@revealui/ai 0.2.7 → 0.2.9

package/dist/tools/coding/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAevC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,KAAK,CACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,UAAU,CACb,CAAC;CACH;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,EAAE,CAmBnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAevC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,KAAK,CACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,UAAU,CACb,CAAC;CACH;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,EAAE,CAmBnE"}

package/dist/tools/coding/lint-fix.d.ts

@@ -1,5 +1,5 @@
 /**
- * lint_fix — Run linter and optionally auto-fix issues
+ * lint_fix  -  Run linter and optionally auto-fix issues
  *
  * Detects the linter (Biome, ESLint) and runs it with machine-parseable
  * output. Returns structured diagnostic counts and details.

package/dist/tools/coding/lint-fix.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint-fix.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/lint-fix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAwMnD,eAAO,MAAM,WAAW,EAAE,IAqHzB,CAAC"}
+{"version":3,"file":"lint-fix.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/lint-fix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AA6MnD,eAAO,MAAM,WAAW,EAAE,IAqHzB,CAAC"}

package/dist/tools/coding/lint-fix.js

@@ -1,11 +1,11 @@
 /**
- * lint_fix — Run linter and optionally auto-fix issues
+ * lint_fix  -  Run linter and optionally auto-fix issues
  *
  * Detects the linter (Biome, ESLint) and runs it with machine-parseable
  * output. Returns structured diagnostic counts and details.
  */
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -22,7 +22,7 @@ function detectLinter(projectRoot) {
     const pkgPath = join(projectRoot, 'package.json');
     if (existsSync(pkgPath)) {
         try {
-            const pkg = JSON.parse(execSync(`cat "${pkgPath}"`, { encoding: 'utf8', timeout: 5000 }));
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
             const deps = {
                 ...pkg.dependencies,
                 ...pkg.devDependencies,
@@ -38,8 +38,12 @@ function detectLinter(projectRoot) {
     }
     return 'unknown';
 }
+/** Validate that a file argument is safe for shell use (no metacharacters) */
+function isSafeShellArg(arg) {
+    return /^[\w./@-]+$/.test(arg);
+}
 function buildCommand(linter, file, fix) {
-    const target = file ?? '.';
+    const target = file && isSafeShellArg(file) ? file : '.';
     switch (linter) {
         case 'biome':
             return fix ? `npx biome check --write ${target}` : `npx biome check ${target}`;

package/dist/tools/coding/project-context.d.ts

@@ -1,5 +1,5 @@
 /**
- * project_context — Query the harness content layer for relevant project rules and skills
+ * project_context  -  Query the harness content layer for relevant project rules and skills
  */
 import type { Tool } from '../base.js';
 export declare const projectContextTool: Tool;

package/dist/tools/coding/project-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-context.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/project-context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAuFnD,eAAO,MAAM,kBAAkB,EAAE,IAkDhC,CAAC"}
+{"version":3,"file":"project-context.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/project-context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAyFnD,eAAO,MAAM,kBAAkB,EAAE,IAkDhC,CAAC"}

package/dist/tools/coding/project-context.js

@@ -1,7 +1,7 @@
 /**
- * project_context — Query the harness content layer for relevant project rules and skills
+ * project_context  -  Query the harness content layer for relevant project rules and skills
  */
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -28,27 +28,28 @@ function searchContent(projectRoot, query, scope) {
         }
         for (const entry of entries) {
             const fullPath = join(dir, entry);
-            try {
-                const stat = statSync(fullPath);
-                if (stat.isDirectory()) {
-                    // Check for skill directories with SKILL.md
-                    const skillPath = join(fullPath, 'SKILL.md');
-                    try {
-                        const content = readFileSync(skillPath, 'utf8');
-                        if (matchesQuery(content, queryTerms)) {
-                            results.push({
-                                id: entry,
-                                type: 'skill',
-                                path: skillPath.replace(`${projectRoot}/`, ''),
-                                content,
-                            });
-                        }
-                    }
-                    catch {
-                        // Not a skill directory, skip
+            // Try reading as skill directory first, then as markdown file
+            // (avoids TOCTOU race between stat and read)
+            if (!entry.includes('.')) {
+                // Likely a directory, check for SKILL.md
+                const skillPath = join(fullPath, 'SKILL.md');
+                try {
+                    const content = readFileSync(skillPath, 'utf8');
+                    if (matchesQuery(content, queryTerms)) {
+                        results.push({
+                            id: entry,
+                            type: 'skill',
+                            path: skillPath.replace(`${projectRoot}/`, ''),
+                            content,
+                        });
                     }
                 }
-                else if (entry.endsWith('.md')) {
+                catch {
+                    // Not a skill directory or not readable, skip
+                }
+            }
+            if (entry.endsWith('.md')) {
+                try {
                     const content = readFileSync(fullPath, 'utf8');
                     if (matchesQuery(content, queryTerms)) {
                         results.push({
@@ -59,9 +60,9 @@ function searchContent(projectRoot, query, scope) {
                         });
                     }
                 }
-            }
-            catch {
-                // Directory not readable or does not exist — skip silently
+                catch {
+                    // Not readable, skip
+                }
             }
         }
     }

package/dist/tools/coding/safety.d.ts

@@ -3,7 +3,7 @@
  * Path sandboxing and command denylist for secure tool execution
  */
 export interface SafetyConfig {
-    /** Project root directory — all file operations are sandboxed here */
+    /** Project root directory  -  all file operations are sandboxed here */
     projectRoot: string;
     /** Additional directories to allow (e.g., /tmp for scratch files) */
     allowedPaths?: string[];

package/dist/tools/coding/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiDD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAE9E;AAMD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAapC;AAQD,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAE1D;AAED,wBAAgB,eAAe,IAAI,YAAY,CAK9C"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiDD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAE9E;AAMD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAapC;AAQD,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAE1D;AAED,wBAAgB,eAAe,IAAI,YAAY,CAK9C"}

package/dist/tools/coding/shell-exec.d.ts

@@ -1,5 +1,5 @@
 /**
- * shell_exec — Sandboxed shell command execution
+ * shell_exec  -  Sandboxed shell command execution
  */
 import type { Tool } from '../base.js';
 export declare const shellExecTool: Tool;

package/dist/tools/coding/shell-exec.js

@@ -1,5 +1,5 @@
 /**
- * shell_exec — Sandboxed shell command execution
+ * shell_exec  -  Sandboxed shell command execution
  */
 import { execSync } from 'node:child_process';
 import { z } from 'zod/v4';

package/dist/tools/coding/test-runner.d.ts

@@ -1,5 +1,5 @@
 /**
- * test_runner — Run tests and return structured results
+ * test_runner  -  Run tests and return structured results
  *
  * Detects the test framework (Vitest, Jest, Mocha) and runs tests with
  * machine-parseable output. Returns structured pass/fail/skip counts

package/dist/tools/coding/test-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-runner.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/test-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAqJnD,eAAO,MAAM,cAAc,EAAE,IA0G5B,CAAC"}
+{"version":3,"file":"test-runner.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/test-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AA2JnD,eAAO,MAAM,cAAc,EAAE,IA0G5B,CAAC"}

package/dist/tools/coding/test-runner.js

@@ -1,12 +1,12 @@
 /**
- * test_runner — Run tests and return structured results
+ * test_runner  -  Run tests and return structured results
  *
  * Detects the test framework (Vitest, Jest, Mocha) and runs tests with
  * machine-parseable output. Returns structured pass/fail/skip counts
  * and failure details.
  */
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -19,8 +19,7 @@ function detectFramework(projectRoot) {
     if (!existsSync(pkgPath))
         return 'unknown';
     try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const pkg = JSON.parse(execSync(`cat "${pkgPath}"`, { encoding: 'utf8', timeout: 5000 }));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
         const deps = {
             ...pkg.dependencies,
             ...pkg.devDependencies,
@@ -37,12 +36,18 @@ function detectFramework(projectRoot) {
     }
     return 'unknown';
 }
+/** Validate that an argument is safe for shell use (no metacharacters) */
+function isSafeShellArg(arg) {
+    return /^[\w./@-]+$/.test(arg);
+}
 function buildCommand(framework, file, grep) {
-    const fileArg = file ? ` ${file}` : '';
-    const grepArg = grep ? ` -t "${grep}"` : '';
+    const safeFile = file && isSafeShellArg(file) ? file : undefined;
+    const fileArg = safeFile ? ` ${safeFile}` : '';
+    const safeGrep = grep && isSafeShellArg(grep) ? grep : undefined;
+    const grepArg = safeGrep ? ` -t "${safeGrep}"` : '';
     switch (framework) {
         case 'vitest':
-            return `npx vitest run${fileArg}${grep ? ` --reporter=verbose` : ''} --no-color`;
+            return `npx vitest run${fileArg}${safeGrep ? ` --reporter=verbose` : ''} --no-color`;
         case 'jest':
             return `npx jest${fileArg}${grepArg} --no-color --forceExit`;
         case 'mocha':

package/dist/tools/deduplicator.js

@@ -22,7 +22,7 @@ function stableStringify(obj) {
 }
 /**
  * Compute a stable cache key for a (toolName, params) pair.
- * Uses a simple djb2-style hash — no crypto dep required.
+ * Uses a simple djb2-style hash  -  no crypto dep required.
  */
 function hashKey(toolName, params) {
     const raw = `${toolName}::${stableStringify(params)}`;

package/dist/tools/document-summarizer.js

@@ -32,7 +32,7 @@ export function createDocumentSummarizerTool(_db, llmClient) {
                 }
                 const fullContent = chunks.map((c) => c.content).join('\n\n');
                 const estimatedTokens = Math.ceil(fullContent.length / CHARS_PER_TOKEN);
-                // Short document — return directly without LLM call
+                // Short document  -  return directly without LLM call
                 if (estimatedTokens <= SHORT_DOCUMENT_TOKENS) {
                     return {
                         success: true,
@@ -45,7 +45,7 @@ export function createDocumentSummarizerTool(_db, llmClient) {
                         metadata: { executionTime: Date.now() - start },
                     };
                 }
-                // Long document — summarize with LLM
+                // Long document  -  summarize with LLM
                 const focusInstruction = focusQuestion
                     ? `Focus especially on answering: "${focusQuestion}"`
                     : '';

package/dist/tools/memory/store-memory.d.ts

@@ -3,7 +3,7 @@
  *
  * Explicit memory storage tool that agents must call to persist information
  * to long-term episodic memory. Agents are never auto-enrolled into memory
- * writes — they must invoke this tool with a clear reason.
+ * writes  -  they must invoke this tool with a clear reason.
  *
  * GDPR rationale: Requiring explicit intent aligns with the data minimisation
  * principle (GDPR Art. 5(1)(c)) and purpose limitation principle (Art. 5(1)(b)).

package/dist/tools/memory/store-memory.js

@@ -3,7 +3,7 @@
  *
  * Explicit memory storage tool that agents must call to persist information
  * to long-term episodic memory. Agents are never auto-enrolled into memory
- * writes — they must invoke this tool with a clear reason.
+ * writes  -  they must invoke this tool with a clear reason.
  *
  * GDPR rationale: Requiring explicit intent aligns with the data minimisation
  * principle (GDPR Art. 5(1)(c)) and purpose limitation principle (Art. 5(1)(b)).
@@ -36,7 +36,7 @@ export function createStoreMemoryTool(memory, agentId) {
         name: 'store_memory',
         description: 'Explicitly store important information in long-term memory for future sessions. ' +
             'Only call this when information is genuinely valuable to retain. ' +
-            'Provide a clear reason — this is required for privacy compliance.',
+            'Provide a clear reason  -  this is required for privacy compliance.',
         parameters: StoreMemoryParamsSchema,
         async execute(params) {
             const { content, tags, reason } = StoreMemoryParamsSchema.parse(params);

package/dist/tools/ticket-tools.d.ts

@@ -1,12 +1,12 @@
 /**
  * Ticket Mutation Tools
  *
- * Tools that allow an agent to update ticket state as it works —
+ * Tools that allow an agent to update ticket state as it works  -
  * closing a ticket when done, moving it between columns, and writing
  * its results back as a comment.
  *
  * These are injected by createTicketTools() and are always paired with
- * CMS tools so agents can act on content AND report back through the ticket.
+ * admin tools so agents can act on content AND report back through the ticket.
  */
 import type { Tool } from './base.js';
 /**

package/dist/tools/ticket-tools.js

@@ -1,12 +1,12 @@
 /**
  * Ticket Mutation Tools
  *
- * Tools that allow an agent to update ticket state as it works —
+ * Tools that allow an agent to update ticket state as it works  -
  * closing a ticket when done, moving it between columns, and writing
  * its results back as a comment.
  *
  * These are injected by createTicketTools() and are always paired with
- * CMS tools so agents can act on content AND report back through the ticket.
+ * admin tools so agents can act on content AND report back through the ticket.
  */
 import { z } from 'zod/v4';
 export function createTicketTools(ticketId, client) {
@@ -41,7 +41,7 @@ export function createTicketTools(ticketId, client) {
     };
     const addCommentTool = {
         name: 'add_ticket_comment',
-        description: 'Write a comment on the current ticket. Use this to report what you did, what changed in the CMS, or why you could not complete the task.',
+        description: 'Write a comment on the current ticket. Use this to report what you did, what changed in the admin, or why you could not complete the task.',
         parameters: z.object({
             text: z.string().min(1).describe('The comment text to add to the ticket'),
         }),

package/dist/tools/web/duck-duck-go.d.ts

@@ -4,13 +4,13 @@
  * Uses the DuckDuckGo Instant Answer API (no API key required).
  * Returns structured results suitable for agent consumption.
  *
- * Part of the WebSearch skill family — see types.ts for the
+ * Part of the WebSearch skill family  -  see types.ts for the
  * WebSearchProvider interface used by future Tavily/Exa backends (P4-3).
  */
 import type { Tool } from '../base.js';
 import type { WebSearchProvider, WebSearchResponse } from './types.js';
 /**
- * DuckDuckGo search provider — zero-config, no API key required.
+ * DuckDuckGo search provider  -  zero-config, no API key required.
  *
  * Uses the DuckDuckGo Instant Answer API to retrieve the abstract summary
  * and related topics for a query.
@@ -38,7 +38,7 @@ export declare function createWebSearchTool(provider: WebSearchProvider): Tool;
  * Web search tool backed by DuckDuckGo (zero-config).
  *
  * Register this on any agent that needs live web access. Requires no
- * API key — backed by the DuckDuckGo Instant Answer API.
+ * API key  -  backed by the DuckDuckGo Instant Answer API.
  *
  * @example
  * ```typescript

package/dist/tools/web/duck-duck-go.js

@@ -4,7 +4,7 @@
  * Uses the DuckDuckGo Instant Answer API (no API key required).
  * Returns structured results suitable for agent consumption.
  *
- * Part of the WebSearch skill family — see types.ts for the
+ * Part of the WebSearch skill family  -  see types.ts for the
  * WebSearchProvider interface used by future Tavily/Exa backends (P4-3).
  */
 import { z } from 'zod/v4';
@@ -17,7 +17,7 @@ function estimateTokens(text) {
 // Provider
 // =============================================================================
 /**
- * DuckDuckGo search provider — zero-config, no API key required.
+ * DuckDuckGo search provider  -  zero-config, no API key required.
  *
  * Uses the DuckDuckGo Instant Answer API to retrieve the abstract summary
  * and related topics for a query.
@@ -57,7 +57,7 @@ export class DuckDuckGoProvider {
             if (results.length >= maxResults)
                 break;
             if (topic.Topics)
-                continue; // category group — skip
+                continue; // category group  -  skip
             const text = topic.Text;
             const firstURL = topic.FirstURL;
             if (!(firstURL && text))
@@ -147,7 +147,7 @@ export function createWebSearchTool(provider) {
  * Web search tool backed by DuckDuckGo (zero-config).
  *
  * Register this on any agent that needs live web access. Requires no
- * API key — backed by the DuckDuckGo Instant Answer API.
+ * API key  -  backed by the DuckDuckGo Instant Answer API.
  *
  * @example
  * ```typescript

package/dist/tools/web/exa.d.ts

@@ -9,7 +9,7 @@
  */
 import type { WebSearchProvider, WebSearchResponse } from './types.js';
 /**
- * Exa neural search provider — BYOK, requires `EXA_API_KEY`.
+ * Exa neural search provider  -  BYOK, requires `EXA_API_KEY`.
  *
  * Exa uses embeddings to find semantically relevant results rather than
  * keyword matching. Best for research-oriented queries.

package/dist/tools/web/exa.js

@@ -13,7 +13,7 @@ function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
 /**
- * Exa neural search provider — BYOK, requires `EXA_API_KEY`.
+ * Exa neural search provider  -  BYOK, requires `EXA_API_KEY`.
  *
  * Exa uses embeddings to find semantically relevant results rather than
  * keyword matching. Best for research-oriented queries.

package/dist/tools/web/scraper.js

@@ -96,7 +96,7 @@ export const webScraperTool = {
             if (content.length > maxChars) {
                 content =
                     content.slice(0, maxChars) +
-                        ' [content truncated — use document_summarize for full content]';
+                        ' [content truncated  -  use document_summarize for full content]';
                 truncated = true;
             }
             return {

package/dist/tools/web/tavily.d.ts

@@ -2,14 +2,14 @@
  * Tavily Web Search Provider (P4-3)
  *
  * High-quality BYOK search backend using the Tavily Search API.
- * Tavily is optimised for LLM consumption — returns clean, summarised
+ * Tavily is optimised for LLM consumption  -  returns clean, summarised
  * content rather than raw HTML. Requires a Tavily API key.
  *
  * @see https://docs.tavily.com/docs/tavily-api/rest_api
  */
 import type { WebSearchProvider, WebSearchResponse } from './types.js';
 /**
- * Tavily search provider — BYOK, requires `TAVILY_API_KEY`.
+ * Tavily search provider  -  BYOK, requires `TAVILY_API_KEY`.
  *
  * Tavily returns high-quality, LLM-optimised results with relevance scoring.
  * Register via `AgentConfig.webSearchProvider` to replace the default

package/dist/tools/web/tavily.js

@@ -2,7 +2,7 @@
  * Tavily Web Search Provider (P4-3)
  *
  * High-quality BYOK search backend using the Tavily Search API.
- * Tavily is optimised for LLM consumption — returns clean, summarised
+ * Tavily is optimised for LLM consumption  -  returns clean, summarised
  * content rather than raw HTML. Requires a Tavily API key.
  *
  * @see https://docs.tavily.com/docs/tavily-api/rest_api
@@ -13,7 +13,7 @@ function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
 /**
- * Tavily search provider — BYOK, requires `TAVILY_API_KEY`.
+ * Tavily search provider  -  BYOK, requires `TAVILY_API_KEY`.
  *
  * Tavily returns high-quality, LLM-optimised results with relevance scoring.
  * Register via `AgentConfig.webSearchProvider` to replace the default

package/dist/tools/web/types.d.ts

@@ -3,8 +3,8 @@
  *
  * Shared types for web search tools and provider interface.
  * The WebSearchProvider interface enables swappable backends:
- * - DuckDuckGo (default, zero-config) — P3-1
- * - Tavily, Exa (BYOK) — P4-3
+ * - DuckDuckGo (default, zero-config)  -  P3-1
+ * - Tavily, Exa (BYOK)  -  P4-3
  */
 export interface WebSearchResult {
     title: string;

package/dist/tools/web/types.js

@@ -3,7 +3,7 @@
  *
  * Shared types for web search tools and provider interface.
  * The WebSearchProvider interface enables swappable backends:
- * - DuckDuckGo (default, zero-config) — P3-1
- * - Tavily, Exa (BYOK) — P4-3
+ * - DuckDuckGo (default, zero-config)  -  P3-1
+ * - Tavily, Exa (BYOK)  -  P4-3
  */
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/ai",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "[Pro] AI system for RevealUI - memory, LLM, orchestration, and tools",
   "keywords": [
     "agent",
@@ -21,23 +21,23 @@
     "url": "https://github.com/RevealUIStudio/revealui.git",
     "directory": "packages/ai"
   },
-  "license": "SEE LICENSE IN ../../LICENSE.commercial",
+  "license": "FSL-1.1-MIT",
   "dependencies": {
-    "lru-cache": "^11.2.5",
-    "zod": "^4.3.5",
-    "@revealui/contracts": "1.3.5",
-    "@revealui/core": "0.5.4",
-    "@revealui/db": "0.3.5"
+    "lru-cache": "^11.3.3",
+    "zod": "^4.3.6",
+    "@revealui/contracts": "1.3.7",
+    "@revealui/core": "0.5.6",
+    "@revealui/db": "0.3.7"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.2",
-    "@vitest/coverage-v8": "^4.0.18",
-    "jsdom": "^29.0.1",
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3",
+    "@vitest/coverage-v8": "^4.1.3",
+    "jsdom": "29.0.1",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
     "typescript": "^6.0.2",
-    "vitest": "^4.0.18",
-    "dev": "0.0.1"
+    "vitest": "^4.1.3",
+    "@revealui/dev": "0.1.0"
   },
   "engines": {
     "node": ">=24.13.0"
@@ -99,9 +99,9 @@
       "types": "./dist/llm/providers/base.d.ts",
       "import": "./dist/llm/providers/base.js"
     },
-    "./tools/cms": {
-      "types": "./dist/tools/cms/index.d.ts",
-      "import": "./dist/tools/cms/index.js"
+    "./tools/admin": {
+      "types": "./dist/tools/admin/index.d.ts",
+      "import": "./dist/tools/admin/index.js"
     },
     "./tools/registry": {
       "types": "./dist/tools/registry.d.ts",
@@ -141,7 +141,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "funding": {
     "type": "commercial",
@@ -159,6 +160,11 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
+  "homepage": "https://revealui.com",
+  "author": "RevealUI Studio <founder@revealui.com>",
+  "bugs": {
+    "url": "https://github.com/RevealUIStudio/revealui/issues"
+  },
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",