@monoes/monomindcli 2.15.7 → 2.16.0

package/.claude/helpers/redact-secrets.cjs

@@ -0,0 +1,69 @@
+'use strict';
+/**
+ * Secret redaction for text that leaves the machine (jev-picker.cjs masks the
+ * task and candidate descriptions with it before a decision-model request).
+ */
+// Ported VERBATIM from packages/@monomind/cli/src/utils/redaction.ts SECRET_PATTERNS
+// (the maintained redactor: JSON keys, header bearer tokens, fine-grained GitHub,
+// GitLab, Slack, Stripe, JWT, credentialed URLs, AWS/Google keys, Basic auth,
+// env passwords). A test compares the two lists source-for-source, so an edit to
+// one without the other fails CI.
+var SECRET_PATTERNS = [
+  /(?:api[_-]?key|apikey)['"]?\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+  /(?:secret|password|passwd|pwd)['"]?\s*[:=]\s*['"]?[^\s'"]{8,}['"]?/gi,
+  /(?:token|bearer)['"]?\s*[:=]\s*['"]?[^\s'"]{10,}['"]?/gi,
+  /\bbearer\s+['"]?[^\s'"]{10,}['"]?/gi,
+  /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY(?: BLOCK)?-----(?:[^-]|-(?!----))*-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY(?: BLOCK)?-----/g,
+  /sk-ant-[a-zA-Z0-9_-]{20,}/g,
+  /sk-[a-zA-Z0-9_-]{20,}/g,
+  /gh[pousr]_[A-Za-z0-9]{20,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /glpat-[A-Za-z0-9_-]{16,}/g,
+  /xox[abprs]-[A-Za-z0-9-]{10,}/g,
+  /xapp-[A-Za-z0-9-]{10,}/g,
+  /hf_[A-Za-z0-9]{30,}/g,
+  /ya29\.[A-Za-z0-9_-]{20,}/g,
+  /[rs]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  /npm_[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /(?<![a-zA-Z0-9_-])eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g,
+  /[a-zA-Z][a-zA-Z0-9+.-]{0,31}:\/\/[^:\s]{1,256}:[^@\s]{1,256}@[^\s'"]+/g,
+  /aws_?secret_?access_?key['"]?\s*[:=]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/gi,
+  /AIza[0-9A-Za-z_-]{35}/g,
+  /\bauthorization['"]?\s*[:=]\s*['"]?basic\s+[A-Za-z0-9+/]+={0,2}/gi,
+  /\b(?:[A-Z0-9]+_)*(?:PASS|PASSWORD|PASSWD|PWD)\s*=\s*['"]?[^\s'"]+['"]?/g,
+];
+
+/** Mask credential-shaped text before it leaves the machine — same output as redaction.ts redactSecrets. */
+function redactSecrets(text) {
+  var out = String(text || '');
+  SECRET_PATTERNS.forEach(function (re) {
+    out = out.replace(re, '[redacted]');
+  });
+  return out;
+}
+
+// Text is cut to this before redaction, so the synchronous regex pass stays short;
+// the margin over the 8000-char Jev state keeps a secret straddling that final
+// cut (a PEM block is a few KB) whole.
+var REDACT_WINDOW_CHARS = 16000;
+
+/** redactSecrets over the first REDACT_WINDOW_CHARS of `text` only. */
+function redactHead(text) {
+  var s = String(text || '');
+  var head = s.slice(0, REDACT_WINDOW_CHARS);
+  if (s.length > REDACT_WINDOW_CHARS) {
+    // A secret cut at the window edge no longer matches its pattern, and earlier
+    // secrets shrinking to "[redacted]" pull it into the sent text: drop the cut
+    // token (a scan, not /\S+$/, which is quadratic) and a key block without a whole
+    // END line (a cut `-----END RSA ` does not close it).
+    var end = head.length;
+    while (end > 0 && !/\s/.test(head.charAt(end - 1))) end--;
+    head = head.slice(0, end);
+    var begin = head.lastIndexOf('-----BEGIN ');
+    if (begin !== -1 && !/-----END [^-\r\n]*-----/.test(head.slice(begin))) head = head.slice(0, begin);
+  }
+  return redactSecrets(head);
+}
+
+module.exports = { SECRET_PATTERNS: SECRET_PATTERNS, redactSecrets: redactSecrets, redactHead: redactHead };

package/.claude/skills/mastermind-agent-select/SKILL.md

@@ -22,6 +22,22 @@ Use this pattern whenever a mastermind skill needs to select specialist agents.
 
 REGISTRY="${REGISTRY:-.monomind/registry.json}"
 
+# 0. Decision model first. `monomind pick` asks Jev/OpenJev when configured
+#    (MONOMIND_JEV_URL, or TYPESAFE_API_KEY + MONOMIND_JEV_HOSTED=1) and
+#    otherwise ranks by keywords.
+# Local only — never npx (no registry egress). A globally installed monomind may
+# predate `pick`, so each candidate must prove it supports the command.
+mm() { for c in monomind ./node_modules/.bin/monomind; do
+         command -v "$c" >/dev/null 2>&1 || [ -x "$c" ] || continue
+         "$c" pick --help >/dev/null 2>&1 && { "$c" "$@"; return $?; }
+       done; return 127; }
+selected_agents=$(mm pick -t "$PROMPT" --agents --categories "$CATEGORIES" \
+  --top "$TOP_N" --json 2>/dev/null \
+  | jq -c '[.agents.ranked[] | {name: (.name // .id), slug: .id, category}]' 2>/dev/null)
+
+# Fallback when the CLI is unavailable: the registry keyword scorer below.
+if [ -z "$selected_agents" ] || [ "$selected_agents" = "[]" ]; then
+
 # 1. Extract candidates from the registry filtered by category
 candidates=$(jq -r \
   --arg cats "$CATEGORIES" \
@@ -58,6 +74,7 @@ selected_agents=$(echo "$candidates" | jq -Rs \
   .[0:$n] |
   map(.agent)
   ')
+fi
 
 echo "$selected_agents"
 ```
@@ -92,6 +109,16 @@ The output is a JSON array of `{name, slug, category}` objects. Use `.name` as t
 TASK_DESC="<one-line description of what this agent must do>"
 CATS="engineering development"
 
+# Local only — never npx (no registry egress). A globally installed monomind may
+# predate `pick`, so each candidate must prove it supports the command.
+mm() { for c in monomind ./node_modules/.bin/monomind; do
+         command -v "$c" >/dev/null 2>&1 || [ -x "$c" ] || continue
+         "$c" pick --help >/dev/null 2>&1 && { "$c" "$@"; return $?; }
+       done; return 127; }
+best_agent=$(mm pick -t "$TASK_DESC" --agents --categories "$CATS" --top 1 --json 2>/dev/null \
+  | jq -r '.agents.ranked[0].name // .agents.ranked[0].id // empty' 2>/dev/null)
+
+if [ -z "$best_agent" ]; then
 best_agent=$(jq -r \
   --arg cats "$CATS" \
   --arg task "$(echo "$TASK_DESC" | tr '[:upper:]' '[:lower:]')" \
@@ -104,6 +131,7 @@ best_agent=$(jq -r \
    | sort_by(-.score)
    | .[0].name // "coder"' \
   "$REGISTRY")
+fi
 ```
 
 ---

package/dist/src/catalog/blueprints.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+import type { OrgDef } from '../orgrt/types.js';
+export declare const BlueprintSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    archetype: z.ZodOptional<z.ZodString>;
+    skills: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    skill_pool: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    runtimeHints: z.ZodOptional<z.ZodObject<{
+        reasoning: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+        }>>;
+    }, z.core.$strict>>;
+    recommendedPolicy: z.ZodOptional<z.ZodObject<{
+        git: z.ZodOptional<z.ZodEnum<{
+            commit: "commit";
+            none: "none";
+            push: "push";
+            read: "read";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Blueprint = z.infer<typeof BlueprintSchema>;
+export interface ResolvedBlueprints {
+    def: OrgDef;
+    errors: string[];
+    notes: string[];
+}
+/**
+ * Fills each blueprint role's unset `skills` / `skill_pool` from its active
+ * `org` blueprint. Explicit role fields always win; blueprints never produce
+ * `policy` or `tool_providers` — their hints only become `notes`. Returns the
+ * input object itself when no role names a blueprint, and never writes the
+ * Org JSON. Skill names are left to the existing `validateRoleSkills`.
+ */
+export declare function resolveOrgDefBlueprints(def: OrgDef, root: string): ResolvedBlueprints;
+//# sourceMappingURL=blueprints.d.ts.map

package/dist/src/catalog/blueprints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprints.d.ts","sourceRoot":"","sources":["../../../src/catalog/blueprints.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKhD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAmBjB,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAcD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA6BrF"}

package/dist/src/catalog/blueprints.js

@@ -0,0 +1,78 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { verifyEntry } from './digest.js';
+import { buildSnapshot, eligible } from './snapshot.js';
+import { CATALOG_NAME_RE } from './types.js';
+export const BlueprintSchema = z
+    .object({
+    name: z.string().regex(CATALOG_NAME_RE),
+    description: z.string().min(1).max(500),
+    archetype: z.string().regex(CATALOG_NAME_RE).optional(),
+    skills: z.array(z.string().regex(CATALOG_NAME_RE)).max(20).default([]),
+    skill_pool: z
+        .array(z.string().regex(/^(tag:)?[a-z0-9][a-z0-9-]{0,63}$/))
+        .max(50)
+        .default([]),
+    runtimeHints: z
+        .object({ reasoning: z.enum(['low', 'medium', 'high']).optional() })
+        .strict()
+        .optional(),
+    recommendedPolicy: z
+        .object({ git: z.enum(['none', 'read', 'commit', 'push']).optional() })
+        .strict()
+        .optional(),
+})
+    .strict();
+/** Active `org` blueprint by name, parsed from its verified package. */
+function loadBlueprint(root, name) {
+    const asset = eligible(buildSnapshot(root), 'org').find((a) => a.kind === 'blueprint' && a.name === name);
+    if (!asset?.dir)
+        return undefined;
+    // The snapshot may be cached; the bytes read below must still match the digest.
+    const check = verifyEntry(root, asset);
+    if (!check.ok)
+        throw new Error(`package ${check.reason}`);
+    return BlueprintSchema.parse(JSON.parse(readFileSync(join(check.dir, 'blueprint.json'), 'utf8')));
+}
+/**
+ * Fills each blueprint role's unset `skills` / `skill_pool` from its active
+ * `org` blueprint. Explicit role fields always win; blueprints never produce
+ * `policy` or `tool_providers` — their hints only become `notes`. Returns the
+ * input object itself when no role names a blueprint, and never writes the
+ * Org JSON. Skill names are left to the existing `validateRoleSkills`.
+ */
+export function resolveOrgDefBlueprints(def, root) {
+    if (!def.roles.some((r) => r.blueprint !== undefined))
+        return { def, errors: [], notes: [] };
+    const errors = [];
+    const notes = [];
+    const roles = def.roles.map((role) => {
+        if (role.blueprint === undefined)
+            return role;
+        const label = `role "${role.id}": blueprint "${role.blueprint}"`;
+        let bp;
+        try {
+            bp = loadBlueprint(root, role.blueprint);
+        }
+        catch (e) {
+            errors.push(`${label} is invalid: ${e.message}`);
+            return role;
+        }
+        if (!bp) {
+            errors.push(`${label} is not active for org on this machine`);
+            return role;
+        }
+        if (bp.runtimeHints?.reasoning)
+            notes.push(`${label} suggests reasoning "${bp.runtimeHints.reasoning}" (not applied)`);
+        if (bp.recommendedPolicy?.git)
+            notes.push(`${label} recommends policy.git "${bp.recommendedPolicy.git}" (not applied)`);
+        return {
+            ...role,
+            skills: role.skills ?? [...(bp.archetype ? [bp.archetype] : []), ...bp.skills],
+            skill_pool: role.skill_pool ?? bp.skill_pool,
+        };
+    });
+    return { def: { ...def, roles }, errors, notes };
+}
+//# sourceMappingURL=blueprints.js.map

package/dist/src/catalog/blueprints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprints.js","sourceRoot":"","sources":["../../../src/catalog/blueprints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;SAC3D,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACnE,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACtE,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAUZ,wEAAwE;AACxE,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CACjD,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,GAAG;QAAE,OAAO,SAAS,CAAC;IAClC,gFAAgF;IAChF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,IAAY;IAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,EAAE,iBAAiB,IAAI,CAAC,SAAS,GAAG,CAAC;QACjE,IAAI,EAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAiB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,EAAE,CAAC,YAAY,CAAC,SAAS,iBAAiB,CAAC,CAAC;QACzF,IAAI,EAAE,CAAC,iBAAiB,EAAE,GAAG;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,EAAE,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,CAAC;QAC3F,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;YAC9E,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU;SAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC"}

package/dist/src/catalog/digest.d.ts

@@ -0,0 +1,16 @@
+import type { CatalogEntry } from './types.js';
+export declare const catalogDir: (root: string) => string;
+export declare const packagesDir: (root: string) => string;
+/** sha256 over (u32 pathLen, path, u64 byteLen, bytes) for every file, paths sorted by code unit. */
+export declare function packageDigest(dir: string): string;
+/** `<packages>/<name>/<sha12>`, proven to stay inside the store after realpath. */
+export declare function resolvePackageDir(root: string, entry: Pick<CatalogEntry, 'id' | 'sha256'>): string;
+export type DigestCheck = {
+    ok: true;
+    dir: string;
+} | {
+    ok: false;
+    reason: 'missing-package' | 'digest-mismatch' | 'escaping-path';
+};
+export declare function verifyEntry(root: string, entry: Pick<CatalogEntry, 'id' | 'sha256'>): DigestCheck;
+//# sourceMappingURL=digest.d.ts.map

package/dist/src/catalog/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../../src/catalog/digest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,MAA4C,CAAC;AACvF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAA4C,CAAC;AAaxF,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWjD;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,QAAQ,CAAC,GACzC,MAAM,CAQR;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,CAAA;CAAE,CAAC;AAEnF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG,WAAW,CAiBjG"}

package/dist/src/catalog/digest.js

@@ -0,0 +1,62 @@
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+export const catalogDir = (root) => join(root, '.monomind', 'catalog');
+export const packagesDir = (root) => join(catalogDir(root), 'packages');
+function files(dir, prefix = '') {
+    const out = [];
+    for (const e of readdirSync(join(dir, prefix), { withFileTypes: true })) {
+        const rel = prefix ? `${prefix}/${e.name}` : e.name;
+        if (e.isSymbolicLink())
+            throw new Error(`symlink in package: ${rel}`);
+        if (e.isDirectory())
+            out.push(...files(dir, rel));
+        else if (e.isFile())
+            out.push(rel);
+    }
+    return out;
+}
+/** sha256 over (u32 pathLen, path, u64 byteLen, bytes) for every file, paths sorted by code unit. */
+export function packageDigest(dir) {
+    const h = createHash('sha256');
+    for (const rel of files(dir).sort()) {
+        const bytes = readFileSync(join(dir, rel));
+        const p = Buffer.from(rel, 'utf8');
+        const lens = Buffer.alloc(12);
+        lens.writeUInt32BE(p.length, 0);
+        lens.writeBigUInt64BE(BigInt(bytes.length), 4);
+        h.update(lens.subarray(0, 4)).update(p).update(lens.subarray(4)).update(bytes);
+    }
+    return h.digest('hex');
+}
+/** `<packages>/<name>/<sha12>`, proven to stay inside the store after realpath. */
+export function resolvePackageDir(root, entry) {
+    const store = realpathSync(packagesDir(root));
+    const name = entry.id.split(':')[1] ?? '';
+    const dir = realpathSync(join(store, name, entry.sha256.slice(0, 12)));
+    const rel = relative(store, dir);
+    if (rel.startsWith('..') || rel.includes(`..${sep}`) || lstatSync(dir).isSymbolicLink())
+        throw new Error(`package path escapes the store: ${entry.id}`);
+    return dir;
+}
+export function verifyEntry(root, entry) {
+    let dir;
+    try {
+        dir = resolvePackageDir(root, entry);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            reason: String(e).includes('escapes') ? 'escaping-path' : 'missing-package',
+        };
+    }
+    try {
+        return packageDigest(dir) === entry.sha256
+            ? { ok: true, dir }
+            : { ok: false, reason: 'digest-mismatch' };
+    }
+    catch {
+        return { ok: false, reason: 'digest-mismatch' };
+    }
+}
+//# sourceMappingURL=digest.js.map

package/dist/src/catalog/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../../src/catalog/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGhD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AAExF,SAAS,KAAK,CAAC,GAAW,EAAE,MAAM,GAAG,EAAE;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aAC7C,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,KAA0C;IAE1C,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;QACrF,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAA0C;IAClF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB;SAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM;YACxC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/src/catalog/frontmatter.d.ts

@@ -0,0 +1,23 @@
+/** The only top-level frontmatter keys a catalog SKILL.md may carry. */
+export declare const ALLOWED_FRONTMATTER_KEYS: readonly ['name', 'description', 'tags', 'tools', 'license'];
+/**
+ * Problems that keep `text` from being a canonical catalog SKILL.md: no
+ * frontmatter, a key outside the allow-list, any line that is not a
+ * single-line `key: value` (indented, flow-mapping, anchor, alias, tag or
+ * block-scalar forms, or a value holding a U+2028/U+2029), or a `---`
+ * anywhere in a line — Claude Code ends the frontmatter at the first `---`,
+ * even mid-value, and would read the rest as body. Staging refuses what
+ * `sanitizeFrontmatter` produces unless this is empty.
+ */
+export declare function frontmatterViolations(text: string): string[];
+/**
+ * Rewrites the frontmatter of `text` to the allow-listed keys, one line each
+ * (strings JSON-quoted, lists as JSON arrays of plain tokens), keeping the
+ * body byte-for-byte. `removed` names the dropped keys. Text without
+ * frontmatter is returned unchanged (inspection then refuses it).
+ */
+export declare function sanitizeFrontmatter(text: string): {
+    text: string;
+    removed: string[];
+};
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/src/catalog/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../../src/catalog/frontmatter.ts"],"names":[],"mappings":"AAQA,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,YACnC,MAAM,EACN,aAAa,EACb,MAAM,EACN,OAAO,EACP,SAAS,CACD,CAAC;AAOX;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAc5D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBrF"}

package/dist/src/catalog/frontmatter.js

@@ -0,0 +1,80 @@
+/**
+ * SKILL.md frontmatter allow-list. Platforms read execution config from the
+ * frontmatter (`hooks`, `allowed-tools`, `model`, `context`, `agent`, …), so
+ * staging rewrites it to the keys below before the package is hashed, and
+ * projection re-checks the stored bytes with `frontmatterViolations`.
+ */
+import { parseFrontmatter } from '../orgrt/skill-library.js';
+/** The only top-level frontmatter keys a catalog SKILL.md may carry. */
+export const ALLOWED_FRONTMATTER_KEYS = [
+    'name',
+    'description',
+    'tags',
+    'tools',
+    'license',
+];
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+const LIST_ITEM_RE = /^[A-Za-z0-9_.:/-]+$/;
+const PLAIN_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+const ALLOWED = ALLOWED_FRONTMATTER_KEYS;
+/**
+ * Problems that keep `text` from being a canonical catalog SKILL.md: no
+ * frontmatter, a key outside the allow-list, any line that is not a
+ * single-line `key: value` (indented, flow-mapping, anchor, alias, tag or
+ * block-scalar forms, or a value holding a U+2028/U+2029), or a `---`
+ * anywhere in a line — Claude Code ends the frontmatter at the first `---`,
+ * even mid-value, and would read the rest as body. Staging refuses what
+ * `sanitizeFrontmatter` produces unless this is empty.
+ */
+export function frontmatterViolations(text) {
+    const m = FRONTMATTER_RE.exec(text);
+    if (!m)
+        return ['SKILL.md has no frontmatter'];
+    const out = [];
+    m[1].split(/\r?\n/).forEach((line, i) => {
+        if (line.trim() === '')
+            return;
+        if (line.includes('---'))
+            return void out.push(`frontmatter line ${i + 1} contains "---"`);
+        const kv = /^([A-Za-z_][\w-]*):(?: (.*))?$/.exec(line);
+        if (!kv)
+            out.push(`frontmatter line ${i + 1} is not a single-line key: value`);
+        else if (!ALLOWED.includes(kv[1]))
+            out.push(`frontmatter key "${kv[1]}" is not allowed`);
+        else if (/^[{&*!|>]/.test(kv[2] ?? ''))
+            out.push(`frontmatter key "${kv[1]}" has a non-scalar value`);
+    });
+    return out;
+}
+/**
+ * Rewrites the frontmatter of `text` to the allow-listed keys, one line each
+ * (strings JSON-quoted, lists as JSON arrays of plain tokens), keeping the
+ * body byte-for-byte. `removed` names the dropped keys. Text without
+ * frontmatter is returned unchanged (inspection then refuses it).
+ */
+export function sanitizeFrontmatter(text) {
+    const m = FRONTMATTER_RE.exec(text);
+    if (!m)
+        return { text, removed: [] };
+    const { data, body } = parseFrontmatter(text);
+    const topLevel = m[1].split(/\r?\n/).filter((l) => /^[^\s#]/.test(l));
+    const keys = topLevel.map((l) => l.split(':')[0].trim().slice(0, 40));
+    const removed = [...new Set(keys.filter((k) => !ALLOWED.includes(k)))];
+    const q = JSON.stringify;
+    const str = (v) => (Array.isArray(v) ? v.join(' ') : v);
+    const list = (v) => (Array.isArray(v) ? v : v.split(/[,\s]+/)).filter((s) => LIST_ITEM_RE.test(s));
+    const lines = [];
+    for (const key of ALLOWED_FRONTMATTER_KEYS) {
+        const v = data[key];
+        if (v === undefined)
+            continue;
+        if (key === 'tags' || key === 'tools')
+            lines.push(`${key}: ${q(list(v))}`);
+        else if (key === 'name' && typeof v === 'string' && PLAIN_NAME_RE.test(v))
+            lines.push(`name: ${v}`);
+        else
+            lines.push(`${key}: ${q(str(v))}`);
+    }
+    return { text: ['---', ...lines, '---', ''].join('\n') + body, removed };
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/src/catalog/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../../src/catalog/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,OAAO,GAAsB,wBAAwB,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;aAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;aACpF,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,EAAE,CACpC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACtE,IAAI,GAAG,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC"}

package/dist/src/catalog/lifecycle.d.ts

@@ -0,0 +1,31 @@
+import { type CatalogEntry, type CatalogStatus } from './types.js';
+export interface LifecycleOptions {
+    /** Self-asserted provenance, recorded in history. */
+    actor: string;
+    reason?: string;
+    now?: string;
+}
+export interface ApproveOptions extends LifecycleOptions {
+    targets: string[];
+    /** Tools to grant; must be requested by the skill and in CATALOG_GRANTABLE_TOOLS. */
+    grant?: string[];
+    replacesLegacy?: boolean;
+}
+export interface LifecycleResult {
+    id: string;
+    before: CatalogStatus;
+    after: CatalogStatus;
+    entry: CatalogEntry;
+}
+/** staged → approved, recording targets, grants and legacy replacement. */
+export declare function approve(root: string, id: string, opts: ApproveOptions): LifecycleResult;
+/** approved or disabled → active; the package digest must verify. */
+export declare const activate: (root: string, id: string, opts: LifecycleOptions) => LifecycleResult;
+export declare const disable: (root: string, id: string, opts: LifecycleOptions) => LifecycleResult;
+/** staged, active or disabled → quarantined; needs a reason. */
+export declare const quarantine: (root: string, id: string, opts: LifecycleOptions) => LifecycleResult;
+/** quarantined → staged; needs a reason and records `inspection.override`. */
+export declare const release: (root: string, id: string, opts: LifecycleOptions) => LifecycleResult;
+/** Any status but revoked → revoked (terminal); needs a reason. */
+export declare const revoke: (root: string, id: string, opts: LifecycleOptions) => LifecycleResult;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/src/catalog/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/catalog/lifecycle.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;CACrB;AA4DD,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,eAAe,CAcvF;AAED,qEAAqE;AACrE,eAAO,MAAM,QAAQ,SAAU,MAAM,MAAM,MAAM,QAAQ,gBAAgB,KAAG,eAC5C,CAAC;AAEjC,eAAO,MAAM,OAAO,SAAU,MAAM,MAAM,MAAM,QAAQ,gBAAgB,KAAG,eACzC,CAAC;AAEnC,gEAAgE;AAChE,eAAO,MAAM,UAAU,SAAU,MAAM,MAAM,MAAM,QAAQ,gBAAgB,KAAG,eACzC,CAAC;AAEtC,8EAA8E;AAC9E,eAAO,MAAM,OAAO,SAAU,MAAM,MAAM,MAAM,QAAQ,gBAAgB,KAAG,eAC3C,CAAC;AAEjC,mEAAmE;AACnE,eAAO,MAAM,MAAM,SAAU,MAAM,MAAM,MAAM,QAAQ,gBAAgB,KAAG,eACzC,CAAC"}

package/dist/src/catalog/lifecycle.js

@@ -0,0 +1,78 @@
+/**
+ * The mutating lifecycle verbs behind `monomind catalog approve|activate|
+ * disable|quarantine|release|revoke`. Each runs one `transition` under the
+ * catalog lock; `approve` also records targets and tool grants.
+ */
+import { CatalogStateError, mutateCatalogState, transition } from './state.js';
+import { CATALOG_GRANTABLE_TOOLS, CatalogTargetSchema, } from './types.js';
+const GRANTABLE = CATALOG_GRANTABLE_TOOLS;
+function move(root, id, to, opts, prepare) {
+    let before;
+    let entry;
+    const now = opts.now ?? new Date().toISOString();
+    mutateCatalogState(root, (state) => {
+        const cur = state.entries.find((e) => e.id === id);
+        if (!cur)
+            throw new CatalogStateError(`no catalog entry ${id}`);
+        before = cur.status;
+        const prepared = prepare ? prepare(cur) : cur;
+        const staged = { ...state, entries: state.entries.map((e) => (e.id === id ? prepared : e)) };
+        const next = transition(staged, id, to, { actor: opts.actor, now, reason: opts.reason, root });
+        entry = next.entries.find((e) => e.id === id);
+        return next;
+    });
+    return { id, before: before, after: to, entry: entry };
+}
+function checkTargets(raw, kind) {
+    if (raw.length === 0)
+        throw new CatalogStateError('approve needs at least one --target');
+    const targets = raw.map((t) => {
+        const p = CatalogTargetSchema.safeParse(t);
+        if (!p.success)
+            throw new CatalogStateError(`unknown target "${t}" — use ${CatalogTargetSchema.options.join(', ')}`);
+        return p.data;
+    });
+    if (new Set(targets).size !== targets.length)
+        throw new CatalogStateError('duplicate --target');
+    if (targets.includes('jev') && !targets.includes('org'))
+        throw new CatalogStateError('the jev target requires the org target');
+    const platform = targets.find((t) => t.startsWith('platform:'));
+    if (platform && kind !== 'skill')
+        throw new CatalogStateError(`only skills can be projected; ${kind} cannot target ${platform}`);
+    return targets;
+}
+function checkGrants(e, grant) {
+    if (grant.length && e.kind !== 'skill')
+        throw new CatalogStateError('only skills take tool grants');
+    for (const t of grant) {
+        if (!GRANTABLE.includes(t))
+            throw new CatalogStateError(`"${t}" is not grantable — grantable tools: ${CATALOG_GRANTABLE_TOOLS.join(', ')}`);
+        if (!e.inspection.requestedTools.includes(t))
+            throw new CatalogStateError(`"${t}" is not requested by ${e.id}`);
+    }
+    return [...new Set(grant)].sort();
+}
+/** staged → approved, recording targets, grants and legacy replacement. */
+export function approve(root, id, opts) {
+    return move(root, id, 'approved', opts, (e) => {
+        const targets = checkTargets(opts.targets, e.kind);
+        if (e.inspection.verdict === 'quarantine' && !e.inspection.override)
+            throw new CatalogStateError(`${id} has a quarantine inspection verdict; release it first (catalog release)`);
+        return {
+            ...e,
+            targets,
+            grantedTools: checkGrants(e, opts.grant ?? []),
+            replacesLegacy: opts.replacesLegacy === true,
+        };
+    });
+}
+/** approved or disabled → active; the package digest must verify. */
+export const activate = (root, id, opts) => move(root, id, 'active', opts);
+export const disable = (root, id, opts) => move(root, id, 'disabled', opts);
+/** staged, active or disabled → quarantined; needs a reason. */
+export const quarantine = (root, id, opts) => move(root, id, 'quarantined', opts);
+/** quarantined → staged; needs a reason and records `inspection.override`. */
+export const release = (root, id, opts) => move(root, id, 'staged', opts);
+/** Any status but revoked → revoked (terminal); needs a reason. */
+export const revoke = (root, id, opts) => move(root, id, 'revoked', opts);
+//# sourceMappingURL=lifecycle.js.map

package/dist/src/catalog/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/catalog/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,uBAAuB,EAIvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAuBpB,MAAM,SAAS,GAAsB,uBAAuB,CAAC;AAE7D,SAAS,IAAI,CACX,IAAY,EACZ,EAAU,EACV,EAAiB,EACjB,IAAsB,EACtB,OAA2C;IAE3C,IAAI,MAAiC,CAAC;IACtC,IAAI,KAA+B,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,kBAAkB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAuB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAqB,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,IAA0B;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,OAAO;YACZ,MAAM,IAAI,iBAAiB,CACzB,mBAAmB,CAAC,WAAW,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxE,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,IAAI,IAAI,KAAK,OAAO;QAC9B,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,IAAI,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,CAAe,EAAE,KAAe;IACnD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QACpC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,iBAAiB,CACzB,IAAI,CAAC,yCAAyC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAkC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,IAAoB;IACpE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ;YACjE,MAAM,IAAI,iBAAiB,CACzB,GAAG,EAAE,0EAA0E,CAChF,CAAC;QACJ,OAAO;YACL,GAAG,CAAC;YACJ,OAAO;YACP,YAAY,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;SAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAsB,EAAmB,EAAE,CAC5F,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAEjC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAsB,EAAmB,EAAE,CAC3F,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAEnC,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAsB,EAAmB,EAAE,CAC9F,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;AAEtC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAsB,EAAmB,EAAE,CAC3F,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAEjC,mEAAmE;AACnE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,IAAsB,EAAmB,EAAE,CAC1F,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC"}