@squadrules/mcp 4.8.6

package/dist/embed-docs/mem/refine-search.md

@@ -0,0 +1,93 @@
+---
+version: "4.8.6"
+slug: refine-search
+title: Get help refining your search
+---
+
+
+
+# Get help refining your search
+
+**You are an AI agent.** You ran `activate` and got no solid match, or only weak
+/ ambiguous matches. This adapter helps you turn a vague request into a better
+query so the next `activate` can find the right adapter.
+
+KAIROS principle: before acting, understand the user better. The goal is not to
+repeat the failed phrase with minor edits. The goal is to recover the user's
+real intent.
+
+## Activation Patterns
+
+**Run this adapter when:**
+- `activate` returned no match.
+- `activate` returned only weak choices.
+- The response included a `refine` choice.
+
+**Trigger pattern:** after `activate` when no strong match exists.
+
+**Must Never:**
+- Run when a strong match already exists.
+- Loop refinement endlessly.
+
+**Must Always:**
+- Infer the real goal, context, and missing constraints from the user's request.
+- Build a more specific query than the one that failed.
+- Run at most once per user request; if the second activation still fails, stop
+  and offer clarification or protocol creation.
+
+**Good trigger examples:**
+- activate returned only "refine" / weak matches → run this adapter
+- "No protocol matched 'do the thing'" → run this adapter
+
+**Bad trigger examples:**
+- activate returned a strong match → use that match instead
+- user asked "what adapters exist?" → use `activate` / `spaces`, not this
+
+## Step 1: Extract what the user actually wants
+
+From the user's original message, identify:
+- the real goal
+- relevant context
+- missing constraints
+- likely wording that would help KAIROS find the right adapter
+
+Write your analysis as the solution.
+
+```json
+{
+  "contract": {
+    "type": "comment",
+    "comment": { "min_length": 60 },
+    "required": true
+  }
+}
+```
+
+## Step 2: Build and run a refined activate query
+
+Using Step 1, construct one refined query with 3–8 specific words. Do not reuse
+the vague phrase that already failed.
+
+Call `activate` with it.
+
+- **Strong match (score >= 0.5):** pick that choice and `forward`.
+- **Weak matches only:** ask the user to clarify or offer the create path.
+
+Do not loop more than once.
+
+```json
+{
+  "contract": {
+    "type": "mcp",
+    "mcp": { "tool_name": "activate" },
+    "required": true
+  }
+}
+```
+
+## Reward Signal
+
+Only reachable after all prior steps are solved.
+
+The agent has converted a failed literal search into a more truthful,
+user-aligned activation attempt.

package/dist/embed-docs/mem/skill-format-guide.md

@@ -0,0 +1,280 @@
+---
+version: "4.8.6"
+slug: skill-format-guide
+title: Skill Format and Local Authoring Guide
+---
+
+
+
+# Skill Format and Local Authoring Guide
+
+Decision rules for authoring SKILL.md files, choosing between local (git) and
+server (KAIROS) storage, and quality gates for skill content. Fetches the
+current Agent Skills format spec (Context7 or agentskills.io) as the
+authoritative generic format, then layers KAIROS customizations on top. Loaded
+by protocol-authoring agents during drafting and review when the output format
+is `skill`.
+
+## Activation Patterns
+
+**Typically invoked by:** `create-new-protocol` and
+`phase-critic`.
+
+**Can be invoked directly when agent needs:**
+- "SKILL.md format reference" / "how to write a skill"
+- "latest SKILL.md spec" / "current agentskills format"
+- "skill vs adapter" / "local skill or KAIROS adapter"
+- "skill quality gates" / "SKILL.md structure"
+- "project-level skill" / "where to put a skill"
+
+**Trigger pattern:** **skill** + (format | structure | guide | quality | local | spec).
+
+**Must Never:**
+- Be used as an execution protocol.
+- Recommend storing a skill in both git AND KAIROS server simultaneously.
+- Confuse SKILL.md (agent instruction file) with protocol markdown (adapter).
+- Hardcode the generic SKILL.md format from memory when the current spec is
+  reachable via Context7 or agentskills.io.
+
+**Must Always:**
+- Be consulted before writing any SKILL.md file.
+- Fetch the current Agent Skills spec before authoring or reviewing generic
+  format, and apply KAIROS customizations after it.
+- Enforce single source of truth: each skill lives in exactly one place.
+- Match storage location to the skill's scope and discoverability needs.
+
+**Good trigger examples:**
+- drafting a new skill and need format rules → load this
+- reviewing a SKILL.md for quality → load this
+- deciding local vs server for a skill → load this
+
+**Bad trigger examples:**
+- "which challenge type for this step?" → use `challenge-type-guide`
+- "create a new protocol" → use `create-new-protocol`
+
+## Storage Decision
+
+Every skill has ONE home. Choose at authoring time. Never both.
+
+| Scope | Storage | Discovery | Source of Truth |
+|---|---|---|---|
+| Project-specific (deploy, test, release) | Git: `.agents/skills/{name}/` or `.cursor/skills/{name}/` | IDE host scans description field | Git repo |
+| Personal cross-project (universal) | KAIROS server via `train` | `activate` embedding search | KAIROS server |
+| Team/group shared | KAIROS server (group space) | `activate` | KAIROS server |
+
+### Decision Tree
+
+```
+Is this skill specific to ONE project's codebase?
+ ├─ YES → Does it reference repo files, paths, or project-specific tools?
+ │         ├─ YES → LOCAL (git)
+ │         └─ NO  → Could it help in other projects?
+ │                   ├─ YES → SERVER (KAIROS)
+ │                   └─ NO  → LOCAL (git)
+ └─ NO → SERVER (KAIROS)
+```
+
+### Local Storage Paths
+
+| Host | Path | Scope |
+|---|---|---|
+| Cursor IDE (project) | `.cursor/skills/{name}/SKILL.md` | Repo-scoped, git-controlled |
+| Cursor IDE (personal) | `~/.cursor/skills/{name}/SKILL.md` | User-wide, all projects |
+| Claude Code (project) | `.agents/skills/{name}/SKILL.md` | Repo-scoped, git-controlled |
+| Claude Code (personal) | `~/.agents/skills/{name}/SKILL.md` | User-wide, all projects |
+
+**Never** create skills in `~/.cursor/skills-cursor/` — reserved for system.
+
+### Promotion and Demotion
+
+**Local → Server (skill graduates to universal):**
+1. Read existing SKILL.md
+2. Optionally wrap in protocol structure (Activation Patterns, contracts)
+3. `train` to KAIROS server
+4. Delete local copy or mark deprecated
+5. Git commit the deletion
+
+**Server → Local (adapter becomes project-specific):**
+1. `export` with `format: skill_zip` or `format: markdown`
+2. Write to `.agents/skills/{slug}/SKILL.md`
+3. Optionally `delete` from server
+
+```json
+{"contract":{"type":"comment","comment":{"min_length":30},"required":true}}
+```
+
+## Fetch the Current Skill Format Spec
+
+Do NOT rely on a frozen copy of the SKILL.md format. The Agent Skills format
+evolves (new frontmatter fields, directory conventions, size guidance). Before
+authoring or reviewing a SKILL.md, fetch the **current** specification and treat
+it as authoritative for the generic format. The KAIROS customizations in the
+sections *after* this one layer on top of that generic spec.
+
+**Authoritative source (fetch fresh — do not guess):**
+
+1. **Context7 (preferred):** query the Agent Skills docs library for the
+   SKILL.md format. Use one of these library IDs directly (skip
+   `resolve-library-id`):
+   - `/llmstxt/agentskills_io_llms-full_txt` — full spec text (best coverage)
+   - `/websites/agentskills_io` — the agentskills.io site docs
+   Example query: "SKILL.md frontmatter fields, directory structure, size limits".
+2. **URL fallback:** if Context7 is unavailable or returns nothing usable,
+   fetch `https://agentskills.io/specification`. Use
+   `https://agentskills.io/llms.txt` as the documentation index to discover
+   related pages.
+
+**What to extract from the fetched spec (do not hardcode from memory):**
+- Required and optional YAML frontmatter fields and their constraints
+  (for example `name`, `description`, and any newer fields such as `license`,
+  `compatibility`, `metadata`, `allowed-tools`).
+- Directory structure and conventional subdirectory names
+  (for example `scripts/`, `references/`, `assets/`).
+- Body content recommendations and section guidance.
+- Size / progressive-disclosure guidance (line and token targets).
+- Any spec-provided validation tooling (for example `skills-ref validate`).
+
+**Rules:**
+- Apply the fetched spec's constraints exactly for the generic format.
+- If the fetch fails on BOTH Context7 and the URL, STOP and tell the user the
+  spec is unreachable — do not fabricate field lists or limits from memory.
+- Record which source and (if available) which version/date you fetched, so the
+  authoring decision is auditable.
+
+```json
+{"contract":{"type":"comment","comment":{"min_length":30},"required":true}}
+```
+
+## KAIROS Customizations (apply after the generic spec)
+
+Everything below is KAIROS-specific and layers on top of the fetched Agent
+Skills spec. When the generic spec and these rules disagree on generic format,
+follow the spec; these rules add KAIROS storage, integrity, and routing
+behavior the generic spec does not cover.
+
+### KAIROS additions to structure
+
+- **`SHA256SUMS`** — required for KAIROS-exported skill bundles (GNU
+  `sha256sum` format, paths relative to the skill dir). This is a KAIROS
+  integrity requirement, not part of the generic Agent Skills spec.
+- **`disable-model-invocation`** — when the host supports it, KAIROS-authored
+  skills default this to `true` (explicit load only) unless the skill is meant
+  to auto-trigger. Only add fields the fetched spec actually recognizes.
+- **Reference depth** — keep references one level deep (SKILL.md → reference
+  file, never deeper), consistent with the spec's progressive-disclosure model.
+
+```json
+{"contract":{"type":"comment","comment":{"min_length":30},"required":true}}
+```
+
+## Quality Gates
+
+### Description Quality
+
+The description is the primary discovery mechanism. It must:
+
+1. Be written in **third person** (not "I can help" or "you can use")
+2. State **WHAT** the skill does (specific capabilities)
+3. State **WHEN** to use it (trigger scenarios, file patterns, keywords)
+4. Include **trigger terms** that match real user language
+5. Avoid vague words: "helps with", "assists", "various"
+
+**Good:**
+```yaml
+description: >-
+  Validate and publish Confluence pages managed as local markdown via Mark CLI.
+  Use when the user asks to dry-run, validate, publish, or sync a Confluence
+  page, or when working with files under confluence/ that have Mark metadata.
+```
+
+**Bad:**
+```yaml
+description: Helps with Confluence stuff.
+```
+
+### Content Quality
+
+| Check | Rule |
+|---|---|
+| Consistent terminology | One term per concept throughout |
+| No time-sensitive info | No "before August 2025" conditions |
+| Concrete examples | Real inputs/outputs, not abstract |
+| Actionable instructions | Agent knows what to DO, not just what exists |
+| Default tool choice | One recommended tool, escape hatch for alternatives |
+| No Windows paths | Forward slashes only |
+
+### Degree of Freedom
+
+Match instruction specificity to the task's fragility:
+
+| Level | When | Example |
+|---|---|---|
+| High (text guidelines) | Multiple valid approaches | Code review guidelines |
+| Medium (templates/pseudocode) | Preferred pattern, acceptable variation | Report generation |
+| Low (exact scripts) | Fragile operations, consistency critical | DB migrations |
+
+```json
+{"contract":{"type":"comment","comment":{"min_length":30},"required":true}}
+```
+
+## Finalisation Paths
+
+### Path A: Local Write (project-level skill)
+
+When `{target}=local`:
+
+1. Determine output path from scope:
+   - Project Cursor: `.cursor/skills/{name}/SKILL.md`
+   - Project Claude: `.agents/skills/{name}/SKILL.md`
+   - Personal: `~/.cursor/skills/{name}/SKILL.md` or `~/.agents/skills/{name}/`
+2. Create directory if needed
+3. Write SKILL.md with frontmatter and body
+4. Generate `SHA256SUMS` (GNU sha256sum format, paths relative to skill dir)
+5. Write any reference files and scripts
+6. Verify: `test -f "{path}/SKILL.md" && wc -l "{path}/SKILL.md"`
+7. Report path and line count to user
+
+Do NOT call `train`. The skill lives only in git.
+
+### Path B: Server Train (KAIROS-routable adapter)
+
+When `{target}=server`:
+
+1. Wrap skill content in protocol markdown if needed:
+   - Add Activation Patterns (first H2)
+   - Add contract blocks per layer
+   - Add Reward Signal (last H2)
+2. Call `train` with full markdown
+3. Verify adapter URI returned
+4. Report URI and slug to user
+
+Do NOT write to local disk. The adapter lives only in KAIROS.
+
+### Path C: Hybrid Authoring (skill that is also an adapter)
+
+When `{target}=hybrid` (rare — use only when explicitly requested):
+
+1. Author as a KAIROS protocol (Activation Patterns, contracts, Reward Signal)
+2. `train` to server
+3. `export` with `format: skill_zip` to produce local SKILL.md bundle
+4. The exported SKILL.md is a **read-only derived artifact**, not a source of truth
+5. Document in the SKILL.md header that it was exported from KAIROS
+
+```json
+{"contract":{"type":"comment","comment":{"min_length":30},"required":true}}
+```
+
+## Reward Signal
+
+Only reachable after all prior steps are solved.
+
+The agent can now:
+1. Fetch the current Agent Skills spec (Context7 or agentskills.io) instead of
+   relying on a frozen copy, and apply it as the authoritative generic format
+2. Layer the KAIROS customizations (storage, `SHA256SUMS`, routing) on top of
+   that fetched spec
+3. Choose the correct storage location for a skill
+4. Author SKILL.md with valid frontmatter and structure per the current spec
+5. Apply quality gates to descriptions and content
+6. Finalize via local write OR server train (never both)
+7. Produce SHA256SUMS for integrity verification

package/dist/http/bearer-validate.d.ts

@@ -0,0 +1,25 @@
+import { type AccountKind } from "./oidc-profile-claims.js";
+export interface AuthPayload {
+    sub: string;
+    groups: string[];
+    /** Raw issuer retained for deterministic space-id derivation across Keycloak hosts. */
+    iss: string;
+    /** Realm from token issuer (e.g. kairos) for space isolation. */
+    realm: string;
+    preferred_username?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    email?: string;
+    email_verified?: boolean;
+    identity_provider?: string;
+    /** Set when profile claims allow derivation; omitted on older session cookies until re-login. */
+    account_kind?: AccountKind;
+    account_label?: string;
+}
+/**
+ * Validate Bearer JWT: iss in trusted list, aud in allowed list, exp not expired, signature valid.
+ * Returns auth payload or null if invalid.
+ */
+export declare function validateBearerToken(token: string, trustedIssuers: string[], allowedAudiences: string[]): Promise<AuthPayload | null>;
+//# sourceMappingURL=bearer-validate.d.ts.map

package/dist/http/bearer-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-validate.d.ts","sourceRoot":"","sources":["../../src/http/bearer-validate.ts"],"names":[],"mappings":"AAaA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA6ED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EAAE,EACxB,gBAAgB,EAAE,MAAM,EAAE,GACzB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAoF7B"}

package/dist/http/bearer-validate.js

@@ -0,0 +1,173 @@
+/**
+ * Bearer JWT validation for OIDC (Keycloak). Verifies iss, aud, exp and signature via JWKS.
+ * When KEYCLOAK_INTERNAL_URL is set, JWKS is fetched from that host so the app in Docker can reach Keycloak.
+ */
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { decodeJwt } from "jose/jwt/decode";
+import { KEYCLOAK_URL, KEYCLOAK_INTERNAL_URL, OIDC_BEARER_MERGE_USERINFO_GROUPS, OIDC_GROUPS_ALLOWLIST } from "../config.js";
+import { structuredLogger } from "../utils/structured-logger.js";
+import { applyOidcGroupsAllowlist, enrichAuthPayloadFromVerifiedJwt, extractGroupsFromPayload, realmFromIssuer } from "./oidc-profile-claims.js";
+const JWKS_CACHE = new Map();
+/**
+ * Issuer URL base for server-side HTTP to Keycloak (JWKS, userinfo).
+ * When KEYCLOAK_INTERNAL_URL is set and the token issuer matches KEYCLOAK_URL, use internal host
+ * so Docker can reach Keycloak.
+ */
+function resolveOidcIssuerBaseForServerFetch(issuer) {
+    const base = issuer.replace(/\/$/, "");
+    if (KEYCLOAK_INTERNAL_URL && KEYCLOAK_URL && base.startsWith(KEYCLOAK_URL.replace(/\/$/, ""))) {
+        const internalBase = KEYCLOAK_INTERNAL_URL.replace(/\/$/, "");
+        return `${internalBase}${new URL(base).pathname}`;
+    }
+    return base;
+}
+function getJwksFetchUrl(issuer) {
+    return `${resolveOidcIssuerBaseForServerFetch(issuer)}/protocol/openid-connect/certs`;
+}
+function getOidcUserinfoUrl(issuer) {
+    return `${resolveOidcIssuerBaseForServerFetch(issuer)}/protocol/openid-connect/userinfo`;
+}
+/**
+ * When the access JWT has no `groups` claim (common if Group Membership is mapped to ID token / userinfo only),
+ * fetch groups from OIDC Userinfo using the same Bearer token. Aligns MCP Bearer auth with browser sessions
+ * that merge id_token groups in the OAuth callback.
+ */
+async function fetchGroupsFromOidcUserinfo(issuer, accessToken) {
+    const url = getOidcUserinfoUrl(issuer);
+    try {
+        const res = await fetch(url, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json"
+            },
+            signal: AbortSignal.timeout(8000)
+        });
+        if (!res.ok) {
+            structuredLogger.debug(`[auth] userinfo groups: HTTP ${res.status} url=${url}`);
+            return [];
+        }
+        const body = (await res.json());
+        const groups = extractGroupsFromPayload(body);
+        if (groups.length === 0) {
+            structuredLogger.info(`[auth] userinfo returned no groups — the issuing client likely lacks a Group Membership protocol mapper. ` +
+                `Add the mapper to the realm's default client scope or the specific client to enable group spaces for DCR/MCP tokens.`);
+        }
+        return groups;
+    }
+    catch (err) {
+        structuredLogger.debug(`[auth] userinfo groups: fetch failed url=${url} err=${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+}
+function getJwksForIssuer(issuer) {
+    const cached = JWKS_CACHE.get(issuer);
+    if (cached)
+        return cached;
+    const url = getJwksFetchUrl(issuer);
+    const jwks = createRemoteJWKSet(new URL(url));
+    JWKS_CACHE.set(issuer, jwks);
+    return jwks;
+}
+/** Decode JWT payload without verification (issuer check only). */
+function decodePayload(jwt) {
+    return decodeJwt(jwt);
+}
+/**
+ * Validate Bearer JWT: iss in trusted list, aud in allowed list, exp not expired, signature valid.
+ * Returns auth payload or null if invalid.
+ */
+export async function validateBearerToken(token, trustedIssuers, allowedAudiences) {
+    if (!token || trustedIssuers.length === 0 || allowedAudiences.length === 0)
+        return null;
+    let payload;
+    try {
+        const unverified = decodePayload(token);
+        if (process.env["AUTH_TRACE"] === "true" || process.env["LOG_LEVEL"] === "trace") {
+            structuredLogger.info(`[auth] TRACE Bearer unverified payload raw=${JSON.stringify(unverified)}`);
+        }
+        const iss = typeof unverified["iss"] === "string" ? unverified["iss"] : undefined;
+        if (!iss || !trustedIssuers.includes(iss)) {
+            structuredLogger.info(`[auth] Bearer rejected: issuer not trusted token_iss=${iss ?? "missing"} trusted=${JSON.stringify(trustedIssuers)}`);
+            return null;
+        }
+        const jwks = getJwksForIssuer(iss);
+        const getKey = (protectedHeader) => jwks(protectedHeader);
+        const { payload: p } = await jwtVerify(token, getKey, { issuer: iss });
+        payload = p;
+        if (process.env["AUTH_TRACE"] === "true" || process.env["LOG_LEVEL"] === "trace") {
+            structuredLogger.info(`[auth] TRACE Bearer payload raw=${JSON.stringify(payload)}`);
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        structuredLogger.info(`[auth] Bearer rejected: JWT verify failed err=${msg}`);
+        return null;
+    }
+    const aud = payload["aud"];
+    const audList = Array.isArray(aud) ? aud : typeof aud === "string" ? [aud] : [];
+    const issForAud = typeof payload["iss"] === "string" ? payload["iss"] : "";
+    // Keycloak: accept aud "account", or empty aud when issuer is a Keycloak realm (some tokens omit aud).
+    const keycloakAccountAud = audList.includes("account") && issForAud.includes("/realms/");
+    const keycloakEmptyAud = audList.length === 0 && issForAud.includes("/realms/");
+    const hasAudience = allowedAudiences.some((a) => audList.includes(a)) || keycloakAccountAud || keycloakEmptyAud;
+    if (!hasAudience) {
+        structuredLogger.info(`[auth] Bearer rejected: audience not allowed token_aud=${JSON.stringify(audList)} allowed=${JSON.stringify(allowedAudiences)}`);
+        return null;
+    }
+    const sub = typeof payload["sub"] === "string" ? payload["sub"] : "";
+    if (!sub)
+        return null;
+    const iss = typeof payload["iss"] === "string" ? payload["iss"] : "";
+    if (!iss)
+        return null;
+    const realm = realmFromIssuer(iss);
+    const groupsFromAccess = extractGroupsFromPayload(payload);
+    let groups = groupsFromAccess;
+    if (groupsFromAccess.length === 0) {
+        const nestedIdToken = payload["id_token"];
+        if (typeof nestedIdToken === "string" && nestedIdToken.length > 0) {
+            try {
+                groups = extractGroupsFromPayload(decodePayload(nestedIdToken));
+            }
+            catch {
+                // Ignore malformed nested id_token and keep empty groups.
+            }
+        }
+    }
+    if (groups.length === 0) {
+        groups = await fetchGroupsFromOidcUserinfo(iss, token);
+    }
+    else if (OIDC_BEARER_MERGE_USERINFO_GROUPS) {
+        const fromUserinfo = await fetchGroupsFromOidcUserinfo(iss, token);
+        if (fromUserinfo.length > 0) {
+            groups = [...new Set([...groups, ...fromUserinfo])];
+        }
+    }
+    groups = applyOidcGroupsAllowlist(groups, OIDC_GROUPS_ALLOWLIST);
+    const enrich = enrichAuthPayloadFromVerifiedJwt(payload);
+    const result = {
+        sub,
+        groups,
+        iss,
+        realm,
+        account_kind: enrich.account_kind,
+        account_label: enrich.account_label,
+    };
+    if (enrich.preferred_username !== undefined)
+        result.preferred_username = enrich.preferred_username;
+    if (enrich.name !== undefined)
+        result.name = enrich.name;
+    if (enrich.given_name !== undefined)
+        result.given_name = enrich.given_name;
+    if (enrich.family_name !== undefined)
+        result.family_name = enrich.family_name;
+    if (enrich.email !== undefined)
+        result.email = enrich.email;
+    if (enrich.email_verified !== undefined)
+        result.email_verified = enrich.email_verified;
+    if (enrich.identity_provider !== undefined)
+        result.identity_provider = enrich.identity_provider;
+    return result;
+}
+//# sourceMappingURL=bearer-validate.js.map

package/dist/http/bearer-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-validate.js","sourceRoot":"","sources":["../../src/http/bearer-validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,iCAAiC,EACjC,qBAAqB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAqBlC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE5E;;;;GAIG;AACH,SAAS,mCAAmC,CAAC,MAAc;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,qBAAqB,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,OAAO,GAAG,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,GAAG,mCAAmC,CAAC,MAAM,CAAC,gCAAgC,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,GAAG,mCAAmC,CAAC,MAAM,CAAC,mCAAmC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,WAAmB;IAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,gBAAgB,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,gBAAgB,CAAC,IAAI,CACnB,2GAA2G;gBAC3G,sHAAsH,CACvH,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAgB,CAAC,KAAK,CACpB,4CAA4C,GAAG,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1G,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,SAAS,CAAC,GAAG,CAA4B,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,cAAwB,EACxB,gBAA0B;IAE1B,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACjF,gBAAgB,CAAC,IAAI,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CACnB,wDAAwD,GAAG,IAAI,SAAS,YAAY,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CACrH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,eAAqE,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChH,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,CAA4B,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACjF,gBAAgB,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,gBAAgB,CAAC,IAAI,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,uGAAuG;IACvG,MAAM,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,WAAW,GACf,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,IAAI,gBAAgB,CAAC;IAC9F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,gBAAgB,CAAC,IAAI,CACnB,0DAA0D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAChI,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,GAAG,gBAAgB,CAAC;IAC9B,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,iCAAiC,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,GAAG,wBAAwB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAgB;QAC1B,GAAG;QACH,MAAM;QACN,GAAG;QACH,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;IACF,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACnG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3E,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC9E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC5D,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACvF,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAChG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/http/export-skill-zip-http.d.ts

@@ -0,0 +1,5 @@
+import type { Response } from 'express';
+import type { MemoryQdrantStore } from '../services/memory/store.js';
+import type { QdrantService } from '../services/qdrant/service.js';
+export declare function streamSkillZipHttpResponse(res: Response, memoryStore: MemoryQdrantStore, qdrantService: QdrantService | undefined, adapterUris: string[]): Promise<void>;
+//# sourceMappingURL=export-skill-zip-http.d.ts.map

package/dist/http/export-skill-zip-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-skill-zip-http.d.ts","sourceRoot":"","sources":["../../src/http/export-skill-zip-http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAMnE,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,QAAQ,EACb,WAAW,EAAE,iBAAiB,EAC9B,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/dist/http/export-skill-zip-http.js

@@ -0,0 +1,29 @@
+import { PassThrough } from 'node:stream';
+import { finished } from 'node:stream/promises';
+import { collectSkillExportItemsForZip } from '../tools/export-skill-items.js';
+import { setSkillZipDecodedBytes } from '../tools/export-telemetry.js';
+import { flattenSkillItemsToZipPaths, pipeSkillZipToWritable } from '../tools/skill-export/zip-bundle.js';
+import { DEFAULT_EXPORT_SKILL_ZIP_FILENAME } from '../config/export-zip-settings.js';
+export async function streamSkillZipHttpResponse(res, memoryStore, qdrantService, adapterUris) {
+    const { items, primaryUri } = await collectSkillExportItemsForZip(memoryStore, qdrantService, adapterUris);
+    const flat = flattenSkillItemsToZipPaths(items.map((it) => ({ slug: it.slug, files: it.files })));
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${DEFAULT_EXPORT_SKILL_ZIP_FILENAME}"`);
+    res.setHeader('X-KAIROS-Primary-Export-Uri', primaryUri);
+    res.setHeader('X-KAIROS-Export-Adapter-Count', String(items.length));
+    res.setHeader('X-KAIROS-Export-Binary', '1');
+    // Dual headers for SquadRules migration: both sets emitted so clients reading either name work.
+    res.setHeader('X-SquadRules-Primary-Export-Uri', primaryUri);
+    res.setHeader('X-SquadRules-Export-Adapter-Count', String(items.length));
+    res.setHeader('X-SquadRules-Export-Binary', '1');
+    let compressedBytes = 0;
+    const pass = new PassThrough();
+    pass.on('data', (chunk) => {
+        compressedBytes += chunk.length;
+    });
+    pass.pipe(res);
+    await pipeSkillZipToWritable(pass, flat);
+    await finished(res);
+    setSkillZipDecodedBytes(compressedBytes);
+}
+//# sourceMappingURL=export-skill-zip-http.js.map

package/dist/http/export-skill-zip-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-skill-zip-http.js","sourceRoot":"","sources":["../../src/http/export-skill-zip-http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC1G,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAa,EACb,WAA8B,EAC9B,aAAwC,EACxC,WAAqB;IAErB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,6BAA6B,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElG,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACjD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,yBAAyB,iCAAiC,GAAG,CAAC,CAAC;IACpG,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IACzD,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,gGAAgG;IAChG,GAAG,CAAC,SAAS,CAAC,iCAAiC,EAAE,UAAU,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,CAAC,mCAAmC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAEjD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAChC,eAAe,IAAI,KAAK,CAAC,MAAM,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAC3C,CAAC"}

package/dist/http/http-api-attest.d.ts

@@ -0,0 +1,7 @@
+import express from 'express';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * Set up API route for reward.
+ */
+export declare function setupRewardRoute(app: express.Express, qdrantService: QdrantService): void;
+//# sourceMappingURL=http-api-attest.d.ts.map

package/dist/http/http-api-attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-attest.d.ts","sourceRoot":"","sources":["../../src/http/http-api-attest.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAMnE;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,QAuBlF"}