist.
+ */
+export declare function findLockfile(searchPaths: readonly string[]): Promise<string | null>;
+/**
+ * Read + parse a lockfile from `lockfilePath`. Throws
+ * {@link LockfileParseError} on schema violations.
+ */
+export declare function loadLockfile(lockfilePath: string): Promise<Lockfile>;
+/**
+ * Parse a lockfile from a raw YAML string. Public for tests and the
+ * forthcoming CLI's lint/validate commands.
+ */
+export declare function parseLockfile(text: string): Lockfile;
+/**
+ * Serialize a lockfile structure to its on-disk YAML form. Output is
+ * deterministic — entries sort by FQN; the writer does not depend on
+ * input order.
+ */
+export declare function writeLockfile(lockfile: Lockfile): string;
+/**
+ * Compute a deterministic SHA-256 hash of a skill's directory contents.
+ *
+ * Walks the directory recursively, sorts the file list, and digests
+ * `<relPath>\0<sha256(content)>\0` for each file. The result is a hex
+ * digest stable across hosts and filesystems.
+ *
+ * Symlinks are followed if they resolve inside the skill directory;
+ * symlinks pointing outside are skipped (and recorded in the
+ * `skipped` list so the caller can surface the audit if needed).
+ */
+export declare function computeSkillHash(skillDir: string): Promise<{
+    readonly sha256: string;
+    readonly fileCount: number;
+    readonly skipped: readonly string[];
+}>;
+/**
+ * Validate one lockfile entry against the current on-disk skill. Returns
+ * a structured outcome the manager translates to telemetry + boot
+ * behavior.
+ */
+export declare function validateLockfileEntry(entry: LockfileEntry, skill: ParsedSkill | undefined): Promise<LockfileValidation>;
+/**
+ * Build a lockfile from an already-discovered catalog. The CLI's
+ * `qodo skills lock` op calls this after a fresh `discover()`.
+ */
+export declare function buildLockfile(skills: readonly ParsedSkill[]): Promise<Lockfile>;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/skills/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/skills/lockfile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;gBAElC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,aAAa,EAAE,OAAO,EAAE,MAAM;CAMxE;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYzF;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG1E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAuCpD;AAoCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAkBxD;AAkFD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAoBvG;AA6ED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,WAAW,GAAG,SAAS,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWrF"}