@rhize/skill-forge 0.8.0 → 0.9.0

package/dist/cli.js

@@ -561,7 +561,7 @@ function resolveMcpCandidateDetail(profile) {
 }
 
 // src/provenance.ts
-import { appendFileSync, existsSync as existsSync6, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { appendFileSync, existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join7 } from "path";
 var FORGE_VERBS = ["DEFER", "ABSORB", "FORK", "REJECT", "WATCH"];
 var LEDGER_HEADER = "# Skill Forge \u2014 Provenance Ledger\n\nOne entry per external-skill ingestion decision.\n";
@@ -600,6 +600,55 @@ function appendProvenance(entry, skillsRoot) {
   appendFileSync(ledgerPath, block, "utf-8");
   return ledgerPath;
 }
+function extractField(block, label) {
+  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = block.match(new RegExp(`\\*\\*${escaped}:\\*\\*\\s*(.*)`));
+  return match ? match[1].trim() : void 0;
+}
+function parseProvenanceLedger(text) {
+  const entries = [];
+  const warnings = [];
+  const blocks = text.split(/\n## /);
+  for (const block of blocks.slice(1)) {
+    const headerLine = block.split("\n", 1)[0] ?? "";
+    const [namePart, ...dateParts] = headerLine.split(" \u2014 ");
+    const name = namePart?.trim();
+    if (!name) {
+      warnings.push(`skipped malformed ledger block: missing "## <name> \u2014 <date>" header (saw "${headerLine.slice(0, 80)}")`);
+      continue;
+    }
+    const date = dateParts.join(" \u2014 ").trim();
+    const verbRaw = extractField(block, "Verb");
+    if (!verbRaw || !FORGE_VERBS.includes(verbRaw)) {
+      warnings.push(`skipped malformed ledger block for "${name}": missing or invalid Verb (saw "${verbRaw ?? ""}")`);
+      continue;
+    }
+    const driftCheckMatch = block.match(/\*\*Drift check:\*\*\s*`([^`]*)`/);
+    entries.push({
+      name,
+      date,
+      source: extractField(block, "Source") ?? "",
+      upstreamRef: extractField(block, "Upstream ref") ?? "",
+      license: extractField(block, "License") ?? "",
+      verb: verbRaw,
+      target: extractField(block, "Target") ?? "",
+      took: extractField(block, "Took") ?? "",
+      verified: extractField(block, "Verified") ?? "",
+      driftCheck: driftCheckMatch ? driftCheckMatch[1] : "",
+      notes: extractField(block, "Notes") ?? ""
+    });
+  }
+  return { entries, warnings };
+}
+function readProvenanceLedger(skillsRoot) {
+  const ledgerPath = join7(skillsRoot, "SOURCES.md");
+  if (!existsSync6(ledgerPath)) {
+    return { ledgerPath, exists: false, entries: [], warnings: [] };
+  }
+  const text = readFileSync5(ledgerPath, "utf-8");
+  const parsed = parseProvenanceLedger(text);
+  return { ledgerPath, exists: true, ...parsed };
+}
 
 // src/commands/gatePipeline.ts
 import { readdirSync as readdirSync5 } from "fs";
@@ -612,7 +661,7 @@ import {
   existsSync as existsSync8,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync3,
   readSync,
   rmSync as rmSync2,
@@ -622,13 +671,13 @@ import { tmpdir } from "os";
 import { basename as basename3, dirname as dirname3, extname as extname3, join as join9, resolve as resolve2 } from "path";
 
 // src/gate/mcpCapabilities.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 import { extname as extname2, join as join8 } from "path";
 var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_ITEMS_PER_CATEGORY = 200;
 function readJsonSafe(file) {
   try {
-    return JSON.parse(readFileSync5(file, "utf-8"));
+    return JSON.parse(readFileSync6(file, "utf-8"));
   } catch {
     return void 0;
   }
@@ -856,7 +905,7 @@ function readPackageJsonSafe(root) {
   const pkgPath = join9(root, "package.json");
   if (!existsSync8(pkgPath)) return void 0;
   try {
-    return JSON.parse(readFileSync6(pkgPath, "utf-8"));
+    return JSON.parse(readFileSync7(pkgPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -1016,7 +1065,7 @@ function detectLicense(root, fm) {
   for (const name of names) {
     const p = join9(root, name);
     if (existsSync8(p) && statSync4(p).isFile()) {
-      const head = readFileSync6(p, "utf-8").slice(0, 2e3).toLowerCase();
+      const head = readFileSync7(p, "utf-8").slice(0, 2e3).toLowerCase();
       for (const [hint, label] of Object.entries(SPDX_HINTS)) {
         if (head.includes(hint)) return label;
       }
@@ -1055,7 +1104,7 @@ function scanMcpAndImports(text, root) {
   if (isDir(scriptsDir)) {
     for (const f of walkFiles(scriptsDir)) {
       if (!f.endsWith(".py")) continue;
-      const ft = readFileSync6(f, "utf-8");
+      const ft = readFileSync7(f, "utf-8");
       for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
       const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
       let m;
@@ -1072,7 +1121,7 @@ function scanMcpAndImports(text, root) {
 function profileSkillDir(inputPath) {
   const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
   try {
-    const text = readFileSync6(skillMd, "utf-8");
+    const text = readFileSync7(skillMd, "utf-8");
     const fm = parseFrontmatter(text);
     const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
     const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
@@ -1103,7 +1152,7 @@ function profilePlugin(p) {
   const manifestPath = join9(p, ".claude-plugin", "plugin.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync6(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
   }
@@ -1134,7 +1183,7 @@ function profileMcp(p) {
   if (explicitConfig) {
     let cfg;
     try {
-      cfg = JSON.parse(readFileSync6(explicitConfig, "utf-8"));
+      cfg = JSON.parse(readFileSync7(explicitConfig, "utf-8"));
     } catch (err) {
       throw new Error(`could not parse MCP config ${explicitConfig}: ${err.message}`);
     }
@@ -1153,7 +1202,7 @@ function profileMcp(p) {
   const pkgPath = join9(p, "package.json");
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync7(pkgPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse package.json ${pkgPath}: ${err.message}`);
   }
@@ -1311,7 +1360,7 @@ async function scanSafety(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/overlap.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "fs";
 import { basename as basename4, dirname as dirname4, join as join11, resolve as resolve3 } from "path";
 var STOPWORDS = new Set(
   `
@@ -1334,7 +1383,7 @@ function splitLimited(text, sep2, maxSplit) {
   return parts;
 }
 function readFrontmatter(skillMdPath) {
-  const text = readFileSync7(skillMdPath, "utf-8");
+  const text = readFileSync8(skillMdPath, "utf-8");
   const meta = { name: basename4(dirname4(skillMdPath)), description: "" };
   if (text.startsWith("---\n")) {
     const block = splitLimited(text, "---", 2)[1] ?? "";
@@ -1705,14 +1754,14 @@ async function mcpScan(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/mcpOverlap.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve4 } from "path";
 function readTargetServers(targetPath) {
   const path = resolve4(expandHome(targetPath));
   if (!existsSync10(path)) return [];
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync8(path, "utf-8"));
+    cfg = JSON.parse(readFileSync9(path, "utf-8"));
   } catch {
     return [];
   }
@@ -2020,7 +2069,7 @@ async function runGate(candidatePath, skillsRoot, {
 
 // src/queue.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { join as join13 } from "path";
 function getQueuePath() {
   return join13(getHomeDir(), "queue.json");
@@ -2030,26 +2079,46 @@ function readQueue() {
   if (!existsSync11(path)) {
     return { version: 1, entries: [] };
   }
-  const raw = readFileSync9(path, "utf-8");
+  const raw = readFileSync10(path, "utf-8");
   const parsed = JSON.parse(raw);
   return { version: 1, entries: parsed.entries ?? [] };
 }
-function writeQueue(queue) {
-  mkdirSync5(getHomeDir(), { recursive: true });
-  writeFileSync4(getQueuePath(), JSON.stringify(queue, null, 2) + "\n", "utf-8");
+function writeQueue(queue2) {
+  const home = getHomeDir();
+  mkdirSync5(home, { recursive: true });
+  const finalPath = getQueuePath();
+  const tempPath = join13(home, `.queue.json.tmp-${randomUUID2()}`);
+  try {
+    writeFileSync4(tempPath, JSON.stringify(queue2, null, 2) + "\n", "utf-8");
+    renameSync2(tempPath, finalPath);
+  } catch (err) {
+    rmSync3(tempPath, { force: true });
+    throw err;
+  }
 }
 function appendQueueEntry(entry) {
-  const queue = readQueue();
-  const existingIds = new Set(queue.entries.map((e) => e.id));
+  const queue2 = readQueue();
+  const existingIds = new Set(queue2.entries.map((e) => e.id));
   const full = {
     ...entry,
     id: generateId(existingIds),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  queue.entries.push(full);
-  writeQueue(queue);
+  queue2.entries.push(full);
+  writeQueue(queue2);
   return full;
 }
+function updateQueueEntry(id, patch) {
+  const queue2 = readQueue();
+  const index = queue2.entries.findIndex((e) => e.id === id);
+  if (index === -1) {
+    throw new Error(`no queue entry with id: ${id}`);
+  }
+  const updated = { ...queue2.entries[index], ...patch };
+  queue2.entries[index] = updated;
+  writeQueue(queue2);
+  return updated;
+}
 function generateId(existingIds) {
   let id;
   do {
@@ -2376,15 +2445,15 @@ import {
   existsSync as existsSync13,
   lstatSync,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   readdirSync as readdirSync6,
   realpathSync,
-  renameSync as renameSync2,
-  rmSync as rmSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync4,
   statSync as statSync8,
   writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename6, extname as extname5, join as join16, resolve as resolvePath2 } from "path";
+import { basename as basename6, delimiter as delimiter2, extname as extname5, join as join16, resolve as resolvePath2 } from "path";
 var OVERSIZED_SKILL_EST_TOKENS = 5e3;
 function toAuditFindings(source) {
   return source.map((f) => ({ severity: f.severity, rule: f.rule, target: f.file, detail: f.detail }));
@@ -2545,7 +2614,7 @@ function profileAuditedSkill(group, findings, unreadableSkillMdPaths) {
   let sizeBytes;
   try {
     sizeBytes = statSync8(skillMdPath).size;
-    text = readFileSync10(skillMdPath, "utf-8");
+    text = readFileSync11(skillMdPath, "utf-8");
   } catch (err) {
     findings.push({
       severity: "MEDIUM",
@@ -2623,7 +2692,7 @@ function auditMcpTarget(targetPath, notices) {
   }
   if (isToml) {
     try {
-      readFileSync10(targetPath, "utf-8");
+      readFileSync11(targetPath, "utf-8");
     } catch (err) {
       findings.push({
         severity: "MEDIUM",
@@ -2638,7 +2707,7 @@ function auditMcpTarget(targetPath, notices) {
   }
   let raw;
   try {
-    raw = readFileSync10(targetPath, "utf-8");
+    raw = readFileSync11(targetPath, "utf-8");
   } catch (err) {
     findings.push({
       severity: "MEDIUM",
@@ -2672,7 +2741,7 @@ function auditMcpTarget(targetPath, notices) {
 }
 function clusterOverlapPairs(pairs) {
   const parent = /* @__PURE__ */ new Map();
-  function find(x) {
+  function find2(x) {
     if (!parent.has(x)) parent.set(x, x);
     let root = x;
     while (parent.get(root) !== root) root = parent.get(root);
@@ -2685,14 +2754,14 @@ function clusterOverlapPairs(pairs) {
     return root;
   }
   function union(a, b) {
-    const ra = find(a);
-    const rb = find(b);
+    const ra = find2(a);
+    const rb = find2(b);
     if (ra !== rb) parent.set(ra, rb);
   }
   for (const pair of pairs) union(pair.aPath, pair.bPath);
   const groups = /* @__PURE__ */ new Map();
   for (const pair of pairs) {
-    const root = find(pair.aPath);
+    const root = find2(pair.aPath);
     const group = groups.get(root) ?? { members: /* @__PURE__ */ new Set(), topScore: 0 };
     group.members.add(pair.aPath);
     group.members.add(pair.bPath);
@@ -2708,6 +2777,45 @@ function toClusterMembers(members) {
   }
   return sorted;
 }
+function defaultWhich(cmd) {
+  const pathEnv = process.env.PATH ?? "";
+  const dirs = pathEnv.split(delimiter2).filter(Boolean);
+  const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = join16(dir, cmd + ext);
+      try {
+        if (statSync8(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+var SKILLSPECTOR_PROVIDER_KEYMAP = {
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  nv_build: "NVIDIA_INFERENCE_KEY"
+};
+function checkTooling(which2, env) {
+  const skillspectorPath = which2("skillspector");
+  const skillspector = skillspectorPath ? { installed: true } : {
+    installed: false,
+    hint: "NOT installed \u2014 github.com/NVIDIA/skillspector (git clone + make install; Python 3.12+)"
+  };
+  const tokenPresent = Boolean(env.VERCEL_OIDC_TOKEN);
+  const skillsShToken = tokenPresent ? { present: true } : {
+    present: false,
+    hint: "missing \u2014 enable OIDC Federation on your Vercel project, then `vercel link && vercel env pull`"
+  };
+  const provider = env.SKILLSPECTOR_PROVIDER;
+  const providerKeyEnv = provider ? SKILLSPECTOR_PROVIDER_KEYMAP[provider] : void 0;
+  const skillspectorLlm = {
+    configured: Boolean(provider && providerKeyEnv && env[providerKeyEnv]),
+    provider: provider || void 0
+  };
+  return { skillspector, skillsShToken, skillspectorLlm };
+}
 async function auditConfiguredSet(config, options = {}) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const oversizedThreshold = options.oversizedSkillTokens ?? OVERSIZED_SKILL_EST_TOKENS;
@@ -2828,12 +2936,14 @@ async function auditConfiguredSet(config, options = {}) {
     overlapClusterCount: overlapClusters.length,
     evolveEligibleCount: evolveEligible.length
   };
+  const tooling = checkTooling(options.which ?? defaultWhich, options.env ?? process.env);
   return {
     schemaVersion: 1,
     generatedAt: now().toISOString(),
     inventory: { skillRoots, skills, mcpTargets },
     hygiene: findings,
     opportunities: { overlapClusters, evolveEligible, foundation, overlapLocked: !overlapStatus.enabled },
+    tooling,
     notices,
     summary
   };
@@ -2927,6 +3037,28 @@ function renderOpportunitiesSection(report) {
     `- ${foundation.message}`
   ];
 }
+function renderToolingSection(tooling) {
+  const lines = ["## Tooling", ""];
+  if (!tooling) {
+    lines.push("- (not available in this report)");
+    return lines;
+  }
+  lines.push(`- SkillSpector CLI: ${tooling.skillspector.installed ? "installed" : "NOT installed"}`);
+  if (tooling.skillspector.hint) lines.push(`  - ${tooling.skillspector.hint}`);
+  lines.push(`- skills.sh auth (VERCEL_OIDC_TOKEN): ${tooling.skillsShToken.present ? "present" : "missing"}`);
+  if (tooling.skillsShToken.hint) lines.push(`  - ${tooling.skillsShToken.hint}`);
+  const llm = tooling.skillspectorLlm;
+  if (llm.configured) {
+    lines.push(`- SkillSpector LLM stage (optional): configured (provider: ${sanitizeForMarkdown(llm.provider ?? "")})`);
+  } else if (llm.provider) {
+    lines.push(`- SkillSpector LLM stage (optional): not configured \u2014 SKILLSPECTOR_PROVIDER is "${sanitizeForMarkdown(llm.provider)}" but its API key env var is not set`);
+  } else {
+    lines.push(
+      "- SkillSpector LLM stage (optional): not set \u2014 static scan works without it (use --no-llm); set SKILLSPECTOR_PROVIDER + its API key for semantic analysis"
+    );
+  }
+  return lines;
+}
 function renderAuditMarkdown(report) {
   const { summary } = report;
   const lines = [
@@ -2953,6 +3085,8 @@ function renderAuditMarkdown(report) {
     "",
     ...renderOpportunitiesSection(report),
     "",
+    ...renderToolingSection(report.tooling),
+    "",
     "## Notices",
     "",
     ...bulletList(report.notices, "(none)")
@@ -3024,9 +3158,9 @@ async function scaffoldFoundationSkill(config, profile, targetRoot) {
         `refusing to scaffold a foundation skill: the generated SKILL.md was flagged by the safety scan (${safety.findings.map(formatSafetyFinding).join("; ")})`
       );
     }
-    renameSync2(tempDir, destDir);
+    renameSync3(tempDir, destDir);
   } catch (err) {
-    rmSync3(tempDir, { recursive: true, force: true });
+    rmSync4(tempDir, { recursive: true, force: true });
     throw err;
   }
   try {
@@ -3664,7 +3798,7 @@ async function status() {
 // src/evolve.ts
 import { createInterface as createInterface4 } from "readline/promises";
 import { createHash } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync16, lstatSync as lstatSync2, mkdtempSync as mkdtempSync3, readFileSync as readFileSync11, rmSync as rmSync4 } from "fs";
+import { cpSync as cpSync3, existsSync as existsSync16, lstatSync as lstatSync2, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename7, dirname as dirname7, join as join20, resolve as resolvePath4, sep } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
@@ -3765,7 +3899,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     safety = await scanSafety(tempDir, strictness);
   } finally {
     try {
-      rmSync4(tempDir, { recursive: true, force: true });
+      rmSync5(tempDir, { recursive: true, force: true });
     } catch (err) {
       console.error(`[skill-forge] failed to clean up temp re-gate dir ${tempDir}: ${err.message}`);
     }
@@ -3847,7 +3981,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     logOutcome("[skill-forge] queued for ingestion review", json);
   } else if (decision === "reject") {
     try {
-      rmSync4(stagingDir, { recursive: true, force: true });
+      rmSync5(stagingDir, { recursive: true, force: true });
     } catch (err) {
       throw new UserError(
         `rejected the proposal, but removing the staging dir ${stagingDir} failed: ${err.message} \u2014 remove it manually.`
@@ -3902,7 +4036,7 @@ function readManifest(stagingDir) {
   const manifestPath = join20(stagingDir, "manifest.json");
   let raw;
   try {
-    raw = readFileSync11(manifestPath, "utf-8");
+    raw = readFileSync12(manifestPath, "utf-8");
   } catch (err) {
     throw new UserError(`could not read staging manifest ${manifestPath}: ${err.message}`);
   }
@@ -3937,7 +4071,7 @@ function validateManifest(raw, manifestPath) {
 }
 function filesIdentical(a, b) {
   if (!existsSync16(a) || !existsSync16(b)) return false;
-  return readFileSync11(a).equals(readFileSync11(b));
+  return readFileSync12(a).equals(readFileSync12(b));
 }
 function isAlreadyAdopted(stagingDir, manifest) {
   const proposedSkillMd = join20(stagingDir, "proposed_SKILL.md");
@@ -3966,7 +4100,7 @@ function assertNotSymlink(path, label) {
 }
 function sha256File(path) {
   if (!existsSync16(path)) return null;
-  return createHash("sha256").update(readFileSync11(path)).digest("hex");
+  return createHash("sha256").update(readFileSync12(path)).digest("hex");
 }
 
 // src/commands/evolve.ts
@@ -3974,6 +4108,920 @@ async function evolveCommand(targetSkillDir, options = {}) {
   await evolve(targetSkillDir, options);
 }
 
+// src/commands/organize.ts
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, resolve as resolvePath6 } from "path";
+
+// src/organize.ts
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync2, statSync as statSync9 } from "fs";
+import { basename as basename8, join as join21, resolve as resolvePath5 } from "path";
+var PRO_FEATURE_LABEL3 = "set-level organizer reports";
+var TIERS = /* @__PURE__ */ new Set(["resource", "custom"]);
+var MATURITIES = /* @__PURE__ */ new Set(["seedling", "stable", "deprecated"]);
+function listSubdirs2(dir) {
+  let entries;
+  try {
+    entries = readdirSync7(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const full = join21(dir, entry.name);
+    if (entry.isDirectory()) {
+      out.push(full);
+      continue;
+    }
+    if (entry.isSymbolicLink()) {
+      try {
+        if (statSync9(full).isDirectory()) out.push(full);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function findSkillDirsUnderRoot2(root) {
+  const found = /* @__PURE__ */ new Set();
+  const topDirs = listSubdirs2(root);
+  for (const dir of topDirs) {
+    if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const dir of listSubdirs2(join21(root, "skills"))) {
+    if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const topDir of topDirs) {
+    for (const dir of listSubdirs2(join21(topDir, "skills"))) {
+      if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+    }
+  }
+  return Array.from(found).filter((p) => !p.includes("/.git/"));
+}
+function collectCandidates(roots) {
+  const out = [];
+  for (const root of roots) {
+    const resolvedRoot = resolvePath5(expandHome(root));
+    if (!isDir(resolvedRoot)) continue;
+    for (const dirPath of findSkillDirsUnderRoot2(resolvedRoot)) {
+      out.push({ dirPath, root });
+    }
+  }
+  return out;
+}
+function parseYamlList(block, key) {
+  const inlineMatch = block.match(new RegExp(`^${key}:\\s*\\[(.*?)\\]\\s*$`, "m"));
+  if (inlineMatch) {
+    return inlineMatch[1].split(",").map((x) => stripQuotes(x.trim())).filter(Boolean);
+  }
+  if (!new RegExp(`^${key}:\\s*$`, "m").test(block)) return [];
+  const lines = block.split(/\r\n|\r|\n/);
+  const startIdx = lines.findIndex((l) => new RegExp(`^${key}:\\s*$`).test(l));
+  if (startIdx === -1) return [];
+  const out = [];
+  for (const line of lines.slice(startIdx + 1)) {
+    const itemMatch = line.match(/^\s*-\s*(.+)$/);
+    if (itemMatch) {
+      out.push(stripQuotes(itemMatch[1].trim()));
+    } else if (line.trim() === "") {
+      continue;
+    } else {
+      break;
+    }
+  }
+  return out;
+}
+function extractFrontmatterBlock(text) {
+  if (!text.startsWith("---\n")) return null;
+  const afterOpen = text.slice(4);
+  const closeIdx = afterOpen.indexOf("\n---");
+  if (closeIdx === -1) return null;
+  return afterOpen.slice(0, closeIdx);
+}
+function parseCapabilityFrontmatter(text, fallbackName) {
+  const block = extractFrontmatterBlock(text);
+  if (block === null) {
+    return { name: fallbackName, consumes: [], validFrontmatter: false };
+  }
+  const fields = {};
+  for (const key of ["name", "tier", "domain", "provenance", "maturity"]) {
+    const m = block.match(new RegExp(`^${key}:\\s*(.+)$`, "m"));
+    if (m) fields[key] = stripQuotes(m[1].trim());
+  }
+  return {
+    name: fields.name ?? fallbackName,
+    tier: fields.tier,
+    domain: fields.domain,
+    provenance: fields.provenance,
+    maturity: fields.maturity,
+    consumes: parseYamlList(block, "consumes"),
+    validFrontmatter: true
+  };
+}
+function loadUsageSnapshot(snapshotPath) {
+  const resolvedPath = resolvePath5(expandHome(snapshotPath));
+  let raw;
+  try {
+    raw = readFileSync13(resolvedPath, "utf-8");
+  } catch (err) {
+    return { usage: /* @__PURE__ */ new Map(), warning: `could not read usage snapshot (${err.message}); proceeding without usage` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return { usage: /* @__PURE__ */ new Map(), warning: `could not parse usage snapshot (${err.message}); proceeding without usage` };
+  }
+  const usage = /* @__PURE__ */ new Map();
+  const outer = parsed;
+  const report = outer && typeof outer === "object" ? outer.report : void 0;
+  const topSkills = report && typeof report === "object" ? report.top_skills : void 0;
+  if (Array.isArray(topSkills)) {
+    for (const row of topSkills) {
+      if (Array.isArray(row) && row.length === 2 && typeof row[0] === "string" && typeof row[1] === "number") {
+        const [name, count] = row;
+        usage.set(name, count);
+        if (name.includes(":")) {
+          const bare = name.split(":").pop();
+          if (!usage.has(bare)) usage.set(bare, count);
+        }
+      }
+    }
+  }
+  return { usage };
+}
+var WHITE = 0;
+var GRAY = 1;
+var BLACK = 2;
+function findCycles(adjacency) {
+  const color = /* @__PURE__ */ new Map();
+  for (const id of adjacency.keys()) color.set(id, WHITE);
+  const stack = [];
+  const cycles = [];
+  function dfs(u) {
+    color.set(u, GRAY);
+    stack.push(u);
+    for (const v of adjacency.get(u) ?? []) {
+      if (!color.has(v)) continue;
+      if (color.get(v) === GRAY && stack.includes(v)) {
+        const idx = stack.indexOf(v);
+        cycles.push([...stack.slice(idx), v]);
+      } else if (color.get(v) === WHITE) {
+        dfs(v);
+      }
+    }
+    color.set(u, BLACK);
+    stack.pop();
+  }
+  for (const id of adjacency.keys()) {
+    if (color.get(id) === WHITE) dfs(id);
+  }
+  return cycles;
+}
+function buildGraph(entries, nameToIds) {
+  const nodes = entries.map((e) => ({ id: e.id, name: e.name, tier: e.tier, domain: e.domain }));
+  const edges = [];
+  const dangling = [];
+  const ambiguous = [];
+  const incoming = new Map(entries.map((e) => [e.id, 0]));
+  const adjacency = new Map(entries.map((e) => [e.id, []]));
+  for (const e of entries) {
+    for (const target of e.consumes) {
+      const matches = nameToIds.get(target) ?? [];
+      edges.push({ from: e.id, to: target, resolvedIds: matches });
+      if (matches.length === 0) {
+        dangling.push({ from: e.id, to: target });
+      } else if (matches.length === 1) {
+        incoming.set(matches[0], (incoming.get(matches[0]) ?? 0) + 1);
+        adjacency.get(e.id).push(matches[0]);
+      } else {
+        ambiguous.push({ from: e.id, to: target, matches });
+      }
+    }
+  }
+  const orphans = entries.filter((e) => e.tier === "custom" && e.consumes.length === 0).map((e) => e.id);
+  const byId = new Map(entries.map((e) => [e.id, e]));
+  const hotResources = Array.from(incoming.entries()).filter(([, count]) => count > 0).map(([id, count]) => ({ id, name: byId.get(id).name, consumedBy: count })).sort((a, b) => b.consumedBy - a.consumedBy);
+  const cycles = findCycles(adjacency);
+  return {
+    nodeCount: nodes.length,
+    edgeCount: edges.length,
+    nodes,
+    edges,
+    orphans,
+    hotResources,
+    danglingEdges: dangling,
+    ambiguousConsumesTargets: ambiguous,
+    cycles
+  };
+}
+function buildRegistryEntries(candidates, warnings) {
+  const entries = [];
+  const seenRealPaths = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    let realPath;
+    try {
+      realPath = realpathSync2(candidate.dirPath);
+    } catch (err) {
+      warnings.push(`could not resolve skill directory ${candidate.dirPath}: ${err.message}`);
+      continue;
+    }
+    if (seenRealPaths.has(realPath)) continue;
+    seenRealPaths.add(realPath);
+    const skillMdPath = join21(realPath, "SKILL.md");
+    let text;
+    try {
+      text = readFileSync13(skillMdPath, "utf-8");
+    } catch (err) {
+      warnings.push(`could not read ${skillMdPath}: ${err.message}`);
+      continue;
+    }
+    const fm = parseCapabilityFrontmatter(text, basename8(realPath));
+    const name = fm.name ?? basename8(realPath);
+    if (fm.tier && !TIERS.has(fm.tier)) {
+      warnings.push(`${name}: tier '${fm.tier}' not in ${JSON.stringify(Array.from(TIERS).sort())}`);
+    }
+    if (fm.maturity && !MATURITIES.has(fm.maturity)) {
+      warnings.push(`${name}: maturity '${fm.maturity}' not in ${JSON.stringify(Array.from(MATURITIES).sort())}`);
+    }
+    entries.push({
+      id: realPath,
+      name,
+      path: realPath,
+      root: candidate.root,
+      tier: fm.tier,
+      domain: fm.domain,
+      consumes: fm.consumes,
+      provenance: fm.provenance,
+      maturity: fm.maturity,
+      validFrontmatter: fm.validFrontmatter
+    });
+  }
+  return entries;
+}
+function joinUsageSnapshot(entries, snapshotPath, warnings) {
+  const { usage, warning } = loadUsageSnapshot(snapshotPath);
+  if (warning) warnings.push(warning);
+  if (usage.size === 0) return false;
+  for (const entry of entries) {
+    const count = usage.get(entry.name);
+    if (count !== void 0) entry.usage = count;
+  }
+  if (!entries.some((e) => e.usage !== void 0)) {
+    warnings.push(
+      "usage snapshot loaded but 0 skills matched by name \u2014 registry `name:` vs telemetry key mismatch; the usage column will be empty"
+    );
+  }
+  return true;
+}
+function buildNameToIds(entries, warnings) {
+  const nameToIds = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const ids = nameToIds.get(e.name) ?? [];
+    ids.push(e.id);
+    nameToIds.set(e.name, ids);
+  }
+  for (const [name, ids] of nameToIds) {
+    if (ids.length > 1) {
+      warnings.push(`duplicate skill name "${name}" across ${ids.length} locations: ${ids.join(", ")}`);
+    }
+  }
+  return nameToIds;
+}
+function findUntagged(entries) {
+  return entries.filter((e) => !e.tier || !e.domain).map((e) => ({
+    id: e.id,
+    name: e.name,
+    missing: [!e.tier ? "tier" : void 0, !e.domain ? "domain" : void 0].filter((v) => Boolean(v))
+  }));
+}
+function countByTierAndDomain(entries) {
+  const byTier = {};
+  const byDomain = {};
+  for (const e of entries) {
+    byTier[e.tier ?? "untagged"] = (byTier[e.tier ?? "untagged"] ?? 0) + 1;
+    byDomain[e.domain ?? "untagged"] = (byDomain[e.domain ?? "untagged"] ?? 0) + 1;
+  }
+  return { byTier, byDomain };
+}
+function buildOrganizeReport(config, options = {}) {
+  const proStatus = proFeatureStatus(PRO_FEATURE_LABEL3);
+  if (!proStatus.enabled) {
+    throw new UserError(proStatus.notice ?? upgradeNotice(PRO_FEATURE_LABEL3));
+  }
+  const notices = proStatus.notice ? [proStatus.notice] : [];
+  const warnings = [];
+  const candidates = collectCandidates(config.skillsRoots);
+  if (candidates.length === 0) {
+    throw new UserError(
+      `no SKILL.md found under any configured skills root (${config.skillsRoots.join(", ") || "(none configured)"})`
+    );
+  }
+  const entries = buildRegistryEntries(candidates, warnings);
+  const usageJoined = options.usageSnapshot ? joinUsageSnapshot(entries, options.usageSnapshot, warnings) : false;
+  const nameToIds = buildNameToIds(entries, warnings);
+  const untagged = findUntagged(entries);
+  const { byTier, byDomain } = countByTierAndDomain(entries);
+  const registry = {
+    skillsRoots: [...config.skillsRoots],
+    count: entries.length,
+    byTier,
+    byDomain,
+    untagged,
+    warnings,
+    usageJoined,
+    skills: entries
+  };
+  const graph = buildGraph(entries, nameToIds);
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    registry,
+    graph,
+    notices
+  };
+}
+
+// src/commands/organize.ts
+function writeReport2(outPath, contents) {
+  const resolved = resolvePath6(outPath);
+  mkdirSync7(dirname8(resolved), { recursive: true });
+  try {
+    writeFileSync7(resolved, contents, { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new UserError(`output file already exists: ${resolved} \u2014 pass a different --out path`);
+    }
+    throw err;
+  }
+  return resolved;
+}
+function renderSummary(report) {
+  const { registry, graph } = report;
+  const lines = [];
+  lines.push(`[skill-forge] organize: ${registry.count} skill(s) across ${registry.skillsRoots.length} root(s)`);
+  lines.push(`  by tier:   ${JSON.stringify(registry.byTier)}`);
+  lines.push(`  by domain: ${JSON.stringify(registry.byDomain)}`);
+  lines.push(`  usage joined: ${registry.usageJoined}`);
+  lines.push(`  untagged (missing tier/domain): ${registry.untagged.length}`);
+  for (const u of registry.untagged.slice(0, 30)) {
+    lines.push(`    - ${sanitizeForMarkdown(u.name)}: missing ${u.missing.join(", ")}`);
+  }
+  if (registry.warnings.length > 0) {
+    lines.push("  warnings:");
+    for (const w of registry.warnings) lines.push(`    ! ${sanitizeForMarkdown(w)}`);
+  }
+  lines.push("");
+  lines.push(`  graph: ${graph.nodeCount} nodes, ${graph.edgeCount} edges`);
+  if (graph.hotResources.length > 0) {
+    lines.push("  hot resources (consumed by N customs):");
+    for (const h of graph.hotResources) lines.push(`    ${h.consumedBy}x  ${sanitizeForMarkdown(h.name)}`);
+  }
+  if (graph.danglingEdges.length > 0) {
+    lines.push("  dangling edges (consumes a target not in the set):");
+    for (const d of graph.danglingEdges) lines.push(`    ${sanitizeForMarkdown(d.from)}  ->  ${sanitizeForMarkdown(d.to)}  (missing)`);
+  }
+  if (graph.ambiguousConsumesTargets.length > 0) {
+    lines.push("  ambiguous consumes targets (name matched multiple skills):");
+    for (const a of graph.ambiguousConsumesTargets) {
+      lines.push(
+        `    ${sanitizeForMarkdown(a.from)}  ->  ${sanitizeForMarkdown(a.to)}  (matches: ${a.matches.map(sanitizeForMarkdown).join(", ")})`
+      );
+    }
+  }
+  if (graph.cycles.length > 0) {
+    lines.push("  cycles (consumes should be acyclic):");
+    for (const c of graph.cycles) lines.push(`    ${c.map(sanitizeForMarkdown).join(" -> ")}`);
+  }
+  if (graph.orphans.length > 0) {
+    lines.push(`  custom skills with no declared consumes (${graph.orphans.length}):`);
+    for (const o of graph.orphans.slice(0, 30)) lines.push(`    - ${sanitizeForMarkdown(o)}`);
+  }
+  for (const n of report.notices) lines.push(`  [notice] ${sanitizeForMarkdown(n)}`);
+  return lines;
+}
+async function organizeCommand(options = {}) {
+  const config = loadConfig();
+  const report = buildOrganizeReport(config, { usageSnapshot: options.usageSnapshot });
+  let outPath;
+  if (options.out) {
+    outPath = writeReport2(options.out, JSON.stringify(report, null, 2) + "\n");
+  }
+  if (options.json) {
+    for (const n of report.notices) console.error(`[skill-forge] ${n}`);
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  for (const line of renderSummary(report)) console.log(line);
+  if (outPath) console.log(`  report -> ${outPath}`);
+}
+
+// src/gate/skillsShApi.ts
+var SKILLS_SH_ORIGIN = "https://skills.sh";
+var SKILLS_SH_API_BASE = "/api/v1";
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var REQUEST_TIMEOUT_MS = 15e3;
+var ID_PATTERN = /^[A-Za-z0-9._/-]+$/;
+var TOKEN_HINT = "No VERCEL_OIDC_TOKEN found. skills.sh authenticates with a short-lived Vercel OIDC token:\n  1. Vercel dashboard -> your project -> Settings -> OIDC Federation -> enable.\n  2. npm i -g vercel && vercel link && vercel env pull   (writes VERCEL_OIDC_TOKEN to .env.local)\n  3. export VERCEL_OIDC_TOKEN from .env.local into your shell before running this command\n  (or set it directly: export VERCEL_OIDC_TOKEN=...)   -   docs: https://skills.sh/docs/api";
+var SkillsShError = class extends Error {
+  exitCode;
+  constructor(message, exitCode) {
+    super(message);
+    this.name = "SkillsShError";
+    this.exitCode = exitCode;
+  }
+};
+var RISK_ORDER = { NONE: 0, LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 };
+function getToken(env = process.env) {
+  const tok = env.VERCEL_OIDC_TOKEN;
+  return tok ? tok : void 0;
+}
+function assertValidId(id) {
+  if (id.length === 0 || !ID_PATTERN.test(id)) {
+    throw new SkillsShError(`invalid skills.sh id: ${JSON.stringify(id)}`, 1);
+  }
+}
+function validatedIdSegments(id) {
+  assertValidId(id);
+  const segments = id.split("/");
+  if (segments.some((s) => s === "" || s === "." || s === "..")) {
+    throw new SkillsShError(`invalid skills.sh id: ${JSON.stringify(id)}`, 1);
+  }
+  return segments;
+}
+function buildUrl(pathSegments, params) {
+  const url = new URL(SKILLS_SH_API_BASE + "/" + pathSegments.map((s) => encodeURIComponent(s)).join("/"), SKILLS_SH_ORIGIN);
+  if (params) {
+    const search2 = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) search2.set(k, String(v));
+    url.search = search2.toString();
+  }
+  return url;
+}
+async function readCappedText(res) {
+  const text = await res.text();
+  if (new TextEncoder().encode(text).length > MAX_RESPONSE_BYTES) {
+    throw new SkillsShError("skills.sh response exceeded the 2 MB size cap", 1);
+  }
+  return text;
+}
+async function call(pathSegments, params, options = {}) {
+  const env = options.env ?? process.env;
+  const token = getToken(env);
+  if (!token) {
+    throw new SkillsShError(TOKEN_HINT, 3);
+  }
+  const url = buildUrl(pathSegments, params);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new SkillsShError(`skills.sh request failed: ${message}`, 1);
+  }
+  if (res.status === 404) {
+    return void 0;
+  }
+  if (!res.ok) {
+    if (res.status === 401) {
+      throw new SkillsShError("skills.sh HTTP 401: unauthorized \u2014 the VERCEL_OIDC_TOKEN was rejected (expired or invalid)", 3);
+    }
+    let snippet = "";
+    try {
+      snippet = (await readCappedText(res)).slice(0, 300);
+    } catch {
+    }
+    throw new SkillsShError(`skills.sh HTTP ${res.status}${snippet ? `: ${snippet}` : ""}`, 1);
+  }
+  const text = await readCappedText(res);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new SkillsShError("skills.sh returned malformed JSON", 1);
+  }
+  return parsed;
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+async function search(query, limit, options = {}) {
+  const data = await call(["skills", "search"], { q: query, limit }, options);
+  if (!isRecord(data) || !Array.isArray(data.data)) {
+    throw new SkillsShError("skills.sh search response had an unexpected shape", 1);
+  }
+  return data;
+}
+async function audit(id, options = {}) {
+  const data = await call(["skills", "audit", ...validatedIdSegments(id)], void 0, options);
+  if (data === void 0) return void 0;
+  if (!isRecord(data) || !Array.isArray(data.audits)) {
+    throw new SkillsShError("skills.sh audit response had an unexpected shape", 1);
+  }
+  return data;
+}
+async function get(id, options = {}) {
+  return call(["skills", ...validatedIdSegments(id)], void 0, options);
+}
+async function curated(options = {}) {
+  return call(["skills", "curated"], void 0, options);
+}
+function auditVerdict(data) {
+  const audits = data.audits ?? [];
+  const statuses = new Set(audits.map((a) => a.status));
+  let worst = "NONE";
+  let worstRank = 0;
+  for (const a of audits) {
+    const rl = a.riskLevel ?? "NONE";
+    const rank = RISK_ORDER[rl] ?? 0;
+    if (rank > worstRank) {
+      worstRank = rank;
+      worst = rl;
+    }
+  }
+  const verdict = statuses.has("fail") ? "fail" : statuses.has("warn") ? "warn" : audits.length > 0 ? "pass" : "none";
+  return { verdict, risk: worst, audits };
+}
+
+// src/commands/find.ts
+var INSTALL_HINT_NOTE = "Results are unvetted \u2014 `skill-forge add <id>` runs the full quarantine + safety gate; `skill-forge find --audit <id>` shows partner audit verdicts.";
+function isRecordWithDataArray(v) {
+  return typeof v === "object" && v !== null && Array.isArray(v.data);
+}
+function printJson(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function printSearchResults(data, query) {
+  const items = data.data;
+  const count = data.count ?? items.length;
+  const searchType = data.searchType ? ` (${sanitizeForMarkdown(data.searchType)})` : "";
+  console.log(`skills.sh \u2014 ${count} matches for ${JSON.stringify(query)}${searchType}:`);
+  for (const item of items) {
+    const name = sanitizeForMarkdown(String(item.name ?? item.id));
+    const id = sanitizeForMarkdown(String(item.id));
+    const installs = item.installs ?? "?";
+    console.log(`  - ${name}  [${id}]  ${installs} installs  [unvetted]`);
+    console.log(`      install: skill-forge add ${id}`);
+  }
+  console.log("");
+  console.log(INSTALL_HINT_NOTE);
+}
+async function find(query, options = {}, deps = {}) {
+  const modes = [query !== void 0, options.audit !== void 0, options.get !== void 0, Boolean(options.curated)];
+  const activeCount = modes.filter(Boolean).length;
+  if (activeCount === 0) {
+    throw new UserError("skill-forge find: provide a search query, or exactly one of --audit <id>, --get <id>, --curated");
+  }
+  if (activeCount > 1) {
+    throw new UserError("skill-forge find: exactly one mode per invocation \u2014 a search query, or exactly one of --audit <id>, --get <id>, --curated");
+  }
+  const callOptions = { fetchImpl: deps.fetchImpl, env: deps.env };
+  try {
+    if (query !== void 0) {
+      if (query.trim().length < 2) {
+        throw new UserError("skill-forge find: query must be at least 2 characters");
+      }
+      const limit = options.limit ?? 10;
+      const data2 = await search(query, limit, callOptions);
+      if (options.json) {
+        printJson(data2);
+        return;
+      }
+      printSearchResults(data2, query);
+      return;
+    }
+    if (options.audit !== void 0) {
+      const id = options.audit;
+      const data2 = await audit(id, callOptions);
+      if (!data2) {
+        console.log(`no partner audits yet for ${sanitizeForMarkdown(id)} (generated after first install).`);
+        return;
+      }
+      if (options.json) {
+        printJson(data2);
+        return;
+      }
+      const { verdict, risk, audits } = auditVerdict(data2);
+      console.log(
+        `skills.sh audit for ${sanitizeForMarkdown(id)}: ${verdict.toUpperCase()} (max risk ${sanitizeForMarkdown(risk)}) \u2014 ${audits.length} partner(s)`
+      );
+      for (const entry of audits) {
+        const provider = sanitizeForMarkdown(String(entry.provider ?? "unknown"));
+        const status2 = sanitizeForMarkdown(String(entry.status ?? "unknown"));
+        const riskLevel = entry.riskLevel ? ` \xB7 ${sanitizeForMarkdown(String(entry.riskLevel))}` : "";
+        const summary = entry.summary ? ` \u2014 ${sanitizeForMarkdown(String(entry.summary))}` : "";
+        console.log(`  - ${provider}: ${status2}${riskLevel}${summary}`);
+      }
+      return;
+    }
+    if (options.get !== void 0) {
+      const data2 = await get(options.get, callOptions);
+      printJson(data2);
+      return;
+    }
+    const data = await curated(callOptions);
+    if (options.json) {
+      printJson(data);
+      return;
+    }
+    if (isRecordWithDataArray(data)) {
+      printSearchResults(data, "(curated)");
+      return;
+    }
+    printJson(data);
+  } catch (err) {
+    if (err instanceof SkillsShError) {
+      console.error(err.message);
+      process.exitCode = err.exitCode;
+      return;
+    }
+    throw err;
+  }
+}
+
+// src/commands/watch.ts
+import { realpathSync as realpathSync3 } from "fs";
+import { join as join22, resolve as resolvePath7 } from "path";
+var PRO_FEATURE_LABEL4 = "provenance drift watch (watch)";
+function isGitUrl(source) {
+  const s = source.trim();
+  return /^https?:\/\/\S+$/i.test(s) || /^git@[\w.-]+:\S+$/i.test(s);
+}
+function looksLikeGitRef(ref) {
+  const r = ref.trim();
+  return /^[0-9a-fA-F]{7,40}$/.test(r);
+}
+function firstNonEmptyLine(text) {
+  return text.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "(no output)";
+}
+async function checkGitDrift(exec, url, ref) {
+  let result;
+  try {
+    result = await exec("git", ["ls-remote", "--", url, ref], { cwd: process.cwd() });
+  } catch (err) {
+    return { status: "unreachable", detail: `git ls-remote failed to run: ${err.message}` };
+  }
+  if (result.code !== 0) {
+    return { status: "unreachable", detail: `git ls-remote exited ${result.code}: ${firstNonEmptyLine(result.stderr || result.stdout)}` };
+  }
+  const shas = result.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).map((l) => l.split(/\s+/)[0] ?? "").filter((sha) => sha.length > 0);
+  if (shas.length === 0) {
+    return { status: "unreachable", detail: `no ref matching "${ref}" found on remote` };
+  }
+  const recorded = ref.trim().toLowerCase();
+  if (shas.some((sha) => sha.toLowerCase() === recorded)) {
+    return { status: "unchanged", detail: `current: ${recorded}` };
+  }
+  return { status: "moved", detail: `recorded ${ref}, remote now resolves to ${shas[0]}` };
+}
+async function runWatch(config, options = {}, deps = {}) {
+  const proStatus = proFeatureStatus(PRO_FEATURE_LABEL4);
+  if (!proStatus.enabled) {
+    return { roots: [], rows: [], warnings: [], notices: [proStatus.notice ?? "Pro feature (watch) locked."] };
+  }
+  const notices = proStatus.notice ? [proStatus.notice] : [];
+  const exec = deps.exec ?? defaultExec;
+  const roots = [];
+  const rows = [];
+  const warnings = [];
+  const seenRealPaths = /* @__PURE__ */ new Set();
+  for (const root of config.skillsRoots) {
+    const resolvedRoot = resolvePath7(expandHome(root));
+    const exists = isDir(resolvedRoot);
+    let realPath = resolvedRoot;
+    if (exists) {
+      try {
+        realPath = realpathSync3(resolvedRoot);
+      } catch {
+        realPath = resolvedRoot;
+      }
+    }
+    if (seenRealPaths.has(realPath)) continue;
+    seenRealPaths.add(realPath);
+    let ledger;
+    try {
+      ledger = readProvenanceLedger(resolvedRoot);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const ledgerPath = join22(resolvedRoot, "SOURCES.md");
+      roots.push({ root, realPath, exists, ledgerPath, ledgerExists: false });
+      warnings.push(`${ledgerPath}: could not read ledger: ${message}`);
+      continue;
+    }
+    roots.push({ root, realPath, exists, ledgerPath: ledger.ledgerPath, ledgerExists: ledger.exists });
+    warnings.push(...ledger.warnings.map((w) => `${ledger.ledgerPath}: ${w}`));
+    for (const entry of ledger.entries) {
+      if (entry.verb === "REJECT") continue;
+      const rowBase = {
+        root,
+        ledgerPath: ledger.ledgerPath,
+        name: entry.name,
+        verb: entry.verb,
+        source: entry.source,
+        upstreamRef: entry.upstreamRef,
+        driftCheckCommand: entry.driftCheck
+      };
+      if (!(isGitUrl(entry.source) && looksLikeGitRef(entry.upstreamRef))) {
+        rows.push({
+          ...rowBase,
+          checkMethod: "manual",
+          driftStatus: "not-checked",
+          detail: "source is not a recognized git URL + ref pin \u2014 check manually"
+        });
+        continue;
+      }
+      if (options.offline) {
+        rows.push({
+          ...rowBase,
+          checkMethod: "git-ls-remote",
+          driftStatus: "not-checked",
+          detail: "--offline: network check skipped"
+        });
+        continue;
+      }
+      const { status: status2, detail } = await checkGitDrift(exec, entry.source, entry.upstreamRef);
+      rows.push({ ...rowBase, checkMethod: "git-ls-remote", driftStatus: status2, detail });
+    }
+  }
+  return { roots, rows, warnings, notices };
+}
+function printWatchTerminal(report) {
+  console.log("[skill-forge] watch \u2014 provenance drift check");
+  for (const notice of report.notices) console.log(`[notice] ${notice}`);
+  if (report.roots.length === 0) {
+    console.log("\nNo configured skills roots.");
+  }
+  for (const root of report.roots) {
+    console.log(`
+${sanitizeForMarkdown(root.root)} (${sanitizeForMarkdown(root.realPath)})`);
+    if (!root.exists) {
+      console.log("  root does not exist on disk");
+      continue;
+    }
+    if (!root.ledgerExists) {
+      console.log(`  no ledger at ${sanitizeForMarkdown(root.ledgerPath)}`);
+      continue;
+    }
+    console.log(`  ledger: ${sanitizeForMarkdown(root.ledgerPath)}`);
+    const rowsForRoot = report.rows.filter((r) => r.root === root.root);
+    if (rowsForRoot.length === 0) {
+      console.log("  (no tracked, non-REJECT sources)");
+      continue;
+    }
+    for (const row of rowsForRoot) {
+      console.log(`  \u2022 ${sanitizeForMarkdown(row.name)}  [${sanitizeForMarkdown(row.verb)}]  ref=${sanitizeForMarkdown(row.upstreamRef)}`);
+      if (row.checkMethod === "git-ls-remote") {
+        console.log(`      drift: ${row.driftStatus} \u2014 ${sanitizeForMarkdown(row.detail)}`);
+      } else {
+        console.log(`      manual check \u2014 stored drift-check command (data, NOT executed): ${sanitizeForMarkdown(row.driftCheckCommand)}`);
+      }
+    }
+  }
+  if (report.warnings.length > 0) {
+    console.log("\nWarnings:");
+    for (const w of report.warnings) console.log(`  - ${sanitizeForMarkdown(w)}`);
+  }
+  console.log("\nCompare each stored ref to current upstream; re-run ingestion on any that moved.");
+}
+async function watchCommand(options = {}) {
+  const report = await runWatch(loadConfig(), options);
+  if (options.json) {
+    console.log(JSON.stringify(report, null, 2));
+    for (const notice of report.notices) console.error(`[skill-forge] ${notice}`);
+    return;
+  }
+  printWatchTerminal(report);
+}
+
+// src/commands/ingest.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname9, isAbsolute, relative, resolve as resolvePath8 } from "path";
+var PRO_FEATURE_LABEL5 = "the pending-ingestion queue";
+var VALID_STATUSES = ["ingested", "dismissed"];
+function requireProFeature() {
+  const status2 = proFeatureStatus(PRO_FEATURE_LABEL5);
+  if (!status2.enabled) {
+    throw new UserError(
+      status2.notice ?? "ingest is a Pro feature \u2014 set SKILL_FORGE_LICENSE or config.licenseKey to a valid license to unlock."
+    );
+  }
+  if (status2.notice) console.error(`[skill-forge] ${status2.notice}`);
+}
+function pluralizeEntries(count) {
+  return `entr${count === 1 ? "y" : "ies"}`;
+}
+function toListRow(entry) {
+  return {
+    id: entry.id,
+    source: entry.source,
+    artifactType: entry.artifactType ?? "skill",
+    safetyVerdict: entry.gate.safetyVerdict,
+    createdAt: entry.createdAt
+  };
+}
+function printPendingList(pending, json) {
+  if (json) {
+    console.log(JSON.stringify({ entries: pending.map(toListRow) }, null, 2));
+    return;
+  }
+  if (pending.length === 0) {
+    console.log("[skill-forge] no pending queue entries.");
+    return;
+  }
+  console.log(`[skill-forge] ${pending.length} pending ${pluralizeEntries(pending.length)}:`);
+  for (const entry of pending) {
+    const row = toListRow(entry);
+    console.log(`  ${row.id}  ${row.source}  (${row.artifactType})  verdict=${row.safetyVerdict}  created=${row.createdAt}`);
+  }
+}
+function realpathOrNull(p) {
+  try {
+    return realpathSync4(p);
+  } catch {
+    return null;
+  }
+}
+function isUnderRoot(candidate, root) {
+  const rel = relative(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function validatePendingEntries(entries, config) {
+  const quarantineRoot = realpathOrNull(resolvePath8(config.quarantineDir));
+  const skillsRoots = config.skillsRoots.map((r) => realpathOrNull(resolvePath8(r))).filter((r) => r !== null);
+  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname9(resolvePath8(f)))).filter((r) => r !== null);
+  const allowedRoots = [quarantineRoot, ...skillsRoots, ...mcpTargetDirs].filter((r) => r !== null);
+  const valid = [];
+  const excluded = [];
+  for (const entry of entries) {
+    const effectivePath = entry.installedPath ?? entry.quarantinePath;
+    if (!effectivePath) {
+      excluded.push({ entry, reason: "no installedPath or quarantinePath recorded on the entry" });
+      continue;
+    }
+    const real = realpathOrNull(resolvePath8(effectivePath));
+    if (!real) {
+      excluded.push({ entry, reason: `path does not exist or could not be resolved: ${effectivePath}` });
+      continue;
+    }
+    if (allowedRoots.length === 0 || !allowedRoots.some((root) => isUnderRoot(real, root))) {
+      excluded.push({ entry, reason: `path escapes every configured root (quarantineDir/skillsRoots/mcpTargets): ${effectivePath}` });
+      continue;
+    }
+    valid.push(entry);
+  }
+  return { valid, excluded };
+}
+async function ingest(options = {}) {
+  requireProFeature();
+  const queue2 = readQueue();
+  const pending = queue2.entries.filter((e) => e.status === "pending");
+  if (options.list) {
+    printPendingList(pending, options.json);
+    return;
+  }
+  if (pending.length === 0) {
+    console.log("[skill-forge] no pending queue entries to ingest.");
+    return;
+  }
+  const config = loadConfig();
+  const { valid, excluded } = validatePendingEntries(pending, config);
+  if (excluded.length > 0) {
+    console.error(`[skill-forge] excluded ${excluded.length} pending ${pluralizeEntries(excluded.length)} that failed path validation:`);
+    for (const { entry, reason } of excluded) {
+      console.error(`  - ${entry.id} (${entry.source}): ${reason}`);
+    }
+    console.error(
+      "[skill-forge] excluded entries stay in the queue \u2014 review each, then dismiss with: skill-forge queue close <id> --status dismissed"
+    );
+  }
+  if (valid.length === 0) {
+    console.log("[skill-forge] no pending entries passed path validation \u2014 nothing to hand off.");
+    return;
+  }
+  console.log(`[skill-forge] ${valid.length} pending ${pluralizeEntries(valid.length)} ready for ingest:`);
+  for (const entry of valid) {
+    console.log(`  - ${entry.id}  ${entry.source}  (${entry.artifactType ?? "skill"})`);
+  }
+  runHandoff(config, getQueuePath(), { promptAsset: "ingest-prompt.md" });
+}
+async function queueClose(id, options = {}) {
+  requireProFeature();
+  const status2 = options.status;
+  if (!status2 || !VALID_STATUSES.includes(status2)) {
+    throw new UserError(`--status must be one of: ${VALID_STATUSES.join(", ")} (got ${status2 ? JSON.stringify(status2) : "nothing"})`);
+  }
+  let updated;
+  try {
+    updated = updateQueueEntry(id, { status: status2 });
+  } catch (err) {
+    throw new UserError(err instanceof Error ? err.message : String(err));
+  }
+  console.log(`[skill-forge] queue entry ${updated.id} closed -> status: ${updated.status}`);
+}
+
 // src/cli.ts
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
@@ -3990,6 +5038,13 @@ function parseLookbackHours(value) {
   }
   return n;
 }
+function parseLimit(value) {
+  const n = Number(value);
+  if (value.trim() === "" || !Number.isInteger(n) || n < 1 || n > 50) {
+    throw new UserError(`--limit must be an integer between 1 and 50 (got "${value}")`);
+  }
+  return n;
+}
 var program = new Command();
 program.name("skill-forge").description("The supply-chain gate for agent skills").version(pkg.version);
 program.command("add <source>").description("Quarantine-install a skill and run it through the safety gate").option("-y, --yes", "skip the interactive prompt; honor the gate verdict automatically").option("-t, --target <dir>", "skills root to promote into (defaults to config defaultTarget, then skillsRoots[0])").option("--json", "print the gate result as JSON instead of the terminal report").option("--ingest", "after a successful promote, hand off the bundled ingest prompt to a coding agent").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).option(
@@ -4001,6 +5056,14 @@ program.command("list").description("List skills currently in quarantine").actio
 program.command("status").description("Show skill-forge configuration and quarantine status").action(status);
 program.command("evolve <target-skill-dir>").description("Self-evolve a skill via SkillOpt-Sleep, re-gate the proposal, then promote/hold/reject (Pro)").option("--project <dir>", "project dir passed to SkillOpt-Sleep as --project (defaults to cwd)").option("--dry-run", "SkillOpt-Sleep dry-run: report only, nothing staged").option("--backend <name>", "SkillOpt-Sleep backend (default: mock, offline \u2014 a real backend requires --yes or interactive confirmation)").option("--lookback-hours <n>", "hours of session history for SkillOpt-Sleep to harvest", parseLookbackHours).option("-y, --yes", "skip interactive prompts; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").option("--force", "allow re-adopting a staging dir whose proposed content already matches the live skill").action(evolveCommand);
 program.command("audit").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").action(auditCommand);
+program.command("organize").description("Build the set-level capability registry + dependency graph across configured skills roots (Pro)").option("--json", "print the registry+graph report as JSON instead of the terminal summary").option("--out <file>", "write the full report JSON to this path (refuses an existing path)").option("--usage-snapshot <file>", "join per-skill usage counts from a skill-monitor snapshot JSON").action(organizeCommand);
+program.command("find [query]").description("Discover skills via skills.sh and check partner security audits (requires VERCEL_OIDC_TOKEN)").option("--limit <n>", "max search results (default 10)", parseLimit).option("--audit <id>", "show partner audit verdicts (Socket/Snyk/\u2026) for a skills.sh id").option("--get <id>", "show detail + file tree for a skills.sh id").option("--curated", "list skills.sh curated skills").option("--json", "print the raw API payload as JSON").action(find);
+program.command("watch").description("Drift check across every SOURCES.md provenance ledger: which ingested upstreams have moved (Pro)").option("--offline", "skip all network checks; list entries for manual comparison only").option("--json", "print the drift report as JSON instead of the terminal summary").action(watchCommand);
+program.command("ingest").description(
+  "Hand the pending-ingestion queue to the configured coding agent for the decide/absorb pass (Pro). For a single new source, use `skill-forge add <source> --ingest` instead."
+).option("--list", "print pending queue entries and exit \u2014 no handoff").option("--json", "with --list: print pending entries as JSON").action(ingest);
+var queue = program.command("queue").description("Manage the pending-ingestion queue (Pro)");
+queue.command("close <id>").description("Close a queue entry after the decide pass \u2014 agents use this instead of hand-editing queue.json").requiredOption("--status <status>", 'final status: "ingested" or "dismissed"').action(queueClose);
 program.command("init").description("Detect installed agents and set gate targets, default promotion target, and handoff agent").option("--defaults", "non-interactive: use all detected agents as gate targets, the first as the default target").option("--list", "print detected agent skill roots and exit \u2014 no writes").action(init);
 try {
   await program.parseAsync();