@lyupro/skillforge-mcp 1.1.0

package/dist/installers/paths.js

@@ -0,0 +1,50 @@
+/**
+ * OS-specific config path helpers for host tools.
+ *
+ * Per repo convention, all SkillForge config paths use `os.homedir()`
+ * exclusively — no platform branching. Cursor is the exception: its
+ * `settings.json` location is third-party (Cursor app), out of our
+ * control, so the platform-specific dispatch here is rubric-exempt.
+ */
+import { join, resolve } from 'node:path';
+import { homedir, platform } from 'node:os';
+import { fileURLToPath } from 'node:url';
+export function claudeConfigPath() {
+    return join(homedir(), '.claude.json');
+}
+export function codexConfigPath() {
+    return join(homedir(), '.codex', 'config.toml');
+}
+// Cursor stores its global settings.json in a per-OS application data
+// directory. We follow the location documented by the Cursor app itself.
+// This is the only place in the codebase where a platform branch is
+// permitted, because the third-party host owns the path.
+export function cursorSettingsPath() {
+    const os = platform();
+    if (os === 'win32') {
+        const appData = process.env.APPDATA ?? join(homedir(), 'AppData', 'Roaming');
+        return join(appData, 'Cursor', 'User', 'settings.json');
+    }
+    if (os === 'darwin') {
+        return join(homedir(), 'Library', 'Application Support', 'Cursor', 'User', 'settings.json');
+    }
+    return join(homedir(), '.config', 'Cursor', 'User', 'settings.json');
+}
+// Fallback `--entry local` target when --binary-path is not supplied.
+// Resolves to <package root>/dist/server.js via import.meta.url so the
+// path works whether the file is executed from dist/ or src/ (tsx).
+export function defaultBinaryPath() {
+    const here = fileURLToPath(import.meta.url);
+    // here = <root>/(dist|src)/installers/paths.(js|ts)
+    // Resolve up three segments to reach the package root, then dist/server.js.
+    return resolve(here, '..', '..', '..', 'dist', 'server.js');
+}
+export function defaultPaths() {
+    return {
+        claudeConfigPath: claudeConfigPath(),
+        codexConfigPath: codexConfigPath(),
+        cursorSettingsPath: cursorSettingsPath(),
+        defaultBinaryPath: defaultBinaryPath(),
+    };
+}
+//# sourceMappingURL=paths.js.map

package/dist/installers/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/installers/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,sEAAsE;AACtE,yEAAyE;AACzE,oEAAoE;AACpE,yDAAyD;AACzD,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,oDAAoD;IACpD,4EAA4E;IAC5E,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,gBAAgB,EAAE,gBAAgB,EAAE;QACpC,eAAe,EAAE,eAAe,EAAE;QAClC,kBAAkB,EAAE,kBAAkB,EAAE;QACxC,iBAAiB,EAAE,iBAAiB,EAAE;KACvC,CAAC;AACJ,CAAC"}

package/dist/installers/registry.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Installer registry — stable enumeration of the three host installers
+ * consumed by the `--all` dispatcher and by --claude / --codex / --cursor.
+ */
+import type { Installer } from './types.js';
+export declare function getAllInstallers(): Installer[];
+export declare function getInstallerByName(name: 'claude' | 'codex' | 'cursor'): Installer;
+//# sourceMappingURL=registry.d.ts.map

package/dist/installers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/installers/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,wBAAgB,gBAAgB,IAAI,SAAS,EAAE,CAE9C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAIjF"}

package/dist/installers/registry.js

@@ -0,0 +1,18 @@
+/**
+ * Installer registry — stable enumeration of the three host installers
+ * consumed by the `--all` dispatcher and by --claude / --codex / --cursor.
+ */
+import { ClaudeInstaller } from './claude-installer.js';
+import { CodexInstaller } from './codex-installer.js';
+import { CursorInstaller } from './cursor-installer.js';
+export function getAllInstallers() {
+    return [new ClaudeInstaller(), new CodexInstaller(), new CursorInstaller()];
+}
+export function getInstallerByName(name) {
+    if (name === 'claude')
+        return new ClaudeInstaller();
+    if (name === 'codex')
+        return new CodexInstaller();
+    return new CursorInstaller();
+}
+//# sourceMappingURL=registry.js.map

package/dist/installers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/installers/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,IAAI,eAAe,EAAE,EAAE,IAAI,cAAc,EAAE,EAAE,IAAI,eAAe,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAmC;IACpE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,eAAe,EAAE,CAAC;IACpD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IAClD,OAAO,IAAI,eAAe,EAAE,CAAC;AAC/B,CAAC"}

package/dist/installers/types.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared types for the install CLI (v1.1).
+ *
+ * Each host tool (Claude Code / Codex CLI / Cursor) ships an Installer
+ * implementing this contract so the CLI dispatcher can iterate them
+ * uniformly under `--all`, `--dry-run`, and `--uninstall`.
+ */
+export type EntryKind = 'npx' | 'local';
+export interface InstallOptions {
+    entry: EntryKind;
+    binaryPath?: string;
+    force?: boolean;
+}
+export type InstallStatus = 'installed' | 'already-installed' | 'updated' | 'skipped';
+export type UninstallStatus = 'uninstalled' | 'not-installed';
+export interface InstallResult {
+    tool: string;
+    status: InstallStatus;
+    configPath: string;
+    message?: string;
+}
+export interface UninstallResult {
+    tool: string;
+    status: UninstallStatus;
+    configPath: string;
+    message?: string;
+}
+export interface PreviewResult {
+    tool: string;
+    configPath: string;
+    willCreate: boolean;
+    before: string | null;
+    after: string;
+    action: 'install' | 'uninstall';
+}
+export interface Installer {
+    readonly name: string;
+    detect(): Promise<boolean>;
+    install(opts: InstallOptions): Promise<InstallResult>;
+    uninstall(): Promise<UninstallResult>;
+    preview(opts: InstallOptions & {
+        action: 'install' | 'uninstall';
+    }): Promise<PreviewResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/installers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/installers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,mBAAmB,GACnB,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG;QAAE,MAAM,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7F"}

package/dist/installers/types.js

@@ -0,0 +1,9 @@
+/**
+ * Shared types for the install CLI (v1.1).
+ *
+ * Each host tool (Claude Code / Codex CLI / Cursor) ships an Installer
+ * implementing this contract so the CLI dispatcher can iterate them
+ * uniformly under `--all`, `--dry-run`, and `--uninstall`.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/installers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/installers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/parser/file-scanner.d.ts

@@ -0,0 +1,10 @@
+interface FileScannerOptions {
+    ignoreDirs?: string[];
+}
+export declare class FileScanner {
+    #private;
+    constructor(options?: FileScannerOptions);
+    scan(folderAbsolutePath: string): Promise<string[]>;
+}
+export {};
+//# sourceMappingURL=file-scanner.d.ts.map

package/dist/parser/file-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.d.ts","sourceRoot":"","sources":["../../src/parser/file-scanner.ts"],"names":[],"mappings":"AAKA,UAAU,kBAAkB;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBAAa,WAAW;;gBAGV,OAAO,GAAE,kBAAuB;IAItC,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAmC1D"}

package/dist/parser/file-scanner.js

@@ -0,0 +1,37 @@
+import { readdir, access } from 'node:fs/promises';
+import { join } from 'node:path';
+const DEFAULT_IGNORE_DIRS = ['node_modules', '.git', 'dist', 'coverage'];
+export class FileScanner {
+    #ignoreDirs;
+    constructor(options = {}) {
+        this.#ignoreDirs = new Set(options.ignoreDirs ?? DEFAULT_IGNORE_DIRS);
+    }
+    async scan(folderAbsolutePath) {
+        try {
+            await access(folderAbsolutePath);
+        }
+        catch {
+            throw new Error(`Folder not found: ${folderAbsolutePath}`);
+        }
+        const entries = await readdir(folderAbsolutePath, {
+            withFileTypes: true,
+            recursive: true,
+        });
+        const results = [];
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const entryPath = join(entry.parentPath ?? entry.path ?? folderAbsolutePath, entry.name);
+            const relativePath = entryPath.slice(folderAbsolutePath.length);
+            const segments = relativePath.split(/[\\/]/).filter(Boolean);
+            const inIgnored = segments.slice(0, -1).some((seg) => this.#ignoreDirs.has(seg));
+            if (inIgnored)
+                continue;
+            if (!entry.name.toLowerCase().endsWith('.md'))
+                continue;
+            results.push(entryPath);
+        }
+        return results.sort();
+    }
+}
+//# sourceMappingURL=file-scanner.js.map

package/dist/parser/file-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.js","sourceRoot":"","sources":["../../src/parser/file-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAMzE,MAAM,OAAO,WAAW;IACb,WAAW,CAAsB;IAE1C,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,kBAA0B;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,kBAAkB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAE9B,MAAM,SAAS,GAAG,IAAI,CACpB,KAAK,CAAC,UAAU,IAAK,KAAqC,CAAC,IAAI,IAAI,kBAAkB,EACrF,KAAK,CAAC,IAAI,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7D,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS;gBAAE,SAAS;YAExB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAExD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/parser/format-detector.d.ts

@@ -0,0 +1,11 @@
+import type { SkillFormat } from '../core/types.js';
+interface DetectInput {
+    filePath?: string;
+    fileName: string;
+    frontmatter?: Record<string, unknown>;
+}
+export declare class FormatDetector {
+    detect({ fileName, frontmatter }: DetectInput): SkillFormat;
+}
+export {};
+//# sourceMappingURL=format-detector.d.ts.map

package/dist/parser/format-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-detector.d.ts","sourceRoot":"","sources":["../../src/parser/format-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,qBAAa,cAAc;IACzB,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,WAAW,GAAG,WAAW;CAO5D"}

package/dist/parser/format-detector.js

@@ -0,0 +1,13 @@
+export class FormatDetector {
+    detect({ fileName, frontmatter }) {
+        if (fileName === 'SKILL.md')
+            return 'claude';
+        if (fileName === 'AGENTS.md')
+            return 'codex';
+        const persona = frontmatter?.['persona'];
+        if (typeof persona === 'string' && persona.trim().length > 0)
+            return 'persona';
+        return 'custom';
+    }
+}
+//# sourceMappingURL=format-detector.js.map

package/dist/parser/format-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-detector.js","sourceRoot":"","sources":["../../src/parser/format-detector.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,cAAc;IACzB,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAe;QAC3C,IAAI,QAAQ,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/parser/frontmatter-parser.d.ts

@@ -0,0 +1,14 @@
+import type { SkillContent } from '../core/types.js';
+import { FormatDetector } from './format-detector.js';
+import type { ScriptsDirDetector } from './scripts-dir-detector.js';
+interface ParserOptions {
+    formatDetector?: FormatDetector;
+    scriptsDirDetector?: ScriptsDirDetector;
+}
+export declare class FrontmatterParser {
+    #private;
+    constructor(options?: ParserOptions);
+    parseFile(absolutePath: string, configuredFolder: string): Promise<SkillContent>;
+}
+export {};
+//# sourceMappingURL=frontmatter-parser.d.ts.map

package/dist/parser/frontmatter-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-parser.d.ts","sourceRoot":"","sources":["../../src/parser/frontmatter-parser.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAuBpE,UAAU,aAAa;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,qBAAa,iBAAiB;;gBAIhB,OAAO,GAAE,aAAkB;IAKjC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAqFvF"}

package/dist/parser/frontmatter-parser.js

@@ -0,0 +1,98 @@
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import matter from 'gray-matter';
+import { FormatDetector } from './format-detector.js';
+import { FsScriptsDirDetector } from './scripts-dir-detector.js';
+const CONSUMED_KEYS = new Set([
+    'name', 'description', 'tags', 'format', 'strategy',
+    'allow_scripts', 'allowScripts', 'allow_network', 'allowNetwork',
+    'skills', 'timeout_ms', 'timeoutMs',
+    'scripts', 'cacheable', 'cache_ttl_ms', 'cacheTtlMs',
+]);
+const STRATEGY_KINDS = new Set(['prompt', 'script', 'hybrid']);
+function normalizeTags(raw) {
+    if (Array.isArray(raw)) {
+        if (raw.every((t) => typeof t === 'string'))
+            return raw;
+        return undefined;
+    }
+    if (typeof raw === 'string') {
+        if (raw.includes(','))
+            return raw.split(',').map((t) => t.trim()).filter(Boolean);
+        return [raw];
+    }
+    return undefined;
+}
+export class FrontmatterParser {
+    #detector;
+    #scriptsDirDetector;
+    constructor(options = {}) {
+        this.#detector = options.formatDetector ?? new FormatDetector();
+        this.#scriptsDirDetector = options.scriptsDirDetector ?? new FsScriptsDirDetector();
+    }
+    async parseFile(absolutePath, configuredFolder) {
+        const raw = await readFile(absolutePath, 'utf-8');
+        const parsed = matter(raw);
+        const data = parsed.data;
+        const name = typeof data['name'] === 'string' ? data['name'].trim() : '';
+        if (!name) {
+            throw new Error(`Skill at ${absolutePath}: missing required frontmatter field 'name'`);
+        }
+        const description = typeof data['description'] === 'string' ? data['description'].trim() : undefined;
+        const tags = normalizeTags(data['tags']);
+        const fileName = basename(absolutePath);
+        const format = this.#detector.detect({ fileName, frontmatter: data });
+        const strategyRaw = data['strategy'];
+        const strategy = typeof strategyRaw === 'string' && STRATEGY_KINDS.has(strategyRaw)
+            ? strategyRaw
+            : undefined;
+        const allowScripts = Boolean(data['allow_scripts'] ?? data['allowScripts'] ?? false);
+        const allowNetwork = Boolean(data['allow_network'] ?? data['allowNetwork'] ?? false);
+        const skillsRaw = data['skills'];
+        const skills = Array.isArray(skillsRaw) && skillsRaw.every((s) => typeof s === 'string')
+            ? skillsRaw
+            : undefined;
+        const timeoutRaw = data['timeout_ms'] ?? data['timeoutMs'];
+        const timeoutMs = typeof timeoutRaw === 'number' && Number.isFinite(timeoutRaw) && timeoutRaw > 0
+            ? timeoutRaw
+            : undefined;
+        const scriptsRaw = data['scripts'];
+        const scripts = Array.isArray(scriptsRaw) && scriptsRaw.every((s) => typeof s === 'string')
+            ? scriptsRaw
+            : undefined;
+        const cacheableRaw = data['cacheable'];
+        const cacheable = typeof cacheableRaw === 'boolean' ? cacheableRaw : undefined;
+        const cacheTtlRaw = data['cache_ttl_ms'] ?? data['cacheTtlMs'];
+        const cacheTtlMs = typeof cacheTtlRaw === 'number' && Number.isFinite(cacheTtlRaw) && cacheTtlRaw > 0
+            ? cacheTtlRaw
+            : undefined;
+        const extra = {};
+        for (const [key, value] of Object.entries(data)) {
+            if (!CONSUMED_KEYS.has(key))
+                extra[key] = value;
+        }
+        const body = parsed.content.replace(/^\n+/, '');
+        const scriptsDir = await this.#scriptsDirDetector.detect(absolutePath);
+        return {
+            name,
+            description,
+            sourcePath: absolutePath,
+            folder: configuredFolder,
+            tags,
+            format,
+            strategy,
+            allowScripts,
+            allowNetwork,
+            skills,
+            timeoutMs,
+            scripts,
+            cacheable,
+            cacheTtlMs,
+            extra: Object.keys(extra).length > 0 ? extra : undefined,
+            body,
+            raw,
+            scriptsDir,
+        };
+    }
+}
+//# sourceMappingURL=frontmatter-parser.js.map

package/dist/parser/frontmatter-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-parser.js","sourceRoot":"","sources":["../../src/parser/frontmatter-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACnD,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc;IAChE,QAAQ,EAAE,YAAY,EAAE,WAAW;IACnC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY;CACrD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpF,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,GAAe,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,OAAO,iBAAiB;IACnB,SAAS,CAAiB;IAC1B,mBAAmB,CAAqB;IAEjD,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,cAAc,EAAE,CAAC;QAChE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,gBAAwB;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QAEpD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,YAAY,YAAY,6CAA6C,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,QAAQ,GACZ,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;YAChE,CAAC,CAAE,WAA4B;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,CAAC;QAErF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAE,SAAsB;YACzB,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GACb,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;YAC7E,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzE,CAAC,CAAE,UAAuB;YAC1B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,UAAU,GACd,OAAO,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC;YAChF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEvE,OAAO;YACL,IAAI;YACJ,WAAW;YACX,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,gBAAgB;YACxB,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,MAAM;YACN,SAAS;YACT,OAAO;YACP,SAAS;YACT,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACxD,IAAI;YACJ,GAAG;YACH,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}

package/dist/parser/index.d.ts

@@ -0,0 +1,4 @@
+export { FormatDetector } from './format-detector.js';
+export { FrontmatterParser } from './frontmatter-parser.js';
+export { FileScanner } from './file-scanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/parser/index.js

@@ -0,0 +1,4 @@
+export { FormatDetector } from './format-detector.js';
+export { FrontmatterParser } from './frontmatter-parser.js';
+export { FileScanner } from './file-scanner.js';
+//# sourceMappingURL=index.js.map

package/dist/parser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/parser/scripts-dir-detector.d.ts

@@ -0,0 +1,7 @@
+export interface ScriptsDirDetector {
+    detect(skillFilePath: string): Promise<string | undefined>;
+}
+export declare class FsScriptsDirDetector implements ScriptsDirDetector {
+    detect(skillFilePath: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=scripts-dir-detector.d.ts.map

package/dist/parser/scripts-dir-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts-dir-detector.d.ts","sourceRoot":"","sources":["../../src/parser/scripts-dir-detector.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC5D;AAED,qBAAa,oBAAqB,YAAW,kBAAkB;IACvD,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAUjE"}

package/dist/parser/scripts-dir-detector.js

@@ -0,0 +1,17 @@
+import { stat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export class FsScriptsDirDetector {
+    async detect(skillFilePath) {
+        const candidate = join(dirname(skillFilePath), 'scripts');
+        try {
+            const s = await stat(candidate);
+            if (s.isDirectory())
+                return candidate;
+            return undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=scripts-dir-detector.js.map

package/dist/parser/scripts-dir-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts-dir-detector.js","sourceRoot":"","sources":["../../src/parser/scripts-dir-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAM1C,MAAM,OAAO,oBAAoB;IAC/B,KAAK,CAAC,MAAM,CAAC,aAAqB;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAO,SAAS,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/security/blacklist-filter.d.ts

@@ -0,0 +1,32 @@
+import type { PatternScanner } from './pattern-scanner.js';
+import type { SkillContent } from '../core/types.js';
+export interface BlacklistFilterOptions {
+    /** Skill names that are always rejected (case-sensitive exact match). */
+    manualBlacklist?: readonly string[];
+    /** Pattern scanner used for auto-audit. When null/undefined, auto-audit is off. */
+    patternScanner?: PatternScanner | null;
+}
+export type FilterVerdict = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: 'manual';
+    pattern?: undefined;
+} | {
+    allowed: false;
+    reason: 'audit';
+    pattern: string;
+};
+export declare class BlacklistFilter {
+    #private;
+    constructor(opts?: BlacklistFilterOptions);
+    /** Replace the manual blacklist atomically. Normalizes input the same way
+     *  the constructor does (trim, drop empties, dedupe). */
+    setManualBlacklist(names: readonly string[]): void;
+    /** Returns the verdict for a parsed skill.
+     *  Manual blacklist checked first (cheap), then pattern audit (only if scanner present). */
+    evaluate(content: SkillContent): FilterVerdict;
+    /** True if neither layer is armed — useful for short-circuiting callers and tests. */
+    isNoop(): boolean;
+}
+//# sourceMappingURL=blacklist-filter.d.ts.map

package/dist/security/blacklist-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blacklist-filter.d.ts","sourceRoot":"","sources":["../../src/security/blacklist-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,mFAAmF;IACnF,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAMzD,qBAAa,eAAe;;gBAId,IAAI,CAAC,EAAE,sBAAsB;IAKzC;6DACyD;IACzD,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAIlD;gGAC4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa;IAe9C,sFAAsF;IACtF,MAAM,IAAI,OAAO;CAGlB"}

package/dist/security/blacklist-filter.js

@@ -0,0 +1,35 @@
+function normalizeNames(names) {
+    return new Set(names.map((s) => s.trim()).filter((s) => s.length > 0));
+}
+export class BlacklistFilter {
+    #blacklist;
+    #scanner;
+    constructor(opts) {
+        this.#blacklist = normalizeNames(opts?.manualBlacklist ?? []);
+        this.#scanner = opts?.patternScanner ?? null;
+    }
+    /** Replace the manual blacklist atomically. Normalizes input the same way
+     *  the constructor does (trim, drop empties, dedupe). */
+    setManualBlacklist(names) {
+        this.#blacklist = normalizeNames(names);
+    }
+    /** Returns the verdict for a parsed skill.
+     *  Manual blacklist checked first (cheap), then pattern audit (only if scanner present). */
+    evaluate(content) {
+        if (this.#blacklist.has(content.name)) {
+            return { allowed: false, reason: 'manual' };
+        }
+        if (this.#scanner !== null) {
+            const result = this.#scanner.scan(content.body);
+            if (!result.safe) {
+                return { allowed: false, reason: 'audit', pattern: result.matches[0].pattern };
+            }
+        }
+        return { allowed: true };
+    }
+    /** True if neither layer is armed — useful for short-circuiting callers and tests. */
+    isNoop() {
+        return this.#blacklist.size === 0 && this.#scanner === null;
+    }
+}
+//# sourceMappingURL=blacklist-filter.js.map

package/dist/security/blacklist-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blacklist-filter.js","sourceRoot":"","sources":["../../src/security/blacklist-filter.ts"],"names":[],"mappings":"AAeA,SAAS,cAAc,CAAC,KAAwB;IAC9C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,OAAO,eAAe;IAC1B,UAAU,CAAc;IACf,QAAQ,CAAwB;IAEzC,YAAY,IAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED;6DACyD;IACzD,kBAAkB,CAAC,KAAwB;QACzC,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;gGAC4F;IAC5F,QAAQ,CAAC,OAAqB;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,sFAAsF;IACtF,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC9D,CAAC;CACF"}

package/dist/security/index.d.ts

@@ -0,0 +1,5 @@
+export { PatternScanner } from './pattern-scanner.js';
+export type { ScanResult, PatternMatch, PatternScannerOptions } from './pattern-scanner.js';
+export { BlacklistFilter } from './blacklist-filter.js';
+export type { BlacklistFilterOptions, FilterVerdict } from './blacklist-filter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,3 @@
+export { PatternScanner } from './pattern-scanner.js';
+export { BlacklistFilter } from './blacklist-filter.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/security/pattern-scanner.d.ts

@@ -0,0 +1,27 @@
+export interface PatternMatch {
+    /** Regex source as supplied to the scanner (caller's original string). */
+    pattern: string;
+    /** Substring of input that matched. */
+    match: string;
+    /** Zero-based character offset of the match in the input. */
+    index: number;
+}
+export interface ScanResult {
+    /** true when zero patterns matched. */
+    safe: boolean;
+    /** All matches across all patterns, ordered by `index` ascending. */
+    matches: PatternMatch[];
+}
+export interface PatternScannerOptions {
+    /** Regex source strings. Each will be compiled once with the `g` flag for full-input scan. */
+    patterns: string[];
+    /** Compile flags appended to the default `g`. Defaults to `''` (case-sensitive). Pass `'i'` for case-insensitive. */
+    flags?: string;
+}
+export declare class PatternScanner {
+    #private;
+    constructor(opts: PatternScannerOptions);
+    scan(input: string): ScanResult;
+    getPatterns(): string[];
+}
+//# sourceMappingURL=pattern-scanner.d.ts.map

package/dist/security/pattern-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-scanner.d.ts","sourceRoot":"","sources":["../../src/security/pattern-scanner.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,IAAI,EAAE,OAAO,CAAC;IACd,qEAAqE;IACrE,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,qHAAqH;IACrH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,qBAAa,cAAc;;gBAGb,IAAI,EAAE,qBAAqB;IAyBvC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAoB/B,WAAW,IAAI,MAAM,EAAE;CAGxB"}

package/dist/security/pattern-scanner.js

@@ -0,0 +1,46 @@
+export class PatternScanner {
+    #compiled;
+    constructor(opts) {
+        const extraFlags = opts.flags ?? '';
+        const seen = new Set();
+        this.#compiled = [];
+        for (const source of opts.patterns) {
+            if (source === '') {
+                process.stderr.write(`[skillforge:pattern-scanner] invalid pattern "": empty pattern discarded\n`);
+                continue;
+            }
+            if (seen.has(source)) {
+                continue;
+            }
+            seen.add(source);
+            try {
+                const regex = new RegExp(source, 'g' + extraFlags);
+                this.#compiled.push({ source, regex });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[skillforge:pattern-scanner] invalid pattern "${source}": ${msg}\n`);
+            }
+        }
+    }
+    scan(input) {
+        const matches = [];
+        for (const { source, regex } of this.#compiled) {
+            regex.lastIndex = 0;
+            let m;
+            while ((m = regex.exec(input)) !== null) {
+                if (m[0].length === 0) {
+                    regex.lastIndex++;
+                    continue;
+                }
+                matches.push({ pattern: source, match: m[0], index: m.index });
+            }
+        }
+        matches.sort((a, b) => a.index - b.index);
+        return { safe: matches.length === 0, matches };
+    }
+    getPatterns() {
+        return this.#compiled.map((e) => e.source);
+    }
+}
+//# sourceMappingURL=pattern-scanner.js.map

package/dist/security/pattern-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-scanner.js","sourceRoot":"","sources":["../../src/security/pattern-scanner.ts"],"names":[],"mappings":"AA4BA,MAAM,OAAO,cAAc;IAChB,SAAS,CAAkB;IAEpC,YAAY,IAA2B;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QAEpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEjB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,SAAS,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF"}