@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/skill/search-extractor.js

@@ -0,0 +1,44 @@
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { buildSearchResult } from "../../query/search/extractor.js";
+export const skillSearchExtractor = {
+    kind: ApiResourceKind.skill,
+    schema: SkillSchema,
+    getSearchSummary(resource) {
+        // Go SkillExtractor.GetSearchSummary: spec.description.
+        const skill = resource;
+        return skill.spec?.description ?? "";
+    },
+    toSearchResult(resource, score) {
+        const skill = resource;
+        return buildSearchResult({
+            kind: ApiResourceKind.skill,
+            metadata: skill.metadata,
+            summary: skill.spec?.description ?? "",
+            score,
+            createdAt: skill.status?.audit?.specAudit?.createdAt,
+            updatedAt: skill.status?.audit?.specAudit?.updatedAt,
+        });
+    },
+    getSearchIndexEntry(resource) {
+        const skill = resource;
+        const metadata = skill.metadata;
+        if (metadata === undefined) {
+            return undefined;
+        }
+        return {
+            name: metadata.name,
+            // Go SkillExtractor.GetSearchSummary: spec.description.
+            description: skill.spec?.description ?? "",
+            // Tags join space-separated — the index entry carries one tags
+            // string (Go extractor.JoinTags).
+            tags: metadata.tags.join(" "),
+            org: metadata.org,
+            // The enum NAME string, exactly Go's visibility.String().
+            visibility: ApiResourceVisibility[metadata.visibility] ?? "",
+            createdAt: Number(skill.status?.audit?.specAudit?.createdAt?.seconds ?? 0n),
+        };
+    },
+};
+//# sourceMappingURL=search-extractor.js.map

package/dist/domain/skill/search-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-extractor.js","sourceRoot":"","sources":["../../../src/domain/skill/search-extractor.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAI/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IAEnB,gBAAgB,CAAC,QAAiB;QAChC,wDAAwD;QACxD,MAAM,KAAK,GAAG,QAA4B,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,cAAc,CAAC,QAAiB,EAAE,KAAa;QAC7C,MAAM,KAAK,GAAG,QAA4B,CAAC;QAC3C,OAAO,iBAAiB,CAAC;YACvB,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;YACtC,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;YACpD,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;SACrD,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,QAAiB;QACnC,MAAM,KAAK,GAAG,QAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,wDAAwD;YACxD,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;YAC1C,+DAA+D;YAC/D,kCAAkC;YAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,0DAA0D;YAC1D,UAAU,EAAE,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE;YAC5D,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5E,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/domain/skill/storage/artifact-storage.d.ts

@@ -0,0 +1,33 @@
+import type { ArtifactStorage } from "../../../artifactstorage/artifact-storage.js";
+/**
+ * Storage abstraction for skill artifacts (Go ArtifactStorage). The
+ * interface exists for the same reason as Go's: cloud uses R2 behind the
+ * identical surface, and the controller must not know which one it holds.
+ */
+export interface SkillArtifactStorage {
+    /** Saves an artifact under its content hash; returns the storage key. */
+    store(hash: string, data: Uint8Array): Promise<string>;
+    /** Loads an artifact by storage key; throws ArtifactNotFoundError if absent. */
+    get(storageKey: string): Promise<Uint8Array>;
+    /** Whether an artifact with this content hash already exists (dedupe). */
+    exists(hash: string): Promise<boolean>;
+    /** The storage key for a hash, without storing ("skills/<hash>.zip"). */
+    getStorageKey(hash: string): string;
+    /** The stored artifact's byte size via stat — never loads content. */
+    size(storageKey: string): Promise<number>;
+}
+/**
+ * A storage key that addresses nothing inside the store — missing file OR
+ * a traversal-shaped key (both render as Go's "artifact not found: %s";
+ * distinguishing them would tell a probing caller which escapes exist).
+ */
+export declare class ArtifactNotFoundError extends Error {
+    constructor(storageKey: string);
+}
+/**
+ * The skill store over a blob driver. Object-literal factory rather than a
+ * class: all state is the captured driver, and the seam-adapter shape
+ * matches runner-credential-provider.ts (the O5 house style for ports).
+ */
+export declare function newSkillArtifactStorage(driver: ArtifactStorage): SkillArtifactStorage;
+//# sourceMappingURL=artifact-storage.d.ts.map

package/dist/domain/skill/storage/artifact-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-storage.d.ts","sourceRoot":"","sources":["../../../../src/domain/skill/storage/artifact-storage.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAGpF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,gFAAgF;IAChF,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,yEAAyE;IACzE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,sEAAsE;IACtE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,UAAU,EAAE,MAAM;CAI/B;AAKD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,GACtB,oBAAoB,CAwDtB"}

package/dist/domain/skill/storage/artifact-storage.js

@@ -0,0 +1,106 @@
+/**
+ * Skill artifact store — ports pkg/domain/skill/storage/artifact_storage.go.
+ * Content-addressed, write-once, never garbage-collected (OD-5): artifacts
+ * live at {storagePath}/skills/{sha256}.zip, byte-identical to Go's paths —
+ * at cutover the TS server inherits a Go-written storage directory and must
+ * serve its artifacts in place. There is deliberately NO delete method on
+ * the interface: historical versions stay downloadable through the storage
+ * keys listVersions exposes.
+ *
+ * Since O5 (20260827.02, blueprint 03 §6b) this is a DOMAIN PORT layered
+ * over the one ArtifactStorage blob driver (the Q2 gate ruling): the
+ * driver stores blobs; this module owns the keys, the write-once posture,
+ * and the not-found vocabulary. The compose root hands it a PER-DOMAIN
+ * driver instance rooted at storagePath (the Q2b ruling) — skill artifacts
+ * never silently follow the generic artifact store's backend selection.
+ *
+ * Proven by __tests__/artifact-storage.test.ts and the skill conformance
+ * suite's getArtifact/round-trip tests.
+ */
+import path from "node:path";
+import { ArtifactStorageNotFoundError } from "../../../artifactstorage/artifact-storage.js";
+/**
+ * A storage key that addresses nothing inside the store — missing file OR
+ * a traversal-shaped key (both render as Go's "artifact not found: %s";
+ * distinguishing them would tell a probing caller which escapes exist).
+ */
+export class ArtifactNotFoundError extends Error {
+    constructor(storageKey) {
+        super(`artifact not found: ${storageKey}`);
+        this.name = "ArtifactNotFoundError";
+    }
+}
+/** Skill artifacts are zip archives; the driver stores the honest type. */
+const SKILL_ARTIFACT_CONTENT_TYPE = "application/zip";
+/**
+ * The skill store over a blob driver. Object-literal factory rather than a
+ * class: all state is the captured driver, and the seam-adapter shape
+ * matches runner-credential-provider.ts (the O5 house style for ports).
+ */
+export function newSkillArtifactStorage(driver) {
+    return {
+        /**
+         * "skills/<hash>.zip" — the relative key format shared with cloud R2.
+         * Deliberately a LITERAL forward-slash join, not path.join: the key is
+         * a wire-visible identifier (status.artifact_storage_key, download
+         * URLs, the lane's "skills/" prefix check), and Windows support
+         * arrives only through this server (#24) — path.join would mint
+         * backslash keys there that the download lane could never serve.
+         */
+        getStorageKey(hash) {
+            return `skills/${hash}.zip`;
+        },
+        async store(hash, data) {
+            const storageKey = this.getStorageKey(hash);
+            await driver.upload(storageKey, data, SKILL_ARTIFACT_CONTENT_TYPE);
+            return storageKey;
+        },
+        async get(storageKey) {
+            if (keyEscapesStore(storageKey)) {
+                throw new ArtifactNotFoundError(storageKey);
+            }
+            try {
+                return await driver.download(storageKey);
+            }
+            catch (error) {
+                if (error instanceof ArtifactStorageNotFoundError) {
+                    throw new ArtifactNotFoundError(storageKey);
+                }
+                throw new Error(`failed to read artifact: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        },
+        async exists(hash) {
+            return driver.exists(this.getStorageKey(hash));
+        },
+        async size(storageKey) {
+            if (keyEscapesStore(storageKey)) {
+                throw new ArtifactNotFoundError(storageKey);
+            }
+            try {
+                return await driver.size(storageKey);
+            }
+            catch (error) {
+                if (error instanceof ArtifactStorageNotFoundError) {
+                    throw new ArtifactNotFoundError(storageKey);
+                }
+                throw new Error(`failed to stat artifact: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        },
+    };
+}
+/**
+ * The domain's own traversal guard (Go resolveWithinRoot, kept HERE per
+ * "the domain owns keys"): a client-supplied storage key that resolves
+ * outside the store addresses nothing inside it, and must collapse to the
+ * same not-found as a missing file BEFORE the driver sees it — the
+ * driver's own containment refusal is a distinguishable error, and
+ * distinguishing them would tell a probing caller which escapes exist.
+ * Lexical, against a fixed virtual root, so the judgment is identical on
+ * every backend rather than an accident of the local driver's directory.
+ */
+function keyEscapesStore(storageKey) {
+    const virtualRoot = path.resolve(path.sep, "skill-store");
+    const resolved = path.resolve(virtualRoot, storageKey);
+    return (resolved !== virtualRoot && !resolved.startsWith(virtualRoot + path.sep));
+}
+//# sourceMappingURL=artifact-storage.js.map

package/dist/domain/skill/storage/artifact-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../../../src/domain/skill/storage/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAoB5F;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,UAAkB;QAC5B,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB;IAEvB,OAAO;QACL;;;;;;;WAOG;QACH,aAAa,CAAC,IAAY;YACxB,OAAO,UAAU,IAAI,MAAM,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,IAAgB;YACxC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,2BAA2B,CAAC,CAAC;YACnE,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,UAAkB;YAC1B,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;gBAC9C,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAY;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,UAAkB;YAC3B,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,IAAI,qBAAqB,CAAC,UAAU,CAAC,CAAC;gBAC9C,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACvD,OAAO,CACL,QAAQ,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/domain/skill/storage/frontmatter.d.ts

@@ -0,0 +1,16 @@
+/** Parsed SKILL.md frontmatter (Go SkillFrontmatter). */
+export interface SkillFrontmatter {
+    /** Canonical skill identifier (required; kebab-case, optionally dot-scoped). */
+    readonly name: string;
+    /** Human-readable summary (optional but recommended). */
+    readonly description: string;
+    /** Informational only — hash-based versioning is used instead. */
+    readonly version: string;
+}
+/**
+ * Extracts and parses YAML frontmatter from SKILL.md content (Go
+ * ParseFrontmatter). Throws plain Errors — the push pipeline wraps them
+ * into the InvalidArgument "failed to extract SKILL.md: ..." arm.
+ */
+export declare function parseFrontmatter(content: string): SkillFrontmatter;
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/domain/skill/storage/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../../../src/domain/skill/storage/frontmatter.ts"],"names":[],"mappings":"AAoBA,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AA0BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAyBlE"}

package/dist/domain/skill/storage/frontmatter.js

@@ -0,0 +1,143 @@
+/**
+ * SKILL.md frontmatter parsing — ports pkg/domain/skill/storage/
+ * frontmatter.go. The backend is the single source of truth for parsing
+ * SKILL.md: name (required, kebab-case with optional dot-scoped
+ * namespaces) and description come from the YAML frontmatter between ---
+ * markers at the start of the file. Every error string is wire-visible
+ * teaching copy, byte-pinned from Go (multi-line "expected format" blocks
+ * included).
+ *
+ * Proven by __tests__/frontmatter.test.ts and the skill conformance
+ * suite's push-validation negatives.
+ */
+import yaml from "js-yaml";
+// goTrimSpace: Go's exact TrimSpace set — a .trim()-based delimiter check
+// would accept BOM'd "---" lines Go rejects (found by the #8 parity review
+// panel; promoted to gocompat when search criteria became the second
+// consumer, #14).
+import { goTrimSpace } from "../../../gocompat/trim.js";
+/**
+ * Kebab-case skill names, optionally scoped with dot-separated namespaces:
+ * lowercase letters, numbers, hyphens (words), and dots (namespace
+ * segments). Every segment between separators must be alphanumeric, so a
+ * name cannot start or end with a separator, nor contain consecutive
+ * separators. The derived slug renders dots as hyphens (generateSlug).
+ */
+const SKILL_NAME_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)*$/;
+/**
+ * bufio.Scanner's default token cap (Go bufio.MaxScanTokenSize): lines
+ * longer than this fail Go's scan loop, so the port enforces the same
+ * ceiling — measured in BYTES, as the scanner buffers bytes. Two distinct
+ * arms, faithful to Go's checking order: a too-long FIRST line makes the
+ * initial Scan() return false before Err() is consulted (reported as
+ * "SKILL.md is empty"), while a too-long line inside the frontmatter
+ * surfaces the scanner error.
+ */
+const MAX_SCAN_TOKEN_SIZE = 64 * 1024;
+function lineTooLong(line) {
+    return Buffer.byteLength(line, "utf8") > MAX_SCAN_TOKEN_SIZE;
+}
+/**
+ * Extracts and parses YAML frontmatter from SKILL.md content (Go
+ * ParseFrontmatter). Throws plain Errors — the push pipeline wraps them
+ * into the InvalidArgument "failed to extract SKILL.md: ..." arm.
+ */
+export function parseFrontmatter(content) {
+    const frontmatterYaml = extractFrontmatterYaml(content);
+    let parsed;
+    try {
+        parsed = yaml.load(frontmatterYaml);
+    }
+    catch (error) {
+        throw new Error(`failed to parse YAML frontmatter: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const record = typeof parsed === "object" && parsed !== null
+        ? parsed
+        : {};
+    const frontmatter = {
+        name: typeof record["name"] === "string" ? record["name"] : "",
+        description: typeof record["description"] === "string" ? record["description"] : "",
+        version: typeof record["version"] === "string" ? record["version"] : "",
+    };
+    validateFrontmatter(frontmatter);
+    return frontmatter;
+}
+/**
+ * Extracts the raw YAML between --- delimiters: the frontmatter must
+ * start on the FIRST line with --- and end with --- on its own line
+ * (whitespace-trimmed comparison on both, as Go's scanner loop does).
+ */
+function extractFrontmatterYaml(content) {
+    if (content === "") {
+        throw new Error("SKILL.md is empty");
+    }
+    const lines = content.split(/\r?\n/);
+    // Go's initial Scan() returns false for a first line over the scanner
+    // cap — and its !Scan() arm reports "SKILL.md is empty" without ever
+    // consulting Err(). Bug-for-bug: the misleading copy IS the contract.
+    if (lineTooLong(lines[0])) {
+        throw new Error("SKILL.md is empty");
+    }
+    const firstLine = goTrimSpace(lines[0]);
+    if (firstLine !== "---") {
+        throw new Error("SKILL.md must start with YAML frontmatter (---)\n\n" +
+            "Expected format:\n" +
+            "---\n" +
+            "name: my-skill-name\n" +
+            "description: A brief description of what this skill does\n" +
+            "---\n" +
+            "# Skill Title\n" +
+            "...");
+    }
+    const frontmatterLines = [];
+    let foundClosing = false;
+    for (let i = 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (lineTooLong(line)) {
+            // Go: the scan loop stops, and Err() is checked BEFORE the
+            // closing-delimiter check — so an over-cap line inside the
+            // frontmatter wins over "not closed". Message text is the %w-chain
+            // rendering of bufio.ErrTooLong.
+            throw new Error("error reading SKILL.md content: bufio.Scanner: token too long");
+        }
+        if (goTrimSpace(line) === "---") {
+            foundClosing = true;
+            break;
+        }
+        frontmatterLines.push(line);
+    }
+    if (!foundClosing) {
+        throw new Error("SKILL.md frontmatter is not closed (missing closing ---)");
+    }
+    if (frontmatterLines.length === 0) {
+        throw new Error("SKILL.md has empty frontmatter\n\n" +
+            "The frontmatter must contain at least a 'name' field:\n" +
+            "---\n" +
+            "name: my-skill-name\n" +
+            "---");
+    }
+    return frontmatterLines.join("\n");
+}
+/** Required-field and format validation (Go validateFrontmatter). */
+function validateFrontmatter(frontmatter) {
+    if (frontmatter.name === "") {
+        throw new Error("SKILL.md is missing required 'name' field in YAML frontmatter\n\n" +
+            "Expected format:\n" +
+            "---\n" +
+            "name: my-skill-name\n" +
+            "---\n\n" +
+            "The name must be kebab-case (lowercase letters, numbers, and hyphens), " +
+            "optionally scoped with dots (e.g. 'platform.my-skill')");
+    }
+    if (!SKILL_NAME_PATTERN.test(frontmatter.name)) {
+        throw new Error(`invalid skill name '${frontmatter.name}' in SKILL.md\n\n` +
+            "Skill names must be kebab-case, optionally scoped with dot-separated namespaces:\n" +
+            "- Lowercase letters (a-z)\n" +
+            "- Numbers (0-9)\n" +
+            "- Hyphens (-) to separate words\n" +
+            "- Dots (.) to separate namespace segments\n\n" +
+            "Every segment must be alphanumeric: no leading, trailing, or consecutive separators.\n\n" +
+            "Examples: 'calculator', 'web-scraper', 'math-utils', 'platform.planton-architecture'");
+    }
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/domain/skill/storage/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../../../src/domain/skill/storage/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AACrE,kBAAkB;AAClB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAYxD;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,mBAAmB,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,eAAe,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAkC;QACrC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,WAAW,GAAqB;QACpC,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9D,WAAW,EACT,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;QACxE,OAAO,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;IAEF,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qDAAqD;YACnD,oBAAoB;YACpB,OAAO;YACP,uBAAuB;YACvB,4DAA4D;YAC5D,OAAO;YACP,iBAAiB;YACjB,KAAK,CACR,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,2DAA2D;YAC3D,2DAA2D;YAC3D,mEAAmE;YACnE,iCAAiC;YACjC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAChC,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM;QACR,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,oCAAoC;YAClC,yDAAyD;YACzD,OAAO;YACP,uBAAuB;YACvB,KAAK,CACR,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,WAA6B;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,oBAAoB;YACpB,OAAO;YACP,uBAAuB;YACvB,SAAS;YACT,yEAAyE;YACzE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,uBAAuB,WAAW,CAAC,IAAI,mBAAmB;YACxD,oFAAoF;YACpF,6BAA6B;YAC7B,mBAAmB;YACnB,mCAAmC;YACnC,+CAA+C;YAC/C,0FAA0F;YAC1F,sFAAsF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/domain/skill/storage/prefilter.d.ts

@@ -0,0 +1,77 @@
+/**
+ * safearchive-parity entry pre-filter — ports the OBSERVABLE half of
+ * github.com/google/safearchive's zip.MaximumSecurityMode (applyMagic,
+ * zip.go:158, at the go.mod-pinned v0.0.0-20241025131057) plus its
+ * sanitizer package. Go's push gate opens ZIPs through safearchive, which
+ * rewrites the entry list BEFORE zip_extractor.go's validation loop sees
+ * it — so the gate's accept/reject behavior includes this filter, and
+ * local parity requires reproducing it (sub-project DD-001, Option A,
+ * owner-ratified 2026-08-24). The cloud edition applies none of this; the
+ * parity target is the Go server.
+ *
+ * The four observable behaviors, in safearchive's exact order per entry:
+ *   1. SanitizeFilenames — names become unrooted, ..-free, /-separated.
+ *      Consequence: "../SKILL.md" IS a root SKILL.md to the gate.
+ *   2. SkipWindowsShortFilenames — entries with an 8.3-style path
+ *      component (`~N`) are dropped.
+ *   3. PreventSymlinkTraversal (+ case-insensitive) — entries whose path
+ *      passes through an earlier symlink entry are dropped; symlink
+ *      entries themselves stay (and register as shadows).
+ *   4. SkipSpecialFiles — device/pipe/socket/char-device entries are
+ *      dropped.
+ * (safearchive's fifth measure, SanitizeFileMode, strips permission bits
+ * the gate never exposes — not observable, not ported.)
+ *
+ * Entry file types are decoded from the central directory's raw
+ * creator/attribute fields exactly as Go archive/zip's FileHeader.Mode()
+ * does: Unix/macOS creators carry a POSIX mode in the attribute high 16
+ * bits; FAT/NTFS/VFAT creators carry MSDOS bits that can never encode a
+ * symlink or special file; unknown creators decode to a regular file.
+ *
+ * Proven by __tests__/prefilter.test.ts (byte-crafted fixtures per DD-001).
+ */
+import type { ZipStructuralEntry } from "@stigmer/zip-structure";
+/**
+ * safearchive sanitizer.SanitizePath (nix variant): backslashes normalize
+ * to slashes, then TrimPrefix(Clean("/"+path), "/") — always unrooted with
+ * no ".." elements; a trailing separator on the input is preserved when
+ * the sanitized result is non-empty.
+ *
+ * The nix variant is deliberate: Go compiles the _win variant only on
+ * Windows hosts, where sanitized names carry backslashes. The TS gate
+ * normalizes to slashes everywhere — a Windows-host-only cosmetic
+ * divergence in ERROR TEXT for pathological names, disclosed in the PR.
+ */
+export declare function sanitizePath(input: string): string;
+/** safearchive sanitizer.HasWindowsShortFilenames, verbatim semantics. */
+export declare function hasWindowsShortFilenames(input: string): boolean;
+interface EntryTypeBits {
+    readonly isSymlink: boolean;
+    /** Device, char device, named pipe, or socket (safearchive isSpecialFile). */
+    readonly isSpecial: boolean;
+}
+/**
+ * Decodes the entry's file-type bits the way Go's zip.FileHeader.Mode()
+ * does. Only Unix/macOS creators can express symlinks or special files;
+ * every other creator (FAT, NTFS, VFAT, unknown) decodes to a regular
+ * file for the two bits this filter tests.
+ */
+export declare function entryTypeBits(entry: ZipStructuralEntry): EntryTypeBits;
+/**
+ * A structural entry after the pre-filter: same record, sanitized name.
+ * The original entry rides along for payload access.
+ */
+export interface PrefilteredEntry {
+    /** The sanitized name — what every downstream check sees (Go f.Name). */
+    readonly name: string;
+    readonly entry: ZipStructuralEntry;
+}
+/**
+ * safearchive applyMagic under MaximumSecurityMode, step-for-step in its
+ * per-entry order: sanitize the name; drop 8.3-named entries; drop entries
+ * shadowed by an earlier symlink (case-insensitive path-prefix match,
+ * registering symlink entries as shadows); drop special files.
+ */
+export declare function applyEntryPrefilter(entries: readonly ZipStructuralEntry[]): PrefilteredEntry[];
+export {};
+//# sourceMappingURL=prefilter.d.ts.map

package/dist/domain/skill/storage/prefilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefilter.d.ts","sourceRoot":"","sources":["../../../../src/domain/skill/storage/prefilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlD;AA2BD,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK/D;AAgBD,UAAU,aAAa;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAetE;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,gBAAgB,EAAE,CAwCpB"}

package/dist/domain/skill/storage/prefilter.js

@@ -0,0 +1,127 @@
+// ─── sanitizer.SanitizePath ──────────────────────────────────────────────
+/**
+ * safearchive sanitizer.SanitizePath (nix variant): backslashes normalize
+ * to slashes, then TrimPrefix(Clean("/"+path), "/") — always unrooted with
+ * no ".." elements; a trailing separator on the input is preserved when
+ * the sanitized result is non-empty.
+ *
+ * The nix variant is deliberate: Go compiles the _win variant only on
+ * Windows hosts, where sanitized names carry backslashes. The TS gate
+ * normalizes to slashes everywhere — a Windows-host-only cosmetic
+ * divergence in ERROR TEXT for pathological names, disclosed in the PR.
+ */
+export function sanitizePath(input) {
+    const sanitized = sanitizeCore(input);
+    if (input.length > 0 &&
+        (input.endsWith("/") || input.endsWith("\\")) &&
+        sanitized.length > 0) {
+        return `${sanitized}/`;
+    }
+    return sanitized;
+}
+function sanitizeCore(input) {
+    const normalizedSeparators = input.replaceAll("\\", "/");
+    // Go filepath.Clean("/"+in): resolve "." and ".." lexically against a
+    // rooted path (leading ".." cannot climb above the root), collapse
+    // duplicate separators, and drop any trailing separator.
+    const segments = `/${normalizedSeparators}`.split("/");
+    const resolved = [];
+    for (const segment of segments) {
+        if (segment === "" || segment === ".") {
+            continue;
+        }
+        if (segment === "..") {
+            resolved.pop();
+            continue;
+        }
+        resolved.push(segment);
+    }
+    return resolved.join("/");
+}
+// ─── sanitizer.HasWindowsShortFilenames ──────────────────────────────────
+/** Matches a Windows 8.3 short-name marker (`~1`, `~23.`) in a component. */
+const WINDOWS_SHORT_FILENAME_PATTERN = /~\d+\.?/;
+/** safearchive sanitizer.HasWindowsShortFilenames, verbatim semantics. */
+export function hasWindowsShortFilenames(input) {
+    return input
+        .replaceAll("\\", "/")
+        .split("/")
+        .some((part) => WINDOWS_SHORT_FILENAME_PATTERN.test(part));
+}
+// ─── archive/zip FileHeader.Mode() — the type bits the filter tests ──────
+// CreatorVersion high bytes (Go archive/zip creator* constants).
+const CREATOR_UNIX = 3;
+const CREATOR_MACOSX = 19;
+// POSIX file-type field masks (syscall.S_IF*).
+const S_IFMT = 0o170000;
+const S_IFBLK = 0o060000;
+const S_IFCHR = 0o020000;
+const S_IFIFO = 0o010000;
+const S_IFLNK = 0o120000;
+const S_IFSOCK = 0o140000;
+/**
+ * Decodes the entry's file-type bits the way Go's zip.FileHeader.Mode()
+ * does. Only Unix/macOS creators can express symlinks or special files;
+ * every other creator (FAT, NTFS, VFAT, unknown) decodes to a regular
+ * file for the two bits this filter tests.
+ */
+export function entryTypeBits(entry) {
+    const creator = entry.versionMadeBy >> 8;
+    if (creator !== CREATOR_UNIX && creator !== CREATOR_MACOSX) {
+        return { isSymlink: false, isSpecial: false };
+    }
+    const unixMode = (entry.externalAttributes >>> 16) & 0xffff;
+    const fileType = unixMode & S_IFMT;
+    return {
+        isSymlink: fileType === S_IFLNK,
+        isSpecial: fileType === S_IFBLK ||
+            fileType === S_IFCHR ||
+            fileType === S_IFIFO ||
+            fileType === S_IFSOCK,
+    };
+}
+/**
+ * safearchive applyMagic under MaximumSecurityMode, step-for-step in its
+ * per-entry order: sanitize the name; drop 8.3-named entries; drop entries
+ * shadowed by an earlier symlink (case-insensitive path-prefix match,
+ * registering symlink entries as shadows); drop special files.
+ */
+export function applyEntryPrefilter(entries) {
+    const symlinks = new Set();
+    const result = [];
+    for (const entry of entries) {
+        const name = sanitizePath(entry.name);
+        if (hasWindowsShortFilenames(name)) {
+            continue;
+        }
+        // PreventSymlinkTraversal + PreventCaseInsensitiveSymlinkTraversal:
+        // re-sanitize (idempotent — safearchive does the same), strip the
+        // trailing separator, lowercase, and test every path prefix against
+        // the symlinks seen so far.
+        const shadowKey = trimTrailingSlash(sanitizePath(name)).toLowerCase();
+        const parts = shadowKey.split("/");
+        let traversal = false;
+        for (let i = 1; i <= parts.length; i++) {
+            if (symlinks.has(parts.slice(0, i).join("/"))) {
+                traversal = true;
+                break;
+            }
+        }
+        if (traversal) {
+            continue;
+        }
+        const typeBits = entryTypeBits(entry);
+        if (typeBits.isSymlink) {
+            symlinks.add(shadowKey);
+        }
+        if (typeBits.isSpecial) {
+            continue;
+        }
+        result.push({ name, entry });
+    }
+    return result;
+}
+function trimTrailingSlash(path) {
+    return path.endsWith("/") ? path.slice(0, -1) : path;
+}
+//# sourceMappingURL=prefilter.js.map

package/dist/domain/skill/storage/prefilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefilter.js","sourceRoot":"","sources":["../../../../src/domain/skill/storage/prefilter.ts"],"names":[],"mappings":"AAkCA,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,SAAS,CAAC,MAAM,GAAG,CAAC,EACpB,CAAC;QACD,OAAO,GAAG,SAAS,GAAG,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,oBAAoB,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,sEAAsE;IACtE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAE5E,6EAA6E;AAC7E,MAAM,8BAA8B,GAAG,SAAS,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,KAAK;SACT,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAE5E,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,+CAA+C;AAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAQ1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,QAAQ,KAAK,OAAO;QAC/B,SAAS,EACP,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,QAAQ;KACxB,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC"}

package/dist/domain/skill/storage/zip-gate.d.ts

@@ -0,0 +1,20 @@
+/** Result of a successful gate pass (Go ExtractSkillMdResult). */
+export interface ExtractSkillMdResult {
+    /** Full SKILL.md content, frontmatter included. */
+    readonly content: string;
+    /** SHA-256 of the ZIP bytes — the content-addressed version identity. */
+    readonly hash: string;
+    /** Skill identifier from the frontmatter (kebab-case). */
+    readonly name: string;
+    /** Human-readable summary from the frontmatter. */
+    readonly description: string;
+}
+/**
+ * Validates the artifact and extracts SKILL.md + frontmatter (Go
+ * ExtractSkillMd). Throws plain Errors with byte-pinned messages; the
+ * push pipeline owns the gRPC code.
+ */
+export declare function extractSkillMd(zipData: Uint8Array): ExtractSkillMdResult;
+/** SHA-256 hex of the artifact bytes (Go CalculateHash). */
+export declare function calculateHash(data: Uint8Array): string;
+//# sourceMappingURL=zip-gate.d.ts.map

package/dist/domain/skill/storage/zip-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-gate.d.ts","sourceRoot":"","sources":["../../../../src/domain/skill/storage/zip-gate.ts"],"names":[],"mappings":"AAyCA,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,oBAAoB,CA0CxE;AAwID,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAEtD"}