@squadrules/mcp 4.8.6

package/dist/cli/safe-http-url.js

@@ -0,0 +1,28 @@
+/**
+ * Restrict outbound CLI URLs to http(s) without embedded credentials, query, or fragment.
+ * Used before fetch() for API base and IdP endpoints from metadata.
+ * (Unlike normalizeAndValidateApiBaseUrl in upload-guards.ts, this does not apply TRUSTED_API_HOSTS.)
+ */
+/** @returns Normalized absolute URL string (no trailing slash), or null if invalid. */
+export function tryNormalizeHttpUrlForFetch(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    let u;
+    try {
+        u = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (u.username !== '' || u.password !== '')
+        return null;
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        return null;
+    if (u.search !== '' || u.hash !== '')
+        return null;
+    return u.href.replace(/\/$/, '');
+}
+//# sourceMappingURL=safe-http-url.js.map

package/dist/cli/safe-http-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-http-url.js","sourceRoot":"","sources":["../../src/cli/safe-http-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CAAC,GAA8B;IACtE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACD,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/cli/skill-zip-local-write.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Path and size checks for `skill_zip` CLI downloads. Same trust model as other `export` formats:
+ * the CLI already emits API-returned markdown (and users redirect to files); ZIP is persisted via
+ * `--zip-out` or a default basename under cwd after the same authenticated export flow.
+ */
+/**
+ * Accept only a single path segment like `my-export.zip` from server hints (Content-Disposition /
+ * JSON). Rejects separators, odd characters, and long names.
+ */
+export declare function safeZipBasenameFromRemoteHint(name: string | undefined): string | null;
+/**
+ * Output path: explicit `--zip-out` (user-controlled), else `cwd/<sanitized remote basename or default>`.
+ */
+export declare function resolveSkillZipOutputPath(zipOut: string | undefined, hints: {
+    downloadBasename?: string;
+    refBasename?: string;
+}): string;
+/** Reject non-ZIP payloads and oversized downloads before writing bytes from the network to disk. */
+export declare function assertSkillZipBufferAllowedForDiskWrite(data: Buffer): void;
+/** Write validated ZIP bytes after export (download_ref GET or inline base64 decode). */
+export declare function writeExportedSkillZipToFile(outputPath: string, source: Buffer): void;
+//# sourceMappingURL=skill-zip-local-write.d.ts.map

package/dist/cli/skill-zip-local-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-zip-local-write.d.ts","sourceRoot":"","sources":["../../src/cli/skill-zip-local-write.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CASrF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,MAAM,CASR;AAED,qGAAqG;AACrG,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAc1E;AAED,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAGpF"}

package/dist/cli/skill-zip-local-write.js

@@ -0,0 +1,69 @@
+/**
+ * Path and size checks for `skill_zip` CLI downloads. Same trust model as other `export` formats:
+ * the CLI already emits API-returned markdown (and users redirect to files); ZIP is persisted via
+ * `--zip-out` or a default basename under cwd after the same authenticated export flow.
+ */
+import { writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { DEFAULT_EXPORT_SKILL_ZIP_FILENAME } from '../config/export-zip-settings.js';
+const DEFAULT_MAX_SKILL_ZIP_BYTES = 512 * 1024 * 1024;
+function parsePositiveInt(raw, fallback) {
+    if (raw === undefined || String(raw).trim() === '')
+        return fallback;
+    const n = parseInt(String(raw).trim(), 10);
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+function maxSkillZipDownloadBytes() {
+    return parsePositiveInt(process.env['KAIROS_EXPORT_ZIP_MAX_DOWNLOAD_BYTES'], DEFAULT_MAX_SKILL_ZIP_BYTES);
+}
+/**
+ * Accept only a single path segment like `my-export.zip` from server hints (Content-Disposition /
+ * JSON). Rejects separators, odd characters, and long names.
+ */
+export function safeZipBasenameFromRemoteHint(name) {
+    if (name === undefined || name === null)
+        return null;
+    const s = String(name).trim();
+    if (s.length === 0)
+        return null;
+    const base = path.basename(s.replace(/\\/g, '/'));
+    if (!base || base === '.' || base === '..')
+        return null;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*\.zip$/i.test(base))
+        return null;
+    if (base.length > 200)
+        return null;
+    return base;
+}
+/**
+ * Output path: explicit `--zip-out` (user-controlled), else `cwd/<sanitized remote basename or default>`.
+ */
+export function resolveSkillZipOutputPath(zipOut, hints) {
+    if (zipOut !== undefined && zipOut.trim().length > 0) {
+        return path.resolve(process.cwd(), zipOut.trim());
+    }
+    const remote = safeZipBasenameFromRemoteHint(hints.downloadBasename) ??
+        safeZipBasenameFromRemoteHint(hints.refBasename);
+    const base = remote ?? DEFAULT_EXPORT_SKILL_ZIP_FILENAME;
+    return path.join(process.cwd(), base);
+}
+/** Reject non-ZIP payloads and oversized downloads before writing bytes from the network to disk. */
+export function assertSkillZipBufferAllowedForDiskWrite(data) {
+    const max = maxSkillZipDownloadBytes();
+    if (data.length === 0) {
+        throw new Error('Export ZIP download was empty.');
+    }
+    if (data.length > max) {
+        throw new Error(`Export ZIP download exceeds configured maximum (${max} bytes); set KAIROS_EXPORT_ZIP_MAX_DOWNLOAD_BYTES to raise the cap.`);
+    }
+    const pk = data[0] === 0x50 && data[1] === 0x4b;
+    if (!pk) {
+        throw new Error('Export download did not look like a ZIP file (missing PK signature).');
+    }
+}
+/** Write validated ZIP bytes after export (download_ref GET or inline base64 decode). */
+export function writeExportedSkillZipToFile(outputPath, source) {
+    assertSkillZipBufferAllowedForDiskWrite(source);
+    writeFileSync(outputPath, source);
+}
+//# sourceMappingURL=skill-zip-local-write.js.map

package/dist/cli/skill-zip-local-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-zip-local-write.js","sourceRoot":"","sources":["../../src/cli/skill-zip-local-write.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAErF,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACpE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC5G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAwB;IACpE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA0B,EAC1B,KAA0D;IAE1D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GACV,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrD,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,IAAI,iCAAiC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,uCAAuC,CAAC,IAAY;IAClE,MAAM,GAAG,GAAG,wBAAwB,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,qEAAqE,CAC5H,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAChD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,MAAc;IAC5E,uCAAuC,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/cli/upload-guards.d.ts

@@ -0,0 +1,7 @@
+export type SafeMarkdownUpload = string & {
+    readonly __safeMarkdownUpload: unique symbol;
+};
+export declare function readMarkdownUploadFromFile(absPath: string, mode: 'train' | 'tune', allowSensitiveUpload?: boolean): SafeMarkdownUpload;
+export declare function prepareMarkdownUploadForMode(markdown: string, mode: 'train' | 'tune', allowSensitiveUpload?: boolean): SafeMarkdownUpload;
+export declare function normalizeAndValidateApiBaseUrl(rawUrl: string): string;
+//# sourceMappingURL=upload-guards.d.ts.map

package/dist/cli/upload-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-guards.d.ts","sourceRoot":"","sources":["../../src/cli/upload-guards.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AA2D3F,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,GAAG,MAAM,EACtB,oBAAoB,UAAQ,GAC3B,kBAAkB,CAUpB;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,GAAG,MAAM,EACtB,oBAAoB,UAAQ,GAC3B,kBAAkB,CAEpB;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBrE"}

package/dist/cli/upload-guards.js

@@ -0,0 +1,96 @@
+import { closeSync, fstatSync, openSync, readFileSync } from 'fs';
+import { validateProtocolStructure } from '../services/memory/validate-protocol-structure.js';
+import { normalizeMarkdownBlob } from '../utils/memory-store-utils.js';
+const DEFAULT_MAX_MARKDOWN_UPLOAD_BYTES = 512 * 1024;
+const SENSITIVE_CONTENT_OVERRIDE_ENV = 'KAIROS_ALLOW_SENSITIVE_UPLOADS';
+const TRUSTED_HOSTS_ENV = 'KAIROS_TRUSTED_API_HOSTS';
+function markdownUploadByteLimit() {
+    const raw = process.env['KAIROS_CLI_MAX_MARKDOWN_BYTES'];
+    if (!raw)
+        return DEFAULT_MAX_MARKDOWN_UPLOAD_BYTES;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_MARKDOWN_UPLOAD_BYTES;
+}
+function isLikelyBinaryText(text) {
+    return text.includes('\u0000');
+}
+function detectSensitiveContent(text) {
+    if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/.test(text))
+        return 'private key material';
+    if (/\bBearer\s+[A-Za-z0-9._-]{20,}\b/i.test(text))
+        return 'bearer token material';
+    if (/\bxox[baprs]-[A-Za-z0-9-]{20,}\b/.test(text))
+        return 'bot or service token material';
+    if (/\bgh[opsu]_[A-Za-z0-9]{20,}\b/.test(text))
+        return 'GitHub token material';
+    return null;
+}
+function sensitiveContentAllowed(allowSensitiveUpload = false) {
+    return allowSensitiveUpload || process.env[SENSITIVE_CONTENT_OVERRIDE_ENV] === 'true';
+}
+function prepareMarkdownUpload(markdown, mode, allowSensitiveUpload = false) {
+    const normalized = normalizeMarkdownBlob(markdown).replace(/\r\n/g, '\n');
+    const trimmed = normalized.trim();
+    if (!trimmed) {
+        throw new Error('Markdown upload is empty');
+    }
+    if (isLikelyBinaryText(normalized)) {
+        throw new Error('Markdown upload contains binary content');
+    }
+    const bytes = Buffer.byteLength(normalized, 'utf8');
+    if (bytes > markdownUploadByteLimit()) {
+        throw new Error(`Markdown upload exceeds ${markdownUploadByteLimit()} bytes`);
+    }
+    const sensitiveFinding = detectSensitiveContent(normalized);
+    if (sensitiveFinding && !sensitiveContentAllowed(allowSensitiveUpload)) {
+        throw new Error(`Refusing to upload markdown containing ${sensitiveFinding}. Set ${SENSITIVE_CONTENT_OVERRIDE_ENV}=true or use the command override to continue.`);
+    }
+    if (mode === 'train') {
+        const validation = validateProtocolStructure(normalized);
+        if (!validation.valid)
+            throw new Error(validation.message);
+    }
+    return normalized;
+}
+export function readMarkdownUploadFromFile(absPath, mode, allowSensitiveUpload = false) {
+    const fd = openSync(absPath, 'r');
+    try {
+        if (!fstatSync(fd).isFile()) {
+            throw Object.assign(new Error('Path is not a regular file'), { code: 'ENOTREG' });
+        }
+        return prepareMarkdownUpload(readFileSync(fd, 'utf-8'), mode, allowSensitiveUpload);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function prepareMarkdownUploadForMode(markdown, mode, allowSensitiveUpload = false) {
+    return prepareMarkdownUpload(markdown, mode, allowSensitiveUpload);
+}
+export function normalizeAndValidateApiBaseUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid API base URL: ${rawUrl}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Unsupported API base URL protocol: ${parsed.protocol}`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error('API base URL must not include credentials');
+    }
+    if (parsed.search || parsed.hash) {
+        throw new Error('API base URL must not include query or fragment');
+    }
+    const trustedHosts = (process.env[TRUSTED_HOSTS_ENV] || '')
+        .split(',')
+        .map((item) => item.trim().toLowerCase())
+        .filter(Boolean);
+    if (trustedHosts.length > 0 && !trustedHosts.includes(parsed.hostname.toLowerCase())) {
+        throw new Error(`API base URL host is not in ${TRUSTED_HOSTS_ENV}`);
+    }
+    return parsed.toString().replace(/\/$/, '');
+}
+//# sourceMappingURL=upload-guards.js.map

package/dist/cli/upload-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-guards.js","sourceRoot":"","sources":["../../src/cli/upload-guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE,MAAM,iCAAiC,GAAG,GAAG,GAAG,IAAI,CAAC;AACrD,MAAM,8BAA8B,GAAG,gCAAgC,CAAC;AACxE,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,iCAAiC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iCAAiC,CAAC;AAC5F,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACtF,IAAI,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACnF,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC1F,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,oBAAoB,GAAG,KAAK;IAC3D,OAAO,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,KAAK,MAAM,CAAC;AACxF,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,IAAsB,EACtB,oBAAoB,GAAG,KAAK;IAE5B,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,uBAAuB,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2BAA2B,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,gBAAgB,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,SAAS,8BAA8B,gDAAgD,CAClJ,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,UAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,IAAsB,EACtB,oBAAoB,GAAG,KAAK;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAW,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,IAAsB,EACtB,oBAAoB,GAAG,KAAK;IAE5B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACxC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,+BAA+B,iBAAiB,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/config/adapter-markdown-size-limits.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Env-driven limits for adapter Markdown / artifact size (train, tune, update).
+ * Kept out of `config.ts` to satisfy max-lines.
+ *
+ * Each `KAIROS_ADAPTER_MARKDOWN_*` variable has a `SQUADRULES_ADAPTER_MARKDOWN_*`
+ * alias. Precedence and empty-string semantics live in `./env-alias.js` (the new
+ * key wins when defined, even as `''`; otherwise the KAIROS_* key; otherwise the
+ * default). Values are re-read on each call so tests / env overrides apply
+ * without a restart.
+ */
+export interface AdapterMarkdownSizeLimits {
+    maxLines: number;
+    maxLineBytes: number;
+    safetyFactor: number;
+    /** `ceil(max_lines × max_line_bytes × safety_factor)` — total UTF-8 document ceiling. */
+    maxTotalBytes: number;
+}
+/** Read on each call so tests and env overrides apply without restart. */
+export declare function getAdapterMarkdownSizeLimits(): AdapterMarkdownSizeLimits;
+//# sourceMappingURL=adapter-markdown-size-limits.d.ts.map

package/dist/config/adapter-markdown-size-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-markdown-size-limits.d.ts","sourceRoot":"","sources":["../../src/config/adapter-markdown-size-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,IAAI,yBAAyB,CAwBxE"}

package/dist/config/adapter-markdown-size-limits.js

@@ -0,0 +1,26 @@
+/**
+ * Env-driven limits for adapter Markdown / artifact size (train, tune, update).
+ * Kept out of `config.ts` to satisfy max-lines.
+ *
+ * Each `KAIROS_ADAPTER_MARKDOWN_*` variable has a `SQUADRULES_ADAPTER_MARKDOWN_*`
+ * alias. Precedence and empty-string semantics live in `./env-alias.js` (the new
+ * key wins when defined, even as `''`; otherwise the KAIROS_* key; otherwise the
+ * default). Values are re-read on each call so tests / env overrides apply
+ * without a restart.
+ */
+import { getEnvIntAliased, getEnvFloatAliased, logDeprecations } from './env-alias.js';
+/** Read on each call so tests and env overrides apply without restart. */
+export function getAdapterMarkdownSizeLimits() {
+    const maxLines = getEnvIntAliased('SQUADRULES_ADAPTER_MARKDOWN_MAX_LINES', 'KAIROS_ADAPTER_MARKDOWN_MAX_LINES', 350);
+    const maxLineBytes = getEnvIntAliased('SQUADRULES_ADAPTER_MARKDOWN_MAX_LINE_BYTES', 'KAIROS_ADAPTER_MARKDOWN_MAX_LINE_BYTES', 8192);
+    const raw = getEnvFloatAliased('SQUADRULES_ADAPTER_MARKDOWN_SIZE_SAFETY_FACTOR', 'KAIROS_ADAPTER_MARKDOWN_SIZE_SAFETY_FACTOR', 1.15);
+    const safetyFactor = raw >= 1 && Number.isFinite(raw) ? raw : 1.15;
+    logDeprecations();
+    return {
+        maxLines,
+        maxLineBytes,
+        safetyFactor,
+        maxTotalBytes: Math.ceil(maxLines * maxLineBytes * safetyFactor)
+    };
+}
+//# sourceMappingURL=adapter-markdown-size-limits.js.map

package/dist/config/adapter-markdown-size-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-markdown-size-limits.js","sourceRoot":"","sources":["../../src/config/adapter-markdown-size-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAUxB,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,uCAAuC,EACvC,mCAAmC,EACnC,GAAG,CACJ,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CACnC,4CAA4C,EAC5C,wCAAwC,EACxC,IAAI,CACL,CAAC;IACF,MAAM,GAAG,GAAG,kBAAkB,CAC5B,gDAAgD,EAChD,4CAA4C,EAC5C,IAAI,CACL,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,eAAe,EAAE,CAAC;IAClB,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/config/env-alias.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Env-var alias infrastructure for the KAIROS → SquadRules rebrand.
+ *
+ * Every `KAIROS_*` environment variable gains a `SQUADRULES_*` alias. This
+ * module centralizes the resolution + precedence rules and the one-time
+ * deprecation warning so the semantics stay identical everywhere.
+ *
+ * ## Precedence (explicit, NOT `new || old || default`)
+ * The raw value is chosen by *definition*, not by truthiness:
+ *   1. If `process.env[newKey] !== undefined` (even when it is `''`), it wins.
+ *   2. Else if `process.env[oldKey] !== undefined`, the KAIROS_* value is used
+ *      and that key is recorded for the deprecation notice.
+ *   3. Else the value is `undefined`.
+ *
+ * ## Empty-string handling
+ * The *parsing* step after resolution preserves each original helper's exact
+ * semantics, so behavior never changes silently:
+ *   - String helper: `resolved || default` — an explicitly-empty value still
+ *     falls through to the default, exactly like the original `getEnvString`.
+ *   - Int / float / boolean helpers: `undefined` → default; a defined value is
+ *     parsed with the same rules as before.
+ *
+ * Because precedence is decided by `!== undefined`, setting `SQUADRULES_X=''`
+ * intentionally shadows `KAIROS_X` (the KAIROS_* key is then ignored and NOT
+ * reported as used) even though the empty value still resolves to the default
+ * through the string helper's `||`.
+ */
+/**
+ * Resolve the raw environment value for an aliased pair.
+ *
+ * @returns the value of `newKey` when it is defined (including `''`),
+ *   otherwise the value of `oldKey` when defined, otherwise `undefined`.
+ *   When the KAIROS_* key supplies the value, it is recorded for deprecation.
+ */
+export declare function resolveAliasedRaw(newKey: string, oldKey: string): string | undefined;
+/** String variant: mirrors the original `process.env[key] || defaultValue`. */
+export declare function getEnvAliased(newKey: string, oldKey: string, defaultValue: string): string;
+/** Integer variant: `undefined` → default; otherwise `parseInt`, NaN → default. */
+export declare function getEnvIntAliased(newKey: string, oldKey: string, defaultValue: number): number;
+/** Float variant: `undefined` → default; otherwise `parseFloat`, NaN → default. */
+export declare function getEnvFloatAliased(newKey: string, oldKey: string, defaultValue: number): number;
+/** Boolean variant: same accepted tokens as the original `getEnvBoolean`. */
+export declare function getEnvBooleanAliased(newKey: string, oldKey: string, defaultValue: boolean): boolean;
+/**
+ * Emit a single consolidated deprecation notice listing every KAIROS_* variable
+ * that was actually used while its `SQUADRULES_*` alias was unset. Idempotent:
+ * safe to call from multiple modules / repeated reads; logs at most once per
+ * process.
+ */
+export declare function logDeprecations(): void;
+/**
+ * Test/reset hook: clears recorded usage and the once-guard so the deprecation
+ * notice can be exercised again. Not used at runtime.
+ */
+export declare function __resetEnvAliasStateForTests(): void;
+//# sourceMappingURL=env-alias.d.ts.map

package/dist/config/env-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-alias.d.ts","sourceRoot":"","sources":["../../src/config/env-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASpF;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAG1F;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAK7F;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAK/F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAOnG;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,IAAI,CActC;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAGnD"}

package/dist/config/env-alias.js

@@ -0,0 +1,112 @@
+/**
+ * Env-var alias infrastructure for the KAIROS → SquadRules rebrand.
+ *
+ * Every `KAIROS_*` environment variable gains a `SQUADRULES_*` alias. This
+ * module centralizes the resolution + precedence rules and the one-time
+ * deprecation warning so the semantics stay identical everywhere.
+ *
+ * ## Precedence (explicit, NOT `new || old || default`)
+ * The raw value is chosen by *definition*, not by truthiness:
+ *   1. If `process.env[newKey] !== undefined` (even when it is `''`), it wins.
+ *   2. Else if `process.env[oldKey] !== undefined`, the KAIROS_* value is used
+ *      and that key is recorded for the deprecation notice.
+ *   3. Else the value is `undefined`.
+ *
+ * ## Empty-string handling
+ * The *parsing* step after resolution preserves each original helper's exact
+ * semantics, so behavior never changes silently:
+ *   - String helper: `resolved || default` — an explicitly-empty value still
+ *     falls through to the default, exactly like the original `getEnvString`.
+ *   - Int / float / boolean helpers: `undefined` → default; a defined value is
+ *     parsed with the same rules as before.
+ *
+ * Because precedence is decided by `!== undefined`, setting `SQUADRULES_X=''`
+ * intentionally shadows `KAIROS_X` (the KAIROS_* key is then ignored and NOT
+ * reported as used) even though the empty value still resolves to the default
+ * through the string helper's `||`.
+ */
+/** KAIROS_* keys that were actually consulted (their alias was unset). */
+const oldKeysUsed = new Set();
+/**
+ * Resolve the raw environment value for an aliased pair.
+ *
+ * @returns the value of `newKey` when it is defined (including `''`),
+ *   otherwise the value of `oldKey` when defined, otherwise `undefined`.
+ *   When the KAIROS_* key supplies the value, it is recorded for deprecation.
+ */
+export function resolveAliasedRaw(newKey, oldKey) {
+    const next = process.env[newKey];
+    if (next !== undefined)
+        return next;
+    const prior = process.env[oldKey];
+    if (prior !== undefined) {
+        oldKeysUsed.add(oldKey);
+        return prior;
+    }
+    return undefined;
+}
+/** String variant: mirrors the original `process.env[key] || defaultValue`. */
+export function getEnvAliased(newKey, oldKey, defaultValue) {
+    const raw = resolveAliasedRaw(newKey, oldKey);
+    return raw || defaultValue;
+}
+/** Integer variant: `undefined` → default; otherwise `parseInt`, NaN → default. */
+export function getEnvIntAliased(newKey, oldKey, defaultValue) {
+    const raw = resolveAliasedRaw(newKey, oldKey);
+    if (raw === undefined)
+        return defaultValue;
+    const parsed = parseInt(raw, 10);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+/** Float variant: `undefined` → default; otherwise `parseFloat`, NaN → default. */
+export function getEnvFloatAliased(newKey, oldKey, defaultValue) {
+    const raw = resolveAliasedRaw(newKey, oldKey);
+    if (raw === undefined)
+        return defaultValue;
+    const parsed = parseFloat(raw);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+/** Boolean variant: same accepted tokens as the original `getEnvBoolean`. */
+export function getEnvBooleanAliased(newKey, oldKey, defaultValue) {
+    const raw = resolveAliasedRaw(newKey, oldKey);
+    if (raw === undefined)
+        return defaultValue;
+    const low = String(raw).trim().toLowerCase();
+    if (low === 'false' || low === '0' || low === 'no' || low === 'n')
+        return false;
+    if (low === 'true' || low === '1' || low === 'yes' || low === 'y')
+        return true;
+    return defaultValue;
+}
+let deprecationLogged = false;
+/**
+ * Emit a single consolidated deprecation notice listing every KAIROS_* variable
+ * that was actually used while its `SQUADRULES_*` alias was unset. Idempotent:
+ * safe to call from multiple modules / repeated reads; logs at most once per
+ * process.
+ */
+export function logDeprecations() {
+    if (deprecationLogged)
+        return;
+    deprecationLogged = true;
+    if (oldKeysUsed.size === 0)
+        return;
+    const keys = [...oldKeysUsed].sort();
+    const mapping = keys.map((k) => `${k} → ${k.replace(/^KAIROS_/, 'SQUADRULES_')}`).join(', ');
+    const message = `[SquadRules] DEPRECATION: older KAIROS_* environment variable(s) in use: ` +
+        `${keys.join(', ')}. Please migrate to the SQUADRULES_* equivalent(s): ${mapping}. ` +
+        `The KAIROS_* names keep working for now but will be removed in a future release.\n`;
+    // Written to stderr (never stdout) so the warning cannot corrupt the stdio
+    // MCP JSON-RPC channel. The structured logger imports config.js, so using it
+    // here would create a circular import; stderr keeps this module dependency-free.
+    process.stderr.write(message);
+}
+/**
+ * Test/reset hook: clears recorded usage and the once-guard so the deprecation
+ * notice can be exercised again. Not used at runtime.
+ */
+export function __resetEnvAliasStateForTests() {
+    oldKeysUsed.clear();
+    deprecationLogged = false;
+}
+//# sourceMappingURL=env-alias.js.map

package/dist/config/env-alias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-alias.js","sourceRoot":"","sources":["../../src/config/env-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc,EAAE,YAAoB;IAChF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,GAAG,IAAI,YAAY,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc,EAAE,YAAoB;IACnF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc,EAAE,YAAoB;IACrF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc,EAAE,YAAqB;IACxF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,MAAM,OAAO,GACX,2EAA2E;QAC3E,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,OAAO,IAAI;QACpF,oFAAoF,CAAC;IACvF,2EAA2E;IAC3E,6EAA6E;IAC7E,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC"}

package/dist/config/export-download-settings.d.ts

@@ -0,0 +1,4 @@
+export declare const KAIROS_EXPORT_DOWNLOAD_SECRET: string;
+export declare const KAIROS_EXPORT_DOWNLOAD_TTL_SEC: number;
+export declare function resolvePublicExportBaseUrl(): string;
+//# sourceMappingURL=export-download-settings.d.ts.map

package/dist/config/export-download-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-settings.d.ts","sourceRoot":"","sources":["../../src/config/export-download-settings.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,6BAA6B,QAIzC,CAAC;AAEF,eAAO,MAAM,8BAA8B,QAI1C,CAAC;AAEF,wBAAgB,0BAA0B,IAAI,MAAM,CAOnD"}

package/dist/config/export-download-settings.js

@@ -0,0 +1,45 @@
+import { randomBytes } from 'crypto';
+import { resolveAliasedRaw, logDeprecations } from './env-alias.js';
+const PROCESS_LOCAL_EXPORT_DOWNLOAD_SECRET = randomBytes(32).toString('hex');
+function envString(key, defaultValue) {
+    const value = process.env[key];
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : defaultValue;
+}
+function envInt(key, defaultValue) {
+    const value = process.env[key];
+    if (value === undefined || String(value).trim() === '')
+        return defaultValue;
+    const parsed = parseInt(String(value).trim(), 10);
+    return Number.isFinite(parsed) ? parsed : defaultValue;
+}
+/**
+ * Alias-aware string read. Keeps the exact `envString` parsing semantics
+ * (trim; whitespace-only → default) while adding `SQUADRULES_*` precedence over
+ * the older `KAIROS_*` name. See `./env-alias.js`.
+ */
+function envStringAliased(newKey, oldKey, defaultValue) {
+    const value = resolveAliasedRaw(newKey, oldKey);
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : defaultValue;
+}
+/** Alias-aware int read; keeps the exact `envInt` parsing semantics. */
+function envIntAliased(newKey, oldKey, defaultValue) {
+    const value = resolveAliasedRaw(newKey, oldKey);
+    if (value === undefined || String(value).trim() === '')
+        return defaultValue;
+    const parsed = parseInt(String(value).trim(), 10);
+    return Number.isFinite(parsed) ? parsed : defaultValue;
+}
+export const KAIROS_EXPORT_DOWNLOAD_SECRET = envStringAliased('SQUADRULES_EXPORT_DOWNLOAD_SECRET', 'KAIROS_EXPORT_DOWNLOAD_SECRET', envString('SESSION_SECRET', PROCESS_LOCAL_EXPORT_DOWNLOAD_SECRET));
+export const KAIROS_EXPORT_DOWNLOAD_TTL_SEC = envIntAliased('SQUADRULES_EXPORT_DOWNLOAD_TTL_SEC', 'KAIROS_EXPORT_DOWNLOAD_TTL_SEC', 600);
+export function resolvePublicExportBaseUrl() {
+    const explicit = envStringAliased('SQUADRULES_PUBLIC_BASE_URL', 'KAIROS_PUBLIC_BASE_URL', '');
+    logDeprecations();
+    if (explicit)
+        return explicit.replace(/\/$/, '');
+    const authCallback = envString('AUTH_CALLBACK_BASE_URL', '');
+    if (authCallback)
+        return authCallback.replace(/\/$/, '');
+    return `http://localhost:${envInt('PORT', 3000)}`;
+}
+logDeprecations();
+//# sourceMappingURL=export-download-settings.js.map

package/dist/config/export-download-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-download-settings.js","sourceRoot":"","sources":["../../src/config/export-download-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEpE,MAAM,oCAAoC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE7E,SAAS,SAAS,CAAC,GAAW,EAAE,YAAoB;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5F,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,YAAoB;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc,EAAE,YAAoB;IAC5E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5F,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc,EAAE,YAAoB;IACzE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAC3D,mCAAmC,EACnC,+BAA+B,EAC/B,SAAS,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAClE,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,aAAa,CACzD,oCAAoC,EACpC,gCAAgC,EAChC,GAAG,CACJ,CAAC;AAEF,MAAM,UAAU,0BAA0B;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,4BAA4B,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAC9F,eAAe,EAAE,CAAC;IAClB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,SAAS,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,oBAAoB,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,eAAe,EAAE,CAAC"}

package/dist/config/export-zip-settings.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Skill ZIP (`skill_zip`) zlib settings. Read on each call so env overrides apply without restart.
+ */
+/** zlib default: good size vs CPU balance for text-heavy skill bundles (same family as many zip tools’ default). */
+export declare const DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL = 6;
+/** Stable default filename for skill ZIP HTTP downloads. */
+export declare const DEFAULT_EXPORT_SKILL_ZIP_FILENAME = "kairos-skills-export.zip";
+/**
+ * Zlib compression level for **`skill_zip`** archives: **0** = store only (fastest, larger files),
+ * **9** = maximum compression (slowest). Default **{@link DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL}**.
+ *
+ * Env: **`KAIROS_EXPORT_ZIP_COMPRESSION_LEVEL`** (alias
+ * **`SQUADRULES_EXPORT_ZIP_COMPRESSION_LEVEL`**) — integer **0–9**; invalid/missing → default.
+ */
+export declare function getExportZipCompressionLevel(): number;
+//# sourceMappingURL=export-zip-settings.d.ts.map

package/dist/config/export-zip-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-zip-settings.d.ts","sourceRoot":"","sources":["../../src/config/export-zip-settings.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,oHAAoH;AACpH,eAAO,MAAM,oCAAoC,IAAI,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,iCAAiC,6BAA6B,CAAC;AAE5E;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,CAcrD"}

package/dist/config/export-zip-settings.js

@@ -0,0 +1,28 @@
+/**
+ * Skill ZIP (`skill_zip`) zlib settings. Read on each call so env overrides apply without restart.
+ */
+import { resolveAliasedRaw, logDeprecations } from './env-alias.js';
+/** zlib default: good size vs CPU balance for text-heavy skill bundles (same family as many zip tools’ default). */
+export const DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL = 6;
+/** Stable default filename for skill ZIP HTTP downloads. */
+export const DEFAULT_EXPORT_SKILL_ZIP_FILENAME = 'kairos-skills-export.zip';
+/**
+ * Zlib compression level for **`skill_zip`** archives: **0** = store only (fastest, larger files),
+ * **9** = maximum compression (slowest). Default **{@link DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL}**.
+ *
+ * Env: **`KAIROS_EXPORT_ZIP_COMPRESSION_LEVEL`** (alias
+ * **`SQUADRULES_EXPORT_ZIP_COMPRESSION_LEVEL`**) — integer **0–9**; invalid/missing → default.
+ */
+export function getExportZipCompressionLevel() {
+    const raw = resolveAliasedRaw('SQUADRULES_EXPORT_ZIP_COMPRESSION_LEVEL', 'KAIROS_EXPORT_ZIP_COMPRESSION_LEVEL');
+    logDeprecations();
+    if (raw === undefined || String(raw).trim() === '') {
+        return DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL;
+    }
+    const parsed = parseInt(String(raw).trim(), 10);
+    if (isNaN(parsed)) {
+        return DEFAULT_EXPORT_ZIP_COMPRESSION_LEVEL;
+    }
+    return Math.min(9, Math.max(0, parsed));
+}
+//# sourceMappingURL=export-zip-settings.js.map

package/dist/config/export-zip-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-zip-settings.js","sourceRoot":"","sources":["../../src/config/export-zip-settings.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEpE,oHAAoH;AACpH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iCAAiC,GAAG,0BAA0B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,iBAAiB,CAC3B,yCAAyC,EACzC,qCAAqC,CACtC,CAAC;IACF,eAAe,EAAE,CAAC;IAClB,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClB,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1C,CAAC"}