wicked-crew 0.7.24 → 0.7.26

package/dist/skills/bundle.js

@@ -0,0 +1,187 @@
+/**
+ * The bundle = the DEPENDENCY CLOSURE of the plugin root (design v3 §4), not a directory heuristic:
+ *
+ *   .claude-plugin/{plugin,archetypes,components,specialist,stack-registry}.json
+ *                                                                     the manifest + the runtime catalogs
+ *                                                                     garden's scripts read, BY NAME
+ *                                                                     (`PLUGIN_MANIFEST_FILES`) — plugin.json,
+ *                                                                     archetypes.json and components.json
+ *                                                                     REQUIRED at publish
+ *                                                                     (`REQUIRED_PLUGIN_CATALOGS`); anything
+ *                                                                     else in that directory (marketplace.json,
+ *                                                                     a publish-time listing) is outside
+ *   skills/**                                                         nested layout VERBATIM — never renamed
+ *   scripts/**  minus ci/, wg/ and the wg-… dev tools                 what `${CLAUDE_PLUGIN_ROOT}/scripts/…` resolves
+ *   schemas/**                                                        `../schemas/evidence.json` links
+ *   docs/examples/**                                                  `qe/refs/campaign.md` → the copyable workflows
+ *   pyproject.toml, uv.lock                                           `uv run` from the plugin root needs them
+ *
+ * Hooks, the site, tests, `.venv`, the operator's `_meta/`, and everything else a plugin checkout
+ * carries never come along. The content hash of THIS set is the baseline's identity.
+ *
+ * # ONE allowlist (codex round 6 on #480; the exact spelling — codex round 7)
+ *
+ * `inBundleClosure` is the closure as a predicate over a plugin-relative path — the single source
+ * three consumers share: the seed/refresh copy (`pluginBundleFiles` keeps only members), the support
+ * file API (`store.resolveSupportFile` refuses a path outside it with an `outside-closure` blocked
+ * envelope) and publish/analyze (a file found under `effective/` outside it — a direct filesystem
+ * edit — is a BLOCKING `outside-closure` finding naming the path). What the seed would not copy,
+ * the API cannot add and a snapshot never ships. The `.claude-plugin` half is an allowlist BY NAME —
+ * design amendment v3.5 §1, adjudicated against the live 12.32.0 layout (six files there; five are
+ * runtime catalogs garden's scripts read — `specialist.json` by `scripts/crew/specialist_discovery.py`,
+ * `stack-registry.json` by the pack/capability registries; `marketplace.json` is a publish-time
+ * listing), superseding the v3 "three files" spelling that predated the catalog audit; `scripts/wg/`
+ * IS a directory in the live plugin, so it is excluded as a directory alongside `ci/`, and the
+ * `wg-…` prefix exclusion stays.
+ *
+ * # No-follow BELOW the source root (codex round 6)
+ *
+ * The plugin root is resolved ONCE (`realPluginRoot` — an operator's symlinked config dir reaches
+ * it legitimately); every designated entry below it — each named manifest file, each root file,
+ * each bundle directory and everything under it — is lstat-walked, and a symlink among them refuses
+ * the whole ingestion by name (`PluginSourceSymlinkError`): nothing is copied. A link inside a
+ * PRUNED subtree (`scripts/ci/`, `node_modules/`, `.venv/`) or at a non-designated name
+ * (`.claude-plugin/marketplace.json`) is never reached — it is not part of the closure, so it is
+ * neither copied nor judged.
+ */
+import { lstatSync } from 'node:fs';
+import { noFollowEntry, PLUGIN_MANIFEST_REL, PluginSourceSymlinkError, realPluginRoot } from './plugin-source.js';
+import { toPosix, walkTree } from './tree.js';
+/** The plugin subdirectory skills live in (and the prefix of every manifest `dir`). */
+export const SKILLS_SUBDIR = 'skills';
+/** The manifest directory. */
+export const PLUGIN_MANIFEST_DIRNAME = '.claude-plugin';
+/**
+ * The files under `.claude-plugin/` that ride the bundle — BY NAME (codex round 7, adjudicated on the
+ * live 12.32.0 layout): the plugin manifest and the four runtime catalogs garden's scripts read.
+ * `marketplace.json` (the marketplace's publish-time listing) and anything else are outside.
+ */
+export const PLUGIN_MANIFEST_FILES = [
+    'plugin.json',
+    'archetypes.json',
+    'components.json',
+    'specialist.json',
+    'stack-registry.json',
+];
+/**
+ * The runtime catalogs every snapshot MUST carry beside `plugin.json` (design v3 §4): garden's
+ * runtime reads `archetypes.json` (`scripts/crew/archetypes_v11.py:60-74` raises when it is absent)
+ * and `components.json`. Their absence in `effective/` is a BLOCKING publish finding
+ * (`missing-plugin-manifest`) — a seed copies what the source has (a source missing them is a
+ * defective install the publish names, not a seed failure).
+ */
+export const REQUIRED_PLUGIN_CATALOGS = [
+    `${PLUGIN_MANIFEST_DIRNAME}/archetypes.json`,
+    `${PLUGIN_MANIFEST_DIRNAME}/components.json`,
+];
+/** Root-level files copied when present. */
+const BUNDLE_ROOT_FILES = ['pyproject.toml', 'uv.lock'];
+/** Directories copied whole (POSIX-relative to the plugin root). */
+const BUNDLE_DIRS = [SKILLS_SUBDIR, 'scripts', 'schemas', 'docs/examples'];
+/** Top-level `scripts/` entries that are dev tooling, never runtime: the `ci/` and `wg/` directories and any `wg-…` maintainer tool. */
+function isScriptsDevDir(rel) {
+    return !rel.includes('/') && (rel === 'ci' || rel === 'wg' || rel.startsWith('wg-'));
+}
+/** The human spelling of the closure — for findings and refusals. */
+export const BUNDLE_CLOSURE_SPELLING = `${PLUGIN_MANIFEST_DIRNAME}/{${PLUGIN_MANIFEST_FILES.map((f) => f.replace(/\.json$/, '')).join(',')}}.json, ${SKILLS_SUBDIR}/**, scripts/** (minus ci/, wg/ and wg-*), schemas/**, docs/examples/**, ${BUNDLE_ROOT_FILES.join(', ')}`;
+/**
+ * Whether a plugin-relative POSIX path is a member of the bundle closure (module header: the ONE
+ * allowlist). Lexical — the caller has already validated the path's shape.
+ */
+export function inBundleClosure(rel) {
+    const segments = rel.split('/');
+    if (segments.length === 2 && segments[0] === PLUGIN_MANIFEST_DIRNAME)
+        return PLUGIN_MANIFEST_FILES.includes(segments[1] ?? '');
+    if (segments.length === 1)
+        return BUNDLE_ROOT_FILES.includes(rel);
+    for (const dir of BUNDLE_DIRS) {
+        const prefix = `${dir}/`;
+        if (!rel.startsWith(prefix))
+            continue;
+        if (dir === 'scripts' && isScriptsDevDir(rel.slice(prefix.length).split('/')[0] ?? ''))
+            return false;
+        return true;
+    }
+    return false;
+}
+/** The plugin root has no `.claude-plugin/plugin.json`. */
+export class NotAPluginRootError extends Error {
+    dir;
+    constructor(dir) {
+        super(`${dir} has no ${toPosix(PLUGIN_MANIFEST_REL)} — not a plugin root`);
+        this.dir = dir;
+        this.name = 'NotAPluginRootError';
+    }
+}
+/**
+ * The bundle file set of `pluginRoot`, sorted by `rel` — every member of the closure the source
+ * carries, reached without following a link below the once-resolved root (module header). Throws
+ * `NotAPluginRootError` (no manifest) or `PluginSourceSymlinkError` (a link among the designated
+ * entries — nothing is copied by the caller either).
+ */
+export function pluginBundleFiles(pluginRoot) {
+    const root = realPluginRoot(pluginRoot);
+    if (root === null)
+        throw new NotAPluginRootError(pluginRoot);
+    const manifestAbs = noFollowEntry(root, [PLUGIN_MANIFEST_DIRNAME, 'plugin.json'], pluginRoot);
+    if (manifestAbs === null || !lstatSync(manifestAbs).isFile())
+        throw new NotAPluginRootError(pluginRoot);
+    const out = [];
+    // The manifest files BY NAME (the dir itself was walked no-follow on the way to plugin.json): a
+    // designated name that is a link is refused; a name outside the allowlist is never touched.
+    for (const name of PLUGIN_MANIFEST_FILES) {
+        const abs = noFollowEntry(root, [PLUGIN_MANIFEST_DIRNAME, name], pluginRoot);
+        if (abs !== null && lstatSync(abs).isFile())
+            out.push({ rel: `${PLUGIN_MANIFEST_DIRNAME}/${name}`, abs });
+    }
+    for (const rel of BUNDLE_ROOT_FILES) {
+        const abs = noFollowEntry(root, [rel], pluginRoot);
+        if (abs !== null && lstatSync(abs).isFile())
+            out.push({ rel, abs });
+    }
+    for (const dir of BUNDLE_DIRS) {
+        const abs = noFollowEntry(root, dir.split('/'), pluginRoot);
+        if (abs === null || !lstatSync(abs).isDirectory())
+            continue;
+        // Links are ENUMERATED, never skipped (`walkTree`): a linked `skills/<x>` dir or a linked file
+        // inside a skill is refused by name rather than silently left out of the bundle.
+        const tree = walkTree(abs, dir === 'scripts' ? isScriptsDevDir : undefined);
+        const link = tree.links[0];
+        if (link !== undefined)
+            throw new PluginSourceSymlinkError(pluginRoot, `${dir}/${link.rel}`, link.target);
+        for (const f of tree.files) {
+            const rel = `${dir}/${f.rel}`;
+            if (inBundleClosure(rel))
+                out.push({ rel, abs: f.abs }); // the predicate is the source of truth; the prune above is its fast path
+        }
+    }
+    return out.sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+}
+/** Every `skills/<rel>` dir in a file set that holds a `SKILL.md` (`skills/SKILL.md` itself is not a skill). */
+export function skillDirsOf(files) {
+    const dirs = new Set();
+    const prefix = `${SKILLS_SUBDIR}/`;
+    for (const f of files) {
+        if (!f.rel.startsWith(prefix) || !f.rel.endsWith('/SKILL.md'))
+            continue;
+        const dir = f.rel.slice(0, -'/SKILL.md'.length);
+        if (dir !== SKILLS_SUBDIR)
+            dirs.add(dir);
+    }
+    return dirs;
+}
+/**
+ * The skill dir that OWNS a plugin-relative path: the deepest `skillDirs` entry the path sits
+ * under, or `null` for a support file. Nested-skill ownership (v3 §6) is exactly this rule.
+ */
+export function owningSkillDir(rel, skillDirs) {
+    let best = null;
+    for (const dir of skillDirs) {
+        if (rel === dir || rel.startsWith(`${dir}/`)) {
+            if (best === null || dir.length > best.length)
+                best = dir;
+        }
+    }
+    return best;
+}
+//# sourceMappingURL=bundle.js.map

package/dist/skills/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/skills/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAmB,MAAM,WAAW,CAAC;AAE/D,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,aAAa;IACb,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA0B;IAC7D,GAAG,uBAAuB,kBAAkB;IAC5C,GAAG,uBAAuB,kBAAkB;CAC7C,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAA0B,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;AAE/E,oEAAoE;AACpE,MAAM,WAAW,GAA0B,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAElG,wIAAwI;AACxI,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,uBAAuB,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,aAAa,4EAA4E,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAE7Q;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,uBAAuB;QAAE,OAAO,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/H,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,IAAI,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,GAAW;QAC9B,KAAK,CAAC,GAAG,GAAG,WAAW,OAAO,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QADxD,QAAG,GAAH,GAAG,CAAQ;QAE9B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACxG,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,gGAAgG;IAChG,4FAA4F;IAC5F,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7E,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,uBAAuB,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC5D,+FAA+F;QAC/F,iFAAiF;QACjF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,yEAAyE;QACpI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,WAAW,CAAC,KAAqC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,aAAa,GAAG,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACxE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,aAAa;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAA8B;IACxE,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;gBAAE,IAAI,GAAG,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/skills/contain.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Skill-scoped containment for the `/skills` file manager (design v3 §API).
+ *
+ * NOT `api/open-path.ts` `isInsideRoot`: that helper FOLLOWS symlinks (a `<root>/link-to-outside`
+ * resolves to its real target, which is the right question for "may I open this file the run
+ * produced" and the wrong one for "may I write here") and accepts the root itself. Writes into the
+ * effective plugin root need the stricter rule:
+ *
+ *   1. the URL wildcard arrives DECODED EXACTLY ONCE — by Fastify (find-my-way decodes every `%xx`,
+ *      `%2F` included, before routing; a malformed escape is Fastify's own 400) — and the store
+ *      never decodes again (codex round 5 on #480: a second decode turned `100%25.txt` into a
+ *      refused `100%.txt` and the literal filename `a%252Fb.txt` into the path `a/b.txt`);
+ *   2. normalize into segments — refuse empty, `.`, `..`, backslashes, NUL, absolute / drive-prefixed;
+ *   3. lstat-walk EVERY existing component and refuse a symlink anywhere on the way (the plugin
+ *      tree carries none; one appearing is either an attack or an accident, and either way the
+ *      write must not follow it);
+ *   4. the root itself is not a file — an empty remainder is refused.
+ *
+ * Atomic tmp+rename writes are the store's job (`tree.ts` `writeFileAtomic`); this module only
+ * decides WHERE. And the walk is necessary, not sufficient (design v3.5 §3; codex round 8): the
+ * path it answers is then OPENED with `O_NOFOLLOW` where the platform has it, and the lstat-then-open
+ * gap is closed everywhere with a post-open identity check (`fstat` dev/ino against the lstat result
+ * — `tree.ts` `openRegularNoFollow`); copies read their source through such an open, never by
+ * path; a staged tree is re-walked and re-hashed after the copy and before the rename into place.
+ * Residual, documented: a directory component swapped between the walk and the rename by another
+ * writer with access to the crew-owned state home — mitigated by the single-writer daemon and the
+ * post-operation verification, not eliminated.
+ */
+/**
+ * `reserved`: a name the store itself owns at that level (`snapshot.json`, `manifest.json`, `current`,
+ * `views/`, `.venv`). `outside-closure`: a support path outside the bundle closure — the ONE allowlist
+ * of what the seed copies and a snapshot may carry (bundle.ts `inBundleClosure`; codex round 6).
+ */
+export type SkillPathReason = 'invalid' | 'symlink' | 'nested-skill' | 'root' | 'reserved' | 'outside-closure';
+/** A skill-relative path the store refuses. `reason` names why; the route answers 400 with `message`. */
+export declare class SkillPathError extends Error {
+    readonly reason: SkillPathReason;
+    constructor(reason: SkillPathReason, message: string);
+}
+/**
+ * Validate a POSIX-relative path into its segments. Rejects: empty, NUL, backslashes (paths are
+ * POSIX; a backslash is never a separator here and never a filename), absolute / drive-prefixed,
+ * and `.` / `..` / empty segments.
+ */
+export declare function validateRelSegments(rel: string): string[];
+/**
+ * `join(root, ...segments)` after an lstat walk refusing any symlink component — the walk itself
+ * is `tree.ts` `assertNoSymlinkComponents` (the one no-follow rule every store path goes
+ * through); this wrapper only speaks the file manager's error type. `root` is the SKILLS root:
+ * the store passes `effective/<skill dir>/<path>` (or `baseline/<hash>/…`) as segments, so the
+ * skill directory itself is a walked component — replacing it with a link is refused, not
+ * followed. A component that does not exist yet ends the walk (a not-yet-written leaf, or its new
+ * parent dirs) — the write creates them. Any filesystem error other than ENOENT propagates: an
+ * unreadable component is not judged lexically.
+ */
+export declare function containedPath(root: string, segments: ReadonlyArray<string>): string;
+//# sourceMappingURL=contain.d.ts.map

package/dist/skills/contain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contain.d.ts","sourceRoot":"","sources":["../../src/skills/contain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,MAAM,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAE/G,yGAAyG;AACzG,qBAAa,cAAe,SAAQ,KAAK;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe;gBAAvB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAI9D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAoBnF"}

package/dist/skills/contain.js

@@ -0,0 +1,90 @@
+/**
+ * Skill-scoped containment for the `/skills` file manager (design v3 §API).
+ *
+ * NOT `api/open-path.ts` `isInsideRoot`: that helper FOLLOWS symlinks (a `<root>/link-to-outside`
+ * resolves to its real target, which is the right question for "may I open this file the run
+ * produced" and the wrong one for "may I write here") and accepts the root itself. Writes into the
+ * effective plugin root need the stricter rule:
+ *
+ *   1. the URL wildcard arrives DECODED EXACTLY ONCE — by Fastify (find-my-way decodes every `%xx`,
+ *      `%2F` included, before routing; a malformed escape is Fastify's own 400) — and the store
+ *      never decodes again (codex round 5 on #480: a second decode turned `100%25.txt` into a
+ *      refused `100%.txt` and the literal filename `a%252Fb.txt` into the path `a/b.txt`);
+ *   2. normalize into segments — refuse empty, `.`, `..`, backslashes, NUL, absolute / drive-prefixed;
+ *   3. lstat-walk EVERY existing component and refuse a symlink anywhere on the way (the plugin
+ *      tree carries none; one appearing is either an attack or an accident, and either way the
+ *      write must not follow it);
+ *   4. the root itself is not a file — an empty remainder is refused.
+ *
+ * Atomic tmp+rename writes are the store's job (`tree.ts` `writeFileAtomic`); this module only
+ * decides WHERE. And the walk is necessary, not sufficient (design v3.5 §3; codex round 8): the
+ * path it answers is then OPENED with `O_NOFOLLOW` where the platform has it, and the lstat-then-open
+ * gap is closed everywhere with a post-open identity check (`fstat` dev/ino against the lstat result
+ * — `tree.ts` `openRegularNoFollow`); copies read their source through such an open, never by
+ * path; a staged tree is re-walked and re-hashed after the copy and before the rename into place.
+ * Residual, documented: a directory component swapped between the walk and the rename by another
+ * writer with access to the crew-owned state home — mitigated by the single-writer daemon and the
+ * post-operation verification, not eliminated.
+ */
+import { assertNoSymlinkComponents, assertSafeRelSegments, SymlinkComponentError, unsafeSegmentReason, UnsafePathSegmentError } from './tree.js';
+/** A skill-relative path the store refuses. `reason` names why; the route answers 400 with `message`. */
+export class SkillPathError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = 'SkillPathError';
+    }
+}
+/**
+ * Validate a POSIX-relative path into its segments. Rejects: empty, NUL, backslashes (paths are
+ * POSIX; a backslash is never a separator here and never a filename), absolute / drive-prefixed,
+ * and `.` / `..` / empty segments.
+ */
+export function validateRelSegments(rel) {
+    // The ONE segment rule (tree.ts `assertSafeRelSegments`), spoken in the file manager's error type.
+    try {
+        return assertSafeRelSegments(rel);
+    }
+    catch (err) {
+        if (err instanceof UnsafePathSegmentError)
+            throw new SkillPathError('invalid', `invalid path ${JSON.stringify(rel)}: ${err.reason}`);
+        throw err;
+    }
+}
+/**
+ * `join(root, ...segments)` after an lstat walk refusing any symlink component — the walk itself
+ * is `tree.ts` `assertNoSymlinkComponents` (the one no-follow rule every store path goes
+ * through); this wrapper only speaks the file manager's error type. `root` is the SKILLS root:
+ * the store passes `effective/<skill dir>/<path>` (or `baseline/<hash>/…`) as segments, so the
+ * skill directory itself is a walked component — replacing it with a link is refused, not
+ * followed. A component that does not exist yet ends the walk (a not-yet-written leaf, or its new
+ * parent dirs) — the write creates them. Any filesystem error other than ENOENT propagates: an
+ * unreadable component is not judged lexically.
+ */
+export function containedPath(root, segments) {
+    if (segments.length === 0)
+        throw new SkillPathError('root', 'the root itself is not a file');
+    // Re-check EVERY component lexically, independent of where it came from (codex round 3): a
+    // manifest-sourced skill `dir` or file record is not trusted to be a safe segment — a `..`,
+    // an absolute/drive-prefixed piece, a separator or a NUL would join OUT of the root before the
+    // symlink walk ever ran. The request's own path is validated by `validateRelSegments`; this is
+    // the same rule applied to the FINAL joined path so the trusted-`dir` half cannot escape either.
+    for (const seg of segments) {
+        const why = unsafeSegmentReason(seg);
+        if (why !== null) {
+            throw new SkillPathError('invalid', `unsafe path segment ${JSON.stringify(seg)} (${why}) — the joined path must stay inside the skills root`);
+        }
+    }
+    try {
+        return assertNoSymlinkComponents(root, segments);
+    }
+    catch (err) {
+        if (err instanceof SymlinkComponentError)
+            throw new SkillPathError('symlink', err.message);
+        if (err instanceof UnsafePathSegmentError)
+            throw new SkillPathError('invalid', err.message);
+        throw err;
+    }
+}
+//# sourceMappingURL=contain.js.map

package/dist/skills/contain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contain.js","sourceRoot":"","sources":["../../src/skills/contain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AASjJ,yGAAyG;AACzG,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,MAAuB,EAAE,OAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,WAAM,GAAN,MAAM,CAAiB;QAE1C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,mGAAmG;IACnG,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrI,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAA+B;IACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,+FAA+F;IAC/F,iGAAiG;IACjG,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,sDAAsD,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3F,IAAI,GAAG,YAAY,sBAAsB;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/skills/core-closure.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Core-by-reference = the REGISTERED-REFERENCE CLOSURE (design v3 §5), recomputed at every publish:
+ *
+ *   seeds     every `skill_ref` of every workflow the daemon knows — core's drop-ins as mirrored in
+ *             `BUILTIN_WORKFLOWS` (asserted field-for-field against wicked-core's `workflows/*.json`
+ *             by tests/builtin-overlay-shadow.test.ts), crew's TS-generated workflows
+ *             (capture-learnings → repo-learn, domain-extraction → domain/extractor/coverage) and
+ *             any user-registered def — `adapter.listWorkflows()` is that one list;
+ *   closure   plus each referenced skill's mandates, transitively. A skill mandates another in two
+ *             ways, and BOTH are read (a mandate that is missed is a phase the engine refuses):
+ *
+ *             declared   the frontmatter `mandates:` list — consumed from the PARSED YAML
+ *                        (`parseFrontmatter().mandates`, frontmatter.ts): each entry's decoded
+ *                        scalar names a catalog skill, so `"wicked-garden-gamma"` mandates
+ *                        `wicked-garden-gamma` exactly as the parser reads it (codex round 4: the
+ *                        closure used to find mandates by a regex over the RAW text, which an
+ *                        escaped scalar slipped past). The frontmatter block is never regex-scanned.
+ *             prose      the BODY's qualified-name mentions (`repo-learn/SKILL.md:79` "Use the
+ *                        **wicked-garden-search** skill", `:113` "`wicked-garden-mem` `recall`") —
+ *                        the live catalog declares no `mandates:` today (0/142), so its real
+ *                        dependencies live in prose. Scanned over the body only
+ *                        (`bodyWithFrontmatterBlanked`): a frontmatter scalar is a parser's
+ *                        business, not a prose mention.
+ *
+ * Two kinds of ABSENCE are reported, and both block a publish (codex review of #480 — the closure
+ * used to fail open, warning on a missing registered ref and dropping an absent mandate silently):
+ *
+ *   missing          a registered ref that names no catalog skill — a run dispatching that phase
+ *                    would find no skill in the snapshot;
+ *   absentMandates   a name a CORE skill mandates (declared or in prose) that no catalog skill
+ *                    answers to — the mandated method is missing, with file:line.
+ *
+ * What counts as a qualified-name MENTION in prose is deliberately narrow so prose does not
+ * masquerade as a mandate: `wicked-garden-<x>` / `wicked-garden:<x>` not glued to a preceding name
+ * character; a token ending in `-`/`_` is a glob or prefix (`wicked-garden-qe-acceptance-test-*`),
+ * not a name; a token continued by `:` is a Claude subagent type (`wicked-garden:crew:implementer`),
+ * not a skill. A DECLARED mandate is taken verbatim (normalized from the Claude colon form) — the
+ * operator wrote it as a requirement, so a name the catalog lacks is absent, never ignored.
+ */
+import type { WorkflowDef } from '../core/types.js';
+/** One qualified name a SKILL.md requires: the catalog name it spells and the 1-based line. */
+export interface NameMention {
+    name: string;
+    line: number;
+}
+/** The non-null `skill_ref`s across a set of workflow defs. */
+export declare function registeredSkillRefs(workflows: ReadonlyArray<WorkflowDef>): Set<string>;
+/**
+ * Every well-formed qualified-name token in `text` with its line — catalog-agnostic, PROSE only.
+ * Glob/prefix tokens (trailing `-`/`_`) and `:`-continued subagent types are not names and are not
+ * returned. Callers hand this the body (`bodyWithFrontmatterBlanked`), never the frontmatter.
+ */
+export declare function mentionedTokens(text: string): NameMention[];
+/**
+ * Everything a SKILL.md mandates, in file order: the DECLARED `mandates:` entries as the YAML parser
+ * decoded them (positioned by node range), then the body's prose mentions (positioned by line). A
+ * frontmatter that does not parse declares nothing here — the frontmatter guard blocks it on its own.
+ */
+export declare function mandateMentions(skillMd: string): NameMention[];
+/** Catalog names `skillMd` mandates (declared + prose), excluding `self`. */
+export declare function mentionedSkillNames(skillMd: string, catalogNames: ReadonlySet<string>, self: string): Set<string>;
+export interface AbsentMandate {
+    /** The core skill whose SKILL.md names the absent skill. */
+    from: string;
+    /** The qualified name no catalog skill answers to. */
+    name: string;
+    /** 1-based line in `from`'s SKILL.md. */
+    line: number;
+}
+export interface CoreClosure {
+    core: Set<string>;
+    /** Registered refs that name no catalog skill. */
+    missing: string[];
+    /** Names core skills mandate (declared or in prose) that no catalog skill answers to, with file:line. */
+    absentMandates: AbsentMandate[];
+}
+/**
+ * BFS from `refs` over "SKILL.md mandates" (`mandateMentions`). `catalog` maps every catalog name
+ * (disabled skills included — disabling does not remove a skill from the catalog) to its SKILL.md
+ * text.
+ */
+export declare function coreClosure(refs: Iterable<string>, catalog: ReadonlyMap<string, string>): CoreClosure;
+//# sourceMappingURL=core-closure.d.ts.map

package/dist/skills/core-closure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-closure.d.ts","sourceRoot":"","sources":["../../src/skills/core-closure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+DAA+D;AAC/D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAQtF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAW3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAI9D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMjH;AAED,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yGAAyG;IACzG,cAAc,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAgCrG"}

package/dist/skills/core-closure.js

@@ -0,0 +1,130 @@
+/**
+ * Core-by-reference = the REGISTERED-REFERENCE CLOSURE (design v3 §5), recomputed at every publish:
+ *
+ *   seeds     every `skill_ref` of every workflow the daemon knows — core's drop-ins as mirrored in
+ *             `BUILTIN_WORKFLOWS` (asserted field-for-field against wicked-core's `workflows/*.json`
+ *             by tests/builtin-overlay-shadow.test.ts), crew's TS-generated workflows
+ *             (capture-learnings → repo-learn, domain-extraction → domain/extractor/coverage) and
+ *             any user-registered def — `adapter.listWorkflows()` is that one list;
+ *   closure   plus each referenced skill's mandates, transitively. A skill mandates another in two
+ *             ways, and BOTH are read (a mandate that is missed is a phase the engine refuses):
+ *
+ *             declared   the frontmatter `mandates:` list — consumed from the PARSED YAML
+ *                        (`parseFrontmatter().mandates`, frontmatter.ts): each entry's decoded
+ *                        scalar names a catalog skill, so `"wicked-garden-gamma"` mandates
+ *                        `wicked-garden-gamma` exactly as the parser reads it (codex round 4: the
+ *                        closure used to find mandates by a regex over the RAW text, which an
+ *                        escaped scalar slipped past). The frontmatter block is never regex-scanned.
+ *             prose      the BODY's qualified-name mentions (`repo-learn/SKILL.md:79` "Use the
+ *                        **wicked-garden-search** skill", `:113` "`wicked-garden-mem` `recall`") —
+ *                        the live catalog declares no `mandates:` today (0/142), so its real
+ *                        dependencies live in prose. Scanned over the body only
+ *                        (`bodyWithFrontmatterBlanked`): a frontmatter scalar is a parser's
+ *                        business, not a prose mention.
+ *
+ * Two kinds of ABSENCE are reported, and both block a publish (codex review of #480 — the closure
+ * used to fail open, warning on a missing registered ref and dropping an absent mandate silently):
+ *
+ *   missing          a registered ref that names no catalog skill — a run dispatching that phase
+ *                    would find no skill in the snapshot;
+ *   absentMandates   a name a CORE skill mandates (declared or in prose) that no catalog skill
+ *                    answers to — the mandated method is missing, with file:line.
+ *
+ * What counts as a qualified-name MENTION in prose is deliberately narrow so prose does not
+ * masquerade as a mandate: `wicked-garden-<x>` / `wicked-garden:<x>` not glued to a preceding name
+ * character; a token ending in `-`/`_` is a glob or prefix (`wicked-garden-qe-acceptance-test-*`),
+ * not a name; a token continued by `:` is a Claude subagent type (`wicked-garden:crew:implementer`),
+ * not a skill. A DECLARED mandate is taken verbatim (normalized from the Claude colon form) — the
+ * operator wrote it as a requirement, so a name the catalog lacks is absent, never ignored.
+ */
+import { bodyWithFrontmatterBlanked, parseFrontmatter, PLUGIN_NAME, SKILL_NAME_PREFIX } from './frontmatter.js';
+/** `wicked-garden-<x>` or the Claude plugin form `wicked-garden:<x>`, not glued to a preceding name char. */
+const NAME_TOKEN_RE = new RegExp(`(?<![A-Za-z0-9_-])${PLUGIN_NAME}[:-]([A-Za-z0-9_-]+)(:?)`, 'g');
+/** The non-null `skill_ref`s across a set of workflow defs. */
+export function registeredSkillRefs(workflows) {
+    const out = new Set();
+    for (const w of workflows) {
+        for (const p of w.phases) {
+            if (typeof p.skill_ref === 'string' && p.skill_ref !== '')
+                out.add(p.skill_ref);
+        }
+    }
+    return out;
+}
+/**
+ * Every well-formed qualified-name token in `text` with its line — catalog-agnostic, PROSE only.
+ * Glob/prefix tokens (trailing `-`/`_`) and `:`-continued subagent types are not names and are not
+ * returned. Callers hand this the body (`bodyWithFrontmatterBlanked`), never the frontmatter.
+ */
+export function mentionedTokens(text) {
+    const out = [];
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+        for (const m of (lines[i] ?? '').matchAll(NAME_TOKEN_RE)) {
+            const raw = m[1] ?? '';
+            if (m[2] === ':' || raw.endsWith('-') || raw.endsWith('_'))
+                continue;
+            out.push({ name: SKILL_NAME_PREFIX + raw, line: i + 1 });
+        }
+    }
+    return out;
+}
+/**
+ * Everything a SKILL.md mandates, in file order: the DECLARED `mandates:` entries as the YAML parser
+ * decoded them (positioned by node range), then the body's prose mentions (positioned by line). A
+ * frontmatter that does not parse declares nothing here — the frontmatter guard blocks it on its own.
+ */
+export function mandateMentions(skillMd) {
+    const parsed = parseFrontmatter(skillMd);
+    const declared = parsed.ok ? parsed.mandates.map((m) => ({ name: m.name, line: m.line })) : [];
+    return [...declared, ...mentionedTokens(bodyWithFrontmatterBlanked(skillMd))];
+}
+/** Catalog names `skillMd` mandates (declared + prose), excluding `self`. */
+export function mentionedSkillNames(skillMd, catalogNames, self) {
+    const out = new Set();
+    for (const { name } of mandateMentions(skillMd)) {
+        if (name !== self && catalogNames.has(name))
+            out.add(name);
+    }
+    return out;
+}
+/**
+ * BFS from `refs` over "SKILL.md mandates" (`mandateMentions`). `catalog` maps every catalog name
+ * (disabled skills included — disabling does not remove a skill from the catalog) to its SKILL.md
+ * text.
+ */
+export function coreClosure(refs, catalog) {
+    const names = new Set(catalog.keys());
+    const core = new Set();
+    const missing = [];
+    const absentMandates = [];
+    const queue = [];
+    for (const ref of refs) {
+        if (!names.has(ref)) {
+            missing.push(ref);
+            continue;
+        }
+        if (!core.has(ref)) {
+            core.add(ref);
+            queue.push(ref);
+        }
+    }
+    while (queue.length > 0) {
+        const name = queue.shift();
+        for (const mention of mandateMentions(catalog.get(name) ?? '')) {
+            if (mention.name === name)
+                continue;
+            if (!names.has(mention.name)) {
+                absentMandates.push({ from: name, name: mention.name, line: mention.line });
+                continue;
+            }
+            if (!core.has(mention.name)) {
+                core.add(mention.name);
+                queue.push(mention.name);
+            }
+        }
+    }
+    absentMandates.sort((a, b) => (a.from < b.from ? -1 : a.from > b.from ? 1 : a.line - b.line));
+    return { core, missing: [...new Set(missing)].sort(), absentMandates };
+}
+//# sourceMappingURL=core-closure.js.map

package/dist/skills/core-closure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-closure.js","sourceRoot":"","sources":["../../src/skills/core-closure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEhH,6GAA6G;AAC7G,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,qBAAqB,WAAW,0BAA0B,EAAE,GAAG,CAAC,CAAC;AAQlG,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,SAAqC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAkB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,eAAe,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,YAAiC,EAAE,IAAY;IAClG,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAsB,EAAE,OAAoC;IACtF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAoB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC;AACzE,CAAC"}

package/dist/skills/engine-env.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The engine handoff: `WICKED_SKILLS_SNAPSHOT` — exactly ONE variable (design v3 DECISION 2,
+ * v3.1 §2, v3.4 §2).
+ *
+ * wicked-core consumes exactly one skills input — the absolute REAL path of a published snapshot
+ * (`<state home>/skills/snapshots/<gen>`, every component — the LAST included — a real directory;
+ * never the `current` link itself and never a parent dir it would have to infer a manifest from;
+ * `WICKED_SKILLS_CURRENT` is withdrawn — v3.1 §2). Crew resolves `current` and exports the path
+ * here; the engine reads `process.env` per worker spawn (the `WICKED_WORKER_HOME` discipline in
+ * api/seat-signin.ts), so applying it at boot and after every publish is the whole mechanism — the
+ * next spawn sees the new snapshot, no daemon or engine restart.
+ *
+ * `WICKED_CREW_STATE_HOME` is RETIRED as an engine input (v3.4 §2 — it reverses the round-4
+ * "passed alongside" decision; core#399 pass 6 retires it on the engine side too). Core derives the
+ * state home it fences from the snapshot path's fixed layout — parent named `snapshots`,
+ * grandparent named `skills`, else a config error naming the path — so crew exports NOTHING beside
+ * the snapshot. The canonical state home is still REPORTED to humans (`GET /diagnostics` →
+ * `skills.stateHome`, `canonicalCrewStateHome()`); it is never an engine input.
+ *
+ * The degradation ladder (v3 §3) is the engine's: with the snapshot variable unset it falls back to
+ * the live installed garden cache and logs `skills.fallback`; with it set to a path that does not
+ * resolve, every launch FAILS loudly (config error). Crew uses both rungs deliberately
+ * (runtime.ts): a VERIFIED snapshot path when it has one; the boot value / unset ONLY when the
+ * configuration is absent (no garden installed — an operator-exported value, or the hermetic test
+ * arming, survives); and a non-existent refusal path (`<root>/refused/skills.{blocked,config}`)
+ * when the configuration is present but defective — a blocked first publish or a corrupt root
+ * must never be "restored" into a live-cache fallback that bypasses recorded disablement.
+ */
+export declare const SKILLS_SNAPSHOT_ENGINE_ENV = "WICKED_SKILLS_SNAPSHOT";
+/** The value this process BOOTED with (the `BOOT_WORKER_HOME` discipline): what "nothing to offer" restores. */
+export declare const BOOT_SKILLS_SNAPSHOT: string | undefined;
+/**
+ * `crewStateHome()` with every link resolved — the spelling `GET /diagnostics` reports as
+ * `skills.stateHome` for humans (NOT an engine input, v3.4 §2). A state home that does not exist
+ * yet (a fresh `--db` parent before the first store lands) is spelled absolute, unresolved.
+ */
+export declare function canonicalCrewStateHome(): string;
+/**
+ * Point the engine at `snapshotPath`, or — when the daemon has no published snapshot — restore
+ * the booted value EXACTLY: deleted when the process booted without one, and PRESERVED when it
+ * booted with an explicitly empty one (design v3.5 §4, v3.1 restated: set-but-empty is a
+ * configuration error core refuses loudly; only an ABSENT variable reaches the live-cache fallback
+ * rung — converting `""` to "unset" would have opened that rung by accident). `fallback` is the
+ * boot value; tests pass it explicitly. Nothing else is exported: the snapshot path is the engine's
+ * ONE skills input (v3.4 §2).
+ */
+export declare function applySkillsSnapshotEnv(snapshotPath: string | null | undefined, fallback?: string | undefined): void;
+//# sourceMappingURL=engine-env.d.ts.map

package/dist/skills/engine-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-env.d.ts","sourceRoot":"","sources":["../../src/skills/engine-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,gHAAgH;AAChH,eAAO,MAAM,oBAAoB,EAAE,MAAM,GAAG,SAAmD,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAO/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,GAAE,MAAM,GAAG,SAAgC,GAClD,IAAI,CAQN"}