@xopcai/xopc 0.0.282 → 0.0.284

package/dist/src/imports/runtime.d.ts

@@ -0,0 +1,5 @@
+import { ImportService } from './importService.js';
+import { type ImportTarget } from './types.js';
+export declare function resolveImportTarget(projectId?: string): ImportTarget;
+export declare function createRuntimeImportService(owner: string, refreshSkills?: () => void | Promise<void>, checkTrust?: (root: string) => boolean): ImportService;
+export declare function recoverCapabilityImports(): Promise<void>;

package/dist/src/imports/runtime.js

@@ -0,0 +1,56 @@
+import { resolveStateDir } from "../config/paths-state.js";
+import { init_paths, resolveBundledSkillsDir, resolveSkillsDir } from "../config/paths.js";
+import { ProjectService } from "../projects/project-service.js";
+import { resolveWorkspaceSkillsDir } from "../agent/skills/workspace-skills-dir.js";
+import { loadSkills } from "../agent/skills/index.js";
+import { ProjectTrustStore } from "../project-trust/trust-store.js";
+import { ImportError } from "./types.js";
+import { ImportRepository } from "../storage/sqlite/import-repository.js";
+import { canonicalTarget } from "./planner.js";
+import { ImportService } from "./importService.js";
+import { existsSync, realpathSync } from "node:fs";
+//#region src/imports/runtime.ts
+init_paths();
+function resolveImportTarget(projectId) {
+	if (!projectId) return { root: canonicalTarget(resolveSkillsDir()) };
+	const project = new ProjectService().get(projectId);
+	if (!project?.workspaceRoot || !existsSync(project.workspaceRoot)) throw new ImportError("invalid_project", "Project needs an existing workspace");
+	return {
+		projectId,
+		root: canonicalTarget(resolveWorkspaceSkillsDir(project.workspaceRoot))
+	};
+}
+function createRuntimeImportService(owner, refreshSkills, checkTrust) {
+	return new ImportService({
+		owner,
+		stateDir: resolveStateDir(),
+		refreshSkills,
+		isConnected(candidate) {
+			if (!candidate.shared) return false;
+			const workspaceDir = (candidate.scope === "project" ? new ProjectService().resolveForWorkspacePath(candidate.location)?.project : void 0)?.workspaceRoot;
+			return loadSkills({
+				workspaceDir,
+				workspaceTrust: workspaceDir && (checkTrust ? checkTrust(workspaceDir) : new ProjectTrustStore().get(workspaceDir) === true) ? "trusted" : "untrusted"
+			}).skills.some((s) => realpathSync(s.baseDir) === candidate.location);
+		},
+		validateTarget(target) {
+			if (resolveImportTarget(target.projectId).root !== target.root) throw new ImportError("scope_mismatch", "Project target changed; preview again", 409);
+			if (target.projectId) {
+				const project = new ProjectService().get(target.projectId);
+				if (!(checkTrust ? checkTrust(project.workspaceRoot) : new ProjectTrustStore().get(project.workspaceRoot) === true)) throw new ImportError("workspace_untrusted", "Trust this project in project settings before importing", 403);
+			}
+		},
+		reservedNames(target) {
+			return loadSkills({
+				workspaceDir: target.projectId ? new ProjectService().get(target.projectId)?.workspaceRoot : void 0,
+				workspaceTrust: "trusted",
+				builtinDir: resolveBundledSkillsDir() ?? void 0
+			}).skills.map((s) => s.name);
+		}
+	});
+}
+async function recoverCapabilityImports() {
+	for (const owner of ImportRepository.owners()) await createRuntimeImportService(owner).recoverAndClean();
+}
+//#endregion
+export { createRuntimeImportService, recoverCapabilityImports, resolveImportTarget };

package/dist/src/imports/scanner.d.ts

@@ -0,0 +1,14 @@
+import { type ImportScan, type ImportSource } from './types.js';
+export { IMPORT_SOURCES } from './sources.js';
+export interface ScanInput {
+    source: ImportSource;
+    root?: string;
+    projectRoot?: string;
+    home?: string;
+    projectOnly?: boolean;
+    budget?: {
+        bytes: number;
+        files: number;
+    };
+}
+export declare function scanLocal(input: ScanInput): ImportScan;

package/dist/src/imports/scanner.js

@@ -0,0 +1,159 @@
+import { containsSecret } from "./secrets.js";
+import { ImportError } from "./types.js";
+import { IMPORT_LIMITS, digest, readRegularFile, readTree } from "./files.js";
+import { inspectMcp, inspectSkill } from "./compatibility.js";
+import { IMPORT_SOURCES, sourceLayout } from "./sources.js";
+import { basename, join } from "node:path";
+import { existsSync, readdirSync, realpathSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { parse as parse$1 } from "smol-toml";
+//#region src/imports/scanner.ts
+function scanResult(source) {
+	if (!IMPORT_SOURCES.some((s) => s.id === source)) throw new ImportError("unsupported_source", "Unsupported source");
+	return {
+		id: randomUUID(),
+		createdAt: Date.now(),
+		source,
+		candidates: [],
+		diagnostics: []
+	};
+}
+function base(source, scope, location, shared = false) {
+	return {
+		id: randomUUID(),
+		source,
+		scope,
+		location,
+		shared
+	};
+}
+function appendMcp(scan, raw, scope, location) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return;
+	for (const [name, config] of Object.entries(raw)) scan.candidates.push(inspectMcp(base(scan.source, scope, location), name, config));
+}
+function scanLocal(input) {
+	const scan = scanResult(input.source);
+	const { home, root, layout } = sourceLayout(input.source, input.home, input.root);
+	const scopes = (input.projectOnly ? [] : layout.skills).map((s) => ({
+		path: join(s.base === "home" ? home : root, s.path),
+		scope: "user",
+		shared: s.shared
+	}));
+	if (input.projectRoot) scopes.push({
+		path: join(input.projectRoot, layout.projectSkills),
+		scope: "project",
+		shared: layout.skills.some((s) => s.shared)
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const budget = input.budget ?? {
+		bytes: 0,
+		files: 0
+	};
+	const consume = (bytes, files) => {
+		budget.bytes += bytes;
+		budget.files += files;
+		if (budget.bytes > IMPORT_LIMITS.total || budget.files > IMPORT_LIMITS.count) throw new ImportError("limit_exceeded", "Import exceeds batch limits", 413);
+	};
+	for (const scope of scopes) {
+		if (!existsSync(scope.path)) continue;
+		let entries;
+		try {
+			entries = readdirSync(scope.path, { withFileTypes: true });
+		} catch {
+			scan.diagnostics.push("Unable to read skills directory");
+			continue;
+		}
+		for (const entry of entries) {
+			if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+			const location = join(scope.path, entry.name);
+			if (!existsSync(join(location, "SKILL.md"))) continue;
+			try {
+				const real = realpathSync(location);
+				if (seen.has(real)) continue;
+				seen.add(real);
+				const files = readTree(location);
+				consume(files.reduce((n, f) => n + Buffer.byteLength(f.data, "base64"), 0), files.length);
+				scan.candidates.push(inspectSkill(base(input.source, scope.scope, real, scope.shared), files));
+			} catch (error) {
+				if (error instanceof ImportError && error.code === "limit_exceeded") throw error;
+				scan.diagnostics.push(`${entry.name}: ${error instanceof ImportError ? error.message : "Unable to read skill"}`);
+			}
+		}
+	}
+	const configs = [{
+		path: join(root, layout.config.path),
+		scope: "user"
+	}];
+	if (input.projectRoot) configs.push({
+		path: join(input.projectRoot, layout.projectConfig),
+		scope: "project"
+	});
+	for (const config of configs) {
+		if (!existsSync(config.path)) continue;
+		try {
+			const text = readRegularFile(config.path, 1024 * 1024).toString("utf8");
+			const parsed = layout.config.format === "toml" ? parse$1(text) : JSON.parse(text);
+			if (!input.projectOnly || config.scope === "project") appendMcp(scan, parsed[layout.config.mcpKey], config.scope, config.path);
+			const projects = parsed.projects;
+			if (config.scope === "user" && projects && typeof projects === "object" && !Array.isArray(projects)) {
+				const paths = Object.keys(projects);
+				scan.projectRoots = paths.slice(0, 100);
+				if (paths.length > 100) scan.diagnostics.push("Only the first 100 projects were imported.");
+				if (input.projectRoot) {
+					const project = projects[input.projectRoot];
+					appendMcp(scan, project?.[layout.config.mcpKey], "project", config.path);
+				}
+			}
+		} catch {
+			scan.diagnostics.push(`${basename(config.path)}: invalid or unreadable configuration`);
+		}
+	}
+	const addDocument = (path, scope) => {
+		if (!existsSync(path)) return;
+		try {
+			const content = readRegularFile(path, 128 * 1024).toString("utf8").trim();
+			if (!content) return;
+			consume(Buffer.byteLength(content), 1);
+			const blocked = containsSecret(content);
+			scan.candidates.push({
+				...base(input.source, scope, realpathSync(path)),
+				kind: "rule",
+				name: basename(path),
+				description: "",
+				hash: digest(content),
+				files: [],
+				compatibility: blocked ? "blocked" : "compatible",
+				findings: blocked ? ["Document contains probable credentials"] : [],
+				requiredEnv: [],
+				content: blocked ? void 0 : content
+			});
+		} catch {
+			scan.diagnostics.push(`${basename(path)}: unable to read context document`);
+		}
+	};
+	const addInstructions = (directory, groups, scope) => {
+		for (const names of groups) {
+			const path = names.map((name) => join(directory, name)).find(existsSync);
+			if (path) addDocument(path, scope);
+		}
+	};
+	const addRules = (directory, scope) => {
+		if (!existsSync(directory)) return;
+		try {
+			for (const entry of readdirSync(directory, { withFileTypes: true }).slice(0, 100)) if (entry.isFile() && entry.name.endsWith(".md")) addDocument(join(directory, entry.name), scope);
+		} catch {
+			scan.diagnostics.push("Unable to read rules directory");
+		}
+	};
+	if (!input.projectOnly) {
+		addInstructions(root, layout.instructions, "user");
+		if (layout.rules) addRules(join(root, layout.rules), "user");
+	}
+	if (input.projectRoot) {
+		addInstructions(input.projectRoot, layout.projectInstructions, "project");
+		if (layout.projectRules) addRules(join(input.projectRoot, layout.projectRules), "project");
+	}
+	return scan;
+}
+//#endregion
+export { IMPORT_SOURCES, scanLocal };

package/dist/src/imports/secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function containsSecret(text: string): boolean;
+export declare function isCredentialPath(path: string): boolean;

package/dist/src/imports/secrets.js

@@ -0,0 +1,9 @@
+//#region src/imports/secrets.ts
+function containsSecret(text) {
+	return /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|\b(?:sk-[a-zA-Z0-9_-]{20,}|gh[pousr]_[a-zA-Z0-9]{20,}|AKIA[A-Z0-9]{16})\b/i.test(text) || /(?:api[_-]?key|access[_-]?token|client[_-]?secret|password|authorization)\s*[=:]\s*["']?(?!\$|<|\{|process\.env|os\.environ)[a-zA-Z0-9_+/.-]{12,}/i.test(text);
+}
+function isCredentialPath(path) {
+	return /(^|\/)(\.env(?:\..*)?|auth\.json|credentials[^/]*|id_rsa|id_ed25519)$/i.test(path);
+}
+//#endregion
+export { containsSecret, isCredentialPath };

package/dist/src/imports/sources.d.ts

@@ -0,0 +1,37 @@
+import { type ImportSource } from './types.js';
+interface SourceLayout {
+    id: ImportSource;
+    name: string;
+    directory: string;
+    environment: string;
+    skills: Array<{
+        base: 'home' | 'root';
+        path: string;
+        shared: boolean;
+    }>;
+    projectSkills: string;
+    instructions: string[][];
+    projectInstructions: string[][];
+    rules?: string;
+    projectRules?: string;
+    config: {
+        path: string;
+        format: 'json' | 'toml';
+        mcpKey: string;
+    };
+    projectConfig: string;
+}
+/** Product differences live here; readers and destination writers are shared. */
+export declare const IMPORT_SOURCES: readonly SourceLayout[];
+export declare function sourceLayout(source: ImportSource, home?: string, root?: string): {
+    layout: SourceLayout;
+    home: string;
+    root: string;
+};
+export declare function detectImportSources(): {
+    id: ImportSource;
+    name: string;
+    detected: boolean;
+}[];
+export declare function isImportSource(value: string): value is ImportSource;
+export {};

package/dist/src/imports/sources.js

@@ -0,0 +1,75 @@
+import { ImportError } from "./types.js";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+//#region src/imports/sources.ts
+/** Product differences live here; readers and destination writers are shared. */
+const IMPORT_SOURCES = [{
+	id: "codex",
+	name: "Codex",
+	directory: ".codex",
+	environment: "CODEX_HOME",
+	skills: [{
+		base: "home",
+		path: ".agents/skills",
+		shared: true
+	}],
+	projectSkills: ".agents/skills",
+	instructions: [["AGENTS.override.md", "AGENTS.md"]],
+	projectInstructions: [["AGENTS.override.md", "AGENTS.md"]],
+	config: {
+		path: "config.toml",
+		format: "toml",
+		mcpKey: "mcp_servers"
+	},
+	projectConfig: ".codex/config.toml"
+}, {
+	id: "claude-code",
+	name: "Claude Code",
+	directory: ".claude",
+	environment: "CLAUDE_CONFIG_DIR",
+	skills: [{
+		base: "root",
+		path: "skills",
+		shared: false
+	}],
+	projectSkills: ".claude/skills",
+	instructions: [["CLAUDE.md"]],
+	projectInstructions: [
+		["CLAUDE.md"],
+		[".claude/CLAUDE.md"],
+		["CLAUDE.local.md"]
+	],
+	rules: "rules",
+	projectRules: ".claude/rules",
+	config: {
+		path: "../.claude.json",
+		format: "json",
+		mcpKey: "mcpServers"
+	},
+	projectConfig: ".mcp.json"
+}];
+function sourceLayout(source, home, root) {
+	const layout = IMPORT_SOURCES.find((s) => s.id === source);
+	if (!layout) throw new ImportError("unsupported_source", "Unsupported source");
+	return {
+		layout,
+		home: home ?? homedir(),
+		root: root ?? (home ? void 0 : process.env[layout.environment]) ?? join(home ?? homedir(), layout.directory)
+	};
+}
+function detectImportSources() {
+	return IMPORT_SOURCES.map((s) => {
+		const { root } = sourceLayout(s.id);
+		return {
+			id: s.id,
+			name: s.name,
+			detected: existsSync(root) || existsSync(join(root, s.config.path))
+		};
+	});
+}
+function isImportSource(value) {
+	return IMPORT_SOURCES.some((source) => source.id === value);
+}
+//#endregion
+export { IMPORT_SOURCES, detectImportSources, isImportSource, sourceLayout };

package/dist/src/imports/types.d.ts

@@ -0,0 +1,91 @@
+export type ImportSource = 'codex' | 'claude-code';
+export type ImportScope = 'user' | 'project';
+export type Compatibility = 'compatible' | 'needs_setup' | 'blocked' | 'unsupported';
+export interface ImportFile {
+    path: string;
+    data: string;
+    executable: boolean;
+}
+export interface ImportCandidate {
+    id: string;
+    source: ImportSource;
+    kind: 'skill' | 'mcp' | 'rule';
+    name: string;
+    description: string;
+    scope: ImportScope;
+    location: string;
+    hash: string;
+    compatibility: Compatibility;
+    findings: string[];
+    files: ImportFile[];
+    content?: string;
+    mcp?: Record<string, unknown>;
+    requiredEnv: string[];
+    shared: boolean;
+    connected?: boolean;
+}
+export interface ImportScan {
+    id: string;
+    createdAt: number;
+    source: ImportSource;
+    candidates: ImportCandidate[];
+    diagnostics: string[];
+    projectRoots?: string[];
+}
+export interface ImportTarget {
+    projectId?: string;
+    root: string;
+}
+export interface ImportAction {
+    candidateId: string;
+    operation: 'skip' | 'create' | 'rename' | 'replace';
+    name: string;
+    beforeHash: string | null;
+}
+export interface ImportPlan {
+    id: string;
+    scanId: string;
+    createdAt: number;
+    expiresAt: number;
+    target: ImportTarget;
+    targetRevision: string;
+    actions: ImportAction[];
+}
+export interface ImportJobItem {
+    action: ImportAction;
+    status: 'staged' | 'skipped' | 'publishing' | 'active' | 'rolling_back' | 'rolled_back' | 'failed';
+    error?: string;
+    afterHash?: string;
+    backupPath?: string;
+}
+export interface ImportJob {
+    id: string;
+    plan: ImportPlan;
+    createdAt: number;
+    expiresAt: number;
+    items: ImportJobItem[];
+}
+export declare class ImportError extends Error {
+    readonly code: string;
+    readonly status: 400 | 403 | 404 | 409 | 413;
+    constructor(code: string, message: string, status?: 400 | 403 | 404 | 409 | 413);
+}
+export interface ProductImportResult {
+    id: string;
+    source: ImportSource;
+    createdAt: number;
+    skills: number;
+    context: number;
+    projects: number;
+    skipped: number;
+    issues: Array<{
+        name: string;
+        reason: string;
+    }>;
+}
+export interface DetectedImportSource {
+    id: ImportSource;
+    name: string;
+    detected: boolean;
+    lastImport?: ProductImportResult;
+}

package/dist/src/imports/types.js

@@ -0,0 +1,11 @@
+//#region src/imports/types.ts
+var ImportError = class extends Error {
+	constructor(code, message, status = 400) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.name = "ImportError";
+	}
+};
+//#endregion
+export { ImportError };

package/dist/src/knowledge-memory/repository.js

@@ -142,7 +142,9 @@ function searchKnowledgeItems(input) {
 	const visible = visibilityClause(input.context);
 	const sourceParts = [];
 	const sourceValues = [];
-	if (input.sources?.includes("connector")) sourceParts.push("k.record_class = 'source_index'");
+	const importedSource = "COALESCE(json_extract(k.source_json, '$.kind'), '') = 'product_import'";
+	if (input.sources?.includes("connector")) sourceParts.push(`(k.record_class = 'source_index' AND NOT (${importedSource}))`);
+	if (input.sources?.includes("workspace")) sourceParts.push(`(k.record_class = 'source_index' AND ${importedSource})`);
 	const memoryScopes = input.sources?.filter((source) => source !== "connector") ?? [];
 	if (memoryScopes.length) {
 		sourceParts.push(`(k.record_class = 'memory' AND k.scope_type IN (${memoryScopes.map(() => "?").join(", ")}))`);
@@ -163,7 +165,7 @@ function searchKnowledgeItems(input) {
     ORDER BY rank ASC, k.importance DESC, k.updated_at DESC LIMIT ?`).all(fts, principalId, asOf, asOf, asOf, ...input.recordClass ? [input.recordClass] : [], ...sourceValues, ...visible.values, limit).map(fromRow);
 }
 function knowledgeSourceAllowed(item, sources) {
-	if (item.recordClass === "source_index") return sources.includes("connector");
+	if (item.recordClass === "source_index") return sources.includes(item.source.kind === "product_import" ? "workspace" : "connector");
 	return item.scope.type === "session" ? sources.includes("session") : item.scope.type === "workspace" ? sources.includes("workspace") : item.scope.type === "project" ? sources.includes("project") : false;
 }
 //#endregion

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
+import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,11 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-registry.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
+import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";

package/dist/src/providers/register-runtime-providers.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
+import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/storage/sqlite/import-repository.d.ts

@@ -0,0 +1,19 @@
+import type { ImportJob, ImportPlan, ImportScan, ProductImportResult } from '../../imports/types.js';
+type Records = {
+    scan: ImportScan;
+    plan: ImportPlan;
+    job: ImportJob;
+    run: ProductImportResult;
+};
+export declare class ImportRepository {
+    readonly owner: string;
+    constructor(owner: string);
+    get<K extends keyof Records>(kind: K, id: string): Records[K];
+    save<K extends keyof Records>(kind: K, value: Records[K], key?: string): void;
+    byKey(key: string): ImportJob | undefined;
+    latestRuns(): ProductImportResult[];
+    static owners(): string[];
+    scansBefore(time: number): ImportScan[];
+    jobs(limit?: number): ImportJob[];
+}
+export {};

package/dist/src/storage/sqlite/import-repository.js

@@ -0,0 +1,35 @@
+import { requireXopcDatabase } from "./connection.js";
+import { ImportError } from "../../imports/types.js";
+//#region src/storage/sqlite/import-repository.ts
+var ImportRepository = class {
+	constructor(owner) {
+		this.owner = owner;
+	}
+	get(kind, id) {
+		const row = requireXopcDatabase().db.prepare("SELECT payload FROM capability_imports WHERE owner = ? AND kind = ? AND id = ?").get(this.owner, kind, id);
+		if (!row) throw new ImportError("not_found", "Import record not found", 404);
+		return JSON.parse(row.payload);
+	}
+	save(kind, value, key) {
+		requireXopcDatabase().db.prepare(`INSERT INTO capability_imports(id, owner, kind, created_at, payload, idempotency_key)
+      VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET payload = excluded.payload WHERE capability_imports.owner = excluded.owner`).run(value.id, this.owner, kind, value.createdAt, JSON.stringify(value), key ?? null);
+	}
+	byKey(key) {
+		const row = requireXopcDatabase().db.prepare("SELECT payload FROM capability_imports WHERE owner = ? AND kind = ? AND idempotency_key = ?").get(this.owner, "job", key);
+		return row ? JSON.parse(row.payload) : void 0;
+	}
+	latestRuns() {
+		return requireXopcDatabase().db.prepare("SELECT payload FROM capability_imports WHERE owner = ? AND kind = 'run' ORDER BY created_at DESC LIMIT 100").all(this.owner).map((r) => JSON.parse(r.payload));
+	}
+	static owners() {
+		return requireXopcDatabase().db.prepare("SELECT DISTINCT owner FROM capability_imports").all().map((r) => r.owner);
+	}
+	scansBefore(time) {
+		return requireXopcDatabase().db.prepare("SELECT payload FROM capability_imports WHERE owner = ? AND kind = ? AND created_at < ?").all(this.owner, "scan", time).map((r) => JSON.parse(r.payload));
+	}
+	jobs(limit = 100) {
+		return requireXopcDatabase().db.prepare("SELECT payload FROM capability_imports WHERE owner = ? AND kind = ? ORDER BY created_at DESC LIMIT ?").all(this.owner, "job", limit).map((r) => JSON.parse(r.payload));
+	}
+};
+//#endregion
+export { ImportRepository };

package/dist/src/storage/sqlite/migrations/174_capability_imports.sql

@@ -0,0 +1,11 @@
+CREATE TABLE capability_imports (
+  id TEXT PRIMARY KEY,
+  owner TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('scan', 'plan', 'job', 'run')),
+  created_at INTEGER NOT NULL,
+  idempotency_key TEXT,
+  payload TEXT NOT NULL
+);
+CREATE INDEX capability_imports_owner_kind ON capability_imports(owner, kind, created_at DESC);
+CREATE UNIQUE INDEX capability_imports_idempotency ON capability_imports(owner, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;

package/dist/src/storage/sqlite/migrations/runner.d.ts

@@ -3,7 +3,7 @@ import type { ApplyMigrationsOptions } from './types.js';
 /** Baseline schema version applied from schema.sql on first open. */
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-export declare const XOPC_DB_SCHEMA_VERSION = 173;
+export declare const XOPC_DB_SCHEMA_VERSION = 174;
 export declare function resolveMigrationsDir(override?: string): string;
 /**
  * Apply sequential SQL migrations from (currentVersion + 1) through targetVersion.

package/dist/src/storage/sqlite/migrations/runner.js

@@ -12,7 +12,7 @@ const log = createLogger("Sqlite:Migrations");
 /** Baseline schema version applied from schema.sql on first open. */
 const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-const XOPC_DB_SCHEMA_VERSION = 173;
+const XOPC_DB_SCHEMA_VERSION = 174;
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 function backupBeforeTaskCutover(db, databasePath) {
 	db.exec("PRAGMA wal_checkpoint(FULL)");
@@ -57,7 +57,7 @@ function applySingleMigration(db, migration) {
 * Each step runs in its own transaction and updates schema_meta on success.
 */
 function applyPendingMigrations(db, options = {}) {
-	const targetVersion = options.targetVersion ?? 173;
+	const targetVersion = options.targetVersion ?? 174;
 	let currentVersion = readSchemaVersion(db);
 	if (currentVersion > targetVersion) throw new DatabaseSchemaTooNewError(currentVersion, targetVersion);
 	if (currentVersion >= targetVersion) return currentVersion;
@@ -94,7 +94,7 @@ function applyPendingMigrations(db, options = {}) {
 }
 /** Inspect schema version without mutating the database. */
 function inspectSchemaMigrationStatus(db, options = {}) {
-	const appVersion = options.targetVersion ?? 173;
+	const appVersion = options.targetVersion ?? 174;
 	const dbVersion = readSchemaVersion(db);
 	if (dbVersion > appVersion) return {
 		dbVersion,

package/dist/src/storage/sqlite/migrations/runner.ts

@@ -19,7 +19,7 @@ const log = createLogger('Sqlite:Migrations');
 export const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 
 /** Latest schema version this release supports (increment when adding migrations). */
-export const XOPC_DB_SCHEMA_VERSION = 173;
+export const XOPC_DB_SCHEMA_VERSION = 174;
 
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 

package/dist/src/storage/sqlite/schema.js

@@ -32,7 +32,7 @@ function ensureXopcDatabaseSchema(db, options = {}) {
 		currentVersion = 11;
 	}
 	applyPendingMigrations(db, {
-		targetVersion: 173,
+		targetVersion: 174,
 		databasePath: options.databasePath
 	});
 }