@vibe-agent-toolkit/agent-skills 0.1.39-rc.6 → 0.1.39-rc.7

package/dist/index.d.ts

@@ -23,9 +23,13 @@ export { crawlAndResolveRegistry, validateSkillForPackaging, type ExcludedRefere
 export { createIssue, NAVIGATION_FILE_PATTERNS, VALIDATION_RULES, VALIDATION_THRESHOLDS, type RuleCategory, type ValidationRule, type ValidationRuleCode, } from './validators/validation-rules.js';
 export type { ValidationResult, ValidateOptions, ResourceFormat, Surface, } from './validators/types.js';
 export { importSkillToAgent, type ImportOptions, type ImportResult, } from './import.js';
+export { cloneGitSource, type GitCloneResult } from './skill-source/git-clone.js';
+export { resolveSkillSource, type ResolveSkillSourceOptions } from './skill-source/resolve-skill-source.js';
+export type { SkillSource, ResolvedSkillSource, ResolveSkillSourceContext, } from './skill-source/types.js';
 export type { EvidenceRecord, EvidenceSource, EvidenceConfidence, EvidenceLocation, PatternDefinition, Observation, } from './evidence/index.js';
 export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, deriveObservationsFromEvidence, } from './evidence/index.js';
 export type { DeriveObservationsOptions, DerivationSubject } from './evidence/index.js';
 export type { AnyInventory, BaseInventory, ComponentRef, DeclaredList, HookRef, InstallInventory, LspRef, MarketplaceInventory, McpRef, ParseError as InventoryParseError, PluginInventory, PluginRef, ResolvedReference, SkillInventory, } from './inventory/index.js';
 export { isInstallInventory, isMarketplaceInventory, isPluginInventory, isSkillInventory, serializeInventory, serializeInventoryShallow, INVENTORY_SCHEMA_VERSION, detectDeclaredButMissing, detectMarketplacePluginSourceMissing, detectPresentButUndeclared, detectReferenceTargetMissing, } from './inventory/index.js';
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,cAAc,GACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,OAAO,GACR,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,YAAY,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,MAAM,EACN,oBAAoB,EACpB,MAAM,EACN,UAAU,IAAI,mBAAmB,EACjC,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,cAAc,GACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,OAAO,GACR,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlF,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,YAAY,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,MAAM,EACN,oBAAoB,EACpB,MAAM,EACN,UAAU,IAAI,mBAAmB,EACjC,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAE9B,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -22,6 +22,11 @@ export { detectResourceFormat, enumerateSurfaces } from './validators/format-det
 export { crawlAndResolveRegistry, validateSkillForPackaging, } from './validators/packaging-validator.js';
 export { createIssue, NAVIGATION_FILE_PATTERNS, VALIDATION_RULES, VALIDATION_THRESHOLDS, } from './validators/validation-rules.js';
 export { importSkillToAgent, } from './import.js';
+// Skill source primitives
+export { cloneGitSource } from './skill-source/git-clone.js';
+// Unified skill-source resolution (spec §11c)
+export { resolveSkillSource } from './skill-source/resolve-skill-source.js';
 export { PATTERN_REGISTRY, getPatternDefinition, assertPatternRegistered, deriveObservationsFromEvidence, } from './evidence/index.js';
 export { isInstallInventory, isMarketplaceInventory, isPluginInventory, isSkillInventory, serializeInventory, serializeInventoryShallow, INVENTORY_SCHEMA_VERSION, detectDeclaredButMissing, detectMarketplacePluginSourceMissing, detectPresentButUndeclared, detectReferenceTargetMissing, } from './inventory/index.js';
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,GAMlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,GAMd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAG/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAA4B,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,GAEjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAyB,MAAM,sCAAsC,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAA+B,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GAItB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAoB7B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AAEpF,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,GAMlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,aAAa,GAMd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAG/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAA4B,MAAM,mCAAmC,CAAC;AAEvI,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EACL,gBAAgB,GAEjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAyB,MAAM,sCAAsC,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAA+B,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAK1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GAItB,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAErB,0BAA0B;AAC1B,OAAO,EAAE,cAAc,EAAuB,MAAM,6BAA6B,CAAC;AAElF,8CAA8C;AAC9C,OAAO,EAAE,kBAAkB,EAAkC,MAAM,wCAAwC,CAAC;AAgB5G,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAoB7B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,oCAAoC,EACpC,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAE9B,cAAc,uBAAuB,CAAC"}

package/dist/skill-source/content-hash.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Deterministic SHA-256 content hash of a directory tree.
+ *
+ * Walks the tree, sorts entries by forward-slash relative path, and feeds each
+ * relative path plus its bytes into a single hash. Order-independent and
+ * platform-independent (forward-slash keys). Symlinks are followed only via
+ * the directory listing; callers that need symlink rejection use stageDirInto.
+ *
+ * @param dir Absolute path to the directory to hash.
+ * @returns 64-char lowercase hex SHA-256.
+ */
+export declare function hashDirectory(dir: string): Promise<string>;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/skill-source/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/skill-source/content-hash.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBhE"}

package/dist/skill-source/content-hash.js

@@ -0,0 +1,49 @@
+import { createHash } from 'node:crypto';
+import { readdir, readFile } from 'node:fs/promises';
+import { safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
+/**
+ * Deterministic SHA-256 content hash of a directory tree.
+ *
+ * Walks the tree, sorts entries by forward-slash relative path, and feeds each
+ * relative path plus its bytes into a single hash. Order-independent and
+ * platform-independent (forward-slash keys). Symlinks are followed only via
+ * the directory listing; callers that need symlink rejection use stageDirInto.
+ *
+ * @param dir Absolute path to the directory to hash.
+ * @returns 64-char lowercase hex SHA-256.
+ */
+export async function hashDirectory(dir) {
+    const files = await collectFiles(dir, dir);
+    files.sort((a, b) => {
+        if (a.rel < b.rel)
+            return -1;
+        if (a.rel > b.rel)
+            return 1;
+        return 0;
+    });
+    const hash = createHash('sha256');
+    for (const { rel, abs } of files) {
+        hash.update(rel, 'utf-8');
+        hash.update('\0');
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- abs derived from caller-provided dir
+        hash.update(await readFile(abs));
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+async function collectFiles(root, current) {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- current derived from caller-provided root
+    const entries = await readdir(current, { withFileTypes: true });
+    const out = [];
+    for (const entry of entries) {
+        const abs = safePath.join(current, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...(await collectFiles(root, abs)));
+        }
+        else if (entry.isFile()) {
+            out.push({ rel: toForwardSlash(safePath.relative(root, abs)), abs });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=content-hash.js.map

package/dist/skill-source/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../src/skill-source/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,2GAA2G;QAC3G,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,OAAe;IAEf,gHAAgH;IAChH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAwC,EAAE,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skill-source/fetch-cache.d.ts

@@ -0,0 +1,26 @@
+export interface CachedFetchArgs {
+    /** Per-user cache root (created 0700 if absent). */
+    cacheDir: string;
+    /** Integrity digest — PART of the cache key so a changed digest misses (spec §11a). */
+    digest: string;
+    /** Stable logical key (e.g. sanitized URL or package@version). */
+    key: string;
+    /** Force re-download/re-resolve (verify still runs). */
+    refresh?: boolean;
+    /** Populate the (empty) cache entry dir. Runs only on a miss or refresh. */
+    fetchInto: (dir: string) => Promise<void>;
+    /** Re-check integrity against `digest`. Runs on EVERY call (hit and miss). */
+    verify: (dir: string) => Promise<void>;
+}
+/**
+ * Content-addressed fetch cache with mandatory §11a hardening:
+ *  - cache root + entries are 0700 and rejected if not owned by the current uid;
+ *  - the entry key INCLUDES the integrity digest, so changing a declared digest
+ *    misses the old entry instead of reusing stale content;
+ *  - verify() runs unconditionally before returning, even on a cache hit and even
+ *    under refresh.
+ *
+ * @returns Forward-slash absolute path to the cached entry directory.
+ */
+export declare function withCachedFetch(args: CachedFetchArgs): Promise<string>;
+//# sourceMappingURL=fetch-cache.d.ts.map

package/dist/skill-source/fetch-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-cache.d.ts","sourceRoot":"","sources":["../../src/skill-source/fetch-cache.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,8EAA8E;IAC9E,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC5E"}

package/dist/skill-source/fetch-cache.js

@@ -0,0 +1,62 @@
+import { chmodSync, existsSync, mkdtempSync, renameSync, statSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { mkdirSyncReal, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
+/**
+ * Content-addressed fetch cache with mandatory §11a hardening:
+ *  - cache root + entries are 0700 and rejected if not owned by the current uid;
+ *  - the entry key INCLUDES the integrity digest, so changing a declared digest
+ *    misses the old entry instead of reusing stale content;
+ *  - verify() runs unconditionally before returning, even on a cache hit and even
+ *    under refresh.
+ *
+ * @returns Forward-slash absolute path to the cached entry directory.
+ */
+export async function withCachedFetch(args) {
+    const currentUid = process.getuid?.() ?? -1;
+    ensureOwned0700(args.cacheDir, currentUid);
+    const entry = safePath.join(args.cacheDir, `${args.key}-${args.digest}`);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- entry under our 0700 cache root
+    const hit = existsSync(entry);
+    if (hit && args.refresh === true) {
+        await rm(entry, { recursive: true, force: true });
+    }
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- entry under our 0700 cache root
+    const entryExists = existsSync(entry);
+    if (entryExists) {
+        assertOwned(entry, currentUid);
+    }
+    else {
+        // Atomic write: fetch into a sibling temp dir, then rename into place so
+        // `entry` only ever exists in a fully-populated state (no partial entries).
+        const tmp = mkdtempSync(safePath.join(args.cacheDir, '.tmp-'));
+        try {
+            await args.fetchInto(tmp);
+            // eslint-disable-next-line security/detect-non-literal-fs-filename -- entry and tmp under our 0700 cache root
+            renameSync(tmp, entry);
+        }
+        catch (err) {
+            await rm(tmp, { recursive: true, force: true });
+            throw err;
+        }
+    }
+    // Verify on EVERY path (hit or miss) before handing the dir back.
+    await args.verify(entry);
+    return toForwardSlash(entry);
+}
+function ensureOwned0700(dir, currentUid) {
+    mkdirSyncReal(dir, { recursive: true, mode: 0o700 });
+    assertOwned(dir, currentUid);
+    // Re-enforce 0700 in case the dir already existed with looser permissions.
+    // assertOwned above confirms we own it, so chmod is safe.
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- our own cache root confirmed owned above
+    chmodSync(dir, 0o700);
+}
+function assertOwned(dir, currentUid) {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- ownership probe on our own cache path
+    const st = statSync(dir);
+    if (currentUid >= 0 && st.uid !== currentUid) {
+        throw new Error(`Refusing to use fetch-cache entry '${dir}': ownership (uid ${st.uid}) ` +
+            `does not match current user (uid ${currentUid}).`);
+    }
+}
+//# sourceMappingURL=fetch-cache.js.map

package/dist/skill-source/fetch-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-cache.js","sourceRoot":"","sources":["../../src/skill-source/fetch-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAiBpF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,sGAAsG;IACtG,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,sGAAsG;IACtG,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,8GAA8G;YAC9G,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,UAAkB;IACtD,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,0DAA0D;IAC1D,+GAA+G;IAC/G,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,UAAkB;IAClD,4GAA4G;IAC5G,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,qBAAqB,EAAE,CAAC,GAAG,IAAI;YACtE,oCAAoC,UAAU,IAAI,CACrD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/skill-source/git-clone.d.ts

@@ -0,0 +1,21 @@
+import { type ParsedGitUrl } from '@vibe-agent-toolkit/utils';
+/** Result of a shallow git clone: the resolved ref, short commit SHA, and target dir. */
+export interface GitCloneResult {
+    /** The ref cloned (the requested `--branch <ref>`, or 'HEAD' for the default branch). */
+    ref: string;
+    /** 8-char resolved HEAD commit SHA. */
+    commit: string;
+    /** The (subpath-resolved) directory the caller should consume. */
+    targetDir: string;
+}
+/**
+ * Shallow-clone `parsed` into the caller-provided `targetTempdir`, validate any
+ * subpath, and return the resolved ref/commit/targetDir.
+ *
+ * Neutral domain primitive: it does NOT create or clean the tempdir, and carries
+ * no audit/provenance coupling. Callers (audit's withClonedRepo, the url skill
+ * source) own tempdir lifecycle. Extracted verbatim from the original audit helper
+ * so audit behavior is unchanged (spec §11c regression requirement).
+ */
+export declare function cloneGitSource(parsed: ParsedGitUrl, targetTempdir: string): GitCloneResult;
+//# sourceMappingURL=git-clone.d.ts.map

package/dist/skill-source/git-clone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../src/skill-source/git-clone.ts"],"names":[],"mappings":"AAGA,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAExE,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CA6B1F"}

package/dist/skill-source/git-clone.js

@@ -0,0 +1,66 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync } from 'node:fs';
+import { safePath } from '@vibe-agent-toolkit/utils';
+/**
+ * Shallow-clone `parsed` into the caller-provided `targetTempdir`, validate any
+ * subpath, and return the resolved ref/commit/targetDir.
+ *
+ * Neutral domain primitive: it does NOT create or clean the tempdir, and carries
+ * no audit/provenance coupling. Callers (audit's withClonedRepo, the url skill
+ * source) own tempdir lifecycle. Extracted verbatim from the original audit helper
+ * so audit behavior is unchanged (spec §11c regression requirement).
+ */
+export function cloneGitSource(parsed, targetTempdir) {
+    const ref = cloneShallow(parsed, targetTempdir);
+    const commit = revParseHead(targetTempdir);
+    const { subpath } = parsed;
+    const targetDir = subpath ? safePath.join(targetTempdir, subpath) : targetTempdir;
+    if (subpath !== undefined) {
+        const resolvedTarget = safePath.resolve(targetDir);
+        const resolvedTemp = safePath.resolve(targetTempdir);
+        const inside = resolvedTarget === resolvedTemp || resolvedTarget.startsWith(`${resolvedTemp}/`);
+        if (!inside) {
+            throw new Error(`Subpath escapes the cloned repository: ${subpath}. ` +
+                `Subpaths must be relative paths inside the repo (no \`..\` traversal).`);
+        }
+    }
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- targetDir = our tempdir + validated subpath
+    if (!existsSync(targetDir)) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- our own tempdir
+        const topLevel = readdirSync(targetTempdir).join(', ');
+        throw new Error(`Subpath not found in cloned repo: ${subpath ?? '(none)'}. Repo root contains: ${topLevel}.`);
+    }
+    return { ref, commit, targetDir };
+}
+function cloneShallow(parsed, tempdir) {
+    const args = ['clone', '--depth', '1', '--single-branch'];
+    if (parsed.ref !== undefined)
+        args.push('--branch', parsed.ref);
+    args.push(parsed.cloneUrl, tempdir);
+    // eslint-disable-next-line sonarjs/no-os-command-from-path -- git is a standard system command
+    const result = spawnSync('git', args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    const status = result.status ?? 1;
+    if (status !== 0) {
+        const stderr = (result.stderr ?? '').trim();
+        if (parsed.ref !== undefined && /not found|did not match/i.test(stderr)) {
+            throw new Error(`Reference not found in ${parsed.cloneUrl}: ${parsed.ref}. ` +
+                `Hint: --depth 1 cloning cannot resolve arbitrary deep commit SHAs; try a branch or tag name.`);
+        }
+        throw new Error(`Clone failed:\n${stderr}`);
+    }
+    return parsed.ref ?? 'HEAD';
+}
+function revParseHead(tempdir) {
+    // eslint-disable-next-line sonarjs/no-os-command-from-path -- git is a standard system command
+    const result = spawnSync('git', ['rev-parse', 'HEAD'], {
+        cwd: tempdir,
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const status = result.status ?? 1;
+    if (status !== 0) {
+        throw new Error(`Failed to resolve HEAD commit in cloned repo: ${(result.stderr ?? '').trim()}`);
+    }
+    return (result.stdout ?? '').trim().slice(0, 8);
+}
+//# sourceMappingURL=git-clone.js.map

package/dist/skill-source/git-clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-clone.js","sourceRoot":"","sources":["../../src/skill-source/git-clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAqB,MAAM,2BAA2B,CAAC;AAYxE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,aAAqB;IACxE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAElF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GACV,cAAc,KAAK,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,IAAI;gBACnD,wEAAwE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kHAAkH;IAClH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,sFAAsF;QACtF,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,IAAI,QAAQ,yBAAyB,QAAQ,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe;IACzD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpC,+FAA+F;IAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI;gBAC1D,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,+FAA+F;IAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACrD,GAAG,EAAE,OAAO;QACZ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/skill-source/resolve-skill-source.d.ts

@@ -0,0 +1,12 @@
+import type { ResolvedSkillSource, ResolveSkillSourceContext, SkillSource } from './types.js';
+export interface ResolveSkillSourceOptions {
+    /** Map of workspace skill name -> absolute SKILL.md path (required for { workspace } sources). */
+    workspaceSkillPaths?: Record<string, string>;
+}
+/**
+ * Unified entry point: materialize any typed SkillSource to a staged directory and
+ * return a stable reconciliation identity (spec §11c). Composes existing primitives —
+ * it never reimplements a resolver.
+ */
+export declare function resolveSkillSource(source: SkillSource, ctx: ResolveSkillSourceContext, opts?: ResolveSkillSourceOptions): Promise<ResolvedSkillSource>;
+//# sourceMappingURL=resolve-skill-source.d.ts.map

package/dist/skill-source/resolve-skill-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-skill-source.d.ts","sourceRoot":"","sources":["../../src/skill-source/resolve-skill-source.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAU9F,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,yBAAyB,EAC9B,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}

package/dist/skill-source/resolve-skill-source.js

@@ -0,0 +1,37 @@
+import { resolveNpmSource } from './sources/npm-source.js';
+import { resolvePathSource } from './sources/path-source.js';
+import { resolveVendoredSource } from './sources/vendored-source.js';
+import { resolveWorkspaceSource } from './sources/workspace-source.js';
+/**
+ * Unified entry point: materialize any typed SkillSource to a staged directory and
+ * return a stable reconciliation identity (spec §11c). Composes existing primitives —
+ * it never reimplements a resolver.
+ */
+export async function resolveSkillSource(source, ctx, opts = {}) {
+    if ('path' in source) {
+        return resolvePathSource(source.path, ctx);
+    }
+    if ('npm' in source) {
+        return resolveNpmSource(source.npm, ctx);
+    }
+    if ('url' in source) {
+        const { resolveUrlSource } = await import('./sources/url-source.js');
+        return resolveUrlSource(source.url, source.sha256, ctx);
+    }
+    if ('vendored' in source) {
+        return resolveVendoredSource(ctx);
+    }
+    if ('workspace' in source) {
+        const skillPath = opts.workspaceSkillPaths?.[source.workspace];
+        if (skillPath === undefined) {
+            throw new Error(`workspace skill source '${source.workspace}' has no SKILL.md path mapping ` +
+                `(pass opts.workspaceSkillPaths['${source.workspace}']).`);
+        }
+        return resolveWorkspaceSource(source.workspace, ctx, { skillPath });
+    }
+    // Exhaustiveness: every SkillSource arm is handled above. Adding a new arm to
+    // the union without a branch here makes this assignment a compile error.
+    const _exhaustive = source;
+    throw new Error(`Unhandled skill source: ${JSON.stringify(_exhaustive)}`);
+}
+//# sourceMappingURL=resolve-skill-source.js.map

package/dist/skill-source/resolve-skill-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-skill-source.js","sourceRoot":"","sources":["../../src/skill-source/resolve-skill-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAgBvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAmB,EACnB,GAA8B,EAC9B,OAAkC,EAAE;IAEpC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACrE,OAAO,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,SAAS,iCAAiC;gBAC1E,mCAAmC,MAAM,CAAC,SAAS,MAAM,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAU,MAAM,CAAC;IAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/skill-source/sources/npm-source.d.ts

@@ -0,0 +1,22 @@
+import type { ResolvedSkillSource, ResolveSkillSourceContext } from '../types.js';
+/**
+ * Split a version-pinned bare specifier into { name, version }.
+ * Throws if no `@version` pin is present — npm sources MUST be version-pinned
+ * for reproducibility (spec §11a).
+ */
+export declare function splitNpmSpecVersion(spec: string): {
+    name: string;
+    version: string;
+};
+/**
+ * Resolve a `{ npm }` skill source.
+ *
+ * resolveAssetReference locates the installed package subpath (location only —
+ * NO registry-integrity check). We then content-hash the staged tree and record
+ * version + tree-hash in the identity. This is NOT a registry dist.integrity
+ * guarantee; v1 stages what is installed (spec §11a, stated honestly).
+ *
+ * @param spec Bare specifier WITH a version pin: `@scope/pkg@1.2.3[/subpath]`.
+ */
+export declare function resolveNpmSource(spec: string, ctx: ResolveSkillSourceContext): Promise<ResolvedSkillSource>;
+//# sourceMappingURL=npm-source.d.ts.map

package/dist/skill-source/sources/npm-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/npm-source.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAMlF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQnF;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAY9B"}

package/dist/skill-source/sources/npm-source.js

@@ -0,0 +1,48 @@
+import { resolveAssetReference } from '@vibe-agent-toolkit/utils';
+import { hashDirectory } from '../content-hash.js';
+import { stageDirInto } from '../stage.js';
+/** Match `@scope/name@version[/subpath]` or `name@version[/subpath]`, capturing name + version. */
+// eslint-disable-next-line security/detect-unsafe-regex -- pattern is safe (bounded quantifiers, no backtracking)
+const NPM_SPEC_RE = /^((?:@[^/@]+\/)?[^/@]+)@([^/]+)(\/.+)?$/;
+/**
+ * Split a version-pinned bare specifier into { name, version }.
+ * Throws if no `@version` pin is present — npm sources MUST be version-pinned
+ * for reproducibility (spec §11a).
+ */
+export function splitNpmSpecVersion(spec) {
+    const match = NPM_SPEC_RE.exec(spec);
+    if (!match?.[1] || !match?.[2]) {
+        throw new Error(`npm skill source '${spec}' must be version-pinned, e.g. "@scope/pkg@1.2.3" or "@scope/pkg@1.2.3/subpath".`);
+    }
+    return { name: match[1], version: match[2] };
+}
+/**
+ * Resolve a `{ npm }` skill source.
+ *
+ * resolveAssetReference locates the installed package subpath (location only —
+ * NO registry-integrity check). We then content-hash the staged tree and record
+ * version + tree-hash in the identity. This is NOT a registry dist.integrity
+ * guarantee; v1 stages what is installed (spec §11a, stated honestly).
+ *
+ * @param spec Bare specifier WITH a version pin: `@scope/pkg@1.2.3[/subpath]`.
+ */
+export async function resolveNpmSource(spec, ctx) {
+    const { name, version } = splitNpmSpecVersion(spec);
+    // resolveAssetReference wants a bare specifier WITHOUT the `@version` pin
+    // (Node module resolution does not understand the pin). Re-attach the subpath.
+    const subpath = spec.slice(`${name}@${version}`.length); // '' or '/dir/...'
+    const locator = `${name}${subpath}`;
+    const resolvedFile = resolveAssetReference(locator, ctx.repoRoot);
+    // resolvedFile may be a file (exports subpath) or a directory specifier; stage its directory.
+    const resolvedDir = await dirOf(resolvedFile);
+    const hash = await hashDirectory(resolvedDir);
+    const stagedDir = await stageDirInto(resolvedDir, ctx, `npm-${hash}`);
+    return { stagedDir, identity: `npm:${name}@${version}:${hash}` };
+}
+async function dirOf(p) {
+    const { statSync } = await import('node:fs');
+    const { dirname } = await import('node:path');
+    const stat = statSync(p);
+    return stat.isDirectory() ? p : dirname(p);
+}
+//# sourceMappingURL=npm-source.js.map

package/dist/skill-source/sources/npm-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/npm-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,mGAAmG;AACnG,kHAAkH;AAClH,MAAM,WAAW,GAAG,yCAAyC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,kFAAkF,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,GAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB;IAC5E,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClE,8FAA8F;IAC9F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,CAAS;IAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/skill-source/sources/path-source.d.ts

@@ -0,0 +1,10 @@
+import type { ResolvedSkillSource, ResolveSkillSourceContext } from '../types.js';
+/**
+ * Resolve a `{ path }` skill source.
+ *
+ * Uses resolveAssetReference for LOCATION only (filesystem branch, relative to
+ * ctx.repoRoot), then content-hashes the resolved tree and stages it under that
+ * hash. The hash IS the integrity story for local dirs — there is no registry.
+ */
+export declare function resolvePathSource(spec: string, ctx: ResolveSkillSourceContext): Promise<ResolvedSkillSource>;
+//# sourceMappingURL=path-source.d.ts.map

package/dist/skill-source/sources/path-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/path-source.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAElF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAK9B"}

package/dist/skill-source/sources/path-source.js

@@ -0,0 +1,17 @@
+import { resolveAssetReference } from '@vibe-agent-toolkit/utils';
+import { hashDirectory } from '../content-hash.js';
+import { stageDirInto } from '../stage.js';
+/**
+ * Resolve a `{ path }` skill source.
+ *
+ * Uses resolveAssetReference for LOCATION only (filesystem branch, relative to
+ * ctx.repoRoot), then content-hashes the resolved tree and stages it under that
+ * hash. The hash IS the integrity story for local dirs — there is no registry.
+ */
+export async function resolvePathSource(spec, ctx) {
+    const resolvedDir = resolveAssetReference(spec, ctx.repoRoot);
+    const hash = await hashDirectory(resolvedDir);
+    const stagedDir = await stageDirInto(resolvedDir, ctx, `path-${hash}`);
+    return { stagedDir, identity: `path:${hash}` };
+}
+//# sourceMappingURL=path-source.js.map

package/dist/skill-source/sources/path-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/path-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,GAA8B;IAE9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;AACjD,CAAC"}

package/dist/skill-source/sources/url-source.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedSkillSource, ResolveSkillSourceContext } from '../types.js';
+/**
+ * Resolve a `{ url, sha256? }` skill source.
+ *
+ * - Git URL (cloneUrl#ref:subpath): clone via the extracted cloneGitSource into a
+ *   cache entry keyed on the resolved commit; identity is url + commit.
+ * - Arbitrary `.zip`: fetch the bytes, verify the REQUIRED sha256, extract into a
+ *   cache entry keyed on the sha256; identity is url + sha256. This is the one
+ *   genuinely new fetch capability (spec §11a).
+ */
+export declare function resolveUrlSource(url: string, sha256: string | undefined, ctx: ResolveSkillSourceContext): Promise<ResolvedSkillSource>;
+/** Re-export so unit tests / callers can compute a zip digest the same way. */
+export declare function sha256Of(bytes: Buffer): string;
+//# sourceMappingURL=url-source.d.ts.map

package/dist/skill-source/sources/url-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/url-source.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAQ9B;AAkGD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C"}