@skillerr/core 0.6.0

package/dist/paths.js

@@ -0,0 +1,22 @@
+const UNSAFE = /(^\/)|(\.\.)|(^$)/;
+export function normalizePath(path) {
+    const nfc = path.normalize("NFC").replace(/\\/g, "/");
+    if (nfc.includes("\0"))
+        throw new Error(`Null byte in path: ${path}`);
+    if (UNSAFE.test(nfc) || nfc.split("/").some((s) => s === "" || s === "." || s === "..")) {
+        throw new Error(`Unsafe path: ${path}`);
+    }
+    return nfc;
+}
+export function assertSafePaths(paths) {
+    const seen = new Set();
+    for (const p of paths) {
+        const n = normalizePath(p);
+        if (seen.has(n))
+            throw new Error(`Duplicate path: ${n}`);
+        seen.add(n);
+    }
+}
+export const MAX_ENTRIES = 10_000;
+export const MAX_UNCOMPRESSED_BYTES = 64 * 1024 * 1024;
+export const MAX_COMPRESSION_RATIO = 100;

package/dist/validate.d.ts

@@ -0,0 +1,36 @@
+import type { SkillManifest, Workflow } from "@skillerr/protocol";
+export interface ValidationIssue {
+    severity: "error" | "warning";
+    code: string;
+    message: string;
+    path?: string;
+}
+export interface ValidationResult {
+    ok: boolean;
+    issues: ValidationIssue[];
+    manifest?: SkillManifest;
+    workflow?: Workflow;
+}
+export declare function validateManifestShape(manifest: SkillManifest): ValidationIssue[];
+export declare function validateWorkflowShape(workflow: Workflow, entrypoint: string): ValidationIssue[];
+export declare function validatePackageBytes(archive: Uint8Array): ValidationResult;
+export declare function inspectSkill(archive: Uint8Array): {
+    ok: boolean;
+    summary: {
+        id: string;
+        version: string;
+        title: string;
+        description: string;
+        intent?: string;
+        inputs: string[];
+        permissions: string[];
+        capabilities: string[];
+        package_digest: string;
+        sealed_manifest_digest?: string;
+        mint_status?: string;
+        needs_human_review?: boolean;
+        trust_label?: string;
+        trust_state?: string;
+    };
+    issues: ValidationIssue[];
+};

package/dist/validate.js

@@ -0,0 +1,274 @@
+import { assessSkillContract, CONTAINER_VERSION, PROTOCOL_VERSION, WORKFLOW_DIALECT_VERSION, } from "@skillerr/protocol";
+import { packageDigestFromContent, sha256Digest } from "./hash.js";
+import { unpackSkill } from "./pack.js";
+export function validateManifestShape(manifest) {
+    const issues = [];
+    if (manifest.kind !== "dot-skill") {
+        issues.push({ severity: "error", code: "kind", message: "kind must be dot-skill" });
+    }
+    if (!manifest.id)
+        issues.push({ severity: "error", code: "id", message: "id required" });
+    if (!manifest.version)
+        issues.push({ severity: "error", code: "version", message: "version required" });
+    if (!manifest.title)
+        issues.push({ severity: "error", code: "title", message: "title required" });
+    if (!manifest.description)
+        issues.push({
+            severity: "error",
+            code: "description",
+            message: "description required",
+        });
+    if (!manifest.entrypoint)
+        issues.push({
+            severity: "error",
+            code: "entrypoint",
+            message: "entrypoint required",
+        });
+    if (manifest.container_version !== CONTAINER_VERSION) {
+        issues.push({
+            severity: "warning",
+            code: "container_version",
+            message: `Unexpected container_version ${manifest.container_version}`,
+        });
+    }
+    if (manifest.protocol_version !== PROTOCOL_VERSION) {
+        issues.push({
+            severity: "error",
+            code: "protocol_version",
+            message: `Unsupported protocol_version ${manifest.protocol_version}; expected ${PROTOCOL_VERSION}`,
+        });
+    }
+    if (manifest.compile_profile === "release") {
+        if (!manifest.contract) {
+            issues.push({
+                severity: "error",
+                code: "release_contract_missing",
+                message: "Release packages require a native 0.5 authoring contract",
+            });
+        }
+        else {
+            for (const issue of assessSkillContract(manifest.contract, "release").issues) {
+                issues.push({
+                    severity: "error",
+                    code: `contract_${issue.code}`,
+                    message: `${issue.field}: ${issue.message}`,
+                    path: issue.field,
+                });
+            }
+        }
+    }
+    if (manifest.mint?.mint_status === "minted") {
+        if (manifest.compile_profile !== "release") {
+            issues.push({
+                severity: "error",
+                code: "minted_profile",
+                message: "Minted packages must use compile_profile=release",
+            });
+        }
+        if (!manifest.completeness?.complete) {
+            issues.push({
+                severity: "error",
+                code: "minted_incomplete",
+                message: "Minted packages require a complete release report",
+            });
+        }
+    }
+    for (const input of manifest.inputs ?? []) {
+        if (input.sensitivity === "secret" && input.examples?.length) {
+            issues.push({
+                severity: "error",
+                code: "secret_examples",
+                message: `Input ${input.name} is secret but includes examples`,
+                path: input.name,
+            });
+        }
+    }
+    return issues;
+}
+export function validateWorkflowShape(workflow, entrypoint) {
+    const issues = [];
+    if (workflow.kind !== "workflow") {
+        issues.push({ severity: "error", code: "workflow_kind", message: "kind must be workflow" });
+    }
+    if (workflow.dialect_version !== WORKFLOW_DIALECT_VERSION) {
+        issues.push({
+            severity: "warning",
+            code: "dialect",
+            message: `Unexpected dialect_version ${workflow.dialect_version}`,
+        });
+    }
+    const ids = new Set(workflow.steps.map((s) => s.id));
+    if (!ids.has(entrypoint)) {
+        issues.push({
+            severity: "error",
+            code: "entrypoint_missing",
+            message: `Entrypoint ${entrypoint} not in steps`,
+        });
+    }
+    for (const step of workflow.steps) {
+        if (!step.id || !step.kind) {
+            issues.push({
+                severity: "error",
+                code: "step",
+                message: "Each step needs id and kind",
+            });
+        }
+        const refs = [
+            ...(typeof step.next === "string" ? [step.next] : step.next ?? []),
+            ...(step.on_fail ? [step.on_fail] : []),
+            ...(step.kind === "branch"
+                ? [...step.cases.map((branch) => branch.goto), ...(step.else ? [step.else] : [])]
+                : []),
+        ];
+        for (const ref of refs) {
+            if (!ids.has(ref)) {
+                issues.push({
+                    severity: "error",
+                    code: "step_reference_missing",
+                    message: `Step ${step.id} references missing step ${ref}`,
+                    path: step.id,
+                });
+            }
+        }
+    }
+    return issues;
+}
+export function validatePackageBytes(archive) {
+    const issues = [];
+    let unpacked;
+    try {
+        unpacked = unpackSkill(archive);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            issues: [
+                {
+                    severity: "error",
+                    code: "unpack",
+                    message: e instanceof Error ? e.message : String(e),
+                },
+            ],
+        };
+    }
+    issues.push(...validateManifestShape(unpacked.manifest));
+    issues.push(...validateWorkflowShape(unpacked.workflow, unpacked.manifest.entrypoint));
+    const computed = [];
+    for (const [path, data] of Object.entries(unpacked.files)) {
+        if (path === "skill.json" || path.startsWith("signatures/"))
+            continue;
+        const digest = sha256Digest(data);
+        computed.push({ path, digest });
+        const listed = unpacked.manifest.content.find((c) => c.path === path);
+        if (!listed) {
+            issues.push({
+                severity: "error",
+                code: "missing_content_entry",
+                message: `File ${path} not listed in manifest.content`,
+                path,
+            });
+        }
+        else if (listed.digest !== digest) {
+            issues.push({
+                severity: "error",
+                code: "digest_mismatch",
+                message: `Digest mismatch for ${path}`,
+                path,
+            });
+        }
+    }
+    for (const entry of unpacked.manifest.content) {
+        if (!unpacked.files[entry.path]) {
+            issues.push({
+                severity: "error",
+                code: "missing_file",
+                message: `Manifest lists missing file ${entry.path}`,
+                path: entry.path,
+            });
+        }
+    }
+    const expectedPkg = packageDigestFromContent(computed);
+    if (unpacked.manifest.package_digest !== expectedPkg) {
+        issues.push({
+            severity: "error",
+            code: "package_digest",
+            message: "package_digest does not match content index",
+        });
+    }
+    if (unpacked.manifest.policy.require_signatures) {
+        const sigs = Object.keys(unpacked.files).filter((p) => p.startsWith("signatures/"));
+        if (sigs.length === 0) {
+            issues.push({
+                severity: "error",
+                code: "signatures_required",
+                message: "Policy requires signatures but none present",
+            });
+        }
+    }
+    const ok = !issues.some((i) => i.severity === "error");
+    return {
+        ok,
+        issues,
+        manifest: unpacked.manifest,
+        workflow: unpacked.workflow,
+    };
+}
+export function inspectSkill(archive) {
+    const result = validatePackageBytes(archive);
+    if (!result.manifest) {
+        return {
+            ok: false,
+            summary: {
+                id: "",
+                version: "",
+                title: "",
+                description: "",
+                inputs: [],
+                permissions: [],
+                capabilities: [],
+                package_digest: "",
+                trust_label: "INVALID",
+                trust_state: "untrusted",
+            },
+            issues: result.issues,
+        };
+    }
+    const m = result.manifest;
+    const mint_status = m.mint?.mint_status ?? "draft";
+    const signed = Boolean((result.manifest &&
+        Object.keys(
+        // signatures live outside validate result — infer from mint + attestation_digest
+        m.attestation_digest ? { signed: true } : {}).length) ||
+        mint_status === "minted");
+    // Lightweight label without full TrustView import cycle; CLI --trust uses inspectTrustView.
+    let trust_label = "UNSIGNED / OPEN — untrusted";
+    let trust_state = "untrusted";
+    if (mint_status === "minted" && m.attestation_digest) {
+        trust_label = "SEALED — use skill inspect --trust for issuer/host details";
+        trust_state = "self_reported";
+    }
+    else if (!signed || mint_status === "draft") {
+        trust_label = "UNSIGNED / OPEN — untrusted";
+        trust_state = "untrusted";
+    }
+    return {
+        ok: result.ok,
+        summary: {
+            id: m.id,
+            version: m.version,
+            title: m.title,
+            description: m.description,
+            intent: m.intent,
+            inputs: m.inputs.filter((i) => i.required).map((i) => i.name),
+            permissions: m.permissions.map((p) => p.side_effect_class),
+            capabilities: m.capabilities.map((c) => c.name),
+            package_digest: m.package_digest,
+            sealed_manifest_digest: m.sealed_manifest_digest,
+            mint_status,
+            needs_human_review: m.needs_human_review,
+            trust_label,
+            trust_state,
+        },
+        issues: result.issues,
+    };
+}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@skillerr/core",
+  "version": "0.6.0",
+  "description": "Compile, pack, validate, and mint portable .skill packages",
+  "license": "MIT",
+  "author": {
+    "name": "Bharat Dudeja",
+    "url": "https://github.com/bharatdudeja13-cmd"
+  },
+  "keywords": [
+    "skill",
+    ".skill",
+    "ai-agents",
+    "agent-skills",
+    "compile",
+    "mint"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dot-skill/dot-skill.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://skillerr.com",
+  "bugs": {
+    "url": "https://github.com/dot-skill/dot-skill/issues"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "prepack": "npm run build",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@skillerr/protocol": "^0.6.0",
+    "fflate": "^0.8.2"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^5.4.5"
+  }
+}