@polpo-ai/core 0.18.22 → 0.18.24

package/dist/skill-activation.js

@@ -0,0 +1,78 @@
+/** Maximum number of skills that a caller may explicitly activate per run. */
+export const MAX_ACTIVATED_SKILLS = 16;
+/** Maximum length of a skill identifier accepted by runtime surfaces. */
+export const MAX_ACTIVATED_SKILL_NAME_LENGTH = 256;
+/** Reject malformed persisted or host-resolved activation snapshots. */
+export function normalizeActivatedSkillReferences(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > MAX_ACTIVATED_SKILLS) {
+        throw new SkillActivationError("Activated skill references are invalid");
+    }
+    const seen = new Set();
+    return value.map((item, index) => {
+        if (!item || typeof item !== "object" || Array.isArray(item)) {
+            throw new SkillActivationError(`Activated skill reference at index ${index} must be an object`);
+        }
+        const name = item.name;
+        const digest = item.digest;
+        if (typeof name !== "string" || name.length === 0 || name.length > MAX_ACTIVATED_SKILL_NAME_LENGTH) {
+            throw new SkillActivationError(`Activated skill reference at index ${index} has an invalid name`);
+        }
+        if (digest !== undefined && (typeof digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(digest))) {
+            throw new SkillActivationError(`Activated skill reference "${name}" has an invalid digest`);
+        }
+        if (seen.has(name))
+            throw new SkillActivationError(`Duplicate activated skill reference: ${name}`);
+        seen.add(name);
+        return digest === undefined ? { name } : { name, digest };
+    });
+}
+export class SkillActivationError extends Error {
+    code = "skill_activation_invalid";
+    constructor(message) {
+        super(message);
+        this.name = "SkillActivationError";
+    }
+}
+/**
+ * Normalize the additive skill selection shared by chat, Tasks and Schedules.
+ * Undefined means "no explicit activation"; an explicit empty array is invalid.
+ */
+export function normalizeActivatedSkills(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ACTIVATED_SKILLS) {
+        throw new SkillActivationError(`Activated skills must contain between 1 and ${MAX_ACTIVATED_SKILLS} names`);
+    }
+    const normalized = [];
+    const seen = new Set();
+    for (const [index, item] of value.entries()) {
+        if (typeof item !== "string") {
+            throw new SkillActivationError(`Activated skill at index ${index} must be a string`);
+        }
+        const name = item.trim();
+        if (name.length === 0 || name.length > MAX_ACTIVATED_SKILL_NAME_LENGTH) {
+            throw new SkillActivationError(`Activated skill at index ${index} must contain between 1 and ${MAX_ACTIVATED_SKILL_NAME_LENGTH} characters`);
+        }
+        if (seen.has(name)) {
+            throw new SkillActivationError(`Duplicate activated skill: ${name}`);
+        }
+        seen.add(name);
+        normalized.push(name);
+    }
+    return normalized;
+}
+/** Validate that explicit activation cannot grant a skill the agent was not assigned. */
+export function requireAssignedActivatedSkills(requested, assigned) {
+    const normalized = normalizeActivatedSkills(requested);
+    if (!normalized)
+        return undefined;
+    const assignedNames = new Set((assigned ?? []).filter((name) => typeof name === "string"));
+    const missing = normalized.find((name) => !assignedNames.has(name));
+    if (missing) {
+        throw new SkillActivationError(`Skill "${missing}" is not assigned to the selected agent`);
+    }
+    return normalized;
+}
+//# sourceMappingURL=skill-activation.js.map

package/dist/skill-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-activation.js","sourceRoot":"","sources":["../src/skill-activation.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AASnD,wEAAwE;AACxE,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,KAAK,oBAAoB,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC/C,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACnG,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,KAAK,sBAAsB,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,IAAI,yBAAyB,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACvF,MAAM,IAAI,oBAAoB,CAC5B,+CAA+C,oBAAoB,QAAQ,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,KAAK,mBAAmB,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACvE,MAAM,IAAI,oBAAoB,CAC5B,4BAA4B,KAAK,+BAA+B,+BAA+B,aAAa,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,8BAA8B,CAC5C,SAAkB,EAClB,QAAuC;IAEvC,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC5E,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,UAAU,OAAO,yCAAyC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/skill-activation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-activation.test.d.ts.map

package/dist/skill-activation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-activation.test.d.ts","sourceRoot":"","sources":["../src/skill-activation.test.ts"],"names":[],"mappings":""}

package/dist/skill-activation.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { MAX_ACTIVATED_SKILLS, normalizeActivatedSkillReferences, normalizeActivatedSkills, requireAssignedActivatedSkills, } from "./skill-activation.js";
+describe("skill activation", () => {
+    it("normalizes a bounded additive selection", () => {
+        expect(normalizeActivatedSkills([" frontend-design ", "testing"])).toEqual([
+            "frontend-design",
+            "testing",
+        ]);
+        expect(normalizeActivatedSkills(undefined)).toBeUndefined();
+    });
+    it.each([
+        { skills: [] },
+        { skills: [""] },
+        { skills: ["frontend-design", " frontend-design "] },
+        { skills: Array.from({ length: MAX_ACTIVATED_SKILLS + 1 }, (_, index) => `skill-${index}`) },
+        { skills: [42] },
+    ])("rejects an invalid selection: $skills", ({ skills }) => {
+        expect(() => normalizeActivatedSkills(skills)).toThrow();
+    });
+    it("rejects activation of a skill not assigned to the agent", () => {
+        expect(() => requireAssignedActivatedSkills(["security-review"], ["frontend-design"])).toThrow(/not assigned/i);
+        expect(requireAssignedActivatedSkills(["frontend-design"], ["frontend-design", "testing"])).toEqual(["frontend-design"]);
+    });
+    it("normalizes immutable activation references used by checkpoints", () => {
+        const digest = `sha256:${"a".repeat(64)}`;
+        expect(normalizeActivatedSkillReferences([
+            { name: "frontend-design", digest },
+            { name: "legacy-skill" },
+        ])).toEqual([
+            { name: "frontend-design", digest },
+            { name: "legacy-skill" },
+        ]);
+    });
+    it.each([
+        { references: [{ name: "frontend-design", digest: "sha256:bad" }] },
+        { references: [{ name: "" }] },
+        { references: [{ name: "frontend-design" }, { name: "frontend-design" }] },
+        { references: ["frontend-design"] },
+    ])("rejects malformed immutable activation references: $references", ({ references }) => {
+        expect(() => normalizeActivatedSkillReferences(references)).toThrow();
+    });
+});
+//# sourceMappingURL=skill-activation.test.js.map

package/dist/skill-activation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-activation.test.js","sourceRoot":"","sources":["../src/skill-activation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAE/B,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,wBAAwB,CAAC,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,iBAAiB;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,EAAE,MAAM,EAAE,EAAE,EAAE;QACd,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE;QAChB,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,EAAE;QAC5F,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE;KACjB,CAAC,CAAC,uCAAuC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACzD,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CACzC,CAAC,iBAAiB,CAAC,EACnB,CAAC,iBAAiB,CAAC,CACpB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,8BAA8B,CACnC,CAAC,iBAAiB,CAAC,EACnB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAC/B,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,MAAM,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,iCAAiC,CAAC;YACvC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE;YACnC,EAAE,IAAI,EAAE,cAAc,EAAE;SACzB,CAAC,CAAC,CAAC,OAAO,CAAC;YACV,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE;YACnC,EAAE,IAAI,EAAE,cAAc,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE;QACnE,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE;QAC9B,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;QAC1E,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;KACpC,CAAC,CAAC,gEAAgE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;QACtF,MAAM,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/skill-archive.d.ts

@@ -0,0 +1,19 @@
+import { type SkillBundle } from "./skill-bundle.js";
+import { type SkillDiagnostic, type SkillManifest } from "./skill-manifest.js";
+export declare const SKILL_ARCHIVE_MAX_COMPRESSED_BYTES: number;
+export declare const SKILL_ARCHIVE_MAX_COMPRESSION_RATIO = 200;
+export type SkillArchiveErrorCode = "invalid_archive" | "encrypted_entry" | "unsupported_entry" | "archive_limit_exceeded" | "ambiguous_root" | "invalid_bundle" | "invalid_manifest";
+export declare class SkillArchiveError extends Error {
+    readonly code: SkillArchiveErrorCode;
+    constructor(code: SkillArchiveErrorCode, message: string);
+}
+export interface UnpackedSkillArchive {
+    bundle: SkillBundle;
+    manifest: SkillManifest;
+    diagnostics: SkillDiagnostic[];
+    digest: string;
+    uncompressedBytes: number;
+}
+export declare function unpackSkillArchive(input: Uint8Array): Promise<UnpackedSkillArchive>;
+export declare function packSkillArchive(bundle: SkillBundle): Promise<Uint8Array>;
+//# sourceMappingURL=skill-archive.d.ts.map

package/dist/skill-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-archive.d.ts","sourceRoot":"","sources":["../src/skill-archive.ts"],"names":[],"mappings":"AACA,OAAO,EASL,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnG,eAAO,MAAM,kCAAkC,QAAmB,CAAC;AACnE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAIlE;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AASD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgEzF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuB/E"}

package/dist/skill-archive.js

@@ -0,0 +1,230 @@
+import { unzipSync, zipSync } from "fflate";
+import { SKILL_BUNDLE_MAX_FILES, SKILL_BUNDLE_MAX_FILE_BYTES, SKILL_BUNDLE_MAX_PATH_LENGTH, SKILL_BUNDLE_MAX_TOTAL_BYTES, decodeBase64, digestSkillBundle, encodeBase64, validateSkillBundleFiles, } from "./skill-bundle.js";
+import { parseSkillManifest } from "./skill-manifest.js";
+export const SKILL_ARCHIVE_MAX_COMPRESSED_BYTES = 30 * 1024 * 1024;
+export const SKILL_ARCHIVE_MAX_COMPRESSION_RATIO = 200;
+export class SkillArchiveError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "SkillArchiveError";
+    }
+}
+export async function unpackSkillArchive(input) {
+    if (input.byteLength === 0 || input.byteLength > SKILL_ARCHIVE_MAX_COMPRESSED_BYTES) {
+        throw new SkillArchiveError("archive_limit_exceeded", "Skill archive compressed size is outside the supported limit");
+    }
+    const inventory = inspectCentralDirectory(input);
+    const files = inventory.filter((entry) => !entry.directory);
+    if (files.length === 0 || files.length > SKILL_BUNDLE_MAX_FILES) {
+        throw new SkillArchiveError("archive_limit_exceeded", `Skill archive must contain 1 to ${SKILL_BUNDLE_MAX_FILES} files`);
+    }
+    let totalBytes = 0;
+    for (const entry of files) {
+        if (entry.uncompressedBytes > SKILL_BUNDLE_MAX_FILE_BYTES) {
+            throw new SkillArchiveError("archive_limit_exceeded", `Skill archive file is too large: ${entry.path}`);
+        }
+        if (entry.compressedBytes === 0 && entry.uncompressedBytes > 0) {
+            throw new SkillArchiveError("archive_limit_exceeded", `Skill archive entry has an invalid compression ratio: ${entry.path}`);
+        }
+        if (entry.compressedBytes > 0 && entry.uncompressedBytes / entry.compressedBytes > SKILL_ARCHIVE_MAX_COMPRESSION_RATIO) {
+            throw new SkillArchiveError("archive_limit_exceeded", `Skill archive entry exceeds the compression-ratio limit: ${entry.path}`);
+        }
+        totalBytes += entry.uncompressedBytes;
+        if (totalBytes > SKILL_BUNDLE_MAX_TOTAL_BYTES) {
+            throw new SkillArchiveError("archive_limit_exceeded", "Skill archive exceeds the uncompressed size limit");
+        }
+    }
+    const root = resolveArchiveRoot(files.map((entry) => entry.path));
+    let expanded;
+    try {
+        expanded = unzipSync(input);
+    }
+    catch (error) {
+        throw new SkillArchiveError("invalid_archive", `Skill archive could not be decompressed: ${errorMessage(error)}`);
+    }
+    const bundleFiles = [];
+    for (const entry of files) {
+        const bytes = expanded[entry.path];
+        if (!bytes || bytes.byteLength !== entry.uncompressedBytes) {
+            throw new SkillArchiveError("invalid_archive", `Skill archive entry is missing or has an invalid size: ${entry.path}`);
+        }
+        const path = root ? entry.path.slice(root.length + 1) : entry.path;
+        bundleFiles.push({ path, content: encodeBase64(bytes), encoding: "base64" });
+    }
+    bundleFiles.sort((left, right) => compareStrings(left.path, right.path));
+    const skillFile = bundleFiles.find((file) => file.path === "SKILL.md");
+    if (!skillFile)
+        throw new SkillArchiveError("ambiguous_root", "Skill archive must contain one root SKILL.md");
+    let parsed;
+    try {
+        const candidate = new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64(skillFile.content));
+        parsed = parseSkillManifest(candidate, { mode: "strict", directoryName: root || undefined });
+    }
+    catch (error) {
+        throw new SkillArchiveError("invalid_manifest", errorMessage(error));
+    }
+    const bundle = { name: parsed.manifest.name, files: bundleFiles };
+    const validationError = validateSkillBundleFiles(bundle.files);
+    if (validationError)
+        throw new SkillArchiveError("invalid_bundle", validationError);
+    return {
+        bundle,
+        manifest: parsed.manifest,
+        diagnostics: parsed.diagnostics,
+        digest: await digestSkillBundle(bundle),
+        uncompressedBytes: totalBytes,
+    };
+}
+export async function packSkillArchive(bundle) {
+    const validationError = validateSkillBundleFiles(bundle.files);
+    if (validationError)
+        throw new SkillArchiveError("invalid_bundle", validationError);
+    const skillFile = bundle.files.find((file) => file.path === "SKILL.md");
+    try {
+        const content = new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64(skillFile.content));
+        parseSkillManifest(content, { mode: "strict", directoryName: bundle.name });
+    }
+    catch (error) {
+        throw new SkillArchiveError("invalid_manifest", errorMessage(error));
+    }
+    const archive = {};
+    for (const file of [...bundle.files].sort((left, right) => compareStrings(left.path, right.path))) {
+        archive[`${bundle.name}/${file.path}`] = [decodeBase64(file.content), {
+                level: 6,
+                // fflate writes DOS timestamps through local Date getters. Constructing
+                // local midnight keeps the archive bytes stable across host timezones.
+                mtime: new Date(1980, 0, 1, 0, 0, 0),
+                os: 3,
+                attrs: 0o100644 << 16,
+            }];
+    }
+    return zipSync(archive, { level: 6 });
+}
+function resolveArchiveRoot(paths) {
+    if (paths.includes("SKILL.md")) {
+        if (paths.some((path) => path !== "SKILL.md" && !path.includes("/"))) {
+            throw new SkillArchiveError("ambiguous_root", "Root-layout skill archives cannot contain unrelated root files");
+        }
+        return "";
+    }
+    const roots = new Set(paths.map((path) => path.split("/", 1)[0]));
+    if (roots.size !== 1)
+        throw new SkillArchiveError("ambiguous_root", "Skill archive must contain exactly one skill root");
+    const root = [...roots][0];
+    if (!paths.includes(`${root}/SKILL.md`)) {
+        throw new SkillArchiveError("ambiguous_root", "Skill archive must contain SKILL.md at its root");
+    }
+    return root;
+}
+function inspectCentralDirectory(input) {
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const eocd = findEndOfCentralDirectory(view);
+    const disk = view.getUint16(eocd + 4, true);
+    const centralDisk = view.getUint16(eocd + 6, true);
+    const diskEntries = view.getUint16(eocd + 8, true);
+    const totalEntries = view.getUint16(eocd + 10, true);
+    const centralSize = view.getUint32(eocd + 12, true);
+    const centralOffset = view.getUint32(eocd + 16, true);
+    if (disk !== 0 || centralDisk !== 0 || diskEntries !== totalEntries) {
+        throw new SkillArchiveError("unsupported_entry", "Multi-disk ZIP archives are not supported");
+    }
+    if (totalEntries === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff) {
+        throw new SkillArchiveError("unsupported_entry", "ZIP64 archives are not supported");
+    }
+    if (centralOffset + centralSize > eocd || totalEntries > SKILL_BUNDLE_MAX_FILES * 2) {
+        throw new SkillArchiveError("invalid_archive", "ZIP central directory is outside the archive bounds");
+    }
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const paths = new Set();
+    const foldedPaths = new Set();
+    const entries = [];
+    let offset = centralOffset;
+    for (let index = 0; index < totalEntries; index += 1) {
+        if (offset + 46 > eocd || view.getUint32(offset, true) !== 0x02014b50) {
+            throw new SkillArchiveError("invalid_archive", "ZIP central directory entry is invalid");
+        }
+        const madeBy = view.getUint16(offset + 4, true);
+        const flags = view.getUint16(offset + 8, true);
+        const method = view.getUint16(offset + 10, true);
+        const compressedBytes = view.getUint32(offset + 20, true);
+        const uncompressedBytes = view.getUint32(offset + 24, true);
+        const nameLength = view.getUint16(offset + 28, true);
+        const extraLength = view.getUint16(offset + 30, true);
+        const commentLength = view.getUint16(offset + 32, true);
+        const diskStart = view.getUint16(offset + 34, true);
+        const externalAttributes = view.getUint32(offset + 38, true);
+        const end = offset + 46 + nameLength + extraLength + commentLength;
+        if (end > eocd)
+            throw new SkillArchiveError("invalid_archive", "ZIP entry metadata is truncated");
+        if ((flags & 1) !== 0)
+            throw new SkillArchiveError("encrypted_entry", "Encrypted skill archive entries are not supported");
+        if (method !== 0 && method !== 8)
+            throw new SkillArchiveError("unsupported_entry", `Unsupported ZIP compression method: ${method}`);
+        if (diskStart !== 0 || compressedBytes === 0xffffffff || uncompressedBytes === 0xffffffff) {
+            throw new SkillArchiveError("unsupported_entry", "ZIP64 or multi-disk entries are not supported");
+        }
+        let path;
+        try {
+            path = decoder.decode(input.subarray(offset + 46, offset + 46 + nameLength));
+        }
+        catch {
+            throw new SkillArchiveError("invalid_archive", "ZIP entry names must be valid UTF-8");
+        }
+        const directory = path.endsWith("/");
+        const normalized = directory ? path.slice(0, -1) : path;
+        validateArchivePath(normalized);
+        const host = madeBy >>> 8;
+        const unixMode = host === 3 ? externalAttributes >>> 16 : 0;
+        const kind = unixMode & 0o170000;
+        if (kind !== 0 && kind !== 0o100000 && !(directory && kind === 0o040000)) {
+            throw new SkillArchiveError("unsupported_entry", `Skill archive contains a non-regular entry: ${path}`);
+        }
+        if (!directory) {
+            if (paths.has(normalized))
+                throw new SkillArchiveError("invalid_archive", `Duplicate ZIP entry: ${normalized}`);
+            const folded = normalized.toLocaleLowerCase("en-US");
+            if (foldedPaths.has(folded))
+                throw new SkillArchiveError("invalid_archive", `Case-colliding ZIP entry: ${normalized}`);
+            paths.add(normalized);
+            foldedPaths.add(folded);
+        }
+        entries.push({ path, compressedBytes, uncompressedBytes, directory });
+        offset = end;
+    }
+    if (offset !== centralOffset + centralSize) {
+        throw new SkillArchiveError("invalid_archive", "ZIP central directory size does not match its entries");
+    }
+    return entries;
+}
+function validateArchivePath(path) {
+    if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || path !== path.normalize("NFC")) {
+        throw new SkillArchiveError("invalid_archive", `Invalid skill archive path: ${path}`);
+    }
+    const segments = path.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new SkillArchiveError("invalid_archive", `Invalid skill archive path: ${path}`);
+    }
+    if (new TextEncoder().encode(path).byteLength > SKILL_BUNDLE_MAX_PATH_LENGTH + 65) {
+        throw new SkillArchiveError("archive_limit_exceeded", `Skill archive path is too long: ${path}`);
+    }
+}
+function findEndOfCentralDirectory(view) {
+    const minimum = Math.max(0, view.byteLength - 65_557);
+    for (let offset = view.byteLength - 22; offset >= minimum; offset -= 1) {
+        if (view.getUint32(offset, true) === 0x06054b50) {
+            const commentLength = view.getUint16(offset + 20, true);
+            if (offset + 22 + commentLength === view.byteLength)
+                return offset;
+        }
+    }
+    throw new SkillArchiveError("invalid_archive", "ZIP end-of-central-directory record was not found");
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+//# sourceMappingURL=skill-archive.js.map

package/dist/skill-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-archive.js","sourceRoot":"","sources":["../src/skill-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,GAGzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAA4C,MAAM,qBAAqB,CAAC;AAEnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAWvD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAA2B,EAAE,OAAe;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAuB;QAE9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAiBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAiB;IACxD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,kCAAkC,EAAE,CAAC;QACpF,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,mCAAmC,sBAAsB,QAAQ,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,iBAAiB,GAAG,2BAA2B,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,oCAAoC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,yDAAyD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,IAAI,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,eAAe,GAAG,mCAAmC,EAAE,CAAC;YACvH,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,4DAA4D,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,UAAU,IAAI,KAAK,CAAC,iBAAiB,CAAC;QACtC,IAAI,UAAU,GAAG,4BAA4B,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,mDAAmD,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,QAAoC,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,4CAA4C,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,0DAA0D,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC;IAE9G,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpG,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC/E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,eAAe;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAEpF,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC;QACvC,iBAAiB,EAAE,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAmB;IACxD,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,eAAe;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAClG,kBAAkB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACpE,KAAK,EAAE,CAAC;gBACR,wEAAwE;gBACxE,uEAAuE;gBACvE,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpC,EAAE,EAAE,CAAC;gBACL,KAAK,EAAE,QAAQ,IAAI,EAAE;aACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,gEAAgE,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,mDAAmD,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAiB;IAChD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,YAAY,KAAK,MAAM,IAAI,WAAW,KAAK,UAAU,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QAC1F,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,aAAa,GAAG,WAAW,GAAG,IAAI,IAAI,YAAY,GAAG,sBAAsB,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QACnE,IAAI,GAAG,GAAG,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAClG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC3H,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,uCAAuC,MAAM,EAAE,CAAC,CAAC;QACpI,IAAI,SAAS,KAAK,CAAC,IAAI,eAAe,KAAK,UAAU,IAAI,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC1F,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACjC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,wBAAwB,UAAU,EAAE,CAAC,CAAC;YAChH,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,6BAA6B,UAAU,EAAE,CAAC,CAAC;YACvH,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,GAAG,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,4BAA4B,GAAG,EAAE,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAc;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;IACtD,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,GAAG,EAAE,GAAG,aAAa,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,MAAM,CAAC;QACrE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/skill-bundle-store.d.ts

@@ -0,0 +1,57 @@
+import type { SkillBundle, SkillBundleReceipt, SkillBundleSource } from "./skill-bundle.js";
+import type { SkillManifest } from "./skill-manifest.js";
+/** A bundle that has passed the canonical manifest, path, size and digest checks. */
+export interface ValidatedSkillBundle {
+    bundle: SkillBundle;
+    manifest: SkillManifest;
+    digest: string;
+    uncompressedBytes: number;
+    source: SkillBundleSource | string;
+}
+/** One immutable version returned by a SkillBundleStore. */
+export interface StoredSkillBundle extends ValidatedSkillBundle {
+    /** Host-specific immutable root when resources can be mounted into a sandbox. */
+    root?: string;
+    createdAt?: string;
+}
+export interface StoredSkillSummary {
+    name: string;
+    description: string;
+    digest: string;
+    files: number;
+    uncompressedBytes: number;
+    source: SkillBundleSource | string;
+    allowedTools?: string[];
+    root?: string;
+    createdAt?: string;
+}
+export interface SkillBundlePutOptions {
+    conflict: "error" | "replace";
+    /** Compare-and-swap precondition for the currently active digest. */
+    expectedDigest?: string;
+}
+export interface SkillBundleDeleteOptions {
+    /** Compare-and-swap precondition for the currently active digest. */
+    expectedDigest?: string;
+}
+/**
+ * Portable content-addressed skill storage contract.
+ *
+ * `get(name)` resolves the active version. `get(name, digest)` resolves that
+ * exact immutable version so a checkpoint can resume without drifting after
+ * a replacement. Implementations must never expose a partially written
+ * bundle as active.
+ */
+export interface SkillBundleStore {
+    get(name: string, digest?: string): Promise<StoredSkillBundle | null>;
+    put(input: ValidatedSkillBundle, options: SkillBundlePutOptions): Promise<SkillBundleReceipt>;
+    delete(name: string, options?: SkillBundleDeleteOptions): Promise<boolean>;
+    list(): Promise<StoredSkillSummary[]>;
+}
+export type SkillBundleStoreConflictCode = "skill_conflict" | "skill_digest_conflict";
+export declare class SkillBundleStoreConflictError extends Error {
+    readonly code: SkillBundleStoreConflictCode;
+    readonly currentDigest?: string | undefined;
+    constructor(code: SkillBundleStoreConflictCode, message: string, currentDigest?: string | undefined);
+}
+//# sourceMappingURL=skill-bundle-store.d.ts.map

package/dist/skill-bundle-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-bundle-store.d.ts","sourceRoot":"","sources":["../src/skill-bundle-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;CACpC;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAkB,SAAQ,oBAAoB;IAC7D,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,4BAA4B,GAAG,gBAAgB,GAAG,uBAAuB,CAAC;AAEtF,qBAAa,6BAA8B,SAAQ,KAAK;IAEpD,QAAQ,CAAC,IAAI,EAAE,4BAA4B;IAE3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM;gBAFtB,IAAI,EAAE,4BAA4B,EAC3C,OAAO,EAAE,MAAM,EACN,aAAa,CAAC,EAAE,MAAM,YAAA;CAKlC"}

package/dist/skill-bundle-store.js

@@ -0,0 +1,11 @@
+export class SkillBundleStoreConflictError extends Error {
+    code;
+    currentDigest;
+    constructor(code, message, currentDigest) {
+        super(message);
+        this.code = code;
+        this.currentDigest = currentDigest;
+        this.name = "SkillBundleStoreConflictError";
+    }
+}
+//# sourceMappingURL=skill-bundle-store.js.map

package/dist/skill-bundle-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-bundle-store.js","sourceRoot":"","sources":["../src/skill-bundle-store.ts"],"names":[],"mappings":"AA2DA,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAE3C;IAEA;IAHX,YACW,IAAkC,EAC3C,OAAe,EACN,aAAsB;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAA8B;QAElC,kBAAa,GAAb,aAAa,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF"}

package/dist/skill-bundle.d.ts

@@ -10,6 +10,21 @@ export interface SkillBundle {
     name: string;
     files: SkillBundleFile[];
 }
+export type SkillBundleSource = "archive" | "directory" | "git" | "builder" | "bundle";
+export interface SkillBundleReceipt {
+    name: string;
+    digest: string;
+    files: number;
+    uncompressedBytes: number;
+    changed: boolean;
+    source: SkillBundleSource | string;
+    assignedTo?: string[];
+    warnings: Array<{
+        code: string;
+        message: string;
+        severity: "warning";
+    }>;
+}
 export declare const SKILL_BUNDLE_MAX_FILES = 512;
 export declare const SKILL_BUNDLE_MAX_FILE_BYTES: number;
 export declare const SKILL_BUNDLE_MAX_TOTAL_BYTES: number;
@@ -18,4 +33,8 @@ export declare function validateSkillName(name: string): string | null;
 export declare function decodedBase64Size(value: string): number;
 /** Validate a complete bundle before any filesystem mutation occurs. */
 export declare function validateSkillBundleFiles(files: readonly SkillBundleFile[]): string | null;
+/** Compute a stable content digest independent of archive metadata and file order. */
+export declare function digestSkillBundle(bundle: SkillBundle): Promise<string>;
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64(value: string): Uint8Array;
 //# sourceMappingURL=skill-bundle.d.ts.map

package/dist/skill-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-bundle.d.ts","sourceRoot":"","sources":["../src/skill-bundle.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmB,CAAC;AAC7D,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAKhD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,GAAG,IAAI,CA2CzF"}
+{"version":3,"file":"skill-bundle.d.ts","sourceRoot":"","sources":["../src/skill-bundle.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CACzE;AAED,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,QAAmB,CAAC;AAC7D,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,GAAG,IAAI,CAkDzF;AAED,sFAAsF;AACtF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQtD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAKtD"}

package/dist/skill-bundle.js

@@ -1,14 +1,11 @@
+import { validateAgentSkillName } from "./skill-manifest.js";
 export const SKILL_BUNDLE_MAX_FILES = 512;
-export const SKILL_BUNDLE_MAX_FILE_BYTES = 5 * 1024 * 1024;
-export const SKILL_BUNDLE_MAX_TOTAL_BYTES = 10 * 1024 * 1024;
+export const SKILL_BUNDLE_MAX_FILE_BYTES = 10 * 1024 * 1024;
+export const SKILL_BUNDLE_MAX_TOTAL_BYTES = 30 * 1024 * 1024;
 export const SKILL_BUNDLE_MAX_PATH_LENGTH = 240;
-const SAFE_SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 export function validateSkillName(name) {
-    if (!SAFE_SKILL_NAME.test(name) || name === "." || name === "..") {
-        return "Skill name must be a safe directory name";
-    }
-    return null;
+    return validateAgentSkillName(name);
 }
 export function decodedBase64Size(value) {
     if (value.length === 0)
@@ -24,6 +21,7 @@ export function validateSkillBundleFiles(files) {
         return `Skill bundle exceeds the ${SKILL_BUNDLE_MAX_FILES}-file limit`;
     }
     const paths = new Set();
+    const foldedPaths = new Map();
     let totalBytes = 0;
     for (const file of files) {
         if (!file || file.encoding !== "base64" || typeof file.path !== "string" || typeof file.content !== "string") {
@@ -33,7 +31,9 @@ export function validateSkillBundleFiles(files) {
             file.path.length > SKILL_BUNDLE_MAX_PATH_LENGTH ||
             file.path.startsWith("/") ||
             file.path.includes("\\") ||
-            file.path.includes("\0")) {
+            file.path.includes("\0") ||
+            file.path !== file.path.normalize("NFC") ||
+            new TextEncoder().encode(file.path).byteLength > SKILL_BUNDLE_MAX_PATH_LENGTH) {
             return `Invalid skill bundle path: ${file.path}`;
         }
         const segments = file.path.split("/");
@@ -43,6 +43,11 @@ export function validateSkillBundleFiles(files) {
         if (paths.has(file.path))
             return `Duplicate skill bundle path: ${file.path}`;
         paths.add(file.path);
+        const folded = file.path.toLocaleLowerCase("en-US");
+        const collision = foldedPaths.get(folded);
+        if (collision)
+            return `Skill bundle path has a case-insensitive collision: ${collision} and ${file.path}`;
+        foldedPaths.set(folded, file.path);
         if (file.content.length % 4 !== 0 || !BASE64.test(file.content)) {
             return `Invalid base64 content for ${file.path}`;
         }
@@ -59,4 +64,49 @@ export function validateSkillBundleFiles(files) {
         return "Skill bundle must contain SKILL.md at its root";
     return null;
 }
+/** Compute a stable content digest independent of archive metadata and file order. */
+export async function digestSkillBundle(bundle) {
+    const nameError = validateSkillName(bundle.name);
+    if (nameError)
+        throw new TypeError(nameError);
+    const bundleError = validateSkillBundleFiles(bundle.files);
+    if (bundleError)
+        throw new TypeError(bundleError);
+    const files = [];
+    for (const file of [...bundle.files].sort((left, right) => compareStrings(left.path, right.path))) {
+        const bytes = decodeBase64(file.content);
+        files.push({
+            path: file.path,
+            bytes: bytes.byteLength,
+            sha256: await sha256Hex(bytes),
+        });
+    }
+    const canonical = new TextEncoder().encode(JSON.stringify({ version: 1, name: bundle.name, files }));
+    return `sha256:${await sha256Hex(canonical)}`;
+}
+export function encodeBase64(bytes) {
+    let binary = "";
+    const chunkSize = 0x8000;
+    for (let offset = 0; offset < bytes.byteLength; offset += chunkSize) {
+        const chunk = bytes.subarray(offset, Math.min(offset + chunkSize, bytes.byteLength));
+        binary += String.fromCharCode(...chunk);
+    }
+    return btoa(binary);
+}
+export function decodeBase64(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+async function sha256Hex(value) {
+    const input = new ArrayBuffer(value.byteLength);
+    new Uint8Array(input).set(value);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", input);
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
 //# sourceMappingURL=skill-bundle.js.map