@playcraft/common 0.1.41-prod → 0.1.43-beta

package/dist/project-skills/bundle-archive.d.ts

@@ -0,0 +1,21 @@
+type SkillRegistryValidationIssue = {
+    severity: 'error' | 'warning';
+    code: 'bundle_too_large' | 'invalid_manifest' | 'unsafe_archive_entry' | 'unsupported_file' | 'duplicate_path';
+    message: string;
+    path?: string;
+};
+export type SkillBundleFile = {
+    path: string;
+    data: Buffer;
+};
+export declare function createCanonicalBundleArchive(files: readonly SkillBundleFile[]): Buffer;
+export type BundleArchiveExtractionOptions = {
+    maxArchiveBytes?: number;
+    maxExpandedBytes?: number;
+};
+export declare function extractBundleArchive(archive: Buffer, options?: BundleArchiveExtractionOptions): {
+    files: SkillBundleFile[];
+    issues: SkillRegistryValidationIssue[];
+};
+export {};
+//# sourceMappingURL=bundle-archive.d.ts.map

package/dist/project-skills/bundle-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.d.ts","sourceRoot":"","sources":["../../src/project-skills/bundle-archive.ts"],"names":[],"mappings":"AAEA,KAAK,4BAA4B,GAAG;IAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAMtN,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAetF;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG;IACnG,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC,CAyEA"}

package/dist/project-skills/bundle-archive.js

@@ -0,0 +1,165 @@
+import { gunzipSync, gzipSync } from 'node:zlib';
+import { normalizeBundlePath } from './bundle-path.js';
+const TAR_BLOCK_SIZE = 512;
+const DEFAULT_MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_EXPANDED_BYTES = 72 * 1024 * 1024;
+export function createCanonicalBundleArchive(files) {
+    const sorted = [...files].sort((left, right) => left.path.localeCompare(right.path));
+    const entries = sorted.map((file) => {
+        const path = normalizeBundlePath(file.path);
+        if (!path)
+            throw new Error(`Cannot archive an unsafe bundle path: ${file.path}`);
+        const { name, prefix } = splitTarPath(path);
+        const header = createTarHeader(name, prefix, file.data.length);
+        const padding = Buffer.alloc(paddedLength(file.data.length) - file.data.length);
+        return Buffer.concat([header, file.data, padding]);
+    });
+    const archive = gzipSync(Buffer.concat([...entries, Buffer.alloc(TAR_BLOCK_SIZE * 2)]));
+    // zlib writes the host operating system into the gzip header (macOS=19, Linux=3).
+    // Preserve the established Linux artifact format on every build host.
+    archive[9] = 3;
+    return archive;
+}
+export function extractBundleArchive(archive, options = {}) {
+    const issues = [];
+    const maxArchiveBytes = options.maxArchiveBytes ?? DEFAULT_MAX_ARCHIVE_BYTES;
+    const maxExpandedBytes = options.maxExpandedBytes ?? DEFAULT_MAX_EXPANDED_BYTES;
+    if (archive.length > maxArchiveBytes) {
+        return {
+            files: [],
+            issues: [{ severity: 'error', code: 'bundle_too_large', message: `The compressed bundle exceeds ${maxArchiveBytes} bytes.` }],
+        };
+    }
+    let contents;
+    try {
+        contents = gunzipSync(archive, { maxOutputLength: maxExpandedBytes });
+    }
+    catch {
+        return {
+            files: [],
+            issues: [{ severity: 'error', code: 'invalid_manifest', message: 'The bundle is not a valid gzip archive.' }],
+        };
+    }
+    const files = [];
+    const seen = new Set();
+    let offset = 0;
+    while (offset + TAR_BLOCK_SIZE <= contents.length) {
+        const header = contents.subarray(offset, offset + TAR_BLOCK_SIZE);
+        if (header.every((byte) => byte === 0))
+            break;
+        const parsed = parseTarHeader(header);
+        if (!parsed) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: 'The bundle contains an invalid tar entry.' });
+            break;
+        }
+        const path = normalizeBundlePath(parsed.path);
+        if (!path) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: `The bundle contains an unsafe tar path: ${parsed.path}` });
+            break;
+        }
+        if (parsed.type !== '0' && parsed.type !== '') {
+            issues.push({
+                severity: 'error',
+                code: 'unsafe_archive_entry',
+                message: `The bundle contains a non-regular tar entry: ${path}`,
+                path,
+            });
+            break;
+        }
+        if ((parsed.mode & 0o111) !== 0) {
+            issues.push({
+                severity: 'error',
+                code: 'unsupported_file',
+                message: `The bundle contains an executable tar entry: ${path}`,
+                path,
+            });
+            break;
+        }
+        const contentStart = offset + TAR_BLOCK_SIZE;
+        const contentEnd = contentStart + parsed.size;
+        if (parsed.size < 0 || contentEnd > contents.length) {
+            issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: `The bundle entry is truncated: ${path}`, path });
+            break;
+        }
+        if (seen.has(path)) {
+            issues.push({ severity: 'error', code: 'duplicate_path', message: `The bundle contains a duplicate path: ${path}`, path });
+            break;
+        }
+        seen.add(path);
+        files.push({ path, data: Buffer.from(contents.subarray(contentStart, contentEnd)) });
+        offset = contentStart + paddedLength(parsed.size);
+    }
+    if (!issues.length && offset < contents.length && !contents.subarray(offset).every((byte) => byte === 0)) {
+        issues.push({ severity: 'error', code: 'unsafe_archive_entry', message: 'The bundle has trailing non-tar data.' });
+    }
+    return { files, issues };
+}
+function createTarHeader(name, prefix, size) {
+    const header = Buffer.alloc(TAR_BLOCK_SIZE);
+    writeString(header, 0, 100, name);
+    writeOctal(header, 100, 8, 0o644);
+    writeOctal(header, 108, 8, 0);
+    writeOctal(header, 116, 8, 0);
+    writeOctal(header, 124, 12, size);
+    writeOctal(header, 136, 12, 0);
+    header.fill(0x20, 148, 156);
+    writeString(header, 156, 1, '0');
+    writeString(header, 257, 6, 'ustar\0');
+    writeString(header, 263, 2, '00');
+    writeString(header, 345, 155, prefix);
+    const checksum = header.reduce((total, value) => total + value, 0);
+    const checksumValue = `${checksum.toString(8).padStart(6, '0')}\0 `;
+    writeString(header, 148, 8, checksumValue);
+    return header;
+}
+function parseTarHeader(header) {
+    const expectedChecksum = readOctal(header, 148, 8);
+    const checksumHeader = Buffer.from(header);
+    checksumHeader.fill(0x20, 148, 156);
+    const actualChecksum = checksumHeader.reduce((total, value) => total + value, 0);
+    const name = readString(header, 0, 100);
+    const prefix = readString(header, 345, 155);
+    const path = prefix ? `${prefix}/${name}` : name;
+    const size = readOctal(header, 124, 12);
+    const mode = readOctal(header, 100, 8);
+    const type = readString(header, 156, 1);
+    if (expectedChecksum === null || expectedChecksum !== actualChecksum || size === null || mode === null || !path)
+        return null;
+    return { path, size, mode, type };
+}
+function splitTarPath(path) {
+    if (Buffer.byteLength(path) <= 100)
+        return { name: path, prefix: '' };
+    const slash = path.lastIndexOf('/');
+    if (slash <= 0)
+        throw new Error(`Bundle path is too long for a tar archive: ${path}`);
+    const prefix = path.slice(0, slash);
+    const name = path.slice(slash + 1);
+    if (Buffer.byteLength(prefix) > 155 || Buffer.byteLength(name) > 100) {
+        throw new Error(`Bundle path is too long for a tar archive: ${path}`);
+    }
+    return { name, prefix };
+}
+function writeString(buffer, offset, length, value) {
+    const encoded = Buffer.from(value);
+    if (encoded.length > length)
+        throw new Error(`Tar header value exceeds ${length} bytes.`);
+    encoded.copy(buffer, offset);
+}
+function writeOctal(buffer, offset, length, value) {
+    const encoded = `${value.toString(8).padStart(length - 1, '0')}\0`;
+    writeString(buffer, offset, length, encoded);
+}
+function readString(buffer, offset, length) {
+    return buffer.subarray(offset, offset + length).toString('utf8').replace(/\0.*$/, '').trim();
+}
+function readOctal(buffer, offset, length) {
+    const value = readString(buffer, offset, length);
+    if (!value)
+        return 0;
+    return /^[0-7]+$/.test(value) ? Number.parseInt(value, 8) : null;
+}
+function paddedLength(length) {
+    return Math.ceil(length / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+}
+//# sourceMappingURL=bundle-archive.js.map

package/dist/project-skills/bundle-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/project-skills/bundle-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAOpD,MAAM,UAAU,4BAA4B,CAAC,KAAiC;IAC5E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,kFAAkF;IAClF,sEAAsE;IACtE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,UAA0C,EAAE;IAIhG,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACrC,OAAO;YACL,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,eAAe,SAAS,EAAE,CAAC;SAC9H,CAAC;IACJ,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SAC9G,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,cAAc,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvH,MAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpI,MAAM;QACR,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,gDAAgD,IAAI,EAAE;gBAC/D,IAAI;aACL,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,gDAAgD,IAAI,EAAE;gBAC/D,IAAI;aACL,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,GAAG,cAAc,CAAC;QAC7C,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,kCAAkC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1H,MAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yCAAyC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3H,MAAM;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;IACpE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,cAAc,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7H,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,SAAS,CAAC,CAAC;IAC1F,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IACnE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,GAAG,cAAc,CAAC;AAC7D,CAAC"}

package/dist/project-skills/bundle-path.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeBundlePath(value: string): string | null;
+export declare function isBundlePathWithin(prefix: string, path: string): boolean;
+//# sourceMappingURL=bundle-path.d.ts.map

package/dist/project-skills/bundle-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-path.d.ts","sourceRoot":"","sources":["../../src/project-skills/bundle-path.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxE"}

package/dist/project-skills/bundle-path.js

@@ -0,0 +1,17 @@
+export function normalizeBundlePath(value) {
+    if (!value || value.includes('\u0000') || value.includes('\\\\'))
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.startsWith('/') || trimmed.endsWith('/'))
+        return null;
+    const parts = trimmed.split('/');
+    if (parts.some((part) => !part || part === '.' || part === '..'))
+        return null;
+    return parts.join('/');
+}
+export function isBundlePathWithin(prefix, path) {
+    const normalizedPrefix = normalizeBundlePath(prefix);
+    const normalizedPath = normalizeBundlePath(path);
+    return Boolean(normalizedPrefix && normalizedPath && (normalizedPath === normalizedPrefix || normalizedPath.startsWith(`${normalizedPrefix}/`)));
+}
+//# sourceMappingURL=bundle-path.js.map

package/dist/project-skills/bundle-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-path.js","sourceRoot":"","sources":["../../src/project-skills/bundle-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC7D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,gBAAgB,IAAI,cAAc,IAAI,CAAC,cAAc,KAAK,gBAAgB,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC"}

package/dist/project-skills/evidence.d.ts

@@ -0,0 +1,15 @@
+export type ManagedSkillEvidence = {
+    runtimeId: string;
+    lockId: string;
+    skillVersionId: string;
+    artifactHash: string;
+    skillRef: string;
+    nativeSessionId: string;
+    nativeCallId: string;
+    bodyHash: string;
+    occurredAt: Date;
+    dedupeKey: string;
+};
+/** Shared by live native events and complete history reconciliation, never text search. */
+export declare function readManagedSkillEvidence(input: unknown): ManagedSkillEvidence | null;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/project-skills/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/project-skills/evidence.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAChF,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAClF,UAAU,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACrC,CAAC;AAKF,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAmBpF"}

package/dist/project-skills/evidence.js

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto';
+import { projectSkillsDigest } from './protocol.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+/** Shared by live native events and complete history reconciliation, never text search. */
+export function readManagedSkillEvidence(input) {
+    const event = record(input);
+    const properties = record(event?.properties);
+    const part = record(event?.part) ?? record(properties?.part) ?? event;
+    const state = record(part?.state);
+    if (part?.type !== 'tool' || part.tool !== 'skill' || state?.status !== 'completed')
+        return null;
+    const metadata = record(record(state.metadata)?.playcraftSkill);
+    if (metadata?.schemaVersion !== 1)
+        return null;
+    const keys = ['runtimeId', 'lockId', 'skillVersionId', 'artifactHash', 'skillRef', 'nativeSessionId', 'bodyHash'];
+    if (keys.some((key) => typeof metadata[key] !== 'string' || !metadata[key].trim()))
+        return null;
+    if (typeof part.callID !== 'string' || !part.callID || part.sessionID !== metadata.nativeSessionId)
+        return null;
+    if (typeof state.output !== 'string' || createHash('sha256').update(state.output).digest('hex') !== metadata.bodyHash)
+        return null;
+    const ended = record(state.time)?.end;
+    if (typeof ended !== 'number' || !Number.isFinite(ended) || ended <= 0)
+        return null;
+    const details = Object.fromEntries(keys.map((key) => [key, metadata[key]]));
+    return {
+        ...details, nativeCallId: part.callID, occurredAt: new Date(ended),
+        dedupeKey: projectSkillsDigest([details.runtimeId, details.nativeSessionId, part.callID, 'loaded', details.skillVersionId]),
+    };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/project-skills/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/project-skills/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAOpD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,EAAE,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,aAAa,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAU,CAAC;IAC3H,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAE,QAAQ,CAAC,GAAG,CAAY,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAChH,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAA4E,CAAC;IACvJ,OAAO;QACL,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;QAClE,SAAS,EAAE,mBAAmB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;KAC5H,CAAC;AACJ,CAAC"}

package/dist/project-skills/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './protocol.js';
+export * from './inventory.js';
+export * from './evidence.js';
+export * from './bundle-archive.js';
+export * from './local-snapshot.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/project-skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/project-skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}

package/dist/project-skills/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './protocol.js';
+export * from './inventory.js';
+export * from './evidence.js';
+export * from './bundle-archive.js';
+export * from './local-snapshot.js';
+//# sourceMappingURL=index.js.map

package/dist/project-skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/project-skills/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}

package/dist/project-skills/inventory.d.ts

@@ -0,0 +1,23 @@
+import { type ProjectSkillDeclaration, type ProjectSkillEntry, type ProjectSkillFile, type ProjectSkillIssue } from './types.js';
+export declare const PROJECT_SKILL_SOURCE_ROOTS: readonly [".agents/skills", ".claude/skills", ".opencode/skills", ".opencode/skill"];
+export type ProjectSkillSource = {
+    entryKey: string;
+    root: string;
+    files: ProjectSkillFile[];
+    sourceTreeHash: string;
+};
+export type ProjectSkillInventory = {
+    declaration: ProjectSkillDeclaration | null;
+    discovered: {
+        root: string;
+        entryKey: string;
+    }[];
+    sources: ProjectSkillSource[];
+    issues: ProjectSkillIssue[];
+};
+/** Metadata is never read through repository-supplied links. */
+export declare function readProjectSkillsLockFile(projectRoot: string): Promise<string | null>;
+export declare function readProjectSkillSource(projectRoot: string, entry: ProjectSkillEntry): Promise<ProjectSkillSource>;
+/** Static inventory only: no source scripts, model calls, or repository mutations. */
+export declare function inspectProjectSkills(projectRoot: string): Promise<ProjectSkillInventory>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/project-skills/inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../src/project-skills/inventory.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EACpG,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,0BAA0B,sFAAuF,CAAC;AAC/H,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACvH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B,CAAC;AAKF,gEAAgE;AAChE,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAW3F;AAmBD,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgCvH;AAED,sFAAsF;AACtF,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4C9F"}

package/dist/project-skills/inventory.js

@@ -0,0 +1,150 @@
+import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { join, resolve, sep } from 'node:path';
+import { createHash } from 'node:crypto';
+import { parseProjectSkillDeclaration, sourceTreeDigest } from './protocol.js';
+import { PROJECT_SKILLS_DECLARATION_PATH, PROJECT_SKILLS_LOCK_PATH, ProjectSkillsError, } from './types.js';
+export const PROJECT_SKILL_SOURCE_ROOTS = ['.agents/skills', '.claude/skills', '.opencode/skills', '.opencode/skill'];
+const MAX_FILES = 512;
+const MAX_FILE_BYTES = 16 * 1024 * 1024;
+const MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
+/** Metadata is never read through repository-supplied links. */
+export async function readProjectSkillsLockFile(projectRoot) {
+    const root = await realpath(resolve(projectRoot));
+    try {
+        const file = await safePath(root, PROJECT_SKILLS_LOCK_PATH);
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.size > 1024 * 1024)
+            throw new ProjectSkillsError('source_limit', PROJECT_SKILLS_LOCK_PATH);
+        return await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Reject links at every segment, including roots. Snapshot bytes before registering. */
+async function safePath(root, relative) {
+    let current = root;
+    for (const part of relative.split('/')) {
+        current = join(current, part);
+        if ((await lstat(current)).isSymbolicLink())
+            throw new ProjectSkillsError('source_symlink', relative);
+    }
+    const target = await realpath(current);
+    if (!target.startsWith(root + sep))
+        throw new ProjectSkillsError('source_escape', relative);
+    return target;
+}
+export async function readProjectSkillSource(projectRoot, entry) {
+    if (entry.source.kind !== 'repository')
+        throw new ProjectSkillsError('not_repository_source', entry.entryKey);
+    // Reuse the portable validation before ever interpreting an uploaded path.
+    parseProjectSkillDeclaration({ schemaVersion: 1, entries: [entry] });
+    const root = await realpath(resolve(projectRoot));
+    const files = [];
+    let bytes = 0;
+    const walk = async (projectPath, bundlePath) => {
+        const absolute = await safePath(root, projectPath);
+        const info = await lstat(absolute);
+        if (info.isDirectory()) {
+            for (const name of (await readdir(absolute)).sort()) {
+                if (name === '.git' || name === 'node_modules')
+                    throw new ProjectSkillsError('unsupported_source', `${projectPath}/${name}`);
+                await walk(`${projectPath}/${name}`, bundlePath ? `${bundlePath}/${name}` : name);
+            }
+            return;
+        }
+        if (!info.isFile())
+            throw new ProjectSkillsError('unsupported_source', projectPath);
+        if (info.size > MAX_FILE_BYTES || files.length >= MAX_FILES)
+            throw new ProjectSkillsError('source_limit', projectPath);
+        const content = await readFile(absolute);
+        bytes += content.byteLength;
+        if (content.byteLength > MAX_FILE_BYTES || bytes > MAX_BUNDLE_BYTES)
+            throw new ProjectSkillsError('source_limit', projectPath);
+        files.push({ path: bundlePath, content });
+    };
+    await walk(entry.source.root, '');
+    if (!files.some((file) => file.path === 'SKILL.md'))
+        throw new ProjectSkillsError('missing_skill_body', entry.source.root);
+    // External project resources retain their original relative path beneath a reserved prefix.
+    if (entry.projectFiles?.length && files.some((file) => file.path === 'project' || file.path.startsWith('project/'))) {
+        throw new ProjectSkillsError('project_resource_collision', entry.entryKey);
+    }
+    for (const relative of entry.projectFiles ?? [])
+        await walk(relative, `project/${relative}`);
+    return { entryKey: entry.entryKey, root: entry.source.root, files, sourceTreeHash: sourceTreeDigest(files) };
+}
+/** Static inventory only: no source scripts, model calls, or repository mutations. */
+export async function inspectProjectSkills(projectRoot) {
+    const root = await realpath(resolve(projectRoot));
+    const result = { declaration: null, discovered: [], sources: [], issues: [] };
+    const issue = (error, path) => result.issues.push({
+        code: error instanceof ProjectSkillsError ? error.code : 'source_read_failed',
+        detail: error instanceof Error ? error.message : String(error), path,
+    });
+    try {
+        if (await exists(join(root, PROJECT_SKILLS_DECLARATION_PATH))) {
+            const file = await safePath(root, PROJECT_SKILLS_DECLARATION_PATH);
+            if ((await lstat(file)).size > 1024 * 1024)
+                throw new ProjectSkillsError('source_limit', PROJECT_SKILLS_DECLARATION_PATH);
+            result.declaration = parseProjectSkillDeclaration(await readFile(file, 'utf8'));
+        }
+    }
+    catch (error) {
+        issue(error, PROJECT_SKILLS_DECLARATION_PATH);
+    }
+    for (const sourceRoot of PROJECT_SKILL_SOURCE_ROOTS) {
+        try {
+            if (!await exists(join(root, sourceRoot)))
+                continue;
+            const directory = await safePath(root, sourceRoot);
+            for (const name of (await readdir(directory)).sort()) {
+                const source = `${sourceRoot}/${name}`;
+                const safe = await safePath(root, source);
+                if (!(await lstat(safe)).isDirectory())
+                    continue;
+                if (!await exists(join(safe, 'SKILL.md'))) {
+                    result.issues.push({ code: 'unrecognized_entry', path: source, detail: 'A skill directory must contain SKILL.md at its root' });
+                    continue;
+                }
+                result.discovered.push({ root: source, entryKey: `repo-${createHash('sha256').update(source).digest('hex').slice(0, 24)}` });
+            }
+        }
+        catch (error) {
+            issue(error, sourceRoot);
+        }
+    }
+    const declaredRoots = new Set(result.declaration?.entries.flatMap((entry) => entry.source.kind === 'repository' ? [entry.source.root] : []) ?? []);
+    const entries = [
+        ...(result.declaration?.entries ?? []),
+        ...result.discovered.filter((item) => !declaredRoots.has(item.root)).map((item) => ({
+            entryKey: item.entryKey, source: { kind: 'repository', root: item.root },
+            enabled: result.declaration === null, surface: 'sandbox-agent',
+        })),
+    ];
+    for (const entry of entries) {
+        if (entry.source.kind !== 'repository')
+            continue;
+        try {
+            result.sources.push(await readProjectSkillSource(root, entry));
+        }
+        catch (error) {
+            issue(error, entry.source.root);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=inventory.js.map

package/dist/project-skills/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../src/project-skills/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAAE,wBAAwB,EAAE,kBAAkB,GAE9E,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,CAAU,CAAC;AAQ/H,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,WAAmB;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QACtH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACtG,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAgB;IACpD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB,EAAE,KAAwB;IACxF,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,KAAK,EAAE,WAAmB,EAAE,UAAkB,EAAiB,EAAE;QAC5E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,cAAc;oBAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC7H,MAAM,IAAI,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,GAAG,cAAc,IAAI,KAAK,GAAG,gBAAgB;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC/H,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3H,4FAA4F;IAC5F,IAAI,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE;QAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,QAAQ,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAA0B,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrG,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAClE,IAAI,EAAE,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;QAC7E,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI;KACrE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;YAC1H,MAAM,CAAC,WAAW,GAAG,4BAA4B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,KAAK,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAAC,CAAC;IAClE,KAAK,MAAM,UAAU,IAAI,0BAA0B,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAAE,SAAS;YACpD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACjD,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;oBAChI,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;IAC/C,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACnJ,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;QACtC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAqB,EAAE,CAAC,CAAC;YACrG,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACxE,OAAO,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,OAAO,EAAE,eAAe;SAC/D,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QACjD,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAAC,CAAC;QACvE,OAAO,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/project-skills/local-snapshot.d.ts

@@ -0,0 +1,12 @@
+import type { ProjectSkillInventory } from './inventory.js';
+import { type ProjectSkillsLockV3, type ProjectSkillDeclaration } from './types.js';
+/** Offline identity is a provenance label, never an access grant on the server. */
+export declare function buildLocalProjectSkillsSnapshot(inventory: ProjectSkillInventory, previous?: unknown): {
+    declaration: ProjectSkillDeclaration;
+    lock: ProjectSkillsLockV3;
+    artifacts: {
+        artifactHash: string;
+        archive: Buffer;
+    }[];
+};
+//# sourceMappingURL=local-snapshot.d.ts.map

package/dist/project-skills/local-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-snapshot.d.ts","sourceRoot":"","sources":["../../src/project-skills/local-snapshot.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAsB,KAAK,mBAAmB,EAAE,KAAK,uBAAuB,EAA8B,MAAM,YAAY,CAAC;AAEpI,mFAAmF;AACnF,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,CAAC,EAAE,OAAO;;;;sBAW3D,MAAM;iBAAW,MAAM;;EAmC/D"}

package/dist/project-skills/local-snapshot.js

@@ -0,0 +1,66 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createCanonicalBundleArchive } from './bundle-archive.js';
+import { declarationDigest, dependencyDigest, parseProjectSkillsLock, validateProjectSkillsSnapshot } from './protocol.js';
+import { ProjectSkillsError } from './types.js';
+/** Offline identity is a provenance label, never an access grant on the server. */
+export function buildLocalProjectSkillsSnapshot(inventory, previous) {
+    if (inventory.issues.length)
+        throw new ProjectSkillsError('inventory_invalid', JSON.stringify(inventory.issues));
+    const old = previous === undefined ? null : parseProjectSkillsLock(previous);
+    if (old && !inventory.declaration)
+        throw new ProjectSkillsError('missing_declaration', 'A managed lock requires its declaration');
+    const declaration = structuredClone(inventory.declaration ?? { schemaVersion: 1, entries: [] });
+    const roots = new Set(declaration.entries.flatMap((entry) => entry.source.kind === 'repository' ? [entry.source.root] : []));
+    for (const found of inventory.discovered)
+        if (!roots.has(found.root))
+            declaration.entries.push({
+                entryKey: found.entryKey, source: { kind: 'repository', root: found.root }, enabled: !inventory.declaration && !old, surface: 'sandbox-agent',
+            });
+    const oldByKey = new Map(old?.entries.map((entry) => [entry.entryKey, entry]) ?? []);
+    const localNamespace = `local-${randomUUID()}`;
+    const artifacts = [];
+    const required = new Map();
+    const entries = declaration.entries.map((entry) => {
+        const previous = oldByKey.get(entry.entryKey);
+        if (entry.source.kind === 'registry') {
+            if (!previous || previous.revision.kind !== 'release' || previous.revision.skillRef !== entry.source.skillRef || previous.revision.version !== entry.source.version) {
+                throw new ProjectSkillsError('missing_release', `An authorized exact release must be downloaded first: ${entry.entryKey}`);
+            }
+            return structuredClone(previous);
+        }
+        const source = inventory.sources.find((source) => source.entryKey === entry.entryKey);
+        if (!source)
+            throw new ProjectSkillsError('missing_source', entry.entryKey);
+        const archive = createCanonicalBundleArchive(source.files.map((file) => ({ path: file.path, data: Buffer.from(file.content) })));
+        const artifactHash = createHash('sha256').update(archive).digest('hex');
+        artifacts.push({ artifactHash, archive });
+        entry.source.skillRef ??= previous?.revision.skillRef ?? `${localNamespace}/${entry.entryKey}`;
+        const manifestFile = source.files.find((file) => file.path === 'manifest.json');
+        if (manifestFile) {
+            const manifest = JSON.parse(Buffer.from(manifestFile.content).toString('utf8'));
+            if (manifest.imports?.some((item) => item.edgeKind !== 'optional'))
+                throw new ProjectSkillsError('dependency_unresolved', entry.entryKey);
+            required.set(entry.entryKey, (manifest.relationships ?? []).filter((edge) => edge.relationType === 'requires')
+                .map((edge) => edge.toSkillRef ?? edge.targetSkillRef));
+        }
+        return { entryKey: entry.entryKey, revision: { kind: 'source', skillRef: entry.source.skillRef, sourceRevision: `src-v1-sha256:${source.sourceTreeHash}`, artifactHash },
+            sourceTreeHash: source.sourceTreeHash, dependencies: [], dependencyLockHash: '' };
+    });
+    const refToKey = new Map(entries.map((entry) => [entry.revision.skillRef, entry.entryKey]));
+    if (refToKey.size !== entries.length)
+        throw new ProjectSkillsError('duplicate_identity', 'Duplicate skill reference');
+    for (const entry of entries)
+        if (entry.revision.kind === 'source')
+            entry.dependencies = (required.get(entry.entryKey) ?? []).map((ref) => {
+                const key = refToKey.get(ref);
+                if (!key)
+                    throw new ProjectSkillsError('dependency_unresolved', ref);
+                return key;
+            });
+    for (const entry of entries)
+        entry.dependencyLockHash = dependencyDigest(entries, entry.dependencies);
+    const lock = { lockVersion: 3, declarationHash: declarationDigest(declaration), entries };
+    validateProjectSkillsSnapshot(declaration, lock);
+    return { declaration, lock, artifacts };
+}
+//# sourceMappingURL=local-snapshot.js.map

package/dist/project-skills/local-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-snapshot.js","sourceRoot":"","sources":["../../src/project-skills/local-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAE3H,OAAO,EAAE,kBAAkB,EAAsF,MAAM,YAAY,CAAC;AAEpI,mFAAmF;AACnF,MAAM,UAAU,+BAA+B,CAAC,SAAgC,EAAE,QAAkB;IAClG,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjH,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW;QAAE,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IAClI,MAAM,WAAW,GAA4B,eAAe,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7H,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC7F,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe;aAC9I,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,cAAc,GAAG,SAAS,UAAU,EAAE,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAqD,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,MAAM,OAAO,GAA4B,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpK,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,yDAAyD,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjI,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,SAAS,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,GAAG,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/F,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAChF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjK,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAA+B,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,UAAU,CAAC;iBACtI,GAAG,CAAC,CAAC,IAAsD,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,iBAAiB,MAAM,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE;YACtK,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;IACtH,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,YAAY,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvI,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC;YAClH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,KAAK,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtG,MAAM,IAAI,GAAwB,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,iBAAiB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/G,6BAA6B,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC"}