@csark0812/skeleton 1.1.3 → 1.5.0

package/dist/cli.js

@@ -15703,6 +15703,106 @@ var $stringify = publicApi.stringify;
 var $visit = visit.visit;
 var $visitAsync = visit.visitAsync;
 
+// src/audit/core/shared.ts
+var REGISTRY_REL_PATH = ".skeleton/registry.md";
+var REGISTRY_DIR_REL = ".skeleton";
+var EXTERNAL_LINK_RE = /^(https?:|mailto:|#)/;
+var SOURCE_OF_TRUTH_BANNER_RE = /\*\*Source of truth for\*\*/;
+var SOURCE_OF_TRUTH_BANNER_LINE_RE = /^\s*\*\*Source of truth for\*\*/m;
+var DOC_META_RE = /<!--\s*doc-meta:\s*owner=[^|]+\|\s*last-reviewed=\d{4}-\d{2}-\d{2}\s*-->/;
+var DOC_META_LAST_REVIEWED_RE = /last-reviewed=(\d{4}-\d{2}-\d{2})/;
+function docMetaLastReviewed(content) {
+  const meta = DOC_META_RE.exec(content);
+  if (!meta?.[0])
+    return null;
+  const match = DOC_META_LAST_REVIEWED_RE.exec(meta[0]);
+  return match?.[1] ?? null;
+}
+function replaceDocMetaLastReviewed(content, date) {
+  const meta = DOC_META_RE.exec(content);
+  if (!meta?.[0] || meta.index === undefined)
+    return null;
+  const updatedComment = meta[0].replace(DOC_META_LAST_REVIEWED_RE, `last-reviewed=${date}`);
+  if (updatedComment === meta[0])
+    return null;
+  return content.slice(0, meta.index) + updatedComment + content.slice(meta.index + meta[0].length);
+}
+var SKILL_LINK_IN_TARGET_RE = /(?:\.claude\/skills\/|\.agents\/skills\/|(?:\.\.\/)+)([a-z0-9-]+)\/SKILL\.md/;
+var SKILL_LINK_RE = /(?:\.claude\/skills\/|\.agents\/skills\/|\.\.\/|\.\/)?([a-z0-9-]+)\/SKILL\.md/g;
+function normalizeRelPath(p) {
+  let out = p.replace(/\\/g, "/");
+  if (out.startsWith("/"))
+    return out;
+  while (out.startsWith("./")) {
+    out = out.slice(2);
+  }
+  return out;
+}
+function isExternalLink(target) {
+  return EXTERNAL_LINK_RE.test(target);
+}
+function isPlaceholderLink(target) {
+  return !target.includes("/") && !target.includes(".") && !target.startsWith("#");
+}
+function escapeRegexLiteral(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function globToRegex(glob) {
+  let pattern = glob.replace(/\\/g, "/");
+  pattern = pattern.replace(/\{([^}]+)\}/g, (_, inner) => {
+    const parts = inner.split(",").map((p) => escapeRegexLiteral(p.trim()));
+    return `(${parts.join("|")})`;
+  });
+  pattern = pattern.replace(/\*\*/g, "§§").replace(/\*/g, "[^/]*").replace(/§§/g, ".*").replace(/\?/g, "[^/]");
+  return new RegExp(`^${pattern}$`);
+}
+function matchesGlobScope(relPath, scope) {
+  if (!scope)
+    return true;
+  return globToRegex(scope).test(normalizeRelPath(relPath));
+}
+function extractScanRootsFromInclude(include) {
+  const roots = new Set;
+  for (const pattern of include) {
+    const normalized = normalizeRelPath(pattern);
+    const globIdx = normalized.search(/[*?[{]/);
+    if (globIdx === -1) {
+      if (/\.[a-z0-9]+$/i.test(normalized))
+        continue;
+      roots.add(normalized.replace(/\/$/, ""));
+      continue;
+    }
+    const root = normalized.slice(0, globIdx).replace(/\/$/, "");
+    if (root)
+      roots.add(root);
+  }
+  return [...roots];
+}
+
+// src/audit/core/draft.ts
+var DRAFT_FILENAME_RE = /(^|\/)_draft-[^/]+\.md$/i;
+function normalizeDraftPrefix(prefix) {
+  const normalized = normalizeRelPath(prefix);
+  const withSlash = normalized.endsWith("/") ? normalized : `${normalized}/`;
+  if (withSlash === "/" || withSlash === "./") {
+    throw new Error(`Invalid draftPathPrefixes entry ${JSON.stringify(prefix)}: must be a repo-relative directory (e.g. drafts/), not ${JSON.stringify(prefix)}`);
+  }
+  return withSlash;
+}
+function validateDraftPathPrefixes(prefixes) {
+  if (!prefixes)
+    return;
+  for (const prefix of prefixes) {
+    normalizeDraftPrefix(prefix);
+  }
+}
+function isDraftPlacementAllowed(relPath, draftPathPrefixes) {
+  const normalized = normalizeRelPath(relPath);
+  if (DRAFT_FILENAME_RE.test(normalized))
+    return true;
+  return draftPathPrefixes.some((prefix) => normalized.startsWith(normalizeDraftPrefix(prefix)));
+}
+
 // src/audit/config/load.ts
 var SCHEMA_CANDIDATES = [
   join(dirname(fileURLToPath(import.meta.url)), "../../../schemas/config.schema.json"),
@@ -15743,7 +15843,9 @@ function validateConfig(raw) {
     const detail = validate.errors?.map((e) => `${e.instancePath || "/"} ${e.message}`).join("; ");
     throw new Error(`Invalid .skeleton/config.yaml: ${detail ?? "schema validation failed"}`);
   }
-  return raw;
+  const config = raw;
+  validateDraftPathPrefixes(config.draftPathPrefixes);
+  return config;
 }
 function loadConfig(root) {
   const configPath = join(root, ".skeleton", "config.yaml");
@@ -15763,9 +15865,10 @@ function nonPublicSkills(config) {
   return config.scan.nonPublicSkills ?? [];
 }
 
-// src/audit/core/collect.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3, relative as relative3 } from "node:path";
+// src/plugins/load.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { relative as relative2 } from "node:path";
+import { pathToFileURL } from "node:url";
 
 // node_modules/tinyglobby/dist/index.mjs
 import { readdir, readdirSync, realpath, realpathSync, stat, statSync } from "fs";
@@ -16593,63 +16696,300 @@ function globSync(globInput, options) {
   return crawler ? formatPaths(crawler.sync(), relative2) : [];
 }
 
-// src/audit/core/shared.ts
-var REGISTRY_REL_PATH = ".skeleton/registry.md";
-var REGISTRY_DIR_REL = ".skeleton";
-var EXTERNAL_LINK_RE = /^(https?:|mailto:|#)/;
-var SOURCE_OF_TRUTH_BANNER_RE = /\*\*Source of truth for\*\*/;
-var SOURCE_OF_TRUTH_BANNER_LINE_RE = /^\s*\*\*Source of truth for\*\*/m;
-var DOC_META_RE = /<!--\s*doc-meta:\s*owner=[^|]+\|\s*last-reviewed=\d{4}-\d{2}-\d{2}\s*-->/;
-var DOC_META_LAST_REVIEWED_RE = /last-reviewed=(\d{4}-\d{2}-\d{2})/;
-var SKILL_LINK_IN_TARGET_RE = /(?:\.claude\/skills\/|\.agents\/skills\/|(?:\.\.\/)+)([a-z0-9-]+)\/SKILL\.md/;
-var SKILL_LINK_RE = /(?:\.claude\/skills\/|\.agents\/skills\/|\.\.\/|\.\/)?([a-z0-9-]+)\/SKILL\.md/g;
-function normalizeRelPath(p) {
-  return p.replace(/\\/g, "/");
-}
-function isExternalLink(target) {
-  return EXTERNAL_LINK_RE.test(target);
+// src/audit/policies/load.ts
+var import_ajv2 = __toESM(require_ajv(), 1);
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname3, extname, join as join2 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+var SCHEMA_CANDIDATES2 = [
+  join2(dirname3(fileURLToPath3(import.meta.url)), "../../../schemas/policy-file.schema.json"),
+  join2(dirname3(fileURLToPath3(import.meta.url)), "../schemas/policy-file.schema.json"),
+  join2(dirname3(fileURLToPath3(import.meta.url)), "../../schemas/policy-file.schema.json")
+];
+function resolvePolicySchemaPath() {
+  for (const candidate of SCHEMA_CANDIDATES2) {
+    if (existsSync2(candidate))
+      return candidate;
+  }
+  throw new Error("Missing schemas/policy-file.schema.json in package");
 }
-function isPlaceholderLink(target) {
-  return !target.includes("/") && !target.includes(".") && !target.startsWith("#");
+function validatePolicyYaml(raw, label) {
+  const schema = JSON.parse(readFileSync2(resolvePolicySchemaPath(), "utf8"));
+  const ajv = new import_ajv2.default({ allErrors: true, strict: false });
+  const validate = ajv.compile(schema);
+  if (!validate(raw)) {
+    const detail = validate.errors?.map((e) => `${e.instancePath || "/"} ${e.message}`).join("; ");
+    throw new Error(`Invalid policy ${label}: ${detail ?? "schema validation failed"}`);
+  }
+  return raw;
 }
-function escapeRegexLiteral(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function parsePolicyYaml(content, fileStem) {
+  const parsed = $parse(content);
+  if (Array.isArray(parsed)) {
+    throw new Error(`Policy ${fileStem}.yaml must use Policy File shape (name + entries) — see schemas/policy-file.schema.json`);
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error(`Policy ${fileStem}.yaml missing required 'entries' array`);
+  }
+  return validatePolicyYaml(parsed, `${fileStem}.yaml`);
 }
-function globToRegex(glob) {
-  let pattern = glob.replace(/\\/g, "/");
-  pattern = pattern.replace(/\{([^}]+)\}/g, (_, inner) => {
-    const parts = inner.split(",").map((p) => escapeRegexLiteral(p.trim()));
-    return `(${parts.join("|")})`;
+function compilePolicy(name, raw) {
+  const caseInsensitive = name !== "skill-hub-duplication";
+  const entries = raw.map((entry) => {
+    const mode = entry.mode ?? "pattern";
+    if (mode === "fingerprint") {
+      return { ...entry, mode, regex: null };
+    }
+    if (!entry.pattern) {
+      throw new Error(`Policy ${name} entry ${entry.id} requires pattern when mode is pattern`);
+    }
+    let regex;
+    try {
+      const flags = entry.pattern.startsWith("^") || !caseInsensitive ? "" : "i";
+      regex = new RegExp(entry.pattern, flags);
+    } catch (err) {
+      throw new Error(`Invalid regex in policy ${name} entry ${entry.id}: ${entry.pattern} — ${err}`);
+    }
+    return { ...entry, mode, regex };
   });
-  pattern = pattern.replace(/\*\*/g, "§§").replace(/\*/g, "[^/]*").replace(/§§/g, ".*").replace(/\?/g, "[^/]");
-  return new RegExp(`^${pattern}$`);
+  return { name, entries };
 }
-function matchesGlobScope(relPath, scope) {
-  if (!scope)
-    return true;
-  return globToRegex(scope).test(normalizeRelPath(relPath));
+function loadPolicyFile(absPath, content) {
+  const stem = basename2(absPath, extname(absPath));
+  const { name, entries } = parsePolicyYaml(content, stem);
+  return compilePolicy(name || stem, entries);
 }
-function extractScanRootsFromInclude(include) {
-  const roots = new Set;
-  for (const pattern of include) {
-    const normalized = normalizeRelPath(pattern);
-    const globIdx = normalized.search(/[*?[{]/);
-    if (globIdx === -1) {
-      if (/\.[a-z0-9]+$/i.test(normalized))
-        continue;
-      roots.add(normalized.replace(/\/$/, ""));
+function policiesForFile(policies, relPath) {
+  const matched = [];
+  for (const policy of policies) {
+    for (const entry of policy.entries) {
+      if (matchesGlobScope(relPath, entry.scope)) {
+        matched.push({ ...entry, policyName: policy.name });
+      }
+    }
+  }
+  return matched;
+}
+
+// src/plugins/paths.ts
+import { existsSync as existsSync3, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname4, join as join3, resolve as resolve3, sep as sep2 } from "node:path";
+function skeletonDir(root) {
+  return join3(root, ".skeleton");
+}
+function mjsPathForTs(tsPath) {
+  if (tsPath.endsWith(".mjs"))
+    return tsPath;
+  if (tsPath.endsWith(".ts"))
+    return `${tsPath.slice(0, -3)}.mjs`;
+  return `${tsPath}.mjs`;
+}
+function underBase(pathAbs, baseAbs) {
+  return pathAbs !== baseAbs && pathAbs.startsWith(baseAbs + sep2);
+}
+function assertUnderBase(abs, base, label) {
+  const baseAbs = resolve3(base);
+  const pathAbs = resolve3(abs);
+  if (!underBase(pathAbs, baseAbs)) {
+    throw new Error(`${label} must stay under .skeleton/: ${abs}`);
+  }
+}
+function assertRealUnderBase(abs, baseReal, label) {
+  const pathAbs = resolve3(abs);
+  let cursor = pathAbs;
+  while (true) {
+    if (existsSync3(cursor)) {
+      const real = realpathSync2(cursor);
+      if (real !== baseReal && !underBase(real, baseReal)) {
+        throw new Error(`${label} must stay under .skeleton/: ${abs}`);
+      }
+      return;
+    }
+    const parent = dirname4(cursor);
+    if (parent === cursor) {
+      throw new Error(`${label} must stay under .skeleton/: ${abs}`);
+    }
+    cursor = parent;
+  }
+}
+function skeletonRealPath(root) {
+  const base = resolve3(skeletonDir(root));
+  return existsSync3(base) ? realpathSync2(base) : base;
+}
+function resolvePluginTsPath(root, entry) {
+  if (entry.startsWith("/") || /^[A-Za-z]:[\\/]/.test(entry)) {
+    throw new Error(`Plugin path must be relative to .skeleton/: ${entry}`);
+  }
+  const cleaned = entry.replace(/^\.skeleton\//, "").replace(/^\.\//, "");
+  if (!cleaned || cleaned === ".") {
+    throw new Error(`Plugin path must stay under .skeleton/: ${entry}`);
+  }
+  if (cleaned.split(/[/\\]/).includes("..")) {
+    throw new Error(`Plugin path must stay under .skeleton/: ${entry}`);
+  }
+  const base = resolve3(skeletonDir(root));
+  const abs = resolve3(base, cleaned);
+  return assertPluginTsUnderSkeleton(root, abs, entry);
+}
+function resolveAbsolutePluginTsPath(root, absEntry) {
+  if (!(absEntry.startsWith("/") || /^[A-Za-z]:[\\/]/.test(absEntry))) {
+    throw new Error(`Expected absolute plugin path: ${absEntry}`);
+  }
+  const abs = resolve3(absEntry);
+  return assertPluginTsUnderSkeleton(root, abs, absEntry);
+}
+function assertPluginTsUnderSkeleton(root, abs, label) {
+  const base = resolve3(skeletonDir(root));
+  assertUnderBase(abs, base, "Plugin path");
+  if (!abs.endsWith(".ts")) {
+    throw new Error(`Plugin path must be a .ts file under .skeleton/: ${label}`);
+  }
+  const mjsAbs = mjsPathForTs(abs);
+  assertUnderBase(mjsAbs, base, "Plugin output");
+  const baseReal = skeletonRealPath(root);
+  assertRealUnderBase(abs, baseReal, "Plugin path");
+  assertRealUnderBase(mjsAbs, baseReal, "Plugin output");
+  return abs;
+}
+function assertUnderSkeleton(root, absPath) {
+  const base = resolve3(skeletonDir(root));
+  assertUnderBase(absPath, base, "Policy file");
+  assertRealUnderBase(absPath, skeletonRealPath(root), "Policy file");
+}
+
+// src/plugins/load.ts
+function normalizeExport(mod) {
+  if (!mod || typeof mod !== "object") {
+    throw new Error("Plugin module must export { rules: AuditRule[]; policies?: string[] }");
+  }
+  const record = mod;
+  const namedRules = Array.isArray(record.rules) ? record.rules : undefined;
+  const namedPoliciesRaw = "policies" in record ? record.policies : undefined;
+  const def = "default" in record && record.default && typeof record.default === "object" ? record.default : null;
+  const defaultRules = def && Array.isArray(def.rules) ? def.rules : undefined;
+  const defaultPoliciesRaw = def && "policies" in def ? def.policies : undefined;
+  let rules;
+  if (defaultRules !== undefined && namedRules !== undefined) {
+    if (defaultRules.length !== namedRules.length || defaultRules.some((rule, i) => rule.id !== namedRules[i]?.id || rule.run !== namedRules[i]?.run)) {
+      throw new Error("Plugin exports disagree on rules: default and named `rules` must match when both are set");
+    }
+    rules = defaultRules;
+  } else {
+    rules = defaultRules ?? namedRules;
+  }
+  let policies;
+  if (defaultPoliciesRaw !== undefined && namedPoliciesRaw !== undefined) {
+    if (!Array.isArray(defaultPoliciesRaw) || !Array.isArray(namedPoliciesRaw) || defaultPoliciesRaw.length !== namedPoliciesRaw.length || defaultPoliciesRaw.some((p, i) => p !== namedPoliciesRaw[i])) {
+      throw new Error("Plugin exports disagree on policies: default and named `policies` must match when both are set");
+    }
+    policies = defaultPoliciesRaw;
+  } else {
+    policies = defaultPoliciesRaw ?? namedPoliciesRaw;
+  }
+  if (!Array.isArray(rules)) {
+    throw new Error("Plugin module must export { rules: AuditRule[]; policies?: string[] }");
+  }
+  for (const rule of rules) {
+    if (!rule || typeof rule.id !== "string" || typeof rule.run !== "function") {
+      throw new Error("Plugin rules must each have string id and run()");
+    }
+  }
+  if (policies !== undefined) {
+    if (!Array.isArray(policies) || policies.some((p) => typeof p !== "string")) {
+      throw new Error("Plugin policies must be string[] (globs relative to .skeleton/) — got non-array");
+    }
+  }
+  return {
+    rules,
+    policies
+  };
+}
+function expandPolicyGlobs(root, globs) {
+  const base = skeletonDir(root);
+  const files = new Set;
+  for (const pattern of globs) {
+    if (pattern.split(/[/\\]/).includes("..")) {
+      throw new Error(`Policy glob must stay under .skeleton/: ${pattern}`);
+    }
+    const matches = globSync(pattern, {
+      cwd: base,
+      absolute: true,
+      onlyFiles: true
+    });
+    for (const match of matches) {
+      assertUnderSkeleton(root, match);
+      if (match.endsWith(".yaml") || match.endsWith(".yml")) {
+        files.add(match);
+      }
+    }
+  }
+  return [...files].sort();
+}
+function loadPoliciesFromGlobs(root, globs) {
+  const files = expandPolicyGlobs(root, globs);
+  const policies = [];
+  for (const abs of files) {
+    assertUnderSkeleton(root, abs);
+    policies.push(loadPolicyFile(abs, readFileSync3(abs, "utf8")));
+  }
+  if (globs.length > 0 && policies.length === 0) {
+    throw new Error(`Plugin policies matched no YAML under .skeleton/: ${globs.join(", ")}. Fix the glob or add policy files.`);
+  }
+  return policies;
+}
+async function collectWiredPolicyRelPaths(root, config) {
+  const entries = config.plugins ?? [];
+  const wired = new Set;
+  if (entries.length === 0)
+    return wired;
+  for (const entry of entries) {
+    const tsAbs = resolvePluginTsPath(root, entry);
+    const mjsAbs = mjsPathForTs(tsAbs);
+    if (!existsSync4(mjsAbs)) {
+      const rel = relative2(skeletonDir(root), tsAbs) || entry;
+      throw new Error(`Plugin not built: ${rel} (missing ${relative2(root, mjsAbs) || mjsAbs}). Run: skeleton build-plugin`);
+    }
+    const mod = await import(pathToFileURL(mjsAbs).href);
+    const normalized = normalizeExport(mod);
+    if (!normalized.policies?.length)
       continue;
+    for (const abs of expandPolicyGlobs(root, normalized.policies)) {
+      wired.add(normalizeRelPath(relative2(root, abs)));
     }
-    const root = normalized.slice(0, globIdx).replace(/\/$/, "");
-    if (root)
-      roots.add(root);
   }
-  return [...roots];
+  return wired;
+}
+async function loadPlugins(root, config) {
+  const entries = config.plugins ?? [];
+  if (entries.length === 0) {
+    return { rules: [], policies: [] };
+  }
+  const rules = [];
+  const policies = [];
+  for (const entry of entries) {
+    const tsAbs = resolvePluginTsPath(root, entry);
+    const mjsAbs = mjsPathForTs(tsAbs);
+    if (!existsSync4(mjsAbs)) {
+      const rel = relative2(skeletonDir(root), tsAbs) || entry;
+      throw new Error(`Plugin not built: ${rel} (missing ${relative2(root, mjsAbs) || mjsAbs}). Run: skeleton build-plugin`);
+    }
+    const mod = await import(pathToFileURL(mjsAbs).href);
+    const normalized = normalizeExport(mod);
+    rules.push(...normalized.rules);
+    if (normalized.policies?.length) {
+      policies.push(...loadPoliciesFromGlobs(root, normalized.policies));
+    }
+  }
+  return { rules, policies };
 }
 
+// src/audit/core/collect.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { join as join5, relative as relative4 } from "node:path";
+
 // src/audit/core/skill-roots.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readlinkSync, realpathSync as realpathSync2 } from "node:fs";
-import { join as join2, relative as relative2 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readlinkSync, realpathSync as realpathSync3 } from "node:fs";
+import { join as join4, relative as relative3 } from "node:path";
 var NESTED_SKILL_ROOTS = [".claude/skills", ".agents/skills"];
 var FLAT_SKILL_DENYLIST = new Set([
   ".git",
@@ -16672,16 +17012,16 @@ var FLAT_SKILL_DENYLIST = new Set([
 var NESTED_EXCLUDED_DIRS = new Set(["references", "_shared"]);
 function safeRealpath(path) {
   try {
-    return realpathSync2(path);
+    return realpathSync3(path);
   } catch {
     return null;
   }
 }
 function listNestedSlugs(root, relRoot) {
-  const absRoot = join2(root, relRoot);
-  if (!existsSync2(absRoot))
+  const absRoot = join4(root, relRoot);
+  if (!existsSync5(absRoot))
     return [];
-  return readdirSync2(absRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NESTED_EXCLUDED_DIRS.has(entry.name)).filter((entry) => existsSync2(join2(absRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
+  return readdirSync2(absRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NESTED_EXCLUDED_DIRS.has(entry.name)).filter((entry) => existsSync5(join4(absRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
 }
 function listFlatSlugs(root) {
   const slugs = [];
@@ -16690,7 +17030,7 @@ function listFlatSlugs(root) {
       continue;
     if (FLAT_SKILL_DENYLIST.has(entry.name))
       continue;
-    if (existsSync2(join2(root, entry.name, "SKILL.md"))) {
+    if (existsSync5(join4(root, entry.name, "SKILL.md"))) {
       slugs.push(entry.name);
     }
   }
@@ -16700,8 +17040,8 @@ function detectSkillRoots(root) {
   const roots = [];
   let claudeReal = null;
   for (const relRoot of NESTED_SKILL_ROOTS) {
-    const abs = join2(root, relRoot);
-    if (!existsSync2(abs))
+    const abs = join4(root, relRoot);
+    if (!existsSync5(abs))
       continue;
     if (relRoot === ".claude/skills") {
       claudeReal = safeRealpath(abs);
@@ -16715,11 +17055,11 @@ function detectSkillRoots(root) {
         continue;
       try {
         const link = readlinkSync(abs);
-        if (link && claudeReal && safeRealpath(join2(root, link)) === claudeReal)
+        if (link && claudeReal && safeRealpath(join4(root, link)) === claudeReal)
           continue;
       } catch {}
     }
-    if (listNestedSlugs(root, relRoot).length > 0 || existsSync2(abs)) {
+    if (listNestedSlugs(root, relRoot).length > 0 || existsSync5(abs)) {
       roots.push({ kind: "nested", relPath: relRoot });
     }
   }
@@ -16746,9 +17086,9 @@ function buildSkillIndex(root) {
 }
 function resolveSkillPath(index, root, slug) {
   for (const skillRoot of index.roots) {
-    const candidate = skillRoot.kind === "nested" ? join2(root, skillRoot.relPath, slug, "SKILL.md") : join2(root, slug, "SKILL.md");
-    if (existsSync2(candidate)) {
-      return normalizeRelPath(relative2(root, candidate));
+    const candidate = skillRoot.kind === "nested" ? join4(root, skillRoot.relPath, slug, "SKILL.md") : join4(root, slug, "SKILL.md");
+    if (existsSync5(candidate)) {
+      return normalizeRelPath(relative3(root, candidate));
     }
   }
   return null;
@@ -16782,12 +17122,33 @@ function skillCollectAugments(index) {
   }
   return patterns;
 }
+function listSkillMarkdownPaths(root, index) {
+  const paths = new Set;
+  for (const skillRoot of index.roots) {
+    const slugs = skillRoot.kind === "nested" ? listNestedSlugs(root, skillRoot.relPath) : listFlatSlugs(root);
+    for (const slug of slugs) {
+      const absDir = skillRoot.kind === "nested" ? join4(root, skillRoot.relPath, slug) : join4(root, slug);
+      if (!existsSync5(absDir))
+        continue;
+      for (const abs of globSync("**/*.{md,mdc}", {
+        cwd: absDir,
+        absolute: true,
+        onlyFiles: true,
+        dot: true
+      })) {
+        paths.add(normalizeRelPath(relative3(root, abs)));
+      }
+    }
+  }
+  return [...paths].sort();
+}
 function listSkillSlugs(index) {
   return index.slugs;
 }
 
 // src/audit/core/collect.ts
 var MARKDOWN_GLOBS = ["**/*.md", "**/*.mdc"];
+var BUILTIN_INCLUDE_PATTERNS = [".skeleton/customize/**"];
 function isMarkdownFile(absPath) {
   return absPath.endsWith(".md") || absPath.endsWith(".mdc");
 }
@@ -16805,7 +17166,7 @@ function expandPatterns(root, patterns, exclude) {
     })) {
       if (!isMarkdownFile(abs))
         continue;
-      const rel = normalizeRelPath(relative3(root, abs));
+      const rel = normalizeRelPath(relative4(root, abs));
       if (shouldExclude(rel, exclude))
         continue;
       files.add(abs);
@@ -16815,7 +17176,7 @@ function expandPatterns(root, patterns, exclude) {
 }
 function collectScanFiles(config, root, skillIndex) {
   const exclude = mergedExcludes(config);
-  const includePatterns = [...config.scan.include];
+  const includePatterns = [...BUILTIN_INCLUDE_PATTERNS, ...config.scan.include];
   if (skillIndex) {
     includePatterns.push(...skillCollectAugments(skillIndex));
   }
@@ -16833,7 +17194,7 @@ function collectBannedFiles(config, root) {
       onlyFiles: true,
       dot: false
     })) {
-      const rel = normalizeRelPath(relative3(root, abs));
+      const rel = normalizeRelPath(relative4(root, abs));
       if (shouldExclude(rel, exclude))
         continue;
       files.add(abs);
@@ -16850,7 +17211,7 @@ function collectCoverageCandidateFiles(root, exclude) {
       onlyFiles: true,
       dot: false
     })) {
-      const rel = normalizeRelPath(relative3(root, abs));
+      const rel = normalizeRelPath(relative4(root, abs));
       if (shouldExclude(rel, exclude))
         continue;
       files.add(rel);
@@ -16861,25 +17222,25 @@ function collectCoverageCandidateFiles(root, exclude) {
 function collectDocMetaPaths(config, root, registryPaths, skillIndex) {
   const paths = [];
   for (const abs of expandPatterns(root, ["docs/*/README.md"], mergedExcludes(config))) {
-    paths.push(normalizeRelPath(relative3(root, abs)));
+    paths.push(normalizeRelPath(relative4(root, abs)));
   }
   const extras = ["docs/README.md", ".skeleton/registry.md"];
   for (const file of extras) {
-    const abs = join3(root, file);
-    if (existsSync3(abs))
+    const abs = join5(root, file);
+    if (existsSync6(abs))
       paths.push(normalizeRelPath(file));
   }
   for (const rel of registryPaths) {
     if (!rel.endsWith(".md") && !rel.endsWith(".mdc"))
       continue;
-    const abs = join3(root, rel);
-    if (existsSync3(abs))
+    const abs = join5(root, rel);
+    if (existsSync6(abs))
       paths.push(normalizeRelPath(rel));
   }
   for (const abs of collectScanFiles(config, root, skillIndex)) {
-    const content = readFileSync2(abs, "utf8");
+    const content = readFileSync4(abs, "utf8");
     if (/<!--\s*doc-meta:/.test(content)) {
-      paths.push(normalizeRelPath(relative3(root, abs)));
+      paths.push(normalizeRelPath(relative4(root, abs)));
     }
   }
   return [...new Set(paths)];
@@ -16887,7 +17248,7 @@ function collectDocMetaPaths(config, root, registryPaths, skillIndex) {
 function validateScanRoots(config, root) {
   const missing = [];
   for (const tree of extractScanRootsFromInclude(config.scan.include)) {
-    if (!existsSync3(join3(root, tree)))
+    if (!existsSync6(join5(root, tree)))
       missing.push(tree);
   }
   return missing;
@@ -16901,28 +17262,56 @@ function filterDocMetaPaths(docMetaPaths, paths) {
 function filterToPaths(files, paths, root) {
   const normalizedPaths = paths.map((path) => normalizeRelPath(path));
   return files.filter((abs) => {
-    const rel = normalizeRelPath(relative3(root, abs));
+    const rel = normalizeRelPath(relative4(root, abs));
     return normalizedPaths.some((path) => rel === path || rel.startsWith(`${path}/`));
   });
 }
+function includeExplicitMarkdownPaths(files, paths, root) {
+  const out = new Set(files);
+  for (const raw of paths) {
+    const rel = normalizeRelPath(raw);
+    const abs = join5(root, rel);
+    if (!existsSync6(abs))
+      continue;
+    if (isMarkdownFile(rel)) {
+      out.add(abs);
+      continue;
+    }
+    try {
+      if (!statSync2(abs).isDirectory())
+        continue;
+    } catch {
+      continue;
+    }
+    for (const md of globSync("**/*.{md,mdc}", {
+      cwd: abs,
+      absolute: true,
+      onlyFiles: true,
+      dot: true
+    })) {
+      out.add(md);
+    }
+  }
+  return [...out];
+}
 function readFileContent(absPath) {
-  return readFileSync2(absPath, "utf8");
+  return readFileSync4(absPath, "utf8");
 }
 function relPath(absPath, root) {
-  return normalizeRelPath(relative3(root, absPath));
+  return normalizeRelPath(relative4(root, absPath));
 }
 
 // src/audit/core/registry.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join4, relative as relative4, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+import { join as join6, relative as relative5, resolve as resolve4 } from "node:path";
 var REGISTRY_TABLE_ROW_RE = /^\|\s*[^|]+\|\s*\[[^\]]*\]\(([^)]+)\)\s*\|/;
 var REGISTRY_TABLE_HEADER_RE = /\|\s*Topic\s*\|\s*Canonical file\s*\|/i;
 function parseRegistry(root) {
-  const abs = join4(root, REGISTRY_REL_PATH);
-  if (!existsSync4(abs)) {
+  const abs = join6(root, REGISTRY_REL_PATH);
+  if (!existsSync7(abs)) {
     return { paths: [], hasTableHeader: false };
   }
-  const content = readFileSync3(abs, "utf8");
+  const content = readFileSync5(abs, "utf8");
   const hasTableHeader = REGISTRY_TABLE_HEADER_RE.test(content);
   const paths = [];
   for (const line of content.split(`
@@ -16933,8 +17322,8 @@ function parseRegistry(root) {
     const linkTarget = match[1].trim();
     if (linkTarget.startsWith("#"))
       continue;
-    const resolved = resolve3(join4(root, REGISTRY_DIR_REL), linkTarget);
-    paths.push(normalizeRelPath(relative4(root, resolved)));
+    const resolved = resolve4(join6(root, REGISTRY_DIR_REL), linkTarget);
+    paths.push(normalizeRelPath(relative5(root, resolved)));
   }
   return { paths: [...new Set(paths)], hasTableHeader };
 }
@@ -16948,7 +17337,11 @@ function createContext(options = {}) {
   const config = loadConfig(root);
   const skillIndex = buildSkillIndex(root);
   let files = collectScanFiles(config, root, skillIndex);
+  if (options.includeExcludedSkillTrees) {
+    files = includeExplicitMarkdownPaths(files, listSkillMarkdownPaths(root, skillIndex), root);
+  }
   if (options.paths && options.paths.length > 0) {
+    files = includeExplicitMarkdownPaths(files, options.paths, root);
     files = filterToPaths(files, options.paths, root);
   }
   const registry = parseRegistry(root);
@@ -16961,479 +17354,111 @@ function createContext(options = {}) {
     registryPaths: registry.paths,
     registryHasTableHeader: registry.hasTableHeader,
     retiredSkills: new Set(retiredSkills(config)),
-    skillIndex
+    skillIndex,
+    policies: options.policies ?? []
   };
 }
 
-// src/audit/core/report.ts
-function issue(rule, file, message, opts) {
-  return {
-    rule,
-    file,
-    link: opts?.link,
-    message,
-    severity: opts?.severity ?? "error"
-  };
+// src/audit/core/fix.ts
+import { existsSync as existsSync10, realpathSync as realpathSync4, writeFileSync } from "node:fs";
+import { dirname as dirname6, resolve as resolve6, sep as sep3 } from "node:path";
+
+// src/audit/fix/anchors.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname5, resolve as resolve5 } from "node:path";
+
+// node_modules/github-slugger/regex.js
+var regex = /[\0-\x1F!-,\.\/:-@\[-\^`\{-\xA9\xAB-\xB4\xB6-\xB9\xBB-\xBF\xD7\xF7\u02C2-\u02C5\u02D2-\u02DF\u02E5-\u02EB\u02ED\u02EF-\u02FF\u0375\u0378\u0379\u037E\u0380-\u0385\u0387\u038B\u038D\u03A2\u03F6\u0482\u0530\u0557\u0558\u055A-\u055F\u0589-\u0590\u05BE\u05C0\u05C3\u05C6\u05C8-\u05CF\u05EB-\u05EE\u05F3-\u060F\u061B-\u061F\u066A-\u066D\u06D4\u06DD\u06DE\u06E9\u06FD\u06FE\u0700-\u070F\u074B\u074C\u07B2-\u07BF\u07F6-\u07F9\u07FB\u07FC\u07FE\u07FF\u082E-\u083F\u085C-\u085F\u086B-\u089F\u08B5\u08C8-\u08D2\u08E2\u0964\u0965\u0970\u0984\u098D\u098E\u0991\u0992\u09A9\u09B1\u09B3-\u09B5\u09BA\u09BB\u09C5\u09C6\u09C9\u09CA\u09CF-\u09D6\u09D8-\u09DB\u09DE\u09E4\u09E5\u09F2-\u09FB\u09FD\u09FF\u0A00\u0A04\u0A0B-\u0A0E\u0A11\u0A12\u0A29\u0A31\u0A34\u0A37\u0A3A\u0A3B\u0A3D\u0A43-\u0A46\u0A49\u0A4A\u0A4E-\u0A50\u0A52-\u0A58\u0A5D\u0A5F-\u0A65\u0A76-\u0A80\u0A84\u0A8E\u0A92\u0AA9\u0AB1\u0AB4\u0ABA\u0ABB\u0AC6\u0ACA\u0ACE\u0ACF\u0AD1-\u0ADF\u0AE4\u0AE5\u0AF0-\u0AF8\u0B00\u0B04\u0B0D\u0B0E\u0B11\u0B12\u0B29\u0B31\u0B34\u0B3A\u0B3B\u0B45\u0B46\u0B49\u0B4A\u0B4E-\u0B54\u0B58-\u0B5B\u0B5E\u0B64\u0B65\u0B70\u0B72-\u0B81\u0B84\u0B8B-\u0B8D\u0B91\u0B96-\u0B98\u0B9B\u0B9D\u0BA0-\u0BA2\u0BA5-\u0BA7\u0BAB-\u0BAD\u0BBA-\u0BBD\u0BC3-\u0BC5\u0BC9\u0BCE\u0BCF\u0BD1-\u0BD6\u0BD8-\u0BE5\u0BF0-\u0BFF\u0C0D\u0C11\u0C29\u0C3A-\u0C3C\u0C45\u0C49\u0C4E-\u0C54\u0C57\u0C5B-\u0C5F\u0C64\u0C65\u0C70-\u0C7F\u0C84\u0C8D\u0C91\u0CA9\u0CB4\u0CBA\u0CBB\u0CC5\u0CC9\u0CCE-\u0CD4\u0CD7-\u0CDD\u0CDF\u0CE4\u0CE5\u0CF0\u0CF3-\u0CFF\u0D0D\u0D11\u0D45\u0D49\u0D4F-\u0D53\u0D58-\u0D5E\u0D64\u0D65\u0D70-\u0D79\u0D80\u0D84\u0D97-\u0D99\u0DB2\u0DBC\u0DBE\u0DBF\u0DC7-\u0DC9\u0DCB-\u0DCE\u0DD5\u0DD7\u0DE0-\u0DE5\u0DF0\u0DF1\u0DF4-\u0E00\u0E3B-\u0E3F\u0E4F\u0E5A-\u0E80\u0E83\u0E85\u0E8B\u0EA4\u0EA6\u0EBE\u0EBF\u0EC5\u0EC7\u0ECE\u0ECF\u0EDA\u0EDB\u0EE0-\u0EFF\u0F01-\u0F17\u0F1A-\u0F1F\u0F2A-\u0F34\u0F36\u0F38\u0F3A-\u0F3D\u0F48\u0F6D-\u0F70\u0F85\u0F98\u0FBD-\u0FC5\u0FC7-\u0FFF\u104A-\u104F\u109E\u109F\u10C6\u10C8-\u10CC\u10CE\u10CF\u10FB\u1249\u124E\u124F\u1257\u1259\u125E\u125F\u1289\u128E\u128F\u12B1\u12B6\u12B7\u12BF\u12C1\u12C6\u12C7\u12D7\u1311\u1316\u1317\u135B\u135C\u1360-\u137F\u1390-\u139F\u13F6\u13F7\u13FE-\u1400\u166D\u166E\u1680\u169B-\u169F\u16EB-\u16ED\u16F9-\u16FF\u170D\u1715-\u171F\u1735-\u173F\u1754-\u175F\u176D\u1771\u1774-\u177F\u17D4-\u17D6\u17D8-\u17DB\u17DE\u17DF\u17EA-\u180A\u180E\u180F\u181A-\u181F\u1879-\u187F\u18AB-\u18AF\u18F6-\u18FF\u191F\u192C-\u192F\u193C-\u1945\u196E\u196F\u1975-\u197F\u19AC-\u19AF\u19CA-\u19CF\u19DA-\u19FF\u1A1C-\u1A1F\u1A5F\u1A7D\u1A7E\u1A8A-\u1A8F\u1A9A-\u1AA6\u1AA8-\u1AAF\u1AC1-\u1AFF\u1B4C-\u1B4F\u1B5A-\u1B6A\u1B74-\u1B7F\u1BF4-\u1BFF\u1C38-\u1C3F\u1C4A-\u1C4C\u1C7E\u1C7F\u1C89-\u1C8F\u1CBB\u1CBC\u1CC0-\u1CCF\u1CD3\u1CFB-\u1CFF\u1DFA\u1F16\u1F17\u1F1E\u1F1F\u1F46\u1F47\u1F4E\u1F4F\u1F58\u1F5A\u1F5C\u1F5E\u1F7E\u1F7F\u1FB5\u1FBD\u1FBF-\u1FC1\u1FC5\u1FCD-\u1FCF\u1FD4\u1FD5\u1FDC-\u1FDF\u1FED-\u1FF1\u1FF5\u1FFD-\u203E\u2041-\u2053\u2055-\u2070\u2072-\u207E\u2080-\u208F\u209D-\u20CF\u20F1-\u2101\u2103-\u2106\u2108\u2109\u2114\u2116-\u2118\u211E-\u2123\u2125\u2127\u2129\u212E\u213A\u213B\u2140-\u2144\u214A-\u214D\u214F-\u215F\u2189-\u24B5\u24EA-\u2BFF\u2C2F\u2C5F\u2CE5-\u2CEA\u2CF4-\u2CFF\u2D26\u2D28-\u2D2C\u2D2E\u2D2F\u2D68-\u2D6E\u2D70-\u2D7E\u2D97-\u2D9F\u2DA7\u2DAF\u2DB7\u2DBF\u2DC7\u2DCF\u2DD7\u2DDF\u2E00-\u2E2E\u2E30-\u3004\u3008-\u3020\u3030\u3036\u3037\u303D-\u3040\u3097\u3098\u309B\u309C\u30A0\u30FB\u3100-\u3104\u3130\u318F-\u319F\u31C0-\u31EF\u3200-\u33FF\u4DC0-\u4DFF\u9FFD-\u9FFF\uA48D-\uA4CF\uA4FE\uA4FF\uA60D-\uA60F\uA62C-\uA63F\uA673\uA67E\uA6F2-\uA716\uA720\uA721\uA789\uA78A\uA7C0\uA7C1\uA7CB-\uA7F4\uA828-\uA82B\uA82D-\uA83F\uA874-\uA87F\uA8C6-\uA8CF\uA8DA-\uA8DF\uA8F8-\uA8FA\uA8FC\uA92E\uA92F\uA954-\uA95F\uA97D-\uA97F\uA9C1-\uA9CE\uA9DA-\uA9DF\uA9FF\uAA37-\uAA3F\uAA4E\uAA4F\uAA5A-\uAA5F\uAA77-\uAA79\uAAC3-\uAADA\uAADE\uAADF\uAAF0\uAAF1\uAAF7-\uAB00\uAB07\uAB08\uAB0F\uAB10\uAB17-\uAB1F\uAB27\uAB2F\uAB5B\uAB6A-\uAB6F\uABEB\uABEE\uABEF\uABFA-\uABFF\uD7A4-\uD7AF\uD7C7-\uD7CA\uD7FC-\uD7FF\uE000-\uF8FF\uFA6E\uFA6F\uFADA-\uFAFF\uFB07-\uFB12\uFB18-\uFB1C\uFB29\uFB37\uFB3D\uFB3F\uFB42\uFB45\uFBB2-\uFBD2\uFD3E-\uFD4F\uFD90\uFD91\uFDC8-\uFDEF\uFDFC-\uFDFF\uFE10-\uFE1F\uFE30-\uFE32\uFE35-\uFE4C\uFE50-\uFE6F\uFE75\uFEFD-\uFF0F\uFF1A-\uFF20\uFF3B-\uFF3E\uFF40\uFF5B-\uFF65\uFFBF-\uFFC1\uFFC8\uFFC9\uFFD0\uFFD1\uFFD8\uFFD9\uFFDD-\uFFFF]|\uD800[\uDC0C\uDC27\uDC3B\uDC3E\uDC4E\uDC4F\uDC5E-\uDC7F\uDCFB-\uDD3F\uDD75-\uDDFC\uDDFE-\uDE7F\uDE9D-\uDE9F\uDED1-\uDEDF\uDEE1-\uDEFF\uDF20-\uDF2C\uDF4B-\uDF4F\uDF7B-\uDF7F\uDF9E\uDF9F\uDFC4-\uDFC7\uDFD0\uDFD6-\uDFFF]|\uD801[\uDC9E\uDC9F\uDCAA-\uDCAF\uDCD4-\uDCD7\uDCFC-\uDCFF\uDD28-\uDD2F\uDD64-\uDDFF\uDF37-\uDF3F\uDF56-\uDF5F\uDF68-\uDFFF]|\uD802[\uDC06\uDC07\uDC09\uDC36\uDC39-\uDC3B\uDC3D\uDC3E\uDC56-\uDC5F\uDC77-\uDC7F\uDC9F-\uDCDF\uDCF3\uDCF6-\uDCFF\uDD16-\uDD1F\uDD3A-\uDD7F\uDDB8-\uDDBD\uDDC0-\uDDFF\uDE04\uDE07-\uDE0B\uDE14\uDE18\uDE36\uDE37\uDE3B-\uDE3E\uDE40-\uDE5F\uDE7D-\uDE7F\uDE9D-\uDEBF\uDEC8\uDEE7-\uDEFF\uDF36-\uDF3F\uDF56-\uDF5F\uDF73-\uDF7F\uDF92-\uDFFF]|\uD803[\uDC49-\uDC7F\uDCB3-\uDCBF\uDCF3-\uDCFF\uDD28-\uDD2F\uDD3A-\uDE7F\uDEAA\uDEAD-\uDEAF\uDEB2-\uDEFF\uDF1D-\uDF26\uDF28-\uDF2F\uDF51-\uDFAF\uDFC5-\uDFDF\uDFF7-\uDFFF]|\uD804[\uDC47-\uDC65\uDC70-\uDC7E\uDCBB-\uDCCF\uDCE9-\uDCEF\uDCFA-\uDCFF\uDD35\uDD40-\uDD43\uDD48-\uDD4F\uDD74\uDD75\uDD77-\uDD7F\uDDC5-\uDDC8\uDDCD\uDDDB\uDDDD-\uDDFF\uDE12\uDE38-\uDE3D\uDE3F-\uDE7F\uDE87\uDE89\uDE8E\uDE9E\uDEA9-\uDEAF\uDEEB-\uDEEF\uDEFA-\uDEFF\uDF04\uDF0D\uDF0E\uDF11\uDF12\uDF29\uDF31\uDF34\uDF3A\uDF45\uDF46\uDF49\uDF4A\uDF4E\uDF4F\uDF51-\uDF56\uDF58-\uDF5C\uDF64\uDF65\uDF6D-\uDF6F\uDF75-\uDFFF]|\uD805[\uDC4B-\uDC4F\uDC5A-\uDC5D\uDC62-\uDC7F\uDCC6\uDCC8-\uDCCF\uDCDA-\uDD7F\uDDB6\uDDB7\uDDC1-\uDDD7\uDDDE-\uDDFF\uDE41-\uDE43\uDE45-\uDE4F\uDE5A-\uDE7F\uDEB9-\uDEBF\uDECA-\uDEFF\uDF1B\uDF1C\uDF2C-\uDF2F\uDF3A-\uDFFF]|\uD806[\uDC3B-\uDC9F\uDCEA-\uDCFE\uDD07\uDD08\uDD0A\uDD0B\uDD14\uDD17\uDD36\uDD39\uDD3A\uDD44-\uDD4F\uDD5A-\uDD9F\uDDA8\uDDA9\uDDD8\uDDD9\uDDE2\uDDE5-\uDDFF\uDE3F-\uDE46\uDE48-\uDE4F\uDE9A-\uDE9C\uDE9E-\uDEBF\uDEF9-\uDFFF]|\uD807[\uDC09\uDC37\uDC41-\uDC4F\uDC5A-\uDC71\uDC90\uDC91\uDCA8\uDCB7-\uDCFF\uDD07\uDD0A\uDD37-\uDD39\uDD3B\uDD3E\uDD48-\uDD4F\uDD5A-\uDD5F\uDD66\uDD69\uDD8F\uDD92\uDD99-\uDD9F\uDDAA-\uDEDF\uDEF7-\uDFAF\uDFB1-\uDFFF]|\uD808[\uDF9A-\uDFFF]|\uD809[\uDC6F-\uDC7F\uDD44-\uDFFF]|[\uD80A\uD80B\uD80E-\uD810\uD812-\uD819\uD824-\uD82B\uD82D\uD82E\uD830-\uD833\uD837\uD839\uD83D\uD83F\uD87B-\uD87D\uD87F\uD885-\uDB3F\uDB41-\uDBFF][\uDC00-\uDFFF]|\uD80D[\uDC2F-\uDFFF]|\uD811[\uDE47-\uDFFF]|\uD81A[\uDE39-\uDE3F\uDE5F\uDE6A-\uDECF\uDEEE\uDEEF\uDEF5-\uDEFF\uDF37-\uDF3F\uDF44-\uDF4F\uDF5A-\uDF62\uDF78-\uDF7C\uDF90-\uDFFF]|\uD81B[\uDC00-\uDE3F\uDE80-\uDEFF\uDF4B-\uDF4E\uDF88-\uDF8E\uDFA0-\uDFDF\uDFE2\uDFE5-\uDFEF\uDFF2-\uDFFF]|\uD821[\uDFF8-\uDFFF]|\uD823[\uDCD6-\uDCFF\uDD09-\uDFFF]|\uD82C[\uDD1F-\uDD4F\uDD53-\uDD63\uDD68-\uDD6F\uDEFC-\uDFFF]|\uD82F[\uDC6B-\uDC6F\uDC7D-\uDC7F\uDC89-\uDC8F\uDC9A-\uDC9C\uDC9F-\uDFFF]|\uD834[\uDC00-\uDD64\uDD6A-\uDD6C\uDD73-\uDD7A\uDD83\uDD84\uDD8C-\uDDA9\uDDAE-\uDE41\uDE45-\uDFFF]|\uD835[\uDC55\uDC9D\uDCA0\uDCA1\uDCA3\uDCA4\uDCA7\uDCA8\uDCAD\uDCBA\uDCBC\uDCC4\uDD06\uDD0B\uDD0C\uDD15\uDD1D\uDD3A\uDD3F\uDD45\uDD47-\uDD49\uDD51\uDEA6\uDEA7\uDEC1\uDEDB\uDEFB\uDF15\uDF35\uDF4F\uDF6F\uDF89\uDFA9\uDFC3\uDFCC\uDFCD]|\uD836[\uDC00-\uDDFF\uDE37-\uDE3A\uDE6D-\uDE74\uDE76-\uDE83\uDE85-\uDE9A\uDEA0\uDEB0-\uDFFF]|\uD838[\uDC07\uDC19\uDC1A\uDC22\uDC25\uDC2B-\uDCFF\uDD2D-\uDD2F\uDD3E\uDD3F\uDD4A-\uDD4D\uDD4F-\uDEBF\uDEFA-\uDFFF]|\uD83A[\uDCC5-\uDCCF\uDCD7-\uDCFF\uDD4C-\uDD4F\uDD5A-\uDFFF]|\uD83B[\uDC00-\uDDFF\uDE04\uDE20\uDE23\uDE25\uDE26\uDE28\uDE33\uDE38\uDE3A\uDE3C-\uDE41\uDE43-\uDE46\uDE48\uDE4A\uDE4C\uDE50\uDE53\uDE55\uDE56\uDE58\uDE5A\uDE5C\uDE5E\uDE60\uDE63\uDE65\uDE66\uDE6B\uDE73\uDE78\uDE7D\uDE7F\uDE8A\uDE9C-\uDEA0\uDEA4\uDEAA\uDEBC-\uDFFF]|\uD83C[\uDC00-\uDD2F\uDD4A-\uDD4F\uDD6A-\uDD6F\uDD8A-\uDFFF]|\uD83E[\uDC00-\uDFEF\uDFFA-\uDFFF]|\uD869[\uDEDE-\uDEFF]|\uD86D[\uDF35-\uDF3F]|\uD86E[\uDC1E\uDC1F]|\uD873[\uDEA2-\uDEAF]|\uD87A[\uDFE1-\uDFFF]|\uD87E[\uDE1E-\uDFFF]|\uD884[\uDF4B-\uDFFF]|\uDB40[\uDC00-\uDCFF\uDDF0-\uDFFF]/g;
+
+// node_modules/github-slugger/index.js
+var own = Object.hasOwnProperty;
+
+class BananaSlug {
+  constructor() {
+    this.occurrences;
+    this.reset();
+  }
+  slug(value, maintainCase) {
+    const self = this;
+    let result = slug(value, maintainCase === true);
+    const originalSlug = result;
+    while (own.call(self.occurrences, result)) {
+      self.occurrences[originalSlug]++;
+      result = originalSlug + "-" + self.occurrences[originalSlug];
+    }
+    self.occurrences[result] = 0;
+    return result;
+  }
+  reset() {
+    this.occurrences = Object.create(null);
+  }
 }
-function finalizeIssues(issues, strict) {
-  if (!strict)
-    return issues;
-  return issues.map((i) => i.severity === "warning" ? { ...i, severity: "error" } : i);
+function slug(value, maintainCase) {
+  if (typeof value !== "string")
+    return "";
+  if (!maintainCase)
+    value = value.toLowerCase();
+  return value.replace(regex, "").replace(/ /g, "-");
 }
-function printReport(issues, options) {
-  const finalized = finalizeIssues(issues, options.strict ?? false);
-  const errors2 = finalized.filter((i) => i.severity === "error");
-  const warnings = finalized.filter((i) => i.severity === "warning");
-  const label = options.label ?? "Audit";
-  if (options.json) {
-    console.log(JSON.stringify({
-      label,
-      fileCount: options.fileCount,
-      errors: errors2.length,
-      warnings: warnings.length,
-      issues: finalized
-    }, null, 2));
-    return errors2.length > 0 ? 1 : 0;
-  }
-  if (warnings.length > 0) {
-    console.log(`${label} warnings:
-`);
-    for (const i of warnings) {
-      const linkPart = i.link ? ` (${i.link})` : "";
-      console.log(`- ${i.file}${linkPart}: ${i.message}`);
-    }
-    console.log("");
-  }
-  if (errors2.length === 0) {
-    const warnNote = warnings.length > 0 ? `, ${warnings.length} warning(s)` : "";
-    const countNote = options.successSuffix ?? (options.fileCount !== undefined ? ` (${options.fileCount} files scanned${warnNote})` : "");
-    console.log(`${label} passed${countNote}.`);
-    return 0;
-  }
-  console.log(`${label} failed:
-`);
-  for (const i of errors2) {
-    const linkPart = i.link ? ` (${i.link})` : "";
-    console.log(`- ${i.file}${linkPart}: ${i.message}`);
-  }
-  return 1;
-}
-
-// src/references/check.ts
-import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync5 } from "node:fs";
-import { join as join6, relative as relative6 } from "node:path";
-
-// src/references/constants.ts
-var CANONICAL_REFS_DIR = ".skeleton/references";
-var GENERATED_MARKER_START = "<!-- skeleton: generated-reference";
-var GENERATED_MARKER_RE = /<!-- skeleton: generated-reference\s*\nsource: ([^\n]+)\s*\nredundancy: intentional\s*\n-->\s*\n?/;
-var SHARED_REF_LINK_RE = /\((?:\.\.\/)+references\/([^)]+)\)/g;
-function formatGeneratedHeader(sourceRelPath) {
-  return `${GENERATED_MARKER_START}
-source: ${sourceRelPath}
-redundancy: intentional
--->
 
-`;
-}
-function stripGeneratedHeader(content) {
-  return content.replace(GENERATED_MARKER_RE, "");
-}
-function isGeneratedReference(content) {
-  return content.startsWith(GENERATED_MARKER_START);
-}
+// node_modules/devlop/lib/development.js
+var codesWarned = new Set;
 
-// src/references/discover.ts
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "node:fs";
-import { join as join5, relative as relative5 } from "node:path";
-function walkMarkdownFiles(dir, root) {
-  const files = [];
-  if (!existsSync5(dir))
-    return files;
-  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith("."))
-      continue;
-    const fullPath = join5(dir, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...walkMarkdownFiles(fullPath, root));
-      continue;
-    }
-    if (entry.name.endsWith(".md")) {
-      files.push(normalizeRelPath(relative5(root, fullPath)));
-    }
-  }
-  return files;
-}
-function canonicalExists(root, refPath) {
-  return existsSync5(join5(root, CANONICAL_REFS_DIR, refPath));
-}
-function findSharedRefLinks(content, sourceFile) {
-  const links = [];
-  for (const match of content.matchAll(SHARED_REF_LINK_RE)) {
-    const refPath = match[1];
-    if (!refPath)
-      continue;
-    links.push({ refPath: normalizeRelPath(refPath), sourceFile });
-  }
-  return links;
-}
-function findLocalCanonicalLinks(root, content, sourceFile) {
-  const links = [];
-  const localRefRe = /\((?:\.\/)?references\/([^)]+)\)/g;
-  for (const match of content.matchAll(localRefRe)) {
-    const refPath = normalizeRelPath(match[1] ?? "");
-    if (!refPath || !canonicalExists(root, refPath))
-      continue;
-    links.push({ refPath, sourceFile });
-  }
-  const inReferencesDir = /\/references\//.test(sourceFile);
-  if (inReferencesDir) {
-    const refsIdx = sourceFile.lastIndexOf("/references/");
-    const withinRefs = sourceFile.slice(refsIdx + "/references/".length);
-    const withinDir = withinRefs.includes("/") ? withinRefs.slice(0, withinRefs.lastIndexOf("/")) : "";
-    const siblingRe = /\((?!https?:|#|\.\.\/)([a-z0-9./_-]+\.md)\)/gi;
-    for (const match of content.matchAll(siblingRe)) {
-      const raw = normalizeRelPath(match[1] ?? "");
-      if (!raw)
-        continue;
-      const refPath = withinDir ? normalizeRelPath(join5(withinDir, raw)) : raw;
-      if (!canonicalExists(root, refPath))
-        continue;
-      links.push({ refPath, sourceFile });
-    }
-  }
-  return links;
-}
-function discoverSkillReferencePlans(root) {
-  const index = buildSkillIndex(root);
-  const plans = [];
-  for (const slug of index.slugs) {
-    const skillDir = join5(root, slug);
-    if (!existsSync5(join5(skillDir, "SKILL.md")))
-      continue;
-    const refPaths = new Set;
-    const links = [];
-    for (const relFile of walkMarkdownFiles(skillDir, root)) {
-      const content = readFileSync4(join5(root, relFile), "utf8");
-      if (isGeneratedReference(content))
-        continue;
-      for (const link of findSharedRefLinks(content, relFile)) {
-        refPaths.add(link.refPath);
-        links.push(link);
-      }
-      for (const link of findLocalCanonicalLinks(root, content, relFile)) {
-        refPaths.add(link.refPath);
-        links.push(link);
-      }
-    }
-    const queue = [...refPaths];
-    while (queue.length > 0) {
-      const refPath = queue.pop();
-      if (!refPath || !canonicalExists(root, refPath))
-        continue;
-      const canonicalContent = readFileSync4(join5(root, CANONICAL_REFS_DIR, refPath), "utf8");
-      const syntheticSource = generatedRefPath(slug, refPath);
-      for (const link of findLocalCanonicalLinks(root, canonicalContent, syntheticSource)) {
-        if (refPaths.has(link.refPath))
-          continue;
-        refPaths.add(link.refPath);
-        links.push(link);
-        queue.push(link.refPath);
-      }
-    }
-    if (refPaths.size > 0) {
-      plans.push({ skill: slug, refPaths, links });
+class AssertionError extends Error {
+  name = "Assertion";
+  code = "ERR_ASSERTION";
+  constructor(message, actual, expected, operator, generated) {
+    super(message);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
     }
+    this.actual = actual;
+    this.expected = expected;
+    this.generated = generated;
+    this.operator = operator;
   }
-  return plans.sort((a, b) => a.skill.localeCompare(b.skill));
 }
-function generatedRefPath(skill, refPath) {
-  return normalizeRelPath(join5(skill, "references", refPath));
+function ok(value, message) {
+  assert(Boolean(value), false, true, "ok", "Expected value to be truthy", message);
 }
-function rewriteSharedRefTarget(sourceFile, skill, refPath) {
-  const sourceDir = sourceFile.slice(0, sourceFile.lastIndexOf("/"));
-  const target = generatedRefPath(skill, refPath);
-  if (!sourceDir)
-    return target;
-  const fromParts = sourceDir.split("/");
-  const toParts = target.split("/");
-  let i = 0;
-  while (i < fromParts.length && i < toParts.length && fromParts[i] === toParts[i]) {
-    i++;
+function assert(bool, actual, expected, operator, defaultMessage, userMessage) {
+  if (!bool) {
+    throw userMessage instanceof Error ? userMessage : new AssertionError(userMessage || defaultMessage, actual, expected, operator, !userMessage);
   }
-  const ups = fromParts.length - i;
-  const down = toParts.slice(i);
-  const rel = [...Array(ups).fill(".."), ...down].join("/");
-  return rel || (toParts.at(-1) ?? refPath);
-}
-function rewriteSharedRefLinks(content, sourceFile, skill) {
-  return content.replace(SHARED_REF_LINK_RE, (_match, refPath) => {
-    const rewritten = rewriteSharedRefTarget(sourceFile, skill, normalizeRelPath(refPath));
-    return `(${rewritten})`;
-  });
 }
 
-// src/references/check.ts
-function listAllGeneratedFiles(root) {
-  const files = [];
-  const walk = (dir) => {
-    if (!existsSync6(dir))
-      return;
-    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-      if (entry.name.startsWith("."))
-        continue;
-      const fullPath = join6(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(fullPath);
-        continue;
-      }
-      if (!entry.name.endsWith(".md"))
-        continue;
-      const content = readFileSync5(fullPath, "utf8");
-      if (isGeneratedReference(content)) {
-        files.push(normalizeRelPath(relative6(root, fullPath)));
-      }
-    }
-  };
-  walk(root);
-  return files;
+// node_modules/mdast-util-to-string/lib/index.js
+var emptyOptions = {};
+function toString(value, options) {
+  const settings = options || emptyOptions;
+  const includeImageAlt = typeof settings.includeImageAlt === "boolean" ? settings.includeImageAlt : true;
+  const includeHtml = typeof settings.includeHtml === "boolean" ? settings.includeHtml : true;
+  return one(value, includeImageAlt, includeHtml);
 }
-function runGeneratedReferencesCheck(root) {
-  const issues = [];
-  const canonicalDir = join6(root, CANONICAL_REFS_DIR);
-  if (!existsSync6(canonicalDir))
-    return issues;
-  const plans = discoverSkillReferencePlans(root);
-  const needed = new Set;
-  for (const plan of plans) {
-    for (const refPath of plan.refPaths) {
-      needed.add(generatedRefPath(plan.skill, refPath));
-    }
-  }
-  for (const targetRel of needed) {
-    const targetPath = join6(root, targetRel);
-    if (!existsSync6(targetPath)) {
-      issues.push(issue("generated-references", targetRel, "missing generated copy — run skeleton references sync"));
-      continue;
-    }
-    const generated = readFileSync5(targetPath, "utf8");
-    if (!isGeneratedReference(generated)) {
-      issues.push(issue("generated-references", targetRel, "expected generated-reference provenance header"));
-      continue;
-    }
-    const body = stripGeneratedHeader(generated);
-    const sourceRel = normalizeRelPath(generated.match(/source: ([^\n]+)/)?.[1] ?? join6(CANONICAL_REFS_DIR, targetRel.split("/references/")[1] ?? ""));
-    const canonicalPath = join6(root, sourceRel);
-    if (!existsSync6(canonicalPath)) {
-      issues.push(issue("generated-references", targetRel, `canonical source missing: ${sourceRel}`));
-      continue;
+function one(value, includeImageAlt, includeHtml) {
+  if (node(value)) {
+    if ("value" in value) {
+      return value.type === "html" && !includeHtml ? "" : value.value;
     }
-    const canonical = readFileSync5(canonicalPath, "utf8");
-    if (body !== canonical) {
-      issues.push(issue("generated-references", targetRel, "stale generated copy — run skeleton references sync"));
+    if (includeImageAlt && "alt" in value && value.alt) {
+      return value.alt;
     }
-  }
-  for (const generatedRel of listAllGeneratedFiles(root)) {
-    if (!needed.has(generatedRel)) {
-      issues.push(issue("generated-references", generatedRel, "orphaned generated copy — run skeleton references sync"));
+    if ("children" in value) {
+      return all(value.children, includeImageAlt, includeHtml);
     }
   }
-  for (const plan of plans) {
-    const skillDir = join6(root, plan.skill);
-    if (!existsSync6(skillDir))
-      continue;
-    const walk = (dir) => {
-      for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-        if (entry.name.startsWith("."))
-          continue;
-        const fullPath = join6(dir, entry.name);
-        if (entry.isDirectory()) {
-          walk(fullPath);
-          continue;
-        }
-        if (!entry.name.endsWith(".md"))
-          continue;
-        const relFile = normalizeRelPath(relative6(root, fullPath));
-        const content = readFileSync5(fullPath, "utf8");
-        if (content.match(SHARED_REF_LINK_RE)) {
-          issues.push(issue("generated-references", relFile, "still links to shared root references/ — run skeleton references sync"));
-        }
-      }
-    };
-    walk(skillDir);
+  if (Array.isArray(value)) {
+    return all(value, includeImageAlt, includeHtml);
   }
-  return issues;
-}
-function runGeneratedReferencesRule(ctx) {
-  return runGeneratedReferencesCheck(ctx.root);
+  return "";
 }
-var generatedReferencesRule = {
-  id: "generated-references",
-  global: true,
-  run: runGeneratedReferencesRule
-};
-
-// src/audit/rules/banned.ts
-function runBannedRule(ctx) {
-  const issues = [];
-  for (const abs of collectBannedFiles(ctx.config, ctx.root)) {
-    const rel = relPath(abs, ctx.root);
-    issues.push(issue("banned", rel, "file matches scan.banned — must not exist in repo"));
+function all(values, includeImageAlt, includeHtml) {
+  const result = [];
+  let index = -1;
+  while (++index < values.length) {
+    result[index] = one(values[index], includeImageAlt, includeHtml);
   }
-  return issues;
-}
-var bannedRule = { id: "banned", run: runBannedRule };
-
-// src/audit/rules/doc-meta.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
-import { join as join7 } from "node:path";
-
-// src/audit/core/git-meta.ts
-import { spawnSync } from "node:child_process";
-function lastGitCommitDate(relPath2, root) {
-  const proc = spawnSync("git", ["log", "-1", "--format=%cs", "--", relPath2], {
-    cwd: root,
-    encoding: "utf8"
-  });
-  if (proc.status !== 0)
-    return null;
-  const date = proc.stdout.trim();
-  return date || null;
-}
-
-// src/audit/rules/doc-meta.ts
-function runDocMetaRule(ctx) {
-  const issues = [];
-  const today = new Date;
-  for (const relPath2 of ctx.docMetaPaths) {
-    const abs = join7(ctx.root, relPath2);
-    if (!existsSync7(abs))
-      continue;
-    const content = readFileSync6(abs, "utf8");
-    if (!DOC_META_RE.test(content)) {
-      issues.push(issue("doc-meta", relPath2, "missing doc-meta comment (owner + last-reviewed)"));
-      continue;
-    }
-    const match = DOC_META_LAST_REVIEWED_RE.exec(content);
-    if (!match?.[1])
-      continue;
-    const reviewed = new Date(`${match[1]}T00:00:00Z`);
-    if (Number.isNaN(reviewed.getTime()))
-      continue;
-    const ageDays = (today.getTime() - reviewed.getTime()) / 86400000;
-    if (ageDays > ctx.config.daysUntilStale) {
-      issues.push(issue("doc-meta", relPath2, `doc-meta last-reviewed ${match[1]} is stale (>${ctx.config.daysUntilStale} days)`, { severity: "warning" }));
-    }
-    const gitDate = lastGitCommitDate(relPath2, ctx.root);
-    if (!gitDate)
-      continue;
-    const committed = new Date(`${gitDate}T00:00:00Z`);
-    if (Number.isNaN(committed.getTime()))
-      continue;
-    if (committed.getTime() > reviewed.getTime()) {
-      issues.push(issue("doc-meta", relPath2, `content changed after last-reviewed ${match[1]} (git: ${gitDate}) — bump last-reviewed or confirm review`, { severity: "warning" }));
-    }
-  }
-  return issues;
-}
-var docMetaRule = { id: "doc-meta", run: runDocMetaRule };
-
-// src/audit/rules/links.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
-
-// node_modules/github-slugger/regex.js
-var regex = /[\0-\x1F!-,\.\/:-@\[-\^`\{-\xA9\xAB-\xB4\xB6-\xB9\xBB-\xBF\xD7\xF7\u02C2-\u02C5\u02D2-\u02DF\u02E5-\u02EB\u02ED\u02EF-\u02FF\u0375\u0378\u0379\u037E\u0380-\u0385\u0387\u038B\u038D\u03A2\u03F6\u0482\u0530\u0557\u0558\u055A-\u055F\u0589-\u0590\u05BE\u05C0\u05C3\u05C6\u05C8-\u05CF\u05EB-\u05EE\u05F3-\u060F\u061B-\u061F\u066A-\u066D\u06D4\u06DD\u06DE\u06E9\u06FD\u06FE\u0700-\u070F\u074B\u074C\u07B2-\u07BF\u07F6-\u07F9\u07FB\u07FC\u07FE\u07FF\u082E-\u083F\u085C-\u085F\u086B-\u089F\u08B5\u08C8-\u08D2\u08E2\u0964\u0965\u0970\u0984\u098D\u098E\u0991\u0992\u09A9\u09B1\u09B3-\u09B5\u09BA\u09BB\u09C5\u09C6\u09C9\u09CA\u09CF-\u09D6\u09D8-\u09DB\u09DE\u09E4\u09E5\u09F2-\u09FB\u09FD\u09FF\u0A00\u0A04\u0A0B-\u0A0E\u0A11\u0A12\u0A29\u0A31\u0A34\u0A37\u0A3A\u0A3B\u0A3D\u0A43-\u0A46\u0A49\u0A4A\u0A4E-\u0A50\u0A52-\u0A58\u0A5D\u0A5F-\u0A65\u0A76-\u0A80\u0A84\u0A8E\u0A92\u0AA9\u0AB1\u0AB4\u0ABA\u0ABB\u0AC6\u0ACA\u0ACE\u0ACF\u0AD1-\u0ADF\u0AE4\u0AE5\u0AF0-\u0AF8\u0B00\u0B04\u0B0D\u0B0E\u0B11\u0B12\u0B29\u0B31\u0B34\u0B3A\u0B3B\u0B45\u0B46\u0B49\u0B4A\u0B4E-\u0B54\u0B58-\u0B5B\u0B5E\u0B64\u0B65\u0B70\u0B72-\u0B81\u0B84\u0B8B-\u0B8D\u0B91\u0B96-\u0B98\u0B9B\u0B9D\u0BA0-\u0BA2\u0BA5-\u0BA7\u0BAB-\u0BAD\u0BBA-\u0BBD\u0BC3-\u0BC5\u0BC9\u0BCE\u0BCF\u0BD1-\u0BD6\u0BD8-\u0BE5\u0BF0-\u0BFF\u0C0D\u0C11\u0C29\u0C3A-\u0C3C\u0C45\u0C49\u0C4E-\u0C54\u0C57\u0C5B-\u0C5F\u0C64\u0C65\u0C70-\u0C7F\u0C84\u0C8D\u0C91\u0CA9\u0CB4\u0CBA\u0CBB\u0CC5\u0CC9\u0CCE-\u0CD4\u0CD7-\u0CDD\u0CDF\u0CE4\u0CE5\u0CF0\u0CF3-\u0CFF\u0D0D\u0D11\u0D45\u0D49\u0D4F-\u0D53\u0D58-\u0D5E\u0D64\u0D65\u0D70-\u0D79\u0D80\u0D84\u0D97-\u0D99\u0DB2\u0DBC\u0DBE\u0DBF\u0DC7-\u0DC9\u0DCB-\u0DCE\u0DD5\u0DD7\u0DE0-\u0DE5\u0DF0\u0DF1\u0DF4-\u0E00\u0E3B-\u0E3F\u0E4F\u0E5A-\u0E80\u0E83\u0E85\u0E8B\u0EA4\u0EA6\u0EBE\u0EBF\u0EC5\u0EC7\u0ECE\u0ECF\u0EDA\u0EDB\u0EE0-\u0EFF\u0F01-\u0F17\u0F1A-\u0F1F\u0F2A-\u0F34\u0F36\u0F38\u0F3A-\u0F3D\u0F48\u0F6D-\u0F70\u0F85\u0F98\u0FBD-\u0FC5\u0FC7-\u0FFF\u104A-\u104F\u109E\u109F\u10C6\u10C8-\u10CC\u10CE\u10CF\u10FB\u1249\u124E\u124F\u1257\u1259\u125E\u125F\u1289\u128E\u128F\u12B1\u12B6\u12B7\u12BF\u12C1\u12C6\u12C7\u12D7\u1311\u1316\u1317\u135B\u135C\u1360-\u137F\u1390-\u139F\u13F6\u13F7\u13FE-\u1400\u166D\u166E\u1680\u169B-\u169F\u16EB-\u16ED\u16F9-\u16FF\u170D\u1715-\u171F\u1735-\u173F\u1754-\u175F\u176D\u1771\u1774-\u177F\u17D4-\u17D6\u17D8-\u17DB\u17DE\u17DF\u17EA-\u180A\u180E\u180F\u181A-\u181F\u1879-\u187F\u18AB-\u18AF\u18F6-\u18FF\u191F\u192C-\u192F\u193C-\u1945\u196E\u196F\u1975-\u197F\u19AC-\u19AF\u19CA-\u19CF\u19DA-\u19FF\u1A1C-\u1A1F\u1A5F\u1A7D\u1A7E\u1A8A-\u1A8F\u1A9A-\u1AA6\u1AA8-\u1AAF\u1AC1-\u1AFF\u1B4C-\u1B4F\u1B5A-\u1B6A\u1B74-\u1B7F\u1BF4-\u1BFF\u1C38-\u1C3F\u1C4A-\u1C4C\u1C7E\u1C7F\u1C89-\u1C8F\u1CBB\u1CBC\u1CC0-\u1CCF\u1CD3\u1CFB-\u1CFF\u1DFA\u1F16\u1F17\u1F1E\u1F1F\u1F46\u1F47\u1F4E\u1F4F\u1F58\u1F5A\u1F5C\u1F5E\u1F7E\u1F7F\u1FB5\u1FBD\u1FBF-\u1FC1\u1FC5\u1FCD-\u1FCF\u1FD4\u1FD5\u1FDC-\u1FDF\u1FED-\u1FF1\u1FF5\u1FFD-\u203E\u2041-\u2053\u2055-\u2070\u2072-\u207E\u2080-\u208F\u209D-\u20CF\u20F1-\u2101\u2103-\u2106\u2108\u2109\u2114\u2116-\u2118\u211E-\u2123\u2125\u2127\u2129\u212E\u213A\u213B\u2140-\u2144\u214A-\u214D\u214F-\u215F\u2189-\u24B5\u24EA-\u2BFF\u2C2F\u2C5F\u2CE5-\u2CEA\u2CF4-\u2CFF\u2D26\u2D28-\u2D2C\u2D2E\u2D2F\u2D68-\u2D6E\u2D70-\u2D7E\u2D97-\u2D9F\u2DA7\u2DAF\u2DB7\u2DBF\u2DC7\u2DCF\u2DD7\u2DDF\u2E00-\u2E2E\u2E30-\u3004\u3008-\u3020\u3030\u3036\u3037\u303D-\u3040\u3097\u3098\u309B\u309C\u30A0\u30FB\u3100-\u3104\u3130\u318F-\u319F\u31C0-\u31EF\u3200-\u33FF\u4DC0-\u4DFF\u9FFD-\u9FFF\uA48D-\uA4CF\uA4FE\uA4FF\uA60D-\uA60F\uA62C-\uA63F\uA673\uA67E\uA6F2-\uA716\uA720\uA721\uA789\uA78A\uA7C0\uA7C1\uA7CB-\uA7F4\uA828-\uA82B\uA82D-\uA83F\uA874-\uA87F\uA8C6-\uA8CF\uA8DA-\uA8DF\uA8F8-\uA8FA\uA8FC\uA92E\uA92F\uA954-\uA95F\uA97D-\uA97F\uA9C1-\uA9CE\uA9DA-\uA9DF\uA9FF\uAA37-\uAA3F\uAA4E\uAA4F\uAA5A-\uAA5F\uAA77-\uAA79\uAAC3-\uAADA\uAADE\uAADF\uAAF0\uAAF1\uAAF7-\uAB00\uAB07\uAB08\uAB0F\uAB10\uAB17-\uAB1F\uAB27\uAB2F\uAB5B\uAB6A-\uAB6F\uABEB\uABEE\uABEF\uABFA-\uABFF\uD7A4-\uD7AF\uD7C7-\uD7CA\uD7FC-\uD7FF\uE000-\uF8FF\uFA6E\uFA6F\uFADA-\uFAFF\uFB07-\uFB12\uFB18-\uFB1C\uFB29\uFB37\uFB3D\uFB3F\uFB42\uFB45\uFBB2-\uFBD2\uFD3E-\uFD4F\uFD90\uFD91\uFDC8-\uFDEF\uFDFC-\uFDFF\uFE10-\uFE1F\uFE30-\uFE32\uFE35-\uFE4C\uFE50-\uFE6F\uFE75\uFEFD-\uFF0F\uFF1A-\uFF20\uFF3B-\uFF3E\uFF40\uFF5B-\uFF65\uFFBF-\uFFC1\uFFC8\uFFC9\uFFD0\uFFD1\uFFD8\uFFD9\uFFDD-\uFFFF]|\uD800[\uDC0C\uDC27\uDC3B\uDC3E\uDC4E\uDC4F\uDC5E-\uDC7F\uDCFB-\uDD3F\uDD75-\uDDFC\uDDFE-\uDE7F\uDE9D-\uDE9F\uDED1-\uDEDF\uDEE1-\uDEFF\uDF20-\uDF2C\uDF4B-\uDF4F\uDF7B-\uDF7F\uDF9E\uDF9F\uDFC4-\uDFC7\uDFD0\uDFD6-\uDFFF]|\uD801[\uDC9E\uDC9F\uDCAA-\uDCAF\uDCD4-\uDCD7\uDCFC-\uDCFF\uDD28-\uDD2F\uDD64-\uDDFF\uDF37-\uDF3F\uDF56-\uDF5F\uDF68-\uDFFF]|\uD802[\uDC06\uDC07\uDC09\uDC36\uDC39-\uDC3B\uDC3D\uDC3E\uDC56-\uDC5F\uDC77-\uDC7F\uDC9F-\uDCDF\uDCF3\uDCF6-\uDCFF\uDD16-\uDD1F\uDD3A-\uDD7F\uDDB8-\uDDBD\uDDC0-\uDDFF\uDE04\uDE07-\uDE0B\uDE14\uDE18\uDE36\uDE37\uDE3B-\uDE3E\uDE40-\uDE5F\uDE7D-\uDE7F\uDE9D-\uDEBF\uDEC8\uDEE7-\uDEFF\uDF36-\uDF3F\uDF56-\uDF5F\uDF73-\uDF7F\uDF92-\uDFFF]|\uD803[\uDC49-\uDC7F\uDCB3-\uDCBF\uDCF3-\uDCFF\uDD28-\uDD2F\uDD3A-\uDE7F\uDEAA\uDEAD-\uDEAF\uDEB2-\uDEFF\uDF1D-\uDF26\uDF28-\uDF2F\uDF51-\uDFAF\uDFC5-\uDFDF\uDFF7-\uDFFF]|\uD804[\uDC47-\uDC65\uDC70-\uDC7E\uDCBB-\uDCCF\uDCE9-\uDCEF\uDCFA-\uDCFF\uDD35\uDD40-\uDD43\uDD48-\uDD4F\uDD74\uDD75\uDD77-\uDD7F\uDDC5-\uDDC8\uDDCD\uDDDB\uDDDD-\uDDFF\uDE12\uDE38-\uDE3D\uDE3F-\uDE7F\uDE87\uDE89\uDE8E\uDE9E\uDEA9-\uDEAF\uDEEB-\uDEEF\uDEFA-\uDEFF\uDF04\uDF0D\uDF0E\uDF11\uDF12\uDF29\uDF31\uDF34\uDF3A\uDF45\uDF46\uDF49\uDF4A\uDF4E\uDF4F\uDF51-\uDF56\uDF58-\uDF5C\uDF64\uDF65\uDF6D-\uDF6F\uDF75-\uDFFF]|\uD805[\uDC4B-\uDC4F\uDC5A-\uDC5D\uDC62-\uDC7F\uDCC6\uDCC8-\uDCCF\uDCDA-\uDD7F\uDDB6\uDDB7\uDDC1-\uDDD7\uDDDE-\uDDFF\uDE41-\uDE43\uDE45-\uDE4F\uDE5A-\uDE7F\uDEB9-\uDEBF\uDECA-\uDEFF\uDF1B\uDF1C\uDF2C-\uDF2F\uDF3A-\uDFFF]|\uD806[\uDC3B-\uDC9F\uDCEA-\uDCFE\uDD07\uDD08\uDD0A\uDD0B\uDD14\uDD17\uDD36\uDD39\uDD3A\uDD44-\uDD4F\uDD5A-\uDD9F\uDDA8\uDDA9\uDDD8\uDDD9\uDDE2\uDDE5-\uDDFF\uDE3F-\uDE46\uDE48-\uDE4F\uDE9A-\uDE9C\uDE9E-\uDEBF\uDEF9-\uDFFF]|\uD807[\uDC09\uDC37\uDC41-\uDC4F\uDC5A-\uDC71\uDC90\uDC91\uDCA8\uDCB7-\uDCFF\uDD07\uDD0A\uDD37-\uDD39\uDD3B\uDD3E\uDD48-\uDD4F\uDD5A-\uDD5F\uDD66\uDD69\uDD8F\uDD92\uDD99-\uDD9F\uDDAA-\uDEDF\uDEF7-\uDFAF\uDFB1-\uDFFF]|\uD808[\uDF9A-\uDFFF]|\uD809[\uDC6F-\uDC7F\uDD44-\uDFFF]|[\uD80A\uD80B\uD80E-\uD810\uD812-\uD819\uD824-\uD82B\uD82D\uD82E\uD830-\uD833\uD837\uD839\uD83D\uD83F\uD87B-\uD87D\uD87F\uD885-\uDB3F\uDB41-\uDBFF][\uDC00-\uDFFF]|\uD80D[\uDC2F-\uDFFF]|\uD811[\uDE47-\uDFFF]|\uD81A[\uDE39-\uDE3F\uDE5F\uDE6A-\uDECF\uDEEE\uDEEF\uDEF5-\uDEFF\uDF37-\uDF3F\uDF44-\uDF4F\uDF5A-\uDF62\uDF78-\uDF7C\uDF90-\uDFFF]|\uD81B[\uDC00-\uDE3F\uDE80-\uDEFF\uDF4B-\uDF4E\uDF88-\uDF8E\uDFA0-\uDFDF\uDFE2\uDFE5-\uDFEF\uDFF2-\uDFFF]|\uD821[\uDFF8-\uDFFF]|\uD823[\uDCD6-\uDCFF\uDD09-\uDFFF]|\uD82C[\uDD1F-\uDD4F\uDD53-\uDD63\uDD68-\uDD6F\uDEFC-\uDFFF]|\uD82F[\uDC6B-\uDC6F\uDC7D-\uDC7F\uDC89-\uDC8F\uDC9A-\uDC9C\uDC9F-\uDFFF]|\uD834[\uDC00-\uDD64\uDD6A-\uDD6C\uDD73-\uDD7A\uDD83\uDD84\uDD8C-\uDDA9\uDDAE-\uDE41\uDE45-\uDFFF]|\uD835[\uDC55\uDC9D\uDCA0\uDCA1\uDCA3\uDCA4\uDCA7\uDCA8\uDCAD\uDCBA\uDCBC\uDCC4\uDD06\uDD0B\uDD0C\uDD15\uDD1D\uDD3A\uDD3F\uDD45\uDD47-\uDD49\uDD51\uDEA6\uDEA7\uDEC1\uDEDB\uDEFB\uDF15\uDF35\uDF4F\uDF6F\uDF89\uDFA9\uDFC3\uDFCC\uDFCD]|\uD836[\uDC00-\uDDFF\uDE37-\uDE3A\uDE6D-\uDE74\uDE76-\uDE83\uDE85-\uDE9A\uDEA0\uDEB0-\uDFFF]|\uD838[\uDC07\uDC19\uDC1A\uDC22\uDC25\uDC2B-\uDCFF\uDD2D-\uDD2F\uDD3E\uDD3F\uDD4A-\uDD4D\uDD4F-\uDEBF\uDEFA-\uDFFF]|\uD83A[\uDCC5-\uDCCF\uDCD7-\uDCFF\uDD4C-\uDD4F\uDD5A-\uDFFF]|\uD83B[\uDC00-\uDDFF\uDE04\uDE20\uDE23\uDE25\uDE26\uDE28\uDE33\uDE38\uDE3A\uDE3C-\uDE41\uDE43-\uDE46\uDE48\uDE4A\uDE4C\uDE50\uDE53\uDE55\uDE56\uDE58\uDE5A\uDE5C\uDE5E\uDE60\uDE63\uDE65\uDE66\uDE6B\uDE73\uDE78\uDE7D\uDE7F\uDE8A\uDE9C-\uDEA0\uDEA4\uDEAA\uDEBC-\uDFFF]|\uD83C[\uDC00-\uDD2F\uDD4A-\uDD4F\uDD6A-\uDD6F\uDD8A-\uDFFF]|\uD83E[\uDC00-\uDFEF\uDFFA-\uDFFF]|\uD869[\uDEDE-\uDEFF]|\uD86D[\uDF35-\uDF3F]|\uD86E[\uDC1E\uDC1F]|\uD873[\uDEA2-\uDEAF]|\uD87A[\uDFE1-\uDFFF]|\uD87E[\uDE1E-\uDFFF]|\uD884[\uDF4B-\uDFFF]|\uDB40[\uDC00-\uDCFF\uDDF0-\uDFFF]/g;
-
-// node_modules/github-slugger/index.js
-var own = Object.hasOwnProperty;
-
-class BananaSlug {
-  constructor() {
-    this.occurrences;
-    this.reset();
-  }
-  slug(value, maintainCase) {
-    const self = this;
-    let result = slug(value, maintainCase === true);
-    const originalSlug = result;
-    while (own.call(self.occurrences, result)) {
-      self.occurrences[originalSlug]++;
-      result = originalSlug + "-" + self.occurrences[originalSlug];
-    }
-    self.occurrences[result] = 0;
-    return result;
-  }
-  reset() {
-    this.occurrences = Object.create(null);
-  }
-}
-function slug(value, maintainCase) {
-  if (typeof value !== "string")
-    return "";
-  if (!maintainCase)
-    value = value.toLowerCase();
-  return value.replace(regex, "").replace(/ /g, "-");
-}
-
-// node_modules/devlop/lib/development.js
-var codesWarned = new Set;
-
-class AssertionError extends Error {
-  name = "Assertion";
-  code = "ERR_ASSERTION";
-  constructor(message, actual, expected, operator, generated) {
-    super(message);
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, this.constructor);
-    }
-    this.actual = actual;
-    this.expected = expected;
-    this.generated = generated;
-    this.operator = operator;
-  }
-}
-function ok(value, message) {
-  assert(Boolean(value), false, true, "ok", "Expected value to be truthy", message);
-}
-function assert(bool, actual, expected, operator, defaultMessage, userMessage) {
-  if (!bool) {
-    throw userMessage instanceof Error ? userMessage : new AssertionError(userMessage || defaultMessage, actual, expected, operator, !userMessage);
-  }
-}
-
-// node_modules/mdast-util-to-string/lib/index.js
-var emptyOptions = {};
-function toString(value, options) {
-  const settings = options || emptyOptions;
-  const includeImageAlt = typeof settings.includeImageAlt === "boolean" ? settings.includeImageAlt : true;
-  const includeHtml = typeof settings.includeHtml === "boolean" ? settings.includeHtml : true;
-  return one(value, includeImageAlt, includeHtml);
-}
-function one(value, includeImageAlt, includeHtml) {
-  if (node(value)) {
-    if ("value" in value) {
-      return value.type === "html" && !includeHtml ? "" : value.value;
-    }
-    if (includeImageAlt && "alt" in value && value.alt) {
-      return value.alt;
-    }
-    if ("children" in value) {
-      return all(value.children, includeImageAlt, includeHtml);
-    }
-  }
-  if (Array.isArray(value)) {
-    return all(value, includeImageAlt, includeHtml);
-  }
-  return "";
-}
-function all(values, includeImageAlt, includeHtml) {
-  const result = [];
-  let index = -1;
-  while (++index < values.length) {
-    result[index] = one(values[index], includeImageAlt, includeHtml);
-  }
-  return result.join("");
+  return result.join("");
 }
 function node(value) {
   return Boolean(value && typeof value === "object");
@@ -20343,10 +20368,10 @@ function resolveAll(constructs2, events, context) {
   const called = [];
   let index = -1;
   while (++index < constructs2.length) {
-    const resolve4 = constructs2[index].resolveAll;
-    if (resolve4 && !called.includes(resolve4)) {
-      events = resolve4(events, context);
-      called.push(resolve4);
+    const resolve5 = constructs2[index].resolveAll;
+    if (resolve5 && !called.includes(resolve5)) {
+      events = resolve5(events, context);
+      called.push(resolve5);
     }
   }
   return events;
@@ -25520,7 +25545,7 @@ var handle = {
 };
 
 // node_modules/mdast-util-to-markdown/lib/join.js
-var join8 = [joinDefaults];
+var join7 = [joinDefaults];
 function joinDefaults(left, right, parent, state) {
   if (right.type === "code" && formatCodeAsIndented(right, state) && (left.type === "list" || left.type === right.type && formatCodeAsIndented(left, state))) {
     return false;
@@ -25903,7 +25928,7 @@ function toMarkdown(tree, options) {
     handle: undefined,
     indentLines,
     indexStack: [],
-    join: [...join8],
+    join: [...join7],
     options: {},
     safe: safeBound,
     stack: [],
@@ -26156,7 +26181,7 @@ import { default as default2 } from "node:path";
 import { default as default3 } from "node:process";
 
 // node_modules/vfile/lib/minurl.js
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // node_modules/vfile/lib/minurl.shared.js
 function isUrl(fileUrlOrPath) {
@@ -26209,40 +26234,40 @@ class VFile {
   get basename() {
     return typeof this.path === "string" ? default2.basename(this.path) : undefined;
   }
-  set basename(basename2) {
-    assertNonEmpty(basename2, "basename");
-    assertPart(basename2, "basename");
-    this.path = default2.join(this.dirname || "", basename2);
+  set basename(basename3) {
+    assertNonEmpty(basename3, "basename");
+    assertPart(basename3, "basename");
+    this.path = default2.join(this.dirname || "", basename3);
   }
   get dirname() {
     return typeof this.path === "string" ? default2.dirname(this.path) : undefined;
   }
-  set dirname(dirname3) {
+  set dirname(dirname5) {
     assertPath(this.basename, "dirname");
-    this.path = default2.join(dirname3 || "", this.basename);
+    this.path = default2.join(dirname5 || "", this.basename);
   }
   get extname() {
     return typeof this.path === "string" ? default2.extname(this.path) : undefined;
   }
-  set extname(extname) {
-    assertPart(extname, "extname");
+  set extname(extname2) {
+    assertPart(extname2, "extname");
     assertPath(this.dirname, "extname");
-    if (extname) {
-      if (extname.codePointAt(0) !== 46) {
+    if (extname2) {
+      if (extname2.codePointAt(0) !== 46) {
         throw new Error("`extname` must start with `.`");
       }
-      if (extname.includes(".", 1)) {
+      if (extname2.includes(".", 1)) {
         throw new Error("`extname` cannot contain multiple dots");
       }
     }
-    this.path = default2.join(this.dirname, this.stem + (extname || ""));
+    this.path = default2.join(this.dirname, this.stem + (extname2 || ""));
   }
   get path() {
     return this.history[this.history.length - 1];
   }
   set path(path) {
     if (isUrl(path)) {
-      path = fileURLToPath3(path);
+      path = fileURLToPath4(path);
     }
     assertNonEmpty(path, "path");
     if (this.path !== path) {
@@ -26396,7 +26421,7 @@ class Processor extends CallableInstance {
     assertParser("process", this.parser || this.Parser);
     assertCompiler("process", this.compiler || this.Compiler);
     return done ? executor(undefined, done) : new Promise(executor);
-    function executor(resolve4, reject) {
+    function executor(resolve5, reject) {
       const realFile = vfile(file);
       const parseTree = self.parse(realFile);
       self.run(parseTree, realFile, function(error, tree, file2) {
@@ -26415,8 +26440,8 @@ class Processor extends CallableInstance {
       function realDone(error, file2) {
         if (error || !file2) {
           reject(error);
-        } else if (resolve4) {
-          resolve4(file2);
+        } else if (resolve5) {
+          resolve5(file2);
         } else {
           ok(done, "`done` is defined if `resolve` is not");
           done(undefined, file2);
@@ -26449,7 +26474,7 @@ class Processor extends CallableInstance {
       file = undefined;
     }
     return done ? executor(undefined, done) : new Promise(executor);
-    function executor(resolve4, reject) {
+    function executor(resolve5, reject) {
       ok(typeof file !== "function", "`file` can’t be a `done` anymore, we checked");
       const realFile = vfile(file);
       transformers.run(tree, realFile, realDone);
@@ -26457,8 +26482,8 @@ class Processor extends CallableInstance {
         const resultingTree = outputTree || tree;
         if (error) {
           reject(error);
-        } else if (resolve4) {
-          resolve4(resultingTree);
+        } else if (resolve5) {
+          resolve5(resultingTree);
         } else {
           ok(done, "`done` is defined if `resolve` is not");
           done(undefined, resultingTree, file2);
@@ -28492,214 +28517,984 @@ function flushCell(map4, context, range, rowKind, rowEnd, previousCell) {
         map4.add(a, b, []);
       }
     }
-    map4.add(range[3] + 1, 0, [["exit", valueToken, context]]);
+    map4.add(range[3] + 1, 0, [["exit", valueToken, context]]);
+  }
+  if (rowEnd !== undefined) {
+    previousCell.end = Object.assign({}, getPoint(context.events, rowEnd));
+    map4.add(rowEnd, 0, [["exit", previousCell, context]]);
+    previousCell = undefined;
+  }
+  return previousCell;
+}
+function flushTableEnd(map4, context, index2, table, tableBody) {
+  const exits = [];
+  const related = getPoint(context.events, index2);
+  if (tableBody) {
+    tableBody.end = Object.assign({}, related);
+    exits.push(["exit", tableBody, context]);
+  }
+  table.end = Object.assign({}, related);
+  exits.push(["exit", table, context]);
+  map4.add(index2 + 1, 0, exits);
+}
+function getPoint(events, index2) {
+  const event = events[index2];
+  const side = event[0] === "enter" ? "start" : "end";
+  return event[1][side];
+}
+// node_modules/micromark-extension-gfm-task-list-item/dev/lib/syntax.js
+var tasklistCheck = { name: "tasklistCheck", tokenize: tokenizeTasklistCheck };
+function gfmTaskListItem() {
+  return {
+    text: { [codes.leftSquareBracket]: tasklistCheck }
+  };
+}
+function tokenizeTasklistCheck(effects, ok3, nok) {
+  const self = this;
+  return open;
+  function open(code3) {
+    ok(code3 === codes.leftSquareBracket, "expected `[`");
+    if (self.previous !== codes.eof || !self._gfmTasklistFirstContentOfListItem) {
+      return nok(code3);
+    }
+    effects.enter("taskListCheck");
+    effects.enter("taskListCheckMarker");
+    effects.consume(code3);
+    effects.exit("taskListCheckMarker");
+    return inside;
+  }
+  function inside(code3) {
+    if (markdownLineEndingOrSpace(code3)) {
+      effects.enter("taskListCheckValueUnchecked");
+      effects.consume(code3);
+      effects.exit("taskListCheckValueUnchecked");
+      return close;
+    }
+    if (code3 === codes.uppercaseX || code3 === codes.lowercaseX) {
+      effects.enter("taskListCheckValueChecked");
+      effects.consume(code3);
+      effects.exit("taskListCheckValueChecked");
+      return close;
+    }
+    return nok(code3);
+  }
+  function close(code3) {
+    if (code3 === codes.rightSquareBracket) {
+      effects.enter("taskListCheckMarker");
+      effects.consume(code3);
+      effects.exit("taskListCheckMarker");
+      effects.exit("taskListCheck");
+      return after;
+    }
+    return nok(code3);
+  }
+  function after(code3) {
+    if (markdownLineEnding(code3)) {
+      return ok3(code3);
+    }
+    if (markdownSpace(code3)) {
+      return effects.check({ tokenize: spaceThenNonSpace }, ok3, nok)(code3);
+    }
+    return nok(code3);
+  }
+}
+function spaceThenNonSpace(effects, ok3, nok) {
+  return factorySpace(effects, after, types.whitespace);
+  function after(code3) {
+    return code3 === codes.eof ? nok(code3) : ok3(code3);
+  }
+}
+// node_modules/micromark-extension-gfm/index.js
+function gfm(options) {
+  return combineExtensions([
+    gfmAutolinkLiteral(),
+    gfmFootnote(),
+    gfmStrikethrough(options),
+    gfmTable(),
+    gfmTaskListItem()
+  ]);
+}
+
+// node_modules/remark-gfm/lib/index.js
+var emptyOptions2 = {};
+function remarkGfm(options) {
+  const self = this;
+  const settings = options || emptyOptions2;
+  const data = self.data();
+  const micromarkExtensions = data.micromarkExtensions || (data.micromarkExtensions = []);
+  const fromMarkdownExtensions = data.fromMarkdownExtensions || (data.fromMarkdownExtensions = []);
+  const toMarkdownExtensions = data.toMarkdownExtensions || (data.toMarkdownExtensions = []);
+  micromarkExtensions.push(gfm(settings));
+  fromMarkdownExtensions.push(gfmFromMarkdown());
+  toMarkdownExtensions.push(gfmToMarkdown(settings));
+}
+// src/audit/core/markdown.ts
+var processor = remark().use(remarkGfm);
+function lineFromOffset(content3, offset) {
+  if (offset === undefined)
+    return;
+  return content3.slice(0, offset).split(`
+`).length;
+}
+function stripYamlFrontmatter(content3) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/.exec(content3);
+  if (match)
+    return content3.slice(match[0].length);
+  const eof = /^---\r?\n([\s\S]*?)\r?\n---\s*$/.exec(content3);
+  if (eof)
+    return "";
+  return content3;
+}
+function destinationConsumesToSliceEnd(slice, afterDest) {
+  let i = afterDest;
+  if (i >= slice.length)
+    return false;
+  if (slice[i] === ")") {
+    return i === slice.length - 1;
+  }
+  if (!/\s/.test(slice[i]))
+    return false;
+  while (i < slice.length && /\s/.test(slice[i]))
+    i++;
+  if (i >= slice.length)
+    return false;
+  if (slice[i] === ")") {
+    return i === slice.length - 1;
+  }
+  const open = slice[i];
+  if (open !== '"' && open !== "'" && open !== "(")
+    return false;
+  const close = open === "(" ? ")" : open;
+  i++;
+  while (i < slice.length && slice[i] !== close)
+    i++;
+  if (i >= slice.length)
+    return false;
+  i++;
+  while (i < slice.length && /\s/.test(slice[i]))
+    i++;
+  return i === slice.length - 1 && slice[i] === ")";
+}
+function findUrlSpanInSlice(content3, nodeStart, nodeEnd, url) {
+  const slice = content3.slice(nodeStart, nodeEnd);
+  let searchFrom = 0;
+  while (searchFrom < slice.length) {
+    const openParen = slice.indexOf("](", searchFrom);
+    if (openParen === -1)
+      break;
+    const after = openParen + 2;
+    if (slice.startsWith(`<${url}>`, after)) {
+      const afterDest = after + 2 + url.length;
+      if (destinationConsumesToSliceEnd(slice, afterDest)) {
+        const urlStart = nodeStart + after + 1;
+        return { urlStart, urlEnd: urlStart + url.length };
+      }
+    } else if (slice.startsWith(url, after)) {
+      const next = slice[after + url.length];
+      if (next === ")" || next !== undefined && /\s/.test(next)) {
+        if (destinationConsumesToSliceEnd(slice, after + url.length)) {
+          const urlStart = nodeStart + after;
+          return { urlStart, urlEnd: urlStart + url.length };
+        }
+      }
+    }
+    searchFrom = openParen + 1;
+  }
+  const auto = `<${url}>`;
+  if (slice === auto) {
+    return { urlStart: nodeStart + 1, urlEnd: nodeStart + 1 + url.length };
+  }
+  if (slice === url) {
+    return { urlStart: nodeStart, urlEnd: nodeEnd };
+  }
+  const trimmed = slice.trim();
+  if (trimmed === auto) {
+    const lead = slice.indexOf(auto);
+    if (lead !== -1) {
+      return { urlStart: nodeStart + lead + 1, urlEnd: nodeStart + lead + 1 + url.length };
+    }
+  }
+  if (trimmed === url) {
+    const lead = slice.indexOf(url);
+    if (lead !== -1) {
+      return { urlStart: nodeStart + lead, urlEnd: nodeStart + lead + url.length };
+    }
+  }
+  return;
+}
+function findUrlInDefinitionSlice(content3, nodeStart, nodeEnd, url) {
+  const slice = content3.slice(nodeStart, nodeEnd);
+  const labelEnd2 = slice.indexOf("]:");
+  if (labelEnd2 === -1)
+    return;
+  let i = labelEnd2 + 2;
+  while (i < slice.length && /\s/.test(slice[i] ?? ""))
+    i++;
+  if (slice.startsWith(`<${url}>`, i)) {
+    const urlStart = nodeStart + i + 1;
+    return { urlStart, urlEnd: urlStart + url.length };
+  }
+  if (slice.startsWith(url, i)) {
+    const urlStart = nodeStart + i;
+    return { urlStart, urlEnd: urlStart + url.length };
+  }
+  return;
+}
+function collectReferenceDefinitions(content3, tree) {
+  const defs = new Map;
+  visit2(tree, (node2) => {
+    if (node2.type !== "definition")
+      return;
+    if (!("identifier" in node2) || !("url" in node2))
+      return;
+    const id = String(node2.identifier).toLowerCase();
+    if (defs.has(id))
+      return;
+    const url = typeof node2.url === "string" ? node2.url : "";
+    if (!url)
+      return;
+    const start = node2.position?.start.offset;
+    const end = node2.position?.end.offset;
+    if (start === undefined || end === undefined)
+      return;
+    const span = findUrlInDefinitionSlice(content3, start, end, url);
+    if (!span)
+      return;
+    defs.set(id, {
+      url,
+      urlStart: span.urlStart,
+      urlEnd: span.urlEnd,
+      line: lineFromOffset(content3, start) ?? 1
+    });
+  });
+  return defs;
+}
+function extractLinksFromMarkdown(content3, _filePath) {
+  const tree = processor.parse(content3);
+  const refDefs = collectReferenceDefinitions(content3, tree);
+  const links = [];
+  visit2(tree, (node2) => {
+    if (node2.type === "link" && "url" in node2 && typeof node2.url === "string") {
+      const target = node2.url.trim();
+      const start = node2.position?.start.offset;
+      const end = node2.position?.end.offset;
+      const span = start !== undefined && end !== undefined ? findUrlSpanInSlice(content3, start, end, target) : undefined;
+      links.push({
+        target,
+        line: lineFromOffset(content3, node2.position?.start.offset),
+        urlStart: span?.urlStart,
+        urlEnd: span?.urlEnd
+      });
+    }
+    if (node2.type === "linkReference" && "identifier" in node2) {
+      const id = String(node2.identifier).toLowerCase();
+      const def = refDefs.get(id);
+      if (def) {
+        links.push({
+          target: def.url.trim(),
+          line: def.line,
+          urlStart: def.urlStart,
+          urlEnd: def.urlEnd
+        });
+      }
+    }
+  });
+  return links;
+}
+function phrasingText(nodes) {
+  if (!nodes?.length)
+    return "";
+  let out = "";
+  for (const node2 of nodes) {
+    if (node2.type === "text" || node2.type === "inlineCode") {
+      out += "value" in node2 && node2.value !== undefined ? String(node2.value) : "";
+      continue;
+    }
+    if (node2.children?.length) {
+      out += phrasingText(node2.children);
+    }
+  }
+  return out;
+}
+function extractHeadingSlugs(content3, _filePath) {
+  const body = stripYamlFrontmatter(content3);
+  const slugger = new BananaSlug;
+  const slugs = new Set;
+  const tree = processor.parse(body);
+  visit2(tree, (node2) => {
+    if (node2.type === "heading" && "children" in node2) {
+      const text5 = phrasingText(node2.children);
+      if (text5)
+        slugs.add(slugger.slug(text5));
+    }
+  });
+  return slugs;
+}
+function slugifyAnchor(anchor) {
+  const slugger = new BananaSlug;
+  return slugger.slug(decodeURIComponent(anchor));
+}
+
+// src/audit/fix/match-anchor.ts
+var ANCHOR_MATCH_MIN_SCORE = 2 / 3;
+var ANCHOR_MATCH_MIN_MARGIN = 0.15;
+function tokenize(slug2) {
+  return new Set(slug2.split("-").filter(Boolean));
+}
+function jaccard(a, b) {
+  if (a.size === 0 && b.size === 0)
+    return 0;
+  let intersection = 0;
+  for (const token of a) {
+    if (b.has(token))
+      intersection++;
+  }
+  const union = a.size + b.size - intersection;
+  return union === 0 ? 0 : intersection / union;
+}
+function scoreAnchorMatch(brokenSlug, candidateSlug) {
+  if (brokenSlug === candidateSlug)
+    return 1;
+  if (candidateSlug.startsWith(`${brokenSlug}-`)) {
+    return 1;
+  }
+  if (brokenSlug.startsWith(candidateSlug) && brokenSlug.length > candidateSlug.length) {
+    return 0;
+  }
+  return jaccard(tokenize(brokenSlug), tokenize(candidateSlug));
+}
+function findBestAnchorMatch(brokenSlug, candidates) {
+  const scored = [];
+  for (const slug2 of candidates) {
+    if (slug2 === brokenSlug)
+      continue;
+    scored.push({ slug: slug2, score: scoreAnchorMatch(brokenSlug, slug2) });
+  }
+  if (scored.length === 0)
+    return null;
+  scored.sort((a, b) => b.score - a.score || a.slug.localeCompare(b.slug));
+  const best = scored[0];
+  const second = scored[1];
+  if (!best || best.score < ANCHOR_MATCH_MIN_SCORE)
+    return null;
+  if (second && best.score - second.score < ANCHOR_MATCH_MIN_MARGIN)
+    return null;
+  return best;
+}
+
+// src/audit/fix/anchors.ts
+function resolveLink(sourceFile, target) {
+  const withoutAnchor = target.split("#")[0]?.split("?")[0] ?? "";
+  if (!withoutAnchor)
+    return sourceFile;
+  return resolve5(dirname5(sourceFile), withoutAnchor);
+}
+function replaceAnchorInTarget(target, oldAnchor, newAnchor) {
+  const hashIndex = target.indexOf("#");
+  if (hashIndex === -1)
+    return target;
+  const pathPart = target.slice(0, hashIndex);
+  const fragment = target.slice(hashIndex + 1);
+  const queryIndex = fragment.indexOf("?");
+  const anchorPart = queryIndex === -1 ? fragment : fragment.slice(0, queryIndex);
+  const queryPart = queryIndex === -1 ? "" : fragment.slice(queryIndex);
+  if (anchorPart !== oldAnchor)
+    return target;
+  return `${pathPart}#${newAnchor}${queryPart}`;
+}
+function collectAnchorFixes(ctx) {
+  const editsByFile = new Map;
+  for (const filePath of ctx.files) {
+    const content3 = readFileContent(filePath);
+    const links = extractLinksFromMarkdown(content3, filePath);
+    const pending = [];
+    const relFile = relPath(filePath, ctx.root);
+    for (const { target, line, urlStart, urlEnd } of links) {
+      if (isExternalLink(target) && !target.startsWith("#"))
+        continue;
+      if (isPlaceholderLink(target))
+        continue;
+      const anchor = target.includes("#") ? target.split("#")[1]?.split("?")[0] ?? "" : "";
+      if (!anchor)
+        continue;
+      const resolved = resolveLink(filePath, target);
+      if (!existsSync8(resolved))
+        continue;
+      const targetContent = readFileSync6(resolved, "utf8");
+      const slugs = extractHeadingSlugs(targetContent, resolved);
+      const anchorSlug = slugifyAnchor(anchor);
+      if (slugs.has(anchorSlug))
+        continue;
+      const match = findBestAnchorMatch(anchorSlug, slugs);
+      if (!match)
+        continue;
+      const nextTarget = replaceAnchorInTarget(target, anchor, match.slug);
+      if (nextTarget === target)
+        continue;
+      const lineLabel = line ? `${relFile}:${line}` : relFile;
+      const description = `${lineLabel} #${anchor} → #${match.slug} (score ${match.score.toFixed(2)})`;
+      if (urlStart !== undefined && urlEnd !== undefined && content3.slice(urlStart, urlEnd) === target) {
+        pending.push({ urlStart, urlEnd, from: target, to: nextTarget, description });
+      }
+    }
+    if (pending.length === 0)
+      continue;
+    const uniqueBySpan = new Map;
+    for (const edit of pending) {
+      uniqueBySpan.set(`${edit.urlStart}:${edit.urlEnd}:${edit.from}`, edit);
+    }
+    const uniquePending = [...uniqueBySpan.values()];
+    uniquePending.sort((a, b) => b.urlStart - a.urlStart);
+    let updated = content3;
+    const descriptions = [];
+    for (const edit of uniquePending) {
+      if (updated.slice(edit.urlStart, edit.urlEnd) !== edit.from)
+        continue;
+      updated = updated.slice(0, edit.urlStart) + edit.to + updated.slice(edit.urlEnd);
+      descriptions.push(edit.description);
+    }
+    if (updated === content3 || descriptions.length === 0)
+      continue;
+    editsByFile.set(filePath, { content: updated, descriptions });
+  }
+  const edits = [];
+  for (const [absPath, { content: content3, descriptions }] of editsByFile) {
+    edits.push({
+      file: relPath(absPath, ctx.root),
+      description: descriptions.join("; "),
+      content: content3
+    });
+  }
+  return edits;
+}
+
+// src/audit/fix/doc-meta.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { join as join8 } from "node:path";
+
+// src/audit/core/git-meta.ts
+import { spawnSync } from "node:child_process";
+function lastGitCommitDate(relPath2, root2) {
+  const proc = spawnSync("git", ["log", "-1", "--format=%cs", "--", relPath2], {
+    cwd: root2,
+    encoding: "utf8"
+  });
+  if (proc.status !== 0)
+    return null;
+  const date = proc.stdout.trim();
+  return date || null;
+}
+
+// src/audit/fix/doc-meta.ts
+function bumpDocMetaLastReviewed(content3, gitDate) {
+  const reviewedStr = docMetaLastReviewed(content3);
+  if (!reviewedStr)
+    return null;
+  const reviewed = new Date(`${reviewedStr}T00:00:00Z`);
+  const committed = new Date(`${gitDate}T00:00:00Z`);
+  if (Number.isNaN(reviewed.getTime()) || Number.isNaN(committed.getTime()))
+    return null;
+  if (committed.getTime() <= reviewed.getTime())
+    return null;
+  return replaceDocMetaLastReviewed(content3, gitDate);
+}
+function collectDocMetaFixes(ctx) {
+  const edits = [];
+  for (const relPath2 of ctx.docMetaPaths) {
+    const abs = join8(ctx.root, relPath2);
+    if (!existsSync9(abs))
+      continue;
+    const content3 = readFileSync7(abs, "utf8");
+    if (!DOC_META_RE.test(content3))
+      continue;
+    const reviewedStr = docMetaLastReviewed(content3);
+    if (!reviewedStr)
+      continue;
+    const reviewed = new Date(`${reviewedStr}T00:00:00Z`);
+    if (Number.isNaN(reviewed.getTime()))
+      continue;
+    const gitDate = lastGitCommitDate(relPath2, ctx.root);
+    if (!gitDate)
+      continue;
+    const updated = bumpDocMetaLastReviewed(content3, gitDate);
+    if (!updated)
+      continue;
+    edits.push({
+      file: relPath2,
+      description: `last-reviewed ${reviewedStr} → ${gitDate}`,
+      content: updated
+    });
+  }
+  return edits;
+}
+
+// src/audit/core/fix.ts
+function collectFixes(ctx, kinds) {
+  const meta = kinds.has("doc-meta") ? collectDocMetaFixes(ctx) : [];
+  const anchors = kinds.has("anchors") ? collectAnchorFixes(ctx) : [];
+  return coalesceFixEdits(meta, anchors);
+}
+function coalesceFixEdits(metaEdits, anchorEdits) {
+  const metaByFile = new Map(metaEdits.map((e) => [e.file, e]));
+  const anchorByFile = new Map(anchorEdits.map((e) => [e.file, e]));
+  const files = new Set([...metaByFile.keys(), ...anchorByFile.keys()]);
+  const out = [];
+  for (const file of [...files].sort()) {
+    const meta = metaByFile.get(file);
+    const anchors = anchorByFile.get(file);
+    if (meta && anchors) {
+      out.push({
+        file,
+        description: `${meta.description}; ${anchors.description}`,
+        content: overlayLastReviewed(anchors.content, meta.content)
+      });
+    } else if (meta) {
+      out.push(meta);
+    } else if (anchors) {
+      out.push(anchors);
+    }
+  }
+  return out;
+}
+function overlayLastReviewed(targetContent, metaContent) {
+  const date = docMetaLastReviewed(metaContent);
+  if (!date)
+    return targetContent;
+  return replaceDocMetaLastReviewed(targetContent, date) ?? targetContent;
+}
+function underRoot(rootAbs, candidateAbs) {
+  return candidateAbs === rootAbs || candidateAbs.startsWith(rootAbs + sep3);
+}
+function resolveWritePath(root2, relFile) {
+  const rootResolved = resolve6(root2);
+  const abs = resolve6(rootResolved, relFile);
+  if (!underRoot(rootResolved, abs)) {
+    throw new Error(`Refusing autofix outside repo root: ${relFile}`);
+  }
+  const rootReal = existsSync10(rootResolved) ? realpathSync4(rootResolved) : rootResolved;
+  let cursor = abs;
+  while (true) {
+    if (existsSync10(cursor)) {
+      const real = realpathSync4(cursor);
+      if (!underRoot(rootReal, real)) {
+        throw new Error(`Refusing autofix outside repo root: ${relFile}`);
+      }
+      return abs;
+    }
+    const parent = dirname6(cursor);
+    if (parent === cursor || !underRoot(rootResolved, parent) && parent !== rootResolved) {
+      return abs;
+    }
+    cursor = parent;
   }
-  if (rowEnd !== undefined) {
-    previousCell.end = Object.assign({}, getPoint(context.events, rowEnd));
-    map4.add(rowEnd, 0, [["exit", previousCell, context]]);
-    previousCell = undefined;
+}
+function applyFixes(ctx, options) {
+  const kinds = new Set(options.kinds);
+  const edits = collectFixes(ctx, kinds);
+  const modifiedFiles = [];
+  if (edits.length > 0) {
+    console.error(`Doc audit autofix:
+`);
+    for (const edit of edits) {
+      console.error(`- ${edit.file}: ${edit.description}`);
+      if (!options.dryRun) {
+        const abs = resolveWritePath(ctx.root, edit.file);
+        writeFileSync(abs, edit.content, "utf8");
+        modifiedFiles.push(edit.file);
+      }
+    }
+    console.error("");
   }
-  return previousCell;
+  return { edits, modifiedFiles };
 }
-function flushTableEnd(map4, context, index2, table, tableBody) {
-  const exits = [];
-  const related = getPoint(context.events, index2);
-  if (tableBody) {
-    tableBody.end = Object.assign({}, related);
-    exits.push(["exit", tableBody, context]);
+function parseFixKinds(raw) {
+  if (raw === true)
+    return ["doc-meta", "anchors"];
+  switch (raw) {
+    case "doc-meta":
+      return ["doc-meta"];
+    case "anchors":
+      return ["anchors"];
+    default:
+      throw new Error(`Unknown --fix kind: ${raw}. Use doc-meta or anchors.`);
   }
-  table.end = Object.assign({}, related);
-  exits.push(["exit", table, context]);
-  map4.add(index2 + 1, 0, exits);
 }
-function getPoint(events, index2) {
-  const event = events[index2];
-  const side = event[0] === "enter" ? "start" : "end";
-  return event[1][side];
+var FIX_KIND_RULE = {
+  "doc-meta": "doc-meta",
+  anchors: "links"
+};
+function fixKindsForOnly(kinds, only) {
+  if (!only)
+    return kinds;
+  return kinds.filter((kind) => only.has(FIX_KIND_RULE[kind]));
 }
-// node_modules/micromark-extension-gfm-task-list-item/dev/lib/syntax.js
-var tasklistCheck = { name: "tasklistCheck", tokenize: tokenizeTasklistCheck };
-function gfmTaskListItem() {
+
+// src/audit/core/report.ts
+function issue(rule, file, message, opts) {
   return {
-    text: { [codes.leftSquareBracket]: tasklistCheck }
+    rule,
+    file,
+    link: opts?.link,
+    message,
+    severity: opts?.severity ?? "error"
   };
 }
-function tokenizeTasklistCheck(effects, ok3, nok) {
-  const self = this;
-  return open;
-  function open(code3) {
-    ok(code3 === codes.leftSquareBracket, "expected `[`");
-    if (self.previous !== codes.eof || !self._gfmTasklistFirstContentOfListItem) {
-      return nok(code3);
+function finalizeIssues(issues, strict) {
+  if (!strict)
+    return issues;
+  return issues.map((i) => i.severity === "warning" ? { ...i, severity: "error" } : i);
+}
+function printReport(issues, options) {
+  const finalized = finalizeIssues(issues, options.strict ?? false);
+  const errors2 = finalized.filter((i) => i.severity === "error");
+  const warnings = finalized.filter((i) => i.severity === "warning");
+  const label = options.label ?? "Audit";
+  if (options.json) {
+    console.log(JSON.stringify({
+      label,
+      fileCount: options.fileCount,
+      errors: errors2.length,
+      warnings: warnings.length,
+      issues: finalized
+    }, null, 2));
+    return errors2.length > 0 ? 1 : 0;
+  }
+  if (warnings.length > 0) {
+    console.log(`${label} warnings:
+`);
+    for (const i of warnings) {
+      const linkPart = i.link ? ` (${i.link})` : "";
+      console.log(`- ${i.file}${linkPart}: ${i.message}`);
     }
-    effects.enter("taskListCheck");
-    effects.enter("taskListCheckMarker");
-    effects.consume(code3);
-    effects.exit("taskListCheckMarker");
-    return inside;
+    console.log("");
   }
-  function inside(code3) {
-    if (markdownLineEndingOrSpace(code3)) {
-      effects.enter("taskListCheckValueUnchecked");
-      effects.consume(code3);
-      effects.exit("taskListCheckValueUnchecked");
-      return close;
+  if (errors2.length === 0) {
+    const warnNote = warnings.length > 0 ? `, ${warnings.length} warning(s)` : "";
+    const countNote = options.successSuffix ?? (options.fileCount !== undefined ? ` (${options.fileCount} files scanned${warnNote})` : "");
+    console.log(`${label} passed${countNote}.`);
+    return 0;
+  }
+  console.log(`${label} failed:
+`);
+  for (const i of errors2) {
+    const linkPart = i.link ? ` (${i.link})` : "";
+    console.log(`- ${i.file}${linkPart}: ${i.message}`);
+  }
+  return 1;
+}
+
+// src/references/check.ts
+import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
+import { join as join10, relative as relative7 } from "node:path";
+
+// src/references/constants.ts
+var CANONICAL_REFS_DIR = ".skeleton/references";
+var GENERATED_MARKER_START = "<!-- skeleton: generated-reference";
+var GENERATED_MARKER_RE = /<!-- skeleton: generated-reference\s*\nsource: ([^\n]+)\s*\nredundancy: intentional\s*\n-->\s*\n?/;
+var SHARED_REF_LINK_RE = /\((?:\.\.\/)+references\/([^)]+)\)/g;
+function formatGeneratedHeader(sourceRelPath) {
+  return `${GENERATED_MARKER_START}
+source: ${sourceRelPath}
+redundancy: intentional
+-->
+
+`;
+}
+function stripGeneratedHeader(content3) {
+  return content3.replace(GENERATED_MARKER_RE, "");
+}
+function isGeneratedReference(content3) {
+  return content3.startsWith(GENERATED_MARKER_START);
+}
+
+// src/references/discover.ts
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "node:fs";
+import { join as join9, relative as relative6 } from "node:path";
+function walkMarkdownFiles(dir, root2) {
+  const files = [];
+  if (!existsSync11(dir))
+    return files;
+  for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith("."))
+      continue;
+    const fullPath = join9(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walkMarkdownFiles(fullPath, root2));
+      continue;
     }
-    if (code3 === codes.uppercaseX || code3 === codes.lowercaseX) {
-      effects.enter("taskListCheckValueChecked");
-      effects.consume(code3);
-      effects.exit("taskListCheckValueChecked");
-      return close;
+    if (entry.name.endsWith(".md")) {
+      files.push(normalizeRelPath(relative6(root2, fullPath)));
     }
-    return nok(code3);
   }
-  function close(code3) {
-    if (code3 === codes.rightSquareBracket) {
-      effects.enter("taskListCheckMarker");
-      effects.consume(code3);
-      effects.exit("taskListCheckMarker");
-      effects.exit("taskListCheck");
-      return after;
+  return files;
+}
+function canonicalExists(root2, refPath) {
+  return existsSync11(join9(root2, CANONICAL_REFS_DIR, refPath));
+}
+function findSharedRefLinks(content3, sourceFile) {
+  const links = [];
+  for (const match of content3.matchAll(SHARED_REF_LINK_RE)) {
+    const refPath = match[1];
+    if (!refPath)
+      continue;
+    links.push({ refPath: normalizeRelPath(refPath), sourceFile });
+  }
+  return links;
+}
+function findLocalCanonicalLinks(root2, content3, sourceFile) {
+  const links = [];
+  const localRefRe = /\((?:\.\/)?references\/([^)]+)\)/g;
+  for (const match of content3.matchAll(localRefRe)) {
+    const refPath = normalizeRelPath(match[1] ?? "");
+    if (!refPath || !canonicalExists(root2, refPath))
+      continue;
+    links.push({ refPath, sourceFile });
+  }
+  const inReferencesDir = /\/references\//.test(sourceFile);
+  if (inReferencesDir) {
+    const refsIdx = sourceFile.lastIndexOf("/references/");
+    const withinRefs = sourceFile.slice(refsIdx + "/references/".length);
+    const withinDir = withinRefs.includes("/") ? withinRefs.slice(0, withinRefs.lastIndexOf("/")) : "";
+    const siblingRe = /\((?!https?:|#|\.\.\/)([a-z0-9./_-]+\.md)\)/gi;
+    for (const match of content3.matchAll(siblingRe)) {
+      const raw = normalizeRelPath(match[1] ?? "");
+      if (!raw)
+        continue;
+      const refPath = withinDir ? normalizeRelPath(join9(withinDir, raw)) : raw;
+      if (!canonicalExists(root2, refPath))
+        continue;
+      links.push({ refPath, sourceFile });
     }
-    return nok(code3);
   }
-  function after(code3) {
-    if (markdownLineEnding(code3)) {
-      return ok3(code3);
+  return links;
+}
+function discoverSkillReferencePlans(root2) {
+  const index2 = buildSkillIndex(root2);
+  const plans = [];
+  for (const slug2 of index2.slugs) {
+    const skillDir = join9(root2, slug2);
+    if (!existsSync11(join9(skillDir, "SKILL.md")))
+      continue;
+    const refPaths = new Set;
+    const links = [];
+    for (const relFile of walkMarkdownFiles(skillDir, root2)) {
+      const content3 = readFileSync8(join9(root2, relFile), "utf8");
+      if (isGeneratedReference(content3))
+        continue;
+      for (const link2 of findSharedRefLinks(content3, relFile)) {
+        refPaths.add(link2.refPath);
+        links.push(link2);
+      }
+      for (const link2 of findLocalCanonicalLinks(root2, content3, relFile)) {
+        refPaths.add(link2.refPath);
+        links.push(link2);
+      }
     }
-    if (markdownSpace(code3)) {
-      return effects.check({ tokenize: spaceThenNonSpace }, ok3, nok)(code3);
+    const queue = [...refPaths];
+    while (queue.length > 0) {
+      const refPath = queue.pop();
+      if (!refPath || !canonicalExists(root2, refPath))
+        continue;
+      const canonicalContent = readFileSync8(join9(root2, CANONICAL_REFS_DIR, refPath), "utf8");
+      const syntheticSource = generatedRefPath(slug2, refPath);
+      for (const link2 of findLocalCanonicalLinks(root2, canonicalContent, syntheticSource)) {
+        if (refPaths.has(link2.refPath))
+          continue;
+        refPaths.add(link2.refPath);
+        links.push(link2);
+        queue.push(link2.refPath);
+      }
+    }
+    if (refPaths.size > 0) {
+      plans.push({ skill: slug2, refPaths, links });
     }
-    return nok(code3);
   }
+  return plans.sort((a, b) => a.skill.localeCompare(b.skill));
 }
-function spaceThenNonSpace(effects, ok3, nok) {
-  return factorySpace(effects, after, types.whitespace);
-  function after(code3) {
-    return code3 === codes.eof ? nok(code3) : ok3(code3);
+function generatedRefPath(skill, refPath) {
+  return normalizeRelPath(join9(skill, "references", refPath));
+}
+function rewriteSharedRefTarget(sourceFile, skill, refPath) {
+  const sourceDir = sourceFile.slice(0, sourceFile.lastIndexOf("/"));
+  const target = generatedRefPath(skill, refPath);
+  if (!sourceDir)
+    return target;
+  const fromParts = sourceDir.split("/");
+  const toParts = target.split("/");
+  let i = 0;
+  while (i < fromParts.length && i < toParts.length && fromParts[i] === toParts[i]) {
+    i++;
   }
+  const ups = fromParts.length - i;
+  const down = toParts.slice(i);
+  const rel = [...Array(ups).fill(".."), ...down].join("/");
+  return rel || (toParts.at(-1) ?? refPath);
 }
-// node_modules/micromark-extension-gfm/index.js
-function gfm(options) {
-  return combineExtensions([
-    gfmAutolinkLiteral(),
-    gfmFootnote(),
-    gfmStrikethrough(options),
-    gfmTable(),
-    gfmTaskListItem()
-  ]);
+function rewriteSharedRefLinks(content3, sourceFile, skill) {
+  return content3.replace(SHARED_REF_LINK_RE, (_match, refPath) => {
+    const rewritten = rewriteSharedRefTarget(sourceFile, skill, normalizeRelPath(refPath));
+    return `(${rewritten})`;
+  });
 }
 
-// node_modules/remark-gfm/lib/index.js
-var emptyOptions2 = {};
-function remarkGfm(options) {
-  const self = this;
-  const settings = options || emptyOptions2;
-  const data = self.data();
-  const micromarkExtensions = data.micromarkExtensions || (data.micromarkExtensions = []);
-  const fromMarkdownExtensions = data.fromMarkdownExtensions || (data.fromMarkdownExtensions = []);
-  const toMarkdownExtensions = data.toMarkdownExtensions || (data.toMarkdownExtensions = []);
-  micromarkExtensions.push(gfm(settings));
-  fromMarkdownExtensions.push(gfmFromMarkdown());
-  toMarkdownExtensions.push(gfmToMarkdown(settings));
-}
-// src/audit/core/markdown.ts
-var MARKDOWN_LINK_RE = /(?<!!)\[([^\]]*)\]\(([^)]+)\)/g;
-var REFERENCE_DEF_RE = /^\[([^\]]+)\]:\s+(\S+)/;
-var HEADING_LINE_RE = /^(#{1,6})\s+(.+)$/;
-var processor = remark().use(remarkGfm);
-function lineFromOffset(content3, offset) {
-  if (offset === undefined)
-    return;
-  return content3.slice(0, offset).split(`
-`).length;
+// src/references/check.ts
+function listAllGeneratedFiles(root2) {
+  const files = [];
+  const walk = (dir) => {
+    if (!existsSync12(dir))
+      return;
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith("."))
+        continue;
+      const fullPath = join10(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(fullPath);
+        continue;
+      }
+      if (!entry.name.endsWith(".md"))
+        continue;
+      const content3 = readFileSync9(fullPath, "utf8");
+      if (isGeneratedReference(content3)) {
+        files.push(normalizeRelPath(relative7(root2, fullPath)));
+      }
+    }
+  };
+  walk(root2);
+  return files;
 }
-function extractLinksFromMarkdown(content3, filePath) {
-  if (filePath.endsWith(".mdc")) {
-    return extractLinksRegex(content3);
-  }
-  const tree = processor.parse(content3);
-  const refDefs = new Map;
-  const links = [];
-  for (const line of content3.split(`
-`)) {
-    const match = REFERENCE_DEF_RE.exec(line.trim());
-    if (match?.[1] && match[2]) {
-      refDefs.set(match[1].toLowerCase(), match[2]);
+function runGeneratedReferencesCheck(root2) {
+  const issues = [];
+  const canonicalDir = join10(root2, CANONICAL_REFS_DIR);
+  if (!existsSync12(canonicalDir))
+    return issues;
+  const plans = discoverSkillReferencePlans(root2);
+  const needed = new Set;
+  for (const plan of plans) {
+    for (const refPath of plan.refPaths) {
+      needed.add(generatedRefPath(plan.skill, refPath));
     }
   }
-  visit2(tree, (node2) => {
-    if (node2.type === "link" && "url" in node2 && typeof node2.url === "string") {
-      links.push({
-        target: node2.url.trim(),
-        line: lineFromOffset(content3, node2.position?.start.offset)
-      });
+  for (const targetRel of needed) {
+    const targetPath = join10(root2, targetRel);
+    if (!existsSync12(targetPath)) {
+      issues.push(issue("generated-references", targetRel, "missing generated copy — run skeleton references sync"));
+      continue;
     }
-    if (node2.type === "linkReference" && "identifier" in node2) {
-      const id = String(node2.identifier).toLowerCase();
-      const url = refDefs.get(id);
-      if (url) {
-        links.push({
-          target: url.trim(),
-          line: lineFromOffset(content3, node2.position?.start.offset)
-        });
-      }
+    const generated = readFileSync9(targetPath, "utf8");
+    if (!isGeneratedReference(generated)) {
+      issues.push(issue("generated-references", targetRel, "expected generated-reference provenance header"));
+      continue;
     }
-  });
-  return links;
-}
-function extractLinksRegex(content3) {
-  const links = [];
-  const lines = content3.split(`
-`);
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i] ?? "";
-    for (const match of line.matchAll(MARKDOWN_LINK_RE)) {
-      const target = match[2]?.trim();
-      if (target)
-        links.push({ target, line: i + 1 });
+    const body = stripGeneratedHeader(generated);
+    const sourceRel = normalizeRelPath(generated.match(/source: ([^\n]+)/)?.[1] ?? join10(CANONICAL_REFS_DIR, targetRel.split("/references/")[1] ?? ""));
+    const canonicalPath = join10(root2, sourceRel);
+    if (!existsSync12(canonicalPath)) {
+      issues.push(issue("generated-references", targetRel, `canonical source missing: ${sourceRel}`));
+      continue;
+    }
+    const canonical = readFileSync9(canonicalPath, "utf8");
+    if (body !== canonical) {
+      issues.push(issue("generated-references", targetRel, "stale generated copy — run skeleton references sync"));
     }
   }
-  return links;
-}
-function extractHeadingSlugs(content3, filePath) {
-  if (filePath.endsWith(".mdc")) {
-    return extractHeadingSlugsLineBased(content3);
-  }
-  const slugger = new BananaSlug;
-  const slugs = new Set;
-  const tree = processor.parse(content3);
-  visit2(tree, (node2) => {
-    if (node2.type === "heading" && "children" in node2) {
-      const text5 = node2.children.filter((c) => c.type === "text" || c.type === "inlineCode").map((c) => ("value" in c) ? String(c.value) : "").join("");
-      if (text5)
-        slugs.add(slugger.slug(text5));
+  for (const generatedRel of listAllGeneratedFiles(root2)) {
+    if (!needed.has(generatedRel)) {
+      issues.push(issue("generated-references", generatedRel, "orphaned generated copy — run skeleton references sync"));
     }
-  });
-  return slugs;
+  }
+  for (const plan of plans) {
+    const skillDir = join10(root2, plan.skill);
+    if (!existsSync12(skillDir))
+      continue;
+    const walk = (dir) => {
+      for (const entry of readdirSync4(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith("."))
+          continue;
+        const fullPath = join10(dir, entry.name);
+        if (entry.isDirectory()) {
+          walk(fullPath);
+          continue;
+        }
+        if (!entry.name.endsWith(".md"))
+          continue;
+        const relFile = normalizeRelPath(relative7(root2, fullPath));
+        const content3 = readFileSync9(fullPath, "utf8");
+        if (content3.match(SHARED_REF_LINK_RE)) {
+          issues.push(issue("generated-references", relFile, "still links to shared root references/ — run skeleton references sync"));
+        }
+      }
+    };
+    walk(skillDir);
+  }
+  return issues;
 }
-function extractHeadingSlugsLineBased(content3) {
-  const slugger = new BananaSlug;
-  const slugs = new Set;
-  for (const line of content3.split(`
-`)) {
-    const match = HEADING_LINE_RE.exec(line);
-    if (match?.[2])
-      slugs.add(slugger.slug(match[2]));
+function runGeneratedReferencesRule(ctx) {
+  return runGeneratedReferencesCheck(ctx.root);
+}
+var generatedReferencesRule = {
+  id: "generated-references",
+  global: true,
+  run: runGeneratedReferencesRule
+};
+
+// src/audit/rules/banned.ts
+function runBannedRule(ctx) {
+  const issues = [];
+  for (const abs of collectBannedFiles(ctx.config, ctx.root)) {
+    const rel = relPath(abs, ctx.root);
+    issues.push(issue("banned", rel, "file matches scan.banned — must not exist in repo"));
   }
-  return slugs;
+  return issues;
 }
-function slugifyAnchor(anchor) {
-  const slugger = new BananaSlug;
-  return slugger.slug(decodeURIComponent(anchor));
+var bannedRule = { id: "banned", run: runBannedRule };
+
+// src/audit/rules/doc-meta.ts
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { join as join11 } from "node:path";
+function runDocMetaRule(ctx) {
+  const issues = [];
+  const today = new Date;
+  for (const relPath2 of ctx.docMetaPaths) {
+    const abs = join11(ctx.root, relPath2);
+    if (!existsSync13(abs))
+      continue;
+    const content3 = readFileSync10(abs, "utf8");
+    if (!DOC_META_RE.test(content3)) {
+      issues.push(issue("doc-meta", relPath2, "missing doc-meta comment (owner + last-reviewed)"));
+      continue;
+    }
+    const reviewedStr = docMetaLastReviewed(content3);
+    if (!reviewedStr)
+      continue;
+    const reviewed = new Date(`${reviewedStr}T00:00:00Z`);
+    if (Number.isNaN(reviewed.getTime()))
+      continue;
+    const ageDays = (today.getTime() - reviewed.getTime()) / 86400000;
+    if (ageDays > ctx.config.daysUntilStale) {
+      issues.push(issue("doc-meta", relPath2, `doc-meta last-reviewed ${reviewedStr} is stale (>${ctx.config.daysUntilStale} days)`, { severity: "warning" }));
+    }
+    const gitDate = lastGitCommitDate(relPath2, ctx.root);
+    if (!gitDate)
+      continue;
+    const committed = new Date(`${gitDate}T00:00:00Z`);
+    if (Number.isNaN(committed.getTime()))
+      continue;
+    if (committed.getTime() > reviewed.getTime()) {
+      issues.push(issue("doc-meta", relPath2, `content changed after last-reviewed ${reviewedStr} (git: ${gitDate}) — bump last-reviewed or confirm review`, { severity: "warning" }));
+    }
+  }
+  return issues;
 }
+var docMetaRule = { id: "doc-meta", run: runDocMetaRule };
 
 // src/audit/rules/links.ts
-function resolveLink(sourceFile, target) {
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname7, resolve as resolve7 } from "node:path";
+function resolveLink2(sourceFile, target) {
   const withoutAnchor = target.split("#")[0]?.split("?")[0] ?? "";
   if (!withoutAnchor)
     return sourceFile;
-  return resolve4(dirname3(sourceFile), withoutAnchor);
+  return resolve7(dirname7(sourceFile), withoutAnchor);
 }
 function validateTarget(ctx, sourceFile, target, linkLabel) {
   const issues = [];
@@ -28710,7 +29505,7 @@ function validateTarget(ctx, sourceFile, target, linkLabel) {
   const relSource = relPath(sourceFile, ctx.root);
   const anchor = target.includes("#") ? target.split("#")[1]?.split("?")[0] ?? "" : "";
   const pathPart = target.split("#")[0]?.split("?")[0] ?? "";
-  const resolved = resolveLink(sourceFile, target);
+  const resolved = resolveLink2(sourceFile, target);
   const relTarget = relPath(resolved, ctx.root);
   const skillMatch = SKILL_LINK_IN_TARGET_RE.exec(target);
   if (skillMatch?.[1] && ctx.retiredSkills.has(skillMatch[1])) {
@@ -28730,19 +29525,19 @@ function validateTarget(ctx, sourceFile, target, linkLabel) {
   }
   if ((target.includes(".claude/agents/") || target.includes(".cursor/agents/")) && target.endsWith(".md")) {
     const agentPath = resolved.endsWith(".md") ? resolved : `${resolved}.md`;
-    if (!existsSync8(agentPath)) {
+    if (!existsSync14(agentPath)) {
       issues.push(issue("links", relSource, "missing agent file", { link: linkLabel }));
     }
     return issues;
   }
-  if (pathPart && !existsSync8(resolved)) {
+  if (pathPart && !existsSync14(resolved)) {
     issues.push(issue("links", relSource, `broken link → ${relTarget}`, {
       link: linkLabel
     }));
     return issues;
   }
-  if (anchor && existsSync8(resolved)) {
-    const targetContent = readFileSync7(resolved, "utf8");
+  if (anchor && existsSync14(resolved)) {
+    const targetContent = readFileSync11(resolved, "utf8");
     const slugs = extractHeadingSlugs(targetContent, resolved);
     const anchorSlug = slugifyAnchor(anchor);
     if (!slugs.has(anchorSlug)) {
@@ -28767,9 +29562,58 @@ function runLinksRule(ctx) {
 }
 var linksRule = { id: "links", run: runLinksRule };
 
+// src/audit/rules/prose-policy.ts
+function runProsePolicyRule(ctx) {
+  if (ctx.policies.length === 0)
+    return [];
+  const issues = [];
+  const draftPrefixes = ctx.config.draftPathPrefixes ?? [];
+  for (const filePath of ctx.files) {
+    const rel = relPath(filePath, ctx.root);
+    const content3 = readFileContent(filePath);
+    const lines = content3.split(`
+`);
+    const policies = policiesForFile(ctx.policies, rel);
+    for (const entry of policies) {
+      if (entry.mode === "fingerprint")
+        continue;
+      if (!entry.regex)
+        continue;
+      if (entry.id === "draft-marker") {
+        for (let i = 0;i < lines.length; i++) {
+          if (entry.regex.test(lines[i] ?? "") && !isDraftPlacementAllowed(rel, draftPrefixes)) {
+            issues.push(issue("prose-policy", rel, entry.message, {
+              link: `line ${i + 1}`,
+              severity: entry.severity
+            }));
+          }
+        }
+        continue;
+      }
+      const isMultiline = entry.pattern?.includes("[\\s\\S]");
+      if (isMultiline) {
+        if (entry.regex.test(content3)) {
+          issues.push(issue("prose-policy", rel, entry.message, { severity: entry.severity }));
+        }
+        continue;
+      }
+      for (let i = 0;i < lines.length; i++) {
+        if (entry.regex.test(lines[i] ?? "")) {
+          issues.push(issue("prose-policy", rel, entry.message, {
+            link: `line ${i + 1}`,
+            severity: entry.severity
+          }));
+        }
+      }
+    }
+  }
+  return issues;
+}
+var prosePolicyRule = { id: "prose-policy", run: runProsePolicyRule };
+
 // src/audit/rules/registry.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "node:fs";
+import { join as join12 } from "node:path";
 function runRegistryRule(ctx) {
   const issues = [];
   const registry = new Set(ctx.registryPaths);
@@ -28777,12 +29621,12 @@ function runRegistryRule(ctx) {
     issues.push(issue("registry", REGISTRY_REL_PATH, "registry table header found but 0 rows parsed — check | Topic | Canonical file | format and link syntax"));
   }
   for (const rel of ctx.registryPaths) {
-    const abs = join9(ctx.root, rel);
-    if (!existsSync9(abs)) {
+    const abs = join12(ctx.root, rel);
+    if (!existsSync15(abs)) {
       issues.push(issue("registry", rel, "registry entry file missing"));
       continue;
     }
-    const content3 = readFileSync8(abs, "utf8");
+    const content3 = readFileSync12(abs, "utf8");
     if (!SOURCE_OF_TRUTH_BANNER_RE.test(content3)) {
       issues.push(issue("registry", rel, "missing **Source of truth for** banner (required for registry entry)"));
     }
@@ -28793,7 +29637,7 @@ function runRegistryRule(ctx) {
       continue;
     if (!rel.endsWith(".md") && !rel.endsWith(".mdc"))
       continue;
-    const content3 = readFileSync8(filePath, "utf8");
+    const content3 = readFileSync12(filePath, "utf8");
     if (!SOURCE_OF_TRUTH_BANNER_LINE_RE.test(content3))
       continue;
     if (!registry.has(rel)) {
@@ -28830,16 +29674,16 @@ function runScanRootsRule(ctx) {
 var scanRootsRule = { id: "scan-roots", run: runScanRootsRule };
 
 // src/audit/rules/skill-index.ts
-import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync9 } from "node:fs";
-import { join as join10, relative as relative7 } from "node:path";
+import { existsSync as existsSync16, readdirSync as readdirSync5, readFileSync as readFileSync13 } from "node:fs";
+import { join as join13, relative as relative8 } from "node:path";
 function walkSkillMarkdown(dir) {
   const files = [];
-  if (!existsSync10(dir))
+  if (!existsSync16(dir))
     return files;
   for (const entry of readdirSync5(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join10(dir, entry.name);
+    const fullPath = join13(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkSkillMarkdown(fullPath));
       continue;
@@ -28865,8 +29709,8 @@ function parseReadmeTaxonomySlugs(content3) {
 }
 function scanFileForSkillLinks(ctx, filePath, index2) {
   const issues = [];
-  const rel = relative7(ctx.root, filePath).replace(/\\/g, "/");
-  const content3 = readFileSync9(filePath, "utf8");
+  const rel = relative8(ctx.root, filePath).replace(/\\/g, "/");
+  const content3 = readFileSync13(filePath, "utf8");
   if (isGeneratedReference(content3))
     return issues;
   for (const match of content3.matchAll(SKILL_LINK_RE)) {
@@ -28889,14 +29733,14 @@ function validateReadmeTaxonomy(ctx, index2, diskSlugs) {
   for (const skillRoot of index2.roots) {
     if (skillRoot.kind !== "nested")
       continue;
-    const readmePath = join10(ctx.root, skillRoot.relPath, "README.md");
-    if (!existsSync10(readmePath))
+    const readmePath = join13(ctx.root, skillRoot.relPath, "README.md");
+    if (!existsSync16(readmePath))
       continue;
-    const readme = readFileSync9(readmePath, "utf8");
+    const readme = readFileSync13(readmePath, "utf8");
     if (!readme.includes("## Taxonomy"))
       continue;
     const taxonomySlugs = parseReadmeTaxonomySlugs(readme);
-    const nestedSlugs = diskSlugs.filter((slug2) => existsSync10(join10(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
+    const nestedSlugs = diskSlugs.filter((slug2) => existsSync16(join13(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
     const publicSlugs = nestedSlugs.filter((slug2) => !nonPublic.has(slug2));
     const relReadme = `${skillRoot.relPath}/README.md`;
     for (const slug2 of publicSlugs) {
@@ -28918,16 +29762,16 @@ function runSkillIndexRule(ctx) {
   const diskSlugs = listSkillSlugs(index2);
   issues.push(...validateReadmeTaxonomy(ctx, index2, diskSlugs));
   for (const skillRoot of index2.roots) {
-    const scanRoot = skillRoot.kind === "nested" ? join10(ctx.root, skillRoot.relPath) : join10(ctx.root);
-    if (skillRoot.kind === "nested" && existsSync10(scanRoot)) {
+    const scanRoot = skillRoot.kind === "nested" ? join13(ctx.root, skillRoot.relPath) : join13(ctx.root);
+    if (skillRoot.kind === "nested" && existsSync16(scanRoot)) {
       for (const skillMd of walkSkillMarkdown(scanRoot)) {
         issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
       }
     }
     if (skillRoot.kind === "flat") {
       for (const slug2 of index2.slugs) {
-        const skillDir = join10(ctx.root, slug2);
-        if (existsSync10(skillDir)) {
+        const skillDir = join13(ctx.root, slug2);
+        if (existsSync16(skillDir)) {
           for (const skillMd of walkSkillMarkdown(skillDir)) {
             issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
           }
@@ -28949,21 +29793,54 @@ var docsRules = [
   { ...coverageGapsRule, global: true },
   linksRule,
   docMetaRule,
-  { ...bannedRule, global: true }
+  { ...bannedRule, global: true },
+  prosePolicyRule
 ];
 var skillsRules = [
   { ...skillIndexRule, global: true },
-  { ...generatedReferencesRule, global: true }
+  { ...generatedReferencesRule, global: true },
+  prosePolicyRule
 ];
 var allRules = [...docsRules, ...skillsRules];
-function rulesForSuite(suite) {
+function assembleRules(pluginRules = []) {
+  const coreIds = new Set(allRules.map((rule) => rule.id));
+  const seenPlugin = new Set;
+  for (const rule of pluginRules) {
+    if (seenPlugin.has(rule.id) || coreIds.has(rule.id)) {
+      throw new Error(`Duplicate audit rule id: ${rule.id}`);
+    }
+    seenPlugin.add(rule.id);
+  }
+  const docs = [...docsRules];
+  const skills = [...skillsRules];
+  for (const rule of pluginRules) {
+    const suites = rule.suites ?? ["docs"];
+    const inDocs = suites.includes("docs");
+    const inSkills = suites.includes("skills");
+    if (!inDocs && !inSkills) {
+      const listed = suites.length === 0 ? "(empty)" : suites.join(", ");
+      throw new Error(`Plugin rule "${rule.id}" suites attach to no known suite (got ${listed}; allowed: docs, skills). ` + `"self" is the union of docs+skills — put the rule in docs and/or skills.`);
+    }
+    if (inDocs)
+      docs.push(rule);
+    if (inSkills)
+      skills.push(rule);
+  }
+  const selfById = new Map;
+  for (const rule of [...docs, ...skills]) {
+    selfById.set(rule.id, rule);
+  }
+  return { docs, skills, self: [...selfById.values()] };
+}
+function rulesForSuite(suite, pluginRules = []) {
+  const assembled = assembleRules(pluginRules);
   switch (suite) {
     case "docs":
-      return docsRules;
+      return assembled.docs;
     case "skills":
-      return skillsRules;
+      return assembled.skills;
     case "self":
-      return allRules;
+      return assembled.self;
     default:
       throw new Error(`Unknown suite: ${suite}`);
   }
@@ -28974,22 +29851,42 @@ function parseAuditArgs(argv) {
   let suite = "docs";
   let strict = false;
   let json = false;
+  let dryRun = false;
   let paths = [];
   let only = null;
-  for (const arg of argv) {
+  let fix = null;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i] ?? "";
     if (arg.startsWith("--suite=")) {
       suite = arg.slice("--suite=".length);
     } else if (arg === "--strict") {
       strict = true;
     } else if (arg === "--json") {
       json = true;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg.startsWith("--dry-run=")) {
+      throw new Error("audit: use --dry-run (boolean flag), not --dry-run=<value>");
+    } else if (arg === "--fix") {
+      const next = argv[i + 1];
+      if (next && !next.startsWith("-")) {
+        if (next !== "doc-meta" && next !== "anchors") {
+          throw new Error(`Unknown --fix kind: ${next}. Use --fix, --fix=doc-meta, or --fix=anchors.`);
+        }
+        fix = next;
+        i++;
+      } else {
+        fix = true;
+      }
+    } else if (arg.startsWith("--fix=")) {
+      fix = arg.slice("--fix=".length);
     } else if (arg.startsWith("--paths=")) {
       paths = arg.slice("--paths=".length).split(",").map((path2) => path2.trim()).filter(Boolean);
     } else if (arg.startsWith("--only=")) {
       only = new Set(arg.slice("--only=".length).split(",").filter(Boolean));
     }
   }
-  return { suite, strict, json, paths, only };
+  return { suite, strict, json, paths, only, fix, dryRun };
 }
 function labelForSuite(suite) {
   switch (suite) {
@@ -29012,16 +29909,40 @@ function shouldRunRule(rule, options, pathScoped) {
     return false;
   return true;
 }
-function runAudit(options) {
-  const ctx = createContext({
+async function runAudit(options) {
+  const pathScoped = options.paths.length > 0;
+  const base = createContext({
     root: options.root,
-    paths: options.paths.length > 0 ? options.paths : undefined
+    paths: pathScoped ? options.paths : undefined,
+    includeExcludedSkillTrees: options.suite === "skills" && !pathScoped
   });
-  const rules = rulesForSuite(options.suite).filter((r) => !options.only || options.only.has(r.id));
-  const pathScoped = options.paths.length > 0 && !options.globalOnly;
+  const loaded = await loadPlugins(base.root, base.config);
+  const ctx = { ...base, policies: loaded.policies };
+  if (options.fix !== null && options.fix !== undefined) {
+    if (options.suite !== "docs") {
+      console.error("--fix is supported only for audit docs");
+      return 1;
+    }
+    const kinds = fixKindsForOnly(parseFixKinds(options.fix), options.only);
+    if (kinds.length === 0) {
+      console.error("--fix has no overlapping rules with --only (doc-meta → doc-meta, anchors → links).");
+      return 1;
+    }
+    applyFixes(ctx, { kinds, dryRun: options.dryRun });
+    if (!options.dryRun) {
+      const refreshed = createContext({
+        root: options.root,
+        paths: options.paths.length > 0 ? options.paths : undefined,
+        policies: loaded.policies
+      });
+      Object.assign(ctx, refreshed);
+    }
+  }
+  const rules = rulesForSuite(options.suite, loaded.rules).filter((r) => !options.only || options.only.has(r.id));
+  const skipGlobalsForPaths = pathScoped && !options.globalOnly;
   const issues = [];
   for (const rule of rules) {
-    if (!shouldRunRule(rule, options, pathScoped))
+    if (!shouldRunRule(rule, options, skipGlobalsForPaths))
       continue;
     issues.push(...rule.run(ctx));
   }
@@ -29036,19 +29957,19 @@ function runAudit(options) {
 }
 
 // src/customize/resolve.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename2, join as join11, relative as relative8 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
+import { basename as basename3, join as join14, relative as relative9 } from "node:path";
 var CUSTOMIZE_PREFIX = "Customize: ";
 function customizeDir(root2) {
-  return join11(root2, REGISTRY_DIR_REL, "customize");
+  return join14(root2, REGISTRY_DIR_REL, "customize");
 }
 function customizePathForSlug(root2, slug2) {
-  return join11(customizeDir(root2), `${slug2}.md`);
+  return join14(customizeDir(root2), `${slug2}.md`);
 }
 function findCustomizeViaRegistry(root2, slug2) {
   for (const rel of parseRegistryPaths(root2)) {
     const expected = `${REGISTRY_DIR_REL}/customize/${slug2}.md`;
-    if (normalizeRelPath(rel) === expected && existsSync11(join11(root2, rel))) {
+    if (normalizeRelPath(rel) === expected && existsSync17(join14(root2, rel))) {
       return rel;
     }
   }
@@ -29056,17 +29977,17 @@ function findCustomizeViaRegistry(root2, slug2) {
 }
 function resolveSlugFile(root2, slug2) {
   const direct = customizePathForSlug(root2, slug2);
-  if (existsSync11(direct)) {
+  if (existsSync17(direct)) {
     return {
-      content: readFileSync10(direct, "utf8"),
-      path: normalizeRelPath(relative8(root2, direct))
+      content: readFileSync14(direct, "utf8"),
+      path: normalizeRelPath(relative9(root2, direct))
     };
   }
   const registryPath = findCustomizeViaRegistry(root2, slug2);
   if (registryPath) {
-    const abs = join11(root2, registryPath);
+    const abs = join14(root2, registryPath);
     return {
-      content: readFileSync10(abs, "utf8"),
+      content: readFileSync14(abs, "utf8"),
       path: registryPath
     };
   }
@@ -29085,21 +30006,21 @@ function readAlwaysInclude(root2, basenames, skipBasename) {
   const paths = [];
   const dir = customizeDir(root2);
   for (const name of basenames) {
-    const file = basename2(name);
+    const file = basename3(name);
     if (skipBasename && file === skipBasename)
       continue;
-    const abs = join11(dir, file);
-    if (!existsSync11(abs))
+    const abs = join14(dir, file);
+    if (!existsSync17(abs))
       continue;
-    parts.push(readFileSync10(abs, "utf8").trimEnd());
-    paths.push(normalizeRelPath(relative8(root2, abs)));
+    parts.push(readFileSync14(abs, "utf8").trimEnd());
+    paths.push(normalizeRelPath(relative9(root2, abs)));
   }
   return { parts, paths };
 }
 function resolveCustomize(root2, slug2) {
   const slugFile = resolveSlugFile(root2, slug2);
   const alwaysNames = alwaysIncludeBasenames(root2);
-  const skip = slugFile.path != null ? basename2(slugFile.path) : null;
+  const skip = slugFile.path != null ? basename3(slugFile.path) : null;
   const always = readAlwaysInclude(root2, alwaysNames, skip);
   const parts = [];
   const included = [];
@@ -29132,49 +30053,49 @@ function resolveCustomizeFromRoot(slug2, startDir) {
 
 // src/init/init.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { copyFileSync, existsSync as existsSync15, mkdirSync as mkdirSync2, readFileSync as readFileSync12 } from "node:fs";
-import { join as join15 } from "node:path";
+import { copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync2, readFileSync as readFileSync16 } from "node:fs";
+import { join as join18 } from "node:path";
 
 // src/init/merge-hooks.ts
-import { existsSync as existsSync14, mkdirSync, readFileSync as readFileSync11, writeFileSync } from "node:fs";
-import { dirname as dirname6, join as join14 } from "node:path";
+import { existsSync as existsSync20, mkdirSync, readFileSync as readFileSync15, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname10, join as join17 } from "node:path";
 
 // src/init/package-paths.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { dirname as dirname4, join as join12 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-var MODULE_DIR = dirname4(fileURLToPath4(import.meta.url));
-var PACKAGE_ROOT_CANDIDATES = [join12(MODULE_DIR, "../.."), join12(MODULE_DIR, "..")];
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname8, join as join15 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+var MODULE_DIR = dirname8(fileURLToPath5(import.meta.url));
+var PACKAGE_ROOT_CANDIDATES = [join15(MODULE_DIR, "../.."), join15(MODULE_DIR, "..")];
 function resolvePackageRoot() {
   for (const candidate of PACKAGE_ROOT_CANDIDATES) {
-    if (existsSync12(join12(candidate, "package.json")))
+    if (existsSync18(join15(candidate, "package.json")))
       return candidate;
   }
   throw new Error("Could not resolve @csark0812/skeleton package root");
 }
 function resolveTemplatesDir() {
-  const dir = join12(resolvePackageRoot(), "templates/skeleton-init");
-  if (!existsSync12(dir)) {
+  const dir = join15(resolvePackageRoot(), "templates/skeleton-init");
+  if (!existsSync18(dir)) {
     throw new Error("Missing templates/skeleton-init in package");
   }
   return dir;
 }
 
 // src/init/resolve-hook-command.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname5, join as join13, relative as relative9, resolve as resolve5 } from "node:path";
+import { dirname as dirname9, join as join16, relative as relative10, resolve as resolve8 } from "node:path";
 var PACKAGE_NAME = "@csark0812/skeleton";
 var HOOK_DIST = "dist/hooks/customize-on-skill-read.js";
 var HOOK_SRC = "src/hooks/customize-on-skill-read.ts";
 var PACKAGE_ROOT = resolvePackageRoot();
 function toRepoRelative(cwd, absPath) {
-  const rel = relative9(cwd, absPath).replace(/\\/g, "/");
+  const rel = relative10(cwd, absPath).replace(/\\/g, "/");
   return rel.startsWith("..") ? absPath.replace(/\\/g, "/") : rel;
 }
 function tryResolvePublished(cwd) {
   try {
-    const req = createRequire3(join13(cwd, "package.json"));
+    const req = createRequire3(join16(cwd, "package.json"));
     return req.resolve(`${PACKAGE_NAME}/${HOOK_DIST}`);
   } catch {
     return null;
@@ -29183,10 +30104,10 @@ function tryResolvePublished(cwd) {
 function walkNodeModules(cwd) {
   let dir = cwd;
   while (true) {
-    const candidate = join13(dir, "node_modules", PACKAGE_NAME, HOOK_DIST);
-    if (existsSync13(candidate))
+    const candidate = join16(dir, "node_modules", PACKAGE_NAME, HOOK_DIST);
+    if (existsSync19(candidate))
       return candidate;
-    const parent = dirname5(dir);
+    const parent = dirname9(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -29194,7 +30115,7 @@ function walkNodeModules(cwd) {
   return null;
 }
 function isInsidePackageRoot(cwd) {
-  const rel = relative9(PACKAGE_ROOT, resolve5(cwd)).replace(/\\/g, "/");
+  const rel = relative10(PACKAGE_ROOT, resolve8(cwd)).replace(/\\/g, "/");
   return rel === "" || !rel.startsWith("..") && !rel.startsWith("/");
 }
 function resolveHookCommand(cwd) {
@@ -29205,11 +30126,11 @@ function resolveHookCommand(cwd) {
   if (hoisted)
     return toRepoRelative(cwd, hoisted);
   if (isInsidePackageRoot(cwd)) {
-    const distHook = join13(PACKAGE_ROOT, HOOK_DIST);
-    if (existsSync13(distHook))
+    const distHook = join16(PACKAGE_ROOT, HOOK_DIST);
+    if (existsSync19(distHook))
       return toRepoRelative(cwd, distHook);
-    const srcHook = join13(PACKAGE_ROOT, HOOK_SRC);
-    if (existsSync13(srcHook)) {
+    const srcHook = join16(PACKAGE_ROOT, HOOK_SRC);
+    if (existsSync19(srcHook)) {
       const rel = toRepoRelative(cwd, srcHook);
       return rel.includes("/") ? `bun ${rel}` : `bun ./${rel}`;
     }
@@ -29228,21 +30149,21 @@ function identityKey(platform, event, matcher) {
   return `skeleton:customize:${platform}:${event}:${matcher}`;
 }
 function loadFragment(name, hookCommand) {
-  const raw = readFileSync11(join14(TEMPLATES_DIR, name), "utf8");
+  const raw = readFileSync15(join17(TEMPLATES_DIR, name), "utf8");
   return JSON.parse(raw.replaceAll("{{HOOK_COMMAND}}", hookCommand));
 }
 function readJson(path2) {
-  if (!existsSync14(path2))
+  if (!existsSync20(path2))
     return null;
   try {
-    return JSON.parse(readFileSync11(path2, "utf8"));
+    return JSON.parse(readFileSync15(path2, "utf8"));
   } catch (error) {
     throw new Error(`Invalid JSON in ${path2}: ${error}`);
   }
 }
 function writeJson(path2, value) {
-  mkdirSync(dirname6(path2), { recursive: true });
-  writeFileSync(path2, `${JSON.stringify(value, null, 2)}
+  mkdirSync(dirname10(path2), { recursive: true });
+  writeFileSync2(path2, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 function deepEqual(a, b) {
@@ -29341,14 +30262,14 @@ function mergeNestedHooks(platform, targetPath, fragment, eventName, opts) {
 }
 function mergeHookConfigs(opts) {
   const results = [];
-  const cursorPath = join14(opts.cwd, ".cursor/hooks.json");
+  const cursorPath = join17(opts.cwd, ".cursor/hooks.json");
   const cursorFragment = loadFragment("cursor-hooks.fragment.json", opts.hookCommand);
   results.push(mergeCursorHooks(cursorPath, cursorFragment, opts));
-  const claudePath = join14(opts.cwd, ".claude/settings.json");
+  const claudePath = join17(opts.cwd, ".claude/settings.json");
   const claudeFragment = loadFragment("claude-settings.fragment.json", opts.hookCommand);
   results.push(mergeNestedHooks("claude", claudePath, claudeFragment, "PostToolUse", opts));
-  const codexPath = join14(opts.cwd, ".codex/hooks.json");
-  if (existsSync14(join14(opts.cwd, ".codex"))) {
+  const codexPath = join17(opts.cwd, ".codex/hooks.json");
+  if (existsSync20(join17(opts.cwd, ".codex"))) {
     const codexFragment = loadFragment("codex-hooks.fragment.json", opts.hookCommand);
     results.push(mergeNestedHooks("codex", codexPath, codexFragment, "PostToolUse", opts));
   } else {
@@ -29357,11 +30278,11 @@ function mergeHookConfigs(opts) {
   return results;
 }
 function mergePackageJsonScripts(cwd) {
-  const pkgPath = join14(cwd, "package.json");
-  if (!existsSync14(pkgPath))
+  const pkgPath = join17(cwd, "package.json");
+  if (!existsSync20(pkgPath))
     return "skipped";
-  const fragment = JSON.parse(readFileSync11(join14(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
-  const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+  const fragment = JSON.parse(readFileSync15(join17(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync15(pkgPath, "utf8"));
   pkg.scripts ??= {};
   let changed = false;
   for (const [key, value] of Object.entries(fragment)) {
@@ -29372,7 +30293,7 @@ function mergePackageJsonScripts(cwd) {
   }
   if (!changed)
     return "skipped";
-  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync2(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `, "utf8");
   return "updated";
 }
@@ -29417,27 +30338,27 @@ function skillsAddArgs(options = {}) {
 // src/init/init.ts
 var TEMPLATES_DIR2 = resolveTemplatesDir();
 function writeScaffold(cwd) {
-  const skeletonDir = join15(cwd, ".skeleton");
-  mkdirSync2(skeletonDir, { recursive: true });
+  const skeletonDir2 = join18(cwd, ".skeleton");
+  mkdirSync2(skeletonDir2, { recursive: true });
   let created = false;
-  const configPath = join15(skeletonDir, "config.yaml");
-  if (!existsSync15(configPath)) {
-    copyFileSync(join15(TEMPLATES_DIR2, "config.yaml"), configPath);
+  const configPath = join18(skeletonDir2, "config.yaml");
+  if (!existsSync21(configPath)) {
+    copyFileSync(join18(TEMPLATES_DIR2, "config.yaml"), configPath);
     created = true;
   }
-  const registryPath = join15(skeletonDir, "registry.md");
-  if (!existsSync15(registryPath)) {
-    copyFileSync(join15(TEMPLATES_DIR2, "registry.md"), registryPath);
+  const registryPath = join18(skeletonDir2, "registry.md");
+  if (!existsSync21(registryPath)) {
+    copyFileSync(join18(TEMPLATES_DIR2, "registry.md"), registryPath);
     created = true;
   }
-  mkdirSync2(join15(skeletonDir, "customize"), { recursive: true });
+  mkdirSync2(join18(skeletonDir2, "customize"), { recursive: true });
   return created ? "created" : "skipped";
 }
 function assertPackageResolvable(cwd) {
-  const pkgPath = join15(cwd, "package.json");
-  if (!existsSync15(pkgPath))
+  const pkgPath = join18(cwd, "package.json");
+  if (!existsSync21(pkgPath))
     return;
-  const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
   const hasDep = pkg.devDependencies?.["@csark0812/skeleton"] || pkg.dependencies?.["@csark0812/skeleton"];
   if (!hasDep) {
     try {
@@ -29518,51 +30439,188 @@ function parseInitArgs(argv) {
   return { forceHooks, skills, noSkills, skillsFlags };
 }
 
+// src/plugins/build.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync22, readFileSync as readFileSync17, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename4, dirname as dirname11, resolve as resolve9 } from "node:path";
+function parseBuildPluginArgs(argv) {
+  let check = false;
+  let entry;
+  for (const arg of argv) {
+    if (arg === "--check") {
+      check = true;
+    } else if (arg.startsWith("--check=")) {
+      throw new Error("build-plugin: use --check (boolean flag), not --check=<value>");
+    } else if (arg.startsWith("-")) {
+      throw new Error(`build-plugin: unknown flag ${arg}`);
+    } else if (!entry) {
+      entry = arg;
+    }
+  }
+  return { entry, check };
+}
+function collectPluginEntries(root2, config, entry) {
+  if (entry) {
+    const abs = entry.startsWith("/") || /^[A-Za-z]:[\\/]/.test(entry) ? resolveAbsolutePluginTsPath(root2, entry) : resolvePluginTsPath(root2, entry);
+    return [abs];
+  }
+  return (config.plugins ?? []).map((e) => resolvePluginTsPath(root2, e));
+}
+function localImportPaths(tsAbs, content3) {
+  const dir = dirname11(tsAbs);
+  const deps = [];
+  const re = /(?:from\s+|import\s*\(\s*|import\s+)["'](\.[^"']+)["']/g;
+  for (const match of content3.matchAll(re)) {
+    const spec = match[1];
+    if (!spec)
+      continue;
+    const candidates = [];
+    if (spec.endsWith(".js")) {
+      const withoutJs = spec.slice(0, -".js".length);
+      candidates.push(resolve9(dir, `${withoutJs}.ts`), resolve9(dir, spec), resolve9(dir, withoutJs, "index.ts"));
+    } else {
+      candidates.push(resolve9(dir, spec), resolve9(dir, `${spec}.ts`), resolve9(dir, `${spec}.js`), resolve9(dir, spec, "index.ts"));
+    }
+    for (const candidate of candidates) {
+      if (existsSync22(candidate) && candidate.endsWith(".ts")) {
+        deps.push(candidate);
+        break;
+      }
+    }
+  }
+  return deps;
+}
+function stampPathForMjs(mjsAbs) {
+  return `${mjsAbs}.stamp`;
+}
+function sourceFingerprint(tsAbs, seen = new Set) {
+  const hash = createHash("sha256");
+  function walk(abs) {
+    if (seen.has(abs))
+      return;
+    seen.add(abs);
+    const content3 = readFileSync17(abs, "utf8");
+    hash.update(basename4(abs));
+    hash.update("\x00");
+    hash.update(content3);
+    hash.update("\x00");
+    for (const dep of localImportPaths(abs, content3).sort()) {
+      walk(dep);
+    }
+  }
+  walk(tsAbs);
+  return hash.digest("hex");
+}
+function writeStamp(tsAbs, mjsAbs) {
+  writeFileSync3(stampPathForMjs(mjsAbs), `${sourceFingerprint(tsAbs)}
+`, "utf8");
+}
+async function buildOne(tsAbs) {
+  const mjsAbs = mjsPathForTs(tsAbs);
+  if (!existsSync22(tsAbs)) {
+    throw new Error(`Plugin source not found: ${tsAbs}`);
+  }
+  const proc = spawnSync3("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
+  if (proc.error) {
+    const code3 = proc.error.code;
+    if (code3 === "ENOENT") {
+      throw new Error("skeleton build-plugin requires the bun binary on PATH (bun build). Install Bun 1.2.x.");
+    }
+    throw new Error(`skeleton build-plugin failed to spawn bun: ${proc.error.message}`);
+  }
+  if (proc.status !== 0) {
+    throw new Error(`skeleton build-plugin failed for ${tsAbs}:
+${proc.stderr || proc.stdout || `exit ${proc.status}`}`);
+  }
+  writeStamp(tsAbs, mjsAbs);
+  return mjsAbs;
+}
+function checkOne(tsAbs) {
+  const mjsAbs = mjsPathForTs(tsAbs);
+  if (!existsSync22(mjsAbs)) {
+    throw new Error(`Plugin not built: ${tsAbs} (missing ${mjsAbs}). Run: skeleton build-plugin`);
+  }
+  if (!existsSync22(tsAbs)) {
+    throw new Error(`Plugin source not found: ${tsAbs}`);
+  }
+  const stampAbs = stampPathForMjs(mjsAbs);
+  if (!existsSync22(stampAbs)) {
+    throw new Error(`Plugin stale: ${mjsAbs} has no fingerprint stamp. Run: skeleton build-plugin`);
+  }
+  const expected = readFileSync17(stampAbs, "utf8").trim();
+  const actual = sourceFingerprint(tsAbs);
+  if (expected !== actual) {
+    throw new Error(`Plugin stale: ${mjsAbs} does not match ${tsAbs} (or local imports). Run: skeleton build-plugin`);
+  }
+}
+async function runBuildPlugin(options = {}) {
+  const root2 = options.root ?? findRepoRoot();
+  const config = loadConfig(root2);
+  const entries = collectPluginEntries(root2, config, options.entry);
+  if (entries.length === 0) {
+    return { built: [], checked: [] };
+  }
+  const built = [];
+  const checked = [];
+  if (options.check) {
+    for (const entry of entries) {
+      checkOne(entry);
+      checked.push(mjsPathForTs(entry));
+    }
+    return { built, checked };
+  }
+  for (const entry of entries) {
+    built.push(await buildOne(entry));
+  }
+  return { built, checked };
+}
+
 // src/references/sync.ts
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync18,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname7, join as join16, relative as relative10 } from "node:path";
+import { dirname as dirname12, join as join19, relative as relative11 } from "node:path";
 function walkMarkdownFiles2(dir, root2) {
   const files = [];
-  if (!existsSync16(dir))
+  if (!existsSync23(dir))
     return files;
   for (const entry of readdirSync6(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join16(dir, entry.name);
+    const fullPath = join19(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkMarkdownFiles2(fullPath, root2));
       continue;
     }
     if (entry.name.endsWith(".md")) {
-      files.push(normalizeRelPath(relative10(root2, fullPath)));
+      files.push(normalizeRelPath(relative11(root2, fullPath)));
     }
   }
   return files;
 }
 function listGeneratedReferenceFiles(skillDir, skill) {
-  const refsDir = join16(skillDir, "references");
-  if (!existsSync16(refsDir))
+  const refsDir = join19(skillDir, "references");
+  if (!existsSync23(refsDir))
     return [];
   const files = [];
   const walk = (dir) => {
     for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-      const fullPath = join16(dir, entry.name);
+      const fullPath = join19(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
         continue;
       }
       if (!entry.name.endsWith(".md"))
         continue;
-      const content3 = readFileSync13(fullPath, "utf8");
+      const content3 = readFileSync18(fullPath, "utf8");
       if (isGeneratedReference(content3)) {
-        const refPath = normalizeRelPath(relative10(refsDir, fullPath));
+        const refPath = normalizeRelPath(relative11(refsDir, fullPath));
         files.push(generatedRefPath(skill, refPath));
       }
     }
@@ -29572,8 +30630,8 @@ function listGeneratedReferenceFiles(skillDir, skill) {
 }
 function syncReferences(options = {}) {
   const root2 = options.root ?? process.cwd();
-  const canonicalDir = join16(root2, CANONICAL_REFS_DIR);
-  if (!existsSync16(canonicalDir)) {
+  const canonicalDir = join19(root2, CANONICAL_REFS_DIR);
+  if (!existsSync23(canonicalDir)) {
     throw new Error(`canonical references dir not found: ${CANONICAL_REFS_DIR}`);
   }
   const result = {
@@ -29584,24 +30642,24 @@ function syncReferences(options = {}) {
   };
   const plans = discoverSkillReferencePlans(root2);
   for (const plan of plans) {
-    const skillDir = join16(root2, plan.skill);
+    const skillDir = join19(root2, plan.skill);
     for (const refPath of plan.refPaths) {
-      const sourceRel = normalizeRelPath(join16(CANONICAL_REFS_DIR, refPath));
-      const canonicalPath = join16(root2, sourceRel);
-      if (!existsSync16(canonicalPath)) {
+      const sourceRel = normalizeRelPath(join19(CANONICAL_REFS_DIR, refPath));
+      const canonicalPath = join19(root2, sourceRel);
+      if (!existsSync23(canonicalPath)) {
         throw new Error(`canonical reference missing: ${sourceRel}`);
       }
       const targetRel = generatedRefPath(plan.skill, refPath);
-      const targetPath = join16(root2, targetRel);
-      const canonicalContent = readFileSync13(canonicalPath, "utf8");
+      const targetPath = join19(root2, targetRel);
+      const canonicalContent = readFileSync18(canonicalPath, "utf8");
       const nextContent = formatGeneratedHeader(sourceRel) + canonicalContent;
       if (!options.dryRun) {
-        mkdirSync3(dirname7(targetPath), { recursive: true });
+        mkdirSync3(dirname12(targetPath), { recursive: true });
       }
-      const existing = existsSync16(targetPath) ? readFileSync13(targetPath, "utf8") : null;
+      const existing = existsSync23(targetPath) ? readFileSync18(targetPath, "utf8") : null;
       if (existing !== nextContent) {
         if (!options.dryRun)
-          writeFileSync2(targetPath, nextContent, "utf8");
+          writeFileSync4(targetPath, nextContent, "utf8");
         result.written.push(targetRel);
       } else {
         result.skipped.push(targetRel);
@@ -29609,12 +30667,12 @@ function syncReferences(options = {}) {
     }
     if (options.rewriteLinks !== false) {
       for (const relFile of walkMarkdownFiles2(skillDir, root2)) {
-        const filePath = join16(root2, relFile);
-        const content3 = readFileSync13(filePath, "utf8");
+        const filePath = join19(root2, relFile);
+        const content3 = readFileSync18(filePath, "utf8");
         const next = rewriteSharedRefLinks(content3, relFile, plan.skill);
         if (next !== content3) {
           if (!options.dryRun)
-            writeFileSync2(filePath, next, "utf8");
+            writeFileSync4(filePath, next, "utf8");
           result.rewritten.push(relFile);
         }
       }
@@ -29622,7 +30680,7 @@ function syncReferences(options = {}) {
     for (const generatedRel of listGeneratedReferenceFiles(skillDir, plan.skill)) {
       const refPath = generatedRel.slice(`${plan.skill}/references/`.length);
       if (!plan.refPaths.has(refPath)) {
-        const fullPath = join16(root2, generatedRel);
+        const fullPath = join19(root2, generatedRel);
         if (!options.dryRun)
           unlinkSync(fullPath);
         result.removed.push(generatedRel);
@@ -29667,8 +30725,8 @@ function printSyncResult(result) {
 }
 
 // src/register.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname8, join as join17, relative as relative11 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync19, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname13, join as join20, relative as relative12 } from "node:path";
 var REGISTRY_TABLE_ROW_RE2 = /^\|\s*([^|]+)\|\s*\[[^\]]*\]\(([^)]+)\)\s*\|/;
 var REGISTRY_TABLE_HEADER = "| Topic | Canonical file |";
 function extractTopic(content3) {
@@ -29676,8 +30734,8 @@ function extractTopic(content3) {
   return match?.[1]?.trim().replace(/\s+$/, "") ?? null;
 }
 function toRegistryLink(root2, absPath) {
-  const fromRegistry = join17(root2, REGISTRY_DIR_REL);
-  return normalizeRelPath(relative11(fromRegistry, absPath));
+  const fromRegistry = join20(root2, REGISTRY_DIR_REL);
+  return normalizeRelPath(relative12(fromRegistry, absPath));
 }
 function inferSection(registryLink) {
   return registryLink.startsWith("customize/") ? "Customizations" : "Documentation";
@@ -29701,12 +30759,12 @@ function parseRegistryRows(content3) {
   return rows;
 }
 function pathFromRegistryLink(root2, link2) {
-  return normalizeRelPath(relative11(root2, join17(root2, REGISTRY_DIR_REL, link2)));
+  return normalizeRelPath(relative12(root2, join20(root2, REGISTRY_DIR_REL, link2)));
 }
 function isOutsideScan(root2, relPath2) {
   const config = loadConfig(root2);
   const skillIndex = buildSkillIndex(root2);
-  const scanned = collectScanFiles(config, root2, skillIndex).map((abs) => normalizeRelPath(relative11(root2, abs)));
+  const scanned = collectScanFiles(config, root2, skillIndex).map((abs) => normalizeRelPath(relative12(root2, abs)));
   if (scanned.includes(relPath2))
     return false;
   return !config.scan.include.some((pattern) => matchesGlobScope(relPath2, pattern));
@@ -29768,11 +30826,11 @@ ${newLine}
 function registerPath(options) {
   const root2 = options.root ?? findRepoRoot();
   const relPath2 = normalizeRelPath(options.path);
-  const absPath = join17(root2, relPath2);
-  if (!existsSync17(absPath)) {
+  const absPath = join20(root2, relPath2);
+  if (!existsSync24(absPath)) {
     throw new Error(`File not found: ${relPath2}`);
   }
-  const content3 = readFileSync14(absPath, "utf8");
+  const content3 = readFileSync19(absPath, "utf8");
   let topic = options.topic ?? extractTopic(content3);
   if (!topic) {
     throw new Error(`No **Source of truth for** banner in ${relPath2} — add banner or pass --topic`);
@@ -29780,9 +30838,9 @@ function registerPath(options) {
   const registryLink = toRegistryLink(root2, absPath);
   topic = ensureCustomizeTopic(topic, registryLink);
   const section = inferSection(registryLink);
-  const registryAbs = join17(root2, REGISTRY_REL_PATH);
-  let registryContent = existsSync17(registryAbs) ? readFileSync14(registryAbs, "utf8") : defaultRegistryContent();
-  if (!existsSync17(registryAbs) && !existsSync17(join17(root2, ".skeleton/config.yaml"))) {
+  const registryAbs = join20(root2, REGISTRY_REL_PATH);
+  let registryContent = existsSync24(registryAbs) ? readFileSync19(registryAbs, "utf8") : defaultRegistryContent();
+  if (!existsSync24(registryAbs) && !existsSync24(join20(root2, ".skeleton/config.yaml"))) {
     throw new Error("Missing .skeleton/config.yaml — run skeleton init first");
   }
   const { content: updated, action } = upsertRow(registryContent, topic, registryLink, section, root2);
@@ -29795,11 +30853,11 @@ function registerPath(options) {
     warnOutsideScan: isOutsideScan(root2, relPath2)
   };
   if (!options.dryRun && action !== "noop") {
-    const dir = dirname8(registryAbs);
-    if (!existsSync17(dir)) {
+    const dir = dirname13(registryAbs);
+    if (!existsSync24(dir)) {
       throw new Error(`Missing ${REGISTRY_DIR_REL}/ directory`);
     }
-    writeFileSync3(registryAbs, registryContent, "utf8");
+    writeFileSync5(registryAbs, registryContent, "utf8");
   }
   if (result.warnOutsideScan) {
     console.error(`warning: ${relPath2} is outside scan.include — register succeeded but audit will not scan it`);
@@ -29817,12 +30875,12 @@ function registerPath(options) {
 }
 
 // src/validate/changed.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
-import { basename as basename3, extname, join as join18 } from "node:path";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync20 } from "node:fs";
+import { basename as basename5, extname as extname2, join as join21 } from "node:path";
 
 // src/validate/git-diff.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function gitDiffChangedFiles(options = {}) {
   const root2 = options.root ?? findRepoRoot();
   let args;
@@ -29833,7 +30891,7 @@ function gitDiffChangedFiles(options = {}) {
   } else {
     args = ["diff", "HEAD", "--name-only", "--diff-filter=ACMR"];
   }
-  const proc = spawnSync3("git", args, { cwd: root2, encoding: "utf8" });
+  const proc = spawnSync4("git", args, { cwd: root2, encoding: "utf8" });
   if (proc.status !== 0) {
     throw new Error(proc.stderr?.trim() || "git diff failed");
   }
@@ -29843,17 +30901,34 @@ function gitDiffChangedFiles(options = {}) {
 
 // src/validate/changed.ts
 var DOC_EXTENSIONS = new Set([".md", ".mdc", ".yaml", ".yml"]);
+var POLICY_EXTENSIONS = new Set([".yaml", ".yml"]);
 var SHELL_EXTENSIONS = new Set([".sh", ".bash", ".zsh"]);
 var SKIP_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py"]);
 var COMMAND_CONFIG_NAMES = new Set(["package.json", "project.json"]);
-function bucketFor(relPath2, root2) {
+function isSkeletonYamlCandidate(normalized, ext) {
+  if (!POLICY_EXTENSIONS.has(ext))
+    return false;
+  if (!(normalized.startsWith(".skeleton/") || normalized.startsWith(".skeleton\\"))) {
+    return false;
+  }
+  const name = basename5(normalized).toLowerCase();
+  if (name === "config.yaml" || name === "config.yml")
+    return false;
+  return true;
+}
+function bucketFor(relPath2, root2, wiredPolicies) {
   const normalized = normalizeRelPath(relPath2);
-  const ext = extname(normalized).toLowerCase();
-  const name = basename3(normalized);
+  const ext = extname2(normalized).toLowerCase();
+  const name = basename5(normalized);
   if (SKIP_EXTENSIONS.has(ext))
     return "skip";
   if (COMMAND_CONFIG_NAMES.has(name))
     return "skip";
+  if (isSkeletonYamlCandidate(normalized, ext)) {
+    if (wiredPolicies.has(normalized))
+      return "policy";
+    return "skip";
+  }
   const skillIndex = buildSkillIndex(root2);
   if (isSkillPath(normalized, skillIndex))
     return "skills";
@@ -29885,21 +30960,31 @@ function parseJsonContent(content3) {
   }
 }
 function validateJson(relPath2, root2) {
-  const abs = join18(root2, relPath2);
+  const abs = join21(root2, relPath2);
   try {
-    parseJsonContent(readFileSync15(abs, "utf8"));
+    parseJsonContent(readFileSync20(abs, "utf8"));
     return 0;
   } catch (error) {
     console.error(`validate changed: invalid JSON in ${relPath2}: ${error}`);
     return 1;
   }
 }
+function validatePolicy(relPath2, root2) {
+  const abs = join21(root2, relPath2);
+  try {
+    loadPolicyFile(abs, readFileSync20(abs, "utf8"));
+    return 0;
+  } catch (error) {
+    console.error(`validate changed: invalid policy ${relPath2}: ${error}`);
+    return 1;
+  }
+}
 function validateShell(relPath2, root2) {
-  const abs = join18(root2, relPath2);
-  const shellcheck = spawnSync4("shellcheck", [abs], { encoding: "utf8" });
+  const abs = join21(root2, relPath2);
+  const shellcheck = spawnSync5("shellcheck", [abs], { encoding: "utf8" });
   if (shellcheck.status === 0)
     return 0;
-  const bash = spawnSync4("bash", ["-n", abs], { encoding: "utf8" });
+  const bash = spawnSync5("bash", ["-n", abs], { encoding: "utf8" });
   if (bash.status === 0)
     return 0;
   console.error(`validate changed: shell syntax check failed for ${relPath2}: ${bash.stderr || shellcheck.stderr}`);
@@ -29917,23 +31002,23 @@ function resolvePaths(options) {
 }
 function codeValidationHint(root2) {
   let pm2 = null;
-  const pkgPath = join18(root2, "package.json");
-  if (existsSync18(pkgPath)) {
+  const pkgPath = join21(root2, "package.json");
+  if (existsSync25(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync15(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
       const raw = pkg.packageManager?.split("@")[0];
       if (raw === "bun" || raw === "npm" || raw === "pnpm" || raw === "yarn")
         pm2 = raw;
     } catch {}
   }
   if (!pm2) {
-    if (existsSync18(join18(root2, "bun.lock")) || existsSync18(join18(root2, "bun.lockb")))
+    if (existsSync25(join21(root2, "bun.lock")) || existsSync25(join21(root2, "bun.lockb")))
       pm2 = "bun";
-    else if (existsSync18(join18(root2, "pnpm-lock.yaml")))
+    else if (existsSync25(join21(root2, "pnpm-lock.yaml")))
       pm2 = "pnpm";
-    else if (existsSync18(join18(root2, "yarn.lock")))
+    else if (existsSync25(join21(root2, "yarn.lock")))
       pm2 = "yarn";
-    else if (existsSync18(join18(root2, "package-lock.json")))
+    else if (existsSync25(join21(root2, "package-lock.json")))
       pm2 = "npm";
   }
   switch (pm2) {
@@ -29949,43 +31034,66 @@ function codeValidationHint(root2) {
       return "  Run your local code validation gates (test + typecheck + build).";
   }
 }
-function runValidateChanged(options = {}) {
+async function runValidateChanged(options = {}) {
   const root2 = options.root ?? findRepoRoot();
   const relPaths = resolvePaths(options);
   if (relPaths.length === 0) {
     console.log("validate changed: no changed files.");
     return 0;
   }
+  const config = loadConfig(root2);
+  let wiredPolicies;
+  try {
+    wiredPolicies = await collectWiredPolicyRelPaths(root2, config);
+  } catch (error) {
+    console.error(`validate changed: ${error instanceof Error ? error.message : error}`);
+    return 1;
+  }
   const buckets = {
     docs: [],
     skills: [],
     shell: [],
-    json: []
+    json: [],
+    policy: []
   };
   let missing = 0;
   let skipped = 0;
+  const orphans = [];
   for (const relPath2 of relPaths) {
-    const abs = join18(root2, relPath2);
-    if (!existsSync18(abs)) {
+    const normalized = normalizeRelPath(relPath2);
+    const abs = join21(root2, normalized);
+    if (!existsSync25(abs)) {
       missing++;
       console.error(`validate changed: path not found: ${relPath2}`);
       continue;
     }
-    const bucket = bucketFor(relPath2, root2);
+    const ext = extname2(normalized).toLowerCase();
+    if (isSkeletonYamlCandidate(normalized, ext) && !wiredPolicies.has(normalized)) {
+      orphans.push(normalized);
+      continue;
+    }
+    const bucket = bucketFor(normalized, root2, wiredPolicies);
     if (bucket === "skip") {
       skipped++;
       continue;
     }
-    buckets[bucket].push(relPath2);
+    buckets[bucket].push(normalized);
   }
-  const audited = buckets.docs.length + buckets.skills.length + buckets.shell.length + buckets.json.length;
+  if (orphans.length > 0) {
+    for (const orphan of orphans) {
+      console.error(`validate changed: ${orphan} is under .skeleton/ but not referenced by any plugin policies glob.
+` + "  Export it from a plugin `policies` array (see docs/developer/plugins.md), or remove the file.");
+    }
+    return 1;
+  }
+  const audited = buckets.docs.length + buckets.skills.length + buckets.shell.length + buckets.json.length + buckets.policy.length;
   let exitCode = 0;
   if (missing > 0 && audited === 0 && skipped === 0) {
     console.error("validate changed: no paths existed on disk. Pass real paths or use --staged / --base.");
     return 1;
   }
   if (options.base) {
-    const globalExit = runAudit({
+    const globalExit = await runAudit({
       suite: "self",
       strict: false,
       json: false,
@@ -30003,7 +31111,7 @@ function runValidateChanged(options = {}) {
     return 1;
   }
   if (buckets.docs.length > 0) {
-    const docExit = runAudit({
+    const docExit = await runAudit({
       suite: "docs",
       strict: false,
       json: false,
@@ -30016,14 +31124,14 @@ function runValidateChanged(options = {}) {
       exitCode = 1;
   }
   if (buckets.skills.length > 0) {
-    const skillsOnly = buckets.docs.length === 0 && buckets.shell.length === 0 && buckets.json.length === 0;
+    const skillsOnly = buckets.docs.length === 0 && buckets.shell.length === 0 && buckets.json.length === 0 && buckets.policy.length === 0;
     if (skillsOnly && !options.base) {
       console.error(`validate changed: skill paths need the full skills suite (path-scoped skill rules are empty).
 ` + `  Run: skeleton audit skills
-` + "  Or:  skeleton audit self");
+` + "  (audit self covers docs + .skeleton; excluded skill trees still need audit skills)");
       return 1;
     }
-    const skillExit = runAudit({
+    const skillExit = await runAudit({
       suite: "skills",
       strict: false,
       json: false,
@@ -30043,6 +31151,46 @@ function runValidateChanged(options = {}) {
     if (validateJson(relPath2, root2) !== 0)
       exitCode = 1;
   }
+  for (const relPath2 of buckets.policy) {
+    if (validatePolicy(relPath2, root2) !== 0)
+      exitCode = 1;
+  }
+  if (buckets.policy.length > 0) {
+    if (options.base) {
+      const proseExit = await runAudit({
+        suite: "docs",
+        strict: false,
+        json: false,
+        paths: [],
+        only: null,
+        root: root2
+      });
+      if (proseExit !== 0)
+        exitCode = 1;
+      const skillPaths = listSkillMarkdownPaths(root2, buildSkillIndex(root2));
+      if (skillPaths.length > 0) {
+        const skillProseExit = await runAudit({
+          suite: "skills",
+          strict: false,
+          json: false,
+          paths: skillPaths,
+          only: null,
+          root: root2,
+          pathScopedOnly: true
+        });
+        if (skillProseExit !== 0)
+          exitCode = 1;
+      }
+    } else {
+      if (exitCode === 0) {
+        console.error(`validate changed: policy YAML changes need a full prose-policy pass (path-scoped docs are not enough).
+` + `  Run: skeleton audit docs
+` + `  And: skeleton audit skills
+` + "  (audit self covers docs + .skeleton; excluded skill trees still need audit skills)");
+      }
+      return 1;
+    }
+  }
   if (exitCode === 0) {
     const note = skipped > 0 ? ` (${skipped} path(s) skipped)` : "";
     console.log(`validate changed passed${note}.`);
@@ -30057,6 +31205,8 @@ function usage() {
 Commands:
   init [--force-hooks] [--skills] [--no-skills] [skills add flags…]
   audit docs|self|skills [--strict] [--json] [--paths=a,b] [--only=rule]
+                         [--fix[=doc-meta|anchors]] [--dry-run]
+  build-plugin [path] [--check]
   validate changed [paths…] [--staged] [--base <ref>]
   register <path> [--topic=…] [--dry-run] [--json]
   customize resolve <slug> [--json]
@@ -30080,7 +31230,7 @@ function parseRegisterArgs(argv) {
   }
   return { path: path2, topic, dryRun, json };
 }
-function main() {
+async function main() {
   const argv = process.argv.slice(2);
   const command = argv[0];
   if (!command || command === "--help" || command === "-h") {
@@ -30096,7 +31246,18 @@ function main() {
       }
       const options = parseAuditArgs(argv.slice(2));
       options.suite = sub;
-      process.exit(runAudit(options));
+      process.exit(await runAudit(options));
+    }
+    if (command === "build-plugin") {
+      const { entry, check } = parseBuildPluginArgs(argv.slice(1));
+      const root2 = findRepoRoot();
+      const result = await runBuildPlugin({ root: root2, entry, check });
+      if (check) {
+        console.log(result.checked.length === 0 ? "build-plugin --check: no plugins configured." : `build-plugin --check: ${result.checked.length} plugin(s) up to date.`);
+      } else {
+        console.log(result.built.length === 0 ? "build-plugin: no plugins configured." : `build-plugin: built ${result.built.length} plugin(s).`);
+      }
+      process.exit(0);
     }
     if (command === "validate" && argv[1] === "changed") {
       const rest = argv.slice(2);
@@ -30114,7 +31275,7 @@ function main() {
         else if (arg && !arg.startsWith("-"))
           paths.push(arg);
       }
-      process.exit(runValidateChanged({ paths, staged, base }));
+      process.exit(await runValidateChanged({ paths, staged, base }));
     }
     if (command === "register") {
       const opts = parseRegisterArgs(argv.slice(1));