omk-book-to-skill 0.96.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+Copyright (c) 2025 virgiliojr94
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# omk-book-to-skill
+
+Optional OMK package for compiling documents into reusable Agent Skills. It combines a pinned `book-to-skill` workflow with OMK commands and a local provenance verifier.
+
+## Install
+
+From npm after publication:
+
+```bash
+omk install npm:omk-book-to-skill@0.95.2
+```
+
+From this repository:
+
+```bash
+npm run build --workspace packages/book-to-skill
+omk install ./packages/book-to-skill
+```
+
+Python 3.9 or newer is required for extraction. Format-specific packages such as `pypdf`, `python-docx`, and Docling are optional and stay in the user's Python environment; this npm package installs none of them.
+
+## Use
+
+```text
+/book-to-skill-compile <source...>
+/book-to-skill-update <existing-skill> <new-source...>
+/book-to-skill-verify <generated-skill-directory>
+```
+
+The package also installs the `book-to-skill` skill, so `/skill:book-to-skill` and `!book-to-skill` remain available.
+
+The workflow records provenance after generation through `scripts/provenance.mjs`, resolved relative to the bundled skill. In a normal npm installation where the package bin is on `PATH`, the equivalent commands are:
+
+```bash
+omk-book-to-skill record --skill ~/.omk/agent/skills/example --source ./book.pdf
+omk-book-to-skill verify --skill ~/.omk/agent/skills/example --source ./book.pdf
+```
+
+Repeat `--source` in the original order for multi-source compilations. Use `record --merge-sources` after folding new sources into an existing skill.
+
+## Verification boundary
+
+The v1 manifest records SHA-256 digests for source files and generated artifacts. `verify` also runs the pinned upstream advisory prompt-injection scanner.
+
+This checks local byte-level consistency against an unsigned manifest. It does not authenticate the manifest or prove authorship, licensing, trusted attestation, or semantic claim-to-source grounding. The latter requires a future span/claim evaluation layer.
+
+## Upstream
+
+The runtime subset under `vendor/book-to-skill/` is an unmodified snapshot of [`virgiliojr94/book-to-skill`](https://github.com/virgiliojr94/book-to-skill) commit `c4c5e948caaa912c9e2024b925a7cdee9237b0c0` (declared upstream version `1.4.0`). `upstream.json` pins every vendored file by SHA-256.
+
+## Development
+
+```bash
+npm test --workspace packages/book-to-skill
+npm run build --workspace packages/book-to-skill
+```

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"","sourcesContent":["#!/usr/bin/env node\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { parseArgs } from \"node:util\";\nimport { COMPILER_IDENTITY } from \"./metadata.ts\";\nimport { recordProvenance, verifyProvenance } from \"./provenance.ts\";\n\nconst PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst SCANNER_PATH = resolve(PACKAGE_ROOT, \"vendor\", \"book-to-skill\", \"tools\", \"scan_generated_skill.py\");\n\ninterface ScannerReport {\n\treadonly status: \"pass\" | \"fail\" | \"inconclusive\" | \"unavailable\" | \"skipped\";\n\treadonly command?: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n}\n\nfunction usage(): string {\n\treturn `Usage:\n  omk-book-to-skill record --skill <dir> --source <file> [--source <file>...] [--merge-sources]\n  omk-book-to-skill verify --skill <dir> [--source <file>...]\n\nrecord writes ${\".book-to-skill-provenance.json\"} after generation.\nverify checks artifact hashes, optionally rechecks exact source files, and runs the bundled advisory scanner.`;\n}\n\nfunction parseCommandOptions(args: readonly string[]) {\n\treturn parseArgs({\n\t\targs,\n\t\tallowPositionals: false,\n\t\tstrict: true,\n\t\toptions: {\n\t\t\tskill: { type: \"string\" },\n\t\t\tsource: { type: \"string\", multiple: true },\n\t\t\t\"merge-sources\": { type: \"boolean\", default: false },\n\t\t},\n\t});\n}\n\nfunction pythonCandidates(): string[] {\n\tconst configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();\n\treturn [...new Set([configured, \"python3\", \"python\"].filter((value): value is string => Boolean(value)))];\n}\n\nfunction runScanner(skillDir: string): ScannerReport {\n\tif (!existsSync(SCANNER_PATH))\n\t\treturn { status: \"unavailable\", stderr: `Bundled scanner is missing: ${SCANNER_PATH}` };\n\tfor (const python of pythonCandidates()) {\n\t\tconst result = spawnSync(python, [SCANNER_PATH, skillDir], {\n\t\t\tencoding: \"utf8\",\n\t\t\tmaxBuffer: 10 * 1024 * 1024,\n\t\t\tshell: false,\n\t\t\ttimeout: 120_000,\n\t\t});\n\t\tif (result.error && \"code\" in result.error && result.error.code === \"ENOENT\") continue;\n\t\treturn {\n\t\t\tstatus: result.status === 0 ? \"pass\" : result.status === 1 ? \"fail\" : \"inconclusive\",\n\t\t\tcommand: python,\n\t\t\tstdout: result.stdout?.trim() || undefined,\n\t\t\tstderr: result.stderr?.trim() || result.error?.message,\n\t\t};\n\t}\n\treturn { status: \"unavailable\", stderr: \"Neither python3 nor python is available\" };\n}\n\nfunction writeJson(value: unknown): void {\n\tprocess.stdout.write(`${JSON.stringify(value, undefined, 2)}\\n`);\n}\n\nfunction requireSkill(value: string | undefined): string {\n\tif (!value) throw new Error(\"--skill is required\");\n\treturn resolve(value);\n}\n\nfunction record(args: readonly string[]): number {\n\tconst { values } = parseCommandOptions(args);\n\tconst sources = values.source ?? [];\n\tif (sources.length === 0 && !values[\"merge-sources\"]) throw new Error(\"record requires at least one --source\");\n\tconst manifest = recordProvenance({\n\t\tskillDir: requireSkill(values.skill),\n\t\tsources,\n\t\tcompiler: COMPILER_IDENTITY,\n\t\tmergeSources: values[\"merge-sources\"],\n\t});\n\twriteJson({ status: \"recorded\", manifest });\n\treturn 0;\n}\n\nfunction verify(args: readonly string[]): number {\n\tconst { values } = parseCommandOptions(args);\n\tconst skillDir = requireSkill(values.skill);\n\tconst provenance = verifyProvenance({ skillDir, sources: values.source });\n\tconst scanner = provenance.artifactIntegrity === \"pass\" ? runScanner(skillDir) : { status: \"skipped\" as const };\n\twriteJson({ provenance, scanner });\n\tif (provenance.status === \"fail\" || scanner.status === \"fail\") return 1;\n\tif (provenance.status === \"inconclusive\" || scanner.status !== \"pass\") return 2;\n\treturn 0;\n}\n\nfunction main(): number {\n\tconst [command, ...args] = process.argv.slice(2);\n\tif (!command || command === \"-h\" || command === \"--help\") {\n\t\tprocess.stdout.write(`${usage()}\\n`);\n\t\treturn command ? 0 : 2;\n\t}\n\tif (command === \"record\") return record(args);\n\tif (command === \"verify\") return verify(args);\n\tthrow new Error(`Unknown command: ${command}`);\n}\n\ntry {\n\tprocess.exitCode = main();\n} catch (error) {\n\tprocess.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n\\n${usage()}\\n`);\n\tprocess.exitCode = 2;\n}\n"]}

package/dist/cli.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { COMPILER_IDENTITY } from "./metadata.js";
+import { recordProvenance, verifyProvenance } from "./provenance.js";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const SCANNER_PATH = resolve(PACKAGE_ROOT, "vendor", "book-to-skill", "tools", "scan_generated_skill.py");
+function usage() {
+    return `Usage:
+  omk-book-to-skill record --skill <dir> --source <file> [--source <file>...] [--merge-sources]
+  omk-book-to-skill verify --skill <dir> [--source <file>...]
+
+record writes ${".book-to-skill-provenance.json"} after generation.
+verify checks artifact hashes, optionally rechecks exact source files, and runs the bundled advisory scanner.`;
+}
+function parseCommandOptions(args) {
+    return parseArgs({
+        args,
+        allowPositionals: false,
+        strict: true,
+        options: {
+            skill: { type: "string" },
+            source: { type: "string", multiple: true },
+            "merge-sources": { type: "boolean", default: false },
+        },
+    });
+}
+function pythonCandidates() {
+    const configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();
+    return [...new Set([configured, "python3", "python"].filter((value) => Boolean(value)))];
+}
+function runScanner(skillDir) {
+    if (!existsSync(SCANNER_PATH))
+        return { status: "unavailable", stderr: `Bundled scanner is missing: ${SCANNER_PATH}` };
+    for (const python of pythonCandidates()) {
+        const result = spawnSync(python, [SCANNER_PATH, skillDir], {
+            encoding: "utf8",
+            maxBuffer: 10 * 1024 * 1024,
+            shell: false,
+            timeout: 120_000,
+        });
+        if (result.error && "code" in result.error && result.error.code === "ENOENT")
+            continue;
+        return {
+            status: result.status === 0 ? "pass" : result.status === 1 ? "fail" : "inconclusive",
+            command: python,
+            stdout: result.stdout?.trim() || undefined,
+            stderr: result.stderr?.trim() || result.error?.message,
+        };
+    }
+    return { status: "unavailable", stderr: "Neither python3 nor python is available" };
+}
+function writeJson(value) {
+    process.stdout.write(`${JSON.stringify(value, undefined, 2)}\n`);
+}
+function requireSkill(value) {
+    if (!value)
+        throw new Error("--skill is required");
+    return resolve(value);
+}
+function record(args) {
+    const { values } = parseCommandOptions(args);
+    const sources = values.source ?? [];
+    if (sources.length === 0 && !values["merge-sources"])
+        throw new Error("record requires at least one --source");
+    const manifest = recordProvenance({
+        skillDir: requireSkill(values.skill),
+        sources,
+        compiler: COMPILER_IDENTITY,
+        mergeSources: values["merge-sources"],
+    });
+    writeJson({ status: "recorded", manifest });
+    return 0;
+}
+function verify(args) {
+    const { values } = parseCommandOptions(args);
+    const skillDir = requireSkill(values.skill);
+    const provenance = verifyProvenance({ skillDir, sources: values.source });
+    const scanner = provenance.artifactIntegrity === "pass" ? runScanner(skillDir) : { status: "skipped" };
+    writeJson({ provenance, scanner });
+    if (provenance.status === "fail" || scanner.status === "fail")
+        return 1;
+    if (provenance.status === "inconclusive" || scanner.status !== "pass")
+        return 2;
+    return 0;
+}
+function main() {
+    const [command, ...args] = process.argv.slice(2);
+    if (!command || command === "-h" || command === "--help") {
+        process.stdout.write(`${usage()}\n`);
+        return command ? 0 : 2;
+    }
+    if (command === "record")
+        return record(args);
+    if (command === "verify")
+        return verify(args);
+    throw new Error(`Unknown command: ${command}`);
+}
+try {
+    process.exitCode = main();
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n\n${usage()}\n`);
+    process.exitCode = 2;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;AAS1G,SAAS,KAAK,GAAW;IACxB,OAAO;;;;gBAIQ,gCAAgC;8GAC8D,CAAC;AAAA,CAC9G;AAED,SAAS,mBAAmB,CAAC,IAAuB,EAAE;IACrD,OAAO,SAAS,CAAC;QAChB,IAAI;QACJ,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE;YACR,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1C,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SACpD;KACD,CAAC,CAAC;AAAA,CACH;AAED,SAAS,gBAAgB,GAAa;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC1G;AAED,SAAS,UAAU,CAAC,QAAgB,EAAiB;IACpD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,YAAY,EAAE,EAAE,CAAC;IACzF,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE;YAC1D,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvF,OAAO;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc;YACpF,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;SACtD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;AAAA,CACpF;AAED,SAAS,SAAS,CAAC,KAAc,EAAQ;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAAA,CACjE;AAED,SAAS,YAAY,CAAC,KAAyB,EAAU;IACxD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CACtB;AAED,SAAS,MAAM,CAAC,IAAuB,EAAU;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QACjC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QACpC,OAAO;QACP,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC;KACrC,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC;AAAA,CACT;AAED,SAAS,MAAM,CAAC,IAAuB,EAAU;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;IAChH,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AAAA,CACT;AAED,SAAS,IAAI,GAAW;IACvB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;AAAA,CAC/C;AAED,IAAI,CAAC;IACJ,OAAO,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC3B,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC;IAClG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport { spawnSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { parseArgs } from \"node:util\";\nimport { COMPILER_IDENTITY } from \"./metadata.ts\";\nimport { recordProvenance, verifyProvenance } from \"./provenance.ts\";\n\nconst PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst SCANNER_PATH = resolve(PACKAGE_ROOT, \"vendor\", \"book-to-skill\", \"tools\", \"scan_generated_skill.py\");\n\ninterface ScannerReport {\n\treadonly status: \"pass\" | \"fail\" | \"inconclusive\" | \"unavailable\" | \"skipped\";\n\treadonly command?: string;\n\treadonly stdout?: string;\n\treadonly stderr?: string;\n}\n\nfunction usage(): string {\n\treturn `Usage:\n  omk-book-to-skill record --skill <dir> --source <file> [--source <file>...] [--merge-sources]\n  omk-book-to-skill verify --skill <dir> [--source <file>...]\n\nrecord writes ${\".book-to-skill-provenance.json\"} after generation.\nverify checks artifact hashes, optionally rechecks exact source files, and runs the bundled advisory scanner.`;\n}\n\nfunction parseCommandOptions(args: readonly string[]) {\n\treturn parseArgs({\n\t\targs,\n\t\tallowPositionals: false,\n\t\tstrict: true,\n\t\toptions: {\n\t\t\tskill: { type: \"string\" },\n\t\t\tsource: { type: \"string\", multiple: true },\n\t\t\t\"merge-sources\": { type: \"boolean\", default: false },\n\t\t},\n\t});\n}\n\nfunction pythonCandidates(): string[] {\n\tconst configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();\n\treturn [...new Set([configured, \"python3\", \"python\"].filter((value): value is string => Boolean(value)))];\n}\n\nfunction runScanner(skillDir: string): ScannerReport {\n\tif (!existsSync(SCANNER_PATH))\n\t\treturn { status: \"unavailable\", stderr: `Bundled scanner is missing: ${SCANNER_PATH}` };\n\tfor (const python of pythonCandidates()) {\n\t\tconst result = spawnSync(python, [SCANNER_PATH, skillDir], {\n\t\t\tencoding: \"utf8\",\n\t\t\tmaxBuffer: 10 * 1024 * 1024,\n\t\t\tshell: false,\n\t\t\ttimeout: 120_000,\n\t\t});\n\t\tif (result.error && \"code\" in result.error && result.error.code === \"ENOENT\") continue;\n\t\treturn {\n\t\t\tstatus: result.status === 0 ? \"pass\" : result.status === 1 ? \"fail\" : \"inconclusive\",\n\t\t\tcommand: python,\n\t\t\tstdout: result.stdout?.trim() || undefined,\n\t\t\tstderr: result.stderr?.trim() || result.error?.message,\n\t\t};\n\t}\n\treturn { status: \"unavailable\", stderr: \"Neither python3 nor python is available\" };\n}\n\nfunction writeJson(value: unknown): void {\n\tprocess.stdout.write(`${JSON.stringify(value, undefined, 2)}\\n`);\n}\n\nfunction requireSkill(value: string | undefined): string {\n\tif (!value) throw new Error(\"--skill is required\");\n\treturn resolve(value);\n}\n\nfunction record(args: readonly string[]): number {\n\tconst { values } = parseCommandOptions(args);\n\tconst sources = values.source ?? [];\n\tif (sources.length === 0 && !values[\"merge-sources\"]) throw new Error(\"record requires at least one --source\");\n\tconst manifest = recordProvenance({\n\t\tskillDir: requireSkill(values.skill),\n\t\tsources,\n\t\tcompiler: COMPILER_IDENTITY,\n\t\tmergeSources: values[\"merge-sources\"],\n\t});\n\twriteJson({ status: \"recorded\", manifest });\n\treturn 0;\n}\n\nfunction verify(args: readonly string[]): number {\n\tconst { values } = parseCommandOptions(args);\n\tconst skillDir = requireSkill(values.skill);\n\tconst provenance = verifyProvenance({ skillDir, sources: values.source });\n\tconst scanner = provenance.artifactIntegrity === \"pass\" ? runScanner(skillDir) : { status: \"skipped\" as const };\n\twriteJson({ provenance, scanner });\n\tif (provenance.status === \"fail\" || scanner.status === \"fail\") return 1;\n\tif (provenance.status === \"inconclusive\" || scanner.status !== \"pass\") return 2;\n\treturn 0;\n}\n\nfunction main(): number {\n\tconst [command, ...args] = process.argv.slice(2);\n\tif (!command || command === \"-h\" || command === \"--help\") {\n\t\tprocess.stdout.write(`${usage()}\\n`);\n\t\treturn command ? 0 : 2;\n\t}\n\tif (command === \"record\") return record(args);\n\tif (command === \"verify\") return verify(args);\n\tthrow new Error(`Unknown command: ${command}`);\n}\n\ntry {\n\tprocess.exitCode = main();\n} catch (error) {\n\tprocess.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n\\n${usage()}\\n`);\n\tprocess.exitCode = 2;\n}\n"]}

package/dist/extension.d.ts

@@ -0,0 +1,5 @@
+import type { ExtensionAPI } from "open-multi-agent-kit";
+export declare function createCompilePrompt(args: string, skillPath?: string): string;
+export declare function createUpdatePrompt(args: string, skillPath?: string): string;
+export default function bookToSkillExtension(omk: ExtensionAPI): void;
+//# sourceMappingURL=extension.d.ts.map

package/dist/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAc,YAAY,EAA2B,MAAM,sBAAsB,CAAC;AAiB9F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAa,GAAG,MAAM,CAEhF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAa,GAAG,MAAM,CAE/E;AA6ED,MAAM,CAAC,OAAO,UAAU,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAepE","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { ExecResult, ExtensionAPI, ExtensionCommandContext } from \"open-multi-agent-kit\";\nimport { verifyProvenance } from \"./provenance.ts\";\n\nconst PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst SKILL_PATH = resolve(PACKAGE_ROOT, \"skills\", \"book-to-skill\", \"SKILL.md\");\nconst SCANNER_PATH = resolve(PACKAGE_ROOT, \"vendor\", \"book-to-skill\", \"tools\", \"scan_generated_skill.py\");\n\nfunction workflowPrompt(mode: \"Full Conversion\" | \"Update / Fold-in\", args: string, skillPath: string): string {\n\treturn [\n\t\t\"Use the bundled OMK book-to-skill workflow for this turn.\",\n\t\t`Read this file completely before acting: ${JSON.stringify(skillPath)}`,\n\t\t`Mode: ${mode}`,\n\t\t`User arguments: ${JSON.stringify(args)}`,\n\t\t\"Treat the arguments as user-supplied path/name data. Follow the skill's validation, confirmation, scan, and provenance gates.\",\n\t].join(\"\\n\");\n}\n\nexport function createCompilePrompt(args: string, skillPath = SKILL_PATH): string {\n\treturn workflowPrompt(\"Full Conversion\", args, skillPath);\n}\n\nexport function createUpdatePrompt(args: string, skillPath = SKILL_PATH): string {\n\treturn workflowPrompt(\"Update / Fold-in\", args, skillPath);\n}\n\nfunction notify(ctx: ExtensionCommandContext, message: string, level: \"info\" | \"warning\" | \"error\"): void {\n\tif (ctx.hasUI) ctx.ui.notify(message, level);\n}\n\nfunction dispatchWorkflow(\n\tomk: ExtensionAPI,\n\tctx: ExtensionCommandContext,\n\targs: string,\n\tusage: string,\n\tcreatePrompt: (args: string) => string,\n): void {\n\tconst trimmed = args.trim();\n\tif (!trimmed) {\n\t\tnotify(ctx, `Usage: ${usage}`, \"warning\");\n\t\treturn;\n\t}\n\tif (!ctx.isIdle()) {\n\t\tnotify(ctx, \"Agent is busy; retry when the current turn finishes.\", \"warning\");\n\t\treturn;\n\t}\n\tomk.sendUserMessage(createPrompt(trimmed));\n}\n\nfunction pythonCandidates(): string[] {\n\tconst configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();\n\treturn [...new Set([configured, \"python3\", \"python\"].filter((value): value is string => Boolean(value)))];\n}\n\nasync function runScanner(omk: ExtensionAPI, skillDir: string, cwd: string): Promise<ExecResult | undefined> {\n\tif (!existsSync(SCANNER_PATH)) throw new Error(`Bundled scanner is missing: ${SCANNER_PATH}`);\n\tfor (const python of pythonCandidates()) {\n\t\tconst result = await omk.exec(python, [SCANNER_PATH, skillDir], { cwd, timeout: 120_000 });\n\t\tif (result.code === 1 && !result.stdout.trim() && !result.stderr.trim()) continue;\n\t\treturn result;\n\t}\n\treturn undefined;\n}\n\nfunction unquotePath(value: string): string {\n\tconst trimmed = value.trim();\n\tconst first = trimmed[0];\n\tif ((first === '\"' || first === \"'\") && trimmed.at(-1) === first) return trimmed.slice(1, -1);\n\treturn trimmed;\n}\n\nasync function verifySkill(omk: ExtensionAPI, args: string, ctx: ExtensionCommandContext): Promise<void> {\n\tconst requested = unquotePath(args);\n\tif (!requested) {\n\t\tnotify(ctx, \"Usage: /book-to-skill-verify <generated-skill-directory>\", \"warning\");\n\t\treturn;\n\t}\n\tconst skillDir = resolve(ctx.cwd, requested);\n\tconst report = verifyProvenance({ skillDir });\n\tif (report.artifactIntegrity === \"fail\") {\n\t\tconst summary = [...new Set(report.issues.map((item) => item.code))].slice(0, 3).join(\", \");\n\t\tnotify(ctx, `Provenance verification failed: ${summary || \"invalid manifest\"}`, \"error\");\n\t\treturn;\n\t}\n\n\tconst scanner = await runScanner(omk, skillDir, ctx.cwd);\n\tif (!scanner) {\n\t\tnotify(ctx, \"Artifact integrity passed, but Python was unavailable; advisory scan not verified.\", \"error\");\n\t\treturn;\n\t}\n\tif (scanner.code !== 0) {\n\t\tnotify(ctx, `Generated-skill scan failed with exit code ${scanner.code}; inspect it with the CLI.`, \"error\");\n\t\treturn;\n\t}\n\tnotify(\n\t\tctx,\n\t\t\"Artifact integrity and advisory scan passed. Source files were not rechecked; use the omk-book-to-skill CLI with --source for full provenance verification.\",\n\t\t\"info\",\n\t);\n}\n\nexport default function bookToSkillExtension(omk: ExtensionAPI): void {\n\tomk.registerCommand(\"book-to-skill-compile\", {\n\t\tdescription: \"Compile documents into an OMK skill with provenance\",\n\t\thandler: async (args, ctx) =>\n\t\t\tdispatchWorkflow(omk, ctx, args, \"/book-to-skill-compile <source...>\", createCompilePrompt),\n\t});\n\tomk.registerCommand(\"book-to-skill-update\", {\n\t\tdescription: \"Fold new documents into an existing generated skill\",\n\t\thandler: async (args, ctx) =>\n\t\t\tdispatchWorkflow(omk, ctx, args, \"/book-to-skill-update <skill> <source...>\", createUpdatePrompt),\n\t});\n\tomk.registerCommand(\"book-to-skill-verify\", {\n\t\tdescription: \"Verify generated-skill integrity and run the advisory scanner\",\n\t\thandler: async (args, ctx) => verifySkill(omk, args, ctx),\n\t});\n}\n"]}

package/dist/extension.js

@@ -0,0 +1,99 @@
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { verifyProvenance } from "./provenance.js";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const SKILL_PATH = resolve(PACKAGE_ROOT, "skills", "book-to-skill", "SKILL.md");
+const SCANNER_PATH = resolve(PACKAGE_ROOT, "vendor", "book-to-skill", "tools", "scan_generated_skill.py");
+function workflowPrompt(mode, args, skillPath) {
+    return [
+        "Use the bundled OMK book-to-skill workflow for this turn.",
+        `Read this file completely before acting: ${JSON.stringify(skillPath)}`,
+        `Mode: ${mode}`,
+        `User arguments: ${JSON.stringify(args)}`,
+        "Treat the arguments as user-supplied path/name data. Follow the skill's validation, confirmation, scan, and provenance gates.",
+    ].join("\n");
+}
+export function createCompilePrompt(args, skillPath = SKILL_PATH) {
+    return workflowPrompt("Full Conversion", args, skillPath);
+}
+export function createUpdatePrompt(args, skillPath = SKILL_PATH) {
+    return workflowPrompt("Update / Fold-in", args, skillPath);
+}
+function notify(ctx, message, level) {
+    if (ctx.hasUI)
+        ctx.ui.notify(message, level);
+}
+function dispatchWorkflow(omk, ctx, args, usage, createPrompt) {
+    const trimmed = args.trim();
+    if (!trimmed) {
+        notify(ctx, `Usage: ${usage}`, "warning");
+        return;
+    }
+    if (!ctx.isIdle()) {
+        notify(ctx, "Agent is busy; retry when the current turn finishes.", "warning");
+        return;
+    }
+    omk.sendUserMessage(createPrompt(trimmed));
+}
+function pythonCandidates() {
+    const configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();
+    return [...new Set([configured, "python3", "python"].filter((value) => Boolean(value)))];
+}
+async function runScanner(omk, skillDir, cwd) {
+    if (!existsSync(SCANNER_PATH))
+        throw new Error(`Bundled scanner is missing: ${SCANNER_PATH}`);
+    for (const python of pythonCandidates()) {
+        const result = await omk.exec(python, [SCANNER_PATH, skillDir], { cwd, timeout: 120_000 });
+        if (result.code === 1 && !result.stdout.trim() && !result.stderr.trim())
+            continue;
+        return result;
+    }
+    return undefined;
+}
+function unquotePath(value) {
+    const trimmed = value.trim();
+    const first = trimmed[0];
+    if ((first === '"' || first === "'") && trimmed.at(-1) === first)
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+async function verifySkill(omk, args, ctx) {
+    const requested = unquotePath(args);
+    if (!requested) {
+        notify(ctx, "Usage: /book-to-skill-verify <generated-skill-directory>", "warning");
+        return;
+    }
+    const skillDir = resolve(ctx.cwd, requested);
+    const report = verifyProvenance({ skillDir });
+    if (report.artifactIntegrity === "fail") {
+        const summary = [...new Set(report.issues.map((item) => item.code))].slice(0, 3).join(", ");
+        notify(ctx, `Provenance verification failed: ${summary || "invalid manifest"}`, "error");
+        return;
+    }
+    const scanner = await runScanner(omk, skillDir, ctx.cwd);
+    if (!scanner) {
+        notify(ctx, "Artifact integrity passed, but Python was unavailable; advisory scan not verified.", "error");
+        return;
+    }
+    if (scanner.code !== 0) {
+        notify(ctx, `Generated-skill scan failed with exit code ${scanner.code}; inspect it with the CLI.`, "error");
+        return;
+    }
+    notify(ctx, "Artifact integrity and advisory scan passed. Source files were not rechecked; use the omk-book-to-skill CLI with --source for full provenance verification.", "info");
+}
+export default function bookToSkillExtension(omk) {
+    omk.registerCommand("book-to-skill-compile", {
+        description: "Compile documents into an OMK skill with provenance",
+        handler: async (args, ctx) => dispatchWorkflow(omk, ctx, args, "/book-to-skill-compile <source...>", createCompilePrompt),
+    });
+    omk.registerCommand("book-to-skill-update", {
+        description: "Fold new documents into an existing generated skill",
+        handler: async (args, ctx) => dispatchWorkflow(omk, ctx, args, "/book-to-skill-update <skill> <source...>", createUpdatePrompt),
+    });
+    omk.registerCommand("book-to-skill-verify", {
+        description: "Verify generated-skill integrity and run the advisory scanner",
+        handler: async (args, ctx) => verifySkill(omk, args, ctx),
+    });
+}
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAChF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;AAE1G,SAAS,cAAc,CAAC,IAA4C,EAAE,IAAY,EAAE,SAAiB,EAAU;IAC9G,OAAO;QACN,2DAA2D;QAC3D,4CAA4C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;QACvE,SAAS,IAAI,EAAE;QACf,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACzC,+HAA+H;KAC/H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CACb;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAS,GAAG,UAAU,EAAU;IACjF,OAAO,cAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,CAC1D;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAS,GAAG,UAAU,EAAU;IAChF,OAAO,cAAc,CAAC,kBAAkB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,CAC3D;AAED,SAAS,MAAM,CAAC,GAA4B,EAAE,OAAe,EAAE,KAAmC,EAAQ;IACzG,IAAI,GAAG,CAAC,KAAK;QAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAAA,CAC7C;AAED,SAAS,gBAAgB,CACxB,GAAiB,EACjB,GAA4B,EAC5B,IAAY,EACZ,KAAa,EACb,YAAsC,EAC/B;IACP,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,UAAU,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO;IACR,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,EAAE,sDAAsD,EAAE,SAAS,CAAC,CAAC;QAC/E,OAAO;IACR,CAAC;IACD,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAAA,CAC3C;AAED,SAAS,gBAAgB,GAAa;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAC1G;AAED,KAAK,UAAU,UAAU,CAAC,GAAiB,EAAE,QAAgB,EAAE,GAAW,EAAmC;IAC5G,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;IAC9F,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,SAAS;QAClF,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,WAAW,CAAC,KAAa,EAAU;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC;AAAA,CACf;AAED,KAAK,UAAU,WAAW,CAAC,GAAiB,EAAE,IAAY,EAAE,GAA4B,EAAiB;IACxG,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,0DAA0D,EAAE,SAAS,CAAC,CAAC;QACnF,OAAO;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,EAAE,mCAAmC,OAAO,IAAI,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;QACzF,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,oFAAoF,EAAE,OAAO,CAAC,CAAC;QAC3G,OAAO;IACR,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,EAAE,8CAA8C,OAAO,CAAC,IAAI,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAC7G,OAAO;IACR,CAAC;IACD,MAAM,CACL,GAAG,EACH,6JAA6J,EAC7J,MAAM,CACN,CAAC;AAAA,CACF;AAED,MAAM,CAAC,OAAO,UAAU,oBAAoB,CAAC,GAAiB,EAAQ;IACrE,GAAG,CAAC,eAAe,CAAC,uBAAuB,EAAE;QAC5C,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC5B,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,oCAAoC,EAAE,mBAAmB,CAAC;KAC5F,CAAC,CAAC;IACH,GAAG,CAAC,eAAe,CAAC,sBAAsB,EAAE;QAC3C,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC5B,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,2CAA2C,EAAE,kBAAkB,CAAC;KAClG,CAAC,CAAC;IACH,GAAG,CAAC,eAAe,CAAC,sBAAsB,EAAE;QAC3C,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC;KACzD,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { ExecResult, ExtensionAPI, ExtensionCommandContext } from \"open-multi-agent-kit\";\nimport { verifyProvenance } from \"./provenance.ts\";\n\nconst PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst SKILL_PATH = resolve(PACKAGE_ROOT, \"skills\", \"book-to-skill\", \"SKILL.md\");\nconst SCANNER_PATH = resolve(PACKAGE_ROOT, \"vendor\", \"book-to-skill\", \"tools\", \"scan_generated_skill.py\");\n\nfunction workflowPrompt(mode: \"Full Conversion\" | \"Update / Fold-in\", args: string, skillPath: string): string {\n\treturn [\n\t\t\"Use the bundled OMK book-to-skill workflow for this turn.\",\n\t\t`Read this file completely before acting: ${JSON.stringify(skillPath)}`,\n\t\t`Mode: ${mode}`,\n\t\t`User arguments: ${JSON.stringify(args)}`,\n\t\t\"Treat the arguments as user-supplied path/name data. Follow the skill's validation, confirmation, scan, and provenance gates.\",\n\t].join(\"\\n\");\n}\n\nexport function createCompilePrompt(args: string, skillPath = SKILL_PATH): string {\n\treturn workflowPrompt(\"Full Conversion\", args, skillPath);\n}\n\nexport function createUpdatePrompt(args: string, skillPath = SKILL_PATH): string {\n\treturn workflowPrompt(\"Update / Fold-in\", args, skillPath);\n}\n\nfunction notify(ctx: ExtensionCommandContext, message: string, level: \"info\" | \"warning\" | \"error\"): void {\n\tif (ctx.hasUI) ctx.ui.notify(message, level);\n}\n\nfunction dispatchWorkflow(\n\tomk: ExtensionAPI,\n\tctx: ExtensionCommandContext,\n\targs: string,\n\tusage: string,\n\tcreatePrompt: (args: string) => string,\n): void {\n\tconst trimmed = args.trim();\n\tif (!trimmed) {\n\t\tnotify(ctx, `Usage: ${usage}`, \"warning\");\n\t\treturn;\n\t}\n\tif (!ctx.isIdle()) {\n\t\tnotify(ctx, \"Agent is busy; retry when the current turn finishes.\", \"warning\");\n\t\treturn;\n\t}\n\tomk.sendUserMessage(createPrompt(trimmed));\n}\n\nfunction pythonCandidates(): string[] {\n\tconst configured = process.env.BOOK_TO_SKILL_PYTHON?.trim();\n\treturn [...new Set([configured, \"python3\", \"python\"].filter((value): value is string => Boolean(value)))];\n}\n\nasync function runScanner(omk: ExtensionAPI, skillDir: string, cwd: string): Promise<ExecResult | undefined> {\n\tif (!existsSync(SCANNER_PATH)) throw new Error(`Bundled scanner is missing: ${SCANNER_PATH}`);\n\tfor (const python of pythonCandidates()) {\n\t\tconst result = await omk.exec(python, [SCANNER_PATH, skillDir], { cwd, timeout: 120_000 });\n\t\tif (result.code === 1 && !result.stdout.trim() && !result.stderr.trim()) continue;\n\t\treturn result;\n\t}\n\treturn undefined;\n}\n\nfunction unquotePath(value: string): string {\n\tconst trimmed = value.trim();\n\tconst first = trimmed[0];\n\tif ((first === '\"' || first === \"'\") && trimmed.at(-1) === first) return trimmed.slice(1, -1);\n\treturn trimmed;\n}\n\nasync function verifySkill(omk: ExtensionAPI, args: string, ctx: ExtensionCommandContext): Promise<void> {\n\tconst requested = unquotePath(args);\n\tif (!requested) {\n\t\tnotify(ctx, \"Usage: /book-to-skill-verify <generated-skill-directory>\", \"warning\");\n\t\treturn;\n\t}\n\tconst skillDir = resolve(ctx.cwd, requested);\n\tconst report = verifyProvenance({ skillDir });\n\tif (report.artifactIntegrity === \"fail\") {\n\t\tconst summary = [...new Set(report.issues.map((item) => item.code))].slice(0, 3).join(\", \");\n\t\tnotify(ctx, `Provenance verification failed: ${summary || \"invalid manifest\"}`, \"error\");\n\t\treturn;\n\t}\n\n\tconst scanner = await runScanner(omk, skillDir, ctx.cwd);\n\tif (!scanner) {\n\t\tnotify(ctx, \"Artifact integrity passed, but Python was unavailable; advisory scan not verified.\", \"error\");\n\t\treturn;\n\t}\n\tif (scanner.code !== 0) {\n\t\tnotify(ctx, `Generated-skill scan failed with exit code ${scanner.code}; inspect it with the CLI.`, \"error\");\n\t\treturn;\n\t}\n\tnotify(\n\t\tctx,\n\t\t\"Artifact integrity and advisory scan passed. Source files were not rechecked; use the omk-book-to-skill CLI with --source for full provenance verification.\",\n\t\t\"info\",\n\t);\n}\n\nexport default function bookToSkillExtension(omk: ExtensionAPI): void {\n\tomk.registerCommand(\"book-to-skill-compile\", {\n\t\tdescription: \"Compile documents into an OMK skill with provenance\",\n\t\thandler: async (args, ctx) =>\n\t\t\tdispatchWorkflow(omk, ctx, args, \"/book-to-skill-compile <source...>\", createCompilePrompt),\n\t});\n\tomk.registerCommand(\"book-to-skill-update\", {\n\t\tdescription: \"Fold new documents into an existing generated skill\",\n\t\thandler: async (args, ctx) =>\n\t\t\tdispatchWorkflow(omk, ctx, args, \"/book-to-skill-update <skill> <source...>\", createUpdatePrompt),\n\t});\n\tomk.registerCommand(\"book-to-skill-verify\", {\n\t\tdescription: \"Verify generated-skill integrity and run the advisory scanner\",\n\t\thandler: async (args, ctx) => verifySkill(omk, args, ctx),\n\t});\n}\n"]}

package/dist/file-digests.d.ts

@@ -0,0 +1,4 @@
+import { type ArtifactDigest, type SourceDigest } from "./types.ts";
+export declare function digestSources(paths: readonly string[]): SourceDigest[];
+export declare function collectArtifactDigests(skillDir: string): ArtifactDigest[];
+//# sourceMappingURL=file-digests.d.ts.map

package/dist/file-digests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-digests.d.ts","sourceRoot":"","sources":["../src/file-digests.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAwB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAyE1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,EAAE,CAKtE;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA6BzE","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync, type Stats } from \"node:fs\";\nimport { basename, join, relative, sep } from \"node:path\";\nimport { type ArtifactDigest, PROVENANCE_FILE_NAME, type SourceDigest } from \"./types.ts\";\n\nconst MAX_ARTIFACT_FILES = 1_000;\nconst MAX_ARTIFACT_BYTES = 2 * 1024 * 1024;\nconst MAX_TOTAL_ARTIFACT_BYTES = 64 * 1024 * 1024;\nconst MAX_SOURCE_BYTES = 2 * 1024 * 1024 * 1024;\nconst HASH_BUFFER_BYTES = 64 * 1024;\n\nfunction regularFileStat(path: string, maxBytes: number) {\n\tconst stat = lstatSync(path);\n\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link: ${path}`);\n\tif (!stat.isFile()) throw new Error(`Expected a regular file: ${path}`);\n\tif (!Number.isSafeInteger(stat.size) || stat.size > maxBytes) {\n\t\tthrow new Error(`File exceeds the ${maxBytes}-byte verification limit: ${path}`);\n\t}\n\treturn stat;\n}\n\nfunction sameFileIdentity(left: Stats, right: Stats): boolean {\n\treturn left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;\n}\n\nfunction hashFile(path: string, maxBytes: number): { bytes: number; sha256: string } {\n\tconst pathStat = regularFileStat(path, maxBytes);\n\tconst hash = createHash(\"sha256\");\n\tconst buffer = Buffer.allocUnsafe(HASH_BUFFER_BYTES);\n\tconst descriptor = openSync(path, \"r\");\n\tlet openedStat: ReturnType<typeof fstatSync>;\n\ttry {\n\t\topenedStat = fstatSync(descriptor);\n\t\tif (!openedStat.isFile() || !sameFileIdentity(pathStat, openedStat) || openedStat.size !== pathStat.size) {\n\t\t\tthrow new Error(`File changed while opening: ${path}`);\n\t\t}\n\t\tlet totalBytes = 0;\n\t\tlet bytesRead = 0;\n\t\tdo {\n\t\t\tbytesRead = readSync(descriptor, buffer, 0, buffer.length, null);\n\t\t\tif (bytesRead > 0) {\n\t\t\t\ttotalBytes += bytesRead;\n\t\t\t\tif (totalBytes > maxBytes) throw new Error(`File changed beyond the verification limit: ${path}`);\n\t\t\t\thash.update(buffer.subarray(0, bytesRead));\n\t\t\t}\n\t\t} while (bytesRead > 0);\n\t\tconst finalStat = fstatSync(descriptor);\n\t\tif (\n\t\t\ttotalBytes !== openedStat.size ||\n\t\t\t!sameFileIdentity(openedStat, finalStat) ||\n\t\t\tfinalStat.size !== openedStat.size ||\n\t\t\tfinalStat.mtimeMs !== openedStat.mtimeMs ||\n\t\t\tfinalStat.ctimeMs !== openedStat.ctimeMs\n\t\t) {\n\t\t\tthrow new Error(`File changed while hashing: ${path}`);\n\t\t}\n\t} finally {\n\t\tcloseSync(descriptor);\n\t}\n\tconst finalPathStat = regularFileStat(path, maxBytes);\n\tif (!sameFileIdentity(openedStat, finalPathStat) || finalPathStat.size !== openedStat.size) {\n\t\tthrow new Error(`File path changed while hashing: ${path}`);\n\t}\n\treturn { bytes: openedStat.size, sha256: hash.digest(\"hex\") };\n}\n\nfunction toPosixRelative(root: string, path: string): string {\n\treturn relative(root, path).split(sep).join(\"/\");\n}\n\nfunction assertSkillDirectory(skillDir: string): void {\n\tconst stat = lstatSync(skillDir);\n\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link skill directory: ${skillDir}`);\n\tif (!stat.isDirectory()) throw new Error(`Expected a skill directory: ${skillDir}`);\n}\n\nexport function digestSources(paths: readonly string[]): SourceDigest[] {\n\treturn paths.map((path, index) => {\n\t\tconst digest = hashFile(path, MAX_SOURCE_BYTES);\n\t\treturn Object.freeze({ id: `source-${index + 1}`, name: basename(path), ...digest });\n\t});\n}\n\nexport function collectArtifactDigests(skillDir: string): ArtifactDigest[] {\n\tassertSkillDirectory(skillDir);\n\tconst files: string[] = [];\n\tconst visit = (directory: string): void => {\n\t\tfor (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t)) {\n\t\t\tconst path = join(directory, entry.name);\n\t\t\tconst stat = lstatSync(path);\n\t\t\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link artifact: ${path}`);\n\t\t\tif (stat.isDirectory()) visit(path);\n\t\t\telse if (stat.isFile() && entry.name !== PROVENANCE_FILE_NAME) files.push(path);\n\t\t\telse if (!stat.isFile()) throw new Error(`Unsupported artifact type: ${path}`);\n\t\t}\n\t};\n\tvisit(skillDir);\n\tif (files.length > MAX_ARTIFACT_FILES) throw new Error(`Skill exceeds ${MAX_ARTIFACT_FILES} artifact files`);\n\n\tlet totalBytes = 0;\n\tconst digests = files.map((path) => {\n\t\tconst digest = hashFile(path, MAX_ARTIFACT_BYTES);\n\t\ttotalBytes += digest.bytes;\n\t\treturn Object.freeze({ path: toPosixRelative(skillDir, path), ...digest });\n\t});\n\tif (totalBytes > MAX_TOTAL_ARTIFACT_BYTES) {\n\t\tthrow new Error(`Skill artifacts exceed ${MAX_TOTAL_ARTIFACT_BYTES} bytes`);\n\t}\n\tif (!digests.some((entry) => entry.path === \"SKILL.md\")) throw new Error(\"Generated skill is missing SKILL.md\");\n\treturn digests.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));\n}\n"]}

package/dist/file-digests.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync } from "node:fs";
+import { basename, join, relative, sep } from "node:path";
+import { PROVENANCE_FILE_NAME } from "./types.js";
+const MAX_ARTIFACT_FILES = 1_000;
+const MAX_ARTIFACT_BYTES = 2 * 1024 * 1024;
+const MAX_TOTAL_ARTIFACT_BYTES = 64 * 1024 * 1024;
+const MAX_SOURCE_BYTES = 2 * 1024 * 1024 * 1024;
+const HASH_BUFFER_BYTES = 64 * 1024;
+function regularFileStat(path, maxBytes) {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink())
+        throw new Error(`Refusing symbolic link: ${path}`);
+    if (!stat.isFile())
+        throw new Error(`Expected a regular file: ${path}`);
+    if (!Number.isSafeInteger(stat.size) || stat.size > maxBytes) {
+        throw new Error(`File exceeds the ${maxBytes}-byte verification limit: ${path}`);
+    }
+    return stat;
+}
+function sameFileIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+function hashFile(path, maxBytes) {
+    const pathStat = regularFileStat(path, maxBytes);
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(HASH_BUFFER_BYTES);
+    const descriptor = openSync(path, "r");
+    let openedStat;
+    try {
+        openedStat = fstatSync(descriptor);
+        if (!openedStat.isFile() || !sameFileIdentity(pathStat, openedStat) || openedStat.size !== pathStat.size) {
+            throw new Error(`File changed while opening: ${path}`);
+        }
+        let totalBytes = 0;
+        let bytesRead = 0;
+        do {
+            bytesRead = readSync(descriptor, buffer, 0, buffer.length, null);
+            if (bytesRead > 0) {
+                totalBytes += bytesRead;
+                if (totalBytes > maxBytes)
+                    throw new Error(`File changed beyond the verification limit: ${path}`);
+                hash.update(buffer.subarray(0, bytesRead));
+            }
+        } while (bytesRead > 0);
+        const finalStat = fstatSync(descriptor);
+        if (totalBytes !== openedStat.size ||
+            !sameFileIdentity(openedStat, finalStat) ||
+            finalStat.size !== openedStat.size ||
+            finalStat.mtimeMs !== openedStat.mtimeMs ||
+            finalStat.ctimeMs !== openedStat.ctimeMs) {
+            throw new Error(`File changed while hashing: ${path}`);
+        }
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    const finalPathStat = regularFileStat(path, maxBytes);
+    if (!sameFileIdentity(openedStat, finalPathStat) || finalPathStat.size !== openedStat.size) {
+        throw new Error(`File path changed while hashing: ${path}`);
+    }
+    return { bytes: openedStat.size, sha256: hash.digest("hex") };
+}
+function toPosixRelative(root, path) {
+    return relative(root, path).split(sep).join("/");
+}
+function assertSkillDirectory(skillDir) {
+    const stat = lstatSync(skillDir);
+    if (stat.isSymbolicLink())
+        throw new Error(`Refusing symbolic link skill directory: ${skillDir}`);
+    if (!stat.isDirectory())
+        throw new Error(`Expected a skill directory: ${skillDir}`);
+}
+export function digestSources(paths) {
+    return paths.map((path, index) => {
+        const digest = hashFile(path, MAX_SOURCE_BYTES);
+        return Object.freeze({ id: `source-${index + 1}`, name: basename(path), ...digest });
+    });
+}
+export function collectArtifactDigests(skillDir) {
+    assertSkillDirectory(skillDir);
+    const files = [];
+    const visit = (directory) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const path = join(directory, entry.name);
+            const stat = lstatSync(path);
+            if (stat.isSymbolicLink())
+                throw new Error(`Refusing symbolic link artifact: ${path}`);
+            if (stat.isDirectory())
+                visit(path);
+            else if (stat.isFile() && entry.name !== PROVENANCE_FILE_NAME)
+                files.push(path);
+            else if (!stat.isFile())
+                throw new Error(`Unsupported artifact type: ${path}`);
+        }
+    };
+    visit(skillDir);
+    if (files.length > MAX_ARTIFACT_FILES)
+        throw new Error(`Skill exceeds ${MAX_ARTIFACT_FILES} artifact files`);
+    let totalBytes = 0;
+    const digests = files.map((path) => {
+        const digest = hashFile(path, MAX_ARTIFACT_BYTES);
+        totalBytes += digest.bytes;
+        return Object.freeze({ path: toPosixRelative(skillDir, path), ...digest });
+    });
+    if (totalBytes > MAX_TOTAL_ARTIFACT_BYTES) {
+        throw new Error(`Skill artifacts exceed ${MAX_TOTAL_ARTIFACT_BYTES} bytes`);
+    }
+    if (!digests.some((entry) => entry.path === "SKILL.md"))
+        throw new Error("Generated skill is missing SKILL.md");
+    return digests.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+//# sourceMappingURL=file-digests.js.map

package/dist/file-digests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-digests.js","sourceRoot":"","sources":["../src/file-digests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAc,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAuB,oBAAoB,EAAqB,MAAM,YAAY,CAAC;AAE1F,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB,EAAE;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,gBAAgB,CAAC,IAAW,EAAE,KAAY,EAAW;IAC7D,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;AAAA,CACpF;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB,EAAqC;IACpF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,UAAwC,CAAC;IAC7C,IAAI,CAAC;QACJ,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,GAAG,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACnB,UAAU,IAAI,SAAS,CAAC;gBACxB,IAAI,UAAU,GAAG,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;gBAClG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC,QAAQ,SAAS,GAAG,CAAC,EAAE;QACxB,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,IACC,UAAU,KAAK,UAAU,CAAC,IAAI;YAC9B,CAAC,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC;YACxC,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YAClC,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;YACxC,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EACvC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,CAC9D;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAU;IAC5D,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAAA,CACjD;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAQ;IACrD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;AAAA,CACpF;AAED,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAkB;IACvE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,KAAK,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAAA,CACrF,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAoB;IAC1E,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAQ,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjF,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5B,EAAE,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;YACvF,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;IAAA,CACD,CAAC;IACF,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,kBAAkB,iBAAiB,CAAC,CAAC;IAE7G,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAClD,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC;QAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAAA,CAC3E,CAAC,CAAC;IACH,IAAI,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,0BAA0B,wBAAwB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAChF","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { closeSync, fstatSync, lstatSync, openSync, readdirSync, readSync, type Stats } from \"node:fs\";\nimport { basename, join, relative, sep } from \"node:path\";\nimport { type ArtifactDigest, PROVENANCE_FILE_NAME, type SourceDigest } from \"./types.ts\";\n\nconst MAX_ARTIFACT_FILES = 1_000;\nconst MAX_ARTIFACT_BYTES = 2 * 1024 * 1024;\nconst MAX_TOTAL_ARTIFACT_BYTES = 64 * 1024 * 1024;\nconst MAX_SOURCE_BYTES = 2 * 1024 * 1024 * 1024;\nconst HASH_BUFFER_BYTES = 64 * 1024;\n\nfunction regularFileStat(path: string, maxBytes: number) {\n\tconst stat = lstatSync(path);\n\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link: ${path}`);\n\tif (!stat.isFile()) throw new Error(`Expected a regular file: ${path}`);\n\tif (!Number.isSafeInteger(stat.size) || stat.size > maxBytes) {\n\t\tthrow new Error(`File exceeds the ${maxBytes}-byte verification limit: ${path}`);\n\t}\n\treturn stat;\n}\n\nfunction sameFileIdentity(left: Stats, right: Stats): boolean {\n\treturn left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;\n}\n\nfunction hashFile(path: string, maxBytes: number): { bytes: number; sha256: string } {\n\tconst pathStat = regularFileStat(path, maxBytes);\n\tconst hash = createHash(\"sha256\");\n\tconst buffer = Buffer.allocUnsafe(HASH_BUFFER_BYTES);\n\tconst descriptor = openSync(path, \"r\");\n\tlet openedStat: ReturnType<typeof fstatSync>;\n\ttry {\n\t\topenedStat = fstatSync(descriptor);\n\t\tif (!openedStat.isFile() || !sameFileIdentity(pathStat, openedStat) || openedStat.size !== pathStat.size) {\n\t\t\tthrow new Error(`File changed while opening: ${path}`);\n\t\t}\n\t\tlet totalBytes = 0;\n\t\tlet bytesRead = 0;\n\t\tdo {\n\t\t\tbytesRead = readSync(descriptor, buffer, 0, buffer.length, null);\n\t\t\tif (bytesRead > 0) {\n\t\t\t\ttotalBytes += bytesRead;\n\t\t\t\tif (totalBytes > maxBytes) throw new Error(`File changed beyond the verification limit: ${path}`);\n\t\t\t\thash.update(buffer.subarray(0, bytesRead));\n\t\t\t}\n\t\t} while (bytesRead > 0);\n\t\tconst finalStat = fstatSync(descriptor);\n\t\tif (\n\t\t\ttotalBytes !== openedStat.size ||\n\t\t\t!sameFileIdentity(openedStat, finalStat) ||\n\t\t\tfinalStat.size !== openedStat.size ||\n\t\t\tfinalStat.mtimeMs !== openedStat.mtimeMs ||\n\t\t\tfinalStat.ctimeMs !== openedStat.ctimeMs\n\t\t) {\n\t\t\tthrow new Error(`File changed while hashing: ${path}`);\n\t\t}\n\t} finally {\n\t\tcloseSync(descriptor);\n\t}\n\tconst finalPathStat = regularFileStat(path, maxBytes);\n\tif (!sameFileIdentity(openedStat, finalPathStat) || finalPathStat.size !== openedStat.size) {\n\t\tthrow new Error(`File path changed while hashing: ${path}`);\n\t}\n\treturn { bytes: openedStat.size, sha256: hash.digest(\"hex\") };\n}\n\nfunction toPosixRelative(root: string, path: string): string {\n\treturn relative(root, path).split(sep).join(\"/\");\n}\n\nfunction assertSkillDirectory(skillDir: string): void {\n\tconst stat = lstatSync(skillDir);\n\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link skill directory: ${skillDir}`);\n\tif (!stat.isDirectory()) throw new Error(`Expected a skill directory: ${skillDir}`);\n}\n\nexport function digestSources(paths: readonly string[]): SourceDigest[] {\n\treturn paths.map((path, index) => {\n\t\tconst digest = hashFile(path, MAX_SOURCE_BYTES);\n\t\treturn Object.freeze({ id: `source-${index + 1}`, name: basename(path), ...digest });\n\t});\n}\n\nexport function collectArtifactDigests(skillDir: string): ArtifactDigest[] {\n\tassertSkillDirectory(skillDir);\n\tconst files: string[] = [];\n\tconst visit = (directory: string): void => {\n\t\tfor (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>\n\t\t\ta.name.localeCompare(b.name),\n\t\t)) {\n\t\t\tconst path = join(directory, entry.name);\n\t\t\tconst stat = lstatSync(path);\n\t\t\tif (stat.isSymbolicLink()) throw new Error(`Refusing symbolic link artifact: ${path}`);\n\t\t\tif (stat.isDirectory()) visit(path);\n\t\t\telse if (stat.isFile() && entry.name !== PROVENANCE_FILE_NAME) files.push(path);\n\t\t\telse if (!stat.isFile()) throw new Error(`Unsupported artifact type: ${path}`);\n\t\t}\n\t};\n\tvisit(skillDir);\n\tif (files.length > MAX_ARTIFACT_FILES) throw new Error(`Skill exceeds ${MAX_ARTIFACT_FILES} artifact files`);\n\n\tlet totalBytes = 0;\n\tconst digests = files.map((path) => {\n\t\tconst digest = hashFile(path, MAX_ARTIFACT_BYTES);\n\t\ttotalBytes += digest.bytes;\n\t\treturn Object.freeze({ path: toPosixRelative(skillDir, path), ...digest });\n\t});\n\tif (totalBytes > MAX_TOTAL_ARTIFACT_BYTES) {\n\t\tthrow new Error(`Skill artifacts exceed ${MAX_TOTAL_ARTIFACT_BYTES} bytes`);\n\t}\n\tif (!digests.some((entry) => entry.path === \"SKILL.md\")) throw new Error(\"Generated skill is missing SKILL.md\");\n\treturn digests.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { parseProvenanceManifest } from "./manifest.ts";
+export { COMPILER_IDENTITY, PACKAGE_VERSION } from "./metadata.ts";
+export { PROVENANCE_FILE_NAME, PROVENANCE_SCHEMA_VERSION, recordProvenance, verifyProvenance, } from "./provenance.ts";
+export type { ArtifactDigest, CompilerIdentity, ProvenanceManifest, RecordProvenanceOptions, SourceDigest, UpstreamIdentity, VerificationIssue, VerificationReport, VerifyProvenanceOptions, } from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACX,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,YAAY,CAAC","sourcesContent":["export { parseProvenanceManifest } from \"./manifest.ts\";\nexport { COMPILER_IDENTITY, PACKAGE_VERSION } from \"./metadata.ts\";\nexport {\n\tPROVENANCE_FILE_NAME,\n\tPROVENANCE_SCHEMA_VERSION,\n\trecordProvenance,\n\tverifyProvenance,\n} from \"./provenance.ts\";\nexport type {\n\tArtifactDigest,\n\tCompilerIdentity,\n\tProvenanceManifest,\n\tRecordProvenanceOptions,\n\tSourceDigest,\n\tUpstreamIdentity,\n\tVerificationIssue,\n\tVerificationReport,\n\tVerifyProvenanceOptions,\n} from \"./types.ts\";\n"]}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { parseProvenanceManifest } from "./manifest.js";
+export { COMPILER_IDENTITY, PACKAGE_VERSION } from "./metadata.js";
+export { PROVENANCE_FILE_NAME, PROVENANCE_SCHEMA_VERSION, recordProvenance, verifyProvenance, } from "./provenance.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAC","sourcesContent":["export { parseProvenanceManifest } from \"./manifest.ts\";\nexport { COMPILER_IDENTITY, PACKAGE_VERSION } from \"./metadata.ts\";\nexport {\n\tPROVENANCE_FILE_NAME,\n\tPROVENANCE_SCHEMA_VERSION,\n\trecordProvenance,\n\tverifyProvenance,\n} from \"./provenance.ts\";\nexport type {\n\tArtifactDigest,\n\tCompilerIdentity,\n\tProvenanceManifest,\n\tRecordProvenanceOptions,\n\tSourceDigest,\n\tUpstreamIdentity,\n\tVerificationIssue,\n\tVerificationReport,\n\tVerifyProvenanceOptions,\n} from \"./types.ts\";\n"]}

package/dist/manifest.d.ts

@@ -0,0 +1,3 @@
+import { type ProvenanceManifest } from "./types.ts";
+export declare function parseProvenanceManifest(value: unknown): ProvenanceManifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,kBAAkB,EAGvB,MAAM,YAAY,CAAC;AA2FpB,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA+B1E","sourcesContent":["import {\n\ttype ArtifactDigest,\n\ttype CompilerIdentity,\n\tPROVENANCE_SCHEMA_VERSION,\n\ttype ProvenanceManifest,\n\ttype SourceDigest,\n\ttype UpstreamIdentity,\n} from \"./types.ts\";\n\nconst SHA256_PATTERN = /^[a-f0-9]{64}$/;\nconst COMMIT_PATTERN = /^[a-f0-9]{40}$/;\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value))\n\t\tthrow new Error(`${label} must be an object`);\n\treturn value as Record<string, unknown>;\n}\n\nfunction string(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n\treturn value;\n}\n\nfunction bytes(value: unknown, label: string): number {\n\tif (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n\t\tthrow new Error(`${label} must be a non-negative safe integer`);\n\t}\n\treturn value;\n}\n\nfunction exactKeys(value: Record<string, unknown>, expected: readonly string[], label: string): void {\n\tconst actual = Object.keys(value).sort();\n\tconst wanted = [...expected].sort();\n\tif (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {\n\t\tthrow new Error(`${label} has unexpected or missing fields`);\n\t}\n}\n\nfunction parseUpstream(value: unknown): UpstreamIdentity {\n\tconst input = record(value, \"compiler.upstream\");\n\texactKeys(input, [\"repository\", \"commit\", \"declaredVersion\"], \"compiler.upstream\");\n\tconst commit = string(input.commit, \"compiler.upstream.commit\");\n\tif (!COMMIT_PATTERN.test(commit)) throw new Error(\"compiler.upstream.commit must be a 40-character Git commit\");\n\treturn Object.freeze({\n\t\trepository: string(input.repository, \"compiler.upstream.repository\"),\n\t\tcommit,\n\t\tdeclaredVersion: string(input.declaredVersion, \"compiler.upstream.declaredVersion\"),\n\t});\n}\n\nfunction parseCompiler(value: unknown): CompilerIdentity {\n\tconst input = record(value, \"compiler\");\n\texactKeys(input, [\"package\", \"version\", \"upstream\"], \"compiler\");\n\tif (input.package !== \"omk-book-to-skill\") throw new Error(\"compiler.package must be omk-book-to-skill\");\n\treturn Object.freeze({\n\t\tpackage: \"omk-book-to-skill\",\n\t\tversion: string(input.version, \"compiler.version\"),\n\t\tupstream: parseUpstream(input.upstream),\n\t});\n}\n\nfunction parseSha(value: unknown, label: string): string {\n\tconst digest = string(value, label);\n\tif (!SHA256_PATTERN.test(digest)) throw new Error(`${label} must be a lowercase SHA-256 digest`);\n\treturn digest;\n}\n\nfunction parseSource(value: unknown, index: number): SourceDigest {\n\tconst input = record(value, `sources[${index}]`);\n\texactKeys(input, [\"id\", \"name\", \"sha256\", \"bytes\"], `sources[${index}]`);\n\tconst name = string(input.name, `sources[${index}].name`);\n\tif (name.includes(\"/\") || name.includes(\"\\\\\")) throw new Error(`sources[${index}].name must be a basename`);\n\treturn Object.freeze({\n\t\tid: string(input.id, `sources[${index}].id`),\n\t\tname,\n\t\tsha256: parseSha(input.sha256, `sources[${index}].sha256`),\n\t\tbytes: bytes(input.bytes, `sources[${index}].bytes`),\n\t});\n}\n\nfunction parseArtifact(value: unknown, index: number): ArtifactDigest {\n\tconst input = record(value, `artifacts[${index}]`);\n\texactKeys(input, [\"path\", \"sha256\", \"bytes\"], `artifacts[${index}]`);\n\tconst path = string(input.path, `artifacts[${index}].path`);\n\tif (path.startsWith(\"/\") || path.includes(\"\\\\\") || path.split(\"/\").includes(\"..\")) {\n\t\tthrow new Error(`artifacts[${index}].path must stay inside the skill directory`);\n\t}\n\treturn Object.freeze({\n\t\tpath,\n\t\tsha256: parseSha(input.sha256, `artifacts[${index}].sha256`),\n\t\tbytes: bytes(input.bytes, `artifacts[${index}].bytes`),\n\t});\n}\n\nfunction unique(values: readonly string[], label: string): void {\n\tif (new Set(values).size !== values.length) throw new Error(`${label} must not contain duplicates`);\n}\n\nexport function parseProvenanceManifest(value: unknown): ProvenanceManifest {\n\tconst input = record(value, \"manifest\");\n\texactKeys(input, [\"schemaVersion\", \"compiler\", \"recordedAt\", \"sources\", \"artifacts\"], \"manifest\");\n\tif (input.schemaVersion !== PROVENANCE_SCHEMA_VERSION)\n\t\tthrow new Error(`Unsupported schemaVersion: ${String(input.schemaVersion)}`);\n\tconst recordedAt = string(input.recordedAt, \"recordedAt\");\n\tif (!Number.isFinite(Date.parse(recordedAt)) || new Date(recordedAt).toISOString() !== recordedAt) {\n\t\tthrow new Error(\"recordedAt must be a canonical ISO timestamp\");\n\t}\n\tif (!Array.isArray(input.sources) || input.sources.length === 0)\n\t\tthrow new Error(\"sources must be a non-empty array\");\n\tif (!Array.isArray(input.artifacts) || input.artifacts.length === 0)\n\t\tthrow new Error(\"artifacts must be a non-empty array\");\n\tconst sources = input.sources.map(parseSource);\n\tconst artifacts = input.artifacts.map(parseArtifact);\n\tunique(\n\t\tsources.map((entry) => entry.id),\n\t\t\"source ids\",\n\t);\n\tunique(\n\t\tartifacts.map((entry) => entry.path),\n\t\t\"artifact paths\",\n\t);\n\tif (!artifacts.some((entry) => entry.path === \"SKILL.md\")) throw new Error(\"artifacts must include SKILL.md\");\n\treturn Object.freeze({\n\t\tschemaVersion: PROVENANCE_SCHEMA_VERSION,\n\t\tcompiler: parseCompiler(input.compiler),\n\t\trecordedAt,\n\t\tsources: Object.freeze(sources),\n\t\tartifacts: Object.freeze(artifacts),\n\t});\n}\n"]}