@envarai/envarpay 0.2.0-alpha.15 → 0.2.0-alpha.16

package/dist/commerce/native-inventory.d.ts

@@ -1,3 +1,4 @@
+export declare const isSkillInstallerMetadata: (path: string) => path is ".clawhub/origin.json";
 export declare function readSkillInventory(roots: string[]): {
     name: string;
     path: string;

package/dist/commerce/native-inventory.js

@@ -4,6 +4,9 @@ import { extname, join, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { parse } from 'yaml';
 const namePattern = /^[a-z][a-z0-9-]{0,63}$/;
+// Native installer provenance is included in the source digest, but never
+// copied into the executable service package or supplied to the model.
+export const isSkillInstallerMetadata = (path) => path === '.clawhub/origin.json';
 export function readSkillInventory(roots) {
     const found = [];
     const seen = new Set();
@@ -54,7 +57,7 @@ export function readSkillInventory(roots) {
                     supported = false;
                     continue;
                 }
-                if (!['.md', '.txt'].includes(extname(name).toLowerCase()) && name !== 'LICENSE')
+                if (!['.md', '.txt'].includes(extname(name).toLowerCase()) && name !== 'LICENSE' && !isSkillInstallerMetadata(prefix + name))
                     supported = false;
                 files.push([prefix + name, createHash('sha256').update(readFileSync(file)).digest('hex')]);
             }

package/dist/commerce/setup.js

@@ -1,7 +1,7 @@
 /** Guided local installation. Platform input is data, never a shell command or wallet policy. */
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync, cpSync, mkdtempSync, renameSync, rmSync, } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 import { execFileSync } from "node:child_process";
@@ -10,6 +10,7 @@ import { probeOpenClaw } from "./openclaw-setup.js";
 import { readInstalledSkills } from "./native-skills.js";
 import { loadCommerceConfig, validateUrl } from "./config.js";
 import { CommerceError } from "./types.js";
+import { isSkillInstallerMetadata } from './native-inventory.js';
 const ID = /^[a-z][a-z0-9-]{0,63}$/, CONTAINER = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 export function parseSetupBundle(raw) {
     const v = raw;
@@ -40,6 +41,8 @@ export function prepareTextSkill(source, destination, name) {
             const item = lstatSync(path);
             if (item.isSymbolicLink())
                 throw new CommerceError("setup_skill", "Skill symlinks are unsupported");
+            if (item.isFile() && isSkillInstallerMetadata(relative(source, path).split(sep).join('/')))
+                return false;
             if (item.isFile() &&
                 !/\.(md|txt)$/i.test(path) &&
                 !path.endsWith("/LICENSE"))

package/examples/hermes-skill-inventory.py

@@ -73,7 +73,8 @@ def inventory(home):
                     if size > 1024 * 1024 or len(package) >= 128:
                         supported = False
                         break
-                    if file.suffix.lower() not in {".md", ".txt"} and file.name != "LICENSE":
+                    if (file.suffix.lower() not in {".md", ".txt"} and file.name != "LICENSE"
+                            and str(file.relative_to(entry.parent)) != ".clawhub/origin.json"):
                         supported = False
                     package.append(
                         [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envarai/envarpay",
-  "version": "0.2.0-alpha.15",
+  "version": "0.2.0-alpha.16",
   "description": "Independent A2A service commerce, budgeted buyers and x402/MPP payments",
   "type": "module",
   "license": "MIT",