@mhd1999/morkit-cli 0.1.0

package/README.md

@@ -0,0 +1,85 @@
+# @mhd1999/morkit-cli
+
+Install the **morkit** kit — skills, commands and agents for Claude Code — into a
+project's `.claude/` directory.
+
+This package ships **no kit content**. It is a downloader: the kit lives in a private
+SkillHub instance and is fetched with your personal access token. That is what replaces
+the old `/plugin marketplace add mor-duongmh/morkit-plugin` flow, which required the
+plugin repository to be public.
+
+```bash
+npm i -g @mhd1999/morkit-cli
+
+morkit login --pat skh_…          # once per machine
+morkit init --dir my-project      # once per project
+```
+
+## Migrating from `/plugin marketplace add`
+
+| Before                                                | Now                              |
+| ----------------------------------------------------- | -------------------------------- |
+| `/plugin marketplace add mor-duongmh/morkit-plugin`   | `morkit login` + `morkit init`   |
+| `/plugin install morkit`                              | `morkit init --dir <project>`    |
+| new release lands automatically for everyone          | `morkit update` per project      |
+| content installed under `~/.claude/`                  | content installed under `<project>/.claude/` |
+
+The kit is now **per project**, not per machine. Commit `.claude/` and
+`.morkit-lock.json` with the project so everyone on the team gets the same version, and
+so a version bump shows up in a pull-request diff instead of changing silently.
+
+Ask the SkillHub owner for a personal access token with the `skills:read` scope.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `morkit login --pat skh_…` | Save credentials to `~/.morkit/config.json` (mode `0600`). |
+| `morkit list` | List the kits your token can read. |
+| `morkit init [--dir .] [--kit morkit]` | Install a kit into `<dir>/.claude/` and write `<dir>/.morkit-lock.json`. |
+| `morkit new --dir <d>` | Create an empty directory and install into it. Refuses a non-empty one. |
+| `morkit update [--force]` | Re-install the kit recorded in the lockfile, keeping files you edited. |
+
+Common flags: `--api-url <url>` and `--pat <token>` work on every command that talks to
+the server and override the saved configuration. The default server is
+`https://skillhub.rainbow-banfish.ts.net`.
+
+## Where files land
+
+```
+my-project/
+  .claude/
+    skills/…          ← kit skills/,   loaded by Claude Code
+    commands/…        ← kit commands/
+    agents/…          ← kit agents/
+    plugins/morkit/…  ← everything else (manifest, hooks, lib, scripts)
+  .morkit-lock.json   ← what was installed — commit this
+```
+
+`.morkit-lock.json` records the API URL, kit slug, version, install timestamp, a
+`sha256` per artifact and one combined hash for the rest. **It never contains a token.**
+
+## Updating, and what happens to your edits
+
+`morkit update` compares each file on disk against the lockfile:
+
+- untouched since install → replaced with the new version;
+- **edited locally → left alone**, and the CLI prints the file name;
+- `--force` → overwritten with the server's copy.
+
+Files under `.claude/plugins/<kit>/` are the kit's machinery (manifest, hooks, helper
+scripts). They are replaced as a unit whenever the server's shell hash changes, so treat
+that directory as managed and keep your own changes in `.claude/skills|commands|agents`.
+
+## Credentials
+
+The token is stored **only** in `~/.morkit/config.json` with mode `0600` — never inside
+a project directory, never in the lockfile. Delete that file to log out.
+
+## Requirements
+
+Node.js ≥ 18.
+
+## Licence
+
+Apache-2.0

package/dist/commands/commands.js

@@ -0,0 +1,66 @@
+import fs from "node:fs";
+import path from "node:path";
+import { listKits } from "../lib/api.js";
+import { DEFAULT_API_URL, normaliseApiUrl, readConfig, resolveAuth, writeConfig, } from "../lib/config.js";
+import { readLock } from "../lib/lock.js";
+import { DEFAULT_KIT, installKit, reportInstall, } from "./install.js";
+/** Store the PAT in ~/.morkit/config.json (0600). Never inside a project. */
+export async function login(opts) {
+    if (!opts.pat) {
+        throw new Error("Missing --pat. Create a token with the 'skills:read' scope in SkillHub.");
+    }
+    const apiUrl = normaliseApiUrl(opts.apiUrl ?? readConfig()?.apiUrl ?? DEFAULT_API_URL);
+    // Fail fast on a bad token. A server without the listing endpoint answers 404,
+    // which says nothing about the token — accept it and let `init` be the check.
+    try {
+        await listKits(apiUrl, opts.pat);
+        process.stdout.write(`✓ Token accepted by ${apiUrl}\n`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/\(401\)|\(403\)/.test(msg))
+            throw err;
+        process.stderr.write(`! Could not verify the token (${msg})\n`);
+    }
+    const file = writeConfig({ apiUrl, pat: opts.pat });
+    process.stdout.write(`✓ Saved credentials to ${file} (mode 0600)\n`);
+}
+export async function list(opts) {
+    const auth = resolveAuth({ apiUrl: opts.apiUrl, pat: opts.pat });
+    const kits = await listKits(auth.apiUrl, auth.pat);
+    if (kits.length === 0) {
+        process.stdout.write(`No kits available on ${auth.apiUrl}.\n`);
+        return;
+    }
+    for (const kit of kits) {
+        const version = kit.version ? `  ${kit.version}` : "";
+        const desc = kit.description ? `  — ${kit.description}` : "";
+        process.stdout.write(`  ${kit.slug}${version}${desc}\n`);
+    }
+}
+export async function init(opts) {
+    const dir = path.resolve(opts.dir);
+    fs.mkdirSync(dir, { recursive: true });
+    const res = await installKit({ ...opts, dir });
+    reportInstall(res, dir, opts.force ?? false);
+}
+/** Like `init`, but refuses to install into a directory that already has content. */
+export async function newProject(opts) {
+    const dir = path.resolve(opts.dir);
+    if (fs.existsSync(dir) && fs.readdirSync(dir).length > 0) {
+        throw new Error(`${dir} is not empty — use 'morkit init --dir ${opts.dir}' instead.`);
+    }
+    fs.mkdirSync(dir, { recursive: true });
+    const res = await installKit({ ...opts, dir });
+    reportInstall(res, dir, opts.force ?? false);
+}
+export async function update(opts) {
+    const dir = path.resolve(opts.dir);
+    const lock = readLock(dir);
+    if (!lock) {
+        throw new Error(`No .morkit-lock.json in ${dir} — run 'morkit init --dir ${opts.dir}' first.`);
+    }
+    const res = await installKit({ ...opts, dir, kit: opts.kit ?? lock.kit ?? DEFAULT_KIT });
+    reportInstall(res, dir, opts.force ?? false);
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/commands/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,UAAU,EACV,aAAa,GAEd,MAAM,cAAc,CAAC;AAOtB,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAkB;IAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IAEvF,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,IAAI,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAoB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,0CAA0C,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACxF,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAoB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,6BAA6B,IAAI,CAAC,GAAG,UAAU,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;IACzF,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/commands/install.js

@@ -0,0 +1,107 @@
+import path from "node:path";
+import { fetchKitArchive, fetchKitMeta } from "../lib/api.js";
+import { resolveAuth } from "../lib/config.js";
+import { applyPlan, computePlan, ensureClaudeLayout } from "../lib/install.js";
+import { isoUtc, lockMatches, readLock, sha256, writeLock } from "../lib/lock.js";
+import { isArtifactPath } from "../lib/paths.js";
+import { extractTarGz } from "../lib/tar.js";
+export const DEFAULT_KIT = "morkit";
+/**
+ * Shared body of `init` and `update`.
+ *
+ * Always fetches metadata + archive and diffs against disk rather than
+ * short-circuiting on the version number, so a locally modified file is
+ * reported even when the server version has not moved.
+ */
+export async function installKit(opts) {
+    const dir = path.resolve(opts.dir);
+    const existing = readLock(dir);
+    const kit = opts.kit ?? existing?.kit ?? DEFAULT_KIT;
+    const auth = resolveAuth({
+        apiUrl: opts.apiUrl,
+        pat: opts.pat,
+        lockApiUrl: existing?.apiUrl || undefined,
+    });
+    const meta = await fetchKitMeta(auth.apiUrl, auth.pat, kit);
+    const archive = await fetchKitArchive(auth.apiUrl, auth.pat, kit);
+    const { files, executable } = extractTarGz(archive);
+    if (files.size === 0) {
+        throw new Error(`Kit '${kit}' archive from ${auth.apiUrl} is empty.`);
+    }
+    // The lock records what is actually on disk, so hashes come from the bytes we
+    // write. Cross-check them against the server's metadata as an integrity
+    // signal, but do not fail the install on a hashing-convention mismatch.
+    const mismatched = Object.entries(meta.artifacts).filter(([rel, hash]) => {
+        const content = files.get(rel);
+        return content !== undefined && sha256(content) !== hash;
+    });
+    // Lock is authoritative for the previous install only when it describes this kit.
+    const lock = existing && existing.kit === kit ? existing : null;
+    const plan = computePlan({
+        files,
+        kit,
+        dir,
+        lock,
+        remoteShell: meta.shell,
+        force: opts.force ?? false,
+    });
+    // `artifacts` holds skills/ commands/ agents/ only — the rest of the kit is
+    // covered by the single `shell` hash (design.md, "Định dạng .morkit-lock.json").
+    const artifacts = {};
+    for (const entry of [...plan.write, ...plan.unchanged]) {
+        if (isArtifactPath(entry.rel))
+            artifacts[entry.rel] = entry.remoteHash;
+    }
+    for (const entry of plan.keep) {
+        if (!isArtifactPath(entry.rel))
+            continue;
+        // Kept a local edit: remember the hash we last installed so the file stays
+        // recognisable as modified next time. Fall back to the remote hash when
+        // there is no prior record, so every artifact has an entry.
+        artifacts[entry.rel] = lock?.artifacts[entry.rel] ?? entry.remoteHash;
+    }
+    const next = {
+        apiUrl: auth.apiUrl,
+        kit,
+        version: meta.version,
+        artifacts,
+        shell: meta.shell,
+    };
+    const upToDate = plan.write.length === 0 && lockMatches(existing, next);
+    if (!upToDate) {
+        ensureClaudeLayout(dir);
+        applyPlan(plan, files, executable);
+        writeLock(dir, { ...next, installedAt: isoUtc() });
+    }
+    if (mismatched.length > 0) {
+        process.stderr.write(`! ${mismatched.length} file(s) hash differently than ${auth.apiUrl} reported; ` +
+            "installed the archive contents as received.\n");
+    }
+    return {
+        kit,
+        version: meta.version,
+        written: plan.write.map((e) => e.rel),
+        kept: plan.keep.map((e) => e.rel),
+        unchanged: plan.unchanged.length,
+        upToDate,
+    };
+}
+/** Human-readable summary shared by `init`, `new` and `update`. */
+export function reportInstall(res, dir, force) {
+    if (res.upToDate) {
+        process.stdout.write(`✓ ${dir} is already up to date (${res.kit} ${res.version}).\n`);
+        return;
+    }
+    for (const rel of res.written)
+        process.stdout.write(`  + ${rel}\n`);
+    if (res.kept.length > 0) {
+        process.stderr.write(`\n! Kept ${res.kept.length} locally modified file(s) — not overwritten:\n`);
+        for (const rel of res.kept)
+            process.stderr.write(`    ~ ${rel}\n`);
+        if (!force)
+            process.stderr.write("  Re-run with --force to overwrite them.\n");
+    }
+    process.stdout.write(`\n✓ ${res.kit} ${res.version} → ${dir}` +
+        ` (${res.written.length} written, ${res.kept.length} kept, ${res.unchanged} unchanged)\n`);
+}
+//# sourceMappingURL=install.js.map

package/dist/commands/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAiB,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAmBpC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,kBAAkB,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC;IACxE,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,KAAK;QACL,GAAG;QACH,GAAG;QACH,IAAI;QACJ,WAAW,EAAE,IAAI,CAAC,KAAK;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;KAC3B,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAkC;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACnC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,UAAU,CAAC,MAAM,kCAAkC,IAAI,CAAC,MAAM,aAAa;YAC9E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACrC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;QAChC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW,EAAE,KAAc;IAC3E,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,gDAAgD,CAC5E,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,EAAE;QACtC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,eAAe,CAC5F,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { DEFAULT_API_URL } from "./lib/config.js";
+import { init, list, login, newProject, update } from "./commands/commands.js";
+import { DEFAULT_KIT } from "./commands/install.js";
+const program = new Command();
+program
+    .name("morkit")
+    .description("Install the morkit kit into a project's .claude/ directory from SkillHub. " +
+    "Ships no kit content — everything is downloaded with your personal access token.")
+    .version("0.1.0");
+program
+    .command("login")
+    .description("Save a personal access token to ~/.morkit/config.json (mode 0600)")
+    .requiredOption("--pat <token>", "personal access token skh_… with the skills:read scope")
+    .option("--api-url <url>", `SkillHub API base URL (default ${DEFAULT_API_URL})`)
+    .action((opts) => login(opts));
+program
+    .command("list")
+    .description("List the kits your token can read")
+    .option("--api-url <url>", "SkillHub API base URL")
+    .option("--pat <token>", "personal access token (overrides ~/.morkit/config.json)")
+    .action((opts) => list(opts));
+program
+    .command("init")
+    .description("Install a kit into <dir>/.claude/ and write <dir>/.morkit-lock.json")
+    .option("--dir <path>", "project directory", ".")
+    .option("--kit <slug>", "kit slug", DEFAULT_KIT)
+    .option("--api-url <url>", "SkillHub API base URL")
+    .option("--pat <token>", "personal access token (overrides ~/.morkit/config.json)")
+    .action((opts) => init(opts));
+program
+    .command("new")
+    .description("Create an empty project directory and install a kit into it")
+    .requiredOption("--dir <path>", "directory to create")
+    .option("--kit <slug>", "kit slug", DEFAULT_KIT)
+    .option("--api-url <url>", "SkillHub API base URL")
+    .option("--pat <token>", "personal access token (overrides ~/.morkit/config.json)")
+    .action((opts) => newProject(opts));
+program
+    .command("update")
+    .description("Update an installed kit, keeping files you edited locally")
+    .option("--dir <path>", "project directory", ".")
+    .option("--kit <slug>", "kit slug (default: the one in .morkit-lock.json)")
+    .option("--api-url <url>", "SkillHub API base URL")
+    .option("--pat <token>", "personal access token (overrides ~/.morkit/config.json)")
+    .option("--force", "overwrite locally modified files", false)
+    .action((opts) => update(opts));
+try {
+    await program.parseAsync(process.argv);
+}
+catch (err) {
+    process.stderr.write(`\n✗ ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CACV,4EAA4E;IAC1E,kFAAkF,CACrF;KACA,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,mEAAmE,CAAC;KAChF,cAAc,CAAC,eAAe,EAAE,wDAAwD,CAAC;KACzF,MAAM,CAAC,iBAAiB,EAAE,kCAAkC,eAAe,GAAG,CAAC;KAC/E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAEjC,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,eAAe,EAAE,yDAAyD,CAAC;KAClF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEhC,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qEAAqE,CAAC;KAClF,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,eAAe,EAAE,yDAAyD,CAAC;KAClF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEhC,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,6DAA6D,CAAC;KAC1E,cAAc,CAAC,cAAc,EAAE,qBAAqB,CAAC;KACrD,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,eAAe,EAAE,yDAAyD,CAAC;KAClF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtC,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,kDAAkD,CAAC;KAC1E,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,eAAe,EAAE,yDAAyD,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,kCAAkC,EAAE,KAAK,CAAC;KAC5D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAElC,IAAI,CAAC;IACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/lib/api.js

@@ -0,0 +1,93 @@
+/**
+ * SkillHub kit endpoints. Contract (agreed with the API side):
+ *
+ *   GET /api/kits/{slug}          X-PAT → { version, artifacts: {path: "sha256:…"}, shell: "sha256:…" }
+ *   GET /api/kits/{slug}/archive  X-PAT → tar.gz with the whole kit at the archive root
+ *   GET /api/kits                 X-PAT → kit listing (see listKits — best effort)
+ *
+ *   401 invalid/revoked PAT · 403 missing `skills:read` scope · 404 unknown slug
+ */
+/** Auth header for every kit call. PAT-only: kit endpoints do not take MCP tokens. */
+export function patHeaders(pat) {
+    if (!pat)
+        throw new Error("No PAT — run 'morkit login' or pass --pat skh_…");
+    return { "X-PAT": pat };
+}
+function httpError(status, base, slug, body) {
+    if (status === 401) {
+        return new Error(`${base} rejected the token (401) — it is invalid or has been revoked. Run 'morkit login' again.`);
+    }
+    if (status === 403) {
+        return new Error(`${base} refused the request (403) — the token is missing the 'skills:read' scope.`);
+    }
+    if (status === 404) {
+        return new Error(`Kit '${slug}' does not exist on ${base} (404).`);
+    }
+    return new Error(`${base} returned ${status}: ${body.slice(0, 400)}`);
+}
+async function request(url, pat, base, slug) {
+    let res;
+    try {
+        res = await fetch(url, { headers: patHeaders(pat) });
+    }
+    catch (err) {
+        throw new Error(`Cannot reach SkillHub at ${base} — check the URL or your network (${String(err)})`);
+    }
+    if (!res.ok)
+        throw httpError(res.status, base, slug, await res.text().catch(() => ""));
+    return res;
+}
+export async function fetchKitMeta(base, pat, slug) {
+    const res = await request(`${base}/api/kits/${encodeURIComponent(slug)}`, pat, base, slug);
+    const data = (await res.json());
+    if (typeof data.version !== "string" || typeof data.artifacts !== "object" || !data.artifacts) {
+        throw new Error(`Malformed response from ${base}/api/kits/${slug}: missing version/artifacts`);
+    }
+    return {
+        version: data.version,
+        artifacts: data.artifacts,
+        shell: typeof data.shell === "string" ? data.shell : "",
+    };
+}
+export async function fetchKitArchive(base, pat, slug) {
+    const res = await request(`${base}/api/kits/${encodeURIComponent(slug)}/archive`, pat, base, slug);
+    return Buffer.from(await res.arrayBuffer());
+}
+/**
+ * List kits visible to the token.
+ *
+ * ASSUMPTION: `GET /api/kits` returns either a bare array or `{ kits: [...] }`.
+ * The frozen contract only covers `/api/kits/{slug}`; both shapes are accepted
+ * and a 404 is reported as "listing not available" rather than crashing.
+ */
+export async function listKits(base, pat) {
+    let res;
+    try {
+        res = await fetch(`${base}/api/kits`, { headers: patHeaders(pat) });
+    }
+    catch (err) {
+        throw new Error(`Cannot reach SkillHub at ${base} (${String(err)})`);
+    }
+    if (res.status === 404) {
+        throw new Error(`${base} has no kit listing endpoint (404). Use 'morkit init --kit <slug>' with a known slug.`);
+    }
+    if (!res.ok)
+        throw httpError(res.status, base, "", await res.text().catch(() => ""));
+    const data = (await res.json());
+    const rows = Array.isArray(data)
+        ? data
+        : Array.isArray(data.kits)
+            ? data.kits
+            : null;
+    if (!rows)
+        throw new Error(`Malformed response from ${base}/api/kits: expected an array`);
+    return rows.map((r) => {
+        const o = r;
+        return {
+            slug: String(o.slug ?? o.name ?? ""),
+            version: typeof o.version === "string" ? o.version : undefined,
+            description: typeof o.description === "string" ? o.description : undefined,
+        };
+    });
+}
+//# sourceMappingURL=api.js.map

package/dist/lib/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgBH,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IACzE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CACd,GAAG,IAAI,0FAA0F,CAClG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CACd,GAAG,IAAI,4EAA4E,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,uBAAuB,IAAI,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,IAAY;IACzE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,qCAAqC,MAAM,CAAC,GAAG,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,aAAa,IAAI,6BAA6B,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAmC;QACnD,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,GAAG,IAAI,aAAa,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACtD,GAAG,EACH,IAAI,EACJ,IAAI,CACL,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IACtD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uFAAuF,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,IAA2B,CAAC,IAAI,CAAC;YAChD,CAAC,CAAG,IAA4B,CAAC,IAAkB;YACnD,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,8BAA8B,CAAC,CAAC;IAE1F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC9D,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/config.js

@@ -0,0 +1,57 @@
+import fs from "node:fs";
+import path from "node:path";
+import { configDir, configFile } from "./paths.js";
+/** SkillHub instance the CLI talks to when nothing overrides it. */
+export const DEFAULT_API_URL = "https://skillhub.rainbow-banfish.ts.net";
+export class NotLoggedInError extends Error {
+    constructor() {
+        super(`Not logged in — ${configFile()} is missing.\n` +
+            "Run:  morkit login --pat skh_…\n" +
+            "or pass the token once with:  --pat skh_…");
+        this.name = "NotLoggedInError";
+    }
+}
+export function normaliseApiUrl(url) {
+    return url.replace(/\/+$/, "");
+}
+export function readConfig() {
+    const file = configFile();
+    if (!fs.existsSync(file))
+        return null;
+    const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!raw.pat)
+        return null;
+    return {
+        apiUrl: normaliseApiUrl(raw.apiUrl ?? DEFAULT_API_URL),
+        pat: raw.pat,
+    };
+}
+/**
+ * Write credentials with mode 0600. `mkdirSync` cannot tighten an existing
+ * directory and `writeFileSync`'s mode is masked by umask on create and ignored
+ * on overwrite, so chmod explicitly afterwards.
+ */
+export function writeConfig(cfg) {
+    const dir = configDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = path.join(dir, "config.json");
+    fs.writeFileSync(file, `${JSON.stringify(cfg, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+    return file;
+}
+/**
+ * Resolve credentials. Precedence, most explicit first:
+ *   --pat / --api-url  >  ~/.morkit/config.json  >  project lockfile  >  DEFAULT_API_URL
+ *
+ * Throws NotLoggedInError when no PAT can be found, so callers exit non-zero
+ * with the `morkit login` hint.
+ */
+export function resolveAuth(o = {}) {
+    const cfg = readConfig();
+    const pat = o.pat ?? cfg?.pat;
+    if (!pat)
+        throw new NotLoggedInError();
+    const apiUrl = o.apiUrl ?? cfg?.apiUrl ?? o.lockApiUrl ?? DEFAULT_API_URL;
+    return { apiUrl: normaliseApiUrl(apiUrl), pat };
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnD,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AASzE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CACH,mBAAmB,UAAU,EAAE,gBAAgB;YAC7C,kCAAkC;YAClC,2CAA2C,CAC9C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC;QACtD,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB,EAAE;IAC/C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,eAAe,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/dist/lib/install.js

@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import path from "node:path";
+import { sha256 } from "./lock.js";
+import { CLAUDE_SUBDIRS, destPathFor, isArtifactPath } from "./paths.js";
+const defaultRead = (p) => (fs.existsSync(p) ? fs.readFileSync(p) : null);
+/**
+ * Decide, per file, whether to write / keep / skip. Pure: all disk access goes
+ * through `readFile`, so the whole policy is unit-testable without a project.
+ *
+ * Artifacts (skills/ commands/ agents/) carry a per-file hash in the lockfile,
+ * so "the user edited it" is detectable exactly: disk ≠ lock ⇒ keep + warn.
+ *
+ * Shell files only have one combined hash in the lockfile (design.md), so the
+ * rule is coarser: while the server's shell hash is unchanged, any difference on
+ * disk must be a local edit ⇒ keep + warn. Once the server's shell hash moves,
+ * the shell is replaced as a unit — it is machinery (hooks, lib, scripts,
+ * manifest) that morkit owns, not user-editable content.
+ */
+export function computePlan(input) {
+    const readFile = input.readFile ?? defaultRead;
+    const plan = { write: [], keep: [], unchanged: [] };
+    const shellUnchanged = input.lock !== null && input.lock.shell === input.remoteShell;
+    for (const rel of [...input.files.keys()].sort()) {
+        const content = input.files.get(rel);
+        const dest = destPathFor(input.dir, input.kit, rel);
+        const remoteHash = sha256(content);
+        const existing = readFile(dest);
+        const entry = { rel, dest, remoteHash };
+        if (existing === null) {
+            plan.write.push({ ...entry, decision: "write" });
+            continue;
+        }
+        const diskHash = sha256(existing);
+        if (diskHash === remoteHash) {
+            plan.unchanged.push({ ...entry, decision: "unchanged" });
+            continue;
+        }
+        if (input.force) {
+            plan.write.push({ ...entry, decision: "write" });
+            continue;
+        }
+        if (isArtifactPath(rel)) {
+            const lockHash = input.lock?.artifacts[rel];
+            // Matches what we installed ⇒ untouched locally ⇒ safe to update.
+            if (lockHash && diskHash === lockHash)
+                plan.write.push({ ...entry, decision: "write" });
+            else
+                plan.keep.push({ ...entry, decision: "keep" });
+        }
+        else {
+            if (shellUnchanged)
+                plan.keep.push({ ...entry, decision: "keep" });
+            else
+                plan.write.push({ ...entry, decision: "write" });
+        }
+    }
+    return plan;
+}
+/** Write via temp-then-rename so a crash never leaves a half-written file. */
+export function applyPlan(plan, files, executable = new Set()) {
+    for (const entry of plan.write) {
+        const content = files.get(entry.rel);
+        if (!content)
+            continue;
+        fs.mkdirSync(path.dirname(entry.dest), { recursive: true });
+        const tmp = `${entry.dest}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, content);
+        fs.renameSync(tmp, entry.dest);
+        if (executable.has(entry.rel))
+            fs.chmodSync(entry.dest, 0o755);
+    }
+}
+/** Create `.claude/{skills,commands,agents,plugins}` even when the kit has none. */
+export function ensureClaudeLayout(dir) {
+    for (const sub of CLAUDE_SUBDIRS) {
+        fs.mkdirSync(path.join(dir, ".claude", sub), { recursive: true });
+    }
+}
+//# sourceMappingURL=install.js.map

package/dist/lib/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/lib/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAiB,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiCzE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEjG;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC/C,MAAM,IAAI,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,CAAC;IAErF,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAExC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QAED,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5C,kEAAkE;YAClE,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;;gBACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,IAAI,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;;gBAC9D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CACvB,IAAU,EACV,KAA0B,EAC1B,aAA0B,IAAI,GAAG,EAAE;IAEnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/lib/lock.js

@@ -0,0 +1,55 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { lockPath } from "./paths.js";
+export function sha256(data) {
+    return `sha256:${crypto.createHash("sha256").update(data).digest("hex")}`;
+}
+/** ISO 8601 UTC without milliseconds, e.g. 2026-08-11T09:00:00Z. */
+export function isoUtc(d = new Date()) {
+    return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+export function readLock(dir) {
+    const file = lockPath(dir);
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!raw.kit || !raw.version)
+            return null;
+        return {
+            apiUrl: raw.apiUrl ?? "",
+            kit: raw.kit,
+            version: raw.version,
+            installedAt: raw.installedAt ?? "",
+            artifacts: raw.artifacts ?? {},
+            shell: raw.shell ?? "",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeLock(dir, lock) {
+    const ordered = {
+        apiUrl: lock.apiUrl,
+        kit: lock.kit,
+        version: lock.version,
+        installedAt: lock.installedAt,
+        // Sorted so a re-install produces a byte-identical file and PR diffs stay readable.
+        artifacts: Object.fromEntries(Object.entries(lock.artifacts).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))),
+        shell: lock.shell,
+    };
+    fs.writeFileSync(lockPath(dir), `${JSON.stringify(ordered, null, 2)}\n`);
+}
+/** True when the lock already describes exactly this install. */
+export function lockMatches(lock, next) {
+    if (!lock)
+        return false;
+    return (lock.apiUrl === next.apiUrl &&
+        lock.kit === next.kit &&
+        lock.version === next.version &&
+        lock.shell === next.shell &&
+        JSON.stringify(Object.entries(lock.artifacts).sort()) ===
+            JSON.stringify(Object.entries(next.artifacts).sort()));
+}
+//# sourceMappingURL=lock.js.map

package/dist/lib/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/lib/lock.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAsBtC,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,MAAM,CAAC,IAAU,IAAI,IAAI,EAAE;IACzC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,IAAc;IACnD,MAAM,OAAO,GAAa;QACxB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oFAAoF;QACpF,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChF;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB,EAAE,IAAmC;IACpF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC3B,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;QACrB,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC7B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CACxD,CAAC;AACJ,CAAC"}

package/dist/lib/paths.js

@@ -0,0 +1,46 @@
+import os from "node:os";
+import path from "node:path";
+/**
+ * Two separate homes, on purpose:
+ *
+ *   ~/.morkit/config.json     credentials (PAT). NEVER inside a project.
+ *   <project>/.claude/        kit content, committed with the project.
+ *   <project>/.morkit-lock.json   what was installed, committed with the project.
+ *
+ * Resolved lazily (not module-level constants) so tests can point HOME at a
+ * temp directory without re-importing the module.
+ */
+export const LOCK_NAME = ".morkit-lock.json";
+/** Kit sub-trees that map straight into `.claude/` (Claude Code reads them there). */
+export const ARTIFACT_ROOTS = ["skills", "commands", "agents"];
+/** Directories `morkit init` always creates, even when the kit has none of them. */
+export const CLAUDE_SUBDIRS = ["skills", "commands", "agents", "plugins"];
+export function configDir() {
+    return path.join(os.homedir(), ".morkit");
+}
+export function configFile() {
+    return path.join(configDir(), "config.json");
+}
+export function lockPath(dir) {
+    return path.join(dir, LOCK_NAME);
+}
+/** True for kit paths that Claude Code loads directly (skills/, commands/, agents/). */
+export function isArtifactPath(rel) {
+    const top = rel.split("/")[0];
+    return ARTIFACT_ROOTS.includes(top);
+}
+/**
+ * Where a kit-relative path lands inside the project.
+ *
+ *   skills/x/SKILL.md          → <dir>/.claude/skills/x/SKILL.md
+ *   .claude-plugin/plugin.json → <dir>/.claude/plugins/<kit>/.claude-plugin/plugin.json
+ *
+ * Everything that is not an artifact is "shell" (hooks, lib, scripts, manifest)
+ * and is kept together under one plugin directory so it stays removable.
+ */
+export function destPathFor(dir, kit, rel) {
+    return isArtifactPath(rel)
+        ? path.join(dir, ".claude", rel)
+        : path.join(dir, ".claude", "plugins", kit, rel);
+}
+//# sourceMappingURL=paths.js.map

package/dist/lib/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/lib/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAE7C,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAExE,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEnF,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IAC/D,OAAO,cAAc,CAAC,GAAG,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/tar.js

@@ -0,0 +1,113 @@
+import zlib from "node:zlib";
+/**
+ * Minimal read-only tar.gz extractor.
+ *
+ * Deliberately dependency-free: this package is published as an empty
+ * downloader, so every runtime dependency is one more thing a user installs
+ * globally just to fetch a kit. Node ships gzip; tar's header format is 512-byte
+ * blocks and needs ~100 lines to read.
+ *
+ * Supports: regular files, directories, GNU long names ('L'), pax extended
+ * headers ('x'). Anything else (symlinks, devices) is skipped — a kit is plain
+ * files, and silently ignoring links is safer than following them.
+ */
+const BLOCK = 512;
+function readString(block, offset, length) {
+    const end = block.indexOf(0, offset);
+    const stop = end === -1 || end > offset + length ? offset + length : end;
+    return block.toString("utf8", offset, stop);
+}
+function readOctal(block, offset, length) {
+    const raw = block.toString("ascii", offset, offset + length).replace(/[\0 ]+$/, "").trim();
+    if (raw === "")
+        return 0;
+    const n = parseInt(raw, 8);
+    return Number.isNaN(n) ? 0 : n;
+}
+function isZeroBlock(block) {
+    for (const byte of block)
+        if (byte !== 0)
+            return false;
+    return true;
+}
+/** Reject absolute paths and any `..` segment before a single byte is written. */
+export function assertSafePath(name) {
+    if (name.startsWith("/") || /^[A-Za-z]:[\\/]/.test(name)) {
+        throw new Error(`Archive contains an absolute path: ${name}`);
+    }
+    if (name.split(/[/\\]/).includes("..")) {
+        throw new Error(`Archive contains a path traversal entry: ${name}`);
+    }
+}
+function normalise(name) {
+    return name.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+/** Pull `path=` out of a pax extended header record block. */
+function paxPath(data) {
+    const text = data.toString("utf8");
+    const m = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(text);
+    return m ? m[1] : null;
+}
+export function extractTarGz(gz) {
+    return extractTar(zlib.gunzipSync(gz));
+}
+export function extractTar(tar) {
+    const files = new Map();
+    const executable = new Set();
+    let offset = 0;
+    let pendingName = null;
+    while (offset + BLOCK <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        offset += BLOCK;
+        if (isZeroBlock(header))
+            break;
+        const size = readOctal(header, 124, 12);
+        const dataBlocks = Math.ceil(size / BLOCK) * BLOCK;
+        const data = tar.subarray(offset, offset + size);
+        offset += dataBlocks;
+        const type = String.fromCharCode(header[156]) || "0";
+        if (type === "L") {
+            pendingName = normalise(data.toString("utf8").replace(/\0+$/, ""));
+            continue;
+        }
+        if (type === "x" || type === "X") {
+            const p = paxPath(data);
+            if (p)
+                pendingName = normalise(p);
+            continue;
+        }
+        if (type === "g")
+            continue; // global pax header — nothing we need
+        const prefix = readString(header, 345, 155);
+        const rawName = readString(header, 0, 100);
+        const name = pendingName ?? normalise(prefix ? `${prefix}/${rawName}` : rawName);
+        pendingName = null;
+        if (name === "")
+            continue;
+        assertSafePath(name);
+        if (type === "5")
+            continue; // directory — created implicitly when writing files
+        if (type !== "0" && type !== "\0" && type !== "7")
+            continue;
+        files.set(name, Buffer.from(data));
+        if (readOctal(header, 100, 8) & 0o100)
+            executable.add(name);
+    }
+    return { files, executable };
+}
+/** Drop a single shared top-level directory (npm tarballs use `package/`). */
+export function stripRoot(entries, root) {
+    const prefix = `${root}/`;
+    const files = new Map();
+    const executable = new Set();
+    for (const [name, data] of entries.files) {
+        if (!name.startsWith(prefix))
+            continue;
+        const rel = name.slice(prefix.length);
+        files.set(rel, data);
+        if (entries.executable.has(name))
+            executable.add(rel);
+    }
+    return { files, executable };
+}
+//# sourceMappingURL=tar.js.map

package/dist/lib/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/lib/tar.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,MAAM,KAAK,GAAG,GAAG,CAAC;AASlB,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,8DAA8D;AAC9D,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,OAAO,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC;QAErB,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAErD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC;gBAAE,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,CAAC,sCAAsC;QAElE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjF,WAAW,GAAG,IAAI,CAAC;QAEnB,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,cAAc,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS,CAAC,oDAAoD;QAChF,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAE5D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,OAAmB,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC"}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@mhd1999/morkit-cli",
+  "version": "0.1.0",
+  "description": "Install the private morkit kit (skills, commands, agents) into a project's .claude/ directory from SkillHub. Ships no kit content — downloads it with your personal access token.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mor-duongmh/skill-hub.git",
+    "directory": "packages/morkit-cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "morkit": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "clean": "rm -rf dist",
+    "test": "node --import tsx --test tests/*.test.ts"
+  },
+  "dependencies": {
+    "commander": "^13.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}