productfoo 0.0.0-stage → 1.0.1

package/dist-public/src/zoomNango.js

@@ -0,0 +1,351 @@
+// Zoom through Nango (zoom-discovery-connector-v0, local worker mode).
+//
+// Nango is the credential broker only (gong-discovery-connector-v0 D-003,
+// carried by this packet's D-001): productfoo asks Nango for the company's Zoom
+// credential and then talks to Zoom's REST API directly, so transcript bytes
+// never transit Nango. Everything here is content-free on every surface productfoo
+// owns: credentials are held in process memory for one command, the Nango
+// connection id is never printed (an opaque `connection_ref` stands in for
+// it), and errors carry a typed code plus a bounded message that never embeds
+// a provider response or a tokenized download URL.
+//
+// Zoom API shapes below are beliefs owned by the packet's feasibility task
+// (T-001) and pinned by fixtures in test/discoveryZoomRuntime.test.ts; the
+// live dogfood run (T-010) is what promotes them from belief to verified.
+import { createHash } from "node:crypto";
+import { refuseSourceWrite } from "./sourceIngress.js";
+export class ZoomRuntimeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ZoomRuntimeError";
+    }
+}
+// Versioned policy fields (Granola packet R-005, carried by D-001): hard
+// ceilings the worker enforces and reports, so a later change is explicit
+// rather than silent.
+export const ZOOM_POLICY = {
+    policy_version: "zoom-local-worker-0.1",
+    max_response_bytes: 8 * 1024 * 1024,
+    max_transcript_bytes: 4 * 1024 * 1024,
+    fetch_timeout_ms: 90_000,
+    max_model_input_tokens: 100_000,
+    max_list_pages: 5,
+    max_page_size: 300,
+    min_request_interval_ms: 350,
+};
+// The recording read grant that also covers cloud-recording downloads
+// (belief owned by T-001; the feasibility report pins the exact scope string).
+const ZOOM_RECORDING_SCOPES = ["recording:read", "recording:read:admin"];
+const DEFAULT_NANGO_HOST = "https://api.nango.dev";
+const DEFAULT_ZOOM_BASE = "https://api.zoom.us";
+const DEFAULT_ZOOM_TOKEN_BASE = "https://zoom.us";
+function nangoConfigured(env) {
+    return Boolean(env.NANGO_SECRET_KEY?.trim() && env.FOO_ZOOM_NANGO_CONNECTION?.trim());
+}
+function directConfigured(env) {
+    return Boolean(env.FOO_ZOOM_ACCOUNT_ID?.trim() && env.FOO_ZOOM_CLIENT_ID?.trim() && env.FOO_ZOOM_CLIENT_SECRET?.trim());
+}
+export function zoomConnectionConfigured(env) {
+    return nangoConfigured(env) || directConfigured(env);
+}
+export function zoomCredentialBroker(env) {
+    if (nangoConfigured(env))
+        return "nango";
+    if (directConfigured(env))
+        return "direct";
+    return null;
+}
+function opaqueConnectionRef(integration, connectionId) {
+    return `zoom:${createHash("sha256").update(`${integration}\n${connectionId}`).digest("hex").slice(0, 16)}`;
+}
+async function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...init, signal: controller.signal });
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            throw new ZoomRuntimeError("provider_timeout", "the provider did not answer within the fetch ceiling");
+        throw new ZoomRuntimeError("network", `network failure reaching ${new URL(url).hostname}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// Reads a response body while counting toward the byte ceiling, so an
+// oversized transcript is dropped before it is ever materialized in full.
+async function readBounded(response, maxBytes) {
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw new ZoomRuntimeError("transcript_too_large", "the provider response exceeds the byte ceiling");
+    if (!response.body) {
+        const buffer = await response.arrayBuffer();
+        if (buffer.byteLength > maxBytes)
+            throw new ZoomRuntimeError("transcript_too_large", "the provider response exceeds the byte ceiling");
+        return new TextDecoder().decode(buffer);
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            chunks.length = 0;
+            throw new ZoomRuntimeError("transcript_too_large", "the provider response exceeds the byte ceiling");
+        }
+        chunks.push(value);
+    }
+    return new TextDecoder().decode(Buffer.concat(chunks));
+}
+function parseJson(text, label) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("not an object");
+        return parsed;
+    }
+    catch {
+        throw new ZoomRuntimeError("provider_failure", `${label} returned a response productfoo could not read`);
+    }
+}
+function recordingScopeFromScopes(scopes) {
+    if (scopes.length === 0)
+        return "unknown";
+    return scopes.some((scope) => ZOOM_RECORDING_SCOPES.includes(scope)) ? "granted" : "missing";
+}
+/**
+ * Resolve the company's Zoom credential. Nango is the primary broker: it holds
+ * the credential, refreshes it, and is where an administrator revokes it. When
+ * Nango is not configured, an administrator-issued server-to-server OAuth app
+ * (FOO_ZOOM_ACCOUNT_ID / FOO_ZOOM_CLIENT_ID / FOO_ZOOM_CLIENT_SECRET) is
+ * accepted as the direct fallback — the same company grant, minus the central
+ * refresh and revoke story. Either way productfoo receives it for one command and
+ * never persists or prints it.
+ */
+export async function resolveZoomConnection(input) {
+    const broker = zoomCredentialBroker(input.env);
+    if (broker === null) {
+        throw new ZoomRuntimeError("not_connected", "Zoom is not connected: set NANGO_SECRET_KEY and FOO_ZOOM_NANGO_CONNECTION for the company connection through Nango, or FOO_ZOOM_ACCOUNT_ID, FOO_ZOOM_CLIENT_ID, and FOO_ZOOM_CLIENT_SECRET for a direct administrator-issued server-to-server app");
+    }
+    if (broker === "direct") {
+        const accountId = input.env.FOO_ZOOM_ACCOUNT_ID.trim();
+        const clientId = input.env.FOO_ZOOM_CLIENT_ID.trim();
+        const clientSecret = input.env.FOO_ZOOM_CLIENT_SECRET.trim();
+        // Documented server-to-server token exchange — an auth operation, not a
+        // source read; it happens once per command against zoom.us. The response
+        // token lives in process memory for the command and is never logged.
+        const response = await fetchWithTimeout(input.fetchImpl, `${DEFAULT_ZOOM_TOKEN_BASE}/oauth/token`, {
+            method: "POST",
+            headers: { authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`, "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "account_credentials", account_id: accountId }).toString(),
+        }, ZOOM_POLICY.fetch_timeout_ms);
+        if (response.status === 400 || response.status === 401 || response.status === 403)
+            throw new ZoomRuntimeError("auth_expired", "Zoom refused the server-to-server credential; check the account id, client id, and secret");
+        if (!response.ok)
+            throw new ZoomRuntimeError("provider_failure", `Zoom answered ${response.status} while exchanging the server-to-server credential`);
+        const body = parseJson(await readBounded(response, 64 * 1024), "Zoom");
+        const token = String(body.access_token ?? "");
+        if (!token)
+            throw new ZoomRuntimeError("auth_expired", "Zoom returned no access token for the server-to-server credential");
+        return { connection_ref: `zoom:direct:${createHash("sha256").update(clientId).digest("hex").slice(0, 16)}`, broker: "direct", credential: { type: "oauth2", access_token: token }, credential_type: "oauth2", transcript_scope: "granted" };
+    }
+    const secret = input.env.NANGO_SECRET_KEY.trim();
+    const connectionId = input.env.FOO_ZOOM_NANGO_CONNECTION.trim();
+    const integration = input.env.FOO_ZOOM_NANGO_INTEGRATION?.trim() || "zoom";
+    const host = (input.env.NANGO_HOST?.trim() || DEFAULT_NANGO_HOST).replace(/\/+$/, "");
+    const url = `${host}/connection/${encodeURIComponent(connectionId)}?provider_config_key=${encodeURIComponent(integration)}`;
+    const response = await fetchWithTimeout(input.fetchImpl, url, { method: "GET", headers: { authorization: `Bearer ${secret}`, accept: "application/json" } }, ZOOM_POLICY.fetch_timeout_ms);
+    if (response.status === 401 || response.status === 403)
+        throw new ZoomRuntimeError("not_connected", "Nango refused the secret key; reconnect Zoom");
+    if (response.status === 404)
+        throw new ZoomRuntimeError("not_connected", "Nango has no Zoom connection with that reference; connect Zoom first");
+    if (!response.ok)
+        throw new ZoomRuntimeError("provider_failure", `Nango answered ${response.status} while resolving the connection`);
+    const body = parseJson(await readBounded(response, 256 * 1024), "Nango");
+    const credentials = (body.credentials ?? {});
+    const type = String(credentials.type ?? "").toUpperCase();
+    const ref = opaqueConnectionRef(integration, connectionId);
+    if (type === "OAUTH2") {
+        const token = String(credentials.access_token ?? "");
+        if (!token)
+            throw new ZoomRuntimeError("auth_expired", "the Nango connection carries no usable Zoom access token; refresh or reconnect");
+        const raw = (credentials.raw ?? {});
+        const scopeValue = typeof raw.scope === "string" ? raw.scope : typeof credentials.scope === "string" ? credentials.scope : "";
+        const scopes = scopeValue.split(/[\s,]+/).filter(Boolean);
+        return { connection_ref: ref, broker: "nango", credential: { type: "oauth2", access_token: token }, credential_type: "oauth2", transcript_scope: recordingScopeFromScopes(scopes) };
+    }
+    throw new ZoomRuntimeError("not_connected", "the Nango connection uses a credential type productfoo does not support for Zoom");
+}
+/**
+ * Minimal read-only Zoom REST client. Only documented read operations are
+ * reachable; any other method or path routes through the single write-refusal
+ * choke point (R-009) so the refusal is testable rather than scattered.
+ */
+export class ZoomClient {
+    credential;
+    options;
+    requests = { list: 0, transcript: 0 };
+    lastRequestAt = 0;
+    baseUrl;
+    sleep;
+    now;
+    fetchTimeoutMs;
+    constructor(credential, options) {
+        this.credential = credential;
+        this.options = options;
+        this.baseUrl = (options.baseUrl ?? DEFAULT_ZOOM_BASE).replace(/\/+$/, "");
+        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.now = options.now ?? (() => Date.now());
+        this.fetchTimeoutMs = options.fetchTimeoutMs ?? ZOOM_POLICY.fetch_timeout_ms;
+    }
+    authorization() {
+        return `Bearer ${this.credential.access_token}`;
+    }
+    async request(pathname, maxBytes) {
+        if (!pathname.startsWith("/"))
+            refuseSourceWrite(`zoom ${pathname}`);
+        const wait = this.lastRequestAt + ZOOM_POLICY.min_request_interval_ms - this.now();
+        if (wait > 0)
+            await this.sleep(wait);
+        this.lastRequestAt = this.now();
+        const response = await fetchWithTimeout(this.options.fetchImpl, `${this.baseUrl}${pathname}`, { method: "GET", headers: { authorization: this.authorization(), accept: "application/json" } }, this.fetchTimeoutMs);
+        if (response.status === 401)
+            throw new ZoomRuntimeError("auth_expired", "Zoom rejected the credential; refresh or reconnect");
+        if (response.status === 403)
+            throw new ZoomRuntimeError("access_denied", "Zoom denied this read; the credential lacks the required permission");
+        if (response.status === 429)
+            throw new ZoomRuntimeError("budget_exhausted", "Zoom rate limit reached; no retry was attempted");
+        if (response.status === 404)
+            throw new ZoomRuntimeError("provider_failure", "Zoom reported the requested record does not exist");
+        if (!response.ok)
+            throw new ZoomRuntimeError("provider_failure", `Zoom answered ${response.status}`);
+        return parseJson(await readBounded(response, maxBytes), "Zoom");
+    }
+    /**
+     * Bounded metadata listing: one time window, a page ceiling, no content. A
+     * recording's participant records carry no affiliation field — the mapping
+     * passes through only what is observed and leaves the rest undefined.
+     */
+    async listSessions(userId, window) {
+        const recordings = [];
+        let nextPageToken;
+        let pages = 0;
+        for (;;) {
+            if (pages >= ZOOM_POLICY.max_list_pages)
+                return { recordings, pages, truncated: true };
+            const params = new URLSearchParams({ from: window.from, to: window.to, page_size: String(ZOOM_POLICY.max_page_size) });
+            if (nextPageToken)
+                params.set("next_page_token", nextPageToken);
+            this.requests.list += 1;
+            const body = await this.request(`/users/${encodeURIComponent(userId)}/recordings?${params.toString()}`, 4 * 1024 * 1024);
+            pages += 1;
+            for (const entry of Array.isArray(body.recordings) ? body.recordings : []) {
+                // Entries without the contract's required identity fields cannot be
+                // normalized and are skipped, exactly as Gong's listing skips calls
+                // without an id.
+                if (!entry || typeof entry.uuid !== "string" || typeof entry.topic !== "string" || typeof entry.start_time !== "string")
+                    continue;
+                const files = (Array.isArray(entry.recording_files) ? entry.recording_files : []).map((file) => ({
+                    file_type: typeof file.file_type === "string" ? file.file_type : undefined,
+                    download_url: typeof file.download_url === "string" ? file.download_url : undefined,
+                    play_url: typeof file.play_url === "string" ? file.play_url : undefined,
+                    status: typeof file.status === "string" ? file.status : undefined,
+                }));
+                // A transcript file counts as available only when it is actually
+                // downloadable — the observed state of THIS recording, never assumed
+                // from the topic or the account (R-005).
+                const transcriptFile = files.find((file) => file.file_type === "TRANSCRIPTION" && file.download_url && file.status === "completed");
+                const participants = (Array.isArray(entry.participants) ? entry.participants : [])
+                    .map((participant) => ({
+                    display_name: typeof participant.display_name === "string" ? participant.display_name : undefined,
+                    email: typeof participant.email === "string" ? participant.email : undefined,
+                }))
+                    .filter((participant) => participant.display_name || participant.email);
+                recordings.push({
+                    meeting_uuid: entry.uuid,
+                    topic: entry.topic,
+                    start_time: entry.start_time,
+                    end_time: typeof entry.end_time === "string" ? entry.end_time : undefined,
+                    state: typeof entry.state === "string" ? entry.state : undefined,
+                    host_display_name: typeof entry.host_display_name === "string" ? entry.host_display_name : undefined,
+                    participants,
+                    // Omitted, never cleaned: a tokenized or non-canonical page URL is
+                    // dropped here and the adapter additionally refuses non-canonical
+                    // forms as defense in depth (R-006).
+                    url: this.canonicalPageUrl(typeof entry.play_url === "string" ? entry.play_url : undefined),
+                    transcript_available: Boolean(transcriptFile),
+                    recording_files: files,
+                });
+            }
+            nextPageToken = typeof body.next_page_token === "string" && body.next_page_token ? body.next_page_token : undefined;
+            if (!nextPageToken)
+                return { recordings, pages, truncated: false };
+        }
+    }
+    // Accepts only the canonical recording page form the sanitizer in
+    // src/discoverySources.ts accepts (one account subdomain, /recording/<id>,
+    // no query, no fragment); anything else — including tokenized share links —
+    // is omitted, never cleaned (R-006).
+    canonicalPageUrl(url) {
+        if (!url)
+            return undefined;
+        try {
+            const parsed = new URL(url);
+            if (parsed.protocol !== "https:" || parsed.search || parsed.hash)
+                return undefined;
+            const host = parsed.hostname.toLowerCase();
+            const suffix = ".zoom.us";
+            if (!host.endsWith(suffix))
+                return undefined;
+            const label = host.slice(0, -suffix.length);
+            if (!label || !/^[a-z0-9-]+$/.test(label))
+                return undefined;
+            if (!/^\/recording\/[A-Za-z0-9_-]{16,128}$/.test(parsed.pathname))
+                return undefined;
+            return `https://${host}${parsed.pathname}`;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Exactly one transcript download (R-007): the observed, downloadable
+     * transcript file of one recording. The URL is the one the listing observed
+     * for that recording; a tokenized link may be used in transit (Zoom's own
+     * access mechanism) and is never logged, persisted, or echoed — error
+     * messages carry the hostname only.
+     */
+    async transcript(downloadUrl) {
+        let hostname = "";
+        try {
+            const parsed = new URL(downloadUrl);
+            hostname = parsed.hostname;
+            if (parsed.protocol !== "https:" || !(parsed.hostname === "zoom.us" || parsed.hostname.endsWith(".zoom.us"))) {
+                throw new Error("not a zoom host");
+            }
+        }
+        catch {
+            throw new ZoomRuntimeError("provider_failure", "a single well-formed Zoom transcript download URL is required");
+        }
+        this.requests.transcript += 1;
+        const response = await fetchWithTimeout(this.options.fetchImpl, downloadUrl, { method: "GET", headers: { authorization: this.authorization(), accept: "text/vtt, text/plain, */*" } }, this.fetchTimeoutMs);
+        if (response.status === 401)
+            throw new ZoomRuntimeError("auth_expired", `Zoom rejected the credential for the transcript download from ${hostname}`);
+        if (response.status === 403)
+            throw new ZoomRuntimeError("access_denied", `Zoom denied the transcript download from ${hostname}`);
+        if (response.status === 429)
+            throw new ZoomRuntimeError("budget_exhausted", "Zoom rate limit reached; no retry was attempted");
+        if (response.status === 404)
+            throw new ZoomRuntimeError("provider_failure", `Zoom reported the transcript on ${hostname} does not exist`);
+        if (!response.ok)
+            throw new ZoomRuntimeError("provider_failure", `Zoom answered ${response.status} for the transcript download`);
+        return { vtt: await readBounded(response, ZOOM_POLICY.max_transcript_bytes) };
+    }
+}

package/docs/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+This changelog covers the public productfoo distribution. Pre-public development
+records are not part of the public release history.
+
+## 1.0.1 — October 17, 2026
+
+Patch release from the fresh public repository. Includes updated README setup
+guidance and section order, plus current installation documentation. CLI commands,
+library exports, bundled skills, packet formats, and runtime requirements are
+unchanged from 1.0.0.
+
+## 1.0.0 — October 17, 2026
+
+The initial release candidate includes the local CLI, bundled product-management
+skills, spec workflows, research and discovery helpers, validation, reconciliation,
+and scanning tools under Apache-2.0. The terminal command is `foo`.
+
+The experimental sales-development subsystem (`foo sdr`) and its PostgreSQL
+dependency were removed before release. Core spec, research, discovery, skill,
+and reporting workflows need no database server.
+
+The local workflows require no productfoo account or hosted service. Optional
+model and connector workflows may use external services and incur charges.
+
+productfoo is a personal open-source project with best-effort maintenance and
+support. Agent behavior depends on the selected model, runtime, and permissions;
+checks cannot guarantee correctness or safety. Read
+[project status and responsible use](https://github.com/rwo572/productfoo#project-status-and-responsible-use)
+before getting started.
+
+Each published release is verified against its exact source and package bytes.

package/docs/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,36 @@
+# Third-party notices
+
+This file lists productfoo's direct runtime dependencies and their licenses.
+It is generated from the package's declared dependencies by
+`scripts/gen-third-party-notices.mjs` — do not edit it by hand. To
+regenerate after adding or upgrading a runtime dependency, run:
+
+```bash
+node scripts/gen-third-party-notices.mjs
+```
+
+Scope note: runtime dependencies may be bundled into the build or installed
+alongside the package by npm. Development and build-time tooling is not
+distributed with the package and is not listed here. productfoo itself is
+licensed under the [Apache License 2.0](https://github.com/rwo572/productfoo/blob/main/LICENSE).
+
+## yaml 2.9.0
+
+- License: ISC
+- Homepage: https://eemeli.org/yaml/
+
+```text
+Copyright Eemeli Aro <eemeli@gmail.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+```

package/package.json

@@ -1,6 +1,73 @@
 {
   "name": "productfoo",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Product-management workflows, specs, and verification for coding agents.",
+  "keywords": [
+    "cli",
+    "product-management",
+    "specifications",
+    "coding-agents",
+    "ai-agents"
+  ],
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rwo572/productfoo.git"
+  },
+  "bugs": {
+    "url": "https://github.com/rwo572/productfoo/issues"
+  },
+  "homepage": "https://github.com/rwo572/productfoo#readme",
+  "type": "module",
+  "bin": {
+    "foo": "bin/foo.mjs"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist-public/src/index.d.ts",
+      "default": "./dist-public/src/index.js"
+    },
+    "./cli": {
+      "types": "./dist-public/src/cli.d.ts",
+      "default": "./dist-public/src/cli.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "foo": {
+    "brandUrl": "https://github.com/rwo572/productfoo"
+  },
+  "files": [
+    "bin",
+    "docs/CHANGELOG.md",
+    "commands",
+    "dist-public/src",
+    "config/pricing.yaml",
+    "config/routing-policy.yaml",
+    "schemas",
+    "skills",
+    "skills-lock.json",
+    "docs/THIRD_PARTY_NOTICES.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/bundle-vendor.mjs",
+    "build:public": "node scripts/build-public.mjs",
+    "verify:public": "npm run build && npm run check:generated && npm run build:public && node scripts/verify-public-package.mjs && node scripts/verify-public-git-manifest.mjs && node scripts/smoke-public-package.mjs",
+    "prepack": "npm run build:public",
+    "prepublishOnly": "npm run build:public",
+    "test": "rm -rf dist && npm run build && find dist -name '*.test.js' -print0 | xargs -0 env NODE_ENV=test node --test",
+    "test:packetindex": "npm run build && env NODE_ENV=test node --test dist/test/packetIndexGolden.test.js dist/test/packetIndex.test.js",
+    "generate": "npm run build && node scripts/build-swarm-skills.mjs && node scripts/skill-tree-anchor.mjs && node scripts/build-anthropic-plugin.mjs && node scripts/gen-cli-reference.mjs && node scripts/gen-third-party-notices.mjs && node scripts/gen-cheatsheet.mjs",
+    "check:generated": "node scripts/build-swarm-skills.mjs --verify && node scripts/skill-tree-anchor.mjs --check && node scripts/build-anthropic-plugin.mjs --check && node scripts/gen-cli-reference.mjs --check && node scripts/gen-third-party-notices.mjs --check && node scripts/gen-cheatsheet.mjs --check"
+  },
+  "dependencies": {
+    "yaml": "^2.8.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.3.0",
+    "esbuild": "^0.28.2",
+    "typescript": "^7.0.2"
+  }
+}

package/schemas/bug-capsule-receipt.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://foo.example/schemas/bug-capsule-receipt.schema.json",
+  "title": "DeliveryReceipt 0.1",
+  "type": "object",
+  "required": ["schema_version", "receipt_id", "capsule_id", "payload_digest", "accepted_at", "destination", "status", "error"],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": { "const": "0.1" },
+    "receipt_id": { "$ref": "#/$defs/uuidV7" },
+    "capsule_id": { "$ref": "#/$defs/uuidV7" },
+    "payload_digest": {
+      "type": "string",
+      "maxLength": 4096,
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "accepted_at": { "$ref": "#/$defs/rfc3339Utc" },
+    "destination": { "$ref": "#/$defs/string" },
+    "status": { "enum": ["accepted", "rejected", "retryable"] },
+    "error": { "type": ["null", "object"] }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "status": { "const": "accepted" } }, "required": ["status"] },
+      "then": { "properties": { "error": { "const": null } } },
+      "else": { "properties": { "error": { "$ref": "#/$defs/error" } } }
+    }
+  ],
+  "$defs": {
+    "string": { "type": "string", "maxLength": 4096 },
+    "uuidV7": {
+      "type": "string",
+      "maxLength": 4096,
+      "format": "uuid",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
+    "rfc3339Utc": {
+      "type": "string",
+      "maxLength": 4096,
+      "format": "date-time",
+      "pattern": "^(?:\\d{4})-(?:\\d{2})-(?:\\d{2})T(?:\\d{2}):(?:\\d{2}):(?:\\d{2})(?:\\.\\d+)?Z$"
+    },
+    "error": {
+      "type": "object",
+      "required": ["code", "message"],
+      "additionalProperties": false,
+      "properties": {
+        "code": { "$ref": "#/$defs/string" },
+        "message": { "$ref": "#/$defs/string" },
+        "retry_after": { "$ref": "#/$defs/rfc3339Utc" }
+      }
+    }
+  }
+}