@squadrules/mcp 5.15.1 → 5.17.0

package/dist/resources/embedded-mcp-resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"embedded-mcp-resources.js","sourceRoot":"","sources":["../../src/resources/embedded-mcp-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,EAAE;IACb,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,EAAE;IACf,OAAO,EAAE;QACP,UAAU,EAAE,mrMAAmrM;QAC/rM,QAAQ,EAAE,qeAAqe;QAC/e,QAAQ,EAAE,4hNAA4hN;QACtiN,SAAS,EAAE,w+QAAw+Q;QACn/Q,QAAQ,EAAE,q3CAAq3C;QAC/3C,QAAQ,EAAE,45DAA45D;QACt6D,OAAO,EAAE,kwKAAkwK;QAC3wK,MAAM,EAAE,uvDAAuvD;KAChwD;IACD,KAAK,EAAE,EAAE;IACT,MAAM,EAAE;QACN,mBAAmB,EAAE,8yTAA8yT;QACn0T,gBAAgB,EAAE,infAAinf;QACnof,8BAA8B,EAAE,q7PAAq7P;QACr9P,sBAAsB,EAAE,w7ZAAw7Z;QACh9Z,mBAAmB,EAAE,uofAAuof;QAC5pf,aAAa,EAAE,0+XAA0+X;QACz/X,wBAAwB,EAAE,ogQAAogQ;QAC9hQ,eAAe,EAAE,kyEAAkyE;KACpzE;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM;IACpB,OAAO,YAAY,CAAC,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;IACvE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAwB,CAAC;IACxE,IAAI,OAAO,GAAQ,SAAS,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAC3E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAA2B,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAExF,qCAAqC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,EAAE,OAAiB,EAAE;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"embedded-mcp-resources.js","sourceRoot":"","sources":["../../src/resources/embedded-mcp-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,EAAE;IACb,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,EAAE;IACf,OAAO,EAAE;QACP,UAAU,EAAE,y1MAAy1M;QACr2M,QAAQ,EAAE,qeAAqe;QAC/e,QAAQ,EAAE,4rNAA4rN;QACtsN,SAAS,EAAE,+hRAA+hR;QAC1iR,QAAQ,EAAE,q3CAAq3C;QAC/3C,QAAQ,EAAE,45DAA45D;QACt6D,OAAO,EAAE,kwKAAkwK;QAC3wK,MAAM,EAAE,uvDAAuvD;KAChwD;IACD,KAAK,EAAE,EAAE;IACT,MAAM,EAAE;QACN,mBAAmB,EAAE,8yTAA8yT;QACn0T,gBAAgB,EAAE,infAAinf;QACnof,8BAA8B,EAAE,q7PAAq7P;QACr9P,sBAAsB,EAAE,8+ZAA8+Z;QACtga,mBAAmB,EAAE,uofAAuof;QAC5pf,aAAa,EAAE,0+XAA0+X;QACz/X,wBAAwB,EAAE,ogQAAogQ;QAC9hQ,eAAe,EAAE,kyEAAkyE;KACpzE;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM;IACpB,OAAO,YAAY,CAAC,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;IACvE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAwB,CAAC;IACxE,IAAI,OAAO,GAAQ,SAAS,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAC3E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAA2B,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAExF,qCAAqC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,EAAE,OAAiB,EAAE;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@squadrules/mcp",
-  "version": "5.15.1",
+  "version": "5.17.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@squadrules/mcp",
-      "version": "5.15.1",
+      "version": "5.17.0",
       "license": "MIT",
       "dependencies": {
         "@exodus/bytes": "^1.16.0",

package/dist/tools/activate-artifacts.d.ts

@@ -4,6 +4,13 @@
  * A choice that ships scripts must tell the agent how to obtain them, and a
  * failed lookup must never look like "this adapter has no artifacts" — the
  * caller would then run a script path it can never obtain (SquadRules/mcp#216).
+ *
+ * Materialization is transport-neutral (ADR 0040): every artifact is fetched by a
+ * `curl`-to-staging command from a source URL. On stdio the running server writes
+ * the verified bytes to its private local cache and hands back a `file://` URL; on
+ * HTTP it mints a short-lived capability URL. Destination paths are validated and
+ * checked for collisions *before* any cache write or capability mint, so an unsafe
+ * path or a collision fails the whole load without leaving side effects behind.
  */
 import type { MemoryQdrantStore } from '../services/memory/store.js';
 import type { QdrantService } from '../services/qdrant/service.js';

package/dist/tools/activate-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activate-artifacts.d.ts","sourceRoot":"","sources":["../../src/tools/activate-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAQnE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,mCAAmC,EAAE,sBAAsB,CAAC;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,gGAAgG;IAChG,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAUD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC,CAgDhC"}
+{"version":3,"file":"activate-artifacts.d.ts","sourceRoot":"","sources":["../../src/tools/activate-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AASnE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,mCAAmC,EAAE,sBAAsB,CAAC;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,gGAAgG;IAChG,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAyGD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC,CA0ChC"}

package/dist/tools/activate-artifacts.js

@@ -2,51 +2,120 @@ import { structuredLogger } from '../utils/structured-logger.js';
 import { listAdapterArtifacts } from './artifact-catalog.js';
 import { mintExportArtifactDownloadCapability } from '../services/export-artifact-download-capability.js';
 import { resolveExportAdapter } from './export-resolve-adapter.js';
-import { normalizeArtifactRelativePath } from './artifact-relative-path.js';
+import { normalizeMaterializeRelativePath, sanitizeArtifactFileName } from './artifact-relative-path.js';
 import { buildArtifactMaterializeInstruction } from './artifact-materialize-command.js';
-function safeArtifactFileName(value) {
-    return value.replace(/[/\\]/g, '_');
+import { getArtifactLocalCache } from './artifact-local-cache.js';
+/**
+ * Resolve the destination path for one artifact. An explicit `relative_path` that
+ * fails validation fails the load — it is never silently replaced with a default.
+ * Only an absent path is synthesized as `artifacts/<safe filename>`, and the
+ * synthesized value passes through the same validator before it is used.
+ */
+function resolveMaterializePath(artifact) {
+    const stored = artifact.relative_path?.trim() ?? '';
+    if (stored.length > 0) {
+        const normalized = normalizeMaterializeRelativePath(stored);
+        if (normalized === null) {
+            throw new Error(`artifact ${artifact.artifact_uuid} ("${artifact.name}") has an unsafe relative_path ` +
+                `${JSON.stringify(artifact.relative_path)}; refusing to materialize it — ` +
+                're-train the artifact with a safe skill-root-relative path');
+        }
+        return normalized;
+    }
+    const safeName = sanitizeArtifactFileName(artifact.name);
+    if (safeName === null) {
+        throw new Error(`artifact ${artifact.artifact_uuid} has no relative_path and its name ${JSON.stringify(artifact.name)} ` +
+            'cannot be reduced to a safe filename; refusing to materialize it');
+    }
+    const synthesized = normalizeMaterializeRelativePath(`artifacts/${safeName}`);
+    if (synthesized === null) {
+        throw new Error(`artifact ${artifact.artifact_uuid} synthesized an unsafe destination path from its name; refusing to materialize it`);
+    }
+    return synthesized;
+}
+/** Case-folded, Unicode-normalized key so filesystem aliases count as one destination. */
+function collisionKey(relativePath) {
+    return relativePath.normalize('NFC').toLowerCase();
+}
+/**
+ * Fail the whole load when two distinct artifact UUIDs target the same canonical
+ * destination. UUID + SHA source identity does not resolve a destination collision
+ * and there is no safe last writer, so this rejects rather than picks one — even
+ * when the two digests match, and even for Unicode/case aliases of the same path.
+ */
+function assertNoDestinationCollisions(resolved) {
+    const seen = new Map();
+    for (const { artifact, relativePath } of resolved) {
+        const key = collisionKey(relativePath);
+        const priorUuid = seen.get(key);
+        if (priorUuid !== undefined && priorUuid !== artifact.artifact_uuid) {
+            throw new Error(`two linked artifacts target the same destination path ${JSON.stringify(relativePath)}: ` +
+                `${priorUuid} and ${artifact.artifact_uuid}; refusing to pick a last writer ` +
+                '(give them distinct relative_path values and re-train)');
+        }
+        seen.set(key, artifact.artifact_uuid);
+    }
 }
-function defaultArtifactRelativePath(fileName) {
-    return `artifacts/${safeArtifactFileName(fileName)}`;
+/** stdio: publish the whole verified batch to this process's local cache; return `file://` URLs by UUID. */
+async function publishStdioCacheUrls(resolved) {
+    const published = await getArtifactLocalCache().publishBatch(resolved.map(({ artifact, relativePath }) => ({
+        artifactUuid: artifact.artifact_uuid,
+        sha256: artifact.sha256,
+        text: artifact.text,
+        relativePath,
+        contentType: artifact.content_type
+    })));
+    const urls = new Map();
+    for (const [uuid, cached] of published) {
+        urls.set(uuid, cached.url);
+    }
+    return urls;
+}
+/** HTTP: mint a short-lived capability URL per artifact; return the URLs by UUID. */
+async function mintHttpCapabilityUrls(resolved) {
+    const minted = await Promise.all(resolved.map(async ({ artifact, relativePath }) => {
+        const capability = await mintExportArtifactDownloadCapability({
+            artifactUuid: artifact.artifact_uuid,
+            filename: artifact.name,
+            contentType: artifact.content_type,
+            sha256: artifact.sha256,
+            relativePath
+        });
+        return [artifact.artifact_uuid, capability.url];
+    }));
+    return new Map(minted);
 }
 export async function loadLinkedArtifacts(memoryStore, qdrantService, adapterUri, isStdio) {
     try {
         const { adapterId } = await resolveExportAdapter(memoryStore, qdrantService, adapterUri);
-        const linkedArtifactsRaw = await listAdapterArtifacts(memoryStore, adapterId);
-        const linkedArtifacts = await Promise.all(linkedArtifactsRaw.map(async (artifact) => {
-            const normalizedRelativePath = artifact.relative_path && artifact.relative_path.trim().length > 0
-                ? normalizeArtifactRelativePath(artifact.relative_path.trim())
-                : null;
-            const relativePath = normalizedRelativePath ?? defaultArtifactRelativePath(artifact.name);
-            const capability = await mintExportArtifactDownloadCapability({
-                artifactUuid: artifact.artifact_uuid,
-                filename: artifact.name,
-                contentType: artifact.content_type,
-                sha256: artifact.sha256,
-                relativePath
-            });
-            const artifactUri = `squadrules://artifact/${artifact.slug}`;
-            // stdio transport: no HTTP listener available, so there is nothing to
-            // download and `download_url` carries the artifact URI instead. The bytes
-            // then arrive through the `export` tool as base64.
-            const downloadUrl = isStdio ? artifactUri : capability.url;
+        const artifacts = await listAdapterArtifacts(memoryStore, adapterId);
+        // Preflight before any side effect: resolve + validate every destination and
+        // reject collisions, so a bad path or a clash leaves no cache write or mint.
+        const resolved = artifacts.map((artifact) => ({
+            artifact,
+            relativePath: resolveMaterializePath(artifact)
+        }));
+        assertNoDestinationCollisions(resolved);
+        const urlByUuid = isStdio ? await publishStdioCacheUrls(resolved) : await mintHttpCapabilityUrls(resolved);
+        const linkedArtifacts = resolved.map(({ artifact, relativePath }) => {
+            const url = urlByUuid.get(artifact.artifact_uuid);
+            if (url === undefined) {
+                throw new Error(`no materialize URL was prepared for artifact ${artifact.artifact_uuid}`);
+            }
             return {
                 slug: artifact.slug,
                 filename: artifact.name,
                 relative_path: relativePath,
-                download_url: downloadUrl,
+                download_url: url,
                 sha256: artifact.sha256,
                 content_type: artifact.content_type,
                 materialize: buildArtifactMaterializeInstruction({
-                    transport: isStdio ? 'stdio' : 'http',
-                    artifactUri,
-                    downloadUrl,
+                    url,
                     relativePath,
                     sha256: artifact.sha256
                 })
             };
-        }));
+        });
         return { linkedArtifacts, artifactLoadError: null };
     }
     catch (error) {

package/dist/tools/activate-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"activate-artifacts.js","sourceRoot":"","sources":["../../src/tools/activate-artifacts.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAkBxF,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,OAAO,aAAa,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAA8B,EAC9B,aAAwC,EACxC,UAAkB,EAClB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CACvC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,sBAAsB,GAC1B,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAChE,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC9D,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,YAAY,GAAG,sBAAsB,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,MAAM,UAAU,GAAG,MAAM,oCAAoC,CAAC;gBAC5D,YAAY,EAAE,QAAQ,CAAC,aAAa;gBACpC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,WAAW,EAAE,QAAQ,CAAC,YAAY;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,YAAY;aACb,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,yBAAyB,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7D,sEAAsE;YACtE,0EAA0E;YAC1E,mDAAmD;YACnD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3D,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,WAAW;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,WAAW,EAAE,mCAAmC,CAAC;oBAC/C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBACrC,WAAW;oBACX,WAAW;oBACX,YAAY;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjF,gBAAgB,CAAC,IAAI,CACnB,kDAAkD,UAAU,KAAK,iBAAiB,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC;IACpD,CAAC;AACH,CAAC"}
+{"version":3,"file":"activate-artifacts.js","sourceRoot":"","sources":["../../src/tools/activate-artifacts.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAgC,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAwBlE;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,QAAiC;IAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,CAAC,aAAa,MAAM,QAAQ,CAAC,IAAI,iCAAiC;gBACpF,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,iCAAiC;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,CAAC,aAAa,sCAAsC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;YACtG,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,gCAAgC,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;IAC9E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,CAAC,aAAa,mFAAmF,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,QAAqC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,yDAAyD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI;gBACvF,GAAG,SAAS,QAAQ,QAAQ,CAAC,aAAa,mCAAmC;gBAC7E,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,qBAAqB,CAAC,QAAqC;IACxE,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC,YAAY,CAC1D,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,YAAY,EAAE,QAAQ,CAAC,aAAa;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,YAAY;KACnC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,sBAAsB,CAAC,QAAqC;IACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE;QAChD,MAAM,UAAU,GAAG,MAAM,oCAAoC,CAAC;YAC5D,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAU,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAA8B,EAC9B,aAAwC,EACxC,UAAkB,EAClB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAErE,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,QAAQ,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChE,QAAQ;YACR,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC;SAC/C,CAAC,CAAC,CAAC;QACJ,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAE3G,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAoB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE;YACrF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAClD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,GAAG;gBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,WAAW,EAAE,mCAAmC,CAAC;oBAC/C,GAAG;oBACH,YAAY;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjF,gBAAgB,CAAC,IAAI,CACnB,kDAAkD,UAAU,KAAK,iBAAiB,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/tools/activate_schema.d.ts

@@ -53,12 +53,8 @@ export declare const activateOutputSchema: z.ZodObject<{
             sha256: z.ZodString;
             content_type: z.ZodString;
             materialize: z.ZodObject<{
-                tool: z.ZodLiteral<"export">;
-                arguments: z.ZodObject<{
-                    uri: z.ZodString;
-                    format: z.ZodLiteral<"source">;
-                    delivery: z.ZodOptional<z.ZodLiteral<"inline_base64">>;
-                }, z.core.$strict>;
+                method: z.ZodLiteral<"url">;
+                url: z.ZodString;
                 out: z.ZodString;
                 sha256: z.ZodString;
                 chmod: z.ZodLiteral<"700">;
@@ -97,12 +93,8 @@ export declare const activateOutputSchema: z.ZodObject<{
             sha256: z.ZodString;
             content_type: z.ZodString;
             materialize: z.ZodObject<{
-                tool: z.ZodLiteral<"export">;
-                arguments: z.ZodObject<{
-                    uri: z.ZodString;
-                    format: z.ZodLiteral<"source">;
-                    delivery: z.ZodOptional<z.ZodLiteral<"inline_base64">>;
-                }, z.core.$strict>;
+                method: z.ZodLiteral<"url">;
+                url: z.ZodString;
                 out: z.ZodString;
                 sha256: z.ZodString;
                 chmod: z.ZodLiteral<"700">;

package/dist/tools/activate_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activate_schema.d.ts","sourceRoot":"","sources":["../../src/tools/activate_schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2FxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;iBAoB9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BtB,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"activate_schema.d.ts","sourceRoot":"","sources":["../../src/tools/activate_schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoFxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;iBAoB9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2BtB,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/tools/activate_schema.js

@@ -18,23 +18,16 @@ const executionIdSchema = z
     .regex(/^[0-9a-f-]{36}$/i, 'must be a UUID');
 const materializeInstructionSchema = z
     .object({
-    tool: z.literal('export').describe('MCP tool that returns the artifact bytes (required on stdio)'),
-    arguments: z
-        .object({
-        uri: z.string().describe('Artifact URI to export: squadrules://artifact/{slug|uuid}'),
-        format: z.literal('source').describe('Export format for artifact content'),
-        delivery: z
-            .literal('inline_base64')
-            .optional()
-            .describe('Set on stdio transport: base64 so the bytes survive the write')
-    })
-        .strict(),
+    method: z.literal('url').describe('Always `url`: `cmd` downloads the bytes from `url` on every transport'),
+    url: z
+        .string()
+        .describe('Source URL `cmd` downloads: a file:// cache path on stdio, an http(s) capability URL on HTTP'),
     out: z.string().describe('Path where the bytes land (uses $SQUADRULES_LOCAL_ARTIFACT_DIR)'),
     sha256: z.string().describe('SHA-256 hex of the artifact bytes; `cmd` verifies it'),
-    chmod: z.literal('700').describe('File permissions the agent must set after verification'),
+    chmod: z.literal('700').describe('File permissions `cmd` sets on the verified bytes before publishing'),
     cmd: z
         .string()
-        .describe('Exact POSIX shell line that writes the file, verifies the digest, and sets permissions. Run it verbatim.')
+        .describe('Exact POSIX shell line that downloads, verifies the digest, chmods, and atomically publishes. Run it verbatim.')
 })
     .strict();
 const linkedArtifactSchema = z
@@ -42,10 +35,10 @@ const linkedArtifactSchema = z
     slug: z.string(),
     filename: z.string(),
     relative_path: z.string().nullable(),
-    download_url: z.string(),
+    download_url: z.string().describe('Source URL for the artifact bytes: a file:// cache path on stdio, a short-lived capability URL on HTTP. Prefer running materialize.cmd over fetching it yourself.'),
     sha256: z.string(),
     content_type: z.string(),
-    materialize: materializeInstructionSchema.describe('Run `cmd` verbatim to materialize the artifact; on stdio, call the `export` tool first and put its `content` into $B64')
+    materialize: materializeInstructionSchema.describe('Run `cmd` verbatim to materialize the artifact: it curls `url`, verifies the sha256 digest, and publishes atomically — no export call and no $B64')
 })
     .strict();
 const activateChoiceCommonSchema = z.object({
@@ -121,6 +114,6 @@ export const activateOutputSchema = z.object({
      * challenges. The server never resolves these to a path on its own filesystem.
      */
     squadrules_local_artifact_dir: z.array(z.string()).optional(),
-    transport: z.enum(['stdio', 'http']).optional().describe('MCP transport mode. When "stdio", no HTTP listener is available; use squadrules:// artifact URIs and `squadrules export` instead of curl.')
+    transport: z.enum(['stdio', 'http']).optional().describe('MCP transport mode. When "stdio", no HTTP listener is available; linked-artifact materialize URLs are file:// paths from the server\'s local cache, and materialize.cmd curls them like any other URL.')
 }).strict();
 //# sourceMappingURL=activate_schema.js.map

package/dist/tools/activate_schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"activate_schema.js","sourceRoot":"","sources":["../../src/tools/activate_schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAExF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CACJ,4EAA4E,EAC5E,wCAAwC,CACzC,CAAC;AACJ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CACJ,4EAA4E,EAC5E,wCAAwC,CACzC,CAAC;AACJ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,oBAAoB;IACzB,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC/C,MAAM,4BAA4B,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAClG,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QACrF,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QAC1E,QAAQ,EAAE,CAAC;aACR,OAAO,CAAC,eAAe,CAAC;aACxB,QAAQ,EAAE;aACV,QAAQ,CAAC,+DAA+D,CAAC;KAC7E,CAAC;SACD,MAAM,EAAE;IACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACnF,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC1F,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CAAC,0GAA0G,CAAC;CACxH,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,4BAA4B,CAAC,QAAQ,CAAC,wHAAwH,CAAC;CAC7K,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,gBAAgB;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACvG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IACnI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACzF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACtF,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC/G,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kFAAkF,CAAC;IAC/F,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2HAA2H,CAC5H;CACJ,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAClE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;IAClO,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC5F,YAAY,EAAE,iBAAiB;SAC5B,QAAQ,EAAE;SACV,QAAQ,CACP,8IAA8I,CAC/I;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qFAAqF,CAAC;IAClG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,2BAA2B,CAAC;SAChC,GAAG,CAAC,2BAA2B,CAAC;SAChC,QAAQ,EAAE;SACV,QAAQ,CAAC,mCAAmC,CAAC;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC3G,YAAY,EAAE,iBAAiB;SAC5B,QAAQ,EAAE;SACV,QAAQ,CACP,sHAAsH,CACvH;IACH,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC3B,yBAAyB;QACzB,0BAA0B;QAC1B,0BAA0B;KAC3B,CAAC,CACH;IACD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2IAA2I,CAAC;CACtM,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"activate_schema.js","sourceRoot":"","sources":["../../src/tools/activate_schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAExF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,KAAK,CACJ,4EAA4E,EAC5E,wCAAwC,CACzC,CAAC;AACJ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,KAAK,CACJ,4EAA4E,EAC5E,wCAAwC,CACzC,CAAC;AACJ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,GAAG,EAAE,oBAAoB;IACzB,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAC/C,MAAM,4BAA4B,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,uEAAuE,CAAC;IAC1G,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CAAC,8FAA8F,CAAC;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACnF,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;IACvG,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CAAC,gHAAgH,CAAC;CAC9H,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;IACtM,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,4BAA4B,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;CACxM,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,gBAAgB;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACvG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IACnI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACzF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACtF,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC/G,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kFAAkF,CAAC;IAC/F,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2HAA2H,CAC5H;CACJ,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAClE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACnE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;IAClO,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC5F,YAAY,EAAE,iBAAiB;SAC5B,QAAQ,EAAE;SACV,QAAQ,CACP,8IAA8I,CAC/I;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qFAAqF,CAAC;IAClG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC3D,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,2BAA2B,CAAC;SAChC,GAAG,CAAC,2BAA2B,CAAC;SAChC,QAAQ,EAAE;SACV,QAAQ,CAAC,mCAAmC,CAAC;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC3G,YAAY,EAAE,iBAAiB;SAC5B,QAAQ,EAAE;SACV,QAAQ,CACP,sHAAsH,CACvH;IACH,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC3B,yBAAyB;QACzB,0BAA0B;QAC1B,0BAA0B;KAC3B,CAAC,CACH;IACD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wMAAwM,CAAC;CACnQ,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/tools/artifact-local-cache-support.d.ts

@@ -0,0 +1,62 @@
+export declare const UUID_RE: RegExp;
+export declare const SHA256_RE: RegExp;
+export declare const NAMESPACE_PREFIX = "sqns-";
+export declare const LEASE_SUFFIX = ".lease";
+export declare const DEFAULT_MAX_ENTRIES = 256;
+export declare const DEFAULT_MAX_BYTES: number;
+export declare const DEFAULT_ORPHAN_GRACE_SEC = 3600;
+export declare const MAINTENANCE_INTERVAL_MS = 60000;
+export declare function envInt(key: string, fallback: number): number;
+export declare function ownerUid(): number | undefined;
+export declare function defaultRootDir(): string;
+/** A shell-safe, path-safe file extension derived from the artifact path or type. */
+export declare function extensionFor(relativePath: string | null, contentType: string): string;
+/** A PID is treated as live unless the OS reports it definitively gone (ESRCH). */
+export declare function processMayBeAlive(pid: number): boolean;
+export declare class ArtifactCacheError extends Error {
+    constructor(message: string);
+}
+/** The stored bytes do not hash to the stored digest; the load must fail closed. */
+export declare class ArtifactCacheDigestError extends ArtifactCacheError {
+}
+/** The batch cannot be admitted without evicting a still-leased entry. */
+export declare class ArtifactCacheQuotaError extends ArtifactCacheError {
+}
+export interface CacheArtifactInput {
+    artifactUuid: string;
+    sha256: string;
+    /** Authoritative UTF-8 bytes; `sha256` is the digest over exactly these. */
+    text: string;
+    relativePath: string | null;
+    contentType: string;
+}
+export interface CachedArtifact {
+    /** Absolute `file://` URL the materialize command curls. */
+    url: string;
+    /** Absolute path of the published file inside this process's namespace. */
+    path: string;
+    bytes: number;
+}
+export interface ArtifactLocalCacheOptions {
+    rootDir?: string;
+    ttlSec?: number;
+    maxEntries?: number;
+    maxBytes?: number;
+    orphanGraceSec?: number;
+    now?: () => number;
+}
+export interface PreparedArtifact {
+    uuid: string;
+    name: string;
+    buf: Buffer;
+    bytes: number;
+}
+export interface LeaseRecord {
+    v: 1;
+    name: string;
+    bytes: number;
+    createdSec: number;
+    lastIssuedSec: number;
+    expiresSec: number;
+}
+//# sourceMappingURL=artifact-local-cache-support.d.ts.map

package/dist/tools/artifact-local-cache-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-local-cache-support.d.ts","sourceRoot":"","sources":["../../src/tools/artifact-local-cache-support.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,OAAO,QAAoE,CAAC;AACzF,eAAO,MAAM,SAAS,QAAoB,CAAC;AAC3C,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,eAAO,MAAM,YAAY,WAAW,CAAC;AACrC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7C;AAED,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAMrF;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,oFAAoF;AACpF,qBAAa,wBAAyB,SAAQ,kBAAkB;CAAG;AAEnE,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,kBAAkB;CAAG;AAElE,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/tools/artifact-local-cache-support.js

@@ -0,0 +1,61 @@
+/**
+ * Support for the STDIO local artifact cache (ADR 0040): identity and path
+ * helpers, tunable quotas, lease records, and the fail-closed error types. Kept
+ * separate from `artifact-local-cache.ts` so the cache class stays within the
+ * file-size gate. Nothing here touches the filesystem.
+ */
+import os from 'node:os';
+import path from 'node:path';
+export const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export const SHA256_RE = /^[a-f0-9]{64}$/i;
+export const NAMESPACE_PREFIX = 'sqns-';
+export const LEASE_SUFFIX = '.lease';
+export const DEFAULT_MAX_ENTRIES = 256;
+export const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
+export const DEFAULT_ORPHAN_GRACE_SEC = 3600;
+export const MAINTENANCE_INTERVAL_MS = 60_000;
+export function envInt(key, fallback) {
+    const raw = process.env[key];
+    if (raw === undefined || raw.trim() === '')
+        return fallback;
+    const parsed = Number.parseInt(raw.trim(), 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+export function ownerUid() {
+    return typeof process.getuid === 'function' ? process.getuid() : undefined;
+}
+export function defaultRootDir() {
+    const uid = ownerUid();
+    return path.join(os.tmpdir(), `squadrules-artifact-cache-${uid === undefined ? 'na' : String(uid)}`);
+}
+/** A shell-safe, path-safe file extension derived from the artifact path or type. */
+export function extensionFor(relativePath, contentType) {
+    const fromPath = relativePath ? path.extname(relativePath).replace(/^\./, '') : '';
+    const subtype = contentType.split('/')[1] ?? '';
+    const candidate = fromPath || subtype.replace(/^x-/, '');
+    const sanitized = candidate.replace(/[^A-Za-z0-9]/g, '').slice(0, 8);
+    return sanitized.length > 0 ? sanitized : 'bin';
+}
+/** A PID is treated as live unless the OS reports it definitively gone (ESRCH). */
+export function processMayBeAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code !== 'ESRCH';
+    }
+}
+export class ArtifactCacheError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ArtifactCacheError';
+    }
+}
+/** The stored bytes do not hash to the stored digest; the load must fail closed. */
+export class ArtifactCacheDigestError extends ArtifactCacheError {
+}
+/** The batch cannot be admitted without evicting a still-leased entry. */
+export class ArtifactCacheQuotaError extends ArtifactCacheError {
+}
+//# sourceMappingURL=artifact-local-cache-support.js.map

package/dist/tools/artifact-local-cache-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-local-cache-support.js","sourceRoot":"","sources":["../../src/tools/artifact-local-cache-support.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AACzF,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,YAA2B,EAAE,WAAmB;IAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;CAAG;AAEnE,0EAA0E;AAC1E,MAAM,OAAO,uBAAwB,SAAQ,kBAAkB;CAAG"}

package/dist/tools/artifact-local-cache.d.ts

@@ -0,0 +1,55 @@
+import { ArtifactCacheDigestError, ArtifactCacheError, ArtifactCacheQuotaError, type ArtifactLocalCacheOptions, type CacheArtifactInput, type CachedArtifact } from './artifact-local-cache-support.js';
+export { ArtifactCacheDigestError, ArtifactCacheError, ArtifactCacheQuotaError };
+export type { ArtifactLocalCacheOptions, CacheArtifactInput, CachedArtifact };
+export declare class ArtifactLocalCache {
+    private readonly rootDir;
+    private readonly ttlSec;
+    private readonly maxEntries;
+    private readonly maxBytes;
+    private readonly orphanGraceSec;
+    private readonly now;
+    private namespace;
+    private lock;
+    private maintenance;
+    constructor(options?: ArtifactLocalCacheOptions);
+    /**
+     * Verify and publish a whole activation batch, or fail it entirely. Digest
+     * verification and quota preflight run before any write, so a bad artifact or
+     * an over-quota batch never leaves a partially usable cache behind.
+     */
+    publishBatch(entries: readonly CacheArtifactInput[]): Promise<Map<string, CachedArtifact>>;
+    /** Remove entries whose lease has expired. Returns the number pruned. */
+    pruneExpired(): Promise<number>;
+    /**
+     * Scavenge namespaces whose owner PID is dead, whose newest lease has expired,
+     * and whose grace period has passed. Never touches a live process's namespace,
+     * including this one; ambiguous liveness is treated as live.
+     */
+    scavengeOrphans(): Promise<number>;
+    startPeriodicMaintenance(intervalMs?: number): void;
+    stopPeriodicMaintenance(): void;
+    private runMaintenance;
+    private prepare;
+    private preflightQuota;
+    private publishOne;
+    /**
+     * True only when `finalPath` is an existing regular file whose bytes match the
+     * digest. The path is resolved exactly once: it is opened read-only with
+     * `O_NOFOLLOW` (so a symlink fails the open with `ELOOP` instead of being
+     * followed), and both the type check and the read run through that single
+     * descriptor. Operating on the opened fd instead of re-resolving the path after
+     * a stat removes the check-then-read race on `finalPath`.
+     */
+    private matchesDigest;
+    private ensureNamespace;
+    private ensureRoot;
+    private writeFileAtomic;
+    private readLease;
+    private listLeases;
+    private pruneExpiredIn;
+    private newestLeaseExpiry;
+    private withLock;
+}
+/** The process-wide stdio cache; created on first use with periodic maintenance. */
+export declare function getArtifactLocalCache(): ArtifactLocalCache;
+//# sourceMappingURL=artifact-local-cache.d.ts.map

package/dist/tools/artifact-local-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-local-cache.d.ts","sourceRoot":"","sources":["../../src/tools/artifact-local-cache.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EAcvB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAGpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;AACjF,YAAY,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC;AAU9E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,WAAW,CAA+C;gBAEtD,OAAO,GAAE,yBAA8B;IAUnD;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAehG,yEAAyE;IACnE,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAOrC;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAqBxC,wBAAwB,CAAC,UAAU,SAA0B,GAAG,IAAI;IASpE,uBAAuB,IAAI,IAAI;YAOjB,cAAc;IAS5B,OAAO,CAAC,OAAO;IAkBf,OAAO,CAAC,cAAc;YAuBR,UAAU;IAkBxB;;;;;;;OAOG;YACW,aAAa;YAiBb,eAAe;YAUf,UAAU;YAYV,eAAe;YAaf,SAAS;YAST,UAAU;YAgBV,cAAc;YAYd,iBAAiB;YAQjB,QAAQ;CAQvB;AAID,oFAAoF;AACpF,wBAAgB,qBAAqB,IAAI,kBAAkB,CAM1D"}