@csark0812/skeleton 1.1.1 → 1.1.2

package/README.md

@@ -1,5 +1,9 @@
 # Skeleton
 
+**Source of truth for** Package overview.
+
+<!-- doc-meta: owner=eng | last-reviewed=2026-07-13 -->
+
 Single source of truth (SSOT) linter for agent-enabled repos.
 
 Agent repos accumulate skills, rules, registries, and cross-linked docs faster than anyone can keep them straight by hand. Code repos solved this decades ago with ESLint — deterministic checks, CI gates, fix what you can before merge. Skeleton does the same job for documentation architecture: what's canonical, what links where, what must not exist, and whether your skill overrides are wired correctly.
@@ -83,12 +87,12 @@ skeleton customize resolve <slug>
 
 **Validate changed** routes git diffs to the right audit:
 
-| Path                                         | Action                      |
-| -------------------------------------------- | --------------------------- |
-| Docs/skills in scan perimeter                | path-scoped audit           |
-| `.sh`, `.bash`, `.zsh`                       | shellcheck or `bash -n`     |
-| Other `.json`                                | JSONC-tolerant syntax check |
-| `.ts`, `.py`, `package.json`, `project.json` | skip                        |
+| Path                                                              | Action                      |
+| ----------------------------------------------------------------- | --------------------------- |
+| Docs/skills in scan perimeter                                     | path-scoped audit           |
+| `.sh`, `.bash`, `.zsh`                                            | shellcheck or `bash -n`     |
+| Other `.json`                                                     | JSONC-tolerant syntax check |
+| `.ts`, `.tsx`, `.js`, `.jsx`, `.mjs`, `.cjs`, `.py`, `package.json`, `project.json` | skip (exits 1 if all skip) |
 
 Pre-commit: `skeleton validate changed --staged` (path-scoped, fast).
 CI: `skeleton validate changed --base origin/main` (global rules first, then changed files).
@@ -128,11 +132,18 @@ One command for humans: `npx skeleton init --skills`.
 
 ## Development
 
-Requires Node ≥ 22. Uses Bun for dev and tests.
+Requires Node ≥ 22. Uses Bun for dev and tests. Agent cold-start: [AGENTS.md](AGENTS.md).
 
 ```bash
 bun install
 bun test
+bun run typecheck
 bun run build
 bun run audit:self
 ```
+
+`validate:changed` is docs/skills only — it skips code/config extensions (see table). All-skip inputs exit non-zero. Use `bun test` and `bun run typecheck` for code.
+
+### Publishing 1.1.2 (human)
+
+Keep version `1.1.2` until `npm publish`. Preflight: `bun test && bun run typecheck && bun run build && bun run audit:self`. Then publish and tag when ready (npm is still on `1.1.1` until then).

package/dist/cli.js

@@ -16595,6 +16595,9 @@ function mergedExcludes(config) {
 function retiredSkills(config) {
   return config.scan.retiredSkills ?? [];
 }
+function nonPublicSkills(config) {
+  return config.scan.nonPublicSkills ?? [];
+}
 
 // src/audit/core/skill-roots.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2, readlinkSync, realpathSync as realpathSync2 } from "node:fs";
@@ -28605,7 +28608,6 @@ function isGeneratedReference(content3) {
 }
 
 // src/audit/rules/skill-index.ts
-var NON_PUBLIC_SLUGS = new Set(["align-commands"]);
 function walkSkillMarkdown(dir) {
   const files = [];
   if (!existsSync8(dir))
@@ -28659,6 +28661,7 @@ function scanFileForSkillLinks(ctx, filePath, index2) {
 }
 function validateReadmeTaxonomy(ctx, index2, diskSlugs) {
   const issues = [];
+  const nonPublic = new Set(nonPublicSkills(ctx.config));
   for (const skillRoot of index2.roots) {
     if (skillRoot.kind !== "nested")
       continue;
@@ -28670,7 +28673,7 @@ function validateReadmeTaxonomy(ctx, index2, diskSlugs) {
       continue;
     const taxonomySlugs = parseReadmeTaxonomySlugs(readme);
     const nestedSlugs = diskSlugs.filter((slug2) => existsSync8(join8(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
-    const publicSlugs = nestedSlugs.filter((slug2) => !NON_PUBLIC_SLUGS.has(slug2));
+    const publicSlugs = nestedSlugs.filter((slug2) => !nonPublic.has(slug2));
     const relReadme = `${skillRoot.relPath}/README.md`;
     for (const slug2 of publicSlugs) {
       if (!taxonomySlugs.includes(slug2)) {
@@ -28764,10 +28767,16 @@ function findLocalCanonicalLinks(root2, content3, sourceFile) {
   }
   const inReferencesDir = /\/references\//.test(sourceFile);
   if (inReferencesDir) {
+    const refsIdx = sourceFile.lastIndexOf("/references/");
+    const withinRefs = sourceFile.slice(refsIdx + "/references/".length);
+    const withinDir = withinRefs.includes("/") ? withinRefs.slice(0, withinRefs.lastIndexOf("/")) : "";
     const siblingRe = /\((?!https?:|#|\.\.\/)([a-z0-9./_-]+\.md)\)/gi;
     for (const match of content3.matchAll(siblingRe)) {
-      const refPath = normalizeRelPath(match[1] ?? "");
-      if (!refPath || !canonicalExists(root2, refPath))
+      const raw = normalizeRelPath(match[1] ?? "");
+      if (!raw)
+        continue;
+      const refPath = withinDir ? normalizeRelPath(join9(withinDir, raw)) : raw;
+      if (!canonicalExists(root2, refPath))
         continue;
       links.push({ refPath, sourceFile });
     }
@@ -28796,6 +28805,21 @@ function discoverSkillReferencePlans(root2) {
         links.push(link2);
       }
     }
+    const queue = [...refPaths];
+    while (queue.length > 0) {
+      const refPath = queue.pop();
+      if (!refPath || !canonicalExists(root2, refPath))
+        continue;
+      const canonicalContent = readFileSync8(join9(root2, CANONICAL_REFS_DIR, refPath), "utf8");
+      const syntheticSource = generatedRefPath(slug2, refPath);
+      for (const link2 of findLocalCanonicalLinks(root2, canonicalContent, syntheticSource)) {
+        if (refPaths.has(link2.refPath))
+          continue;
+        refPaths.add(link2.refPath);
+        links.push(link2);
+        queue.push(link2.refPath);
+      }
+    }
     if (refPaths.size > 0) {
       plans.push({ skill: slug2, refPaths, links });
     }
@@ -29787,6 +29811,7 @@ function runValidateChanged(options = {}) {
     }
     buckets[bucket].push(relPath2);
   }
+  const audited = buckets.docs.length + buckets.skills.length + buckets.shell.length + buckets.json.length;
   let exitCode = 0;
   if (options.base) {
     const globalExit = runAudit({
@@ -29801,6 +29826,12 @@ function runValidateChanged(options = {}) {
     if (globalExit !== 0)
       exitCode = 1;
   }
+  if (skipped > 0 && audited === 0) {
+    console.error(`validate changed: all paths were skipped (code/config). This does not verify TypeScript or app code.
+` + `  In this repo: bun test && bun run typecheck
+` + "  Consumers: run your local code validation gates.");
+    return 1;
+  }
   if (buckets.docs.length > 0) {
     const docExit = runAudit({
       suite: "docs",
@@ -30062,7 +30093,12 @@ function main() {
         console.error("register: path required");
         process.exit(1);
       }
-      registerPath(opts);
+      registerPath({
+        path: opts.path,
+        topic: opts.topic,
+        dryRun: opts.dryRun,
+        json: opts.json
+      });
       process.exit(0);
     }
     if (command === "customize" && argv[1] === "resolve") {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@csark0812/skeleton",
-	"version": "1.1.1",
+	"version": "1.1.2",
 	"description": "SSOT audit CLI for agent harness repos",
 	"type": "module",
 	"bin": {
@@ -20,12 +20,13 @@
 		"test": "bun test",
 		"test:audit": "bun test src/audit/__tests__",
 		"test:cli": "bun test src/__tests__/cli",
+		"typecheck": "tsc -p tsconfig.json --noEmit",
 		"validate:changed": "bun src/cli.ts validate changed",
 		"validate:ci": "bun src/cli.ts validate changed --base origin/main",
 		"audit:docs": "bun src/cli.ts audit docs",
 		"audit:skills": "bun src/cli.ts audit skills",
 		"audit:self": "bun src/cli.ts audit self",
-		"prepack": "bun test && bun run build"
+		"prepack": "bun test && bun run typecheck && bun run build"
 	},
 	"dependencies": {
 		"ajv": "^8.17.1",

package/schemas/config.schema.json

@@ -24,9 +24,14 @@
 					"type": "array",
 					"items": { "type": "string" }
 				},
-				"retiredSkills": {
+	"retiredSkills": {
 					"type": "array",
 					"items": { "type": "string", "pattern": "^[a-z0-9-]+$" }
+				},
+				"nonPublicSkills": {
+					"type": "array",
+					"items": { "type": "string", "pattern": "^[a-z0-9-]+$" },
+					"description": "Skill slugs that exist on disk but must not appear in README Taxonomy (consumer-internal skills)"
 				}
 			}
 		},