@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/engineering/engineering-runtime/scripts/invocation-policy.test.mjs

@@ -0,0 +1,95 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  applyInvocationPolicy,
+  clearInvocationPolicy,
+  MANUAL_ONLY,
+  manualOnlyPolicyFindings,
+  reconcileInvocationPolicy,
+  reviewedSourceInjections,
+} from './invocation-policy.mjs';
+
+const UPSTREAM_SKILL = `---
+name: tdd
+description: Test-driven development.
+---
+
+# TDD
+`;
+const UPSTREAM_OPENAI = `interface:
+  display_name: "TDD"
+  short_description: "Test-driven red-green-refactor"
+`;
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'invocation-policy-'));
+  const skill = join(root, 'tdd');
+  mkdirSync(join(skill, 'agents'), { recursive: true });
+  writeFileSync(join(skill, 'SKILL.md'), UPSTREAM_SKILL);
+  writeFileSync(join(skill, 'agents', 'openai.yaml'), UPSTREAM_OPENAI);
+  return { root, skill };
+}
+
+test('manual-only policy is idempotent and preserves explicit invocation metadata', () => {
+  const { root, skill } = fixture();
+  const first = applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
+  const skillOnce = readFileSync(join(skill, 'SKILL.md'), 'utf8');
+  const openaiOnce = readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8');
+  const second = applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
+
+  assert.equal(first.changed, true);
+  assert.equal(second.changed, false);
+  assert.match(skillOnce, /^disable-model-invocation: true$/m);
+  assert.match(openaiOnce, /^policy:\n  allow_implicit_invocation: false$/m);
+  assert.deepEqual(manualOnlyPolicyFindings(skill), []);
+  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), skillOnce);
+  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), openaiOnce);
+});
+
+test('reviewed source injections remove only the deterministic runtime policy overlay', () => {
+  const { root, skill } = fixture();
+  applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
+  const injected = Object.fromEntries(reviewedSourceInjections(skill, MANUAL_ONLY)
+    .map((entry) => [entry.relativePath, entry.contents]));
+  assert.equal(injected['SKILL.md'], UPSTREAM_SKILL);
+  assert.equal(injected['agents/openai.yaml'], UPSTREAM_OPENAI);
+
+  const cleared = clearInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
+  assert.equal(cleared.changed, true);
+  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), UPSTREAM_SKILL);
+  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), UPSTREAM_OPENAI);
+  assert.equal(clearInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root }).changed, false);
+});
+
+test('a missing selection defaults TDD to implicit invocation', () => {
+  const { root, skill } = fixture();
+  applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
+  const home = mkdtempSync(join(tmpdir(), 'invocation-policy-home-'));
+  const result = reconcileInvocationPolicy({
+    installName: 'tdd',
+    policy: MANUAL_ONLY,
+    skillsRoot: root,
+    env: { HOME: home },
+  });
+  assert.equal(result.policy, 'implicit');
+  assert.equal(result.changed, true);
+  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), UPSTREAM_SKILL);
+  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), UPSTREAM_OPENAI);
+});
+
+test('policy application fails closed on malformed or missing skill metadata', () => {
+  const { root, skill } = fixture();
+  writeFileSync(join(skill, 'SKILL.md'), 'not frontmatter\n');
+  assert.throws(
+    () => applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root }),
+    /must begin with YAML frontmatter/,
+  );
+  assert.throws(
+    () => applyInvocationPolicy({ installName: '../tdd', policy: MANUAL_ONLY, skillsRoot: root }),
+    /invalid installed skill name/,
+  );
+});

package/skills/engineering/engineering-runtime/scripts/main-module.mjs

@@ -0,0 +1,79 @@
+// The one ESM main-module guard every skill script in this repo uses.
+//
+// Not a style preference — the hand-written versions of this three-line check had two opposite
+// silent failure modes in production, and both shipped:
+//
+//   #718  `import.meta.url === pathToFileURL(process.argv[1]).href`
+//         Node resolves `import.meta.url` to the REAL path; `argv[1]` keeps whatever the caller
+//         typed. A skills install is a symlink farm (`~/.claude/skills/<skill>` → the checkout),
+//         so through the install path the two never match: the CLI does not run and node exits 0.
+//         `coverage-ledger.mjs` shipped this and recorded a false pass in the wild
+//         (a consumer product repo: epic #352, unit #379, PR #384) on a gate whose only job is to
+//         say no. Fails OPEN, invisibly — "passed" and "never ran" are byte-identical evidence.
+//
+//   #446  `fs.realpathSync(process.argv[1]) === …`, unguarded.
+//         `node -` sets `argv[1]` to the literal string `"-"` — truthy, so the usual
+//         `process.argv[1] &&` prefix does not save it — and realpath throws ENOENT at MODULE
+//         LOAD, before a line of the module's own code runs. The module cannot be imported by
+//         anything that does not launch it as a file. Fails CLOSED, at load.
+//
+// So the contract has exactly two obligations, one per failure mode:
+//   1. realpath BOTH sides before comparing, so a symlinked invocation is still the main module;
+//   2. degrade to `false` — "not the main module" — for anything that does not resolve, never throw.
+//
+// WHY IT IS SHARED RATHER THAN COPIED. PR #278 fixed twelve copies of failure mode #718 by hand and
+// mechanized nothing. Five weeks later `mergify/scripts/audit.mjs` was written with the pre-#278
+// form, and `coverage-ledger.mjs` survived the whole pass because it spelled the same bug a third
+// way that #278's grep did not match. One module plus `main-guard-hygiene.test.mjs` is what stops
+// the next copy: there is now no second place for this logic to drift to, and adding one fails CI.
+//
+// WHERE IT LIVES, AND WHY HERE. Native Skills CLI installation flattens selected packages into
+// sibling directories under `~/.agents/skills`, while this repository nests them under
+// `skills/engineering`. A Workflow consumer at `<skill>/scripts` therefore imports
+// `../../engineering-runtime/scripts/main-module.mjs`: the same specifier reaches this package in
+// both layouts. Claude Code launches through a per-skill symlink into the canonical store; node's
+// realpath-aware module resolution and this predicate preserve that path as well.
+//
+// `engineering-runtime` owns the helper as an installable support package rather than a user
+// capability. Every consumer imports this package directly.
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Is the module identified by `importMetaUrl` the script node was launched with?
+ *
+ * Symlink-transparent, and total: any input that does not resolve to a real file answers `false`
+ * instead of throwing, so importing a CLI module is always safe.
+ *
+ * @param {string} importMetaUrl the caller's own `import.meta.url`
+ * @returns {boolean}
+ */
+export function isMainModule(importMetaUrl) {
+  const entry = process.argv[1];
+  if (typeof entry !== 'string' || entry === '') return false; // imported, or an embedding harness
+
+  let entryPath;
+  try {
+    entryPath = fs.realpathSync(entry);
+  } catch {
+    return false; // #446: `node -` gives "-"; some harnesses give a path that is not on disk
+  }
+
+  let selfPath;
+  try {
+    selfPath = fileURLToPath(importMetaUrl);
+  } catch {
+    return false; // a data:/http: module has no path to compare, so it is never the launched script
+  }
+  try {
+    // #718: the launched side is resolved above, so this side must be too. Under Node's default
+    // resolution `import.meta.url` is already real and this is a no-op; under `--preserve-symlinks`
+    // it is the half that makes the comparison hold.
+    selfPath = fs.realpathSync(selfPath);
+  } catch {
+    // The module is executing, so it existed a moment ago. Compare what we have rather than
+    // claiming "not main" — a vanished file should not silently disable a running CLI.
+  }
+
+  return entryPath === selfPath;
+}

package/skills/engineering/engineering-runtime/scripts/main-module.test.mjs

@@ -0,0 +1,288 @@
+// Behaviour gate for the shared ESM main-module guard (issues #718 and #446).
+//
+// The two failure modes this pins are opposite halves of one idiom, and both are silent:
+//
+//   #718 — comparing `import.meta.url` against an un-realpathed `process.argv[1]`. Node resolves
+//          `import.meta.url` to the REAL file; `argv[1]` keeps whatever the caller typed. Invoked
+//          through a symlink — which is exactly how every skills install works — the two never
+//          match, the CLI never runs, and node exits 0 having done nothing. On a gate whose job is
+//          to say *no*, "passed" and "never ran" produce byte-identical evidence.
+//   #446 — calling `fs.realpathSync(process.argv[1])` unguarded. `node -` sets `argv[1]` to the
+//          literal string `"-"`, which is truthy and is not a file, so realpath throws ENOENT at
+//          MODULE LOAD — before any of the module's own code runs. The module becomes unimportable
+//          by any consumer that does not launch it as a file.
+//
+// So the in-process predicate tests below are necessary but not sufficient: #446 is a *load-time*
+// throw, which an in-process test cannot observe at all. Every claim that matters here is also
+// driven through a real child process — a real temp symlink, a real `node -` on stdin, and the
+// real `coverage-ledger.mjs` that #718 was filed against.
+//
+// Discovered and run by .github/workflows/ci.yml (every skills/**/*.test.mjs).
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { cpSync, mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { isMainModule } from './main-module.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url)); // skills/engineering/engineering-runtime/scripts
+const SKILLS_DIR = dirname(dirname(dirname(HERE))); // skills/
+const REPO = dirname(SKILLS_DIR);
+const HELPER_URL = pathToFileURL(join(HERE, 'main-module.mjs')).href;
+
+// Every child-process case builds its own scratch dir and removes it, so a failing run leaves
+// nothing behind and two runs never share a symlink.
+function withTmp(fn) {
+  const dir = mkdtempSync(join(tmpdir(), 'main-module-'));
+  try {
+    return fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// A minimal CLI with the exact shape every converted site has: import the helper, run the CLI only
+// when the guard says this module is main, and exit with a distinctive code so "ran" and "did not
+// run" cannot be confused with each other.
+const FIXTURE_CLI = `
+import { isMainModule } from ${JSON.stringify(HELPER_URL)};
+export const marker = 'imported-cleanly';
+if (isMainModule(import.meta.url)) {
+  console.log('CLI RAN');
+  process.exit(7);
+}
+`;
+
+function runNode(args, opts = {}) {
+  const r = spawnSync(process.execPath, args, { encoding: 'utf8', ...opts });
+  return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+}
+
+// --- the predicate itself -------------------------------------------------------------------
+// Restoring argv[1] rather than assigning a saved copy back blindly: `node --test` needs it, and a
+// test that corrupted it would poison every later file in the same process.
+
+function withArgv1(value, fn) {
+  const saved = process.argv[1];
+  if (value === undefined) delete process.argv[1];
+  else process.argv[1] = value;
+  try {
+    return fn();
+  } finally {
+    process.argv[1] = saved;
+  }
+}
+
+test('argv[1] absent → not main, and no throw (#446)', () => {
+  withArgv1(undefined, () => {
+    assert.equal(isMainModule(import.meta.url), false);
+  });
+});
+
+test('argv[1] set to a path that is not a real file → not main, and no throw (#446)', () => {
+  // `"-"` is not a hypothetical: it is literally what `node -` puts in argv[1].
+  for (const value of ['-', '', '/definitely/not/a/real/path.mjs', '[eval]']) {
+    withArgv1(value, () => {
+      assert.equal(isMainModule(import.meta.url), false, `argv[1]=${JSON.stringify(value)}`);
+    });
+  }
+});
+
+test('argv[1] is this module → main (AC7: the true branch still fires)', () => {
+  const self = fileURLToPath(import.meta.url);
+  withArgv1(self, () => {
+    assert.equal(isMainModule(import.meta.url), true);
+  });
+});
+
+test('argv[1] is a SYMLINK to this module → still main (#718)', () => {
+  withTmp((dir) => {
+    const link = join(dir, 'aliased-name.mjs');
+    symlinkSync(fileURLToPath(import.meta.url), link);
+    withArgv1(link, () => {
+      assert.equal(isMainModule(import.meta.url), true, 'a symlinked invocation is the main module');
+    });
+    // The pre-fix predicate is what this must not degrade back into. Stated as an executable
+    // contrast so the assertion above cannot be satisfied by an implementation that happens to
+    // compare raw strings on a machine where nothing is symlinked.
+    assert.notEqual(pathToFileURL(link).href, import.meta.url, 'the naive comparison would be false here');
+  });
+});
+
+test('argv[1] is a different real file → not main', () => {
+  withArgv1(join(REPO, 'CLAUDE.md'), () => {
+    assert.equal(isMainModule(import.meta.url), false);
+  });
+});
+
+test('a non-file import.meta.url → not main, and no throw', () => {
+  withArgv1(fileURLToPath(import.meta.url), () => {
+    assert.equal(isMainModule('data:text/javascript,export{}'), false);
+  });
+});
+
+// --- real child processes -------------------------------------------------------------------
+
+test('a CLI invoked through a symlink runs, byte-identically to a direct invocation (#718)', () => {
+  withTmp((dir) => {
+    const real = join(dir, 'real-cli.mjs');
+    const link = join(dir, 'installed-cli.mjs');
+    writeFileSync(real, FIXTURE_CLI);
+    symlinkSync(real, link);
+
+    const direct = runNode([real]);
+    const viaLink = runNode([link]);
+
+    assert.equal(direct.stdout.trim(), 'CLI RAN');
+    assert.equal(direct.status, 7);
+    assert.deepEqual(
+      { stdout: viaLink.stdout, status: viaLink.status },
+      { stdout: direct.stdout, status: direct.status },
+      `the symlinked invocation must produce the same output and exit code.\nstderr:\n${viaLink.stderr}`,
+    );
+  });
+});
+
+test('a directory symlink — the actual skills-install shape — resolves too (#718)', () => {
+  withTmp((dir) => {
+    // ~/.claude/skills/<skill> is a symlink to the skill DIRECTORY, not to each script, so the
+    // symlink sits in the middle of the path rather than at its end.
+    const skill = join(dir, 'real-skill');
+    mkdirSync(join(skill, 'scripts'), { recursive: true });
+    const script = join(skill, 'scripts', 'cli.mjs');
+    writeFileSync(script, FIXTURE_CLI);
+    const installed = join(dir, 'installed-skill');
+    symlinkSync(skill, installed);
+
+    const viaDir = runNode([join(installed, 'scripts', 'cli.mjs')]);
+    assert.equal(viaDir.stdout.trim(), 'CLI RAN', `stderr:\n${viaDir.stderr}`);
+    assert.equal(viaDir.status, 7);
+  });
+});
+
+test('`node -` can import a module that uses the guard, without throwing at load (#446, AC8)', () => {
+  withTmp((dir) => {
+    const mod = join(dir, 'cli.mjs');
+    writeFileSync(mod, FIXTURE_CLI);
+    // Reading the program from stdin is the case that sets argv[1] to the literal "-". This is the
+    // invocation that threw ENOENT at module load before the fix, so it is run as a real child
+    // process — an in-process test cannot observe a load-time throw.
+    const r = runNode(['-'], {
+      input: `const m = await import(${JSON.stringify(pathToFileURL(mod).href)});\nconsole.log(m.marker);\n`,
+    });
+    assert.equal(r.status, 0, `import under \`node -\` must not throw.\nstderr:\n${r.stderr}`);
+    assert.equal(r.stdout.trim(), 'imported-cleanly');
+    assert.ok(!r.stdout.includes('CLI RAN'), 'an imported module must not execute its CLI');
+  });
+});
+
+test('argv[1] set to a nonexistent path does not stop a module from loading (#446)', () => {
+  withTmp((dir) => {
+    const mod = join(dir, 'cli.mjs');
+    writeFileSync(mod, FIXTURE_CLI);
+    const driver = join(dir, 'driver.mjs');
+    writeFileSync(
+      driver,
+      `process.argv[1] = '/no/such/file.mjs';\n` +
+        `const m = await import(${JSON.stringify(pathToFileURL(mod).href)});\n` +
+        `console.log(m.marker);\n`,
+    );
+    const r = runNode([driver]);
+    assert.equal(r.status, 0, `stderr:\n${r.stderr}`);
+    assert.equal(r.stdout.trim(), 'imported-cleanly');
+  });
+});
+
+// --- the real script #718 was filed against ---------------------------------------------------
+
+test('coverage-ledger.mjs: symlinked and direct invocations agree (#718 AC1)', () => {
+  withTmp((dir) => {
+    // A scratch cwd with no surface inventory, so the honest answer is a deterministic failure —
+    // exit 2 — rather than a pass. That is the whole point of the issue: before the fix the
+    // symlinked run printed nothing and exited 0, which is indistinguishable from success.
+    const cwd = join(dir, 'workdir');
+    mkdirSync(cwd);
+    const skill = join(SKILLS_DIR, 'engineering', 'ensure-coverage');
+    const installed = join(dir, 'ensure-coverage');
+    symlinkSync(skill, installed);
+
+    const argsFor = (root) => [join(root, 'scripts', 'coverage-ledger.mjs'), 'validate'];
+    const direct = runNode(argsFor(skill), { cwd });
+    const viaLink = runNode(argsFor(installed), { cwd });
+
+    assert.equal(direct.status, 2, `expected the honest failure, got:\n${direct.stdout}${direct.stderr}`);
+    assert.match(direct.stderr, /Inventory not found/);
+    assert.deepEqual(
+      { status: viaLink.status, stdout: viaLink.stdout, stderr: viaLink.stderr },
+      { status: direct.status, stdout: direct.stdout, stderr: direct.stderr },
+      'a symlinked coverage-ledger must not silently no-op and exit 0',
+    );
+  });
+});
+
+test('flat installation and Claude skill symlink preserve direct launch and import behavior', () => {
+  withTmp((dir) => {
+    const canonical = join(dir, '.agents', 'skills');
+    const claude = join(dir, '.claude', 'skills');
+    const sourceEngineering = join(SKILLS_DIR, 'engineering');
+    mkdirSync(canonical, { recursive: true });
+    mkdirSync(claude, { recursive: true });
+    cpSync(join(sourceEngineering, 'ensure-coverage'), join(canonical, 'ensure-coverage'), { recursive: true });
+    cpSync(join(sourceEngineering, 'engineering-runtime'), join(canonical, 'engineering-runtime'), { recursive: true });
+    symlinkSync(join(canonical, 'ensure-coverage'), join(claude, 'ensure-coverage'));
+    symlinkSync(join(canonical, 'engineering-runtime'), join(claude, 'engineering-runtime'));
+
+    const cwd = join(dir, 'workdir');
+    mkdirSync(cwd);
+    const directScript = join(canonical, 'ensure-coverage', 'scripts', 'coverage-ledger.mjs');
+    const claudeScript = join(claude, 'ensure-coverage', 'scripts', 'coverage-ledger.mjs');
+    const direct = runNode([directScript, 'validate'], { cwd });
+    const viaClaude = runNode([claudeScript, 'validate'], { cwd });
+
+    assert.equal(direct.status, 2, `the installed CLI must reach its honest failure:\n${direct.stderr}`);
+    assert.match(direct.stderr, /Inventory not found/);
+    assert.deepEqual(
+      { status: viaClaude.status, stdout: viaClaude.stdout, stderr: viaClaude.stderr },
+      { status: direct.status, stdout: direct.stdout, stderr: direct.stderr },
+      'Claude symlink launch must preserve installed CLI output and exit status',
+    );
+
+    const imported = runNode(['-'], {
+      cwd,
+      input: `await import(${JSON.stringify(pathToFileURL(directScript).href)});\nconsole.log('IMPORTED');\n`,
+    });
+    assert.equal(imported.status, 0, `a flat-installed Workflow module must import under non-file argv:\n${imported.stderr}`);
+    assert.equal(imported.stdout.trim(), 'IMPORTED');
+  });
+});
+
+// --- the whole converted class, not just the fixture -------------------------------------------
+
+test('every script that adopted the guard is importable with argv[1] = "-" (#446 AC6/AC8)', () => {
+  // The class, executed. `grep` for the helper import, then import all of them in one child whose
+  // argv[1] is the literal "-": before the fix this is precisely the invocation that threw ENOENT
+  // at load, so a regression at ANY single site turns this red without anyone maintaining a list.
+  const listed = execFileSync(
+    'git',
+    ['grep', '-l', '--', 'main-module.mjs', ':(exclude)skills/engineering/engineering-runtime', 'skills'],
+    { cwd: REPO, encoding: 'utf8' },
+  )
+    .split('\n')
+    .filter((p) => p.endsWith('.mjs') && !p.endsWith('.test.mjs'));
+
+  assert.ok(listed.length >= 30, `expected the converted class to be found, got ${listed.length}`);
+
+  const program = listed
+    .map((p) => `await import(${JSON.stringify(pathToFileURL(join(REPO, p)).href)});`)
+    .join('\n');
+  const r = runNode(['-'], { input: `${program}\nconsole.log('ALL IMPORTED');\n`, cwd: REPO });
+  assert.equal(
+    r.status,
+    0,
+    `importing the converted scripts under \`node -\` must not throw.\nstderr:\n${r.stderr}`,
+  );
+  assert.match(r.stdout, /ALL IMPORTED/);
+});

package/skills/engineering/engineering-runtime/scripts/mergify-yaml.mjs

@@ -0,0 +1,11 @@
+import { DEFAULT_SCHEMA, load } from "js-yaml"
+
+export function parseMergifyYaml(yaml) {
+  try {
+    const value = load(String(yaml || ""), { schema: DEFAULT_SCHEMA, json: false })
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Mergify YAML root must be a mapping")
+    return value
+  } catch (error) {
+    throw new Error(`Mergify YAML structural parse failed closed: ${String(error.message || error).trim()}`)
+  }
+}

package/skills/engineering/engineering-runtime/scripts/package-lock.json

@@ -0,0 +1,43 @@
+{
+  "name": "engineering-runtime",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "engineering-runtime",
+      "version": "1.0.0",
+      "dependencies": {
+        "js-yaml": "4.3.1"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmmirror.com/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/js-yaml": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    }
+  }
+}

package/skills/engineering/engineering-runtime/scripts/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "engineering-runtime",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Engineering Workflow runtime dependency closure",
+  "dependencies": {
+    "js-yaml": "4.3.1"
+  }
+}