@illicomedia/skills-mcp-server 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Frédéric Charles Viallet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,121 @@
-# Temporary Holding Version
+# Fredo QA Skills - Model Context Protocol (MCP) Server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official **Model Context Protocol (MCP)** server for **Fredo QA Skills**.
+Connects AI coding assistants (**Cursor, Claude Desktop, Antigravity, Windsurf, Copilot**) to the Fredo QA Skills quality policy engine and compliance framework.
+
+---
+
+## Features
+
+- **Standard MCP Protocol**: 100% compliant with the MCP specification (JSON-RPC 2.0 over `stdio`).
+- **Dynamic Skill Injection**: Automatically supplies AI agents with authoritative QA rules, test commands, and quality gates (`qa:starter`, `qa:standard`, `qa:strict`).
+- **Signed License Files**: Verifies an Ed25519-signed `license.json` offline and unlocks Pro or Enterprise skills accordingly. Without a valid license, all MIT skills stay available.
+- **Version Retention**: A license unlocks every server release published on or before its `updates_until` date, permanently. Later releases run in free mode until the license is renewed. No clock check is involved.
+- **Canary Cryptographic Watermarking**: Embeds non-intrusive provenance tokens into skill outputs for copyright protection and leak detection.
+- **Presence Audit**: The `audit_compliance` tool checks that expected files and scripts exist (AGENTS.md, `.qa-exceptions.yaml`, security.txt, `.gitignore`, QA scripts). It does not run gates or validate contents.
+
+---
+
+## Quick Setup (npx or local node)
+
+### 1. Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "fredo-qa": {
+      "command": "npx",
+      "args": ["-y", "@illicomedia/skills-mcp-server"],
+      "env": {
+        "FREDO_QA_LICENSE_FILE": "/absolute/path/to/license.json"
+      }
+    }
+  }
+}
+```
+
+### 2. Cursor IDE
+
+Add to `.cursor/mcp.json` in your workspace or user settings:
+
+```json
+{
+  "mcpServers": {
+    "fredo-qa": {
+      "command": "npx",
+      "args": ["-y", "@illicomedia/skills-mcp-server"],
+      "env": {
+        "FREDO_QA_LICENSE_FILE": "/absolute/path/to/license.json"
+      }
+    }
+  }
+}
+```
+
+### 3. Google Antigravity
+
+Add to your `antigravity.json` or custom MCP settings:
+
+```json
+{
+  "mcpServers": {
+    "fredo-qa": {
+      "command": "npx",
+      "args": ["-y", "@illicomedia/skills-mcp-server"],
+      "env": {
+        "FREDO_QA_LICENSE_FILE": "/absolute/path/to/license.json"
+      }
+    }
+  }
+}
+```
+
+## License Files
+
+Pro and Enterprise skills require a license file signed by the vendor with Ed25519. The server
+looks for it in this order:
+
+1. The path in `FREDO_QA_LICENSE_FILE`.
+2. `~/.config/fredo-qa/license.json`.
+3. `.qa-license.json` at the project root (keep it out of git).
+
+The server verifies the signature offline against the public keys compiled into the release.
+A missing, malformed, tampered, or untrusted license leaves the server in free mode and says why.
+The format is defined in `docs/plans/2026-10-07-enforcement-kit/distribution-licensing.md`,
+section 3.
+
+---
+
+## Available MCP Tools
+
+| Tool Name | Parameters | Description |
+|---|---|---|
+| `list_skills` | `{ category?: string }` | Lists all skills accessible under your current plan with their descriptions and key gates. |
+| `get_skill_rules` | `{ skill_id: string }` | Returns complete prompt instructions and QA directives for a skill (e.g. `qa-security`, `qa-accessibility`). |
+| `install_skill` | `{ skill_id: string, project_path?: string, license_key?: string }` | Installs a skill into `.agents/skills/<skill_id>/` with `SKILL.md` and `LICENSE`. Enforces auth for paid Pro & Enterprise skills. |
+| `sync_workspace_skills` | `{ project_path?: string, skills?: string[], license_key?: string }` | Auto-detects project stack and provisions matching QA skills and licenses. Respects license tiers and reports auth status. |
+| `set_license_key` | `{ license_key: string }` | Sets the signed license file (path or JSON content) for the active session, without a server restart. |
+| `audit_compliance` | `{ project_path: string }` | Reports which expected files and scripts are present. Presence only: no gate is executed and no content is validated. |
+| `verify_license` | `{ license_key?: string }` | Returns signature validity, tier, licensee, license ID, `updates_until`, and fallback status. |
+
+---
+
+## Development & Testing
+
+```bash
+# Build the TypeScript MCP server
+npm run build
+
+# Run automated tests
+npm test
+```
+
+---
+
+## License & Copyright
+
+Copyright (c) 2026 Frédéric Charles Viallet.  
+Open-source foundation tools released under the MIT License.  
+Commercial skills and enterprise packs are proprietary and subject to the Fredo QA Skills Commercial License.

package/dist/audit.d.ts

@@ -0,0 +1,23 @@
+export interface AuditCheckResult {
+    category: string;
+    name: string;
+    passed: boolean;
+    severity: 'blocker' | 'warning' | 'info';
+    details: string;
+}
+export interface AuditReport {
+    projectPath: string;
+    timestamp: string;
+    /** Share of presence checks that found their file or script, 0-100. Not a compliance score. */
+    score: number;
+    scope: string;
+    totalChecks: number;
+    passedChecks: number;
+    failedChecks: number;
+    results: AuditCheckResult[];
+    recommendations: string[];
+}
+/**
+ * Checks that the files and scripts expected by Fredo QA Skills are present in a project.
+ */
+export declare function runComplianceAudit(projectPath: string): AuditReport;

package/dist/audit.js

@@ -0,0 +1,124 @@
+// SPDX-FileCopyrightText: 2026 Frédéric Charles Viallet
+// SPDX-License-Identifier: MIT
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const AUDIT_SCOPE = 'File-presence checks only: gates are not executed and file contents are not validated. A full pass means the expected files exist, not that the project is compliant.';
+/**
+ * Checks that the files and scripts expected by Fredo QA Skills are present in a project.
+ */
+export function runComplianceAudit(projectPath) {
+    const resolvedPath = path.resolve(projectPath);
+    const results = [];
+    // Check 1: AGENTS.md policy presence
+    const agentsMd = path.join(resolvedPath, 'AGENTS.md');
+    const hasAgentsMd = fs.existsSync(agentsMd);
+    results.push({
+        category: 'governance',
+        name: 'AGENTS.md present',
+        passed: hasAgentsMd,
+        severity: 'blocker',
+        details: hasAgentsMd
+            ? 'AGENTS.md file present (content not evaluated).'
+            : 'AGENTS.md not found. Coding agents have no repository-level QA instructions.',
+    });
+    // Check 2: .qa-exceptions governance
+    const exceptionsFile = path.join(resolvedPath, '.qa-exceptions.yaml');
+    const hasExceptions = fs.existsSync(exceptionsFile);
+    results.push({
+        category: 'governance',
+        name: '.qa-exceptions.yaml present',
+        passed: hasExceptions,
+        severity: 'warning',
+        details: hasExceptions
+            ? 'Exception register file present (schema and expiry not checked).'
+            : 'No .qa-exceptions.yaml found. Deviations from quality gates should be tracked there.',
+    });
+    // Check 3: RFC 9116 security.txt
+    const secTxtPublic = path.join(resolvedPath, 'public', '.well-known', 'security.txt');
+    const secTxtDist = path.join(resolvedPath, 'dist', '.well-known', 'security.txt');
+    const secTxtRoot = path.join(resolvedPath, '.well-known', 'security.txt');
+    const hasSecTxt = fs.existsSync(secTxtPublic) || fs.existsSync(secTxtDist) || fs.existsSync(secTxtRoot);
+    results.push({
+        category: 'security',
+        name: 'security.txt present',
+        passed: hasSecTxt,
+        severity: 'blocker',
+        details: hasSecTxt
+            ? 'security.txt file present in a .well-known/ directory (RFC 9116 fields not checked).'
+            : 'No security.txt found in public/, dist/, or root .well-known/ directories.',
+    });
+    // Check 4: Safe gitignore configuration
+    const gitignore = path.join(resolvedPath, '.gitignore');
+    const hasGitignore = fs.existsSync(gitignore);
+    let ignoresEnv = false;
+    if (hasGitignore) {
+        const gitignoreContent = fs.readFileSync(gitignore, 'utf-8');
+        ignoresEnv = gitignoreContent.includes('.env');
+    }
+    results.push({
+        category: 'security',
+        name: '.gitignore mentions .env',
+        passed: hasGitignore && ignoresEnv,
+        severity: 'blocker',
+        details: hasGitignore && ignoresEnv
+            ? '.gitignore contains the text ".env" (ignore rules and other secret files not evaluated).'
+            : '.gitignore missing or does not mention .env (also ignore private keys and credentials).',
+    });
+    // Check 5: QA scripts in package.json
+    const pkgJsonPath = path.join(resolvedPath, 'package.json');
+    let hasQaStandard = false;
+    let hasTypeCheck = false;
+    if (fs.existsSync(pkgJsonPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+            hasQaStandard = Boolean(pkg.scripts?.['qa:standard'] || pkg.scripts?.['qa:starter']);
+            hasTypeCheck = Boolean(pkg.scripts?.['type-check'] || pkg.scripts?.['tsc']);
+        }
+        catch {
+            // Ignored
+        }
+    }
+    results.push({
+        category: 'quality',
+        name: 'qa:starter or qa:standard script declared',
+        passed: hasQaStandard,
+        severity: 'blocker',
+        details: hasQaStandard
+            ? 'package.json declares qa:starter or qa:standard (script not executed).'
+            : 'No qa:starter / qa:standard script in package.json.',
+    });
+    results.push({
+        category: 'quality',
+        name: 'type-check script declared',
+        passed: hasTypeCheck,
+        severity: 'blocker',
+        details: hasTypeCheck
+            ? 'package.json declares a type-check script (script not executed).'
+            : 'No type-check or tsc script in package.json.',
+    });
+    const totalChecks = results.length;
+    const passedChecks = results.filter((r) => r.passed).length;
+    const failedChecks = totalChecks - passedChecks;
+    const score = Math.round((passedChecks / totalChecks) * 100);
+    const recommendations = [];
+    if (!hasAgentsMd) {
+        recommendations.push('Create an AGENTS.md in project root enforcing Fredo QA Skills rules for AI assistants.');
+    }
+    if (!hasSecTxt) {
+        recommendations.push('Generate public/.well-known/security.txt with valid Contact and Expires directives.');
+    }
+    if (!hasQaStandard) {
+        recommendations.push('Add "qa:starter" and "qa:standard" scripts to package.json to ensure local and CI parity.');
+    }
+    return {
+        projectPath: resolvedPath,
+        timestamp: new Date().toISOString(),
+        score,
+        scope: AUDIT_SCOPE,
+        totalChecks,
+        passedChecks,
+        failedChecks,
+        results,
+        recommendations,
+    };
+}

package/dist/catalog.d.ts

@@ -0,0 +1,18 @@
+import type { LicenseValidationResult, SkillMetadata, SkillTier } from './types.js';
+export declare const SKILLS_CATALOG: SkillMetadata[];
+/**
+ * Filter skills by active license tier
+ */
+export declare function getAvailableSkills(userTier: SkillTier): SkillMetadata[];
+/**
+ * Finds a skill by ID
+ */
+export declare function findSkill(id: string): SkillMetadata | undefined;
+/**
+ * Attempts to load the real SKILL.md from filesystem, or falls back to metadata
+ */
+export declare function loadSkillContent(skillId: string, searchDir?: string): string;
+/**
+ * Loads or generates a compliant LICENSE file for a skill
+ */
+export declare function loadSkillLicense(skillId: string, license: LicenseValidationResult, searchDir?: string): string;

package/dist/catalog.js

@@ -0,0 +1,306 @@
+// SPDX-FileCopyrightText: 2026 Frédéric Charles Viallet
+// SPDX-License-Identifier: MIT
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { resolveSkillLicense } from './license-templates.js';
+export const SKILLS_CATALOG = [
+    // Free Foundation (MIT)
+    {
+        id: 'qa-core',
+        name: 'Core Quality Policy',
+        tier: 'free',
+        category: 'core',
+        description: 'Universal QA policy across stacks, standard profiles, and DoD checklists.',
+        rulesSummary: [
+            'Zero unhandled exceptions',
+            'Local/CI execution parity',
+            'Exception governance via .qa-exceptions.yaml',
+        ],
+    },
+    {
+        id: 'dev-flow',
+        name: 'Engineering Development Flow',
+        tier: 'free',
+        category: 'core',
+        description: 'Disciplined development flow with risk-based planning and small vertical slices.',
+        rulesSummary: ['Atomic commits with provenance', 'TDD/BDD inner loop', 'Continuous validation'],
+    },
+    {
+        id: 'qa-python',
+        name: 'Python Quality Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'Strict typing (mypy), deterministic formatting (ruff), and branch coverage.',
+        rulesSummary: ['100% type coverage without Any', 'Ruff check & format', 'Pytest branch coverage >= 90%'],
+    },
+    {
+        id: 'qa-javascript-typescript',
+        name: 'JavaScript & TypeScript Quality',
+        tier: 'free',
+        category: 'language',
+        description: 'Strict type checking, Biome formatting, Vitest coverage, and Core Web Vitals.',
+        rulesSummary: ['tsc --noEmit clean', 'Biome check with zero debt', 'Coverage threshold enforcement'],
+    },
+    {
+        id: 'qa-php',
+        name: 'PHP Quality Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'PHPStan max level, Pint/PHP-CS-Fixer formatting, and boundary architecture.',
+        rulesSummary: [
+            'PHPStan level max',
+            'Hardened public forms (HMAC captcha, honeypot, rate limit)',
+            'Architecture boundaries',
+        ],
+    },
+    {
+        id: 'qa-bash',
+        name: 'Bash & Shell Scripting',
+        tier: 'free',
+        category: 'language',
+        description: 'Safe POSIX defaults (set -euo pipefail), ShellCheck clean, and Bats testing.',
+        rulesSummary: ['set -euo pipefail', 'ShellCheck clean', 'shfmt formatted'],
+    },
+    {
+        id: 'qa-mcp',
+        name: 'Model Context Protocol Quality',
+        tier: 'free',
+        category: 'language',
+        description: 'Strict JSON Schema validation, JSON-RPC 2.0 contract tests, stdio isolation.',
+        rulesSummary: ['JSON-RPC 2.0 compliance', 'Stdio pollution prevention', 'Graceful error handling'],
+    },
+    {
+        id: 'qa-c-cpp',
+        name: 'C & C++ Systems Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'clangd LSP diagnostics, clang-tidy, cppcheck, sanitizers (ASan/UBSan/TSan), and memory safety.',
+        rulesSummary: ['clangd semantic validation', 'ASan/UBSan clean execution', 'Strict compiler warnings (-Werror)'],
+    },
+    {
+        id: 'qa-rust',
+        name: 'Rust Systems Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'Cargo check, Clippy with -D warnings, rustfmt, cargo-deny, cargo-audit, and Miri safety.',
+        rulesSummary: ['cargo clippy --all-targets -- -D warnings', 'cargo fmt --check', 'cargo deny check and cargo audit'],
+    },
+    {
+        id: 'qa-go',
+        name: 'Go Systems Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'golangci-lint, go test -race, govulncheck, gosec, and strict error handling.',
+        rulesSummary: ['golangci-lint run', 'go test -race ./...', 'govulncheck ./... and gosec'],
+    },
+    {
+        id: 'qa-java',
+        name: 'Java Enterprise Engineering',
+        tier: 'free',
+        category: 'language',
+        description: 'Checkstyle, SpotBugs, PMD, Error Prone, JaCoCo branch coverage >= 80%, and ArchUnit boundaries.',
+        rulesSummary: ['javac -Werror clean compile', 'SpotBugs & PMD zero violations', 'JaCoCo line & branch coverage >= 80%'],
+    },
+    // Pro Production (Commercial)
+    {
+        id: 'qa-accessibility',
+        name: 'Accessibility & WCAG 2.2',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'Automated Axe-core testing, WCAG 2.2 AA/AAA baselines, and inclusive UX.',
+        rulesSummary: ['Zero Axe-core violations', 'Keyboard navigability', 'Semantic landmarks'],
+    },
+    {
+        id: 'qa-security',
+        name: 'Application Security & OWASP',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'OWASP Top 10 prevention, dependency audits, CSP headers, and secret scanning.',
+        rulesSummary: [
+            'Dependency audit clean',
+            'CSP on every deploy variant; hosts = active integrations',
+            'Server-verified anti-bot for public forms',
+        ],
+    },
+    {
+        id: 'qa-performance',
+        name: 'Performance & Core Web Vitals',
+        tier: 'pro',
+        category: 'quality',
+        description: 'Lighthouse budgets, LCP < 2.5s, INP < 200ms, CLS < 0.1, bundle optimization.',
+        rulesSummary: ['Lighthouse score >= 90', 'Strict performance budgets', 'Asset compression'],
+    },
+    {
+        id: 'qa-gdpr-rgpd',
+        name: 'GDPR / RGPD Privacy Engineering',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'Privacy by design, CNIL public-web gates, consent parity, data subject rights (DSR), RoPA, and DPIA.',
+        rulesSummary: [
+            'Equal refuse/accept consent; no unconsented trackers',
+            'Art.13 forms + server-verified captcha + retain-until',
+            'RoPA/CSP/legal copy lockstep with processing flags',
+        ],
+    },
+    {
+        id: 'qa-seo-website',
+        name: 'Technical SEO & Search Visibility',
+        tier: 'pro',
+        category: 'quality',
+        description: 'Pre-rendered metadata, JSON-LD structured data, canonical tags, GEO/AEO optimization.',
+        rulesSummary: ['Unique title and description per route', 'Valid Schema.org JSON-LD', 'Canonical tag parity'],
+    },
+    {
+        id: 'qa-well-known',
+        name: 'Well-Known URI Standards',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'RFC 9116 security.txt validation, robots.txt, sitemap.xml, and IANA registry conformance.',
+        rulesSummary: ['Valid security.txt syntax', 'Canonical link directive', 'Future expiry date'],
+    },
+    {
+        id: 'qa-emails-dns',
+        name: 'Email & DNS Security',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'SPF, DKIM, DMARC p=reject, BIMI assertions, and DNS drift detection.',
+        rulesSummary: [
+            'DMARC p=quarantine or reject',
+            'X-Retain-Until on personal-data operator mail',
+            'BIMI indicator validation',
+        ],
+    },
+    {
+        id: 'qa-cnil',
+        name: 'CNIL RGPD Article 30 Processing Register',
+        tier: 'pro',
+        category: 'compliance',
+        description: 'Automated CNIL Article 30 Records of Processing Activities (RoPA) extraction, JSON pivot, and ODS export.',
+        rulesSummary: [
+            'Automated personal data mapping',
+            'Article 30.1 Controller and 30.2 Processor register separation',
+            'Official CNIL OpenDocument Spreadsheet (.ods) export',
+        ],
+    },
+    // Enterprise Assurance (Enterprise)
+    {
+        id: 'qa-devops',
+        name: 'DevOps & CI/CD Security',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'GitHub Actions hardening, Dockerfile linting, container security, and IaC scanning.',
+        rulesSummary: ['Pinned Action SHAs', 'Trivy container scan clean', 'Least-privilege tokens'],
+    },
+    {
+        id: 'qa-ai-infrastructure-compliance',
+        name: 'AI Infrastructure & NIS2 Compliance',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'ISO 42001, NIS2 Directive mapping, EU AI Act risk classification, SOC2 Type II.',
+        rulesSummary: ['AI risk tiering documented', 'NIS2 incident notification readiness', 'Auditable evidence export'],
+    },
+    {
+        id: 'qa-cra-software-supply-chain',
+        name: 'CRA & Supply Chain Assurance',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'EU CRA compliance, CycloneDX/SPDX SBOMs, SLSA Level 3 provenance, and Sigstore signing.',
+        rulesSummary: ['CycloneDX v1.6 SBOM generated', 'SLSA Level 3 provenance verified', 'VEX statements published'],
+    },
+    {
+        id: 'qa-pci-dss',
+        name: 'PCI-DSS v4.0 Payment Security',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'Cardholder Data Environment isolation, client-side tokenization, PAN masking, and audit trails.',
+        rulesSummary: ['Zero SAD/CVV retention', 'Client-side payment tokenization', 'Strict PAN masking'],
+    },
+    {
+        id: 'qa-health-data-compliance',
+        name: 'Health Data (HDS & HIPAA)',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'French HDS v2.0, HIPAA Security Rule, HL7 FHIR validation, and PHI pseudonymization.',
+        rulesSummary: ['Envelope encryption with HSM', 'HL7 FHIR SMART-on-FHIR scopes', 'Immutable access audit logging'],
+    },
+    {
+        id: 'qa-enterprise-iam-sso',
+        name: 'Enterprise IAM & SSO Federation',
+        tier: 'enterprise',
+        category: 'compliance',
+        description: 'SAML 2.0 XML signatures, OIDC with PKCE, SCIM 2.0 provisioning, and multi-tenant isolation.',
+        rulesSummary: ['SAML XML signature & replay check', 'SCIM instant deprovisioning', 'Multi-tenant isolation verified'],
+    },
+];
+/**
+ * Filter skills by active license tier
+ */
+export function getAvailableSkills(userTier) {
+    if (userTier === 'enterprise') {
+        return SKILLS_CATALOG;
+    }
+    if (userTier === 'pro') {
+        return SKILLS_CATALOG.filter((s) => s.tier === 'free' || s.tier === 'pro');
+    }
+    // Free tier
+    return SKILLS_CATALOG.filter((s) => s.tier === 'free');
+}
+/**
+ * Finds a skill by ID
+ */
+export function findSkill(id) {
+    return SKILLS_CATALOG.find((s) => s.id === id);
+}
+/**
+ * Attempts to load the real SKILL.md from filesystem, or falls back to metadata
+ */
+export function loadSkillContent(skillId, searchDir) {
+    const meta = findSkill(skillId);
+    if (!meta) {
+        throw new Error(`Unknown skill: ${skillId}`);
+    }
+    // Look for actual file on disk if available
+    const candidatePaths = [
+        path.join(searchDir || process.cwd(), 'skills', 'free', skillId, 'SKILL.md'),
+        path.join(searchDir || process.cwd(), 'skills', 'pro', skillId, 'SKILL.md'),
+        path.join(searchDir || process.cwd(), 'skills', 'enterprise', skillId, 'SKILL.md'),
+        path.join(searchDir || process.cwd(), 'skills', skillId, 'SKILL.md'),
+        path.join(searchDir || process.cwd(), '.agents', 'skills', skillId, 'SKILL.md'),
+    ];
+    for (const p of candidatePaths) {
+        if (fs.existsSync(p)) {
+            try {
+                return fs.readFileSync(p, 'utf-8');
+            }
+            catch {
+                // Fallback
+            }
+        }
+    }
+    // Generate synthetic structured directives if file not directly on disk
+    return `# Skill: ${meta.name} (${meta.id})
+Category: ${meta.category}
+Tier: ${meta.tier.toUpperCase()}
+
+## Description
+${meta.description}
+
+## Mandatory QA Rules & Quality Gates
+${meta.rulesSummary.map((r, i) => `${i + 1}. **${r}**`).join('\n')}
+
+## Inner Loop Commands
+- Run \`pnpm run qa:starter\` or equivalent inner-loop test before committing.
+- Run \`pnpm run qa:standard\` before submitting merge requests.
+- Adhere strictly to zero-hidden-debt principles. Suppressions without documented justification in \`.qa-exceptions.yaml\` are rejected.
+`;
+}
+/**
+ * Loads or generates a compliant LICENSE file for a skill
+ */
+export function loadSkillLicense(skillId, license, searchDir) {
+    const meta = findSkill(skillId);
+    if (!meta) {
+        throw new Error(`Unknown skill: ${skillId}`);
+    }
+    return resolveSkillLicense(meta, license, searchDir);
+}

package/dist/executor.d.ts

@@ -0,0 +1,4 @@
+import { type LicenseOptions } from './license.js';
+export declare class ToolExecutor {
+    static execute(name: string, args: Record<string, unknown>, activeLicenseKey: string | undefined, onLicenseUpdate: (key: string) => void, licenseOptions?: LicenseOptions): string;
+}