@vibe-agent-toolkit/agent-skills 0.2.0-rc.7 → 0.2.0-rc.8

package/dist/schemas/installed-plugins-registry.js

@@ -71,7 +71,13 @@ const PluginInstallationSchema = z
  */
 export const InstalledPluginsRegistrySchema = z
     .object({
-    version: z.literal(2).describe('Registry format version (currently 2)'),
+    // Claude Code's file, Claude Code's number: `installed_plugins.json` is
+    // written by another vendor and declares its own format version. Reading
+    // it is an external fact, like `ANTHROPIC_VERSION`, not a VAT version
+    // constant — a registry at a format VAT has never seen should be refused
+    // by name rather than parsed on hope.
+    // eslint-disable-next-line local/no-version-literal -- external format version declared by Claude Code's own file, not a VAT constant
+    version: z.literal(2).describe('Registry format version as Claude Code writes it (currently 2)'),
     plugins: z
         .record(z
         .string()

package/dist/schemas/installed-plugins-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"installed-plugins-registry.js","sourceRoot":"","sources":["../../src/schemas/installed-plugins-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;CACC,CAAC;AAEX,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEhF;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CACP,mCAAmC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CACzG;IAEH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IAEpF,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,CAAC,6CAA6C,CAAC;IAE1D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,CAAC,0CAA0C,CAAC;IAEvD,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oDAAoD,CAAC;IAEjE,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAE9D,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IAEzD,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8GAA8G,CAC/G;CACJ,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAEvE,OAAO,EAAE,CAAC;SACP,MAAM,CACL,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CAAC,eAAe,EAAE,4CAA4C,CAAC,EACvE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACzC;SACA,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,WAAW,EAAE;KACb,QAAQ,CAAC,sCAAsC,CAAC,CAAC;AAOpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,eAAe,CAC/D,8BAA8B,EAC9B,EAAE,IAAI,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,EAAE,CAC3D,CAAC;AAEF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO;IACP,aAAa;IACb,aAAa;IACb,SAAS;IACT,aAAa;IACb,aAAa;IACb,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,KAAc,EACd,OAAe,EACf,MAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,iBAAiB,CACf,KAAK,EACL,uBAAuB,EACvB,OAAO,EACP,CAAC,GAAG,EAAE,EAAE,CAAC,kDAAkD,GAAG,GAAG,EACjE,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,WAAW,CACT,MAAM,EACN,GAAG,OAAO,QAAQ,EAClB,uBAAuB,KAAK,0CAA0C,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CACjD,IAAa;IAEb,MAAM,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iBAAiB,CACf,IAAI,EACJ,mBAAmB,EACnB,EAAE,EACF,CAAC,GAAG,EAAE,EAAE,CAAC,kDAAkD,GAAG,GAAG,EACjE,KAAK,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,WAAW,SAAS,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"installed-plugins-registry.js","sourceRoot":"","sources":["../../src/schemas/installed-plugins-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;CACC,CAAC;AAEX,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEhF;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,CACP,mCAAmC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CACzG;IAEH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IAEpF,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,CAAC,6CAA6C,CAAC;IAE1D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,CAAC,0CAA0C,CAAC;IAEvD,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oDAAoD,CAAC;IAEjE,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAE9D,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IAEzD,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,8GAA8G,CAC/G;CACJ,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,sCAAsC;IACtC,sIAAsI;IACtI,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IAEhG,OAAO,EAAE,CAAC;SACP,MAAM,CACL,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CAAC,eAAe,EAAE,4CAA4C,CAAC,EACvE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACzC;SACA,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,WAAW,EAAE;KACb,QAAQ,CAAC,sCAAsC,CAAC,CAAC;AAOpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,eAAe,CAC/D,8BAA8B,EAC9B,EAAE,IAAI,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,EAAE,CAC3D,CAAC;AAEF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO;IACP,aAAa;IACb,aAAa;IACb,SAAS;IACT,aAAa;IACb,aAAa;IACb,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,KAAc,EACd,OAAe,EACf,MAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,iBAAiB,CACf,KAAK,EACL,uBAAuB,EACvB,OAAO,EACP,CAAC,GAAG,EAAE,EAAE,CAAC,kDAAkD,GAAG,GAAG,EACjE,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,WAAW,CACT,MAAM,EACN,GAAG,OAAO,QAAQ,EAClB,uBAAuB,KAAK,0CAA0C,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CACjD,IAAa;IAEb,MAAM,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iBAAiB,CACf,IAAI,EACJ,mBAAmB,EACnB,EAAE,EACF,CAAC,GAAG,EAAE,EAAE,CAAC,kDAAkD,GAAG,GAAG,EACjE,KAAK,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,WAAW,SAAS,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/skill-identity.d.ts

@@ -13,9 +13,14 @@
 /**
  * Read the name a SKILL.md declares for itself.
  *
- * Returns `undefined` when the file is unreadable, has no frontmatter, or
- * declares no usable `name` — callers decide whether that is fatal or whether
- * some fallback (typically the directory leaf) applies.
+ * Returns `undefined` when there is no file at the path, it has no frontmatter,
+ * or it declares no usable `name` — callers decide whether that is fatal or
+ * whether some fallback (typically the directory leaf) applies.
+ *
+ * A file that IS there but could not be read (a permission refusal, a path
+ * component that is a directory) throws: `undefined` means "declares no name",
+ * and a refusal has not established that — a caller falling back to the
+ * directory leaf would otherwise rename the skill on the operator's behalf.
  */
 export declare function readDeclaredSkillName(skillMdPath: string): string | undefined;
 /**

package/dist/skill-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-identity.d.ts","sourceRoot":"","sources":["../src/skill-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvE"}
+{"version":3,"file":"skill-identity.d.ts","sourceRoot":"","sources":["../src/skill-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvE"}

package/dist/skill-identity.js

@@ -11,22 +11,29 @@
  * a path, so every lane answers the question the same way.
  */
 import { readFileSync } from 'node:fs';
+import { isPathAbsentError } from '@vibe-agent-toolkit/utils';
 import { parseFrontmatter } from './parsers/frontmatter-parser.js';
 /**
  * Read the name a SKILL.md declares for itself.
  *
- * Returns `undefined` when the file is unreadable, has no frontmatter, or
- * declares no usable `name` — callers decide whether that is fatal or whether
- * some fallback (typically the directory leaf) applies.
+ * Returns `undefined` when there is no file at the path, it has no frontmatter,
+ * or it declares no usable `name` — callers decide whether that is fatal or
+ * whether some fallback (typically the directory leaf) applies.
+ *
+ * A file that IS there but could not be read (a permission refusal, a path
+ * component that is a directory) throws: `undefined` means "declares no name",
+ * and a refusal has not established that — a caller falling back to the
+ * directory leaf would otherwise rename the skill on the operator's behalf.
  */
 export function readDeclaredSkillName(skillMdPath) {
     let content;
     try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- caller-supplied skill path
         content = readFileSync(skillMdPath, 'utf-8');
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (isPathAbsentError(error))
+            return undefined;
+        throw error;
     }
     return declaredSkillNameIn(content);
 }

package/dist/skill-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-identity.js","sourceRoot":"","sources":["../src/skill-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,iGAAiG;QACjG,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"skill-identity.js","sourceRoot":"","sources":["../src/skill-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC"}

package/dist/skill-packager.d.ts

@@ -16,6 +16,7 @@
  */
 import { ResourceRegistry, type ResourceLink, type ResourcePopulationSource } from '@vibe-agent-toolkit/resources';
 import { type AllowUsageLedger, type ValidationConfig, type ValidationIssue } from '@vibe-agent-toolkit/schema';
+import { VatError } from '@vibe-agent-toolkit/utils';
 import { type GitTracker } from '@vibe-agent-toolkit/utils/git';
 import { type PackagingTarget } from './content-type-routing.js';
 import { type SkillFileEntry } from './files-config.js';
@@ -496,7 +497,7 @@ export declare function generateTargetPath(filePath: string, basePath: string, s
  * Thrown when a claude-web ZIP exceeds the 8MB Claude.ai upload limit.
  * The CLI catches this and exits with code 1.
  */
-export declare class ZipSizeLimitError extends Error {
+export declare class ZipSizeLimitError extends VatError {
     readonly sizeBytes: number;
     readonly limitBytes: number;
     constructor(sizeBytes: number, limitBytes: number);

package/dist/skill-packager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packager.d.ts","sourceRoot":"","sources":["../src/skill-packager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAGL,gBAAgB,EAWhB,KAAK,YAAY,EAEjB,KAAK,wBAAwB,EAE9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAIL,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EACL,KAAK,UAAU,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAIvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAA6B,KAAK,yBAAyB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AA4E3I;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAKlF,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1D;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAE9C,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAE7C,mEAAmE;IACnE,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC/B,CAAC,GAAG,SAAS,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACtC,GAAG,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAE1C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAClD,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,oBAAoB,EAAE,sBAAsB,GAC3C,mBAAmB,CAmCrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IAEhD,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAE5D,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,gBAAgB,EAC7B,UAAU,GAAE,sBAA2B,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiChC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA0Y7B;AAgJD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAkCD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAgtBD;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,cAAc,EAAE,MAAM,IAAI,GACzB,YAAY,EAAE,CAYhB;AAoUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASlE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAsC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,sBAAmC,EAC7C,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CA6CR;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAUlD"}
+{"version":3,"file":"skill-packager.d.ts","sourceRoot":"","sources":["../src/skill-packager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAGL,gBAAgB,EAWhB,KAAK,YAAY,EAEjB,KAAK,wBAAwB,EAE9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAIL,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EASL,QAAQ,EACT,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,UAAU,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAIvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAA6B,KAAK,yBAAyB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AA4E3I;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;AAKlF,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;IAE1D;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAE9C,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAE7C,mEAAmE;IACnE,2BAA2B,CAAC,EAAE;QAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC/B,CAAC,GAAG,SAAS,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACtC,GAAG,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAExC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAE1C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAErC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAClD,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,oBAAoB,EAAE,sBAAsB,GAC3C,mBAAmB,CAmCrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IAEhD,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAE5D,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,gBAAgB,EAC7B,UAAU,GAAE,sBAA2B,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiChC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA+Y7B;AAgJD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AA+CD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AA+sBD;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,cAAc,EAAE,MAAM,IAAI,GACzB,YAAY,EAAE,CAYhB;AAgUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASlE;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAsC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,sBAAmC,EAC7C,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CA6CR;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAUlD"}

package/dist/skill-packager.js

@@ -19,7 +19,7 @@ import { copyFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { basename, dirname } from 'node:path';
 import { DeferredArtifacts, DuplicateResourceIdError, ResourceRegistry, loadConfig, openFrontmatter, resolveLocalHref, rewriteFrontmatterUriReferencesFromSchema, rewriteHtmlLinks, transformContent, parseFileCached, } from '@vibe-agent-toolkit/resources';
 import { allowUnusedIssues, createAllowUsageLedger, runValidationFramework, } from '@vibe-agent-toolkit/schema';
-import { findProjectRoot, isGlob, issueLocation, resolveAssetReference, toForwardSlash, safePath, } from '@vibe-agent-toolkit/utils';
+import { direntKindFollowingSync, findProjectRoot, isGlob, isSingleFsSegment, issueLocation, resolveAssetReference, safePath, toForwardSlash, VatError, } from '@vibe-agent-toolkit/utils';
 import { readTextContent } from '@vibe-agent-toolkit/utils/fs';
 import { getResourceSubdirForFile } from './content-type-routing.js';
 import { applyFilesConfig, buildArtifactHint, droppedGlobMatchesToIssues, explicitFilesConfigDests, globEntryDest, skippedGlobMatchesToIssues, } from './files-config.js';
@@ -30,7 +30,7 @@ import { detectPackagedAgentInstructionFiles } from './validators/agent-instruct
 import { checkPackagedSizeLimit } from './validators/packaged-size-limit.js';
 import { validateSkillForPackaging } from './validators/packaging-validator.js';
 import { materializeIssue } from './validators/rule-engine/index.js';
-import { deferredAssetsToIssues, walkerExclusionsToIssues } from './validators/walker-to-issues.js';
+import { deferredAssetsToIssues, outsideSkillDirLinksToIssues, walkerExclusionsToIssues } from './validators/walker-to-issues.js';
 import { walkLinkGraph } from './walk-link-graph.js';
 const PACKAGE_JSON_FILENAME = 'package.json';
 /** `withFsAttribution` action for a write in `copyAndRewriteFile` — never a copy, since the bytes are rewritten first. */
@@ -295,7 +295,7 @@ export async function packageSkill(skillPath, options = {}) {
     const registry = options.registry ?? await createProjectRegistry(projectRoot);
     // 3b. Load per-collection frontmatter schemas (Gap 3: packager rewrites frontmatter URI-refs
     // against the same schemas the validator uses, with body parity).
-    const collectionSchemas = await loadCollectionSchemas(registry.config, projectRoot);
+    const { schemas: collectionSchemas, issues: collectionSchemaIssues } = await loadCollectionSchemas(registry.config, projectRoot);
     // 4. Walk the link graph using registry data
     const linkFollowDepth = options.linkFollowDepth ?? 2;
     const excludeConfig = options.excludeReferencesFromBundle;
@@ -325,7 +325,7 @@ export async function packageSkill(skillPath, options = {}) {
     if (options.gitTracker !== undefined) {
         packagerWalkOptions.gitTracker = options.gitTracker;
     }
-    const { bundledResources, bundledAssets, excludedReferences, deferredAssets } = walkLinkGraph(skillResourceId, registry, packagerWalkOptions);
+    const { bundledResources, bundledAssets, excludedReferences, outsideSkillDirLinks, deferredAssets } = walkLinkGraph(skillResourceId, registry, packagerWalkOptions);
     // Register non-markdown bundled assets in the source registry so link rewriting
     // can resolve them (resolvedId must be set on links pointing to YAML, JSON, etc.).
     // For any asset whose id is already taken (a path-slug clash — `a-b/c.html`
@@ -347,7 +347,6 @@ export async function packageSkill(skillPath, options = {}) {
     // 7. Clean stale output (skip when source SKILL.md lives inside the output, e.g. builder flow)
     const resolvedOutput = safePath.resolve(outputPath);
     const sourceInOutput = safePath.resolve(skillPath).startsWith(resolvedOutput + '/');
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- outputPath is validated
     if (!sourceInOutput && existsSync(resolvedOutput)) {
         await rm(resolvedOutput, { recursive: true });
     }
@@ -410,9 +409,7 @@ export async function packageSkill(skillPath, options = {}) {
     // The build's own output directory. An unwritable `dist/` or a full disk failed
     // here with a bare errno naming an output path the author never typed — the
     // same shape as the copiers, at the step before any of them run.
-    await withFsAttribution(`skill '${skillMetadata.name}' output directory ${issueLocation(outputPath, projectRoot) || '.'}`, 
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- outputPath is validated
-    () => mkdir(outputPath, { recursive: true }), 'created');
+    await withFsAttribution(`skill '${skillMetadata.name}' output directory ${issueLocation(outputPath, projectRoot) || '.'}`, () => mkdir(outputPath, { recursive: true }), 'created');
     await copyAndRewriteFiles(skillPath, bundledFiles, {
         pathMap,
         rewriteLinks,
@@ -498,8 +495,8 @@ export async function packageSkill(skillPath, options = {}) {
         // path a reader can open is its source path.
         ...droppedGlobMatchesToIssues(appliedFiles.dropped, projectRoot),
         // The same receipt, for matches that are not copyable files at all. Anchored
-        // identically and for the identical reason. Until issue #183 this population
-        // had no channel because the build died on the first one it met.
+        // identically and for the identical reason. Without a channel of its own this
+        // population is invisible: the build used to die on the first one it met.
         ...skippedGlobMatchesToIssues(appliedFiles.skipped, projectRoot),
         // Presence-side backstop for agent-instruction files. The walker excludes
         // them from link-following, but a `files:` glob can still copy one in, and
@@ -514,6 +511,9 @@ export async function packageSkill(skillPath, options = {}) {
         // A receipt for each `files:` entry that was dropped for pointing into declared
         // test input — the build already produced the right artifact; this just says so.
         ...testInputFileEntryIssues(droppedTestInputFiles),
+        // A collection schema that could not be loaded, so its frontmatter was not
+        // rewritten (see loadCollectionSchemas).
+        ...collectionSchemaIssues,
         // Backstop: if declared test input reached the output despite both exclusions,
         // say so rather than shipping an answer key silently.
         ...checkPackagedTestInput({ pathMap, outputPath, testInputDirs }),
@@ -525,6 +525,7 @@ export async function packageSkill(skillPath, options = {}) {
         // (a pattern match is author-declared intent; this exclusion is VAT's).
         ...testInputLinkIssues(excludedReferences, testInputDirs, projectRoot),
         ...deferredAssetsToIssues(deferredAssets, projectRoot),
+        ...outsideSkillDirLinksToIssues(outsideSkillDirLinks, projectRoot),
     ];
     // ONE ledger for BOTH lanes below. `options.validation.allow` governs the
     // build-receipt lane AND the built-SKILL.md lane, but the two see disjoint
@@ -603,7 +604,7 @@ function withRunAllowUnused(framework, ledger) {
  *
  * ## 🚨 This lane's link graph is EMPTY — and that is the NORMAL case
  *
- * Measured 2026-08 on a probe fixture (one skill, one `reference.md` reachable by
+ * Measured on a probe fixture (one skill, one `reference.md` reachable by
  * a single relative link from `SKILL.md`), run three ways with ONE variable —
  * where the packaged output lands:
  *
@@ -626,7 +627,7 @@ function withRunAllowUnused(framework, ledger) {
  * `${CLAUDE_PLUGIN_ROOT}` invocation inside a bundled reference is caught at
  * source and CANNOT be caught in the built artifact.
  *
- * 🔑 Measured vs inferred. The three rows are MEASURED (2026-08, that probe).
+ * 🔑 Measured vs inferred. The three rows are MEASURED (that probe).
  * That the finding is still LIVE is inferred from this function's own body: it
  * passes only the built `SKILL.md` path, with no registry and no population
  * source rooted at the output tree, so `validateSkillForPackaging` resolves
@@ -736,30 +737,40 @@ export async function createProjectRegistry(projectRoot, options = {}) {
  * Mirrors ResourceRegistry.validateAgainstCollectionSchema's loading flow so
  * the packager rewrites frontmatter URI-refs against the same schemas the
  * validator uses. Collections without a frontmatterSchema configured are
- * absent from the map. Schema file read/parse failures are silently skipped
- * — the validator will surface those errors elsewhere; the packager just
- * won't rewrite the un-routed collection's frontmatter.
+ * absent from the map.
+ *
+ * A schema that cannot be resolved, read or parsed is absent from the map too,
+ * and that is REPORTED as a `FRONTMATTER_SCHEMA_ERROR` issue in the build's own
+ * receipt — the same code `vat validate` gives the same config. It used to be
+ * swallowed on the theory that "the validator will surface it elsewhere", which
+ * left `vat build` shipping a bundle whose frontmatter URI-refs still pointed
+ * at source-tree paths, with a clean report and nothing to say why.
  */
 async function loadCollectionSchemas(config, baseDir) {
     const schemas = new Map();
+    const issues = [];
     const collections = config?.resources?.collections;
     if (!collections)
-        return schemas;
+        return { schemas, issues };
     for (const [collectionId, collectionConfig] of Object.entries(collections)) {
         const schemaPath = collectionConfig.validation?.frontmatterSchema;
         if (schemaPath === undefined)
             continue;
         try {
             const resolvedPath = resolveAssetReference(schemaPath, baseDir);
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- schema path from validated config
             const content = await readFile(resolvedPath, 'utf-8');
             schemas.set(collectionId, JSON.parse(content));
         }
-        catch {
-            // Schema unavailable — validator will report; packager skips rewrite.
+        catch (error) {
+            issues.push(materializeIssue('FRONTMATTER_SCHEMA_ERROR', {
+                location: schemaPath,
+                message: `Collection "${collectionId}" declares frontmatterSchema "${schemaPath}", which could not ` +
+                    `be loaded: ${error instanceof Error ? error.message : String(error)}. Frontmatter ` +
+                    `URI-references in this collection were NOT rewritten for the packaged output.`,
+            }));
         }
     }
-    return schemas;
+    return { schemas, issues };
 }
 /**
  * Generate a synthetic resource ID for a non-markdown asset that collides with an
@@ -986,7 +997,6 @@ function applyFilesEntriesToPathMap(filesConfig, projectRoot, outputPath, pathMa
         // have helped. A wrong diagnosis with a confident wrong remedy attached.
         // Only ENOENT is absence; a refusal is reported as itself, naming the entry.
         try {
-            // eslint-disable-next-line security/detect-non-literal-fs-filename -- source path from validated config
             statSync(absoluteSource);
         }
         catch (error) {
@@ -1421,7 +1431,6 @@ async function copyAndRewriteFile(sourcePath, targetPath, ctx) {
     const subject = `linked file ${issueLocation(sourcePath, ctx.projectRoot) || '.'}`;
     // Ensure target directory exists
     await withFsAttribution(subject, async () => {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- targetPath is constructed from validated paths
         await mkdir(dirname(targetPath), { recursive: true });
     });
     const lower = sourcePath.toLowerCase();
@@ -1480,9 +1489,7 @@ async function copyAndRewriteFile(sourcePath, targetPath, ctx) {
                 `Source-relative links inside it are not rewritten.`
             : `Copied '${sourcePath}' verbatim without link rewriting: it lost a resource-id collision to ` +
                 `'${winner}', which was registered first and holds the id. Source-relative links inside it are not rewritten.`);
-        await withFsAttribution(subject, 
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- targetPath is constructed from validated paths
-        () => writeFile(targetPath, content, 'utf-8'), WRITE_ACTION);
+        await withFsAttribution(subject, () => writeFile(targetPath, content, 'utf-8'), WRITE_ACTION);
         return;
     }
     // HTML: offset-splice link rewrite (no frontmatter, no template body rewrite).
@@ -1492,9 +1499,7 @@ async function copyAndRewriteFile(sourcePath, targetPath, ctx) {
             ctx.warn(`Could not rewrite <${info.tagName} ${info.attr}="${info.from}"> in '${sourcePath}' (${info.reason}); ` +
                 `the original value was kept.`);
         });
-        await withFsAttribution(subject, 
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- targetPath is constructed from validated paths
-        () => writeFile(targetPath, rewritten, 'utf-8'), WRITE_ACTION);
+        await withFsAttribution(subject, () => writeFile(targetPath, rewritten, 'utf-8'), WRITE_ACTION);
         return;
     }
     // Parse once via FrontmatterEditor so comments survive any frontmatter
@@ -1528,9 +1533,7 @@ async function copyAndRewriteFile(sourcePath, targetPath, ctx) {
             }
         }
     }
-    await withFsAttribution(subject, 
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- targetPath is constructed from validated paths
-    () => writeFile(targetPath, editor.toString(), 'utf-8'), WRITE_ACTION);
+    await withFsAttribution(subject, () => writeFile(targetPath, editor.toString(), 'utf-8'), WRITE_ACTION);
 }
 /**
  * Build the per-href rewrite callback used for frontmatter URI-refs and HTML attributes.
@@ -1584,10 +1587,10 @@ function buildHrefRewriter(fromRegistry, toRegistry, sourcePath, targetPath, pro
  * but this check acts as a safety net in case files are introduced through other means.
  */
 async function validateNoNestedSkillMd(outputPath, skillName) {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- outputPath is validated
     const entries = readdirSync(outputPath, { recursive: true, withFileTypes: true });
     const nestedSkillMds = entries
-        .filter(entry => entry.isFile() && entry.name === 'SKILL.md')
+        // Followed: a symlinked nested SKILL.md is a nested skill marker all the same.
+        .filter(entry => entry.name === 'SKILL.md' && direntKindFollowingSync(entry.parentPath, entry) === 'file')
         .map(entry => safePath.relative(outputPath, safePath.join(entry.parentPath, entry.name)))
         .filter(relativePath => relativePath !== 'SKILL.md'); // Exclude the root SKILL.md
     if (nestedSkillMds.length > 0) {
@@ -1755,14 +1758,13 @@ const ZIP_SIZE_ERROR_BYTES = 8 * 1024 * 1024;
  * Thrown when a claude-web ZIP exceeds the 8MB Claude.ai upload limit.
  * The CLI catches this and exits with code 1.
  */
-export class ZipSizeLimitError extends Error {
+export class ZipSizeLimitError extends VatError {
     sizeBytes;
     limitBytes;
     constructor(sizeBytes, limitBytes) {
         const mb = (sizeBytes / 1024 / 1024).toFixed(1);
-        super(`ZIP size ${mb}MB exceeds 8MB limit for Claude.ai upload. ` +
+        super('ZIP_SIZE_LIMIT', `ZIP size ${mb}MB exceeds 8MB limit for Claude.ai upload. ` +
             `Reduce the number of linked resources or use --target claude-code.`);
-        this.name = 'ZipSizeLimitError';
         this.sizeBytes = sizeBytes;
         this.limitBytes = limitBytes;
     }
@@ -1774,7 +1776,6 @@ export class ZipSizeLimitError extends Error {
  * @param zipPath - Path to the ZIP file
  */
 function validateZipSize(zipPath) {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- zipPath is constructed from validated outputPath
     const stats = statSync(zipPath);
     const bytes = stats.size;
     if (bytes >= ZIP_SIZE_ERROR_BYTES) {
@@ -1855,7 +1856,6 @@ async function createNpmPackage(outputPath, metadata) {
         files: ['**/*.md'],
     };
     const packageJsonPath = safePath.join(outputPath, PACKAGE_JSON_FILENAME);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is constructed from validated outputPath
     await writeFile(packageJsonPath, JSON.stringify(packageJson, null, 2), 'utf-8');
     // For now, just return a placeholder path
     // Full npm pack implementation would require running `npm pack`
@@ -1880,7 +1880,6 @@ async function createMarketplaceManifest(outputPath, metadata) {
         created: new Date().toISOString(),
     };
     const manifestPath = safePath.join(dirname(outputPath), `${metadata.name}.marketplace.json`);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is constructed from validated outputPath
     await writeFile(manifestPath, JSON.stringify(manifest, null, 2), 'utf-8');
     return manifestPath;
 }
@@ -1894,6 +1893,15 @@ async function createMarketplaceManifest(outputPath, metadata) {
  * @returns Default output path
  */
 function getDefaultSkillOutputPath(skillPath, skillName) {
+    // The name may have come from the H1 title when frontmatter carries none,
+    // and the directory this returns is `rm -rf`'d before the package is
+    // written: a SKILL.md headed `# ../../../canary` used to delete `<root>/canary`
+    // through the public `packageSkill` export, issues empty, `hasErrors` false.
+    if (!isSingleFsSegment(skillName)) {
+        throw new VatError('SKILL_NAME_NOT_A_SEGMENT', `Cannot derive an output directory from skill name "${skillName}": a name must be a single ` +
+            `path segment (no separators, not "." or ".."). Declare \`name:\` in the SKILL.md frontmatter ` +
+            `or pass an explicit outputPath.`);
+    }
     const skillPackageRoot = findPackageRoot(skillPath);
     return safePath.join(skillPackageRoot, 'dist', 'skills', skillName);
 }
@@ -1912,7 +1920,6 @@ function findPackageRoot(skillPath, fallbackToSkillDir = false) {
     // Walk up until we find a package.json or hit the filesystem root
     while (currentDir !== dirname(currentDir)) {
         const packageJsonPath = safePath.join(currentDir, PACKAGE_JSON_FILENAME);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Searching for package.json
         if (existsSync(packageJsonPath)) {
             return currentDir;
         }