@aipm-registry/cli 0.3.5 → 0.4.1

package/dist/bin.cjs

@@ -4178,8 +4178,8 @@ var init_manifest = __esm({
     "use strict";
     init_zod();
     init_scope_name();
-    AiToolSchema = external_exports.enum(["cursor", "claude", "*"]);
-    ALL_TOOLS = ["cursor", "claude"];
+    AiToolSchema = external_exports.enum(["cursor", "claude", "codex", "*"]);
+    ALL_TOOLS = ["cursor", "claude", "codex"];
     PackageExampleSchema = external_exports.object({
       title: external_exports.string().trim().min(1).max(80),
       description: external_exports.string().trim().min(1).max(240).optional(),
@@ -4237,7 +4237,7 @@ var init_manifest = __esm({
 });
 
 // ../../packages/schemas/dist/package-json.js
-var scopedPackageKey, ProjectPackageJsonSchema;
+var scopedPackageKey, promptAliasKey, ProjectPackageJsonSchema;
 var init_package_json = __esm({
   "../../packages/schemas/dist/package-json.js"() {
     "use strict";
@@ -4245,17 +4245,19 @@ var init_package_json = __esm({
     init_scope_name();
     init_manifest();
     scopedPackageKey = external_exports.string().regex(SCOPE_NAME_REGEX);
+    promptAliasKey = external_exports.string().trim().min(1).max(120);
     ProjectPackageJsonSchema = external_exports.object({
       schemaVersion: external_exports.literal("0.1"),
       registry: external_exports.string().url(),
       preferredTools: external_exports.array(AiToolSchema).optional(),
-      packages: external_exports.record(scopedPackageKey, external_exports.string().min(1))
+      packages: external_exports.record(scopedPackageKey, external_exports.string().min(1)),
+      prompts: external_exports.record(promptAliasKey, external_exports.string().url()).default({})
     });
   }
 });
 
 // ../../packages/schemas/dist/lockfile.js
-var scopedPackageKey2, InstalledPathsSchema, LockfilePackageEntrySchema, LockfileSchema;
+var scopedPackageKey2, InstalledPathsSchema, LockfilePromptEntrySchema, LockfilePackageEntrySchema, LockfileSchema;
 var init_lockfile = __esm({
   "../../packages/schemas/dist/lockfile.js"() {
     "use strict";
@@ -4264,6 +4266,15 @@ var init_lockfile = __esm({
     init_manifest();
     scopedPackageKey2 = external_exports.string().regex(SCOPE_NAME_REGEX);
     InstalledPathsSchema = external_exports.record(AiToolSchema, external_exports.array(external_exports.string()));
+    LockfilePromptEntrySchema = external_exports.object({
+      id: external_exports.string().min(1),
+      url: external_exports.string().url(),
+      publisher: external_exports.string().min(1),
+      slug: external_exports.string().min(1),
+      contentHash: external_exports.string().min(1),
+      updatedAt: external_exports.string().min(1),
+      installedPath: external_exports.string().min(1)
+    });
     LockfilePackageEntrySchema = external_exports.object({
       version: external_exports.string(),
       integrity: external_exports.string(),
@@ -4283,7 +4294,8 @@ var init_lockfile = __esm({
     });
     LockfileSchema = external_exports.object({
       schemaVersion: external_exports.literal("0.1"),
-      packages: external_exports.record(scopedPackageKey2, LockfilePackageEntrySchema)
+      packages: external_exports.record(scopedPackageKey2, LockfilePackageEntrySchema),
+      prompts: external_exports.record(external_exports.string().min(1), LockfilePromptEntrySchema).default({})
     });
   }
 });
@@ -4314,6 +4326,8 @@ async function detectToolsInProject(projectRoot) {
     detected.push("cursor");
   if (await pathExists((0, import_node_path2.join)(projectRoot, ".claude")))
     detected.push("claude");
+  if (await pathExists((0, import_node_path2.join)(projectRoot, ".codex")))
+    detected.push("codex");
   return detected;
 }
 function manifestAllowsTool(manifest, tool) {
@@ -4404,6 +4418,29 @@ var init_dist3 = __esm({
   }
 });
 
+// ../../packages/adapter-codex/dist/index.js
+var import_promises4, import_node_path5, CodexSkillAdapter, codexSkillAdapter;
+var init_dist4 = __esm({
+  "../../packages/adapter-codex/dist/index.js"() {
+    "use strict";
+    import_promises4 = require("node:fs/promises");
+    import_node_path5 = require("node:path");
+    init_dist();
+    CodexSkillAdapter = class {
+      tool = "codex";
+      async installSkill(input2) {
+        const short = shortNameFromScopeName(input2.packageName);
+        const skillDir = (0, import_node_path5.join)(input2.projectRoot, ".agents", "skills", short);
+        await (0, import_promises4.mkdir)(skillDir, { recursive: true });
+        const filePath = (0, import_node_path5.join)(skillDir, "SKILL.md");
+        await (0, import_promises4.writeFile)(filePath, input2.skillMarkdown, "utf8");
+        return { writtenPaths: [filePath] };
+      }
+    };
+    codexSkillAdapter = new CodexSkillAdapter();
+  }
+});
+
 // ../../packages/engine/dist/install-skill.js
 async function installSkillPackage(options) {
   const tools = await resolveInstallTools({
@@ -4413,7 +4450,7 @@ async function installSkillPackage(options) {
     explicitTarget: options.explicitTarget
   });
   if (tools.length === 0) {
-    throw new Error("No AI tool detected (.cursor/ or .claude/). Use --target cursor|claude|* or set preferredTools in aipm.package.json.");
+    throw new Error("No AI tool detected (.cursor/, .claude/, or .codex/). Use --target cursor|claude|codex|* or set preferredTools in aipm.package.json.");
   }
   const installed = {};
   for (const tool of tools) {
@@ -4434,10 +4471,12 @@ var init_install_skill = __esm({
     "use strict";
     init_dist2();
     init_dist3();
+    init_dist4();
     init_detect_tools();
     adapters = {
       cursor: cursorSkillAdapter,
-      claude: claudeSkillAdapter
+      claude: claudeSkillAdapter,
+      codex: codexSkillAdapter
     };
   }
 });
@@ -4449,7 +4488,7 @@ __export(dist_exports, {
   installSkillPackage: () => installSkillPackage,
   resolveInstallTools: () => resolveInstallTools
 });
-var init_dist4 = __esm({
+var init_dist5 = __esm({
   "../../packages/engine/dist/index.js"() {
     "use strict";
     init_detect_tools();
@@ -7826,28 +7865,28 @@ function useColor() {
 var program = new Command();
 
 // src/bin.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 var import_node_child_process4 = require("node:child_process");
 var import_node_http = require("node:http");
-var import_promises10 = require("node:fs/promises");
-var import_node_path13 = require("node:path");
+var import_promises12 = require("node:fs/promises");
+var import_node_path15 = require("node:path");
 var import_node_process5 = require("node:process");
 init_dist();
-init_dist4();
+init_dist5();
 
 // src/pack.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_util3 = require("node:util");
-var import_promises5 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_promises6 = require("node:fs/promises");
+var import_node_path7 = require("node:path");
 var import_node_os = require("node:os");
 
 // src/publish-state.ts
 var import_node_crypto = require("node:crypto");
-var import_promises4 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_promises5 = require("node:fs/promises");
+var import_node_path6 = require("node:path");
 init_dist();
-var STATE_PATH = (0, import_node_path5.join)(".aipm", "publish-state.json");
+var STATE_PATH = (0, import_node_path6.join)(".aipm", "publish-state.json");
 var IGNORE_FILE = ".aipmignore";
 var MAX_PACKAGE_BYTES = 50 * 1024 * 1024;
 var EXCLUDED_SEGMENTS = /* @__PURE__ */ new Set([".aipm", ".git", "node_modules", "dist", ".next"]);
@@ -7862,11 +7901,11 @@ var SECRET_PATTERNS = [
   /<publishData/i
 ];
 function publishStatePath(root) {
-  return (0, import_node_path5.join)(root, STATE_PATH);
+  return (0, import_node_path6.join)(root, STATE_PATH);
 }
 function normalizePublishPath(root, filePath) {
-  const abs = (0, import_node_path5.resolve)(root, filePath);
-  const rel = (0, import_node_path5.normalize)((0, import_node_path5.relative)(root, abs)).split(import_node_path5.sep).join("/");
+  const abs = (0, import_node_path6.resolve)(root, filePath);
+  const rel = (0, import_node_path6.normalize)((0, import_node_path6.relative)(root, abs)).split(import_node_path6.sep).join("/");
   if (!rel || rel === ".") return ".";
   if (rel.startsWith("../") || rel === ".." || rel.startsWith("/")) {
     throw new Error(`Path is outside the skill folder: ${filePath}`);
@@ -7883,7 +7922,7 @@ function isExcludedPublishPath(rel) {
 }
 async function readAipmIgnore(root) {
   try {
-    const raw = await (0, import_promises4.readFile)((0, import_node_path5.join)(root, IGNORE_FILE), "utf8");
+    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, IGNORE_FILE), "utf8");
     return raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   } catch {
     return [];
@@ -7904,7 +7943,7 @@ async function isIgnoredByAipmIgnore(root, rel) {
   return rules.some((rule) => matchesIgnoreRule(rel, rule));
 }
 async function assertNoObviousSecrets(path2, rel) {
-  const data = await (0, import_promises4.readFile)(path2);
+  const data = await (0, import_promises5.readFile)(path2);
   if (data.includes(0)) return;
   const text = data.toString("utf8");
   if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) {
@@ -7912,7 +7951,7 @@ async function assertNoObviousSecrets(path2, rel) {
   }
 }
 async function fileHash(path2) {
-  const data = await (0, import_promises4.readFile)(path2);
+  const data = await (0, import_promises5.readFile)(path2);
   return {
     hash: (0, import_node_crypto.createHash)("sha256").update(data).digest("hex"),
     size: data.length
@@ -7920,7 +7959,7 @@ async function fileHash(path2) {
 }
 async function readPublishState(root) {
   try {
-    const raw = await (0, import_promises4.readFile)(publishStatePath(root), "utf8");
+    const raw = await (0, import_promises5.readFile)(publishStatePath(root), "utf8");
     const parsed = JSON.parse(raw);
     return {
       schemaVersion: "0.1",
@@ -7932,18 +7971,18 @@ async function readPublishState(root) {
 }
 async function writePublishState(root, state) {
   const path2 = publishStatePath(root);
-  await (0, import_promises4.mkdir)((0, import_node_path5.dirname)(path2), { recursive: true });
+  await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(path2), { recursive: true });
   const files = [...state.files].sort((a, b) => a.path.localeCompare(b.path));
-  await (0, import_promises4.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
+  await (0, import_promises5.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
 }
 async function expandPublishPath(root, rel) {
   if (isExcludedPublishPath(rel)) return [];
   if (await isIgnoredByAipmIgnore(root, rel)) return [];
-  const abs = (0, import_node_path5.join)(root, rel);
-  const info = await (0, import_promises4.stat)(abs);
+  const abs = (0, import_node_path6.join)(root, rel);
+  const info = await (0, import_promises5.stat)(abs);
   if (info.isFile()) return [rel];
   if (!info.isDirectory()) return [];
-  const entries = await (0, import_promises4.readdir)(abs);
+  const entries = await (0, import_promises5.readdir)(abs);
   const nested = await Promise.all(
     entries.map((entry) => expandPublishPath(root, `${rel === "." ? "" : `${rel}/`}${entry}`))
   );
@@ -7959,7 +7998,7 @@ async function addPublishFiles(root, paths) {
     for (const rel of files) {
       if (isExcludedPublishPath(rel)) continue;
       if (await isIgnoredByAipmIgnore(root, rel)) continue;
-      const hashed = await fileHash((0, import_node_path5.join)(root, rel));
+      const hashed = await fileHash((0, import_node_path6.join)(root, rel));
       byPath.set(rel, { path: rel, ...hashed });
     }
   }
@@ -7978,11 +8017,11 @@ async function removePublishFiles(root, paths) {
   return next;
 }
 async function resetPublishState(root) {
-  await (0, import_promises4.rm)(publishStatePath(root), { force: true });
+  await (0, import_promises5.rm)(publishStatePath(root), { force: true });
 }
 async function readManifest(root) {
   try {
-    const raw = await (0, import_promises4.readFile)((0, import_node_path5.join)(root, "aipm.manifest.json"), "utf8");
+    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, "aipm.manifest.json"), "utf8");
     return PackageManifestSchema.parse(JSON.parse(raw));
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
@@ -8015,8 +8054,8 @@ async function validatePublishState(root) {
     if (await isIgnoredByAipmIgnore(root, entry.path)) {
       throw new Error(`Refusing to publish ignored path: ${entry.path}`);
     }
-    const abs = (0, import_node_path5.join)(root, entry.path);
-    const info = await (0, import_promises4.stat)(abs).catch(() => null);
+    const abs = (0, import_node_path6.join)(root, entry.path);
+    const info = await (0, import_promises5.stat)(abs).catch(() => null);
     if (!info?.isFile()) throw new Error(`Staged file is missing: ${entry.path}`);
     const hashed = await fileHash(abs);
     if (hashed.hash !== entry.hash) {
@@ -8032,7 +8071,7 @@ async function statusPublishState(root) {
   const state = await readPublishState(root);
   const rows = [];
   for (const entry of state.files) {
-    const current = await fileHash((0, import_node_path5.join)(root, entry.path)).catch(() => null);
+    const current = await fileHash((0, import_node_path6.join)(root, entry.path)).catch(() => null);
     rows.push({ ...entry, changed: !current || current.hash !== entry.hash });
   }
   return rows;
@@ -8040,9 +8079,9 @@ async function statusPublishState(root) {
 async function copyStagedFiles(root, destination) {
   const state = await readPublishState(root);
   for (const entry of state.files) {
-    const target = (0, import_node_path5.join)(destination, entry.path);
-    await (0, import_promises4.mkdir)((0, import_node_path5.dirname)(target), { recursive: true });
-    await (0, import_promises4.cp)((0, import_node_path5.join)(root, entry.path), target);
+    const target = (0, import_node_path6.join)(destination, entry.path);
+    await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(target), { recursive: true });
+    await (0, import_promises5.cp)((0, import_node_path6.join)(root, entry.path), target);
   }
 }
 
@@ -8056,21 +8095,21 @@ async function packDirectory(dir) {
   return Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
 }
 async function packStagedFiles(root) {
-  const tempDir = await (0, import_promises5.mkdtemp)((0, import_node_path6.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
+  const tempDir = await (0, import_promises6.mkdtemp)((0, import_node_path7.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
   try {
     await copyStagedFiles(root, tempDir);
     return await packDirectory(tempDir);
   } finally {
-    await (0, import_promises5.rm)(tempDir, { recursive: true, force: true });
+    await (0, import_promises6.rm)(tempDir, { recursive: true, force: true });
   }
 }
 async function unpackTarballToDirectory(tarball) {
-  const { mkdtemp: mkdtemp2, writeFile: writeFile7 } = await import("node:fs/promises");
-  const { join: join13 } = await import("node:path");
+  const { mkdtemp: mkdtemp2, writeFile: writeFile9 } = await import("node:fs/promises");
+  const { join: join15 } = await import("node:path");
   const { tmpdir: tmpdir2 } = await import("node:os");
-  const tempDir = await mkdtemp2(join13(tmpdir2(), "aipm-install-"));
-  const tgzPath = join13(tempDir, "pkg.tgz");
-  await writeFile7(tgzPath, tarball);
+  const tempDir = await mkdtemp2(join15(tmpdir2(), "aipm-install-"));
+  const tgzPath = join15(tempDir, "pkg.tgz");
+  await writeFile9(tgzPath, tarball);
   await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
   return tempDir;
 }
@@ -8229,18 +8268,53 @@ async function recordPackageInstall(registry, name, token) {
   }
   return res.json();
 }
+async function fetchPromptDetail(registry, publisher, slug) {
+  const base = registry.replace(/\/$/, "");
+  const url = `${base}/v1/prompts/${encodeURIComponent(publisher)}/${encodeURIComponent(slug)}`;
+  const res = await registryFetch(url, base);
+  if (!res.ok) throw new Error(`Prompt not found: @${publisher}/${slug} (${res.status})`);
+  return res.json();
+}
+async function recordPromptCopy(registry, publisher, slug) {
+  const base = registry.replace(/\/$/, "");
+  const url = `${base}/v1/prompts/${encodeURIComponent(publisher)}/${encodeURIComponent(slug)}/copy`;
+  const res = await registryFetch(url, base, { method: "POST" });
+  if (!res.ok) throw new Error(`Prompt copy recording failed: ${res.status}`);
+}
+async function publishPrompt(registry, input2, accessToken, sampleImage) {
+  const base = registry.replace(/\/$/, "");
+  const form = new FormData();
+  form.append("data", JSON.stringify(input2));
+  if (sampleImage) {
+    form.append(
+      "sampleImage",
+      new Blob([sampleImage.data], { type: sampleImage.contentType }),
+      sampleImage.filename
+    );
+  }
+  const res = await registryFetch(`${base}/v1/prompts`, base, {
+    method: "POST",
+    headers: registryAuthHeaders(accessToken),
+    body: form
+  });
+  if (!res.ok) {
+    const error = await res.json().catch(() => ({}));
+    throw new Error(error.error ?? `Prompt publish failed: ${res.status}`);
+  }
+  return res.json();
+}
 
 // src/auth-store.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
-var import_node_path7 = require("node:path");
-var AUTH_FILE = (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
+var import_node_path8 = require("node:path");
+var AUTH_FILE = (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
 function normalizeRegistry(registry) {
   return registry.replace(/\/$/, "");
 }
 async function readAuthStore() {
   try {
-    const raw = await (0, import_promises6.readFile)(AUTH_FILE, "utf8");
+    const raw = await (0, import_promises7.readFile)(AUTH_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return { registries: parsed.registries ?? {} };
   } catch {
@@ -8248,9 +8322,9 @@ async function readAuthStore() {
   }
 }
 async function writeAuthStore(store) {
-  await (0, import_promises6.mkdir)((0, import_node_path7.dirname)(AUTH_FILE), { recursive: true });
-  await (0, import_promises6.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
-  await (0, import_promises6.chmod)(AUTH_FILE, 384).catch(() => void 0);
+  await (0, import_promises7.mkdir)((0, import_node_path8.dirname)(AUTH_FILE), { recursive: true });
+  await (0, import_promises7.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
+  await (0, import_promises7.chmod)(AUTH_FILE, 384).catch(() => void 0);
 }
 async function getStoredRegistryAuth(registry) {
   const store = await readAuthStore();
@@ -8279,41 +8353,41 @@ function isAccessTokenFresh(auth, skewMs = 6e4) {
 }
 
 // src/install-one.ts
-init_dist4();
-var import_promises8 = require("node:fs/promises");
-var import_node_path9 = require("node:path");
+init_dist5();
+var import_promises9 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
 
 // src/project-files.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_path8 = require("node:path");
+var import_promises8 = require("node:fs/promises");
+var import_node_path9 = require("node:path");
 init_dist();
 var PACKAGE_JSON = "aipm.package.json";
 var LOCKFILE = "aipm-lock.json";
 async function readProjectPackageJson(projectRoot) {
   try {
-    const raw = await (0, import_promises7.readFile)((0, import_node_path8.join)(projectRoot, PACKAGE_JSON), "utf8");
+    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, PACKAGE_JSON), "utf8");
     return ProjectPackageJsonSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeProjectPackageJson(projectRoot, data) {
-  await (0, import_promises7.writeFile)(
-    (0, import_node_path8.join)(projectRoot, PACKAGE_JSON),
+  await (0, import_promises8.writeFile)(
+    (0, import_node_path9.join)(projectRoot, PACKAGE_JSON),
     JSON.stringify(data, null, 2) + "\n",
     "utf8"
   );
 }
 async function readLockfile(projectRoot) {
   try {
-    const raw = await (0, import_promises7.readFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), "utf8");
+    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), "utf8");
     return LockfileSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeLockfile(projectRoot, data) {
-  await (0, import_promises7.writeFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
+  await (0, import_promises8.writeFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function upsertLockEntry(lock, name, entry) {
   return {
@@ -8321,6 +8395,12 @@ function upsertLockEntry(lock, name, entry) {
     packages: { ...lock.packages, [name]: entry }
   };
 }
+function upsertPromptLockEntry(lock, name, entry) {
+  return {
+    ...lock,
+    prompts: { ...lock.prompts, [name]: entry }
+  };
+}
 function resolveRegistryUrl(project, flag, fallback) {
   const fromEnv = process.env.AIPM_REGISTRY_URL ?? process.env.AIPM_REGISTRY;
   if (flag) return flag.replace(/\/$/, "");
@@ -8331,15 +8411,17 @@ function resolveRegistryUrl(project, flag, fallback) {
 }
 function parseTargetFlag(target) {
   if (!target) return void 0;
-  if (target === "cursor" || target === "claude" || target === "*") return target;
-  throw new Error('--target must be "cursor", "claude", or "*"');
+  if (target === "cursor" || target === "claude" || target === "codex" || target === "*") {
+    return target;
+  }
+  throw new Error('--target must be "cursor", "claude", "codex", or "*"');
 }
 function parseTargetsFlag(value) {
   const targets = value.split(",").map((target) => target.trim()).filter(Boolean);
   if (targets.length === 0) throw new Error("At least one target is required.");
   for (const target of targets) {
-    if (target !== "cursor" && target !== "claude" && target !== "*") {
-      throw new Error('--targets must contain only "cursor", "claude", and/or "*"');
+    if (target !== "cursor" && target !== "claude" && target !== "codex" && target !== "*") {
+      throw new Error('--targets must contain only "cursor", "claude", "codex", and/or "*"');
     }
   }
   const unique = [...new Set(targets)];
@@ -8355,13 +8437,13 @@ async function promptForTool() {
   try {
     while (true) {
       const answer = await rl.question(
-        "Which AI tool should this skill be installed for? (cursor/claude): "
+        "Which AI tool should this skill be installed for? (cursor/claude/codex): "
       );
       const normalized = answer.trim().toLowerCase();
-      if (normalized === "cursor" || normalized === "claude") {
+      if (normalized === "cursor" || normalized === "claude" || normalized === "codex") {
         return normalized;
       }
-      console.log('Please enter "cursor" or "claude".');
+      console.log('Please enter "cursor", "claude", or "codex".');
     }
   } finally {
     rl.close();
@@ -8380,7 +8462,7 @@ async function promptForConfirmation(question) {
 
 // src/install-one.ts
 function normalizeRelativePath(path2) {
-  return (0, import_node_path9.normalize)(path2).split(import_node_path9.sep).join("/");
+  return (0, import_node_path10.normalize)(path2).split(import_node_path10.sep).join("/");
 }
 function assertSafeRelativePath(path2) {
   const rel = normalizeRelativePath(path2.trim());
@@ -8391,8 +8473,8 @@ function assertSafeRelativePath(path2) {
 }
 function safeJoin(root, relPath) {
   const rel = assertSafeRelativePath(relPath);
-  const target = (0, import_node_path9.resolve)(root, rel);
-  const fromRoot = normalizeRelativePath((0, import_node_path9.relative)(root, target));
+  const target = (0, import_node_path10.resolve)(root, rel);
+  const fromRoot = normalizeRelativePath((0, import_node_path10.relative)(root, target));
   if (fromRoot === ".." || fromRoot.startsWith("../") || fromRoot.startsWith("/")) {
     throw new Error(`Unsafe install path: ${relPath}`);
   }
@@ -8403,12 +8485,12 @@ function packageHelperSlug(name) {
   return `${scope}__${pkg}`;
 }
 function helperRootFor(configRoot, packageName, version) {
-  const base = (0, import_node_path9.basename)(configRoot) === ".aipm" ? (0, import_node_path9.join)(configRoot, "helpers") : (0, import_node_path9.join)(configRoot, ".aipm", "helpers");
-  return (0, import_node_path9.join)(base, packageHelperSlug(packageName), version);
+  const base = (0, import_node_path10.basename)(configRoot) === ".aipm" ? (0, import_node_path10.join)(configRoot, "helpers") : (0, import_node_path10.join)(configRoot, ".aipm", "helpers");
+  return (0, import_node_path10.join)(base, packageHelperSlug(packageName), version);
 }
 async function assertSourceFile(packageRoot, relPath) {
   const source = safeJoin(packageRoot, relPath);
-  const info = await (0, import_promises8.stat)(source).catch(() => null);
+  const info = await (0, import_promises9.stat)(source).catch(() => null);
   if (!info?.isFile()) throw new Error(`Package install file not found: ${relPath}`);
   return source;
 }
@@ -8416,20 +8498,20 @@ async function copyMainFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
   const target = safeJoin(input2.installRoot, input2.file.to);
   const overwrite = input2.file.overwrite ?? "fail";
-  const exists = await (0, import_promises8.stat)(target).catch(() => null);
+  const exists = await (0, import_promises9.stat)(target).catch(() => null);
   if (exists) {
     if (overwrite === "skip") return null;
     if (overwrite === "fail") throw new Error(`Install target already exists: ${target}`);
   }
-  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
-  await (0, import_promises8.cp)(source, target, { force: overwrite === "replace" });
+  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
+  await (0, import_promises9.cp)(source, target, { force: overwrite === "replace" });
   return target;
 }
 async function copyHelperFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
-  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path9.basename)(input2.file.from));
-  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
-  await (0, import_promises8.cp)(source, target, { force: true });
+  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path10.basename)(input2.file.from));
+  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
+  await (0, import_promises9.cp)(source, target, { force: true });
   return target;
 }
 async function installPackageAssets(options) {
@@ -8446,7 +8528,7 @@ async function installPackageAssets(options) {
   }
   const helperRoot = helperRootFor(options.configRoot, options.packageName, options.version);
   if ((install.helperFiles ?? []).length > 0) {
-    await (0, import_promises8.rm)(helperRoot, { recursive: true, force: true });
+    await (0, import_promises9.rm)(helperRoot, { recursive: true, force: true });
   }
   for (const file of install.helperFiles ?? []) {
     assets.helper.push(await copyHelperFile({ packageRoot: options.packageRoot, helperRoot, file }));
@@ -8491,7 +8573,7 @@ async function installOnePackage(options) {
   }
   let explicitTarget = options.explicitTarget;
   let preferredTools = options.project.preferredTools;
-  const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist4(), dist_exports));
+  const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
   let tools = await resolveInstallTools2({
     projectRoot: installRoot,
     manifest,
@@ -8501,7 +8583,7 @@ async function installOnePackage(options) {
   if (tools.length === 0) {
     if (options.ci) {
       throw new Error(
-        "No tool detected. Use --target cursor|claude|* in CI mode."
+        "No tool detected. Use --target cursor|claude|codex|* in CI mode."
       );
     }
     const choice = await promptForTool();
@@ -8522,7 +8604,7 @@ async function installOnePackage(options) {
   );
   const packageRoot = await unpackTarballToDirectory(tarball);
   try {
-    const skillMarkdown = await (0, import_promises8.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
+    const skillMarkdown = await (0, import_promises9.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
     const result = await installSkillPackage({
       projectRoot: installRoot,
       manifest,
@@ -8540,7 +8622,8 @@ async function installOnePackage(options) {
     });
     const lock = await readLockfile(configRoot) ?? {
       schemaVersion: "0.1",
-      packages: {}
+      packages: {},
+      prompts: {}
     };
     const installed = {};
     for (const tool of result.resolvedTools) {
@@ -8562,23 +8645,23 @@ async function installOnePackage(options) {
     console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
     printPostInstallNotice(options.name, postInstall);
   } finally {
-    await (0, import_promises8.rm)(packageRoot, { recursive: true, force: true });
+    await (0, import_promises9.rm)(packageRoot, { recursive: true, force: true });
   }
 }
 
 // src/doctor.ts
 var import_node_child_process3 = require("node:child_process");
-var import_promises9 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_promises10 = require("node:fs/promises");
+var import_node_path12 = require("node:path");
 var import_node_util4 = require("node:util");
 
 // src/project-root.ts
 var import_node_os3 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var import_node_process3 = require("node:process");
 function globalConfigDir(env2 = process.env) {
   const fromEnv = env2.AIPM_HOME?.trim();
-  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".aipm");
+  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".aipm");
 }
 function resolveConfigRoot(options = {}) {
   return options.global ? globalConfigDir() : (0, import_node_process3.cwd)();
@@ -8609,11 +8692,11 @@ async function commandOutput(command, args) {
 }
 function npmGlobalBin(prefix) {
   if (!prefix) return null;
-  return process.platform === "win32" ? prefix : `${prefix}${import_node_path11.sep}bin`;
+  return process.platform === "win32" ? prefix : `${prefix}${import_node_path12.sep}bin`;
 }
 function pathIncludes(pathDir) {
   if (!pathDir) return false;
-  return (process.env.PATH ?? "").split(import_node_path11.delimiter).includes(pathDir);
+  return (process.env.PATH ?? "").split(import_node_path12.delimiter).includes(pathDir);
 }
 function shellPathHint(binDir) {
   if (!binDir) return "Run npm prefix -g and add its bin folder to PATH.";
@@ -8666,11 +8749,11 @@ async function runDoctor(options) {
   if (!options.publish) {
     const configLabel = options.global ? "Global config" : "Project config";
     try {
-      await (0, import_promises9.access)((0, import_node_path11.join)(configRoot, "aipm.package.json"));
+      await (0, import_promises10.access)((0, import_node_path12.join)(configRoot, "aipm.package.json"));
       checks.push({
         name: configLabel,
         ok: true,
-        detail: `${(0, import_node_path11.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
+        detail: `${(0, import_node_path12.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
       });
     } catch {
       checks.push({
@@ -8738,11 +8821,181 @@ async function runDoctor(options) {
   }
 }
 
+// src/prompt-install.ts
+var import_node_crypto2 = require("node:crypto");
+var import_promises11 = require("node:fs/promises");
+var import_node_path13 = require("node:path");
+var PROMPT_SITE_ORIGIN = "https://www.aipm-registry.com";
+function parsePromptUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.origin !== PROMPT_SITE_ORIGIN) return null;
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length !== 3 || parts[0] !== "prompts") return null;
+  const publisher = decodeURIComponent(parts[1] ?? "").trim().toLowerCase();
+  const slug = decodeURIComponent(parts[2] ?? "").trim().toLowerCase();
+  if (!publisher || !slug || !/^[a-z0-9][a-z0-9-]*$/.test(publisher) || !/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+    return null;
+  }
+  return {
+    url: `${PROMPT_SITE_ORIGIN}/prompts/${encodeURIComponent(publisher)}/${encodeURIComponent(slug)}`,
+    publisher,
+    slug,
+    alias: slug
+  };
+}
+function promptDirectory(configRoot) {
+  return (0, import_node_path13.basename)(configRoot) === ".aipm" ? (0, import_node_path13.join)(configRoot, "prompts") : (0, import_node_path13.join)(configRoot, ".aipm", "prompts");
+}
+function promptSnapshotPath(configRoot, reference) {
+  return (0, import_node_path13.join)(promptDirectory(configRoot), `${reference.publisher}--${reference.slug}.md`);
+}
+function canonicalPromptContent(prompt) {
+  return JSON.stringify({
+    promptText: prompt.promptText,
+    variables: prompt.variables,
+    exampleInput: prompt.exampleInput,
+    exampleOutput: prompt.exampleOutput,
+    usageNotes: prompt.usageNotes,
+    license: prompt.license
+  });
+}
+function promptContentHash(prompt) {
+  return (0, import_node_crypto2.createHash)("sha256").update(canonicalPromptContent(prompt)).digest("hex");
+}
+function section(title, value) {
+  return value?.trim() ? `
+## ${title}
+
+${value.trim()}
+` : "";
+}
+function renderPromptMarkdown(prompt, sourceUrl) {
+  const variables = prompt.variables.length ? `
+## Variables
+
+${prompt.variables.map(
+    (variable) => `- \`{{${variable.name}}}\`${variable.required ? " \u2014 required" : " \u2014 optional"}: ${variable.description}${variable.example ? ` Example: ${variable.example}` : ""}`
+  ).join("\n")}
+` : "";
+  const publisher = prompt.publisher.org?.name ?? prompt.publisher.user.name ?? `@${prompt.publisher.scope}`;
+  return [
+    `# ${prompt.title}`,
+    "",
+    prompt.summary,
+    "",
+    `- Source: ${sourceUrl}`,
+    `- Publisher: ${publisher} (@${prompt.publisher.scope})`,
+    `- Category: ${prompt.category}`,
+    `- Inputs: ${prompt.inputTypes.join(", ") || "none"}`,
+    `- Outputs: ${prompt.outputTypes.join(", ") || "none"}`,
+    `- Effort: ${prompt.effort}`,
+    `- Language: ${prompt.language}`,
+    `- License: ${prompt.license}`,
+    `- Updated: ${prompt.updatedAt}`,
+    "",
+    "## Prompt",
+    "",
+    prompt.promptText.trim(),
+    variables,
+    section("Example input", prompt.exampleInput),
+    section("Example output", prompt.exampleOutput),
+    section("Usage notes", prompt.usageNotes)
+  ].join("\n").replace(/\n{3,}/g, "\n\n").trimEnd().concat("\n");
+}
+function emptyLock() {
+  return { schemaVersion: "0.1", packages: {}, prompts: {} };
+}
+function installedRelativePath(configRoot, absolutePath) {
+  return (0, import_node_path13.relative)(configRoot, absolutePath).split("\\").join("/");
+}
+async function installTrackedPrompt(input2) {
+  const prompt = await fetchPromptDetail(
+    input2.registry,
+    input2.reference.publisher,
+    input2.reference.slug
+  );
+  const canonicalReference = {
+    ...input2.reference,
+    publisher: prompt.publisher.scope,
+    slug: prompt.slug,
+    url: `${PROMPT_SITE_ORIGIN}/prompts/${encodeURIComponent(prompt.publisher.scope)}/${encodeURIComponent(prompt.slug)}`
+  };
+  const outputPath = promptSnapshotPath(input2.configRoot, canonicalReference);
+  const contentHash = promptContentHash(prompt);
+  const lock = await readLockfile(input2.configRoot) ?? emptyLock();
+  const existing = lock.prompts[input2.reference.alias];
+  const fileExists = Boolean(await (0, import_promises11.stat)(outputPath).catch(() => null));
+  const changed = !existing || existing.contentHash !== contentHash || !fileExists;
+  if (!input2.updateOnly || changed) {
+    await (0, import_promises11.mkdir)((0, import_node_path13.dirname)(outputPath), { recursive: true });
+    await (0, import_promises11.writeFile)(outputPath, renderPromptMarkdown(prompt, canonicalReference.url), "utf8");
+  }
+  if (input2.track) {
+    const currentUrl = input2.project.prompts[input2.reference.alias];
+    if (currentUrl && currentUrl !== canonicalReference.url) {
+      throw new Error(
+        `Prompt alias "${input2.reference.alias}" already tracks ${currentUrl}. Remove it first or use a unique slug.`
+      );
+    }
+    await writeProjectPackageJson(input2.configRoot, {
+      ...input2.project,
+      prompts: { ...input2.project.prompts, [input2.reference.alias]: canonicalReference.url }
+    });
+  }
+  const entry = {
+    id: prompt.id,
+    url: canonicalReference.url,
+    publisher: canonicalReference.publisher,
+    slug: canonicalReference.slug,
+    contentHash,
+    updatedAt: prompt.updatedAt,
+    installedPath: installedRelativePath(input2.configRoot, outputPath)
+  };
+  await writeLockfile(input2.configRoot, upsertPromptLockEntry(lock, input2.reference.alias, entry));
+  if (input2.recordCopy) {
+    await recordPromptCopy(input2.registry, canonicalReference.publisher, canonicalReference.slug).catch(
+      () => void 0
+    );
+  }
+  return { changed, path: outputPath, prompt };
+}
+function resolveTrackedPrompt(project, value) {
+  const direct = parsePromptUrl(value);
+  if (direct) {
+    const match = Object.entries(project.prompts).find(([, url2]) => url2 === direct.url);
+    return match ? { ...direct, alias: match[0] } : direct;
+  }
+  const url = project.prompts[value];
+  const parsed = url ? parsePromptUrl(url) : null;
+  return parsed ? { ...parsed, alias: value } : null;
+}
+async function readInstalledPrompt(configRoot, entry) {
+  return (0, import_promises11.readFile)((0, import_node_path13.join)(configRoot, entry.installedPath), "utf8");
+}
+async function removeTrackedPrompt(input2) {
+  const lock = await readLockfile(input2.configRoot);
+  const entry = lock?.prompts[input2.reference.alias];
+  if (entry) await (0, import_promises11.rm)((0, import_node_path13.join)(input2.configRoot, entry.installedPath), { force: true });
+  const prompts = { ...input2.project.prompts };
+  delete prompts[input2.reference.alias];
+  await writeProjectPackageJson(input2.configRoot, { ...input2.project, prompts });
+  if (lock) {
+    const lockedPrompts = { ...lock.prompts };
+    delete lockedPrompts[input2.reference.alias];
+    await writeLockfile(input2.configRoot, { ...lock, prompts: lockedPrompts });
+  }
+}
+
 // src/version.ts
 var import_node_fs2 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_path14 = require("node:path");
 function getCliVersion() {
-  const pkgPath = (0, import_node_path12.join)(__dirname, "..", "package.json");
+  const pkgPath = (0, import_node_path14.join)(__dirname, "..", "package.json");
   const pkg = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
   return pkg.version;
 }
@@ -8831,11 +9084,14 @@ async function notifyCliUpdateIfNeeded(currentVersion, options) {
 var CLI_VERSION = getCliVersion();
 var program2 = new Command();
 var DEFAULT_REGISTRY = "https://api.aipm-registry.com";
-var SITE_URL = "https://aipm-registry.com";
-var PUBLISH_DOC_URL = "https://aipm-registry.com/publish";
-var DASHBOARD_URL = "https://aipm-registry.com/dashboard";
+var SITE_URL = "https://www.aipm-registry.com";
+var PUBLISH_DOC_URL = `${SITE_URL}/publish`;
+var DASHBOARD_URL = `${SITE_URL}/dashboard`;
 var GLOBAL_OPTION = "-g, --global";
 var GLOBAL_OPTION_DESC = "Use global config (~/.aipm) and install skills under your home directory";
+var normalizedArgv = process.argv.map(
+  (arg) => arg === "-prompt" ? "--prompt" : arg === "-skill" ? "--skill" : arg
+);
 program2.name("aipm").description("AI package manager").enablePositionalOptions().version(CLI_VERSION, "-v, --version", "output the current version").option("--verbose", "Print extra diagnostic output").option("--quiet", "Reduce non-essential output").addHelpText(
   "after",
   `
@@ -8863,6 +9119,10 @@ function packagePageUrl(packageName, version) {
   const [scope, name] = packageName.replace(/^@/, "").split("/");
   return `${SITE_URL}/packages/${encodeURIComponent(scope ?? "")}/${encodeURIComponent(name ?? "")}/${encodeURIComponent(version)}`;
 }
+function packageBadgeMarkdown(packageName, version) {
+  const pageUrl = packagePageUrl(packageName, version);
+  return `[![Install with AIPM](${SITE_URL}/install-with-aipm.svg)](${pageUrl})`;
+}
 function parsePackageArg(value) {
   const match = value.match(/^(@[^@]+)(?:@(.+))?$/);
   if (!match) throw new Error("Package must be @scope/name or @scope/name@version");
@@ -8877,23 +9137,23 @@ function skillFolderName(name) {
   return folder;
 }
 async function writeStarterFile(path2, content) {
-  await (0, import_promises10.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
+  await (0, import_promises12.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
 }
 async function inferEntryFromSource(source, fallback) {
-  const sourceInfo = await (0, import_promises10.stat)(source);
-  if (sourceInfo.isFile()) return (0, import_node_path13.basename)(source);
+  const sourceInfo = await (0, import_promises12.stat)(source);
+  if (sourceInfo.isFile()) return (0, import_node_path15.basename)(source);
   if (!sourceInfo.isDirectory()) return fallback;
-  const entries = await (0, import_promises10.readdir)(source);
+  const entries = await (0, import_promises12.readdir)(source);
   if (entries.includes(fallback)) return fallback;
   return entries.find((entry) => entry.endsWith(".md")) ?? entries.find((entry) => entry.endsWith(".mdc")) ?? fallback;
 }
 async function copySourceIntoSkillRoot(source, root, sourceLabel) {
-  const sourceInfo = await (0, import_promises10.stat)(source);
-  await (0, import_promises10.mkdir)(root, { recursive: true });
+  const sourceInfo = await (0, import_promises12.stat)(source);
+  await (0, import_promises12.mkdir)(root, { recursive: true });
   if (sourceInfo.isDirectory()) {
-    const entries = await (0, import_promises10.readdir)(source);
+    const entries = await (0, import_promises12.readdir)(source);
     for (const entry of entries) {
-      await (0, import_promises10.cp)((0, import_node_path13.join)(source, entry), (0, import_node_path13.join)(root, entry), {
+      await (0, import_promises12.cp)((0, import_node_path15.join)(source, entry), (0, import_node_path15.join)(root, entry), {
         recursive: true,
         force: false,
         errorOnExist: true
@@ -8902,7 +9162,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
     return;
   }
   if (sourceInfo.isFile()) {
-    await (0, import_promises10.cp)(source, (0, import_node_path13.join)(root, (0, import_node_path13.basename)(source)), { force: false, errorOnExist: true });
+    await (0, import_promises12.cp)(source, (0, import_node_path15.join)(root, (0, import_node_path15.basename)(source)), { force: false, errorOnExist: true });
     return;
   }
   throw new Error(`Unsupported source path: ${sourceLabel}`);
@@ -8936,11 +9196,11 @@ function packageDashboardUrl(name) {
   return `${DASHBOARD_URL}/packages/${name.replace(/^@/, "")}`;
 }
 function helperRootFromTrackedPath(path2) {
-  const parts = path2.split(import_node_path13.sep).filter(Boolean);
+  const parts = path2.split(import_node_path15.sep).filter(Boolean);
   const helpersIndex = parts.lastIndexOf("helpers");
   if (helpersIndex === -1 || parts.length <= helpersIndex + 2) return null;
-  const prefix = path2.startsWith(import_node_path13.sep) ? import_node_path13.sep : "";
-  return (0, import_node_path13.join)(prefix, ...parts.slice(0, helpersIndex + 3));
+  const prefix = path2.startsWith(import_node_path15.sep) ? import_node_path15.sep : "";
+  return (0, import_node_path15.join)(prefix, ...parts.slice(0, helpersIndex + 3));
 }
 async function showInstalledPrompt(configRoot, packageArg) {
   const { name } = parsePackageArg(packageArg);
@@ -8953,7 +9213,7 @@ async function showInstalledPrompt(configRoot, packageArg) {
   if (entry.postInstall.status === "cleaned") {
     throw new Error(`Setup helper files were cleaned for ${name}. Reinstall the package to restore them.`);
   }
-  const content = await (0, import_promises10.readFile)(entry.postInstall.promptFile, "utf8").catch(() => {
+  const content = await (0, import_promises12.readFile)(entry.postInstall.promptFile, "utf8").catch(() => {
     throw new Error(`Setup prompt file is missing: ${entry.postInstall?.promptFile}`);
   });
   console.log(`Prompt file: ${entry.postInstall.promptFile}`);
@@ -8986,9 +9246,9 @@ async function cleanupInstalledHelpers(options) {
     entry.installedAssets.helper.map((path2) => helperRootFromTrackedPath(path2)).filter((path2) => Boolean(path2))
   );
   if (roots.size > 0) {
-    for (const root of roots) await (0, import_promises10.rm)(root, { recursive: true, force: true });
+    for (const root of roots) await (0, import_promises12.rm)(root, { recursive: true, force: true });
   } else {
-    for (const helperPath of entry.installedAssets.helper) await (0, import_promises10.rm)(helperPath, { force: true });
+    for (const helperPath of entry.installedAssets.helper) await (0, import_promises12.rm)(helperPath, { force: true });
   }
   await writeLockfile(options.configRoot, {
     ...lock,
@@ -9011,10 +9271,10 @@ async function openUrl(url) {
   console.log(`Open: ${url}`);
 }
 function randomBase64Url(bytes = 32) {
-  return (0, import_node_crypto2.randomBytes)(bytes).toString("base64url");
+  return (0, import_node_crypto3.randomBytes)(bytes).toString("base64url");
 }
 function sha256Base64Url(value) {
-  return (0, import_node_crypto2.createHash)("sha256").update(value).digest("base64url");
+  return (0, import_node_crypto3.createHash)("sha256").update(value).digest("base64url");
 }
 function deviceName() {
   return `AIPM CLI on ${process.platform}`;
@@ -9282,9 +9542,9 @@ function buildStarterQualityMetadata(options) {
 }
 async function initSkill(opts) {
   if (!isValidScopeName(opts.name)) throw new Error("Invalid @scope/name");
-  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path13.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
+  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path15.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
   const cdTarget = opts.here ? null : opts.dir ?? skillFolderName(opts.name);
-  const source = opts.from ? (0, import_node_path13.resolve)(opts.from) : null;
+  const source = opts.from ? (0, import_node_path15.resolve)(opts.from) : null;
   const entry = source ? await inferEntryFromSource(source, opts.entry) : opts.entry;
   const template = parseSkillTemplate(opts.template ?? "blank");
   const manifest = PackageManifestSchema.parse({
@@ -9305,17 +9565,17 @@ async function initSkill(opts) {
   if (source) {
     await copySourceIntoSkillRoot(source, root, source);
   } else {
-    await (0, import_promises10.mkdir)(root, { recursive: true });
+    await (0, import_promises12.mkdir)(root, { recursive: true });
   }
-  await writeStarterFile((0, import_node_path13.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await writeStarterFile((0, import_node_path15.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
   if (!opts.from) {
     await writeStarterFile(
-      (0, import_node_path13.join)(root, entry),
+      (0, import_node_path15.join)(root, entry),
       SKILL_TEMPLATES[template](opts.name)
     );
   }
   await writeStarterFile(
-    (0, import_node_path13.join)(root, ".aipmignore"),
+    (0, import_node_path15.join)(root, ".aipmignore"),
     [
       "# Files that should never be published with this skill",
       ".env*",
@@ -9333,14 +9593,14 @@ async function initSkill(opts) {
       ""
     ].join("\n")
   );
-  await (0, import_promises10.mkdir)((0, import_node_path13.join)(root, ".aipm"), { recursive: true });
+  await (0, import_promises12.mkdir)((0, import_node_path15.join)(root, ".aipm"), { recursive: true });
   console.log(`Created ${opts.name} skill folder: ${root}`);
   printPublishGuide(
     opts.from ? `Copied ${opts.from} into ${root} and created aipm.manifest.json, .aipmignore, and the local publish state folder.` : `Created ${root} with aipm.manifest.json, ${entry}, .aipmignore, and the local publish state folder.`,
     cdTarget ? `Run cd ${cdTarget}, edit/review the files, then run aipm publish add .` : "Edit/review the files, then run aipm publish add ."
   );
 }
-program2.command("init").description("Create aipm.package.json in the current project or globally").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Default registry URL").option("--target <tool>", "Preferred install target: cursor, claude, or *").action(async (opts) => {
+program2.command("init").description("Create aipm.package.json in the current project or globally").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Default registry URL").option("--target <tool>", "Preferred install target: cursor, claude, codex, or *").action(async (opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const existing = await readProjectPackageJson(configRoot);
@@ -9348,7 +9608,7 @@ program2.command("init").description("Create aipm.package.json in the current pr
     console.log(`aipm.package.json already exists (${scopeLabel(scope)}).`);
     return;
   }
-  if (scope.global) await (0, import_promises10.mkdir)(configRoot, { recursive: true });
+  if (scope.global) await (0, import_promises12.mkdir)(configRoot, { recursive: true });
   const installRoot = resolveInstallRoot(scope);
   const detected = await detectToolsInProject(installRoot);
   const parsedTarget = parseTargetFlag(opts.target);
@@ -9362,7 +9622,8 @@ program2.command("init").description("Create aipm.package.json in the current pr
     schemaVersion: "0.1",
     registry,
     preferredTools: preferredTools.length ? preferredTools : void 0,
-    packages: {}
+    packages: {},
+    prompts: {}
   });
   console.log(`Created aipm.package.json (${scopeLabel(scope)}, registry: ${registry})`);
 });
@@ -9450,14 +9711,27 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
   console.log(`Auth file: ${data.authFile}`);
   console.log(`Publish guide: ${data.publishDoc}`);
 });
-program2.command("add <package>").description("Add and install a package @scope/name[@version]").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive; fail if prompt needed").action(async (pkgArg, opts) => {
-  const { name, version: requestedVersion } = parsePackageArg(pkgArg);
+program2.command("add <package-or-prompt>").description("Add a skill package or an AIPM prompt URL").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive; fail if prompt needed").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
   let project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
+  const promptReference = parsePromptUrl(pkgArg);
+  if (promptReference) {
+    const result = await installTrackedPrompt({
+      configRoot,
+      registry,
+      project,
+      reference: promptReference,
+      track: true,
+      recordCopy: true
+    });
+    console.log(`Installed prompt ${result.prompt.title} \u2192 ${result.path}`);
+    return;
+  }
+  const { name, version: requestedVersion } = parsePackageArg(pkgArg);
   const token = await tokenForRead(registry, opts.token);
   const version = requestedVersion ?? project.packages[name] ?? await latestVersionForPackage(registry, name, token);
   if (!version) throw new Error("Specify version: aipm add @scope/pkg@1.0.0");
@@ -9509,7 +9783,7 @@ program2.command("search [query]").description("Search public registry packages"
     console.log(`  ${meta}`);
   }
 });
-program2.command("install").description("Install all packages from aipm.package.json").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (opts) => {
+program2.command("install").description("Install all packages from aipm.package.json").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
@@ -9531,10 +9805,75 @@ program2.command("install").description("Install all packages from aipm.package.
       token
     });
   }
+  for (const [alias, url] of Object.entries(project.prompts)) {
+    const reference = parsePromptUrl(url);
+    if (!reference) throw new Error(`Invalid tracked prompt URL for ${alias}: ${url}`);
+    const result = await installTrackedPrompt({
+      configRoot,
+      registry,
+      project,
+      reference: { ...reference, alias },
+      track: false
+    });
+    console.log(`Restored prompt ${result.prompt.title} \u2192 ${result.path}`);
+  }
+});
+program2.command("show <package-or-prompt>").description("Show an installed prompt snapshot or tracked skill details").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (value, opts) => {
+  const configRoot = resolveConfigRoot({ global: opts.global });
+  const project = await readProjectPackageJson(configRoot);
+  if (!project) throw new Error(initRequiredMessage({ global: opts.global }));
+  const reference = resolveTrackedPrompt(project, value);
+  if (reference && project.prompts[reference.alias] === reference.url) {
+    const lock2 = await readLockfile(configRoot);
+    const entry2 = lock2?.prompts[reference.alias];
+    if (!entry2) throw new Error(`Prompt is not installed: ${reference.url}. Run aipm install.`);
+    console.log(await readInstalledPrompt(configRoot, entry2));
+    return;
+  }
+  const { name } = parsePackageArg(value);
+  const lock = await readLockfile(configRoot);
+  const entry = lock?.packages[name];
+  if (!entry) throw new Error(`Package is not installed: ${name}`);
+  console.log(`${name}@${entry.version} [${entry.resolvedTools.join(", ")}]`);
 });
 program2.command("show-prompt <package>").description("Show the manual setup prompt installed with a package").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
   await showInstalledPrompt(resolveConfigRoot({ global: opts.global }), pkgArg);
 });
+function promptImageContentType(path2) {
+  const extension = (0, import_node_path15.extname)(path2).toLowerCase();
+  if (extension === ".png") return "image/png";
+  if (extension === ".jpg" || extension === ".jpeg") return "image/jpeg";
+  if (extension === ".webp") return "image/webp";
+  throw new Error(`Unsupported prompt sample image: ${path2}`);
+}
+var promptCommand = program2.command("prompt").description("Publish prompt listings from structured JSON");
+promptCommand.command("publish <file>").description("Publish one prompt or a batch of prompts from JSON").option("--registry <url>", "Registry API base URL").option("--yes", "Confirm public publishing without an extra reminder").action(async (file, opts) => {
+  const registry = registryFromEnvOrDefault(opts.registry);
+  const accessToken = await authTokenForRegistry(registry, { throwOnFailure: true });
+  if (!accessToken) throw new Error("Run aipm login before publishing prompts.");
+  const absoluteFile = (0, import_node_path15.resolve)(file);
+  const parsed = JSON.parse(await (0, import_promises12.readFile)(absoluteFile, "utf8"));
+  const rows = Array.isArray(parsed) ? parsed : "prompts" in parsed ? parsed.prompts : [parsed];
+  if (rows.length === 0) throw new Error("Prompt publish file contains no prompts.");
+  if (!opts.yes) {
+    console.log(`Reminder: this will publish ${rows.length} public prompt${rows.length === 1 ? "" : "s"}.`);
+    console.log("Use --yes to skip this reminder in automation.");
+  }
+  for (const row of rows) {
+    const { sampleImagePath, ...input2 } = row;
+    let sampleImage;
+    if (sampleImagePath) {
+      const imagePath = (0, import_node_path15.resolve)((0, import_node_path15.dirname)(absoluteFile), sampleImagePath);
+      sampleImage = {
+        data: await (0, import_promises12.readFile)(imagePath),
+        filename: (0, import_node_path15.basename)(imagePath),
+        contentType: promptImageContentType(imagePath)
+      };
+    }
+    const saved = await publishPrompt(registry, input2, accessToken, sampleImage);
+    console.log(`Published ${saved.title} \u2192 ${SITE_URL}${saved.path}`);
+  }
+});
 program2.command("cleanup <package>").description("Delete temporary helper files installed with a package").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--yes", "Delete helper files without asking for confirmation").action(async (pkgArg, opts) => {
   await cleanupInstalledHelpers({
     configRoot: resolveConfigRoot({ global: opts.global }),
@@ -9550,8 +9889,8 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
     publish.help();
     return;
   }
-  const abs = (0, import_node_path13.resolve)(dir);
-  const manifestRaw = await (0, import_promises10.readFile)((0, import_node_path13.join)(abs, "aipm.manifest.json"), "utf8");
+  const abs = (0, import_node_path15.resolve)(dir);
+  const manifestRaw = await (0, import_promises12.readFile)((0, import_node_path15.join)(abs, "aipm.manifest.json"), "utf8");
   const manifest = PackageManifestSchema.parse(JSON.parse(manifestRaw));
   const tarball = await packDirectory(abs);
   const registry = registryFromEnvOrDefault(opts.registry);
@@ -9559,6 +9898,7 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
   console.log(`Published ${manifest.name}@${result.version}`);
   console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
+  console.log(`README badge: ${packageBadgeMarkdown(manifest.name, result.version)}`);
   printPublishGuide(
     `Published ${manifest.name}@${result.version} from ${abs}.`,
     "Share the install command or open the package page to confirm the listing."
@@ -9684,28 +10024,46 @@ publish.command("push").description("Publish staged files").option("--registry <
   console.log(`Published ${manifest.name}@${result.version}`);
   console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
+  console.log(`README badge: ${packageBadgeMarkdown(manifest.name, result.version)}`);
   printPublishGuide(
     `Published ${manifest.name}@${result.version} to ${registry}.`,
     "Open the registry page, test the install command in a clean project, and share the package link."
   );
 });
-program2.command("list").description("List packages from aipm-lock.json").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (opts) => {
+program2.command("list").description("List installed skills and prompts from aipm-lock.json").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("-p, --prompt", "List prompts only").option("-s, --skill", "List skills only").action(async (opts) => {
   const configRoot = resolveConfigRoot({ global: opts.global });
   const lock = await readLockfile(configRoot);
-  if (!lock || Object.keys(lock.packages).length === 0) {
-    console.log("No packages installed.");
+  const showSkills = !opts.prompt || Boolean(opts.skill);
+  const showPrompts = !opts.skill || Boolean(opts.prompt);
+  const skillRows = lock ? Object.entries(lock.packages) : [];
+  const promptRows = lock ? Object.entries(lock.prompts) : [];
+  if ((!showSkills || skillRows.length === 0) && (!showPrompts || promptRows.length === 0)) {
+    console.log(opts.prompt && !opts.skill ? "No prompts installed." : opts.skill && !opts.prompt ? "No skills installed." : "No skills or prompts installed.");
     return;
   }
-  for (const [name, entry] of Object.entries(lock.packages)) {
-    console.log(`${name}@${entry.version} [${entry.resolvedTools.join(", ")}]`);
+  if (showSkills) {
+    for (const [name, entry] of skillRows) {
+      console.log(`skill  ${name}@${entry.version} [${entry.resolvedTools.join(", ")}]`);
+    }
+  }
+  if (showPrompts) {
+    for (const [name, entry] of promptRows) {
+      console.log(`prompt  ${name}  ${entry.url}  ${entry.installedPath}`);
+    }
   }
 });
-program2.command("remove <package>").alias("rm").description("Remove a package from aipm.package.json and aipm-lock.json").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
-  const { name } = parsePackageArg(pkgArg);
+program2.command("remove <package-or-prompt>").alias("rm").description("Remove a tracked skill or prompt and its installed files").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
+  const promptReference = resolveTrackedPrompt(project, pkgArg);
+  if (promptReference && project.prompts[promptReference.alias] === promptReference.url) {
+    await removeTrackedPrompt({ configRoot, project, reference: promptReference });
+    console.log(`Removed prompt ${promptReference.url} and its local snapshot.`);
+    return;
+  }
+  const { name } = parsePackageArg(pkgArg);
   const packages = { ...project.packages };
   delete packages[name];
   await writeProjectPackageJson(configRoot, { ...project, packages });
@@ -9718,19 +10076,31 @@ program2.command("remove <package>").alias("rm").description("Remove a package f
   console.log(`Removed ${name} from AIPM ${scopeLabel(scope)} files.`);
   console.log("Adapter-written files are not deleted yet; review your project before committing.");
 });
-program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
+program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
   let project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
-  const token = await tokenForRead(registry, opts.token);
-  const names = pkgArg ? [parsePackageArg(pkgArg).name] : Object.keys(project.packages);
-  if (names.length === 0) {
-    console.log("No packages configured.");
+  const requestedPrompt = pkgArg ? resolveTrackedPrompt(project, pkgArg) : null;
+  if (requestedPrompt) {
+    if (project.prompts[requestedPrompt.alias] !== requestedPrompt.url) {
+      throw new Error(`Prompt is not tracked: ${requestedPrompt.url}`);
+    }
+    const result = await installTrackedPrompt({
+      configRoot,
+      registry,
+      project,
+      reference: requestedPrompt,
+      track: false,
+      updateOnly: true
+    });
+    console.log(result.changed ? `Updated prompt ${result.prompt.title} \u2192 ${result.path}` : `Prompt unchanged: ${result.prompt.title}`);
     return;
   }
+  const token = await tokenForRead(registry, opts.token);
+  const names = pkgArg ? [parsePackageArg(pkgArg).name] : Object.keys(project.packages);
   for (const name of names) {
     const version = await latestVersionForPackage(registry, name, token);
     project = {
@@ -9750,9 +10120,27 @@ program2.command("update [package]").description("Update one installed package,
       token
     });
   }
+  if (!pkgArg) {
+    for (const [alias, url] of Object.entries(project.prompts)) {
+      const reference = parsePromptUrl(url);
+      if (!reference) throw new Error(`Invalid tracked prompt URL for ${alias}: ${url}`);
+      const result = await installTrackedPrompt({
+        configRoot,
+        registry,
+        project,
+        reference: { ...reference, alias },
+        track: false,
+        updateOnly: true
+      });
+      console.log(result.changed ? `Updated prompt ${result.prompt.title} \u2192 ${result.path}` : `Prompt unchanged: ${result.prompt.title}`);
+    }
+  }
+  if (names.length === 0 && Object.keys(project.prompts).length === 0) {
+    console.log("No skills or prompts configured.");
+  }
 });
 program2.command("doctor").description("Check PATH, Node, registry, project config, and publish readiness").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--json", "Print machine-readable JSON").option("--publish", "Only show publish-readiness checks").action((opts) => runDoctor(opts));
-program2.parseAsync(process.argv).catch((err) => {
+program2.parseAsync(normalizedArgv).catch((err) => {
   console.error(err.message);
   const message = err.message.toLowerCase();
   if (message.includes("token") || message.includes("unauthorized") || message.includes("forbidden")) {