@axisagent/cli 0.1.0

package/README.md

@@ -0,0 +1,61 @@
+# Axis Local
+
+Local runtime package for Axis.
+
+It contains the first usable registry, skill manifest generator, policy schema, scanner, and CLI. This is the part that makes the project more than a frontend catalog.
+
+## Commands
+
+```bash
+npx @axisagent/cli validate
+npx @axisagent/cli list
+npx @axisagent/cli list --chain Base
+npm run axis -- inspect bankr-launch-feed
+npx @axisagent/cli install bankr-launch-feed --target .axis/skills
+npx @axisagent/cli scan .axis/skills/bankr-launch-feed
+npx @axisagent/cli connect --pair AXIS-1234 --api https://api.axisagent.xyz
+npx @axisagent/cli serve --port 8788
+```
+
+## Axis Relay
+
+The public dashboard should connect through Axis API, not direct browser-to-localhost permission prompts.
+
+Flow:
+
+1. Dashboard creates a pairing code through `POST /v1/pairing/create`.
+2. User runs `npx @axisagent/cli connect --pair AXIS-1234 --api https://api.axisagent.xyz`.
+3. The local connector opens an outbound session to Axis API.
+4. The connector sends heartbeats, detected agents, capabilities and registry stats.
+5. The dashboard polls `GET /v1/pairing/:code/status`.
+
+For local API testing:
+
+```bash
+npx @axisagent/cli connect --pair AXIS-1234 --api http://127.0.0.1:8790 --once
+```
+
+## Local Connector
+
+The localhost connector remains available for development and fallback flows. When the server is running, the dashboard or relay client can call the local connector before any execution:
+
+- `POST /v1/install` installs a skill package and scans its policy.
+- `POST /v1/scan` scans an existing skill package.
+- `POST /v1/tickets` creates a simulation ticket with chain, spend cap, permissions, execution plan and policy checks.
+- `POST /v1/tickets/:id/decision` records user approval or rejection. Blocked tickets cannot be approved.
+
+Ticket controls are grouped by purpose:
+
+- `core`: chain, spend cap, approval, execution mode and session limits
+- `permission`: explicit control for every declared permission
+- `payment`: x402 quote, asset and receipt controls
+- `execution`: wallet execution gates
+- `audit`: secrets and local audit requirements
+
+## Safety Rules
+
+- Money-moving skills default to `approval-required`.
+- Critical skills must require approval and declare a spend cap or read-only mode.
+- Private keys are never stored in generated packages.
+- Install output includes `SKILL.md`, `policy.json`, and `README.md`.
+- Simulation tickets are persisted under `.axis/tickets` for local auditability.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+import { mkdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import { startLocalServer } from "./localServer.js";
+import { getSkillById, getSkillsByChain, skills, summarizeSkill, validateRegistry } from "./skillRegistry.js";
+import { scanSkillPackage, writeSkillPackage } from "./packageWriter.js";
+import { connectRelay } from "./relayClient.js";
+const args = process.argv.slice(2);
+const command = args[0] ?? "help";
+const userCwd = process.env.INIT_CWD ?? process.cwd();
+function getOption(name, fallback) {
+    const index = args.indexOf(name);
+    if (index === -1)
+        return fallback;
+    return args[index + 1] ?? fallback;
+}
+function hasFlag(name) {
+    return args.includes(name);
+}
+function printHelp() {
+    console.log(`Axis Local
+
+Commands:
+  list [--chain Base] [--json]
+  inspect <skill-id> [--json]
+  install <skill-id> [--target .axis/skills]
+  scan <skill-dir>
+  validate
+  connect [--pair AXIS-4821] [--api https://api.axisagent.xyz] [--once]
+  serve [--port 8788]
+`);
+}
+async function run() {
+    if (command === "help" || command === "--help" || command === "-h") {
+        printHelp();
+        return;
+    }
+    if (command === "list") {
+        const chain = getOption("--chain");
+        const rows = chain ? getSkillsByChain(chain) : skills;
+        if (hasFlag("--json")) {
+            console.log(JSON.stringify(rows.map(summarizeSkill), null, 2));
+            return;
+        }
+        for (const skill of rows) {
+            console.log(`${skill.id.padEnd(32)} ${skill.risk.padEnd(8)} ${skill.executionMode.padEnd(17)} ${skill.chains.join(", ")}`);
+        }
+        return;
+    }
+    if (command === "inspect") {
+        const id = args[1];
+        if (!id)
+            throw new Error("Missing skill id.");
+        const skill = getSkillById(id);
+        if (!skill)
+            throw new Error(`Unknown skill: ${id}`);
+        console.log(JSON.stringify(hasFlag("--summary") ? summarizeSkill(skill) : skill, null, 2));
+        return;
+    }
+    if (command === "install") {
+        const id = args[1];
+        if (!id)
+            throw new Error("Missing skill id.");
+        const target = resolve(userCwd, getOption("--target", ".axis/skills") ?? ".axis/skills");
+        await mkdir(target, { recursive: true });
+        const result = await writeSkillPackage(id, target);
+        console.log(`Installed ${result.skill.id}`);
+        console.log(`Path: ${result.skillDir}`);
+        console.log(`Files: ${result.files.join(", ")}`);
+        return;
+    }
+    if (command === "scan") {
+        const target = args[1];
+        if (!target)
+            throw new Error("Missing skill directory.");
+        const result = await scanSkillPackage(resolve(userCwd, target));
+        console.log(JSON.stringify(result, null, 2));
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "validate") {
+        const result = validateRegistry();
+        console.log(JSON.stringify(result, null, 2));
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "connect") {
+        const pairingCode = getOption("--pair", "AXIS-4821") ?? "AXIS-4821";
+        const apiUrl = getOption("--api", process.env.AXIS_API_URL ?? "https://api.axisagent.xyz") ?? "https://api.axisagent.xyz";
+        const heartbeatIntervalMs = Number(getOption("--heartbeat-ms", "5000"));
+        await connectRelay({
+            apiUrl,
+            pairingCode,
+            baseDir: userCwd,
+            heartbeatIntervalMs,
+            once: hasFlag("--once")
+        });
+        return;
+    }
+    if (command === "serve") {
+        const port = Number(getOption("--port", "8788"));
+        const host = getOption("--host", "127.0.0.1") ?? "127.0.0.1";
+        const server = await startLocalServer({ port, host, baseDir: userCwd });
+        console.log(`Axis local connector listening at ${server.url}`);
+        console.log("Endpoints: /health, /v1/protocol/stats, /v1/skills, /v1/skills/:id");
+        return;
+    }
+    throw new Error(`Unknown command: ${command}`);
+}
+run().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = 1;
+});

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./schema.js";
+export * from "./skillRegistry.js";
+export * from "./packageWriter.js";
+export * from "./localServer.js";
+export * from "./relayClient.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from "./schema.js";
+export * from "./skillRegistry.js";
+export * from "./packageWriter.js";
+export * from "./localServer.js";
+export * from "./relayClient.js";

package/dist/localServer.d.ts

@@ -0,0 +1,11 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+type ServerOptions = {
+    port: number;
+    host: string;
+    baseDir: string;
+};
+export declare function startLocalServer(options: ServerOptions): Promise<{
+    server: import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    url: string;
+}>;
+export {};

package/dist/localServer.js

@@ -0,0 +1,333 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { getRegistryStats, getSkillById, getSkillsByChain, skills, summarizeSkill } from "./skillRegistry.js";
+import { scanSkillPackage, writeSkillPackage } from "./packageWriter.js";
+function writeJson(response, statusCode, body) {
+    response.writeHead(statusCode, {
+        "content-type": "application/json; charset=utf-8",
+        "access-control-allow-origin": "*",
+        "access-control-allow-methods": "GET,POST,OPTIONS",
+        "access-control-allow-headers": "content-type"
+    });
+    response.end(JSON.stringify(body, null, 2));
+}
+async function readJson(request) {
+    const chunks = [];
+    for await (const chunk of request) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    if (chunks.length === 0)
+        return {};
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function resolveInsideBase(baseDir, inputPath) {
+    const base = resolve(baseDir);
+    const target = resolve(base, inputPath);
+    const pathFromBase = relative(base, target);
+    if (pathFromBase === ".." || pathFromBase.startsWith(`..${"/"}`) || isAbsolute(pathFromBase)) {
+        throw new Error("Path escapes Axis workspace");
+    }
+    return target;
+}
+function defaultRequestedSpendUsd(skill) {
+    if (skill.policy.maxSpendUsd === null)
+        return null;
+    if (skill.permissions.includes("paid-api"))
+        return Math.min(skill.policy.maxSpendUsd, 0.01);
+    return skill.policy.maxSpendUsd;
+}
+function check(group, label, severity, value) {
+    return { group, label, severity, value };
+}
+function permissionCheck(permission, severity, value) {
+    return check("permission", `permission:${permission}`, severity, value);
+}
+function summarizeChecks(checks) {
+    return {
+        safe: checks.filter((item) => item.severity === "safe").length,
+        warning: checks.filter((item) => item.severity === "warning").length,
+        blocked: checks.filter((item) => item.severity === "blocked").length,
+        total: checks.length
+    };
+}
+function buildPermissionChecks(skill, chain) {
+    return skill.permissions.map((permission) => {
+        if (permission === "network") {
+            return permissionCheck(permission, "safe", `Network scoped to ${skill.protocols.join(", ")} on ${chain}`);
+        }
+        if (permission === "market-data") {
+            return permissionCheck(permission, "safe", "Read-only market data; no order placement from this permission alone");
+        }
+        if (permission === "wallet-read") {
+            return permissionCheck(permission, "safe", "Wallet reads are allowed; private keys are never exposed");
+        }
+        if (permission === "wallet-signature") {
+            if (!skill.policy.requiresApproval) {
+                return permissionCheck(permission, "blocked", "Wallet signatures require human approval");
+            }
+            if (!skill.permissions.includes("transaction-preview")) {
+                return permissionCheck(permission, "warning", "Wallet signature allowed, but transaction-preview permission is not declared");
+            }
+            return permissionCheck(permission, "safe", "Wallet signature requires approval after transaction preview");
+        }
+        if (permission === "transaction-preview") {
+            return permissionCheck(permission, "safe", "Transaction preview must be rendered before signing");
+        }
+        if (permission === "trading") {
+            if (!skill.policy.requiresApproval) {
+                return permissionCheck(permission, "blocked", "Trading cannot execute without human approval");
+            }
+            if (skill.policy.maxSpendUsd === null) {
+                return permissionCheck(permission, "blocked", "Trading requires a spend cap");
+            }
+            return permissionCheck(permission, "safe", `Trading is approval-gated with $${skill.policy.maxSpendUsd} cap`);
+        }
+        if (permission === "contract-call") {
+            if (!skill.permissions.includes("transaction-preview")) {
+                return permissionCheck(permission, "blocked", "Contract calls require transaction preview");
+            }
+            return permissionCheck(permission, "safe", "Contract call must show target, calldata and value before signing");
+        }
+        if (permission === "paid-api") {
+            if (skill.policy.maxSpendUsd === null) {
+                return permissionCheck(permission, "blocked", "Paid API calls require a budget cap");
+            }
+            return permissionCheck(permission, "safe", `Paid API budget capped at $${skill.policy.maxSpendUsd}`);
+        }
+        if (permission === "api-key") {
+            return permissionCheck(permission, "warning", "API keys must be referenced by environment name, never stored in package files");
+        }
+        if (permission === "secrets-read") {
+            if (skill.policy.secrets.length === 0) {
+                return permissionCheck(permission, "blocked", "secrets-read requires declared secret names");
+            }
+            return permissionCheck(permission, "safe", `Secrets restricted to ${skill.policy.secrets.join(", ")}`);
+        }
+        if (permission === "filesystem-read") {
+            return permissionCheck(permission, "safe", "Filesystem reads are limited to user-selected local paths");
+        }
+        if (permission === "filesystem-write") {
+            return permissionCheck(permission, "warning", "Filesystem writes must stay inside the Axis workspace or exported report path");
+        }
+        if (permission === "notifications") {
+            return permissionCheck(permission, "safe", "Notifications can alert the user but cannot execute actions");
+        }
+        if (permission === "browser") {
+            return permissionCheck(permission, "warning", "Browser actions require visible session context and user confirmation for submissions");
+        }
+        if (permission === "governance") {
+            return permissionCheck(permission, "warning", "Governance actions require proposal preview and explicit approval");
+        }
+        return permissionCheck(permission, "warning", "Permission declared but no specialized control is implemented");
+    });
+}
+function createSimulationTicket(skill, body) {
+    const isX402 = skill.protocols.some((protocol) => protocol.toLowerCase() === "x402");
+    const requestedSpendUsd = Number.isFinite(body.amountUsd) ? Number(body.amountUsd) : defaultRequestedSpendUsd(skill);
+    const chain = body.chain ?? skill.policy.allowedChains[0] ?? skill.chains[0];
+    const executionPlan = isX402
+        ? ["request paid endpoint", "read HTTP 402 payment requirements", "verify Base USDC quote", "approve payment", "retry request and log receipt"]
+        : skill.operations.slice(0, 4);
+    const checks = [
+        check("core", "policy", "safe", skill.policy.humanReadableRule),
+        check("core", "execution mode", skill.executionMode === skill.policy.defaultMode ? "safe" : "warning", `Skill mode ${skill.executionMode}; policy default ${skill.policy.defaultMode}`),
+        check("core", "chain", skill.policy.allowedChains.includes(chain) ? "safe" : "blocked", skill.policy.allowedChains.includes(chain) ? `${chain} is allowed` : `${chain} is not allowed by policy`),
+        check("core", "session limit", "safe", `Session limited to ${skill.policy.sessionLimitMinutes} minutes`),
+        check("core", "approval", skill.policy.requiresApproval ? "safe" : "warning", skill.policy.requiresApproval ? "Human approval required before execution" : "Read-only skill does not require approval")
+    ];
+    if (skill.policy.maxSpendUsd === null) {
+        checks.push(check("core", "spend cap", "safe", "No spend path declared"));
+    }
+    else if (requestedSpendUsd !== null && requestedSpendUsd > skill.policy.maxSpendUsd) {
+        checks.push(check("core", "spend cap", "blocked", `Requested $${requestedSpendUsd} exceeds $${skill.policy.maxSpendUsd} policy cap`));
+    }
+    else {
+        checks.push(check("core", "spend cap", "safe", `Capped at $${skill.policy.maxSpendUsd}`));
+    }
+    if (skill.policy.walletWrite) {
+        checks.push(check("execution", "wallet", "safe", "Wallet signature required after approval"));
+    }
+    else {
+        checks.push(check("execution", "wallet", "safe", "No direct wallet write declared"));
+    }
+    if (skill.policy.secrets.length > 0) {
+        checks.push(check("audit", "secrets", "warning", `Requires env refs: ${skill.policy.secrets.join(", ")}`));
+    }
+    checks.push(...buildPermissionChecks(skill, chain));
+    if (isX402) {
+        checks.push(check("payment", "x402 quote", "warning", "Payment-Required quote must be inspected before signing"), check("payment", "asset", "safe", "USDC on Base only for this skill"), check("payment", "receipt", "safe", "Payment response must be logged locally"));
+    }
+    const blocked = checks.some((check) => check.severity === "blocked");
+    const controlSummary = summarizeChecks(checks);
+    return {
+        id: `ticket-${randomUUID()}`,
+        skillId: skill.id,
+        skillTitle: skill.title,
+        status: blocked ? "blocked" : skill.policy.requiresApproval ? "needs-approval" : "ready",
+        intent: body.intent ?? `Prepare ${skill.operations[0]} with ${skill.title}`,
+        risk: skill.risk,
+        chain,
+        protocols: skill.protocols,
+        permissions: skill.permissions,
+        approvalRequired: skill.policy.requiresApproval,
+        maxSpendUsd: skill.policy.maxSpendUsd,
+        requestedSpendUsd,
+        controlSummary,
+        payment: isX402
+            ? {
+                protocol: "x402",
+                asset: "USDC",
+                network: chain,
+                facilitator: "https://x402.org/facilitator",
+                resourceUrl: body.resourceUrl ?? "pending 402 response",
+                quoteStatus: "required-before-payment",
+                receipt: "required"
+            }
+            : undefined,
+        executionPlan,
+        checks,
+        createdAt: new Date().toISOString()
+    };
+}
+export async function startLocalServer(options) {
+    const tickets = new Map();
+    async function persistTicket(ticket) {
+        const ticketDir = resolveInsideBase(options.baseDir, ".axis/tickets");
+        await mkdir(ticketDir, { recursive: true });
+        await writeFile(resolve(ticketDir, `${ticket.id}.json`), `${JSON.stringify(ticket, null, 2)}\n`, "utf8");
+    }
+    const server = createServer(async (request, response) => {
+        try {
+            if (!request.url) {
+                writeJson(response, 400, { error: "Missing URL" });
+                return;
+            }
+            if (request.method === "OPTIONS") {
+                writeJson(response, 200, { ok: true });
+                return;
+            }
+            const url = new URL(request.url, `http://${options.host}:${options.port}`);
+            if (request.method === "GET" && url.pathname === "/health") {
+                writeJson(response, 200, {
+                    service: "axis-local-connector",
+                    status: "ok",
+                    timestamp: new Date().toISOString()
+                });
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/v1/protocol/stats") {
+                writeJson(response, 200, {
+                    registry: getRegistryStats(),
+                    connector: {
+                        status: "local-ready",
+                        baseDir: options.baseDir
+                    }
+                });
+                return;
+            }
+            if (request.method === "GET" && url.pathname === "/v1/skills") {
+                const chain = url.searchParams.get("chain");
+                const rows = chain ? getSkillsByChain(chain) : skills;
+                writeJson(response, 200, { skills: rows.map(summarizeSkill) });
+                return;
+            }
+            const skillMatch = url.pathname.match(/^\/v1\/skills\/([a-z0-9-]+)$/);
+            if (request.method === "GET" && skillMatch) {
+                const skill = getSkillById(skillMatch[1]);
+                if (!skill) {
+                    writeJson(response, 404, { error: "Skill not found" });
+                    return;
+                }
+                writeJson(response, 200, { skill });
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/v1/install") {
+                const body = (await readJson(request));
+                if (!body.id) {
+                    writeJson(response, 400, { error: "Missing skill id" });
+                    return;
+                }
+                const target = resolveInsideBase(options.baseDir, body.target ?? ".axis/skills");
+                const result = await writeSkillPackage(body.id, target);
+                const scan = await scanSkillPackage(result.skillDir);
+                writeJson(response, 200, {
+                    installed: result.skill.id,
+                    path: result.skillDir,
+                    files: result.files,
+                    scan
+                });
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/v1/scan") {
+                const body = (await readJson(request));
+                const skillPath = body.path ?? (body.id ? `${body.target ?? ".axis/skills"}/${body.id}` : null);
+                if (!skillPath) {
+                    writeJson(response, 400, { error: "Missing skill id or path" });
+                    return;
+                }
+                const skillDir = resolveInsideBase(options.baseDir, skillPath);
+                const scan = await scanSkillPackage(skillDir);
+                writeJson(response, 200, scan);
+                return;
+            }
+            if (request.method === "POST" && url.pathname === "/v1/tickets") {
+                const body = (await readJson(request));
+                if (!body.id) {
+                    writeJson(response, 400, { error: "Missing skill id" });
+                    return;
+                }
+                const skill = getSkillById(body.id);
+                if (!skill) {
+                    writeJson(response, 404, { error: "Skill not found" });
+                    return;
+                }
+                const ticket = createSimulationTicket(skill, body);
+                tickets.set(ticket.id, ticket);
+                await persistTicket(ticket);
+                writeJson(response, 200, { ticket });
+                return;
+            }
+            const decisionMatch = url.pathname.match(/^\/v1\/tickets\/([a-z0-9-]+)\/decision$/);
+            if (request.method === "POST" && decisionMatch) {
+                const body = (await readJson(request));
+                const ticket = tickets.get(decisionMatch[1]);
+                if (!ticket) {
+                    writeJson(response, 404, { error: "Ticket not found" });
+                    return;
+                }
+                if (body.decision !== "approved" && body.decision !== "rejected") {
+                    writeJson(response, 400, { error: "Decision must be approved or rejected" });
+                    return;
+                }
+                if (ticket.status === "blocked" && body.decision === "approved") {
+                    writeJson(response, 409, { error: "Blocked tickets cannot be approved", ticket });
+                    return;
+                }
+                const updated = {
+                    ...ticket,
+                    status: body.decision,
+                    decidedAt: new Date().toISOString()
+                };
+                tickets.set(updated.id, updated);
+                await persistTicket(updated);
+                writeJson(response, 200, { ticket: updated });
+                return;
+            }
+            writeJson(response, 404, { error: "Route not found" });
+        }
+        catch (error) {
+            writeJson(response, 500, { error: error instanceof Error ? error.message : "Unknown error" });
+        }
+    });
+    await new Promise((resolveListen) => {
+        server.listen(options.port, options.host, resolveListen);
+    });
+    const address = server.address();
+    const actualPort = typeof address === "object" && address ? address.port : options.port;
+    return {
+        server,
+        url: `http://${options.host}:${actualPort}`
+    };
+}

package/dist/packageWriter.d.ts

@@ -0,0 +1,41 @@
+export declare function writeSkillPackage(skillId: string, targetDir: string): Promise<{
+    skill: {
+        id: string;
+        title: string;
+        category: string;
+        summary: string;
+        useWhen: string;
+        chains: string[];
+        protocols: string[];
+        risk: "low" | "medium" | "high" | "critical";
+        executionMode: "read-only" | "approval-required" | "live-execution";
+        permissions: ("network" | "market-data" | "wallet-read" | "wallet-signature" | "transaction-preview" | "trading" | "api-key" | "notifications" | "contract-call" | "filesystem-read" | "filesystem-write" | "secrets-read" | "paid-api" | "governance" | "browser")[];
+        installTargets: ("codex" | "claude" | "openclaw" | "cursor" | "generic-mcp")[];
+        source: string;
+        tokenUtility: string;
+        auditNotes: string[];
+        operations: string[];
+        tests: string[];
+        policy: {
+            defaultMode: "read-only" | "approval-required" | "live-execution";
+            requiresApproval: boolean;
+            networkAccess: boolean;
+            walletWrite: boolean;
+            secrets: string[];
+            allowedChains: string[];
+            maxSpendUsd: number | null;
+            sessionLimitMinutes: number;
+            humanReadableRule: string;
+        };
+    };
+    skillDir: string;
+    files: string[];
+}>;
+export declare function scanSkillPackage(skillDir: string): Promise<{
+    ok: boolean;
+    findings: {
+        label: string;
+        severity: "safe" | "warning" | "blocked";
+        value: string;
+    }[];
+}>;

package/dist/packageWriter.js

@@ -0,0 +1,48 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { getSkillById, toPolicyJson, toSkillMarkdown } from "./skillRegistry.js";
+export async function writeSkillPackage(skillId, targetDir) {
+    const skill = getSkillById(skillId);
+    if (!skill) {
+        throw new Error(`Unknown skill: ${skillId}`);
+    }
+    const skillDir = join(targetDir, skill.id);
+    await mkdir(skillDir, { recursive: true });
+    await writeFile(join(skillDir, "SKILL.md"), toSkillMarkdown(skill), "utf8");
+    await writeFile(join(skillDir, "policy.json"), `${toPolicyJson(skill)}\n`, "utf8");
+    await writeFile(join(skillDir, "README.md"), `# ${skill.title}\n\nGenerated by Axis Local.\n\nInstall command:\n\n\`\`\`bash\nnpx @axisagent/cli install ${skill.id}\n\`\`\`\n`, "utf8");
+    return {
+        skill,
+        skillDir,
+        files: ["SKILL.md", "policy.json", "README.md"]
+    };
+}
+export async function scanSkillPackage(skillDir) {
+    const skillMarkdown = await readFile(join(skillDir, "SKILL.md"), "utf8");
+    const policyRaw = await readFile(join(skillDir, "policy.json"), "utf8");
+    const findings = [];
+    if (!skillMarkdown.startsWith("---")) {
+        findings.push({ label: "SKILL.md", severity: "blocked", value: "Missing frontmatter" });
+    }
+    else {
+        findings.push({ label: "SKILL.md", severity: "safe", value: "Frontmatter present" });
+    }
+    const policyJson = JSON.parse(policyRaw);
+    if (!policyJson.id || !policyJson.policy) {
+        findings.push({ label: "policy.json", severity: "blocked", value: "Invalid policy file" });
+    }
+    else {
+        findings.push({ label: "policy.json", severity: "safe", value: "Policy present" });
+    }
+    const isMoneyMoving = policyJson.permissions?.some((permission) => ["trading", "wallet-signature", "contract-call", "paid-api"].includes(permission));
+    if (isMoneyMoving && !policyJson.policy?.requiresApproval) {
+        findings.push({ label: "approval", severity: "blocked", value: "Money-moving package lacks approval gate" });
+    }
+    else if (isMoneyMoving) {
+        findings.push({ label: "approval", severity: "safe", value: "Approval required" });
+    }
+    return {
+        ok: findings.every((finding) => finding.severity !== "blocked"),
+        findings
+    };
+}

package/dist/relayClient.d.ts

@@ -0,0 +1,17 @@
+type RelayConnectOptions = {
+    apiUrl: string;
+    pairingCode: string;
+    baseDir: string;
+    heartbeatIntervalMs: number;
+    once: boolean;
+};
+export declare function connectRelay(options: RelayConnectOptions): Promise<{
+    status: string;
+    relayToken: string;
+    session: {
+        pairingCode: string;
+        status: string;
+        expiresAt: string;
+    };
+}>;
+export {};