@camunda8/spm 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,167 @@
+# spm — skill package manager
+
+Declare AI skills as git dependencies in `ai.json`, and `spm` wires them into your
+AI tool (Claude Code and GitHub Copilot CLI) **without ever copying skills into
+your repo**. No symlinks in the project, no fragile `.gitignore` rules.
+
+## How it works
+
+```
+ai.json ──resolve──▶ ai.lock ──fetch──▶ ~/.spm/store/<repo>@<sha>   (global cache, one clone per commit)
+                                              │
+                                              └─project──▶ ~/.spm/vendors/<target>/<project>/   (assembled marketplace)
+                                                                 │
+                                                                 └─register─▶ vendor picks it up (see below)
+```
+
+- **`ai.json`** — you author it, commit it. Declares target vendors + skill deps.
+- **`ai.lock`** — generated, commit it. Pins every version selector to an immutable commit SHA → reproducible installs.
+- **Global store** (`~/.spm/store`) — each repo@commit fetched once, shared across all projects.
+- **Vendor projection** (`~/.spm/vendors`) — a self-contained plugin marketplace assembled outside your repo. Both vendors require skills to physically live inside a plugin dir, so spm copies them **here**, never into your project tree.
+- **Registration** differs per vendor:
+  - **Claude** — spm writes a pointer to the marketplace into `.claude/settings.local.json` (gitignored by convention). Declarative, per-project, zero VCS footprint.
+  - **Copilot CLI** — spm shells out to `copilot plugin marketplace add` + `copilot plugin install`. Copilot marketplaces/plugins are **user-global** (no project-local config), so registration is global. spm names the registration by a **stable, path-independent project id** stored in `ai.lock` (`spm-xxxxxxxx`), so a moved or re-cloned checkout re-registers the *same* entry instead of leaving a duplicate. Orphaned registrations (whose local dir no longer exists) are pruned automatically on each `spm install`/`clean`. Requires the `copilot` CLI on PATH.
+
+On a fresh clone, teammates run `spm install` — it rebuilds their own store and re-registers from `ai.lock`. Same model as `node_modules`.
+
+## ai.json
+
+```json
+{
+  "targets": ["claude", "copilot"],
+  "skills": {
+    "pdf-tools": { "git": "https://github.com/org/skills", "tag": "v1.2.0", "path": "skills/pdf" },
+    "reviewer":  { "git": "https://github.com/me/reviewer", "branch": "main" },
+    "pinned":    { "git": "https://github.com/x/y",         "commit": "a1b2c3d" }
+  }
+}
+```
+
+`targets` lists one or more vendors (`claude`, `copilot`) — skills resolve once
+and project into each independently.
+
+### Schema & validation
+
+`ai.json` is described by a JSON Schema at [`schema/ai.schema.json`](schema/ai.schema.json)
+(draft-07). spm embeds it and validates every `ai.json` on load, reporting all
+violations at once with their JSON path:
+
+```
+error: in ai.json: ai.json does not match schema:
+  at /skills/x: {"git":"u"} is not valid under any of the schemas listed in the 'oneOf' keyword
+```
+
+Add a `"$schema"` reference for editor autocompletion/validation:
+
+```json
+{ "$schema": "./schema/ai.schema.json", "targets": ["claude"], "skills": {} }
+```
+
+Version selectors (exactly one per skill):
+
+| field    | meaning                                    | locked to      |
+|----------|--------------------------------------------|----------------|
+| `tag`    | git tag (annotated tags deref to commit)   | resolved SHA   |
+| `branch` | branch tip at install/update time          | resolved SHA   |
+| `commit` | exact commit                               | itself         |
+
+`path` (optional) selects a subdirectory — for monorepos holding many skills.
+
+### Repo URLs (HTTPS & SSH)
+
+`git` accepts any URL the system `git` understands:
+
+```bash
+spm add https://github.com/org/repo --tag v1.0.0            # HTTPS
+spm add git@github.com:org/repo.git --branch main           # SSH (scp-style)
+spm add ssh://git@github.com/org/repo.git --branch main     # SSH (url form)
+```
+
+SSH auth goes through your ssh-agent / keys — spm never handles credentials.
+Private HTTPS repos use your git credential helper. spm runs git with
+`GIT_TERMINAL_PROMPT=0`, so a missing credential fails with a clear error
+instead of hanging on a prompt (helpers and ssh-agent still work).
+
+## Installation
+
+`spm` ships as a single self-contained binary (needs the system `git` on `PATH`
+at runtime, plus the `copilot` CLI if you target `copilot`).
+
+**From npm (recommended)** — _pending the initial publish ([#6](https://github.com/camunda/spm-cli/issues/6))_.
+Once published, this is the zero-setup path on every platform — it puts `spm` on
+your `PATH` with no manual steps:
+
+```bash
+npm i -g @camunda8/spm
+spm --help
+```
+
+`@camunda8/spm` is a thin launcher that pulls in the matching prebuilt binary for
+your OS/CPU via an optional dependency (`@camunda8/spm-<os>-<cpu>`), so nothing is
+compiled or downloaded outside npm. Supported: `darwin-x64`, `darwin-arm64`,
+`linux-x64`, `linux-arm64`, `win32-x64`. Update with `npm i -g @camunda8/spm@latest`.
+
+**Prebuilt binary** — the repo is **internal**, so release assets require
+authentication. Download with the [GitHub CLI](https://cli.github.com/) (you must
+be signed in via `gh auth login` and be a Camunda org member), then put the binary
+on your `PATH`:
+
+```bash
+# pick the asset for your platform (see list below); example: Apple Silicon macOS
+gh release download --repo camunda/spm-cli \
+  --pattern 'spm-aarch64-apple-darwin' --output spm
+chmod +x spm && sudo mv spm /usr/local/bin/
+```
+
+`--repo camunda/spm-cli` with no tag grabs the latest release; add
+`v0.1.0` as the first positional arg to pin a specific version.
+
+Assets: `spm-x86_64-unknown-linux-gnu`, `spm-aarch64-unknown-linux-gnu`,
+`spm-x86_64-apple-darwin`, `spm-aarch64-apple-darwin`,
+`spm-x86_64-pc-windows-msvc.exe`.
+
+**From crates.io** — _not published yet_. The crate name `spm-cli` is reserved
+(the binary is `spm`); once it's published you'll be able to run:
+
+```bash
+cargo install spm-cli
+```
+
+**From source:**
+
+```bash
+git clone https://github.com/camunda/spm-cli && cd spm-cli
+make install                  # release build → /usr/local/bin/spm
+make install PREFIX=~/.local  # or a custom prefix
+# or: cargo install --path .
+```
+
+## Commands
+
+```bash
+spm init [--target claude|copilot ...]             # scaffold ai.json (repeatable / comma-separated)
+spm add <git> (--tag|--branch|--commit <v>) \      # add + install a skill
+        [--path <subdir>] [--name <local-name>]
+spm remove <name>                                  # drop a skill
+spm update [name]                                  # re-resolve branches/tags to latest
+spm install                                        # rebuild from ai.lock (after clone)
+spm list                                           # show skills + pinned commits
+spm clean                                          # remove generated vendor config
+```
+
+## Design notes
+
+- **Cross-OS**: shells out to the system `git` (no libgit2 build deps); no symlinks; all paths via `std::path`. Runs on Linux, macOS, Windows.
+- **`SPM_HOME`** overrides the store/vendor root (default `~/.spm`) — used by tests.
+- **Vendor adapters**: adding a target means implementing one `Vendor` trait (`src/vendor/`). Both `claude` and `copilot` assemble the same plugin-marketplace layout (`marketplace.json` → `plugin.json` → `skills/<name>/SKILL.md`); they differ only in how the marketplace is registered.
+
+## Development
+
+`make check` runs the full CI gate locally (`fmt-check` + `clippy` + `test`).
+
+A **pre-commit hook** (fmt + clippy) installs itself automatically via
+[`cargo-husky`](https://github.com/rhysd/cargo-husky) — just run `cargo test`
+(or `cargo build`) once after cloning and the hook lands in `.git/hooks`. The
+hook source lives in [`.cargo-husky/hooks/`](.cargo-husky/hooks). Bypass a
+single commit with `git commit --no-verify`.
+

package/bin/spm.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+"use strict";
+
+// Launcher for the `spm` command distributed via npm.
+//
+// The npm package `@camunda8/spm` ships no binary itself. Instead it declares
+// the per-platform packages (`@camunda8/spm-<os>-<cpu>`) as optionalDependencies
+// with matching `os`/`cpu` fields, so npm installs only the one that fits the
+// host. This script resolves that package's prebuilt binary and execs it,
+// forwarding argv, stdio, and the exit code — giving `spm` on PATH with no
+// postinstall download and no extra setup.
+
+const { spawnSync } = require("node:child_process");
+const { existsSync } = require("node:fs");
+
+function resolveBinary() {
+  const platform = process.platform; // 'darwin' | 'linux' | 'win32' | ...
+  const arch = process.arch; // 'x64' | 'arm64' | ...
+  const pkg = `@camunda8/spm-${platform}-${arch}`;
+  const exe = platform === "win32" ? "spm.exe" : "spm";
+  try {
+    // Resolve through Node's normal algorithm so it works whether installed
+    // globally (npm i -g) or as a local dependency.
+    const path = require.resolve(`${pkg}/bin/${exe}`);
+    return existsSync(path) ? path : null;
+  } catch {
+    return null;
+  }
+}
+
+function fail(message) {
+  process.stderr.write(`[spm] ${message}\n`);
+  process.exit(1);
+}
+
+const binary = resolveBinary();
+if (!binary) {
+  fail(
+    `no prebuilt binary found for ${process.platform}-${process.arch}.\n` +
+      `The optional dependency @camunda8/spm-${process.platform}-${process.arch} ` +
+      `is missing or your platform is unsupported.\n` +
+      `Supported platforms: darwin-x64, darwin-arm64, linux-x64, linux-arm64, win32-x64.\n` +
+      `Try reinstalling: npm i -g @camunda8/spm`,
+  );
+}
+
+const result = spawnSync(binary, process.argv.slice(2), { stdio: "inherit" });
+
+if (result.error) {
+  fail(`failed to launch binary: ${result.error.message}`);
+}
+
+// Re-raise a terminating signal so callers (and shells) observe it faithfully;
+// otherwise propagate the child's exit code.
+if (result.signal) {
+  process.kill(process.pid, result.signal);
+}
+process.exit(result.status === null ? 1 : result.status);

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@camunda8/spm",
+  "version": "0.1.0",
+  "description": "Skill package manager (spm): declare AI skills in ai.json and materialize them for Claude/Copilot.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/camunda/spm-cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camunda/spm-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/camunda/spm-cli/issues"
+  },
+  "author": "Camunda",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "ai",
+    "skills",
+    "claude",
+    "copilot",
+    "package-manager",
+    "cli"
+  ],
+  "bin": {
+    "spm": "bin/spm.js"
+  },
+  "files": [
+    "bin/spm.js"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "@camunda8/spm-linux-x64": "0.1.0",
+    "@camunda8/spm-linux-arm64": "0.1.0",
+    "@camunda8/spm-darwin-x64": "0.1.0",
+    "@camunda8/spm-darwin-arm64": "0.1.0",
+    "@camunda8/spm-win32-x64": "0.1.0"
+  }
+}