@agentskit/doc-bridge 1.7.44 → 1.7.45

package/docs/RELEASE.md

@@ -32,29 +32,43 @@ pnpm changeset          # if new entry needed
 pnpm version-packages   # bumps package.json + CHANGELOG from .changeset/*
 ```
 
-Current track: **`1.2.1` stable** (alpha series ended at `0.1.0-alpha.5`).
+Current track: **`1.7.45` stable**. The release includes the enterprise
+knowledge-bridge, deterministic benchmark, scoped-package artifact fix, and
+trusted-publishing workflow hardening.
 
 ## Publish (npm + GitHub)
 
-Stable packages are published only by `.github/workflows/release.yml` from an immutable semver tag. The workflow re-runs the complete security, test, coverage, packaged-smoke, dogfood, Marketplace-contract, and conformance matrix, publishes npm with provenance, verifies the registry result, uploads the tarball to a GitHub Release draft, and leaves final publication to the owner so the Marketplace fields can be completed first.
+Routine releases use `.github/workflows/changesets.yml`: merging a changeset
+opens the version PR, and merging that PR publishes through npm Trusted
+Publishing (GitHub OIDC) without `NPM_TOKEN`. The workflow runs audit,
+typecheck, tests, and build before versioning or publishing.
+
+The existing `.github/workflows/release.yml` remains the guarded recovery path
+for an immutable semver tag. It also uses npm Trusted Publishing and re-runs
+the complete security, test, coverage, packaged-smoke, dogfood,
+Marketplace-contract, and conformance matrix.
+
+Before the first publish, configure npm Trusted Publishing for package
+`@agentskit/doc-bridge` with owner `AgentsKit-io`, repository `doc-bridge`,
+workflow `changesets.yml`, and GitHub environment `npm`.
 
 ```bash
-git tag v1.2.1
-git push origin v1.2.1
+git tag v1.7.45
+git push origin v1.7.45
 ```
 
 For recovery of an existing immutable tag, use the guarded manual dispatch. Never move or recreate a release tag.
 
 ```bash
-gh workflow run release.yml --ref master -f tag=v1.2.1
+gh workflow run release.yml --ref master -f tag=v1.7.45
 ```
 
 Confirm:
 
 ```bash
-npm view @agentskit/doc-bridge@1.2.1 version dist.integrity
-npx ak-docs@1.2.1 --version
-gh release view v1.2.1 --json isDraft
+npm view @agentskit/doc-bridge@1.7.45 version dist.integrity
+npx ak-docs@1.7.45 --version
+gh release view v1.7.45 --json isDraft
 ```
 
 GitHub Pages must remain configured for GitHub Actions; `.github/workflows/pages.yml` builds and deploys the Fumadocs portal from `apps/docs`.

package/docs/agent-corpus/INDEX.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-index
+type: module
+id: doc-bridge-index
 editRoot: src/index-builder
 humanDoc: /docs/recipes/index-pipeline
 ---

package/docs/agent-corpus/chat.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-chat
+type: module
+id: doc-bridge-chat
 editRoot: src/intelligence
 humanDoc: /docs/chat-and-rag
 ---

package/docs/agent-corpus/cli.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-cli
+type: module
+id: doc-bridge-cli
 editRoot: src/cli
 humanDoc: /docs/spec/cli
 ---

package/docs/agent-corpus/conformance.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-conformance
+type: module
+id: doc-bridge-conformance
 editRoot: src/conformance
 humanDoc: /docs/spec/documentation-standard-v1
 ---

package/docs/agent-corpus/doc-bridge.md

@@ -1,6 +1,6 @@
 ---
 type: package
-package: doc-bridge
+package: '@agentskit/doc-bridge'
 editRoot: src
 humanDoc: /docs/POSITIONING
 ---

package/docs/agent-corpus/doctor.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-doctor
+type: module
+id: doc-bridge-doctor
 editRoot: src/doctor
 humanDoc: /docs/spec/documentation-standard-v1
 ---

package/docs/agent-corpus/gates.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-gates
+type: module
+id: doc-bridge-gates
 editRoot: src/gates
 humanDoc: /docs/spec/documentation-standard-v1
 ---

package/docs/agent-corpus/mcp.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-mcp
+type: module
+id: doc-bridge-mcp
 editRoot: src/mcp
 humanDoc: /docs/mcp
 ---

package/docs/agent-corpus/memory.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-memory
+type: module
+id: doc-bridge-memory
 editRoot: src/memory
 humanDoc: /docs/schemas/memory-candidate-v1
 ---

package/docs/agent-corpus/query.md

@@ -1,6 +1,6 @@
 ---
-type: package
-package: doc-bridge-query
+type: module
+id: doc-bridge-query
 editRoot: src/query
 humanDoc: /docs/query
 ---

package/docs/knowledge-engine-runbook.md

@@ -16,6 +16,8 @@ ak-docs map --html --output .doc-bridge/report.html
 
 Expected artifacts are under `.doc-bridge/workflow/`: `manifest.json`, immutable stage artifacts, `transitions.jsonl`, and `last-known-good.json`. The HTML report is standalone and can be opened directly without a server or network.
 
+The safe repository walk excludes common generated trees, including `dist`, `build`, `.next`, `out`, `.turbo`, `.svelte-kit`, `.mcpb-build`, and `.mcpb-output`, so generated output is reported as a coverage boundary rather than mistaken for source architecture. Add a project-specific `safety.exclude` pattern when another tool generates code outside these conventions.
+
 ## Safe fixes
 
 ```bash
@@ -56,13 +58,16 @@ Missing declarations are configurable because not every implementation import is
 {
   "reconciliation": {
     "scope": "package",
-    "requiredRelationKinds": ["imports", "re-exports", "depends-on"]
+    "requiredRelationKinds": ["imports", "re-exports", "depends-on"],
+    "requiredRelationTargets": "internal"
   }
 }
 ```
 
 Omit the option to preserve the original all-relation behavior. Use an empty list for low-friction adoption when package/app coverage and explicitly declared claims matter more than documenting every module, test, or external-library import. Existing declarations are still checked for stale, conflicting, and unresolved references.
 
+With `requiredRelationTargets: "internal"`, external-library relations remain in the canonical graph and evidence trail but do not require a Markdown declaration. Internal project relations still require declarations and remain subject to stale, conflicting, and unresolved checks.
+
 Package health is not inferred from coverage presence alone. A covered package
 is `fresh` only when its relevant relations are verified; undocumented or
 not-analyzed relations make it `unverified`, while conflicting declarations
@@ -72,3 +77,10 @@ large architecture/documentation gap.
 The reconciliation summary also includes deterministic `diagnosticsByCode` and
 `diagnosticsByStatus` rollups. Use them for triage and dashboards, but keep the
 canonical diagnostics and their evidence as the source of truth.
+
+Document counts are intentionally split by classification. The total document
+inventory includes human, agent, project, archive, and unclassified Markdown;
+it is not the denominator for agent-corpus coverage. Compare
+`documentClassificationCounts.agent` with
+`documentedDocumentClassificationCounts.agent` for the configured agent-doc
+surface, and inspect the remaining classifications separately.

package/docs/spec/benchmark-v1.md

@@ -28,3 +28,9 @@ The fixture contains only stable identifiers and explicitly supported cases:
 The observation contains the same three sets, plus optional evidence identifiers and finding-category counts. The result reports true positives, false positives, false negatives, precision, recall, duplicate observations, evidence ratio, finding density, excluded cases, thresholds, and regressions. Excluded cases are removed from denominators only because they are explicitly listed and their counts remain visible.
 
 Benchmark output is aggregate by default: it does not include repository contents, prompts, credentials, or the member lists used to calculate the result. Baselines are not changed by `benchmark` or by a verification run. Use the verification harness's explicit audited baseline command when a new baseline is intentionally approved.
+
+## Semantic reconciliation gate
+
+The semantic gate runs labeled, synthetic cases through the real reconciliation implementation. The required v1 cases are `confirmed`, `undocumented`, `stale`, `not-analyzed`, `conflict`, and `unresolved`. Each case declares its exact expected diagnostic-code set and requires every emitted diagnostic to contain evidence.
+
+The gate is passing only when finding precision, finding recall, and evidence ratio are all `1.000`, with no regressions. The conflict case may legitimately emit the additional `RELATION_CONFIRMED` and `RELATION_NOT_ANALYZED` diagnostics because both declarations are evaluated independently; the expected set records that behavior explicitly. These cases prove classifier behavior, not coverage of every language analyzer or runtime-only relationship.

package/docs/spec/config-v1.md

@@ -38,6 +38,12 @@ package.json → "docBridge" field (subset, JSON only)
 
 TypeScript/JavaScript configs are static in v0.1 alpha: `defineConfig` imports are supported, but arbitrary imports are not. YAML config files are planned.
 
+Dynamic-loading coverage is evidence-backed. Literal strings, constant aliases,
+parenthesized strings, and string concatenations are resolved without executing
+repository code. Runtime-dependent `import()` and `require()` expressions remain
+`partial`/`not-analyzed`, and the coverage entry records representative
+file-and-line evidence for each observed loading site (up to the schema limit).
+
 ## TypeScript shape (authoritative)
 
 ```ts
@@ -410,6 +416,8 @@ type ReconciliationConfig = {
   scope?: 'file' | 'module' | 'package'
   /** Observed relation kinds that require documentation declarations. */
   requiredRelationKinds?: string[]
+  /** Limit missing-declaration findings to relations between internal project entities. */
+  requiredRelationTargets?: 'all' | 'internal'
   /** Emit info findings for documentation with no observed package/module join. */
   includeOrphanedDocuments?: boolean
 }
@@ -417,6 +425,8 @@ type ReconciliationConfig = {
 
 Use `scope: 'package'` for monorepos where file imports should be compared as package-level architecture evidence. Omit `requiredRelationKinds` to require all observed kinds; an empty array intentionally disables undocumented-relation findings and must be treated as an explicit exemption.
 
+Use `requiredRelationTargets: 'internal'` when the repository wants package or module architecture declarations without requiring Markdown to enumerate every external library import. External relations remain in the raw snapshot and report as evidence; they simply do not generate missing-declaration findings.
+
 The reconciliation documentation summary reports package health separately from
 relation findings: `fresh` means the package has coverage documentation and no
 known discrepancy; `stale` means a declared relation conflicts with observed
@@ -426,6 +436,15 @@ could not be verified. Package-level aggregation preserves the relation
 endpoints used for this classification, so an undocumented relation cannot be
 reported alongside a falsely `fresh` package.
 
+The same summary keeps document inventory separate from coverage claims:
+`documentCount` and `documentClassificationCounts` describe every discovered
+Markdown document, while `documentedDocumentCount` and
+`documentedDocumentClassificationCounts` describe documents that declare a
+knowledge relation. The classification keys are analyzer output (for example
+`agent`, `human`, `project`, `archive`, and `unclassified`); consumers must not
+interpret total repository Markdown coverage as agent-corpus coverage. Use the
+`agent` pair when measuring the configured agent documentation surface.
+
 ## `report` (optional)
 
 ```ts
@@ -437,6 +456,27 @@ report?: {
 
 `private` is the default and keeps local evidence useful for debugging. `anonymized` is intended for reports shared outside the repository: it preserves counts, relation kinds, topology, and coverage status while removing project-specific identity and evidence content. The generated HTML and every lazy chunk use the same mode.
 
+## `safety` (optional)
+
+```ts
+type RepositorySafetyConfig = {
+  /** Additional project-relative glob patterns excluded from repository discovery. */
+  exclude?: string[]
+  maxFiles?: number
+  maxBytes?: number
+  maxTimeMs?: number
+  maxMemoryMb?: number
+  redactSecrets?: boolean
+}
+```
+
+Discovery always excludes unsafe or generated trees by default, including
+`.git`, `node_modules`, `dist`, `build`, `coverage`, `.doc-bridge`, `.next`,
+`out`, `.turbo`, `.svelte-kit`, `.mcpb-build`, and `.mcpb-output`, plus common
+secret files. `safety.exclude` adds project-specific patterns; it does not
+replace the built-in safety boundary. Excluded files remain outside the
+snapshot and are represented by analyzer coverage when relevant.
+
 ## `analysis` (optional)
 
 ```ts
@@ -467,6 +507,11 @@ When a configured method receives an identifier bound to a
 static import, Doc Bridge records a `runtime-wiring` relation with
 `metadata.detection: 'runtime-wiring-static'`. Reflective, computed, or
 otherwise unbound targets remain explicit `not-analyzed` coverage entries.
+Dynamic `import()` and `require()` targets are resolved when their specifier is
+a literal, a `const` string binding, a parenthesized static expression, or a
+concatenation of other statically known strings. Expressions that depend on
+runtime values remain explicit `not-analyzed` coverage entries; Doc Bridge does
+not execute repository code to guess their targets.
 Test/spec modules are excluded from this signal by default because their
 registrations usually construct fixtures rather than production architecture;
 set `includeTestRuntimeWiring: true` when test wiring is part of the contract.

package/docs/validation-cycle-plan.md

@@ -102,6 +102,21 @@ This plan is a validation contract. A green result from one cycle never substitu
 - the known-case fixture matrix has 100% detection of expected findings and 0 unsupported findings;
 - the real target report does not show zero findings merely because reconciliation was disabled.
 
+### Phase 3 — Real-artifact documentation inventory
+
+The first AKOS audit exposed that the repository contains multiple documentation
+surfaces. A single `documentedDocumentCount / documentCount` ratio mixed the 27
+agent-corpus documents with human guides, project files, archives, and
+unclassified Markdown. Doc Bridge now reports deterministic document counts by
+classification and marks `docs-archive` as `archive`; the report highlights the
+agent-corpus ratio separately. This keeps the metric useful without hiding the
+full inventory.
+
+The phase gate is satisfied only when the real AKOS artifact reports the
+classification totals, the agent-corpus numerator/denominator, and evidence for
+the classification rule. A changed source revision or configuration invalidates
+the evidence and requires a new workflow and verification run.
+
 ### Cycle 5 — Registry agent quality
 
 **Purpose:** validate the configured agent from the AgentsKit Registry as an evidence-grounded assistant to discovery and classification.
@@ -234,3 +249,7 @@ Cycle 7 shipped Doc Bridge `1.7.28` to `agentskit-os` and made the large-report
 - the current verification contract covers the package dogfood target, not the complete Doc Bridge enterprise objective.
 
 The current run is `AWAITING_HUMAN_APPROVAL`, not complete. Discovery, package-level reconciliation, Registry-agent proof, documentation cohesion, export accuracy, CLI execution, and measured efficiency passed. The benchmark baseline was not replaced. After human approval, the next cycle should use these numbers as the comparison point and focus on classifying the remaining 9 production runtime-wiring candidates and improving documentation usefulness rather than report transport performance.
+
+### Phase 2 — Semantic classification measurement
+
+The next cycle adds a small, deterministic labeled benchmark around the real reconciliation function. It covers confirmed, undocumented, stale, not-analyzed, conflicting, and unresolved declarations. The acceptance threshold is exact per-case diagnostic classification with non-empty evidence, plus `1.000` finding precision, `1.000` finding recall, and `1.000` evidence ratio. The AKOS verification contract runs this gate directly against the checked-out Doc Bridge source so a later change cannot silently preserve only the aggregate report counts.

package/docs/verification-harness.md

@@ -52,6 +52,10 @@ Checks may emit one final JSON line with `status` set to `passed`, `failed`, or
 
 Visual checks must use a real browser or an explicitly configured equivalent. A passing build is not visual approval. Endpoint, database, CLI, and MCP checks must execute their real artifact when the contract marks that surface as required.
 
+UI checks fail closed unless the check declares the `real-browser` and `screenshot` capabilities and its final structured result contains `capability: "real-browser"`, screenshot artifacts with project-relative paths, SHA-256 hashes and viewports, plus a passing result for every contract outcome mapped to that check. Missing files, stale hashes, placeholder pending results, and unmapped criteria block the run before human approval is available.
+
+Delegated work does not weaken the gate. Subagents receive the parent contract hash, assigned criterion IDs, allowed scope, required capabilities, and expected evidence. Their output remains provisional until the orchestrator reruns this harness against the combined current source revision.
+
 The final evidence ledger must distinguish `validated`, `partially validated`, `not analyzed`, `blocked`, and `not applicable`. Counts such as indexed documents, package presence, or rendered reports do not prove semantic documentation/code agreement, stale-content detection, runtime wiring, or UI behavior.
 
 When a report is shared outside its repository, configure `report.privacy: 'anonymized'`. This is separate from `safety.redactSecrets`: secret redaction does not anonymize project names, paths, identifiers, snippets, or finding messages. The privacy check must inspect the generated HTML and all lazy chunks, not only the configuration.

package/mcpb/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "doc-bridge",
   "display_name": "Doc Bridge",
-  "version": "1.7.44",
+  "version": "1.7.45",
   "description": "Deterministic repository handoffs for coding agents, running locally without an LLM or API key.",
   "long_description": "Doc Bridge turns a repository's own documentation and ownership metadata into deterministic handoffs: where an agent should start, which paths it may edit, which checks it must run, and when a human must take over. The local connector exposes the same read-only contract available through Doc Bridge CLI and CI.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentskit/doc-bridge",
-  "version": "1.7.44",
+  "version": "1.7.45",
   "mcpName": "io.github.AgentsKit-io/doc-bridge",
   "description": "Human↔agent documentation bridge — deterministic handoffs, doc-site links, memory→docs, optional AgentsKit RAG/chat.",
   "type": "module",
@@ -46,51 +46,6 @@
     "src",
     "skills"
   ],
-  "scripts": {
-    "prebuild": "node scripts/sync-version.mjs",
-    "build": "tsup",
-    "test": "vitest run && pnpm test:cursor-plugin && pnpm test:claude-plugin && pnpm test:copilot-plugin && pnpm test:portable-skill",
-    "test:watch": "vitest",
-    "coverage": "vitest run --coverage",
-    "check:ecosystem-upstream": "node scripts/check-ecosystem-upstream.mjs",
-    "check:no-legacy-chat-imports": "node scripts/check-no-legacy-chat-imports.mjs",
-    "typecheck": "tsc --noEmit",
-    "smoke:packaged": "node scripts/smoke-packaged.mjs",
-    "smoke:docsites": "node scripts/smoke-docsites.mjs",
-    "smoke:real-docsites": "node scripts/smoke-real-docsites.mjs",
-    "smoke:ollama": "node scripts/smoke-ollama.mjs",
-    "mcpb:stage": "npm run build && node scripts/build-mcpb.mjs stage",
-    "mcpb:validate": "node scripts/build-mcpb.mjs validate",
-    "mcpb:smoke": "node scripts/smoke-mcpb.mjs",
-    "mcpb:pack": "npm run mcpb:stage && npm run mcpb:smoke && node scripts/build-mcpb.mjs pack",
-    "test:mcpb": "node --test scripts/mcpb-contract.test.mjs",
-    "test:cursor-plugin": "node --test scripts/cursor-plugin-contract.test.mjs",
-    "test:claude-plugin": "node --test scripts/claude-plugin-contract.test.mjs",
-    "test:copilot-plugin": "node --test scripts/copilot-plugin-contract.test.mjs",
-    "test:portable-skill": "node --test scripts/portable-skill-contract.test.mjs",
-    "coverage:badge": "node scripts/update-coverage-badge.mjs",
-    "changeset": "changeset",
-    "version-packages": "changeset version && node scripts/sync-version.mjs",
-    "release": "npm run build && npm test && changeset publish",
-    "version": "node scripts/sync-version.mjs && git add package.json src/version.ts action.yml",
-    "prepublishOnly": "npm run build && npm test",
-    "prepare": "node scripts/prepare.mjs",
-    "prepack": "npm run build",
-    "docs:dev": "cd apps/docs && next dev",
-    "docs:artifacts": "node scripts/build-docs-artifacts.mjs",
-    "docs:build": "pnpm build && node bin/ak-docs.js index && pnpm docs:artifacts && cd apps/docs && next build",
-    "docs:typecheck": "cd apps/docs && fumadocs-mdx && tsc --noEmit",
-    "docs:e2e": "playwright test",
-    "report:visual": "node scripts/report-visual-check.mjs",
-    "test:verification-harness": "node --test scripts/verification-harness.test.mjs",
-    "docs:lighthouse": "lhci autorun",
-    "test:readme-standard": "node --test scripts/readme-standard.test.mjs",
-    "test:marketplace": "node --test scripts/marketplace-contract.test.mjs",
-    "check:marketplace": "node scripts/check-marketplace-contract.mjs",
-    "test:docs-artifacts": "node --test scripts/docs-artifacts-contract.test.mjs",
-    "check:readme-standard": "node scripts/check-readme-standard.mjs",
-    "check:docs": "pnpm check:readme-standard && node bin/ak-docs.js gate run && node bin/ak-docs.js conformance run documentation-standard-v1 --text && pnpm docs:typecheck && pnpm docs:build && pnpm test:docs-artifacts"
-  },
   "keywords": [
     "agentskit",
     "documentation",
@@ -120,10 +75,10 @@
   },
   "dependencies": {
     "github-slugger": "^2.0.0",
-    "mermaid": "^11.16.1",
+    "mermaid": "^11.17.2",
     "minimatch": "^10.2.6",
     "typescript": "^6.0.3",
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "@agentskit/adapters": ">=0.12.0 <1",
@@ -154,30 +109,31 @@
     }
   },
   "devDependencies": {
-    "@agentskit/chat": "0.4.0",
-    "@agentskit/core": "1.12.3",
-    "@agentskit/ink": "0.10.4",
+    "@agentskit/chat": "0.4.1",
+    "@agentskit/core": "1.12.8",
+    "@agentskit/ink": "0.10.9",
     "@agentskit/react": "0.7.4",
     "@anthropic-ai/mcpb": "2.1.2",
-    "@changesets/cli": "^2.31.0",
+    "@changesets/cli": "^3.0.1",
     "@lhci/cli": "^0.15.1",
-    "@playwright/test": "1.61.1",
-    "@tailwindcss/postcss": "4.3.2",
-    "@types/node": "^22.15.3",
-    "@types/react": "19.2.17",
-    "@types/react-dom": "19.2.3",
-    "@vitest/coverage-v8": "4.1.10",
-    "esbuild": "^0.28.1",
-    "fumadocs-core": "15.6.5",
-    "fumadocs-mdx": "11.6.4",
-    "fumadocs-ui": "15.6.5",
-    "lucide-react": "0.460.0",
-    "next": "15.5.21",
-    "react": "19.2.0",
-    "react-dom": "19.2.0",
-    "tailwindcss": "4.3.2",
+    "@playwright/test": "1.62.1",
+    "@tailwindcss/postcss": "4.3.3",
+    "@types/node": "^26.4.0",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.5",
+    "@vitest/coverage-v8": "4.1.11",
+    "esbuild": "^0.28.2",
+    "fumadocs-core": "16.15.4",
+    "fumadocs-mdx": "15.4.0",
+    "fumadocs-ui": "16.15.4",
+    "lucide-react": "1.34.0",
+    "next": "16.3.3",
+    "proxy-agent": "8.0.2",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "tailwindcss": "4.3.3",
     "tsup": "^8.5.0",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.11"
   },
   "directories": {
     "doc": "docs",
@@ -188,5 +144,47 @@
   "bugs": {
     "url": "https://github.com/AgentsKit-io/doc-bridge/issues"
   },
-  "homepage": "https://doc-bridge.agentskit.io/"
-}
+  "homepage": "https://doc-bridge.agentskit.io/",
+  "scripts": {
+    "prebuild": "node scripts/sync-version.mjs",
+    "build": "tsup",
+    "test": "vitest run && pnpm test:cursor-plugin && pnpm test:claude-plugin && pnpm test:copilot-plugin && pnpm test:portable-skill",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
+    "check:ecosystem-upstream": "node scripts/check-ecosystem-upstream.mjs",
+    "check:no-legacy-chat-imports": "node scripts/check-no-legacy-chat-imports.mjs",
+    "typecheck": "tsc --noEmit",
+    "smoke:packaged": "node scripts/smoke-packaged.mjs",
+    "smoke:docsites": "node scripts/smoke-docsites.mjs",
+    "smoke:real-docsites": "node scripts/smoke-real-docsites.mjs",
+    "smoke:ollama": "node scripts/smoke-ollama.mjs",
+    "mcpb:stage": "npm run build && node scripts/build-mcpb.mjs stage",
+    "mcpb:validate": "node scripts/build-mcpb.mjs validate",
+    "mcpb:smoke": "node scripts/smoke-mcpb.mjs",
+    "mcpb:pack": "npm run mcpb:stage && npm run mcpb:smoke && node scripts/build-mcpb.mjs pack",
+    "test:mcpb": "node --test scripts/mcpb-contract.test.mjs",
+    "test:cursor-plugin": "node --test scripts/cursor-plugin-contract.test.mjs",
+    "test:claude-plugin": "node --test scripts/claude-plugin-contract.test.mjs",
+    "test:copilot-plugin": "node --test scripts/copilot-plugin-contract.test.mjs",
+    "test:portable-skill": "node --test scripts/portable-skill-contract.test.mjs",
+    "coverage:badge": "node scripts/update-coverage-badge.mjs",
+    "changeset": "changeset",
+    "version-packages": "changeset version && node scripts/sync-version.mjs",
+    "release": "npm run build && npm test && changeset publish",
+    "version": "node scripts/sync-version.mjs && git add package.json src/version.ts action.yml",
+    "docs:dev": "cd apps/docs && next dev",
+    "docs:artifacts": "node scripts/build-docs-artifacts.mjs",
+    "docs:build": "pnpm build && node bin/ak-docs.js index && pnpm docs:artifacts && cd apps/docs && next build",
+    "docs:typecheck": "cd apps/docs && fumadocs-mdx && tsc --noEmit",
+    "docs:e2e": "playwright test",
+    "report:visual": "node scripts/report-visual-check.mjs",
+    "test:verification-harness": "node --test scripts/verification-harness.test.mjs",
+    "docs:lighthouse": "lhci autorun",
+    "test:readme-standard": "node --test scripts/readme-standard.test.mjs",
+    "test:marketplace": "node --test scripts/marketplace-contract.test.mjs",
+    "check:marketplace": "node scripts/check-marketplace-contract.mjs",
+    "test:docs-artifacts": "node --test scripts/docs-artifacts-contract.test.mjs",
+    "check:readme-standard": "node scripts/check-readme-standard.mjs",
+    "check:docs": "pnpm check:readme-standard && node bin/ak-docs.js gate run && node bin/ak-docs.js conformance run documentation-standard-v1 --text && pnpm docs:typecheck && pnpm docs:build && pnpm test:docs-artifacts"
+  }
+}

package/scripts/check-ecosystem-upstream.mjs

@@ -41,8 +41,9 @@ for (const file of requiredFiles) {
   if (localDigest !== expectedDigest) {
     throw new Error(`${file} differs from its recorded upstream SHA-256 digest.`)
   }
-  const url = `https://raw.githubusercontent.com/${metadata.repository}/${metadata.ref}/${file}`
-  const upstream = await fetchText(url)
+  const url = new URL(`https://raw.githubusercontent.com/${metadata.repository}/${metadata.ref}/${file}`)
+  if (url.hostname !== 'raw.githubusercontent.com') throw new Error('Unexpected upstream host.')
+  const upstream = await fetchText(url.href)
   if (sha256(upstream) !== expectedDigest || upstream !== local) {
     throw new Error(`${file} is stale against ${metadata.repository}@${metadata.ref}. Sync the canonical snapshot and digest.`)
   }

package/scripts/report-visual-check.mjs

@@ -94,6 +94,12 @@ const inspect = async (frame, width, height) => frame.evaluate(({ width: viewpor
     diagnosticCount: typeof globalThis.__DOC_BRIDGE_DATA__?.diagnosticCount === 'number'
       ? globalThis.__DOC_BRIDGE_DATA__.diagnosticCount
       : Number.parseInt(document.querySelector('#finding-count')?.textContent ?? '', 10) || document.querySelectorAll('.finding').length,
+    actionableCount: typeof globalThis.__DOC_BRIDGE_DATA__?.actionableCount === 'number'
+      ? globalThis.__DOC_BRIDGE_DATA__.actionableCount
+      : Number.parseInt((document.querySelector('#finding-count')?.textContent ?? '').match(/(\d+) actionable findings/)?.[1] ?? '0', 10),
+    confirmedCount: typeof globalThis.__DOC_BRIDGE_DATA__?.confirmedCount === 'number'
+      ? globalThis.__DOC_BRIDGE_DATA__.confirmedCount
+      : Number.parseInt((document.querySelector('#finding-count')?.textContent ?? '').match(/(\d+) confirmed checks/)?.[1] ?? '0', 10),
     unnamedButtonCount: unnamedButtons.length,
     visibleOverflowCount: visibleOverflow.length,
     contrastFailures,
@@ -157,7 +163,8 @@ const exercise = async (frame, result) => {
     if (await load.count()) await load.click()
     else if (result.diagnosticCount > 0 && await frame.locator('.finding-group').count() === 0) throw new Error('finding loader is missing while findings are present')
   }, async () => {
-    if (result.diagnosticCount > 0) {
+    const evidenceView = await frame.locator('body').getAttribute('data-report-view') === 'coverage'
+    if (result.actionableCount > 0 || (evidenceView && result.confirmedCount > 0)) {
       await poll(() => frame.locator('.finding-group').count(), (count) => count > 0, 'finding groups')
     } else if (await frame.locator('.finding-group').count() !== 0) {
       throw new Error('finding groups rendered despite zero findings')
@@ -280,6 +287,16 @@ const result = {
       : 'Automated checks passed; screenshots require human visual review. Re-run with --human-approved only after review.',
 }
 writeFileSync(join(outputDir, 'result.json'), `${JSON.stringify(result, null, 2)}\n`, 'utf8')
-console.log(JSON.stringify(result, null, 2))
-console.log(JSON.stringify(result))
+console.log(JSON.stringify({
+  status,
+  capability: result.capability,
+  artifacts: result.artifacts,
+  criteria: result.criteria,
+  reportPath: result.reportPath,
+  outputDir: result.outputDir,
+  viewports: result.viewports,
+  themes: result.themes,
+  failures: result.failures,
+  note: result.note,
+}))
 if (status === 'failed') process.exitCode = 1

package/scripts/verification-harness.mjs

@@ -10,7 +10,6 @@ import {
   readdirSync,
   renameSync,
   rmSync,
-  statSync,
   writeFileSync,
 } from 'node:fs'
 import { dirname, join, relative, resolve, sep } from 'node:path'

package/skills/doc-bridge-handoff/scripts/resolve-handoff.mjs

@@ -3,7 +3,7 @@
 import { spawnSync } from 'node:child_process'
 import { isAbsolute } from 'node:path'
 
-const VERSION = '1.7.44'
+const VERSION = '1.7.45'
 const kinds = new Set(['package', 'ownership'])
 const args = process.argv.slice(2)
 const id = args[0]

package/src/cli/demo.ts

@@ -1,4 +1,4 @@
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -140,4 +140,4 @@ export const withDemoWorkspace = (
   } finally {
     rmSync(dir, { recursive: true, force: true })
   }
-}
+}