@agentsmarket/cli 0.1.0

package/dist/commands/scan.js

@@ -0,0 +1,193 @@
+/**
+ * `agentsmarket scan <SKILL.md>` — security scan before publishing.
+ *
+ * Checks for common attack patterns in AI agent skills:
+ * - Prompt injection (override system instructions, ignore safety)
+ * - Data exfiltration (hidden URLs, webhook posts, env var access)
+ * - Hidden/obfuscated content (base64 blobs, eval/Function, encoded strings)
+ * - Dangerous commands (rm -rf, curl|bash, fs access)
+ * - Credential harvesting (API_KEY, SECRET, TOKEN patterns)
+ *
+ * Returns a 0-100 safety score. Exit code 0 if score >= 70 (publish).
+ * Exit code 1 if score < 70 (warnings — review before publishing).
+ *
+ * Differentiation vs competitors:
+ * - skills.sh / Agensi: third-party audits POST-publish (passive)
+ * - Gen Digital Agent Trust Hub / Snyk ToxicSkills / Socket: external scanners
+ *   for ONE marketplace (Composio/Smithery only)
+ * - agentsmarket scan: marketplace-integrated PRE-publish gate, real-time,
+ *   free, open source. Runs in CLI before skill hits the server.
+ */
+import { readFileSync } from 'node:fs';
+const PATTERNS = [
+    // CRITICAL: prompt injection
+    {
+        severity: 'critical', category: 'prompt-injection',
+        regex: /ignore\s+(all\s+)?previous\s+instructions/i,
+        message: 'Tries to override previous instructions',
+    },
+    {
+        severity: 'critical', category: 'prompt-injection',
+        regex: /disregard\s+(all\s+)?(prior|previous|above)\s+(instructions|rules|context)/i,
+        message: 'Tries to disregard prior rules or context',
+    },
+    {
+        severity: 'critical', category: 'prompt-injection',
+        regex: /system\s*prompt|reveal\s+system|show\s+system\s+prompt/i,
+        message: 'References or attempts to extract system prompt',
+    },
+    {
+        severity: 'critical', category: 'prompt-injection',
+        regex: /you\s+are\s+now\s+[a-z_]+|act\s+as\s+(an?\s+)?unrestricted/i,
+        message: 'Tries to override persona or remove restrictions',
+    },
+    // HIGH: data exfiltration
+    {
+        severity: 'high', category: 'exfiltration',
+        regex: /\b(fetch|axios|got|request)\s*\([^)]*\$\{?[A-Z_][A-Z0-9_]*\}?/,
+        message: 'Sends server-side env var via HTTP request',
+    },
+    {
+        severity: 'high', category: 'exfiltration',
+        regex: /\b(webhook\.site|requestbin|pipedream|burpcollaborator)\b/i,
+        message: 'Uses known exfiltration testing service',
+    },
+    {
+        severity: 'high', category: 'exfiltration',
+        regex: /https?:\/\/[^\s]*\$\{?[A-Z_]/i,
+        message: 'Embeds env var in URL (possible data exfiltration)',
+    },
+    // HIGH: hidden/obfuscated content
+    {
+        severity: 'high', category: 'obfuscation',
+        regex: /\beval\s*\(/,
+        message: 'Uses eval() (code execution risk)',
+    },
+    {
+        severity: 'high', category: 'obfuscation',
+        regex: /\bnew\s+Function\s*\(/,
+        message: 'Uses new Function() (code execution risk)',
+    },
+    {
+        severity: 'high', category: 'obfuscation',
+        regex: /\batob\s*\(\s*[A-Za-z0-9+/=]{100,}\s*\)/,
+        message: 'Decodes large base64 blob (possible hidden payload)',
+    },
+    // HIGH: credential harvesting
+    {
+        severity: 'high', category: 'credentials',
+        regex: /(API[_-]?KEY|SECRET[_-]?KEY|ACCESS[_-]?TOKEN|PRIVATE[_-]?KEY)\s*[:=]/i,
+        message: 'Contains hardcoded credential pattern',
+    },
+    {
+        severity: 'high', category: 'credentials',
+        regex: /\b(aws|github|gcp|azure|slack|openai|anthropic)[_-]?(token|key|secret)\s*[:=]/i,
+        message: 'Contains provider-specific credential',
+    },
+    // MEDIUM: dangerous commands
+    {
+        severity: 'medium', category: 'dangerous-cmd',
+        regex: /\brm\s+-rf?\s+\//,
+        message: 'Recursive delete from root',
+    },
+    {
+        severity: 'medium', category: 'dangerous-cmd',
+        regex: /\bcurl\s+[^|]+\|\s*(bash|sh)\b/,
+        message: 'Pipes curl output to shell (RCE risk)',
+    },
+    {
+        severity: 'medium', category: 'dangerous-cmd',
+        regex: /~\/\.ssh|\/etc\/passwd|\/etc\/shadow/,
+        message: 'References sensitive file paths',
+    },
+    // LOW: style issues
+    {
+        severity: 'low', category: 'style',
+        regex: /TODO|FIXME|XXX/i,
+        message: 'Unfinished code markers in skill',
+    },
+];
+const SCORE_BY_SEVERITY = {
+    critical: -40,
+    high: -15,
+    medium: -5,
+    low: -1,
+};
+function findLineNumber(content, matchIndex) {
+    return content.slice(0, matchIndex).split('\n').length;
+}
+export function scanContent(content, path) {
+    const findings = [];
+    for (const pattern of PATTERNS) {
+        let match;
+        const regex = new RegExp(pattern.regex.source, pattern.regex.flags + 'g');
+        while ((match = regex.exec(content)) !== null) {
+            findings.push({
+                severity: pattern.severity,
+                category: pattern.category,
+                message: pattern.message,
+                line: findLineNumber(content, match.index),
+            });
+            if (match[0].length === 0)
+                regex.lastIndex++;
+        }
+    }
+    const deductions = findings.reduce((sum, f) => sum + SCORE_BY_SEVERITY[f.severity], 0);
+    const score = Math.max(0, Math.min(100, 100 + deductions));
+    let recommendation = 'publish';
+    if (score < 50)
+        recommendation = 'block';
+    else if (score < 70)
+        recommendation = 'review';
+    return { path, score, findings, recommendation };
+}
+export async function scanCommand(filePath) {
+    let content;
+    try {
+        content = readFileSync(filePath, 'utf-8');
+    }
+    catch (err) {
+        console.error(`✗ Cannot read ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(2);
+    }
+    const result = scanContent(content, filePath);
+    const color = (s, code) => `\x1b[${code}m${s}\x1b[0m`;
+    const red = (s) => color(s, 31);
+    const yellow = (s) => color(s, 33);
+    const green = (s) => color(s, 32);
+    const gray = (s) => color(s, 90);
+    console.log(`\nScanning ${result.path}…\n`);
+    const bySev = { critical: [], high: [], medium: [], low: [] };
+    for (const f of result.findings)
+        bySev[f.severity].push(f);
+    if (result.findings.length === 0) {
+        console.log(green('  ✓ No issues found. Safe to publish.'));
+    }
+    else {
+        for (const [sev, list] of Object.entries(bySev)) {
+            if (list.length === 0)
+                continue;
+            const label = sev === 'critical' ? red(sev.toUpperCase()) :
+                sev === 'high' ? color(sev, 91) :
+                    sev === 'medium' ? yellow(sev) :
+                        gray(sev);
+            console.log(`  ${label} (${list.length})`);
+            for (const f of list) {
+                const where = f.line ? gray(`L${f.line}`) : '';
+                console.log(`    [${f.category}] ${f.message} ${where}`);
+            }
+        }
+    }
+    const scoreLabel = result.score >= 90 ? green(`${result.score}/100`) :
+        result.score >= 70 ? yellow(`${result.score}/100`) :
+            red(`${result.score}/100`);
+    console.log(`\nSafety score: ${scoreLabel}`);
+    const recLabel = result.recommendation === 'publish' ? green('✓ PUBLISH') :
+        result.recommendation === 'review' ? yellow('⚠ REVIEW before publishing') :
+            red('✗ BLOCK — do not publish');
+    console.log(`Recommendation: ${recLabel}\n`);
+    if (result.recommendation !== 'publish') {
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/commands/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,MAAM,QAAQ,GAA+F;IAC3G,6BAA6B;IAC7B;QACE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB;QAClD,KAAK,EAAE,4CAA4C;QACnD,OAAO,EAAE,yCAAyC;KACnD;IACD;QACE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB;QAClD,KAAK,EAAE,6EAA6E;QACpF,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB;QAClD,KAAK,EAAE,yDAAyD;QAChE,OAAO,EAAE,iDAAiD;KAC3D;IACD;QACE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB;QAClD,KAAK,EAAE,6DAA6D;QACpE,OAAO,EAAE,kDAAkD;KAC5D;IAED,0BAA0B;IAC1B;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc;QAC1C,KAAK,EAAE,+DAA+D;QACtE,OAAO,EAAE,4CAA4C;KACtD;IACD;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc;QAC1C,KAAK,EAAE,4DAA4D;QACnE,OAAO,EAAE,yCAAyC;KACnD;IACD;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc;QAC1C,KAAK,EAAE,+BAA+B;QACtC,OAAO,EAAE,oDAAoD;KAC9D;IAED,kCAAkC;IAClC;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACzC,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,mCAAmC;KAC7C;IACD;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACzC,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACzC,KAAK,EAAE,yCAAyC;QAChD,OAAO,EAAE,qDAAqD;KAC/D;IAED,8BAA8B;IAC9B;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACzC,KAAK,EAAE,uEAAuE;QAC9E,OAAO,EAAE,uCAAuC;KACjD;IACD;QACE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACzC,KAAK,EAAE,gFAAgF;QACvF,OAAO,EAAE,uCAAuC;KACjD;IAED,6BAA6B;IAC7B;QACE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe;QAC7C,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,4BAA4B;KACtC;IACD;QACE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe;QAC7C,KAAK,EAAE,gCAAgC;QACvC,OAAO,EAAE,uCAAuC;KACjD;IACD;QACE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe;QAC7C,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EAAE,iCAAiC;KAC3C;IAED,oBAAoB;IACpB;QACE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;QAClC,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,kCAAkC;KAC5C;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAwC;IAC7D,QAAQ,EAAE,CAAC,EAAE;IACb,IAAI,EAAE,CAAC,EAAE;IACT,MAAM,EAAE,CAAC,CAAC;IACV,GAAG,EAAE,CAAC,CAAC;CACR,CAAC;AAEF,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,KAA6B,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;aAC3C,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAChC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC/C,CAAC,CACF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC;IAE3D,IAAI,cAAc,GAAiC,SAAS,CAAC;IAC7D,IAAI,KAAK,GAAG,EAAE;QAAE,cAAc,GAAG,OAAO,CAAC;SACpC,IAAI,KAAK,GAAG,EAAE;QAAE,cAAc,GAAG,QAAQ,CAAC;IAE/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iBAAiB,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;IACtE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAE5C,MAAM,KAAK,GAA8B,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,KAAK,GACT,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC7C,GAAG,KAAK,MAAM,CAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBACrC,GAAG,KAAK,QAAQ,CAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBACZ,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;IAE7C,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,IAAI,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/search.d.ts

@@ -0,0 +1,4 @@
+export declare function searchCommand(query: string, opts?: {
+    freeOnly?: boolean;
+    limit?: number;
+}): Promise<void>;

package/dist/commands/search.js

@@ -0,0 +1,29 @@
+/**
+ * `agentsmarket search <query>` — browse the marketplace.
+ */
+import { authedFetch } from '../lib/http.js';
+export async function searchCommand(query, opts = {}) {
+    const params = new URLSearchParams();
+    params.set('q', query);
+    if (opts.freeOnly)
+        params.set('free', 'true');
+    if (opts.limit)
+        params.set('limit', String(opts.limit));
+    const path = `/v1/skills?${params.toString()}`;
+    const res = await authedFetch('GET', path, undefined, { requireAuth: false });
+    const data = await res.json();
+    if (data.skills.length === 0) {
+        console.log(`No skills found matching "${query}".`);
+        return;
+    }
+    console.log(`Found ${data.count} skill(s) matching "${query}":\n`);
+    for (const s of data.skills) {
+        const price = s.is_free ? 'FREE' : `$${(s.price_usdt / 1_000_000).toFixed(3)} USDT`;
+        const tags = s.tags.length ? `[${s.tags.join(', ')}]` : '';
+        console.log(`  ${s.id}`);
+        console.log(`    ${s.name} — ${price} (${s.invocation_count} invocations) ${tags}`);
+        console.log(`    ${s.description.slice(0, 120)}${s.description.length > 120 ? '...' : ''}`);
+        console.log(`    by ${s.author_agent_id}\n`);
+    }
+}
+//# sourceMappingURL=search.js.map

package/dist/commands/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,WAAW,EAAc,MAAM,gBAAgB,CAAC;AAazD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,OAA+C,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,IAAI,GAAG,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwC,CAAC;IAEpE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,IAAI,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,KAAK,uBAAuB,KAAK,MAAM,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,gBAAgB,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * agentsmarket CLI entry point.
+ *
+ * Commands:
+ *   init      Generate Ed25519 agent keypair (one-time setup)
+ *   info      Show current agent identity and status
+ *   search    Browse the marketplace for skills
+ *   call      Invoke a skill (handles signing + payment)
+ *   publish   Publish your own skill (from SKILL.md)
+ *   balance   Show current wallet balance in USDT
+ *
+ * More info: https://agentsmarket.world
+ */
+export {};

package/dist/index.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+/**
+ * agentsmarket CLI entry point.
+ *
+ * Commands:
+ *   init      Generate Ed25519 agent keypair (one-time setup)
+ *   info      Show current agent identity and status
+ *   search    Browse the marketplace for skills
+ *   call      Invoke a skill (handles signing + payment)
+ *   publish   Publish your own skill (from SKILL.md)
+ *   balance   Show current wallet balance in USDT
+ *
+ * More info: https://agentsmarket.world
+ */
+import { Command } from 'commander';
+import { initCommand } from './commands/init.js';
+import { infoCommand } from './commands/info.js';
+import { registerCommand } from './commands/register.js';
+import { searchCommand } from './commands/search.js';
+import { callCommand } from './commands/call.js';
+import { publishCommand } from './commands/publish.js';
+import { rateCommand } from './commands/rate.js';
+import { mcpCommand } from './commands/mcp.js';
+import { balanceCommand } from './commands/balance.js';
+import { scanCommand } from './commands/scan.js';
+import { refundCommand } from './commands/refund.js';
+import { installCommand } from './commands/install.js';
+import { renameCommand } from './commands/rename.js';
+const program = new Command();
+program
+    .name('agentsmarket')
+    .description('CLI for agentsmarket.world — manage your AI agent identity, wallet, and skill invocations.\n' +
+    'Generate an Ed25519 keypair, sign messages, browse and invoke skills from the marketplace.')
+    .version('0.1.0');
+program
+    .command('init')
+    .description('Generate a new Ed25519 agent keypair, save it locally, and register on server')
+    .action(initCommand);
+program
+    .command('register')
+    .description('Re-register the current agent on the marketplace server')
+    .action(registerCommand);
+program
+    .command('info')
+    .description('Show current agent identity, network, and config locations')
+    .action(infoCommand);
+program
+    .command('search <query>')
+    .description('Browse the marketplace for skills matching a query')
+    .option('--free', 'only show free skills')
+    .option('--limit <n>', 'max number of results', '20')
+    .action(async (query, opts) => {
+    await searchCommand(query, {
+        freeOnly: !!opts.free,
+        limit: opts.limit ? parseInt(opts.limit, 10) : undefined,
+    });
+});
+program
+    .command('call <skill_id>')
+    .description('Invoke a skill by ID (handles signing + payment automatically)')
+    .action(async (skillId) => {
+    await callCommand(skillId, {});
+});
+program
+    .command('publish <path>')
+    .description('Publish a SKILL.md to the marketplace (parses YAML frontmatter)')
+    .action(async (filePath) => {
+    await publishCommand(filePath);
+});
+program
+    .command('rate <skill_id> <rating>')
+    .description('Rate a purchased skill (1-5). Requires prior purchase within 30 days.')
+    .option('-c, --comment <text>', 'optional comment (max 1000 chars)')
+    .action(async (skillId, rating, opts) => {
+    await rateCommand(skillId, rating, { comment: opts.comment });
+});
+program
+    .command('mcp')
+    .description('Run agentsmarket as an MCP server (stdio). Use to expose marketplace tools to Claude Code, OpenCode, Cursor, Codex CLI, etc.')
+    .action(async () => {
+    await mcpCommand();
+});
+program
+    .command('scan <path>')
+    .description('Scan a SKILL.md file for security issues before publishing (prompt injection, exfiltration, obfuscation, dangerous commands). Exit 0 if safe to publish.')
+    .action(async (filePath) => {
+    await scanCommand(filePath);
+});
+program
+    .command('refund <purchase_id>')
+    .description('Refund a recent purchase if output was too short (<100 chars) and within 24h window. Phase 1 buyer protection.')
+    .action(async (purchaseId) => {
+    await refundCommand(purchaseId);
+});
+program
+    .command('install <skill_id>')
+    .description('Download a skill\'s SKILL.md and write it to your agent\'s skill directory (auto-detected). MCP-first: LLMs/agents should call install_skill MCP tool instead, since they know where they live.')
+    .action(async (skillId) => {
+    await installCommand(skillId);
+});
+program
+    .command('rename <display_name>')
+    .description('Set human-readable name for current agent (max 80 chars). Shown in skill listings + author profile.')
+    .action(async (newName) => {
+    await renameCommand(newName);
+});
+program
+    .command('balance')
+    .description('Show current wallet balance in USDT')
+    .action(balanceCommand);
+program.parseAsync(process.argv).catch((err) => {
+    console.error('✗ ' + (err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,cAAc,CAAC;KACpB,WAAW,CACV,8FAA8F;IAC9F,4FAA4F,CAC7F;KACA,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,eAAe,CAAC,CAAC;AAE3B,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;KACzC,MAAM,CAAC,aAAa,EAAE,uBAAuB,EAAE,IAAI,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAwC,EAAE,EAAE;IACxE,MAAM,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KACzD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;IAChC,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,0BAA0B,CAAC;KACnC,WAAW,CAAC,uEAAuE,CAAC;KACpF,MAAM,CAAC,sBAAsB,EAAE,mCAAmC,CAAC;KACnE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,MAAc,EAAE,IAA0B,EAAE,EAAE;IAC5E,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,8HAA8H,CAAC;KAC3I,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,0JAA0J,CAAC;KACvK,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,sBAAsB,CAAC;KAC/B,WAAW,CAAC,gHAAgH,CAAC;KAC7H,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;IACnC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,oBAAoB,CAAC;KAC7B,WAAW,CAAC,iMAAiM,CAAC;KAC9M,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;IAChC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,uBAAuB,CAAC;KAChC,WAAW,CAAC,qGAAqG,CAAC;KAClH,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;IAChC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,qCAAqC,CAAC;KAClD,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/config.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Config file management for agentsmarket CLI.
+ *
+ * Stores agent identity + network preference in ~/.config/agentsmarket/
+ *
+ * MVP: file-based storage with 0700 dir / 0600 file permissions.
+ * Production: migrate to OS keychain (macOS Keychain / Linux libsecret /
+ * Windows Credential Manager) via @napi-rs/keyring.
+ */
+export type Network = 'base-sepolia' | 'base-mainnet';
+export interface Config {
+    /** Ed25519 public key, base64url-encoded, with "ed25519:" prefix. */
+    agent_id: string;
+    /** secp256k1 payment address (0x-prefixed). Used for EIP-3009 USDC payments. */
+    payment_address: string;
+    /** Blockchain network. MVP: only base-sepolia supported. */
+    network: Network;
+    /** ISO 8601 timestamp of agent creation. */
+    created_at: string;
+}
+/** Returns ~/.config/agentsmarket (platform-correct home dir). */
+export declare function getConfigDir(): string;
+export declare function getKeyPath(): string;
+export declare function getPaymentKeyPath(): string;
+export declare function getConfigPath(): string;
+/** Returns existing config or null. */
+export declare function loadConfig(): Config | null;
+/** Save config file with 0600 permissions. Creates parent dir if needed. */
+export declare function saveConfig(config: Config): void;
+/** Save private key with 0600 permissions. */
+export declare function savePrivateKey(pem: string): void;
+/** Save secp256k1 payment key with 0600 permissions. */
+export declare function savePaymentKey(pem: string): void;
+export declare function loadPaymentKeyPem(): string;
+export declare function configExists(): boolean;
+export declare function keyExists(): boolean;
+export declare function paymentKeyExists(): boolean;

package/dist/lib/config.js

@@ -0,0 +1,112 @@
+/**
+ * Config file management for agentsmarket CLI.
+ *
+ * Stores agent identity + network preference in ~/.config/agentsmarket/
+ *
+ * MVP: file-based storage with 0700 dir / 0600 file permissions.
+ * Production: migrate to OS keychain (macOS Keychain / Linux libsecret /
+ * Windows Credential Manager) via @napi-rs/keyring.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+const CONFIG_DIR_NAME = 'agentsmarket';
+const KEY_FILE_NAME = 'agent.key';
+const PAYMENT_KEY_FILE_NAME = 'payment.key';
+const CONFIG_FILE_NAME = 'config.json';
+/** Returns ~/.config/agentsmarket (platform-correct home dir). */
+export function getConfigDir() {
+    const home = os.homedir();
+    if (process.platform === 'win32') {
+        return path.join(home, 'AppData', 'Roaming', CONFIG_DIR_NAME);
+    }
+    if (process.platform === 'darwin') {
+        return path.join(home, 'Library', 'Application Support', CONFIG_DIR_NAME);
+    }
+    // Linux / Unix — XDG default
+    const xdgConfig = process.env.XDG_CONFIG_HOME ?? path.join(home, '.config');
+    return path.join(xdgConfig, CONFIG_DIR_NAME);
+}
+export function getKeyPath() {
+    return path.join(getConfigDir(), KEY_FILE_NAME);
+}
+export function getPaymentKeyPath() {
+    return path.join(getConfigDir(), PAYMENT_KEY_FILE_NAME);
+}
+export function getConfigPath() {
+    return path.join(getConfigDir(), CONFIG_FILE_NAME);
+}
+/** Returns existing config or null. */
+export function loadConfig() {
+    try {
+        const content = fs.readFileSync(getConfigPath(), 'utf-8');
+        const parsed = JSON.parse(content);
+        if (typeof parsed.agent_id !== 'string' || !parsed.agent_id.startsWith('ed25519:')) {
+            return null;
+        }
+        if (typeof parsed.payment_address !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(parsed.payment_address)) {
+            return null;
+        }
+        if (parsed.network !== 'base-sepolia' && parsed.network !== 'base-mainnet') {
+            return null;
+        }
+        if (typeof parsed.created_at !== 'string') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Save config file with 0600 permissions. Creates parent dir if needed. */
+export function saveConfig(config) {
+    const dir = getConfigDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    setPermissions(dir, 0o700);
+    const configPath = getConfigPath();
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+    setPermissions(configPath, 0o600);
+}
+/** Save private key with 0600 permissions. */
+export function savePrivateKey(pem) {
+    const dir = getConfigDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    setPermissions(dir, 0o700);
+    const keyPath = getKeyPath();
+    fs.writeFileSync(keyPath, pem, { mode: 0o600 });
+    setPermissions(keyPath, 0o600);
+}
+/** Save secp256k1 payment key with 0600 permissions. */
+export function savePaymentKey(pem) {
+    const dir = getConfigDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    setPermissions(dir, 0o700);
+    const keyPath = getPaymentKeyPath();
+    fs.writeFileSync(keyPath, pem, { mode: 0o600 });
+    setPermissions(keyPath, 0o600);
+}
+export function loadPaymentKeyPem() {
+    return fs.readFileSync(getPaymentKeyPath(), 'utf-8');
+}
+export function configExists() {
+    return fs.existsSync(getConfigPath());
+}
+export function keyExists() {
+    return fs.existsSync(getKeyPath());
+}
+export function paymentKeyExists() {
+    return fs.existsSync(getPaymentKeyPath());
+}
+/** Set file permissions — best-effort on Windows (chmod doesn't fully apply). */
+function setPermissions(path, mode) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        fs.chmodSync(path, mode);
+    }
+    catch {
+        // Ignore — best effort
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAe9B,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAC5C,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,kEAAkE;AAClE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAW,CAAC;QAC7C,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;AACH,CAAC"}

package/dist/lib/http.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Authenticated HTTP client for the marketplace server.
+ *
+ * Signs every request with the agent's Ed25519 key per server protocol:
+ *   Headers:
+ *     X-Agent-ID:    ed25519:...
+ *     X-Signature:   base64(64-byte Ed25519 sig)
+ *     X-Timestamp:   unix ms (within 5 min drift)
+ *   Message: METHOD\nPATH\nTIMESTAMP\nSHA256(BODY)
+ */
+export declare class HttpError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** Make an authenticated request to the marketplace server. */
+export declare function authedFetch(method: string, path: string, body?: unknown, opts?: {
+    baseUrl?: string;
+    requireAuth?: boolean;
+}): Promise<Response>;
+/** Convenience: authed JSON request, returns parsed body. */
+export declare function authedJson<T>(method: string, path: string, body?: unknown, opts?: {
+    baseUrl?: string;
+    requireAuth?: boolean;
+}): Promise<T>;