@vauban-org/agent-sdk 1.0.0 → 1.3.0

package/dist/skill-manifest/types.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Skill Lineage Manifest — types (sprint-586).
+ *
+ * Every skill has a cryptographically anchored lineage.
+ * Modifying 1 byte of the training replay → verifier rejects.
+ * ClawHavoc defense: arXiv:2603.00195.
+ *
+ * Grade hierarchy:
+ *   starknet_primary — Poseidon hash anchored on-chain (decentralised, post-quantum).
+ *   tsa_fallback     — RFC 3161 DigiCert TSA only (DEGRADED: centralised, not post-quantum).
+ *   unanchored       — Development / testing only. No anchor.
+ *
+ * @module skill-manifest/types
+ */
+export interface SkillManifest {
+    /** Canonical identifier for the skill, e.g. "vauban.sentinel.rebalancing". */
+    skillId: string;
+    /** SemVer of the skill implementation. */
+    version: string;
+    /** Domain bucket, e.g. "finance", "governance", "identity". */
+    domain: string;
+    /**
+     * SHA-256 hex digest of the deterministic training replay snapshot.
+     * 1-byte tamper in the replay → this value changes → verifier rejects.
+     */
+    trainingReplayRoot: string;
+    /**
+     * Poseidon(skillId_felt, version_felt, domain_felt, replayRoot_felt).
+     * ZK-friendly commitment over felt252 — used for Starknet anchoring.
+     */
+    poseidonHash: string;
+    /**
+     * Base64-encoded RFC 3161 TimeStampToken from DigiCert TSA.
+     * Fallback anchor only — see grade field for semantics.
+     */
+    tsaToken?: string;
+    /**
+     * Starknet transaction hash of the batch anchor call.
+     * Present when grade === 'starknet_primary'.
+     */
+    starknetAnchorTx?: string;
+    /**
+     * Optional IPFS CID of the full manifest for content-addressed redundancy.
+     * Not a security anchor — informational only.
+     */
+    ipfsCid?: string;
+    createdAt: Date;
+    /**
+     * Proof grade of this manifest:
+     *   starknet_primary — on-chain, decentralised, post-quantum (Poseidon/STARK).
+     *   tsa_fallback     — RFC 3161 DigiCert TSA only — DEGRADED MODE.
+     *   unanchored       — No anchor. Development/testing only.
+     */
+    grade: "starknet_primary" | "tsa_fallback" | "unanchored";
+}
+export interface AnchorWitness {
+    /** Which anchor mechanism produced this witness. */
+    type: "starknet" | "tsa" | "none";
+    /**
+     * For starknet: Merkle inclusion proof (hex-encoded siblings, comma-separated).
+     * For tsa: base64 TSA token (same as SkillManifest.tsaToken).
+     * For none: empty string.
+     */
+    proof: string;
+    verifiedAt: Date;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/skill-manifest/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/skill-manifest/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB;;;;;OAKG;IACH,KAAK,EAAE,kBAAkB,GAAG,cAAc,GAAG,YAAY,CAAC;CAC3D;AAID,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;IAClC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,IAAI,CAAC;CAClB"}

package/dist/skill-manifest/types.js

@@ -0,0 +1,16 @@
+/**
+ * Skill Lineage Manifest — types (sprint-586).
+ *
+ * Every skill has a cryptographically anchored lineage.
+ * Modifying 1 byte of the training replay → verifier rejects.
+ * ClawHavoc defense: arXiv:2603.00195.
+ *
+ * Grade hierarchy:
+ *   starknet_primary — Poseidon hash anchored on-chain (decentralised, post-quantum).
+ *   tsa_fallback     — RFC 3161 DigiCert TSA only (DEGRADED: centralised, not post-quantum).
+ *   unanchored       — Development / testing only. No anchor.
+ *
+ * @module skill-manifest/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/skill-manifest/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/skill-manifest/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/skill-manifest/verifier.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Skill Lineage Manifest — verifier (sprint-586).
+ *
+ * Zero external dependency verifier — mirrors vauban-claim-verifier philosophy.
+ *
+ * Verification checks:
+ *   1. replayRootMatches  — SHA-256(replaySnapshot) === manifest.trainingReplayRoot
+ *   2. poseidonHashValid  — computeManifestHash(manifest) === manifest.poseidonHash
+ *   3. tsaAnchorValid     — verifyTsaAnchor(manifest) (skipped if no tsaToken)
+ *   4. starknetAnchorValid — merkle inclusion via AnchorWitness (if provided)
+ *
+ * A 1-byte tamper in replaySnapshot causes check 1 to fail.
+ * All checks run independently; errors array collects all failures.
+ *
+ * @module skill-manifest/verifier
+ */
+import type { SkillManifest, AnchorWitness } from "./types.js";
+export interface ManifestVerifyResult {
+    /** Overall validity — true only if all applicable checks pass. */
+    valid: boolean;
+    /** SHA-256(replaySnapshot) === manifest.trainingReplayRoot */
+    replayRootMatches: boolean;
+    /** Poseidon commitment over manifest fields matches stored poseidonHash */
+    poseidonHashValid: boolean;
+    /** RFC 3161 TSA token structurally verifiable (false if no tsaToken) */
+    tsaAnchorValid: boolean;
+    /** Merkle inclusion proof valid (false if no witness or witness.type='none') */
+    starknetAnchorValid: boolean;
+    /** Grade propagated from the manifest (informational). */
+    grade: SkillManifest["grade"];
+    /** Human-readable error messages for every failed check. */
+    errors: string[];
+}
+/**
+ * Verify a SkillManifest against the original training replay snapshot.
+ *
+ * @param manifest         - Manifest to verify.
+ * @param replaySnapshot   - Original training trace bytes (same input used in buildManifest).
+ * @param starknetWitness  - Optional Merkle inclusion witness from the Starknet anchor.
+ */
+export declare function verifyManifest(manifest: SkillManifest, replaySnapshot: string | Buffer, starknetWitness?: AnchorWitness): ManifestVerifyResult;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/skill-manifest/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/skill-manifest/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI/D,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,cAAc,EAAE,OAAO,CAAC;IACxB,gFAAgF;IAChF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0DAA0D;IAC1D,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAkBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EACvB,cAAc,EAAE,MAAM,GAAG,MAAM,EAC/B,eAAe,CAAC,EAAE,aAAa,GAC9B,oBAAoB,CAgItB"}

package/dist/skill-manifest/verifier.js

@@ -0,0 +1,136 @@
+/**
+ * Skill Lineage Manifest — verifier (sprint-586).
+ *
+ * Zero external dependency verifier — mirrors vauban-claim-verifier philosophy.
+ *
+ * Verification checks:
+ *   1. replayRootMatches  — SHA-256(replaySnapshot) === manifest.trainingReplayRoot
+ *   2. poseidonHashValid  — computeManifestHash(manifest) === manifest.poseidonHash
+ *   3. tsaAnchorValid     — verifyTsaAnchor(manifest) (skipped if no tsaToken)
+ *   4. starknetAnchorValid — merkle inclusion via AnchorWitness (if provided)
+ *
+ * A 1-byte tamper in replaySnapshot causes check 1 to fail.
+ * All checks run independently; errors array collects all failures.
+ *
+ * @module skill-manifest/verifier
+ */
+import { createHash } from "node:crypto";
+import { computeManifestHash } from "./builder.js";
+import { verifyTsaAnchor } from "./anchor.js";
+import { verifyProofInclusion } from "../proof/index.js";
+// ─── helpers ─────────────────────────────────────────────────────────────────
+function sha256Hex(input) {
+    const data = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+    return createHash("sha256").update(data).digest("hex");
+}
+/**
+ * Normalise hex strings for comparison: strip "0x" prefix, lowercase.
+ */
+function normaliseHex(h) {
+    return (h.startsWith("0x") ? h.slice(2) : h).toLowerCase();
+}
+// ─── verifyManifest ───────────────────────────────────────────────────────────
+/**
+ * Verify a SkillManifest against the original training replay snapshot.
+ *
+ * @param manifest         - Manifest to verify.
+ * @param replaySnapshot   - Original training trace bytes (same input used in buildManifest).
+ * @param starknetWitness  - Optional Merkle inclusion witness from the Starknet anchor.
+ */
+export function verifyManifest(manifest, replaySnapshot, starknetWitness) {
+    const errors = [];
+    // ── Check 1: replay root integrity ──────────────────────────────────────────
+    const recomputedRoot = sha256Hex(typeof replaySnapshot === "string"
+        ? Buffer.from(replaySnapshot, "utf8")
+        : replaySnapshot);
+    const replayRootMatches = normaliseHex(recomputedRoot) === normaliseHex(manifest.trainingReplayRoot);
+    if (!replayRootMatches) {
+        errors.push(`replayRoot mismatch: expected ${manifest.trainingReplayRoot}, got ${recomputedRoot}`);
+    }
+    // ── Check 2: Poseidon hash validity ──────────────────────────────────────────
+    let poseidonHashValid = false;
+    try {
+        const recomputed = computeManifestHash({
+            skillId: manifest.skillId,
+            version: manifest.version,
+            domain: manifest.domain,
+            trainingReplayRoot: manifest.trainingReplayRoot,
+        });
+        poseidonHashValid =
+            normaliseHex(recomputed) === normaliseHex(manifest.poseidonHash);
+        if (!poseidonHashValid) {
+            errors.push(`poseidonHash mismatch: expected ${manifest.poseidonHash}, got ${recomputed}`);
+        }
+    }
+    catch (err) {
+        errors.push(`poseidonHash computation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // ── Check 3: TSA anchor ───────────────────────────────────────────────────────
+    const tsaAnchorValid = manifest.tsaToken ? verifyTsaAnchor(manifest) : false;
+    if (manifest.tsaToken && !tsaAnchorValid) {
+        errors.push("tsaAnchor invalid: token present but verification failed");
+    }
+    // ── Check 4: Starknet Merkle inclusion ──────────────────────────────────────
+    let starknetAnchorValid = false;
+    if (starknetWitness && starknetWitness.type === "starknet") {
+        try {
+            // proof field: comma-separated Merkle siblings (hex)
+            const siblings = starknetWitness.proof.length > 0
+                ? starknetWitness.proof.split(",").map((s) => s.trim())
+                : [];
+            const leafFelt = manifest.poseidonHash.startsWith("0x")
+                ? manifest.poseidonHash.slice(2)
+                : manifest.poseidonHash;
+            // We need a root to verify against; derive it from the first sibling
+            // if the proof is a single-leaf tree (leaf === root).
+            if (siblings.length === 0) {
+                // Degenerate tree: leaf is the root — valid if leaf is consistent.
+                starknetAnchorValid = leafFelt.length > 0;
+            }
+            else {
+                // verifyProofInclusion: leaf + proof[] → recomputed root must match
+                // the last sibling used as root sentinel in single-layer proofs.
+                // For multi-layer proofs the root must be provided externally.
+                // We use the witness.proof first element as root when siblings.length === 1.
+                const root = siblings[siblings.length - 1];
+                const proofSiblings = siblings.slice(0, -1);
+                starknetAnchorValid = verifyProofInclusion(leafFelt, proofSiblings, root);
+            }
+            if (!starknetAnchorValid) {
+                errors.push("starknetAnchor: Merkle inclusion proof failed");
+            }
+        }
+        catch (err) {
+            errors.push(`starknetAnchor verification error: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    else if (starknetWitness && starknetWitness.type === "tsa") {
+        // TSA witness — treat as tsaAnchorValid supplement (already checked above).
+        starknetAnchorValid = false;
+    }
+    // type === 'none' or no witness → starknetAnchorValid remains false (expected).
+    // ── Grade propagation ─────────────────────────────────────────────────────────
+    const grade = manifest.grade;
+    // Warn about unanchored grade in errors (non-fatal, but caller should know).
+    if (grade === "unanchored") {
+        errors.push("grade=unanchored: manifest has no anchor — development/testing only");
+    }
+    // ── Overall validity ──────────────────────────────────────────────────────────
+    // An anchored manifest is valid when the integrity checks pass.
+    // For unanchored: valid = replayRootMatches && poseidonHashValid only.
+    const anchorErrors = errors.filter((e) => e.startsWith("tsa") ||
+        e.startsWith("starknet") ||
+        e.startsWith("grade=unanchored"));
+    const integrityErrors = errors.filter((e) => !anchorErrors.includes(e));
+    const valid = integrityErrors.length === 0;
+    return {
+        valid,
+        replayRootMatches,
+        poseidonHashValid,
+        tsaAnchorValid,
+        starknetAnchorValid,
+        grade,
+        errors,
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/skill-manifest/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/skill-manifest/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAsBzD,gFAAgF;AAEhF,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAuB,EACvB,cAA+B,EAC/B,eAA+B;IAE/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,+EAA+E;IAC/E,MAAM,cAAc,GAAG,SAAS,CAC9B,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC;QACrC,CAAC,CAAC,cAAc,CACnB,CAAC;IACF,MAAM,iBAAiB,GACrB,YAAY,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,iCAAiC,QAAQ,CAAC,kBAAkB,SAAS,cAAc,EAAE,CACtF,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;YACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD,CAAC,CAAC;QACH,iBAAiB;YACf,YAAY,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,mCAAmC,QAAQ,CAAC,YAAY,SAAS,UAAU,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,oCACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;IAED,+EAA+E;IAC/E,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,QAAQ,GACZ,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAE1B,qEAAqE;YACrE,sDAAsD;YACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,mEAAmE;gBACnE,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,iEAAiE;gBACjE,+DAA+D;gBAC/D,6EAA6E;gBAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5C,mBAAmB,GAAG,oBAAoB,CACxC,QAAQ,EACR,aAAa,EACb,IAAI,CACL,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,sCACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7D,4EAA4E;QAC5E,mBAAmB,GAAG,KAAK,CAAC;IAC9B,CAAC;IACD,gFAAgF;IAEhF,iFAAiF;IACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,6EAA6E;IAC7E,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,gEAAgE;IAChE,uEAAuE;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxB,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CACnC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;IAE3C,OAAO;QACL,KAAK;QACL,iBAAiB;QACjB,iBAAiB;QACjB,cAAc;QACd,mBAAmB;QACnB,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/skills/_secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Internal helper for skills that read configuration secrets.
+ *
+ * Prefers `ctx.secrets` (audit-trail-bearing per ADR-ECO-036) over
+ * `process.env` when a {@link SecretsAccessor} is configured on the
+ * {@link SkillContext}. Falls back to env when no accessor is wired so
+ * legacy callers see no behavior change.
+ *
+ * Returns `undefined` when the secret is configured nowhere — callers
+ * decide whether that's a SkillNotConfiguredError or a soft default.
+ *
+ * @internal
+ */
+import type { SkillContext } from "../orchestration/ooda/skills.js";
+export declare function readSecret(ctx: SkillContext, name: string): string | undefined;
+//# sourceMappingURL=_secrets.d.ts.map

package/dist/skills/_secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_secrets.d.ts","sourceRoot":"","sources":["../../src/skills/_secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,wBAAgB,UAAU,CACxB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAKpB"}

package/dist/skills/_secrets.js

@@ -0,0 +1,20 @@
+/**
+ * Internal helper for skills that read configuration secrets.
+ *
+ * Prefers `ctx.secrets` (audit-trail-bearing per ADR-ECO-036) over
+ * `process.env` when a {@link SecretsAccessor} is configured on the
+ * {@link SkillContext}. Falls back to env when no accessor is wired so
+ * legacy callers see no behavior change.
+ *
+ * Returns `undefined` when the secret is configured nowhere — callers
+ * decide whether that's a SkillNotConfiguredError or a soft default.
+ *
+ * @internal
+ */
+export function readSecret(ctx, name) {
+    if (ctx.secrets && ctx.secrets.has(name)) {
+        return ctx.secrets.get(name);
+    }
+    return process.env[name];
+}
+//# sourceMappingURL=_secrets.js.map

package/dist/skills/_secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_secrets.js","sourceRoot":"","sources":["../../src/skills/_secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,UAAU,UAAU,CACxB,GAAiB,EACjB,IAAY;IAEZ,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/skills/alpaca-quote.d.ts

@@ -12,10 +12,10 @@ declare const inputSchema: z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<["paper", "live"]>>;
 }, "strict", z.ZodTypeAny, {
     symbol: string;
-    mode: "live" | "paper";
+    mode: "paper" | "live";
 }, {
     symbol: string;
-    mode?: "live" | "paper" | undefined;
+    mode?: "paper" | "live" | undefined;
 }>;
 type AlpacaQuoteInput = z.infer<typeof inputSchema>;
 export interface AlpacaQuoteOutput {

package/dist/skills/alpaca-quote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alpaca-quote.d.ts","sourceRoot":"","sources":["../../src/skills/alpaca-quote.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,iCAAiC,CAAC;AAI3E,QAAA,MAAM,WAAW;;;;;;;;;EASN,CAAC;AACZ,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,CAiDlE,CAAC"}
+{"version":3,"file":"alpaca-quote.d.ts","sourceRoot":"","sources":["../../src/skills/alpaca-quote.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,iCAAiC,CAAC;AAmB3E,QAAA,MAAM,WAAW;;;;;;;;;EASN,CAAC;AACZ,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,CAwElE,CAAC"}

package/dist/skills/alpaca-quote.js

@@ -6,8 +6,24 @@
  * @public
  */
 import { z } from "zod";
+import { retry, RETRY_TRANSIENT, RetryExhaustedError, } from "../retry/index.js";
 import { SkillExecutionError, SkillNotConfiguredError } from "./errors.js";
 import { withSkillSpan } from "./_otel.js";
+import { readSecret } from "./_secrets.js";
+class RetryableHttpError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`HTTP ${status}: ${body.slice(0, 200)}`);
+        this.status = status;
+        this.body = body;
+        this.name = "RetryableHttpError";
+    }
+}
+const ALPACA_RETRY = {
+    ...RETRY_TRANSIENT,
+    retryIf: (err) => err instanceof RetryableHttpError || err instanceof TypeError,
+};
 const inputSchema = z
     .object({
     symbol: z
@@ -35,8 +51,8 @@ export const alpacaQuote = {
             };
         }
         return withSkillSpan("alpaca_quote", async () => {
-            const apiKey = process.env.ALPACA_API_KEY;
-            const apiSecret = process.env.ALPACA_API_SECRET;
+            const apiKey = readSecret(ctx, "ALPACA_API_KEY");
+            const apiSecret = readSecret(ctx, "ALPACA_API_SECRET");
             if (!apiKey || !apiSecret) {
                 throw new SkillNotConfiguredError("alpaca_quote", [
                     "ALPACA_API_KEY",
@@ -45,25 +61,40 @@ export const alpacaQuote = {
             }
             const dataHost = "https://data.alpaca.markets";
             const url = `${dataHost}/v2/stocks/${encodeURIComponent(input.symbol)}/quotes/latest`;
-            const res = await fetch(url, {
-                headers: {
-                    "APCA-API-KEY-ID": apiKey,
-                    "APCA-API-SECRET-KEY": apiSecret,
-                },
-            });
-            if (!res.ok) {
-                throw new SkillExecutionError("alpaca_quote", `${res.status}`, {
-                    status: res.status,
-                });
+            try {
+                return await retry(async () => {
+                    const res = await fetch(url, {
+                        headers: {
+                            "APCA-API-KEY-ID": apiKey,
+                            "APCA-API-SECRET-KEY": apiSecret,
+                        },
+                    });
+                    if (!res.ok) {
+                        const body = await res.text().catch(() => "");
+                        if (res.status >= 500 || res.status === 429) {
+                            throw new RetryableHttpError(res.status, body);
+                        }
+                        throw new SkillExecutionError("alpaca_quote", `${res.status}`, {
+                            status: res.status,
+                        });
+                    }
+                    const data = (await res.json());
+                    return {
+                        symbol: input.symbol,
+                        bid: data.quote?.bp ?? 0,
+                        ask: data.quote?.ap ?? 0,
+                        timestamp: data.quote?.t ?? new Date().toISOString(),
+                        mode: input.mode,
+                    };
+                }, { config: ALPACA_RETRY });
+            }
+            catch (err) {
+                const cause = err instanceof RetryExhaustedError ? err.lastError : err;
+                if (cause instanceof RetryableHttpError) {
+                    throw new SkillExecutionError("alpaca_quote", `${cause.status} after retries`, { status: cause.status });
+                }
+                throw cause;
             }
-            const data = (await res.json());
-            return {
-                symbol: input.symbol,
-                bid: data.quote?.bp ?? 0,
-                ask: data.quote?.ap ?? 0,
-                timestamp: data.quote?.t ?? new Date().toISOString(),
-                mode: input.mode,
-            };
         });
     },
 };

package/dist/skills/alpaca-quote.js.map

@@ -1 +1 @@
-{"version":3,"file":"alpaca-quote.js","sourceRoot":"","sources":["../../src/skills/alpaca-quote.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,gBAAgB,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAWZ,MAAM,CAAC,MAAM,WAAW,GAA+C;IACrE,IAAI,EAAE,cAAc;IACpB,WAAW;IACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAiB;QACpC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAsB,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBACpC,IAAI,EAAE,QAAQ;aACf,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE;oBAChD,gBAAgB;oBAChB,mBAAmB;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,6BAA6B,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG,QAAQ,cAAc,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACtF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE;oBACP,iBAAiB,EAAE,MAAM;oBACzB,qBAAqB,EAAE,SAAS;iBACjC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,mBAAmB,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;oBAC7D,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;gBACxB,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpD,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
+{"version":3,"file":"alpaca-quote.js","sourceRoot":"","sources":["../../src/skills/alpaca-quote.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,KAAK,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,kBAAmB,SAAQ,KAAK;IACR;IAAgC;IAA5D,YAA4B,MAAc,EAAkB,IAAY;QACtE,KAAK,CAAC,QAAQ,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QADrB,WAAM,GAAN,MAAM,CAAQ;QAAkB,SAAI,GAAJ,IAAI,CAAQ;QAEtE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,YAAY,GAAgB;IAChC,GAAG,eAAe;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,SAAS;CAChE,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,gBAAgB,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAWZ,MAAM,CAAC,MAAM,WAAW,GAA+C;IACrE,IAAI,EAAE,cAAc;IACpB,WAAW;IACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAiB;QACpC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAsB,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBACpC,IAAI,EAAE,QAAQ;aACf,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,cAAc,EAAE;oBAChD,gBAAgB;oBAChB,mBAAmB;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,6BAA6B,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG,QAAQ,cAAc,kBAAkB,CACrD,KAAK,CAAC,MAAM,CACb,gBAAgB,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAChB,KAAK,IAAI,EAAE;oBACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;wBAC3B,OAAO,EAAE;4BACP,iBAAiB,EAAE,MAAM;4BACzB,qBAAqB,EAAE,SAAS;yBACjC;qBACF,CAAC,CAAC;oBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;4BAC5C,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;wBACjD,CAAC;wBACD,MAAM,IAAI,mBAAmB,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;4BAC7D,MAAM,EAAE,GAAG,CAAC,MAAM;yBACnB,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;oBACF,OAAO;wBACL,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;wBACxB,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC;wBACxB,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACpD,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC;gBACJ,CAAC,EACD,EAAE,MAAM,EAAE,YAAY,EAAE,CACzB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBACvE,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,MAAM,IAAI,mBAAmB,CAC3B,cAAc,EACd,GAAG,KAAK,CAAC,MAAM,gBAAgB,EAC/B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/skills/brain-query.d.ts

@@ -15,14 +15,14 @@ declare const inputSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     query: string;
     limit: number;
-    tags?: string[] | undefined;
-    category?: string | undefined;
     mcp_call_hash?: string | undefined;
+    category?: string | undefined;
+    tags?: string[] | undefined;
 }, {
     query: string;
-    tags?: string[] | undefined;
-    category?: string | undefined;
     mcp_call_hash?: string | undefined;
+    category?: string | undefined;
+    tags?: string[] | undefined;
     limit?: number | undefined;
 }>;
 type BrainQueryInput = z.infer<typeof inputSchema>;

package/dist/skills/brain-store.d.ts

@@ -19,20 +19,20 @@ declare const inputSchema: z.ZodObject<{
     mcp_call_hash: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     content: string;
-    metadata?: Record<string, unknown> | undefined;
-    tags?: string[] | undefined;
-    category?: string | undefined;
     mcp_call_hash?: string | undefined;
     confidence?: number | undefined;
+    category?: string | undefined;
+    tags?: string[] | undefined;
     author?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
 }, {
     content: string;
-    metadata?: Record<string, unknown> | undefined;
-    tags?: string[] | undefined;
-    category?: string | undefined;
     mcp_call_hash?: string | undefined;
     confidence?: number | undefined;
+    category?: string | undefined;
+    tags?: string[] | undefined;
     author?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
 }>;
 type BrainStoreInput = z.infer<typeof inputSchema>;
 export interface BrainStoreOutput {

package/dist/skills/errors.d.ts

@@ -30,4 +30,19 @@ export declare class HttpFetchAllowlistError extends Error {
     readonly host: string;
     constructor(url: string, host: string);
 }
+export declare class SkillMdParseError extends Error {
+    readonly filePath: string;
+    constructor(filePath: string, reason: string);
+}
+export declare class SkillMdValidationError extends Error {
+    readonly filePath: string;
+    readonly issues: ReadonlyArray<{
+        path: string;
+        message: string;
+    }>;
+    constructor(filePath: string, issues: ReadonlyArray<{
+        path: string;
+        message: string;
+    }>);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/skills/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;gBAC3B,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE;CAQ7D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ9C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM;CAK1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMtC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;gBAC3B,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE;CAU7D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ9C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM;CAK1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMtC;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK7C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAEhE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAU3D"}

package/dist/skills/errors.js

@@ -47,4 +47,25 @@ export class HttpFetchAllowlistError extends Error {
         this.host = host;
     }
 }
+export class SkillMdParseError extends Error {
+    filePath;
+    constructor(filePath, reason) {
+        super(`SKILL.md at ${filePath}: ${reason}`);
+        this.name = "SkillMdParseError";
+        this.filePath = filePath;
+    }
+}
+export class SkillMdValidationError extends Error {
+    filePath;
+    issues;
+    constructor(filePath, issues) {
+        const summary = issues
+            .map((i) => `${i.path || "(root)"}: ${i.message}`)
+            .join("; ");
+        super(`SKILL.md at ${filePath}: invalid frontmatter — ${summary}`);
+        this.name = "SkillMdValidationError";
+        this.filePath = filePath;
+        this.issues = issues;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/skills/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,SAAS,CAAS;IAClB,UAAU,CAAoB;IACvC,YAAY,SAAiB,EAAE,UAA6B;QAC1D,KAAK,CACH,UAAU,SAAS,iCAAiC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,SAAS,CAAS;IAClB,MAAM,CAAU;IAChB,KAAK,CAAW;IACzB,YACE,SAAiB,EACjB,OAAe,EACf,IAA2C;QAE3C,KAAK,CAAC,UAAU,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,KAAK,CAAS;IACvB,YAAY,KAAa;QACvB,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,GAAG,CAAS;IACZ,IAAI,CAAS;IACtB,YAAY,GAAW,EAAE,IAAY;QACnC,KAAK,CAAC,qBAAqB,IAAI,+BAA+B,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,SAAS,CAAS;IAClB,UAAU,CAAoB;IACvC,YAAY,SAAiB,EAAE,UAA6B;QAC1D,KAAK,CACH,UAAU,SAAS,iCAAiC,UAAU,CAAC,IAAI,CACjE,IAAI,CACL,EAAE,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,SAAS,CAAS;IAClB,MAAM,CAAU;IAChB,KAAK,CAAW;IACzB,YACE,SAAiB,EACjB,OAAe,EACf,IAA2C;QAE3C,KAAK,CAAC,UAAU,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,KAAK,CAAS;IACvB,YAAY,KAAa;QACvB,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,GAAG,CAAS;IACZ,IAAI,CAAS;IACtB,YAAY,GAAW,EAAE,IAAY;QACnC,KAAK,CAAC,qBAAqB,IAAI,+BAA+B,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,QAAQ,CAAS;IAC1B,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CAAC,eAAe,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAS;IACjB,MAAM,CAAmD;IAClE,YACE,QAAgB,EAChB,MAAwD;QAExD,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,eAAe,QAAQ,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/skills/hitl-request.d.ts

@@ -18,13 +18,13 @@ declare const inputSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     reason: string;
     agent_run_id: string;
-    risk_level: "low" | "medium" | "high" | "critical";
+    risk_level: "critical" | "low" | "medium" | "high";
     timeout_seconds: number;
     payload?: Record<string, unknown> | undefined;
 }, {
     reason: string;
     agent_run_id: string;
-    risk_level?: "low" | "medium" | "high" | "critical" | undefined;
+    risk_level?: "critical" | "low" | "medium" | "high" | undefined;
     payload?: Record<string, unknown> | undefined;
     timeout_seconds?: number | undefined;
 }>;

package/dist/skills/index.d.ts

@@ -12,7 +12,9 @@
  *
  * @public
  */
-export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, } from "./errors.js";
+export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, SkillMdParseError, SkillMdValidationError, } from "./errors.js";
+export { loadSkillMd, parseSkillMd, toDiscoveryEntry, type ParsedSkillFile, } from "./markdown/loader.js";
+export { SkillManifestSchema, resolveTier, parseAllowedTools, type SkillManifest, type VaubanSkillTier, type VaubanBiscuitScope, type VaubanAuditStatus, } from "./markdown/schema.js";
 export { webSearch } from "./web-search.js";
 export type { WebSearchOutput, WebSearchResult } from "./web-search.js";
 export { alpacaQuote } from "./alpaca-quote.js";

package/dist/skills/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC"}

package/dist/skills/index.js

@@ -12,7 +12,10 @@
  *
  * @public
  */
-export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, } from "./errors.js";
+export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, SkillMdParseError, SkillMdValidationError, } from "./errors.js";
+// SKILL.md loader (agentskills.io standard) — ADR-ECO-034
+export { loadSkillMd, parseSkillMd, toDiscoveryEntry, } from "./markdown/loader.js";
+export { SkillManifestSchema, resolveTier, parseAllowedTools, } from "./markdown/schema.js";
 export { webSearch } from "./web-search.js";
 export { alpacaQuote } from "./alpaca-quote.js";
 export { brainStore } from "./brain-store.js";