@raybase/core 0.0.2 → 0.3.3

package/dist/agent-skill-format.js

@@ -0,0 +1,238 @@
+import { sha256Hex, stableJson, validateRaybaseName } from "./internal.js";
+export const raybaseAgentSkillFormatLimits = {
+    maxNameChars: 64,
+    maxDescriptionChars: 1024,
+    maxGuidanceBytes: 64_000,
+    maxFiles: 64,
+    maxFileBytes: 256 * 1024,
+    maxTotalFileBytes: 2 * 1024 * 1024
+};
+export class AgentSkillValidationError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.name = "AgentSkillValidationError";
+        this.code = code;
+        this.details = details;
+    }
+}
+export function validateOpenAgentSkillName(value) {
+    if (typeof value !== "string")
+        throw new AgentSkillValidationError("invalid_name", "Skill name must be a string");
+    const name = value.trim();
+    if (!name || name.length > raybaseAgentSkillFormatLimits.maxNameChars || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) {
+        throw new AgentSkillValidationError("invalid_name", "Skill name must be lowercase kebab-case and at most 64 characters");
+    }
+    try {
+        validateRaybaseName("agent", name);
+    }
+    catch (error) {
+        throw new AgentSkillValidationError("invalid_name", error instanceof Error ? error.message : String(error));
+    }
+    return name;
+}
+export function normalizeSkillPath(value) {
+    if (typeof value !== "string" || !value)
+        throw new AgentSkillValidationError("invalid_path", "Skill file path is required");
+    if (value.includes("\0") || value.includes("\\") || value.startsWith("/") || value.startsWith("//") || /^[A-Za-z]:/.test(value)) {
+        throw new AgentSkillValidationError("invalid_path", `Unsafe skill file path: ${value}`);
+    }
+    const segments = value.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new AgentSkillValidationError("invalid_path", `Unsafe skill file path: ${value}`);
+    }
+    return segments.join("/");
+}
+export function parseSkillMd(bytes) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new AgentSkillValidationError("invalid_encoding", "SKILL.md must be valid UTF-8");
+    }
+    text = text.replace(/^\uFEFF/, "");
+    if (!text.startsWith("---\n") && !text.startsWith("---\r\n")) {
+        throw new AgentSkillValidationError("frontmatter_required", "SKILL.md must begin with YAML frontmatter");
+    }
+    const normalized = text.replace(/\r\n/g, "\n");
+    const end = normalized.indexOf("\n---\n", 4);
+    if (end < 0)
+        throw new AgentSkillValidationError("frontmatter_invalid", "SKILL.md frontmatter must end with --- on its own line");
+    const source = normalized.slice(4, end);
+    const frontmatter = parseFlatYaml(source);
+    const name = validateOpenAgentSkillName(frontmatter.name);
+    const description = scalarString(frontmatter.description, "description");
+    if (description.length > raybaseAgentSkillFormatLimits.maxDescriptionChars) {
+        throw new AgentSkillValidationError("description_too_large", `Skill description exceeds ${raybaseAgentSkillFormatLimits.maxDescriptionChars} characters`);
+    }
+    const guidance = normalized.slice(end + 5).replace(/^\n/, "").trim();
+    if (new TextEncoder().encode(guidance).byteLength > raybaseAgentSkillFormatLimits.maxGuidanceBytes) {
+        throw new AgentSkillValidationError("guidance_too_large", `Skill guidance exceeds ${raybaseAgentSkillFormatLimits.maxGuidanceBytes} bytes`);
+    }
+    const title = optionalScalar(frontmatter.title);
+    const license = optionalScalar(frontmatter.license);
+    const compatibility = optionalScalar(frontmatter.compatibility);
+    if (frontmatter.ephemeral !== undefined && typeof frontmatter.ephemeral !== "boolean") {
+        throw new AgentSkillValidationError("frontmatter_invalid", "SKILL.md frontmatter ephemeral must be boolean");
+    }
+    const ephemeral = frontmatter.ephemeral === true;
+    const metadata = Object.fromEntries(Object.entries(frontmatter).filter(([key]) => !["name", "title", "description", "license", "compatibility", "ephemeral"].includes(key)));
+    return {
+        frontmatter,
+        name,
+        ...(title ? { title } : {}),
+        description,
+        guidance,
+        ephemeral,
+        ...(license ? { license } : {}),
+        ...(compatibility ? { compatibility } : {}),
+        metadataJson: stableJson(metadata)
+    };
+}
+export async function normalizeSkillPackage(input) {
+    if (!Array.isArray(input.files) || input.files.length === 0)
+        throw new AgentSkillValidationError("skill_md_missing", "Skill package is empty");
+    if (input.files.length > raybaseAgentSkillFormatLimits.maxFiles + 1) {
+        throw new AgentSkillValidationError("too_many_files", `Skill package exceeds ${raybaseAgentSkillFormatLimits.maxFiles} supporting files`);
+    }
+    const seen = new Set();
+    const normalizedInputs = input.files.map((file) => {
+        const path = normalizeSkillPath(file.path);
+        const folded = path.normalize("NFC").toLocaleLowerCase("en-US");
+        if (seen.has(folded))
+            throw new AgentSkillValidationError("duplicate_path", `Skill package contains duplicate normalized path ${path}`);
+        seen.add(folded);
+        return { path, bytes: file.bytes };
+    });
+    const skillMd = normalizedInputs.find((file) => file.path === "SKILL.md");
+    if (!skillMd)
+        throw new AgentSkillValidationError("skill_md_missing", "Skill package must contain SKILL.md at its root");
+    const parsed = parseSkillMd(skillMd.bytes);
+    if (input.rootName !== undefined && input.rootName !== parsed.name) {
+        throw new AgentSkillValidationError("directory_name_mismatch", `Skill directory ${input.rootName} must equal frontmatter name ${parsed.name}`);
+    }
+    const guidanceBytes = new TextEncoder().encode(parsed.guidance).byteLength;
+    const maxGuidanceBytes = input.maxGuidanceBytes ?? raybaseAgentSkillFormatLimits.maxGuidanceBytes;
+    if (guidanceBytes > maxGuidanceBytes)
+        throw new AgentSkillValidationError("guidance_too_large", `Skill guidance exceeds ${maxGuidanceBytes} bytes`);
+    let totalBytes = 0;
+    const files = [];
+    for (const file of normalizedInputs.filter((entry) => entry.path !== "SKILL.md").sort((a, b) => bytewise(a.path, b.path))) {
+        if (file.bytes.byteLength > raybaseAgentSkillFormatLimits.maxFileBytes) {
+            throw new AgentSkillValidationError("file_too_large", `Skill file ${file.path} exceeds ${raybaseAgentSkillFormatLimits.maxFileBytes} bytes`, { path: file.path });
+        }
+        totalBytes += file.bytes.byteLength;
+        if (totalBytes > raybaseAgentSkillFormatLimits.maxTotalFileBytes) {
+            throw new AgentSkillValidationError("package_too_large", `Skill supporting files exceed ${raybaseAgentSkillFormatLimits.maxTotalFileBytes} bytes`, { path: file.path });
+        }
+        const decoded = decodeUtf8(file.bytes);
+        files.push({
+            path: file.path,
+            kind: skillFileKind(file.path),
+            encoding: decoded === null ? "base64" : "utf8",
+            content: decoded ?? bytesToBase64(file.bytes),
+            bytes: file.bytes.byteLength,
+            sha256: await sha256Hex(file.bytes)
+        });
+    }
+    const contentDigest = await sha256Hex(stableJson({
+        frontmatter: parsed.frontmatter,
+        guidance: parsed.guidance,
+        files: files.map(({ path, sha256 }) => ({ path, sha256 }))
+    }));
+    return { ...parsed, files, contentDigest };
+}
+function parseFlatYaml(source) {
+    const output = {};
+    const lines = source.split("\n");
+    let objectKey = null;
+    for (let index = 0; index < lines.length; index += 1) {
+        const raw = lines[index];
+        if (!raw.trim() || raw.trimStart().startsWith("#"))
+            continue;
+        if (/^\s/.test(raw)) {
+            if (!objectKey)
+                throw new AgentSkillValidationError("frontmatter_invalid", `Unexpected indentation on line ${index + 1}`);
+            const match = raw.match(/^\s+([^:#][^:]*):\s*(.*)$/);
+            if (!match)
+                throw new AgentSkillValidationError("frontmatter_invalid", `Unsupported YAML on line ${index + 1}`);
+            const target = output[objectKey];
+            target[match[1].trim()] = parseYamlScalar(match[2]);
+            continue;
+        }
+        const match = raw.match(/^([^:#][^:]*):(?:\s*(.*))?$/);
+        if (!match)
+            throw new AgentSkillValidationError("frontmatter_invalid", `Unsupported YAML on line ${index + 1}`);
+        const key = match[1].trim();
+        const value = match[2] ?? "";
+        if (Object.prototype.hasOwnProperty.call(output, key))
+            throw new AgentSkillValidationError("frontmatter_invalid", `Duplicate frontmatter key ${key}`);
+        if (!value.trim()) {
+            output[key] = {};
+            objectKey = key;
+        }
+        else {
+            output[key] = parseYamlScalar(value);
+            objectKey = null;
+        }
+    }
+    return output;
+}
+function parseYamlScalar(value) {
+    const trimmed = stripYamlComment(value.trim());
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.startsWith('"') ? JSON.parse(trimmed) : trimmed.slice(1, -1).replace(/''/g, "'");
+    }
+    if (trimmed === "true")
+        return true;
+    if (trimmed === "false")
+        return false;
+    if (trimmed === "null" || trimmed === "~")
+        return null;
+    if (/^-?\d+(?:\.\d+)?$/.test(trimmed))
+        return Number(trimmed);
+    if (trimmed.startsWith("[") && trimmed.endsWith("]"))
+        return trimmed.slice(1, -1).split(",").map((item) => parseYamlScalar(item));
+    return trimmed;
+}
+function stripYamlComment(value) {
+    const index = value.indexOf(" #");
+    return index < 0 ? value : value.slice(0, index).trimEnd();
+}
+function scalarString(value, key) {
+    if (typeof value !== "string" || !value.trim())
+        throw new AgentSkillValidationError("frontmatter_invalid", `SKILL.md frontmatter requires non-empty ${key}`);
+    return value.trim();
+}
+function optionalScalar(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function skillFileKind(path) {
+    const head = path.split("/", 1)[0];
+    return head === "references" ? "reference" : head === "assets" ? "asset" : head === "scripts" ? "script" : "other";
+}
+function decodeUtf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+function bytesToBase64(bytes) {
+    let binary = "";
+    for (let offset = 0; offset < bytes.length; offset += 0x8000)
+        binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
+    return btoa(binary);
+}
+function bytewise(left, right) {
+    const a = new TextEncoder().encode(left);
+    const b = new TextEncoder().encode(right);
+    for (let index = 0; index < Math.min(a.length, b.length); index += 1)
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    return a.length - b.length;
+}
+//# sourceMappingURL=agent-skill-format.js.map

package/dist/agent-skill-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-skill-format.js","sourceRoot":"","sources":["../src/agent-skill-format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AA2B3E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,YAAY,EAAE,EAAE;IAChB,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,MAAM;IACxB,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,GAAG,GAAG,IAAI;IACxB,iBAAiB,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;CAC1B,CAAC;AAEX,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAS;IACb,OAAO,CAA2B;IAC3C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,6BAA6B,CAAC,YAAY,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,mEAAmE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,CAAC;QAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;IAC5H,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChI,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB;IAW5C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAC7E,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;IAClI,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzE,IAAI,WAAW,CAAC,MAAM,GAAG,6BAA6B,CAAC,mBAAmB,EAAE,CAAC;QAC3E,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,6BAA6B,6BAA6B,CAAC,mBAAmB,aAAa,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,GAAG,6BAA6B,CAAC,gBAAgB,EAAE,CAAC;QACnG,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,EAAE,0BAA0B,6BAA6B,CAAC,gBAAgB,QAAQ,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7K,OAAO;QACL,WAAW;QACX,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,WAAW;QACX,QAAQ;QACR,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;IAC/I,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,6BAA6B,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,EAAE,yBAAyB,6BAA6B,CAAC,QAAQ,mBAAmB,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,EAAE,oDAAoD,IAAI,EAAE,CAAC,CAAC;QACxI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,yBAAyB,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,EAAE,mBAAmB,KAAK,CAAC,QAAQ,gCAAgC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC;IAC3E,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,6BAA6B,CAAC,gBAAgB,CAAC;IAClG,IAAI,aAAa,GAAG,gBAAgB;QAAE,MAAM,IAAI,yBAAyB,CAAC,oBAAoB,EAAE,0BAA0B,gBAAgB,QAAQ,CAAC,CAAC;IACpJ,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1H,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC;YACvE,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,EAAE,cAAc,IAAI,CAAC,IAAI,YAAY,6BAA6B,CAAC,YAAY,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpK,CAAC;QACD,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,UAAU,GAAG,6BAA6B,CAAC,iBAAiB,EAAE,CAAC;YACjE,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,iCAAiC,6BAA6B,CAAC,iBAAiB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1K,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAC9C,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,kCAAkC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1H,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,4BAA4B,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAA4B,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,4BAA4B,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACtJ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,SAAS,GAAG,GAAG,CAAC;QAAC,CAAC;aACpD,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;QAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAClI,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,GAAW;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;IAC7J,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACrH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAChG,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;IACxI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC,KAAK,CAAE,CAAC;IAC9H,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC"}

package/dist/agent-skill-import.d.ts

@@ -0,0 +1,64 @@
+import { type AgentSkillDiscoveryResult, type DiscoverAgentSkillsOptions } from "./agent-skill-discovery.js";
+import { type AgentSkillMode } from "./agent-skill-store.js";
+import type { RaybaseAgent } from "./agent.js";
+import type { AgentRuntimeTool } from "./agent-runtime.js";
+import type { RaybaseAgentPrincipal } from "./ai.js";
+import type { SqlExecutor } from "./db.js";
+export type ApplyAgentSkillsOptions = DiscoverAgentSkillsOptions & {
+    expectedSourceDigest: string;
+    maxSkills?: number;
+    conflictPolicy?: "fail" | "replace";
+    expectedReplacedRevisions?: Record<string, number>;
+    mode?: AgentSkillMode;
+    enable?: boolean;
+    actorKind: "agent" | "operator" | "sync";
+    actor: string;
+    ownerKind?: "agent" | "operator" | "sync";
+    managedSourceId?: string;
+};
+export type ApplyAgentSkillsResult = {
+    ok: boolean;
+    applied: Array<{
+        name: string;
+        revision: number;
+        created: boolean;
+    }>;
+    discovery: AgentSkillDiscoveryResult;
+    error?: {
+        code: string;
+        message: string;
+    };
+};
+export declare function agentSkillImportRuntimeTools<Env, Schema extends import("./schema.js").RaybaseSchema = import("./schema.js").RaybaseSchema>(input: {
+    agent: RaybaseAgent<Env, Schema>;
+    principal: RaybaseAgentPrincipal;
+    control: SqlExecutor;
+    fetcher?: typeof fetch;
+}): AgentRuntimeTool[];
+export declare function applyAgentSkills(options: ApplyAgentSkillsOptions): Promise<ApplyAgentSkillsResult>;
+export declare function refreshAgentSkill(options: {
+    control: SqlExecutor;
+    agentName: string;
+    name: string;
+    expectedRevision: number;
+    overwriteLocalEdits?: boolean;
+    actorKind: "agent" | "operator";
+    actor: string;
+    fetcher?: typeof fetch;
+}): Promise<ApplyAgentSkillsResult>;
+export declare function syncDueAgentSkillSources(input: {
+    control: SqlExecutor;
+    fetcher?: typeof fetch;
+    env?: unknown;
+    now?: string;
+    sourceId?: string;
+    limit?: number;
+}): Promise<{
+    synced: string[];
+    failed: Array<{
+        sourceId: string;
+        error: string;
+    }>;
+    nextDueAt: string | null;
+}>;
+//# sourceMappingURL=agent-skill-import.d.ts.map

package/dist/agent-skill-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-skill-import.d.ts","sourceRoot":"","sources":["../src/agent-skill-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,yBAAyB,EAAmC,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACnK,OAAO,EAAiE,KAAK,cAAc,EAA6B,MAAM,wBAAwB,CAAC;AAEvJ,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI3C,MAAM,MAAM,uBAAuB,GAAG,0BAA0B,GAAG;IACjE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,SAAS,EAAE,yBAAyB,CAAC;IACrC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,SAAS,OAAO,aAAa,EAAE,aAAa,GAAG,OAAO,aAAa,EAAE,aAAa,EAAE,KAAK,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,gBAAgB,EAAE,CA2B3R;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqFxG;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC/G,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAalC;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAoEnR"}

package/dist/agent-skill-import.js

@@ -0,0 +1,295 @@
+import { discoverAgentSkills } from "./agent-skill-discovery.js";
+import { findAgentSkill, listAgentSkills, raybaseAgentSkillStoreLimits } from "./agent-skill-store.js";
+import { sweepExpiredAgentSkillUploads } from "./agent-skill-store.js";
+import { recordAudit } from "./audit.js";
+import { fetchOutboundHardened } from "./outbound-https.js";
+import { nowIso, q, randomId } from "./sql.js";
+export function agentSkillImportRuntimeTools(input) {
+    if (input.principal.kind === "public")
+        return [];
+    const actorId = input.principal.user.id;
+    const allowed = input.agent.skillStore?.enabled === true ? input.agent.skillStore.agentAccess?.importSources ?? [] : [];
+    if (!allowed.length)
+        return [];
+    const parse = (args) => {
+        const record = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+        if (!record.source || typeof record.source !== "object")
+            throw new Error("source is required");
+        const source = { ...record.source };
+        if (!allowed.includes(source.kind))
+            throw new Error(`Agent source kind ${source.kind} is not granted`);
+        if (source.kind === "github")
+            source.discovery = "skills";
+        const requestedNames = Array.isArray(record.requestedNames) ? record.requestedNames.filter((value) => typeof value === "string") : undefined;
+        return { source, requestedNames };
+    };
+    return [
+        {
+            name: "skill_import_discover", displayName: "Discover skills", description: `Discover an external skill source without changing state. Allowed kinds: ${allowed.join(", ")}. GitHub is always shallow skills mode.`,
+            parameters: { type: "object", properties: { source: { type: "object" }, requestedNames: { type: "array", items: { type: "string" } } }, required: ["source"], additionalProperties: false }, dataChange: null,
+            run: async (args) => { const parsed = parse(args); return stripPackages(await discoverAgentSkills({ ...parsed, agentName: input.agent.name, control: input.control, fetcher: input.fetcher, maxGuidanceBytes: input.agent.skillStore?.limits?.maxGuidanceBytes ?? raybaseAgentSkillStoreLimits.maxGuidanceBytes })); }
+        },
+        {
+            name: "skill_import_apply", displayName: "Apply skills", description: "Atomically import the previously discovered external skills as agent-owned local snapshots.",
+            parameters: { type: "object", properties: { source: { type: "object" }, expectedSourceDigest: { type: "string" }, requestedNames: { type: "array", items: { type: "string" } }, conflictPolicy: { type: "string", enum: ["fail", "replace"] }, expectedReplacedRevisions: { type: "object" } }, required: ["source", "expectedSourceDigest"], additionalProperties: false },
+            dataChange: { actionName: "skill_import_apply", effects: ["agent-skills"] },
+            run: async (args) => { const record = args; const parsed = parse(args); if (typeof record.expectedSourceDigest !== "string")
+                throw new Error("expectedSourceDigest is required"); const result = await applyAgentSkills({ ...parsed, agentName: input.agent.name, control: input.control, fetcher: input.fetcher, expectedSourceDigest: record.expectedSourceDigest, conflictPolicy: record.conflictPolicy === "replace" ? "replace" : "fail", expectedReplacedRevisions: record.expectedReplacedRevisions && typeof record.expectedReplacedRevisions === "object" ? record.expectedReplacedRevisions : undefined, actorKind: "agent", actor: actorId, ownerKind: "agent", maxSkills: input.agent.skillStore?.limits?.maxSkills ?? raybaseAgentSkillStoreLimits.maxSkills, maxGuidanceBytes: input.agent.skillStore?.limits?.maxGuidanceBytes ?? raybaseAgentSkillStoreLimits.maxGuidanceBytes }); if (result.ok)
+                await recordAudit(input.control, { actor: input.principal, action: "agent.skills.import.apply", target: { type: "_agent_skills", id: result.applied.length === 1 ? result.applied[0].name : null }, metadata: { agentName: input.agent.name, sourceKind: parsed.source.kind, sourceDigest: record.expectedSourceDigest, applied: result.applied.map((item) => ({ name: item.name, revision: item.revision })) } }); return result; }
+        }
+    ];
+}
+export async function applyAgentSkills(options) {
+    if (!options.control)
+        throw new Error("Skill apply requires the skill store database");
+    const discovery = await discoverAgentSkills(options);
+    if (discovery.sourceDigest !== options.expectedSourceDigest)
+        return failed("source_changed", "Skill source changed after discovery", discovery);
+    if (discovery.status !== "ready")
+        return failed("not_ready", "Skill discovery is not ready to apply", discovery);
+    const requested = options.requestedNames?.length ? new Set(options.requestedNames) : new Set(discovery.candidates.map((candidate) => candidate.name));
+    const selected = discovery.candidates.filter((candidate) => requested.has(candidate.name));
+    if (!selected.length || selected.some((candidate) => !candidate.valid || !candidate.package))
+        return failed("invalid_selection", "Selected skills are invalid", discovery);
+    const existingRows = new Map();
+    for (const candidate of selected) {
+        const existing = await findAgentSkill(options.control, options.agentName, candidate.name);
+        if (!existing)
+            continue;
+        existingRows.set(candidate.name, existing);
+        if (existing.source === "code")
+            return failed("skill_conflict", `Code skill ${candidate.name} cannot be replaced`, discovery);
+        if (existing.source === "managed" || options.managedSourceId) {
+            if (existing.sourceId !== options.managedSourceId)
+                return failed("skill_conflict", `Skill ${candidate.name} belongs to a different source`, discovery);
+        }
+        else {
+            if (options.conflictPolicy !== "replace")
+                return failed("skill_conflict", `Local skill ${candidate.name} requires conflictPolicy replace`, discovery);
+            if (options.expectedReplacedRevisions?.[candidate.name] !== existing.revision)
+                return failed("stale_revision", `Local skill ${candidate.name} revision changed`, discovery);
+            if (options.actorKind === "agent" && (existing.ownerKind !== "agent" || existing.ownerAgentName !== options.agentName))
+                return failed("ownership", `Agent cannot replace skill ${candidate.name}`, discovery);
+        }
+    }
+    const currentCount = (await listAgentSkills(options.control, options.agentName)).length;
+    const maxSkills = options.maxSkills ?? raybaseAgentSkillStoreLimits.maxSkills;
+    if (currentCount + selected.filter((candidate) => !existingRows.has(candidate.name)).length > maxSkills)
+        return failed("skill_limit", `Agent skill limit of ${maxSkills} would be exceeded`, discovery);
+    const statements = [];
+    const applied = [];
+    const now = nowIso();
+    const replacements = [...existingRows.values()];
+    const casGuardId = replacements.length ? randomId("skill_cas_guard") : null;
+    if (replacements.length)
+        statements.push(batchCasGuard(replacements, casGuardId, now));
+    for (const candidate of selected) {
+        const pkg = candidate.package;
+        const existing = existingRows.get(candidate.name);
+        const mode = options.mode ?? existing?.mode ?? (pkg.ephemeral ? "include" : "available");
+        if (pkg.ephemeral && mode === "available")
+            return failed("invalid_durability", `Ephemeral skill ${pkg.name} must use include mode`, discovery);
+        if (existing) {
+            const unchanged = existing.contentDigest === pkg.contentDigest
+                && existing.mode === mode
+                && existing.ephemeral === (pkg.ephemeral ? 1 : 0)
+                && existing.remoteSha256 === (options.managedSourceId ? candidate.sha256 : existing.remoteSha256);
+            if (unchanged) {
+                applied.push({ name: candidate.name, revision: existing.revision, created: false });
+                continue;
+            }
+            statements.push(revisionInsert(existing, options.managedSourceId ? "sync" : "replace", options.actorKind, options.actor));
+            statements.push({ sql: `UPDATE ${q("_agent_skills")} SET "title"=?,"description"=?,"guidance"=?,"mode"=?,"ephemeral"=?,"contentDigest"=?,"lastImportedContentDigest"=?,"license"=?,"compatibility"=?,"metadataJson"=?,"enabled"=?,"revision"=?,"remoteSha256"=?,"syncedAt"=?,"syncStatus"=?,"syncError"=?,"updatedAt"=? WHERE "id"=? AND "revision"=?`, params: [
+                    pkg.title ?? null, pkg.description, pkg.guidance, mode, pkg.ephemeral ? 1 : 0, pkg.contentDigest, existing.source === "local" ? pkg.contentDigest : null,
+                    pkg.license ?? null, pkg.compatibility ?? null, pkg.metadataJson, options.managedSourceId ? existing.enabled : options.enable === false ? 0 : existing.enabled,
+                    existing.revision + 1, options.managedSourceId ? candidate.sha256 : existing.remoteSha256, options.managedSourceId ? now : existing.syncedAt,
+                    options.managedSourceId ? "ok" : existing.syncStatus, null, now, existing.id, existing.revision
+                ] });
+            statements.push({ sql: `DELETE FROM ${q("_agent_skill_files")} WHERE "skillId"=?`, params: [existing.id] });
+            statements.push(...fileInserts(existing.id, pkg.files, now));
+            applied.push({ name: candidate.name, revision: existing.revision + 1, created: false });
+        }
+        else {
+            const id = randomId("skill");
+            const sourceClass = options.managedSourceId ? "managed" : "local";
+            const provenance = candidate.provenance ?? {};
+            statements.push({ sql: `INSERT INTO ${q("_agent_skills")} ("id","agentName","normalizedName","name","title","description","guidance","mode","ephemeral","contentDigest","lastImportedContentDigest","license","compatibility","metadataJson","enabled","revision","source","ownerKind","ownerAgentName","createdBy","originKind","originUrl","originRef","originRefKind","originCommit","originRepo","originManifestPath","originSkillPath","originDigest","importedAt","sourceId","remoteSha256","syncedAt","syncStatus","syncError","createdAt","updatedAt") VALUES (${Array.from({ length: 37 }, () => "?").join(",")})`, params: [
+                    id, options.agentName, normalizeName(pkg.name), pkg.name, pkg.title ?? null, pkg.description, pkg.guidance, mode, pkg.ephemeral ? 1 : 0, pkg.contentDigest,
+                    sourceClass === "local" ? pkg.contentDigest : null, pkg.license ?? null, pkg.compatibility ?? null, pkg.metadataJson, options.enable === false ? 0 : 1, 1,
+                    sourceClass, options.ownerKind ?? (options.actorKind === "agent" ? "agent" : options.managedSourceId ? "sync" : "operator"), options.actorKind === "agent" ? options.agentName : null,
+                    options.actor, originKind(options.source, Boolean(options.managedSourceId)), originUrl(options.source), options.source.kind === "github" ? options.source.ref ?? null : null,
+                    discovery.github?.refKind ?? null, discovery.resolvedCommit ?? null, provenance.originRepo ?? discovery.github?.repo ?? null,
+                    provenance.originManifestPath ?? discovery.github?.manifestPath ?? null, provenance.originSkillPath ?? candidate.path ?? null,
+                    candidate.sha256, now, options.managedSourceId ?? null, options.managedSourceId ? candidate.sha256 : null, options.managedSourceId ? now : null,
+                    options.managedSourceId ? "ok" : null, null, now, now
+                ] });
+            statements.push(...fileInserts(id, pkg.files, now));
+            applied.push({ name: candidate.name, revision: 1, created: true });
+        }
+    }
+    if (casGuardId)
+        statements.push({ sql: `DELETE FROM ${q("_agent_skill_revisions")} WHERE "id"=?`, params: [casGuardId] });
+    for (const existing of existingRows.values())
+        statements.push({ sql: `DELETE FROM ${q("_agent_skill_revisions")} WHERE "skillId"=? AND "id" NOT IN (SELECT "id" FROM ${q("_agent_skill_revisions")} WHERE "skillId"=? ORDER BY "createdAt" DESC LIMIT 3)`, params: [existing.id, existing.id] });
+    try {
+        if (options.control.runTransaction)
+            await options.control.runTransaction(statements);
+        else if (statements.length <= 1)
+            for (const statement of statements)
+                await options.control.run(statement.sql, statement.params);
+        else
+            throw new Error("Skill apply requires atomic transaction support");
+    }
+    catch (error) {
+        for (const existing of replacements) {
+            const current = await findAgentSkill(options.control, options.agentName, existing.name);
+            if (!current || current.revision !== existing.revision)
+                return failed("stale_revision", `Skill ${existing.name} revision changed`, discovery);
+        }
+        throw error;
+    }
+    return { ok: true, applied, discovery };
+}
+export async function refreshAgentSkill(options) {
+    const row = await findAgentSkill(options.control, options.agentName, options.name);
+    if (!row)
+        throw new Error(`Skill ${options.name} not found`);
+    if (row.source !== "local" || !row.originUrl && row.originKind !== "github")
+        return failed("source_changed", "Skill has no refreshable origin", emptyDiscovery("direct-url"));
+    if (row.revision !== options.expectedRevision)
+        return failed("stale_revision", "Skill revision changed", emptyDiscovery("direct-url"));
+    if (row.lastImportedContentDigest && row.contentDigest !== row.lastImportedContentDigest && !options.overwriteLocalEdits)
+        return failed("local_modifications", "Skill has local modifications; pass overwriteLocalEdits with matching revision", emptyDiscovery("direct-url"));
+    let source;
+    if (row.originKind === "github" && row.originRepo)
+        source = { kind: "github", repo: row.originRepo, ...(row.originRef ? { ref: row.originRef } : {}), ...(row.originSkillPath ? { path: row.originSkillPath } : {}), discovery: "skills" };
+    else
+        source = { kind: "direct-url", url: row.originUrl };
+    const discovery = await discoverAgentSkills({ control: options.control, agentName: options.agentName, source, requestedNames: [row.name], fetcher: options.fetcher });
+    const candidate = discovery.candidates.find((item) => item.name === row.name && item.path === (row.originSkillPath ?? item.path));
+    if (!candidate)
+        return failed("source_changed", "Original skill path/name is missing, moved, renamed, or duplicated", discovery);
+    return applyAgentSkills({ control: options.control, agentName: options.agentName, source, requestedNames: [row.name], fetcher: options.fetcher, expectedSourceDigest: discovery.sourceDigest, conflictPolicy: "replace", expectedReplacedRevisions: { [row.name]: row.revision }, actorKind: options.actorKind, actor: options.actor, ownerKind: row.ownerKind === "agent" ? "agent" : "operator" });
+}
+export async function syncDueAgentSkillSources(input) {
+    const now = input.now ?? nowIso();
+    await sweepExpiredAgentSkillUploads(input.control, now);
+    const rows = input.sourceId
+        ? await input.control.all(`SELECT * FROM "_agent_skill_sources" WHERE "id"=? AND "enabled"=1`, [input.sourceId])
+        : await input.control.all(`SELECT * FROM "_agent_skill_sources" WHERE "enabled"=1 AND ("lastSyncAt" IS NULL OR (julianday(?) - julianday("lastSyncAt")) * 86400000 >= "syncEveryMs") ORDER BY COALESCE("lastSyncAt",'') LIMIT ?`, [now, Math.max(1, Math.min(20, input.limit ?? 5))]);
+    const synced = [];
+    const failed = [];
+    for (const row of rows) {
+        try {
+            if (row.sourceType === "github" && row.refKind === "commit" && row.lastSyncAt) {
+                await input.control.run(`UPDATE "_agent_skill_sources" SET "lastSyncAt"=?,"lastSyncStatus"='ok',"lastSyncError"=NULL WHERE "id"=?`, [now, row.id]);
+                synced.push(row.id);
+                continue;
+            }
+            const allowedArtifactOrigins = JSON.parse(row.allowedArtifactOriginsJson || "[]");
+            const artifactAuth = JSON.parse(row.artifactAuthJson || "[]");
+            const source = row.sourceType === "github"
+                ? { kind: "github", repo: row.repo, ...(row.requestedRef ? { ref: row.requestedRef } : {}), ...(row.manifestPath ? { manifestPath: row.manifestPath } : {}), discovery: "manifest" }
+                : { kind: "manifest-url", url: row.url, allowedOrigins: allowedArtifactOrigins };
+            const selectedNames = row.selectionMode === "named" ? JSON.parse(row.selectedNamesJson || "[]") : undefined;
+            let etag = row.etag;
+            if (row.sourceType === "http-index") {
+                const headers = new Headers(row.etag ? { "if-none-match": row.etag } : undefined);
+                const credential = namedBearerCredential(row.authSecretName, input.env);
+                if (credential)
+                    headers.set("authorization", credential);
+                const probe = await fetchOutboundHardened(row.url, { fetcher: input.fetcher, allowedOrigins: [new URL(row.url).origin, ...allowedArtifactOrigins], allowedContentTypes: ["application/json", "application/octet-stream"], headers });
+                if (probe.response.status === 304) {
+                    await input.control.run(`UPDATE "_agent_skill_sources" SET "lastSyncAt"=?,"lastSyncStatus"='ok',"lastSyncError"=NULL,"updatedAt"=? WHERE "id"=?`, [now, now, row.id]);
+                    synced.push(row.id);
+                    continue;
+                }
+                if (!probe.response.ok)
+                    throw new Error(`Skill index returned HTTP ${probe.response.status}`);
+                etag = probe.response.headers.get("etag");
+            }
+            const discoveryOptions = { agentName: row.agentName, source, control: input.control, fetcher: input.fetcher, env: input.env, indexAuthSecretName: row.authSecretName ?? undefined, artifactAuth };
+            let discovery = await discoverAgentSkills({ ...discoveryOptions, requestedNames: selectedNames });
+            let effectiveNames = selectedNames;
+            if (row.selectionMode === "all") {
+                effectiveNames = discovery.candidates.filter((candidate) => candidate.valid).map((candidate) => candidate.name);
+                if (effectiveNames.length)
+                    discovery = await discoverAgentSkills({ ...discoveryOptions, requestedNames: effectiveNames });
+            }
+            else if (discovery.invalidRequestedNames.length) {
+                effectiveNames = selectedNames?.filter((name) => !discovery.invalidRequestedNames.includes(name));
+                if (effectiveNames?.length)
+                    discovery = await discoverAgentSkills({ ...discoveryOptions, requestedNames: effectiveNames });
+            }
+            if (!effectiveNames?.length)
+                discovery = { ...discovery, status: "ready" };
+            if (discovery.status !== "ready")
+                throw new Error(discovery.error?.message ?? `Discovery returned ${discovery.status}`);
+            if (row.sourceType === "github" && row.resolvedCommit === discovery.resolvedCommit) {
+                await input.control.run(`UPDATE "_agent_skill_sources" SET "lastSyncAt"=?,"lastSyncStatus"='ok',"lastSyncError"=NULL WHERE "id"=?`, [now, row.id]);
+                synced.push(row.id);
+                continue;
+            }
+            const statements = [];
+            const transactionControl = { all: input.control.all.bind(input.control), first: input.control.first.bind(input.control), run: input.control.run.bind(input.control), runTransaction: async (batch) => { statements.push(...batch); } };
+            const result = effectiveNames?.length ? await applyAgentSkills({ ...discoveryOptions, requestedNames: effectiveNames, expectedSourceDigest: discovery.sourceDigest, control: transactionControl, actorKind: "sync", actor: `source:${row.id}`, managedSourceId: row.id }) : { ok: true, applied: [], discovery };
+            if (!result.ok)
+                throw new Error(result.error?.message ?? "Managed sync apply failed");
+            const seen = new Set(result.discovery.candidates.filter((candidate) => effectiveNames?.includes(candidate.name)).map((candidate) => candidate.name.normalize("NFC").toLowerCase()));
+            const managed = (await listAgentSkills(input.control, row.agentName)).filter((skill) => skill.sourceId === row.id);
+            const orphaned = managed.filter((skill) => !seen.has(skill.normalizedName));
+            // Sync reads the managed set before it starts its transaction. Guard every
+            // soon-to-be orphaned row so a concurrent local mutation aborts the whole
+            // sync instead of silently disabling the newer version.
+            const orphanCasGuardId = orphaned.length ? randomId("skill_cas_guard") : null;
+            if (orphanCasGuardId)
+                statements.push(batchCasGuard(orphaned, orphanCasGuardId, now));
+            for (const skill of orphaned) {
+                statements.push(revisionInsert(skill, "orphan", "sync", `source:${row.id}`));
+                statements.push({ sql: `UPDATE "_agent_skills" SET "enabled"=0,"syncStatus"='orphaned',"syncError"=NULL,"revision"=?,"updatedAt"=? WHERE "id"=? AND "revision"=?`, params: [skill.revision + 1, now, skill.id, skill.revision] });
+            }
+            // This is a transaction-local assertion, not user-facing history.
+            // Remove it after all revision-qualified orphan updates have succeeded.
+            if (orphanCasGuardId)
+                statements.push({ sql: `DELETE FROM ${q("_agent_skill_revisions")} WHERE "id"=?`, params: [orphanCasGuardId] });
+            statements.push({ sql: `UPDATE "_agent_skill_sources" SET "etag"=?,"resolvedCommit"=?,"defaultBranch"=?,"repo"=?,"lastSyncAt"=?,"lastSyncStatus"='ok',"lastSyncError"=NULL,"lastSyncSummaryJson"=?,"updatedAt"=? WHERE "id"=?`, params: [etag, discovery.resolvedCommit ?? row.resolvedCommit, discovery.github?.defaultBranch ?? row.defaultBranch, discovery.github?.repo ?? row.repo, now, JSON.stringify({ changed: result.applied.map((item) => item.name), orphaned: orphaned.map((skill) => skill.name) }), now, row.id] });
+            if (!input.control.runTransaction)
+                throw new Error("Managed source sync requires transaction support");
+            await input.control.runTransaction(statements);
+            synced.push(row.id);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message.slice(0, 2000) : String(error).slice(0, 2000);
+            await input.control.run(`UPDATE "_agent_skill_sources" SET "lastSyncAt"=?,"lastSyncStatus"='error',"lastSyncError"=?,"updatedAt"=? WHERE "id"=?`, [now, message, now, row.id]);
+            failed.push({ sourceId: row.id, error: message });
+        }
+    }
+    const due = await input.control.first(`SELECT MIN(datetime(COALESCE("lastSyncAt","createdAt"), '+' || CAST("syncEveryMs" / 1000 AS INTEGER) || ' seconds')) AS "nextDueAt" FROM "_agent_skill_sources" WHERE "enabled"=1`);
+    return { synced, failed, nextDueAt: due?.nextDueAt ?? null };
+}
+function revisionInsert(row, reason, actorKind, actor) { return { sql: `INSERT INTO ${q("_agent_skill_revisions")} ("id","skillId","revision","title","description","guidance","mode","ephemeral","enabled","contentDigest","reason","actorKind","actor","createdAt") SELECT ?,"id","revision","title","description","guidance","mode","ephemeral","enabled","contentDigest",?,?,?,? FROM ${q("_agent_skills")} WHERE "id"=? AND "revision"=?`, params: [randomId("skill_rev"), reason, actorKind, actor, nowIso(), row.id, row.revision] }; }
+function batchCasGuard(rows, guardId, now) {
+    const predicates = rows.map(() => '("id"=? AND "revision"=?)').join(" OR ");
+    const params = [];
+    for (const row of rows)
+        params.push(row.id, row.revision);
+    const first = rows[0];
+    // The guard must *abort* when any observed row is stale.  A conditional id
+    // is not enough because SQLite permits NULL in a non-INTEGER PRIMARY KEY.
+    // `description` is a required column, making the stale branch a constraint
+    // violation and preserving all-or-nothing replacement semantics.
+    return { sql: `INSERT INTO ${q("_agent_skill_revisions")} ("id","skillId","revision","title","description","guidance","mode","ephemeral","enabled","contentDigest","reason","actorKind","actor","createdAt") SELECT ?,?,?,?,CASE WHEN (SELECT COUNT(*) FROM ${q("_agent_skills")} WHERE ${predicates})=? THEN ? ELSE NULL END,?,?,?,?,?,?,?,?,?`, params: [guardId, first.id, 0, null, ...params, rows.length, "", "", "available", 0, 0, "", "cas_guard", "system", null, now] };
+}
+function fileInserts(skillId, files, createdAt) { return files.map((file) => ({ sql: `INSERT INTO ${q("_agent_skill_files")} ("id","skillId","path","normalizedPath","kind","encoding","content","bytes","sha256","createdAt") VALUES (?,?,?,?,?,?,?,?,?,?)`, params: [randomId("skill_file"), skillId, file.path, normalizeName(file.path), file.kind, file.encoding, file.content, file.bytes, file.sha256, createdAt] })); }
+function normalizeName(value) { return value.normalize("NFC").toLocaleLowerCase("en-US"); }
+function originKind(source, managed) { if (managed)
+    return "managed-sync"; return source.kind === "github" ? "github" : source.kind === "upload" || source.kind === "upload-inline" ? "upload" : "direct-url"; }
+function originUrl(source) { return "url" in source ? source.url : null; }
+function failed(code, message, discovery) { return { ok: false, applied: [], discovery, error: { code, message } }; }
+function emptyDiscovery(kind) { return { status: "invalid", sourceKind: kind, sourceDigest: "", classification: "unmanaged-scan", candidates: [], totalCandidates: 0, truncated: false, invalidRequestedNames: [], warnings: [] }; }
+function stripPackages(result) { return { ...result, candidates: result.candidates.map(({ package: _package, ...candidate }) => candidate) }; }
+function namedBearerCredential(secretName, env) { if (!secretName)
+    return undefined; if (!/^[A-Z][A-Z0-9_]*$/.test(secretName))
+    throw new Error(`Credential secret name ${secretName} is invalid`); const value = env && typeof env === "object" ? env[secretName] : undefined; if (typeof value !== "string" || !value.trim())
+    throw new Error(`Credential secret ${secretName} is not configured`); return `Bearer ${value.trim()}`; }
+//# sourceMappingURL=agent-skill-import.js.map