@jarel/myskills 0.1.0-alpha.3 → 0.1.0-beta.2

package/README.md

@@ -2,6 +2,8 @@
 
 Command-line client for MySkills.
 
+Supported runtime: Node.js `>=22.13 <23 || >=24 <25`.
+
 Package:
 
 ```text
@@ -49,7 +51,8 @@ myskills config reset api-url
 myskills config list
 myskills submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]
 myskills review submissions [--api-url <url>] [--token <token>]
-myskills review action <submission-id> --action <approve|request-changes|reject|publish> [--reason <text>] [--api-url <url>] [--token <token>]
+myskills review bundle <submission-id> [--platform <name>] [--output <file>] [--api-url <url>] [--token <token>]
+myskills review action <submission-id> --action <approve|request-changes|reject|publish> [--artifact-sha256 <hash>] [--reason <text>] [--api-url <url>] [--token <token>]
 myskills submissions list [--api-url <url>] [--token <token>]
 myskills submissions withdraw <submission-id> [--reason <text>] [--api-url <url>] [--token <token>]
 myskills skills edit <skill-slug> [--title <text>] [--summary <text>] [--visibility <scope>] [--tag <tag>] [--reason <text>] [--api-url <url>] [--token <token>]
@@ -74,9 +77,9 @@ myskills token list
 myskills token revoke <token-id>
 ```
 
-## Public Alpha Install
+## Published And Candidate Channels
 
-The first public alpha package is distributed through npm under the `alpha` tag:
+The currently published package remains available under npm's `alpha` tag:
 
 ```bash
 npm install -g @jarel/myskills@alpha
@@ -90,13 +93,15 @@ Update the CLI with:
 npm install -g @jarel/myskills@alpha
 ```
 
+The `0.1.0-beta.2` source manifest is configured for the `beta` dist-tag, but package publication is a separate maintainer approval step. The release-verification workflow packs and installs the candidate without publishing it.
+
 `validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the API URL when one is not supplied; the default is the local API at `http://localhost:3001`, and custom hosted URLs can be entered manually. Successful login stores the selected API URL in local CLI config so later commands can omit `--api-url`. API URL resolution is `--api-url`, then `MYSKILLS_API_URL`, then saved config, then `http://localhost:3001`.
 
 `login` supports an email/password session flow and an API-key flow. The email/password flow handles MFA challenges with a TOTP or recovery code prompt and stores only the verified session token. The API-key flow validates the key with `/v1/me` before storing it. Token resolution is `--token`, then `MYSKILLS_TOKEN`, then the stored login token. The default token store uses the platform credential store through `@napi-rs/keyring` and falls back to `tokens.json` with user-only file permissions when keyring storage is unavailable or `MYSKILLS_TOKEN_STORE=file`/`MYSKILLS_TOKEN_FILE` is set. `auth status` validates the current token without printing it. `logout` revokes stored session tokens and clears the local entry; stored API tokens are removed locally and must be revoked with `token revoke`.
 
 `config get api-url`, `config set api-url <url>`, `config reset api-url`, and `config list` manage the saved API URL. `doctor` checks the CLI version, Node version, resolved API URL, `/health`, auth status, token-store backend, install-directory writability, and `/v1/capabilities`. If the CLI is pointed at the web app instead of the API, or a newer command is sent to an older server, command errors include concrete next steps and `--json` returns structured error codes.
 
-`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. Authors can inspect their submitted versions with `submissions list` and withdraw unreviewed or changes-requested submissions with `submissions withdraw`. Maintainers can approve, request changes, reject, and publish submitted versions through `review action`.
+`submit` validates and scans locally before sending package directories as normalized text entries or `.zip` packages as base64 archive uploads for server-side extraction. Authors can inspect their submitted versions with `submissions list` and withdraw unreviewed or changes-requested submissions with `submissions withdraw`. Maintainers can fetch the reviewed artifact and approval hash with `review bundle`, then approve, request changes, reject, and publish submitted versions through `review action`.
 
 Published artifacts remain immutable. `skills edit` changes mutable skill metadata only, while `releases deprecate`, `releases unpublish`, `releases revoke`, `releases restore`, and `releases delete` update server-owned lifecycle state for a specific version. Deprecated releases remain visible and installable; unpublished, revoked, archived, and deleted releases are hidden from install/export queries. `export` downloads server-authorized bundle content, verifies byte size and SHA-256 against release metadata, and writes normalized package paths under the requested output directory. `install` uses the same verified bundle path, writes into `--dir`, `MYSKILLS_INSTALL_DIR`, or the user data directory, and records local state in `.myskills-app/installed.json`; `update` preserves a rollback snapshot before replacing files, and `rollback` restores the most recent snapshot. `token create` prints the plaintext API token only once and does not overwrite the stored login session. Browser/device login, platform-specific install adapters, and archive creation are still planned.
 

package/dist/index.js

@@ -16321,7 +16321,7 @@ function decodePackageText(buffer, relativePath) {
 
 // src/cli.ts
 var DEFAULT_API_URL = "http://localhost:3001";
-var CLI_VERSION = "0.1.0-alpha.3";
+var CLI_VERSION = "0.1.0-beta.2";
 var CLI_VISIBILITY_SCOPES = ["public", "authenticated", "organization", "team", "private", "explicit-users"];
 var LOGIN_AUTH_METHODS = ["password", "api-key"];
 async function runCli(argv, runtime) {
@@ -16780,16 +16780,21 @@ async function reviewCommand(parsed, runtime) {
   if (subcommand === "action") {
     const submissionId = parsed.args[1];
     if (!submissionId) {
-      throw new CliError("Usage: myskills review action <submission-id> --action <approve|request-changes|reject|publish> [--reason <text>] [--api-url <url>] [--token <token>]", 2);
+      throw new CliError("Usage: myskills review action <submission-id> --action <approve|request-changes|reject|publish> [--artifact-sha256 <hash>] [--reason <text>] [--api-url <url>] [--token <token>]", 2);
     }
     const action = stringOption(parsed, "action");
     if (action !== "approve" && action !== "request-changes" && action !== "reject" && action !== "publish") {
       throw new CliError("--action must be approve, request-changes, reject, or publish.", 2);
     }
     const reason = optionalStringOption(parsed, "reason");
+    const artifactSha256 = optionalStringOption(parsed, "artifact-sha256")?.toLowerCase();
+    if (action === "approve" && !isArtifactSha256(artifactSha256)) {
+      throw new CliError("--artifact-sha256 is required when approving a submission and must be a 64-character SHA-256 hex digest.", 2);
+    }
     const response = await apiPost(`/v1/review/submissions/${encodeURIComponent(submissionId)}/actions`, {
       action,
-      ...reason ? { reason } : {}
+      ...reason ? { reason } : {},
+      ...action === "approve" ? { artifactSha256 } : {}
     }, parsed, runtime, token);
     if (parsed.options.json) {
       runtime.io.stdout(JSON.stringify(response, null, 2));
@@ -16799,7 +16804,35 @@ async function reviewCommand(parsed, runtime) {
     }
     return 0;
   }
-  throw new CliError("Usage: myskills review submissions | review action <submission-id> --action <approve|request-changes|reject|publish> [--reason <text>]", 2);
+  if (subcommand === "bundle") {
+    const submissionId = parsed.args[1];
+    if (!submissionId) {
+      throw new CliError("Usage: myskills review bundle <submission-id> [--platform <name>] [--output <file>] [--api-url <url>] [--token <token>]", 2);
+    }
+    const platform = optionalStringOption(parsed, "platform");
+    const query = platform ? `?platform=${encodeURIComponent(platform)}` : "";
+    const response = await apiGetWithHeaders(`/v1/review/submissions/${encodeURIComponent(submissionId)}/bundle${query}`, parsed, runtime, token);
+    const artifactSha256 = response.headers["x-myskills-artifact-sha256"] ?? "";
+    if (!isArtifactSha256(artifactSha256)) {
+      throw new CliError("Review bundle response is missing artifact hash.", 1);
+    }
+    const outputPath = optionalStringOption(parsed, "output");
+    if (outputPath) {
+      await mkdir(path2.dirname(path2.resolve(outputPath)), { recursive: true });
+      await writeFile(path2.resolve(outputPath), response.text, { encoding: "utf8", mode: 384 });
+    }
+    if (parsed.options.json) {
+      runtime.io.stdout(JSON.stringify({
+        artifactSha256,
+        ...outputPath ? { output: path2.resolve(outputPath) } : {},
+        payload: parseJsonResponse(`/v1/review/submissions/${submissionId}/bundle`, apiBaseUrl(parsed, runtime), response.text)
+      }, null, 2));
+    } else {
+      runtime.io.stdout(`artifactSha256=${artifactSha256}${outputPath ? `	output=${path2.resolve(outputPath)}` : ""}`);
+    }
+    return 0;
+  }
+  throw new CliError("Usage: myskills review submissions | review bundle <submission-id> | review action <submission-id> --action <approve|request-changes|reject|publish> [--artifact-sha256 <hash>] [--reason <text>]", 2);
 }
 async function submissionsCommand(parsed, runtime) {
   const token = await requireToken(parsed, runtime);
@@ -17733,6 +17766,21 @@ async function apiGet(pathname, parsed, runtime, token) {
   }
   return await apiJsonRequest(pathname, parsed, runtime, { headers });
 }
+async function apiGetWithHeaders(pathname, parsed, runtime, token) {
+  const headers = {};
+  if (token) {
+    headers.authorization = `Bearer ${token}`;
+  }
+  const response = await apiFetch(pathname, parsed, runtime, { headers });
+  if (!response.ok) {
+    const body = parseJsonResponse(pathname, apiBaseUrl(parsed, runtime), response.text);
+    throw apiErrorFromBody(pathname, apiBaseUrl(parsed, runtime), response.status, body, response.text);
+  }
+  return {
+    headers: response.headers,
+    text: response.text
+  };
+}
 async function apiGetText(pathname, parsed, runtime, token) {
   const headers = {};
   if (token) {
@@ -17802,11 +17850,21 @@ async function apiFetch(pathname, parsed, runtime, init) {
     ].join("\n"), 1, "API_UNREACHABLE");
   }
   return {
+    headers: responseHeaders(response.headers),
     ok: response.ok,
     status: response.status,
     text: await response.text()
   };
 }
+function responseHeaders(input) {
+  if (!input) {
+    return {};
+  }
+  if (input instanceof Headers) {
+    return Object.fromEntries([...input.entries()].map(([key, value]) => [key.toLowerCase(), value]));
+  }
+  return Object.fromEntries(Object.entries(input).map(([key, value]) => [key.toLowerCase(), value]));
+}
 function parseJsonResponse(pathname, baseUrl, text) {
   if (!text) {
     return {};
@@ -18191,6 +18249,9 @@ function optionalStringOption(parsed, key) {
   const value = parsed.options[key];
   return typeof value === "string" && value ? value : void 0;
 }
+function isArtifactSha256(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
 function stringListOption(parsed, key) {
   const value = parsed.options[key];
   if (typeof value === "string") {
@@ -18310,7 +18371,8 @@ function helpText() {
     "  config list",
     "  submit --path <file-directory-or-zip> [--api-url <url>] [--token <token>]",
     "  review submissions [--api-url <url>] [--token <token>]",
-    "  review action <submission-id> --action <approve|request-changes|reject|publish> [--reason <text>] [--api-url <url>] [--token <token>]",
+    "  review bundle <submission-id> [--platform <name>] [--output <file>] [--api-url <url>] [--token <token>]",
+    "  review action <submission-id> --action <approve|request-changes|reject|publish> [--artifact-sha256 <hash>] [--reason <text>] [--api-url <url>] [--token <token>]",
     "  submissions list [--api-url <url>] [--token <token>]",
     "  submissions withdraw <submission-id> [--reason <text>] [--api-url <url>] [--token <token>]",
     "  skills edit <skill-slug> [--title <text>] [--summary <text>] [--visibility <scope>] [--tag <tag>] [--reason <text>] [--api-url <url>] [--token <token>]",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jarel/myskills",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-beta.2",
   "description": "Command-line client for publishing, discovering, installing, updating, and rolling back MySkills packages.",
   "license": "Apache-2.0",
   "private": false,
@@ -13,7 +13,7 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22.13 <23 || >=24 <25"
   },
   "repository": {
     "type": "git",
@@ -33,7 +33,7 @@
   ],
   "publishConfig": {
     "access": "public",
-    "tag": "alpha",
+    "tag": "beta",
     "provenance": true
   },
   "scripts": {
@@ -41,7 +41,7 @@
     "test": "node ../../scripts/run-node-tests.mjs --import tsx --extensions .test.ts"
   },
   "devDependencies": {
-    "@myskills-app/skill-package": "0.1.0-alpha.0",
+    "@myskills-app/skill-package": "0.1.0-beta.2",
     "esbuild": "^0.28.1",
     "tsx": "^4.20.6"
   },