@holdyourvoice/hyv 3.3.4 → 3.4.0

package/dist/approval-context.js

@@ -2,7 +2,7 @@ import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
 import { userInfo } from 'node:os';
 import { join } from 'node:path';
 import { parseApprovalTrustStore } from './approval-capability.js';
-const MAX_BYTES = 1024 * 1024;
+import { MAX_JSON_BYTES as MAX_BYTES } from './internal.js';
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 function readBounded(descriptor) {
     const chunks = [];

package/dist/cli.js

@@ -13,13 +13,14 @@ import { evaluateRewriteResponse, parseRewriteTask, prepareRewriteTask } from '.
 import { parseJudgmentEnvelope, preparePostCandidateJudgment, preparePreEditJudgment, reducePostCandidate, reducePreEdit } from './judgment-task.js';
 import { evaluateRebuildResponse, parseRebuildTask, prepareRebuildTask, writerRequestForRebuild } from './rebuild-task.js';
 import { canonicalJson, parseCanonicalJson } from './canonical-json.js';
+import { MAX_JSON_BYTES } from './internal.js';
 import { finalizeLifecycle, inspectLifecycle, prepareLifecycle, recordApprovedLearning, submitSemanticVerdict, validateFinalApproval } from './lifecycle-adapter.js';
 import { buildProfile } from './voice-dna.js';
 import { loadApprovalContext } from './approval-context.js';
 import { formatFactLintReport, lintFacts } from './fact-linter.js';
 import { lintLogic } from './logic-linter.js';
-const usage = 'Commands: profile, analyze, hygiene, inspect-hidden-text, apply-hidden-text-policy, final-check, fact-lint, logic-lint, batch-analyze, rewrite-prompt, prepare-rewrite, apply-rewrite, prepare-judgment, reduce-judgment, prepare-rebuild, rebuild-writer-request, apply-rebuild, verify, verify-spec, lifecycle, learning, patterns, mcp';
-const MAX_JSON_BYTES = 1024 * 1024;
+import { loadAll, validateAll, validateId, sortedIds, describe, emitJson, emitPrompt } from './agents/index.js';
+const usage = 'Commands: agent, profile, analyze, hygiene, inspect-hidden-text, apply-hidden-text-policy, final-check, fact-lint, logic-lint, batch-analyze, rewrite-prompt, prepare-rewrite, apply-rewrite, prepare-judgment, reduce-judgment, prepare-rebuild, rebuild-writer-request, apply-rebuild, verify, verify-spec, lifecycle, learning, patterns, mcp';
 function input(path) {
     return path === '-' ? readFileSync(0, 'utf8') : readFileSync(path, 'utf8');
 }
@@ -269,8 +270,116 @@ function writeNewFileAtomically(path, text) {
     if (primaryError)
         throw primaryError;
 }
+function agentFlags(args) {
+    const values = [];
+    let host = 'generic';
+    let mode;
+    let output;
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--host') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--'))
+                throw new Error('Usage: hyv agent --host HOST requires a value.');
+            host = value;
+            index += 1;
+        }
+        else if (argument.startsWith('--host=')) {
+            const value = argument.slice('--host='.length);
+            if (!value)
+                throw new Error('Usage: hyv agent --host HOST requires a value.');
+            host = value;
+        }
+        else if (argument === '--mode') {
+            const value = args[index + 1];
+            if (value !== 'prompt' && value !== 'json')
+                throw new Error('Usage: hyv agent --mode prompt|json requires a mode.');
+            mode = value;
+            index += 1;
+        }
+        else if (argument.startsWith('--mode=')) {
+            const value = argument.slice('--mode='.length);
+            if (value !== 'prompt' && value !== 'json')
+                throw new Error('Usage: hyv agent --mode prompt|json requires a mode.');
+            mode = value;
+        }
+        else if (argument === '--output') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('--'))
+                throw new Error('Usage: hyv agent --output FILE requires a value.');
+            output = value;
+            index += 1;
+        }
+        else if (argument.startsWith('--output=')) {
+            const value = argument.slice('--output='.length);
+            if (!value)
+                throw new Error('Usage: hyv agent --output FILE requires a value.');
+            output = value;
+        }
+        else {
+            values.push(argument);
+        }
+    }
+    return { values, host, mode, output };
+}
+function runAgent(args) {
+    const [subcommand, ...subargs] = args;
+    if (subcommand === 'list') {
+        if (subargs.length)
+            throw new Error('Usage: hyv agent list');
+        const packages = loadAll();
+        const ids = sortedIds(packages);
+        json(ids.map((id) => {
+            const descriptor = packages.get(id).descriptor;
+            return { id, role: descriptor.role, workflow_phase: descriptor.workflow_phase, description: descriptor.description };
+        }));
+        return 0;
+    }
+    if (subcommand === 'validate') {
+        if (subargs.length > 1)
+            throw new Error('Usage: hyv agent validate [id]');
+        const packages = loadAll();
+        const id = subargs[0];
+        if (id !== undefined)
+            validateId(packages, id);
+        validateAll(packages);
+        json({ schema_version: '1.0.0', status: 'PASS', agent: id ?? 'all' });
+        return 0;
+    }
+    if (subcommand === 'describe') {
+        const { values, host, mode, output } = agentFlags(subargs);
+        if (values.length !== 1 || mode !== undefined || output !== undefined)
+            throw new Error('Usage: hyv agent describe <id> [--host HOST]');
+        const packages = loadAll();
+        validateId(packages, values[0]);
+        json(describe(packages.get(values[0]), host));
+        return 0;
+    }
+    if (subcommand === 'emit') {
+        const { values, host, mode, output } = agentFlags(subargs);
+        if (values.length !== 1)
+            throw new Error('Usage: hyv agent emit <id> --mode prompt|json [--host HOST] [--output FILE]');
+        if (!mode)
+            throw new Error('Usage: hyv agent emit <id> --mode prompt|json [--host HOST] [--output FILE]');
+        const packages = loadAll();
+        validateId(packages, values[0]);
+        const pkg = packages.get(values[0]);
+        const body = mode === 'prompt' ? emitPrompt(pkg, host) : `${emitJson(pkg, host)}\n`;
+        if (output !== undefined) {
+            writeFileSync(output, body, { encoding: 'utf8', flag: 'wx' });
+        }
+        else {
+            process.stdout.write(body);
+        }
+        return 0;
+    }
+    throw new Error('Usage: hyv agent <list|validate|describe|emit> ...');
+}
 export async function runCli(args) {
     const [command, ...rest] = args;
+    if (command === 'agent') {
+        return runAgent(rest);
+    }
     if (command === 'profile') {
         const { output, samples, avoid } = profileArguments(rest);
         writeFileSync(output, `${JSON.stringify(buildProfile(samples.map(input), avoid), null, 2)}\n`);

package/dist/cli.test.js

@@ -556,3 +556,79 @@ test('prepares and applies an authorized rebuild through CLI', () => {
         rmSync(directory, { recursive: true, force: true });
     }
 });
+test('agent list enumerates every command as one portable package', () => {
+    const result = run(['agent', 'list']);
+    assert.equal(result.status, 0, result.stderr);
+    const entries = JSON.parse(result.stdout);
+    assert.equal(entries.length, 23);
+    const ids = entries.map((entry) => entry.id);
+    assert.equal(new Set(ids).size, ids.length);
+    for (const id of ['hyv-profile', 'hyv-analyze', 'hyv-verify', 'hyv-mcp', 'hyv-patterns']) {
+        assert.ok(ids.includes(id), `missing ${id}`);
+    }
+    for (const entry of entries) {
+        assert.ok(entry.role);
+        assert.ok(entry.workflow_phase);
+        assert.ok(entry.description);
+    }
+});
+test('agent validate passes over the full package tree and rejects unknown ids', () => {
+    const result = run(['agent', 'validate']);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(JSON.parse(result.stdout).status, 'PASS');
+    assert.equal(run(['agent', 'validate', 'hyv-verify']).status, 0);
+    const unknown = run(['agent', 'validate', 'hyv-does-not-exist']);
+    assert.equal(unknown.status, 1);
+    assert.match(unknown.stderr, /unknown agent/);
+});
+test('agent describe resolves a host and reports the runtime descriptor', () => {
+    const result = run(['agent', 'describe', 'hyv-verify', '--host', 'codex']);
+    assert.equal(result.status, 0, result.stderr);
+    const descriptor = JSON.parse(result.stdout);
+    assert.equal(descriptor.agent.id, 'hyv-verify');
+    assert.equal(descriptor.host.id, 'codex');
+    assert.ok(descriptor.available_capabilities.includes('read_repository'));
+    assert.ok(Array.isArray(descriptor.unavailable_capabilities));
+});
+test('agent emit writes a prompt or json contract to stdout or a named file', () => {
+    const prompt = run(['agent', 'emit', 'hyv-verify', '--mode=prompt', '--host=generic']);
+    assert.equal(prompt.status, 0, prompt.stderr);
+    assert.match(prompt.stdout, /# hyv-verify/);
+    assert.match(prompt.stdout, /Required input: original path, candidate path, profile path/);
+    const jsonOut = run(['agent', 'emit', 'hyv-verify', '--mode', 'json', '--host', 'generic']);
+    assert.equal(jsonOut.status, 0, jsonOut.stderr);
+    assert.equal(JSON.parse(jsonOut.stdout).agent.id, 'hyv-verify');
+    const directory = mkdtempSync(join(tmpdir(), 'holdyourvoice-agent-'));
+    try {
+        const target = join(directory, 'verify.json');
+        const emitted = run(['agent', 'emit', 'hyv-verify', '--mode', 'json', '--output', target]);
+        assert.equal(emitted.status, 0, emitted.stderr);
+        assert.equal(JSON.parse(readFileSync(target, 'utf8')).agent.id, 'hyv-verify');
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+});
+test('agent commands locate the installed package tree outside a repository', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'holdyourvoice-agent-cwd-'));
+    try {
+        mkdirSync(join(directory, 'skills'));
+        const result = spawnSync(process.execPath, [cli, 'agent', 'validate'], { cwd: directory, encoding: 'utf8' });
+        assert.equal(result.status, 0, result.stderr);
+        assert.equal(JSON.parse(result.stdout).status, 'PASS');
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+});
+test('agent usage errors return exit 1 and never mutate', () => {
+    assert.equal(run(['agent']).status, 1);
+    assert.equal(run(['agent', 'emit', 'hyv-verify']).status, 1);
+    assert.equal(run(['agent', 'emit', 'hyv-verify', '--mode', 'bad']).status, 1);
+    assert.equal(run(['agent', 'describe']).status, 1);
+    assert.equal(run(['agent', 'describe', 'hyv-verify', '--mode', 'json']).status, 1);
+    assert.equal(run(['agent', 'describe', 'hyv-verify', '--output', 'ignored.json']).status, 1);
+    assert.equal(run(['agent', 'list', '--host', 'codex']).status, 1);
+    assert.equal(run(['agent', 'list', 'extra']).status, 1);
+    assert.equal(run(['agent', 'nope']).status, 1);
+});

package/dist/copy-spec.js

@@ -1,19 +1,14 @@
 import { sentences } from './text.js';
+import { escaped, isText } from './internal.js';
 function normalized(value) {
     return value.toLowerCase().replace(/\s+/g, ' ').trim();
 }
-function escaped(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
 function atomMatches(value, atom) {
     return new RegExp(`(?<![\\p{L}\\p{N}\\p{M}])${escaped(atom)}(?![\\p{L}\\p{N}\\p{M}])`, 'u').test(value);
 }
 function isAtom(value) {
     return isText(value, 500) && /[\p{L}\p{N}]/u.test(normalized(value));
 }
-function isText(value, limit) {
-    return typeof value === 'string' && value.trim().length > 0 && value.length <= limit;
-}
 function isClaim(value) {
     if (!value || typeof value !== 'object')
         return false;

package/dist/editorial-packs.js

@@ -1,9 +1,7 @@
 import { paragraphs, sentences, words } from './text.js';
+import { isText } from './internal.js';
 const formats = ['general', 'social', 'deck', 'outreach', 'blog', 'audit', 'website'];
 const evidenceStatuses = ['primary', 'attributed', 'internal', 'unverified'];
-function isText(value, limit) {
-    return typeof value === 'string' && value.trim().length > 0 && value.length <= limit;
-}
 function isTerms(value) {
     return Array.isArray(value) && value.length <= 100 && value.every((term) => isText(term, 200));
 }

package/dist/hidden-text.js

@@ -1,10 +1,8 @@
-import { createHash } from 'node:crypto';
-import { canonicalJson } from './canonical-json.js';
+import { fingerprint as hash } from './internal.js';
 const ACKNOWLEDGEMENT = 'Removes only listed non-semantic controls; all other findings remain review-only.';
 export const minimalHiddenTextPolicy = {
     version: '1', name: 'minimal-text-control-cleanup', approvedRemovals: ['ascii_control', 'mid_document_bom'], acknowledgement: ACKNOWLEDGEMENT,
 };
-function hash(value) { return createHash('sha256').update(typeof value === 'string' ? value : canonicalJson(value)).digest('hex'); }
 function codepoint(value) { return `U+${value.toString(16).toUpperCase().padStart(4, '0')}`; }
 export function parseHiddenTextPolicy(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -50,15 +48,7 @@ export function inspectHiddenText(text, policy = minimalHiddenTextPolicy) {
 }
 export function applyHiddenTextPolicy(text, policy = minimalHiddenTextPolicy) {
     const report = inspectHiddenText(text, policy);
-    const offsets = new Set(report.proposedChanges.map((item) => item.offset));
-    let output = '';
-    for (let offset = 0; offset < text.length;) {
-        const value = text.codePointAt(offset);
-        const character = String.fromCodePoint(value);
-        if (!offsets.has(offset))
-            output += character;
-        offset += character.length;
-    }
+    const output = applyOnce(text, policy);
     const remaining = inspectHiddenText(output, policy).findings;
     const again = applyOnce(output, policy);
     return { ...report, outputHash: hash(output), output, remaining, idempotent: again === output };

package/dist/internal.js

@@ -0,0 +1,30 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from './canonical-json.js';
+export const MAX_JSON_BYTES = 1024 * 1024;
+export function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export function digestCanonical(value) {
+    return sha256(canonicalJson(value));
+}
+export function fingerprint(value) {
+    return sha256(typeof value === 'string' ? value : canonicalJson(value));
+}
+export function profileIdentity(profile) {
+    if (profile.version === '3')
+        return { profileId: profile.id, profileRevisionDigest: profile.revisionDigest };
+    const legacy = `legacy-v2:${digestCanonical(profile)}`;
+    return { profileId: legacy, profileRevisionDigest: legacy };
+}
+export function isPlainObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+export function exactKeys(value, required, optional = []) {
+    return required.every((key) => key in value) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+}
+export function isText(value, maximum = 256) {
+    return typeof value === 'string' && value.trim().length > 0 && value.length <= maximum;
+}
+export function escaped(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/judgment-task.js

@@ -1,21 +1,9 @@
-import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.js';
 import { sentences } from './text.js';
 import { HYV_VERSION } from './version.js';
+import { profileIdentity, sha256 as digest } from './internal.js';
 const PRE_EDIT_KINDS = ['triage', 'argument', 'form'];
 const POST_CANDIDATE_KINDS = ['argument', 'polarity', 'form', 'flatness', 'semantic'];
-function digest(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
-function digestCanonical(value) {
-    return digest(canonicalJson(value));
-}
-function profileIdentity(profile) {
-    if (profile.version === '3')
-        return { profileId: profile.id, profileRevisionDigest: profile.revisionDigest };
-    const legacy = `legacy-v2:${digestCanonical(profile)}`;
-    return { profileId: legacy, profileRevisionDigest: legacy };
-}
 function fingerprintTask(task) {
     return digest(`hyv:judgment-task:v1\0${canonicalJson(task)}`);
 }

package/dist/lifecycle-adapter.js

@@ -3,6 +3,7 @@ import { verifyApprovalCapability } from './approval-capability.js';
 import { createInitialLifecycleArtifact, isValidLifecycleArtifact, parseSemanticVerdict, prepareSemanticReviewTask, reduceRewriteLifecycle } from './semantic-review.js';
 import { verifyDeterministically } from './pipeline.js';
 import { recordVerifiedCandidate } from './learning.js';
+import { MAX_JSON_BYTES } from './internal.js';
 export function prepareLifecycle(deterministic, binding, receipt, policy, allowedViolations) {
     const task = prepareSemanticReviewTask(binding, policy, receipt, allowedViolations);
     return { task, artifact: createInitialLifecycleArtifact(task, deterministic) };
@@ -58,7 +59,7 @@ export function finalizeLifecycle(artifact, decision, context, capability) {
 }
 export function recordApprovedLearning(request) {
     const { ready, approved, decision, capability, source, candidate, profile, context, copySpec, writingBrief } = request;
-    if (Buffer.byteLength(source, 'utf8') > 1024 * 1024 || Buffer.byteLength(candidate, 'utf8') > 1024 * 1024)
+    if (Buffer.byteLength(source, 'utf8') > MAX_JSON_BYTES || Buffer.byteLength(candidate, 'utf8') > MAX_JSON_BYTES)
         throw new Error('Approved learning text exceeds the byte limit.');
     inspectLifecycle(ready);
     inspectLifecycle(approved);

package/dist/mcp-tools.js

@@ -12,6 +12,7 @@ import { inspectHiddenText, applyHiddenTextPolicy, parseHiddenTextPolicy } from
 import { buildProfile } from './voice-dna.js';
 import { finalOutputCheck, inspectHygiene } from './hygiene.js';
 import { finalizeLifecycle, inspectLifecycle, prepareLifecycle, recordApprovedLearning, submitSemanticVerdict, validateFinalApproval } from './lifecycle-adapter.js';
+import { MAX_JSON_BYTES } from './internal.js';
 function profileFromJson(profileJson) {
     try {
         return parseProfile(JSON.parse(profileJson));
@@ -103,7 +104,7 @@ export function logicLintForMcp(draft, writingBriefJson) {
     return lintLogic(draft, writingBriefFromJson(writingBriefJson));
 }
 function parsed(json, label) {
-    if (Buffer.byteLength(json, 'utf8') > 1024 * 1024)
+    if (Buffer.byteLength(json, 'utf8') > MAX_JSON_BYTES)
         throw new Error(`${label} exceeds the byte limit.`);
     try {
         return JSON.parse(json);

package/dist/pipeline.js

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.js';
 import { HYV_VERSION } from './version.js';
 import { analyzeAiEditor } from './ai-editor.js';
@@ -6,10 +5,11 @@ import { verifyClaims } from './copy-spec.js';
 import { analyzeEditorial } from './editorial-packs.js';
 import { finalOutputCheck, inspectHygiene } from './hygiene.js';
 import { analyzeVoiceDna } from './voice-dna.js';
-import { legacySetPreservation } from './preservation.js';
+import { legacySetPreservation, LEGACY_SET_PRESERVATION_VERSION } from './preservation.js';
 import { lintFacts } from './fact-linter.js';
 import { lintLogic } from './logic-linter.js';
 import { sentences } from './text.js';
+import { digestCanonical, escaped as escapeRegex, profileIdentity, sha256 as digest } from './internal.js';
 export function analyze(text, profile, brief) {
     const voiceDna = analyzeVoiceDna(text, profile);
     const aiEditor = analyzeAiEditor(text, profile);
@@ -101,7 +101,7 @@ function verifyRequiredFacts(candidate, brief) {
     const reversed = brief.requiredFacts.filter((fact) => {
         const terms = fact.atoms?.length ? fact.atoms : [fact.text];
         return terms.some((term) => {
-            const escaped = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const escaped = escapeRegex(term);
             const quotedDenial = new RegExp(`${escaped}(?:["']|\\s)*(?:is|was|are|were)?\\s*(?:not|false|untrue|incorrect)`, 'i');
             return quotedDenial.test(candidate) || draftSentences.some((sentence, index) => sentence.text.toLowerCase().includes(term.toLowerCase()) && (/\b(?:not|false|untrue|incorrect)\b/i.test(sentence.text) || /^(?:that|this) (?:statement|claim|fact|assertion|point) (?:is|was) (?:not|false|untrue|incorrect)\b/i.test(draftSentences[index + 1]?.text.trim() ?? '')));
         });
@@ -153,19 +153,11 @@ export function verifyRebuildWithCopySpec(original, candidate, profile, spec, br
         passed: checked.passed && !regressions.some(isBlockingFinding) && claims.passed && finalCheck.accepted && logicLint.passed && !factLint?.findings.some((finding) => finding.severity === 'error') && (requiredFacts?.passed ?? true),
     };
 }
-function digest(value) { return createHash('sha256').update(value).digest('hex'); }
-function digestCanonical(value) { return digest(canonicalJson(value)); }
-function profileIdentity(profile) {
-    if (profile.version === '3')
-        return { profileId: profile.id, profileRevisionDigest: profile.revisionDigest };
-    const legacy = `legacy-v2:${digestCanonical(profile)}`;
-    return { profileId: legacy, profileRevisionDigest: legacy };
-}
 function projectDeterministicVerificationArtifact(source, candidate, profile, verification, copySpec, writingBrief, verificationKind = 'claims' in verification ? 'copy_spec' : 'standard') {
     const identity = profileIdentity(profile);
     const base = {
         version: '1', verificationKind, passed: verification.passed, analysisVersion: verification.candidate.version,
-        rulesetVersion: HYV_VERSION, preservationMetricVersion: 'legacy-set-v1', preservationScore: verification.preservationScore,
+        rulesetVersion: HYV_VERSION, preservationMetricVersion: LEGACY_SET_PRESERVATION_VERSION, preservationScore: verification.preservationScore,
         sourceHash: digest(source), candidateHash: digest(candidate), ...identity,
         ...(copySpec ? { copySpecHash: digestCanonical(copySpec) } : {}), ...(writingBrief ? { writingBriefHash: digestCanonical(writingBrief) } : {}),
         regressionKeys: verification.regressions.map((finding) => `${finding.engine}:${finding.id}:${finding.sentence}`).sort(),

package/dist/profile.js

@@ -1,12 +1,10 @@
 import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.js';
+import { isPlainObject } from './internal.js';
 const METRICS_KEYS = ['sentenceLength', 'sentenceVariation', 'sentenceStructure', 'rhythm', 'paragraphLength', 'openingMoves', 'vocabulary', 'lexicalDensity', 'pointOfView', 'punctuation', 'caseStyle', 'questionRate', 'transitions'];
 const PROFILE_V3_KEYS = ['version', 'id', 'revision', 'revisionDigest', 'sampleCount', 'metrics', 'avoid', 'provenance', 'rulePolicy', 'fingerprint', 'tolerances', 'metricFixtures'];
 const FINGERPRINT_METRICS = ['contractionRate', 'sentenceLengthDistribution', 'bulletRate', 'enDashRate'];
 const STABLE_ID = /^[a-z0-9](?:[a-z0-9._-]{0,127})$/;
-function isPlainObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
-}
 function hasKnownKeys(value, keys) {
     return Object.keys(value).every((key) => keys.includes(key)) && keys.every((key) => key in value);
 }

package/dist/rebuild-task.js

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.js';
 import { parseCopySpec } from './copy-spec.js';
 import { parseWritingBrief } from './editorial-packs.js';
@@ -10,29 +9,15 @@ import { sentences } from './text.js';
 import { HYV_VERSION } from './version.js';
 import { buildRecompositionBrief, measureLexicalResidual, parseRecompositionPolicy } from './recomposition.js';
 import { provenanceStatusForRebuild, writerRequestForRebuild } from './provenance-status.js';
+import { fingerprint, profileIdentity, sha256 as digest } from './internal.js';
 const MAX_RESPONSE_BYTES = 100_000;
 const MAX_CANDIDATE_CHARACTERS = 100_000;
-function fingerprint(value) {
-    return createHash('sha256').update(typeof value === 'string' ? value : canonicalJson(value)).digest('hex');
-}
-function digest(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
-function digestCanonical(value) {
-    return digest(canonicalJson(value));
-}
 function failure(code, message, path) {
     return { code, message, ...(path ? { path } : {}) };
 }
 function isFailure(value) {
     return typeof value === 'object' && value !== null && 'code' in value && 'message' in value;
 }
-function profileIdentity(profile) {
-    if (profile.version === '3')
-        return { profileId: profile.id, profileRevisionDigest: profile.revisionDigest };
-    const legacy = `legacy-v2:${digestCanonical(profile)}`;
-    return { profileId: legacy, profileRevisionDigest: legacy };
-}
 function parseJson(value) {
     if (Buffer.byteLength(value) > MAX_RESPONSE_BYTES)
         return failure('response_too_large', `Response exceeds ${MAX_RESPONSE_BYTES} bytes.`);

package/dist/rebuild-task.test.js

@@ -174,7 +174,7 @@ test('CLI and MCP rebuild helpers share fingerprints', () => {
         version: '1', audience: 'operators', intent: 'explain', format: 'outreach',
     });
     assert.match(briefTask.prompt, /# WritingBrief/);
-    assert.equal(HYV_VERSION, '3.3.4');
+    assert.equal(HYV_VERSION, '3.4.0');
 });
 test('apply rejects forged tasks, missing capability, and substituted profiles', () => {
     const reduction = rebuildRecommendation();

package/dist/release-audit.test.js

@@ -23,7 +23,7 @@ function fixture(files) {
     const directory = mkdtempSync(join(tmpdir(), 'holdyourvoice-audit-'));
     execFileSync('git', ['init', '--quiet'], { cwd: directory });
     const defaults = {
-        'package.json': JSON.stringify({ name: 'audit-fixture', license: 'MIT', files: ['dist', 'Readme.md', 'LICENSE'], scripts: { 'stage1:evaluate': 'node scripts/evaluate-rewrite-benchmark.mjs', 'stage1:dry-run': 'npm run build && node scripts/run-stage1-dry-run.mjs', 'stage1:human-packet': 'npm run build && node scripts/run-stage1-human-packet.mjs', 'stage2:human-packet': 'npm run build && node scripts/run-stage2-human-packet.mjs' }, version: '1.0.0', type: 'module', bin: { hyv: 'dist/cli.js' }, engines: { node: '>=20' } }),
+        'package.json': JSON.stringify({ name: 'audit-fixture', license: 'MIT', files: ['dist', 'skills', 'Readme.md', 'LICENSE'], scripts: { 'stage1:evaluate': 'node scripts/evaluate-rewrite-benchmark.mjs', 'stage1:dry-run': 'npm run build && node scripts/run-stage1-dry-run.mjs', 'stage1:human-packet': 'npm run build && node scripts/run-stage1-human-packet.mjs', 'stage2:human-packet': 'npm run build && node scripts/run-stage2-human-packet.mjs' }, version: '1.0.0', type: 'module', bin: { hyv: 'dist/cli.js' }, engines: { node: '>=20' } }),
         'mcpb/manifest.json': JSON.stringify({ version: '1.0.0' }),
         'claude-plugin/.claude-plugin/plugin.json': JSON.stringify({ version: '1.0.0' }),
         '.claude-plugin/marketplace.json': JSON.stringify({ plugins: [{ name: 'hold-your-voice', version: '1.0.0' }] }),
@@ -36,6 +36,9 @@ function fixture(files) {
         ].join('\n'),
         'src/version.ts': "export const HYV_VERSION = '1.0.0';",
         'src/stage1-evaluation.ts': "const baseline = '4e6269121d551c008a34db73077e1e4fea41b3f9'; const stage1 = '550ea24f652291dca13757fdbd2f0fa0b5e3f621';",
+        'skills/hyv-test/agent.json': '{}',
+        'skills/hyv-test/SKILL.md': '# test',
+        'skills/hyv-test/agents/openai.yaml': 'name: test',
         ...Object.fromEntries(stage1Files.map((file) => [file, '{}'])),
     };
     for (const [file, text] of Object.entries({ ...defaults, ...files })) {
@@ -146,6 +149,7 @@ test('requires the npm package runtime contract', () => {
         const result = spawnSync(process.execPath, [audit], { cwd: directory, encoding: 'utf8' });
         assert.notEqual(result.status, 0);
         assert.match(result.stderr, /npm package must include dist/);
+        assert.match(result.stderr, /npm package must include skills/);
         assert.match(result.stderr, /npm package must include Readme\.md/);
         assert.match(result.stderr, /npm package must use the ESM runtime contract/);
         assert.match(result.stderr, /npm hyv binary must point to dist\/cli\.js/);

package/dist/rewrite-task.js

@@ -1,15 +1,11 @@
-import { createHash } from 'node:crypto';
-import { canonicalJson } from './canonical-json.js';
 import { parseWritingBrief } from './editorial-packs.js';
 import { finalOutputCheck, hygieneSourceFindings } from './hygiene.js';
 import { analyze, deriveEditScope, renderRewritePrompt, verifyDeterministically } from './pipeline.js';
 import { sentences } from './text.js';
+import { fingerprint } from './internal.js';
 const MAX_RESPONSE_BYTES = 100_000;
 const MAX_REPLACEMENTS = 100;
 const MAX_REPLACEMENT_CHARACTERS = 10_000;
-function fingerprint(value) {
-    return createHash('sha256').update(typeof value === 'string' ? value : canonicalJson(value)).digest('hex');
-}
 function failure(code, message, path) {
     return { code, message, ...(path ? { path } : {}) };
 }

package/dist/semantic-review.js

@@ -1,13 +1,12 @@
 import { createHash } from 'node:crypto';
 import { canonicalJson } from './canonical-json.js';
 import { verifyApprovalCapability } from './approval-capability.js';
+import { exactKeys as exact, isPlainObject as plain } from './internal.js';
 const violations = new Set(['action_change', 'dropped_object', 'unsupported_claim', 'constraint_weakened', 'clarity_regression']);
 const HEX = /^[a-f0-9]{64}$/;
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 function hash(domain, value) { return createHash('sha256').update(`${domain}\0`).update(canonicalJson(value)).digest('hex'); }
 function same(left, right) { return canonicalJson(left) === canonicalJson(right); }
-function exact(value, required, optional = []) { return required.every((key) => key in value) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key)); }
-function plain(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype; }
 function bindingValid(binding) {
     return binding.schemaVersion === '1' && [binding.rewriteTaskFingerprint, binding.rewriteResponseFingerprint, binding.deterministicArtifactFingerprint, binding.sourceHash, binding.candidateHash].every((item) => HEX.test(item))
         && ID.test(binding.profileId) && ID.test(binding.profileRevisionDigest) && ID.test(binding.rulesetVersion);

package/dist/version.js

@@ -1 +1 @@
-export const HYV_VERSION = '3.3.4';
+export const HYV_VERSION = '3.4.0';

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@holdyourvoice/hyv",
-  "version": "3.3.4",
+  "version": "3.4.0",
   "description": "A local-first dual-engine writing gate that protects voice and catches generic AI patterns.",
   "type": "module",
   "bin": { "hyv": "dist/cli.js" },
-  "files": ["dist", "Readme.md", "LICENSE"],
-  "scripts": { "build": "tsc -p tsconfig.json", "bundle:claude": "esbuild src/mcp.ts --bundle --platform=node --format=esm --target=node20 --outfile=mcpb/server/index.js", "build:claude": "npm run build && npm run bundle:claude", "pack:claude": "npm run build:claude && node scripts/pack-claude.mjs", "stage1:evaluate": "node scripts/evaluate-rewrite-benchmark.mjs", "stage1:dry-run": "npm run build && node scripts/run-stage1-dry-run.mjs", "stage1:human-packet": "npm run build && node scripts/run-stage1-human-packet.mjs", "stage2:human-packet": "npm run build && node scripts/run-stage2-human-packet.mjs", "test": "npm run build && node --test dist/**/*.test.js", "check:release": "node scripts/release-audit.mjs", "prepack": "npm run check:release && npm test" },
+  "files": ["dist", "skills", "Readme.md", "LICENSE"],
+  "scripts": { "build": "tsc -p tsconfig.json", "bundle:claude": "esbuild src/mcp.ts --bundle --platform=node --format=esm --target=node20 --outfile=mcpb/server/index.js", "build:claude": "npm run build && npm run bundle:claude", "pack:claude": "npm run build:claude && node scripts/pack-claude.mjs", "stage1:evaluate": "node scripts/evaluate-rewrite-benchmark.mjs", "stage1:dry-run": "npm run build && node scripts/run-stage1-dry-run.mjs", "stage1:human-packet": "npm run build && node scripts/run-stage1-human-packet.mjs", "stage2:human-packet": "npm run build && node scripts/run-stage2-human-packet.mjs", "test": "npm run build && node --test \"dist/**/*.test.js\"", "check:release": "node scripts/release-audit.mjs", "prepack": "npm run check:release && npm test" },
   "engines": { "node": ">=20" },
   "license": "MIT",
   "keywords": ["ai-writing", "cli", "editing", "voice", "writing"],

package/skills/hyv-analyze/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: hyv-analyze
+description: Run separate VoiceDNA and AI Editor checks plus a non-scoring Unicode hygiene inspection against a draft.
+---
+
+# hyv-analyze
+
+Run independent VoiceDNA and AI Editor reports plus a separate non-scoring Unicode hygiene report against a draft using a portable profile. An optional WritingBrief adds local audience, intent, and format context without changing the profile. Analysis is read-only; it never rewrites the draft or calls a model.
+
+## Usage
+
+```text
+hyv analyze draft.md profile.json [writing-brief.json]
+```
+
+## Behavior
+
+- Deterministic and local-first: this command never calls a provider and never sends drafts, samples, profiles, or telemetry to a service.
+- Commands that write use an explicit output path. Confirm that path before running the command.
+- This agent describes how to invoke the command and what it returns. It does not change command behavior or exit codes.
+
+## Handoff
+
+Run `hyv analyze` directly to execute the operation. Follow-on agents: hyv-rewrite-prompt, hyv-prepare-rewrite.