@topmindspace/topmind-writing-skills 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.9.2] - 2026-10-31
+
+- 宿主包运行时显式提供文章渲染、从源稿渲染、本地文本提取、长度评估和长度规则集评估。文章结果绑定所选稿与产物的 SHA-256，可选绑定创作快照指纹。
+- 长度规则集只接受调用方传入的 JSON，先校验结构和日期再报告。本包不附带、也不启用真实平台规则。Unicode 码点上限不能代替 X 加权长度或编辑器里的最终核对。
+- 八个技能的版本不变。
+
 ## [0.9.1] - 2026-10-28
 
 - 安装器新增 `install all`、`update` 与 `status`：整套首次安装只需一条命令，后续更新只处理已装技能，状态直接显示安装版本与包快照。

package/README.en.md

@@ -30,6 +30,8 @@ Open a Markdown document and choose **Writing & delivery** from the article tool
 
 Built-in HTML/text typography requires no Python. Preview and copy use the same output; changed sources or images require regeneration. Diagnostics identify missing images, diagram source, extended containers and table paste limitations. AI images, PNG rendering and publishing require their respective tools. Copying does not publish; wording scores do not decide editorial quality.
 
+The host pack also renders from source bytes, extracts local text from clipboard HTML, and evaluates a length rule set. The length entry accepts only caller-supplied JSON. This package does not ship or enable production platform rules. Fields, dates and reports are in [the length rule-set contract](docs/length-ruleset-v1.md). A Unicode code-point ceiling is not X weighted length and is not the target editor's final check. JavaScript and Python renderer differences are in [the capability matrix](docs/renderer-capability-matrix.md).
+
 About & updates tracks the application, core skills, independent writing pack and integrations separately. Writing resources can update independently; compiled renderer code follows the host release. Managed packs are isolated, local modifications block replacement and failed installs preserve the previous version. Supported Desktop installs can download an update and explicitly restart; manual downloads remain available when signing or the installation channel prevents automatic updates.
 
 ## More choices, concrete references

package/README.md

@@ -30,6 +30,8 @@ npx @topmindspace/topmind-writing-skills@latest update    # 以后只更新已
 
 内置 HTML/文本排版无需 Python，预览与复制同源；源稿或图片改变后需要重新生成。扩展容器、图表源码、缺图和平台表格粘贴限制会显示诊断。封面生图、PNG 和外部发布依赖实际工具，复制不等于已发布。审校不使用“AI 味分数”作为定稿门槛。
 
+宿主包运行时另外提供从源稿生成文章结果、从剪贴板 HTML 提取本地文本，以及长度规则集评估。长度入口只接受调用方传入的 JSON，本包不附带、也不启用真实平台规则。规则字段、日期和报告见 [长度规则集运行契约](docs/length-ruleset-v1.md)。Unicode 码点上限不能代替 X 加权长度或目标编辑器里的最终核对。JavaScript 与 Python 渲染器的差异见 [能力矩阵](docs/renderer-capability-matrix.md)。
+
 “关于与更新”分别展示 Desktop、核心技能、独立写作包和集成组件。写作资源可独立更新；编译进宿主的排版代码随宿主升级。受管包按身份隔离，覆盖本地定制会被阻止，失败保留旧版。Desktop 支持标准更新器下载后显式重启；签名、平台或渠道不支持时保留手动下载。
 
 ## 加选项，让经验帮助创作

package/lib/host-pack.cjs

@@ -28,7 +28,17 @@ function buildHostPack(root) {
     if (!/^---\r?\n/u.test(raw) || !/^name:\s*/mu.test(raw)) throw new Error(`Invalid skill: ${id}`);
     return { id, name: id, description: meta.description || id, version: meta.version, packId: 'topmind-writing-skills' };
   });
-  const manifest = { schema_version: 1, name: 'topmind-writing-skills', version: pkg.version, license: pkg.license, repository: pkg.repository, entry_files: ids.map(id => `${id}/SKILL.md`), files, runtime: { api: 1, entry: 'runtime/article-renderer.mjs', update: 'host-release' } };
+  const capabilities = [
+    { id: 'article.render', entry: 'runtime/article-renderer.mjs', export: 'prepareArticleResult' },
+    { id: 'article.renderFromSource', entry: 'runtime/article-renderer.mjs', export: 'prepareArticleResultFromSource' },
+    { id: 'article.localTextDocument', entry: 'runtime/article-renderer.mjs', export: 'articleLocalTextDocument' },
+    { id: 'length.evaluate', entry: 'runtime/length-rules.mjs', export: 'evaluateLengthRules' },
+    { id: 'length.ruleset.evaluate', entry: 'runtime/length-ruleset.mjs', export: 'evaluateLengthRuleSet' },
+  ];
+  for (const capability of capabilities) {
+    if (!Object.hasOwn(files, capability.entry)) throw new Error(`Missing runtime capability entry: ${capability.entry}`);
+  }
+  const manifest = { schema_version: 1, name: 'topmind-writing-skills', version: pkg.version, license: pkg.license, repository: pkg.repository, entry_files: ids.map(id => `${id}/SKILL.md`), files, runtime: { api: 1, entry: 'runtime/article-renderer.mjs', capabilities, update: 'host-release' } };
   const digest = hash(JSON.stringify(manifest));
   return { manifest: { ...manifest, digest }, snapshot: { id: manifest.name, version: pkg.version, source: 'https://github.com/topmindspace/topmind-writing-skills', license: pkg.license, digest, skills, resources } };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topmindspace/topmind-writing-skills",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "TopMindSpace 写作技能合集 — 通过 npm / npx 安装技能（公众号长文、X 长文、干货短文、X 引流短帖、改稿与质检、封面图、长图海报）。只出稿与发布包，不代发。",
   "license": "MIT",
   "author": "TopMindspace",

package/runtime/article-renderer.d.mts

@@ -1,9 +1,30 @@
 export type WritingPlatform = 'wechat' | 'x' | 'text';
 export type WritingTheme = 'minimal-ink' | 'tech-blue' | 'newsprint' | 'graphite';
 export const WRITING_THEMES: Record<WritingTheme, { ink: string; accent: string; paper: string; muted: string }>;
+export const ARTICLE_RENDERER_PROVIDER: Readonly<{ id: string; version: string }>;
 export const WRITING_ACTIONS: ReadonlyArray<{ id: string; zh: string; en: string; prompt: string; promptEn: string }>;
 export function stripFrontmatter(value: string): string;
 export interface ArticleDelivery { platform: WritingPlatform; theme: WritingTheme; html: string; body: string; text: string; checklist: string; images: Array<{ source: string; alt: string; status: string }>; diagnostics: Array<{ code: string; source?: string }> }
 export function renderArticle(input: { markdown: string; platform?: WritingPlatform; theme?: WritingTheme; title?: string; images?: Record<string, string> }): ArticleDelivery;
 export function resolveArticleImage(sourcePath: string, reference: string): string;
 export function prepareArticle(input: { sourcePath: string; markdown: string; platform?: WritingPlatform; theme?: WritingTheme; title?: string }, readImage: (relative: string) => Promise<string>): Promise<ArticleDelivery>;
+export interface ArticleResult {
+  schemaVersion: 1;
+  capabilityId: 'article.render';
+  provider: Readonly<{ id: string; version: string }>;
+  status: 'ok' | 'warning' | 'error';
+  input: { fingerprint: string | null; target?: { platform: WritingPlatform; theme: WritingTheme };
+    source?: { relativePath: string; sha256: string };
+    imageBytes?: Array<{ relativePath: string; sha256: string }>;
+    creationSnapshotFingerprint?: string; localTextTitle?: string | null;
+    renderParameters?: { theme: WritingTheme; title: string } };
+  artifacts: Array<{ role: 'preview' | 'clipboard-html' | 'source-markdown' | 'image-checklist' | 'local-clipboard-text'; format: string; content: string; sha256: string }>;
+  images: ArticleDelivery['images'];
+  diagnostics: Array<{ code: string; severity: 'warning' | 'error'; message: string; location?: { source: string } }>;
+}
+export function renderArticleResult(input?: { markdown?: string; platform?: WritingPlatform; theme?: WritingTheme; title?: string; sourcePath?: string; images?: Record<string, string> }): Promise<ArticleResult>;
+export function prepareArticleResult(input: { sourcePath: string; markdown: string; platform?: WritingPlatform; theme?: WritingTheme; title?: string }, readImage: (relative: string) => Promise<string>): Promise<ArticleResult>;
+export function prepareArticleResultFromSource(input: { sourcePath: string; sourceBytes: Uint8Array;
+  platform?: WritingPlatform; theme?: WritingTheme; title?: string; creationSnapshotFingerprint?: string },
+  readImage: (relative: string) => Promise<string>): Promise<ArticleResult>;
+export function articleLocalTextDocument(result: ArticleResult): { text_kind: 'platform_text'; title?: string; body: string } | null;

package/runtime/article-renderer.mjs

@@ -1,10 +1,13 @@
 /** Portable host renderer. Canonical source: topmind-writing-skills. No IO or executable HTML. */
+import { sha256, sha256Bytes } from './content-sha256.mjs';
 export const WRITING_THEMES = Object.freeze({
   'minimal-ink': { ink: '#252525', accent: '#955247', paper: '#ffffff', muted: '#666666' },
   'tech-blue': { ink: '#172033', accent: '#0369a1', paper: '#ffffff', muted: '#536174' },
   newsprint: { ink: '#24211c', accent: '#80502a', paper: '#fffdf8', muted: '#655f55' },
   graphite: { ink: '#222222', accent: '#444444', paper: '#ffffff', muted: '#666666' },
 });
+/** Version of the renderer's output semantics, independent from the npm package version. */
+export const ARTICLE_RENDERER_PROVIDER = Object.freeze({ id: 'topmind-writing-skills/article-renderer', version: '1.1.0' });
 export const WRITING_ACTIONS = Object.freeze([
   { id: 'topmind-revise', zh: '改稿', en: 'Revise', prompt: '按 topmind-revise 审校当前内容，保留事实、数字、归因和作者原意。' },
   { id: 'topmind-format', zh: '只排版', en: 'Format', prompt: '按 topmind-format 只调整当前内容的排版，不改写文字。' },
@@ -20,8 +23,17 @@ export function stripFrontmatter(value) {
   return String(value || '').replace(/^\uFEFF/u, '').replace(/\r\n?/gu, '\n').replace(/^---\n[\s\S]*?\n---(?:\n|$)/u, '');
 }
 export function resolveArticleImage(sourcePath, reference) {
-  if (!sourcePath || /[\\:]|^\//u.test(sourcePath) || /[\\:]|^\//u.test(reference)) throw new Error('Invalid workspace image path');
-  const parts = sourcePath.split('/').slice(0, -1);
+  if (typeof sourcePath !== 'string' || typeof reference !== 'string'
+    || !sourcePath || !reference || /[\\:\u0000-\u001f]|^\//u.test(sourcePath)
+    || /[\\:\u0000-\u001f]|^\//u.test(reference)) throw new Error('Invalid workspace image path');
+  const parts = [];
+  for (const segment of sourcePath.split('/')) {
+    if (!segment || segment === '.') continue;
+    if (segment === '..') { if (!parts.length) throw new Error('Source escapes workspace'); parts.pop(); }
+    else parts.push(segment);
+  }
+  if (!parts.length) throw new Error('Invalid workspace image path');
+  parts.pop();
   for (const segment of reference.split('/')) {
     if (!segment || segment === '.') continue;
     if (segment === '..') { if (!parts.length) throw new Error('Image escapes workspace'); parts.pop(); }
@@ -29,14 +41,19 @@ export function resolveArticleImage(sourcePath, reference) {
   }
   return parts.join('/');
 }
-export async function prepareArticle(input, readImage) {
+async function collectArticleImages(input, readImage) {
   const images = Object.create(null);
   for (const match of String(input.markdown).matchAll(/!\[[^\]]*\]\(([^\s)]+)(?:\s+"[^"]*")?\)/gu)) {
     const source = match[1];
     if (/^(https?:|data:)/iu.test(source) || Object.hasOwn(images, source)) continue;
-    try { images[source] = await readImage(resolveArticleImage(input.sourcePath, source)); }
+    const relativePath = resolveArticleImage(input.sourcePath, source);
+    try { images[source] = await readImage(relativePath); }
     catch { images[source] = ''; }
   }
+  return images;
+}
+export async function prepareArticle(input, readImage) {
+  const images = await collectArticleImages(input, readImage);
   return renderArticle({ ...input, images });
 }
 function safeUrl(value, image = false) {
@@ -128,3 +145,207 @@ export function renderArticle({ markdown = '', platform = 'wechat', theme = 'min
   const checklist = ['# 图片交付清单', '', '按正文出现顺序核对；内嵌不代表目标平台已托管或发布。', '', ...imageList.map((item, i) => `${i + 1}. ${item.status} · ${item.source.replace(/[\r\n]/gu, ' ')}`)].join('\n');
   return { platform, theme, html, body, text, images: imageList, diagnostics, checklist };
 }
+
+const ARTICLE_DIAGNOSTIC_MESSAGES = Object.freeze({
+  'image-unavailable': 'Image could not be loaded or embedded.',
+  'unsafe-link': 'Unsafe link was removed from the rendered output.',
+  'unclosed-code-fence': 'Code fence was not closed.',
+  'diagram-source-only': 'Diagram source needs a separate visual render.',
+  'table-paste-check': 'Check table layout after pasting into the target editor.',
+  'container-as-text': 'Unsupported container was rendered as text.',
+  'remote-image-unverified': 'Remote image was referenced but its availability was not verified.',
+});
+const MAX_BOUND_SOURCE_BYTES = 16 * 1024 * 1024;
+const MAX_BOUND_IMAGE_BASE64_CHARS = 48 * 1024 * 1024;
+function validBoundSourcePath(value) {
+  return typeof value === 'string' && value.length > 0 && value.length <= 2048
+    && /\.(?:md|markdown)$/iu.test(value) && !/[\\:\u0000-\u001f]/u.test(value)
+    && value.split('/').every(segment => segment && segment !== '.' && segment !== '..');
+}
+async function embeddedImageBytesSha256(value) {
+  if (typeof value !== 'string') return null;
+  const match = value.match(/^data:image\/(?:png|jpe?g|gif|webp);base64,([a-z0-9+/]+={0,2})$/iu);
+  if (!match || match[1].length > MAX_BOUND_IMAGE_BASE64_CHARS || typeof atob !== 'function') return null;
+  try {
+    const binary = atob(match[1]);
+    return await sha256Bytes(Uint8Array.from(binary, char => char.charCodeAt(0)));
+  } catch {
+    return null;
+  }
+}
+function articleInputSnapshot(input, delivery) {
+  const images = Object.entries(input.images ?? {})
+    .map(([source, value]) => [source, String(value)])
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  return {
+    markdown: String(input.markdown ?? ''),
+    platform: delivery.platform,
+    theme: delivery.theme,
+    title: String(input.title ?? ''),
+    sourcePath: input.sourcePath == null ? null : String(input.sourcePath),
+    images,
+    provider: ARTICLE_RENDERER_PROVIDER,
+  };
+}
+function articleFailure(error) {
+  const message = error instanceof Error ? error.message : '';
+  const known = {
+    'Unsupported delivery format': ['unsupported-platform', 'Unsupported delivery format.'],
+    'Unknown writing theme': ['unknown-theme', 'Unknown writing theme.'],
+    'Invalid workspace image path': ['invalid-image-path', 'Image path must remain inside the workspace.'],
+    'Source escapes workspace': ['invalid-image-path', 'Image path must remain inside the workspace.'],
+    'Image escapes workspace': ['invalid-image-path', 'Image path must remain inside the workspace.'],
+    'Invalid workspace source path': ['invalid-source-path', 'Source path must be a canonical workspace-relative Markdown path.'],
+    'Invalid source bytes': ['invalid-source-bytes', 'Source must be supplied as UTF-8 bytes.'],
+    'Invalid source encoding': ['invalid-source-encoding', 'Source bytes must be valid UTF-8.'],
+    'Source too large': ['source-too-large', 'Source exceeds the 16 MiB render limit.'],
+    'Invalid creation snapshot fingerprint': ['invalid-snapshot-fingerprint', 'Creation snapshot fingerprint must be SHA-256.'],
+    'Invalid article title': ['invalid-title', 'Article title must be a string.'],
+    'Unsupported bound renderer option': ['unsupported-render-option', 'Byte-bound rendering accepts only platform, theme and title options.'],
+  }[message];
+  return {
+    schemaVersion: 1,
+    capabilityId: 'article.render',
+    provider: ARTICLE_RENDERER_PROVIDER,
+    status: 'error',
+    input: { fingerprint: null },
+    artifacts: [],
+    images: [],
+    diagnostics: [{ code: known?.[0] ?? 'render-failed', severity: 'error', message: known?.[1] ?? 'Article could not be rendered.' }],
+  };
+}
+
+// Extract a local text fallback only from markup produced by renderArticle.
+// It is an estimate for preflight checks, never a target editor readback.
+function localClipboardText(html) {
+  return html
+    .replace(/<img\b[^>]*\/?\s*>/giu, '')
+    .replace(/<br\s*\/?\s*>/giu, '\n')
+    .replace(/<\/(?:p|h[1-6]|blockquote|li|tr|section|table)>/giu, '\n')
+    .replace(/<\/(?:th|td)>/giu, '\t')
+    .replace(/<hr\b[^>]*\/?\s*>/giu, '\n')
+    .replace(/<[^>]+>/gu, '')
+    .replace(/&lt;/gu, '<').replace(/&gt;/gu, '>')
+    .replace(/&quot;/gu, '"').replace(/&#39;/gu, "'")
+    .replace(/&amp;/gu, '&')
+    .replace(/[\t ]+\n/gu, '\n')
+    .replace(/\n{3,}/gu, '\n\n')
+    .trim();
+}
+
+/** Prepared local text for a length preflight; the target editor must be checked separately. */
+export function articleLocalTextDocument(result) {
+  if (result?.status === 'error' || !result?.input?.source) return null;
+  const artifact = result.artifacts?.find(item => item.role === 'local-clipboard-text');
+  if (artifact?.format !== 'text/plain' || typeof artifact.content !== 'string' ||
+      !/^[a-f0-9]{64}$/u.test(artifact.sha256 ?? '')) return null;
+  const title = result.input.localTextTitle;
+  if (title !== null && typeof title !== 'string') return null;
+  return { text_kind: 'platform_text', ...(title === null ? {} : { title }), body: artifact.content };
+}
+/** Deterministic, machine-readable delivery. The legacy renderArticle shape is unchanged. */
+export async function renderArticleResult(input = {}) {
+  try {
+    const delivery = renderArticle(input);
+    const fingerprint = await sha256(JSON.stringify(articleInputSnapshot(input, delivery)));
+    const artifacts = await Promise.all([
+      { role: 'preview', format: 'text/html', content: delivery.html },
+      { role: 'clipboard-html', format: 'text/html', content: delivery.body },
+      { role: 'source-markdown', format: 'text/markdown', content: delivery.text },
+      { role: 'image-checklist', format: 'text/markdown', content: delivery.checklist },
+    ].map(async artifact => ({ ...artifact, sha256: await sha256(artifact.content) })));
+    const diagnostics = [
+      ...delivery.diagnostics.map(diagnostic => ({
+        code: diagnostic.code,
+        severity: 'warning',
+        message: ARTICLE_DIAGNOSTIC_MESSAGES[diagnostic.code] ?? 'Review the rendered output.',
+        ...(diagnostic.source == null ? {} : { location: { source: diagnostic.source } }),
+      })),
+      ...delivery.images.filter(image => image.status === 'remote').map(image => ({
+        code: 'remote-image-unverified',
+        severity: 'warning',
+        message: ARTICLE_DIAGNOSTIC_MESSAGES['remote-image-unverified'],
+        location: { source: image.source },
+      })),
+    ];
+    return {
+      schemaVersion: 1,
+      capabilityId: 'article.render',
+      provider: ARTICLE_RENDERER_PROVIDER,
+      status: diagnostics.length ? 'warning' : 'ok',
+      input: { fingerprint, target: { platform: delivery.platform, theme: delivery.theme } },
+      artifacts,
+      images: delivery.images,
+      diagnostics,
+    };
+  } catch (error) {
+    return articleFailure(error);
+  }
+}
+/** Load local images through the host, then fingerprint their actual returned data. */
+export async function prepareArticleResult(input, readImage) {
+  try {
+    const images = await collectArticleImages(input, readImage);
+    return await renderArticleResult({ ...input, images });
+  } catch (error) {
+    return articleFailure(error);
+  }
+}
+
+/**
+ * Render exact UTF-8 source bytes supplied by a trusted host. The host compares
+ * input.source against the selected Kernel snapshot before using the artifacts.
+ */
+export async function prepareArticleResultFromSource({
+  sourcePath, sourceBytes, creationSnapshotFingerprint, ...options
+} = {}, readImage) {
+  if (!validBoundSourcePath(sourcePath)) return articleFailure(new Error('Invalid workspace source path'));
+  if (!(sourceBytes instanceof Uint8Array)) return articleFailure(new Error('Invalid source bytes'));
+  if (sourceBytes.byteLength > MAX_BOUND_SOURCE_BYTES) return articleFailure(new Error('Source too large'));
+  if (creationSnapshotFingerprint !== undefined &&
+      (typeof creationSnapshotFingerprint !== 'string' ||
+        !/^[a-f0-9]{64}$/u.test(creationSnapshotFingerprint))) {
+    return articleFailure(new Error('Invalid creation snapshot fingerprint'));
+  }
+  if (options.title !== undefined && typeof options.title !== 'string') {
+    return articleFailure(new Error('Invalid article title'));
+  }
+  if (Object.keys(options).some(key => !['platform', 'theme', 'title'].includes(key))) {
+    return articleFailure(new Error('Unsupported bound renderer option'));
+  }
+  // Own the bytes before the first await so caller mutation cannot split the
+  // hash from the Markdown actually rendered.
+  const stableBytes = Uint8Array.from(sourceBytes);
+  let markdown;
+  try {
+    markdown = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(stableBytes);
+  } catch {
+    return articleFailure(new Error('Invalid source encoding'));
+  }
+  const source = { relativePath: sourcePath, sha256: await sha256Bytes(stableBytes) };
+  const readImages = new Map();
+  const trackedReadImage = async relativePath => {
+    const dataUrl = await readImage(relativePath);
+    const sha256 = await embeddedImageBytesSha256(dataUrl);
+    if (sha256) readImages.set(relativePath, sha256);
+    return dataUrl;
+  };
+  const result = await prepareArticleResult({ ...options, sourcePath, markdown }, trackedReadImage);
+  if (result.status === 'error') return result;
+  const clipboard = result.artifacts.find(item => item.role === 'clipboard-html');
+  const localTextArtifact = { role: 'local-clipboard-text', format: 'text/plain',
+    content: localClipboardText(clipboard.content) };
+  localTextArtifact.sha256 = await sha256(localTextArtifact.content);
+  const localTextTitle = options.title ?? null;
+  const renderParameters = { theme: result.input.target.theme, title: options.title ?? '' };
+  const imageBytes = [...readImages].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+    .map(([relativePath, sha256]) => ({ relativePath, sha256 }));
+  return { ...result, artifacts: [...result.artifacts, localTextArtifact], input: { ...result.input, source,
+    imageBytes,
+    localTextTitle,
+    renderParameters,
+    ...(creationSnapshotFingerprint === undefined ? {} : { creationSnapshotFingerprint }),
+    fingerprint: await sha256(JSON.stringify({ rendererFingerprint: result.input.fingerprint, source, imageBytes,
+      localTextTitle, renderParameters, localTextSha256: localTextArtifact.sha256,
+      ...(creationSnapshotFingerprint === undefined ? {} : { creationSnapshotFingerprint }) })) } };
+}

package/runtime/content-sha256.mjs

@@ -0,0 +1,19 @@
+/** SHA-256 for browser and Node hosts; never hashes by reading a path. */
+export async function sha256Bytes(bytes) {
+  if (!(bytes instanceof Uint8Array)) throw new TypeError('SHA-256 input must be bytes');
+  if (globalThis.crypto?.subtle) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+  }
+  // Node 18 may run without the global Web Crypto API. Keep browser imports portable.
+  if (typeof process !== 'undefined' && process.versions?.node) {
+    const nodeCrypto = 'node:crypto';
+    const { createHash } = await import(nodeCrypto);
+    return createHash('sha256').update(bytes).digest('hex');
+  }
+  throw new Error('SHA-256 is unavailable');
+}
+
+export async function sha256(value) {
+  return sha256Bytes(new TextEncoder().encode(value));
+}

package/runtime/length-rules.d.mts

@@ -0,0 +1,24 @@
+export type LengthTarget = { platform: string; format: string; entrypoint: string; account_capability: string };
+export type LengthRule = {
+  id: string;
+  category: 'platform_limit' | 'creator_preference';
+  status: string;
+  applies_to: LengthTarget;
+  check: { field: 'title' | 'body'; operation: 'max_characters'; counter: 'unicode_code_points'; max: number };
+  outcome: { exceeded: 'block' | 'warn' };
+  evidence: { tier: string; url?: string; checked_at?: string; review_after?: string; confirmed_at?: string };
+};
+export interface LengthRuleResult {
+  schemaVersion: 1;
+  capabilityId: 'platform.validate.length';
+  provider: Readonly<{ id: string; version: string }>;
+  status: 'ok' | 'warning' | 'error';
+  verdict: 'pass' | 'review' | 'block' | 'invalid';
+  input: { fingerprint: string | null; rulesDigest?: string; documentDigest?: string; target?: LengthTarget; asOf?: string };
+  artifacts: [];
+  checks: Array<{ ruleId: string; category: string; field: 'title' | 'body'; observed: number; max: number; unit: 'unicode_code_points'; exceeded: boolean }>;
+  effectiveLimits: Array<{ field: 'title' | 'body'; unit: 'unicode_code_points'; hardMax: number | null; preferenceMax: number | null; effectiveMax: number }>;
+  diagnostics: Array<{ code: string; severity: 'warning' | 'error'; message: string; ruleId?: string; dimension?: string; location?: { field: string }; observed?: number; max?: number; unit?: string; hardMax?: number; preferenceMax?: number }>;
+}
+export const LENGTH_RULE_PROVIDER: Readonly<{ id: string; version: string }>;
+export function evaluateLengthRules(input: { target: LengthTarget; document: { text_kind: 'platform_text'; title?: string; body?: string }; rules: LengthRule[]; asOf?: string }): Promise<LengthRuleResult>;

package/runtime/length-rules.mjs

@@ -0,0 +1,262 @@
+/** Narrow, deterministic Unicode code-point length evaluator. Rules are caller supplied. */
+import { sha256 } from './content-sha256.mjs';
+
+export const LENGTH_RULE_PROVIDER = Object.freeze({ id: 'topmind-writing-skills/length-rules', version: '2.1.0' });
+const SCOPE_FIELDS = Object.freeze(['platform', 'format', 'entrypoint', 'account_capability']);
+const CONTENT_FIELDS = new Set(['title', 'body']);
+const SENSITIVE_KEY = /(?:token|secret|password|credential|authorization|cookie|api[_-]?key)/iu;
+const UNSAFE_KEY = new Set(['__proto__', 'prototype', 'constructor']);
+
+function diagnostic(code, severity, message, extras = {}) {
+  return { code, severity, message, ...extras };
+}
+function compareId(left, right) {
+  const a = String(left?.id ?? '');
+  const b = String(right?.id ?? '');
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function canonical(value, seen = new WeakSet()) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (!value || typeof value !== 'object' || seen.has(value)) throw new TypeError('Rules must be finite JSON data');
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) return value.map(item => canonical(item, seen));
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) throw new TypeError('Rules must be plain JSON data');
+    const ordered = Object.create(null);
+    for (const key of Object.keys(value).sort()) {
+      if (UNSAFE_KEY.has(key) || SENSITIVE_KEY.test(key)) throw new TypeError('Rules contain a forbidden field');
+      ordered[key] = canonical(value[key], seen);
+    }
+    return ordered;
+  } finally {
+    seen.delete(value);
+  }
+}
+function hasScope(scope) {
+  return scope && typeof scope === 'object' && !Array.isArray(scope)
+    && Object.keys(scope).every(key => SCOPE_FIELDS.includes(key))
+    && SCOPE_FIELDS.every(key => typeof scope[key] === 'string' && scope[key].trim());
+}
+function scopeMatch(scope, target) {
+  let unknown = null;
+  for (const key of SCOPE_FIELDS) {
+    if (scope[key] === 'any') continue;
+    if (target[key] === 'unknown') { unknown ??= key; continue; }
+    if (scope[key] !== target[key]) return { matches: false };
+  }
+  return unknown ? { matches: false, unknown } : { matches: true };
+}
+function validDate(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/u.test(value)) return false;
+  const parsed = new Date(`${value}T00:00:00Z`);
+  return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value;
+}
+function isOfficialEvidence(evidence) {
+  if (evidence?.tier !== 'official_primary' || !validDate(evidence.checked_at)) return false;
+  try { return new URL(evidence.url).protocol === 'https:'; }
+  catch { return false; }
+}
+function baseResult() {
+  return {
+    schemaVersion: 1,
+    capabilityId: 'platform.validate.length',
+    provider: LENGTH_RULE_PROVIDER,
+    status: 'error',
+    verdict: 'invalid',
+    input: { fingerprint: null },
+    artifacts: [],
+    checks: [],
+    effectiveLimits: [],
+    diagnostics: [],
+  };
+}
+
+/**
+ * Evaluate only max_characters + unicode_code_points. This is not X weighted length.
+ * A rule must name all four scope dimensions, even when a dimension is `any`.
+ */
+export async function evaluateLengthRules({ target, document, rules, asOf } = {}) {
+  const result = baseResult();
+  if (asOf !== undefined && !validDate(asOf)) {
+    result.diagnostics.push(diagnostic('invalid-evaluation-date', 'error', 'Evaluation date must be an ISO calendar date.'));
+    return result;
+  }
+  if (!hasScope(target) || Object.values(target).some(value => value === 'any')) {
+    result.diagnostics.push(diagnostic('invalid-target-scope', 'error', 'Target must name platform, format, entrypoint and account capability; use unknown when unresolved.'));
+    return result;
+  }
+  if (!document || typeof document !== 'object' || Array.isArray(document) || !Array.isArray(rules)) {
+    result.diagnostics.push(diagnostic('invalid-rule-input', 'error', 'Document must be an object and rules must be an array.'));
+    return result;
+  }
+  if (document.text_kind !== 'platform_text') {
+    result.diagnostics.push(diagnostic('invalid-content-kind', 'error', 'Length checks require prepared platform text, not raw Markdown.'));
+    return result;
+  }
+  const sortedRules = [...rules].sort(compareId);
+  try {
+    const preparedDocument = { text_kind: document.text_kind,
+      ...(Object.hasOwn(document, 'title') ? { title: document.title } : {}),
+      ...(Object.hasOwn(document, 'body') ? { body: document.body } : {}) };
+    // Keep the exact caller supplied rule array bound to the validation report.
+    // The Kernel snapshot computes the same canonical digest from ruleset.rules.
+    result.input.rulesDigest = await sha256(JSON.stringify(canonical(rules)));
+    result.input.documentDigest = await sha256(JSON.stringify(canonical(preparedDocument)));
+    result.input.fingerprint = await sha256(JSON.stringify(canonical({
+      target,
+      document: preparedDocument,
+      rules: sortedRules,
+      ...(asOf === undefined ? {} : { asOf }),
+      provider: LENGTH_RULE_PROVIDER,
+    })));
+  } catch {
+    result.input = { fingerprint: null };
+    result.diagnostics.push(diagnostic('input-fingerprint-failed', 'error', 'Input snapshot could not be fingerprinted.'));
+    return result;
+  }
+  result.input.target = {
+    platform: target.platform,
+    format: target.format,
+    entrypoint: target.entrypoint,
+    account_capability: target.account_capability,
+  };
+  if (asOf !== undefined) result.input.asOf = asOf;
+
+  let invalid = false;
+  let blocked = false;
+  let needsReview = false;
+  for (const dimension of SCOPE_FIELDS.filter(key => target[key] === 'unknown')) {
+    needsReview = true;
+    result.diagnostics.push(diagnostic('target-dimension-unknown', 'warning', 'Target dimension needs confirmation before validation can pass.', { dimension }));
+  }
+  const ids = new Set();
+  for (const rule of sortedRules) {
+    const ruleId = typeof rule?.id === 'string' && rule.id.trim() ? rule.id : null;
+    if (!ruleId || ids.has(ruleId)) {
+      invalid = true;
+      result.diagnostics.push(diagnostic('invalid-rule-id', 'error', 'Rule ID must be unique and nonempty.', { ...(ruleId ? { ruleId } : {}) }));
+      continue;
+    }
+    ids.add(ruleId);
+    if (!hasScope(rule.applies_to) || SCOPE_FIELDS.some(key => rule.applies_to[key] === 'unknown')) {
+      invalid = true;
+      result.diagnostics.push(diagnostic('invalid-rule-scope', 'error', 'Rule must specify exactly the four supported scope dimensions.', { ruleId }));
+      continue;
+    }
+    const match = scopeMatch(rule.applies_to, target);
+    if (!match.matches && !match.unknown) continue;
+    if (rule.status !== 'active') {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('rule-inactive', 'warning', 'Rule is not active and was not applied.', { ruleId }));
+      continue;
+    }
+    if (match.unknown) {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('target-scope-unknown', 'warning', 'Target capability or entrypoint needs confirmation before this rule can be applied.', { ruleId, dimension: match.unknown }));
+      continue;
+    }
+    if (!match.matches) continue;
+    const check = rule.check;
+    if (check?.operation !== 'max_characters' || check.counter !== 'unicode_code_points') {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('unsupported-length-operation', 'warning', 'Length rule needs a supported operation and explicit counter.', { ruleId }));
+      continue;
+    }
+    if (!CONTENT_FIELDS.has(check.field) || !Number.isSafeInteger(check.max) || check.max < 0) {
+      invalid = true;
+      result.diagnostics.push(diagnostic('invalid-length-check', 'error', 'Length check needs title or body and a nonnegative integer maximum.', { ruleId }));
+      continue;
+    }
+    if (rule.category === 'platform_limit') {
+      if (rule.applies_to.platform === 'any' || rule.outcome?.exceeded !== 'block') {
+        invalid = true;
+        result.diagnostics.push(diagnostic('invalid-hard-rule', 'error', 'Platform hard limit needs a concrete platform and block outcome.', { ruleId }));
+        continue;
+      }
+      if (!isOfficialEvidence(rule.evidence)) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('hard-rule-evidence-unverified', 'warning', 'Official source and check date are required before treating a limit as blocking.', { ruleId }));
+        continue;
+      }
+      if (!validDate(rule.evidence.review_after) || rule.evidence.review_after < rule.evidence.checked_at) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('hard-rule-review-date-invalid', 'warning', 'Hard rule review date is invalid.', { ruleId }));
+        continue;
+      }
+      if (asOf === undefined) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('hard-rule-evaluation-date-required', 'warning', 'Hard rule needs an evaluation date to check its evidence.', { ruleId }));
+        continue;
+      }
+      if (asOf < rule.evidence.checked_at) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('hard-rule-evidence-not-yet-checked', 'warning', 'Hard rule evidence was checked after the evaluation date.', { ruleId }));
+        continue;
+      }
+      if (asOf > rule.evidence.review_after) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('hard-rule-evidence-expired', 'warning', 'Hard rule evidence needs review before use.', { ruleId }));
+        continue;
+      }
+    } else if (rule.category === 'creator_preference') {
+      if (rule.outcome?.exceeded !== 'warn' || rule.evidence?.tier !== 'user_confirmed') {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('preference-unconfirmed', 'warning', 'Creator preference needs confirmation and a warn outcome before use.', { ruleId }));
+        continue;
+      }
+      if (!validDate(rule.evidence.confirmed_at) || asOf === undefined || asOf < rule.evidence.confirmed_at) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('preference-confirmation-date-unverified', 'warning', 'Creator preference confirmation date must precede evaluation.', { ruleId }));
+        continue;
+      }
+    } else {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('unsupported-rule-category', 'warning', 'Rule category is outside this length evaluator.', { ruleId }));
+      continue;
+    }
+    if (typeof document[check.field] !== 'string') {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('content-field-missing', 'warning', 'Target content field is unavailable.', { ruleId, location: { field: check.field } }));
+      continue;
+    }
+    const observed = Array.from(document[check.field]).length;
+    const exceeded = observed > check.max;
+    result.checks.push({ ruleId, category: rule.category, field: check.field, observed, max: check.max, unit: 'unicode_code_points', exceeded });
+    if (exceeded) {
+      const hard = rule.category === 'platform_limit';
+      blocked ||= hard;
+      needsReview ||= !hard;
+      result.diagnostics.push(diagnostic(hard ? 'hard-length-exceeded' : 'preference-length-exceeded', hard ? 'error' : 'warning', 'Content length exceeds the applicable maximum.', { ruleId, location: { field: check.field }, observed, max: check.max, unit: 'unicode_code_points' }));
+    }
+  }
+
+  for (const field of ['title', 'body']) {
+    const checks = result.checks.filter(check => check.field === field);
+    if (!checks.length) continue;
+    const hardMax = Math.min(...checks.filter(check => check.category === 'platform_limit').map(check => check.max));
+    const preferenceMax = Math.min(...checks.filter(check => check.category === 'creator_preference').map(check => check.max));
+    const hard = Number.isFinite(hardMax) ? hardMax : null;
+    const preference = Number.isFinite(preferenceMax) ? preferenceMax : null;
+    result.effectiveLimits.push({ field, unit: 'unicode_code_points', hardMax: hard, preferenceMax: preference, effectiveMax: Math.min(hard ?? Infinity, preference ?? Infinity) });
+    if (hard !== null) {
+      for (const check of checks.filter(check => check.category === 'creator_preference' && check.max > hard)) {
+        needsReview = true;
+        result.diagnostics.push(diagnostic('preference-widens-hard-limit', 'warning', 'Creator preference is wider than an applicable hard limit and cannot relax it.', { ruleId: check.ruleId, location: { field }, hardMax: hard, preferenceMax: check.max }));
+      }
+    }
+  }
+  if (!result.checks.length) {
+    needsReview = true;
+    result.diagnostics.push(diagnostic('no-applicable-length-rule', 'warning', 'No applicable length rule was evaluated for this target.'));
+  } else {
+    for (const limit of result.effectiveLimits.filter(item => item.preferenceMax !== null && item.hardMax === null)) {
+      needsReview = true;
+      result.diagnostics.push(diagnostic('no-applicable-platform-limit', 'warning', 'Creator preferences alone cannot confirm a platform length limit.', { location: { field: limit.field } }));
+    }
+  }
+  result.verdict = invalid ? 'invalid' : blocked ? 'block' : needsReview ? 'review' : 'pass';
+  result.status = result.verdict === 'pass' ? 'ok' : result.verdict === 'review' ? 'warning' : 'error';
+  return result;
+}

package/runtime/length-ruleset.d.mts

@@ -0,0 +1,13 @@
+import type { LengthRule, LengthRuleResult, LengthTarget } from './length-rules.mjs';
+
+export type LengthRuleSet = { schemaVersion: 1; id: string; version: string; rules: LengthRule[] };
+export type LengthRuleSetResult = Omit<LengthRuleResult, 'capabilityId' | 'input'> & {
+  capabilityId: 'platform.validate.length-ruleset';
+  input: LengthRuleResult['input'] & { ruleSet?: { id: string; version: string }; creationSnapshotFingerprint?: string };
+};
+export class LengthRuleSetError extends Error { code: string; }
+export const LENGTH_RULESET_PROVIDER: Readonly<{ id: string; version: string }>;
+export function parseLengthRuleSet(jsonText: string): LengthRuleSet;
+export function evaluateLengthRuleSet(input: { ruleSetJson: string; target: LengthTarget;
+  document: { text_kind: 'platform_text'; title?: string; body?: string }; asOf: string;
+  creationSnapshotFingerprint?: string }): Promise<LengthRuleSetResult>;

package/runtime/length-ruleset.mjs

@@ -0,0 +1,121 @@
+/** Portable JSON rule-set loader and deterministic length report. No platform rules ship here. */
+import { sha256 } from './content-sha256.mjs';
+import { evaluateLengthRules } from './length-rules.mjs';
+
+export const LENGTH_RULESET_PROVIDER = Object.freeze({ id: 'topmind-writing-skills/length-ruleset', version: '1.1.0' });
+const MAX_JSON_BYTES = 1024 * 1024;
+const MAX_RULES = 1000;
+const SCOPE = ['platform', 'format', 'entrypoint', 'account_capability'];
+const FORBIDDEN_KEY = /(?:token|secret|password|credential|authorization|cookie|api[_-]?key)/iu;
+
+export class LengthRuleSetError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = 'LengthRuleSetError';
+    this.code = code;
+  }
+}
+
+function fail(code, message) { throw new LengthRuleSetError(code, message); }
+function exactKeys(value, keys) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === keys.length && Object.keys(value).every(key => keys.includes(key));
+}
+function validDate(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/u.test(value)) return false;
+  const parsed = new Date(`${value}T00:00:00Z`);
+  return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value;
+}
+function safeJson(value, depth = 0, budget = { nodes: 0 }) {
+  if (++budget.nodes > 100_000 || depth > 32) fail('ruleset-too-complex', 'Rule set exceeds the supported JSON complexity.');
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return;
+  if (typeof value === 'number' && Number.isFinite(value)) return;
+  if (!value || typeof value !== 'object') fail('invalid-ruleset-json', 'Rule set must contain finite JSON data.');
+  for (const key of Object.keys(value)) {
+    if (['__proto__', 'prototype', 'constructor'].includes(key) || FORBIDDEN_KEY.test(key)) {
+      fail('forbidden-ruleset-field', 'Rule set contains a forbidden field.');
+    }
+    safeJson(value[key], depth + 1, budget);
+  }
+}
+function label(value) {
+  return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,127}$/u.test(value);
+}
+function ruleShape(rule) {
+  if (!exactKeys(rule, ['id', 'category', 'status', 'applies_to', 'check', 'outcome', 'evidence']) || !label(rule.id)) return false;
+  if (!['active', 'proposed_unconfirmed'].includes(rule.status)) return false;
+  if (!exactKeys(rule.applies_to, SCOPE) || SCOPE.some(key => typeof rule.applies_to[key] !== 'string'
+    || !rule.applies_to[key].trim() || rule.applies_to[key] === 'unknown')) return false;
+  if (!exactKeys(rule.check, ['field', 'operation', 'counter', 'max'])
+    || !['title', 'body'].includes(rule.check.field) || rule.check.operation !== 'max_characters'
+    || rule.check.counter !== 'unicode_code_points' || !Number.isSafeInteger(rule.check.max) || rule.check.max < 0) return false;
+  if (!exactKeys(rule.outcome, ['exceeded'])) return false;
+  if (rule.category === 'platform_limit') {
+    if (rule.applies_to.platform === 'any' || rule.outcome.exceeded !== 'block'
+      || !exactKeys(rule.evidence, ['tier', 'url', 'checked_at', 'review_after'])
+      || rule.evidence.tier !== 'official_primary' || !validDate(rule.evidence.checked_at)
+      || !validDate(rule.evidence.review_after) || rule.evidence.review_after < rule.evidence.checked_at) return false;
+    try {
+      const url = new URL(rule.evidence.url);
+      return url.protocol === 'https:' && !url.username && !url.password;
+    } catch { return false; }
+  }
+  if (rule.category !== 'creator_preference' || rule.outcome.exceeded !== 'warn') return false;
+  if (rule.status === 'active') {
+    return exactKeys(rule.evidence, ['tier', 'confirmed_at'])
+      && rule.evidence.tier === 'user_confirmed' && validDate(rule.evidence.confirmed_at);
+  }
+  return exactKeys(rule.evidence, ['tier']) && rule.evidence.tier === 'user_preference_pending_confirmation';
+}
+
+/** Parse a reviewed JSON document. The caller must verify source claims before activation. */
+export function parseLengthRuleSet(jsonText) {
+  if (typeof jsonText !== 'string' || new TextEncoder().encode(jsonText).length > MAX_JSON_BYTES) {
+    fail('invalid-ruleset-json', 'Rule set must be JSON text no larger than 1 MiB.');
+  }
+  let value;
+  try { value = JSON.parse(jsonText); }
+  catch { fail('invalid-ruleset-json', 'Rule set is not valid JSON.'); }
+  safeJson(value);
+  if (!exactKeys(value, ['schemaVersion', 'id', 'version', 'rules']) || value.schemaVersion !== 1
+    || !label(value.id) || !label(value.version) || !Array.isArray(value.rules) || value.rules.length > MAX_RULES) {
+    fail('invalid-ruleset', 'Rule set needs schemaVersion 1, id, version and a bounded rules array.');
+  }
+  const ids = new Set();
+  for (const rule of value.rules) {
+    if (!ruleShape(rule)) fail('invalid-ruleset-rule', 'Rule set contains an unsupported or incomplete length rule.');
+    if (ids.has(rule.id)) fail('duplicate-ruleset-rule', 'Rule IDs must be unique within a rule set.');
+    ids.add(rule.id);
+  }
+  return value;
+}
+
+function invalidResult(code, message) {
+  return { schemaVersion: 1, capabilityId: 'platform.validate.length-ruleset', provider: LENGTH_RULESET_PROVIDER,
+    status: 'error', verdict: 'invalid', input: { fingerprint: null }, artifacts: [], checks: [],
+    effectiveLimits: [], diagnostics: [{ code, severity: 'error', message }] };
+}
+
+/** Evaluate one explicit target and date; the result's rulesDigest matches Kernel ruleset.rules. */
+export async function evaluateLengthRuleSet({ ruleSetJson, target, document, asOf, creationSnapshotFingerprint } = {}) {
+  if (!validDate(asOf)) return invalidResult('invalid-evaluation-date', 'Evaluation date must be an ISO calendar date.');
+  if (creationSnapshotFingerprint !== undefined &&
+      (typeof creationSnapshotFingerprint !== 'string' || !/^[a-f0-9]{64}$/u.test(creationSnapshotFingerprint))) {
+    return invalidResult('invalid-snapshot-fingerprint', 'Creation snapshot fingerprint must be SHA-256.');
+  }
+  let ruleSet;
+  try { ruleSet = parseLengthRuleSet(ruleSetJson); }
+  catch (error) {
+    if (error instanceof LengthRuleSetError) return invalidResult(error.code, error.message);
+    throw error;
+  }
+  const evaluated = await evaluateLengthRules({ target, document, rules: ruleSet.rules, asOf });
+  const input = { ...evaluated.input, ruleSet: { id: ruleSet.id, version: ruleSet.version },
+    ...(creationSnapshotFingerprint === undefined ? {} : { creationSnapshotFingerprint }) };
+  if (input.fingerprint) input.fingerprint = await sha256(JSON.stringify({
+    evaluationFingerprint: input.fingerprint, rulesDigest: input.rulesDigest,
+    ruleSet: input.ruleSet, provider: LENGTH_RULESET_PROVIDER,
+    ...(creationSnapshotFingerprint === undefined ? {} : { creationSnapshotFingerprint }),
+  }));
+  return { ...evaluated, capabilityId: 'platform.validate.length-ruleset', provider: LENGTH_RULESET_PROVIDER, input };
+}