parts implementation

Configuration and packaged skills

Core persists manifest-declared pl24Password, profiautoPassword and corahbPassword in PluginSecretVault and materializes the existing keys into ctx.config and ctx.userConfig(). readInstanceConfig resolves the materialized instance snapshot at registration. resolveEshopAccount is asynchronous and awaits the acting account and userConfig on every call; cart, order and search tools await the result before using credentials. Parts adds no secret persistence or direct vault SQL. Missing credentials retain null catalog/NoLoginError behavior; unavailable vault access propagates. The coupled test runs the actual core registry and stores against a PostgreSQL fixture and reopens the stored credentials.

Parts registers its packaged skills through ctx.registerSkillDirectory. Core owns native PI loading, plugin source identity, pinned metadata and account visibility. A zero count is an empty contribution. Registration performs local directory reads; skill body content costs prompt tokens only when loaded for use. Brainstorming deliberately rejects zero; Parts and Raynet do not.

URLs, basket reads and VIN caches

pl24Url(path) in src/pl24/types.ts joins PartsLink24 paths to the catalog origin; absolute HTTP URLs pass through. The Struts viewer base retains plain concatenation so remote data cannot become a cookie-bearing absolute URL. basketItems(session) in eshop/api-driver.ts fetches/parses the basket before mutations and verification, without cross-operation caching.

cacheTecDocVinDecode returns TrimmedCategory[] or null; incomplete decodes write nothing. VIN parts records contain units without cachedAt. External diagram caches contain only bytes, validated by sniffed image type; old metadata sidecars are ignored. BOM records use diagram {} when bytes are stored and null otherwise, without cache time or MIME; older records remain readable.

PartsShopSearch batch picks preserve the in-stock selection for supported limits through ten. Product cards retain distributor availability at every limit; distributor stock is distinct from local warehouse stock.

EshopSessions.run wraps every e-shop tool call: it retries once after a session expiry and holds a per-account lock, so calls for one account are serialized within a process only. PartsLink24 catalog requests run one at a time: Pl24Client waits until the previous request has finished and PL24_MIN_REQUEST_INTERVAL_MS has passed, because overlapping requests trigger the catalog's rate limit. A 429 response waits for its Retry-After header, or for two seconds times the retry number, and is retried at most PL24_RATE_LIMIT_RETRIES times inside the same tool call. A group walk is bounded by PL24_GROUP_FETCH_BUDGET requests and PL24_GROUP_ENTRY_LIMIT entries and fails instead of caching a truncated group list.

Implementation contract owns module, transport, error and test details.