@senior-skills/core 1.0.0

package/dist/domain/errors.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Every user-facing failure in the system is an {@link AgentSkillsError} carrying a stable
+ * code. Codes are part of the public contract: they appear in `--json` output, in error
+ * messages, so scripts and bug reports can refer to them.
+ */
+export declare const ErrorCode: {
+    /** The CLI was invoked in a way that cannot be interpreted. */
+    readonly USAGE: "ASK_USAGE";
+    /** A manifest, SKILL.md, or package layout violated the format. */
+    readonly INVALID_MANIFEST: "ASK_INVALID_MANIFEST";
+    readonly INVALID_PACKAGE: "ASK_INVALID_PACKAGE";
+    readonly INVALID_SKILL_NAME: "ASK_INVALID_SKILL_NAME";
+    readonly INVALID_VERSION: "ASK_INVALID_VERSION";
+    /** The package format is newer than this CLI understands. */
+    readonly UNSUPPORTED_SCHEMA: "ASK_UNSUPPORTED_SCHEMA";
+    /** Resolution failures. */
+    readonly SKILL_NOT_FOUND: "ASK_SKILL_NOT_FOUND";
+    readonly VERSION_NOT_FOUND: "ASK_VERSION_NOT_FOUND";
+    readonly DEPENDENCY_CONFLICT: "ASK_DEPENDENCY_CONFLICT";
+    readonly DEPENDENCY_CYCLE: "ASK_DEPENDENCY_CYCLE";
+    /** Registry failures. */
+    readonly REGISTRY_NOT_FOUND: "ASK_REGISTRY_NOT_FOUND";
+    readonly REGISTRY_UNAVAILABLE: "ASK_REGISTRY_UNAVAILABLE";
+    readonly REGISTRY_INVALID_INDEX: "ASK_REGISTRY_INVALID_INDEX";
+    readonly REGISTRY_DUPLICATE: "ASK_REGISTRY_DUPLICATE";
+    /** Security and integrity failures. */
+    readonly INTEGRITY_MISMATCH: "ASK_INTEGRITY_MISMATCH";
+    readonly UNSAFE_PATH: "ASK_UNSAFE_PATH";
+    readonly UNSAFE_ARCHIVE: "ASK_UNSAFE_ARCHIVE";
+    readonly INSECURE_TRANSPORT: "ASK_INSECURE_TRANSPORT";
+    /** Agent selection and detection. */
+    readonly NO_AGENT_DETECTED: "ASK_NO_AGENT_DETECTED";
+    readonly UNKNOWN_AGENT: "ASK_UNKNOWN_AGENT";
+    readonly AGENT_INCOMPATIBLE: "ASK_AGENT_INCOMPATIBLE";
+    /** Installation lifecycle. */
+    readonly ALREADY_INSTALLED: "ASK_ALREADY_INSTALLED";
+    readonly NOT_INSTALLED: "ASK_NOT_INSTALLED";
+    readonly INSTALL_FAILED: "ASK_INSTALL_FAILED";
+    readonly MODIFIED_INSTALL: "ASK_MODIFIED_INSTALL";
+    /** Lockfile. */
+    readonly LOCKFILE_INVALID: "ASK_LOCKFILE_INVALID";
+    readonly LOCKFILE_MISMATCH: "ASK_LOCKFILE_MISMATCH";
+    /** Filesystem and environment. */
+    readonly IO_ERROR: "ASK_IO_ERROR";
+    readonly PERMISSION_DENIED: "ASK_PERMISSION_DENIED";
+    /** Publishing. */
+    readonly PUBLISH_REJECTED: "ASK_PUBLISH_REJECTED";
+    /** Anything genuinely unexpected. */
+    readonly INTERNAL: "ASK_INTERNAL";
+};
+export type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
+export interface AgentSkillsErrorOptions {
+    /** Extra lines rendered under the headline, in order. */
+    readonly details?: readonly string[];
+    /** Concrete next actions, rendered under a `Try:` heading. */
+    readonly hints?: readonly string[];
+    /** Underlying cause, preserved for `--verbose` stack output. */
+    readonly cause?: unknown;
+    /** Structured payload surfaced in `--json` mode. */
+    readonly data?: Readonly<Record<string, unknown>>;
+}
+/**
+ * The single error type crossing the application boundary. Infrastructure errors are
+ * wrapped rather than rethrown so the CLI never has to interpret an `ENOENT`.
+ */
+export declare class AgentSkillsError extends Error {
+    readonly code: ErrorCode;
+    readonly details: readonly string[];
+    readonly hints: readonly string[];
+    readonly data: Readonly<Record<string, unknown>>;
+    constructor(code: ErrorCode, message: string, options?: AgentSkillsErrorOptions);
+    toJSON(): Record<string, unknown>;
+}
+export declare function isAgentSkillsError(value: unknown): value is AgentSkillsError;
+/**
+ * Process exit codes. Distinct codes for validation, resolution and security let CI
+ * scripts react differently to "your package is wrong" and "the download was tampered
+ * with", which is the whole point of not returning 1 for everything.
+ */
+export declare const ExitCode: {
+    readonly OK: 0;
+    readonly FAILURE: 1;
+    readonly USAGE: 2;
+    readonly VALIDATION: 3;
+    readonly RESOLUTION: 4;
+    readonly SECURITY: 5;
+    readonly NO_AGENT: 6;
+};
+export type ExitCode = (typeof ExitCode)[keyof typeof ExitCode];
+export declare function exitCodeFor(error: unknown): ExitCode;
+//# sourceMappingURL=errors.d.ts.map

package/dist/domain/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,SAAS;IACpB,+DAA+D;;IAE/D,mEAAmE;;;;;IAKnE,6DAA6D;;IAE7D,2BAA2B;;;;;IAK3B,yBAAyB;;;;;IAKzB,uCAAuC;;;;;IAKvC,qCAAqC;;;;IAIrC,8BAA8B;;;;;IAK9B,gBAAgB;;;IAGhB,kCAAkC;;;IAGlC,kBAAkB;;IAElB,qCAAqC;;CAE7B,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAErC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B;IASnF,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;CAQX,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC;AAuBhE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAGpD"}

package/dist/domain/errors.js

@@ -0,0 +1,121 @@
+/**
+ * Every user-facing failure in the system is an {@link AgentSkillsError} carrying a stable
+ * code. Codes are part of the public contract: they appear in `--json` output, in error
+ * messages, so scripts and bug reports can refer to them.
+ */
+export const ErrorCode = {
+    /** The CLI was invoked in a way that cannot be interpreted. */
+    USAGE: 'ASK_USAGE',
+    /** A manifest, SKILL.md, or package layout violated the format. */
+    INVALID_MANIFEST: 'ASK_INVALID_MANIFEST',
+    INVALID_PACKAGE: 'ASK_INVALID_PACKAGE',
+    INVALID_SKILL_NAME: 'ASK_INVALID_SKILL_NAME',
+    INVALID_VERSION: 'ASK_INVALID_VERSION',
+    /** The package format is newer than this CLI understands. */
+    UNSUPPORTED_SCHEMA: 'ASK_UNSUPPORTED_SCHEMA',
+    /** Resolution failures. */
+    SKILL_NOT_FOUND: 'ASK_SKILL_NOT_FOUND',
+    VERSION_NOT_FOUND: 'ASK_VERSION_NOT_FOUND',
+    DEPENDENCY_CONFLICT: 'ASK_DEPENDENCY_CONFLICT',
+    DEPENDENCY_CYCLE: 'ASK_DEPENDENCY_CYCLE',
+    /** Registry failures. */
+    REGISTRY_NOT_FOUND: 'ASK_REGISTRY_NOT_FOUND',
+    REGISTRY_UNAVAILABLE: 'ASK_REGISTRY_UNAVAILABLE',
+    REGISTRY_INVALID_INDEX: 'ASK_REGISTRY_INVALID_INDEX',
+    REGISTRY_DUPLICATE: 'ASK_REGISTRY_DUPLICATE',
+    /** Security and integrity failures. */
+    INTEGRITY_MISMATCH: 'ASK_INTEGRITY_MISMATCH',
+    UNSAFE_PATH: 'ASK_UNSAFE_PATH',
+    UNSAFE_ARCHIVE: 'ASK_UNSAFE_ARCHIVE',
+    INSECURE_TRANSPORT: 'ASK_INSECURE_TRANSPORT',
+    /** Agent selection and detection. */
+    NO_AGENT_DETECTED: 'ASK_NO_AGENT_DETECTED',
+    UNKNOWN_AGENT: 'ASK_UNKNOWN_AGENT',
+    AGENT_INCOMPATIBLE: 'ASK_AGENT_INCOMPATIBLE',
+    /** Installation lifecycle. */
+    ALREADY_INSTALLED: 'ASK_ALREADY_INSTALLED',
+    NOT_INSTALLED: 'ASK_NOT_INSTALLED',
+    INSTALL_FAILED: 'ASK_INSTALL_FAILED',
+    MODIFIED_INSTALL: 'ASK_MODIFIED_INSTALL',
+    /** Lockfile. */
+    LOCKFILE_INVALID: 'ASK_LOCKFILE_INVALID',
+    LOCKFILE_MISMATCH: 'ASK_LOCKFILE_MISMATCH',
+    /** Filesystem and environment. */
+    IO_ERROR: 'ASK_IO_ERROR',
+    PERMISSION_DENIED: 'ASK_PERMISSION_DENIED',
+    /** Publishing. */
+    PUBLISH_REJECTED: 'ASK_PUBLISH_REJECTED',
+    /** Anything genuinely unexpected. */
+    INTERNAL: 'ASK_INTERNAL',
+};
+/**
+ * The single error type crossing the application boundary. Infrastructure errors are
+ * wrapped rather than rethrown so the CLI never has to interpret an `ENOENT`.
+ */
+export class AgentSkillsError extends Error {
+    code;
+    details;
+    hints;
+    data;
+    constructor(code, message, options = {}) {
+        super(message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = 'AgentSkillsError';
+        this.code = code;
+        this.details = options.details ?? [];
+        this.hints = options.hints ?? [];
+        this.data = options.data ?? {};
+    }
+    toJSON() {
+        return {
+            error: true,
+            code: this.code,
+            message: this.message,
+            details: this.details,
+            hints: this.hints,
+            ...this.data,
+        };
+    }
+}
+export function isAgentSkillsError(value) {
+    return value instanceof AgentSkillsError;
+}
+/**
+ * Process exit codes. Distinct codes for validation, resolution and security let CI
+ * scripts react differently to "your package is wrong" and "the download was tampered
+ * with", which is the whole point of not returning 1 for everything.
+ */
+export const ExitCode = {
+    OK: 0,
+    FAILURE: 1,
+    USAGE: 2,
+    VALIDATION: 3,
+    RESOLUTION: 4,
+    SECURITY: 5,
+    NO_AGENT: 6,
+};
+const EXIT_BY_CODE = {
+    [ErrorCode.USAGE]: ExitCode.USAGE,
+    [ErrorCode.INVALID_MANIFEST]: ExitCode.VALIDATION,
+    [ErrorCode.INVALID_PACKAGE]: ExitCode.VALIDATION,
+    [ErrorCode.INVALID_SKILL_NAME]: ExitCode.VALIDATION,
+    [ErrorCode.INVALID_VERSION]: ExitCode.VALIDATION,
+    [ErrorCode.UNSUPPORTED_SCHEMA]: ExitCode.VALIDATION,
+    [ErrorCode.LOCKFILE_INVALID]: ExitCode.VALIDATION,
+    [ErrorCode.PUBLISH_REJECTED]: ExitCode.VALIDATION,
+    [ErrorCode.SKILL_NOT_FOUND]: ExitCode.RESOLUTION,
+    [ErrorCode.VERSION_NOT_FOUND]: ExitCode.RESOLUTION,
+    [ErrorCode.DEPENDENCY_CONFLICT]: ExitCode.RESOLUTION,
+    [ErrorCode.DEPENDENCY_CYCLE]: ExitCode.RESOLUTION,
+    [ErrorCode.INTEGRITY_MISMATCH]: ExitCode.SECURITY,
+    [ErrorCode.UNSAFE_PATH]: ExitCode.SECURITY,
+    [ErrorCode.UNSAFE_ARCHIVE]: ExitCode.SECURITY,
+    [ErrorCode.INSECURE_TRANSPORT]: ExitCode.SECURITY,
+    [ErrorCode.LOCKFILE_MISMATCH]: ExitCode.SECURITY,
+    [ErrorCode.NO_AGENT_DETECTED]: ExitCode.NO_AGENT,
+};
+export function exitCodeFor(error) {
+    if (!isAgentSkillsError(error))
+        return ExitCode.FAILURE;
+    return EXIT_BY_CODE[error.code] ?? ExitCode.FAILURE;
+}
+//# sourceMappingURL=errors.js.map

package/dist/domain/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,+DAA+D;IAC/D,KAAK,EAAE,WAAW;IAClB,mEAAmE;IACnE,gBAAgB,EAAE,sBAAsB;IACxC,eAAe,EAAE,qBAAqB;IACtC,kBAAkB,EAAE,wBAAwB;IAC5C,eAAe,EAAE,qBAAqB;IACtC,6DAA6D;IAC7D,kBAAkB,EAAE,wBAAwB;IAC5C,2BAA2B;IAC3B,eAAe,EAAE,qBAAqB;IACtC,iBAAiB,EAAE,uBAAuB;IAC1C,mBAAmB,EAAE,yBAAyB;IAC9C,gBAAgB,EAAE,sBAAsB;IACxC,yBAAyB;IACzB,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,0BAA0B;IAChD,sBAAsB,EAAE,4BAA4B;IACpD,kBAAkB,EAAE,wBAAwB;IAC5C,uCAAuC;IACvC,kBAAkB,EAAE,wBAAwB;IAC5C,WAAW,EAAE,iBAAiB;IAC9B,cAAc,EAAE,oBAAoB;IACpC,kBAAkB,EAAE,wBAAwB;IAC5C,qCAAqC;IACrC,iBAAiB,EAAE,uBAAuB;IAC1C,aAAa,EAAE,mBAAmB;IAClC,kBAAkB,EAAE,wBAAwB;IAC5C,8BAA8B;IAC9B,iBAAiB,EAAE,uBAAuB;IAC1C,aAAa,EAAE,mBAAmB;IAClC,cAAc,EAAE,oBAAoB;IACpC,gBAAgB,EAAE,sBAAsB;IACxC,gBAAgB;IAChB,gBAAgB,EAAE,sBAAsB;IACxC,iBAAiB,EAAE,uBAAuB;IAC1C,kCAAkC;IAClC,QAAQ,EAAE,cAAc;IACxB,iBAAiB,EAAE,uBAAuB;IAC1C,kBAAkB;IAClB,gBAAgB,EAAE,sBAAsB;IACxC,qCAAqC;IACrC,QAAQ,EAAE,cAAc;CAChB,CAAC;AAeX;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAY;IAChB,OAAO,CAAoB;IAC3B,KAAK,CAAoB;IACzB,IAAI,CAAoC;IAEjD,YAAY,IAAe,EAAE,OAAe,EAAE,UAAmC,EAAE;QACjF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,IAAI,CAAC,IAAI;SACb,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,gBAAgB,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,EAAE,EAAE,CAAC;IACL,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;IACR,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;CACH,CAAC;AAIX,MAAM,YAAY,GAAyC;IACzD,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK;IACjC,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACjD,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,UAAU;IAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACnD,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,UAAU;IAChD,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACnD,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACjD,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACjD,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,UAAU;IAChD,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,UAAU;IAClD,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACpD,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,UAAU;IACjD,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,QAAQ;IACjD,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ;IAC1C,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,QAAQ;IAC7C,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,QAAQ;IACjD,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,QAAQ;IAChD,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,QAAQ;CACjD,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;IACxD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC;AACtD,CAAC"}

package/dist/domain/integrity.d.ts

@@ -0,0 +1,19 @@
+import type { Hasher } from '../ports/infrastructure.ts';
+import type { PackageFile, SkillPackage } from './skill-package.ts';
+/**
+ * Package integrity is a hash over a *canonical digest tree*, not over a tarball.
+ *
+ * Hashing an archive would make the integrity string depend on tar block padding, mtimes and
+ * gzip settings — so the same package fetched from a git registry and from an HTTP registry
+ * would hash differently. Hashing content instead means one skill has one integrity value
+ * regardless of how it travelled, which is what lets a lockfile written against a git
+ * registry keep verifying after a migration to HTTP.
+ *
+ * The `integrity` field inside `skill.yaml` is excluded from its own input, since it cannot
+ * be known before it is computed.
+ */
+export declare const INTEGRITY_PREFIX = "sha256-";
+export declare function computeIntegrity(files: readonly PackageFile[], hasher: Hasher): string;
+export declare function computePackageIntegrity(pkg: SkillPackage, hasher: Hasher): string;
+export declare function isIntegrityString(value: string): boolean;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/domain/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/domain/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMtF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjF;AAsBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/domain/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/domain/integrity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGlD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,KAA6B,EAAE,MAAc;IAC5E,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC;SACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAE3E,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAiB,EAAE,MAAc;IACvE,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAEvD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAElD,MAAM,QAAQ,GAAG,IAAI;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;AACtF,CAAC"}

package/dist/domain/js-literal.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A parser for JavaScript *literal* expressions — objects, arrays, strings, numbers,
+ * booleans and null. Nothing else: no identifiers, no operators, no function calls.
+ *
+ * It exists so a workflow's `export const meta = { … }` can be read without executing the
+ * script. Claude Code requires that literal to be pure ("no computed values") and parses it
+ * the same way; refusing anything computable here is what keeps a package this project
+ * accepts from being one the agent then rejects.
+ *
+ * Deliberately not a JSON parser: the source is JavaScript, so single quotes, unquoted keys,
+ * trailing commas and comments all appear in practice and all have to be understood.
+ */
+export declare function parseJsLiteral(source: string, from: number, context: string): {
+    value: unknown;
+    end: number;
+};
+/**
+ * Advances past whitespace and comments, so callers can require a declaration to be the
+ * *first statement* without tripping over a licence header.
+ */
+export declare function skipTrivia(source: string, from: number): number;
+//# sourceMappingURL=js-literal.d.ts.map

package/dist/domain/js-literal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"js-literal.d.ts","sourceRoot":"","sources":["../../src/domain/js-literal.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAIjC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D"}

package/dist/domain/js-literal.js

@@ -0,0 +1,221 @@
+import { AgentSkillsError, ErrorCode } from "./errors.js";
+/**
+ * A parser for JavaScript *literal* expressions — objects, arrays, strings, numbers,
+ * booleans and null. Nothing else: no identifiers, no operators, no function calls.
+ *
+ * It exists so a workflow's `export const meta = { … }` can be read without executing the
+ * script. Claude Code requires that literal to be pure ("no computed values") and parses it
+ * the same way; refusing anything computable here is what keeps a package this project
+ * accepts from being one the agent then rejects.
+ *
+ * Deliberately not a JSON parser: the source is JavaScript, so single quotes, unquoted keys,
+ * trailing commas and comments all appear in practice and all have to be understood.
+ */
+export function parseJsLiteral(source, from, context) {
+    const cursor = { index: from };
+    const value = readValue(source, cursor, context);
+    return { value, end: cursor.index };
+}
+/**
+ * Advances past whitespace and comments, so callers can require a declaration to be the
+ * *first statement* without tripping over a licence header.
+ */
+export function skipTrivia(source, from) {
+    const cursor = { index: from };
+    skipIgnorable(source, cursor);
+    return cursor.index;
+}
+function fail(source, cursor, context, what) {
+    const line = source.slice(0, cursor.index).split('\n').length;
+    throw new AgentSkillsError(ErrorCode.INVALID_PACKAGE, `${context}: ${what}`, {
+        details: [`At line ${line}.`],
+        hints: ['The value must be a literal: no variables, calls, operators or template strings'],
+        data: { context, line },
+    });
+}
+function skipIgnorable(source, cursor) {
+    for (;;) {
+        while (cursor.index < source.length && /\s/.test(source[cursor.index]))
+            cursor.index += 1;
+        if (source.startsWith('//', cursor.index)) {
+            const newline = source.indexOf('\n', cursor.index);
+            cursor.index = newline === -1 ? source.length : newline + 1;
+            continue;
+        }
+        if (source.startsWith('/*', cursor.index)) {
+            const close = source.indexOf('*/', cursor.index + 2);
+            cursor.index = close === -1 ? source.length : close + 2;
+            continue;
+        }
+        return;
+    }
+}
+function readValue(source, cursor, context) {
+    skipIgnorable(source, cursor);
+    if (cursor.index >= source.length)
+        fail(source, cursor, context, 'unexpected end of input');
+    const char = source[cursor.index];
+    if (char === '{')
+        return readObject(source, cursor, context);
+    if (char === '[')
+        return readArray(source, cursor, context);
+    if (char === "'" || char === '"')
+        return readString(source, cursor, context);
+    if (char === '`') {
+        fail(source, cursor, context, 'template strings are not allowed; use a quoted string');
+    }
+    for (const [word, literal] of [
+        ['true', true],
+        ['false', false],
+        ['null', null],
+    ]) {
+        if (source.startsWith(word, cursor.index) &&
+            !isIdentifierChar(source[cursor.index + word.length])) {
+            cursor.index += word.length;
+            return literal;
+        }
+    }
+    return readNumber(source, cursor, context);
+}
+function readObject(source, cursor, context) {
+    cursor.index += 1; // {
+    const result = {};
+    for (;;) {
+        skipIgnorable(source, cursor);
+        if (cursor.index >= source.length)
+            fail(source, cursor, context, 'unterminated object');
+        if (source[cursor.index] === '}') {
+            cursor.index += 1;
+            return result;
+        }
+        const key = readKey(source, cursor, context);
+        skipIgnorable(source, cursor);
+        if (source[cursor.index] !== ':') {
+            // Shorthand (`{ name }`) reads a variable, which is exactly what "pure literal" forbids.
+            fail(source, cursor, context, `property "${key}" has no value`);
+        }
+        cursor.index += 1;
+        result[key] = readValue(source, cursor, context);
+        skipIgnorable(source, cursor);
+        if (source[cursor.index] === ',') {
+            cursor.index += 1;
+            continue;
+        }
+        if (source[cursor.index] === '}') {
+            cursor.index += 1;
+            return result;
+        }
+        fail(source, cursor, context, 'expected "," or "}" after a property');
+    }
+}
+function readArray(source, cursor, context) {
+    cursor.index += 1; // [
+    const result = [];
+    for (;;) {
+        skipIgnorable(source, cursor);
+        if (cursor.index >= source.length)
+            fail(source, cursor, context, 'unterminated array');
+        if (source[cursor.index] === ']') {
+            cursor.index += 1;
+            return result;
+        }
+        result.push(readValue(source, cursor, context));
+        skipIgnorable(source, cursor);
+        if (source[cursor.index] === ',') {
+            cursor.index += 1;
+            continue;
+        }
+        if (source[cursor.index] === ']') {
+            cursor.index += 1;
+            return result;
+        }
+        fail(source, cursor, context, 'expected "," or "]" after an element');
+    }
+}
+function readKey(source, cursor, context) {
+    const char = source[cursor.index];
+    if (char === "'" || char === '"')
+        return readString(source, cursor, context);
+    const start = cursor.index;
+    while (cursor.index < source.length && isIdentifierChar(source[cursor.index]))
+        cursor.index += 1;
+    if (cursor.index === start)
+        fail(source, cursor, context, 'expected a property name');
+    return source.slice(start, cursor.index);
+}
+function readString(source, cursor, context) {
+    const quote = source[cursor.index];
+    cursor.index += 1;
+    let out = '';
+    while (cursor.index < source.length) {
+        const char = source[cursor.index];
+        if (char === '\\') {
+            const escaped = source[cursor.index + 1];
+            if (escaped === undefined)
+                break;
+            cursor.index += 2;
+            out += unescape(escaped, source, cursor, context);
+            continue;
+        }
+        if (char === quote) {
+            cursor.index += 1;
+            return out;
+        }
+        if (char === '\n')
+            fail(source, cursor, context, 'a string may not span lines');
+        out += char;
+        cursor.index += 1;
+    }
+    return fail(source, cursor, context, 'unterminated string');
+}
+const SIMPLE_ESCAPES = {
+    n: '\n',
+    t: '\t',
+    r: '\r',
+    b: '\b',
+    f: '\f',
+    v: '\v',
+    '0': '\0',
+};
+function unescape(escaped, source, cursor, context) {
+    if (escaped === 'u') {
+        // Both \uXXXX and \u{XXXX}; the code point is validated rather than trusted.
+        if (source[cursor.index] === '{') {
+            const close = source.indexOf('}', cursor.index);
+            if (close === -1)
+                fail(source, cursor, context, 'unterminated unicode escape');
+            const code = Number.parseInt(source.slice(cursor.index + 1, close), 16);
+            if (!Number.isFinite(code) || code > 0x10ffff) {
+                fail(source, cursor, context, 'invalid unicode escape');
+            }
+            cursor.index = close + 1;
+            return String.fromCodePoint(code);
+        }
+        const digits = source.slice(cursor.index, cursor.index + 4);
+        if (!/^[0-9a-fA-F]{4}$/.test(digits))
+            fail(source, cursor, context, 'invalid unicode escape');
+        cursor.index += 4;
+        return String.fromCharCode(Number.parseInt(digits, 16));
+    }
+    if (escaped === 'x') {
+        const digits = source.slice(cursor.index, cursor.index + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(digits))
+            fail(source, cursor, context, 'invalid hex escape');
+        cursor.index += 2;
+        return String.fromCharCode(Number.parseInt(digits, 16));
+    }
+    return SIMPLE_ESCAPES[escaped] ?? escaped;
+}
+function readNumber(source, cursor, context) {
+    const match = /^-?(?:0[xX][0-9a-fA-F]+|\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|\.\d+(?:[eE][+-]?\d+)?)/.exec(source.slice(cursor.index));
+    if (match === null) {
+        const preview = source.slice(cursor.index, cursor.index + 20).split('\n')[0] ?? '';
+        fail(source, cursor, context, `expected a literal value, found "${preview}"`);
+    }
+    cursor.index += match[0].length;
+    return Number(match[0]);
+}
+function isIdentifierChar(char) {
+    return char !== undefined && /[A-Za-z0-9_$]/.test(char);
+}
+//# sourceMappingURL=js-literal.js.map

package/dist/domain/js-literal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"js-literal.js","sourceRoot":"","sources":["../../src/domain/js-literal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/B,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAMD,SAAS,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe,EAAE,IAAY;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,OAAO,KAAK,IAAI,EAAE,EAAE;QAC3E,OAAO,EAAE,CAAC,WAAW,IAAI,GAAG,CAAC;QAC7B,KAAK,EAAE,CAAC,iFAAiF,CAAC;QAC1F,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,SAAS,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;YAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAE3F,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,OAAO;IACT,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAChE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;IACnC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,MAAM,EAAE,IAAI,CAAC;QACd,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,MAAM,EAAE,IAAI,CAAC;KACN,EAAE,CAAC;QACX,IACE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YACrC,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EACrD,CAAC;YACD,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YAC5B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IACjE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;IACvB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,SAAS,CAAC;QACR,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,yFAAyF;YACzF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,gBAAgB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAElB,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEjD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAChE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;IACvB,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,SAAS,CAAC;QACR,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAEhD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;IACpC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,OAAO,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;QAEnC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM;YACjC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC;QAEhF,GAAG,IAAI,IAAI,CAAC;QACZ,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,cAAc,GAAqC;IACvD,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,IAAI;IACP,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,SAAS,QAAQ,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc,EAAE,OAAe;IAChF,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,6EAA6E;QAC7E,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IACjE,MAAM,KAAK,GACT,gFAAgF,CAAC,IAAI,CACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;IACJ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oCAAoC,OAAO,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB;IAChD,OAAO,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC"}

package/dist/domain/lockfile.d.ts

@@ -0,0 +1,36 @@
+import { type SemanticVersion } from './version.ts';
+import type { AgentId } from './agent.ts';
+/**
+ * `skills.lock` makes a project install reproducible. It is written for project scope only:
+ * a user's global agent configuration is a mutable environment, not a build artefact.
+ */
+export declare const LOCKFILE_NAME = "skills.lock";
+export declare const CURRENT_LOCKFILE_VERSION = 1;
+export interface LockedSkill {
+    readonly version: SemanticVersion;
+    /** Configured registry name the version came from. Pinning it defeats registry reordering. */
+    readonly registry: string;
+    /** Fully qualified location, for auditing and for offline diagnosis. */
+    readonly resolved: string;
+    readonly integrity: string;
+    readonly agents: readonly AgentId[];
+    /** Exact versions this skill's dependencies resolved to, for a readable diff. */
+    readonly dependencies: Readonly<Record<string, SemanticVersion>>;
+}
+export interface Lockfile {
+    readonly lockfileVersion: number;
+    readonly generatedWith?: string;
+    /** Sorted by name so diffs stay minimal and merge conflicts stay local. */
+    readonly skills: Readonly<Record<string, LockedSkill>>;
+}
+export declare function emptyLockfile(generatedWith?: string): Lockfile;
+export declare function parseLockfile(text: string, source?: string): Lockfile;
+export declare function stringifyLockfile(lock: Lockfile): string;
+export declare function withSkill(lock: Lockfile, name: string, entry: LockedSkill): Lockfile;
+export declare function withoutSkill(lock: Lockfile, name: string): Lockfile;
+/**
+ * Guards against a registry serving different bytes for a version we have already pinned.
+ * A mismatch is a security event, not a cache-miss: it aborts rather than re-resolving.
+ */
+export declare function assertIntegrityMatches(name: string, expected: string, actual: string, source?: string): void;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/domain/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/domain/lockfile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CACxD;AAED,wBAAgB,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAM9D;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAgB,GAAG,QAAQ,CA2D5E;AAsDD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAyBxD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,QAAQ,CAEpF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAInE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,SAAgB,GACrB,IAAI,CAgBN"}