@aipm-registry/cli 0.2.13 → 0.3.1

package/dist/bin.cjs

@@ -4160,7 +4160,7 @@ function expandTargets(targets) {
     return [...ALL_TOOLS];
   return targets.filter((t) => t !== "*");
 }
-var AiToolSchema, ALL_TOOLS, PackageManifestSchema;
+var AiToolSchema, ALL_TOOLS, PackageExampleSchema, PackageManifestSchema;
 var init_manifest = __esm({
   "../../packages/schemas/dist/manifest.js"() {
     "use strict";
@@ -4168,16 +4168,26 @@ var init_manifest = __esm({
     init_scope_name();
     AiToolSchema = external_exports.enum(["cursor", "claude", "*"]);
     ALL_TOOLS = ["cursor", "claude"];
+    PackageExampleSchema = external_exports.object({
+      title: external_exports.string().trim().min(1).max(80),
+      description: external_exports.string().trim().min(1).max(240).optional(),
+      prompt: external_exports.string().trim().min(1).max(1e3)
+    });
     PackageManifestSchema = external_exports.object({
       schemaVersion: external_exports.literal("0.1"),
       name: external_exports.string().regex(SCOPE_NAME_REGEX, "name must be @scope/name"),
       version: external_exports.string().min(1),
       type: external_exports.literal("skill"),
-      description: external_exports.string().min(1),
+      description: external_exports.string().trim().min(1).max(240),
       entry: external_exports.string().min(1),
       targets: external_exports.array(AiToolSchema).min(1),
       license: external_exports.string().optional(),
-      usage: external_exports.string().min(1).optional()
+      usage: external_exports.string().trim().min(1).max(2e3).optional(),
+      tags: external_exports.array(external_exports.string().trim().min(1).max(40)).max(12).optional(),
+      categories: external_exports.array(external_exports.string().trim().min(1).max(40)).max(4).optional(),
+      sourceUrl: external_exports.string().trim().url().max(500).optional(),
+      examples: external_exports.array(PackageExampleSchema).max(5).optional(),
+      releaseNotes: external_exports.string().trim().min(1).max(2e3).optional()
     });
   }
 });
@@ -7762,9 +7772,11 @@ function useColor() {
 var program = new Command();
 
 // src/bin.ts
+var import_node_crypto2 = require("node:crypto");
 var import_node_child_process4 = require("node:child_process");
-var import_promises9 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_node_http = require("node:http");
+var import_promises10 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
 var import_node_process5 = require("node:process");
 init_dist();
 init_dist4();
@@ -7989,15 +8001,15 @@ async function packStagedFiles(root) {
   }
 }
 async function unpackTarballToBuffer(tarball, entry) {
-  const { mkdtemp: mkdtemp2, rm: rm3, writeFile: writeFile6 } = await import("node:fs/promises");
-  const { join: join11 } = await import("node:path");
+  const { mkdtemp: mkdtemp2, rm: rm3, writeFile: writeFile7 } = await import("node:fs/promises");
+  const { join: join12 } = await import("node:path");
   const { tmpdir: tmpdir2 } = await import("node:os");
-  const tempDir = await mkdtemp2(join11(tmpdir2(), "aipm-install-"));
-  const tgzPath = join11(tempDir, "pkg.tgz");
+  const tempDir = await mkdtemp2(join12(tmpdir2(), "aipm-install-"));
+  const tgzPath = join12(tempDir, "pkg.tgz");
   try {
-    await writeFile6(tgzPath, tarball);
+    await writeFile7(tgzPath, tarball);
     await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
-    return (0, import_promises5.readFile)(join11(tempDir, entry), "utf8");
+    return (0, import_promises5.readFile)(join12(tempDir, entry), "utf8");
   } finally {
     await rm3(tempDir, { recursive: true, force: true });
   }
@@ -8032,7 +8044,7 @@ function privateInstallHint(name, status, token) {
   if (status !== 404 || !name.startsWith("@") || token) {
     return `Package not found: ${name} (${status})`;
   }
-  return `Package not found: ${name} (${status}). If @org/pkg is private, set AIPM_TOKEN with an install token from the dashboard.`;
+  return `Package not found: ${name} (${status}). If @org/pkg is private, run aipm login, or set AIPM_TOKEN for CI.`;
 }
 async function assertRegistryReachable(registry) {
   const base = registry.replace(/\/$/, "");
@@ -8054,16 +8066,64 @@ async function publishPackage(registry, name, tarball, token) {
   }
   return res.json();
 }
-async function searchPackages(registry, query, limit = 20) {
+async function searchPackages(registry, query, limit = 20, token) {
   const base = registry.replace(/\/$/, "");
   const params = new URLSearchParams();
   if (query) params.set("q", query);
   params.set("limit", String(limit));
-  const res = await registryFetch(`${base}/v1/packages?${params}`, base);
+  if (token) params.set("includePrivate", "true");
+  const res = await registryFetch(`${base}/v1/packages?${params}`, base, {
+    headers: registryAuthHeaders(token)
+  });
   if (!res.ok) throw new Error(`Search failed: ${res.status}`);
   const data = await res.json();
   return data.packages ?? [];
 }
+async function exchangeCliAuthCode(registry, input2) {
+  const base = registry.replace(/\/$/, "");
+  const res = await registryFetch(`${base}/v1/cli-auth/token`, base, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(input2)
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error ?? `CLI login failed: ${res.status}`);
+  }
+  return res.json();
+}
+async function refreshCliAuth(registry, refreshToken) {
+  const base = registry.replace(/\/$/, "");
+  const res = await registryFetch(`${base}/v1/cli-auth/refresh`, base, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ refreshToken })
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error ?? `CLI session refresh failed: ${res.status}`);
+  }
+  return res.json();
+}
+async function fetchCliAuthMe(registry, accessToken) {
+  const base = registry.replace(/\/$/, "");
+  const res = await registryFetch(`${base}/v1/cli-auth/me`, base, {
+    headers: registryAuthHeaders(accessToken)
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error ?? `CLI auth check failed: ${res.status}`);
+  }
+  return res.json();
+}
+async function logoutCliAuth(registry, refreshToken) {
+  const base = registry.replace(/\/$/, "");
+  await registryFetch(`${base}/v1/cli-auth/logout`, base, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ refreshToken })
+  });
+}
 async function fetchPackageMetadata(registry, name, version, token) {
   const base = registry.replace(/\/$/, "");
   const url = `${base}/v1/packages/${encodePackageName(name)}/versions/${version}`;
@@ -8080,41 +8140,102 @@ async function fetchPackageTarball(registry, name, version, token) {
   const ab = await res.arrayBuffer();
   return Buffer.from(ab);
 }
+async function recordPackageInstall(registry, name, token) {
+  const base = registry.replace(/\/$/, "");
+  const url = `${base}/v1/packages/${encodePackageName(name)}/installs`;
+  const res = await registryFetch(url, base, {
+    method: "POST",
+    headers: registryAuthHeaders(token)
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({}));
+    throw new Error(err.error ?? `Install recording failed: ${res.status}`);
+  }
+  return res.json();
+}
+
+// src/auth-store.ts
+var import_promises7 = require("node:fs/promises");
+var import_node_os2 = require("node:os");
+var import_node_path7 = require("node:path");
+var AUTH_FILE = (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
+function normalizeRegistry(registry) {
+  return registry.replace(/\/$/, "");
+}
+async function readAuthStore() {
+  try {
+    const raw = await (0, import_promises7.readFile)(AUTH_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    return { registries: parsed.registries ?? {} };
+  } catch {
+    return { registries: {} };
+  }
+}
+async function writeAuthStore(store) {
+  await (0, import_promises7.mkdir)((0, import_node_path7.dirname)(AUTH_FILE), { recursive: true });
+  await (0, import_promises7.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
+  await (0, import_promises7.chmod)(AUTH_FILE, 384).catch(() => void 0);
+}
+async function getStoredRegistryAuth(registry) {
+  const store = await readAuthStore();
+  return store.registries[normalizeRegistry(registry)] ?? null;
+}
+async function setStoredRegistryAuth(registry, auth) {
+  const store = await readAuthStore();
+  store.registries[normalizeRegistry(registry)] = auth;
+  await writeAuthStore(store);
+}
+async function clearStoredRegistryAuth(registry) {
+  const store = await readAuthStore();
+  const key = normalizeRegistry(registry);
+  const existing = store.registries[key] ?? null;
+  delete store.registries[key];
+  await writeAuthStore(store);
+  return existing;
+}
+function authFilePath() {
+  return AUTH_FILE;
+}
+function isAccessTokenFresh(auth, skewMs = 6e4) {
+  if (!auth?.accessToken || !auth.accessTokenExpiresAt) return false;
+  const expiresAt = Date.parse(auth.accessTokenExpiresAt);
+  return Number.isFinite(expiresAt) && expiresAt - skewMs > Date.now();
+}
 
 // src/install-one.ts
 init_dist4();
 
 // src/project-files.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_path7 = require("node:path");
+var import_promises8 = require("node:fs/promises");
+var import_node_path8 = require("node:path");
 init_dist();
 var PACKAGE_JSON = "aipm.package.json";
 var LOCKFILE = "aipm-lock.json";
 async function readProjectPackageJson(projectRoot) {
   try {
-    const raw = await (0, import_promises7.readFile)((0, import_node_path7.join)(projectRoot, PACKAGE_JSON), "utf8");
+    const raw = await (0, import_promises8.readFile)((0, import_node_path8.join)(projectRoot, PACKAGE_JSON), "utf8");
     return ProjectPackageJsonSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeProjectPackageJson(projectRoot, data) {
-  await (0, import_promises7.writeFile)(
-    (0, import_node_path7.join)(projectRoot, PACKAGE_JSON),
+  await (0, import_promises8.writeFile)(
+    (0, import_node_path8.join)(projectRoot, PACKAGE_JSON),
     JSON.stringify(data, null, 2) + "\n",
     "utf8"
   );
 }
 async function readLockfile(projectRoot) {
   try {
-    const raw = await (0, import_promises7.readFile)((0, import_node_path7.join)(projectRoot, LOCKFILE), "utf8");
+    const raw = await (0, import_promises8.readFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), "utf8");
     return LockfileSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeLockfile(projectRoot, data) {
-  await (0, import_promises7.writeFile)((0, import_node_path7.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
+  await (0, import_promises8.writeFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function upsertLockEntry(lock, name, entry) {
   return {
@@ -8248,23 +8369,23 @@ async function installOnePackage(options) {
 
 // src/doctor.ts
 var import_node_child_process3 = require("node:child_process");
-var import_promises8 = require("node:fs/promises");
-var import_node_path9 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
 var import_node_util4 = require("node:util");
 
 // src/project-root.ts
-var import_node_os2 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_os3 = require("node:os");
+var import_node_path9 = require("node:path");
 var import_node_process3 = require("node:process");
 function globalConfigDir(env2 = process.env) {
   const fromEnv = env2.AIPM_HOME?.trim();
-  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".aipm");
+  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".aipm");
 }
 function resolveConfigRoot(options = {}) {
   return options.global ? globalConfigDir() : (0, import_node_process3.cwd)();
 }
 function resolveInstallRoot(options = {}) {
-  return options.global ? (0, import_node_os2.homedir)() : (0, import_node_process3.cwd)();
+  return options.global ? (0, import_node_os3.homedir)() : (0, import_node_process3.cwd)();
 }
 function scopeLabel(options) {
   return options.global ? "global" : "project";
@@ -8289,11 +8410,11 @@ async function commandOutput(command, args) {
 }
 function npmGlobalBin(prefix) {
   if (!prefix) return null;
-  return process.platform === "win32" ? prefix : `${prefix}${import_node_path9.sep}bin`;
+  return process.platform === "win32" ? prefix : `${prefix}${import_node_path10.sep}bin`;
 }
 function pathIncludes(pathDir) {
   if (!pathDir) return false;
-  return (process.env.PATH ?? "").split(import_node_path9.delimiter).includes(pathDir);
+  return (process.env.PATH ?? "").split(import_node_path10.delimiter).includes(pathDir);
 }
 function shellPathHint(binDir) {
   if (!binDir) return "Run npm prefix -g and add its bin folder to PATH.";
@@ -8346,11 +8467,11 @@ async function runDoctor(options) {
   if (!options.publish) {
     const configLabel = options.global ? "Global config" : "Project config";
     try {
-      await (0, import_promises8.access)((0, import_node_path9.join)(configRoot, "aipm.package.json"));
+      await (0, import_promises9.access)((0, import_node_path10.join)(configRoot, "aipm.package.json"));
       checks.push({
         name: configLabel,
         ok: true,
-        detail: `${(0, import_node_path9.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
+        detail: `${(0, import_node_path10.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
       });
     } catch {
       checks.push({
@@ -8420,9 +8541,9 @@ async function runDoctor(options) {
 
 // src/version.ts
 var import_node_fs2 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 function getCliVersion() {
-  const pkgPath = (0, import_node_path10.join)(__dirname, "..", "package.json");
+  const pkgPath = (0, import_node_path11.join)(__dirname, "..", "package.json");
   const pkg = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
   return pkg.version;
 }
@@ -8523,7 +8644,9 @@ program2.name("aipm").description("AI package manager").enablePositionalOptions(
 Examples:
   $ npm install -g @aipm-registry/cli
   $ aipm doctor
-  $ aipm init
+  $ aipm login
+  $ aipm whoami
+  $ aipm init --target cursor
   $ aipm init -g
   $ aipm search sentry
   $ aipm add @scope/name@1.0.0 --target cursor --ci
@@ -8537,6 +8660,10 @@ Examples:
 function registryFromEnvOrDefault(flag) {
   return resolveRegistryUrl(null, flag, DEFAULT_REGISTRY);
 }
+function packagePageUrl(packageName, version) {
+  const [scope, name] = packageName.replace(/^@/, "").split("/");
+  return `${SITE_URL}/packages/${encodeURIComponent(scope ?? "")}/${encodeURIComponent(name ?? "")}/${encodeURIComponent(version)}`;
+}
 function parsePackageArg(value) {
   const match = value.match(/^(@[^@]+)(?:@(.+))?$/);
   if (!match) throw new Error("Package must be @scope/name or @scope/name@version");
@@ -8551,23 +8678,23 @@ function skillFolderName(name) {
   return folder;
 }
 async function writeStarterFile(path2, content) {
-  await (0, import_promises9.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
+  await (0, import_promises10.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
 }
 async function inferEntryFromSource(source, fallback) {
-  const sourceInfo = await (0, import_promises9.stat)(source);
-  if (sourceInfo.isFile()) return (0, import_node_path11.basename)(source);
+  const sourceInfo = await (0, import_promises10.stat)(source);
+  if (sourceInfo.isFile()) return (0, import_node_path12.basename)(source);
   if (!sourceInfo.isDirectory()) return fallback;
-  const entries = await (0, import_promises9.readdir)(source);
+  const entries = await (0, import_promises10.readdir)(source);
   if (entries.includes(fallback)) return fallback;
   return entries.find((entry) => entry.endsWith(".md")) ?? entries.find((entry) => entry.endsWith(".mdc")) ?? fallback;
 }
 async function copySourceIntoSkillRoot(source, root, sourceLabel) {
-  const sourceInfo = await (0, import_promises9.stat)(source);
-  await (0, import_promises9.mkdir)(root, { recursive: true });
+  const sourceInfo = await (0, import_promises10.stat)(source);
+  await (0, import_promises10.mkdir)(root, { recursive: true });
   if (sourceInfo.isDirectory()) {
-    const entries = await (0, import_promises9.readdir)(source);
+    const entries = await (0, import_promises10.readdir)(source);
     for (const entry of entries) {
-      await (0, import_promises9.cp)((0, import_node_path11.join)(source, entry), (0, import_node_path11.join)(root, entry), {
+      await (0, import_promises10.cp)((0, import_node_path12.join)(source, entry), (0, import_node_path12.join)(root, entry), {
         recursive: true,
         force: false,
         errorOnExist: true
@@ -8576,13 +8703,13 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
     return;
   }
   if (sourceInfo.isFile()) {
-    await (0, import_promises9.cp)(source, (0, import_node_path11.join)(root, (0, import_node_path11.basename)(source)), { force: false, errorOnExist: true });
+    await (0, import_promises10.cp)(source, (0, import_node_path12.join)(root, (0, import_node_path12.basename)(source)), { force: false, errorOnExist: true });
     return;
   }
   throw new Error(`Unsupported source path: ${sourceLabel}`);
 }
-async function latestVersionForPackage(registry, name) {
-  const packages = await searchPackages(registry, name, 20);
+async function latestVersionForPackage(registry, name, token) {
+  const packages = await searchPackages(registry, name, 20, token);
   const exact = packages.find((pkg) => pkg.name === name);
   if (!exact) throw new Error(`Package not found in registry: ${name}`);
   return exact.version;
@@ -8617,6 +8744,111 @@ async function openUrl(url) {
   });
   console.log(`Open: ${url}`);
 }
+function randomBase64Url(bytes = 32) {
+  return (0, import_node_crypto2.randomBytes)(bytes).toString("base64url");
+}
+function sha256Base64Url(value) {
+  return (0, import_node_crypto2.createHash)("sha256").update(value).digest("base64url");
+}
+function deviceName() {
+  return `AIPM CLI on ${process.platform}`;
+}
+async function authTokenForRegistry(registry, options = {}) {
+  const stored = await getStoredRegistryAuth(registry);
+  if (!stored?.refreshToken) return void 0;
+  if (isAccessTokenFresh(stored)) return stored.accessToken;
+  try {
+    const refreshed = await refreshCliAuth(registry, stored.refreshToken);
+    await setStoredRegistryAuth(registry, {
+      ...stored,
+      accessToken: refreshed.accessToken,
+      accessTokenExpiresAt: refreshed.accessTokenExpiresAt
+    });
+    return refreshed.accessToken;
+  } catch {
+    await clearStoredRegistryAuth(registry);
+    const message = `CLI login for ${registry} expired or was revoked. Run aipm login to access private packages.`;
+    if (options.throwOnFailure) throw new Error(message);
+    if (!options.quiet) console.warn(`Warning: ${message}`);
+    return void 0;
+  }
+}
+async function tokenForRead(registry, explicitToken, options = {}) {
+  return explicitToken ?? import_node_process5.env.AIPM_TOKEN ?? await authTokenForRegistry(registry, options);
+}
+async function runLoopbackLogin(options) {
+  const state = randomBase64Url(24);
+  const verifier = randomBase64Url(48);
+  const challenge = sha256Base64Url(verifier);
+  const result = await new Promise((resolveLogin, rejectLogin) => {
+    const server = (0, import_node_http.createServer)((request, response) => {
+      const host = request.headers.host ?? "127.0.0.1";
+      const url = new URL(request.url ?? "/", `http://${host}`);
+      if (url.pathname !== "/callback") {
+        response.writeHead(404, { "content-type": "text/plain" });
+        response.end("Not found");
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        response.writeHead(400, { "content-type": "text/html" });
+        response.end("<h1>AIPM login failed</h1><p>Invalid state. Return to the terminal and try again.</p>");
+        rejectLogin(new Error("Invalid CLI login state"));
+        server.close();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (!code) {
+        response.writeHead(400, { "content-type": "text/html" });
+        response.end("<h1>AIPM login failed</h1><p>Missing code. Return to the terminal and try again.</p>");
+        rejectLogin(new Error("Missing CLI authorization code"));
+        server.close();
+        return;
+      }
+      response.writeHead(200, { "content-type": "text/html" });
+      response.end("<h1>AIPM CLI is signed in</h1><p>You can close this window and return to the terminal.</p>");
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        rejectLogin(new Error("Could not read CLI callback address"));
+      } else {
+        resolveLogin({ code, redirectUri: `http://127.0.0.1:${address.port}/callback` });
+      }
+      server.close();
+    });
+    server.once("error", rejectLogin);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+      const loginUrl = new URL("/cli/login", options.siteUrl);
+      loginUrl.searchParams.set("redirect_uri", redirectUri);
+      loginUrl.searchParams.set("state", state);
+      loginUrl.searchParams.set("code_challenge", challenge);
+      loginUrl.searchParams.set("device", deviceName());
+      console.log("Authorize the AIPM CLI in your browser.");
+      if (options.open) void openUrl(loginUrl.toString());
+      else console.log(`Open: ${loginUrl.toString()}`);
+    });
+    server.setTimeout(5 * 60 * 1e3, () => {
+      rejectLogin(new Error("CLI login timed out"));
+      server.close();
+    });
+  });
+  const tokens = await exchangeCliAuthCode(options.registry, {
+    code: result.code,
+    codeVerifier: verifier,
+    redirectUri: result.redirectUri,
+    deviceName: deviceName()
+  });
+  await setStoredRegistryAuth(options.registry, {
+    accessToken: tokens.accessToken,
+    accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+    refreshToken: tokens.refreshToken,
+    refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+    user: tokens.user
+  });
+  const label = tokens.user?.username ?? tokens.user?.githubLogin ?? tokens.user?.email ?? "AIPM user";
+  console.log(`Logged in as ${label}.`);
+  console.log(`Credentials saved to ${authFilePath()}`);
+}
 function printPublishFlow() {
   console.log("AIPM publish flow");
   console.log("1. Create an account and organization in the dashboard.");
@@ -8728,12 +8960,55 @@ function parseSkillTemplate(value) {
   if (value in SKILL_TEMPLATES) return value;
   throw new Error(`Unknown template "${value}". Use one of: ${Object.keys(SKILL_TEMPLATES).join(", ")}`);
 }
+var TEMPLATE_METADATA = {
+  blank: {
+    tags: ["ai-skill"],
+    categories: ["AI workflow"],
+    exampleTitle: "Use this skill in a project",
+    examplePrompt: "Use this skill with the current project context and explain the next useful action."
+  },
+  "code-review": {
+    tags: ["code-review", "pull-requests", "quality"],
+    categories: ["Engineering", "Quality"],
+    exampleTitle: "Review a pull request",
+    examplePrompt: "Review my current diff for correctness, regressions, missing tests, and security risk."
+  },
+  "issue-summary": {
+    tags: ["issue-summary", "triage", "support"],
+    categories: ["Support", "Engineering"],
+    exampleTitle: "Summarize a production issue",
+    examplePrompt: "Summarize this issue with impact, likely cause, evidence, and next debugging steps."
+  },
+  "release-notes": {
+    tags: ["release-notes", "changelog", "documentation"],
+    categories: ["Product", "Documentation"],
+    exampleTitle: "Draft release notes",
+    examplePrompt: "Draft release notes from these changes with highlights, fixes, upgrade notes, and known issues."
+  }
+};
+function buildStarterQualityMetadata(options) {
+  const metadata = TEMPLATE_METADATA[options.template];
+  const shortName = skillFolderName(options.name);
+  return {
+    usage: `Install ${options.name}, then ask your AI assistant to use the ${shortName} skill when the project needs: ${options.description}`,
+    tags: metadata.tags,
+    categories: metadata.categories,
+    examples: [
+      {
+        title: metadata.exampleTitle,
+        prompt: metadata.examplePrompt
+      }
+    ],
+    releaseNotes: "Initial release."
+  };
+}
 async function initSkill(opts) {
   if (!isValidScopeName(opts.name)) throw new Error("Invalid @scope/name");
-  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path11.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
+  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path12.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
   const cdTarget = opts.here ? null : opts.dir ?? skillFolderName(opts.name);
-  const source = opts.from ? (0, import_node_path11.resolve)(opts.from) : null;
+  const source = opts.from ? (0, import_node_path12.resolve)(opts.from) : null;
   const entry = source ? await inferEntryFromSource(source, opts.entry) : opts.entry;
+  const template = parseSkillTemplate(opts.template ?? "blank");
   const manifest = PackageManifestSchema.parse({
     schemaVersion: "0.1",
     name: opts.name,
@@ -8742,23 +9017,27 @@ async function initSkill(opts) {
     description: opts.description,
     entry,
     targets: parseTargetsFlag(opts.targets),
-    license: "Apache-2.0"
+    license: "Apache-2.0",
+    ...buildStarterQualityMetadata({
+      name: opts.name,
+      description: opts.description,
+      template
+    })
   });
   if (source) {
     await copySourceIntoSkillRoot(source, root, source);
   } else {
-    await (0, import_promises9.mkdir)(root, { recursive: true });
+    await (0, import_promises10.mkdir)(root, { recursive: true });
   }
-  await writeStarterFile((0, import_node_path11.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await writeStarterFile((0, import_node_path12.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
   if (!opts.from) {
-    const template = parseSkillTemplate(opts.template ?? "blank");
     await writeStarterFile(
-      (0, import_node_path11.join)(root, entry),
+      (0, import_node_path12.join)(root, entry),
       SKILL_TEMPLATES[template](opts.name)
     );
   }
   await writeStarterFile(
-    (0, import_node_path11.join)(root, ".aipmignore"),
+    (0, import_node_path12.join)(root, ".aipmignore"),
     [
       "# Files that should never be published with this skill",
       ".env*",
@@ -8776,14 +9055,14 @@ async function initSkill(opts) {
       ""
     ].join("\n")
   );
-  await (0, import_promises9.mkdir)((0, import_node_path11.join)(root, ".aipm"), { recursive: true });
+  await (0, import_promises10.mkdir)((0, import_node_path12.join)(root, ".aipm"), { recursive: true });
   console.log(`Created ${opts.name} skill folder: ${root}`);
   printPublishGuide(
     opts.from ? `Copied ${opts.from} into ${root} and created aipm.manifest.json, .aipmignore, and the local publish state folder.` : `Created ${root} with aipm.manifest.json, ${entry}, .aipmignore, and the local publish state folder.`,
     cdTarget ? `Run cd ${cdTarget}, edit/review the files, then run aipm publish add .` : "Edit/review the files, then run aipm publish add ."
   );
 }
-program2.command("init").description("Create aipm.package.json in the current project or globally").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Default registry URL").action(async (opts) => {
+program2.command("init").description("Create aipm.package.json in the current project or globally").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Default registry URL").option("--target <tool>", "Preferred install target: cursor, claude, or *").action(async (opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const existing = await readProjectPackageJson(configRoot);
@@ -8791,11 +9070,12 @@ program2.command("init").description("Create aipm.package.json in the current pr
     console.log(`aipm.package.json already exists (${scopeLabel(scope)}).`);
     return;
   }
-  if (scope.global) await (0, import_promises9.mkdir)(configRoot, { recursive: true });
+  if (scope.global) await (0, import_promises10.mkdir)(configRoot, { recursive: true });
   const installRoot = resolveInstallRoot(scope);
   const detected = await detectToolsInProject(installRoot);
-  let preferredTools = detected;
-  if (detected.length === 0) {
+  const parsedTarget = parseTargetFlag(opts.target);
+  let preferredTools = parsedTarget ? [parsedTarget] : detected;
+  if (!opts.target && detected.length === 0) {
     const choice = await promptForTool();
     preferredTools = [choice];
   }
@@ -8808,12 +9088,44 @@ program2.command("init").description("Create aipm.package.json in the current pr
   });
   console.log(`Created aipm.package.json (${scopeLabel(scope)}, registry: ${registry})`);
 });
-program2.command("login").description("Open the AIPM dashboard sign-in page").option("--no-open", "Print the URL without opening a browser").action(async (opts) => {
-  const url = `${SITE_URL}/login`;
-  console.log("AIPM uses the website dashboard for account sign-in and short-lived publish tokens.");
-  console.log("After signing in, create or open an organization, reserve a package, and generate a token.");
-  if (opts.open) await openUrl(url);
-  else console.log(`Open: ${url}`);
+program2.command("login").description("Sign in and store a local CLI session for private installs").option("--registry <url>", "Registry API base URL").option("--site <url>", "Website base URL", SITE_URL).option("--no-open", "Print the URL without opening a browser").action(async (opts) => {
+  const registry = registryFromEnvOrDefault(opts.registry);
+  await runLoopbackLogin({
+    registry,
+    siteUrl: opts.site.replace(/\/$/, ""),
+    open: opts.open
+  });
+});
+program2.command("whoami").description("Show the current AIPM CLI login").option("--registry <url>", "Registry API base URL").option("--json", "Print machine-readable JSON").action(async (opts) => {
+  const registry = registryFromEnvOrDefault(opts.registry);
+  const token = await authTokenForRegistry(registry, { quiet: opts.json, throwOnFailure: true });
+  if (!token) {
+    if (opts.json) console.log(JSON.stringify({ loggedIn: false }, null, 2));
+    else console.log("Not logged in. Run aipm login.");
+    return;
+  }
+  const me = await fetchCliAuthMe(registry, token);
+  if (opts.json) {
+    console.log(JSON.stringify({ loggedIn: true, registry, ...me }, null, 2));
+    return;
+  }
+  const label = me.user?.username ?? me.user?.githubLogin ?? me.user?.email ?? me.user?.userId ?? "AIPM user";
+  console.log(`Logged in as ${label}`);
+  console.log(`Registry: ${registry}`);
+  if (me.orgs.length > 0) {
+    console.log("Organizations:");
+    for (const org of me.orgs) console.log(`  @${org.slug} (${org.role})`);
+  } else {
+    console.log("Organizations: none");
+  }
+});
+program2.command("logout").description("Revoke and remove the local AIPM CLI session").option("--registry <url>", "Registry API base URL").action(async (opts) => {
+  const registry = registryFromEnvOrDefault(opts.registry);
+  const existing = await clearStoredRegistryAuth(registry);
+  if (existing?.refreshToken) {
+    await logoutCliAuth(registry, existing.refreshToken).catch(() => void 0);
+  }
+  console.log(`Logged out of ${registry}.`);
 });
 program2.command("config").description("Show resolved AIPM CLI and project configuration").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--json", "Print machine-readable JSON").action(async (opts) => {
   const scope = { global: opts.global };
@@ -8822,6 +9134,7 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
   const project = await readProjectPackageJson(configRoot);
   const lock = await readLockfile(configRoot);
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
+  const storedAuth = await getStoredRegistryAuth(registry);
   const data = {
     cliVersion: CLI_VERSION,
     nodeVersion: process.versions.node,
@@ -8835,6 +9148,8 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
     projectPackages: project ? Object.keys(project.packages) : [],
     hasLockfile: Boolean(lock),
     installedPackages: lock ? Object.keys(lock.packages) : [],
+    loggedIn: Boolean(storedAuth?.refreshToken),
+    authFile: authFilePath(),
     publishDoc: PUBLISH_DOC_URL
   };
   if (opts.json) {
@@ -8853,6 +9168,8 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
   console.log(`Configured packages: ${data.projectPackages.length}`);
   console.log(`Lockfile: ${data.hasLockfile ? "found" : "not found"}`);
   console.log(`Installed packages: ${data.installedPackages.length}`);
+  console.log(`CLI login: ${data.loggedIn ? "found" : "not found"}`);
+  console.log(`Auth file: ${data.authFile}`);
   console.log(`Publish guide: ${data.publishDoc}`);
 });
 program2.command("add <package>").description("Add and install a package @scope/name[@version]").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive; fail if prompt needed").action(async (pkgArg, opts) => {
@@ -8863,7 +9180,8 @@ program2.command("add <package>").description("Add and install a package @scope/
   let project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
-  const version = requestedVersion ?? project.packages[name] ?? await latestVersionForPackage(registry, name);
+  const token = await tokenForRead(registry, opts.token);
+  const version = requestedVersion ?? project.packages[name] ?? await latestVersionForPackage(registry, name, token);
   if (!version) throw new Error("Specify version: aipm add @scope/pkg@1.0.0");
   project = {
     ...project,
@@ -8879,15 +9197,24 @@ program2.command("add <package>").description("Add and install a package @scope/
     project,
     explicitTarget: parseTargetFlag(opts.target),
     ci: opts.ci,
-    token: opts.token ?? process.env.AIPM_TOKEN
+    token
   });
+  try {
+    await recordPackageInstall(registry, name, token);
+  } catch (error) {
+    if (!opts.ci && !program2.opts().quiet) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`Warning: could not record install count: ${message}`);
+    }
+  }
   if (!opts.ci && !program2.opts().quiet) {
     await notifyCliUpdateIfNeeded(CLI_VERSION);
   }
 });
-program2.command("search [query]").description("Search public registry packages").option("--registry <url>", "Registry base URL").option("--limit <number>", "Maximum results", "20").option("--json", "Print machine-readable JSON").action(async (query = "", opts) => {
+program2.command("search [query]").description("Search public registry packages").option("--registry <url>", "Registry base URL").option("--limit <number>", "Maximum results", "20").option("--token <token>", "Install token for private package search").option("--json", "Print machine-readable JSON").action(async (query = "", opts) => {
   const registry = registryFromEnvOrDefault(opts.registry);
-  const packages = await searchPackages(registry, query, Number(opts.limit));
+  const token = await tokenForRead(registry, opts.token, { quiet: opts.json });
+  const packages = await searchPackages(registry, query, Number(opts.limit), token);
   if (opts.json) {
     console.log(JSON.stringify({ packages }, null, 2));
     return;
@@ -8912,6 +9239,7 @@ program2.command("install").description("Install all packages from aipm.package.
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
   const target = parseTargetFlag(opts.target);
+  const token = await tokenForRead(registry, opts.token);
   for (const [name, version] of Object.entries(project.packages)) {
     await installOnePackage({
       configRoot,
@@ -8922,7 +9250,7 @@ program2.command("install").description("Install all packages from aipm.package.
       project,
       explicitTarget: target,
       ci: opts.ci,
-      token: opts.token ?? process.env.AIPM_TOKEN
+      token
     });
   }
 });
@@ -8934,14 +9262,14 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
     publish.help();
     return;
   }
-  const abs = (0, import_node_path11.resolve)(dir);
-  const manifestRaw = await (0, import_promises9.readFile)((0, import_node_path11.join)(abs, "aipm.manifest.json"), "utf8");
+  const abs = (0, import_node_path12.resolve)(dir);
+  const manifestRaw = await (0, import_promises10.readFile)((0, import_node_path12.join)(abs, "aipm.manifest.json"), "utf8");
   const manifest = PackageManifestSchema.parse(JSON.parse(manifestRaw));
   const tarball = await packDirectory(abs);
   const registry = registryFromEnvOrDefault(opts.registry);
   const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process5.env.AIPM_TOKEN);
   console.log(`Published ${manifest.name}@${result.version}`);
-  console.log(`View: ${registry.replace(/\/$/, "")}/packages/${manifest.name.replace(/^@/, "").replace("/", "/")}/${result.version}`);
+  console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
   printPublishGuide(
     `Published ${manifest.name}@${result.version} from ${abs}.`,
@@ -9061,9 +9389,8 @@ publish.command("push").description("Publish staged files").option("--registry <
   console.log(`Uploading ${staged.length} file${staged.length === 1 ? "" : "s"} to ${registry}.`);
   for (const entry of staged) console.log(`  ${entry.path}`);
   const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process5.env.AIPM_TOKEN);
-  const base = registry.replace(/\/$/, "");
   console.log(`Published ${manifest.name}@${result.version}`);
-  console.log(`View: ${base}/packages/${manifest.name.replace(/^@/, "")}/${result.version}`);
+  console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
   printPublishGuide(
     `Published ${manifest.name}@${result.version} to ${registry}.`,
@@ -9099,20 +9426,21 @@ program2.command("remove <package>").alias("rm").description("Remove a package f
   console.log(`Removed ${name} from AIPM ${scopeLabel(scope)} files.`);
   console.log("Adapter-written files are not deleted yet; review your project before committing.");
 });
-program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
+program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
   let project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
+  const token = await tokenForRead(registry, opts.token);
   const names = pkgArg ? [parsePackageArg(pkgArg).name] : Object.keys(project.packages);
   if (names.length === 0) {
     console.log("No packages configured.");
     return;
   }
   for (const name of names) {
-    const version = await latestVersionForPackage(registry, name);
+    const version = await latestVersionForPackage(registry, name, token);
     project = {
       ...project,
       packages: { ...project.packages, [name]: version }
@@ -9126,7 +9454,8 @@ program2.command("update [package]").description("Update one installed package,
       version,
       project,
       explicitTarget: parseTargetFlag(opts.target),
-      ci: opts.ci
+      ci: opts.ci,
+      token
     });
   }
 });