@xopcai/xopc 0.0.105 → 0.0.107

package/dist/src/agent/mcp/bundle-mcp-config.js

@@ -1,18 +1,26 @@
-import { isManagedConnectorServer } from "../../connectors/materialize.js";
 import { normalizeConfiguredMcpServers } from "../../config/mcp-config-normalize.js";
+import { loadEnabledBundleMcpConfig } from "../../extensions/bundle-mcp.js";
 //#region src/agent/mcp/bundle-mcp-config.ts
-function listConnectorManagedMcpServers(params) {
+function listConfiguredMcpServers(params) {
 	const configuredMcp = normalizeConfiguredMcpServers(params.cfg?.mcp?.servers);
-	return Object.fromEntries(Object.entries(configuredMcp).filter(([, server]) => isManagedConnectorServer(server)).map(([name, server]) => [name, params.mapConfiguredServer(server, name)]));
+	return Object.fromEntries(Object.entries(configuredMcp).map(([name, server]) => [name, params.mapConfiguredServer(server, name)]));
 }
 function loadMergedBundleMcpConfig(params) {
 	const mapConfiguredServer = params.mapConfiguredServer ?? ((server) => server);
+	const bundled = loadEnabledBundleMcpConfig({
+		workspaceDir: params.workspaceDir,
+		cfg: params.cfg
+	});
+	const configured = listConfiguredMcpServers({
+		cfg: params.cfg,
+		mapConfiguredServer
+	});
 	return {
-		config: { mcpServers: listConnectorManagedMcpServers({
-			cfg: params.cfg,
-			mapConfiguredServer
-		}) },
-		diagnostics: []
+		config: { mcpServers: {
+			...bundled.config.mcpServers,
+			...configured
+		} },
+		diagnostics: bundled.diagnostics
 	};
 }
 //#endregion

package/dist/src/agent/mcp/bundle-mcp-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-mcp-config.js","names":[],"sources":["../../../../src/agent/mcp/bundle-mcp-config.ts"],"sourcesContent":["import { normalizeConfiguredMcpServers } from '../../config/mcp-config-normalize.js';\nimport { isManagedConnectorServer } from '../../connectors/materialize.js';\nimport type { Config } from '../../config/schema.js';\nimport {\n  type BundleMcpConfig,\n  type BundleMcpDiagnostic,\n  type BundleMcpServerConfig,\n} from '../../extensions/bundle-mcp.js';\n\nexport type MergedBundleMcpConfig = {\n  config: BundleMcpConfig;\n  diagnostics: BundleMcpDiagnostic[];\n};\n\nexport type BundleMcpServerMapper = (\n  server: BundleMcpServerConfig,\n  name: string,\n) => BundleMcpServerConfig;\n\nfunction listConnectorManagedMcpServers(params: {\n  cfg?: Config;\n  mapConfiguredServer: BundleMcpServerMapper;\n}): BundleMcpConfig[\"mcpServers\"] {\n  const configuredMcp = normalizeConfiguredMcpServers(params.cfg?.mcp?.servers);\n  return Object.fromEntries(\n    Object.entries(configuredMcp)\n      .filter(([, server]) => isManagedConnectorServer(server))\n      .map(([name, server]) => [\n        name,\n        params.mapConfiguredServer(server as BundleMcpServerConfig, name),\n      ]),\n  ) satisfies BundleMcpConfig[\"mcpServers\"];\n}\n\nexport function loadMergedBundleMcpConfig(params: {\n  workspaceDir: string;\n  cfg?: Config;\n  mapConfiguredServer?: BundleMcpServerMapper;\n}): MergedBundleMcpConfig {\n  const mapConfiguredServer = params.mapConfiguredServer ?? ((server) => server);\n\n  return {\n    config: {\n      mcpServers: listConnectorManagedMcpServers({\n        cfg: params.cfg,\n        mapConfiguredServer,\n      }),\n    },\n    diagnostics: [],\n  };\n}\n"],"mappings":";;;AAmBA,SAAS,+BAA+B,QAGN;CAChC,MAAM,gBAAgB,8BAA8B,OAAO,KAAK,KAAK,QAAQ;AAC7E,QAAO,OAAO,YACZ,OAAO,QAAQ,cAAc,CAC1B,QAAQ,GAAG,YAAY,yBAAyB,OAAO,CAAC,CACxD,KAAK,CAAC,MAAM,YAAY,CACvB,MACA,OAAO,oBAAoB,QAAiC,KAAK,CAClE,CAAC,CACL;;AAGH,SAAgB,0BAA0B,QAIhB;CACxB,MAAM,sBAAsB,OAAO,yBAAyB,WAAW;AAEvE,QAAO;EACL,QAAQ,EACN,YAAY,+BAA+B;GACzC,KAAK,OAAO;GACZ;GACD,CAAC,EACH;EACD,aAAa,EAAE;EAChB"}
+{"version":3,"file":"bundle-mcp-config.js","names":[],"sources":["../../../../src/agent/mcp/bundle-mcp-config.ts"],"sourcesContent":["import { normalizeConfiguredMcpServers } from '../../config/mcp-config-normalize.js';\nimport type { Config } from '../../config/schema.js';\nimport {\n  loadEnabledBundleMcpConfig,\n  type BundleMcpConfig,\n  type BundleMcpDiagnostic,\n  type BundleMcpServerConfig,\n} from '../../extensions/bundle-mcp.js';\n\nexport type MergedBundleMcpConfig = {\n  config: BundleMcpConfig;\n  diagnostics: BundleMcpDiagnostic[];\n};\n\nexport type BundleMcpServerMapper = (\n  server: BundleMcpServerConfig,\n  name: string,\n) => BundleMcpServerConfig;\n\nfunction listConfiguredMcpServers(params: {\n  cfg?: Config;\n  mapConfiguredServer: BundleMcpServerMapper;\n}): BundleMcpConfig[\"mcpServers\"] {\n  const configuredMcp = normalizeConfiguredMcpServers(params.cfg?.mcp?.servers);\n  return Object.fromEntries(\n    Object.entries(configuredMcp)\n      .map(([name, server]) => [\n        name,\n        params.mapConfiguredServer(server as BundleMcpServerConfig, name),\n      ]),\n  ) satisfies BundleMcpConfig[\"mcpServers\"];\n}\n\nexport function loadMergedBundleMcpConfig(params: {\n  workspaceDir: string;\n  cfg?: Config;\n  mapConfiguredServer?: BundleMcpServerMapper;\n}): MergedBundleMcpConfig {\n  const mapConfiguredServer = params.mapConfiguredServer ?? ((server) => server);\n  const bundled = loadEnabledBundleMcpConfig({\n    workspaceDir: params.workspaceDir,\n    cfg: params.cfg,\n  });\n  const configured = listConfiguredMcpServers({\n    cfg: params.cfg,\n    mapConfiguredServer,\n  });\n\n  return {\n    config: {\n      mcpServers: {\n        ...bundled.config.mcpServers,\n        ...configured,\n      },\n    },\n    diagnostics: bundled.diagnostics,\n  };\n}\n"],"mappings":";;;AAmBA,SAAS,yBAAyB,QAGA;CAChC,MAAM,gBAAgB,8BAA8B,OAAO,KAAK,KAAK,QAAQ;AAC7E,QAAO,OAAO,YACZ,OAAO,QAAQ,cAAc,CAC1B,KAAK,CAAC,MAAM,YAAY,CACvB,MACA,OAAO,oBAAoB,QAAiC,KAAK,CAClE,CAAC,CACL;;AAGH,SAAgB,0BAA0B,QAIhB;CACxB,MAAM,sBAAsB,OAAO,yBAAyB,WAAW;CACvE,MAAM,UAAU,2BAA2B;EACzC,cAAc,OAAO;EACrB,KAAK,OAAO;EACb,CAAC;CACF,MAAM,aAAa,yBAAyB;EAC1C,KAAK,OAAO;EACZ;EACD,CAAC;AAEF,QAAO;EACL,QAAQ,EACN,YAAY;GACV,GAAG,QAAQ,OAAO;GAClB,GAAG;GACJ,EACF;EACD,aAAa,QAAQ;EACtB"}

package/dist/src/agent/mcp/bundle-mcp-materialize.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { buildSafeToolName, normalizeReservedToolNames } from "./bundle-mcp-names.js";
 import { setPluginToolMeta } from "./mcp-tool-meta.js";
 import crypto from "node:crypto";

package/dist/src/agent/mcp/bundle-mcp-policy.js

@@ -1,10 +1,10 @@
 import "./bundle-mcp-names.js";
-import { listConnectorInstances } from "../../connectors/instances.js";
+import { hasAnyMcpServers } from "../../extensions/bundle-mcp.js";
 //#region src/agent/mcp/bundle-mcp-policy.ts
 function shouldCreateBundleMcpRuntimeForAttempt(params) {
 	if (params.toolsEnabled === false) return false;
 	if (params.disabledTools?.has("bundle-mcp")) return false;
-	return listConnectorInstances(params.cfg ?? {}).length > 0;
+	return hasAnyMcpServers(params.cfg ?? {});
 }
 function isMcpToolName(toolName) {
 	return toolName.includes("__");

package/dist/src/agent/mcp/bundle-mcp-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-mcp-policy.js","names":[],"sources":["../../../../src/agent/mcp/bundle-mcp-policy.ts"],"sourcesContent":["import { TOOL_NAME_SEPARATOR } from './bundle-mcp-names.js';\nimport { listConnectorInstances } from '../../connectors/instances.js';\nimport type { Config } from '../../config/schema.js';\n\nexport function shouldCreateBundleMcpRuntimeForAttempt(params: {\n  cfg?: Config;\n  toolsEnabled?: boolean;\n  disabledTools?: Set<string>;\n}): boolean {\n  if (params.toolsEnabled === false) {\n    return false;\n  }\n  if (params.disabledTools?.has('bundle-mcp')) {\n    return false;\n  }\n  return listConnectorInstances(params.cfg ?? ({} as Config)).length > 0;\n}\n\nexport function isMcpToolName(toolName: string): boolean {\n  return toolName.includes(TOOL_NAME_SEPARATOR);\n}\n\nexport function parseMcpToolName(toolName: string): { serverId: string; toolId: string } | null {\n  const idx = toolName.indexOf(TOOL_NAME_SEPARATOR);\n  if (idx <= 0) {\n    return null;\n  }\n  return {\n    serverId: toolName.slice(0, idx),\n    toolId: toolName.slice(idx + TOOL_NAME_SEPARATOR.length),\n  };\n}\n"],"mappings":";;;AAIA,SAAgB,uCAAuC,QAI3C;AACV,KAAI,OAAO,iBAAiB,MAC1B,QAAO;AAET,KAAI,OAAO,eAAe,IAAI,aAAa,CACzC,QAAO;AAET,QAAO,uBAAuB,OAAO,OAAQ,EAAE,CAAY,CAAC,SAAS;;AAGvE,SAAgB,cAAc,UAA2B;AACvD,QAAO,SAAS,SAAA,KAA6B;;AAG/C,SAAgB,iBAAiB,UAA+D;CAC9F,MAAM,MAAM,SAAS,QAAA,KAA4B;AACjD,KAAI,OAAO,EACT,QAAO;AAET,QAAO;EACL,UAAU,SAAS,MAAM,GAAG,IAAI;EAChC,QAAQ,SAAS,MAAM,MAAA,EAAiC;EACzD"}
+{"version":3,"file":"bundle-mcp-policy.js","names":[],"sources":["../../../../src/agent/mcp/bundle-mcp-policy.ts"],"sourcesContent":["import { TOOL_NAME_SEPARATOR } from './bundle-mcp-names.js';\nimport { hasAnyMcpServers } from '../../extensions/bundle-mcp.js';\nimport type { Config } from '../../config/schema.js';\n\nexport function shouldCreateBundleMcpRuntimeForAttempt(params: {\n  cfg?: Config;\n  toolsEnabled?: boolean;\n  disabledTools?: Set<string>;\n}): boolean {\n  if (params.toolsEnabled === false) {\n    return false;\n  }\n  if (params.disabledTools?.has('bundle-mcp')) {\n    return false;\n  }\n  return hasAnyMcpServers(params.cfg ?? ({} as Config));\n}\n\nexport function isMcpToolName(toolName: string): boolean {\n  return toolName.includes(TOOL_NAME_SEPARATOR);\n}\n\nexport function parseMcpToolName(toolName: string): { serverId: string; toolId: string } | null {\n  const idx = toolName.indexOf(TOOL_NAME_SEPARATOR);\n  if (idx <= 0) {\n    return null;\n  }\n  return {\n    serverId: toolName.slice(0, idx),\n    toolId: toolName.slice(idx + TOOL_NAME_SEPARATOR.length),\n  };\n}\n"],"mappings":";;;AAIA,SAAgB,uCAAuC,QAI3C;AACV,KAAI,OAAO,iBAAiB,MAC1B,QAAO;AAET,KAAI,OAAO,eAAe,IAAI,aAAa,CACzC,QAAO;AAET,QAAO,iBAAiB,OAAO,OAAQ,EAAE,CAAY;;AAGvD,SAAgB,cAAc,UAA2B;AACvD,QAAO,SAAS,SAAA,KAA6B;;AAG/C,SAAgB,iBAAiB,UAA+D;CAC9F,MAAM,MAAM,SAAS,QAAA,KAA4B;AACjD,KAAI,OAAO,EACT,QAAO;AAET,QAAO;EACL,UAAU,SAAS,MAAM,GAAG,IAAI;EAChC,QAAQ,SAAS,MAAM,MAAA,EAAiC;EACzD"}

package/dist/src/agent/mcp/bundle-mcp-runtime.js

@@ -1,11 +1,11 @@
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { resolveGlobalSingleton } from "../../utils/global-singleton.js";
 import { sanitizeServerName } from "./bundle-mcp-names.js";
-import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";
 import { redactSensitiveUrlLikeString } from "../../utils/redact-sensitive-url.js";
 import { loadEmbeddedMcpConfig } from "./embedded-mcp.js";
+import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";
 import { isMcpConfigRecord } from "./mcp-config-shared.js";
 import { resolveMcpTransport } from "./mcp-transport.js";
 import crypto from "node:crypto";

package/dist/src/agent/mcp/mcp-http.js

@@ -30,7 +30,7 @@ function resolveHttpMcpServerLaunchConfig(raw, options) {
 	return {
 		ok: true,
 		config: {
-			transportType: options?.transportType ?? "sse",
+			transportType: options?.transportType ?? "streamable-http",
 			url,
 			headers
 		}

package/dist/src/agent/mcp/mcp-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-http.js","names":[],"sources":["../../../../src/agent/mcp/mcp-http.ts"],"sourcesContent":["import {\n  redactSensitiveUrl,\n  redactSensitiveUrlLikeString,\n} from \"../../utils/redact-sensitive-url.js\";\nimport { isMcpConfigRecord, toMcpStringRecord } from \"./mcp-config-shared.js\";\n\nexport type HttpMcpTransportType = \"sse\" | \"streamable-http\";\n\nexport type HttpMcpServerLaunchConfig = {\n  transportType: HttpMcpTransportType;\n  url: string;\n  headers?: Record<string, string>;\n};\n\nexport type HttpMcpServerLaunchResult =\n  | { ok: true; config: HttpMcpServerLaunchConfig }\n  | { ok: false; reason: string };\n\nexport function resolveHttpMcpServerLaunchConfig(\n  raw: unknown,\n  options?: {\n    transportType?: HttpMcpTransportType;\n    onDroppedHeader?: (key: string, value: unknown) => void;\n    onMalformedHeaders?: (value: unknown) => void;\n  },\n): HttpMcpServerLaunchResult {\n  if (!isMcpConfigRecord(raw)) {\n    return { ok: false, reason: \"server config must be an object\" };\n  }\n  if (typeof raw.url !== \"string\" || raw.url.trim().length === 0) {\n    return { ok: false, reason: \"its url is missing\" };\n  }\n  const url = raw.url.trim();\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return {\n      ok: false,\n      reason: `its url is not a valid URL: ${redactSensitiveUrlLikeString(url)}`,\n    };\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return {\n      ok: false,\n      reason: `only http and https URLs are supported, got ${parsed.protocol}`,\n    };\n  }\n\n  let headers: Record<string, string> | undefined;\n  if (raw.headers !== undefined && raw.headers !== null) {\n    if (!isMcpConfigRecord(raw.headers)) {\n      options?.onMalformedHeaders?.(raw.headers);\n    } else {\n      headers = toMcpStringRecord(raw.headers, {\n        onDroppedEntry: options?.onDroppedHeader,\n      });\n    }\n  }\n\n  return {\n    ok: true,\n    config: {\n      transportType: options?.transportType ?? \"sse\",\n      url,\n      headers,\n    },\n  };\n}\n\nexport function describeHttpMcpServerLaunchConfig(config: HttpMcpServerLaunchConfig): string {\n  return redactSensitiveUrl(config.url);\n}\n"],"mappings":";;;AAkBA,SAAgB,iCACd,KACA,SAK2B;AAC3B,KAAI,CAAC,kBAAkB,IAAI,CACzB,QAAO;EAAE,IAAI;EAAO,QAAQ;EAAmC;AAEjE,KAAI,OAAO,IAAI,QAAQ,YAAY,IAAI,IAAI,MAAM,CAAC,WAAW,EAC3D,QAAO;EAAE,IAAI;EAAO,QAAQ;EAAsB;CAEpD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,IAAI;SACf;AACN,SAAO;GACL,IAAI;GACJ,QAAQ,+BAA+B,6BAA6B,IAAI;GACzE;;AAEH,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACrD,QAAO;EACL,IAAI;EACJ,QAAQ,+CAA+C,OAAO;EAC/D;CAGH,IAAI;AACJ,KAAI,IAAI,YAAY,KAAA,KAAa,IAAI,YAAY,KAC/C,KAAI,CAAC,kBAAkB,IAAI,QAAQ,CACjC,UAAS,qBAAqB,IAAI,QAAQ;KAE1C,WAAU,kBAAkB,IAAI,SAAS,EACvC,gBAAgB,SAAS,iBAC1B,CAAC;AAIN,QAAO;EACL,IAAI;EACJ,QAAQ;GACN,eAAe,SAAS,iBAAiB;GACzC;GACA;GACD;EACF;;AAGH,SAAgB,kCAAkC,QAA2C;AAC3F,QAAO,mBAAmB,OAAO,IAAI"}
+{"version":3,"file":"mcp-http.js","names":[],"sources":["../../../../src/agent/mcp/mcp-http.ts"],"sourcesContent":["import {\n  redactSensitiveUrl,\n  redactSensitiveUrlLikeString,\n} from \"../../utils/redact-sensitive-url.js\";\nimport { isMcpConfigRecord, toMcpStringRecord } from \"./mcp-config-shared.js\";\n\nexport type HttpMcpTransportType = \"sse\" | \"streamable-http\";\n\nexport type HttpMcpServerLaunchConfig = {\n  transportType: HttpMcpTransportType;\n  url: string;\n  headers?: Record<string, string>;\n};\n\nexport type HttpMcpServerLaunchResult =\n  | { ok: true; config: HttpMcpServerLaunchConfig }\n  | { ok: false; reason: string };\n\nexport function resolveHttpMcpServerLaunchConfig(\n  raw: unknown,\n  options?: {\n    transportType?: HttpMcpTransportType;\n    onDroppedHeader?: (key: string, value: unknown) => void;\n    onMalformedHeaders?: (value: unknown) => void;\n  },\n): HttpMcpServerLaunchResult {\n  if (!isMcpConfigRecord(raw)) {\n    return { ok: false, reason: \"server config must be an object\" };\n  }\n  if (typeof raw.url !== \"string\" || raw.url.trim().length === 0) {\n    return { ok: false, reason: \"its url is missing\" };\n  }\n  const url = raw.url.trim();\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return {\n      ok: false,\n      reason: `its url is not a valid URL: ${redactSensitiveUrlLikeString(url)}`,\n    };\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return {\n      ok: false,\n      reason: `only http and https URLs are supported, got ${parsed.protocol}`,\n    };\n  }\n\n  let headers: Record<string, string> | undefined;\n  if (raw.headers !== undefined && raw.headers !== null) {\n    if (!isMcpConfigRecord(raw.headers)) {\n      options?.onMalformedHeaders?.(raw.headers);\n    } else {\n      headers = toMcpStringRecord(raw.headers, {\n        onDroppedEntry: options?.onDroppedHeader,\n      });\n    }\n  }\n\n  return {\n    ok: true,\n    config: {\n      transportType: options?.transportType ?? \"streamable-http\",\n      url,\n      headers,\n    },\n  };\n}\n\nexport function describeHttpMcpServerLaunchConfig(config: HttpMcpServerLaunchConfig): string {\n  return redactSensitiveUrl(config.url);\n}\n"],"mappings":";;;AAkBA,SAAgB,iCACd,KACA,SAK2B;AAC3B,KAAI,CAAC,kBAAkB,IAAI,CACzB,QAAO;EAAE,IAAI;EAAO,QAAQ;EAAmC;AAEjE,KAAI,OAAO,IAAI,QAAQ,YAAY,IAAI,IAAI,MAAM,CAAC,WAAW,EAC3D,QAAO;EAAE,IAAI;EAAO,QAAQ;EAAsB;CAEpD,MAAM,MAAM,IAAI,IAAI,MAAM;CAC1B,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,IAAI;SACf;AACN,SAAO;GACL,IAAI;GACJ,QAAQ,+BAA+B,6BAA6B,IAAI;GACzE;;AAEH,KAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACrD,QAAO;EACL,IAAI;EACJ,QAAQ,+CAA+C,OAAO;EAC/D;CAGH,IAAI;AACJ,KAAI,IAAI,YAAY,KAAA,KAAa,IAAI,YAAY,KAC/C,KAAI,CAAC,kBAAkB,IAAI,QAAQ,CACjC,UAAS,qBAAqB,IAAI,QAAQ;KAE1C,WAAU,kBAAkB,IAAI,SAAS,EACvC,gBAAgB,SAAS,iBAC1B,CAAC;AAIN,QAAO;EACL,IAAI;EACJ,QAAQ;GACN,eAAe,SAAS,iBAAiB;GACzC;GACA;GACD;EACF;;AAGH,SAAgB,kCAAkC,QAA2C;AAC3F,QAAO,mBAAmB,OAAO,IAAI"}

package/dist/src/agent/mcp/mcp-transport-config.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { resolveXopcMcpTransportAlias } from "../../config/mcp-config-normalize.js";
 import { sanitizeForLog } from "../../utils/sanitize-log.js";
 import { describeHttpMcpServerLaunchConfig, resolveHttpMcpServerLaunchConfig } from "./mcp-http.js";
@@ -71,12 +71,8 @@ function resolveMcpTransportConfig(serverName, rawServer) {
 		log.warn(`bundle-mcp: skipped server "${logServerName}" because transport "${sanitizeForLog(effectiveTransport)}" is not supported.`);
 		return null;
 	}
-	if (effectiveTransport === "streamable-http") {
-		const httpTransport = resolveHttpTransportConfig(serverName, rawServer, "streamable-http");
-		if (httpTransport) return httpTransport;
-	}
-	const sseTransport = resolveHttpTransportConfig(serverName, rawServer, "sse");
-	if (sseTransport) return sseTransport;
+	const httpTransport = resolveHttpTransportConfig(serverName, rawServer, effectiveTransport === "sse" ? "sse" : "streamable-http");
+	if (httpTransport) return httpTransport;
 	const stdioReason = stdioLaunch.ok === false ? stdioLaunch.reason : "not a stdio server";
 	const httpLaunch = resolveHttpMcpServerLaunchConfig(rawServer);
 	const httpReason = httpLaunch.ok === false ? httpLaunch.reason : "not an HTTP MCP server";

package/dist/src/agent/mcp/mcp-transport-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-transport-config.js","names":[],"sources":["../../../../src/agent/mcp/mcp-transport-config.ts"],"sourcesContent":["import { resolveXopcMcpTransportAlias } from \"../../config/mcp-config-normalize.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nconst log = createLogger(\"Mcp:Bundle\");\nimport { normalizeLowercaseStringOrEmpty } from \"../../utils/string-coerce.js\";\nimport { sanitizeForLog } from \"../../utils/sanitize-log.js\";\nimport {\n  describeHttpMcpServerLaunchConfig,\n  resolveHttpMcpServerLaunchConfig,\n  type HttpMcpTransportType,\n} from \"./mcp-http.js\";\nimport {\n  describeStdioMcpServerLaunchConfig,\n  resolveStdioMcpServerLaunchConfig,\n} from \"./mcp-stdio.js\";\n\ntype ResolvedBaseMcpTransportConfig = {\n  description: string;\n  connectionTimeoutMs: number;\n};\n\nexport type ResolvedStdioMcpTransportConfig = ResolvedBaseMcpTransportConfig & {\n  kind: \"stdio\";\n  transportType: \"stdio\";\n  command: string;\n  args?: string[];\n  env?: Record<string, string>;\n  cwd?: string;\n};\n\nexport type ResolvedHttpMcpTransportConfig = ResolvedBaseMcpTransportConfig & {\n  kind: \"http\";\n  transportType: HttpMcpTransportType;\n  url: string;\n  headers?: Record<string, string>;\n};\n\nexport type ResolvedMcpTransportConfig =\n  | ResolvedStdioMcpTransportConfig\n  | ResolvedHttpMcpTransportConfig;\n\nconst DEFAULT_CONNECTION_TIMEOUT_MS = 30_000;\n\nfunction getConnectionTimeoutMs(rawServer: unknown): number {\n  if (\n    rawServer &&\n    typeof rawServer === \"object\" &&\n    typeof (rawServer as { connectionTimeoutMs?: unknown }).connectionTimeoutMs === \"number\" &&\n    (rawServer as { connectionTimeoutMs: number }).connectionTimeoutMs > 0\n  ) {\n    return (rawServer as { connectionTimeoutMs: number }).connectionTimeoutMs;\n  }\n  return DEFAULT_CONNECTION_TIMEOUT_MS;\n}\n\nfunction getRequestedTransport(rawServer: unknown): string {\n  if (\n    !rawServer ||\n    typeof rawServer !== \"object\" ||\n    typeof (rawServer as { transport?: unknown }).transport !== \"string\"\n  ) {\n    return \"\";\n  }\n  return normalizeLowercaseStringOrEmpty((rawServer as { transport?: string }).transport);\n}\n\nfunction getRequestedTransportAlias(rawServer: unknown): HttpMcpTransportType | \"\" {\n  if (\n    !rawServer ||\n    typeof rawServer !== \"object\" ||\n    typeof (rawServer as { type?: unknown }).type !== \"string\"\n  ) {\n    return \"\";\n  }\n  return resolveXopcMcpTransportAlias((rawServer as { type?: string }).type) ?? \"\";\n}\n\nfunction resolveHttpTransportConfig(\n  serverName: string,\n  rawServer: unknown,\n  transportType: HttpMcpTransportType,\n): ResolvedHttpMcpTransportConfig | null {\n  const launch = resolveHttpMcpServerLaunchConfig(rawServer, {\n    transportType,\n    onDroppedHeader: (key) => {\n      log.warn(\n        {\n          phase: 'agent.mcp_connect',\n          serverName,\n          header: key,\n        },\n        `bundle-mcp: server \"${serverName}\": header \"${key}\" has an unsupported value type and was ignored`,\n      );\n    },\n    onMalformedHeaders: () => {\n      log.warn(\n        { phase: 'agent.mcp_connect', serverName },\n        `bundle-mcp: server \"${serverName}\": \"headers\" must be a JSON object; the value was ignored`,\n      );\n    },\n  });\n  if (!launch.ok) {\n    return null;\n  }\n  return {\n    kind: \"http\",\n    transportType: launch.config.transportType,\n    url: launch.config.url,\n    headers: launch.config.headers,\n    description: describeHttpMcpServerLaunchConfig(launch.config),\n    connectionTimeoutMs: getConnectionTimeoutMs(rawServer),\n  };\n}\n\nexport function resolveMcpTransportConfig(\n  serverName: string,\n  rawServer: unknown,\n): ResolvedMcpTransportConfig | null {\n  const logServerName = sanitizeForLog(serverName);\n  const requestedTransport = getRequestedTransport(rawServer);\n  const requestedTransportAlias = requestedTransport ? \"\" : getRequestedTransportAlias(rawServer);\n  const effectiveTransport = requestedTransport || requestedTransportAlias;\n  const stdioLaunch = resolveStdioMcpServerLaunchConfig(rawServer, {\n    onDroppedEnv: (key) => {\n      log.warn(\n        `bundle-mcp: server \"${logServerName}\": env \"${sanitizeForLog(key)}\" is blocked for stdio startup safety and was ignored.`,\n      );\n    },\n  });\n  if (stdioLaunch.ok) {\n    return {\n      kind: \"stdio\",\n      transportType: \"stdio\",\n      command: stdioLaunch.config.command,\n      args: stdioLaunch.config.args,\n      env: stdioLaunch.config.env,\n      cwd: stdioLaunch.config.cwd,\n      description: describeStdioMcpServerLaunchConfig(stdioLaunch.config),\n      connectionTimeoutMs: getConnectionTimeoutMs(rawServer),\n    };\n  }\n\n  if (\n    effectiveTransport &&\n    effectiveTransport !== \"sse\" &&\n    effectiveTransport !== \"streamable-http\"\n  ) {\n    log.warn(\n      `bundle-mcp: skipped server \"${logServerName}\" because transport \"${sanitizeForLog(effectiveTransport)}\" is not supported.`,\n    );\n    return null;\n  }\n\n  if (effectiveTransport === \"streamable-http\") {\n    const httpTransport = resolveHttpTransportConfig(serverName, rawServer, \"streamable-http\");\n    if (httpTransport) {\n      return httpTransport;\n    }\n  }\n\n  const sseTransport = resolveHttpTransportConfig(serverName, rawServer, \"sse\");\n  if (sseTransport) {\n    return sseTransport;\n  }\n\n  const stdioReason =\n    stdioLaunch.ok === false ? stdioLaunch.reason : 'not a stdio server';\n  const httpLaunch = resolveHttpMcpServerLaunchConfig(rawServer);\n  const httpReason =\n    httpLaunch.ok === false ? httpLaunch.reason : 'not an HTTP MCP server';\n  log.warn(\n    `bundle-mcp: skipped server \"${logServerName}\" because ${stdioReason} and ${httpReason}.`,\n  );\n  return null;\n}\n"],"mappings":";;;;;;;;aACqD;oBAE0B;AAD/E,MAAM,MAAM,aAAa,aAAa;AAsCtC,MAAM,gCAAgC;AAEtC,SAAS,uBAAuB,WAA4B;AAC1D,KACE,aACA,OAAO,cAAc,YACrB,OAAQ,UAAgD,wBAAwB,YAC/E,UAA8C,sBAAsB,EAErE,QAAQ,UAA8C;AAExD,QAAO;;AAGT,SAAS,sBAAsB,WAA4B;AACzD,KACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAsC,cAAc,SAE5D,QAAO;AAET,QAAO,gCAAiC,UAAqC,UAAU;;AAGzF,SAAS,2BAA2B,WAA+C;AACjF,KACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAiC,SAAS,SAElD,QAAO;AAET,QAAO,6BAA8B,UAAgC,KAAK,IAAI;;AAGhF,SAAS,2BACP,YACA,WACA,eACuC;CACvC,MAAM,SAAS,iCAAiC,WAAW;EACzD;EACA,kBAAkB,QAAQ;AACxB,OAAI,KACF;IACE,OAAO;IACP;IACA,QAAQ;IACT,EACD,uBAAuB,WAAW,aAAa,IAAI,iDACpD;;EAEH,0BAA0B;AACxB,OAAI,KACF;IAAE,OAAO;IAAqB;IAAY,EAC1C,uBAAuB,WAAW,2DACnC;;EAEJ,CAAC;AACF,KAAI,CAAC,OAAO,GACV,QAAO;AAET,QAAO;EACL,MAAM;EACN,eAAe,OAAO,OAAO;EAC7B,KAAK,OAAO,OAAO;EACnB,SAAS,OAAO,OAAO;EACvB,aAAa,kCAAkC,OAAO,OAAO;EAC7D,qBAAqB,uBAAuB,UAAU;EACvD;;AAGH,SAAgB,0BACd,YACA,WACmC;CACnC,MAAM,gBAAgB,eAAe,WAAW;CAChD,MAAM,qBAAqB,sBAAsB,UAAU;CAC3D,MAAM,0BAA0B,qBAAqB,KAAK,2BAA2B,UAAU;CAC/F,MAAM,qBAAqB,sBAAsB;CACjD,MAAM,cAAc,kCAAkC,WAAW,EAC/D,eAAe,QAAQ;AACrB,MAAI,KACF,uBAAuB,cAAc,UAAU,eAAe,IAAI,CAAC,wDACpE;IAEJ,CAAC;AACF,KAAI,YAAY,GACd,QAAO;EACL,MAAM;EACN,eAAe;EACf,SAAS,YAAY,OAAO;EAC5B,MAAM,YAAY,OAAO;EACzB,KAAK,YAAY,OAAO;EACxB,KAAK,YAAY,OAAO;EACxB,aAAa,mCAAmC,YAAY,OAAO;EACnE,qBAAqB,uBAAuB,UAAU;EACvD;AAGH,KACE,sBACA,uBAAuB,SACvB,uBAAuB,mBACvB;AACA,MAAI,KACF,+BAA+B,cAAc,uBAAuB,eAAe,mBAAmB,CAAC,qBACxG;AACD,SAAO;;AAGT,KAAI,uBAAuB,mBAAmB;EAC5C,MAAM,gBAAgB,2BAA2B,YAAY,WAAW,kBAAkB;AAC1F,MAAI,cACF,QAAO;;CAIX,MAAM,eAAe,2BAA2B,YAAY,WAAW,MAAM;AAC7E,KAAI,aACF,QAAO;CAGT,MAAM,cACJ,YAAY,OAAO,QAAQ,YAAY,SAAS;CAClD,MAAM,aAAa,iCAAiC,UAAU;CAC9D,MAAM,aACJ,WAAW,OAAO,QAAQ,WAAW,SAAS;AAChD,KAAI,KACF,+BAA+B,cAAc,YAAY,YAAY,OAAO,WAAW,GACxF;AACD,QAAO"}
+{"version":3,"file":"mcp-transport-config.js","names":[],"sources":["../../../../src/agent/mcp/mcp-transport-config.ts"],"sourcesContent":["import { resolveXopcMcpTransportAlias } from \"../../config/mcp-config-normalize.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nconst log = createLogger(\"Mcp:Bundle\");\nimport { normalizeLowercaseStringOrEmpty } from \"../../utils/string-coerce.js\";\nimport { sanitizeForLog } from \"../../utils/sanitize-log.js\";\nimport {\n  describeHttpMcpServerLaunchConfig,\n  resolveHttpMcpServerLaunchConfig,\n  type HttpMcpTransportType,\n} from \"./mcp-http.js\";\nimport {\n  describeStdioMcpServerLaunchConfig,\n  resolveStdioMcpServerLaunchConfig,\n} from \"./mcp-stdio.js\";\n\ntype ResolvedBaseMcpTransportConfig = {\n  description: string;\n  connectionTimeoutMs: number;\n};\n\nexport type ResolvedStdioMcpTransportConfig = ResolvedBaseMcpTransportConfig & {\n  kind: \"stdio\";\n  transportType: \"stdio\";\n  command: string;\n  args?: string[];\n  env?: Record<string, string>;\n  cwd?: string;\n};\n\nexport type ResolvedHttpMcpTransportConfig = ResolvedBaseMcpTransportConfig & {\n  kind: \"http\";\n  transportType: HttpMcpTransportType;\n  url: string;\n  headers?: Record<string, string>;\n};\n\nexport type ResolvedMcpTransportConfig =\n  | ResolvedStdioMcpTransportConfig\n  | ResolvedHttpMcpTransportConfig;\n\nconst DEFAULT_CONNECTION_TIMEOUT_MS = 30_000;\n\nfunction getConnectionTimeoutMs(rawServer: unknown): number {\n  if (\n    rawServer &&\n    typeof rawServer === \"object\" &&\n    typeof (rawServer as { connectionTimeoutMs?: unknown }).connectionTimeoutMs === \"number\" &&\n    (rawServer as { connectionTimeoutMs: number }).connectionTimeoutMs > 0\n  ) {\n    return (rawServer as { connectionTimeoutMs: number }).connectionTimeoutMs;\n  }\n  return DEFAULT_CONNECTION_TIMEOUT_MS;\n}\n\nfunction getRequestedTransport(rawServer: unknown): string {\n  if (\n    !rawServer ||\n    typeof rawServer !== \"object\" ||\n    typeof (rawServer as { transport?: unknown }).transport !== \"string\"\n  ) {\n    return \"\";\n  }\n  return normalizeLowercaseStringOrEmpty((rawServer as { transport?: string }).transport);\n}\n\nfunction getRequestedTransportAlias(rawServer: unknown): HttpMcpTransportType | \"\" {\n  if (\n    !rawServer ||\n    typeof rawServer !== \"object\" ||\n    typeof (rawServer as { type?: unknown }).type !== \"string\"\n  ) {\n    return \"\";\n  }\n  return resolveXopcMcpTransportAlias((rawServer as { type?: string }).type) ?? \"\";\n}\n\nfunction resolveHttpTransportConfig(\n  serverName: string,\n  rawServer: unknown,\n  transportType: HttpMcpTransportType,\n): ResolvedHttpMcpTransportConfig | null {\n  const launch = resolveHttpMcpServerLaunchConfig(rawServer, {\n    transportType,\n    onDroppedHeader: (key) => {\n      log.warn(\n        {\n          phase: 'agent.mcp_connect',\n          serverName,\n          header: key,\n        },\n        `bundle-mcp: server \"${serverName}\": header \"${key}\" has an unsupported value type and was ignored`,\n      );\n    },\n    onMalformedHeaders: () => {\n      log.warn(\n        { phase: 'agent.mcp_connect', serverName },\n        `bundle-mcp: server \"${serverName}\": \"headers\" must be a JSON object; the value was ignored`,\n      );\n    },\n  });\n  if (!launch.ok) {\n    return null;\n  }\n  return {\n    kind: \"http\",\n    transportType: launch.config.transportType,\n    url: launch.config.url,\n    headers: launch.config.headers,\n    description: describeHttpMcpServerLaunchConfig(launch.config),\n    connectionTimeoutMs: getConnectionTimeoutMs(rawServer),\n  };\n}\n\nexport function resolveMcpTransportConfig(\n  serverName: string,\n  rawServer: unknown,\n): ResolvedMcpTransportConfig | null {\n  const logServerName = sanitizeForLog(serverName);\n  const requestedTransport = getRequestedTransport(rawServer);\n  const requestedTransportAlias = requestedTransport ? \"\" : getRequestedTransportAlias(rawServer);\n  const effectiveTransport = requestedTransport || requestedTransportAlias;\n  const stdioLaunch = resolveStdioMcpServerLaunchConfig(rawServer, {\n    onDroppedEnv: (key) => {\n      log.warn(\n        `bundle-mcp: server \"${logServerName}\": env \"${sanitizeForLog(key)}\" is blocked for stdio startup safety and was ignored.`,\n      );\n    },\n  });\n  if (stdioLaunch.ok) {\n    return {\n      kind: \"stdio\",\n      transportType: \"stdio\",\n      command: stdioLaunch.config.command,\n      args: stdioLaunch.config.args,\n      env: stdioLaunch.config.env,\n      cwd: stdioLaunch.config.cwd,\n      description: describeStdioMcpServerLaunchConfig(stdioLaunch.config),\n      connectionTimeoutMs: getConnectionTimeoutMs(rawServer),\n    };\n  }\n\n  if (\n    effectiveTransport &&\n    effectiveTransport !== \"sse\" &&\n    effectiveTransport !== \"streamable-http\"\n  ) {\n    log.warn(\n      `bundle-mcp: skipped server \"${logServerName}\" because transport \"${sanitizeForLog(effectiveTransport)}\" is not supported.`,\n    );\n    return null;\n  }\n\n  const httpTransport = resolveHttpTransportConfig(\n    serverName,\n    rawServer,\n    effectiveTransport === \"sse\" ? \"sse\" : \"streamable-http\",\n  );\n  if (httpTransport) {\n    return httpTransport;\n  }\n\n  const stdioReason =\n    stdioLaunch.ok === false ? stdioLaunch.reason : 'not a stdio server';\n  const httpLaunch = resolveHttpMcpServerLaunchConfig(rawServer);\n  const httpReason =\n    httpLaunch.ok === false ? httpLaunch.reason : 'not an HTTP MCP server';\n  log.warn(\n    `bundle-mcp: skipped server \"${logServerName}\" because ${stdioReason} and ${httpReason}.`,\n  );\n  return null;\n}\n"],"mappings":";;;;;;;;aACqD;oBAE0B;AAD/E,MAAM,MAAM,aAAa,aAAa;AAsCtC,MAAM,gCAAgC;AAEtC,SAAS,uBAAuB,WAA4B;AAC1D,KACE,aACA,OAAO,cAAc,YACrB,OAAQ,UAAgD,wBAAwB,YAC/E,UAA8C,sBAAsB,EAErE,QAAQ,UAA8C;AAExD,QAAO;;AAGT,SAAS,sBAAsB,WAA4B;AACzD,KACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAsC,cAAc,SAE5D,QAAO;AAET,QAAO,gCAAiC,UAAqC,UAAU;;AAGzF,SAAS,2BAA2B,WAA+C;AACjF,KACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAiC,SAAS,SAElD,QAAO;AAET,QAAO,6BAA8B,UAAgC,KAAK,IAAI;;AAGhF,SAAS,2BACP,YACA,WACA,eACuC;CACvC,MAAM,SAAS,iCAAiC,WAAW;EACzD;EACA,kBAAkB,QAAQ;AACxB,OAAI,KACF;IACE,OAAO;IACP;IACA,QAAQ;IACT,EACD,uBAAuB,WAAW,aAAa,IAAI,iDACpD;;EAEH,0BAA0B;AACxB,OAAI,KACF;IAAE,OAAO;IAAqB;IAAY,EAC1C,uBAAuB,WAAW,2DACnC;;EAEJ,CAAC;AACF,KAAI,CAAC,OAAO,GACV,QAAO;AAET,QAAO;EACL,MAAM;EACN,eAAe,OAAO,OAAO;EAC7B,KAAK,OAAO,OAAO;EACnB,SAAS,OAAO,OAAO;EACvB,aAAa,kCAAkC,OAAO,OAAO;EAC7D,qBAAqB,uBAAuB,UAAU;EACvD;;AAGH,SAAgB,0BACd,YACA,WACmC;CACnC,MAAM,gBAAgB,eAAe,WAAW;CAChD,MAAM,qBAAqB,sBAAsB,UAAU;CAC3D,MAAM,0BAA0B,qBAAqB,KAAK,2BAA2B,UAAU;CAC/F,MAAM,qBAAqB,sBAAsB;CACjD,MAAM,cAAc,kCAAkC,WAAW,EAC/D,eAAe,QAAQ;AACrB,MAAI,KACF,uBAAuB,cAAc,UAAU,eAAe,IAAI,CAAC,wDACpE;IAEJ,CAAC;AACF,KAAI,YAAY,GACd,QAAO;EACL,MAAM;EACN,eAAe;EACf,SAAS,YAAY,OAAO;EAC5B,MAAM,YAAY,OAAO;EACzB,KAAK,YAAY,OAAO;EACxB,KAAK,YAAY,OAAO;EACxB,aAAa,mCAAmC,YAAY,OAAO;EACnE,qBAAqB,uBAAuB,UAAU;EACvD;AAGH,KACE,sBACA,uBAAuB,SACvB,uBAAuB,mBACvB;AACA,MAAI,KACF,+BAA+B,cAAc,uBAAuB,eAAe,mBAAmB,CAAC,qBACxG;AACD,SAAO;;CAGT,MAAM,gBAAgB,2BACpB,YACA,WACA,uBAAuB,QAAQ,QAAQ,kBACxC;AACD,KAAI,cACF,QAAO;CAGT,MAAM,cACJ,YAAY,OAAO,QAAQ,YAAY,SAAS;CAClD,MAAM,aAAa,iCAAiC,UAAU;CAC9D,MAAM,aACJ,WAAW,OAAO,QAAQ,WAAW,SAAS;AAChD,KAAI,KACF,+BAA+B,cAAc,YAAY,YAAY,OAAO,WAAW,GACxF;AACD,QAAO"}

package/dist/src/agent/mcp/mcp-transport.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

package/dist/src/agent/memory/builtin-memory-store.js

@@ -1,6 +1,6 @@
+import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { join } from "node:path";
 import lockfile from "proper-lockfile";
 //#region src/agent/memory/builtin-memory-store.ts
 /**

package/dist/src/agent/memory/dreaming/deep-promotion.js

@@ -4,8 +4,8 @@ import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, isoDay, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore, saveDreamingStore, withDreamingPromotionLock } from "./short-term-store.js";
 import { emptyDeepPhaseSkipped, writeDreamingDeepLastRun } from "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/deep-promotion.ts
 init_logger();
 const log = createLogger("Dreaming:Deep");

package/dist/src/agent/memory/dreaming/events.js

@@ -1,6 +1,6 @@
 import { DREAMING_DIR_RELATIVE, DREAMING_EVENTS_LOG_RELATIVE } from "./constants.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/events.ts
 /**
 * Append a single event line to `memory/.dreams/events.jsonl`.

package/dist/src/agent/memory/dreaming/last-run.js

@@ -1,6 +1,6 @@
 import { DREAMING_LAST_RUN_RELATIVE } from "./constants.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/last-run.ts
 const DREAMING_LAST_RUN_FORMAT_VERSION = 2;
 function isRecord(v) {

package/dist/src/agent/memory/dreaming/light-sweep.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE } from "./constants.js";
 import { buildEntryKey, isoDay, normalizeMemoryPath, normalizeSnippetForHash, snippetHash } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/light-sweep.ts
 init_logger();
 const log = createLogger("Dreaming:Light");

package/dist/src/agent/memory/dreaming/preview.js

@@ -1,8 +1,8 @@
 import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore } from "./short-term-store.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/preview.ts
 async function previewDreamingDeepPromotion(params) {
 	const cfg = resolveDeepDefaults(params.config);

package/dist/src/agent/memory/dreaming/rem-patterns.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE, DREAMS_MD_FILENAME, MS_PER_DAY } from "./constan
 import { isoDay } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/rem-patterns.ts
 init_logger();
 const log = createLogger("Dreaming:REM");

package/dist/src/agent/memory/dreaming/short-term-store.js

@@ -2,9 +2,9 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "./constants.js";
 import { buildEntryKey, clamp01, isoDay, normalizeMemoryPath } from "./utils.js";
+import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
-import path from "node:path";
 //#region src/agent/memory/dreaming/short-term-store.ts
 init_logger();
 const log = createLogger("Dreaming:Store");

package/dist/src/agent/memory/dreaming/utils.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DEEP_CRON, DIVERSITY_WEIGHT, MS_PER_DAY, REINFORCEMENT_WEIGHT } from "./constants.js";
+import path from "node:path";
 import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
-import path from "node:path";
 //#region src/agent/memory/dreaming/utils.ts
 /** Normalize a workspace-relative memory path: forward slashes, no odd ../ escapes at start. */
 function normalizeMemoryPath(rel) {

package/dist/src/agent/memory/memory-flush.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
 //#region src/agent/memory/memory-flush.ts
 init_logger();
 const log = createLogger("MemoryFlush");

package/dist/src/agent/memory/plugin-discovery.js

@@ -1,5 +1,5 @@
-import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { readdir, stat } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 //#region src/agent/memory/plugin-discovery.ts
 async function discoverMemoryPlugins() {

package/dist/src/agent/models/manager.js

@@ -1,6 +1,6 @@
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getAllModels, getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed, maybeRetryTurnAfterTransientLlmFailure } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -1,6 +1,6 @@
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { DEFAULT_USER_FILENAME } from "../context/workspace.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
@@ -9,8 +9,8 @@ import { createSkillConfigManager } from "../skills/config.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { selectSkillsVisibleInPrompt } from "../skills/format-skills-prompt.js";
-import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/prompt/service-prompt-builder.ts
 /**
 * System Prompt Builder - Builds the complete system prompt

package/dist/src/agent/reply/post-compaction-context.js

@@ -1,7 +1,7 @@
 import { init_agent_scope, resolveAgentProfileDir } from "../agent-scope.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
-import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/agent/reply/post-compaction-context.ts
 init_agent_scope();
 const MAX_CONTEXT_CHARS = 1800;

package/dist/src/agent/reply/workspace-boundary-read.js

@@ -1,5 +1,5 @@
-import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/agent/reply/workspace-boundary-read.ts
 /**
 * Read a file relative to workspace root with path traversal guard and byte cap.

package/dist/src/agent/sandbox/path-policy.js

@@ -1,6 +1,6 @@
-import { realpathSync } from "node:fs";
-import { isAbsolute, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, normalize, resolve, sep } from "node:path";
+import { realpathSync } from "node:fs";
 //#region src/agent/sandbox/path-policy.ts
 /**
 * Path safety validation for sandbox isolation.

package/dist/src/agent/service.js

@@ -1,9 +1,9 @@
-import { createLogger } from "../utils/logger/index.js";
-import { init_logger } from "../utils/logger.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
 import { extractTextContent } from "./context/workspace.js";
 import { getWorkflowProgressBroker } from "./workflow/progress-broker.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
@@ -60,8 +60,8 @@ import { parseOutboundSessionKey } from "./service/parse-outbound-session-key.js
 import { cleanTrailingErrors } from "./memory/message-sanitizer.js";
 import { MemoryFlushService } from "./memory/memory-flush.js";
 import { tryApplySessionTranscriptHygiene } from "./transcript/transcript-hygiene.js";
-import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/service.ts
 init_schema();
 init_logger();

package/dist/src/agent/session/session-inspector.js

@@ -1,6 +1,6 @@
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { resolveVerboseLevel } from "../../session/config-store.js";
 import { resolveEffectiveReasoningLevel, resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { effectiveWorkspacePathForSession } from "../../session/session-workspace.js";

package/dist/src/agent/skills/config.js

@@ -1,6 +1,6 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { hasBinary } from "./installer.js";
 import { join } from "path";
 import { existsSync, readFileSync } from "fs";

package/dist/src/agent/skills/hub-hash.js

@@ -1,6 +1,6 @@
-import { createHash } from "node:crypto";
-import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
+import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 //#region src/agent/skills/hub-hash.ts
 /**
 * Deterministic content hash for a skill directory (for hub lock / drift detection).

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -4,9 +4,9 @@ import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
 import { installSkillFromZip, isValidSkillId } from "./managed-store.js";
 import { computeSkillTreeHashSync } from "./hub-hash.js";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, normalize, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
+import { basename, join, normalize, resolve, sep } from "node:path";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { fetch } from "undici";

package/dist/src/agent/skills/index.js

@@ -1,6 +1,6 @@
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, installSkill } from "./installer.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import AdmZip from "adm-zip";
 //#region src/agent/skills/managed-store.ts
 /**

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.d.ts

@@ -101,11 +101,15 @@ export interface StorePublishedPackageHead {
     latestVersion: {
         version: string;
         downloadUrl: string;
+        checksum?: string;
+        integrity?: string;
+        sha256?: string;
     };
 }
 export declare function resolveExtensionZipDownloadUrl(storeBaseUrl: string, packageName: string, version?: string): Promise<{
     downloadUrl: string;
     version: string;
+    integrity?: string;
 }>;
 export declare function downloadExtensionStoreZipBuffer(storeBaseUrl: string, downloadUrl: string): Promise<Buffer>;
 export declare function skillIdForMarketplaceInstall(packageName: string): string | undefined;

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js

@@ -135,7 +135,8 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 		assertDownloadUrlAllowed(detail.downloadUrl, base);
 		return {
 			downloadUrl: detail.downloadUrl,
-			version: detail.version
+			version: detail.version,
+			integrity: detail.integrity ?? detail.checksum ?? detail.sha256
 		};
 	}
 	const lv = meta.latestVersion;
@@ -143,7 +144,8 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 	assertDownloadUrlAllowed(lv.downloadUrl, base);
 	return {
 		downloadUrl: lv.downloadUrl,
-		version: lv.version
+		version: lv.version,
+		integrity: lv.integrity ?? lv.checksum ?? lv.sha256
 	};
 }
 async function downloadExtensionStoreZipBuffer(storeBaseUrl, downloadUrl) {

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-api-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/store-api-client.ts"],"sourcesContent":["/**\n * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).\n * Used by the store marketplace adapter and SSRF-safe download helpers.\n *\n * Facade: {@link ../../../skills-marketplace.js}.\n */\n\nimport type { Config } from '../../../../../config/schema.js';\nimport { MAX_EXTENSION_STORE_ZIP_BYTES } from '../../../../../extensions/store-zip-limits.js';\nimport { isValidSkillId, MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\nimport type { SkillMarkdownPreviewPayload } from '../../../types.js';\n\nconst DEFAULT_STORE_BASE = 'https://store.xopc.ai';\n\n/**\n * Marketplace provider identifier. Dynamic — extensions can register additional providers\n * via `api.registerMarketplaceAdapter()`. Built-in values: 'store', 'skillhub', 'clawhub'.\n */\nexport type SkillsMarketplaceProvider = string;\n\nexport interface SkillsStoreListParams {\n  q?: string;\n  page?: number;\n  pageSize?: number;\n  sort?: 'downloads' | 'newest';\n  /** Adapter-defined category id (exact match against package `categories`). */\n  category?: string;\n}\n\n/** Category option for marketplace filter chips (from adapter). */\nexport interface MarketplaceCategoryOption {\n  id: string;\n  label: string;\n}\n\n/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */\nexport interface SkillsStorePackageListItem {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion?: string;\n  updatedAt: string;\n  /** Taxonomy / tags from the marketplace (adapter-specific). */\n  categories?: string[];\n  tags?: string[];\n  stars?: number;\n  /** Short provenance label for the row (e.g. ClawHub). */\n  sourceLabel?: string;\n}\n\n/** Unified marketplace package list item (works for all adapters). */\nexport type MarketplacePackageListItem = SkillsStorePackageListItem;\n\nexport interface SkillsStoreListResponse {\n  items: SkillsStorePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n}\n\nexport function resolveSkillsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_SKILLS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  const fromConfig = config.gateway?.skillsStoreBaseUrl?.trim();\n  if (fromConfig) {\n    try {\n      return normalizeBaseUrl(new URL(fromConfig).toString());\n    } catch {\n      return DEFAULT_STORE_BASE;\n    }\n  }\n  return DEFAULT_STORE_BASE;\n}\n\nexport { MAX_EXTENSION_STORE_ZIP_BYTES };\n\n/**\n * Base URL for extension downloads (defaults to skills store host — usually store.xopc.ai).\n * Override with `XOPC_EXTENSIONS_STORE_URL`.\n */\nexport function resolveExtensionsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_EXTENSIONS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  return resolveSkillsStoreBaseUrl(config);\n}\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nexport function getStoreOrigin(baseUrl: string): string {\n  const u = new URL(baseUrl);\n  return `${u.protocol}//${u.host}`;\n}\n\n/**\n * Allow download URLs whose origin matches the configured store base (SSRF guard).\n * Production store is HTTPS-only; local dev (`http://localhost` / `127.0.0.1`) may use HTTP.\n */\nexport function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL {\n  let u: URL;\n  try {\n    u = new URL(downloadUrl);\n  } catch {\n    throw new Error('Invalid download URL from store');\n  }\n  const allowed = new URL(storeBaseUrl);\n  const localHttpDev =\n    allowed.protocol === 'http:' &&\n    (allowed.hostname === 'localhost' || allowed.hostname === '127.0.0.1');\n  if (localHttpDev) {\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      throw new Error('Download URL must use HTTP or HTTPS');\n    }\n  } else if (u.protocol !== 'https:') {\n    throw new Error('Download URL must use HTTPS');\n  }\n  if (u.host !== allowed.host) {\n    throw new Error('Download URL host does not match configured store host');\n  }\n  return u;\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: { Accept: 'application/json', ...init?.headers },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `Store request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { error?: { message?: string } };\n      if (j.error?.message) msg = j.error.message;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('Store returned invalid JSON');\n  }\n}\n\nexport async function listSkillPackages(\n  storeBaseUrl: string,\n  params: SkillsStoreListParams,\n): Promise<SkillsStoreListResponse> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const sp = new URLSearchParams();\n  sp.set('type', 'skill');\n  if (params.q?.trim()) sp.set('q', params.q.trim());\n  if (params.page != null) sp.set('page', String(params.page));\n  if (params.pageSize != null) sp.set('pageSize', String(params.pageSize));\n  if (params.sort) sp.set('sort', params.sort);\n  if (params.category?.trim()) sp.set('category', params.category.trim());\n\n  const url = `${base}/api/v1/packages?${sp.toString()}`;\n  return fetchJson<SkillsStoreListResponse>(url);\n}\n\n/** GET /api/v1/packages/:name — published skill package (public). */\nexport interface MarketplacePackageDetail {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  readme: string | null;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    publishedAt: string;\n  };\n}\n\nexport async function fetchMarketplacePackageDetail(\n  storeBaseUrl: string,\n  packageName: string,\n): Promise<MarketplacePackageDetail> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  return fetchJson<MarketplacePackageDetail>(`${base}/api/v1/packages/${enc}`);\n}\n\nexport async function resolveSkillZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName);\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n\n  const pkg = await fetchJson<{\n    name: string;\n    latestVersion: { downloadUrl: string; version: string };\n  }>(`${base}/api/v1/packages/${enc}`);\n  if (!pkg.latestVersion?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(pkg.latestVersion.downloadUrl, base);\n  return {\n    downloadUrl: pkg.latestVersion.downloadUrl,\n    version: pkg.latestVersion.version,\n  };\n}\n\nexport async function downloadSkillZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\n/** GET /api/v1/packages/:name — subset used for extension installs. */\nexport interface StorePublishedPackageHead {\n  name: string;\n  type: string;\n  latestVersion: {\n    version: string;\n    downloadUrl: string;\n  };\n}\n\nexport async function resolveExtensionZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  const meta = await fetchJson<StorePublishedPackageHead>(`${base}/api/v1/packages/${enc}`);\n  if (meta.type !== 'extension') {\n    throw new Error(\n      `Package \"${packageName}\" has type \"${meta.type}\" (expected extension). ` +\n        'Use `xopc skills install` for skills.',\n    );\n  }\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{ downloadUrl: string; version: string }>(\n      `${base}/api/v1/packages/${enc}/versions/${v}`,\n    );\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n  const lv = meta.latestVersion;\n  if (!lv?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(lv.downloadUrl, base);\n  return { downloadUrl: lv.downloadUrl, version: lv.version };\n}\n\nexport async function downloadExtensionStoreZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download extension archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_EXTENSION_STORE_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_EXTENSION_STORE_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\nexport function skillIdForMarketplaceInstall(packageName: string): string | undefined {\n  const trimmed = packageName.trim();\n  if (!trimmed) return undefined;\n  return isValidSkillId(trimmed) ? trimmed : undefined;\n}\n\n/**\n * Unified marketplace list response (adapter fills `provider`).\n */\nexport interface UnifiedMarketplaceListResponse {\n  items: MarketplacePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n  provider: string;\n}\n\n/**\n * Unified marketplace package detail response.\n */\nexport interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {\n  provider: string;\n  /** Gateway-normalized structured meta + body rendered by the console. */\n  skillDocPreview: SkillMarkdownPreviewPayload;\n  /** SkillHub-specific fields */\n  skillHubInfo?: {\n    category: string;\n    installs: number;\n    stars: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n}\n"],"mappings":";;;AAYA,MAAM,qBAAqB;AAiD3B,SAAgB,0BAA0B,QAAwB;CAChE,MAAM,MAAM,QAAQ,IAAI,uBAAuB,MAAM;AACrD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;CAIV,MAAM,aAAa,OAAO,SAAS,oBAAoB,MAAM;AAC7D,KAAI,WACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;SACjD;AACN,SAAO;;AAGX,QAAO;;;;;;AAST,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,MAAM,QAAQ,IAAI,2BAA2B,MAAM;AACzD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;AAIV,QAAO,0BAA0B,OAAO;;AAG1C,SAAS,iBAAiB,KAAqB;AAC7C,QAAO,IAAI,QAAQ,OAAO,GAAG;;AAG/B,SAAgB,eAAe,SAAyB;CACtD,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,QAAO,GAAG,EAAE,SAAS,IAAI,EAAE;;;;;;AAO7B,SAAgB,yBAAyB,aAAqB,cAA2B;CACvF,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,YAAY;SAClB;AACN,QAAM,IAAI,MAAM,kCAAkC;;CAEpD,MAAM,UAAU,IAAI,IAAI,aAAa;AAIrC,KAFE,QAAQ,aAAa,YACpB,QAAQ,aAAa,eAAe,QAAQ,aAAa;MAEtD,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,OAAM,IAAI,MAAM,sCAAsC;YAE/C,EAAE,aAAa,SACxB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,KAAI,EAAE,SAAS,QAAQ,KACrB,OAAM,IAAI,MAAM,yDAAyD;AAE3E,QAAO;;AAGT,eAAe,UAAa,KAAa,MAAgC;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GAAE,QAAQ;GAAoB,GAAG,MAAM;GAAS;EAC1D,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,yBAAyB,IAAI,OAAO;AAC9C,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,OAAO,QAAS,OAAM,EAAE,MAAM;UAC9B;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,8BAA8B;;;AAIlD,eAAsB,kBACpB,cACA,QACkC;CAClC,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,KAAK,IAAI,iBAAiB;AAChC,IAAG,IAAI,QAAQ,QAAQ;AACvB,KAAI,OAAO,GAAG,MAAM,CAAE,IAAG,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAClD,KAAI,OAAO,QAAQ,KAAM,IAAG,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC;AAC5D,KAAI,OAAO,YAAY,KAAM,IAAG,IAAI,YAAY,OAAO,OAAO,SAAS,CAAC;AACxE,KAAI,OAAO,KAAM,IAAG,IAAI,QAAQ,OAAO,KAAK;AAC5C,KAAI,OAAO,UAAU,MAAM,CAAE,IAAG,IAAI,YAAY,OAAO,SAAS,MAAM,CAAC;AAGvE,QAAO,UAAmC,GAD3B,KAAK,mBAAmB,GAAG,UAAU,GACN;;AAmBhD,eAAsB,8BACpB,cACA,aACmC;AAGnC,QAAO,UAAoC,GAF9B,iBAAiB,aAEoB,CAAC,mBADvC,mBAAmB,YAAY,MAAM,CACwB,GAAG;;AAG9E,eAAsB,2BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY;AAC3C,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAGlB,GAAG,KAAK,mBAAmB,IAAI,YAJxB,mBAAmB,QAAQ,MAAM,CAII,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAGrE,MAAM,MAAM,MAAM,UAGf,GAAG,KAAK,mBAAmB,MAAM;AACpC,KAAI,CAAC,IAAI,eAAe,YACtB,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,IAAI,cAAc,aAAa,KAAK;AAC7D,QAAO;EACL,aAAa,IAAI,cAAc;EAC/B,SAAS,IAAI,cAAc;EAC5B;;AAGH,eAAsB,uBACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAE3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAErE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAG9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;AAE5E,QAAO;;AAaT,eAAsB,+BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY,MAAM,CAAC;CAClD,MAAM,OAAO,MAAM,UAAqC,GAAG,KAAK,mBAAmB,MAAM;AACzF,KAAI,KAAK,SAAS,YAChB,OAAM,IAAI,MACR,YAAY,YAAY,cAAc,KAAK,KAAK,iEAEjD;AAEH,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UACnB,GAAG,KAAK,mBAAmB,IAAI,YAFvB,mBAAmB,QAAQ,MAAM,CAEG,GAC7C;AACD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAErE,MAAM,KAAK,KAAK;AAChB,KAAI,CAAC,IAAI,YACP,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,GAAG,aAAa,KAAK;AAC9C,QAAO;EAAE,aAAa,GAAG;EAAa,SAAS,GAAG;EAAS;;AAG7D,eAAsB,gCACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAC3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,GAAG;CAEzE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;;CAGxF,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;AAEtF,QAAO;;AAGT,SAAgB,6BAA6B,aAAyC;CACpF,MAAM,UAAU,YAAY,MAAM;AAClC,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,QAAO,eAAe,QAAQ,GAAG,UAAU,KAAA"}
+{"version":3,"file":"store-api-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/store-api-client.ts"],"sourcesContent":["/**\n * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).\n * Used by the store marketplace adapter and SSRF-safe download helpers.\n *\n * Facade: {@link ../../../skills-marketplace.js}.\n */\n\nimport type { Config } from '../../../../../config/schema.js';\nimport { MAX_EXTENSION_STORE_ZIP_BYTES } from '../../../../../extensions/store-zip-limits.js';\nimport { isValidSkillId, MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\nimport type { SkillMarkdownPreviewPayload } from '../../../types.js';\n\nconst DEFAULT_STORE_BASE = 'https://store.xopc.ai';\n\n/**\n * Marketplace provider identifier. Dynamic — extensions can register additional providers\n * via `api.registerMarketplaceAdapter()`. Built-in values: 'store', 'skillhub', 'clawhub'.\n */\nexport type SkillsMarketplaceProvider = string;\n\nexport interface SkillsStoreListParams {\n  q?: string;\n  page?: number;\n  pageSize?: number;\n  sort?: 'downloads' | 'newest';\n  /** Adapter-defined category id (exact match against package `categories`). */\n  category?: string;\n}\n\n/** Category option for marketplace filter chips (from adapter). */\nexport interface MarketplaceCategoryOption {\n  id: string;\n  label: string;\n}\n\n/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */\nexport interface SkillsStorePackageListItem {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion?: string;\n  updatedAt: string;\n  /** Taxonomy / tags from the marketplace (adapter-specific). */\n  categories?: string[];\n  tags?: string[];\n  stars?: number;\n  /** Short provenance label for the row (e.g. ClawHub). */\n  sourceLabel?: string;\n}\n\n/** Unified marketplace package list item (works for all adapters). */\nexport type MarketplacePackageListItem = SkillsStorePackageListItem;\n\nexport interface SkillsStoreListResponse {\n  items: SkillsStorePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n}\n\nexport function resolveSkillsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_SKILLS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  const fromConfig = config.gateway?.skillsStoreBaseUrl?.trim();\n  if (fromConfig) {\n    try {\n      return normalizeBaseUrl(new URL(fromConfig).toString());\n    } catch {\n      return DEFAULT_STORE_BASE;\n    }\n  }\n  return DEFAULT_STORE_BASE;\n}\n\nexport { MAX_EXTENSION_STORE_ZIP_BYTES };\n\n/**\n * Base URL for extension downloads (defaults to skills store host — usually store.xopc.ai).\n * Override with `XOPC_EXTENSIONS_STORE_URL`.\n */\nexport function resolveExtensionsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_EXTENSIONS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  return resolveSkillsStoreBaseUrl(config);\n}\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nexport function getStoreOrigin(baseUrl: string): string {\n  const u = new URL(baseUrl);\n  return `${u.protocol}//${u.host}`;\n}\n\n/**\n * Allow download URLs whose origin matches the configured store base (SSRF guard).\n * Production store is HTTPS-only; local dev (`http://localhost` / `127.0.0.1`) may use HTTP.\n */\nexport function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL {\n  let u: URL;\n  try {\n    u = new URL(downloadUrl);\n  } catch {\n    throw new Error('Invalid download URL from store');\n  }\n  const allowed = new URL(storeBaseUrl);\n  const localHttpDev =\n    allowed.protocol === 'http:' &&\n    (allowed.hostname === 'localhost' || allowed.hostname === '127.0.0.1');\n  if (localHttpDev) {\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      throw new Error('Download URL must use HTTP or HTTPS');\n    }\n  } else if (u.protocol !== 'https:') {\n    throw new Error('Download URL must use HTTPS');\n  }\n  if (u.host !== allowed.host) {\n    throw new Error('Download URL host does not match configured store host');\n  }\n  return u;\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: { Accept: 'application/json', ...init?.headers },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `Store request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { error?: { message?: string } };\n      if (j.error?.message) msg = j.error.message;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('Store returned invalid JSON');\n  }\n}\n\nexport async function listSkillPackages(\n  storeBaseUrl: string,\n  params: SkillsStoreListParams,\n): Promise<SkillsStoreListResponse> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const sp = new URLSearchParams();\n  sp.set('type', 'skill');\n  if (params.q?.trim()) sp.set('q', params.q.trim());\n  if (params.page != null) sp.set('page', String(params.page));\n  if (params.pageSize != null) sp.set('pageSize', String(params.pageSize));\n  if (params.sort) sp.set('sort', params.sort);\n  if (params.category?.trim()) sp.set('category', params.category.trim());\n\n  const url = `${base}/api/v1/packages?${sp.toString()}`;\n  return fetchJson<SkillsStoreListResponse>(url);\n}\n\n/** GET /api/v1/packages/:name — published skill package (public). */\nexport interface MarketplacePackageDetail {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  readme: string | null;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    publishedAt: string;\n  };\n}\n\nexport async function fetchMarketplacePackageDetail(\n  storeBaseUrl: string,\n  packageName: string,\n): Promise<MarketplacePackageDetail> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  return fetchJson<MarketplacePackageDetail>(`${base}/api/v1/packages/${enc}`);\n}\n\nexport async function resolveSkillZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName);\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n\n  const pkg = await fetchJson<{\n    name: string;\n    latestVersion: { downloadUrl: string; version: string };\n  }>(`${base}/api/v1/packages/${enc}`);\n  if (!pkg.latestVersion?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(pkg.latestVersion.downloadUrl, base);\n  return {\n    downloadUrl: pkg.latestVersion.downloadUrl,\n    version: pkg.latestVersion.version,\n  };\n}\n\nexport async function downloadSkillZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\n/** GET /api/v1/packages/:name — subset used for extension installs. */\nexport interface StorePublishedPackageHead {\n  name: string;\n  type: string;\n  latestVersion: {\n    version: string;\n    downloadUrl: string;\n    checksum?: string;\n    integrity?: string;\n    sha256?: string;\n  };\n}\n\nexport async function resolveExtensionZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string; integrity?: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  const meta = await fetchJson<StorePublishedPackageHead>(`${base}/api/v1/packages/${enc}`);\n  if (meta.type !== 'extension') {\n    throw new Error(\n      `Package \"${packageName}\" has type \"${meta.type}\" (expected extension). ` +\n        'Use `xopc skills install` for skills.',\n    );\n  }\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n      checksum?: string;\n      integrity?: string;\n      sha256?: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return {\n      downloadUrl: detail.downloadUrl,\n      version: detail.version,\n      integrity: detail.integrity ?? detail.checksum ?? detail.sha256,\n    };\n  }\n  const lv = meta.latestVersion;\n  if (!lv?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(lv.downloadUrl, base);\n  return {\n    downloadUrl: lv.downloadUrl,\n    version: lv.version,\n    integrity: lv.integrity ?? lv.checksum ?? lv.sha256,\n  };\n}\n\nexport async function downloadExtensionStoreZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download extension archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_EXTENSION_STORE_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_EXTENSION_STORE_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\nexport function skillIdForMarketplaceInstall(packageName: string): string | undefined {\n  const trimmed = packageName.trim();\n  if (!trimmed) return undefined;\n  return isValidSkillId(trimmed) ? trimmed : undefined;\n}\n\n/**\n * Unified marketplace list response (adapter fills `provider`).\n */\nexport interface UnifiedMarketplaceListResponse {\n  items: MarketplacePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n  provider: string;\n}\n\n/**\n * Unified marketplace package detail response.\n */\nexport interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {\n  provider: string;\n  /** Gateway-normalized structured meta + body rendered by the console. */\n  skillDocPreview: SkillMarkdownPreviewPayload;\n  /** SkillHub-specific fields */\n  skillHubInfo?: {\n    category: string;\n    installs: number;\n    stars: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n}\n"],"mappings":";;;AAYA,MAAM,qBAAqB;AAiD3B,SAAgB,0BAA0B,QAAwB;CAChE,MAAM,MAAM,QAAQ,IAAI,uBAAuB,MAAM;AACrD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;CAIV,MAAM,aAAa,OAAO,SAAS,oBAAoB,MAAM;AAC7D,KAAI,WACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;SACjD;AACN,SAAO;;AAGX,QAAO;;;;;;AAST,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,MAAM,QAAQ,IAAI,2BAA2B,MAAM;AACzD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;AAIV,QAAO,0BAA0B,OAAO;;AAG1C,SAAS,iBAAiB,KAAqB;AAC7C,QAAO,IAAI,QAAQ,OAAO,GAAG;;AAG/B,SAAgB,eAAe,SAAyB;CACtD,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,QAAO,GAAG,EAAE,SAAS,IAAI,EAAE;;;;;;AAO7B,SAAgB,yBAAyB,aAAqB,cAA2B;CACvF,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,YAAY;SAClB;AACN,QAAM,IAAI,MAAM,kCAAkC;;CAEpD,MAAM,UAAU,IAAI,IAAI,aAAa;AAIrC,KAFE,QAAQ,aAAa,YACpB,QAAQ,aAAa,eAAe,QAAQ,aAAa;MAEtD,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,OAAM,IAAI,MAAM,sCAAsC;YAE/C,EAAE,aAAa,SACxB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,KAAI,EAAE,SAAS,QAAQ,KACrB,OAAM,IAAI,MAAM,yDAAyD;AAE3E,QAAO;;AAGT,eAAe,UAAa,KAAa,MAAgC;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GAAE,QAAQ;GAAoB,GAAG,MAAM;GAAS;EAC1D,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,yBAAyB,IAAI,OAAO;AAC9C,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,OAAO,QAAS,OAAM,EAAE,MAAM;UAC9B;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,8BAA8B;;;AAIlD,eAAsB,kBACpB,cACA,QACkC;CAClC,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,KAAK,IAAI,iBAAiB;AAChC,IAAG,IAAI,QAAQ,QAAQ;AACvB,KAAI,OAAO,GAAG,MAAM,CAAE,IAAG,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAClD,KAAI,OAAO,QAAQ,KAAM,IAAG,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC;AAC5D,KAAI,OAAO,YAAY,KAAM,IAAG,IAAI,YAAY,OAAO,OAAO,SAAS,CAAC;AACxE,KAAI,OAAO,KAAM,IAAG,IAAI,QAAQ,OAAO,KAAK;AAC5C,KAAI,OAAO,UAAU,MAAM,CAAE,IAAG,IAAI,YAAY,OAAO,SAAS,MAAM,CAAC;AAGvE,QAAO,UAAmC,GAD3B,KAAK,mBAAmB,GAAG,UAAU,GACN;;AAmBhD,eAAsB,8BACpB,cACA,aACmC;AAGnC,QAAO,UAAoC,GAF9B,iBAAiB,aAEoB,CAAC,mBADvC,mBAAmB,YAAY,MAAM,CACwB,GAAG;;AAG9E,eAAsB,2BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY;AAC3C,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAGlB,GAAG,KAAK,mBAAmB,IAAI,YAJxB,mBAAmB,QAAQ,MAAM,CAII,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAGrE,MAAM,MAAM,MAAM,UAGf,GAAG,KAAK,mBAAmB,MAAM;AACpC,KAAI,CAAC,IAAI,eAAe,YACtB,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,IAAI,cAAc,aAAa,KAAK;AAC7D,QAAO;EACL,aAAa,IAAI,cAAc;EAC/B,SAAS,IAAI,cAAc;EAC5B;;AAGH,eAAsB,uBACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAE3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAErE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAG9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;AAE5E,QAAO;;AAgBT,eAAsB,+BACpB,cACA,aACA,SACuE;CACvE,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY,MAAM,CAAC;CAClD,MAAM,OAAO,MAAM,UAAqC,GAAG,KAAK,mBAAmB,MAAM;AACzF,KAAI,KAAK,SAAS,YAChB,OAAM,IAAI,MACR,YAAY,YAAY,cAAc,KAAK,KAAK,iEAEjD;AAEH,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAMlB,GAAG,KAAK,mBAAmB,IAAI,YAPxB,mBAAmB,QAAQ,MAAM,CAOI,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GACL,aAAa,OAAO;GACpB,SAAS,OAAO;GAChB,WAAW,OAAO,aAAa,OAAO,YAAY,OAAO;GAC1D;;CAEH,MAAM,KAAK,KAAK;AAChB,KAAI,CAAC,IAAI,YACP,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,GAAG,aAAa,KAAK;AAC9C,QAAO;EACL,aAAa,GAAG;EAChB,SAAS,GAAG;EACZ,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG;EAC9C;;AAGH,eAAsB,gCACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAC3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,GAAG;CAEzE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;;CAGxF,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;AAEtF,QAAO;;AAGT,SAAgB,6BAA6B,aAAyC;CACpF,MAAM,UAAU,YAAY,MAAM;AAClC,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,QAAO,eAAe,QAAQ,GAAG,UAAU,KAAA"}

package/dist/src/agent/skills/scanner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { readFile, readdir } from "fs/promises";
 import { join } from "path";
+import { readFile, readdir } from "fs/promises";
 //#region src/agent/skills/scanner.ts
 /**
 * Skill security scanner — scans skill directories for potentially dangerous code patterns.