@playcraft/common 0.1.36-beta1 → 0.1.38-beta

package/dist/model-proxy/index.js

@@ -0,0 +1,81 @@
+const marker = '__playcraft_model_wire_v1__';
+export function encodeModelValue(value, hooks = {}) {
+    if (value === undefined)
+        return { [marker]: 'undefined' };
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error('invalid_model_transport_number');
+        return value;
+    }
+    if (typeof value === 'function') {
+        if (!hooks.callback)
+            throw new Error('model_transport_callback_not_allowed');
+        return { [marker]: 'callback', id: hooks.callback(value) };
+    }
+    if (value instanceof AbortSignal) {
+        hooks.onSignal?.(value);
+        return { [marker]: 'signal' };
+    }
+    if (value instanceof Date)
+        return { [marker]: 'date', value: value.toISOString() };
+    if (value instanceof URL)
+        return { [marker]: 'url', value: value.toString() };
+    if (value instanceof Error)
+        return { [marker]: 'error', name: value.name, message: value.message.slice(0, 2000) };
+    if (Buffer.isBuffer(value))
+        return { [marker]: 'buffer', value: value.toString('base64') };
+    if (value instanceof Uint8Array)
+        return { [marker]: 'bytes', value: Buffer.from(value).toString('base64') };
+    if (Array.isArray(value))
+        return value.map((item) => encodeModelValue(item, hooks));
+    if (typeof value !== 'object')
+        throw new Error('invalid_model_transport_value');
+    const result = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (key === marker || key === '__proto__' || key === 'constructor' || key === 'prototype')
+            throw new Error('invalid_model_transport_key');
+        result[key] = encodeModelValue(item, hooks);
+    }
+    return result;
+}
+export function decodeModelValue(value, hooks = {}) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => decodeModelValue(item, hooks));
+    if (marker in value) {
+        const kind = value[marker];
+        if (kind === 'undefined')
+            return undefined;
+        if (kind === 'signal')
+            return hooks.signal;
+        if (kind === 'callback' && typeof value.id === 'string' && hooks.onCallback)
+            return (...args) => hooks.onCallback(value.id, args);
+        if (kind === 'error' && typeof value.name === 'string' && typeof value.message === 'string') {
+            const error = new Error(value.message);
+            error.name = value.name;
+            return error;
+        }
+        if (typeof value.value === 'string') {
+            if (kind === 'buffer')
+                return Buffer.from(value.value, 'base64');
+            if (kind === 'bytes')
+                return Uint8Array.from(Buffer.from(value.value, 'base64'));
+            if (kind === 'date')
+                return new Date(value.value);
+            if (kind === 'url')
+                return new URL(value.value);
+        }
+        throw new Error('invalid_model_transport_tag');
+    }
+    const result = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            throw new Error('invalid_model_transport_key');
+        result[key] = decodeModelValue(item, hooks);
+    }
+    return result;
+}
+//# sourceMappingURL=index.js.map

package/dist/model-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/model-proxy/index.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAE7C,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAmB,EAAE;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7E,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAwC,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IACnF,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9E,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IAClH,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3F,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChF,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW;YACvF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAqB,EAAE,QAAmB,EAAE;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACpF,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU;YACzE,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,KAAK,CAAC,UAAW,CAAC,KAAK,CAAC,EAAY,EAAE,IAAI,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5F,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjF,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW;YACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/prefab/index.d.ts

@@ -10,6 +10,4 @@ export * from './descriptor.js';
 export * from './diff.js';
 export * from './image-padding-color.js';
 export * from './mime-type-list.js';
-export * from './image-generation-constraints.js';
-export * from './image-background.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/prefab/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prefab/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mCAAmC,CAAC;AAClD,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prefab/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC"}

package/dist/prefab/index.js

@@ -10,6 +10,4 @@ export * from './descriptor.js';
 export * from './diff.js';
 export * from './image-padding-color.js';
 export * from './mime-type-list.js';
-export * from './image-generation-constraints.js';
-export * from './image-background.js';
 //# sourceMappingURL=index.js.map

package/dist/prefab/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prefab/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mCAAmC,CAAC;AAClD,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prefab/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC"}

package/dist/project-skills/bundle-archive.d.ts

@@ -0,0 +1,21 @@
+type SkillRegistryValidationIssue = {
+    severity: 'error' | 'warning';
+    code: 'bundle_too_large' | 'invalid_manifest' | 'unsafe_archive_entry' | 'unsupported_file' | 'duplicate_path';
+    message: string;
+    path?: string;
+};
+export type SkillBundleFile = {
+    path: string;
+    data: Buffer;
+};
+export declare function createCanonicalBundleArchive(files: readonly SkillBundleFile[]): Buffer;
+export type BundleArchiveExtractionOptions = {
+    maxArchiveBytes?: number;
+    maxExpandedBytes?: number;
+};
+export declare function extractBundleArchive(archive: Buffer, options?: BundleArchiveExtractionOptions): {
+    files: SkillBundleFile[];
+    issues: SkillRegistryValidationIssue[];
+};
+export {};
+//# sourceMappingURL=bundle-archive.d.ts.map

package/dist/project-skills/bundle-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.d.ts","sourceRoot":"","sources":["../../src/project-skills/bundle-archive.ts"],"names":[],"mappings":"AAEA,KAAK,4BAA4B,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAMtN,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAetF;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG;IACnG,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC,CAyEA"}

package/dist/project-skills/bundle-archive.js

@@ -0,0 +1,165 @@
+import { gunzipSync, gzipSync } from 'node:zlib';
+import { normalizeBundlePath } from './bundle-path.js';
+const TAR_BLOCK_SIZE = 512;
+const DEFAULT_MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_EXPANDED_BYTES = 72 * 1024 * 1024;
+export function createCanonicalBundleArchive(files) {
+    const sorted = [...files].sort((left, right) => left.path.localeCompare(right.path));
+    const entries = sorted.map((file) => {
+        const path = normalizeBundlePath(file.path);
+        if (!path)
+            throw new Error(`Cannot archive an unsafe bundle path: ${file.path}`);
+        const { name, prefix } = splitTarPath(path);
+        const header = createTarHeader(name, prefix, file.data.length);
+        const padding = Buffer.alloc(paddedLength(file.data.length) - file.data.length);
+        return Buffer.concat([header, file.data, padding]);
+    });
+    const archive = gzipSync(Buffer.concat([...entries, Buffer.alloc(TAR_BLOCK_SIZE * 2)]));
+    // zlib writes the host operating system into the gzip header (macOS=19, Linux=3).
+    // Preserve the established Linux artifact format on every build host.
+    archive[9] = 3;
+    return archive;
+}
+export function extractBundleArchive(archive, options = {}) {
+    const issues = [];
+    const maxArchiveBytes = options.maxArchiveBytes ?? DEFAULT_MAX_ARCHIVE_BYTES;
+    const maxExpandedBytes = options.maxExpandedBytes ?? DEFAULT_MAX_EXPANDED_BYTES;
+    if (archive.length > maxArchiveBytes) {
+        return {
+            files: [],
+            issues: [{ severity: 'error', code: 'bundle_too_large', message: `The compressed bundle exceeds ${maxArchiveBytes} bytes.` }],
+        };
+    }
+    let contents;
+    try {
+        contents = gunzipSync(archive, { maxOutputLength: maxExpandedBytes });
+    }
+    catch {
+        return {
+            files: [],
+            issues: [{ severity: 'error', code: 'invalid_manifest', message: 'The bundle is not a valid gzip archive.' }],
+        };
+    }
+    const files = [];
+    const seen = new Set();
+    let offset = 0;
+    while (offset + TAR_BLOCK_SIZE <= contents.length) {
+        const header = contents.subarray(offset, offset + TAR_BLOCK_SIZE);
+        if (header.every((byte) => byte === 0))
+            break;
+        const parsed = parseTarHeader(header);
+        if (!parsed) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: 'The bundle contains an invalid tar entry.' });
+            break;
+        }
+        const path = normalizeBundlePath(parsed.path);
+        if (!path) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: `The bundle contains an unsafe tar path: ${parsed.path}` });
+            break;
+        }
+        if (parsed.type !== '0' && parsed.type !== '') {
+            issues.push({
+                severity: 'error',
+                code: 'unsafe_archive_entry',
+                message: `The bundle contains a non-regular tar entry: ${path}`,
+                path,
+            });
+            break;
+        }
+        if ((parsed.mode & 0o111) !== 0) {
+            issues.push({
+                severity: 'error',
+                code: 'unsupported_file',
+                message: `The bundle contains an executable tar entry: ${path}`,
+                path,
+            });
+            break;
+        }
+        const contentStart = offset + TAR_BLOCK_SIZE;
+        const contentEnd = contentStart + parsed.size;
+        if (parsed.size < 0 || contentEnd > contents.length) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: `The bundle entry is truncated: ${path}`, path });
+            break;
+        }
+        if (seen.has(path)) {
+            issues.push({ severity: 'error', code: 'duplicate_path', message: `The bundle contains a duplicate path: ${path}`, path });
+            break;
+        }
+        seen.add(path);
+        files.push({ path, data: Buffer.from(contents.subarray(contentStart, contentEnd)) });
+        offset = contentStart + paddedLength(parsed.size);
+    }
+    if (!issues.length && offset < contents.length && !contents.subarray(offset).every((byte) => byte === 0)) {
+        issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: 'The bundle has trailing non-tar data.' });
+    }
+    return { files, issues };
+}
+function createTarHeader(name, prefix, size) {
+    const header = Buffer.alloc(TAR_BLOCK_SIZE);
+    writeString(header, 0, 100, name);
+    writeOctal(header, 100, 8, 0o644);
+    writeOctal(header, 108, 8, 0);
+    writeOctal(header, 116, 8, 0);
+    writeOctal(header, 124, 12, size);
+    writeOctal(header, 136, 12, 0);
+    header.fill(0x20, 148, 156);
+    writeString(header, 156, 1, '0');
+    writeString(header, 257, 6, 'ustar\0');
+    writeString(header, 263, 2, '00');
+    writeString(header, 345, 155, prefix);
+    const checksum = header.reduce((total, value) => total + value, 0);
+    const checksumValue = `${checksum.toString(8).padStart(6, '0')}\0 `;
+    writeString(header, 148, 8, checksumValue);
+    return header;
+}
+function parseTarHeader(header) {
+    const expectedChecksum = readOctal(header, 148, 8);
+    const checksumHeader = Buffer.from(header);
+    checksumHeader.fill(0x20, 148, 156);
+    const actualChecksum = checksumHeader.reduce((total, value) => total + value, 0);
+    const name = readString(header, 0, 100);
+    const prefix = readString(header, 345, 155);
+    const path = prefix ? `${prefix}/${name}` : name;
+    const size = readOctal(header, 124, 12);
+    const mode = readOctal(header, 100, 8);
+    const type = readString(header, 156, 1);
+    if (expectedChecksum === null || expectedChecksum !== actualChecksum || size === null || mode === null || !path)
+        return null;
+    return { path, size, mode, type };
+}
+function splitTarPath(path) {
+    if (Buffer.byteLength(path) <= 100)
+        return { name: path, prefix: '' };
+    const slash = path.lastIndexOf('/');
+    if (slash <= 0)
+        throw new Error(`Bundle path is too long for a tar archive: ${path}`);
+    const prefix = path.slice(0, slash);
+    const name = path.slice(slash + 1);
+    if (Buffer.byteLength(prefix) > 155 || Buffer.byteLength(name) > 100) {
+        throw new Error(`Bundle path is too long for a tar archive: ${path}`);
+    }
+    return { name, prefix };
+}
+function writeString(buffer, offset, length, value) {
+    const encoded = Buffer.from(value);
+    if (encoded.length > length)
+        throw new Error(`Tar header value exceeds ${length} bytes.`);
+    encoded.copy(buffer, offset);
+}
+function writeOctal(buffer, offset, length, value) {
+    const encoded = `${value.toString(8).padStart(length - 1, '0')}\0`;
+    writeString(buffer, offset, length, encoded);
+}
+function readString(buffer, offset, length) {
+    return buffer.subarray(offset, offset + length).toString('utf8').replace(/\0.*$/, '').trim();
+}
+function readOctal(buffer, offset, length) {
+    const value = readString(buffer, offset, length);
+    if (!value)
+        return 0;
+    return /^[0-7]+$/.test(value) ? Number.parseInt(value, 8) : null;
+}
+function paddedLength(length) {
+    return Math.ceil(length / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+}
+//# sourceMappingURL=bundle-archive.js.map

package/dist/project-skills/bundle-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/project-skills/bundle-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAOpD,MAAM,UAAU,4BAA4B,CAAC,KAAiC;IAC5E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,kFAAkF;IAClF,sEAAsE;IACtE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,UAA0C,EAAE;IAIhG,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACrC,OAAO;YACL,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,eAAe,SAAS,EAAE,CAAC;SAC9H,CAAC;IACJ,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SAC9G,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,cAAc,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvH,MAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpI,MAAM;QACR,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,gDAAgD,IAAI,EAAE;gBAC/D,IAAI;aACL,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,gDAAgD,IAAI,EAAE;gBAC/D,IAAI;aACL,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,GAAG,cAAc,CAAC;QAC7C,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,kCAAkC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1H,MAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yCAAyC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3H,MAAM;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;IACpE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,cAAc,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7H,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,SAAS,CAAC,CAAC;IAC1F,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IACnE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,GAAG,cAAc,CAAC;AAC7D,CAAC"}

package/dist/project-skills/bundle-path.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeBundlePath(value: string): string | null;
+export declare function isBundlePathWithin(prefix: string, path: string): boolean;
+//# sourceMappingURL=bundle-path.d.ts.map

package/dist/project-skills/bundle-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-path.d.ts","sourceRoot":"","sources":["../../src/project-skills/bundle-path.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxE"}

package/dist/project-skills/bundle-path.js

@@ -0,0 +1,17 @@
+export function normalizeBundlePath(value) {
+    if (!value || value.includes('\u0000') || value.includes('\\\\'))
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.startsWith('/') || trimmed.endsWith('/'))
+        return null;
+    const parts = trimmed.split('/');
+    if (parts.some((part) => !part || part === '.' || part === '..'))
+        return null;
+    return parts.join('/');
+}
+export function isBundlePathWithin(prefix, path) {
+    const normalizedPrefix = normalizeBundlePath(prefix);
+    const normalizedPath = normalizeBundlePath(path);
+    return Boolean(normalizedPrefix && normalizedPath && (normalizedPath === normalizedPrefix || normalizedPath.startsWith(`${normalizedPrefix}/`)));
+}
+//# sourceMappingURL=bundle-path.js.map

package/dist/project-skills/bundle-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-path.js","sourceRoot":"","sources":["../../src/project-skills/bundle-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC7D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,gBAAgB,IAAI,cAAc,IAAI,CAAC,cAAc,KAAK,gBAAgB,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC"}

package/dist/project-skills/evidence.d.ts

@@ -0,0 +1,15 @@
+export type ManagedSkillEvidence = {
+    runtimeId: string;
+    lockId: string;
+    skillVersionId: string;
+    artifactHash: string;
+    skillRef: string;
+    nativeSessionId: string;
+    nativeCallId: string;
+    bodyHash: string;
+    occurredAt: Date;
+    dedupeKey: string;
+};
+/** Shared by live native events and complete history reconciliation, never text search. */
+export declare function readManagedSkillEvidence(input: unknown): ManagedSkillEvidence | null;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/project-skills/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/project-skills/evidence.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAChF,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAClF,UAAU,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACrC,CAAC;AAKF,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAmBpF"}

package/dist/project-skills/evidence.js

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto';
+import { projectSkillsDigest } from './protocol.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+/** Shared by live native events and complete history reconciliation, never text search. */
+export function readManagedSkillEvidence(input) {
+    const event = record(input);
+    const properties = record(event?.properties);
+    const part = record(event?.part) ?? record(properties?.part) ?? event;
+    const state = record(part?.state);
+    if (part?.type !== 'tool' || part.tool !== 'skill' || state?.status !== 'completed')
+        return null;
+    const metadata = record(record(state.metadata)?.playcraftSkill);
+    if (metadata?.schemaVersion !== 1)
+        return null;
+    const keys = ['runtimeId', 'lockId', 'skillVersionId', 'artifactHash', 'skillRef', 'nativeSessionId', 'bodyHash'];
+    if (keys.some((key) => typeof metadata[key] !== 'string' || !metadata[key].trim()))
+        return null;
+    if (typeof part.callID !== 'string' || !part.callID || part.sessionID !== metadata.nativeSessionId)
+        return null;
+    if (typeof state.output !== 'string' || createHash('sha256').update(state.output).digest('hex') !== metadata.bodyHash)
+        return null;
+    const ended = record(state.time)?.end;
+    if (typeof ended !== 'number' || !Number.isFinite(ended) || ended <= 0)
+        return null;
+    const details = Object.fromEntries(keys.map((key) => [key, metadata[key]]));
+    return {
+        ...details, nativeCallId: part.callID, occurredAt: new Date(ended),
+        dedupeKey: projectSkillsDigest([details.runtimeId, details.nativeSessionId, part.callID, 'loaded', details.skillVersionId]),
+    };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/project-skills/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/project-skills/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAOpD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,EAAE,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,aAAa,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAU,CAAC;IAC3H,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAE,QAAQ,CAAC,GAAG,CAAY,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAChH,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAA4E,CAAC;IACvJ,OAAO;QACL,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;QAClE,SAAS,EAAE,mBAAmB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;KAC5H,CAAC;AACJ,CAAC"}

package/dist/project-skills/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './protocol.js';
+export * from './inventory.js';
+export * from './evidence.js';
+export * from './bundle-archive.js';
+export * from './local-snapshot.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/project-skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project-skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}

package/dist/project-skills/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './protocol.js';
+export * from './inventory.js';
+export * from './evidence.js';
+export * from './bundle-archive.js';
+export * from './local-snapshot.js';
+//# sourceMappingURL=index.js.map

package/dist/project-skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project-skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}

package/dist/project-skills/inventory.d.ts

@@ -0,0 +1,23 @@
+import { type ProjectSkillDeclaration, type ProjectSkillEntry, type ProjectSkillFile, type ProjectSkillIssue } from './types.js';
+export declare const PROJECT_SKILL_SOURCE_ROOTS: readonly [".agents/skills", ".claude/skills", ".opencode/skills", ".opencode/skill"];
+export type ProjectSkillSource = {
+    entryKey: string;
+    root: string;
+    files: ProjectSkillFile[];
+    sourceTreeHash: string;
+};
+export type ProjectSkillInventory = {
+    declaration: ProjectSkillDeclaration | null;
+    discovered: {
+        root: string;
+        entryKey: string;
+    }[];
+    sources: ProjectSkillSource[];
+    issues: ProjectSkillIssue[];
+};
+/** Metadata is never read through repository-supplied links. */
+export declare function readProjectSkillsLockFile(projectRoot: string): Promise<string | null>;
+export declare function readProjectSkillSource(projectRoot: string, entry: ProjectSkillEntry): Promise<ProjectSkillSource>;
+/** Static inventory only: no source scripts, model calls, or repository mutations. */
+export declare function inspectProjectSkills(projectRoot: string): Promise<ProjectSkillInventory>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/project-skills/inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../src/project-skills/inventory.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EACpG,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,0BAA0B,sFAAuF,CAAC;AAC/H,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACvH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B,CAAC;AAKF,gEAAgE;AAChE,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAW3F;AAmBD,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgCvH;AAED,sFAAsF;AACtF,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4C9F"}

package/dist/project-skills/inventory.js

@@ -0,0 +1,150 @@
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+import { createHash } from 'node:crypto';
+import { parseProjectSkillDeclaration, sourceTreeDigest } from './protocol.js';
+import { PROJECT_SKILLS_DECLARATION_PATH, PROJECT_SKILLS_LOCK_PATH, ProjectSkillsError, } from './types.js';
+export const PROJECT_SKILL_SOURCE_ROOTS = ['.agents/skills', '.claude/skills', '.opencode/skills', '.opencode/skill'];
+const MAX_FILES = 512;
+const MAX_FILE_BYTES = 16 * 1024 * 1024;
+const MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
+/** Metadata is never read through repository-supplied links. */
+export async function readProjectSkillsLockFile(projectRoot) {
+    const root = await realpath(resolve(projectRoot));
+    try {
+        const file = await safePath(root, PROJECT_SKILLS_LOCK_PATH);
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.size > 1024 * 1024)
+            throw new ProjectSkillsError('source_limit', PROJECT_SKILLS_LOCK_PATH);
+        return await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Reject links at every segment, including roots. Snapshot bytes before registering. */
+async function safePath(root, relative) {
+    let current = root;
+    for (const part of relative.split('/')) {
+        current = join(current, part);
+        if ((await lstat(current)).isSymbolicLink())
+            throw new ProjectSkillsError('source_symlink', relative);
+    }
+    const target = await realpath(current);
+    if (!target.startsWith(root + sep))
+        throw new ProjectSkillsError('source_escape', relative);
+    return target;
+}
+export async function readProjectSkillSource(projectRoot, entry) {
+    if (entry.source.kind !== 'repository')
+        throw new ProjectSkillsError('not_repository_source', entry.entryKey);
+    // Reuse the portable validation before ever interpreting an uploaded path.
+    parseProjectSkillDeclaration({ schemaVersion: 1, entries: [entry] });
+    const root = await realpath(resolve(projectRoot));
+    const files = [];
+    let bytes = 0;
+    const walk = async (projectPath, bundlePath) => {
+        const absolute = await safePath(root, projectPath);
+        const info = await lstat(absolute);
+        if (info.isDirectory()) {
+            for (const name of (await readdir(absolute)).sort()) {
+                if (name === '.git' || name === 'node_modules')
+                    throw new ProjectSkillsError('unsupported_source', `${projectPath}/${name}`);
+                await walk(`${projectPath}/${name}`, bundlePath ? `${bundlePath}/${name}` : name);
+            }
+            return;
+        }
+        if (!info.isFile())
+            throw new ProjectSkillsError('unsupported_source', projectPath);
+        if (info.size > MAX_FILE_BYTES || files.length >= MAX_FILES)
+            throw new ProjectSkillsError('source_limit', projectPath);
+        const content = await readFile(absolute);
+        bytes += content.byteLength;
+        if (content.byteLength > MAX_FILE_BYTES || bytes > MAX_BUNDLE_BYTES)
+            throw new ProjectSkillsError('source_limit', projectPath);
+        files.push({ path: bundlePath, content });
+    };
+    await walk(entry.source.root, '');
+    if (!files.some((file) => file.path === 'SKILL.md'))
+        throw new ProjectSkillsError('missing_skill_body', entry.source.root);
+    // External project resources retain their original relative path beneath a reserved prefix.
+    if (entry.projectFiles?.length && files.some((file) => file.path === 'project' || file.path.startsWith('project/'))) {
+        throw new ProjectSkillsError('project_resource_collision', entry.entryKey);
+    }
+    for (const relative of entry.projectFiles ?? [])
+        await walk(relative, `project/${relative}`);
+    return { entryKey: entry.entryKey, root: entry.source.root, files, sourceTreeHash: sourceTreeDigest(files) };
+}
+/** Static inventory only: no source scripts, model calls, or repository mutations. */
+export async function inspectProjectSkills(projectRoot) {
+    const root = await realpath(resolve(projectRoot));
+    const result = { declaration: null, discovered: [], sources: [], issues: [] };
+    const issue = (error, path) => result.issues.push({
+        code: error instanceof ProjectSkillsError ? error.code : 'source_read_failed',
+        detail: error instanceof Error ? error.message : String(error), path,
+    });
+    try {
+        if (await exists(join(root, PROJECT_SKILLS_DECLARATION_PATH))) {
+            const file = await safePath(root, PROJECT_SKILLS_DECLARATION_PATH);
+            if ((await lstat(file)).size > 1024 * 1024)
+                throw new ProjectSkillsError('source_limit', PROJECT_SKILLS_DECLARATION_PATH);
+            result.declaration = parseProjectSkillDeclaration(await readFile(file, 'utf8'));
+        }
+    }
+    catch (error) {
+        issue(error, PROJECT_SKILLS_DECLARATION_PATH);
+    }
+    for (const sourceRoot of PROJECT_SKILL_SOURCE_ROOTS) {
+        try {
+            if (!await exists(join(root, sourceRoot)))
+                continue;
+            const directory = await safePath(root, sourceRoot);
+            for (const name of (await readdir(directory)).sort()) {
+                const source = `${sourceRoot}/${name}`;
+                const safe = await safePath(root, source);
+                if (!(await lstat(safe)).isDirectory())
+                    continue;
+                if (!await exists(join(safe, 'SKILL.md'))) {
+                    result.issues.push({ code: 'unrecognized_entry', path: source, detail: 'A skill directory must contain SKILL.md at its root' });
+                    continue;
+                }
+                result.discovered.push({ root: source, entryKey: `repo-${createHash('sha256').update(source).digest('hex').slice(0, 24)}` });
+            }
+        }
+        catch (error) {
+            issue(error, sourceRoot);
+        }
+    }
+    const declaredRoots = new Set(result.declaration?.entries.flatMap((entry) => entry.source.kind === 'repository' ? [entry.source.root] : []) ?? []);
+    const entries = [
+        ...(result.declaration?.entries ?? []),
+        ...result.discovered.filter((item) => !declaredRoots.has(item.root)).map((item) => ({
+            entryKey: item.entryKey, source: { kind: 'repository', root: item.root },
+            enabled: result.declaration === null, surface: 'sandbox-agent',
+        })),
+    ];
+    for (const entry of entries) {
+        if (entry.source.kind !== 'repository')
+            continue;
+        try {
+            result.sources.push(await readProjectSkillSource(root, entry));
+        }
+        catch (error) {
+            issue(error, entry.source.root);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=inventory.js.map