@squadrules/mcp 4.8.6

package/dist/services/export-artifact-download-capability-store.d.ts

@@ -0,0 +1,19 @@
+import type { SpaceContext } from '../utils/tenant-context.js';
+export interface ExportArtifactDownloadCapabilityRecord {
+    id: string;
+    artifact_uuid: string;
+    filename: string;
+    content_type: string;
+    sha256: string;
+    relative_path: string | null;
+    expires_at: string;
+    space_context: SpaceContext;
+}
+export declare class ExportArtifactDownloadCapabilityStore {
+    private readonly prefix;
+    private key;
+    put(record: ExportArtifactDownloadCapabilityRecord, ttlSeconds: number): Promise<void>;
+    get(id: string): Promise<ExportArtifactDownloadCapabilityRecord | null>;
+}
+export declare const exportArtifactDownloadCapabilityStore: ExportArtifactDownloadCapabilityStore;
+//# sourceMappingURL=export-artifact-download-capability-store.d.ts.map

package/dist/services/export-artifact-download-capability-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-artifact-download-capability-store.d.ts","sourceRoot":"","sources":["../../src/services/export-artifact-download-capability-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,WAAW,sCAAsC;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,YAAY,CAAC;CAC7B;AAED,qBAAa,qCAAqC;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,MAAM,EAAE,sCAAsC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sCAAsC,GAAG,IAAI,CAAC;CAG9E;AAED,eAAO,MAAM,qCAAqC,uCAA8C,CAAC"}

package/dist/services/export-artifact-download-capability-store.js

@@ -0,0 +1,15 @@
+import { keyValueStore } from './key-value-store-factory.js';
+export class ExportArtifactDownloadCapabilityStore {
+    prefix = 'mem:export-artifact-download:';
+    key(id) {
+        return `${this.prefix}${id}`;
+    }
+    async put(record, ttlSeconds) {
+        await keyValueStore.setJson(this.key(record.id), record, ttlSeconds);
+    }
+    async get(id) {
+        return keyValueStore.getJson(this.key(id));
+    }
+}
+export const exportArtifactDownloadCapabilityStore = new ExportArtifactDownloadCapabilityStore();
+//# sourceMappingURL=export-artifact-download-capability-store.js.map

package/dist/services/export-artifact-download-capability-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-artifact-download-capability-store.js","sourceRoot":"","sources":["../../src/services/export-artifact-download-capability-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAc7D,MAAM,OAAO,qCAAqC;IAC/B,MAAM,GAAG,+BAA+B,CAAC;IAElD,GAAG,CAAC,EAAU;QACpB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAA8C,EAAE,UAAkB;QAC1E,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,OAAO,aAAa,CAAC,OAAO,CAAyC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,qCAAqC,EAAE,CAAC"}

package/dist/services/export-artifact-download-capability.d.ts

@@ -0,0 +1,19 @@
+import { type ExportArtifactDownloadCapabilityRecord } from './export-artifact-download-capability-store.js';
+export interface MintExportArtifactDownloadCapabilityInput {
+    artifactUuid: string;
+    filename: string;
+    contentType: string;
+    sha256: string;
+    relativePath?: string | null;
+    baseUrl?: string;
+}
+export interface MintedExportArtifactDownloadCapability {
+    url: string;
+    expires_at: string;
+    filename: string;
+    content_type: string;
+}
+export declare function buildExportArtifactDownloadUrl(opaque: string, baseUrl?: string): string;
+export declare function mintExportArtifactDownloadCapability(input: MintExportArtifactDownloadCapabilityInput): Promise<MintedExportArtifactDownloadCapability>;
+export declare function verifyExportArtifactDownloadCapability(opaque: string): Promise<ExportArtifactDownloadCapabilityRecord | null>;
+//# sourceMappingURL=export-artifact-download-capability.d.ts.map

package/dist/services/export-artifact-download-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-artifact-download-capability.d.ts","sourceRoot":"","sources":["../../src/services/export-artifact-download-capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,gDAAgD,CAAC;AAQxD,MAAM,WAAW,yCAAyC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sCAAsC;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAwBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM,CAGnF;AAED,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,yCAAyC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAwBjD;AAED,wBAAsB,sCAAsC,CAC1D,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAiBxD"}

package/dist/services/export-artifact-download-capability.js

@@ -0,0 +1,79 @@
+import crypto from 'crypto';
+import { KAIROS_EXPORT_DOWNLOAD_SECRET, KAIROS_EXPORT_DOWNLOAD_TTL_SEC, resolvePublicExportBaseUrl } from '../config/export-download-settings.js';
+import { exportArtifactDownloadCapabilityStore } from './export-artifact-download-capability-store.js';
+import { getSpaceContextFromStorage } from '../utils/tenant-context.js';
+function toBase64Url(value) {
+    return Buffer.from(value).toString('base64url');
+}
+function fromBase64UrlJson(value) {
+    return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+}
+function sign(payloadB64) {
+    return crypto
+        .createHmac('sha256', KAIROS_EXPORT_DOWNLOAD_SECRET)
+        .update(payloadB64)
+        .digest('base64url');
+}
+function timingSafeEqualString(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ab, bb);
+}
+export function buildExportArtifactDownloadUrl(opaque, baseUrl = '') {
+    baseUrl = baseUrl || resolvePublicExportBaseUrl();
+    return `${baseUrl.replace(/\/$/, '')}/export/artifact/${encodeURIComponent(opaque)}`;
+}
+export async function mintExportArtifactDownloadCapability(input) {
+    const id = crypto.randomUUID();
+    const exp = Math.floor(Date.now() / 1000) + KAIROS_EXPORT_DOWNLOAD_TTL_SEC;
+    const expiresAt = new Date(exp * 1000).toISOString();
+    const payload = { id, exp };
+    const payloadB64 = toBase64Url(JSON.stringify(payload));
+    const opaque = `${payloadB64}.${sign(payloadB64)}`;
+    const record = {
+        id,
+        artifact_uuid: input.artifactUuid,
+        filename: input.filename,
+        content_type: input.contentType,
+        sha256: input.sha256,
+        relative_path: input.relativePath ?? null,
+        expires_at: expiresAt,
+        space_context: getSpaceContextFromStorage()
+    };
+    await exportArtifactDownloadCapabilityStore.put(record, KAIROS_EXPORT_DOWNLOAD_TTL_SEC);
+    return {
+        url: buildExportArtifactDownloadUrl(opaque, input.baseUrl),
+        expires_at: expiresAt,
+        filename: input.filename,
+        content_type: input.contentType
+    };
+}
+export async function verifyExportArtifactDownloadCapability(opaque) {
+    const [payloadB64, sig, extra] = opaque.split('.');
+    if (!payloadB64 || !sig || extra !== undefined)
+        return null;
+    if (!timingSafeEqualString(sign(payloadB64), sig))
+        return null;
+    let payload;
+    try {
+        payload = fromBase64UrlJson(payloadB64);
+    }
+    catch {
+        return null;
+    }
+    if (!payload.id || typeof payload.exp !== 'number')
+        return null;
+    if (payload.exp < Math.floor(Date.now() / 1000))
+        return null;
+    const record = await exportArtifactDownloadCapabilityStore.get(payload.id);
+    if (!record)
+        return null;
+    if (record.id !== payload.id)
+        return null;
+    if (Date.parse(record.expires_at) < Date.now())
+        return null;
+    return record;
+}
+//# sourceMappingURL=export-artifact-download-capability.js.map

package/dist/services/export-artifact-download-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-artifact-download-capability.js","sourceRoot":"","sources":["../../src/services/export-artifact-download-capability.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,qCAAqC,EAEtC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAuBxE,SAAS,WAAW,CAAC,KAAsB;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAa;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CAAC,UAAkB;IAC9B,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,6BAA6B,CAAC;SACnD,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,OAAO,GAAG,EAAE;IACzE,OAAO,GAAG,OAAO,IAAI,0BAA0B,EAAE,CAAC;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,8BAA8B,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,OAAO,GAAuC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IACnD,MAAM,MAAM,GAA2C;QACrD,EAAE;QACF,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACzC,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,0BAA0B,EAAE;KAC5C,CAAC;IACF,MAAM,qCAAqC,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,EAAE,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1D,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,MAAc;IAEd,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAqC,UAAU,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,qCAAqC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/export-download-capability-store.d.ts

@@ -0,0 +1,20 @@
+import type { SpaceContext } from '../utils/tenant-context.js';
+export interface ExportDownloadCapabilityRecord {
+    id: string;
+    adapter_uris: string[];
+    primary_uri: string;
+    item_count: number;
+    adapter_name: string | null;
+    adapter_version: string | null;
+    skill_bundle_manifest: string;
+    expires_at: string;
+    space_context: SpaceContext;
+}
+export declare class ExportDownloadCapabilityStore {
+    private readonly prefix;
+    private key;
+    put(record: ExportDownloadCapabilityRecord, ttlSeconds: number): Promise<void>;
+    get(id: string): Promise<ExportDownloadCapabilityRecord | null>;
+}
+export declare const exportDownloadCapabilityStore: ExportDownloadCapabilityStore;
+//# sourceMappingURL=export-download-capability-store.d.ts.map

package/dist/services/export-download-capability-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-capability-store.d.ts","sourceRoot":"","sources":["../../src/services/export-download-capability-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,YAAY,CAAC;CAC7B;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,MAAM,EAAE,8BAA8B,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;CAGtE;AAED,eAAO,MAAM,6BAA6B,+BAAsC,CAAC"}

package/dist/services/export-download-capability-store.js

@@ -0,0 +1,15 @@
+import { keyValueStore } from './key-value-store-factory.js';
+export class ExportDownloadCapabilityStore {
+    prefix = 'mem:export-download:';
+    key(id) {
+        return `${this.prefix}${id}`;
+    }
+    async put(record, ttlSeconds) {
+        await keyValueStore.setJson(this.key(record.id), record, ttlSeconds);
+    }
+    async get(id) {
+        return keyValueStore.getJson(this.key(id));
+    }
+}
+export const exportDownloadCapabilityStore = new ExportDownloadCapabilityStore();
+//# sourceMappingURL=export-download-capability-store.js.map

package/dist/services/export-download-capability-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-capability-store.js","sourceRoot":"","sources":["../../src/services/export-download-capability-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAe7D,MAAM,OAAO,6BAA6B;IACvB,MAAM,GAAG,sBAAsB,CAAC;IAEzC,GAAG,CAAC,EAAU;QACpB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAsC,EAAE,UAAkB;QAClE,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,OAAO,aAAa,CAAC,OAAO,CAAiC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,6BAA6B,EAAE,CAAC"}

package/dist/services/export-download-capability.d.ts

@@ -0,0 +1,20 @@
+import { type ExportDownloadCapabilityRecord } from './export-download-capability-store.js';
+export interface MintExportDownloadCapabilityInput {
+    adapterUris: string[];
+    primaryUri: string;
+    itemCount: number;
+    adapterName: string | null;
+    adapterVersion: string | null;
+    skillBundleManifest: string;
+    baseUrl?: string;
+}
+export interface MintedExportDownloadCapability {
+    url: string;
+    expires_at: string;
+    filename: string;
+    content_type: string;
+}
+export declare function buildExportDownloadUrl(opaque: string, baseUrl?: string): string;
+export declare function mintExportDownloadCapability(input: MintExportDownloadCapabilityInput): Promise<MintedExportDownloadCapability>;
+export declare function verifyExportDownloadCapability(opaque: string): Promise<ExportDownloadCapabilityRecord | null>;
+//# sourceMappingURL=export-download-capability.d.ts.map

package/dist/services/export-download-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-capability.d.ts","sourceRoot":"","sources":["../../src/services/export-download-capability.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,uCAAuC,CAAC;AAQ/C,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAwBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM,CAG3E;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAyBzC;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAiBhD"}

package/dist/services/export-download-capability.js

@@ -0,0 +1,81 @@
+import crypto from 'crypto';
+import { KAIROS_EXPORT_DOWNLOAD_SECRET, KAIROS_EXPORT_DOWNLOAD_TTL_SEC, resolvePublicExportBaseUrl } from '../config/export-download-settings.js';
+import { DEFAULT_EXPORT_SKILL_ZIP_FILENAME } from '../config/export-zip-settings.js';
+import { exportDownloadCapabilityStore } from './export-download-capability-store.js';
+import { getSpaceContextFromStorage } from '../utils/tenant-context.js';
+function toBase64Url(value) {
+    return Buffer.from(value).toString('base64url');
+}
+function fromBase64UrlJson(value) {
+    return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+}
+function sign(payloadB64) {
+    return crypto
+        .createHmac('sha256', KAIROS_EXPORT_DOWNLOAD_SECRET)
+        .update(payloadB64)
+        .digest('base64url');
+}
+function timingSafeEqualString(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ab, bb);
+}
+export function buildExportDownloadUrl(opaque, baseUrl = '') {
+    baseUrl = baseUrl || resolvePublicExportBaseUrl();
+    return `${baseUrl.replace(/\/$/, '')}/export/skill-zip/${encodeURIComponent(opaque)}`;
+}
+export async function mintExportDownloadCapability(input) {
+    const id = crypto.randomUUID();
+    const exp = Math.floor(Date.now() / 1000) + KAIROS_EXPORT_DOWNLOAD_TTL_SEC;
+    const expiresAt = new Date(exp * 1000).toISOString();
+    const payload = { id, exp };
+    const payloadB64 = toBase64Url(JSON.stringify(payload));
+    const opaque = `${payloadB64}.${sign(payloadB64)}`;
+    const record = {
+        id,
+        adapter_uris: input.adapterUris,
+        primary_uri: input.primaryUri,
+        item_count: input.itemCount,
+        adapter_name: input.adapterName,
+        adapter_version: input.adapterVersion,
+        skill_bundle_manifest: input.skillBundleManifest,
+        expires_at: expiresAt,
+        space_context: getSpaceContextFromStorage()
+    };
+    await exportDownloadCapabilityStore.put(record, KAIROS_EXPORT_DOWNLOAD_TTL_SEC);
+    return {
+        url: buildExportDownloadUrl(opaque, input.baseUrl),
+        expires_at: expiresAt,
+        filename: DEFAULT_EXPORT_SKILL_ZIP_FILENAME,
+        content_type: 'application/zip'
+    };
+}
+export async function verifyExportDownloadCapability(opaque) {
+    const [payloadB64, sig, extra] = opaque.split('.');
+    if (!payloadB64 || !sig || extra !== undefined)
+        return null;
+    if (!timingSafeEqualString(sign(payloadB64), sig))
+        return null;
+    let payload;
+    try {
+        payload = fromBase64UrlJson(payloadB64);
+    }
+    catch {
+        return null;
+    }
+    if (!payload.id || typeof payload.exp !== 'number')
+        return null;
+    if (payload.exp < Math.floor(Date.now() / 1000))
+        return null;
+    const record = await exportDownloadCapabilityStore.get(payload.id);
+    if (!record)
+        return null;
+    if (record.id !== payload.id)
+        return null;
+    if (Date.parse(record.expires_at) < Date.now())
+        return null;
+    return record;
+}
+//# sourceMappingURL=export-download-capability.js.map

package/dist/services/export-download-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-capability.js","sourceRoot":"","sources":["../../src/services/export-download-capability.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EACL,6BAA6B,EAE9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAwBxE,SAAS,WAAW,CAAC,KAAsB;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAa;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CAAC,UAAkB;IAC9B,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,6BAA6B,CAAC;SACnD,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,OAAO,GAAG,EAAE;IACjE,OAAO,GAAG,OAAO,IAAI,0BAA0B,EAAE,CAAC;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,8BAA8B,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,OAAO,GAA+B,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IACnD,MAAM,MAAM,GAAmC;QAC7C,EAAE;QACF,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;QAChD,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,0BAA0B,EAAE;KAC5C,CAAC;IACF,MAAM,6BAA6B,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,EAAE,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;QAClD,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,iBAAiB;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAc;IAEd,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAA6B,UAAU,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/forward-runtime-store.d.ts

@@ -0,0 +1,21 @@
+export interface ForwardExecutionMeta {
+    execution_id: string;
+    adapter_id: string;
+    adapter_uri: string;
+    activation_query?: string;
+    /** When forward started from an ambiguous slug URI, echoed on forward responses for this run. */
+    slug_disambiguation_note?: string;
+    merge_depth: number;
+    created_at: string;
+}
+export declare class ForwardRuntimeStore {
+    startExecution(meta: ForwardExecutionMeta): Promise<void>;
+    getExecution(executionId: string): Promise<ForwardExecutionMeta | null>;
+    setTensor(executionId: string, name: string, value: unknown): Promise<void>;
+    getTensor(executionId: string, name: string): Promise<unknown | null>;
+    getTensorInputs(executionId: string, names: string[]): Promise<Record<string, unknown>>;
+    requireTensorInputs(executionId: string, names: string[]): Promise<Record<string, unknown>>;
+    deleteExecution(executionId: string, tensorNames?: string[]): Promise<void>;
+}
+export declare const forwardRuntimeStore: ForwardRuntimeStore;
+//# sourceMappingURL=forward-runtime-store.d.ts.map

package/dist/services/forward-runtime-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-runtime-store.d.ts","sourceRoot":"","sources":["../../src/services/forward-runtime-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAUD,qBAAa,mBAAmB;IACxB,cAAc,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAIvE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3E,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAKrE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAWvF,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAS3F,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAYtF;AAED,eAAO,MAAM,mBAAmB,qBAA4B,CAAC"}

package/dist/services/forward-runtime-store.js

@@ -0,0 +1,58 @@
+import { keyValueStore } from './key-value-store-factory.js';
+import { logger } from '../utils/structured-logger.js';
+const DEFAULT_EXECUTION_TTL_SEC = 7 * 24 * 60 * 60;
+function metaKey(executionId) {
+    return `runtime:execution:${executionId}:meta`;
+}
+function tensorKey(executionId, tensorName) {
+    return `runtime:execution:${executionId}:tensor:${tensorName}`;
+}
+export class ForwardRuntimeStore {
+    async startExecution(meta) {
+        await keyValueStore.setJson(metaKey(meta.execution_id), meta, DEFAULT_EXECUTION_TTL_SEC);
+    }
+    async getExecution(executionId) {
+        return keyValueStore.getJson(metaKey(executionId));
+    }
+    async setTensor(executionId, name, value) {
+        if (!executionId || !name)
+            return;
+        await keyValueStore.setJson(tensorKey(executionId, name), value, DEFAULT_EXECUTION_TTL_SEC);
+    }
+    async getTensor(executionId, name) {
+        if (!executionId || !name)
+            return null;
+        return keyValueStore.getJson(tensorKey(executionId, name));
+    }
+    async getTensorInputs(executionId, names) {
+        const result = {};
+        for (const name of names) {
+            const value = await this.getTensor(executionId, name);
+            if (value !== null) {
+                result[name] = value;
+            }
+        }
+        return result;
+    }
+    async requireTensorInputs(executionId, names) {
+        const values = await this.getTensorInputs(executionId, names);
+        const missing = names.filter((name) => !(name in values));
+        if (missing.length > 0) {
+            throw new Error(`Missing required tensor inputs: ${missing.join(', ')}`);
+        }
+        return values;
+    }
+    async deleteExecution(executionId, tensorNames = []) {
+        try {
+            await keyValueStore.del(metaKey(executionId));
+            for (const name of tensorNames) {
+                await keyValueStore.del(tensorKey(executionId, name));
+            }
+        }
+        catch (error) {
+            logger.warn(`[ForwardRuntimeStore] Failed to delete execution ${executionId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+export const forwardRuntimeStore = new ForwardRuntimeStore();
+//# sourceMappingURL=forward-runtime-store.js.map

package/dist/services/forward-runtime-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-runtime-store.js","sourceRoot":"","sources":["../../src/services/forward-runtime-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAanD,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,qBAAqB,WAAW,OAAO,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,UAAkB;IACxD,OAAO,qBAAqB,WAAW,WAAW,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,cAAc,CAAC,IAA0B;QAC7C,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,OAAO,aAAa,CAAC,OAAO,CAAuB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAc;QAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;YAAE,OAAO;QAClC,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,IAAY;QAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,aAAa,CAAC,OAAO,CAAU,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,KAAe;QACxD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,KAAe;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,cAAwB,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oDAAoD,WAAW,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC"}

package/dist/services/id-generator.d.ts

@@ -0,0 +1,66 @@
+/**
+ * ID Generator Service for KAIROS
+ *
+ * Generates UUID-based identifiers for knowledge items.
+ * Uses URI-based UUIDv5 for deterministic Qdrant IDs where appropriate.
+*/
+export declare const KAIROS_NAMESPACE = "6f1d7e2b-8f7b-4b1e-9c8f-2f2f0b1a2e11";
+export declare class IDGenerator {
+    /**
+     * Generate a protocol ID for protocols
+     * This ID is shared across all steps in a protocol sequence
+     * Uses full UUID for native Qdrant support
+     *
+     * @returns RFC 4122 UUID v4 string
+     */
+    static generateProtocolId(): string;
+    /**
+     * Generate a deterministic protocol_id from domain/type/task combination
+     * This ensures the same domain/type/task always gets the same protocol_id
+     *
+     * @param domain - Knowledge domain
+     * @param type - Knowledge type
+     * @param task - Task identifier
+     * @returns Deterministic UUIDv5 string
+     */
+    static generateDeterministicProtocolId(domain: string, type: string, task: string): string;
+    /**
+    /**
+     * Generate a deterministic adapter UUID (v5) from a label
+     * Label is normalized (trim, collapse spaces, lower-case)
+     */
+    static generateAdapterUUIDv5(label: string): string;
+    /**
+     * Generate a UUID for unified protocol
+     * Used for kairos://UUID URIs in the unified store protocol
+     *
+     * @returns RFC 4122 UUID v4 string
+     */
+    static generateUUID(): string;
+    /**
+     * Build Qdrant ID from human-readable URI using deterministic UUIDv5
+     *
+     * This enables URI-based retrieval: given a URI, we can always regenerate
+     * the exact same Qdrant ID for direct lookup.
+     *
+     * @param humanUri - Full human-readable URI (e.g., "kairos://uuid" or older "kairos://ai/rule/coding-rules@lF5kZa9D/step/1")
+     * @returns Deterministic UUIDv5 string
+     *
+     * @example
+     * buildQdrantId("kairos://700468C5-2C80-4502-B60B-9A8C74044A35")
+     * // Returns: "700468C5-2C80-4502-B60B-9A8C74044A35" (direct UUID)
+     */
+    static buildQdrantId(humanUri: string): string;
+    /**
+     * Convert URI to Qdrant ID
+     * Supports both new {scheme}://UUID and older URI formats.
+     * Accepts kairos:// (canonical) and squadrules:// (alias) on input; the
+     * deterministic v5 hash is always computed from the canonical kairos:// form
+     * so stored Qdrant IDs stay stable regardless of the scheme the caller used.
+     *
+     * @param uri - Full URI string
+     * @returns UUID string for Qdrant operations
+     */
+    static qdrantIdFromUri(uri: string): string;
+}
+//# sourceMappingURL=id-generator.d.ts.map

package/dist/services/id-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-generator.d.ts","sourceRoot":"","sources":["../../src/services/id-generator.ts"],"names":[],"mappings":"AAAA;;;;;EAKE;AAOF,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AAEvE,qBAAa,WAAW;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB,IAAI,MAAM;IAInC;;;;;;;;OAQG;IACH,MAAM,CAAC,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAK1F;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKnD;;;;;OAKG;IACH,MAAM,CAAC,YAAY,IAAI,MAAM;IAI7B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;;;;;;OASG;IACH,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;CAsC9C"}

package/dist/services/id-generator.js

@@ -0,0 +1,112 @@
+/**
+ * ID Generator Service for KAIROS
+ *
+ * Generates UUID-based identifiers for knowledge items.
+ * Uses URI-based UUIDv5 for deterministic Qdrant IDs where appropriate.
+*/
+import { v5 as uuidv5, v4 as uuidv4 } from 'uuid';
+import { structuredLogger } from '../utils/structured-logger.js';
+// KAIROS namespace UUID for deterministic ID generation
+// Generate once and hardcode for deployment consistency
+export const KAIROS_NAMESPACE = '6f1d7e2b-8f7b-4b1e-9c8f-2f2f0b1a2e11';
+export class IDGenerator {
+    /**
+     * Generate a protocol ID for protocols
+     * This ID is shared across all steps in a protocol sequence
+     * Uses full UUID for native Qdrant support
+     *
+     * @returns RFC 4122 UUID v4 string
+     */
+    static generateProtocolId() {
+        return uuidv4();
+    }
+    /**
+     * Generate a deterministic protocol_id from domain/type/task combination
+     * This ensures the same domain/type/task always gets the same protocol_id
+     *
+     * @param domain - Knowledge domain
+     * @param type - Knowledge type
+     * @param task - Task identifier
+     * @returns Deterministic UUIDv5 string
+     */
+    static generateDeterministicProtocolId(domain, type, task) {
+        const input = `${domain}:${type}:${task}`;
+        return uuidv5(input, KAIROS_NAMESPACE);
+    }
+    /**
+    /**
+     * Generate a deterministic adapter UUID (v5) from a label
+     * Label is normalized (trim, collapse spaces, lower-case)
+     */
+    static generateAdapterUUIDv5(label) {
+        const normalized = (label || '').trim().replace(/\s+/g, ' ').toLowerCase();
+        return uuidv5(normalized, KAIROS_NAMESPACE);
+    }
+    /**
+     * Generate a UUID for unified protocol
+     * Used for kairos://UUID URIs in the unified store protocol
+     *
+     * @returns RFC 4122 UUID v4 string
+     */
+    static generateUUID() {
+        return crypto.randomUUID();
+    }
+    /**
+     * Build Qdrant ID from human-readable URI using deterministic UUIDv5
+     *
+     * This enables URI-based retrieval: given a URI, we can always regenerate
+     * the exact same Qdrant ID for direct lookup.
+     *
+     * @param humanUri - Full human-readable URI (e.g., "kairos://uuid" or older "kairos://ai/rule/coding-rules@lF5kZa9D/step/1")
+     * @returns Deterministic UUIDv5 string
+     *
+     * @example
+     * buildQdrantId("kairos://700468C5-2C80-4502-B60B-9A8C74044A35")
+     * // Returns: "700468C5-2C80-4502-B60B-9A8C74044A35" (direct UUID)
+     */
+    static buildQdrantId(humanUri) {
+        return uuidv5(humanUri, KAIROS_NAMESPACE);
+    }
+    /**
+     * Convert URI to Qdrant ID
+     * Supports both new {scheme}://UUID and older URI formats.
+     * Accepts kairos:// (canonical) and squadrules:// (alias) on input; the
+     * deterministic v5 hash is always computed from the canonical kairos:// form
+     * so stored Qdrant IDs stay stable regardless of the scheme the caller used.
+     *
+     * @param uri - Full URI string
+     * @returns UUID string for Qdrant operations
+     */
+    static qdrantIdFromUri(uri) {
+        structuredLogger.debug(`qdrantIdFromUri called with URI: ${uri}`);
+        // Canonicalize the alias scheme so v5 hashes match stored kairos:// IDs.
+        const canonicalUri = uri.replace(/^squadrules:\/\//i, 'kairos://');
+        const layerMatch = uri.match(/^(?:kairos|squadrules):\/\/layer\/([^/?#]+)/i);
+        if (layerMatch?.[1]) {
+            const id = layerMatch[1];
+            if (/^[0-9a-fA-F-]{32,36}$/.test(id)) {
+                return id;
+            }
+        }
+        const olderLayerRowPrefix = ['kairos', '://', 'me', 'm', '/'].join('');
+        if (uri.startsWith(olderLayerRowPrefix)) {
+            return uri.substring(olderLayerRowPrefix.length).split('?')[0].split('/')[0];
+        }
+        // {scheme}://{domain}/{type}/{task}/step/{step} (deterministic hashed id)
+        if (/^(?:kairos|squadrules):\/\//i.test(uri) && uri.includes('/step/')) {
+            return IDGenerator.buildQdrantId(canonicalUri);
+        }
+        // {scheme}://{uuid}
+        const simpleMatch = uri.match(/^(?:kairos|squadrules):\/\/([\s\S]*)$/i);
+        if (simpleMatch) {
+            const candidate = simpleMatch[1] ?? '';
+            // If it's a bare UUID, return it; otherwise, fall back to v5 hash of the canonical URI
+            if (/^[0-9a-fA-F-]{32,36}$/.test(candidate)) {
+                return candidate;
+            }
+            return IDGenerator.buildQdrantId(canonicalUri);
+        }
+        throw new Error(`Unsupported URI format: ${uri}`);
+    }
+}
+//# sourceMappingURL=id-generator.js.map

package/dist/services/id-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-generator.js","sourceRoot":"","sources":["../../src/services/id-generator.ts"],"names":[],"mappings":"AAAA;;;;;EAKE;AAEF,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,wDAAwD;AACxD,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEvE,MAAM,OAAO,WAAW;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,kBAAkB;QACrB,OAAO,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,+BAA+B,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;QAC7E,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAa;QACtC,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY;QACf,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAAC,QAAgB;QACjC,OAAO,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,eAAe,CAAC,GAAW;QAC9B,gBAAgB,CAAC,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAElE,yEAAyE;QACzE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC7E,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QACD,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnF,CAAC;QAED,0EAA0E;QAC1E,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrE,OAAO,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QAED,oBAAoB;QACpB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxE,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,uFAAuF;YACvF,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;CAGJ"}

package/dist/services/key-value-store-factory.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Single export for cache/proof-of-work key-value store.
+ * Uses networked KV backend when isRedisConfigured is true,
+ * in-memory when it is false.
+ */
+import type { IKeyValueStore } from './key-value-store.js';
+export declare const keyValueStore: IKeyValueStore;
+//# sourceMappingURL=key-value-store-factory.d.ts.map

package/dist/services/key-value-store-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-value-store-factory.d.ts","sourceRoot":"","sources":["../../src/services/key-value-store-factory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAW3D,eAAO,MAAM,aAAa,EAAE,cAAsC,CAAC"}

package/dist/services/key-value-store-factory.js

@@ -0,0 +1,16 @@
+/**
+ * Single export for cache/proof-of-work key-value store.
+ * Uses networked KV backend when isRedisConfigured is true,
+ * in-memory when it is false.
+ */
+import { isRedisConfigured } from '../config.js';
+import { MemoryStore } from './memory-store.js';
+import { RedisService } from './redis.js';
+function createKeyValueStore() {
+    if (!isRedisConfigured) {
+        return new MemoryStore();
+    }
+    return new RedisService();
+}
+export const keyValueStore = createKeyValueStore();
+//# sourceMappingURL=key-value-store-factory.js.map

package/dist/services/key-value-store-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-value-store-factory.js","sourceRoot":"","sources":["../../src/services/key-value-store-factory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,SAAS,mBAAmB;IAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,YAAY,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB,mBAAmB,EAAE,CAAC"}