@vibe-agent-toolkit/agent-skills 0.1.31 → 0.1.32-rc.1

package/README.md

@@ -156,9 +156,12 @@ The validator checks for:
 #### Warnings (Non-Blocking)
 
 - `SKILL_TOO_LONG` - Skill exceeds 5000 lines
-- `COMPAT_REQUIRES_LOCAL_SHELL` - References Write, Edit, Bash, or NotebookEdit tools (see [validation-codes.md](../../docs/validation-codes.md#compat_requires_local_shell))
-- `COMPAT_REQUIRES_BROWSER_AUTH` - Requires a browser login flow (MSAL, cloud SSO, OAuth redirect) (see [validation-codes.md](../../docs/validation-codes.md#compat_requires_browser_auth))
-- `COMPAT_REQUIRES_EXTERNAL_CLI` - Invokes an unbundled external CLI (az, aws, gcloud, kubectl, docker, terraform, gh, op) (see [validation-codes.md](../../docs/validation-codes.md#compat_requires_external_cli))
+- `CAPABILITY_LOCAL_SHELL` - References Write, Edit, Bash, or NotebookEdit tools (info; see [validation-codes.md](../../docs/validation-codes.md#capability_local_shell))
+- `CAPABILITY_BROWSER_AUTH` - Requires a browser login flow (MSAL, cloud SSO, OAuth redirect) (info; see [validation-codes.md](../../docs/validation-codes.md#capability_browser_auth))
+- `CAPABILITY_EXTERNAL_CLI` - Invokes an unbundled external CLI (az, aws, gcloud, kubectl, docker, terraform, gh, op) (info; see [validation-codes.md](../../docs/validation-codes.md#capability_external_cli))
+- `COMPAT_TARGET_INCOMPATIBLE` - Declared target runtime lacks a required capability (warning; see [validation-codes.md](../../docs/validation-codes.md#compat_target_incompatible))
+- `COMPAT_TARGET_NEEDS_REVIEW` - Declared target covers the capability but a specific resource is uncertain (warning; see [validation-codes.md](../../docs/validation-codes.md#compat_target_needs_review))
+- `COMPAT_TARGET_UNDECLARED` - Capability observations present but no target declared (info; see [validation-codes.md](../../docs/validation-codes.md#compat_target_undeclared))
 
 See [Best Practices Guide](../../docs/guides/agent-skills-best-practices.md) for detailed guidance.
 

package/dist/evidence/derive-observations.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared capability-observation derivation.
+ *
+ * Rolls `EvidenceRecord`s up into `CAPABILITY_*` observations. Callers
+ * supply the local-shell pattern-ID set (which differs per subject — skills
+ * check fewer patterns than full plugins) and a subject label for summary
+ * wording.
+ */
+import type { EvidenceRecord, Observation } from './types.js';
+/** Subject of derivation — controls observation summary wording. */
+export type DerivationSubject = 'skill' | 'plugin';
+export interface DeriveObservationsOptions {
+    /** Pattern IDs that imply CAPABILITY_LOCAL_SHELL for this subject. */
+    localShellPatternIds: ReadonlySet<string>;
+    /** Subject label used in observation summaries. */
+    subject: DerivationSubject;
+}
+/** External-CLI pattern IDs paired with their binary name. */
+export declare const EXTERNAL_CLI_BINARIES: ReadonlyArray<{
+    binary: string;
+    patternId: string;
+}>;
+export declare function deriveObservationsFromEvidence(evidence: readonly EvidenceRecord[], options: DeriveObservationsOptions): Observation[];
+//# sourceMappingURL=derive-observations.d.ts.map

package/dist/evidence/derive-observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-observations.d.ts","sourceRoot":"","sources":["../../src/evidence/derive-observations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9D,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,mDAAmD;IACnD,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,8DAA8D;AAC9D,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAStF,CAAC;AAsBF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,OAAO,EAAE,yBAAyB,GACjC,WAAW,EAAE,CA8Cf"}

package/dist/evidence/derive-observations.js

@@ -0,0 +1,85 @@
+/**
+ * Shared capability-observation derivation.
+ *
+ * Rolls `EvidenceRecord`s up into `CAPABILITY_*` observations. Callers
+ * supply the local-shell pattern-ID set (which differs per subject — skills
+ * check fewer patterns than full plugins) and a subject label for summary
+ * wording.
+ */
+/** External-CLI pattern IDs paired with their binary name. */
+export const EXTERNAL_CLI_BINARIES = [
+    { binary: 'az', patternId: 'EXTERNAL_CLI_AZ' },
+    { binary: 'aws', patternId: 'EXTERNAL_CLI_AWS' },
+    { binary: 'gcloud', patternId: 'EXTERNAL_CLI_GCLOUD' },
+    { binary: 'kubectl', patternId: 'EXTERNAL_CLI_KUBECTL' },
+    { binary: 'docker', patternId: 'EXTERNAL_CLI_DOCKER' },
+    { binary: 'terraform', patternId: 'EXTERNAL_CLI_TERRAFORM' },
+    { binary: 'gh', patternId: 'EXTERNAL_CLI_GH' },
+    { binary: 'op', patternId: 'EXTERNAL_CLI_OP' },
+];
+const BROWSER_AUTH_PATTERN_IDS = new Set([
+    'BROWSER_AUTH_MSAL_PYTHON_IMPORT',
+    'BROWSER_AUTH_MSAL_JS_IMPORT',
+    'BROWSER_AUTH_AZ_LOGIN',
+    'BROWSER_AUTH_GCLOUD_LOGIN',
+    'BROWSER_AUTH_AWS_SSO_LOGIN',
+    'BROWSER_AUTH_WEBBROWSER_OPEN',
+]);
+function dedupePatternIds(records) {
+    const seen = new Set();
+    const out = [];
+    for (const r of records) {
+        if (seen.has(r.patternId))
+            continue;
+        seen.add(r.patternId);
+        out.push(r.patternId);
+    }
+    return out;
+}
+export function deriveObservationsFromEvidence(evidence, options) {
+    const subjectCap = options.subject === 'skill' ? 'Skill' : 'Plugin';
+    const out = [];
+    const localShell = evidence.filter(e => options.localShellPatternIds.has(e.patternId));
+    if (localShell.length > 0) {
+        out.push({
+            code: 'CAPABILITY_LOCAL_SHELL',
+            summary: `${subjectCap} requires a local shell environment.`,
+            supportingEvidence: dedupePatternIds(localShell),
+        });
+    }
+    const cliByBinary = new Map();
+    for (const e of evidence) {
+        const match = EXTERNAL_CLI_BINARIES.find(b => b.patternId === e.patternId);
+        if (!match)
+            continue;
+        const existing = cliByBinary.get(match.binary);
+        if (existing) {
+            existing.push(e);
+        }
+        else {
+            cliByBinary.set(match.binary, [e]);
+        }
+    }
+    const sortedBinaries = [...cliByBinary.keys()].sort((a, b) => a.localeCompare(b));
+    for (const binary of sortedBinaries) {
+        const records = cliByBinary.get(binary);
+        if (!records)
+            continue;
+        out.push({
+            code: 'CAPABILITY_EXTERNAL_CLI',
+            summary: `${subjectCap} invokes external CLI: ${binary}.`,
+            payload: { binary },
+            supportingEvidence: dedupePatternIds(records),
+        });
+    }
+    const browserAuth = evidence.filter(e => BROWSER_AUTH_PATTERN_IDS.has(e.patternId));
+    if (browserAuth.length > 0) {
+        out.push({
+            code: 'CAPABILITY_BROWSER_AUTH',
+            summary: `${subjectCap} requires an interactive browser authentication flow.`,
+            supportingEvidence: dedupePatternIds(browserAuth),
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=derive-observations.js.map

package/dist/evidence/derive-observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-observations.js","sourceRoot":"","sources":["../../src/evidence/derive-observations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAyD;IACzF,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9C,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE;IAChD,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE;IACtD,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE;IACxD,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE;IACtD,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,EAAE;IAC5D,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE;IAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE;CAC/C,CAAC;AAEF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,iCAAiC;IACjC,6BAA6B;IAC7B,uBAAuB;IACvB,2BAA2B;IAC3B,4BAA4B;IAC5B,8BAA8B;CAC/B,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAkC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAmC,EACnC,OAAkC;IAElC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,GAAG,UAAU,sCAAsC;YAC5D,kBAAkB,EAAE,gBAAgB,CAAC,UAAU,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,GAAG,UAAU,0BAA0B,MAAM,GAAG;YACzD,OAAO,EAAE,EAAE,MAAM,EAAE;YACnB,kBAAkB,EAAE,gBAAgB,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,GAAG,UAAU,uDAAuD;YAC7E,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/evidence/index.d.ts

@@ -0,0 +1,4 @@
+export type { EvidenceRecord, EvidenceSource, EvidenceConfidence, EvidenceLocation, PatternDefinition, Observation, } from './types.js';
+export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, } from './pattern-registry.js';
+export { deriveObservationsFromEvidence, EXTERNAL_CLI_BINARIES, type DeriveObservationsOptions, type DerivationSubject, } from './derive-observations.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/evidence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC"}

package/dist/evidence/index.js

@@ -0,0 +1,3 @@
+export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, } from './pattern-registry.js';
+export { deriveObservationsFromEvidence, EXTERNAL_CLI_BINARIES, } from './derive-observations.js';
+//# sourceMappingURL=index.js.map

package/dist/evidence/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,0BAA0B,CAAC"}

package/dist/evidence/pattern-registry.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Pattern registry — the authoritative list of things VAT's detectors look for.
+ *
+ * Every pattern a detector fires references an entry here by stable ID.
+ * Naming convention: describe what the pattern matches (the observable
+ * phenomenon), not what observation it might support.
+ */
+import type { PatternDefinition } from './types.js';
+export declare const PATTERN_REGISTRY: Record<string, PatternDefinition>;
+export declare function getPatternDefinition(patternId: string): PatternDefinition | undefined;
+export declare function assertPatternRegistered(patternId: string): void;
+//# sourceMappingURL=pattern-registry.d.ts.map

package/dist/evidence/pattern-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-registry.d.ts","sourceRoot":"","sources":["../../src/evidence/pattern-registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAsK9D,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAErF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI/D"}

package/dist/evidence/pattern-registry.js

@@ -0,0 +1,176 @@
+/**
+ * Pattern registry — the authoritative list of things VAT's detectors look for.
+ *
+ * Every pattern a detector fires references an entry here by stable ID.
+ * Naming convention: describe what the pattern matches (the observable
+ * phenomenon), not what observation it might support.
+ */
+export const PATTERN_REGISTRY = {
+    // Shell-presence patterns
+    FENCED_SHELL_BLOCK: {
+        patternId: 'FENCED_SHELL_BLOCK',
+        source: 'code',
+        description: 'Fenced code block with language bash/sh/shell/zsh.',
+        confidence: 'high',
+    },
+    ALLOWED_TOOLS_LOCAL_SHELL: {
+        patternId: 'ALLOWED_TOOLS_LOCAL_SHELL',
+        source: 'code',
+        description: 'Frontmatter allowed-tools list includes Bash/Edit/Write/NotebookEdit.',
+        confidence: 'high',
+    },
+    PROSE_LOCAL_SHELL_TOOL_REFERENCE: {
+        patternId: 'PROSE_LOCAL_SHELL_TOOL_REFERENCE',
+        source: 'code',
+        description: 'Prose mentions "Bash/Edit/Write/NotebookEdit tool" by name.',
+        confidence: 'medium',
+    },
+    // External-CLI patterns
+    EXTERNAL_CLI_AZ: {
+        patternId: 'EXTERNAL_CLI_AZ',
+        source: 'code',
+        description: 'az CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_AWS: {
+        patternId: 'EXTERNAL_CLI_AWS',
+        source: 'code',
+        description: 'aws CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_GCLOUD: {
+        patternId: 'EXTERNAL_CLI_GCLOUD',
+        source: 'code',
+        description: 'gcloud CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_KUBECTL: {
+        patternId: 'EXTERNAL_CLI_KUBECTL',
+        source: 'code',
+        description: 'kubectl CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_DOCKER: {
+        patternId: 'EXTERNAL_CLI_DOCKER',
+        source: 'code',
+        description: 'docker CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_TERRAFORM: {
+        patternId: 'EXTERNAL_CLI_TERRAFORM',
+        source: 'code',
+        description: 'terraform CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_GH: {
+        patternId: 'EXTERNAL_CLI_GH',
+        source: 'code',
+        description: 'gh CLI invocation in a shell block.',
+        confidence: 'high',
+    },
+    EXTERNAL_CLI_OP: {
+        patternId: 'EXTERNAL_CLI_OP',
+        source: 'code',
+        description: '1Password CLI (op) invocation in a shell block.',
+        confidence: 'high',
+    },
+    // Browser-auth patterns
+    BROWSER_AUTH_AZ_LOGIN: {
+        patternId: 'BROWSER_AUTH_AZ_LOGIN',
+        source: 'code',
+        description: '"az login" invocation in a shell context.',
+        confidence: 'high',
+    },
+    BROWSER_AUTH_GCLOUD_LOGIN: {
+        patternId: 'BROWSER_AUTH_GCLOUD_LOGIN',
+        source: 'code',
+        description: '"gcloud auth login" invocation in a shell context.',
+        confidence: 'high',
+    },
+    BROWSER_AUTH_AWS_SSO_LOGIN: {
+        patternId: 'BROWSER_AUTH_AWS_SSO_LOGIN',
+        source: 'code',
+        description: '"aws sso login" invocation in a shell context.',
+        confidence: 'high',
+    },
+    BROWSER_AUTH_MSAL_PYTHON_IMPORT: {
+        patternId: 'BROWSER_AUTH_MSAL_PYTHON_IMPORT',
+        source: 'code',
+        description: 'Python "from msal" import.',
+        confidence: 'medium',
+    },
+    BROWSER_AUTH_MSAL_JS_IMPORT: {
+        patternId: 'BROWSER_AUTH_MSAL_JS_IMPORT',
+        source: 'code',
+        description: '@azure/msal-* JS import.',
+        confidence: 'medium',
+    },
+    BROWSER_AUTH_WEBBROWSER_OPEN: {
+        patternId: 'BROWSER_AUTH_WEBBROWSER_OPEN',
+        source: 'code',
+        description: 'Python webbrowser.open(...) call.',
+        confidence: 'medium',
+    },
+    // Hook patterns
+    HOOK_COMMAND_INVOKES_BINARY: {
+        patternId: 'HOOK_COMMAND_INVOKES_BINARY',
+        source: 'code',
+        description: 'A hook handler executes a shell command.',
+        confidence: 'high',
+    },
+    // MCP server patterns
+    MCP_SERVER_COMMAND: {
+        patternId: 'MCP_SERVER_COMMAND',
+        source: 'code',
+        description: '.mcp.json declares a "command" for a stdio MCP server.',
+        confidence: 'high',
+    },
+    MCP_SERVER_URL: {
+        patternId: 'MCP_SERVER_URL',
+        source: 'code',
+        description: '.mcp.json declares a "url" for an HTTP MCP server.',
+        confidence: 'high',
+    },
+    // Script-file patterns
+    SCRIPT_FILE_PYTHON: {
+        patternId: 'SCRIPT_FILE_PYTHON',
+        source: 'code',
+        description: 'A .py script file is present in the plugin.',
+        confidence: 'high',
+    },
+    SCRIPT_FILE_SHELL: {
+        patternId: 'SCRIPT_FILE_SHELL',
+        source: 'code',
+        description: 'A .sh/.bash script file is present in the plugin.',
+        confidence: 'high',
+    },
+    SCRIPT_FILE_NODE: {
+        patternId: 'SCRIPT_FILE_NODE',
+        source: 'code',
+        description: 'A .mjs/.cjs/.js script file is present in the plugin.',
+        confidence: 'high',
+    },
+    // Python import pattern
+    PYTHON_IMPORT_THIRD_PARTY: {
+        patternId: 'PYTHON_IMPORT_THIRD_PARTY',
+        source: 'code',
+        description: 'Third-party (non-stdlib) Python import statement.',
+        confidence: 'high',
+    },
+    // Frontmatter allowed-tools entry pattern (broader than the local-shell-only variant)
+    FRONTMATTER_ALLOWED_TOOLS_ENTRY: {
+        patternId: 'FRONTMATTER_ALLOWED_TOOLS_ENTRY',
+        source: 'code',
+        description: 'Allowed-tools entry in skill frontmatter.',
+        confidence: 'high',
+    },
+};
+export function getPatternDefinition(patternId) {
+    return PATTERN_REGISTRY[patternId];
+}
+export function assertPatternRegistered(patternId) {
+    if (!(patternId in PATTERN_REGISTRY)) {
+        throw new Error(`Unregistered pattern ID: ${patternId}. Add it to PATTERN_REGISTRY.`);
+    }
+}
+//# sourceMappingURL=pattern-registry.js.map

package/dist/evidence/pattern-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-registry.js","sourceRoot":"","sources":["../../src/evidence/pattern-registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAsC;IACjE,0BAA0B;IAC1B,kBAAkB,EAAE;QAClB,SAAS,EAAE,oBAAoB;QAC/B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oDAAoD;QACjE,UAAU,EAAE,MAAM;KACnB;IACD,yBAAyB,EAAE;QACzB,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uEAAuE;QACpF,UAAU,EAAE,MAAM;KACnB;IACD,gCAAgC,EAAE;QAChC,SAAS,EAAE,kCAAkC;QAC7C,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,6DAA6D;QAC1E,UAAU,EAAE,QAAQ;KACrB;IAED,wBAAwB;IACxB,eAAe,EAAE;QACf,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,qCAAqC;QAClD,UAAU,EAAE,MAAM;KACnB;IACD,gBAAgB,EAAE;QAChB,SAAS,EAAE,kBAAkB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,sCAAsC;QACnD,UAAU,EAAE,MAAM;KACnB;IACD,mBAAmB,EAAE;QACnB,SAAS,EAAE,qBAAqB;QAChC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;QACtD,UAAU,EAAE,MAAM;KACnB;IACD,oBAAoB,EAAE;QACpB,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,0CAA0C;QACvD,UAAU,EAAE,MAAM;KACnB;IACD,mBAAmB,EAAE;QACnB,SAAS,EAAE,qBAAqB;QAChC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,yCAAyC;QACtD,UAAU,EAAE,MAAM;KACnB;IACD,sBAAsB,EAAE;QACtB,SAAS,EAAE,wBAAwB;QACnC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4CAA4C;QACzD,UAAU,EAAE,MAAM;KACnB;IACD,eAAe,EAAE;QACf,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,qCAAqC;QAClD,UAAU,EAAE,MAAM;KACnB;IACD,eAAe,EAAE;QACf,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,iDAAiD;QAC9D,UAAU,EAAE,MAAM;KACnB;IAED,wBAAwB;IACxB,qBAAqB,EAAE;QACrB,SAAS,EAAE,uBAAuB;QAClC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2CAA2C;QACxD,UAAU,EAAE,MAAM;KACnB;IACD,yBAAyB,EAAE;QACzB,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oDAAoD;QACjE,UAAU,EAAE,MAAM;KACnB;IACD,0BAA0B,EAAE;QAC1B,SAAS,EAAE,4BAA4B;QACvC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gDAAgD;QAC7D,UAAU,EAAE,MAAM;KACnB;IACD,+BAA+B,EAAE;QAC/B,SAAS,EAAE,iCAAiC;QAC5C,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4BAA4B;QACzC,UAAU,EAAE,QAAQ;KACrB;IACD,2BAA2B,EAAE;QAC3B,SAAS,EAAE,6BAA6B;QACxC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,QAAQ;KACrB;IACD,4BAA4B,EAAE;QAC5B,SAAS,EAAE,8BAA8B;QACzC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,mCAAmC;QAChD,UAAU,EAAE,QAAQ;KACrB;IAED,gBAAgB;IAChB,2BAA2B,EAAE;QAC3B,SAAS,EAAE,6BAA6B;QACxC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,0CAA0C;QACvD,UAAU,EAAE,MAAM;KACnB;IAED,sBAAsB;IACtB,kBAAkB,EAAE;QAClB,SAAS,EAAE,oBAAoB;QAC/B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wDAAwD;QACrE,UAAU,EAAE,MAAM;KACnB;IACD,cAAc,EAAE;QACd,SAAS,EAAE,gBAAgB;QAC3B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oDAAoD;QACjE,UAAU,EAAE,MAAM;KACnB;IAED,uBAAuB;IACvB,kBAAkB,EAAE;QAClB,SAAS,EAAE,oBAAoB;QAC/B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,MAAM;KACnB;IACD,iBAAiB,EAAE;QACjB,SAAS,EAAE,mBAAmB;QAC9B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,mDAAmD;QAChE,UAAU,EAAE,MAAM;KACnB;IACD,gBAAgB,EAAE;QAChB,SAAS,EAAE,kBAAkB;QAC7B,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,uDAAuD;QACpE,UAAU,EAAE,MAAM;KACnB;IAED,wBAAwB;IACxB,yBAAyB,EAAE;QACzB,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,mDAAmD;QAChE,UAAU,EAAE,MAAM;KACnB;IAED,sFAAsF;IACtF,+BAA+B,EAAE;QAC/B,SAAS,EAAE,iCAAiC;QAC5C,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2CAA2C;QACxD,UAAU,EAAE,MAAM;KACnB;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,IAAI,CAAC,CAAC,SAAS,IAAI,gBAAgB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,+BAA+B,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/evidence/types.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Evidence substrate types.
+ *
+ * Evidence is a neutral, pattern-level observation produced by a parser:
+ * "pattern X fired at location Y with match text Z." Evidence has no opinion
+ * about whether the match is good or bad — that is the job of the derivation
+ * layer, which rolls evidence into domain-specific observations.
+ */
+/** Where the evidence came from. */
+export type EvidenceSource = 'code' | 'ai';
+/** Inherent false-positive risk of the pattern. */
+export type EvidenceConfidence = 'high' | 'medium' | 'low';
+export interface EvidenceLocation {
+    file: string;
+    line?: number;
+    col?: number;
+}
+export interface EvidenceRecord {
+    source: EvidenceSource;
+    /** Stable ID registered in PATTERN_REGISTRY. */
+    patternId: string;
+    location: EvidenceLocation;
+    /** What the detector saw — short snippet, truncated for display. */
+    matchText: string;
+    confidence: EvidenceConfidence;
+    /** AI-source: short "why"; code-source: rarely used. */
+    rationale?: string;
+}
+export interface PatternDefinition {
+    patternId: string;
+    source: EvidenceSource;
+    /** Human-readable description of what the pattern detects. */
+    description: string;
+    confidence: EvidenceConfidence;
+}
+/**
+ * An observation is a derived capability-level claim about a skill or plugin,
+ * referencing the evidence records that support it.
+ */
+export interface Observation {
+    /** Validation code (e.g. 'CAPABILITY_LOCAL_SHELL'). */
+    code: string;
+    /** Human-readable claim. */
+    summary: string;
+    /** Payload specific to the observation code. */
+    payload?: Record<string, unknown>;
+    /** patternId[] of evidence records that support this observation. */
+    supportingEvidence: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/evidence/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,IAAI,CAAC;AAE3C,mDAAmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B"}

package/dist/evidence/types.js

@@ -0,0 +1,10 @@
+/**
+ * Evidence substrate types.
+ *
+ * Evidence is a neutral, pattern-level observation produced by a parser:
+ * "pattern X fired at location Y with match text Z." Evidence has no opinion
+ * about whether the match is good or bad — that is the job of the derivation
+ * layer, which rolls evidence into domain-specific observations.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/evidence/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/index.d.ts

@@ -12,7 +12,8 @@ export { ClaudePluginJsonSchema, ClaudePluginSchema, type ClaudePlugin } from '.
 export { MarketplaceManifestJsonSchema, MarketplaceManifestSchema, type MarketplaceManifest } from './schemas/marketplace-manifest.js';
 export { PluginJsonSchema, type PluginJson } from './schemas/plugin-json.js';
 export { parseFrontmatter, type FrontmatterResult, } from './parsers/frontmatter-parser.js';
-export { runCompatDetectors } from './validators/compat-detectors.js';
+export { observationToIssue, runCompatDetectors, type DetectorOutput, } from './validators/compat-detectors.js';
+export { CODE_REGISTRY, type CodeRegistryEntry } from './validators/code-registry.js';
 export { validateMarketplace } from './validators/marketplace-validator.js';
 export { validatePlugin } from './validators/plugin-validator.js';
 export { validateSkill } from './validators/skill-validator.js';
@@ -23,4 +24,7 @@ export { type ValidationConfig } from './validators/validation-framework.js';
 export { createIssue, NAVIGATION_FILE_PATTERNS, VALIDATION_RULES, VALIDATION_THRESHOLDS, type RuleCategory, type ValidationRule, type ValidationRuleCode, } from './validators/validation-rules.js';
 export type { ValidationResult, ValidationIssue, ValidateOptions, ResourceFormat, } from './validators/types.js';
 export { importSkillToAgent, type ImportOptions, type ImportResult, } from './import.js';
+export type { EvidenceRecord, EvidenceSource, EvidenceConfidence, EvidenceLocation, PatternDefinition, Observation, } from './evidence/index.js';
+export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, deriveObservationsFromEvidence, } from './evidence/index.js';
+export type { DeriveObservationsOptions, DerivationSubject } from './evidence/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE3G,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE3G,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,cAAc,GACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -12,7 +12,8 @@ export { ClaudePluginJsonSchema, ClaudePluginSchema } from './schemas/claude-plu
 export { MarketplaceManifestJsonSchema, MarketplaceManifestSchema } from './schemas/marketplace-manifest.js';
 export { PluginJsonSchema } from './schemas/plugin-json.js';
 export { parseFrontmatter, } from './parsers/frontmatter-parser.js';
-export { runCompatDetectors } from './validators/compat-detectors.js';
+export { observationToIssue, runCompatDetectors, } from './validators/compat-detectors.js';
+export { CODE_REGISTRY } from './validators/code-registry.js';
 export { validateMarketplace } from './validators/marketplace-validator.js';
 export { validatePlugin } from './validators/plugin-validator.js';
 export { validateSkill } from './validators/skill-validator.js';
@@ -21,4 +22,5 @@ export { detectResourceFormat } from './validators/format-detection.js';
 export { validateSkillForPackaging, } from './validators/packaging-validator.js';
 export { createIssue, NAVIGATION_FILE_PATTERNS, VALIDATION_RULES, VALIDATION_THRESHOLDS, } from './validators/validation-rules.js';
 export { importSkillToAgent, } from './import.js';
+export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, deriveObservationsFromEvidence, } from './evidence/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,GAMlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,GAMd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAG/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAqB,MAAM,4BAA4B,CAAC;AAE3G,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAA4B,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,GAEjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,yBAAyB,GAI1B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GAItB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,GAMlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,GAMd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAG/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAqB,MAAM,4BAA4B,CAAC;AAE3G,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAA4B,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,GAEjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,aAAa,EAA0B,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,yBAAyB,GAI1B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GAItB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC"}

package/dist/schemas/plugin-json.d.ts

@@ -21,16 +21,16 @@ export declare const PluginJsonSchema: z.ZodObject<{
     }>;
     version: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    name: string;
     description: string;
+    name: string;
     author: {
         name: string;
         email?: string | undefined;
     };
     version?: string | undefined;
 }, {
-    name: string;
     description: string;
+    name: string;
     author: {
         name: string;
         email?: string | undefined;

package/dist/skill-packager.d.ts

@@ -16,6 +16,7 @@
  */
 import { ResourceRegistry } from '@vibe-agent-toolkit/resources';
 import type { SkillFileEntry } from './files-config.js';
+import { type PackagingValidationResult } from './validators/packaging-validator.js';
 import type { ValidationIssue } from './validators/types.js';
 import { type ValidationConfig } from './validators/validation-framework.js';
 /**
@@ -159,6 +160,8 @@ export interface PackageSkillResult {
      * Empty (or omitted) means all post-build checks passed.
      */
     postBuildIssues?: ValidationIssue[] | undefined;
+    /** Full validation result against the built output. */
+    postBuildValidation?: PackagingValidationResult | undefined;
     /** True when any emitted issue has resolved severity 'error'. */
     hasErrors: boolean;
 }

package/dist/skill-packager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packager.d.ts","sourceRoot":"","sources":["../src/skill-packager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EACL,gBAAgB,EAMjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AASrG;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,CAAC;AAK3D,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1D;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAE9C,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAE7C,mEAAmE;IACnE,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC/B,CAAC,GAAG,SAAS,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACtC,GAAG,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IAEhD,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAe/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAiO7B;AA8fD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASlE;AA0HD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAUlD"}
+{"version":3,"file":"skill-packager.d.ts","sourceRoot":"","sources":["../src/skill-packager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EACL,gBAAgB,EAMjB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAA6B,KAAK,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAgD,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAS3H;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,CAAC;AAK3D,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1D;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAE9C,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAE7C,mEAAmE;IACnE,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC/B,CAAC,GAAG,SAAS,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACtC,GAAG,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IAEhD,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAE5D,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAe/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAsN7B;AAyjBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASlE;AA0HD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAUlD"}

package/dist/skill-packager.js

@@ -21,6 +21,7 @@ import { ResourceRegistry, transformContent, parseMarkdown, } from '@vibe-agent-
 import { findProjectRoot, toForwardSlash, safePath } from '@vibe-agent-toolkit/utils';
 import { getTargetSubdir } from './content-type-routing.js';
 import { checkBrokenPackagedLinks, checkUnreferencedFiles } from './post-build-checks.js';
+import { validateSkillForPackaging } from './validators/packaging-validator.js';
 import { runValidationFramework } from './validators/validation-framework.js';
 import { walkerExclusionsToIssues } from './validators/walker-to-issues.js';
 import { walkLinkGraph } from './walk-link-graph.js';
@@ -220,27 +221,53 @@ export async function packageSkill(skillPath, options = {}) {
     ];
     const rawLinkIssues = walkerExclusionsToIssues(excludedReferences, projectRoot);
     const framework = runValidationFramework([...rawLinkIssues, ...rawPostBuildIssues], options.validation ?? {});
+    // 13c. Run full validation suite on built output
+    const postBuildValidation = await runPostBuildValidation(outputPath, options.validation);
     // 14. Generate distribution artifacts
     const artifacts = await generatePackageArtifacts(outputPath, skillMetadata, formats, target);
     // Get relative paths for result
     const relativeLinkedFiles = bundledFiles.map(f => safePath.relative(effectiveBasePath, f));
-    // Build result — hasErrors is always set (non-optional)
-    const result = {
+    // Build result
+    return assemblePackageResult({
         outputPath,
-        skill: skillMetadata,
+        skillMetadata,
+        relativeLinkedFiles,
+        artifacts,
+        postBuildValidation,
+        framework,
+        excludedReferences,
+        skillRoot,
+    });
+}
+/**
+ * Run full validation suite against built output (context = 'built').
+ * Source-only codes are automatically filtered out by validateSkillForPackaging.
+ */
+async function runPostBuildValidation(outputPath, validation) {
+    const builtSkillPath = safePath.join(outputPath, 'SKILL.md');
+    return validateSkillForPackaging(builtSkillPath, validation ? { validation } : undefined, 'built');
+}
+/**
+ * Assemble the final PackageSkillResult from intermediate data.
+ * Extracted to keep packageSkill() within the cognitive-complexity budget.
+ */
+function assemblePackageResult(input) {
+    const result = {
+        outputPath: input.outputPath,
+        skill: input.skillMetadata,
         files: {
             root: 'SKILL.md',
-            dependencies: relativeLinkedFiles,
+            dependencies: input.relativeLinkedFiles,
         },
-        artifacts,
-        hasErrors: framework.hasErrors,
+        artifacts: input.artifacts,
+        postBuildValidation: input.postBuildValidation,
+        hasErrors: input.framework.hasErrors || input.postBuildValidation.activeErrors.length > 0,
     };
-    if (framework.emitted.length > 0) {
-        result.postBuildIssues = framework.emitted;
+    if (input.framework.emitted.length > 0) {
+        result.postBuildIssues = input.framework.emitted;
     }
-    if (excludedReferences.length > 0) {
-        // Deduplicate excluded reference paths for the result
-        const uniqueExcludedPaths = [...new Set(excludedReferences.map(r => safePath.relative(skillRoot, r.path)))];
+    if (input.excludedReferences.length > 0) {
+        const uniqueExcludedPaths = [...new Set(input.excludedReferences.map(r => safePath.relative(input.skillRoot, r.path)))];
         result.excludedReferences = uniqueExcludedPaths;
     }
     return result;