@vegastack/skills 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VegaStack
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,46 @@
+# @vegastack/skills
+
+Installer for VegaStack Agent Skills. Installs the **vegastack-arch-guardian** skill — an architecture advisor with stable normative rules and deterministic checks — into Claude Code (`.claude/skills`) and Codex (`.agents/skills`).
+
+```sh
+npx @vegastack/skills add vegastack-arch-guardian
+```
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `add <skill>` | Install (or upgrade) the skill into the selected agent directories |
+| `verify <skill>` | Check an installed copy against the bundled checksum manifest |
+| `doctor` | Diagnose an install: integrity, profile presence, installed-vs-latest version |
+| `remove <skill>` | Uninstall the skill from the selected agent directories |
+
+## Flags
+
+| Flag | Meaning |
+|---|---|
+| `--project` / `--global` | Install into the current project (default) or the user's home directory |
+| `--agent codex\|claude\|both` | Target agent runtime(s) |
+| `--dir PATH` | Operate on a different project directory |
+| `--dry-run` | Show what would change without writing |
+| `--force` | Overwrite a modified installed copy |
+| `--non-interactive` | Skip prompts and use defaults: `--agent both`, project-local (for automation) |
+
+## Integrity model
+
+The package ships a checksum manifest that is verified at install and by `verify` — it proves the installed bytes match what was packed, not who published it. Publisher identity is attested separately by npm provenance, generated by the trusted-publishing release pipeline. Verify it with `npm audit signatures` or on the package's npm page.
+
+## Network and telemetry
+
+Zero telemetry. The only network call in the tool is `doctor`'s single version check against registry.npmjs.org (installed-vs-latest); `add`, `verify`, and `remove` are fully offline.
+
+## Requirements
+
+- Node >= 20.11
+- macOS or Linux. Windows is not yet supported (path handling; tracked in the repo issues).
+
+## Docs
+
+Skill content, freshness model, and policies: [github.com/vegastack/vegastack-skills](https://github.com/vegastack/vegastack-skills)
+
+MIT license.

package/dist/index.js

@@ -0,0 +1,512 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createHash, randomUUID } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import { access, cp, lstat, mkdir, open, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline/promises";
+import { spawnSync } from "node:child_process";
+var packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+var skillName = "vegastack-arch-guardian";
+var surfaces = { codex: ".agents/skills", claude: ".claude/skills" };
+var packageVersion = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8")).version;
+function usage() {
+  return `Usage: vegastack-skills <add|verify|doctor|remove> [vegastack-arch-guardian] [options]
+
+Options:
+  --agent codex|claude|both
+  --project | --global
+  --dir PATH
+  --dry-run
+  --force
+  --non-interactive
+  --version
+`;
+}
+function parse(argv) {
+  const command = argv[0] && !argv[0].startsWith("-") ? argv.shift() : "help";
+  const options = { command, skill: skillName, dryRun: false, force: false, nonInteractive: false };
+  if (argv[0] && !argv[0].startsWith("-"))
+    options.skill = argv.shift();
+  while (argv.length) {
+    const flag = argv.shift();
+    if (flag === "--agent")
+      options.agent = argv.shift();
+    else if (flag === "--project")
+      options.mode = "project";
+    else if (flag === "--global")
+      options.mode = "global";
+    else if (flag === "--dir")
+      options.dir = argv.shift();
+    else if (flag === "--dry-run")
+      options.dryRun = true;
+    else if (flag === "--force")
+      options.force = true;
+    else if (flag === "--non-interactive" || flag === "--yes")
+      options.nonInteractive = true;
+    else if (flag === "--help" || flag === "-h")
+      options.command = "help";
+    else if (flag === "--version" || flag === "-v")
+      options.command = "version";
+    else
+      throw new Error(`Unknown option: ${flag}`);
+  }
+  if (!["add", "verify", "doctor", "remove", "version", "help"].includes(options.command))
+    throw new Error(`Unknown command: ${options.command}`);
+  if (options.skill !== skillName)
+    throw new Error(`Unknown skill: ${options.skill}`);
+  if (options.agent && !["codex", "claude", "both"].includes(options.agent))
+    throw new Error(`Invalid --agent: ${options.agent}`);
+  if (options.mode === "global" && options.dir)
+    throw new Error("--dir cannot be combined with --global");
+  return options;
+}
+async function prompt(options) {
+  if (options.agent && options.mode)
+    return { agent: options.agent, mode: options.mode };
+  if (options.nonInteractive || !process.stdin.isTTY) {
+    return { agent: options.agent ?? "both", mode: options.mode ?? "project" };
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const agentAnswer = options.agent ?? await rl.question("Install for codex, claude, or both? [both] ");
+  const modeAnswer = options.mode ?? await rl.question("Install project-local or user-global? [project] ");
+  rl.close();
+  const agent = agentAnswer || "both";
+  const mode = modeAnswer === "global" ? "global" : "project";
+  if (!["codex", "claude", "both"].includes(agent))
+    throw new Error(`Invalid agent choice: ${agent}`);
+  return { agent, mode };
+}
+async function exists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function assertNoSymlink(path, allowMissingTail = true) {
+  const absolute = resolve(path);
+  const parsedRoot = resolve(absolute, sep);
+  const parts = relative(parsedRoot, absolute).split(sep).filter(Boolean);
+  let current = parsedRoot;
+  for (const part of parts) {
+    current = join(current, part);
+    try {
+      const info = await lstat(current);
+      if (info.isSymbolicLink())
+        throw new Error(`Refusing symlink path component: ${current}`);
+    } catch (error) {
+      if (allowMissingTail && error.code === "ENOENT")
+        return;
+      throw error;
+    }
+  }
+}
+async function syncDirectory(path) {
+  const handle = await open(path, "r");
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+async function durableJson(path, value) {
+  await assertNoSymlink(dirname(path));
+  await mkdir(dirname(path), { recursive: true });
+  await assertNoSymlink(dirname(path), false);
+  if (await exists(path))
+    await assertNoSymlink(path, false);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  const handle = await open(temporary, "wx");
+  try {
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}
+`);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename(temporary, path);
+  await syncDirectory(dirname(path));
+}
+async function recoverInstall(base) {
+  const journalPath = join(base, ".vegastack", ".skills-install-transaction.json");
+  if (!await exists(journalPath))
+    return;
+  await assertNoSymlink(journalPath, false);
+  const journal = JSON.parse(await readFile(journalPath, "utf8"));
+  if (journal.schemaVersion !== 1 || !["prepared", "committed"].includes(journal.status) || !Array.isArray(journal.operations))
+    throw new Error(`Invalid installer recovery journal: ${journalPath}`);
+  const seenAgents = new Set;
+  for (const operation of journal.operations) {
+    if (!["codex", "claude"].includes(operation.agent) || seenAgents.has(operation.agent))
+      throw new Error(`Untrusted installer recovery journal: invalid agent`);
+    seenAgents.add(operation.agent);
+    const expectedDestination = join(base, surfaces[operation.agent], skillName);
+    if (resolve(operation.destination) !== expectedDestination || typeof operation.existed !== "boolean")
+      throw new Error(`Untrusted installer recovery journal: destination outside installer roots`);
+    const expectedParent = dirname(expectedDestination);
+    const validateTemporary = (path, kind) => {
+      if (!path)
+        return kind === "backup" && !operation.existed;
+      return dirname(resolve(path)) === expectedParent && basename(path).startsWith(`.${skillName}.${kind}-`);
+    };
+    if (!validateTemporary(operation.stage, "stage") || !validateTemporary(operation.backup, "backup"))
+      throw new Error(`Untrusted installer recovery journal: invalid transaction path`);
+  }
+  for (const operation of [...journal.operations].reverse()) {
+    for (const path of [operation.destination, operation.stage, operation.backup].filter(Boolean))
+      await assertNoSymlink(path);
+    if (journal.status === "prepared") {
+      if (operation.backup && await exists(operation.backup)) {
+        if (await exists(operation.destination))
+          await rm(operation.destination, { recursive: true, force: true });
+        await rename(operation.backup, operation.destination);
+      } else if (!operation.existed && await exists(operation.destination))
+        await rm(operation.destination, { recursive: true, force: true });
+    } else if (operation.backup && await exists(operation.backup))
+      await rm(operation.backup, { recursive: true, force: true });
+    if (await exists(operation.stage))
+      await rm(operation.stage, { recursive: true, force: true });
+  }
+  await rm(journalPath, { force: true });
+  await syncDirectory(dirname(journalPath));
+}
+async function withInstallLock(base, callback) {
+  const directory = join(base, ".vegastack");
+  const lockPath = join(directory, ".skills-install.lock");
+  await assertNoSymlink(directory);
+  await mkdir(directory, { recursive: true });
+  await assertNoSymlink(directory, false);
+  let handle;
+  try {
+    handle = await open(lockPath, "wx");
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    await assertNoSymlink(lockPath, false);
+    let active = true;
+    try {
+      const owner = JSON.parse(await readFile(lockPath, "utf8"));
+      if (!Number.isInteger(owner.pid) || owner.pid <= 0)
+        active = false;
+      else
+        try {
+          process.kill(owner.pid, 0);
+        } catch {
+          active = false;
+        }
+    } catch {
+      active = false;
+    }
+    if (active)
+      throw new Error(`Another VegaStack skill installation is active: ${lockPath}`);
+    await rm(lockPath, { force: true });
+    return withInstallLock(base, callback);
+  }
+  try {
+    await handle.writeFile(`${JSON.stringify({ schemaVersion: 1, pid: process.pid, startedAt: new Date().toISOString() })}
+`);
+    await handle.sync();
+    return await callback();
+  } finally {
+    await handle.close();
+    await rm(lockPath, { force: true });
+    await syncDirectory(directory);
+  }
+}
+async function listFiles(root) {
+  const output = [];
+  async function walk(directory) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      const path = join(directory, entry.name);
+      if (entry.isSymbolicLink())
+        throw new Error(`Refusing symlink in skill tree: ${path}`);
+      if (entry.isDirectory())
+        await walk(path);
+      else if (entry.isFile())
+        output.push(path);
+    }
+  }
+  await walk(root);
+  return output.sort();
+}
+var hash = (body) => createHash("sha256").update(body).digest("hex");
+async function loadSource() {
+  const source = join(packageRoot, "skill", skillName);
+  const integrityPath = join(packageRoot, "skill-integrity.json");
+  const manifest = JSON.parse(await readFile(integrityPath, "utf8"));
+  if (manifest.schemaVersion !== 1 || manifest.skill !== skillName)
+    throw new Error("Invalid bundled skill manifest");
+  const skill = await readFile(join(source, "SKILL.md"), "utf8");
+  if (!skill.startsWith(`---
+`) || !/^name: vegastack-arch-guardian$/m.test(skill) || !/^description: .+/m.test(skill)) {
+    throw new Error("Bundled skill fails Agent Skills frontmatter validation");
+  }
+  const observed = {};
+  for (const file of await listFiles(source))
+    observed[relative(source, file).split(sep).join("/")] = hash(await readFile(file));
+  if (JSON.stringify(observed) !== JSON.stringify(manifest.files))
+    throw new Error("Bundled skill checksum mismatch");
+  return { source, manifest };
+}
+function destinations(agent, mode, directory) {
+  const agents = agent === "both" ? ["codex", "claude"] : [agent];
+  const base = mode === "global" ? homedir() : resolve(directory ?? process.cwd());
+  return agents.map((item) => ({ agent: item, destination: join(base, surfaces[item], skillName) }));
+}
+async function compare(destination, manifest) {
+  if (!await exists(destination))
+    return { status: "missing", issues: ["not installed"] };
+  await assertNoSymlink(destination, false);
+  const issues = [];
+  const actualFiles = await listFiles(destination);
+  const actualKeys = new Set(actualFiles.map((file) => relative(destination, file).split(sep).join("/")).filter((key) => key !== ".vegastack-install.json"));
+  for (const [key, expected] of Object.entries(manifest.files)) {
+    if (!actualKeys.has(key))
+      issues.push(`missing ${key}`);
+    else if (hash(await readFile(join(destination, key))) !== expected)
+      issues.push(`changed ${key}`);
+  }
+  for (const key of actualKeys)
+    if (!(key in manifest.files))
+      issues.push(`unexpected ${key}`);
+  return { status: issues.length ? "drifted" : "verified", issues };
+}
+async function install(options) {
+  const choice = await prompt(options);
+  const base = choice.mode === "global" ? homedir() : resolve(options.dir ?? process.cwd());
+  if (!options.dryRun)
+    return withInstallLock(base, () => installLocked(options, choice, base));
+  return installLocked(options, choice, base, false);
+}
+async function installLocked(options, choice, base, recover = true) {
+  if (recover)
+    await recoverInstall(base);
+  const { source, manifest } = await loadSource();
+  const targets = destinations(choice.agent, choice.mode, options.dir);
+  const operations = [];
+  for (const target of targets) {
+    await assertNoSymlink(target.destination);
+    const parent = dirname(target.destination);
+    await assertNoSymlink(parent);
+    const existed = await exists(target.destination);
+    if (existed) {
+      const comparison = await compare(target.destination, manifest);
+      if (comparison.status === "verified" && !options.force) {
+        console.log(`unchanged ${target.agent}: ${target.destination}`);
+        continue;
+      }
+      if (!options.force)
+        throw new Error(`Refusing differing installation without --force: ${target.destination}`);
+    }
+    const suffix = randomUUID();
+    operations.push({ ...target, existed, stage: join(parent, `.${skillName}.stage-${suffix}`), backup: existed ? join(parent, `.${skillName}.backup-${suffix}`) : undefined });
+  }
+  if (options.dryRun) {
+    for (const operation of operations)
+      console.log(`would install ${operation.agent}: ${operation.destination}`);
+    return;
+  }
+  if (!operations.length)
+    return;
+  const journalPath = join(base, ".vegastack", ".skills-install-transaction.json");
+  const staged = [];
+  const applied = [];
+  try {
+    for (const operation of operations) {
+      await mkdir(dirname(operation.destination), { recursive: true });
+      await assertNoSymlink(dirname(operation.destination), false);
+      await cp(source, operation.stage, { recursive: true, dereference: false, errorOnExist: true });
+      await writeFile(join(operation.stage, ".vegastack-install.json"), `${JSON.stringify({ installer: "@vegastack/skills", version: packageVersion, manifest }, null, 2)}
+`, { flag: "wx" });
+      const stagedCheck = await compare(operation.stage, manifest);
+      if (stagedCheck.status !== "verified")
+        throw new Error(`Staged copy failed verification: ${stagedCheck.issues.join(", ")}`);
+      staged.push(operation);
+    }
+    await durableJson(journalPath, { schemaVersion: 1, status: "prepared", operations });
+    for (const operation of operations) {
+      await assertNoSymlink(dirname(operation.destination), false);
+      if (await exists(operation.destination))
+        await assertNoSymlink(operation.destination, false);
+      if (operation.existed && operation.backup)
+        await rename(operation.destination, operation.backup);
+      try {
+        await rename(operation.stage, operation.destination);
+      } catch (error) {
+        if (operation.existed && operation.backup && await exists(operation.backup))
+          await rename(operation.backup, operation.destination);
+        throw error;
+      }
+      applied.push(operation);
+    }
+    await durableJson(journalPath, { schemaVersion: 1, status: "committed", operations });
+  } catch (error) {
+    if (await exists(journalPath))
+      await recoverInstall(base);
+    else
+      for (const operation of [...applied].reverse()) {
+        await rm(operation.destination, { recursive: true, force: true });
+        if (operation.backup && await exists(operation.backup))
+          await rename(operation.backup, operation.destination);
+      }
+    for (const operation of staged)
+      await rm(operation.stage, { recursive: true, force: true });
+    throw error;
+  }
+  for (const operation of applied)
+    if (operation.backup) {
+      try {
+        await rm(operation.backup, { recursive: true, force: true });
+      } catch (error) {
+        console.warn(`warning: installed successfully but could not remove backup ${operation.backup}: ${error.message}`);
+      }
+    }
+  await rm(journalPath, { force: true });
+  await syncDirectory(dirname(journalPath));
+  for (const operation of applied)
+    console.log(`installed ${operation.agent}: ${operation.destination}`);
+}
+async function verify(options) {
+  const choice = await prompt(options);
+  const { manifest } = await loadSource();
+  let failed = false;
+  for (const target of destinations(choice.agent, choice.mode, options.dir)) {
+    const result = await compare(target.destination, manifest);
+    console.log(`${result.status} ${target.agent}: ${target.destination}${result.issues.length ? ` (${result.issues.join(", ")})` : ""}`);
+    if (result.status !== "verified")
+      failed = true;
+  }
+  if (failed)
+    process.exitCode = 1;
+}
+async function latestPublishedVersion() {
+  try {
+    const response = await fetch("https://registry.npmjs.org/@vegastack%2fskills/latest", { signal: AbortSignal.timeout(3000) });
+    if (!response.ok)
+      return null;
+    const version = (await response.json()).version;
+    return typeof version === "string" && /^\d+\.\d+\.\d+/.test(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function removeSkill(options) {
+  const choice = await prompt(options);
+  let removed = 0;
+  for (const target of destinations(choice.agent, choice.mode, options.dir)) {
+    if (!await exists(target.destination)) {
+      console.log(`not installed ${target.agent}: ${target.destination}`);
+      continue;
+    }
+    await assertNoSymlink(target.destination, false);
+    if (!options.force) {
+      const { manifest } = await loadSource();
+      const comparison = await compare(target.destination, manifest);
+      if (comparison.status === "drifted")
+        throw new Error(`Installation differs from the bundled skill (possibly locally modified); re-run with --force to remove anyway: ${target.destination}`);
+    }
+    if (options.dryRun) {
+      console.log(`would remove ${target.agent}: ${target.destination}`);
+      continue;
+    }
+    await rm(target.destination, { recursive: true, force: true });
+    removed += 1;
+    console.log(`removed ${target.agent}: ${target.destination}`);
+  }
+  if (!removed && !options.dryRun)
+    process.exitCode = 1;
+}
+async function doctor(options) {
+  const base = options.mode === "global" ? homedir() : resolve(options.dir ?? process.cwd());
+  await access(base, fsConstants.R_OK | fsConstants.W_OK);
+  await assertNoSymlink(base, false);
+  let failed = false;
+  const profileCandidates = [join(base, ".vegastack", "architecture.json"), join(base, ".vegastack", "architecture.yaml")];
+  if (options.mode !== "global") {
+    let profile = null;
+    for (const candidate of profileCandidates)
+      if (await exists(candidate)) {
+        profile = candidate;
+        break;
+      }
+    if (profile) {
+      if (profile.endsWith(".yaml"))
+        console.log(`notice: ${profile} uses the legacy .yaml name for a JSON document; rename to architecture.json`);
+      try {
+        const parsed = JSON.parse(await readFile(profile, "utf8"));
+        if (parsed.schemaVersion !== 3 || parsed.profileStatus !== "confirmed" || !parsed.project?.name || !parsed.environments?.production)
+          throw new Error("required identity fields are absent or profile is not confirmed schema v3");
+        console.log(`ok architecture profile: ${profile}`);
+      } catch (error) {
+        console.log(`invalid architecture profile: ${profile} (${error.message})`);
+        failed = true;
+      }
+    } else {
+      console.log(`missing architecture profile: ${profileCandidates[0]}`);
+      failed = true;
+    }
+  }
+  console.log(`ok runtime: Node ${process.versions.node}`);
+  const latest = await latestPublishedVersion();
+  if (latest && latest !== packageVersion)
+    console.log(`update available: installed ${packageVersion}, latest ${latest} — run: npx @vegastack/skills@latest add ${skillName} --force`);
+  else if (latest)
+    console.log(`ok installer version: ${packageVersion} (latest)`);
+  else
+    console.log(`skipped installer version check (npmjs.org unreachable); installed ${packageVersion}`);
+  const { manifest } = await loadSource();
+  let installations = 0;
+  let checkScript = "";
+  for (const agent of ["codex", "claude"]) {
+    const destination = join(base, surfaces[agent], skillName);
+    if (!await exists(destination)) {
+      console.log(`missing ${agent} guardian installation`);
+      continue;
+    }
+    installations += 1;
+    const result = await compare(destination, manifest);
+    console.log(`${result.status === "verified" ? "ok" : "invalid"} ${agent} guardian installation${result.issues.length ? ` (${result.issues.join(", ")})` : ""}`);
+    if (result.status !== "verified")
+      failed = true;
+    if (!checkScript)
+      checkScript = join(destination, "scripts", "architecture-check.mjs");
+  }
+  if (!installations)
+    failed = true;
+  if (options.mode !== "global" && checkScript && !failed) {
+    const result = spawnSync(process.execPath, [checkScript, base, "--json"], { encoding: "utf8" });
+    if (result.status === 0)
+      console.log("ok architecture invariants");
+    else {
+      console.log(`invalid architecture invariants: ${result.stdout.trim() || result.stderr.trim()}`);
+      failed = true;
+    }
+  }
+  if (failed)
+    process.exitCode = 1;
+}
+async function main() {
+  const options = parse(process.argv.slice(2));
+  if (options.command === "help")
+    return console.log(usage());
+  if (options.command === "version")
+    return console.log(packageVersion);
+  if (options.command === "add")
+    return install(options);
+  if (options.command === "verify")
+    return verify(options);
+  if (options.command === "remove")
+    return removeSkill(options);
+  return doctor(options);
+}
+main().catch((error) => {
+  console.error(`error: ${error.message}`);
+  process.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@vegastack/skills",
+  "version": "0.1.0",
+  "description": "Installer and verifier for VegaStack Agent Skills (Claude Code and Codex)",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vegastack/vegastack-skills.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/vegastack/vegastack-skills#readme",
+  "bugs": "https://github.com/vegastack/vegastack-skills/issues",
+  "author": "VegaStack",
+  "keywords": [
+    "agent-skills",
+    "claude-code",
+    "codex",
+    "skill",
+    "architecture",
+    "vegastack"
+  ],
+  "bin": { "vegastack-skills": "dist/index.js" },
+  "files": ["dist", "skill", "skill-integrity.json", "README.md", "LICENSE"],
+  "engines": { "node": ">=20.11" },
+  "scripts": {
+    "sync": "bun scripts/sync-skill.mjs",
+    "build": "bun run sync && bun build src/index.ts --target=node --outfile dist/index.js && chmod +x dist/index.js",
+    "lint": "bun scripts/lint.mjs",
+    "typecheck": "bunx tsc -p tsconfig.json --noEmit",
+    "test": "bun test test",
+    "prepack": "bun run build",
+    "pack:local": "mkdir -p ../../work/packed && npm pack --pack-destination ../../work/packed"
+  }
+}