@kilnai/core 0.1.0

package/dist/security/self-audit.js

@@ -0,0 +1,142 @@
+// SelfAudit: periodic security health checks
+export class SelfAudit {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async runAudit() {
+        const checkNames = [
+            "secrets_encryption",
+            "audit_integrity",
+            "tenant_isolation",
+            "config_validation",
+        ];
+        const checks = await Promise.all(checkNames.map((name) => this.runCheck(name)));
+        const failedChecks = checks.filter((c) => !c.passed).map((c) => c.check);
+        const passedCount = checks.filter((c) => c.passed).length;
+        const total = checks.length;
+        let overallStatus;
+        if (failedChecks.length > 0) {
+            overallStatus = "fail";
+        }
+        else if (total === 0) {
+            overallStatus = "warn";
+        }
+        else {
+            overallStatus = "pass";
+        }
+        let summary;
+        if (failedChecks.length === 0) {
+            summary = `${passedCount}/${total} checks passed`;
+        }
+        else {
+            summary = `${passedCount}/${total} checks passed (${failedChecks.join(", ")} failed)`;
+        }
+        return {
+            timestamp: new Date(),
+            overallStatus,
+            checks,
+            summary,
+        };
+    }
+    async runCheck(check) {
+        const checkedAt = new Date();
+        switch (check) {
+            case "secrets_encryption": {
+                const { tenantRegistry } = this.options;
+                if (!tenantRegistry) {
+                    return { check, passed: true, details: "tenant registry not configured", checkedAt };
+                }
+                const tenants = tenantRegistry.list();
+                const plaintextTenants = [];
+                for (const tenant of tenants) {
+                    const hasPlaintext = (tenant.whatsappAccessToken !== undefined &&
+                        tenant.whatsappAccessToken !== "[encrypted]") ||
+                        (tenant.whatsappVerifyToken !== undefined &&
+                            tenant.whatsappVerifyToken !== "[encrypted]");
+                    if (hasPlaintext) {
+                        plaintextTenants.push(tenant.tenantId);
+                    }
+                }
+                if (plaintextTenants.length > 0) {
+                    return {
+                        check,
+                        passed: false,
+                        details: `Plaintext tokens found in tenants: ${plaintextTenants.join(", ")}`,
+                        checkedAt,
+                    };
+                }
+                return { check, passed: true, details: "All tenant tokens are encrypted", checkedAt };
+            }
+            case "audit_integrity": {
+                const { auditLog } = this.options;
+                if (!auditLog) {
+                    return { check, passed: true, details: "audit log not configured", checkedAt };
+                }
+                const result = auditLog.verifyChain();
+                if (!result.valid) {
+                    return {
+                        check,
+                        passed: false,
+                        details: result.error ?? `Chain broken at index ${result.brokenAt ?? "unknown"}`,
+                        checkedAt,
+                    };
+                }
+                return {
+                    check,
+                    passed: true,
+                    details: `Audit chain valid (${result.entriesChecked} entries checked)`,
+                    checkedAt,
+                };
+            }
+            case "tenant_isolation": {
+                const { tenantRegistry } = this.options;
+                if (!tenantRegistry) {
+                    return { check, passed: true, details: "tenant registry not configured", checkedAt };
+                }
+                const tenants = tenantRegistry.list();
+                const seen = new Set();
+                const duplicates = [];
+                for (const tenant of tenants) {
+                    if (seen.has(tenant.tenantId)) {
+                        duplicates.push(tenant.tenantId);
+                    }
+                    else {
+                        seen.add(tenant.tenantId);
+                    }
+                }
+                if (duplicates.length > 0) {
+                    return {
+                        check,
+                        passed: false,
+                        details: `Duplicate tenant IDs detected: ${duplicates.join(", ")}`,
+                        checkedAt,
+                    };
+                }
+                return {
+                    check,
+                    passed: true,
+                    details: `All ${tenants.length} tenant IDs are unique`,
+                    checkedAt,
+                };
+            }
+            case "config_validation": {
+                const { configValidator } = this.options;
+                if (!configValidator) {
+                    return { check, passed: true, details: "no validator configured", checkedAt };
+                }
+                const errors = configValidator();
+                if (errors.length > 0) {
+                    return {
+                        check,
+                        passed: false,
+                        details: `Config errors: ${errors.join("; ")}`,
+                        checkedAt,
+                    };
+                }
+                return { check, passed: true, details: "Config validation passed", checkedAt };
+            }
+        }
+    }
+}
+//# sourceMappingURL=self-audit.js.map

package/dist/security/self-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-audit.js","sourceRoot":"","sources":["../../src/security/self-audit.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAiC7C,MAAM,OAAO,SAAS;IACH,OAAO,CAAmB;IAE3C,YAAY,OAAyB;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,UAAU,GAAwB;YACtC,oBAAoB;YACpB,iBAAiB;YACjB,kBAAkB;YAClB,mBAAmB;SACpB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,IAAI,aAAuC,CAAC;QAC5C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,GAAG,WAAW,IAAI,KAAK,gBAAgB,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,GAAG,WAAW,IAAI,KAAK,mBAAmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACxF,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,aAAa;YACb,MAAM;YACN,OAAO;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAwB;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;gBACxC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,SAAS,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;gBACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAChB,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;wBACvC,MAAM,CAAC,mBAAmB,KAAK,aAAa,CAAC;wBAC/C,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;4BACvC,MAAM,CAAC,mBAAmB,KAAK,aAAa,CAAC,CAAC;oBAClD,IAAI,YAAY,EAAE,CAAC;wBACjB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO;wBACL,KAAK;wBACL,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,sCAAsC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC5E,SAAS;qBACV,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,iCAAiC,EAAE,SAAS,EAAE,CAAC;YACxF,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;gBAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,CAAC;gBACjF,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,OAAO;wBACL,KAAK;wBACL,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,yBAAyB,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE;wBAChF,SAAS;qBACV,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,KAAK;oBACL,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,sBAAsB,MAAM,CAAC,cAAc,mBAAmB;oBACvE,SAAS;iBACV,CAAC;YACJ,CAAC;YAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;gBACxC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,EAAE,SAAS,EAAE,CAAC;gBACvF,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC9B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACnC,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO;wBACL,KAAK;wBACL,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,kCAAkC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAClE,SAAS;qBACV,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,KAAK;oBACL,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,wBAAwB;oBACtD,SAAS;iBACV,CAAC;YACJ,CAAC;YAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC;gBAChF,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,OAAO;wBACL,KAAK;wBACL,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC9C,SAAS;qBACV,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/security/types.d.ts

@@ -0,0 +1,107 @@
+/** Categories of auditable actions */
+export type AuditAction = "capability_executed" | "destructive_blocked" | "destructive_approved" | "injection_detected" | "injection_cleared" | "secret_accessed" | "secret_rotated" | "tenant_created" | "tenant_updated" | "tenant_deleted" | "memory_accessed" | "memory_denied" | "session_started" | "session_ended" | "config_changed" | "self_audit_completed" | "pii_detected" | "content_classified" | "policy_evaluated";
+/** Single audit log entry */
+export interface AuditEntry {
+    readonly id: string;
+    readonly timestamp: Date;
+    readonly action: AuditAction;
+    readonly actor: string;
+    readonly resource: string;
+    readonly outcome: "allowed" | "denied" | "error";
+    readonly metadata?: Record<string, unknown>;
+    readonly tenantId?: string;
+    readonly sessionId?: string;
+    readonly hash?: string;
+    readonly previousHash?: string;
+}
+/** Audit log interface (append-only) */
+export interface AuditLog {
+    append(entry: Omit<AuditEntry, "id" | "hash" | "previousHash">): AuditEntry;
+    query(filter: AuditFilter): readonly AuditEntry[];
+    verifyChain(fromIndex?: number, toIndex?: number): AuditChainResult;
+    count(): number;
+}
+export interface AuditFilter {
+    readonly action?: AuditAction;
+    readonly actor?: string;
+    readonly tenantId?: string;
+    readonly since?: Date;
+    readonly until?: Date;
+    readonly outcome?: "allowed" | "denied" | "error";
+    readonly limit?: number;
+}
+export interface AuditChainResult {
+    readonly valid: boolean;
+    readonly entriesChecked: number;
+    readonly brokenAt?: number;
+    readonly error?: string;
+}
+/** Secret store for encrypted credentials at rest */
+export interface SecretStore {
+    set(key: string, value: string): void;
+    get(key: string): string | null;
+    has(key: string): boolean;
+    delete(key: string): boolean;
+    keys(): readonly string[];
+    rotateKey(newMasterKey: string): void;
+}
+/** Prompt injection detection result */
+export interface PromptScanResult {
+    readonly safe: boolean;
+    readonly tier: "heuristic" | "deep";
+    readonly threats: readonly PromptThreat[];
+    readonly scannedAt: Date;
+    readonly inputLength: number;
+}
+export interface PromptThreat {
+    readonly pattern: string;
+    readonly severity: "low" | "medium" | "high" | "critical";
+    readonly matched: string;
+    readonly description: string;
+}
+/** Guardian review result for destructive capability execution */
+export interface GuardianReviewResult {
+    readonly approved: boolean;
+    readonly reason: string;
+    readonly reviewedBy: string;
+    readonly reviewDurationMs: number;
+    readonly riskLevel: "low" | "medium" | "high" | "critical";
+    readonly capabilityName: string;
+    readonly agentName: string;
+}
+/** Top-level security configuration (YAML-driven, all opt-in) */
+export interface SecurityConfig {
+    readonly guardian?: GuardianConfig;
+    readonly promptInjection?: PromptInjectionConfig;
+    readonly secrets?: SecretsConfig;
+    readonly audit?: AuditConfig;
+    readonly tenantIsolation?: TenantIsolationConfig;
+}
+export interface GuardianConfig {
+    readonly enabled: boolean;
+    readonly reviewerTier: "reasoning" | "fast";
+    readonly blockOnError: boolean;
+    readonly bypassForReadOnly: boolean;
+}
+export interface PromptInjectionConfig {
+    readonly enabled: boolean;
+    readonly heuristicOnly: boolean;
+    readonly blockOnDetection: boolean;
+    readonly allowedPatterns?: readonly string[];
+}
+export interface SecretsConfig {
+    readonly enabled: boolean;
+    readonly storePath: string;
+}
+export interface AuditConfig {
+    readonly enabled: boolean;
+    readonly logPath: string;
+    readonly hashChaining: boolean;
+    readonly retentionDays?: number;
+}
+export interface TenantIsolationConfig {
+    readonly enabled: boolean;
+    readonly enforceMemoryNamespace: boolean;
+    readonly enforceFileSystem: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAIA,sCAAsC;AACtC,MAAM,MAAM,WAAW,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,sBAAsB,GACtB,cAAc,GACd,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,cAAc,CAAC,GAAG,UAAU,CAAC;IAC5E,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,UAAU,EAAE,CAAC;IAClD,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACpE,KAAK,IAAI,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,IAAI,IAAI,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAID,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,WAAW,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC"}

package/dist/security/types.js

@@ -0,0 +1,3 @@
+// Security types: interfaces for audit, secrets, prompt scanning, and guardian review
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,sFAAsF"}

package/dist/skill/index.d.ts

@@ -0,0 +1,7 @@
+export type { SkillConfig, SkillTrigger } from "./types.js";
+export type { SkillYaml, SkillTriggerYaml } from "./yaml-schema.js";
+export { validateSkillYaml } from "./yaml-schema.js";
+export { parseSkillYaml, loadSkillYaml, SkillYamlError } from "./yaml-parser.js";
+export { SkillRegistry } from "./skill-registry.js";
+export type { SkillRegistryOptions } from "./skill-registry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/skill/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skill/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/skill/index.js

@@ -0,0 +1,4 @@
+export { validateSkillYaml } from "./yaml-schema.js";
+export { parseSkillYaml, loadSkillYaml, SkillYamlError } from "./yaml-parser.js";
+export { SkillRegistry } from "./skill-registry.js";
+//# sourceMappingURL=index.js.map

package/dist/skill/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skill/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/skill/skill-registry.d.ts

@@ -0,0 +1,26 @@
+import type { SkillConfig } from "./types.js";
+import type { DomainPackageManifest } from "../package/types.js";
+export interface SkillRegistryOptions {
+    readonly builtinSkills?: readonly SkillConfig[];
+}
+export declare class SkillRegistry {
+    private readonly skills;
+    constructor(options?: SkillRegistryOptions);
+    /** Register a skill. First-registered wins -- no overwrite. */
+    register(skill: SkillConfig): void;
+    get(name: string): SkillConfig | undefined;
+    all(): SkillConfig[];
+    /** Discover skills from a directory path. Returns number of skills loaded. */
+    discoverFrom(dirPath: string): number;
+    /** Discover skills from a domain package manifest. Returns number loaded. */
+    discoverFromPackage(manifest: DomainPackageManifest): number;
+    /**
+     * Discover skills from 3-tier hierarchy:
+     * 1. workspace: projectPath/.kiln/skills/
+     * 2. user: userHome/.kiln/skills/
+     * 3. builtin (passed via constructor)
+     * Earlier tiers override later (workspace wins over user wins over builtin).
+     */
+    discoverAll(projectPath: string, userHome: string): number;
+}
+//# sourceMappingURL=skill-registry.d.ts.map

package/dist/skill/skill-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-registry.d.ts","sourceRoot":"","sources":["../../src/skill/skill-registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACjD;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAE7C,OAAO,CAAC,EAAE,oBAAoB;IAQ1C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAMlC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAI1C,GAAG,IAAI,WAAW,EAAE;IAIpB,8EAA8E;IAC9E,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAsBrC,6EAA6E;IAC7E,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM;IAmB5D;;;;;;OAMG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAS3D"}

package/dist/skill/skill-registry.js

@@ -0,0 +1,81 @@
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { loadSkillYaml } from "./yaml-parser.js";
+export class SkillRegistry {
+    skills = new Map();
+    constructor(options) {
+        if (options?.builtinSkills) {
+            for (const skill of options.builtinSkills) {
+                this.register(skill);
+            }
+        }
+    }
+    /** Register a skill. First-registered wins -- no overwrite. */
+    register(skill) {
+        if (!this.skills.has(skill.name)) {
+            this.skills.set(skill.name, skill);
+        }
+    }
+    get(name) {
+        return this.skills.get(name);
+    }
+    all() {
+        return [...this.skills.values()];
+    }
+    /** Discover skills from a directory path. Returns number of skills loaded. */
+    discoverFrom(dirPath) {
+        if (!existsSync(dirPath))
+            return 0;
+        const files = readdirSync(dirPath).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
+        let loaded = 0;
+        for (const file of files) {
+            try {
+                const skill = loadSkillYaml(join(dirPath, file));
+                if (!this.skills.has(skill.name)) {
+                    this.skills.set(skill.name, skill);
+                    loaded++;
+                }
+            }
+            catch {
+                // Skip invalid files silently
+            }
+        }
+        return loaded;
+    }
+    /** Discover skills from a domain package manifest. Returns number loaded. */
+    discoverFromPackage(manifest) {
+        if (manifest.skills.length === 0)
+            return 0;
+        let loaded = 0;
+        for (const skillPath of manifest.skills) {
+            const fullPath = join(manifest.installPath, skillPath);
+            try {
+                const skill = loadSkillYaml(fullPath);
+                if (!this.skills.has(skill.name)) {
+                    this.skills.set(skill.name, skill);
+                    loaded++;
+                }
+            }
+            catch {
+                // Skip invalid skill files silently
+            }
+        }
+        return loaded;
+    }
+    /**
+     * Discover skills from 3-tier hierarchy:
+     * 1. workspace: projectPath/.kiln/skills/
+     * 2. user: userHome/.kiln/skills/
+     * 3. builtin (passed via constructor)
+     * Earlier tiers override later (workspace wins over user wins over builtin).
+     */
+    discoverAll(projectPath, userHome) {
+        const workspaceDir = join(projectPath, ".kiln", "skills");
+        const userDir = join(userHome, ".kiln", "skills");
+        let total = 0;
+        total += this.discoverFrom(workspaceDir);
+        total += this.discoverFrom(userDir);
+        return total;
+    }
+}
+//# sourceMappingURL=skill-registry.js.map

package/dist/skill/skill-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-registry.js","sourceRoot":"","sources":["../../src/skill/skill-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOjD,MAAM,OAAO,aAAa;IACP,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEzD,YAAY,OAA8B;QACxC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,QAAQ,CAAC,KAAkB;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,OAAe;QAC1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjD,CAAC;QAEF,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACnC,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6EAA6E;IAC7E,mBAAmB,CAAC,QAA+B;QACjD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE3C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACnC,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,WAAmB,EAAE,QAAgB;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACzC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/skill/types.d.ts

@@ -0,0 +1,17 @@
+import type { EventType } from "../events/index.js";
+/** Trigger condition: a skill activates when an event matches */
+export interface SkillTrigger {
+    readonly event: EventType;
+    readonly filter?: Record<string, unknown>;
+}
+/** Skill configuration (runtime form) */
+export interface SkillConfig {
+    readonly name: string;
+    readonly description: string;
+    readonly tools: readonly string[];
+    readonly triggers: readonly SkillTrigger[];
+    readonly tags: readonly string[];
+    readonly instructions: string;
+    readonly handler?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/skill/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/skill/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/skill/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/skill/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/skill/types.ts"],"names":[],"mappings":""}

package/dist/skill/yaml-parser.d.ts

@@ -0,0 +1,18 @@
+import { KilnError } from "../engine/errors.js";
+import type { SkillConfig } from "./types.js";
+export declare class SkillYamlError extends KilnError {
+    readonly errors: readonly {
+        field: string;
+        message: string;
+    }[];
+    readonly filePath?: string;
+    constructor(errors: readonly {
+        field: string;
+        message: string;
+    }[], filePath?: string);
+}
+/** Parse a YAML string into a validated SkillConfig */
+export declare function parseSkillYaml(content: string, filePath?: string): SkillConfig;
+/** Read a YAML file from disk and parse into SkillConfig */
+export declare function loadSkillYaml(filePath: string): SkillConfig;
+//# sourceMappingURL=yaml-parser.d.ts.map

package/dist/skill/yaml-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-parser.d.ts","sourceRoot":"","sources":["../../src/skill/yaml-parser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ9C,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAGzB,MAAM,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,EACrD,QAAQ,CAAC,EAAE,MAAM;CAWpB;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,CAkC9E;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAG3D"}

package/dist/skill/yaml-parser.js

@@ -0,0 +1,61 @@
+import { parse } from "yaml";
+import { readFileSync } from "node:fs";
+import { KilnError } from "../engine/errors.js";
+import { validateSkillYaml } from "./yaml-schema.js";
+import { EVENT_LEVEL_MAP } from "../events/index.js";
+const VALID_EVENT_TYPES = new Set(Object.keys(EVENT_LEVEL_MAP));
+export class SkillYamlError extends KilnError {
+    errors;
+    filePath;
+    constructor(errors, filePath) {
+        const msg = errors.map((e) => `  ${e.field}: ${e.message}`).join("\n");
+        super("SKILL_YAML_INVALID", `Invalid skill YAML${filePath ? ` (${filePath})` : ""}:\n${msg}`, {
+            context: { errors, filePath },
+            retryable: false,
+        });
+        this.name = "SkillYamlError";
+        this.errors = errors;
+        this.filePath = filePath;
+    }
+}
+/** Parse a YAML string into a validated SkillConfig */
+export function parseSkillYaml(content, filePath) {
+    const data = parse(content);
+    const errors = validateSkillYaml(data, filePath);
+    if (errors.length > 0)
+        throw new SkillYamlError(errors, filePath);
+    // Safe cast: validation above confirmed the required shape
+    const yaml = data;
+    // Validate trigger event values against known EventType strings
+    const triggerErrors = [];
+    const rawTriggers = yaml.triggers ?? [];
+    for (let i = 0; i < rawTriggers.length; i++) {
+        const trigger = rawTriggers[i];
+        if (!VALID_EVENT_TYPES.has(trigger.event)) {
+            triggerErrors.push({
+                field: `triggers[${i}].event`,
+                message: `Unknown event type "${trigger.event}"`,
+            });
+        }
+    }
+    if (triggerErrors.length > 0)
+        throw new SkillYamlError(triggerErrors, filePath);
+    return {
+        name: yaml.name,
+        description: yaml.description,
+        tools: yaml.tools ?? [],
+        triggers: rawTriggers.map((t) => ({
+            event: t.event,
+            ...(t.filter !== undefined ? { filter: t.filter } : {}),
+        })),
+        tags: yaml.tags ?? [],
+        instructions: yaml.instructions,
+        ...(yaml.handler !== undefined ? { handler: yaml.handler } : {}),
+    };
+}
+/** Read a YAML file from disk and parse into SkillConfig */
+export function loadSkillYaml(filePath) {
+    const content = readFileSync(filePath, "utf-8");
+    return parseSkillYaml(content, filePath);
+}
+//# sourceMappingURL=yaml-parser.js.map

package/dist/skill/yaml-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-parser.js","sourceRoot":"","sources":["../../src/skill/yaml-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;AAExE,MAAM,OAAO,cAAe,SAAQ,SAAS;IAClC,MAAM,CAAgD;IACtD,QAAQ,CAAU;IAE3B,YACE,MAAqD,EACrD,QAAiB;QAEjB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,KAAK,CAAC,oBAAoB,EAAE,qBAAqB,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE;YAC5F,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC7B,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAiB;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAY,CAAC;IACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAiB,CAAC;IAE/B,gEAAgE;IAChE,MAAM,aAAa,GAAyC,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAChC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,aAAa,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,YAAY,CAAC,SAAS;gBAC7B,OAAO,EAAE,uBAAuB,OAAO,CAAC,KAAK,GAAG;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEhF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,KAAK,EAAE,CAAC,CAAC,KAAkB;YAC3B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/skill/yaml-schema.d.ts

@@ -0,0 +1,20 @@
+import type { YamlValidationError } from "../domain/yaml-schema.js";
+export type { YamlValidationError };
+/** Trigger as expressed in YAML */
+export interface SkillTriggerYaml {
+    readonly event: string;
+    readonly filter?: Record<string, unknown>;
+}
+/** Skill config as expressed in YAML */
+export interface SkillYaml {
+    readonly name: string;
+    readonly description: string;
+    readonly tools?: readonly string[];
+    readonly triggers?: readonly SkillTriggerYaml[];
+    readonly tags?: readonly string[];
+    readonly instructions: string;
+    readonly handler?: string;
+}
+/** Validate a parsed YAML object against the SkillYaml schema */
+export declare function validateSkillYaml(data: unknown, filePath?: string): YamlValidationError[];
+//# sourceMappingURL=yaml-schema.d.ts.map

package/dist/skill/yaml-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-schema.d.ts","sourceRoot":"","sources":["../../src/skill/yaml-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,mBAAmB,EAAE,CA+EvB"}

package/dist/skill/yaml-schema.js

@@ -0,0 +1,80 @@
+const REQUIRED_FIELDS = ["name", "description", "instructions"];
+/** Validate a parsed YAML object against the SkillYaml schema */
+export function validateSkillYaml(data, filePath) {
+    const errors = [];
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+        errors.push({ field: "(root)", message: "Expected an object", filePath });
+        return errors;
+    }
+    const obj = data;
+    // Required fields
+    for (const field of REQUIRED_FIELDS) {
+        if (!(field in obj)) {
+            errors.push({ field, message: `Missing required field "${field}"`, filePath });
+        }
+    }
+    // Type checks for present fields
+    if ("name" in obj && typeof obj.name !== "string") {
+        errors.push({ field: "name", message: `Expected string, got ${typeof obj.name}`, filePath });
+    }
+    if ("description" in obj && typeof obj.description !== "string") {
+        errors.push({ field: "description", message: `Expected string, got ${typeof obj.description}`, filePath });
+    }
+    if ("instructions" in obj && typeof obj.instructions !== "string") {
+        errors.push({ field: "instructions", message: `Expected string, got ${typeof obj.instructions}`, filePath });
+    }
+    if ("handler" in obj && typeof obj.handler !== "string") {
+        errors.push({ field: "handler", message: `Expected string, got ${typeof obj.handler}`, filePath });
+    }
+    // tools: optional array of strings
+    if ("tools" in obj) {
+        if (!Array.isArray(obj.tools)) {
+            errors.push({ field: "tools", message: `Expected array, got ${typeof obj.tools}`, filePath });
+        }
+        else {
+            for (let i = 0; i < obj.tools.length; i++) {
+                if (typeof obj.tools[i] !== "string") {
+                    errors.push({ field: `tools[${i}]`, message: `Expected string, got ${typeof obj.tools[i]}`, filePath });
+                }
+            }
+        }
+    }
+    // tags: optional array of strings
+    if ("tags" in obj) {
+        if (!Array.isArray(obj.tags)) {
+            errors.push({ field: "tags", message: `Expected array, got ${typeof obj.tags}`, filePath });
+        }
+        else {
+            for (let i = 0; i < obj.tags.length; i++) {
+                if (typeof obj.tags[i] !== "string") {
+                    errors.push({ field: `tags[${i}]`, message: `Expected string, got ${typeof obj.tags[i]}`, filePath });
+                }
+            }
+        }
+    }
+    // triggers: optional array of objects with event=string
+    if ("triggers" in obj) {
+        if (!Array.isArray(obj.triggers)) {
+            errors.push({ field: "triggers", message: `Expected array, got ${typeof obj.triggers}`, filePath });
+        }
+        else {
+            for (let i = 0; i < obj.triggers.length; i++) {
+                const trigger = obj.triggers[i];
+                if (typeof trigger !== "object" || trigger === null || Array.isArray(trigger)) {
+                    errors.push({ field: `triggers[${i}]`, message: "Expected an object", filePath });
+                }
+                else {
+                    const t = trigger;
+                    if (!("event" in t)) {
+                        errors.push({ field: `triggers[${i}].event`, message: `Missing required field "event"`, filePath });
+                    }
+                    else if (typeof t.event !== "string") {
+                        errors.push({ field: `triggers[${i}].event`, message: `Expected string, got ${typeof t.event}`, filePath });
+                    }
+                }
+            }
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=yaml-schema.js.map