@quatronic/sdk 0.6.1-rc.4 → 0.7.0-rc.6

package/dist/cli/skills.js

@@ -0,0 +1,499 @@
+#!/usr/bin/env node
+
+// src/cli/skills.ts
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmdirSync, rmSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+
+// src/cli/skills-core.ts
+import { createHash } from "crypto";
+var MANIFEST_PATH = "qore/manifest.json";
+var INDEX_PATH = "qore/skills.md";
+var README_PATH = "qore/README.md";
+var EXTENSIONS_DIR = "qore/extensions";
+var CLAUDE_MD_IMPORT = "@.claude/qore/skills.md";
+var RUNTIMES = ["next", "node"];
+var AUTHS = ["none", "keycloak", "betterauth"];
+function parseFeatures(raw) {
+  const o = raw ?? {};
+  if (!RUNTIMES.includes(o.runtime)) throw new Error(`features.runtime must be one of ${RUNTIMES.join("|")}`);
+  if (!AUTHS.includes(o.auth)) throw new Error(`features.auth must be one of ${AUTHS.join("|")}`);
+  if (typeof o.db !== "boolean") throw new Error("features.db must be a boolean");
+  return { runtime: o.runtime, auth: o.auth, db: o.db };
+}
+function inferFeatures(pkg, exists) {
+  const deps = { ...pkg.devDependencies, ...pkg.dependencies };
+  const runtime = "next" in deps ? "next" : "node";
+  const auth = "better-auth" in deps ? "betterauth" : exists("src/lib/permissions.ts") ? "keycloak" : "none";
+  const db = "drizzle-orm" in deps || Boolean(pkg.scripts?.["db:up"]) || exists("docker-compose.yml");
+  return { runtime, auth, db };
+}
+function evalCondition(expr, f) {
+  const e = expr.trim();
+  if (e.startsWith("!")) return !evalCondition(e.slice(1), f);
+  const [key, value] = e.split("=", 2);
+  const options = value === void 0 ? void 0 : value.split("|");
+  switch (key) {
+    case "runtime":
+      if (!options) throw new Error(`condition "${e}" needs a value`);
+      return options.includes(f.runtime);
+    case "auth":
+      return options ? options.includes(f.auth) : f.auth !== "none";
+    case "db":
+      if (options) throw new Error(`condition "${e}" takes no value`);
+      return f.db;
+    default:
+      throw new Error(`unknown condition "${e}"`);
+  }
+}
+var TAG = /\{\{(#if [^}]+|else|\/if)\}\}/g;
+var LINE_START_TAG = /^[ \t]+(?=\{\{(?:#if [^}]+|else|\/if)\}\})/gm;
+function renderTemplate(src, f) {
+  const text = src.replace(/\r\n/g, "\n").replace(LINE_START_TAG, "");
+  const root = [];
+  const stack = [];
+  const push = (n) => {
+    const top = stack.at(-1);
+    if (!top) root.push(n);
+    else (top.inElse ? top.node.else : top.node.then).push(n);
+  };
+  let last = 0;
+  for (const m of text.matchAll(TAG)) {
+    push(text.slice(last, m.index));
+    last = m.index + m[0].length;
+    if (text[last] === "\n") last += 1;
+    const tag = m[1];
+    if (tag.startsWith("#if ")) {
+      const cond = tag.slice(4).trim();
+      evalCondition(cond, { runtime: "next", auth: "none", db: false });
+      const node = { cond, then: [], else: [] };
+      push(node);
+      stack.push({ node, inElse: false });
+    } else if (tag === "else") {
+      const top = stack.at(-1);
+      if (!top || top.inElse) throw new Error("{{else}} without a matching {{#if}}");
+      top.inElse = true;
+    } else {
+      if (!stack.pop()) throw new Error("{{/if}} without a matching {{#if}}");
+    }
+  }
+  if (stack.length) throw new Error(`unclosed {{#if ${stack.at(-1).node.cond}}}`);
+  push(text.slice(last));
+  const emit = (nodes) => nodes.map((n) => typeof n === "string" ? n : emit(evalCondition(n.cond, f) ? n.then : n.else)).join("");
+  return emit(root);
+}
+var VARIANT = /^(.*)\.(next|node)(\.[^./]+)$/;
+function skillApplies(entry, f) {
+  return (entry.requires ?? []).every((c) => evalCondition(c, f));
+}
+function renderSkills(catalog, sources, f) {
+  const out = /* @__PURE__ */ new Map();
+  for (const entry of catalog.skills) {
+    if (!skillApplies(entry, f)) continue;
+    const prefix = `${entry.name}/`;
+    for (const [key, src] of [...sources].sort(([a], [b]) => a.localeCompare(b))) {
+      if (!key.startsWith(prefix)) continue;
+      let rel = key.slice(prefix.length);
+      const v = VARIANT.exec(rel);
+      if (v) {
+        if (v[2] !== f.runtime) continue;
+        rel = `${v[1]}${v[3]}`;
+      }
+      out.set(`skills/${entry.name}/${rel}`, renderTemplate(src, f));
+    }
+  }
+  return out;
+}
+function frontmatterField(text, field) {
+  const fm = /^---\n([\s\S]*?)\n---\n/.exec(text);
+  if (!fm) return void 0;
+  const line = fm[1].split("\n").find((l) => l.startsWith(`${field}:`));
+  return line?.slice(field.length + 1).trim();
+}
+function extensionFooter(entry) {
+  const path = `.claude/${EXTENSIONS_DIR}/${entry.name}.md`;
+  const rule = entry.kind === "contract" ? "It may add steps and conventions to this skill but cannot relax it: the portal reads what this skill produces." : "Where it conflicts with this skill, it wins.";
+  return `
+---
+
+*Managed by \`@quatronic/sdk\` \u2014 do not edit this file; the next SDK update overwrites it.*
+If \`${path}\` exists, read it before you start: it is this app team's extension of the skill. ${rule}
+`;
+}
+function renderIndex(catalog, skills) {
+  const rows = catalog.skills.filter((e) => skills.has(`skills/${e.name}/SKILL.md`)).map((e) => {
+    const desc = frontmatterField(skills.get(`skills/${e.name}/SKILL.md`), "description") ?? "";
+    return `| \`/${e.name}\` | ${e.kind} | ${desc.replace(/\|/g, "\\|")} |`;
+  });
+  return [
+    "# Qore skills",
+    "",
+    "Managed by `@quatronic/sdk`; see `.claude/qore/README.md` for how to disable, extend or detach one.",
+    "",
+    "**Never edit `.claude/skills/qore-*` or anything under `.claude/qore/` except `extensions/`** \u2014 the next SDK update overwrites it. To add, change, extend or turn off a skill, use `/qore-author-skill`.",
+    "",
+    "| Skill | Kind | When to use |",
+    "|---|---|---|",
+    ...rows,
+    ""
+  ].join("\n");
+}
+var README = `# Managed Qore skills
+
+The skills under \`.claude/skills/qore-*\` come from \`@quatronic/sdk\` and are
+updated with it: an SDK upgrade PR re-syncs them (\`pnpm exec qore-skills sync\`).
+\`manifest.json\` here records the SDK version, this app's features and a hash
+of every managed file.
+
+## What you can do
+
+| You want to\u2026 | Do this |
+|---|---|
+| Turn a skill off | \`"skillOverrides": { "qore-add-page": "off" }\` in \`.claude/settings.json\` |
+| Add your own conventions | Write \`.claude/qore/extensions/<skill>.md\`; the skill tells Claude to read it |
+| Replace a skill | Turn ours off and write your own skill under a name without the \`qore-\` prefix |
+| Own a copy | Add the skill's name to \`detached\` in \`manifest.json\`; sync stops touching it |
+
+\`/qore-author-skill\` walks through each of these.
+
+Editing a managed file in place does not stick: the next sync overwrites it and
+lists it in the PR, so the change is still in that PR's diff to move into an
+extension file.
+
+## Contract skills
+
+\`qore-add-integration\`, \`qore-add-connection\`, \`qore-use-permissions\`,
+\`qore-observability\` and \`qore-use-database\` produce code the portal reads:
+the Integrations tab, connections, roles, Monitoring, the local database. An
+extension may add to them but not relax them, and turning one off does not turn
+off the SDK's lint rules that check the same things.
+
+The \`qore-\` prefix is reserved for managed skills. Sync never touches a skill
+it does not ship, so your own skills are safe under any other name.
+`;
+function buildTree(catalog, sources, f) {
+  const skills = renderSkills(catalog, sources, f);
+  for (const entry of catalog.skills) {
+    const key = `skills/${entry.name}/SKILL.md`;
+    const body = skills.get(key);
+    if (body !== void 0) skills.set(key, body.replace(/\n*$/, "\n") + extensionFooter(entry));
+  }
+  skills.set(INDEX_PATH, renderIndex(catalog, skills));
+  skills.set(README_PATH, README);
+  return skills;
+}
+function normalise(text) {
+  return text.replace(/\r\n/g, "\n");
+}
+function hashContent(text) {
+  return `sha256:${createHash("sha256").update(normalise(text), "utf8").digest("hex")}`;
+}
+function parseManifest(text) {
+  const raw = JSON.parse(text);
+  if (raw.schemaVersion !== 1) throw new Error(`unsupported manifest schemaVersion ${String(raw.schemaVersion)}`);
+  return {
+    schemaVersion: 1,
+    sdkVersion: String(raw.sdkVersion ?? ""),
+    features: parseFeatures(raw.features),
+    ...raw.featureOverride === void 0 ? {} : { featureOverride: parseFeatures(raw.featureOverride) },
+    detached: Array.isArray(raw.detached) ? raw.detached.map(String) : [],
+    files: raw.files ?? {}
+  };
+}
+function renderManifest(m) {
+  const files = Object.fromEntries(Object.entries(m.files).sort(([a], [b]) => a.localeCompare(b)));
+  return `${JSON.stringify({ ...m, files }, null, 2)}
+`;
+}
+var skillOf = (rel) => /^skills\/([^/]+)\//.exec(rel)?.[1];
+function planSync(s) {
+  const detached = new Set(s.manifest?.detached ?? []);
+  const managed = (rel) => {
+    const skill = skillOf(rel);
+    return !(skill && detached.has(skill));
+  };
+  const tree = new Map([...s.tree].filter(([rel]) => managed(rel)));
+  const known = s.manifest?.files ?? {};
+  const writes = /* @__PURE__ */ new Map();
+  const edited = [];
+  const adopted = [];
+  for (const [rel, content] of tree) {
+    const disk = s.read(rel);
+    if (disk !== void 0 && normalise(disk) === content) continue;
+    if (disk !== void 0) {
+      if (!(rel in known)) adopted.push(rel);
+      else if (hashContent(disk) !== known[rel]) edited.push(rel);
+    }
+    writes.set(rel, content);
+  }
+  const deletes = [];
+  for (const rel of Object.keys(known)) {
+    if (tree.has(rel) || !managed(rel) || s.read(rel) === void 0) continue;
+    deletes.push(rel);
+    if (hashContent(s.read(rel)) !== known[rel]) edited.push(rel);
+  }
+  const legacyRemoved = [];
+  for (const entry of s.catalog.skills) {
+    if (detached.has(entry.name)) continue;
+    for (const legacy of entry.legacyNames ?? []) {
+      const files = s.listDir(`skills/${legacy}`);
+      if (!files.length) continue;
+      legacyRemoved.push(`skills/${legacy}`);
+      deletes.push(...files);
+    }
+  }
+  let claudeMd = s.claudeMd;
+  const claudeMdRenamed = [];
+  let claudeMdImportAdded = false;
+  if (claudeMd !== void 0) {
+    for (const entry of s.catalog.skills) {
+      for (const legacy of entry.legacyNames ?? []) {
+        const exact = new RegExp(`(?<![a-z0-9-])${legacy}(?![a-z0-9-])`, "g");
+        if (!exact.test(claudeMd)) continue;
+        claudeMd = claudeMd.replace(exact, entry.name);
+        claudeMdRenamed.push([legacy, entry.name]);
+      }
+    }
+    if (!claudeMd.split(/\r?\n/).some((l) => l.trim() === CLAUDE_MD_IMPORT)) {
+      claudeMd = `${claudeMd.replace(/\s*$/, "")}
+
+${CLAUDE_MD_IMPORT}
+`;
+      claudeMdImportAdded = true;
+    }
+  }
+  const manifest = {
+    schemaVersion: 1,
+    sdkVersion: s.sdkVersion,
+    features: s.features,
+    ...s.featureOverride ? { featureOverride: s.featureOverride } : {},
+    detached: [...detached].sort(),
+    files: Object.fromEntries([...tree].map(([rel, c]) => [rel, hashContent(c)]))
+  };
+  const manifestText = renderManifest(manifest);
+  if (s.read(MANIFEST_PATH) === void 0 || normalise(s.read(MANIFEST_PATH)) !== manifestText) {
+    writes.set(MANIFEST_PATH, manifestText);
+  }
+  return {
+    writes,
+    deletes: deletes.sort(),
+    edited: edited.sort(),
+    adopted: adopted.sort(),
+    legacyRemoved: legacyRemoved.sort(),
+    manifest,
+    claudeMd: claudeMd === s.claudeMd ? void 0 : claudeMd,
+    claudeMdRenamed: claudeMdRenamed.sort(([a], [b]) => a.localeCompare(b)),
+    claudeMdImportAdded
+  };
+}
+function planChanges(p) {
+  return p.writes.size > 0 || p.deletes.length > 0 || p.claudeMd !== void 0;
+}
+function renderReport(p, opts) {
+  const f = p.manifest.features;
+  const lines = [
+    "### Qore skills",
+    "",
+    `Synced the managed skills for \`@quatronic/sdk@${p.manifest.sdkVersion}\` (runtime \`${f.runtime}\`, auth \`${f.auth}\`, database \`${f.db ? "yes" : "no"}\`${opts.inferred ? ", inferred from the app \u2014 pin with `qore-skills sync --features`" : ", pinned in the manifest"}).`
+  ];
+  const managedWrites = [...p.writes.keys()].filter((r) => r !== MANIFEST_PATH);
+  if (!managedWrites.length && !p.deletes.length && p.claudeMd === void 0) {
+    lines.push("", "No skill content changed.");
+  }
+  const section = (title, items, note) => {
+    if (!items.length) return;
+    lines.push("", `**${title}** ${note}`, "", ...items.map((i) => `- \`.claude/${i}\``));
+  };
+  section(
+    "Hand-edited managed files, overwritten",
+    p.edited,
+    "(the edit is in this change's diff; to keep it, move it into `.claude/qore/extensions/<skill>.md`):"
+  );
+  section("Existing files now managed", p.adopted, "(written by an older template; check the diff for local changes):");
+  section(
+    "Legacy skill directories removed",
+    p.legacyRemoved,
+    "(replaced by their `qore-*` names; a local edit to one is in this change's diff):"
+  );
+  if (p.claudeMd !== void 0) {
+    lines.push("", "**`CLAUDE.md`:**", "");
+    for (const [from, to] of p.claudeMdRenamed) lines.push(`- Renamed \`${from}\` to \`${to}\`.`);
+    if (p.claudeMdImportAdded) lines.push(`- Imports \`${CLAUDE_MD_IMPORT}\`, the index of managed skills.`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/cli/skills.ts
+var USAGE = `usage:
+  qore-skills sync   [--cwd <app>] [--features <json>|infer] [--report <file.md>]
+  qore-skills check  [--cwd <app>] [--json]
+  qore-skills render --features <json> --out <dir>`;
+var PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+function parseArgs(argv) {
+  const [cmd, ...rest] = argv;
+  if (cmd !== "sync" && cmd !== "check" && cmd !== "render") return { error: USAGE };
+  const args = { cmd, cwd: process.cwd(), json: false };
+  for (let i = 0; i < rest.length; i++) {
+    const flag = rest[i];
+    const value = () => {
+      const v = rest[++i];
+      if (v === void 0) throw new Error(`${flag} needs a value`);
+      return v;
+    };
+    try {
+      if (flag === "--cwd") args.cwd = resolve(value());
+      else if (flag === "--features") {
+        const v = value();
+        args.features = v === "infer" ? "infer" : parseFeatures(JSON.parse(v));
+      } else if (flag === "--report") args.report = resolve(value());
+      else if (flag === "--out") args.out = resolve(value());
+      else if (flag === "--json") args.json = true;
+      else return { error: `unknown option ${flag}
+${USAGE}` };
+    } catch (err) {
+      return { error: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  if (cmd === "render" && (!args.features || args.features === "infer" || !args.out)) return { error: `render needs --features and --out
+${USAGE}` };
+  return args;
+}
+function walk(root, prefix = "") {
+  const dir = join(root, prefix);
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true }).flatMap((d) => {
+    const rel = prefix ? `${prefix}/${d.name}` : d.name;
+    return d.isDirectory() ? walk(root, rel) : d.isFile() ? [rel] : [];
+  });
+}
+function loadSources(root = join(PACKAGE_ROOT, "skills")) {
+  const catalog = JSON.parse(readFileSync(join(root, "catalog.json"), "utf8"));
+  const sources = new Map(
+    walk(root).filter((rel) => rel !== "catalog.json").map((rel) => [rel, readFileSync(join(root, rel), "utf8").replace(/\r\n/g, "\n")])
+  );
+  return { catalog, sources };
+}
+function sdkVersion() {
+  return JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
+}
+function readOptional(path) {
+  return existsSync(path) ? readFileSync(path, "utf8") : void 0;
+}
+function writeFile(path, text) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, text);
+}
+function pruneEmpty(root, rel, stop) {
+  let dir = dirname(join(root, rel));
+  while (dir.startsWith(join(root, stop)) && dir !== join(root, stop)) {
+    if (!existsSync(dir) || readdirSync(dir).length) return;
+    rmdirSync(dir);
+    dir = dirname(dir);
+  }
+}
+function plan(app, override) {
+  const claude = join(app, ".claude");
+  const manifestText = readOptional(join(claude, MANIFEST_PATH));
+  const manifest = manifestText ? parseManifest(manifestText) : null;
+  const featureOverride = override === "infer" ? void 0 : override ?? manifest?.featureOverride;
+  const pkg = JSON.parse(readOptional(join(app, "package.json")) ?? "{}");
+  const features = featureOverride ?? inferFeatures(pkg, (rel) => existsSync(join(app, rel)));
+  const inferred = !featureOverride;
+  const { catalog, sources } = loadSources();
+  return {
+    inferred,
+    plan: planSync({
+      catalog,
+      tree: buildTree(catalog, sources, features),
+      manifest,
+      sdkVersion: sdkVersion(),
+      features,
+      featureOverride,
+      read: (rel) => readOptional(join(claude, rel)),
+      listDir: (rel) => walk(join(claude, rel)).map((f) => `${rel}/${f}`),
+      claudeMd: readOptional(join(app, "CLAUDE.md"))
+    })
+  };
+}
+function apply(app, p) {
+  const claude = join(app, ".claude");
+  for (const rel of p.deletes) {
+    rmSync(join(claude, rel), { force: true });
+    pruneEmpty(claude, rel, "skills");
+  }
+  for (const [rel, text] of p.writes) writeFile(join(claude, rel), text);
+  if (p.claudeMd !== void 0) writeFileSync(join(app, "CLAUDE.md"), p.claudeMd);
+}
+function render(features, out) {
+  const { catalog, sources } = loadSources();
+  const tree = buildTree(catalog, sources, features);
+  for (const [rel, text] of tree) writeFile(join(out, rel), text);
+  const manifest = {
+    schemaVersion: 1,
+    sdkVersion: sdkVersion(),
+    features,
+    detached: [],
+    files: Object.fromEntries([...tree].map(([rel, c]) => [rel, hashContent(c)]))
+  };
+  writeFile(join(out, MANIFEST_PATH), renderManifest(manifest));
+}
+function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if ("error" in args) {
+    console.error(`qore-skills: ${args.error}`);
+    return 2;
+  }
+  if (args.cmd === "render") {
+    render(args.features, args.out);
+    console.log(`qore-skills: rendered into ${args.out}`);
+    return 0;
+  }
+  const { plan: p, inferred } = plan(args.cwd, args.features);
+  const report = renderReport(p, { inferred });
+  if (args.cmd === "check") {
+    const changed = planChanges(p);
+    if (args.json) {
+      console.log(
+        JSON.stringify({
+          upToDate: !changed,
+          writes: [...p.writes.keys()],
+          deletes: p.deletes,
+          edited: p.edited,
+          claudeMd: p.claudeMd !== void 0
+        })
+      );
+    } else {
+      console.log(changed ? report : "qore-skills: up to date");
+    }
+    return changed ? 1 : 0;
+  }
+  apply(args.cwd, p);
+  if (args.report) writeFile(args.report, report);
+  console.log(report);
+  return 0;
+}
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  try {
+    process.exitCode = main();
+  } catch (err) {
+    console.error(`qore-skills: ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 2;
+  }
+}
+export {
+  apply,
+  loadSources,
+  main,
+  parseArgs,
+  plan,
+  render
+};

package/dist/cli/sourcemaps.js

@@ -17,7 +17,7 @@ var MAPPING_URL = /^\/\/# sourceMappingURL=(\S+)[ \t]*$/gm;
 var STANDALONE_SERVER = "standalone/.next/server/";
 function parseArgs(argv) {
   const [cmd, dir, ...rest] = argv;
-  if (cmd !== "upload" || !dir) return { error: "usage: qdc-sourcemaps upload <dir> [--bundle <name>]" };
+  if (cmd !== "upload" || !dir) return { error: "usage: qore-sourcemaps upload <dir> [--bundle <name>]" };
   let bundle = "app";
   if (rest[0] === "--bundle") bundle = rest[1] ?? "";
   if (!BUNDLE.test(bundle)) return { error: `invalid bundle name: ${bundle}` };
@@ -149,13 +149,13 @@ function tryRemove(io, path) {
 async function main(argv = process.argv.slice(2), io = defaultIo()) {
   const args = parseArgs(argv);
   if ("error" in args) {
-    console.warn(`qdc-sourcemaps: ${args.error}`);
+    console.warn(`qore-sourcemaps: ${args.error}`);
     const dir2 = argv[0] === "upload" ? argv[1] : void 0;
     if (dir2 && !dir2.startsWith("-")) {
       try {
         for (const m of listMaps(io.walk(dir2))) tryRemove(io, join(dir2, m));
       } catch (err) {
-        console.warn(`qdc-sourcemaps: cleanup skipped: ${describe(err, io.env.QORE_BUILD_UPLOAD_TOKEN)}`);
+        console.warn(`qore-sourcemaps: cleanup skipped: ${describe(err, io.env.QORE_BUILD_UPLOAD_TOKEN)}`);
       }
     }
     return;
@@ -169,7 +169,7 @@ async function main(argv = process.argv.slice(2), io = defaultIo()) {
     maps = listMaps(paths);
     const skip = skipReason(io.env);
     if (skip) {
-      console.log(`qdc-sourcemaps: skipped (${skip})`);
+      console.log(`qore-sourcemaps: skipped (${skip})`);
       return;
     }
     const roots = nextRoots((rel) => io.exists(at(rel)));
@@ -185,9 +185,9 @@ async function main(argv = process.argv.slice(2), io = defaultIo()) {
       await io.run("sentry-cli", ["sourcemaps", "inject", dir]);
     }
     const { files, dropped } = listArtifacts(dir, () => paths, (rel) => io.readText(at(rel)), roots);
-    if (dropped > 0) console.log(`qdc-sourcemaps: dropped ${dropped} source maps the uploader would reject`);
+    if (dropped > 0) console.log(`qore-sourcemaps: dropped ${dropped} source maps the uploader would reject`);
     if (files.length === 0) {
-      console.log("qdc-sourcemaps: no source maps found, nothing to upload");
+      console.log("qore-sourcemaps: no source maps found, nothing to upload");
       return;
     }
     const tgz = io.tmpFile();
@@ -207,10 +207,10 @@ async function main(argv = process.argv.slice(2), io = defaultIo()) {
       body: new Uint8Array(body),
       signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
     });
-    if (res.ok) console.log(`qdc-sourcemaps: handed off ${files.length / 2} source maps (${body.byteLength} bytes)`);
-    else console.warn(`qdc-sourcemaps: upload refused, broker answered ${res.status}`);
+    if (res.ok) console.log(`qore-sourcemaps: handed off ${files.length / 2} source maps (${body.byteLength} bytes)`);
+    else console.warn(`qore-sourcemaps: upload refused, broker answered ${res.status}`);
   } catch (err) {
-    console.warn(`qdc-sourcemaps: upload skipped: ${describe(err, io.env.QORE_BUILD_UPLOAD_TOKEN)}`);
+    console.warn(`qore-sourcemaps: upload skipped: ${describe(err, io.env.QORE_BUILD_UPLOAD_TOKEN)}`);
   } finally {
     for (const m of maps) tryRemove(io, at(m));
     for (const s of scratch) tryRemove(io, s);

package/dist/cli/test-report.js

@@ -168,10 +168,10 @@ function main(argv = process.argv.slice(2)) {
     });
     writeReport(out, report);
     const summary = report.measured ? Object.entries(report.suites).map(([name, s]) => `${name}: ${s.passed} passed, ${s.failed} failed, ${s.skipped} skipped`).join("; ") : `unmeasured (${report.reason})`;
-    console.log(`qdc-test-report \u2192 ${out} \u2014 ${summary}`);
+    console.log(`qore-test-report \u2192 ${out} \u2014 ${summary}`);
   } catch (err) {
     console.warn(
-      `qdc-test-report could not build a report: ${err instanceof Error ? err.message : String(err)}`
+      `qore-test-report could not build a report: ${err instanceof Error ? err.message : String(err)}`
     );
     try {
       writeReport(out, unmeasuredReport(commitSha, ranAt, "parse_failed"));

package/dist/next/config/index.js

@@ -20,7 +20,7 @@ function sentryBuildOptions(env) {
   if (qoreUploads(env)) {
     return {
       ...common,
-      // Qore uploads the maps after the build (qdc-sourcemaps); the build holds no Sentry token.
+      // Qore uploads the maps after the build (qore-sourcemaps); the build holds no Sentry token.
       // deleteSourcemapsAfterUpload must stay false: the plugin would otherwise delete the maps anyway.
       sourcemaps: { disable: true, deleteSourcemapsAfterUpload: false },
       release: { name: release, create: false }

package/dist/next/config/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/next/config/index.ts"],"sourcesContent":["import { withSentryConfig } from \"@sentry/nextjs/config\"\nimport type { NextConfig } from \"next\"\n\nimport { STATIC_SECURITY_HEADERS } from \"../../security-core/headers\"\n\ntype Env = Record<string, string | undefined>\n\n/** Only the Qore build sets this; without it the build behaves as before (portal-web, older repos). */\nfunction qoreUploads(env: Env): boolean {\n  return Boolean(env.QORE_BUILD_UPLOAD_URL)\n}\n\nexport function sentryBuildOptions(env: Env): Parameters<typeof withSentryConfig>[1] {\n  const release = env.SENTRY_RELEASE || undefined\n  const common = {\n    org: env.SENTRY_ORG,\n    project: env.SENTRY_PROJECT,\n    sentryUrl: env.SENTRY_URL || \"https://de.sentry.io\",\n    silent: true,\n    telemetry: false,\n    widenClientFileUpload: true,\n  }\n  if (qoreUploads(env)) {\n    return {\n      ...common,\n      // Qore uploads the maps after the build (qdc-sourcemaps); the build holds no Sentry token.\n      // deleteSourcemapsAfterUpload must stay false: the plugin would otherwise delete the maps anyway.\n      sourcemaps: { disable: true, deleteSourcemapsAfterUpload: false },\n      release: { name: release, create: false },\n    }\n  }\n  const authToken = env.SENTRY_AUTH_TOKEN || undefined\n  return {\n    ...common,\n    authToken,\n    sourcemaps: { disable: !authToken, deleteSourcemapsAfterUpload: true },\n    release: {\n      name: release,\n      create: Boolean(authToken && release),\n      setCommits: env.SENTRY_REPO && release ? { repo: env.SENTRY_REPO, commit: release } : undefined,\n    },\n  }\n}\n\nfunction turbopackDebugIds(config: NextConfig): boolean | undefined {\n  return (config.turbopack as { debugIds?: boolean } | undefined)?.debugIds\n}\n\nfunction qoreMapOptions(config: NextConfig): NextConfig {\n  return {\n    productionBrowserSourceMaps: config.productionBrowserSourceMaps ?? true,\n    // With sourcemaps disabled the Sentry plugin no longer turns debug ids on. Next 16 option, not in the Next 15 types.\n    turbopack: { ...config.turbopack, debugIds: turbopackDebugIds(config) ?? true } as NextConfig[\"turbopack\"],\n  }\n}\n\nexport function withQdcConfig(config: NextConfig = {}, env: Env = process.env): NextConfig {\n  const base: NextConfig = {\n    ...config,\n    ...(qoreUploads(env) ? qoreMapOptions(config) : {}),\n    serverExternalPackages: [...(config.serverExternalPackages ?? [])],\n    // The static security headers, on every route Next serves. The CSP is\n    // deliberately NOT here — it carries a per-response nonce, which a\n    // build-time constant cannot have; that comes from `withSecurityHeaders`.\n    headers: async () => [\n      {\n        source: \"/:path*\",\n        headers: STATIC_SECURITY_HEADERS.map(([key, value]) => ({ key, value })),\n      },\n      ...((await config.headers?.()) ?? []),\n    ],\n  }\n  return withSentryConfig(base, sentryBuildOptions(env))\n}\n"],"mappings":";;;;;AAAA,SAAS,wBAAwB;AAQjC,SAAS,YAAY,KAAmB;AACtC,SAAO,QAAQ,IAAI,qBAAqB;AAC1C;AAEO,SAAS,mBAAmB,KAAkD;AACnF,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,SAAS;AAAA,IACb,KAAK,IAAI;AAAA,IACT,SAAS,IAAI;AAAA,IACb,WAAW,IAAI,cAAc;AAAA,IAC7B,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,uBAAuB;AAAA,EACzB;AACA,MAAI,YAAY,GAAG,GAAG;AACpB,WAAO;AAAA,MACL,GAAG;AAAA;AAAA;AAAA,MAGH,YAAY,EAAE,SAAS,MAAM,6BAA6B,MAAM;AAAA,MAChE,SAAS,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,YAAY,IAAI,qBAAqB;AAC3C,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,YAAY,EAAE,SAAS,CAAC,WAAW,6BAA6B,KAAK;AAAA,IACrE,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,QAAQ,aAAa,OAAO;AAAA,MACpC,YAAY,IAAI,eAAe,UAAU,EAAE,MAAM,IAAI,aAAa,QAAQ,QAAQ,IAAI;AAAA,IACxF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAAyC;AAClE,SAAQ,OAAO,WAAkD;AACnE;AAEA,SAAS,eAAe,QAAgC;AACtD,SAAO;AAAA,IACL,6BAA6B,OAAO,+BAA+B;AAAA;AAAA,IAEnE,WAAW,EAAE,GAAG,OAAO,WAAW,UAAU,kBAAkB,MAAM,KAAK,KAAK;AAAA,EAChF;AACF;AAEO,SAAS,cAAc,SAAqB,CAAC,GAAG,MAAW,QAAQ,KAAiB;AACzF,QAAM,OAAmB;AAAA,IACvB,GAAG;AAAA,IACH,GAAI,YAAY,GAAG,IAAI,eAAe,MAAM,IAAI,CAAC;AAAA,IACjD,wBAAwB,CAAC,GAAI,OAAO,0BAA0B,CAAC,CAAE;AAAA;AAAA;AAAA;AAAA,IAIjE,SAAS,YAAY;AAAA,MACnB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,wBAAwB,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE;AAAA,MACzE;AAAA,MACA,GAAK,MAAM,OAAO,UAAU,KAAM,CAAC;AAAA,IACrC;AAAA,EACF;AACA,SAAO,iBAAiB,MAAM,mBAAmB,GAAG,CAAC;AACvD;","names":[]}
+{"version":3,"sources":["../../../src/next/config/index.ts"],"sourcesContent":["import { withSentryConfig } from \"@sentry/nextjs/config\"\nimport type { NextConfig } from \"next\"\n\nimport { STATIC_SECURITY_HEADERS } from \"../../security-core/headers\"\n\ntype Env = Record<string, string | undefined>\n\n/** Only the Qore build sets this; without it the build behaves as before (portal-web, older repos). */\nfunction qoreUploads(env: Env): boolean {\n  return Boolean(env.QORE_BUILD_UPLOAD_URL)\n}\n\nexport function sentryBuildOptions(env: Env): Parameters<typeof withSentryConfig>[1] {\n  const release = env.SENTRY_RELEASE || undefined\n  const common = {\n    org: env.SENTRY_ORG,\n    project: env.SENTRY_PROJECT,\n    sentryUrl: env.SENTRY_URL || \"https://de.sentry.io\",\n    silent: true,\n    telemetry: false,\n    widenClientFileUpload: true,\n  }\n  if (qoreUploads(env)) {\n    return {\n      ...common,\n      // Qore uploads the maps after the build (qore-sourcemaps); the build holds no Sentry token.\n      // deleteSourcemapsAfterUpload must stay false: the plugin would otherwise delete the maps anyway.\n      sourcemaps: { disable: true, deleteSourcemapsAfterUpload: false },\n      release: { name: release, create: false },\n    }\n  }\n  const authToken = env.SENTRY_AUTH_TOKEN || undefined\n  return {\n    ...common,\n    authToken,\n    sourcemaps: { disable: !authToken, deleteSourcemapsAfterUpload: true },\n    release: {\n      name: release,\n      create: Boolean(authToken && release),\n      setCommits: env.SENTRY_REPO && release ? { repo: env.SENTRY_REPO, commit: release } : undefined,\n    },\n  }\n}\n\nfunction turbopackDebugIds(config: NextConfig): boolean | undefined {\n  return (config.turbopack as { debugIds?: boolean } | undefined)?.debugIds\n}\n\nfunction qoreMapOptions(config: NextConfig): NextConfig {\n  return {\n    productionBrowserSourceMaps: config.productionBrowserSourceMaps ?? true,\n    // With sourcemaps disabled the Sentry plugin no longer turns debug ids on. Next 16 option, not in the Next 15 types.\n    turbopack: { ...config.turbopack, debugIds: turbopackDebugIds(config) ?? true } as NextConfig[\"turbopack\"],\n  }\n}\n\nexport function withQdcConfig(config: NextConfig = {}, env: Env = process.env): NextConfig {\n  const base: NextConfig = {\n    ...config,\n    ...(qoreUploads(env) ? qoreMapOptions(config) : {}),\n    serverExternalPackages: [...(config.serverExternalPackages ?? [])],\n    // The static security headers, on every route Next serves. The CSP is\n    // deliberately NOT here — it carries a per-response nonce, which a\n    // build-time constant cannot have; that comes from `withSecurityHeaders`.\n    headers: async () => [\n      {\n        source: \"/:path*\",\n        headers: STATIC_SECURITY_HEADERS.map(([key, value]) => ({ key, value })),\n      },\n      ...((await config.headers?.()) ?? []),\n    ],\n  }\n  return withSentryConfig(base, sentryBuildOptions(env))\n}\n"],"mappings":";;;;;AAAA,SAAS,wBAAwB;AAQjC,SAAS,YAAY,KAAmB;AACtC,SAAO,QAAQ,IAAI,qBAAqB;AAC1C;AAEO,SAAS,mBAAmB,KAAkD;AACnF,QAAM,UAAU,IAAI,kBAAkB;AACtC,QAAM,SAAS;AAAA,IACb,KAAK,IAAI;AAAA,IACT,SAAS,IAAI;AAAA,IACb,WAAW,IAAI,cAAc;AAAA,IAC7B,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,uBAAuB;AAAA,EACzB;AACA,MAAI,YAAY,GAAG,GAAG;AACpB,WAAO;AAAA,MACL,GAAG;AAAA;AAAA;AAAA,MAGH,YAAY,EAAE,SAAS,MAAM,6BAA6B,MAAM;AAAA,MAChE,SAAS,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,YAAY,IAAI,qBAAqB;AAC3C,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,YAAY,EAAE,SAAS,CAAC,WAAW,6BAA6B,KAAK;AAAA,IACrE,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,QAAQ,aAAa,OAAO;AAAA,MACpC,YAAY,IAAI,eAAe,UAAU,EAAE,MAAM,IAAI,aAAa,QAAQ,QAAQ,IAAI;AAAA,IACxF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAAyC;AAClE,SAAQ,OAAO,WAAkD;AACnE;AAEA,SAAS,eAAe,QAAgC;AACtD,SAAO;AAAA,IACL,6BAA6B,OAAO,+BAA+B;AAAA;AAAA,IAEnE,WAAW,EAAE,GAAG,OAAO,WAAW,UAAU,kBAAkB,MAAM,KAAK,KAAK;AAAA,EAChF;AACF;AAEO,SAAS,cAAc,SAAqB,CAAC,GAAG,MAAW,QAAQ,KAAiB;AACzF,QAAM,OAAmB;AAAA,IACvB,GAAG;AAAA,IACH,GAAI,YAAY,GAAG,IAAI,eAAe,MAAM,IAAI,CAAC;AAAA,IACjD,wBAAwB,CAAC,GAAI,OAAO,0BAA0B,CAAC,CAAE;AAAA;AAAA;AAAA;AAAA,IAIjE,SAAS,YAAY;AAAA,MACnB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,wBAAwB,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE;AAAA,MACzE;AAAA,MACA,GAAK,MAAM,OAAO,UAAU,KAAM,CAAC;AAAA,IACrC;AAAA,EACF;AACA,SAAO,iBAAiB,MAAM,mBAAmB,GAAG,CAAC;AACvD;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quatronic/sdk",
-  "version": "0.6.1-rc.4",
+  "version": "0.7.0-rc.6",
   "type": "module",
   "private": false,
   "publishConfig": {
@@ -9,12 +9,17 @@
   },
   "files": [
     "dist",
-    "semgrep"
+    "semgrep",
+    "skills",
+    "postinstall.mjs"
   ],
   "bin": {
+    "qore-skills": "./dist/cli/skills.js",
+    "qore-sourcemaps": "./dist/cli/sourcemaps.js",
+    "qore-test-report": "./dist/cli/test-report.js",
     "qdc-setup-env": "./dist/cli/setup-env.js",
-    "qdc-sourcemaps": "./dist/cli/sourcemaps.js",
-    "qdc-test-report": "./dist/cli/test-report.js"
+    "qdc-sourcemaps": "./dist/cli/legacy/qdc-sourcemaps.js",
+    "qdc-test-report": "./dist/cli/legacy/qdc-test-report.js"
   },
   "exports": {
     "./auth": {
@@ -123,6 +128,7 @@
     "surface": "node scripts/api-surface.mjs",
     "surface:check": "node scripts/api-surface.mjs --check",
     "prepublishOnly": "pnpm build",
+    "postinstall": "node postinstall.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json",

package/postinstall.mjs

@@ -0,0 +1,9 @@
+// Syncs an app's managed skills when it installs or bumps this package; see
+// src/cli/skills-postinstall.ts. It must never fail an install, so a missing
+// build (the SDK's own workspace) or any error is swallowed here.
+try {
+  const { main } = await import("./dist/cli/skills-postinstall.js")
+  main()
+} catch {
+  // Nothing to do: the next `qore-skills check` reports skills that lag the SDK.
+}

package/skills/.gitattributes

@@ -0,0 +1 @@
+* text eol=lf