@revealui/ai 0.1.2 → 0.2.0

package/dist/llm/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/llm/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAA;AAG3B,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/llm/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAA;AAG3B,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA"}

package/dist/llm/server.js

@@ -9,7 +9,9 @@ export * from './client.js';
 // Export provider implementations
 export * from './providers/anthropic.js';
 export * from './providers/base.js';
+export * from './providers/bitnet.js';
 export * from './providers/groq.js';
+export * from './providers/inference-snaps.js';
 export * from './providers/ollama.js';
 export * from './providers/openai.js';
 export * from './providers/vultr.js';

package/dist/memory/persistence/crdt-persistence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crdt-persistence.d.ts","sourceRoot":"","sources":["../../../src/memory/persistence/crdt-persistence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAOjF,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAA;AAC/D,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAClB,aAAa,EAAE,iBAAiB,CAAA;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;IAC3B,UAAU,CAAC,EAAE,aAAa,CAAA;CAC3B;AAMD;;;;;;GAMG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAEhC;;;;;;;;;OASG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,EACnE,MAAM,GAAE,eAAiC,EACzC,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,IAAI,CAAC;IA4ChB;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC;IAiBhF;;;;OAIG;IACG,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAiBxF;;;;;;;;OAQG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;IAuChB;;;;;OAKG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;CAyBvF"}
+{"version":3,"file":"crdt-persistence.d.ts","sourceRoot":"","sources":["../../../src/memory/persistence/crdt-persistence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAOjF,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAA;AAC/D,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAClB,aAAa,EAAE,iBAAiB,CAAA;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;IAC3B,UAAU,CAAC,EAAE,aAAa,CAAA;CAC3B;AAMD;;;;;;GAMG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAEhC;;;;;;;;;OASG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,EACnE,MAAM,GAAE,eAAiC,EACzC,MAAM,GAAE,MAAkB,GACzB,OAAO,CAAC,IAAI,CAAC;IA4ChB;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC;IAiBhF;;;;OAIG;IACG,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrE;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAiBxF;;;;;;;;OAQG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;IAuChB;;;;;OAKG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;CAyBvF"}

package/dist/memory/persistence/crdt-persistence.js

@@ -5,7 +5,8 @@
  * Supports both state-based (JSONB) and operation-based (operations log) storage.
  */
 import { randomUUID } from 'node:crypto';
-import { agentContexts, and, crdtOperations, eq, gte } from '@revealui/db/schema';
+import { and, eq, gte } from 'drizzle-orm';
+import { agentContexts, crdtOperations } from '@revealui/db/schema';
 import { findAgentContextById } from '../utils/sql-helpers.js';
 // =============================================================================
 // CRDT Persistence

package/dist/memory/preferences/user-preferences-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-preferences-manager.d.ts","sourceRoot":"","sources":["../../../src/memory/preferences/user-preferences-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAgB3E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,MAAM,CAAoC;IAElD;;;;;;OAMG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ;IAcxD;;;;OAIG;IACH,cAAc,IAAI,eAAe;IAIjC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;IAsB1D;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI;IAUlD;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAgBnC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAiChD;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB;IAM5D;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiF3B;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA6E3B;;;;OAIG;IACH,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC;IAI1C;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,CACb,IAAI,EAAE,eAAe,CAAC,eAAe,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,QAAQ,GACX,sBAAsB;IAMzB;;;;OAIG;IACH,KAAK,IAAI,sBAAsB;IAI/B;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB"}
+{"version":3,"file":"user-preferences-manager.d.ts","sourceRoot":"","sources":["../../../src/memory/preferences/user-preferences-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAgB3E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,MAAM,CAAiD;IAE/D;;;;;;OAMG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ;IAcxD;;;;OAIG;IACH,cAAc,IAAI,eAAe;IAIjC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;IAsB1D;;;;OAIG;IACH,cAAc,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI;IAUlD;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAgBnC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAiChD;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB;IAM5D;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoF3B;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgF3B;;;;OAIG;IACH,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC;IAI1C;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,CACb,IAAI,EAAE,eAAe,CAAC,eAAe,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,QAAQ,GACX,sBAAsB;IAMzB;;;;OAIG;IACH,KAAK,IAAI,sBAAsB;IAI/B;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB"}

package/dist/memory/preferences/user-preferences-manager.js

@@ -5,11 +5,12 @@
  * from multiple devices. Uses LWWRegister for last-writer-wins semantics.
  */
 import { UserPreferencesSchema } from '@revealui/contracts/entities';
-import { eq, users } from '@revealui/db/schema';
+import { eq } from 'drizzle-orm';
+import { users } from '@revealui/db/schema';
 import { LWWRegister } from '../crdt/lww-register.js';
 import { DatabaseConnectionError, DatabaseConstraintError, DatabaseOperationError, NotFoundError, ValidationError, } from '../errors/index.js';
 import { deepClone } from '../utils/deep-clone.js';
-import { createLogger } from '../utils/logger.js';
+import { createLogger } from '@revealui/core/observability/logger';
 import { findUserById } from '../utils/sql-helpers.js';
 // =============================================================================
 // User Preferences Manager
@@ -36,7 +37,7 @@ export class UserPreferencesManager {
     userId;
     nodeId;
     db;
-    logger = createLogger('[UserPreferences]');
+    logger = createLogger({ component: 'UserPreferences' });
     /**
      * Creates a new UserPreferencesManager.
      *
@@ -217,18 +218,18 @@ export class UserPreferencesManager {
                     errorMessage.includes('timeout') ||
                     errorMessage.includes('econnrefused') ||
                     errorMessage.includes('connect econnrefused')) {
-                    this.logger.error(`Database connection error loading preferences for user ${this.userId}:`, error);
+                    this.logger.error(`Database connection error loading preferences for user ${this.userId}`, error);
                     throw new DatabaseConnectionError('Failed to load user preferences', error);
                 }
                 if (errorMessage.includes('violates') ||
                     errorMessage.includes('constraint') ||
                     errorMessage.includes('foreign key')) {
-                    this.logger.error(`Database constraint error loading preferences for user ${this.userId}:`, error);
+                    this.logger.error(`Database constraint error loading preferences for user ${this.userId}`, error);
                     throw new DatabaseConstraintError('Failed to load user preferences', error);
                 }
             }
             // Generic database operation error
-            this.logger.error(`Failed to load preferences for user ${this.userId}:`, error);
+            this.logger.error(`Failed to load preferences for user ${this.userId}`, error instanceof Error ? error : new Error(String(error)));
             throw new DatabaseOperationError('Failed to load user preferences', error instanceof Error ? error : new Error(String(error)));
         }
     }
@@ -281,19 +282,19 @@ export class UserPreferencesManager {
                     errorMessage.includes('timeout') ||
                     errorMessage.includes('econnrefused') ||
                     errorMessage.includes('connect econnrefused')) {
-                    this.logger.error(`Database connection error saving preferences for user ${this.userId}:`, error);
+                    this.logger.error(`Database connection error saving preferences for user ${this.userId}`, error);
                     throw new DatabaseConnectionError('Failed to save user preferences', error);
                 }
                 if (errorMessage.includes('violates') ||
                     errorMessage.includes('constraint') ||
                     errorMessage.includes('foreign key') ||
                     errorMessage.includes('duplicate')) {
-                    this.logger.error(`Database constraint error saving preferences for user ${this.userId}:`, error);
+                    this.logger.error(`Database constraint error saving preferences for user ${this.userId}`, error);
                     throw new DatabaseConstraintError('Failed to save user preferences', error);
                 }
             }
             // Generic database operation error
-            this.logger.error(`Failed to save preferences for user ${this.userId}:`, error);
+            this.logger.error(`Failed to save preferences for user ${this.userId}`, error instanceof Error ? error : new Error(String(error)));
             throw new DatabaseOperationError('Failed to save user preferences', error instanceof Error ? error : new Error(String(error)));
         }
     }

package/dist/memory/stores/episodic-memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"episodic-memory.d.ts","sourceRoot":"","sources":["../../../src/memory/stores/episodic-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAMlG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IAC3B,aAAa,EAAE,aAAa,CAAA;CAC7B;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,aAAa,CAAW;IAChC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,WAAW,CAAC,CAAiB;IACrC,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,aAAa,CAAqB;IAE1C;;;;;;;OAOG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,eAAe;IAYvF;;;;;;OAMG;IACG,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/C;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU5B;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBnD;;;;OAIG;IACH,YAAY,IAAI,MAAM,EAAE;IAIxB;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAwBtC;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAuBxD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAgBhF;;;;OAIG;IACG,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBvD;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAM,GAChD,OAAO,CAAC,WAAW,EAAE,CAAC;IAsBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc;IAO5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;;OAIG;IACH,MAAM,IAAI,kBAAkB;IAS5B;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CACb,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,QAAQ,EACZ,WAAW,CAAC,EAAE,eAAe,GAC5B,cAAc;IAOjB;;;;OAIG;IACH,KAAK,IAAI,cAAc;IAIvB;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB"}
+{"version":3,"file":"episodic-memory.d.ts","sourceRoot":"","sources":["../../../src/memory/stores/episodic-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAMlG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IAC3B,aAAa,EAAE,aAAa,CAAA;CAC7B;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,aAAa,CAAW;IAChC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,WAAW,CAAC,CAAiB;IACrC,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,aAAa,CAAqB;IAE1C;;;;;;;OAOG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,eAAe;IAYvF;;;;;;OAMG;IACG,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IA+B/C;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU5B;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBnD;;;;OAIG;IACH,YAAY,IAAI,MAAM,EAAE;IAIxB;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAwBtC;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAuBxD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAgBhF;;;;OAIG;IACG,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBvD;;;;OAIG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAM,GAChD,OAAO,CAAC,WAAW,EAAE,CAAC;IAuBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc;IAO5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;;OAIG;IACH,MAAM,IAAI,kBAAkB;IAS5B;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CACb,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,QAAQ,EACZ,WAAW,CAAC,EAAE,eAAe,GAC5B,cAAc;IAOjB;;;;OAIG;IACH,KAAK,IAAI,cAAc;IAIvB;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB"}

package/dist/memory/stores/episodic-memory.js

@@ -266,10 +266,11 @@ export class EpisodicMemory {
             // Return memories sorted by similarity
             return results.map((r) => r.memory);
         }
-        catch (_error) {
+        catch (error) {
             // Embedding generation failed (e.g. embedding service unavailable).
             // Return empty results — do NOT fall back to getAll(), which would dump the
             // entire memory store into agent context regardless of relevance.
+            void (error instanceof Error ? error.message : String(error)); // Semantic search failed — return empty results
             return [];
         }
     }

package/dist/memory/utils/index.d.ts

@@ -2,7 +2,6 @@
  * Utility functions
  */
 export { deepClone } from './deep-clone.js';
-export { createLogger, defaultLogger, type Logger } from './logger.js';
 export { findAgentContextById, findAgentMemoriesByUserId, findAgentMemoryById, findNodeIdMappingByEntity, findNodeIdMappingByHash, findUserById, } from './sql-helpers.js';
 export { estimateObjectSize, hasCircularReference, validateContext, validateContextKey, validateContextSize, validateContextValue, validateObjectDepth, } from './validation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/memory/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/memory/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,GACb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/memory/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,GACb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,iBAAiB,CAAA"}

package/dist/memory/utils/index.js

@@ -2,6 +2,5 @@
  * Utility functions
  */
 export { deepClone } from './deep-clone.js';
-export { createLogger, defaultLogger } from './logger.js';
 export { findAgentContextById, findAgentMemoriesByUserId, findAgentMemoryById, findNodeIdMappingByEntity, findNodeIdMappingByHash, findUserById, } from './sql-helpers.js';
 export { estimateObjectSize, hasCircularReference, validateContext, validateContextKey, validateContextSize, validateContextValue, validateObjectDepth, } from './validation.js';

package/dist/memory/vector/vector-memory-service.d.ts

@@ -30,11 +30,14 @@ export interface VectorSearchResult {
  */
 export declare class VectorMemoryService {
     private _db;
+    private _restDb;
     /**
      * Lazy-load database client to avoid connection initialization at module import time.
      * This allows the module to be imported in test environments without triggering database connections.
      */
     private get db();
+    /** Lazy-load REST client for cross-DB reference validation. */
+    private get restDb();
     /**
      * Search for similar memories using vector similarity.
      *

package/dist/memory/vector/vector-memory-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector-memory-service.d.ts","sourceRoot":"","sources":["../../../src/memory/vector/vector-memory-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAK7D,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,GAAG,CAAkD;IAE7D;;;OAGG;IACH,OAAO,KAAK,EAAE,GAKb;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2GhC;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,WAAW,GAAG,YAAY,CAAC,GAAG;QAC7D,EAAE,CAAC,EAAE,MAAM,CAAA;KACZ,GACA,OAAO,CAAC,WAAW,CAAC;IAmEvB;;;;;;OAMG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GACtD,OAAO,CAAC,WAAW,CAAC;IAyEvB;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;OAKG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA8CvD"}
+{"version":3,"file":"vector-memory-service.d.ts","sourceRoot":"","sources":["../../../src/memory/vector/vector-memory-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAM7D,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,GAAG,CAAkD;IAC7D,OAAO,CAAC,OAAO,CAAgD;IAE/D;;;OAGG;IACH,OAAO,KAAK,EAAE,GAKb;IAED,+DAA+D;IAC/D,OAAO,KAAK,MAAM,GAKjB;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA2GhC;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,WAAW,GAAG,YAAY,CAAC,GAAG;QAC7D,EAAE,CAAC,EAAE,MAAM,CAAA;KACZ,GACA,OAAO,CAAC,WAAW,CAAC;IA4EvB;;;;;;OAMG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GACtD,OAAO,CAAC,WAAW,CAAC;IAyEvB;;;;;OAKG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;OAKG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA8CvD"}

package/dist/memory/vector/vector-memory-service.js

@@ -12,7 +12,8 @@
  * const memories = await service.searchSimilar(embedding, { siteId: 'site-123', limit: 10 })
  * ```
  */
-import { getVectorClient } from '@revealui/db/client';
+import { getRestClient, getVectorClient } from '@revealui/db/client';
+import { safeVectorInsert } from '@revealui/db/validation';
 import { agentMemories } from '@revealui/db/schema/vector';
 import { and, eq, sql } from 'drizzle-orm';
 /**
@@ -20,6 +21,7 @@ import { and, eq, sql } from 'drizzle-orm';
  */
 export class VectorMemoryService {
     _db = null;
+    _restDb = null;
     /**
      * Lazy-load database client to avoid connection initialization at module import time.
      * This allows the module to be imported in test environments without triggering database connections.
@@ -30,6 +32,13 @@ export class VectorMemoryService {
         }
         return this._db;
     }
+    /** Lazy-load REST client for cross-DB reference validation. */
+    get restDb() {
+        if (!this._restDb) {
+            this._restDb = getRestClient();
+        }
+        return this._restDb;
+    }
     /**
      * Search for similar memories using vector similarity.
      *
@@ -146,12 +155,16 @@ export class VectorMemoryService {
      * @returns Created memory with generated id and timestamps
      */
     async create(memory) {
-        const id = memory.id || `mem-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+        const id = memory.id || crypto.randomUUID();
         const now = new Date();
         // Pass embedding vector directly - Drizzle's vector type will handle conversion
         // The vector custom type has toDriver() that converts number[] to string format
         const embeddingVector = memory.embedding?.vector || null;
-        const result = await this.db
+        const siteId = memory.metadata?.siteId;
+        if (!siteId) {
+            throw new Error('siteId is required to create an agent memory');
+        }
+        const result = await safeVectorInsert(this.restDb, async () => this.db
             .insert(agentMemories)
             .values({
             id,
@@ -167,12 +180,12 @@ export class VectorMemoryService {
             verified: memory.verified,
             verifiedBy: null, // Can be set via update
             verifiedAt: null,
-            siteId: memory.metadata?.siteId || null,
+            siteId,
             agentId: memory.metadata?.custom?.agentId || null,
             createdAt: now,
             expiresAt: memory.metadata?.expiresAt ? new Date(memory.metadata.expiresAt) : null,
         })
-            .returning();
+            .returning(), { siteId: siteId ?? undefined });
         const row = result[0];
         if (!row) {
             throw new Error('Failed to create memory');

package/dist/skills/loader/github-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-loader.d.ts","sourceRoot":"","sources":["../../../src/skills/loader/github-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA+B9D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IAEjB,uCAAuC;IACvC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAA;IAEzB,sCAAsC;IACtC,QAAQ,EAAE,aAAa,CAAA;IAEvB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CA8D/F;AAwDD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAS5B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E"}
+{"version":3,"file":"github-loader.d.ts","sourceRoot":"","sources":["../../../src/skills/loader/github-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAaxC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA+B9D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IAEjB,uCAAuC;IACvC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAA;IAEzB,sCAAsC;IACtC,QAAQ,EAAE,aAAa,CAAA;IAEvB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CA8D/F;AA2DD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAS5B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY3E"}

package/dist/skills/loader/github-loader.js

@@ -3,12 +3,19 @@
  *
  * Install skills from GitHub repositories.
  */
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { promisify } from 'node:util';
 import { parseSkillMd } from '../parser/index.js';
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
+/** Validate shell-unsafe characters in git arguments (R4-C1 fix) */
+const SAFE_GIT_ARG = /^[a-zA-Z0-9._\-/]+$/;
+function validateGitArg(value, name) {
+    if (!SAFE_GIT_ARG.test(value)) {
+        throw new Error(`Invalid ${name}: "${value}". Only alphanumeric, dots, hyphens, underscores, and slashes allowed.`);
+    }
+}
 /**
  * Parse a GitHub source string into components.
  *
@@ -109,19 +116,17 @@ export async function loadFromGitHub(source, options) {
  * Perform a sparse checkout for a specific path.
  */
 async function sparseClone(repoUrl, targetPath, subPath, ref) {
-    // Create a temp directory for the sparse checkout
+    validateGitArg(subPath, 'subPath');
+    if (ref)
+        validateGitArg(ref, 'ref');
     const tempDir = `${targetPath}.tmp`;
     try {
-        // Initialize sparse checkout
-        await execAsync(`git clone --depth 1 --filter=blob:none --sparse ${repoUrl} ${tempDir}`);
-        // Configure sparse checkout
-        await execAsync(`git -C ${tempDir} sparse-checkout set ${subPath}`);
-        // Checkout specific ref if provided
+        await execFileAsync('git', ['clone', '--depth', '1', '--filter=blob:none', '--sparse', repoUrl, tempDir]);
+        await execFileAsync('git', ['-C', tempDir, 'sparse-checkout', 'set', subPath]);
         if (ref) {
-            await execAsync(`git -C ${tempDir} fetch --depth 1 origin ${ref}`);
-            await execAsync(`git -C ${tempDir} checkout ${ref}`);
+            await execFileAsync('git', ['-C', tempDir, 'fetch', '--depth', '1', 'origin', ref]);
+            await execFileAsync('git', ['-C', tempDir, 'checkout', ref]);
         }
-        // Move the skill directory to target
         const sourcePath = path.join(tempDir, subPath);
         if (!fs.existsSync(sourcePath)) {
             throw new Error(`Path "${subPath}" not found in repository`);
@@ -129,7 +134,6 @@ async function sparseClone(repoUrl, targetPath, subPath, ref) {
         fs.renameSync(sourcePath, targetPath);
     }
     finally {
-        // Clean up temp directory
         if (fs.existsSync(tempDir)) {
             fs.rmSync(tempDir, { recursive: true });
         }
@@ -139,8 +143,14 @@ async function sparseClone(repoUrl, targetPath, subPath, ref) {
  * Perform a full shallow clone.
  */
 async function fullClone(repoUrl, targetPath, ref) {
-    const refArg = ref ? `--branch ${ref}` : '';
-    await execAsync(`git clone --depth 1 ${refArg} ${repoUrl} ${targetPath}`);
+    if (ref)
+        validateGitArg(ref, 'ref');
+    const args = ['clone', '--depth', '1'];
+    if (ref) {
+        args.push('--branch', ref);
+    }
+    args.push(repoUrl, targetPath);
+    await execFileAsync('git', args);
     // Remove .git directory to save space
     const gitDir = path.join(targetPath, '.git');
     if (fs.existsSync(gitDir)) {
@@ -165,9 +175,10 @@ export async function updateFromGitHub(skillName, registry) {
 export async function validateGitHubSource(source) {
     try {
         const parsed = parseGitHubSource(source);
+        validateGitArg(parsed.owner, 'owner');
+        validateGitArg(parsed.repo, 'repo');
         const repoUrl = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
-        // Use git ls-remote to check if repo exists
-        await execAsync(`git ls-remote --exit-code ${repoUrl} HEAD`);
+        await execFileAsync('git', ['ls-remote', '--exit-code', repoUrl, 'HEAD']);
         return true;
     }
     catch {

package/dist/skills/loader/vercel-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-loader.d.ts","sourceRoot":"","sources":["../../../src/skills/loader/vercel-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,mBAAmB,CAAA;AAK1B;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IAEjB,uCAAuC;IACvC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAA;IAEzB,sCAAsC;IACtC,QAAQ,EAAE,aAAa,CAAA;IAEvB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;IAEf,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,KAAK,CAAC,CA8EhB;AAsKD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,KAAK,CAAC,CAwBhB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D"}
+{"version":3,"file":"vercel-loader.d.ts","sourceRoot":"","sources":["../../../src/skills/loader/vercel-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,mBAAmB,CAAA;AAc1B;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IAEjB,uCAAuC;IACvC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAA;IAEzB,sCAAsC;IACtC,QAAQ,EAAE,aAAa,CAAA;IAEvB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAE3B,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAA;IAEf,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,KAAK,CAAC,CA8EhB;AAwKD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,KAAK,CAAC,CAwBhB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO7D"}

package/dist/skills/loader/vercel-loader.js

@@ -4,14 +4,21 @@
  * Bridge layer to load skills from the Vercel Skills ecosystem (skills.sh)
  * and convert them to RevealUI's format.
  */
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { promisify } from 'node:util';
 import { logger } from '@revealui/core/observability/logger';
 import { parseSkillMd } from '../parser/index.js';
 import { parseVercelSource } from './vercel-types.js';
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
+/** Validate shell-unsafe characters in git arguments (R4-C1 fix) */
+const SAFE_GIT_ARG = /^[a-zA-Z0-9._\-/]+$/;
+function validateGitArg(value, name) {
+    if (!SAFE_GIT_ARG.test(value)) {
+        throw new Error(`Invalid ${name}: "${value}". Only alphanumeric, dots, hyphens, underscores, and slashes allowed.`);
+    }
+}
 /**
  * Load a skill from the Vercel Skills ecosystem.
  *
@@ -115,9 +122,8 @@ async function installViaVercelCli(source, options) {
     if (options.ref) {
         args.push('--ref', options.ref);
     }
-    const command = `npx ${args.join(' ')}`;
     try {
-        const { stdout, stderr } = await execAsync(command, {
+        const { stdout, stderr } = await execFileAsync('npx', args, {
             cwd: options.dir,
             timeout: 60000, // 60 second timeout
         });
@@ -191,18 +197,17 @@ async function fallbackGitClone(source, targetPath) {
  * Perform a sparse checkout for a specific path.
  */
 async function sparseClone(repoUrl, targetPath, subPath, ref) {
+    validateGitArg(subPath, 'subPath');
+    if (ref)
+        validateGitArg(ref, 'ref');
     const tempDir = `${targetPath}.tmp`;
     try {
-        // Initialize sparse checkout
-        await execAsync(`git clone --depth 1 --filter=blob:none --sparse ${repoUrl} ${tempDir}`);
-        // Configure sparse checkout
-        await execAsync(`git -C ${tempDir} sparse-checkout set ${subPath}`);
-        // Checkout specific ref if provided
+        await execFileAsync('git', ['clone', '--depth', '1', '--filter=blob:none', '--sparse', repoUrl, tempDir]);
+        await execFileAsync('git', ['-C', tempDir, 'sparse-checkout', 'set', subPath]);
         if (ref) {
-            await execAsync(`git -C ${tempDir} fetch --depth 1 origin ${ref}`);
-            await execAsync(`git -C ${tempDir} checkout ${ref}`);
+            await execFileAsync('git', ['-C', tempDir, 'fetch', '--depth', '1', 'origin', ref]);
+            await execFileAsync('git', ['-C', tempDir, 'checkout', ref]);
         }
-        // Move the skill directory to target
         const sourcePath = path.join(tempDir, subPath);
         if (!fs.existsSync(sourcePath)) {
             throw new Error(`Path "${subPath}" not found in repository`);
@@ -210,7 +215,6 @@ async function sparseClone(repoUrl, targetPath, subPath, ref) {
         fs.renameSync(sourcePath, targetPath);
     }
     finally {
-        // Clean up temp directory
         if (fs.existsSync(tempDir)) {
             fs.rmSync(tempDir, { recursive: true });
         }
@@ -220,8 +224,14 @@ async function sparseClone(repoUrl, targetPath, subPath, ref) {
  * Perform a full shallow clone.
  */
 async function fullClone(repoUrl, targetPath, ref) {
-    const refArg = ref ? `--branch ${ref}` : '';
-    await execAsync(`git clone --depth 1 ${refArg} ${repoUrl} ${targetPath}`);
+    if (ref)
+        validateGitArg(ref, 'ref');
+    const args = ['clone', '--depth', '1'];
+    if (ref) {
+        args.push('--branch', ref);
+    }
+    args.push(repoUrl, targetPath);
+    await execFileAsync('git', args);
     // Remove .git directory to save space
     const gitDir = path.join(targetPath, '.git');
     if (fs.existsSync(gitDir)) {
@@ -304,7 +314,7 @@ export async function updateVercelSkill(skillName, registry) {
  */
 export async function isVercelCliAvailable() {
     try {
-        await execAsync('npx skills --version', { timeout: 5000 });
+        await execFileAsync('npx', ['skills', '--version'], { timeout: 5000 });
         return true;
     }
     catch {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@revealui/ai",
-  "version": "0.1.2",
-  "description": "AI system for RevealUI - memory, LLM, orchestration, and tools",
+  "version": "0.2.0",
+  "description": "[Pro] AI system for RevealUI - memory, LLM, orchestration, and tools",
   "keywords": [
     "agent",
     "ai",
@@ -16,13 +16,18 @@
     "tools",
     "vector-search"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RevealUIStudio/revealui.git",
+    "directory": "packages/ai"
+  },
   "license": "SEE LICENSE IN ../../LICENSE.commercial",
   "dependencies": {
     "lru-cache": "^11.2.5",
     "zod": "^4.3.5",
-    "@revealui/contracts": "1.0.0",
-    "@revealui/core": "0.2.0",
-    "@revealui/db": "^0.2.0"
+    "@revealui/db": "0.3.0",
+    "@revealui/core": "0.3.0",
+    "@revealui/contracts": "1.3.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.2",
@@ -116,24 +121,26 @@
   "files": [
     "dist"
   ],
+  "funding": {
+    "type": "commercial",
+    "url": "https://revealui.com/pro"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "peerDependencies": {
     "drizzle-orm": "^0.45.1",
     "react": "^18.0.0 || ^19.0.0"
   },
-  "type": "module",
-  "types": "./dist/index.d.ts",
   "publishConfig": {
-    "registry": "https://registry.npmjs.org",
     "access": "public"
   },
+  "type": "module",
+  "types": "./dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",
     "dev": "tsc --watch",
     "lint": "biome check .",
-    "lint:eslint": "eslint .",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:integration": "vitest run --root . --config vitest.integration.config.ts",

package/dist/memory/utils/logger.d.ts

@@ -1,21 +0,0 @@
-/**
- * Simple Logger Utility
- *
- * Provides a minimal logging interface that can be easily replaced
- * with a proper logging service later. Respects environment and log levels.
- */
-export interface Logger {
-    info: (...args: unknown[]) => void;
-    warn: (...args: unknown[]) => void;
-    error: (...args: unknown[]) => void;
-    debug: (...args: unknown[]) => void;
-}
-/**
- * Creates a logger instance with optional prefix
- */
-export declare function createLogger(prefix?: string): Logger;
-/**
- * Default logger instance
- */
-export declare const defaultLogger: Logger;
-//# sourceMappingURL=logger.d.ts.map

package/dist/memory/utils/logger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/memory/utils/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;IAClC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;IAClC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;CACpC;AA0DD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,MAAqC,CAAA"}

package/dist/memory/utils/logger.js

@@ -1,62 +0,0 @@
-/**
- * Simple Logger Utility
- *
- * Provides a minimal logging interface that can be easily replaced
- * with a proper logging service later. Respects environment and log levels.
- */
-/**
- * Environment-aware logger implementation
- * Only logs when appropriate for the environment and log level
- */
-class SimpleLogger {
-    prefix;
-    minLevel;
-    isProduction;
-    constructor(prefix = '[Memory]') {
-        this.prefix = prefix;
-        this.isProduction = process.env.NODE_ENV === 'production';
-        this.minLevel = process.env.LOG_LEVEL || (this.isProduction ? 'warn' : 'debug');
-    }
-    shouldLog(level) {
-        // Never log debug or info in production
-        if (this.isProduction && (level === 'debug' || level === 'info')) {
-            return false;
-        }
-        const levels = ['debug', 'info', 'warn', 'error'];
-        return levels.indexOf(level) >= levels.indexOf(this.minLevel);
-    }
-    info(...args) {
-        // Info logs are never shown in production
-        if (process.env.NODE_ENV !== 'production') {
-            console.log(this.prefix, ...args);
-        }
-        // In production: complete no-op
-    }
-    warn(...args) {
-        // Warning logs are never shown in production
-        if (process.env.NODE_ENV !== 'production') {
-            console.warn(this.prefix, ...args);
-        }
-        // In production: complete no-op
-    }
-    error(...args) {
-        if (this.shouldLog('error')) {
-            console.error(this.prefix, ...args);
-        }
-    }
-    debug(...args) {
-        if (process.env.NODE_ENV !== 'production') {
-            console.debug(this.prefix, ...args);
-        }
-    }
-}
-/**
- * Creates a logger instance with optional prefix
- */
-export function createLogger(prefix) {
-    return new SimpleLogger(prefix);
-}
-/**
- * Default logger instance
- */
-export const defaultLogger = new SimpleLogger('[Memory]');