@vibesdotdev/external 0.0.0-stage → 1.0.0-rc.0

package/dist/storage/file-access.record.descriptor.js

@@ -0,0 +1,370 @@
+/**
+ * File Access Storage Record Descriptor
+ *
+ * Storage pattern for external tool file access tracking.
+ * This replaces the need for one-off adapters like LocalSQLiteExternalAdapter.
+ *
+ * @example
+ * ```typescript
+ * // Query from runtime
+ * const fileAccesses = await runtime
+ *   .query('storage/record')
+ *   .withId('external.file_accesses')
+ *   .resolve();
+ *
+ * // Track a file access
+ * const access = await fileAccesses.create({
+ *   sessionId: 'session-123',
+ *   filePath: '/src/lib/example.ts',
+ *   operation: 'read',
+ *   timestamp: new Date()
+ * });
+ *
+ * // List accesses with filters
+ * const result = await fileAccesses.list({
+ *   where: {
+ *     sessionId: 'session-123',
+ *     operation: 'edit'
+ *   },
+ *   orderBy: { timestamp: 'desc' },
+ *   limit: 100
+ * });
+ * ```
+ */
+import * as z from 'zod/v4';
+// SCHEMA DEFINITIONS
+/**
+ * File operation types
+ */
+export const FileOperationSchema = z.enum([
+    'read', // File was read
+    'edit', // File was edited
+    'write', // File was written/created
+    'delete' // File was deleted
+]);
+/**
+ * Line range schema for partial file access
+ */
+export const LineRangeSchema = z.object({
+    start: z.number().int().nonnegative(),
+    end: z.number().int().nonnegative()
+});
+/**
+ * File Access Schema
+ *
+ * Defines the structure of a file access tracking record.
+ * Tracks file operations during sessions for context and analytics.
+ */
+export const FileAccessSchema = z.object({
+    // Identity
+    id: z.string().uuid(),
+    // Foreign keys
+    sessionId: z.string().uuid(),
+    // File information
+    filePath: z.string().min(1),
+    operation: FileOperationSchema,
+    // Line range (for partial file access)
+    lineRange: LineRangeSchema.optional(),
+    // Access metadata
+    symbolsAccessed: z.array(z.string()).default([]),
+    // I/O metrics
+    bytesRead: z.number().int().nonnegative().optional(),
+    bytesWritten: z.number().int().nonnegative().optional(),
+    // Diagnostics
+    diagnosticsCount: z.number().int().nonnegative().optional(),
+    // Context
+    activeTodoId: z.string().uuid().optional(),
+    toolName: z.string().optional(),
+    toolCallId: z.string().optional(),
+    // AMBIENT IDENTITY (v2) — who touched this, where, working on what.
+    // Every field is OPTIONAL by design: a degraded identity beats a dropped
+    // row. A touch that cannot resolve its machine still records.
+    // See docs/architecture/AMBIENT-AGENT-AWARENESS.md.
+    /** Stable machine id, from context `runtime/machine-identity`. */
+    machineId: z.string().min(1).optional(),
+    /** Human-readable machine name (OS hostname) for the notice line. */
+    machineName: z.string().min(1).optional(),
+    /** Durable participant identity and copy-safe collaboration reference. */
+    participantId: z.string().min(1).optional(),
+    participantSlug: z.string().min(1).optional(),
+    /**
+     * Absolute workspace root of the touching session.
+     *
+     * This is the field that keeps the signal honest: two agents in different
+     * worktrees of the same repo share a relative path but are NOT colliding.
+     * Without it the collision notice cries wolf constantly.
+     */
+    workspaceRoot: z.string().min(1).optional(),
+    /** Branch at touch time; workspaceRoot is the worktree path. */
+    gitBranch: z.string().min(1).optional(),
+    /** Git HEAD sha at touch time, when cheaply available. */
+    headSha: z.string().min(1).optional(),
+    /**
+     * The human-legible unit of work. `activeTodoId` (session todos) is kept
+     * as-is; this is the work item a reader can actually name out loud.
+     */
+    workItemId: z.string().min(1).optional(),
+    workItemTitle: z.string().min(1).optional(),
+    /**
+     * How many touches this row stands for.
+     *
+     * A row is a ROLLUP BUCKET, not a single event: one row per
+     * (session, path, operation, tool, day). The ambient filesystem watcher
+     * fires on every OS change, so a file being written in a loop produced one
+     * row per fire — 2,152,590 rows in eight days on 2026-08-31, 1.3 GB of
+     * JSON, against nine rows of real tool activity, on a volume at 100%
+     * capacity. Counting instead of appending keeps the same signal at a
+     * bounded size.
+     *
+     * Optional with a default of 1 so every row written before rollup existed
+     * still reads correctly.
+     */
+    accessCount: z.number().int().positive().default(1),
+    // Additional metadata
+    metadata: z.record(z.string(), z.unknown()).default({}),
+    // Timestamps
+    timestamp: z.union([z.string().datetime(), z.date()]),
+    createdAt: z.union([z.string().datetime(), z.date()]),
+    updatedAt: z.union([z.string().datetime(), z.date()]).optional()
+});
+// STORAGE RECORD DESCRIPTOR
+/**
+ * Storage Record Descriptor for File Accesses
+ *
+ * This descriptor defines how file access tracking data is stored, indexed, and managed.
+ */
+export const fileAccessRecordDescriptor = {
+    // Runtime metadata
+    kind: 'storage/record',
+    id: 'external.file_accesses',
+    name: 'File Access Tracking',
+    description: 'Tracks file operations during sessions for context and analytics',
+    /**
+     * This table reached 3,182,962 rows and 5.6GB on a developer machine that
+     * then hit 100% disk. Its ONLY consumer is collision detection, which reads
+     * `DEFAULT_RECENCY_WINDOW_MS` — thirty minutes. Two days is 96x that window,
+     * chosen so `external file-access-list` stays useful to a human looking back
+     * over recent work, not because collision detection needs it.
+     *
+     * Ages by `timestamp` (when the touch HAPPENED), not `createdAt` (when the
+     * row was written). Those diverge under backfill and replay, and the touch
+     * time is the one that means anything.
+     */
+    retention: {
+        maxAgeDays: 2,
+        ageField: 'timestamp',
+        reason: 'Read only by collision detection over a 30-minute window; 2 days keeps ' +
+            'file-access-list useful for humans. Reached 3.18M rows / 5.6GB undeclared.'
+    },
+    // Schema for validation
+    schema: FileAccessSchema,
+    // Table configuration
+    tableName: 'file_accesses',
+    primaryKey: 'id',
+    // Relations
+    relations: {
+        // Each file access belongs to a session
+        session: {
+            type: 'belongs_to',
+            target: 'session.sessions',
+            foreignKey: 'sessionId',
+            optional: false,
+            cascadeDelete: true // Delete file accesses when session is deleted
+        },
+        // Optional relation to active todo
+        activeTodo: {
+            type: 'belongs_to',
+            target: 'session.todos',
+            foreignKey: 'activeTodoId',
+            optional: true,
+            cascadeDelete: false
+        }
+    },
+    // Indexes for performance.
+    //
+    // THE SET IS FIVE, NOT SEVEN. `idx_file_accesses_session` on
+    // `(sessionId)` and `idx_file_accesses_file_path` on `(filePath)` were both
+    // dropped on 2026-10-04: each is a STRICT LEFT PREFIX of a longer index on
+    // the same leading column (`idx_file_accesses_session_timestamp`,
+    // `idx_file_accesses_path_recent`), which is the one property that makes an
+    // index strictly redundant — every query the short one can serve, the long
+    // one serves at least as well. Measured 115.7MB on a 528,639-row table.
+    //
+    // Not a judgement call: `EXPLAIN QUERY PLAN` was run on the live database
+    // for every query shape the readers issue, and for the unbounded variants.
+    // SQLite's own planner chose the long index for all of them, including
+    // `filePath = ?` with no time bound and `COUNT(*) WHERE filePath = ?`
+    // (which it served as a COVERING index). The two short ones were never
+    // chosen for any shape.
+    //
+    // The remaining five are each load-bearing, and two of them exist to supply
+    // an `ORDER BY` without a temp b-tree: dropping `path_recent` or
+    // `session_timestamp` would put a sort into the collision-detection hot
+    // path.
+    //
+    // A descriptor edit alone does NOT reclaim the bytes on an existing
+    // database: `createIndexes` only ever issues `CREATE INDEX IF NOT EXISTS`
+    // for what is declared, so a stale index on disk survives its removal from
+    // here. That is why migration version 3 below drops them.
+    indexes: [
+        {
+            name: 'idx_file_accesses_timestamp',
+            fields: ['timestamp'],
+            unique: false
+        },
+        {
+            name: 'idx_file_accesses_operation',
+            fields: ['operation'],
+            unique: false
+        },
+        {
+            name: 'idx_file_accesses_session_file',
+            fields: ['sessionId', 'filePath'],
+            unique: false
+        },
+        {
+            name: 'idx_file_accesses_session_timestamp',
+            fields: ['sessionId', 'timestamp'],
+            unique: false
+        },
+        {
+            // The collision read's access pattern: "who else touched THIS path
+            // recently". Without the timestamp leg, a hot path degrades to a
+            // full scan of its own history.
+            name: 'idx_file_accesses_path_recent',
+            fields: ['filePath', 'timestamp'],
+            unique: false
+        }
+    ],
+    // Migrations
+    migrations: [
+        {
+            version: 1,
+            name: 'Create file_accesses table',
+            up: `
+				CREATE TABLE IF NOT EXISTS file_accesses (
+					id TEXT PRIMARY KEY,
+					session_id TEXT NOT NULL,
+					file_path TEXT NOT NULL,
+					operation TEXT NOT NULL CHECK (operation IN ('read', 'edit', 'write', 'delete')),
+					line_start INTEGER,
+					line_end INTEGER,
+					symbols_accessed TEXT DEFAULT '[]',
+					bytes_read INTEGER,
+					bytes_written INTEGER,
+					diagnostics_count INTEGER,
+					active_todo_id TEXT,
+					tool_name TEXT,
+					tool_call_id TEXT,
+					metadata TEXT DEFAULT '{}',
+					timestamp TEXT NOT NULL,
+					created_at TEXT NOT NULL
+				);
+
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_session ON file_accesses(session_id);
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_file_path ON file_accesses(file_path);
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_timestamp ON file_accesses(timestamp DESC);
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_operation ON file_accesses(operation);
+			`,
+            down: `DROP TABLE IF EXISTS file_accesses`
+        }
+        // NO v2 MIGRATION — AND THAT IS DELIBERATE. READ THIS BEFORE ADDING ONE.
+        //
+        // The v1 migration above declares normalized columns, but they DO NOT
+        // EXIST at runtime. `StorageRecord` CRUDs this table as a JSON blob:
+        // every read/write goes through `json_extract(data, '$.field')` and
+        // `INSERT INTO file_accesses (id, data)`. On first init,
+        // `StorageRecord.ensureDataColumn()` sees a table with no `data`
+        // column, finds it empty, and DROPS AND RECREATES it as
+        // `(id TEXT PRIMARY KEY, data TEXT NOT NULL)`.
+        //
+        // Verified, not assumed — `src/__tests__/file-access-identity.test.ts`
+        // probes the live table and reports:
+        //   [PROBE] file_accesses columns = ["id","data"]
+        //
+        // So an `ALTER TABLE ... ADD COLUMN` migration for the v2 identity
+        // fields would be pure theater: the columns are either dropped moments
+        // later or added to a blob table that never reads them.
+        //
+        // What IS real for adding a field here:
+        //   1. Add it to `FileAccessSchema` — it lands in the JSON blob. That
+        //      alone is the persistence, and old rows simply lack the key.
+        //   2. Declare any index in `indexes` below — `createIndexes()` renders
+        //      it as `json_extract(data, '$.field')`, which is why
+        //      `idx_file_accesses_path_recent` is a real index and not a
+        //      no-op.
+        // Neither step needs a migration.
+        //
+        // (The dead v1 migration is left in place: removing it would send this
+        // descriptor down `createTableFromSchema()` instead, changing the init
+        // path for a table that is already correct. That cleanup is not this
+        // milestone's to make.)
+        //
+        // There is no v2: the identity fields were added to `FileAccessSchema`
+        // alone, because in JSON-blob mode the schema IS the persistence. The
+        // descriptor's `version` field moved to 3 with the migration below.
+        ,
+        {
+            version: 3,
+            name: 'Drop the two left-prefix duplicate indexes',
+            // Unlike the ADD-COLUMN case above, this migration acts on a real SQL
+            // object and is not theater: the indexes exist as json_extract
+            // expression indexes created by `createIndexes`, and dropping them here
+            // is the only thing that removes them from an existing database.
+            // Removing them from `indexes` above alone would leave them in place —
+            // `createIndexes` only creates, never reconciles.
+            //
+            // `IF EXISTS` because a fresh database never had them: v1's normalized
+            // table (and its indexes) was dropped and recreated as `(id, data)`, so
+            // on a new install these names are already absent.
+            up: `
+				DROP INDEX IF EXISTS idx_file_accesses_session;
+				DROP INDEX IF EXISTS idx_file_accesses_file_path;
+			`,
+            down: `
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_session
+					ON file_accesses (json_extract(data, '$.sessionId'));
+				CREATE INDEX IF NOT EXISTS idx_file_accesses_file_path
+					ON file_accesses (json_extract(data, '$.filePath'));
+			`
+        }
+    ],
+    // Schema version
+    version: 3,
+    // Auto-managed fields
+    timestamps: {
+        createdAt: 'createdAt',
+        updatedAt: 'updatedAt'
+    },
+    autoId: {
+        field: 'id',
+        strategy: 'uuid'
+    },
+    softDelete: false, // Hard delete for file accesses
+    // Adapter selection
+    allowedAdapters: ['storage.localdb'],
+    defaultAdapter: 'storage.localdb',
+    // Adapter configuration
+    adapterConfig: {
+        'storage.localdb': {
+            dbName: 'external.db',
+            scope: 'project'
+        }
+    },
+    // Scope
+    scope: 'project',
+    // Validation
+    validateOnWrite: true,
+    validateOnRead: false,
+    // Metadata
+    internal: false,
+    namespace: 'external.file_accesses',
+    tags: ['external', 'file-tracking', 'analytics'],
+    // Performance optimization
+    versioning: false,
+    audit: false,
+    changeTracking: false
+};
+// EXPORTS
+export default fileAccessRecordDescriptor;
+//# sourceMappingURL=file-access.record.descriptor.js.map

package/dist/storage/file-access.record.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-access.record.descriptor.js","sourceRoot":"","sources":["../../src/storage/file-access.record.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,qBAAqB;AAErB;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,2BAA2B;IACpC,QAAQ,CAAC,mBAAmB;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACnC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW;IACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAErB,eAAe;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAE5B,mBAAmB;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,mBAAmB;IAE9B,uCAAuC;IACvC,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IAErC,kBAAkB;IAClB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhD,cAAc;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAEvD,cAAc;IACd,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAE3D,UAAU;IACV,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,oEAAoE;IACpE,yEAAyE;IACzE,8DAA8D;IAC9D,oDAAoD;IAEpD,kEAAkE;IAClE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,qEAAqE;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,0EAA0E;IAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE7C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,0DAA0D;IAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAErC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;;;;;;;;;;;OAaG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,sBAAsB;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvD,aAAa;IACb,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAQH,4BAA4B;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACvE,mBAAmB;IACnB,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,kEAAkE;IAE/E;;;;;;;;;;OAUG;IACH,SAAS,EAAE;QACV,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,WAAW;QACrB,MAAM,EACL,yEAAyE;YACzE,4EAA4E;KAC7E;IAED,wBAAwB;IACxB,MAAM,EAAE,gBAAgB;IAExB,sBAAsB;IACtB,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,IAAI;IAEhB,YAAY;IACZ,SAAS,EAAE;QACV,wCAAwC;QACxC,OAAO,EAAE;YACR,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,KAAK;YACf,aAAa,EAAE,IAAI,CAAC,+CAA+C;SACnE;QAED,mCAAmC;QACnC,UAAU,EAAE;YACX,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,KAAK;SACpB;KACD;IAED,2BAA2B;IAC3B,EAAE;IACF,6DAA6D;IAC7D,4EAA4E;IAC5E,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,wBAAwB;IACxB,EAAE;IACF,4EAA4E;IAC5E,iEAAiE;IACjE,wEAAwE;IACxE,QAAQ;IACR,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,OAAO,EAAE;QACR;YACC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,CAAC,WAAW,CAAC;YACrB,MAAM,EAAE,KAAK;SACb;QACD;YACC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,CAAC,WAAW,CAAC;YACrB,MAAM,EAAE,KAAK;SACb;QACD;YACC,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;YACjC,MAAM,EAAE,KAAK;SACb;QACD;YACC,IAAI,EAAE,qCAAqC;YAC3C,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YAClC,MAAM,EAAE,KAAK;SACb;QACD;YACC,mEAAmE;YACnE,iEAAiE;YACjE,gCAAgC;YAChC,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;YACjC,MAAM,EAAE,KAAK;SACb;KACD;IAED,aAAa;IACb,UAAU,EAAE;QACX;YACC,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,4BAA4B;YAClC,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;IAwBH;YACD,IAAI,EAAE,oCAAoC;SAC1C;QACD,yEAAyE;QACzE,EAAE;QACF,sEAAsE;QACtE,qEAAqE;QACrE,oEAAoE;QACpE,yDAAyD;QACzD,iEAAiE;QACjE,wDAAwD;QACxD,+CAA+C;QAC/C,EAAE;QACF,uEAAuE;QACvE,qCAAqC;QACrC,kDAAkD;QAClD,EAAE;QACF,mEAAmE;QACnE,uEAAuE;QACvE,wDAAwD;QACxD,EAAE;QACF,wCAAwC;QACxC,sEAAsE;QACtE,mEAAmE;QACnE,wEAAwE;QACxE,2DAA2D;QAC3D,iEAAiE;QACjE,cAAc;QACd,kCAAkC;QAClC,EAAE;QACF,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,wBAAwB;QACxB,EAAE;QACF,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;;QAEpE;YACC,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,4CAA4C;YAClD,sEAAsE;YACtE,+DAA+D;YAC/D,wEAAwE;YACxE,iEAAiE;YACjE,uEAAuE;YACvE,kDAAkD;YAClD,EAAE;YACF,uEAAuE;YACvE,wEAAwE;YACxE,mDAAmD;YACnD,EAAE,EAAE;;;IAGH;YACD,IAAI,EAAE;;;;;IAKL;SACD;KACD;IAED,iBAAiB;IACjB,OAAO,EAAE,CAAC;IAEV,sBAAsB;IACtB,UAAU,EAAE;QACX,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,WAAW;KACtB;IACD,MAAM,EAAE;QACP,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,MAAM;KAChB;IACD,UAAU,EAAE,KAAK,EAAE,gCAAgC;IAEnD,oBAAoB;IACpB,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,cAAc,EAAE,iBAAiB;IAEjC,wBAAwB;IACxB,aAAa,EAAE;QACd,iBAAiB,EAAE;YAClB,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,SAAS;SAChB;KACD;IAED,QAAQ;IACR,KAAK,EAAE,SAAS;IAEhB,aAAa;IACb,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IAErB,WAAW;IACX,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,wBAAwB;IACnC,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,CAAC;IAEhD,2BAA2B;IAC3B,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,KAAK;CACrB,CAAC;AAEF,UAAU;AAEV,eAAe,0BAA0B,CAAC"}

package/dist/storage/touch-identity.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Ambient touch identity resolution.
+ *
+ * Gathers "who touched this, where, working on what" from the runtime so a
+ * recorded touch can name a machine, a workspace, and a unit of work.
+ *
+ * EVERY LOOKUP IS BEST-EFFORT AND INDEPENDENT. A failure in one field must
+ * never cost the others, and must never cost the touch itself: a row with a
+ * degraded identity is strictly better than no row. Nothing here throws.
+ *
+ * All resolution is via `runtime.context(...)` — no package imports — so the
+ * identity sources stay swappable. See
+ * docs/architecture/AMBIENT-AGENT-AWARENESS.md.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { TouchIdentity, CachedMachineIdentity } from '../schemas/touch-identity.ts';
+export type { TouchIdentity } from '../schemas/touch-identity.ts';
+/**
+ * Resolve this machine's stable identity via `runtime/machine-identity`.
+ *
+ * Cached for the runtime lifetime: the id is persisted on disk and the
+ * hostname does not meaningfully change mid-session, so re-reading it on every
+ * file touch would be pure overhead on a hot path.
+ */
+export declare class TouchIdentityCache {
+    generation: number;
+    machine?: CachedMachineIdentity;
+    readonly checkouts: Map<string, {
+        expiresAt: number;
+        gitBranch?: string | undefined;
+    }>;
+    reset(): void;
+}
+/** Test seam: forget this runtime's cached machine and checkout identity. */
+export declare function resetTouchIdentityCache(runtime: RuntimeRef): void;
+/**
+ * Resolve the full ambient identity for a touch.
+ *
+ * Lookups run concurrently — this sits on the fs write path and the pieces are
+ * independent, so there is no reason to pay for them serially.
+ */
+export declare function resolveTouchIdentity(runtime: RuntimeRef): Promise<TouchIdentity>;
+//# sourceMappingURL=touch-identity.d.ts.map

package/dist/storage/touch-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"touch-identity.d.ts","sourceRoot":"","sources":["../../src/storage/touch-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAA0B,MAAM,8BAA8B,CAAC;AACjH,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAuDlE;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC9B,UAAU,SAAK;IACf,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,QAAQ,CAAC,SAAS;;;OAA6C;IAE/D,KAAK,IAAI,IAAI;CAKb;AA2BD,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAEjE;AA4BD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CA6EtF"}

package/dist/storage/touch-identity.js

@@ -0,0 +1,155 @@
+/**
+ * Ambient touch identity resolution.
+ *
+ * Gathers "who touched this, where, working on what" from the runtime so a
+ * recorded touch can name a machine, a workspace, and a unit of work.
+ *
+ * EVERY LOOKUP IS BEST-EFFORT AND INDEPENDENT. A failure in one field must
+ * never cost the others, and must never cost the touch itself: a row with a
+ * degraded identity is strictly better than no row. Nothing here throws.
+ *
+ * All resolution is via `runtime.context(...)` — no package imports — so the
+ * identity sources stay swappable. See
+ * docs/architecture/AMBIENT-AGENT-AWARENESS.md.
+ */
+import { tryGetVibesClient } from '@vibesdotdev/kernel/client';
+import * as z from 'zod/v4';
+import { attempt } from "../ambient/attempt.js";
+function nonEmpty(value) {
+    const parsed = z.string().min(1).safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+function participantSlug(value) {
+    const parsed = z.string().min(1).safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    return parsed.data
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 64) || undefined;
+}
+const GitStatusReaderSchema = z.custom((value) => value instanceof Object && 'status' in value && Object(value).status instanceof Function);
+/**
+ * Resolve this machine's stable identity via `runtime/machine-identity`.
+ *
+ * Cached for the runtime lifetime: the id is persisted on disk and the
+ * hostname does not meaningfully change mid-session, so re-reading it on every
+ * file touch would be pure overhead on a hot path.
+ */
+export class TouchIdentityCache {
+    generation = 0;
+    machine;
+    checkouts = new Map();
+    reset() {
+        this.generation++;
+        this.machine = undefined;
+        this.checkouts.clear();
+    }
+}
+async function resolveMachine(runtime, cache) {
+    const generation = cache.generation;
+    const cached = cache.machine;
+    if (cached)
+        return cached;
+    const identityOutcome = await attempt(runtime, async () => {
+        const reader = await runtime.context('runtime/machine-identity');
+        return reader?.getIdentity ? await reader.getIdentity() : undefined;
+    }, 'touch identity lookup');
+    const identity = identityOutcome.ok ? identityOutcome.value : undefined;
+    const resolved = {
+        machineId: nonEmpty(identity?.id),
+        machineName: nonEmpty(identity?.name)
+    };
+    if (cache.generation === generation)
+        cache.machine = resolved;
+    return resolved;
+}
+/** Test seam: forget this runtime's cached machine and checkout identity. */
+export function resetTouchIdentityCache(runtime) {
+    tryGetVibesClient('external', runtime)?.touchIdentity.reset();
+}
+async function resolveCheckout(runtime, workspaceRoot, cache) {
+    if (!workspaceRoot)
+        return {};
+    const generation = cache.generation;
+    const byRoot = cache.checkouts;
+    const hit = byRoot.get(workspaceRoot);
+    if (hit && hit.expiresAt > Date.now()) {
+        return { gitBranch: hit.gitBranch };
+    }
+    const statusOutcome = await attempt(runtime, async () => {
+        const operations = GitStatusReaderSchema.parse(await runtime.query('git/operations').resolve());
+        return operations.status(workspaceRoot);
+    }, 'touch identity lookup');
+    const status = statusOutcome.ok ? statusOutcome.value : undefined;
+    const entry = { gitBranch: nonEmpty(status?.branch), expiresAt: Date.now() + 2_000 };
+    if (cache.generation === generation)
+        byRoot.set(workspaceRoot, entry);
+    return { gitBranch: entry.gitBranch };
+}
+/**
+ * Resolve the full ambient identity for a touch.
+ *
+ * Lookups run concurrently — this sits on the fs write path and the pieces are
+ * independent, so there is no reason to pay for them serially.
+ */
+export async function resolveTouchIdentity(runtime) {
+    // Identity is the active invocation's actor, never a declared qualifier.
+    const actor = runtime.scope.actor ?? {};
+    // Standalone identity readers remain usable without activating External.
+    // Only an activated client retains results beyond this call.
+    const cache = tryGetVibesClient('external', runtime)?.touchIdentity ?? new TouchIdentityCache();
+    const [machine, ambientWorkspaceRootOutcome, workOutcome] = await Promise.all([
+        resolveMachine(runtime, cache),
+        attempt(runtime, async () => nonEmpty(await runtime.context('runtime/workspace-path')), 'touch identity lookup'),
+        attempt(runtime, async () => {
+            const session = await runtime.context('session/manager');
+            const getDefaultActiveSession = session?.getDefaultActiveSession;
+            const activeSessionId = nonEmpty(actor.sessionId) ??
+                nonEmpty(session?.activeSessionId) ??
+                (getDefaultActiveSession instanceof Function
+                    ? nonEmpty(await getDefaultActiveSession())
+                    : undefined);
+            const getSession = session?.getSession;
+            const current = activeSessionId && getSession instanceof Function
+                ? await getSession(activeSessionId)
+                : undefined;
+            const participantId = nonEmpty(actor.participantId) ?? nonEmpty(current?.ownerParticipant);
+            const getParticipant = session?.getParticipant;
+            const profile = participantId && getParticipant instanceof Function
+                ? await getParticipant(participantId)
+                : undefined;
+            const storedSlug = profile?.metadata?.slug;
+            const slug = participantSlug(storedSlug) ?? participantSlug(profile?.name ?? participantId);
+            const metadata = current?.metadata;
+            return {
+                participantId,
+                participantSlug: slug,
+                workspaceRoot: nonEmpty(metadata?.workspacePath),
+                workItemId: nonEmpty(current?.workItemId) ?? nonEmpty(session?.activeWorkItemId),
+                workItemTitle: nonEmpty(metadata?.workItemTitle) ?? nonEmpty(session?.activeWorkItemTitle)
+            };
+        })
+    ]);
+    const ambientWorkspaceRoot = ambientWorkspaceRootOutcome.ok
+        ? ambientWorkspaceRootOutcome.value
+        : undefined;
+    const work = workOutcome.ok ? workOutcome.value : undefined;
+    const workspaceRoot = ambientWorkspaceRoot ?? work?.workspaceRoot;
+    const checkoutOutcome = await attempt(runtime, () => resolveCheckout(runtime, workspaceRoot, cache), 'touch identity lookup');
+    const checkout = checkoutOutcome.ok ? checkoutOutcome.value : undefined;
+    return {
+        machineId: machine.machineId,
+        machineName: machine.machineName,
+        participantId: work?.participantId,
+        participantSlug: work?.participantSlug,
+        workspaceRoot,
+        gitBranch: checkout?.gitBranch,
+        workItemId: work?.workItemId,
+        workItemTitle: work?.workItemTitle
+    };
+}
+//# sourceMappingURL=touch-identity.js.map

package/dist/storage/touch-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"touch-identity.js","sourceRoot":"","sources":["../../src/storage/touch-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAgChD,SAAS,QAAQ,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI;SAChB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AAC7B,CAAC;AAOD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,MAAM,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,QAAQ,CACnG,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IAC9B,UAAU,GAAG,CAAC,CAAC;IACf,OAAO,CAAyB;IACvB,SAAS,GAAG,IAAI,GAAG,EAAkC,CAAC;IAE/D,KAAK;QACJ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACD;AAED,KAAK,UAAU,cAAc,CAC5B,OAAmB,EAAE,KAAyB;IAE9C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,eAAe,GAAG,MAAM,OAAO,CACpC,OAAO,EACP,KAAK,IAAI,EAAE;QACV,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,0BAA0B,CAAC,CAAC;QACxF,OAAO,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC,EACD,uBAAuB,CACvB,CAAC;IACF,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,QAAQ,GAAG;QAChB,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjC,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;KACrC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC9D,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,OAAmB;IAC1D,iBAAiB,CAAiB,UAAU,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,OAAmB,EACnB,aAAiC,EACjC,KAAyB;IAEzB,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAClC,OAAO,EACP,KAAK,IAAI,EAAE;QACV,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,OAAO,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC,EACD,uBAAuB,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB;IAC7D,yEAAyE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IACxC,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAiB,UAAU,EAAE,OAAO,CAAC,EAAE,aAAa,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAChH,MAAM,CAAC,OAAO,EAAE,2BAA2B,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7E,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC;QAC9B,OAAO,CACN,OAAO,EACP,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC,EAC7E,uBAAuB,CACvB;QACD,OAAO,CACN,OAAO,EACP,KAAK,IAMF,EAAE;YACJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,iBAAiB,CAAC,CAAC;YAChF,MAAM,uBAAuB,GAAG,OAAO,EAAE,uBAAuB,CAAC;YACjE,MAAM,eAAe,GACpB,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;gBACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAClC,CAAC,uBAAuB,YAAY,QAAQ;oBAC3C,CAAC,CAAC,QAAQ,CAAC,MAAM,uBAAuB,EAAE,CAAC;oBAC3C,CAAC,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;YACvC,MAAM,OAAO,GACZ,eAAe,IAAI,UAAU,YAAY,QAAQ;gBAChD,CAAC,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC;gBACnC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,aAAa,GAClB,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACtE,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;YAC/C,MAAM,OAAO,GACZ,aAAa,IAAI,cAAc,YAAY,QAAQ;gBAClD,CAAC,CAAC,MAAM,cAAc,CAAC,aAAa,CAAC;gBACrC,CAAC,CAAC,SAAS,CAAC;YACf,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;YAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,IAAI,aAAa,CAAC,CAAC;YAC5F,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,OAAO;gBACN,aAAa;gBACb,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;gBAChD,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAChF,aAAa,EACZ,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;aAC5E,CAAC;QACH,CAAC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,EAAE;QAC1D,CAAC,CAAC,2BAA2B,CAAC,KAAK;QACnC,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,aAAa,GAAG,oBAAoB,IAAI,IAAI,EAAE,aAAa,CAAC;IAClE,MAAM,eAAe,GAAG,MAAM,OAAO,CACpC,OAAO,EACP,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EACpD,uBAAuB,CACvB,CAAC;IACF,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,OAAO;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,IAAI,EAAE,aAAa;QAClC,eAAe,EAAE,IAAI,EAAE,eAAe;QACtC,aAAa;QACb,SAAS,EAAE,QAAQ,EAAE,SAAS;QAC9B,UAAU,EAAE,IAAI,EAAE,UAAU;QAC5B,aAAa,EAAE,IAAI,EAAE,aAAa;KAClC,CAAC;AACH,CAAC"}

package/dist/svelte/external-svelte.plugin.d.ts

@@ -0,0 +1,39 @@
+export declare const externalWidgetDescriptor: {
+    id: string;
+    kind: "tools/ui";
+    surfaces: ("cli" | "tui" | "worker" | "bridge" | "web")[];
+    role: "badge" | "widget" | "approval";
+    targetToolId: string;
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    hardware?: ("consumer" | "cloud")[] | undefined;
+    targetId?: string | undefined;
+    placement?: "inline" | "top" | "bottom" | undefined;
+};
+/**
+ * Runtime plugin (browser/chat parity).
+ *
+ * The unified `external` tool is External-owned. Its designed Kit ToolCard
+ * lives here so Chat hosts discover it through `tools/ui`, not a host-local
+ * card table. The consumer plugin (`./consumer/node/plugin`) must not import
+ * this graph.
+ */
+export declare const externalSveltePlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default externalSveltePlugin;
+//# sourceMappingURL=external-svelte.plugin.d.ts.map

package/dist/svelte/external-svelte.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-svelte.plugin.d.ts","sourceRoot":"","sources":["../../src/svelte/external-svelte.plugin.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGnC,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,6CAW/B,CAAC;AAEH,eAAe,oBAAoB,CAAC"}

package/dist/svelte/external-svelte.plugin.js

@@ -0,0 +1,25 @@
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { createSvelteToolWidgetDescriptor, createSvelteToolWidgetLoader } from '@vibesdotdev/tools/svelte/tool-widgets';
+export const externalWidgetDescriptor = createSvelteToolWidgetDescriptor({
+    toolId: 'external',
+    tags: ['external', 'integration']
+});
+/**
+ * Runtime plugin (browser/chat parity).
+ *
+ * The unified `external` tool is External-owned. Its designed Kit ToolCard
+ * lives here so Chat hosts discover it through `tools/ui`, not a host-local
+ * card table. The consumer plugin (`./consumer/node/plugin`) must not import
+ * this graph.
+ */
+export const externalSveltePlugin = createRuntimePlugin({
+    id: '@vibesdotdev/external/svelte',
+    name: 'External Svelte',
+    description: 'Svelte/browser surface for the unified external tool card',
+    dependencies: ['tools'],
+    descriptors: [externalWidgetDescriptor],
+    loaders: [
+        createSvelteToolWidgetLoader(externalWidgetDescriptor, () => import('./tool-widgets/ExternalToolCard.svelte'))
+    ]
+});
+export default externalSveltePlugin;