@skillfm/local 2.6.4 → 2.7.1

package/README.md

@@ -1,6 +1,55 @@
 # @skillfm/local
 
-Tiny localhost sidecar that lets any AI agent activate and use [SkillFM](https://skillfm.ai) **in the current conversation**, without restarting its MCP runtime.
+Single npm package for the SkillFM platform on user nodes. As of `2.7.0` it
+exposes **two top-level usages** via subcommand routing — pick the one that
+matches your goal:
+
+## Two usages
+
+### 1. Beacon MCP — your AI agent's cost optimizer (灯塔)
+
+A stdio MCP server that any agent harness (Cursor / Claude Code / OpenClaw /
+Cherry Studio) can plug into. Tracks API spend, suggests cheaper routes,
+flags expiring assets, surfaces monthly Pro picks. **BYOK** — only reads
+`SKILLFM_AGENT_TOKEN`; never touches your LLM API keys, cookies, or vault.
+
+```bash
+# Run the MCP server directly (the agent harness spawns this for you):
+npx -y @skillfm/local mcp
+```
+
+Cursor / Claude Code config (`mcp.servers`):
+
+```json
+{
+  "skillfm-beacon": {
+    "command": "npx",
+    "args": ["-y", "@skillfm/local", "mcp"],
+    "env": { "SKILLFM_AGENT_TOKEN": "sk_…" }
+  }
+}
+```
+
+This subsystem was originally `@skillfm/beacon-mcp`; merged into
+`@skillfm/local` 2.7.0 on 2026-05-01.
+
+### 2. Skill runtime — your AI's apprenticeship station (灶台学徒)
+
+The original `@skillfm/local` purpose: a tiny localhost sidecar that lets any
+AI agent activate and use [SkillFM](https://skillfm.ai) **in the current
+conversation**, without restarting its MCP runtime.
+
+```bash
+# Run a SkillFM skill bundle (auto-starts the sidecar):
+npx -y @skillfm/local skill <slug>
+
+# Or boot the sidecar directly + use the HTTP API:
+npx -y @skillfm/local start
+```
+
+---
+
+## Sidecar — the long-lived flavor
 
 ## Why this exists
 

package/dist/_signers/aliyun-v3.d.ts

@@ -0,0 +1,21 @@
+export interface AliyunV3SignInput {
+    method: string;
+    host: string;
+    path: string;
+    query: Record<string, string | number | boolean | undefined>;
+    headers: Record<string, string>;
+    payload: string;
+    ak_id: string;
+    ak_secret: string;
+    /** 自动注入 x-acs-signature-nonce / x-acs-action / x-acs-version 等 RPC 头(可选) */
+    rpc?: {
+        action: string;
+        version: string;
+    };
+}
+export interface AliyunV3SignResult {
+    authorization: string;
+    signed_headers_with_signature: Record<string, string>;
+}
+export declare function signAliyunV3(input: AliyunV3SignInput): AliyunV3SignResult;
+//# sourceMappingURL=aliyun-v3.d.ts.map

package/dist/_signers/aliyun-v3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aliyun-v3.d.ts","sourceRoot":"","sources":["../../src/_signers/aliyun-v3.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvD;AAUD,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAiCzE"}

package/dist/_signers/aliyun-v3.js

@@ -0,0 +1,47 @@
+// sdk/skillfm-local/src/_signers/aliyun-v3.ts
+//
+// 阿里云 V3 签名 (ACS3-HMAC-SHA256, RPC 风格)
+// Doc: https://help.aliyun.com/document_detail/315526.html
+//
+// StringToSign = ACS3-HMAC-SHA256\n<hex(SHA256(canonical_request))>
+// signature = hex(HMAC(<sk>, StringToSign))
+// Authorization: ACS3-HMAC-SHA256 Credential=<ak>,SignedHeaders=<...>,Signature=<...>
+import { hmacSha256, sha256Hex, buildCanonicalRequest } from './canonical.js';
+const ALGORITHM = 'ACS3-HMAC-SHA256';
+function randomNonce() {
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++)
+        bytes[i] = Math.floor(Math.random() * 256);
+    return Buffer.from(bytes).toString('hex');
+}
+export function signAliyunV3(input) {
+    const date = new Date();
+    // 阿里云 V3 用 RFC 3339 (e.g. "2026-05-01T12:00:00Z")
+    const iso = date.toISOString().replace(/\.\d{3}Z$/, 'Z');
+    const headers = {
+        ...input.headers,
+        host: input.host,
+        'x-acs-date': iso,
+        'x-acs-content-sha256': sha256Hex(input.payload),
+        'x-acs-signature-nonce': randomNonce(),
+    };
+    if (input.rpc) {
+        headers['x-acs-action'] = input.rpc.action;
+        headers['x-acs-version'] = input.rpc.version;
+    }
+    const cr = buildCanonicalRequest({
+        method: input.method,
+        uri: input.path,
+        query: input.query,
+        headers,
+        payload: input.payload,
+    });
+    const string_to_sign = `${ALGORITHM}\n${sha256Hex(cr.request)}`;
+    const signature = hmacSha256(input.ak_secret, string_to_sign).toString('hex');
+    const authorization = `${ALGORITHM} Credential=${input.ak_id},SignedHeaders=${cr.signed_headers},Signature=${signature}`;
+    return {
+        authorization,
+        signed_headers_with_signature: { ...headers, authorization },
+    };
+}
+//# sourceMappingURL=aliyun-v3.js.map

package/dist/_signers/aliyun-v3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aliyun-v3.js","sourceRoot":"","sources":["../../src/_signers/aliyun-v3.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,uCAAuC;AACvC,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4CAA4C;AAC5C,sFAAsF;AAEtF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAoB9E,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,OAAO,GAA2B;QACtC,GAAG,KAAK,CAAC,OAAO;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,GAAG;QACjB,sBAAsB,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAChD,uBAAuB,EAAE,WAAW,EAAE;KACvC,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3C,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,GAAG,qBAAqB,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,GAAG,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,GAAG,SAAS,eAAe,KAAK,CAAC,KAAK,kBAAkB,EAAE,CAAC,cAAc,cAAc,SAAS,EAAE,CAAC;IAEzH,OAAO;QACL,aAAa;QACb,6BAA6B,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE;KAC7D,CAAC;AACJ,CAAC"}

package/dist/_signers/canonical.d.ts

@@ -0,0 +1,29 @@
+export declare function sha256Hex(input: string | Buffer): string;
+export declare function hmacSha256(key: Buffer | string, data: string): Buffer;
+/** 按 RFC 3986 encode, 比 encodeURIComponent 更严格 */
+export declare function rfc3986Encode(s: string): string;
+/** Canonical query string: 字典序 sort + RFC 3986 encode */
+export declare function canonicalizeQuery(params: Record<string, string | number | boolean | undefined>): string;
+/** Canonical headers (lowercase + trim + sort) */
+export declare function canonicalizeHeaders(headers: Record<string, string>): {
+    canonical: string;
+    signed: string;
+};
+export interface CanonicalRequestInput {
+    method: string;
+    uri: string;
+    query: Record<string, string | number | boolean | undefined>;
+    headers: Record<string, string>;
+    payload: string;
+}
+export interface CanonicalRequest {
+    request: string;
+    signed_headers: string;
+    payload_hash: string;
+}
+export declare function buildCanonicalRequest(input: CanonicalRequestInput): CanonicalRequest;
+/** ISO 8601 时间, 阿里云/火山要的格式 (e.g. "20260501T120000Z") */
+export declare function basicIso8601(date?: Date): string;
+/** YYYYMMDD (用于 credential scope) */
+export declare function dateYYYYMMDD(date?: Date): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/_signers/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/_signers/canonical.ts"],"names":[],"mappings":"AAWA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GAAG,MAAM,CAMvG;AAED,kDAAkD;AAClD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAOA;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CAapF;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAE5D;AAED,qCAAqC;AACrC,wBAAgB,YAAY,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAE5D"}

package/dist/_signers/canonical.js

@@ -0,0 +1,59 @@
+// sdk/skillfm-local/src/_signers/canonical.ts
+//
+// AWS SigV4-style canonical request 共用原语 (Day 4 B1)
+// 阿里云 / 腾讯云 / 火山引擎 V3+V4 签名都基于这个 pattern, 仅 algorithm name + 派生 key 不同
+// 文档:
+//   - 阿里云: https://help.aliyun.com/document_detail/315526.html
+//   - 腾讯云: https://cloud.tencent.com/document/api/213/30654
+//   - 火山引擎: https://www.volcengine.com/docs/6369/67269
+import { createHash, createHmac } from 'node:crypto';
+export function sha256Hex(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+export function hmacSha256(key, data) {
+    return createHmac('sha256', key).update(data, 'utf8').digest();
+}
+/** 按 RFC 3986 encode, 比 encodeURIComponent 更严格 */
+export function rfc3986Encode(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+}
+/** Canonical query string: 字典序 sort + RFC 3986 encode */
+export function canonicalizeQuery(params) {
+    const entries = Object.entries(params)
+        .filter(([, v]) => v !== undefined && v !== null && v !== '')
+        .map(([k, v]) => [k, String(v)])
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return entries.map(([k, v]) => `${rfc3986Encode(k)}=${rfc3986Encode(v)}`).join('&');
+}
+/** Canonical headers (lowercase + trim + sort) */
+export function canonicalizeHeaders(headers) {
+    const sorted = Object.entries(headers)
+        .map(([k, v]) => [k.toLowerCase().trim(), String(v).trim().replace(/\s+/g, ' ')])
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    const canonical = sorted.map(([k, v]) => `${k}:${v}`).join('\n') + '\n';
+    const signed = sorted.map(([k]) => k).join(';');
+    return { canonical, signed };
+}
+export function buildCanonicalRequest(input) {
+    const canonical_query = canonicalizeQuery(input.query);
+    const { canonical, signed } = canonicalizeHeaders(input.headers);
+    const payload_hash = sha256Hex(input.payload);
+    const request = [
+        input.method.toUpperCase(),
+        input.uri || '/',
+        canonical_query,
+        canonical,
+        signed,
+        payload_hash,
+    ].join('\n');
+    return { request, signed_headers: signed, payload_hash };
+}
+/** ISO 8601 时间, 阿里云/火山要的格式 (e.g. "20260501T120000Z") */
+export function basicIso8601(date = new Date()) {
+    return date.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+}
+/** YYYYMMDD (用于 credential scope) */
+export function dateYYYYMMDD(date = new Date()) {
+    return date.toISOString().slice(0, 10).replace(/-/g, '');
+}
+//# sourceMappingURL=canonical.js.map

package/dist/_signers/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/_signers/canonical.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oDAAoD;AACpD,uEAAuE;AACvE,MAAM;AACN,+DAA+D;AAC/D,4DAA4D;AAC5D,uDAAuD;AAEvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,IAAY;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAClC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,MAA6D;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAqB,CAAC;SACnD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,mBAAmB,CAAC,OAA+B;IAIjE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAqB,CAAC;SACpG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,GAAG,IAAI,GAAG;QAChB,eAAe;QACf,SAAS;QACT,MAAM;QACN,YAAY;KACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,OAAa,IAAI,IAAI,EAAE;IAClD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,YAAY,CAAC,OAAa,IAAI,IAAI,EAAE;IAClD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/_signers/index.d.ts

@@ -0,0 +1,9 @@
+export { sha256Hex, hmacSha256, rfc3986Encode, canonicalizeQuery, canonicalizeHeaders, buildCanonicalRequest, basicIso8601, dateYYYYMMDD, } from './canonical.js';
+export type { CanonicalRequestInput, CanonicalRequest } from './canonical.js';
+export { signAliyunV3 } from './aliyun-v3.js';
+export type { AliyunV3SignInput, AliyunV3SignResult } from './aliyun-v3.js';
+export { signTencentTC3 } from './tencent-tc3.js';
+export type { TencentTC3SignInput, TencentTC3SignResult } from './tencent-tc3.js';
+export { signVolcV4 } from './volc-v4.js';
+export type { VolcV4SignInput, VolcV4SignResult } from './volc-v4.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_signers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/_signers/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/_signers/index.js

@@ -0,0 +1,6 @@
+// sdk/skillfm-local/src/_signers/index.ts
+export { sha256Hex, hmacSha256, rfc3986Encode, canonicalizeQuery, canonicalizeHeaders, buildCanonicalRequest, basicIso8601, dateYYYYMMDD, } from './canonical.js';
+export { signAliyunV3 } from './aliyun-v3.js';
+export { signTencentTC3 } from './tencent-tc3.js';
+export { signVolcV4 } from './volc-v4.js';
+//# sourceMappingURL=index.js.map

package/dist/_signers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_signers/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,YAAY,GACb,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/_signers/tencent-tc3.d.ts

@@ -0,0 +1,21 @@
+export interface TencentTC3SignInput {
+    method: string;
+    host: string;
+    path: string;
+    query: Record<string, string | number | boolean | undefined>;
+    headers: Record<string, string>;
+    payload: string;
+    ak_id: string;
+    ak_secret: string;
+    service: string;
+    region?: string;
+    action: string;
+    version: string;
+}
+export interface TencentTC3SignResult {
+    authorization: string;
+    signed_headers_with_signature: Record<string, string>;
+    timestamp: number;
+}
+export declare function signTencentTC3(input: TencentTC3SignInput): TencentTC3SignResult;
+//# sourceMappingURL=tencent-tc3.d.ts.map

package/dist/_signers/tencent-tc3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tencent-tc3.d.ts","sourceRoot":"","sources":["../../src/_signers/tencent-tc3.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAuC/E"}

package/dist/_signers/tencent-tc3.js

@@ -0,0 +1,48 @@
+// sdk/skillfm-local/src/_signers/tencent-tc3.ts
+//
+// 腾讯云 TC3-HMAC-SHA256 签名 (类 AWS SigV4)
+// Doc: https://cloud.tencent.com/document/api/213/30654
+//
+// StringToSign = TC3-HMAC-SHA256\n<timestamp>\n<credential_scope>\n<hex(SHA256(canonical_request))>
+// signing_key = HMAC(HMAC(HMAC("TC3" + sk, date), service), "tc3_request")
+// signature = hex(HMAC(signing_key, StringToSign))
+// Authorization: TC3-HMAC-SHA256 Credential=<sid>/<scope>, SignedHeaders=<list>, Signature=<sig>
+import { hmacSha256, sha256Hex, buildCanonicalRequest, dateYYYYMMDD } from './canonical.js';
+const ALGORITHM = 'TC3-HMAC-SHA256';
+const REQUEST_SUFFIX = 'tc3_request';
+export function signTencentTC3(input) {
+    const now = new Date();
+    const timestamp = Math.floor(now.getTime() / 1000);
+    const date_str = dateYYYYMMDD(now);
+    const headers = {
+        ...input.headers,
+        'content-type': input.headers['content-type'] ?? 'application/json',
+        host: input.host,
+        'x-tc-action': input.action,
+        'x-tc-timestamp': String(timestamp),
+        'x-tc-version': input.version,
+    };
+    if (input.region)
+        headers['x-tc-region'] = input.region;
+    const cr = buildCanonicalRequest({
+        method: input.method,
+        uri: input.path,
+        query: input.query,
+        headers,
+        payload: input.payload,
+    });
+    const credential_scope = `${date_str}/${input.service}/${REQUEST_SUFFIX}`;
+    const string_to_sign = [ALGORITHM, String(timestamp), credential_scope, sha256Hex(cr.request)].join('\n');
+    // signing_key = HMAC(HMAC(HMAC("TC3" + sk, date), service), "tc3_request")
+    const k_date = hmacSha256(`TC3${input.ak_secret}`, date_str);
+    const k_service = hmacSha256(k_date, input.service);
+    const k_signing = hmacSha256(k_service, REQUEST_SUFFIX);
+    const signature = hmacSha256(k_signing, string_to_sign).toString('hex');
+    const authorization = `${ALGORITHM} Credential=${input.ak_id}/${credential_scope}, SignedHeaders=${cr.signed_headers}, Signature=${signature}`;
+    return {
+        authorization,
+        signed_headers_with_signature: { ...headers, authorization },
+        timestamp,
+    };
+}
+//# sourceMappingURL=tencent-tc3.js.map

package/dist/_signers/tencent-tc3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tencent-tc3.js","sourceRoot":"","sources":["../../src/_signers/tencent-tc3.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uCAAuC;AACvC,wDAAwD;AACxD,EAAE;AACF,oGAAoG;AACpG,2EAA2E;AAC3E,mDAAmD;AACnD,iGAAiG;AAEjG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAuB5F,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,OAAO,GAA2B;QACtC,GAAG,KAAK,CAAC,OAAO;QAChB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;QACnE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,KAAK,CAAC,OAAO;KAC9B,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IAExD,MAAM,EAAE,GAAG,qBAAqB,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,GAAG,QAAQ,IAAI,KAAK,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IAC1E,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE1G,2EAA2E;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,GAAG,SAAS,eAAe,KAAK,CAAC,KAAK,IAAI,gBAAgB,mBAAmB,EAAE,CAAC,cAAc,eAAe,SAAS,EAAE,CAAC;IAE/I,OAAO;QACL,aAAa;QACb,6BAA6B,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE;QAC5D,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/_signers/volc-v4.d.ts

@@ -0,0 +1,18 @@
+export interface VolcV4SignInput {
+    method: string;
+    host: string;
+    path: string;
+    query: Record<string, string | number | boolean | undefined>;
+    headers: Record<string, string>;
+    payload: string;
+    ak_id: string;
+    ak_secret: string;
+    service: string;
+    region: string;
+}
+export interface VolcV4SignResult {
+    authorization: string;
+    signed_headers_with_signature: Record<string, string>;
+}
+export declare function signVolcV4(input: VolcV4SignInput): VolcV4SignResult;
+//# sourceMappingURL=volc-v4.d.ts.map

package/dist/_signers/volc-v4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"volc-v4.d.ts","sourceRoot":"","sources":["../../src/_signers/volc-v4.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvD;AAKD,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAoCnE"}

package/dist/_signers/volc-v4.js

@@ -0,0 +1,43 @@
+// sdk/skillfm-local/src/_signers/volc-v4.ts
+//
+// 火山引擎 V4 签名 (HMAC-SHA256, AWS SigV4 风格)
+// Doc: https://www.volcengine.com/docs/6369/67269
+//
+// StringToSign = HMAC-SHA256\n<timestamp>\n<credential_scope>\n<hex(SHA256(canonical_request))>
+// signing_key = HMAC(HMAC(HMAC(HMAC(<sk>, date), region), service), "request")
+// Authorization: HMAC-SHA256 Credential=<ak>/<scope>, SignedHeaders=<list>, Signature=<sig>
+import { hmacSha256, sha256Hex, buildCanonicalRequest, basicIso8601, dateYYYYMMDD } from './canonical.js';
+const ALGORITHM = 'HMAC-SHA256';
+const REQUEST_SUFFIX = 'request';
+export function signVolcV4(input) {
+    const now = new Date();
+    const ts = basicIso8601(now); // "20260501T120000Z"
+    const date_str = dateYYYYMMDD(now);
+    const headers = {
+        ...input.headers,
+        'content-type': input.headers['content-type'] ?? 'application/json',
+        host: input.host,
+        'x-date': ts,
+        'x-content-sha256': sha256Hex(input.payload),
+    };
+    const cr = buildCanonicalRequest({
+        method: input.method,
+        uri: input.path,
+        query: input.query,
+        headers,
+        payload: input.payload,
+    });
+    const credential_scope = `${date_str}/${input.region}/${input.service}/${REQUEST_SUFFIX}`;
+    const string_to_sign = [ALGORITHM, ts, credential_scope, sha256Hex(cr.request)].join('\n');
+    const k_date = hmacSha256(input.ak_secret, date_str);
+    const k_region = hmacSha256(k_date, input.region);
+    const k_service = hmacSha256(k_region, input.service);
+    const k_signing = hmacSha256(k_service, REQUEST_SUFFIX);
+    const signature = hmacSha256(k_signing, string_to_sign).toString('hex');
+    const authorization = `${ALGORITHM} Credential=${input.ak_id}/${credential_scope}, SignedHeaders=${cr.signed_headers}, Signature=${signature}`;
+    return {
+        authorization,
+        signed_headers_with_signature: { ...headers, authorization },
+    };
+}
+//# sourceMappingURL=volc-v4.js.map

package/dist/_signers/volc-v4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"volc-v4.js","sourceRoot":"","sources":["../../src/_signers/volc-v4.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,yCAAyC;AACzC,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,+EAA+E;AAC/E,4FAA4F;AAE5F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAoB1G,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,OAAO,GAA2B;QACtC,GAAG,KAAK,CAAC,OAAO;QAChB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB;QACnE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,EAAE;QACZ,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;KAC7C,CAAC;IAEF,MAAM,EAAE,GAAG,qBAAqB,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,IAAI;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IAC1F,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,GAAG,SAAS,eAAe,KAAK,CAAC,KAAK,IAAI,gBAAgB,mBAAmB,EAAE,CAAC,cAAc,eAAe,SAAS,EAAE,CAAC;IAE/I,OAAO;QACL,aAAa;QACb,6BAA6B,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE;KAC7D,CAAC;AACJ,CAAC"}

package/dist/agent-hints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-hints.d.ts","sourceRoot":"","sources":["../src/agent-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,UAAU,aAAa;IACrB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuFD;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAY7E"}
+{"version":3,"file":"agent-hints.d.ts","sourceRoot":"","sources":["../src/agent-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,UAAU,aAAa;IACrB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAsGD;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAY7E"}

package/dist/agent-hints.js

@@ -20,9 +20,12 @@ const ACTIVATION_SUCCESS_ZH = [
     '`npx -y -p @skillfm/local skillfm-local init --v3`',
     '完成项目级三层防御安装（写 SKILL.md priming + 自动检测 harness 写 PreToolUse hook + MCP 服务注册）。',
     '该命令幂等 — 已安装过会自动 skip，不会破坏用户文件。',
-    '然后用温暖的语气告诉用户:「SkillFM 激活成功！🎉 SkillFM BSO 三层防御已就绪」',
-    '再调用 GET /skills 发现可用技能，',
-    '以对话的方式介绍技能列表 — 用大白话解释每个技能能做什么，并基于上下文推荐一个用户可能想先试的。',
+    '⚠️ 然后告诉用户「SkillFM 已就绪！🎉」并按以下顺序引导（不要跳到赚钱技能）:',
+    '1) Beacon 监控 (默认免费, 已启动): 调用 skillfm_list_credentials 看用户已配哪些 LLM provider。',
+    '   如果是空的, 用对话方式问用户: "要我开始监控你的 LLM 花费吗? 你用 OpenAI / Anthropic / DeepSeek / 豆包 / Qwen / Kimi 哪些?',
+    '   告诉我我帮你配 — BYOK 安全, 你的 API key 加密存本地, 永不出节点。" 用户告知后用 skillfm_save_credential 工具保存 (注意: 需要用户提供 billing-only / admin key 才能调 provider 用量 API)。',
+    '2) 用户问"你能干啥"才 GET /skills 列赚钱技能 — 不要主动推。当前主推赚钱技能仅 1 个 (xianyu 闲鱼 AI 头像), 其他在迭代中。',
+    '核心原则: SkillFM 三件事是「管 AI 资产 + 省 token + 装赚钱技能」, 默认先帮用户管 + 省 (Beacon, 免费), 赚钱技能用户主动问再讲。',
 ].join(' ');
 const ACTIVATION_SUCCESS_EN = [
     '[English] Activation successful! brain_key saved to ~/.skillfm/config.json.',
@@ -32,10 +35,16 @@ const ACTIVATION_SUCCESS_EN = [
     'to complete project-level three-layer defense installation',
     '(SKILL.md priming + auto-detect harness PreToolUse hook + MCP server registration).',
     'This command is idempotent — already-installed files will be skipped, never overwritten.',
-    'Then tell the user warmly: "SkillFM activated! 🎉 BSO three-layer defense is ready"',
-    'and call GET /skills to discover available skills.',
-    'Present skills in a friendly conversational way — explain each in plain language',
-    'and suggest one the user might want to try first.',
+    '⚠️ Then tell the user "SkillFM is ready! 🎉" and onboard in this order (do NOT jump to earning skills):',
+    '1) Beacon monitoring (default free, already started): call skillfm_list_credentials to see which providers the user has configured.',
+    '   If empty, ask the user conversationally: "Want me to start monitoring your LLM spend?',
+    '   Which do you use — OpenAI / Anthropic / DeepSeek / Doubao / Qwen / Kimi? Tell me and I\'ll set it up.',
+    '   BYOK-safe — your API key is encrypted locally and never leaves your node."',
+    '   Once they tell you, use skillfm_save_credential to save (note: needs billing-only / admin key for provider usage API).',
+    '2) Only call GET /skills when the user asks "what can you do" — do not proactively push earning skills.',
+    '   The earning catalog currently surfaces 1 skill (xianyu — Xianyu AI avatar gigs); others are in iteration.',
+    'Core principle: SkillFM = manage AI assets + save tokens + earning skills. Default first helps with manage + save (Beacon, free).',
+    'Earning skills only on explicit user request.',
 ].join(' ');
 // ── running_activated ─────────────────────────────────────────────────
 function runningActivatedZh(url) {
@@ -44,9 +53,11 @@ function runningActivatedZh(url) {
         '⚠️ 检查项目级初始化：如果用户当前 workspace 没有 SKILL.md 文件，请先在 workspace 执行',
         '`npx -y -p @skillfm/local skillfm-local init --v3`',
         '完成三层防御安装（SKILL.md + harness hooks + MCP 注册），该命令幂等可重复跑。',
-        '然后告诉用户「SkillFM 已就绪!」, 调用',
-        `GET ${url}/skills 发现可用技能。`,
-        '以对话的方式介绍 — 用大白话解释每个技能能做什么, 推荐一个可以试试的。',
+        '⚠️ 然后告诉用户「SkillFM 已就绪!」并按以下顺序 onboard:',
+        '1) Beacon 监控 (默认免费, 已启动): 调用 skillfm_list_credentials 看用户已配哪些 LLM provider。',
+        '   如果空, 问用户用 OpenAI / Anthropic / DeepSeek / 豆包 / Qwen / Kimi 哪些, 收到回答用 skillfm_save_credential 保存 (BYOK: 加密存本地, 不出节点)。',
+        '2) 用户问"你能干啥"才 GET /skills 列赚钱技能 (当前仅 xianyu 真上线)。不要主动推赚钱技能。',
+        'SkillFM 核心定位: 管 AI 资产 + 省 token (默认免费) + 装赚钱技能 (用户主动)。',
     ].join(' ');
 }
 function runningActivatedEn(url) {
@@ -56,9 +67,13 @@ function runningActivatedEn(url) {
         'first run `npx -y -p @skillfm/local skillfm-local init --v3` in the workspace',
         'to complete three-layer defense installation (SKILL.md + harness hooks + MCP registration).',
         'This command is idempotent and safe to re-run.',
-        `Then tell the user "SkillFM is ready!" and call GET ${url}/skills to discover`,
-        'available skills. Present them conversationally — explain what each skill does',
-        'in plain language and suggest one to try.',
+        '⚠️ Then tell the user "SkillFM is ready!" and onboard in this order:',
+        '1) Beacon monitoring (default free, already started): call skillfm_list_credentials to see which providers are configured.',
+        '   If empty, ask which of OpenAI / Anthropic / DeepSeek / Doubao / Qwen / Kimi the user uses,',
+        '   then use skillfm_save_credential to save (BYOK: encrypted locally, never leaves the node).',
+        `2) Only call GET ${url}/skills when the user asks what you can do (currently only xianyu is shipped).`,
+        'Do not proactively push earning skills.',
+        'SkillFM positioning: manage AI assets + save tokens (free default) + earning skills (user-driven).',
     ].join(' ');
 }
 // ── running_not_activated ─────────────────────────────────────────────

package/dist/agent-hints.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-hints.js","sourceRoot":"","sources":["../src/agent-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,MAAM,gBAAgB,GACpB,iDAAiD,CAAC;AAEpD,yEAAyE;AAEzE,MAAM,qBAAqB,GAAG;IAC5B,uDAAuD;IACvD,+BAA+B;IAC/B,oDAAoD;IACpD,8EAA8E;IAC9E,gCAAgC;IAChC,oDAAoD;IACpD,yBAAyB;IACzB,mDAAmD;CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,qBAAqB,GAAG;IAC5B,6EAA6E;IAC7E,eAAe;IACf,8DAA8D;IAC9D,oDAAoD;IACpD,4DAA4D;IAC5D,qFAAqF;IACrF,0FAA0F;IAC1F,qFAAqF;IACrF,oDAAoD;IACpD,kFAAkF;IAClF,mDAAmD;CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,yEAAyE;AAEzE,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO;QACL,yBAAyB,GAAG,kCAAkC;QAC9D,8DAA8D;QAC9D,oDAAoD;QACpD,wDAAwD;QACxD,0BAA0B;QAC1B,OAAO,GAAG,iBAAiB;QAC3B,uCAAuC;KACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO;QACL,yCAAyC,GAAG,oDAAoD;QAChG,qFAAqF;QACrF,+EAA+E;QAC/E,6FAA6F;QAC7F,gDAAgD;QAChD,uDAAuD,GAAG,qBAAqB;QAC/E,gFAAgF;QAChF,2CAA2C;KAC5C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO;QACL,yBAAyB,GAAG,WAAW;QACvC,aAAa,GAAG,sCAAsC;QACtD,0BAA0B;QAC1B,4CAA4C;QAC5C,kBAAkB,GAAG,sBAAsB;QAC3C,uCAAuC;QACvC,2BAA2B;KAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO;QACL,yCAAyC,GAAG,sBAAsB;QAClE,mBAAmB,GAAG,2DAA2D;QACjF,kEAAkE;QAClE,iFAAiF;QACjF,4CAA4C,GAAG,gCAAgC;QAC/E,yGAAyG;QACzG,4EAA4E;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,OAAsB,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,oBAAoB;YACvB,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3F,KAAK,uBAAuB;YAC1B,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CACpF,MAAM,CACP,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-hints.js","sourceRoot":"","sources":["../src/agent-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,MAAM,gBAAgB,GACpB,iDAAiD,CAAC;AAEpD,yEAAyE;AAEzE,MAAM,qBAAqB,GAAG;IAC5B,uDAAuD;IACvD,+BAA+B;IAC/B,oDAAoD;IACpD,8EAA8E;IAC9E,gCAAgC;IAChC,8CAA8C;IAC9C,6EAA6E;IAC7E,gGAAgG;IAChG,gJAAgJ;IAChJ,kFAAkF;IAClF,uFAAuF;CACxF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,qBAAqB,GAAG;IAC5B,6EAA6E;IAC7E,eAAe;IACf,8DAA8D;IAC9D,oDAAoD;IACpD,4DAA4D;IAC5D,qFAAqF;IACrF,0FAA0F;IAC1F,yGAAyG;IACzG,qIAAqI;IACrI,0FAA0F;IAC1F,0GAA0G;IAC1G,+EAA+E;IAC/E,2HAA2H;IAC3H,yGAAyG;IACzG,8GAA8G;IAC9G,mIAAmI;IACnI,+CAA+C;CAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,yEAAyE;AAEzE,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO;QACL,yBAAyB,GAAG,kCAAkC;QAC9D,8DAA8D;QAC9D,oDAAoD;QACpD,wDAAwD;QACxD,wCAAwC;QACxC,6EAA6E;QAC7E,yHAAyH;QACzH,6DAA6D;QAC7D,wDAAwD;KACzD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO;QACL,yCAAyC,GAAG,oDAAoD;QAChG,qFAAqF;QACrF,+EAA+E;QAC/E,6FAA6F;QAC7F,gDAAgD;QAChD,sEAAsE;QACtE,4HAA4H;QAC5H,+FAA+F;QAC/F,+FAA+F;QAC/F,oBAAoB,GAAG,gFAAgF;QACvG,yCAAyC;QACzC,oGAAoG;KACrG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO;QACL,yBAAyB,GAAG,WAAW;QACvC,aAAa,GAAG,sCAAsC;QACtD,0BAA0B;QAC1B,4CAA4C;QAC5C,kBAAkB,GAAG,sBAAsB;QAC3C,uCAAuC;QACvC,2BAA2B;KAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO;QACL,yCAAyC,GAAG,sBAAsB;QAClE,mBAAmB,GAAG,2DAA2D;QACjF,kEAAkE;QAClE,iFAAiF;QACjF,4CAA4C,GAAG,gCAAgC;QAC/E,yGAAyG;QACzG,4EAA4E;KAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,OAAsB,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,oBAAoB;YACvB,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3F,KAAK,uBAAuB;YAC1B,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CACpF,MAAM,CACP,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/asset-connectors/aliyun-ecs.d.ts

@@ -0,0 +1,18 @@
+import { AssetBaseConnector } from './base.js';
+import type { AssetExpiry, AssetProviderId, FetchAssetsOptions } from './types.js';
+export declare class AliyunECSConnector extends AssetBaseConnector {
+    id: AssetProviderId;
+    name: string;
+    is_real: boolean;
+    fetchAssets(byok_key: string, opts?: FetchAssetsOptions): Promise<AssetExpiry[]>;
+    ping(byok_key: string): Promise<{
+        ok: boolean;
+        key_fingerprint: string;
+        error?: undefined;
+    } | {
+        ok: boolean;
+        error: string;
+        key_fingerprint: string;
+    }>;
+}
+//# sourceMappingURL=aliyun-ecs.d.ts.map

package/dist/asset-connectors/aliyun-ecs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aliyun-ecs.d.ts","sourceRoot":"","sources":["../../src/asset-connectors/aliyun-ecs.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BnF,qBAAa,kBAAmB,SAAQ,kBAAkB;IACxD,EAAE,EAAE,eAAe,CAAgB;IACnC,IAAI,SAAa;IACjB,OAAO,UAAQ;IAET,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAiDhF,IAAI,CAAC,QAAQ,EAAE,MAAM;;;;;;;;;CAkC5B"}