comisai 1.0.36 → 1.0.40

package/node_modules/@comis/memory/dist/observability-store.js

@@ -1,387 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * ObservabilityStore — SQLite persistence for observability data.
- *
- * Factory function pattern: prepares fixed SQL statements once in closure,
- * builds dynamic queries per-call for variable filter combinations, and
- * returns a frozen ObservabilityStore object.
- *
- * Maps between camelCase domain fields and snake_case database columns.
- *
- * @module
- */
-// ---------------------------------------------------------------------------
-// Row mapping helpers
-// ---------------------------------------------------------------------------
-function tokenUsageFromRow(row) {
-    return {
-        id: row.id,
-        timestamp: row.timestamp,
-        traceId: row.trace_id,
-        agentId: row.agent_id,
-        channelId: row.channel_id,
-        executionId: row.execution_id,
-        sessionKey: row.session_key,
-        provider: row.provider,
-        model: row.model,
-        promptTokens: row.prompt_tokens,
-        completionTokens: row.completion_tokens,
-        totalTokens: row.total_tokens,
-        cacheReadTokens: row.cache_read_tokens,
-        cacheWriteTokens: row.cache_write_tokens,
-        costInput: row.cost_input,
-        costOutput: row.cost_output,
-        costTotal: row.cost_total,
-        costCacheRead: row.cost_cache_read,
-        costCacheWrite: row.cost_cache_write,
-        cacheSaved: row.cache_saved,
-        latencyMs: row.latency_ms,
-        cacheRetention: row.cache_retention,
-    };
-}
-function deliveryFromRow(row) {
-    return {
-        id: row.id,
-        timestamp: row.timestamp,
-        traceId: row.trace_id,
-        agentId: row.agent_id,
-        channelType: row.channel_type,
-        channelId: row.channel_id,
-        sessionKey: row.session_key,
-        status: row.status,
-        latencyMs: row.latency_ms,
-        errorMessage: row.error_message,
-        messagePreview: row.message_preview,
-        toolCalls: row.tool_calls,
-        llmCalls: row.llm_calls,
-        tokensTotal: row.tokens_total,
-        costTotal: row.cost_total,
-    };
-}
-function diagnosticFromRow(row) {
-    return {
-        id: row.id,
-        timestamp: row.timestamp,
-        category: row.category,
-        severity: row.severity,
-        agentId: row.agent_id,
-        sessionKey: row.session_key,
-        message: row.message,
-        details: row.details,
-        traceId: row.trace_id,
-    };
-}
-function snapshotFromRow(row) {
-    return {
-        id: row.id,
-        timestamp: row.timestamp,
-        channelType: row.channel_type,
-        channelId: row.channel_id,
-        status: row.status,
-        messagesSent: row.messages_sent,
-        messagesReceived: row.messages_received,
-        uptimeMs: row.uptime_ms,
-    };
-}
-// ---------------------------------------------------------------------------
-// Table name mapping
-// ---------------------------------------------------------------------------
-const TABLE_MAP = {
-    token_usage: "obs_token_usage",
-    delivery: "obs_delivery",
-    diagnostics: "obs_diagnostics",
-    channels: "obs_channel_snapshots",
-};
-// ---------------------------------------------------------------------------
-// Factory
-// ---------------------------------------------------------------------------
-/**
- * Create an ObservabilityStore bound to the given database.
- *
- * Assumes `initSchema()` has already been called (tables exist).
- * Prepares fixed SQL statements once for performance. Dynamic-filter
- * queries build SQL per-call (better-sqlite3 statement cache handles this).
- *
- * @param db - An open better-sqlite3 Database instance
- * @returns ObservabilityStore implementation (frozen)
- */
-export function createObservabilityStore(db) {
-    // --- Prepared statements (fixed SQL, prepared once) ---
-    const insertTokenUsageStmt = db.prepare(`
-    INSERT INTO obs_token_usage (
-      timestamp, trace_id, agent_id, channel_id, execution_id, session_key,
-      provider, model, prompt_tokens, completion_tokens, total_tokens,
-      cache_read_tokens, cache_write_tokens, cost_input, cost_output, cost_total,
-      cost_cache_read, cost_cache_write, cache_saved, latency_ms, cache_retention
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `);
-    const aggByProviderAllStmt = db.prepare(`
-    SELECT provider, model, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage GROUP BY provider, model
-  `);
-    const aggByProviderSinceStmt = db.prepare(`
-    SELECT provider, model, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage WHERE timestamp >= ? GROUP BY provider, model
-  `);
-    const aggByAgentAllStmt = db.prepare(`
-    SELECT agent_id, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage GROUP BY agent_id
-  `);
-    const aggByAgentSinceStmt = db.prepare(`
-    SELECT agent_id, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage WHERE timestamp >= ? GROUP BY agent_id
-  `);
-    const aggBySessionStmt = db.prepare(`
-    SELECT session_key, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage WHERE session_key = ? GROUP BY session_key
-  `);
-    const aggBySessionSinceStmt = db.prepare(`
-    SELECT session_key, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage WHERE session_key = ? AND timestamp >= ? GROUP BY session_key
-  `);
-    const aggHourlyAllStmt = db.prepare(`
-    SELECT (timestamp / 3600000) * 3600000 as hour, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage GROUP BY (timestamp / 3600000) ORDER BY hour
-  `);
-    const aggHourlySinceStmt = db.prepare(`
-    SELECT (timestamp / 3600000) * 3600000 as hour, SUM(cost_total) as total_cost, SUM(total_tokens) as total_tokens, COUNT(*) as call_count, COALESCE(SUM(cache_saved), 0) as total_cache_saved
-    FROM obs_token_usage WHERE timestamp >= ? GROUP BY (timestamp / 3600000) ORDER BY hour
-  `);
-    const insertDeliveryStmt = db.prepare(`
-    INSERT INTO obs_delivery (
-      timestamp, trace_id, agent_id, channel_type, channel_id, session_key,
-      status, latency_ms, error_message, message_preview,
-      tool_calls, llm_calls, tokens_total, cost_total
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `);
-    const deliveryStatsAllStmt = db.prepare(`
-    SELECT
-      COUNT(*) as total,
-      COALESCE(SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END), 0) as success,
-      COALESCE(SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END), 0) as error,
-      COALESCE(SUM(CASE WHEN status = 'timeout' THEN 1 ELSE 0 END), 0) as timeout,
-      COALESCE(SUM(CASE WHEN status = 'filtered' THEN 1 ELSE 0 END), 0) as filtered,
-      COALESCE(AVG(latency_ms), 0) as avg_latency_ms
-    FROM obs_delivery
-  `);
-    const deliveryStatsSinceStmt = db.prepare(`
-    SELECT
-      COUNT(*) as total,
-      COALESCE(SUM(CASE WHEN status = 'success' THEN 1 ELSE 0 END), 0) as success,
-      COALESCE(SUM(CASE WHEN status = 'error' THEN 1 ELSE 0 END), 0) as error,
-      COALESCE(SUM(CASE WHEN status = 'timeout' THEN 1 ELSE 0 END), 0) as timeout,
-      COALESCE(SUM(CASE WHEN status = 'filtered' THEN 1 ELSE 0 END), 0) as filtered,
-      COALESCE(AVG(latency_ms), 0) as avg_latency_ms
-    FROM obs_delivery WHERE timestamp >= ?
-  `);
-    const insertDiagnosticStmt = db.prepare(`
-    INSERT INTO obs_diagnostics (
-      timestamp, category, severity, agent_id, session_key, message, details, trace_id
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-  `);
-    const insertSnapshotStmt = db.prepare(`
-    INSERT INTO obs_channel_snapshots (
-      timestamp, channel_type, channel_id, status, messages_sent, messages_received, uptime_ms
-    ) VALUES (?, ?, ?, ?, ?, ?, ?)
-  `);
-    const latestSnapshotsStmt = db.prepare(`
-    SELECT s.* FROM obs_channel_snapshots s
-    INNER JOIN (
-      SELECT channel_type, MAX(timestamp) as max_ts
-      FROM obs_channel_snapshots GROUP BY channel_type
-    ) latest ON s.channel_type = latest.channel_type AND s.timestamp = latest.max_ts
-  `);
-    // Reset/prune prepared statements
-    const deleteTokenUsageStmt = db.prepare("DELETE FROM obs_token_usage");
-    const deleteDeliveryStmt = db.prepare("DELETE FROM obs_delivery");
-    const deleteDiagnosticsStmt = db.prepare("DELETE FROM obs_diagnostics");
-    const deleteChannelsStmt = db.prepare("DELETE FROM obs_channel_snapshots");
-    const pruneTokenUsageStmt = db.prepare("DELETE FROM obs_token_usage WHERE timestamp < ?");
-    const pruneDeliveryStmt = db.prepare("DELETE FROM obs_delivery WHERE timestamp < ?");
-    const pruneDiagnosticsStmt = db.prepare("DELETE FROM obs_diagnostics WHERE timestamp < ?");
-    const pruneChannelsStmt = db.prepare("DELETE FROM obs_channel_snapshots WHERE timestamp < ?");
-    // Transactional helpers
-    const resetAllTx = db.transaction(() => {
-        const tokenUsage = deleteTokenUsageStmt.run().changes;
-        const delivery = deleteDeliveryStmt.run().changes;
-        const diagnostics = deleteDiagnosticsStmt.run().changes;
-        const channels = deleteChannelsStmt.run().changes;
-        return { tokenUsage, delivery, diagnostics, channels };
-    });
-    const pruneTx = db.transaction((cutoff) => {
-        const tokenUsage = pruneTokenUsageStmt.run(cutoff).changes;
-        const delivery = pruneDeliveryStmt.run(cutoff).changes;
-        const diagnostics = pruneDiagnosticsStmt.run(cutoff).changes;
-        const channels = pruneChannelsStmt.run(cutoff).changes;
-        return { tokenUsage, delivery, diagnostics, channels };
-    });
-    // --- Store implementation ---
-    const store = {
-        insertTokenUsage(entry) {
-            insertTokenUsageStmt.run(entry.timestamp, entry.traceId, entry.agentId, entry.channelId ?? "", entry.executionId ?? "", entry.sessionKey ?? "", entry.provider, entry.model, entry.promptTokens, entry.completionTokens, entry.totalTokens, entry.cacheReadTokens ?? 0, entry.cacheWriteTokens ?? 0, entry.costInput, entry.costOutput, entry.costTotal, entry.costCacheRead ?? 0, entry.costCacheWrite ?? 0, entry.cacheSaved ?? 0, entry.latencyMs, entry.cacheRetention ?? null);
-        },
-        queryTokenUsage(params) {
-            const conditions = [];
-            const values = [];
-            if (params?.sinceMs != null) {
-                conditions.push("timestamp >= ?");
-                values.push(params.sinceMs);
-            }
-            if (params?.agentId != null) {
-                conditions.push("agent_id = ?");
-                values.push(params.agentId);
-            }
-            if (params?.provider != null) {
-                conditions.push("provider = ?");
-                values.push(params.provider);
-            }
-            if (params?.sessionKey != null) {
-                conditions.push("session_key = ?");
-                values.push(params.sessionKey);
-            }
-            const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-            const limit = params?.limit ?? 1000;
-            const sql = `SELECT * FROM obs_token_usage ${where} ORDER BY timestamp DESC LIMIT ?`;
-            values.push(limit);
-            const rows = db.prepare(sql).all(...values);
-            return rows.map(tokenUsageFromRow);
-        },
-        aggregateByProvider(sinceMs) {
-            const rows = sinceMs != null
-                ? aggByProviderSinceStmt.all(sinceMs)
-                : aggByProviderAllStmt.all();
-            return rows.map((r) => ({
-                provider: r.provider,
-                model: r.model,
-                totalCost: r.total_cost,
-                totalTokens: r.total_tokens,
-                callCount: r.call_count,
-                totalCacheSaved: r.total_cache_saved,
-            }));
-        },
-        aggregateByAgent(sinceMs) {
-            const rows = sinceMs != null
-                ? aggByAgentSinceStmt.all(sinceMs)
-                : aggByAgentAllStmt.all();
-            return rows.map((r) => ({
-                agentId: r.agent_id,
-                totalCost: r.total_cost,
-                totalTokens: r.total_tokens,
-                callCount: r.call_count,
-                totalCacheSaved: r.total_cache_saved,
-            }));
-        },
-        aggregateBySession(sessionKey, sinceMs) {
-            const row = sinceMs != null
-                ? aggBySessionSinceStmt.get(sessionKey, sinceMs)
-                : aggBySessionStmt.get(sessionKey);
-            if (!row) {
-                return { sessionKey, totalCost: 0, totalTokens: 0, callCount: 0, totalCacheSaved: 0 };
-            }
-            return {
-                sessionKey: row.session_key,
-                totalCost: row.total_cost,
-                totalTokens: row.total_tokens,
-                callCount: row.call_count,
-                totalCacheSaved: row.total_cache_saved,
-            };
-        },
-        aggregateHourly(sinceMs) {
-            const rows = sinceMs != null
-                ? aggHourlySinceStmt.all(sinceMs)
-                : aggHourlyAllStmt.all();
-            return rows.map((r) => ({
-                hour: r.hour,
-                totalCost: r.total_cost,
-                totalTokens: r.total_tokens,
-                callCount: r.call_count,
-                totalCacheSaved: r.total_cache_saved,
-            }));
-        },
-        insertDelivery(entry) {
-            insertDeliveryStmt.run(entry.timestamp, entry.traceId, entry.agentId, entry.channelType, entry.channelId, entry.sessionKey ?? "", entry.status, entry.latencyMs, entry.errorMessage ?? "", entry.messagePreview ?? "", entry.toolCalls ?? 0, entry.llmCalls ?? 0, entry.tokensTotal ?? 0, entry.costTotal ?? 0);
-        },
-        queryDelivery(params) {
-            const conditions = [];
-            const values = [];
-            if (params?.sinceMs != null) {
-                conditions.push("timestamp >= ?");
-                values.push(params.sinceMs);
-            }
-            if (params?.channelType != null) {
-                conditions.push("channel_type = ?");
-                values.push(params.channelType);
-            }
-            if (params?.status != null) {
-                conditions.push("status = ?");
-                values.push(params.status);
-            }
-            const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-            const limit = params?.limit ?? 1000;
-            const sql = `SELECT * FROM obs_delivery ${where} ORDER BY timestamp DESC LIMIT ?`;
-            values.push(limit);
-            const rows = db.prepare(sql).all(...values);
-            return rows.map(deliveryFromRow);
-        },
-        deliveryStats(sinceMs) {
-            const row = sinceMs != null
-                ? deliveryStatsSinceStmt.get(sinceMs)
-                : deliveryStatsAllStmt.get();
-            return {
-                total: row.total,
-                success: row.success,
-                error: row.error,
-                timeout: row.timeout,
-                filtered: row.filtered,
-                avgLatencyMs: row.avg_latency_ms,
-            };
-        },
-        insertDiagnostic(entry) {
-            insertDiagnosticStmt.run(entry.timestamp, entry.category, entry.severity, entry.agentId ?? "", entry.sessionKey ?? "", entry.message, entry.details ?? "", entry.traceId ?? "");
-        },
-        queryDiagnostics(params) {
-            const conditions = [];
-            const values = [];
-            if (params?.sinceMs != null) {
-                conditions.push("timestamp >= ?");
-                values.push(params.sinceMs);
-            }
-            if (params?.category != null) {
-                conditions.push("category = ?");
-                values.push(params.category);
-            }
-            if (params?.severity != null) {
-                conditions.push("severity = ?");
-                values.push(params.severity);
-            }
-            const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-            const limit = params?.limit ?? 1000;
-            const sql = `SELECT * FROM obs_diagnostics ${where} ORDER BY timestamp DESC LIMIT ?`;
-            values.push(limit);
-            const rows = db.prepare(sql).all(...values);
-            return rows.map(diagnosticFromRow);
-        },
-        insertChannelSnapshot(entry) {
-            insertSnapshotStmt.run(entry.timestamp, entry.channelType, entry.channelId ?? "", entry.status, entry.messagesSent ?? 0, entry.messagesReceived ?? 0, entry.uptimeMs ?? 0);
-        },
-        latestChannelSnapshots() {
-            const rows = latestSnapshotsStmt.all();
-            return rows.map(snapshotFromRow);
-        },
-        prune(retentionDays) {
-            const cutoff = Date.now() - retentionDays * 86400000;
-            return pruneTx(cutoff);
-        },
-        resetAll() {
-            return resetAllTx();
-        },
-        resetTable(table) {
-            const sqlTable = TABLE_MAP[table];
-            if (!sqlTable) {
-                throw new Error(`Unknown observability table: ${table}`);
-            }
-            return db.prepare(`DELETE FROM ${sqlTable}`).run().changes;
-        },
-    };
-    return Object.freeze(store);
-}

package/node_modules/@comis/scheduler/dist/execution/execution-lock.d.ts

@@ -1,45 +0,0 @@
-/**
- * File-based execution locking via proper-lockfile.
- *
- * Provides at-most-once execution guarantee for scheduled jobs
- * across processes. Uses file system locks with stale detection
- * and periodic mtime updates for liveness proof.
- */
-import type { Result } from "@comis/shared";
-/** Options for file-based execution locking. */
-export interface ExecutionLockOptions {
-    /** Lock considered stale after this many ms without update (default 600_000 = 10 min). */
-    staleMs: number;
-    /** Mtime update interval in ms for liveness proof (default 30_000 = 30s). */
-    updateMs: number;
-    /** Callback when lock is compromised (e.g., external release). */
-    onCompromised?: (err: Error) => void;
-    /**
-     * Optional lock-acquisition retry budget. Forwarded to proper-lockfile's
-     * own retry option (uses a built-in incremental backoff). When undefined
-     * (default), retries: 0 — fail fast on contention. Lets the OAuth manager
-     * wait for a sibling refresh to complete (concurrent-refresh acceptance)
-     * without callers having to roll their own retry loop.
-     */
-    retries?: number | {
-        retries: number;
-        minTimeout?: number;
-        maxTimeout?: number;
-        factor?: number;
-    };
-}
-/**
- * Acquire a file lock, execute the function, and release the lock.
- *
- * Returns `ok(result)` on success, `err("locked")` when the lock is
- * already held by another process/call, or `err("error")` for
- * unexpected failures.
- *
- * The lock is always released in a finally block, even if `fn` throws.
- * The lockPath should be a sentinel file (e.g., `${lockDir}/job.lock`).
- */
-export declare function withExecutionLock<T>(lockPath: string, fn: () => Promise<T>, options?: Partial<ExecutionLockOptions>): Promise<Result<T, "locked" | "error">>;
-/**
- * Check whether a lock is currently held on the given path.
- */
-export declare function isLocked(lockPath: string): Promise<boolean>;

package/node_modules/@comis/scheduler/dist/execution/execution-lock.js

@@ -1,86 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * File-based execution locking via proper-lockfile.
- *
- * Provides at-most-once execution guarantee for scheduled jobs
- * across processes. Uses file system locks with stale detection
- * and periodic mtime updates for liveness proof.
- */
-import { ok, err } from "@comis/shared";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import lockfile from "proper-lockfile";
-const DEFAULT_OPTIONS = {
-    staleMs: 600_000,
-    updateMs: 30_000,
-    onCompromised: () => { },
-};
-/**
- * Acquire a file lock, execute the function, and release the lock.
- *
- * Returns `ok(result)` on success, `err("locked")` when the lock is
- * already held by another process/call, or `err("error")` for
- * unexpected failures.
- *
- * The lock is always released in a finally block, even if `fn` throws.
- * The lockPath should be a sentinel file (e.g., `${lockDir}/job.lock`).
- */
-export async function withExecutionLock(lockPath, fn, options) {
-    const opts = { ...DEFAULT_OPTIONS, ...options };
-    // Ensure lock directory and sentinel file exist
-    const dir = path.dirname(lockPath);
-    await fs.mkdir(dir, { recursive: true });
-    try {
-        await fs.access(lockPath);
-    }
-    catch {
-        await fs.writeFile(lockPath, "");
-    }
-    let release;
-    try {
-        release = await lockfile.lock(lockPath, {
-            stale: opts.staleMs,
-            update: opts.updateMs,
-            retries: opts.retries ?? 0,
-            onCompromised: opts.onCompromised ?? (() => { }),
-        });
-    }
-    catch (lockErr) {
-        if (isElockedError(lockErr)) {
-            return err("locked");
-        }
-        return err("error");
-    }
-    try {
-        const result = await fn();
-        return ok(result);
-    }
-    finally {
-        if (release) {
-            try {
-                await release();
-            }
-            catch {
-                // Lock may have been compromised; ignore release error
-            }
-        }
-    }
-}
-/**
- * Check whether a lock is currently held on the given path.
- */
-export async function isLocked(lockPath) {
-    try {
-        return await lockfile.check(lockPath);
-    }
-    catch {
-        return false;
-    }
-}
-/** Detect proper-lockfile ELOCKED error. */
-function isElockedError(error) {
-    if (error instanceof Error && "code" in error) {
-        return error.code === "ELOCKED";
-    }
-    return false;
-}

package/node_modules/@comis/skills/dist/audit/skill-audit.js

@@ -1,72 +0,0 @@
-import { createAuditEvent, classifyAction } from "@comis/core";
-/**
- * Emit a skill-related audit event on the typed event bus.
- *
- * Produces both a generic `audit:event` and a specific skill event
- * (`skill:prompt_loaded` or `skill:prompt_invoked`) on the bus.
- *
- * @param eventBus - The typed event bus to emit on
- * @param opts - Audit event options
- */
-export function emitSkillAudit(eventBus, opts) {
-    const classification = classifyAction(opts.action);
-    // Emit the generic audit:event
-    const auditEvent = createAuditEvent({
-        agentId: opts.agentId,
-        tenantId: opts.tenantId,
-        userId: opts.userId,
-        actionType: opts.action,
-        classification,
-        outcome: opts.outcome,
-        metadata: {
-            skillName: opts.skillName,
-            ...opts.metadata,
-        },
-        duration: opts.duration,
-    });
-    eventBus.emit("audit:event", {
-        timestamp: Date.now(),
-        agentId: auditEvent.agentId,
-        tenantId: auditEvent.tenantId,
-        actionType: auditEvent.actionType,
-        classification: auditEvent.classification,
-        outcome: auditEvent.outcome,
-        metadata: auditEvent.metadata,
-    });
-    // Emit the specific skill event
-    const now = Date.now();
-    switch (opts.action) {
-        case "skill.prompt.load":
-            eventBus.emit("skill:prompt_loaded", {
-                skillName: opts.skillName,
-                source: opts.metadata?.["source"] ?? "unknown",
-                bodyLength: opts.metadata?.["bodyLength"] ?? 0,
-                timestamp: now,
-            });
-            break;
-        case "skill.prompt.invoke":
-            eventBus.emit("skill:prompt_invoked", {
-                skillName: opts.skillName,
-                invokedBy: opts.metadata?.["invokedBy"] ?? "user",
-                args: opts.metadata?.["args"] ?? "",
-                timestamp: now,
-            });
-            break;
-        case "skill.scan":
-            eventBus.emit("skill:rejected", {
-                skillName: opts.skillName,
-                reason: "Content scan findings detected",
-                violations: opts.metadata?.["findings"]?.map(f => f.ruleId) ?? [],
-                timestamp: now,
-            });
-            break;
-        case "skill.scan.reject":
-            eventBus.emit("skill:rejected", {
-                skillName: opts.skillName,
-                reason: "Skill blocked: CRITICAL content scan findings",
-                violations: opts.metadata?.["findings"]?.map(f => f.ruleId) ?? [],
-                timestamp: now,
-            });
-            break;
-    }
-}

package/node_modules/@comis/skills/dist/bridge/credential-injector.d.ts

@@ -1,90 +0,0 @@
-/**
- * Credential injector: Transparent HTTP credential injection for agent tools.
- *
- * Intercepts outbound fetch() calls from agent tools and injects credentials
- * (bearer tokens, custom headers, query params, basic auth) for matching URLs.
- * Tool code never sees plaintext API keys -- the injection is transparent.
- *
- * Security invariants:
- * - SSRF validation runs BEFORE credential injection (no creds to private IPs)
- * - globalThis.fetch is always restored in finally block after tool execution
- * - Error messages are sanitized to prevent credential leakage in stack traces
- *
- * @module
- */
-import type { SecretManager, TypedEventBus, CredentialMapping } from "@comis/core";
-import type { AgentTool } from "@mariozechner/pi-agent-core";
-/** Credential injector: creates fetch wrappers that inject credentials for matching URLs. */
-export interface CredentialInjector {
-    /** Create a fetch function that injects credentials for a specific tool. */
-    createInjectedFetch(toolName: string): typeof fetch;
-    /** Get a frozen copy of the configured credential mappings. */
-    getMappings(): readonly CredentialMapping[];
-}
-/** Dependencies for creating a credential injector. */
-export interface CredentialInjectorDeps {
-    /** Secret manager for resolving credential values by name. */
-    secretManager: SecretManager;
-    /** Credential mappings defining which URLs get which credentials. */
-    mappings: CredentialMapping[];
-    /** Optional event bus for audit event emission. */
-    eventBus?: TypedEventBus;
-    /** Optional agent ID for audit event attribution. */
-    agentId?: string;
-}
-/**
- * Check whether a request URL matches a credential mapping URL pattern.
- *
- * Matching rules:
- * 1. Parse both URLs (pattern gets "https://" prepended if no protocol)
- * 2. Compare hostnames exactly (case-insensitive via URL normalization)
- * 3. If pattern has a non-root pathname, check request path starts with it
- *
- * @param requestUrl - The full URL being fetched
- * @param urlPattern - The pattern from the credential mapping (hostname or hostname/path)
- * @returns true if the request URL matches the pattern
- */
-export declare function matchesUrl(requestUrl: string, urlPattern: string): boolean;
-/**
- * Inject a credential into an outbound HTTP request based on the mapping type.
- *
- * @param init - The RequestInit (headers, body, etc.)
- * @param url - The parsed request URL
- * @param mapping - The credential mapping defining injection strategy
- * @param secretValue - The plaintext secret value to inject
- * @returns Updated init and url (url may change for query_param injection)
- */
-export declare function injectCredential(init: RequestInit, url: URL, mapping: CredentialMapping, secretValue: string): {
-    init: RequestInit;
-    url: URL;
-};
-/**
- * Create a credential injector that wraps fetch() to transparently inject credentials.
- *
- * The injector captures a reference to the REAL globalThis.fetch at creation time.
- * All HTTP calls (both matched and unmatched) go through this captured reference,
- * not through globalThis.fetch (which will be the wrapper during tool execution).
- *
- * @param deps - Injector dependencies (secret manager, mappings, optional event bus)
- * @returns A frozen CredentialInjector instance
- */
-export declare function createCredentialInjector(deps: CredentialInjectorDeps): CredentialInjector;
-/**
- * Wrap an AgentTool to inject credentials into its outbound HTTP requests.
- *
- * During tool.execute(), globalThis.fetch is replaced with an injected fetch
- * that transparently adds credentials for matching URLs. The original fetch
- * is always restored in the finally block, even if execute() throws.
- *
- * @concurrency WARNING: This function mutates globalThis.fetch for the duration
- * of tool.execute(). If multiple tools execute concurrently in the same Node.js
- * process, their fetch wrappers will conflict. The current architecture runs
- * tools sequentially within a single agent execution loop, making this safe.
- * If parallel tool execution is introduced, migrate to AsyncLocalStorage-based
- * fetch scoping instead of globalThis mutation.
- *
- * @param tool - The AgentTool to wrap
- * @param injector - The credential injector to use
- * @returns A new AgentTool with credential injection
- */
-export declare function wrapWithCredentialInjection(tool: AgentTool<any>, injector: CredentialInjector): AgentTool<any>;