@skillerr/core 0.6.0

package/dist/mint.js

@@ -0,0 +1,467 @@
+import { readFileSync } from "node:fs";
+import { detectAgentRuntimeMarkers, hasAgentRuntimeEvidence, isValidAgentHost, } from "@skillerr/protocol";
+import { canonicalize, PUBLIC_DEV_MINT_KEY, PUBLIC_DEV_MINT_KEY_ID, sealedManifestDigest, sha256Digest, } from "./hash.js";
+import { packSkill, unpackSkill } from "./pack.js";
+import { validatePackageBytes } from "./validate.js";
+function loadCoreIdentity() {
+    const metadata = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof metadata.name !== "string" || typeof metadata.version !== "string") {
+        throw new Error("Invalid @skillerr/core package metadata");
+    }
+    return { name: metadata.name, version: metadata.version };
+}
+const CORE_IDENTITY = loadCoreIdentity();
+function resolveIssuerClass(secret, keyId) {
+    if (secret === PUBLIC_DEV_MINT_KEY || keyId === PUBLIC_DEV_MINT_KEY_ID) {
+        return "public_dev_hmac";
+    }
+    return "configured_hmac";
+}
+function resolveHostClaimBinding(opts, issuerClass, markers) {
+    if (opts.host_claim_binding === "verified_issuer") {
+        if (issuerClass === "public_dev_hmac") {
+            throw new Error("Cannot mark host_claim_binding=verified_issuer with the public development HMAC key");
+        }
+        if (!hasAgentRuntimeEvidence(opts.agent_runtime_evidence, opts.env) && markers.length === 0) {
+            throw new Error("verified_issuer host binding requires agent runtime evidence (markers or session_id)");
+        }
+        return "verified_issuer";
+    }
+    return "self_reported";
+}
+/**
+ * Seal a draft package as minted.
+ * Content under signatures/ may change; package_digest (content) stays fixed after finalize.
+ *
+ * Trust rules:
+ * - Forbidden hosts (human/cli/shell/manual/…) refuse mint entirely.
+ * - Env-only SKILL_HOST without agent runtime markers still mints, but as self_reported
+ *   + public_dev_hmac — never production trust.
+ * - Seal binds sealed_manifest_digest (identity + policy + content claims).
+ */
+export function mintSkillPackage(pkg, opts) {
+    if (!isValidAgentHost(opts.host)) {
+        throw new Error(`Mint host "${opts.host}" is not a valid AI agent host (denylisted human/cli/shell/manual). ` +
+            `Use an agent host id such as cursor, ollama, lmstudio, llama-cpp, custom-agent.`);
+    }
+    if (pkg.manifest.needs_human_review) {
+        throw new Error("Cannot mint while needs_human_review is true — approve inputs/permissions first");
+    }
+    if (pkg.manifest.compile_profile !== "release") {
+        throw new Error("Cannot mint: compile_profile must be release. Complete the journey and release compile first.");
+    }
+    if (!pkg.manifest.completeness?.complete) {
+        throw new Error(`Cannot mint incomplete skill. Missing: ${pkg.manifest.completeness?.missing.join(", ") || "completeness report"}`);
+    }
+    const report = pkg.provenance?.compilation_report;
+    if (!report ||
+        report.profile !== "release" ||
+        report.semantic_contract !== "native_0.5" ||
+        !report.completeness.complete ||
+        !report.approved ||
+        report.pending_approvals.length > 0) {
+        throw new Error("Cannot mint: approved release compilation report required");
+    }
+    const pending = pkg.manifest.inputs.filter((i) => i.required && i.approved !== true);
+    if (pending.length) {
+        throw new Error(`Cannot mint with unapproved inputs: ${pending.map((p) => p.name).join(", ")}`);
+    }
+    const draftBytes = packSkill({
+        ...pkg,
+        signatures: undefined,
+        attestation: undefined,
+        anchors: pkg.anchors ?? pkg.manifest.anchors,
+    });
+    const unpacked = unpackSkill(draftBytes);
+    const package_digest = unpacked.manifest.package_digest;
+    const agentRuntime = opts.agent_runtime ?? CORE_IDENTITY.name;
+    const agentVersion = opts.agent_version ?? (agentRuntime === CORE_IDENTITY.name ? CORE_IDENTITY.version : "unknown");
+    const secret = opts.issuer_secret ?? PUBLIC_DEV_MINT_KEY;
+    const keyId = opts.key_id ?? (secret === PUBLIC_DEV_MINT_KEY ? PUBLIC_DEV_MINT_KEY_ID : "configured-issuer");
+    const issuer_class = resolveIssuerClass(secret, keyId);
+    const markers = [
+        ...detectAgentRuntimeMarkers(opts.env),
+        ...(opts.agent_runtime_evidence?.markers ?? []),
+    ].filter((m, i, arr) => arr.indexOf(m) === i);
+    const host_claim_binding = resolveHostClaimBinding(opts, issuer_class, markers);
+    // Apply seal-bound policy updates before hashing sealed_manifest_digest so
+    // attestation covers the final identity/policy/content claims.
+    const sealedManifestBase = {
+        ...unpacked.manifest,
+        policy: {
+            ...unpacked.manifest.policy,
+            require_signatures: true,
+            require_minted: true,
+            trust_profile: opts.policy_profile ?? "minted",
+        },
+    };
+    const sealed_manifest_digest = sealedManifestDigest(sealedManifestBase);
+    const attestation = {
+        kind: "creation_attestation",
+        package_digest,
+        sealed_manifest_digest,
+        skill_id: pkg.manifest.id,
+        skill_version: pkg.manifest.version,
+        minted_at: new Date().toISOString(),
+        agent: {
+            runtime: agentRuntime,
+            version: agentVersion,
+            key_id: keyId,
+        },
+        host: opts.host,
+        provider: opts.provider,
+        model: opts.model,
+        deployment: opts.deployment,
+        endpoint: opts.endpoint,
+        host_claim_binding,
+        issuer_class,
+        agent_runtime_markers: markers.length ? markers : undefined,
+        journey: {
+            source_id: pkg.provenance?.compilation_report?.source_id,
+            source_hash: pkg.provenance?.proof &&
+                typeof pkg.provenance.proof === "object" &&
+                pkg.provenance.proof !== null &&
+                "source_hash" in pkg.provenance.proof
+                ? String(pkg.provenance.proof.source_hash)
+                : undefined,
+            recipe_id: pkg.provenance?.compilation_report?.recipe_id,
+            recipe_hash: pkg.provenance?.recipe &&
+                typeof pkg.provenance.recipe === "object" &&
+                pkg.provenance.recipe !== null &&
+                "hash" in pkg.provenance.recipe
+                ? String(pkg.provenance.recipe.hash)
+                : undefined,
+            proof_digest: pkg.provenance?.proof
+                ? sha256Digest(canonicalize(pkg.provenance.proof))
+                : undefined,
+            summary: pkg.provenance?.journey?.summary,
+        },
+        generation_usage: pkg.provenance?.generation_usage,
+        human_approvals: {
+            inputs: pkg.manifest.inputs.filter((i) => i.approved === true).map((i) => i.name),
+            permissions: pkg.manifest.permissions
+                .filter((p) => p.requires_consent)
+                .map((p) => p.side_effect_class),
+            actors: opts.actors ?? ["human"],
+        },
+        policy_profile: opts.policy_profile ?? "minted",
+    };
+    const payload = canonicalize(attestation);
+    const payloadDigest = sha256Digest(payload);
+    const sig = sha256Digest(`${secret}:${payloadDigest}`);
+    const dsse = {
+        payloadType: "application/vnd.dot-skill.creation-attestation+json",
+        payload_digest: payloadDigest,
+        signatures: [{ keyid: attestation.agent.key_id, sig }],
+        attestation,
+    };
+    const minted = {
+        ...unpacked.raw,
+        manifest: {
+            ...sealedManifestBase,
+            mint: {
+                mint_status: "minted",
+                minted_at: attestation.minted_at,
+                mint_issuer: attestation.agent.runtime,
+                content_id: package_digest,
+            },
+            attestation_digest: payloadDigest,
+            sealed_manifest_digest,
+        },
+        attestation,
+        signatures: {
+            "creation.dsse.json": dsse,
+        },
+        anchors: unpacked.raw.anchors ?? unpacked.manifest.anchors,
+    };
+    const packageBytes = packSkill(minted);
+    const verify = unpackSkill(packageBytes);
+    if (verify.manifest.package_digest !== package_digest) {
+        throw new Error(`Mint changed content digest (${verify.manifest.package_digest} != ${package_digest})`);
+    }
+    return { files: { ...minted, manifest: verify.manifest }, packageBytes, attestation };
+}
+export function addPermanenceAnchor(archive, anchor) {
+    const unpacked = unpackSkill(archive);
+    const package_digest = unpacked.manifest.package_digest;
+    const full = {
+        ...anchor,
+        package_digest: anchor.package_digest ?? package_digest,
+    };
+    if (full.package_digest !== package_digest) {
+        throw new Error("Anchor package_digest must match skill package_digest");
+    }
+    const anchors = [...(unpacked.manifest.anchors ?? []), full];
+    const files = {
+        ...unpacked.raw,
+        manifest: {
+            ...unpacked.manifest,
+            anchors,
+        },
+        anchors,
+        signatures: {
+            ...(unpacked.raw.signatures ?? {}),
+            [`anchors/${anchors.length}-${full.kind}.json`]: full,
+        },
+    };
+    return packSkill(files);
+}
+function extractAttestation(unpacked) {
+    const envelope = unpacked.raw.signatures?.["creation.dsse.json"];
+    const attestation = envelope?.attestation ?? unpacked.raw.attestation;
+    return { attestation, envelope };
+}
+function classifyTrustState(attestation, signedOk) {
+    if (!attestation || !signedOk)
+        return "untrusted";
+    if (attestation.issuer_class === "public_dev_hmac")
+        return "development";
+    if (attestation.host_claim_binding === "verified_issuer")
+        return "verified_issuer";
+    return "self_reported";
+}
+export function verifyMintTrust(archive, profile = "minted", issuer_secret_or_opts) {
+    const opts = typeof issuer_secret_or_opts === "string"
+        ? { issuer_secret: issuer_secret_or_opts }
+        : (issuer_secret_or_opts ?? {});
+    const base = validatePackageBytes(archive);
+    const issues = [...base.issues];
+    const unpacked = unpackSkill(archive);
+    const mintStatus = unpacked.manifest.mint?.mint_status ?? "draft";
+    const { attestation, envelope } = extractAttestation(unpacked);
+    let signedOk = false;
+    if (profile !== "open") {
+        if (mintStatus !== "minted") {
+            issues.push({
+                severity: "error",
+                code: "not_minted",
+                message: "Trust profile requires mint_status=minted",
+            });
+        }
+        if (!attestation) {
+            issues.push({
+                severity: "error",
+                code: "missing_attestation",
+                message: "Minted skills require CreationAttestation",
+            });
+        }
+        else if (!envelope?.signatures?.[0]?.sig) {
+            issues.push({
+                severity: "error",
+                code: "missing_attestation_signature",
+                message: "Minted trust profile requires a signed DSSE attestation envelope",
+            });
+        }
+        else if (attestation.package_digest !== unpacked.manifest.package_digest) {
+            issues.push({
+                severity: "error",
+                code: "attestation_digest_mismatch",
+                message: "Attestation package_digest does not match manifest",
+            });
+        }
+        else {
+            const expectedSealed = sealedManifestDigest(unpacked.manifest);
+            const sealed = attestation.sealed_manifest_digest ?? unpacked.manifest.sealed_manifest_digest;
+            if (!sealed) {
+                issues.push({
+                    severity: "error",
+                    code: "missing_sealed_manifest_digest",
+                    message: "Attestation must bind sealed_manifest_digest over identity/policy/content claims",
+                });
+            }
+            else if (sealed !== expectedSealed) {
+                issues.push({
+                    severity: "error",
+                    code: "sealed_manifest_digest_mismatch",
+                    message: "sealed_manifest_digest does not match current manifest claims",
+                });
+            }
+            if (unpacked.manifest.sealed_manifest_digest &&
+                unpacked.manifest.sealed_manifest_digest !== sealed) {
+                issues.push({
+                    severity: "error",
+                    code: "manifest_sealed_digest_mismatch",
+                    message: "Manifest sealed_manifest_digest does not match attestation",
+                });
+            }
+            const payloadDigest = sha256Digest(canonicalize(attestation));
+            if (envelope.payload_digest !== payloadDigest) {
+                issues.push({
+                    severity: "error",
+                    code: "attestation_payload_digest",
+                    message: "DSSE payload_digest does not match CreationAttestation",
+                });
+            }
+            const issuerClass = attestation.issuer_class ??
+                (attestation.agent.key_id === PUBLIC_DEV_MINT_KEY_ID
+                    ? "public_dev_hmac"
+                    : "configured_hmac");
+            // Fail closed: public-dev HMAC is never production trust unless explicitly allowed.
+            if (issuerClass === "public_dev_hmac" && !opts.allow_development_issuer) {
+                issues.push({
+                    severity: "error",
+                    code: "public_dev_issuer_untrusted",
+                    message: "Seal uses the public development HMAC key — not production trust. " +
+                        "Pass allow_development_issuer only for local testing, or mint with a configured issuer secret.",
+                });
+            }
+            const hostBinding = attestation.host_claim_binding ?? "self_reported";
+            if (hostBinding === "self_reported" &&
+                !opts.allow_self_reported &&
+                !opts.allow_development_issuer) {
+                issues.push({
+                    severity: "error",
+                    code: "self_reported_host_untrusted",
+                    message: "Host/model claims are self_reported (e.g. SKILL_HOST env alone). " +
+                        "Not treated as verified_issuer trust.",
+                });
+            }
+            const secret = opts.issuer_secret ??
+                (issuerClass === "public_dev_hmac" ? PUBLIC_DEV_MINT_KEY : undefined);
+            if (!secret) {
+                issues.push({
+                    severity: "error",
+                    code: "issuer_secret_required",
+                    message: "Configured issuer seal requires a matching issuer_secret in the trust store",
+                });
+            }
+            else {
+                const expected = sha256Digest(`${secret}:${payloadDigest}`);
+                const sig = envelope?.signatures?.[0]?.sig;
+                if (sig !== expected) {
+                    issues.push({
+                        severity: "error",
+                        code: "attestation_sig_invalid",
+                        message: "CreationAttestation signature failed verification",
+                    });
+                }
+                else {
+                    signedOk = true;
+                }
+            }
+            if (issuerClass === "public_dev_hmac") {
+                issues.push({
+                    severity: "warning",
+                    code: "development_attestation",
+                    message: "Attestation uses the public development key — labeled development, never production identity",
+                });
+            }
+        }
+    }
+    else if (attestation && envelope?.signatures?.[0]?.sig) {
+        // open profile: still classify if a seal is present
+        const payloadDigest = sha256Digest(canonicalize(attestation));
+        const secret = opts.issuer_secret ?? PUBLIC_DEV_MINT_KEY;
+        signedOk = envelope.signatures[0].sig === sha256Digest(`${secret}:${payloadDigest}`);
+    }
+    if (profile === "anchored") {
+        const anchors = unpacked.manifest.anchors ?? [];
+        if (!anchors.length) {
+            issues.push({
+                severity: "error",
+                code: "anchor_required",
+                message: "Trust profile requires at least one PermanenceAnchor",
+            });
+        }
+    }
+    if (profile.startsWith("issuer:")) {
+        const want = profile.slice("issuer:".length);
+        if (attestation?.agent.runtime !== want && attestation?.agent.key_id !== want) {
+            issues.push({
+                severity: "error",
+                code: "issuer_mismatch",
+                message: `Attestation issuer does not match ${profile}`,
+            });
+        }
+    }
+    const trust_state = classifyTrustState(attestation, signedOk);
+    return {
+        ok: !issues.some((i) => i.severity === "error"),
+        issues,
+        attestation,
+        trust_state,
+    };
+}
+/**
+ * TrustView from skill.json + signatures + digests only — no compile, no model body ingest.
+ */
+export function inspectTrustView(archive) {
+    const base = validatePackageBytes(archive);
+    const warnings = [];
+    if (!base.manifest) {
+        return {
+            trust_state: "untrusted",
+            mint_status: "draft",
+            signed: false,
+            package_digest: "",
+            label: "INVALID — package failed validation",
+            warnings: [],
+            issues: base.issues,
+        };
+    }
+    const unpacked = unpackSkill(archive);
+    const m = unpacked.manifest;
+    const mint_status = m.mint?.mint_status ?? "draft";
+    const { attestation, envelope } = extractAttestation(unpacked);
+    const signed = Boolean(envelope?.signatures?.[0]?.sig && attestation);
+    let trust_state = "untrusted";
+    let label = "UNSIGNED / OPEN — untrusted";
+    if (mint_status === "draft" || !signed) {
+        trust_state = "untrusted";
+        label = "UNSIGNED / OPEN — untrusted (do not execute without --allow-untrusted)";
+        warnings.push("Package has no verified creation seal");
+    }
+    else {
+        const verify = verifyMintTrust(archive, "minted", {
+            allow_development_issuer: true,
+            allow_self_reported: true,
+        });
+        trust_state = verify.trust_state;
+        if (trust_state === "development") {
+            label = "DEVELOPMENT seal (public-dev HMAC) — not production trust";
+            warnings.push("Public development HMAC is forgeable; treat as untrusted for production execute");
+        }
+        else if (trust_state === "self_reported") {
+            label = "SELF-REPORTED agent host claims — signed but not verified_issuer";
+            warnings.push("Host/provider/model are self-asserted; local LLMs can lie about authorship");
+        }
+        else if (trust_state === "verified_issuer") {
+            label = "VERIFIED ISSUER seal — host claims bound by configured issuer";
+            warnings.push("Issuer key authenticity is established; model honesty (esp. local LLMs) remains a residual risk");
+        }
+        else {
+            label = "UNTRUSTED — seal present but verification failed";
+        }
+        for (const issue of verify.issues) {
+            if (issue.severity === "warning")
+                warnings.push(issue.message);
+        }
+    }
+    const expectedSealed = sealedManifestDigest(m);
+    return {
+        trust_state,
+        mint_status,
+        signed,
+        issuer: attestation?.agent.runtime ?? m.mint?.mint_issuer,
+        issuer_class: attestation?.issuer_class,
+        host_claim_binding: attestation?.host_claim_binding,
+        agent: attestation
+            ? {
+                host: attestation.host,
+                provider: attestation.provider,
+                model: attestation.model,
+                runtime: attestation.agent.runtime,
+                version: attestation.agent.version,
+                key_id: attestation.agent.key_id,
+                deployment: attestation.deployment,
+                markers: attestation.agent_runtime_markers,
+            }
+            : undefined,
+        package_digest: m.package_digest,
+        sealed_manifest_digest: attestation?.sealed_manifest_digest ?? m.sealed_manifest_digest ?? expectedSealed,
+        attestation_digest: m.attestation_digest,
+        label,
+        warnings,
+        issues: base.issues,
+    };
+}

package/dist/pack.d.ts

@@ -0,0 +1,20 @@
+import type { KnowledgeItem, SkillManifest, SkillPackageFiles, Workflow, CompilationReport } from "@skillerr/protocol";
+export interface PackOptions {
+    recomputeDigests?: boolean;
+}
+export declare function buildFileMap(pkg: SkillPackageFiles): Record<string, Uint8Array>;
+/**
+ * Content index covers every file except `skill.json` and `signatures/**`.
+ * `package_digest` is the digest of that index (RFC8785 JCS + SHA-256).
+ */
+export declare function finalizeManifest(base: Omit<SkillManifest, "content" | "package_digest"> & Partial<Pick<SkillManifest, "content" | "package_digest">>, files: Record<string, Uint8Array>): SkillManifest;
+export declare function packSkill(pkg: SkillPackageFiles, _opts?: PackOptions): Uint8Array;
+export interface UnpackResult {
+    files: Record<string, Uint8Array>;
+    manifest: SkillManifest;
+    workflow: Workflow;
+    knowledge: KnowledgeItem[];
+    compilation_report?: CompilationReport;
+    raw: SkillPackageFiles;
+}
+export declare function unpackSkill(archive: Uint8Array): UnpackResult;

package/dist/pack.js

@@ -0,0 +1,191 @@
+import { zipSync, unzipSync, strToU8, strFromU8 } from "fflate";
+import { packageDigestFromContent, sha256Digest } from "./hash.js";
+import { assertSafePaths, MAX_COMPRESSION_RATIO, MAX_ENTRIES, MAX_UNCOMPRESSED_BYTES, normalizePath, } from "./paths.js";
+function toBytes(data) {
+    return typeof data === "string" ? strToU8(data) : data;
+}
+function textEncode(obj) {
+    return strToU8(JSON.stringify(obj, null, 2) + "\n");
+}
+export function buildFileMap(pkg) {
+    const files = {};
+    files["workflow.json"] = textEncode(pkg.workflow);
+    for (const item of pkg.knowledge) {
+        files[`knowledge/${item.id}.json`] = textEncode(item);
+    }
+    if (pkg.prompts) {
+        for (const [name, body] of Object.entries(pkg.prompts)) {
+            files[`prompts/${normalizePath(name)}`] = toBytes(body);
+        }
+    }
+    if (pkg.resources) {
+        for (const [name, body] of Object.entries(pkg.resources)) {
+            files[`resources/${normalizePath(name)}`] = toBytes(body);
+        }
+    }
+    if (pkg.artifacts) {
+        for (const [name, body] of Object.entries(pkg.artifacts)) {
+            files[`artifacts/${normalizePath(name)}`] = toBytes(body);
+        }
+    }
+    if (pkg.provenance?.recipe) {
+        files["provenance/recipe.json"] = textEncode(pkg.provenance.recipe);
+    }
+    if (pkg.provenance?.source) {
+        files["provenance/source.json"] = textEncode(pkg.provenance.source);
+    }
+    if (pkg.provenance?.journey) {
+        files["provenance/journey.json"] = textEncode(pkg.provenance.journey);
+    }
+    if (pkg.provenance?.generation_usage) {
+        files["provenance/generation_usage.json"] = textEncode(pkg.provenance.generation_usage);
+    }
+    if (pkg.provenance?.proof) {
+        files["provenance/proof.json"] = textEncode(pkg.provenance.proof);
+    }
+    if (pkg.provenance?.compilation_report) {
+        files["provenance/compilation_report.json"] = textEncode(pkg.provenance.compilation_report);
+    }
+    if (pkg.attestation && !pkg.signatures?.["creation.dsse.json"]) {
+        files["signatures/creation.attestation.json"] = textEncode(pkg.attestation);
+    }
+    if (pkg.signatures) {
+        for (const [name, body] of Object.entries(pkg.signatures)) {
+            files[`signatures/${normalizePath(name)}`] = textEncode(body);
+        }
+    }
+    if (pkg.anchors) {
+        pkg.anchors.forEach((anchor, i) => {
+            const path = `signatures/anchors/${i}-${anchor.kind}.json`;
+            if (!files[path])
+                files[path] = textEncode(anchor);
+        });
+    }
+    return files;
+}
+/**
+ * Content index covers every file except `skill.json` and `signatures/**`.
+ * `package_digest` is the digest of that index (RFC8785 JCS + SHA-256).
+ */
+export function finalizeManifest(base, files) {
+    const content = Object.keys(files)
+        .filter((p) => p !== "skill.json" && !p.startsWith("signatures/"))
+        .sort()
+        .map((path) => ({
+        path,
+        digest: sha256Digest(files[path]),
+        bytes: files[path].byteLength,
+    }));
+    return {
+        ...base,
+        mint: base.mint ?? { mint_status: "draft" },
+        content,
+        package_digest: packageDigestFromContent(content),
+    };
+}
+export function packSkill(pkg, _opts = {}) {
+    const files = buildFileMap(pkg);
+    const manifest = finalizeManifest(pkg.manifest, files);
+    files["skill.json"] = textEncode(manifest);
+    assertSafePaths(Object.keys(files));
+    if (Object.keys(files).length > MAX_ENTRIES) {
+        throw new Error(`Too many entries: ${Object.keys(files).length}`);
+    }
+    let total = 0;
+    for (const bytes of Object.values(files))
+        total += bytes.byteLength;
+    if (total > MAX_UNCOMPRESSED_BYTES) {
+        throw new Error(`Package too large: ${total} bytes`);
+    }
+    return zipSync(files, { level: 6 });
+}
+export function unpackSkill(archive) {
+    if (archive.byteLength > MAX_UNCOMPRESSED_BYTES * 2) {
+        throw new Error("Archive too large to unpack");
+    }
+    const unzipped = unzipSync(archive);
+    const paths = Object.keys(unzipped);
+    if (paths.length > MAX_ENTRIES)
+        throw new Error("Too many zip entries");
+    assertSafePaths(paths);
+    let uncompressed = 0;
+    for (const data of Object.values(unzipped)) {
+        uncompressed += data.byteLength;
+        if (uncompressed > MAX_UNCOMPRESSED_BYTES) {
+            throw new Error("Uncompressed size exceeds limit");
+        }
+        const ratio = archive.byteLength > 0 ? uncompressed / archive.byteLength : 0;
+        if (ratio > MAX_COMPRESSION_RATIO && uncompressed > 1_000_000) {
+            throw new Error("Suspicious compression ratio");
+        }
+    }
+    const skillJson = unzipped["skill.json"];
+    if (!skillJson)
+        throw new Error("Missing skill.json");
+    const workflowJson = unzipped["workflow.json"];
+    if (!workflowJson)
+        throw new Error("Missing workflow.json");
+    const manifest = JSON.parse(strFromU8(skillJson));
+    const workflow = JSON.parse(strFromU8(workflowJson));
+    const knowledge = [];
+    for (const [path, data] of Object.entries(unzipped)) {
+        if (path.startsWith("knowledge/") && path.endsWith(".json")) {
+            knowledge.push(JSON.parse(strFromU8(data)));
+        }
+    }
+    let compilation_report;
+    if (unzipped["provenance/compilation_report.json"]) {
+        compilation_report = JSON.parse(strFromU8(unzipped["provenance/compilation_report.json"]));
+    }
+    const prompts = {};
+    const resources = {};
+    const artifacts = {};
+    const signatures = {};
+    for (const [path, data] of Object.entries(unzipped)) {
+        if (path.startsWith("prompts/"))
+            prompts[path.slice("prompts/".length)] = strFromU8(data);
+        if (path.startsWith("resources/"))
+            resources[path.slice("resources/".length)] = data;
+        if (path.startsWith("artifacts/"))
+            artifacts[path.slice("artifacts/".length)] = data;
+        if (path.startsWith("signatures/") && path.endsWith(".json")) {
+            signatures[path.slice("signatures/".length)] = JSON.parse(strFromU8(data));
+        }
+    }
+    const creation = signatures["creation.dsse.json"];
+    const attestation = creation?.attestation ??
+        signatures["creation.attestation.json"];
+    const anchorsFromSig = Object.entries(signatures)
+        .filter(([k]) => k.startsWith("anchors/"))
+        .map(([, v]) => v);
+    const raw = {
+        manifest,
+        workflow,
+        knowledge,
+        prompts,
+        artifacts,
+        resources,
+        provenance: {
+            recipe: unzipped["provenance/recipe.json"]
+                ? JSON.parse(strFromU8(unzipped["provenance/recipe.json"]))
+                : undefined,
+            source: unzipped["provenance/source.json"]
+                ? JSON.parse(strFromU8(unzipped["provenance/source.json"]))
+                : undefined,
+            journey: unzipped["provenance/journey.json"]
+                ? JSON.parse(strFromU8(unzipped["provenance/journey.json"]))
+                : undefined,
+            generation_usage: unzipped["provenance/generation_usage.json"]
+                ? JSON.parse(strFromU8(unzipped["provenance/generation_usage.json"]))
+                : undefined,
+            proof: unzipped["provenance/proof.json"]
+                ? JSON.parse(strFromU8(unzipped["provenance/proof.json"]))
+                : undefined,
+            compilation_report,
+        },
+        signatures,
+        attestation,
+        anchors: manifest.anchors?.length ? manifest.anchors : anchorsFromSig,
+    };
+    return { files: unzipped, manifest, workflow, knowledge, compilation_report, raw };
+}

package/dist/paths.d.ts

@@ -0,0 +1,5 @@
+export declare function normalizePath(path: string): string;
+export declare function assertSafePaths(paths: string[]): void;
+export declare const MAX_ENTRIES = 10000;
+export declare const MAX_UNCOMPRESSED_BYTES: number;
+export declare const MAX_COMPRESSION_RATIO = 100;