@camunda8/spm 0.1.0 → 0.1.1

package/README.md

@@ -1,26 +1,25 @@
 # spm — skill package manager
 
 Declare AI skills as git dependencies in `ai.json`, and `spm` wires them into your
-AI tool (Claude Code and GitHub Copilot CLI) **without ever copying skills into
-your repo**. No symlinks in the project, no fragile `.gitignore` rules.
+AI tool (Claude Code and GitHub Copilot CLI) **without ever committing skills to
+your repo**. Anything spm materializes into the working tree is gitignored — no
+symlinks, no skills under version control.
 
 ## How it works
 
 ```
 ai.json ──resolve──▶ ai.lock ──fetch──▶ ~/.spm/store/<repo>@<sha>   (global cache, one clone per commit)
                                               │
-                                              └─project──▶ ~/.spm/vendors/<target>/<project>/   (assembled marketplace)
-                                                                 │
-                                                                 └─register─▶ vendor picks it up (see below)
+                                              └─project──▶ materialized where the vendor expects it (see below)
 ```
 
 - **`ai.json`** — you author it, commit it. Declares target vendors + skill deps.
 - **`ai.lock`** — generated, commit it. Pins every version selector to an immutable commit SHA → reproducible installs.
 - **Global store** (`~/.spm/store`) — each repo@commit fetched once, shared across all projects.
-- **Vendor projection** (`~/.spm/vendors`) — a self-contained plugin marketplace assembled outside your repo. Both vendors require skills to physically live inside a plugin dir, so spm copies them **here**, never into your project tree.
+- **Vendor projection** — spm copies the store's skills into wherever each vendor loads them from. Nothing spm generates is committed to your repo.
 - **Registration** differs per vendor:
-  - **Claude** — spm writes a pointer to the marketplace into `.claude/settings.local.json` (gitignored by convention). Declarative, per-project, zero VCS footprint.
-  - **Copilot CLI** — spm shells out to `copilot plugin marketplace add` + `copilot plugin install`. Copilot marketplaces/plugins are **user-global** (no project-local config), so registration is global. spm names the registration by a **stable, path-independent project id** stored in `ai.lock` (`spm-xxxxxxxx`), so a moved or re-cloned checkout re-registers the *same* entry instead of leaving a duplicate. Orphaned registrations (whose local dir no longer exists) are pruned automatically on each `spm install`/`clean`. Requires the `copilot` CLI on PATH.
+  - **Claude** — spm assembles a self-contained plugin marketplace in the **project-local**, gitignored `.spm/claude/` dir and writes a pointer to it into `.claude/settings.local.json` (gitignored by convention). The dir sits outside `.agents/skills/` so Copilot's scanner never picks it up. Declarative, per-project, zero VCS footprint.
+  - **Copilot CLI** — spm copies the resolved skills into a **project-local** directory, `.agents/skills/spm-managed-skills/<name>/`, where Copilot CLI auto-discovers them (`.agents/skills/**/SKILL.md`). That directory is added to the project's `.gitignore` (with an explanatory comment) so the materialized skills stay truly local and are never committed. No user-global state, no `copilot` CLI required.
 
 On a fresh clone, teammates run `spm install` — it rebuilds their own store and re-registers from `ai.lock`. Same model as `node_modules`.
 
@@ -85,11 +84,10 @@ instead of hanging on a prompt (helpers and ssh-agent still work).
 ## Installation
 
 `spm` ships as a single self-contained binary (needs the system `git` on `PATH`
-at runtime, plus the `copilot` CLI if you target `copilot`).
+at runtime).
 
-**From npm (recommended)** — _pending the initial publish ([#6](https://github.com/camunda/spm-cli/issues/6))_.
-Once published, this is the zero-setup path on every platform — it puts `spm` on
-your `PATH` with no manual steps:
+**From npm (recommended)** — the zero-setup path on every platform. It puts `spm`
+on your `PATH` with no manual steps:
 
 ```bash
 npm i -g @camunda8/spm
@@ -101,6 +99,13 @@ your OS/CPU via an optional dependency (`@camunda8/spm-<os>-<cpu>`), so nothing
 compiled or downloaded outside npm. Supported: `darwin-x64`, `darwin-arm64`,
 `linux-x64`, `linux-arm64`, `win32-x64`. Update with `npm i -g @camunda8/spm@latest`.
 
+**From crates.io** — build and install from source via Cargo (needs a Rust
+toolchain). The crate is `spm-cli`; the installed binary is `spm`:
+
+```bash
+cargo install spm-cli
+```
+
 **Prebuilt binary** — the repo is **internal**, so release assets require
 authentication. Download with the [GitHub CLI](https://cli.github.com/) (you must
 be signed in via `gh auth login` and be a Camunda org member), then put the binary
@@ -120,13 +125,6 @@ Assets: `spm-x86_64-unknown-linux-gnu`, `spm-aarch64-unknown-linux-gnu`,
 `spm-x86_64-apple-darwin`, `spm-aarch64-apple-darwin`,
 `spm-x86_64-pc-windows-msvc.exe`.
 
-**From crates.io** — _not published yet_. The crate name `spm-cli` is reserved
-(the binary is `spm`); once it's published you'll be able to run:
-
-```bash
-cargo install spm-cli
-```
-
 **From source:**
 
 ```bash
@@ -153,12 +151,18 @@ spm clean                                          # remove generated vendor con
 
 - **Cross-OS**: shells out to the system `git` (no libgit2 build deps); no symlinks; all paths via `std::path`. Runs on Linux, macOS, Windows.
 - **`SPM_HOME`** overrides the store/vendor root (default `~/.spm`) — used by tests.
-- **Vendor adapters**: adding a target means implementing one `Vendor` trait (`src/vendor/`). Both `claude` and `copilot` assemble the same plugin-marketplace layout (`marketplace.json` → `plugin.json` → `skills/<name>/SKILL.md`); they differ only in how the marketplace is registered.
+- **Vendor adapters**: adding a target means implementing one `Vendor` trait (`src/vendor/`). `claude` assembles a plugin-marketplace layout (`marketplace.json` → `plugin.json` → `skills/<name>/SKILL.md`) into the gitignored project-local `.spm/claude/` and points to it; `copilot` copies skills into the gitignored project-local `.agents/skills/spm-managed-skills/`. Both keep their materialized files out of VCS via the shared `src/gitignore.rs` helper.
 
 ## Development
 
 `make check` runs the full CI gate locally (`fmt-check` + `clippy` + `test`).
 
+To cut a release, bump the crate version (the single source of truth for
+crates.io, npm, and the GitHub Release) with `make bump` — `PART=patch|minor|major`
+(default `patch`) or `VERSION=X.Y.Z`. Since `main` is protected, `make bump-pr`
+does the bump on a branch and opens the PR for you. See [`RELEASE.md`](RELEASE.md)
+for the full procedure.
+
 A **pre-commit hook** (fmt + clippy) installs itself automatically via
 [`cargo-husky`](https://github.com/rhysd/cargo-husky) — just run `cargo test`
 (or `cargo build`) once after cloning and the hook lands in `.git/hooks`. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda8/spm",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Skill package manager (spm): declare AI skills in ai.json and materialize them for Claude/Copilot.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/camunda/spm-cli#readme",
@@ -33,10 +33,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@camunda8/spm-linux-x64": "0.1.0",
-    "@camunda8/spm-linux-arm64": "0.1.0",
-    "@camunda8/spm-darwin-x64": "0.1.0",
-    "@camunda8/spm-darwin-arm64": "0.1.0",
-    "@camunda8/spm-win32-x64": "0.1.0"
+    "@camunda8/spm-linux-x64": "0.1.1",
+    "@camunda8/spm-linux-arm64": "0.1.1",
+    "@camunda8/spm-darwin-x64": "0.1.1",
+    "@camunda8/spm-darwin-arm64": "0.1.1",
+    "@camunda8/spm-win32-x64": "0.1.1"
   }
 }