@loxtep/sdk 0.2.1 → 0.3.0

package/dist/skills/check-scope.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure fail-closed scope decision function.
+ *
+ * `checkScope` determines whether a given operation on a resource is permitted
+ * by a skill definition. The function is deny-by-default: if any check fails
+ * or cannot complete, the operation is blocked.
+ *
+ * Decision logic (in order):
+ * 1. If the skill definition is undefined → UNKNOWN_SKILL
+ * 2. If the resource type has no scope entries, or the resource id is not
+ *    in the scope list → SCOPE_VIOLATION
+ * 3. If the resource type has no permissions, or the operation is not in
+ *    the permissions list → OPERATION_DENIED
+ * 4. Otherwise → allowed
+ *
+ * Any unexpected error during validation → SCOPE_VALIDATION_FAILED (fail-closed)
+ */
+import type { SkillDefinition, SkillScope, Operation, ScopeDecision } from './types.js';
+/**
+ * Check whether a specific operation on a resource is permitted by a skill.
+ *
+ * @param skill - The skill definition to check against, or undefined if not found
+ * @param resourceType - The type of resource being accessed (e.g. 'data_products')
+ * @param resourceId - The specific resource identifier being accessed
+ * @param operation - The operation being attempted (read, write, create, delete)
+ * @returns A ScopeDecision indicating whether the operation is allowed or denied
+ */
+export declare function checkScope(skill: SkillDefinition | undefined, resourceType: keyof SkillScope, resourceId: string, operation: Operation): ScopeDecision;
+/**
+ * Resolve a skill by name from a map and check scope in one step.
+ * Convenience wrapper used by both the SDK client-side enforcement and
+ * the MCP server-side checker.
+ *
+ * @param skills - Map of skill name → SkillDefinition
+ * @param skillName - The name of the skill to look up
+ * @param resourceType - The type of resource being accessed
+ * @param resourceId - The specific resource identifier
+ * @param operation - The operation being attempted
+ * @returns A ScopeDecision
+ */
+export declare function checkScopeByName(skills: Map<string, SkillDefinition>, skillName: string, resourceType: keyof SkillScope, resourceId: string, operation: Operation): ScopeDecision;
+//# sourceMappingURL=check-scope.d.ts.map

package/dist/skills/check-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-scope.d.ts","sourceRoot":"","sources":["../../src/skills/check-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExF;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,eAAe,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,UAAU,EAC9B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GACnB,aAAa,CAkCf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,UAAU,EAC9B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GACnB,aAAa,CAUf"}

package/dist/skills/check-scope.js

@@ -0,0 +1,84 @@
+/**
+ * Pure fail-closed scope decision function.
+ *
+ * `checkScope` determines whether a given operation on a resource is permitted
+ * by a skill definition. The function is deny-by-default: if any check fails
+ * or cannot complete, the operation is blocked.
+ *
+ * Decision logic (in order):
+ * 1. If the skill definition is undefined → UNKNOWN_SKILL
+ * 2. If the resource type has no scope entries, or the resource id is not
+ *    in the scope list → SCOPE_VIOLATION
+ * 3. If the resource type has no permissions, or the operation is not in
+ *    the permissions list → OPERATION_DENIED
+ * 4. Otherwise → allowed
+ *
+ * Any unexpected error during validation → SCOPE_VALIDATION_FAILED (fail-closed)
+ */
+/**
+ * Check whether a specific operation on a resource is permitted by a skill.
+ *
+ * @param skill - The skill definition to check against, or undefined if not found
+ * @param resourceType - The type of resource being accessed (e.g. 'data_products')
+ * @param resourceId - The specific resource identifier being accessed
+ * @param operation - The operation being attempted (read, write, create, delete)
+ * @returns A ScopeDecision indicating whether the operation is allowed or denied
+ */
+export function checkScope(skill, resourceType, resourceId, operation) {
+    try {
+        // 1. Unknown skill — no definition provided
+        if (skill === undefined) {
+            return { allowed: false, code: 'UNKNOWN_SKILL', skillName: '' };
+        }
+        // 2. Scope check — is the resource within the skill's declared scope?
+        const scopeList = skill.scope[resourceType];
+        if (!scopeList || !scopeList.includes(resourceId)) {
+            return {
+                allowed: false,
+                code: 'SCOPE_VIOLATION',
+                deniedResource: `${resourceType}/${resourceId}`,
+            };
+        }
+        // 3. Permission check — is the operation allowed for this resource type?
+        const permittedOps = skill.permissions[resourceType];
+        if (!permittedOps || !permittedOps.includes(operation)) {
+            return {
+                allowed: false,
+                code: 'OPERATION_DENIED',
+                deniedOperation: operation,
+                resource: `${resourceType}/${resourceId}`,
+            };
+        }
+        // 4. All checks pass
+        return { allowed: true };
+    }
+    catch {
+        // Fail-closed: any unexpected error blocks the operation
+        return { allowed: false, code: 'SCOPE_VALIDATION_FAILED' };
+    }
+}
+/**
+ * Resolve a skill by name from a map and check scope in one step.
+ * Convenience wrapper used by both the SDK client-side enforcement and
+ * the MCP server-side checker.
+ *
+ * @param skills - Map of skill name → SkillDefinition
+ * @param skillName - The name of the skill to look up
+ * @param resourceType - The type of resource being accessed
+ * @param resourceId - The specific resource identifier
+ * @param operation - The operation being attempted
+ * @returns A ScopeDecision
+ */
+export function checkScopeByName(skills, skillName, resourceType, resourceId, operation) {
+    try {
+        const skill = skills.get(skillName);
+        if (!skill) {
+            return { allowed: false, code: 'UNKNOWN_SKILL', skillName };
+        }
+        return checkScope(skill, resourceType, resourceId, operation);
+    }
+    catch {
+        return { allowed: false, code: 'SCOPE_VALIDATION_FAILED' };
+    }
+}
+//# sourceMappingURL=check-scope.js.map

package/dist/skills/check-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-scope.js","sourceRoot":"","sources":["../../src/skills/check-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,KAAkC,EAClC,YAA8B,EAC9B,UAAkB,EAClB,SAAoB;IAEpB,IAAI,CAAC;QACH,4CAA4C;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,iBAAiB;gBACvB,cAAc,EAAE,GAAG,YAAY,IAAI,UAAU,EAAE;aAChD,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,kBAAkB;gBACxB,eAAe,EAAE,SAAS;gBAC1B,QAAQ,EAAE,GAAG,YAAY,IAAI,UAAU,EAAE;aAC1C,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoC,EACpC,SAAiB,EACjB,YAA8B,EAC9B,UAAkB,EAClB,SAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/skills/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Skill scoping model — YAML loader and fail-closed scope decision.
+ *
+ * A skill is a scoped integration bundle declaring which platform resources
+ * and operations an AI agent may reach. The platform enforces scope fail-closed:
+ * out-of-scope → SCOPE_VIOLATION, disallowed op → OPERATION_DENIED, unknown
+ * skill → rejected, check failure → blocks the operation.
+ */
+export type { SkillScope, Operation, SkillDefinition, ScopeDecision, } from './types.js';
+export { checkScope, checkScopeByName } from './check-scope.js';
+export { parseSkillYaml, loadSkillFromFile, loadSkillsFromDirectory, SkillDefinitionSchema, } from './loader.js';
+export type { SkillReferenceError, SkillValidationResult } from './validate-references.js';
+export { validateSkillReferences, formatSkillValidationErrors, } from './validate-references.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC"}

package/dist/skills/index.js

@@ -0,0 +1,12 @@
+/**
+ * Skill scoping model — YAML loader and fail-closed scope decision.
+ *
+ * A skill is a scoped integration bundle declaring which platform resources
+ * and operations an AI agent may reach. The platform enforces scope fail-closed:
+ * out-of-scope → SCOPE_VIOLATION, disallowed op → OPERATION_DENIED, unknown
+ * skill → rejected, check failure → blocks the operation.
+ */
+export { checkScope, checkScopeByName } from './check-scope.js';
+export { parseSkillYaml, loadSkillFromFile, loadSkillsFromDirectory, SkillDefinitionSchema, } from './loader.js';
+export { validateSkillReferences, formatSkillValidationErrors, } from './validate-references.js';
+//# sourceMappingURL=index.js.map

package/dist/skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC"}

package/dist/skills/loader.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Skill YAML schema validation and loader.
+ *
+ * Parses `.loxtep/skills/<name>.yaml` files into validated `SkillDefinition`
+ * objects using zod for schema enforcement. Invalid YAML or schema violations
+ * produce descriptive errors.
+ */
+import { z } from 'zod/v4';
+import type { SkillDefinition } from './types.js';
+declare const SkillDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodObject<{
+        data_products: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        connectors: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        workflows: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        domains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        queues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    permissions: z.ZodObject<{
+        data_products: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            write: "write";
+            read: "read";
+            create: "create";
+            delete: "delete";
+        }>>>>;
+        connectors: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            write: "write";
+            read: "read";
+            create: "create";
+            delete: "delete";
+        }>>>>;
+        workflows: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            write: "write";
+            read: "read";
+            create: "create";
+            delete: "delete";
+        }>>>>;
+        domains: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            write: "write";
+            read: "read";
+            create: "create";
+            delete: "delete";
+        }>>>>;
+        queues: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            write: "write";
+            read: "read";
+            create: "create";
+            delete: "delete";
+        }>>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export { SkillDefinitionSchema };
+/**
+ * Parse a YAML string into a validated SkillDefinition.
+ *
+ * @param content - Raw YAML content
+ * @param filename - Source filename (for error messages)
+ * @returns Validated SkillDefinition
+ * @throws Error with descriptive message on invalid YAML or schema violations
+ */
+export declare function parseSkillYaml(content: string, filename?: string): SkillDefinition;
+/**
+ * Load a single skill definition from a YAML file path.
+ *
+ * @param filePath - Absolute or relative path to the `.yaml` file
+ * @returns Validated SkillDefinition
+ * @throws Error if file cannot be read or fails validation
+ */
+export declare function loadSkillFromFile(filePath: string): SkillDefinition;
+/**
+ * Load all skill definitions from a `.loxtep/skills/` directory.
+ *
+ * @param skillsDir - Path to the skills directory (e.g. `.loxtep/skills/`)
+ * @returns Map of skill name → SkillDefinition
+ * @throws Error if any file fails to parse or validate
+ */
+export declare function loadSkillsFromDirectory(skillsDir: string): Map<string, SkillDefinition>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/skills/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/skills/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAI3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgBlD,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWzB,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAqBlF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAGnE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAwBvF"}

package/dist/skills/loader.js

@@ -0,0 +1,102 @@
+/**
+ * Skill YAML schema validation and loader.
+ *
+ * Parses `.loxtep/skills/<name>.yaml` files into validated `SkillDefinition`
+ * objects using zod for schema enforcement. Invalid YAML or schema violations
+ * produce descriptive errors.
+ */
+import { z } from 'zod/v4';
+import * as yaml from 'js-yaml';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/**
+ * Zod schema for a skill definition YAML file.
+ * Validates the structure and constraints of skill scope and permissions.
+ */
+const OperationSchema = z.enum(['read', 'write', 'create', 'delete']);
+const SkillScopeSchema = z.object({
+    data_products: z.array(z.string()).optional(),
+    connectors: z.array(z.string()).optional(),
+    workflows: z.array(z.string()).optional(),
+    domains: z.array(z.string()).optional(),
+    queues: z.array(z.string()).optional(),
+});
+const SkillDefinitionSchema = z.object({
+    name: z.string().min(1),
+    description: z.string().optional(),
+    scope: SkillScopeSchema,
+    permissions: z.object({
+        data_products: z.array(OperationSchema).optional(),
+        connectors: z.array(OperationSchema).optional(),
+        workflows: z.array(OperationSchema).optional(),
+        domains: z.array(OperationSchema).optional(),
+        queues: z.array(OperationSchema).optional(),
+    }).partial(),
+});
+export { SkillDefinitionSchema };
+/**
+ * Parse a YAML string into a validated SkillDefinition.
+ *
+ * @param content - Raw YAML content
+ * @param filename - Source filename (for error messages)
+ * @returns Validated SkillDefinition
+ * @throws Error with descriptive message on invalid YAML or schema violations
+ */
+export function parseSkillYaml(content, filename) {
+    let parsed;
+    try {
+        parsed = yaml.load(content);
+    }
+    catch (err) {
+        const prefix = filename ? `${filename}: ` : '';
+        throw new Error(`${prefix}Invalid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const result = SkillDefinitionSchema.safeParse(parsed);
+    if (!result.success) {
+        const prefix = filename ? `${filename}: ` : '';
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join('.')}: ${i.message}`)
+            .join('\n');
+        throw new Error(`${prefix}Skill schema validation failed:\n${issues}`);
+    }
+    return result.data;
+}
+/**
+ * Load a single skill definition from a YAML file path.
+ *
+ * @param filePath - Absolute or relative path to the `.yaml` file
+ * @returns Validated SkillDefinition
+ * @throws Error if file cannot be read or fails validation
+ */
+export function loadSkillFromFile(filePath) {
+    const content = fs.readFileSync(filePath, 'utf-8');
+    return parseSkillYaml(content, path.basename(filePath));
+}
+/**
+ * Load all skill definitions from a `.loxtep/skills/` directory.
+ *
+ * @param skillsDir - Path to the skills directory (e.g. `.loxtep/skills/`)
+ * @returns Map of skill name → SkillDefinition
+ * @throws Error if any file fails to parse or validate
+ */
+export function loadSkillsFromDirectory(skillsDir) {
+    const skills = new Map();
+    if (!fs.existsSync(skillsDir)) {
+        return skills;
+    }
+    const entries = fs.readdirSync(skillsDir);
+    for (const entry of entries) {
+        if (!entry.endsWith('.yaml') && !entry.endsWith('.yml')) {
+            continue;
+        }
+        const filePath = path.join(skillsDir, entry);
+        const stat = fs.statSync(filePath);
+        if (!stat.isFile()) {
+            continue;
+        }
+        const skill = loadSkillFromFile(filePath);
+        skills.set(skill.name, skill);
+    }
+    return skills;
+}
+//# sourceMappingURL=loader.js.map

package/dist/skills/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/skills/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,gBAAgB;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAClD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC/C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;KAC5C,CAAC,CAAC,OAAO,EAAE;CACb,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAiB;IAC/D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,oCAAoC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC,IAAuB,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/skills/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Skill types for the scoped access model.
+ *
+ * A skill defines which platform resources and operations an AI agent may
+ * reach within a workspace. The scope is fail-closed: any check that cannot
+ * complete blocks the operation.
+ */
+/**
+ * The set of resource types a skill can scope access to.
+ * Each key maps to a list of permitted resource identifiers (IDs or names).
+ */
+export interface SkillScope {
+    data_products?: string[];
+    connectors?: string[];
+    workflows?: string[];
+    domains?: string[];
+    queues?: string[];
+}
+/**
+ * The set of operations that can be permitted on a resource type.
+ */
+export type Operation = 'read' | 'write' | 'create' | 'delete';
+/**
+ * A parsed skill definition from `.loxtep/skills/<name>.yaml`.
+ */
+export interface SkillDefinition {
+    name: string;
+    description?: string;
+    scope: SkillScope;
+    permissions: Partial<Record<keyof SkillScope, Operation[]>>;
+}
+/**
+ * The result of a scope check decision.
+ * Only `{ allowed: true }` permits execution. All other variants deny.
+ */
+export type ScopeDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    code: 'SCOPE_VIOLATION';
+    deniedResource: string;
+} | {
+    allowed: false;
+    code: 'OPERATION_DENIED';
+    deniedOperation: Operation;
+    resource: string;
+} | {
+    allowed: false;
+    code: 'UNKNOWN_SKILL';
+    skillName: string;
+} | {
+    allowed: false;
+    code: 'SCOPE_VALIDATION_FAILED';
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/skills/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/skills/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,eAAe,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC"}

package/dist/skills/types.js

@@ -0,0 +1,9 @@
+/**
+ * Skill types for the scoped access model.
+ *
+ * A skill defines which platform resources and operations an AI agent may
+ * reach within a workspace. The scope is fail-closed: any check that cannot
+ * complete blocks the operation.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/skills/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/skills/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/skills/validate-references.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Generate-time skill validation against the Workspace_Context.
+ *
+ * During `loxtep generate`, every skill definition file at `.loxtep/skills/*.yaml`
+ * is validated against the loaded Workspace_Context. If a skill references a
+ * resource that does not exist in the context, `generate` exits non-zero with
+ * the skill name and each missing resource identifier.
+ *
+ * Requirements: 5.8, 5.9
+ */
+import type { SkillDefinition, SkillScope } from './types.js';
+import type { WorkspaceContext } from '../codegen/types.js';
+/**
+ * A single invalid resource reference found during validation.
+ */
+export interface SkillReferenceError {
+    /** Name of the skill that contains the invalid reference */
+    skillName: string;
+    /** Resource type (e.g. 'data_products', 'connectors') */
+    resourceType: keyof SkillScope;
+    /** The identifier that does not exist in the Workspace_Context */
+    missingIdentifier: string;
+}
+/**
+ * Result of validating skill references against the workspace context.
+ */
+export type SkillValidationResult = {
+    valid: true;
+} | {
+    valid: false;
+    errors: SkillReferenceError[];
+};
+/**
+ * Validate all skill resource references against the loaded Workspace_Context.
+ *
+ * For each skill, every identifier listed in the skill's `scope` is checked
+ * against the corresponding resource collection in the context. Resource
+ * identifiers in skill scope files are matched by `name` against the workspace
+ * context collections.
+ *
+ * @param skills - Map of skill name → SkillDefinition (loaded from `.loxtep/skills/`)
+ * @param context - The Workspace_Context loaded from the platform
+ * @returns Validation result: either `{ valid: true }` or `{ valid: false, errors: [...] }`
+ */
+export declare function validateSkillReferences(skills: Map<string, SkillDefinition>, context: WorkspaceContext): SkillValidationResult;
+/**
+ * Format skill validation errors into human-readable error messages.
+ * Each message identifies the skill name, resource type, and missing identifier.
+ *
+ * @param errors - Array of SkillReferenceError from validation
+ * @returns Formatted error messages, one per line
+ */
+export declare function formatSkillValidationErrors(errors: SkillReferenceError[]): string;
+//# sourceMappingURL=validate-references.d.ts.map

package/dist/skills/validate-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-references.d.ts","sourceRoot":"","sources":["../../src/skills/validate-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,YAAY,EAAE,MAAM,UAAU,CAAC;IAC/B,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AA2BpD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,OAAO,EAAE,gBAAgB,GACxB,qBAAqB,CA+BvB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAMjF"}

package/dist/skills/validate-references.js

@@ -0,0 +1,80 @@
+/**
+ * Generate-time skill validation against the Workspace_Context.
+ *
+ * During `loxtep generate`, every skill definition file at `.loxtep/skills/*.yaml`
+ * is validated against the loaded Workspace_Context. If a skill references a
+ * resource that does not exist in the context, `generate` exits non-zero with
+ * the skill name and each missing resource identifier.
+ *
+ * Requirements: 5.8, 5.9
+ */
+/**
+ * Mapping from skill scope resource type keys to the corresponding
+ * WorkspaceContext collection keys.
+ */
+const RESOURCE_TYPE_TO_CONTEXT_KEY = {
+    data_products: 'dataProducts',
+    connectors: 'connectors',
+    workflows: 'workflows',
+    domains: 'domains',
+    queues: 'queues',
+};
+/**
+ * Extract the set of resource names available in the workspace context
+ * for a given resource type.
+ */
+function getAvailableNames(context, resourceType) {
+    const contextKey = RESOURCE_TYPE_TO_CONTEXT_KEY[resourceType];
+    const collection = context[contextKey];
+    return new Set(collection.map((r) => r.name));
+}
+/**
+ * Validate all skill resource references against the loaded Workspace_Context.
+ *
+ * For each skill, every identifier listed in the skill's `scope` is checked
+ * against the corresponding resource collection in the context. Resource
+ * identifiers in skill scope files are matched by `name` against the workspace
+ * context collections.
+ *
+ * @param skills - Map of skill name → SkillDefinition (loaded from `.loxtep/skills/`)
+ * @param context - The Workspace_Context loaded from the platform
+ * @returns Validation result: either `{ valid: true }` or `{ valid: false, errors: [...] }`
+ */
+export function validateSkillReferences(skills, context) {
+    const errors = [];
+    for (const [, skill] of skills) {
+        const resourceTypes = Object.keys(skill.scope);
+        for (const resourceType of resourceTypes) {
+            const identifiers = skill.scope[resourceType];
+            if (!identifiers || identifiers.length === 0) {
+                continue;
+            }
+            const availableNames = getAvailableNames(context, resourceType);
+            for (const identifier of identifiers) {
+                if (!availableNames.has(identifier)) {
+                    errors.push({
+                        skillName: skill.name,
+                        resourceType,
+                        missingIdentifier: identifier,
+                    });
+                }
+            }
+        }
+    }
+    if (errors.length === 0) {
+        return { valid: true };
+    }
+    return { valid: false, errors };
+}
+/**
+ * Format skill validation errors into human-readable error messages.
+ * Each message identifies the skill name, resource type, and missing identifier.
+ *
+ * @param errors - Array of SkillReferenceError from validation
+ * @returns Formatted error messages, one per line
+ */
+export function formatSkillValidationErrors(errors) {
+    const lines = errors.map((e) => `Skill "${e.skillName}": references ${e.resourceType} "${e.missingIdentifier}" which does not exist in the workspace context`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=validate-references.js.map

package/dist/skills/validate-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-references.js","sourceRoot":"","sources":["../../src/skills/validate-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwBH;;;GAGG;AACH,MAAM,4BAA4B,GAAqD;IACrF,aAAa,EAAE,cAAc;IAC7B,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACH,SAAS,iBAAiB,CACxB,OAAyB,EACzB,YAA8B;IAE9B,MAAM,UAAU,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAuB,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAoC,EACpC,OAAyB;IAEzB,MAAM,MAAM,GAA0B,EAAE,CAAC;IAEzC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC;QAEvE,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAEhE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,YAAY;wBACZ,iBAAiB,EAAE,UAAU;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA6B;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,UAAU,CAAC,CAAC,SAAS,iBAAiB,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,iBAAiB,iDAAiD,CAChI,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loxtep/sdk",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Loxtep SDK for Node.js - data products, flows, projects, queues",
   "author": "Loxtep <engineering@loxtep.io>",
   "homepage": "https://loxtep.io",
@@ -78,17 +78,19 @@
     "@smithy/protocol-http": "^5.4.3",
     "@smithy/signature-v4": "^5.4.3",
     "@smithy/types": "^4.14.2",
-    "leo-sdk": "7.1.12"
+    "js-yaml": "4.1.0",
+    "leo-sdk": "7.1.12",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
+    "@types/js-yaml": "4.0.9",
     "fast-check": "^4.8.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.9",
     "tsx": "^4.22.0",
     "typedoc": "^0.28.19",
     "typescript": "^6.0.3",
-    "zod": "^4.4.3",
     "zod-to-ts": "^2.0.0"
   }
 }