@floomhq/floom 1.0.63 → 2.0.0

package/dist/publish.js

@@ -1,240 +0,0 @@
-import { parse as parseYaml } from "yaml";
-import ora from "ora";
-import clipboard from "clipboardy";
-import { getWebUrl, readConfig, resolveApiUrl } from "./config.js";
-import { floomFetch } from "./lib/api.js";
-import { c, symbols } from "./ui.js";
-import { FloomError, friendlyHttp } from "./errors.js";
-import { formatVersionLabel } from "./version.js";
-import { detectSkillSecurityFindings, formatSecurityFindings } from "./secrets.js";
-import { readSkillPackage } from "./package.js";
-const ASSET_TYPES = new Set(["knowledge", "instruction", "workflow", "skill"]);
-const INSTALL_TARGETS = new Set([
-    "claude_skill",
-    "memory",
-    "rule",
-    "codex_instruction",
-    "opencode_instruction",
-    "cursor_rule",
-    "other",
-]);
-const VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
-const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
-const YAML_MAX_ALIAS_COUNT = 50;
-function parseFrontmatter(input) {
-    const trimmed = input.replace(/^/, "");
-    if (!trimmed.startsWith("---"))
-        return { meta: {}, body: input };
-    const end = trimmed.indexOf("\n---", 3);
-    if (end === -1) {
-        return {
-            meta: {},
-            body: input,
-            error: { message: "Frontmatter opens with `---` but never closes.", line: 1 },
-        };
-    }
-    const headerBlock = trimmed.slice(3, end).trim();
-    const rest = trimmed.slice(end + 4).replace(/^\r?\n/, "");
-    const meta = {};
-    let parsed;
-    try {
-        parsed = headerBlock ? parseYaml(headerBlock, { maxAliasCount: YAML_MAX_ALIAS_COUNT }) : {};
-    }
-    catch (err) {
-        return {
-            meta,
-            body: rest,
-            error: {
-                message: err instanceof Error ? err.message.replace(/\n.*/s, "") : "Invalid YAML.",
-                line: yamlErrorLine(err),
-            },
-        };
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return { meta, body: rest };
-    for (const [rawKey, rawValue] of Object.entries(parsed)) {
-        const key = rawKey.trim().toLowerCase();
-        const value = frontmatterScalar(rawValue);
-        if (value === undefined)
-            continue;
-        if (key === "title"
-            || key === "description"
-            || key === "version"
-            || key === "slug"
-            || key === "type"
-            || key === "asset_type"
-            || key === "installs_as"
-            || key === "installs-as") {
-            if (key === "installs-as") {
-                meta.installs_as = value;
-            }
-            else {
-                meta[key] = value;
-            }
-        }
-    }
-    return { meta, body: rest };
-}
-function yamlErrorLine(err) {
-    const linePos = err.linePos;
-    const line = linePos?.[0]?.line;
-    return typeof line === "number" && Number.isFinite(line) ? line + 1 : 2;
-}
-function frontmatterScalar(value) {
-    if (typeof value === "string")
-        return value;
-    if (typeof value === "number" || typeof value === "boolean")
-        return String(value);
-    return undefined;
-}
-function parseAssetType(value, source) {
-    if (!value)
-        return undefined;
-    if (ASSET_TYPES.has(value))
-        return value;
-    throw new FloomError(`Invalid ${source}: ${value}`, "Use one of: knowledge, instruction, workflow, skill.");
-}
-function parseInstallsAs(value, source) {
-    if (!value)
-        return undefined;
-    if (INSTALL_TARGETS.has(value))
-        return value;
-    throw new FloomError(`Invalid ${source}: ${value}`, "Use one of: claude_skill, memory, rule, codex_instruction, opencode_instruction, cursor_rule, other.");
-}
-function parseVersion(value, source) {
-    if (!value)
-        return undefined;
-    if (VERSION_RE.test(value))
-        return value;
-    throw new FloomError(`Invalid ${source}: ${value}`, "Use 1-64 characters: letters, numbers, dots, underscores, plus, or hyphen.");
-}
-export async function publishSkillPath(opts) {
-    const skillPackage = await readSkillPackage(opts.file);
-    const securityFailures = [
-        { path: "SKILL.md", body: skillPackage.skillBody },
-        ...skillPackage.packageFiles.map((file) => ({
-            path: file.path,
-            body: Buffer.from(file.content_base64, "base64").toString("utf8"),
-        })),
-    ].flatMap((file) => {
-        const findings = detectSkillSecurityFindings(file.body);
-        return findings.length > 0 ? [`${file.path}\n${formatSecurityFindings(findings)}`] : [];
-    });
-    if (securityFailures.length > 0) {
-        throw new FloomError("Security scan failed. Publish stopped.", `${securityFailures.join("\n")}\nRemove secrets, prompt-injection text, or data-exfiltration instructions before publishing.`);
-    }
-    const fileCount = 1 + skillPackage.packageFiles.length;
-    if (!opts.quiet) {
-        process.stdout.write(`\n${symbols.ok}  Pre-publish security scan passed (${fileCount} file${fileCount === 1 ? "" : "s"}, 3 checks).\n`);
-    }
-    const { meta, error: fmError } = parseFrontmatter(skillPackage.skillBody);
-    if (fmError) {
-        throw new FloomError(`Couldn't parse frontmatter — check your YAML.`, `Line ${fmError.line}: ${fmError.message}`);
-    }
-    validateTextMeta(meta.title, "frontmatter title", 200);
-    validateTextMeta(meta.description, "frontmatter description", 1000);
-    const assetType = opts.assetType ?? parseAssetType(meta.asset_type ?? meta.type, "frontmatter type") ?? "skill";
-    const installsAs = opts.installsAs ?? parseInstallsAs(meta.installs_as, "frontmatter installs_as") ?? null;
-    const version = opts.version ?? parseVersion(meta.version, "frontmatter version") ?? null;
-    const updateSlug = opts.update ? (opts.updateSlug ?? meta.slug) : undefined;
-    if (opts.update && !updateSlug) {
-        throw new FloomError("Missing update slug.", "Use `--update <slug>` or add `slug:` to the skill frontmatter.");
-    }
-    if (updateSlug !== undefined && !SLUG_RE.test(updateSlug)) {
-        throw new FloomError(`Invalid update slug: ${updateSlug}`, "Use the Floom skill slug from its share URL.");
-    }
-    const cfg = await readConfig();
-    if (!cfg) {
-        throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
-    }
-    const apiUrl = resolveApiUrl(cfg);
-    const body = {
-        title: meta.title ?? null,
-        description: meta.description ?? null,
-        body_md: skillPackage.skillBody,
-        ...((opts.visibility ?? (!updateSlug ? "unlisted" : undefined)) ? { visibility: opts.visibility ?? "unlisted" } : {}),
-        asset_type: assetType,
-        source: "markdown",
-        installs_as: installsAs,
-        version,
-        original_filename: skillPackage.originalFilename,
-        published_via: "cli",
-        ...(opts.sharedWithEmails ? { shared_with_emails: opts.sharedWithEmails } : {}),
-        ...(skillPackage.packageFiles.length > 0 ? { package_files: skillPackage.packageFiles } : {}),
-    };
-    let res;
-    try {
-        res = await floomFetch(updateSlug ? `${apiUrl}/api/v1/skills/${updateSlug}` : `${apiUrl}/api/skills`, updateSlug ? "update your skill" : "publish your skill", {
-            method: updateSlug ? "PATCH" : "POST",
-            token: cfg.accessToken,
-            checkOk: false,
-            body,
-        });
-    }
-    catch (err) {
-        throw err;
-    }
-    if (res.status === 409) {
-        throw new FloomError("Skill already published.", "Use `--update <slug>` to publish a new version of an existing skill.");
-    }
-    if (!res.ok) {
-        throw friendlyHttp(res.status, updateSlug ? "update your skill" : "publish your skill");
-    }
-    const data = (await res.json());
-    // Build a humans-friendly URL: strip the trailing `.md` if the API returned one.
-    const webBase = getWebUrl();
-    const humanUrl = data.url
-        ? data.url.replace(/\.md$/, "")
-        : `${webBase}/s/${data.slug}`;
-    const titleLabel = data.title ? `"${data.title}"` : opts.file;
-    return { data, humanUrl, version, titleLabel };
-}
-export async function publish(opts) {
-    const spinner = ora({
-        text: c.dim(`${opts.update ? "Updating" : "Publishing"} ${opts.file}...`),
-        color: "yellow",
-    }).start();
-    let result;
-    try {
-        result = await publishSkillPath(opts);
-    }
-    catch (err) {
-        spinner.stop();
-        throw err;
-    }
-    spinner.stop();
-    const versionTag = result.version ? c.dim(` (${formatVersionLabel(result.version)})`) : "";
-    const verb = opts.update ? "Updated" : "Published";
-    process.stdout.write(`\n${symbols.ok}  ${verb} ${c.bold(result.titleLabel)}${versionTag}\n\n`);
-    process.stdout.write(`   ${c.cyan(result.humanUrl)}\n\n`);
-    if (result.data.visibility === "shared" && result.data.shared_with_emails?.length) {
-        process.stdout.write(`   ${c.dim(`Shared with ${result.data.shared_with_emails.join(", ")}`)}\n\n`);
-    }
-    let copied = false;
-    try {
-        await clipboard.write(result.humanUrl);
-        copied = true;
-    }
-    catch {
-        copied = false;
-    }
-    if (copied) {
-        process.stdout.write(`   ${c.dim("Copied to clipboard. Share it anywhere.")}\n\n`);
-    }
-    else {
-        process.stdout.write(`   ${c.dim("Share it anywhere.")}\n\n`);
-    }
-    process.stdout.write(`   ${c.bold("Next")}\n`);
-    process.stdout.write(`   ${c.dim("1.")} Test locally: ${c.cyan(`npx -y @floomhq/floom add ${result.humanUrl} --setup`)}\n`);
-    process.stdout.write(`   ${c.dim("2.")} Send the link.\n`);
-    process.stdout.write(`   ${c.dim("3.")} Receiver runs ${c.cyan(`npx -y @floomhq/floom add ${result.humanUrl} --setup`)}\n`);
-    process.stdout.write(`   ${c.dim("4.")} Agent reads the installed Markdown from the local skills folder.\n\n`);
-}
-function validateTextMeta(value, label, maxLength) {
-    if (value === undefined)
-        return;
-    if (!value.trim())
-        throw new FloomError(`Invalid ${label}.`, "Metadata values cannot be blank.");
-    if (value.length > maxLength)
-        throw new FloomError(`Invalid ${label}.`, `Use ${maxLength} characters or fewer.`);
-}

package/dist/push-watch.js

@@ -1,372 +0,0 @@
-import { constants } from "node:fs";
-import { mkdir, open, readdir, rename } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { CONFIG_DIR } from "./config.js";
-import { FloomError } from "./errors.js";
-import { publishSkillPath } from "./publish.js";
-import { readSkillPackage } from "./package.js";
-import { manifestKey, markSynced, readSyncManifest, unmarkSynced, writeSyncManifest } from "./sync-manifest.js";
-import { c, symbols } from "./ui.js";
-import { targetSkillsDir } from "./targets.js";
-const MANIFEST_VERSION = 1;
-const PUSH_MANIFEST_PATH = join(CONFIG_DIR, "push-manifest.json");
-const MAX_SCAN_DEPTH = 8;
-const SKIP_DIRS = new Set([".cache", ".git", ".next", ".pytest_cache", "__pycache__", "build", "coverage", "dist", "node_modules", "out"]);
-const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
-const PROJECTION_MANIFEST_FILENAMES = [".floom-cli-sync-manifest.json", ".floom-sync-manifest.json"];
-function emptyManifest() {
-    return { version: MANIFEST_VERSION, files: {} };
-}
-async function readPushManifest() {
-    try {
-        const handle = await open(PUSH_MANIFEST_PATH, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const parsed = JSON.parse(await handle.readFile("utf8"));
-            if (parsed.version !== MANIFEST_VERSION || !parsed.files || typeof parsed.files !== "object")
-                return emptyManifest();
-            return parsed;
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return emptyManifest();
-        if (err instanceof SyntaxError)
-            return emptyManifest();
-        throw err;
-    }
-}
-async function writePushManifest(manifest) {
-    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    const tmp = join(CONFIG_DIR, `.push-manifest.${process.pid}.${Date.now()}.tmp`);
-    const handle = await open(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    try {
-        await handle.writeFile(JSON.stringify(manifest, null, 2));
-    }
-    finally {
-        await handle.close();
-    }
-    await rename(tmp, PUSH_MANIFEST_PATH);
-}
-function hashPackage(skillPath, body, files) {
-    const hash = createHash("sha256");
-    hash.update(skillPath);
-    hash.update("\0");
-    hash.update(body);
-    for (const file of files) {
-        hash.update("\0");
-        hash.update(file.path);
-        hash.update("\0");
-        hash.update(file.sha256);
-    }
-    return hash.digest("hex");
-}
-async function findSkillPackages(root) {
-    const out = [];
-    async function walk(dir, depth) {
-        if (depth > MAX_SCAN_DEPTH)
-            return;
-        let entries;
-        try {
-            entries = await readdir(dir, { withFileTypes: true });
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                return;
-            throw err;
-        }
-        if (entries.some((entry) => entry.isFile() && entry.name === "SKILL.md")) {
-            out.push(dir);
-        }
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.name.startsWith(".") || SKIP_DIRS.has(entry.name))
-                continue;
-            if (entry.isSymbolicLink())
-                continue;
-            await walk(join(dir, entry.name), depth + 1);
-        }
-    }
-    await walk(root, 0);
-    return out.sort();
-}
-function safeRootRelative(root, path) {
-    const relativePath = relative(resolve(root), resolve(path));
-    if (relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
-        throw new FloomError("Invalid watched skill path.");
-    }
-    return relativePath.split(sep).join("/");
-}
-function slugFromSyncManifest(root, skillFilePath, syncManifest) {
-    const key = manifestKey(root, skillFilePath);
-    const entry = syncManifest.files[key];
-    return entry?.slug ?? null;
-}
-async function readProjectionManifest(root, target, syncManifest) {
-    const manifest = { version: 1, files: { ...syncManifest.files } };
-    const candidates = [
-        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(root, name)),
-        join(CONFIG_DIR, "native-sync-manifests", `${target}.json`),
-        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(CONFIG_DIR, "skill-cache", target, name)),
-    ];
-    const seen = new Set();
-    for (const candidate of candidates) {
-        const resolved = resolve(candidate);
-        if (seen.has(resolved))
-            continue;
-        seen.add(resolved);
-        const extra = await readSyncManifestFile(resolved);
-        Object.assign(manifest.files, extra.files);
-    }
-    return manifest;
-}
-async function readSyncManifestFile(path) {
-    try {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const parsed = JSON.parse(await handle.readFile("utf8"));
-            if (parsed.version !== 1 || !parsed.files || typeof parsed.files !== "object")
-                return { version: 1, files: {} };
-            const files = {};
-            for (const [key, entry] of Object.entries(parsed.files)) {
-                if (entry &&
-                    typeof entry === "object" &&
-                    typeof entry.hash === "string" &&
-                    typeof entry.slug === "string" &&
-                    typeof entry.target === "string" &&
-                    typeof entry.syncedAt === "string" &&
-                    entry.target === key &&
-                    SLUG_RE.test(entry.slug)) {
-                    files[key] = entry;
-                }
-            }
-            return { version: 1, files };
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return { version: 1, files: {} };
-        if (err instanceof SyntaxError)
-            return { version: 1, files: {} };
-        throw err;
-    }
-}
-function isFloomCacheRoot(root, target) {
-    const relativeRoot = relative(resolve(CONFIG_DIR, "skill-cache", target), resolve(root));
-    return relativeRoot === "" || (!relativeRoot.startsWith(`..${sep}`) && relativeRoot !== ".." && !isAbsolute(relativeRoot));
-}
-function isExplicitlyPublished(entry) {
-    return entry?.source === "published" || entry?.source === "updated";
-}
-function isBaselineAdopted(entry) {
-    return Boolean(entry) && !isExplicitlyPublished(entry);
-}
-function slugFromPushManifest(key, pushManifest) {
-    return pushManifest.files[key]?.slug ?? null;
-}
-function pushManifestKey(target, relativeSkillPath) {
-    return `${target}:${relativeSkillPath}`;
-}
-function baselineAdoptAll() {
-    return process.env.FLOOM_BASELINE_ADOPT_ALL === "1";
-}
-function isUnchangedSyncedPackage(root, skillPackage, syncManifest) {
-    const files = [
-        { target: skillPackage.skillPath, hash: createHash("sha256").update(skillPackage.skillBody).digest("hex") },
-        ...skillPackage.packageFiles.map((file) => ({
-            target: join(dirname(skillPackage.skillPath), ...file.path.split("/")),
-            hash: file.sha256,
-        })),
-    ];
-    return files.every((file) => syncManifest.files[manifestKey(root, file.target)]?.hash === file.hash);
-}
-function markPackageSynced(root, skillPackage, syncManifest, slug) {
-    markSynced(syncManifest, manifestKey(root, skillPackage.skillPath), slug, createHash("sha256").update(skillPackage.skillBody).digest("hex"));
-    for (const file of skillPackage.packageFiles) {
-        markSynced(syncManifest, manifestKey(root, join(dirname(skillPackage.skillPath), ...file.path.split("/"))), slug, file.sha256);
-    }
-}
-function fallbackSlugFromPath(packagePath) {
-    const slug = packagePath.split(/[\\/]/).filter(Boolean).at(-1);
-    return slug && SLUG_RE.test(slug) ? slug : null;
-}
-export async function pushWatchOnce(opts) {
-    const root = targetSkillsDir(opts.target);
-    const pushManifest = await readPushManifest();
-    const syncManifest = await readSyncManifest();
-    const projectionManifest = await readProjectionManifest(root, opts.target, syncManifest);
-    const cacheRoot = isFloomCacheRoot(root, opts.target);
-    const packages = await findSkillPackages(root);
-    const activePushKeys = new Set();
-    const activeSyncKeys = new Set();
-    let published = 0;
-    let updated = 0;
-    let adopted = 0;
-    let skipped = 0;
-    let syncManifestChanged = false;
-    for (const packagePath of packages) {
-        let skillPackage;
-        try {
-            skillPackage = await readSkillPackage(packagePath);
-        }
-        catch (err) {
-            skipped += 1;
-            if (!opts.quiet) {
-                process.stderr.write(`[floom] skipped ${packagePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-            }
-            continue;
-        }
-        const key = safeRootRelative(root, skillPackage.skillPath);
-        const pushKey = pushManifestKey(opts.target, key);
-        activeSyncKeys.add(manifestKey(root, skillPackage.skillPath));
-        for (const file of skillPackage.packageFiles) {
-            activeSyncKeys.add(manifestKey(root, join(dirname(skillPackage.skillPath), ...file.path.split("/"))));
-        }
-        const hash = hashPackage(key, skillPackage.skillBody, skillPackage.packageFiles);
-        const pushed = pushManifest.files[pushKey];
-        const projectionSlug = slugFromSyncManifest(root, skillPackage.skillPath, projectionManifest);
-        if (cacheRoot || (projectionSlug !== null && !isExplicitlyPublished(pushed))) {
-            skipped += 1;
-            continue;
-        }
-        activePushKeys.add(pushKey);
-        if (pushed?.hash === hash) {
-            if (baselineAdoptAll() && pushed.source !== "adopted") {
-                pushManifest.files[pushKey] = {
-                    hash,
-                    slug: pushed.slug,
-                    path: key,
-                    pushedAt: new Date().toISOString(),
-                    source: "adopted",
-                };
-                adopted += 1;
-                continue;
-            }
-            if (!isUnchangedSyncedPackage(root, skillPackage, syncManifest)) {
-                adopted += 1;
-                markPackageSynced(root, skillPackage, syncManifest, pushed.slug);
-                syncManifestChanged = true;
-                await writeSyncManifest(syncManifest);
-            }
-            else {
-                skipped += 1;
-            }
-            continue;
-        }
-        if (!opts.yolo) {
-            const syncedSlug = slugFromSyncManifest(root, skillPackage.skillPath, syncManifest);
-            const pushedSlug = slugFromPushManifest(pushKey, pushManifest);
-            const fallbackSlug = fallbackSlugFromPath(packagePath);
-            pushManifest.files[pushKey] = {
-                hash,
-                slug: pushedSlug ?? syncedSlug ?? fallbackSlug ?? key,
-                path: key,
-                pushedAt: new Date().toISOString(),
-                source: baselineAdoptAll() ? "adopted" : pushed?.source ?? "adopted",
-            };
-            adopted += 1;
-            continue;
-        }
-        const syncedSlug = slugFromSyncManifest(root, skillPackage.skillPath, syncManifest);
-        const pushedSlug = slugFromPushManifest(pushKey, pushManifest);
-        const fallbackSlug = fallbackSlugFromPath(packagePath);
-        const slug = pushedSlug ?? syncedSlug ?? fallbackSlug;
-        if (isBaselineAdopted(pushed) && !syncedSlug) {
-            pushManifest.files[pushKey] = {
-                hash,
-                slug: pushed.slug,
-                path: key,
-                pushedAt: new Date().toISOString(),
-                source: "adopted",
-            };
-            adopted += 1;
-            continue;
-        }
-        if (!pushed && syncedSlug && isUnchangedSyncedPackage(root, skillPackage, syncManifest)) {
-            pushManifest.files[pushKey] = {
-                hash,
-                slug: syncedSlug,
-                path: key,
-                pushedAt: new Date().toISOString(),
-            };
-            adopted += 1;
-            continue;
-        }
-        if (pushed || syncedSlug) {
-            if (!slug) {
-                skipped += 1;
-                continue;
-            }
-            try {
-                await publishSkillPath({ file: packagePath, update: true, updateSlug: slug, quiet: true });
-                updated += 1;
-                pushManifest.files[pushKey] = { hash, slug, path: key, pushedAt: new Date().toISOString(), source: "updated" };
-                markPackageSynced(root, skillPackage, syncManifest, slug);
-                syncManifestChanged = true;
-                await writeSyncManifest(syncManifest);
-            }
-            catch (err) {
-                if (err instanceof Error && /Skill not found/i.test(err.message)) {
-                    const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
-                    published += 1;
-                    pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
-                    markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
-                    syncManifestChanged = true;
-                    await writeSyncManifest(syncManifest);
-                    continue;
-                }
-                skipped += 1;
-                if (!opts.quiet) {
-                    process.stderr.write(`[floom] skipped ${packagePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-                }
-            }
-            continue;
-        }
-        try {
-            const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
-            published += 1;
-            pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
-            markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
-            syncManifestChanged = true;
-            await writeSyncManifest(syncManifest);
-        }
-        catch (err) {
-            skipped += 1;
-            if (!opts.quiet) {
-                process.stderr.write(`[floom] skipped ${packagePath}: ${err instanceof Error ? err.message : String(err)}\n`);
-            }
-        }
-    }
-    for (const key of Object.keys(pushManifest.files)) {
-        if (key.startsWith(`${opts.target}:`) && !activePushKeys.has(key))
-            delete pushManifest.files[key];
-    }
-    for (const key of Object.keys(syncManifest.files)) {
-        if (!activeSyncKeys.has(key)) {
-            unmarkSynced(syncManifest, key);
-            syncManifestChanged = true;
-        }
-    }
-    await writePushManifest(pushManifest);
-    if (syncManifestChanged)
-        await writeSyncManifest(syncManifest);
-    if (!opts.quiet && (published > 0 || updated > 0 || adopted > 0)) {
-        process.stdout.write(`${symbols.ok}  Floom push watch: ${packages.length} scanned, ${published} published, ${updated} updated, ${adopted} adopted\n`);
-    }
-    return { scanned: packages.length, published, updated, adopted, skipped };
-}
-export async function watchPush(intervalSeconds, opts) {
-    for (;;) {
-        await pushWatchOnce(opts);
-        if (opts.once)
-            return;
-        await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1000));
-        if (!opts.quiet)
-            process.stdout.write(c.dim("[floom] push watch tick\n"));
-    }
-}

package/dist/scan.js

@@ -1,24 +0,0 @@
-import { detectSkillSecurityFindings, formatSecurityFindings } from "./secrets.js";
-import { FloomError } from "./errors.js";
-import { c, symbols } from "./ui.js";
-import { readSkillPackage } from "./package.js";
-export async function scanSkill(inputPath) {
-    const skillPackage = await readSkillPackage(inputPath);
-    const failures = [
-        { path: "SKILL.md", body: skillPackage.skillBody },
-        ...skillPackage.packageFiles.map((file) => ({
-            path: file.path,
-            body: Buffer.from(file.content_base64, "base64").toString("utf8"),
-        })),
-    ].flatMap((file) => {
-        const findings = detectSkillSecurityFindings(file.body);
-        return findings.length > 0 ? [`${file.path}\n${formatSecurityFindings(findings)}`] : [];
-    });
-    if (failures.length > 0) {
-        throw new FloomError("Security scan failed.", `${failures.join("\n")}\nRemove secrets, prompt-injection text, or data-exfiltration instructions before publishing.`);
-    }
-    const fileCount = 1 + skillPackage.packageFiles.length;
-    process.stdout.write(`\n${symbols.ok}  Security scan passed for ${c.bold(inputPath)}\n`);
-    process.stdout.write(`   ${c.dim(`Checked ${fileCount} package file${fileCount === 1 ? "" : "s"}.`)}\n`);
-    process.stdout.write(`   ${c.dim("No high-confidence secrets, prompt-injection text, or exfiltration instructions found.")}\n\n`);
-}

package/dist/search.js

@@ -1,54 +0,0 @@
-import ora from "ora";
-import { readConfig, resolveApiUrl } from "./config.js";
-import { getJson } from "./lib/api.js";
-import { c, symbols } from "./ui.js";
-function formatSkillRow(skill) {
-    const title = skill.title ?? c.dim("(untitled)");
-    const type = c.dim(`[${skill.asset_type}]`);
-    const libs = skill.libraries.length
-        ? c.dim(` ${skill.libraries.map((lib) => `@${lib.slug}`).join(", ")}`)
-        : "";
-    return `   ${c.cyan(skill.slug.padEnd(22))}  ${title}  ${type}${libs}`;
-}
-function formatLibraryRow(library) {
-    const count = `${library.skill_count} ${library.skill_count === 1 ? "skill" : "skills"}`;
-    return `   ${c.cyan(`@${library.slug}`.padEnd(22))}  ${library.name}  ${c.dim(count)}`;
-}
-export async function search(opts) {
-    const cfg = await readConfig();
-    const apiUrl = resolveApiUrl(cfg);
-    const params = new URLSearchParams({ q: opts.query });
-    if (opts.library)
-        params.set("library", opts.library);
-    if (opts.type)
-        params.set("type", opts.type);
-    const spinner = opts.json ? null : ora({ text: c.dim("Searching Floom..."), color: "yellow" }).start();
-    let result;
-    try {
-        result = await getJson(`${apiUrl}/api/v1/search?${params.toString()}`, "search skills");
-    }
-    finally {
-        spinner?.stop();
-    }
-    if (opts.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-        return;
-    }
-    process.stdout.write(`\n${symbols.dot}  ${c.bold("Search results")} ${c.dim(`for "${result.query}"`)}\n\n`);
-    if (result.skills.length === 0 && result.libraries.length === 0) {
-        process.stdout.write(`   ${c.dim("No matching public skills or libraries.")}\n\n`);
-        return;
-    }
-    if (result.skills.length > 0) {
-        process.stdout.write(` ${c.dim("Skills")}\n`);
-        for (const skill of result.skills)
-            process.stdout.write(`${formatSkillRow(skill)}\n`);
-        process.stdout.write("\n");
-    }
-    if (result.libraries.length > 0) {
-        process.stdout.write(` ${c.dim("Libraries")}\n`);
-        for (const library of result.libraries)
-            process.stdout.write(`${formatLibraryRow(library)}\n`);
-        process.stdout.write("\n");
-    }
-}