agentskeptic 1.0.4 → 1.2.0

package/schemas/tools-registry.schema.json

@@ -72,12 +72,115 @@
                 "items": { "$ref": "#/$defs/sqlRelationalCheck" }
               }
             }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "provider", "documentId", "indexName"],
+            "properties": {
+              "kind": { "const": "vector_document" },
+              "provider": { "type": "string", "enum": ["pinecone", "weaviate", "chroma"] },
+              "documentId": { "$ref": "#/$defs/stringSpec" },
+              "indexName": { "$ref": "#/$defs/stringSpec" },
+              "namespace": { "$ref": "#/$defs/stringSpec" },
+              "host": { "$ref": "#/$defs/stringSpec" },
+              "metadataEq": { "$ref": "#/$defs/requiredFieldsPointer" },
+              "expectPayloadSha256": { "$ref": "#/$defs/stringSpec" }
+            }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "bucket", "key"],
+            "properties": {
+              "kind": { "const": "object_storage_object" },
+              "bucket": { "$ref": "#/$defs/stringSpec" },
+              "key": { "$ref": "#/$defs/stringSpec" },
+              "endpoint": { "$ref": "#/$defs/stringSpec" },
+              "expectSizeBytes": { "$ref": "#/$defs/numberOrPointerSpec" },
+              "expectSha256": { "$ref": "#/$defs/stringSpec" },
+              "expectEtag": { "$ref": "#/$defs/stringSpec" }
+            }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "url"],
+            "properties": {
+              "kind": { "const": "http_witness" },
+              "method": { "type": "string", "enum": ["GET", "POST"] },
+              "url": { "$ref": "#/$defs/stringSpec" },
+              "expectedStatus": { "$ref": "#/$defs/numberOrPointerSpec" },
+              "assertions": {
+                "type": "array",
+                "items": { "$ref": "#/$defs/httpWitnessAssertion" }
+              }
+            }
+          },
+          {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "collection", "filterPointer", "requiredFields"],
+            "properties": {
+              "kind": { "const": "mongo_document" },
+              "collection": { "$ref": "#/$defs/stringSpec" },
+              "filterPointer": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["pointer"],
+                "properties": {
+                  "pointer": { "type": "string", "pattern": "^/" }
+                }
+              },
+              "requiredFields": { "$ref": "#/$defs/requiredFieldsPointer" }
+            }
           }
         ]
       }
     }
   },
   "$defs": {
+    "stringSpec": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["const"],
+          "properties": { "const": { "type": "string", "minLength": 1 } }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["pointer"],
+          "properties": { "pointer": { "type": "string", "pattern": "^/" } }
+        }
+      ]
+    },
+    "numberOrPointerSpec": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["const"],
+          "properties": { "const": { "type": "number" } }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["pointer"],
+          "properties": { "pointer": { "type": "string", "pattern": "^/" } }
+        }
+      ]
+    },
+    "httpWitnessAssertion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["jsonPointer", "value"],
+      "properties": {
+        "jsonPointer": { "type": "string", "minLength": 1 },
+        "value": { "$ref": "#/$defs/scalarOrPointer" }
+      }
+    },
     "tableSpec": {
       "oneOf": [
         {

package/schemas/workflow-engine-result.schema.json

@@ -414,6 +414,70 @@
         }
       }
     },
+    "verificationRequestVectorDocument": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "provider", "documentId", "indexName"],
+      "properties": {
+        "kind": { "const": "vector_document" },
+        "provider": { "type": "string", "enum": ["pinecone", "weaviate", "chroma"] },
+        "documentId": { "type": "string", "minLength": 1 },
+        "indexName": { "type": "string", "minLength": 1 },
+        "namespace": { "type": "string" },
+        "host": { "type": "string", "minLength": 1 },
+        "metadataSubset": { "type": "object", "additionalProperties": true },
+        "expectPayloadSha256": { "type": "string", "minLength": 1 }
+      }
+    },
+    "verificationRequestObjectStorageObject": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "bucket", "key"],
+      "properties": {
+        "kind": { "const": "object_storage_object" },
+        "bucket": { "type": "string", "minLength": 1 },
+        "key": { "type": "string", "minLength": 1 },
+        "endpoint": { "type": "string", "minLength": 1 },
+        "expectSizeBytes": { "type": "number", "minimum": 0 },
+        "expectSha256": { "type": "string", "minLength": 1 },
+        "expectEtag": { "type": "string", "minLength": 1 }
+      }
+    },
+    "httpWitnessResolvedAssertion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["jsonPointer", "value"],
+      "properties": {
+        "jsonPointer": { "type": "string", "minLength": 1 },
+        "value": { "type": ["string", "number", "boolean", "null"] }
+      }
+    },
+    "verificationRequestHttpWitness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "method", "url"],
+      "properties": {
+        "kind": { "const": "http_witness" },
+        "method": { "type": "string", "enum": ["GET", "POST"] },
+        "url": { "type": "string", "minLength": 1 },
+        "expectedStatus": { "type": "integer", "minimum": 100, "maximum": 599 },
+        "assertions": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/httpWitnessResolvedAssertion" }
+        }
+      }
+    },
+    "verificationRequestMongoDocument": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "collection", "filter", "requiredFields"],
+      "properties": {
+        "kind": { "const": "mongo_document" },
+        "collection": { "type": "string", "minLength": 1 },
+        "filter": { "type": "object", "additionalProperties": true },
+        "requiredFields": { "$ref": "#/$defs/requiredFieldsMap" }
+      }
+    },
     "effectOutcome": {
       "type": "object",
       "additionalProperties": false,
@@ -478,7 +542,11 @@
                 { "$ref": "#/$defs/verificationRequestSqlRow" },
                 { "$ref": "#/$defs/verificationRequestSqlRowAbsent" },
                 { "$ref": "#/$defs/verificationRequestSqlEffects" },
-                { "$ref": "#/$defs/verificationRequestSqlRelational" }
+                { "$ref": "#/$defs/verificationRequestSqlRelational" },
+                { "$ref": "#/$defs/verificationRequestVectorDocument" },
+                { "$ref": "#/$defs/verificationRequestObjectStorageObject" },
+                { "$ref": "#/$defs/verificationRequestHttpWitness" },
+                { "$ref": "#/$defs/verificationRequestMongoDocument" }
               ]
             },
             "status": {

package/schemas/workflow-truth-report.schema.json

@@ -624,6 +624,18 @@
                 },
                 {
                   "$ref": "https://agentskeptic.com/schemas/workflow-engine-result.schema.json#/$defs/verificationRequestSqlRelational"
+                },
+                {
+                  "$ref": "https://agentskeptic.com/schemas/workflow-engine-result.schema.json#/$defs/verificationRequestVectorDocument"
+                },
+                {
+                  "$ref": "https://agentskeptic.com/schemas/workflow-engine-result.schema.json#/$defs/verificationRequestObjectStorageObject"
+                },
+                {
+                  "$ref": "https://agentskeptic.com/schemas/workflow-engine-result.schema.json#/$defs/verificationRequestHttpWitness"
+                },
+                {
+                  "$ref": "https://agentskeptic.com/schemas/workflow-engine-result.schema.json#/$defs/verificationRequestMongoDocument"
                 }
               ]
             }

package/scripts/discovery-acquisition.lib.cjs

@@ -2,8 +2,6 @@
 
 const { existsSync, readFileSync, readdirSync } = require("node:fs");
 const { join } = require("node:path");
-const Ajv = require("ajv");
-const addFormats = require("ajv-formats");
 
 const PLACEHOLDER_KEYS = [
   ["{{ORIGIN}}", "ORIGIN"],
@@ -20,8 +18,7 @@ const PLACEHOLDER_KEYS = [
  */
 function discoveryPaths(root) {
   return {
-    jsonPath: join(root, "config", "discovery-acquisition.json"),
-    schemaPath: join(root, "config", "discovery-acquisition.schema.json"),
+    jsonPath: join(root, "config", "marketing.json"),
   };
 }
 
@@ -177,20 +174,12 @@ function appendDiscoveryLlmsAppendix(baseLlms, discovery, canonicalOrigin) {
  * @param {string} root
  */
 function validateDiscoveryAcquisition(root) {
-  const { jsonPath, schemaPath } = discoveryPaths(root);
+  const { jsonPath } = discoveryPaths(root);
+  const { validateMarketing } = require("./validate-marketing.cjs");
+  validateMarketing(root);
   const discovery = JSON.parse(readFileSync(jsonPath, "utf8"));
-  const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
-  const ajv = new Ajv({ allErrors: true, strict: true });
-  addFormats(ajv);
-  const validate = ajv.compile(schema);
-  if (!validate(discovery)) {
-    const msg = ajv.errorsText(validate.errors, { separator: "\n" });
-    throw new Error(`discovery-acquisition: schema validation failed:\n${msg}`);
-  }
-  const anchorsPath = join(root, "config", "public-product-anchors.json");
-  const anchors = JSON.parse(readFileSync(anchorsPath, "utf8"));
-  const { normalize } = require("./public-product-anchors.cjs");
-  const origin = normalize(anchors.productionCanonicalOrigin);
+  const { normalize } = require("./origin.cjs");
+  const origin = normalize(String(discovery.productionCanonicalOrigin));
   buildDiscoveryFoldBody(discovery, origin);
   const demo = discovery.shareableTerminalDemo;
   if (demo && String(demo.transcript).includes("```")) {

package/scripts/discovery-payload.lib.cjs

@@ -132,8 +132,10 @@ function buildDiscoveryPayload(root) {
     problemAnchor: padAnchor(path),
     embedKey: embedKeyForExamplePath(path),
   }));
-  const anchorsPath = join(root, "config", "public-product-anchors.json");
-  const anchors = JSON.parse(readFileSync(anchorsPath, "utf8"));
+  const pm = /** @type {{ productionCanonicalOrigin: string; identityOneLiner: string; gitRepositoryUrl: string; npmPackageUrl: string }} */ (
+    discovery
+  );
+  const anchors = pm;
   const canonicalOrigin = normalizeOrigin(anchors.productionCanonicalOrigin);
   const integrateUrl = `${canonicalOrigin}/integrate`;
   const learnHubUrl = `${canonicalOrigin}/guides`;
@@ -141,7 +143,7 @@ function buildDiscoveryPayload(root) {
   const { owner, repo } = parseGithubRepoFromUrl(anchors.gitRepositoryUrl);
   const llmsRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${DISCOVERY_LLM_BRANCH}/llms.txt`;
   const llmsBlob = `https://github.com/${owner}/${repo}/blob/${DISCOVERY_LLM_BRANCH}/llms.txt`;
-  const integratorVerificationSsotRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${DISCOVERY_LLM_BRANCH}/docs/integrator-verification-ssot.md`;
+  const integratorVerificationSsotRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${DISCOVERY_LLM_BRANCH}/docs/integrator-verification.md`;
   const openapiRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${DISCOVERY_LLM_BRANCH}/schemas/openapi-commercial-v1.yaml`;
   const llms = /** @type {{ intentPhrases: string[]; notFor: string[]; relatedQueries: string[] }} */ (
     discovery.llms

package/scripts/emit-primary-marketing.cjs

@@ -0,0 +1,326 @@
+"use strict";
+
+const { readFileSync, writeFileSync, mkdirSync } = require("node:fs");
+const { join, dirname } = require("node:path");
+const { normalize, assertNextPublicOriginParity, MARKETING_PATH } = require("./origin.cjs");
+
+const ROOT = join(__dirname, "..");
+
+const OPENAPI_IN = join(ROOT, "schemas", "openapi-commercial-v1.in.yaml");
+const OPENAPI_OUT = join(ROOT, "schemas", "openapi-commercial-v1.yaml");
+const OPENAPI_PUBLIC = join(ROOT, "website", "public", "openapi-commercial-v1.yaml");
+const LLMS_PUBLIC = join(ROOT, "website", "public", "llms.txt");
+const LLMS_REPO_ROOT = join(ROOT, "llms.txt");
+const README_PATH = join(ROOT, "README.md");
+const PKG_PATH = join(ROOT, "package.json");
+
+const README_START = "<!-- public-product-anchors:start -->";
+const README_END = "<!-- public-product-anchors:end -->";
+const DISCOVERY_README_START = "<!-- discovery-acquisition-fold:start -->";
+const DISCOVERY_README_END = "<!-- discovery-acquisition-fold:end -->";
+const DISCOVERY_README_TITLE_START = "<!-- discovery-readme-title:start -->";
+const DISCOVERY_README_TITLE_END = "<!-- discovery-readme-title:end -->";
+
+const TOKENS = [
+  "__IDENTITY_ONE_LINER__",
+  "__DISTRIBUTION_CONTACT_URL__",
+  "__DISTRIBUTION_INTEGRATE_URL__",
+  "__DISTRIBUTION_REPO_URL__",
+  "__DISTRIBUTION_NPM_URL__",
+  "__OPENAPI_SELF_URL__",
+  "__SERVERS_ORIGIN__",
+];
+
+/**
+ * @param {string} haystack
+ * @param {string} needle
+ */
+function countOccurrences(haystack, needle) {
+  let n = 0;
+  let i = 0;
+  while (true) {
+    const j = haystack.indexOf(needle, i);
+    if (j === -1) break;
+    n++;
+    i = j + needle.length;
+  }
+  return n;
+}
+
+function validateOpenapiTemplate() {
+  const template = readFileSync(OPENAPI_IN, "utf8");
+  for (const tok of TOKENS) {
+    const c = countOccurrences(template, tok);
+    if (c !== 1) {
+      throw new Error(`openapi template: token ${tok} must appear exactly once, found ${c}`);
+    }
+  }
+}
+
+function escapeYamlDoubleQuotedOneLiner(s) {
+  return String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+/**
+ * @param {Record<string, unknown>} anchors
+ */
+function distributionSsotBlobUrl(anchors) {
+  const u = String(anchors.gitRepositoryUrl);
+  const m = u.match(/github\.com\/([^/]+)\/([^/#?]+)/i);
+  if (!m) throw new Error("emit-primary-marketing: cannot derive SSOT blob URL from gitRepositoryUrl");
+  const repo = m[2].replace(/\.git$/i, "");
+  return `https://github.com/${m[1]}/${repo}/blob/main/docs/public-distribution.md`;
+}
+
+/**
+ * @param {string} line
+ * @param {string} origin
+ * @param {string} slug
+ */
+function expandCliFooterLine(line, origin, slug) {
+  const acquisitionUrl = `${origin}${slug}`;
+  const integrateUrl = `${origin}/integrate`;
+  let out = String(line)
+    .replace(/\{\{ORIGIN\}\}/g, origin)
+    .replace(/\{\{ACQUISITION_URL\}\}/g, acquisitionUrl)
+    .replace(/\{\{INTEGRATE_URL\}\}/g, integrateUrl);
+  if (out.includes("{{")) {
+    throw new Error(`emit-primary-marketing: unresolved placeholder in cliFollowupLines: ${line}`);
+  }
+  return out;
+}
+
+/**
+ * @param {Record<string, unknown>} anchors
+ * @param {Record<string, unknown>} discovery
+ */
+function writePublicDistributionGenerated(anchors, discovery) {
+  const ssotUrl = distributionSsotBlobUrl(anchors);
+  const origin = normalize(anchors.productionCanonicalOrigin);
+  const slug = String(discovery.slug);
+  const cliLines = /** @type {string[]} */ (discovery.cliFollowupLines);
+  const expanded = cliLines.map((l) => expandCliFooterLine(l, origin, slug));
+  expanded.push(`Distribution contract (SSOT): ${ssotUrl}`);
+  if (expanded.length > 6) {
+    throw new Error(
+      `emit-primary-marketing: distribution footer exceeds 6 lines (${expanded.length}); shorten cliFollowupLines`,
+    );
+  }
+  const returnParts = expanded.map((line) => `${JSON.stringify(`${line}\n`)}`);
+  const pkgRaw = readFileSync(PKG_PATH, "utf8");
+  const pkgJson = JSON.parse(pkgRaw);
+  const cliSemver = String(pkgJson.version ?? "").trim();
+  if (!cliSemver) {
+    throw new Error("emit-primary-marketing: package.json missing version");
+  }
+  const body = `// Generated by npm run emit-primary-marketing — do not hand edit.
+
+export const PUBLIC_DISTRIBUTION_SSOT_BLOB_URL = ${JSON.stringify(ssotUrl)};
+
+export const PUBLIC_CANONICAL_SITE_ORIGIN = ${JSON.stringify(origin)};
+
+export const AGENTSKEPTIC_CLI_SEMVER = ${JSON.stringify(cliSemver)};
+
+export function formatDistributionFooter(): string {
+  return ${returnParts.join("\n    + ")};
+}
+`;
+  writeFileSync(join(ROOT, "src", "publicDistribution.generated.ts"), body, "utf8");
+}
+
+/**
+ * @param {Record<string, unknown>} anchors
+ * @param {Record<string, unknown>} discovery
+ */
+function writeAgentsMd(anchors, discovery) {
+  const url = distributionSsotBlobUrl(anchors);
+  const origin = normalize(anchors.productionCanonicalOrigin);
+  const slug = String(discovery.slug);
+  const acquisitionUrl = `${origin}${slug}`;
+  const dp = require("./discovery-payload.lib.cjs");
+  const { owner, repo } = dp.parseGithubRepoFromUrl(String(anchors.gitRepositoryUrl));
+  const branch = dp.DISCOVERY_LLM_BRANCH;
+  const llmsRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${branch}/llms.txt`;
+  const openapiRaw = `https://raw.githubusercontent.com/${owner}/${repo}/refs/heads/${branch}/schemas/openapi-commercial-v1.yaml`;
+  const body = `# AGENTS
+
+Normative **public distribution** and anchor sync: [\`docs/public-distribution.md\`](docs/public-distribution.md) (same content as ${url}).
+
+## Machine-readable product entrypoints
+
+- Committed \`llms.txt\` at repo root (same bytes as site \`/llms.txt\` after prebuild sync).
+- Raw GitHub \`llms.txt\`: ${llmsRaw}
+- OpenAPI YAML (repo raw): ${openapiRaw}
+- Acquisition page (canonical): ${acquisitionUrl}
+`;
+  writeFileSync(join(ROOT, "AGENTS.md"), body, "utf8");
+}
+
+function syncPrimaryMarketing() {
+  const discoveryLib = require("./discovery-acquisition.lib.cjs");
+  discoveryLib.validateDiscoveryAcquisition(ROOT);
+  const pm = discoveryLib.loadDiscoveryAcquisition(ROOT);
+  const anchors = pm;
+  const discovery = pm;
+
+  validateOpenapiTemplate();
+
+  const escaped = escapeYamlDoubleQuotedOneLiner(anchors.identityOneLiner);
+  const canonicalOrigin = normalize(anchors.productionCanonicalOrigin);
+  const openapiSelfCanonical = `${canonicalOrigin}/openapi-commercial-v1.yaml`;
+
+  const envUrl = process.env.NEXT_PUBLIC_APP_URL;
+  const effectivePublicOrigin =
+    typeof envUrl === "string" && envUrl.trim() ? envUrl.trim() : anchors.productionCanonicalOrigin;
+  const publicOriginNormalized = normalize(effectivePublicOrigin);
+  const openapiSelfEffective = `${publicOriginNormalized}/openapi-commercial-v1.yaml`;
+
+  const integrateUrl = `${canonicalOrigin}/integrate`;
+
+  const template = readFileSync(OPENAPI_IN, "utf8");
+  let mid = template;
+  mid = mid.replace("__IDENTITY_ONE_LINER__", escaped);
+  mid = mid.replace("__DISTRIBUTION_CONTACT_URL__", canonicalOrigin);
+  mid = mid.replace("__DISTRIBUTION_INTEGRATE_URL__", integrateUrl);
+  mid = mid.replace("__DISTRIBUTION_REPO_URL__", anchors.gitRepositoryUrl);
+  mid = mid.replace("__DISTRIBUTION_NPM_URL__", anchors.npmPackageUrl);
+
+  const repoYaml = mid
+    .replace("__SERVERS_ORIGIN__", canonicalOrigin)
+    .replace("__OPENAPI_SELF_URL__", openapiSelfCanonical);
+  writeFileSync(OPENAPI_OUT, repoYaml, "utf8");
+
+  mkdirSync(dirname(OPENAPI_PUBLIC), { recursive: true });
+  const publicYaml = mid
+    .replace("__SERVERS_ORIGIN__", publicOriginNormalized)
+    .replace("__OPENAPI_SELF_URL__", openapiSelfEffective);
+  writeFileSync(OPENAPI_PUBLIC, publicYaml, "utf8");
+
+  const discoveryPayload = require("./discovery-payload.lib.cjs");
+  const discoveryPayloadObj = discoveryPayload.buildDiscoveryPayload(ROOT);
+  const llmsNormalized = discoveryPayload.renderLlmsTextFromPayload(discoveryPayloadObj);
+
+  mkdirSync(dirname(LLMS_PUBLIC), { recursive: true });
+  writeFileSync(LLMS_PUBLIC, llmsNormalized, "utf8");
+  writeFileSync(LLMS_REPO_ROOT, llmsNormalized, "utf8");
+
+  const pkgRaw = readFileSync(PKG_PATH, "utf8");
+  const pkg = JSON.parse(pkgRaw);
+  pkg.description = String(discovery.pageMetadata.description);
+  pkg.repository = { type: "git", url: anchors.gitRepositoryGitUrl };
+  pkg.homepage = `${canonicalOrigin}${String(discovery.slug)}`;
+  pkg.bugs = { url: anchors.bugsUrl };
+  pkg.keywords = anchors.keywords;
+  writeFileSync(PKG_PATH, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+
+  let readme = readFileSync(README_PATH, "utf8");
+  if (!readme.includes(DISCOVERY_README_TITLE_START) || !readme.includes(DISCOVERY_README_TITLE_END)) {
+    throw new Error("README.md must contain discovery-readme-title markers");
+  }
+  const titleBody = `# ${String(discovery.readmeTitle)}`;
+  const titleBlock = `${DISCOVERY_README_TITLE_START}\n${titleBody}\n${DISCOVERY_README_TITLE_END}`;
+  const titleRe = new RegExp(
+    `${DISCOVERY_README_TITLE_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${DISCOVERY_README_TITLE_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`,
+  );
+  if (!titleRe.test(readme)) {
+    throw new Error("README: could not match discovery-readme-title region");
+  }
+  readme = readme.replace(titleRe, titleBlock);
+
+  if (!readme.includes(DISCOVERY_README_START) || !readme.includes(DISCOVERY_README_END)) {
+    throw new Error("README.md must contain discovery-acquisition-fold markers");
+  }
+  const foldBody = discoveryLib.buildDiscoveryFoldBody(discovery, canonicalOrigin);
+  const discBlock = `${DISCOVERY_README_START}\n${foldBody}\n${DISCOVERY_README_END}`;
+  const discRe = new RegExp(
+    `${DISCOVERY_README_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${DISCOVERY_README_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`,
+  );
+  if (!discRe.test(readme)) {
+    throw new Error("README: could not match discovery-acquisition-fold region");
+  }
+  readme = readme.replace(discRe, discBlock);
+
+  if (!readme.includes(README_START) || !readme.includes(README_END)) {
+    throw new Error("README.md must contain public-product-anchors markers");
+  }
+  const pl = discoveryPayloadObj.links;
+  const inner = [
+    anchors.identityOneLiner,
+    "",
+    `- **Repository:** ${anchors.gitRepositoryUrl}`,
+    `- **npm package:** ${anchors.npmPackageUrl}`,
+    `- **Canonical site:** ${canonicalOrigin}`,
+    `- **Integrate:** ${integrateUrl}`,
+    `- **OpenAPI (canonical):** ${openapiSelfCanonical}`,
+    `- **llms.txt (agents, site):** ${canonicalOrigin}/llms.txt`,
+    `- **llms.txt (repo, raw):** ${pl.llmsRaw}`,
+    `- **llms.txt (repo, blob):** ${pl.llmsBlob}`,
+    "",
+  ].join("\n");
+  const block = `${README_START}\n${inner}\n${README_END}`;
+  const re = new RegExp(
+    `${README_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${README_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`,
+  );
+  if (!re.test(readme)) {
+    throw new Error("README: could not match public-product-anchors region");
+  }
+  readme = readme.replace(re, block);
+  writeFileSync(README_PATH, readme, "utf8");
+
+  writePublicDistributionGenerated(anchors, discovery);
+  writeAgentsMd(anchors, discovery);
+}
+
+function validateForCheck() {
+  const discoveryLib = require("./discovery-acquisition.lib.cjs");
+  discoveryLib.validateDiscoveryAcquisition(ROOT);
+  validateOpenapiTemplate();
+  const pm = JSON.parse(readFileSync(MARKETING_PATH, "utf8"));
+  const required = [
+    "identityOneLiner",
+    "productionCanonicalOrigin",
+    "gitRepositoryUrl",
+    "gitRepositoryGitUrl",
+    "npmPackageUrl",
+    "bugsUrl",
+    "keywords",
+  ];
+  for (const k of required) {
+    if (pm[k] === undefined || pm[k] === null) {
+      throw new Error(`marketing: missing ${k}`);
+    }
+  }
+  if (!Array.isArray(pm.keywords) || pm.keywords.length === 0) {
+    throw new Error("marketing: keywords must be a non-empty array");
+  }
+}
+
+function main() {
+  validateForCheck();
+  if (process.argv.includes("--check")) {
+    return;
+  }
+  syncPrimaryMarketing();
+}
+
+/** @deprecated use syncPrimaryMarketing */
+const syncPublicProductAnchors = syncPrimaryMarketing;
+/** @deprecated use validateForCheck */
+const validateAnchors = validateForCheck;
+
+module.exports = {
+  validateAnchors,
+  syncPublicProductAnchors,
+  syncPrimaryMarketing,
+  assertNextPublicOriginParity,
+  normalize,
+};
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : e);
+    process.exit(1);
+  }
+}

package/scripts/origin.cjs

@@ -0,0 +1,52 @@
+"use strict";
+
+const { readFileSync } = require("node:fs");
+const { join } = require("node:path");
+
+const ROOT = join(__dirname, "..");
+const MARKETING_PATH = join(ROOT, "config", "marketing.json");
+
+/**
+ * @param {string} s
+ */
+function normalize(s) {
+  const t = String(s).trim();
+  if (!t) throw new Error("normalize: empty origin");
+  const u = new URL(t);
+  return u.origin;
+}
+
+function isLoopbackOrigin(raw) {
+  try {
+    const u = new URL(normalize(raw));
+    const h = u.hostname.toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "[::1]";
+  } catch {
+    return false;
+  }
+}
+
+function readProductionCanonicalOrigin() {
+  const pm = JSON.parse(readFileSync(MARKETING_PATH, "utf8"));
+  return String(pm.productionCanonicalOrigin);
+}
+
+function assertNextPublicOriginParity() {
+  const canonicalFromJson = readProductionCanonicalOrigin();
+  const skip = process.env.NODE_ENV !== "production" || process.env.VERCEL_ENV === "preview";
+  if (skip) return;
+  const url = String(process.env.NEXT_PUBLIC_APP_URL || "").trim();
+  if (!url) return;
+  if (normalize(url) !== normalize(canonicalFromJson)) {
+    if (process.env.VERCEL_ENV !== "production" && isLoopbackOrigin(url)) return;
+    throw new Error("NEXT_PUBLIC_APP_URL must equal productionCanonicalOrigin");
+  }
+}
+
+module.exports = {
+  normalize,
+  assertNextPublicOriginParity,
+  MARKETING_PATH,
+  /** @deprecated use MARKETING_PATH */
+  PRIMARY_MARKETING_PATH: MARKETING_PATH,
+};

package/scripts/public-product-anchors.cjs

@@ -0,0 +1,3 @@
+"use strict";
+/** @deprecated Re-export — use `emit-primary-marketing.cjs` and `config/marketing.json`. */
+module.exports = require("./emit-primary-marketing.cjs");