veryfront 0.1.1213 → 0.1.1215

package/esm/src/skill/allowed-tools.js

@@ -1,37 +1,23 @@
 /**
- * Allowed-Tools Enforcement
+ * Skill Tool Availability
  *
- * Dual-layer enforcement for skill tool access restrictions.
- * Layer 1: Filter tool definitions before sending to model (planning-time)
- * Layer 2: Check individual tool calls at execution time
+ * Gates the skill infrastructure tools by what the active skill actually
+ * advertises: `load_skill_reference` needs a reference file, and
+ * `execute_skill_script` needs a script. Ordinary tools are never gated here.
+ *
+ * A skill's `allowed-tools` frontmatter is deliberately *not* enforced. The
+ * Agent Skills specification defines that field as pre-approval: tools the
+ * agent may run without prompting, not an authorization boundary. See
+ * veryfront/veryfront-issue-inbox#406.
  *
  * @module
  */
-import { isSkillInfrastructureToolId, isValidSkillAllowedToolPattern } from "./types.js";
-import { createError, toError } from "../errors/index.js";
-import { isProxyWithoutHooks } from "../platform/compat/error-introspection.js";
-import { SKILL_ALLOWED_TOOL_MAX_PATTERNS, SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH, } from "./limits.js";
-import { hasControlCharacters, isWellFormedUtf16 } from "./string-safety.js";
+import { isSkillInfrastructureToolId } from "./types.js";
 const LOAD_SKILL_TOOL_ID = "load_skill";
 const LOAD_SKILL_REFERENCE_TOOL_ID = "load_skill_reference";
 const EXECUTE_SKILL_SCRIPT_TOOL_ID = "execute_skill_script";
 const apply = Reflect.apply;
 const arrayFilter = Array.prototype.filter;
-const arrayIsArray = Array.isArray;
-const defineProperty = Object.defineProperty;
-const freeze = Object.freeze;
-const getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
-const numberIsSafeInteger = Number.isSafeInteger;
-const objectHasOwnProperty = Object.prototype.hasOwnProperty;
-const stringEndsWith = String.prototype.endsWith;
-const stringSlice = String.prototype.slice;
-const stringStartsWith = String.prototype.startsWith;
-function hasOwn(value, key) {
-    return apply(objectHasOwnProperty, value, [key]);
-}
-function isValidAllowedToolPattern(pattern) {
-    return isValidSkillAllowedToolPattern(pattern);
-}
 function isSkillInfrastructureToolAllowed(toolName, availability = {}) {
     if (!isSkillInfrastructureToolId(toolName)) {
         return undefined;
@@ -47,168 +33,31 @@ function isSkillInfrastructureToolAllowed(toolName, availability = {}) {
     }
     return false;
 }
-function isToolAllowedByCapturedPolicy(toolName, allowedTools, availability) {
-    const skillToolAvailable = isSkillInfrastructureToolAllowed(toolName, availability);
-    if (skillToolAvailable !== undefined) {
-        // Skill navigation stays available independently of the active policy, but
-        // file-backed capabilities require both an advertised file and an explicit
-        // policy grant whenever a policy exists. Treating availability alone as an
-        // authorization grant would widen malformed or explicitly empty policies.
-        if (!skillToolAvailable || toolName === LOAD_SKILL_TOOL_ID) {
-            return skillToolAvailable;
-        }
-        return allowedTools === undefined || matchesAnyAllowedTool(toolName, allowedTools);
-    }
-    if (allowedTools === undefined)
-        return true;
-    return matchesAnyAllowedTool(toolName, allowedTools);
-}
-/**
- * Check if a tool name matches a single allowed-tools pattern.
- *
- * Supports:
- * - Exact match: "Read" matches "Read"
- * - Prefix wildcard: "api:*" matches "api:list-users"
- */
-export function matchesAllowedTool(toolName, pattern) {
-    // Invalid patterns always fail (fail closed)
-    if (!isValidAllowedToolPattern(pattern)) {
-        return false;
-    }
-    // Prefix wildcard
-    if (apply(stringEndsWith, pattern, [":*"])) {
-        const prefix = apply(stringSlice, pattern, [0, -1]); // keep the colon: "api:"
-        return apply(stringStartsWith, toolName, [prefix]);
-    }
-    // Exact match
-    return toolName === pattern;
-}
 /**
- * Layer 1: Filter tool definitions before sending to model.
+ * Filter tool definitions before sending them to the model.
  *
- * Removes tools not in the allowed list. `load_skill` remains available for
- * skill navigation. File-backed skill tools also require an advertised file.
+ * Only skill infrastructure tools are affected; every other tool passes
+ * through untouched.
  *
  * @param tools - Full list of tool definitions
- * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
+ * @param skillToolAvailability - Files the active skill advertises
  * @returns Filtered tool definitions
  */
-export function filterToolsForSkill(tools, allowedTools, skillToolAvailability) {
-    if (allowedTools === undefined) {
-        if (!skillToolAvailability) {
-            return tools;
-        }
-        return apply(arrayFilter, tools, [(tool) => {
-                const skillToolAllowed = isSkillInfrastructureToolAllowed(tool.name, skillToolAvailability);
-                return skillToolAllowed ?? true;
-            }]);
-    }
-    const capturedAllowedTools = captureProgrammaticAllowedToolPatterns(allowedTools);
-    return apply(arrayFilter, tools, [(tool) => isToolAllowedByCapturedPolicy(tool.name, capturedAllowedTools, skillToolAvailability)]);
-}
-/**
- * Layer 2: Check if a specific tool call is allowed at execution time.
- *
- * @param toolName - Name of the tool being called
- * @param allowedTools - Allowed tool patterns, or undefined for no restrictions
- * @returns true if the tool call is allowed
- */
-export function isToolAllowedBySkill(toolName, allowedTools, skillToolAvailability) {
-    return isToolAllowedByCapturedPolicy(toolName, allowedTools === undefined ? undefined : captureProgrammaticAllowedToolPatterns(allowedTools), skillToolAvailability);
-}
-/** Filter provider-native or other name-only tool inventories through the same policy boundary. */
-export function filterToolNamesForSkill(toolNames, allowedTools, skillToolAvailability) {
-    const capturedAllowedTools = allowedTools === undefined
-        ? undefined
-        : captureProgrammaticAllowedToolPatterns(allowedTools);
-    return apply(arrayFilter, toolNames, [(toolName) => isToolAllowedByCapturedPolicy(toolName, capturedAllowedTools, skillToolAvailability)]);
-}
-function matchesAnyAllowedTool(toolName, patterns) {
-    for (let index = 0; index < patterns.length; index += 1) {
-        if (matchesAllowedTool(toolName, patterns[index]))
-            return true;
-    }
-    return false;
-}
-/**
- * Validate allowed-tool patterns at parse time.
- *
- * Ensures each pattern matches the expected format.
- * Rejects unsupported patterns with a descriptive error (fail closed).
- *
- * @param patterns - Array of tool patterns to validate
- * @returns A detached mutable copy of the validated patterns
- * @throws If any pattern is invalid
- */
-export function validateAllowedToolPatterns(patterns) {
-    return captureProgrammaticAllowedToolPatterns(patterns);
-}
-/** Validate bounded allowed-tool patterns at filesystem and runtime trust boundaries. */
-export function validateStrictAllowedToolPatterns(patterns) {
-    return captureStrictAllowedToolPatterns(patterns);
-}
-/** Validate, detach, and freeze an active authorization policy. */
-export function snapshotAllowedToolPatterns(patterns) {
-    return freeze(captureStrictAllowedToolPatterns(patterns));
-}
-const STRICT_ALLOWED_TOOL_PATTERN_LIMITS = freeze({
-    maxPatterns: SKILL_ALLOWED_TOOL_MAX_PATTERNS,
-    maxPatternLength: SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH,
-});
-function captureProgrammaticAllowedToolPatterns(patterns) {
-    return captureAllowedToolPatterns(patterns, undefined);
-}
-function captureStrictAllowedToolPatterns(patterns) {
-    return captureAllowedToolPatterns(patterns, STRICT_ALLOWED_TOOL_PATTERN_LIMITS);
-}
-function captureAllowedToolPatterns(patterns, limits) {
-    if ((typeof patterns !== "object" && typeof patterns !== "function") ||
-        patterns === null ||
-        !arrayIsArray(patterns)) {
-        throw new TypeError("Allowed-tools patterns must be an array");
-    }
-    if (isProxyWithoutHooks(patterns)) {
-        throw new TypeError("Allowed-tools patterns must not be a proxy");
-    }
-    const lengthDescriptor = getOwnPropertyDescriptor(patterns, "length");
-    const length = lengthDescriptor && hasOwn(lengthDescriptor, "value")
-        ? lengthDescriptor.value
-        : undefined;
-    if (!numberIsSafeInteger(length) || length < 0) {
-        throw new TypeError("Allowed-tools length must be a data property");
-    }
-    if (limits && length > limits.maxPatterns) {
-        throw new RangeError(`Allowed-tools accepts at most ${limits.maxPatterns} patterns`);
-    }
-    const snapshot = [];
-    for (let index = 0; index < length; index += 1) {
-        const descriptor = getOwnPropertyDescriptor(patterns, index);
-        if (!descriptor || !hasOwn(descriptor, "value")) {
-            throw new TypeError(`Allowed-tools pattern ${index} must be a data property`);
-        }
-        const pattern = descriptor.value;
-        if (typeof pattern !== "string") {
-            throw new TypeError("Allowed-tools patterns must be strings");
-        }
-        if (limits && pattern.length > limits.maxPatternLength) {
-            throw new RangeError(`Allowed-tools patterns must be at most ${limits.maxPatternLength} characters`);
-        }
-        if (!isWellFormedUtf16(pattern) || hasControlCharacters(pattern)) {
-            throw new TypeError("Allowed-tools patterns must contain well-formed UTF-16 without control characters");
-        }
-        if (!isValidAllowedToolPattern(pattern)) {
-            throw toError(createError({
-                type: "agent",
-                message: "Invalid allowed-tools pattern. " +
-                    `Only exact tool IDs (e.g. "Read") and prefix wildcards (e.g. "api:*") are supported.`,
-            }));
-        }
-        defineProperty(snapshot, snapshot.length, {
-            configurable: true,
-            enumerable: true,
-            value: pattern,
-            writable: true,
-        });
-    }
-    return snapshot;
+export function filterToolsForSkill(tools, skillToolAvailability) {
+    if (!skillToolAvailability) {
+        return tools;
+    }
+    return apply(arrayFilter, tools, [
+        (tool) => isSkillInfrastructureToolAllowed(tool.name, skillToolAvailability) ?? true,
+    ]);
+}
+/** Check whether a specific tool call is available at execution time. */
+export function isSkillToolAvailable(toolName, skillToolAvailability) {
+    return isSkillInfrastructureToolAllowed(toolName, skillToolAvailability) ?? true;
+}
+/** Filter provider-native or other name-only tool inventories through the same boundary. */
+export function filterToolNamesForSkill(toolNames, skillToolAvailability) {
+    return apply(arrayFilter, toolNames, [
+        (toolName) => isSkillInfrastructureToolAllowed(toolName, skillToolAvailability) ?? true,
+    ]);
 }

package/esm/src/skill/index.d.ts

@@ -23,7 +23,7 @@ export { parseSkillFileFrontmatter, parseSkillFrontmatter, validateSkillFileMeta
 export { listSkillSubdir, validateSkillPath } from "./path-safety.js";
 export { createExecuteSkillScriptTool, createLoadSkillReferenceTool, createLoadSkillTool, } from "./tools.js";
 export { getSkillScriptExecutor } from "./executor.js";
-export { filterToolNamesForSkill, filterToolsForSkill, isToolAllowedBySkill, snapshotAllowedToolPatterns, validateAllowedToolPatterns, validateStrictAllowedToolPatterns, } from "./allowed-tools.js";
+export { filterToolNamesForSkill, filterToolsForSkill, isSkillToolAvailable, } from "./allowed-tools.js";
 export type { ParsedSkillContent } from "./document-parser.js";
 export { parseBoundedSkillDocument } from "./document-parser.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/skill/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/skill/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,sBAAsB,EACtB,gCAAgC,EAChC,gBAAgB,EAChB,4BAA4B,EAC5B,iBAAiB,EACjB,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,KAAK,oBAAoB,EACzB,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/skill/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,KAAK,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,sBAAsB,EACtB,gCAAgC,EAChC,gBAAgB,EAChB,4BAA4B,EAC5B,iBAAiB,EACjB,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,KAAK,oBAAoB,EACzB,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}

package/esm/src/skill/index.js

@@ -28,6 +28,6 @@ export { listSkillSubdir, validateSkillPath } from "./path-safety.js";
 export { createExecuteSkillScriptTool, createLoadSkillReferenceTool, createLoadSkillTool, } from "./tools.js";
 // Executor
 export { getSkillScriptExecutor } from "./executor.js";
-// Allowed-Tools
-export { filterToolNamesForSkill, filterToolsForSkill, isToolAllowedBySkill, snapshotAllowedToolPatterns, validateAllowedToolPatterns, validateStrictAllowedToolPatterns, } from "./allowed-tools.js";
+// Skill tool availability
+export { filterToolNamesForSkill, filterToolsForSkill, isSkillToolAvailable, } from "./allowed-tools.js";
 export { parseBoundedSkillDocument } from "./document-parser.js";

package/esm/src/skill/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/src/skill/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAEjG,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAGpB,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA4D/D;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,2BAA2B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,2BAA2B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AA0ED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,aAAa,CAsFf;AAwKD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,aAAa,CAEf"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/src/skill/parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAEjG,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAGpB,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA0D/D;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,2BAA2B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,2BAA2B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AA0ED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,aAAa,CAsFf;AAwKD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,aAAa,CAEf"}

package/esm/src/skill/parser.js

@@ -6,8 +6,7 @@
  * @module
  */
 import { createError, toError } from "../errors/index.js";
-import { isNativeErrorWithoutHooks, isProxyWithoutHooks, } from "../platform/compat/error-introspection.js";
-import { validateAllowedToolPatterns, validateStrictAllowedToolPatterns } from "./allowed-tools.js";
+import { isProxyWithoutHooks } from "../platform/compat/error-introspection.js";
 import { SKILL_ALLOWED_TOOL_MAX_PATTERNS, SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH, SKILL_ID_MAX_LENGTH, } from "./limits.js";
 import { parseBoundedSkillDocument } from "./document-parser.js";
 import { ensureDefaultSkillDocumentParserContract } from "../extensions/parser/skill-defaults.js";
@@ -23,10 +22,8 @@ const ownKeys = Reflect.ownKeys;
 const NativeRegExp = RegExp;
 const NativeString = String;
 const regExpExec = RegExp.prototype.exec;
-const stringCharAt = String.prototype.charAt;
 const stringCharCodeAt = String.prototype.charCodeAt;
 const stringSlice = String.prototype.slice;
-const stringToLowerCase = String.prototype.toLowerCase;
 const stringTrim = String.prototype.trim;
 // Keep authorization regexes private: the exported compatibility regexes are
 // intentionally mutable inspection values and must not control strict parsing.
@@ -402,12 +399,10 @@ function parseLegacyAllowedTools(value, skillName) {
     }
     if (patterns.length === 0)
         return undefined;
-    try {
-        return validateAllowedToolPatterns(patterns);
-    }
-    catch (error) {
-        throwAllowedToolsValidationError(error, skillName);
-    }
+    // Patterns are recorded verbatim. `allowed-tools` is pre-approval metadata in the
+    // Agent Skills spec, not an authorization boundary, so the runtime does not act on
+    // it and must not reject spec-conformant values such as `Bash(git:*)`.
+    return patterns;
 }
 function parseLegacyAllowedToolString(value) {
     const patterns = [];
@@ -526,33 +521,7 @@ function parseStrictAllowedTools(value, skillName) {
             push(patterns, pattern);
         }
     }
-    try {
-        return validateStrictAllowedToolPatterns(patterns);
-    }
-    catch (error) {
-        throwAllowedToolsValidationError(error, skillName);
-    }
-}
-function throwAllowedToolsValidationError(error, skillName) {
-    const message = readNativeErrorMessage(error) ?? "Invalid allowed-tools declaration";
-    const firstCharacter = apply(stringCharAt, message, [0]);
-    const normalizedMessage = firstCharacter
-        ? `${apply(stringToLowerCase, firstCharacter, [])}${apply(stringSlice, message, [
-            1,
-        ])}`
-        : message;
-    throw toError(createError({
-        type: "agent",
-        message: `Skill "${skillName}" has ${normalizedMessage}`,
-    }));
-}
-function readNativeErrorMessage(error) {
-    if (isProxyWithoutHooks(error) || !isNativeErrorWithoutHooks(error))
-        return undefined;
-    const descriptor = getOwnPropertyDescriptor(error, "message");
-    return descriptor && hasOwn(descriptor, "value") && typeof descriptor.value === "string"
-        ? descriptor.value
-        : undefined;
+    return patterns;
 }
 function parseStrictAllowedToolString(value) {
     if (value.length > SKILL_ALLOWED_TOOL_DECLARATION_MAX_LENGTH) {

package/esm/src/skill/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/src/skill/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAoCnE,OAAO,KAAK,EAGV,mBAAmB,EAIpB,MAAM,YAAY,CAAC;AAoCpB,KAAK,wBAAwB,GAAG;IAC9B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC;CAC3F,CAAC;AA+XF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI,CAiEhF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI,CAsCzF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,GAAG,wBAA6B,GAC1E,IAAI,CA0DN"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/src/skill/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAoCnE,OAAO,KAAK,EAGV,mBAAmB,EAIpB,MAAM,YAAY,CAAC;AAoCpB,KAAK,wBAAwB,GAAG;IAC9B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC;CAC3F,CAAC;AA+XF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI,CAgEhF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI,CAsCzF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAE,GAAG,wBAA6B,GAC1E,IAAI,CA0DN"}

package/esm/src/skill/tools.js

@@ -295,8 +295,8 @@ function assertActiveSkillFileAvailable(input, context) {
 export function createLoadSkillTool(options = {}) {
     return tool({
         id: "load_skill",
-        description: "Load a skill's full instructions. Returns the skill's markdown instructions, " +
-            "allowed tools policy, and lists of available reference files and scripts.",
+        description: "Load a skill's full instructions. Returns the skill's markdown instructions " +
+            "and lists of available reference files and scripts.",
         inputSchema: getLoadSkillInputSchema(),
         execute: async (input, context) => {
             const budget = createFileBudget(context);
@@ -316,7 +316,6 @@ export function createLoadSkillTool(options = {}) {
             return {
                 skillId: skill.id,
                 instructions: parsed.body,
-                ...(skill.metadata.allowedTools ? { allowedTools: skill.metadata.allowedTools } : {}),
                 references: loadableReferences,
                 scripts,
             };

package/esm/src/skill/types.d.ts

@@ -90,7 +90,6 @@ export interface SkillContent {
     /** Markdown instructions (body after frontmatter) */
     instructions: string;
     /** Tool access restrictions from frontmatter */
-    allowedTools?: string[];
     /** Available reference file paths */
     references: string[];
     /** Available script file paths */
@@ -197,9 +196,8 @@ export interface SkillScriptExecutorInput {
 export interface SkillScriptExecutor {
     execute(input: SkillScriptExecutorInput): Promise<SkillScriptResult>;
 }
-/** Active skill context for runtime policy tracking */
+/** Active skill context for runtime availability and delegation tracking */
 export interface ActiveSkillContext {
     skillId: string;
-    allowedTools?: string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/esm/src/skill/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/src/skill/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAoBtE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAEnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAExC,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGhE;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGtE;AAED,kEAAkE;AAClE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAG1E;AAED,wEAAwE;AACxE,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAuBnF;AAQD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,QAE5C,CAAC;AAEF,kDAAkD;AAClD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAG9E;AAED,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAW5C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,oBAAoB,eAAe,CAAC;AACjD,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,gDAM/B,CAAC;AAIF,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qCAAqC;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,gCAAgC;AAChC,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACpD;AAED,oCAAoC;AACpC,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtE;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/src/skill/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAoBtE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAEnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAExC,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGhE;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGtE;AAED,kEAAkE;AAClE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAG1E;AAED,wEAAwE;AACxE,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAuBnF;AAQD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,QAE5C,CAAC;AAEF,kDAAkD;AAClD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAG9E;AAED,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAW5C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAAwC,CAAC;AAEpE,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,oBAAoB,eAAe,CAAC;AACjD,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,gDAM/B,CAAC;AAIF,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,qCAAqC;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,gCAAgC;AAChC,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACpD;AAED,oCAAoC;AACpC,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtE;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/esm/src/skill/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/src/skill/validation.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,KAAK,EAQX,MAAM,YAAY,CAAC;AAmNpB;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CA0DxE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAyBxD;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EACpC,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,KAAK,GACd,IAAI,CAcN"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/src/skill/validation.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,KAAK,EAQX,MAAM,YAAY,CAAC;AAqPpB;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CA0DxE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAyBxD;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EACpC,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,KAAK,GACd,IAAI,CAcN"}

package/esm/src/skill/validation.js

@@ -1,7 +1,6 @@
 import { isAbsolute } from "../platform/compat/path/index.js";
 import { isProxyWithoutHooks } from "../platform/compat/error-introspection.js";
-import { snapshotAllowedToolPatterns } from "./allowed-tools.js";
-import { SKILL_ID_MAX_LENGTH, SKILL_ROOT_PATH_MAX_LENGTH } from "./limits.js";
+import { SKILL_ALLOWED_TOOL_MAX_PATTERNS, SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH, SKILL_ID_MAX_LENGTH, SKILL_ROOT_PATH_MAX_LENGTH, } from "./limits.js";
 import { isCanonicalAdapterRelativeSkillRoot, isValidProviderSafeSkillId, SKILL_COMPATIBILITY_MAX_LENGTH, SKILL_DESCRIPTION_MAX_LENGTH, SKILL_LICENSE_MAX_LENGTH, SKILL_METADATA_KEY_MAX_LENGTH, SKILL_METADATA_MAX_ENTRIES, SKILL_METADATA_VALUE_MAX_LENGTH, } from "./types.js";
 import { hasControlCharacters, isWellFormedUtf16 } from "./string-safety.js";
 const apply = Reflect.apply;
@@ -65,6 +64,29 @@ function optionalBoundedIdentity(value, field, maxLength) {
         return undefined;
     return requireBoundedIdentity(value, field, maxLength);
 }
+/**
+ * Validate `allowed-tools` entries as bounded strings.
+ *
+ * Bounds mirror the strict parser's, so a document rejected there is not
+ * silently accepted here.
+ */
+function normalizeAllowedToolEntries(raw) {
+    if (raw.length > SKILL_ALLOWED_TOOL_MAX_PATTERNS) {
+        throw new NativeTypeError(`Skill metadata allowedTools must not exceed ${SKILL_ALLOWED_TOOL_MAX_PATTERNS} entries`);
+    }
+    return raw.map((entry) => {
+        if (typeof entry !== "string") {
+            throw new NativeTypeError("Skill metadata allowedTools entries must be strings");
+        }
+        if (entry.length > SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH) {
+            throw new NativeTypeError(`Skill metadata allowedTools entries must not exceed ${SKILL_ALLOWED_TOOL_PATTERN_MAX_LENGTH} characters`);
+        }
+        if (hasControlCharacters(entry) || !isWellFormedUtf16(entry)) {
+            throw new NativeTypeError("Skill metadata allowedTools entries must be printable text");
+        }
+        return entry;
+    });
+}
 function optionalBoundedString(value, field, maxLength) {
     if (value === undefined)
         return undefined;
@@ -141,9 +163,15 @@ function normalizeSkillMetadata(value) {
     if (rawAllowedTools !== undefined && !arrayIsArray(rawAllowedTools)) {
         throw new NativeTypeError("Skill metadata allowedTools must be an array");
     }
+    // `allowed-tools` is spec pre-approval metadata the runtime does not enforce,
+    // so entries are recorded verbatim rather than matched against a pattern
+    // grammar. Not enforcing it is not a reason to stop validating its shape:
+    // this value is parsed from untrusted skill files, stored, and surfaced, so
+    // it still has to be strings within bounds. Dropping the grammar and dropping
+    // the type check are separate decisions, and only the first was intended.
     const allowedTools = rawAllowedTools === undefined
         ? undefined
-        : snapshotAllowedToolPatterns(rawAllowedTools);
+        : Object.freeze(normalizeAllowedToolEntries(rawAllowedTools));
     const license = optionalBoundedString(ownDataValue(value, "license"), "Skill metadata license", SKILL_LICENSE_MAX_LENGTH);
     const compatibility = optionalBoundedString(ownDataValue(value, "compatibility"), "Skill metadata compatibility", SKILL_COMPATIBILITY_MAX_LENGTH);
     const metadata = normalizeStringMetadata(ownDataValue(value, "metadata"));

package/esm/src/types/server.d.ts

@@ -31,6 +31,16 @@ export interface SecurityConfig {
      * renderer requires.
      */
     csp?: Partial<Record<string, string | string[] | null>>;
+    /**
+     * Origins derived from the project's own released source, merged between the
+     * platform floor and `csp`.
+     *
+     * Platform-owned: `deriveSecurityContext` overwrites whatever a project
+     * config carries under this key, because `SecurityConfig` has an index
+     * signature and would otherwise let a project declare its own derived layer.
+     * Projects extend the policy through `csp`, which is merged on top of this.
+     */
+    derivedCsp?: import("../security/http/derived-csp-origins.js").DerivedCspOrigins;
     coop?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
     corp?: "same-origin" | "same-site" | "cross-origin";
     coep?: "require-corp" | "unsafe-none";

package/esm/src/types/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/types/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EACD,OAAO,GACP;QACA,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACJ,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,6BAA6B,EAAE,UAAU,CAAC;IAClE;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAC;IAClE,IAAI,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;IACpD,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kDAAkD;IAClD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/C,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sGAAsG;IACtG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE,kEAAkE;IAClE,aAAa,CAAC,EAAE;QACd,WAAW,IAAI,aAAa,CAAC;YAAE,QAAQ,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QAC5D,QAAQ,IAAI;YACV,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,oBAAY,eAAe;IACzB,QAAQ,IAAI,CAAE,wBAAwB;IACtC,KAAK,KAAK,CAAE,kDAAkD;IAC9D,IAAI,MAAM,CAAE,yBAAyB;IACrC,MAAM,MAAM,CAAE,2BAA2B;IACzC,GAAG,OAAO,CAAE,iBAAiB;IAC7B,QAAQ,QAAQ;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,KAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/types/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EACD,OAAO,GACP;QACA,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACJ,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,6BAA6B,EAAE,UAAU,CAAC;IAClE;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,yCAAyC,EAAE,iBAAiB,CAAC;IACjF,IAAI,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAC;IAClE,IAAI,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;IACpD,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kDAAkD;IAClD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/C,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sGAAsG;IACtG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE,kEAAkE;IAClE,aAAa,CAAC,EAAE;QACd,WAAW,IAAI,aAAa,CAAC;YAAE,QAAQ,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QAC5D,QAAQ,IAAI;YACV,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,oBAAY,eAAe;IACzB,QAAQ,IAAI,CAAE,wBAAwB;IACtC,KAAK,KAAK,CAAE,kDAAkD;IAC9D,IAAI,MAAM,CAAE,yBAAyB;IACrC,MAAM,MAAM,CAAE,2BAA2B;IACzC,GAAG,OAAO,CAAE,iBAAiB;IAC7B,QAAQ,QAAQ;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,KAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C"}

package/esm/src/utils/cors-policy-limits.d.ts

@@ -18,6 +18,13 @@ export declare function isBoundedCorsOriginList(values: readonly unknown[]): val
 export declare function isBoundedCorsToken(value: unknown): value is string;
 export declare function isBoundedCorsTokenList(values: readonly unknown[]): values is readonly string[];
 export declare function isValidCorsMaxAge(value: unknown): value is number;
-/** Whether a response header is reserved for the dedicated CORS policy layer. */
-export declare function isCorsPolicyResponseHeaderName(value: unknown): value is string;
+/**
+ * Whether a response header is reserved for the dedicated CORS policy layer.
+ *
+ * Returns a plain boolean rather than a `value is string` predicate: the
+ * narrowing that predicate implied was wrong in the negative branch, where it
+ * told the compiler a non-matching value was not a string at all, collapsing
+ * an ordinary header name to `never`.
+ */
+export declare function isCorsPolicyResponseHeaderName(value: unknown): boolean;
 //# sourceMappingURL=cors-policy-limits.d.ts.map

package/esm/src/utils/cors-policy-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors-policy-limits.d.ts","sourceRoot":"","sources":["../../../src/src/utils/cors-policy-limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,+BAA+B,OAAO,CAAC;AACpD,eAAO,MAAM,gBAAgB,QAA0B,CAAC;AAExD,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,QAAmC,CAAC;AAoBnE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAMnE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,IAAI,SAAS,MAAM,EAAE,CAI/F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKlE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,IAAI,SAAS,MAAM,EAAE,CAI9F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKjE;AAED,iFAAiF;AACjF,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAI9E"}
+{"version":3,"file":"cors-policy-limits.d.ts","sourceRoot":"","sources":["../../../src/src/utils/cors-policy-limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,+BAA+B,OAAO,CAAC;AACpD,eAAO,MAAM,gBAAgB,QAA0B,CAAC;AAExD,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,QAAmC,CAAC;AAoBnE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAMnE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,IAAI,SAAS,MAAM,EAAE,CAI/F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKlE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,IAAI,SAAS,MAAM,EAAE,CAI9F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKjE;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAItE"}

package/esm/src/utils/cors-policy-limits.js

@@ -64,7 +64,14 @@ export function isValidCorsMaxAge(value) {
         value >= 0 &&
         value <= MAX_CORS_MAX_AGE;
 }
-/** Whether a response header is reserved for the dedicated CORS policy layer. */
+/**
+ * Whether a response header is reserved for the dedicated CORS policy layer.
+ *
+ * Returns a plain boolean rather than a `value is string` predicate: the
+ * narrowing that predicate implied was wrong in the negative branch, where it
+ * told the compiler a non-matching value was not a string at all, collapsing
+ * an ordinary header name to `never`.
+ */
 export function isCorsPolicyResponseHeaderName(value) {
     return typeof value === "string" &&
         value.slice(0, CORS_POLICY_RESPONSE_HEADER_PREFIX.length).toLowerCase() ===

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1213";
+export declare const VERSION = "0.1.1215";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1213";
+export const VERSION = "0.1.1215";

package/esm/src/workflow/api.d.ts

@@ -52,7 +52,7 @@ export declare const api: {
             cursor?: string;
             limit?: number;
             pattern?: string;
-        }) => Promise<import("../platform/adapters/veryfront-api-client/operations.js").FileListResult>;
+        }) => Promise<import("../platform/adapters/index.js").FileListResult>;
         /**
          * List all files in the project (handles pagination automatically)
          */
@@ -72,7 +72,7 @@ export declare const api: {
          * Get file details (content + metadata)
          * @param pathOrId - File path or ID
          */
-        get: (pathOrId: string) => Promise<import("../platform/adapters/veryfront-api-client/operations.js").FileDetail>;
+        get: (pathOrId: string) => Promise<import("../platform/adapters/index.js").FileDetail>;
         /**
          * Search for files matching a pattern
          * @param pattern - Search pattern (glob-like)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1213",
+  "version": "0.1.1215",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -421,13 +421,13 @@
     "@deno/shim-crypto": "0.3.1",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "@veryfront/ext-bundler-esbuild": "0.1.1213",
-    "@veryfront/ext-content-mdx": "0.1.1213",
-    "@veryfront/ext-css-tailwind": "0.1.1213",
-    "@veryfront/ext-dev-ui-react": "0.1.1213",
-    "@veryfront/ext-node-websocket-ws": "0.1.1213",
-    "@veryfront/ext-parser-babel": "0.1.1213",
-    "@veryfront/ext-yaml": "0.1.1213"
+    "@veryfront/ext-bundler-esbuild": "0.1.1215",
+    "@veryfront/ext-content-mdx": "0.1.1215",
+    "@veryfront/ext-css-tailwind": "0.1.1215",
+    "@veryfront/ext-dev-ui-react": "0.1.1215",
+    "@veryfront/ext-node-websocket-ws": "0.1.1215",
+    "@veryfront/ext-parser-babel": "0.1.1215",
+    "@veryfront/ext-yaml": "0.1.1215"
   },
   "devDependencies": {
     "@types/node": "20.9.0"