@open-agent-toolkit/cli 0.2.66 → 0.2.68

package/dist/fs/assets.d.ts

@@ -12,6 +12,17 @@
  * caller has to satisfy.
  */
 export type AssetsRootSource = 'packaged' | 'override';
+/**
+ * Top-level directories `packages/cli/scripts/bundle-assets.sh` creates for
+ * every bundle, listed in the order that script creates them. The producer
+ * makes all of them unconditionally — even when a category has no entries — so
+ * their presence is the cheapest structural contract that tells a complete
+ * bundle apart from a metadata-only or truncated one.
+ *
+ * This is deliberately a shape check and nothing more: no per-file manifest,
+ * no checksums, and no walk of the bundled documents.
+ */
+export declare const REQUIRED_BUNDLE_DIRECTORIES: readonly ['skills', 'agents', 'templates', 'scripts', 'docs', 'migration', 'config'];
 /**
  * Fail closed on any bundle a consumer must not read as a legitimate install.
  *

package/dist/fs/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/fs/assets.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AA4IvD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,eAAe,SAAc,EAC7B,MAAM,GAAE,gBAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAsCf;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/fs/assets.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AA0CvD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,YACtC,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,SAAS,EACT,MAAM,EACN,WAAW,EACX,QAAQ,CACA,CAAC;AAgFX;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,eAAe,SAAc,EAC7B,MAAM,GAAE,gBAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAsCf;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/fs/assets.js

@@ -45,7 +45,7 @@ function assetsRemedy(source, packagedRemedy = PACKAGED_BUNDLE_REMEDY) {
  * This is deliberately a shape check and nothing more: no per-file manifest,
  * no checksums, and no walk of the bundled documents.
  */
-const REQUIRED_BUNDLE_DIRECTORIES = [
+export const REQUIRED_BUNDLE_DIRECTORIES = [
     'skills',
     'agents',
     'templates',

package/dist/manifest/hash.d.ts

@@ -1,5 +1,115 @@
+import { type Hash } from 'node:crypto';
 export declare function computeStringHash(content: string): string;
 export declare function computeFileHash(filePath: string): Promise<string>;
 export declare function computeContentHash(contentPath: string, isFile: boolean): Promise<string>;
+/**
+ * The digests of a directory tree: the sorted `(relativePath, content)` list of
+ * every regular file under it, hashed with SHA-256.
+ *
+ * ## Length framing (wave-7 final review, Critical 4)
+ *
+ * `framed` is the digest every caller compares. The stream opens with a fixed
+ * domain tag and then, for every file in order, each field carries its own byte
+ * length ahead of its bytes — `<byteLength> NUL <bytes>` for the relative path,
+ * then the same for the content. That makes the stream a self-delimiting
+ * encoding of the sorted file list, so two distinct file lists cannot produce
+ * the same stream. Files are ordered by their UTF-8 path bytes rather than by
+ * `localeCompare`, which is not a total order (distinct Unicode spellings can
+ * compare equal) and would otherwise leave the digest dependent on directory
+ * enumeration order and the host's ICU data.
+ *
+ * `legacy` is the digest this module produced before that change: a bare
+ * `relPath NUL content NUL …` stream, ordered by `localeCompare`. A relative
+ * path cannot contain NUL but file *content* can, so the stream did not
+ * determine the file set. The review's witness:
+ * `{references/p.md: "P", references/q.md: "Q"}` and the
+ * single file `{references/p.md: "P\0references/q.md\0Q"}` both hashed to
+ * `2bb17da7d373d82dd09024613a5bc31764837c2590441dfbc0eda55d3bcd283c`. A forged
+ * provider view could therefore delete `SKILL.md`, fuse its bytes into a
+ * surviving file, and still reproduce the canonical digest — reading `in_sync`
+ * with `oat sync` planning `skip`, permanently healthy-looking and
+ * unrepairable.
+ *
+ * The domain tag is what keeps the two encodings apart, and it is load-bearing
+ * rather than decorative. A recorded `contentHash` carries no version, so a
+ * legacy value is compared against framed values — including by the raw fast
+ * path in `drift/detector.ts` that runs before any marker or sentinel check.
+ * Without separation those namespaces overlap: the canonical tree
+ * `{"8": "SKILL.md26\0# evil\n", "SKILL.md": "# skill\n"}` and the single-file
+ * provider tree `{"SKILL.md": "# evil\n\0SKILL.md\0# skill\n\0"}` emit the
+ * identical byte string under the legacy and framed encoders respectively
+ * (`1b83055cfb0680a8f70cdb66ba4902a6a48627f5584b0ae3bbebf9fc44830b70`), so an
+ * undecorated forged view would have been accepted. The tag opens the framed
+ * stream with a NUL byte; a legacy stream opens with a relative path and paths
+ * cannot contain NUL, so the two encoders' input spaces are disjoint and no
+ * framed digest equals a legacy digest under SHA-256 collision resistance —
+ * the same assumption every other comparison here already rests on.
+ *
+ * `legacy` is retained for exactly one purpose: `drift/detector.ts` uses it to
+ * recognize a manifest written before the framing change and re-decide with
+ * `framed`. It is never an acceptance basis for provider content on its own.
+ * The migration is needed because framing changes every recorded
+ * `contentHash`, and `oat sync` plans `skip` for a faithful tree while
+ * `ensureSkipEntryManaged` (`engine/execute-plan.ts`) does not restamp an entry
+ * it already owns — so a legacy value is never rewritten by a no-op sync.
+ * Measured on the built CLI: a directory-copy entry whose `contentHash` no
+ * longer matches reports `drifted/modified` from `oat status`, `oat sync`
+ * answers `skip` / "already in sync", and the manifest keeps the old value.
+ *
+ * ## Bounds this digest still does not cover
+ *
+ * Both recorded rather than closed (wave-7 final review, Important 5, and
+ * `BL-260909-use-handle-bound-traversal`): file mode bits and empty
+ * directories. A provider view differing from canonical only in those respects
+ * still digests equal. Framing addresses file-set ambiguity, not the set of
+ * attributes hashed.
+ */
+export interface DirectoryDigests {
+    framed: string;
+    legacy: string;
+}
+/**
+ * Opens a framed directory digest with the domain tag.
+ *
+ * Exported alongside `compareDirectoryRelativePaths` and
+ * `updateFramedDirectoryDigest` so `engine/managed-copy-hash.ts` shares this
+ * exact encoding rather than mirroring it. The three must agree byte for byte:
+ * a faithful managed copy has to reproduce the canonical `framed` digest that
+ * `engine/execute-plan.ts` records as the manifest `contentHash`, and
+ * `managed-copy-hash.test.ts` pins that equality.
+ */
+export declare function createFramedDirectoryDigest(): Hash;
+/** Total order over distinct relative paths, by UTF-8 bytes. */
+export declare function compareDirectoryRelativePaths(left: string, right: string): number;
+/**
+ * Contributes one file to a framed directory digest.
+ */
+export declare function updateFramedDirectoryDigest(hash: Hash, relativePath: string, content: Buffer): void;
+/**
+ * Both digests of a directory tree, derived from one traversal that reads each
+ * file exactly once.
+ *
+ * The single capture is load-bearing, not an optimization. Computing the two
+ * encodings from two separate traversals would let the canonical tree change
+ * between them, so the pre-framing bridge in `drift/detector.ts` could pair
+ * `framed` from one canonical state with `legacy` from another and accept a
+ * provider view that the pre-framing detector rejected. Both digests must
+ * describe the same captured file set. The residual per-file race — the tree
+ * mutating partway through a single traversal — is the pre-existing bound
+ * every filesystem reader in this package shares, recorded on
+ * `BL-260909-use-handle-bound-traversal`.
+ *
+ * Only the bridge needs `legacy`, and it asks only after a comparison has
+ * already failed, so buffering the tree here does not touch the hot path:
+ * `computeDirectoryHash` still streams file by file.
+ */
+export declare function computeDirectoryDigests(dirPath: string): Promise<DirectoryDigests>;
+/**
+ * The framed digest of a directory tree.
+ *
+ * Streams file by file rather than capturing the tree, because this is the
+ * digest every ordinary caller computes. `hash.test.ts` pins that it agrees
+ * with `computeDirectoryDigests(...).framed`.
+ */
 export declare function computeDirectoryHash(dirPath: string): Promise<string>;
 //# sourceMappingURL=hash.d.ts.map

package/dist/manifest/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/manifest/hash.ts"],"names":[],"mappings":"AAMA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAqBD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBvE;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/manifest/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAMpD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAqBD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBvE;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CAIjB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD;AAED,gEAAgE;AAChE,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,IAAI,CAMN;AAgFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB3E"}

package/dist/manifest/hash.js

@@ -42,7 +42,43 @@ export async function computeContentHash(contentPath, isFile) {
         ? computeFileHash(contentPath)
         : computeDirectoryHash(contentPath);
 }
-export async function computeDirectoryHash(dirPath) {
+const FRAMED_DIRECTORY_DIGEST_DOMAIN = '\0oat-directory-digest-v2\0';
+/**
+ * Opens a framed directory digest with the domain tag.
+ *
+ * Exported alongside `compareDirectoryRelativePaths` and
+ * `updateFramedDirectoryDigest` so `engine/managed-copy-hash.ts` shares this
+ * exact encoding rather than mirroring it. The three must agree byte for byte:
+ * a faithful managed copy has to reproduce the canonical `framed` digest that
+ * `engine/execute-plan.ts` records as the manifest `contentHash`, and
+ * `managed-copy-hash.test.ts` pins that equality.
+ */
+export function createFramedDirectoryDigest() {
+    const hash = createHash('sha256');
+    hash.update(FRAMED_DIRECTORY_DIGEST_DOMAIN);
+    return hash;
+}
+/** Total order over distinct relative paths, by UTF-8 bytes. */
+export function compareDirectoryRelativePaths(left, right) {
+    return Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}
+/**
+ * Contributes one file to a framed directory digest.
+ */
+export function updateFramedDirectoryDigest(hash, relativePath, content) {
+    const pathBytes = Buffer.from(relativePath, 'utf8');
+    hash.update(`${pathBytes.length}\0`);
+    hash.update(pathBytes);
+    hash.update(`${content.length}\0`);
+    hash.update(content);
+}
+function updateLegacyDirectoryDigest(hash, relativePath, content) {
+    hash.update(relativePath);
+    hash.update('\0');
+    hash.update(content);
+    hash.update('\0');
+}
+async function collectDirectoryFiles(dirPath) {
     const root = resolve(dirPath);
     const files = [];
     try {
@@ -57,19 +93,81 @@ export async function computeDirectoryHash(dirPath) {
         }
         throw new CliError(`Failed to compute hash for ${dirPath}: ${error instanceof Error ? error.message : 'unknown error'}`, 2);
     }
-    files.sort((left, right) => {
-        const leftRelative = relative(root, left);
-        const rightRelative = relative(root, right);
-        return leftRelative.localeCompare(rightRelative);
-    });
-    const hash = createHash('sha256');
+    return files;
+}
+/**
+ * Orders a captured file list for one encoding and folds it into a digest.
+ *
+ * Each encoding keeps its own ordering: the legacy digest has to stay
+ * byte-reproducible to remain recognizable, while the framed digest wants a
+ * total order, which `localeCompare` does not provide (distinct Unicode
+ * spellings can compare equal, leaving the result dependent on directory
+ * enumeration order and the host's ICU data).
+ */
+function digestDirectoryRecords(records, encoding) {
+    const ordered = [...records].sort(encoding === 'framed'
+        ? (left, right) => compareDirectoryRelativePaths(left.relativePath, right.relativePath)
+        : (left, right) => left.relativePath.localeCompare(right.relativePath));
+    const hash = encoding === 'framed'
+        ? createFramedDirectoryDigest()
+        : createHash('sha256');
+    for (const record of ordered) {
+        if (encoding === 'framed') {
+            updateFramedDirectoryDigest(hash, record.relativePath, record.content);
+        }
+        else {
+            updateLegacyDirectoryDigest(hash, record.relativePath, record.content);
+        }
+    }
+    return hash.digest('hex');
+}
+/**
+ * Both digests of a directory tree, derived from one traversal that reads each
+ * file exactly once.
+ *
+ * The single capture is load-bearing, not an optimization. Computing the two
+ * encodings from two separate traversals would let the canonical tree change
+ * between them, so the pre-framing bridge in `drift/detector.ts` could pair
+ * `framed` from one canonical state with `legacy` from another and accept a
+ * provider view that the pre-framing detector rejected. Both digests must
+ * describe the same captured file set. The residual per-file race — the tree
+ * mutating partway through a single traversal — is the pre-existing bound
+ * every filesystem reader in this package shares, recorded on
+ * `BL-260909-use-handle-bound-traversal`.
+ *
+ * Only the bridge needs `legacy`, and it asks only after a comparison has
+ * already failed, so buffering the tree here does not touch the hot path:
+ * `computeDirectoryHash` still streams file by file.
+ */
+export async function computeDirectoryDigests(dirPath) {
+    const root = resolve(dirPath);
+    const files = await collectDirectoryFiles(dirPath);
+    const records = [];
     for (const file of files) {
-        const relativePath = relative(root, file);
-        const content = await readFile(file);
-        hash.update(relativePath);
-        hash.update('\0');
-        hash.update(content);
-        hash.update('\0');
+        records.push({
+            relativePath: relative(root, file),
+            content: await readFile(file),
+        });
+    }
+    return {
+        framed: digestDirectoryRecords(records, 'framed'),
+        legacy: digestDirectoryRecords(records, 'legacy'),
+    };
+}
+/**
+ * The framed digest of a directory tree.
+ *
+ * Streams file by file rather than capturing the tree, because this is the
+ * digest every ordinary caller computes. `hash.test.ts` pins that it agrees
+ * with `computeDirectoryDigests(...).framed`.
+ */
+export async function computeDirectoryHash(dirPath) {
+    const root = resolve(dirPath);
+    const files = await collectDirectoryFiles(dirPath);
+    files.sort((left, right) => compareDirectoryRelativePaths(relative(root, left), relative(root, right)));
+    const hash = createFramedDirectoryDigest();
+    for (const file of files) {
+        updateFramedDirectoryDigest(hash, relative(root, file), await readFile(file));
     }
     return hash.digest('hex');
 }

package/dist/providers/ceiling/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/providers/ceiling/registry.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB,IAAI,CAAC;AAKT,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,oBAAoB,CAAC;IAChC,aAAa,EAAE,qBAAqB,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,qBAAqB,GACzB,mBAAmB,CAAC;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC;CACtE;AAMD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAK9C,CAAC;AA6HF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/providers/ceiling/registry.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB,IAAI,CAAC;AAKT,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,oBAAoB,CAAC;IAChC,aAAa,EAAE,qBAAqB,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,qBAAqB,GACzB,mBAAmB,CAAC;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC;CACtE;AAMD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAK9C,CAAC;AA6HF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAM1E"}

package/dist/providers/ceiling/registry.js

@@ -1,4 +1,5 @@
 import { VALID_CLAUDE_DISPATCH_CEILINGS, VALID_CODEX_DISPATCH_CEILINGS, } from '../../config/oat-config.js';
+import { getOwnKey } from '../../config/own-keys.js';
 import { buildCodexMaterializedTargetRoleName } from '../codex/codec/shared.js';
 import { findCursorModelPinMapping } from '../cursor/codec/catalog.js';
 import { buildCursorMaterializedRoleName } from '../cursor/codec/shared.js';
@@ -128,5 +129,9 @@ const REGISTERED_ADAPTERS = {
  * `compileToDispatchArgs → null`).
  */
 export function getCeilingAdapter(provider) {
-    return REGISTERED_ADAPTERS[provider] ?? advisoryAdapter(provider);
+    // Own-key read: `provider` is user-supplied (`--provider <name>`), and a
+    // bare lookup for `__proto__` returns `Object.prototype`, which is neither
+    // nullish nor an adapter, so the `??` fallback above would be skipped and
+    // callers would read `undefined` for `mechanism` and `supportsCeiling`.
+    return getOwnKey(REGISTERED_ADAPTERS, provider) ?? advisoryAdapter(provider);
 }

package/dist/providers/identity/dispatch-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-report.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/dispatch-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,0BAA0B,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,wBAAwB,GACxB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,kCAAkC,GAClC,uCAAuC,GACvC,+BAA+B,CAAC;IACpC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EACL,qBAAqB,GACrB,mBAAmB,GACnB,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,kBAAkB,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC/C,aAAa,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACnD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1D,SAAS,EAAE,4BAA4B,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,0BAA0B,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,cAAc,CAAC;QACvB,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,0BAA0B,CAAC;QACnC,IAAI,EAAE,wBAAwB,CAAC;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,SAAS,EAAE;QACT,kBAAkB,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,aAAa,EAAE,0BAA0B,GAAG,IAAI,CAAC;QACjD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,WAAW,EAAE,0BAA0B,GAAG,IAAI,CAAC;QAC/C,aAAa,EAAE,4BAA4B,GAAG,IAAI,CAAC;QACnD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,mBAAmB,EAAE,4BAA4B,GAAG,IAAI,CAAC;QACzD,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF,cAAc,EAAE,4BAA4B,CAAC;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,cAAc,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACxD,eAAe,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,wBAAwB,CAAC;IACrC,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,cAAc,CAAC,EAAE,4BAA4B,CAAC;IAC9C,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,uBAAuB,CAAC;CAC3C;AAqND,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,GACzB,gBAAgB,CA0DlB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAExE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAmErE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,GACvB,mBAAmB,CAcrB"}
+{"version":3,"file":"dispatch-report.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/dispatch-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAG1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,0BAA0B,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,wBAAwB,GACxB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,kCAAkC,GAClC,uCAAuC,GACvC,+BAA+B,CAAC;IACpC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EACL,qBAAqB,GACrB,mBAAmB,GACnB,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,kBAAkB,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC/C,aAAa,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACnD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1D,SAAS,EAAE,4BAA4B,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,0BAA0B,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,cAAc,CAAC;QACvB,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,0BAA0B,CAAC;QACnC,IAAI,EAAE,wBAAwB,CAAC;QAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,SAAS,EAAE;QACT,kBAAkB,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC9D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,aAAa,EAAE,0BAA0B,GAAG,IAAI,CAAC;QACjD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,WAAW,EAAE,0BAA0B,GAAG,IAAI,CAAC;QAC/C,aAAa,EAAE,4BAA4B,GAAG,IAAI,CAAC;QACnD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,mBAAmB,EAAE,4BAA4B,GAAG,IAAI,CAAC;QACzD,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF,cAAc,EAAE,4BAA4B,CAAC;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,cAAc,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACxD,eAAe,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,wBAAwB,CAAC;IACrC,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,cAAc,CAAC,EAAE,4BAA4B,CAAC;IAC9C,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,uBAAuB,CAAC;CAC3C;AAqND,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,GACzB,gBAAgB,CA+DlB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAExE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAmErE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,GACvB,mBAAmB,CAcrB"}

package/dist/providers/identity/dispatch-report.js

@@ -1,3 +1,4 @@
+import { getOwnKey } from '../../config/own-keys.js';
 const ROLE_BY_ACTION = {
     implementation: 'implementer',
     fix: 'fix',
@@ -180,7 +181,9 @@ function dispatchCeiling(report) {
 }
 export function buildDispatchReport(input) {
     assertActionRole(input.action, input.role);
-    const provider = input.resolution.providers[input.resolution.provider];
+    // `resolution.provider` is a plain string, and the check below is a
+    // truthiness test that an inherited `Object.prototype` member would pass.
+    const provider = getOwnKey(input.resolution.providers, input.resolution.provider);
     if (!provider) {
         throw new Error(`Dispatch report resolution is missing provider data for "${input.resolution.provider}".`);
     }

package/dist/release/public-package-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AA6KD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}
+{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAkMD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}

package/dist/release/public-package-contract.js

@@ -46,6 +46,27 @@ const PUBLIC_PACKAGE_CONTRACTS = [
             'dist/index.js',
             'assets',
             'assets/bundle-metadata.json',
+            // Every name in `REQUIRED_BUNDLE_DIRECTORIES` (src/fs/assets.ts) keeps at
+            // least one concrete packed path in this list. `npm pack` drops empty
+            // directories, so without these entries a producer regression that
+            // emptied one of them published a tarball whose every command exits 2
+            // from `validateBundleStructure` while every release check stayed green:
+            // the bare `assets` entry above is satisfied by any single file anywhere
+            // under `assets/`, and the directory itself still existed in the build
+            // workspace. Naming a file under each directory closes that at both
+            // layers — `findMissingBuildArtifacts` for the build workspace and
+            // `findMissingPackedPaths` for the packed tarball.
+            //
+            // Two checks in `public-package-contract.test.ts` hold this list to the
+            // runtime one: `guards a packed path under every required bundle
+            // directory` derives its expectation from `REQUIRED_BUNDLE_DIRECTORIES`
+            // rather than restating it, and `fails release validation when a
+            // required bundle directory is empty in the tarball` is the negative
+            // pack control.
+            'assets/agents/oat-reviewer.md',
+            'assets/scripts/generate-oat-state.sh',
+            'assets/docs/index.md',
+            'assets/config/dispatch-matrix-recommendation.json',
             'assets/migration/pjm-restructure.md',
             'assets/templates/decision.md',
             'assets/templates/repo-agents.md',

package/dist/validation/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAwhCD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAoBjD;AAyED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAyIlC"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAm0CD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAsBjD;AAsGD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAyIlC"}