@modootoday/pmcp 0.1.0

package/dist/cli.js

@@ -0,0 +1,1885 @@
+#!/usr/bin/env node
+import {
+  openDatabase
+} from "./chunk-X3KWFZBP.js";
+import {
+  serve
+} from "./chunk-UTABV2C4.js";
+import {
+  readCatalog
+} from "./chunk-WIVQKKE4.js";
+
+// src/cli/command.ts
+var ArgumentError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ArgumentError";
+  }
+};
+function parseArgs(argv, specs = []) {
+  const byName = new Map(specs.map((spec) => [spec.name, spec]));
+  const positional = [];
+  const options = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("--")) {
+      positional.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
+    const spec = byName.get(name);
+    if (spec === void 0) {
+      throw new ArgumentError(`unknown option --${name}`);
+    }
+    if (spec.boolean === true) {
+      if (eq !== -1) {
+        throw new ArgumentError(`--${name} does not take a value`);
+      }
+      flags.add(name);
+      continue;
+    }
+    const value = eq === -1 ? argv[++i] : arg.slice(eq + 1);
+    if (value === void 0 || value === "" || value.startsWith("--")) {
+      throw new ArgumentError(`--${name} needs a value`);
+    }
+    const existing = options.get(name);
+    if (existing !== void 0 && spec.repeat !== true) {
+      throw new ArgumentError(`--${name} was given more than once`);
+    }
+    options.set(name, [...existing ?? [], value]);
+  }
+  return { positional, options, flags };
+}
+function one(args, name) {
+  return args.options.get(name)?.[0];
+}
+function many(args, name) {
+  return args.options.get(name) ?? [];
+}
+function printCommandHelp(ui, command) {
+  ui.heading(`pmcp ${command.name}`);
+  ui.line(`  ${command.describe}`);
+  ui.line();
+  ui.line(`  ${ui.paint(command.usage, "dim")}`);
+  if (command.options && command.options.length > 0) {
+    ui.line();
+    ui.table(
+      command.options.map((option) => [
+        `--${option.name}${option.placeholder ? ` ${option.placeholder}` : ""}`,
+        option.describe
+      ])
+    );
+  }
+  ui.line();
+}
+function printHelp(ui, commands, notImplemented) {
+  ui.heading("pmcp \u2014 the skills your installed packages ship");
+  ui.line();
+  ui.table(commands.map((command) => [command.name, command.describe]));
+  ui.line();
+  ui.line("  With no command, pmcp runs the MCP server on stdio.");
+  ui.line();
+  ui.table([
+    ["-q, --quiet", "only errors"],
+    ["--no-color", "never colour output; NO_COLOR is honoured too"],
+    ["--version", "print the version"],
+    ["-h, --help", "this, or help for one command"]
+  ]);
+  ui.line();
+  if (notImplemented.length > 0) {
+    ui.line(
+      `  ${ui.paint(`not implemented yet: ${notImplemented.join(", ")}`, "dim")}`
+    );
+    ui.line();
+  }
+}
+
+// src/cli/ui.ts
+var ESC = String.fromCharCode(27);
+var CODES = {
+  reset: `${ESC}[0m`,
+  bold: `${ESC}[1m`,
+  dim: `${ESC}[2m`,
+  red: `${ESC}[31m`,
+  green: `${ESC}[32m`,
+  yellow: `${ESC}[33m`,
+  cyan: `${ESC}[36m`
+};
+var SYMBOL = {
+  success: "+",
+  error: "x",
+  warn: "!",
+  info: "-",
+  prompt: ">"
+};
+var KIND_COLOUR = {
+  success: "green",
+  error: "red",
+  warn: "yellow",
+  info: "cyan",
+  prompt: "cyan"
+};
+var Ui = class {
+  out;
+  err;
+  quiet;
+  colour;
+  constructor(options = {}) {
+    this.out = options.stdout ?? process.stdout;
+    this.err = options.stderr ?? process.stderr;
+    this.quiet = options.quiet ?? false;
+    const env = options.env ?? process.env;
+    this.colour = options.color ?? (this.err.isTTY === true && (env["NO_COLOR"] ?? "") === "" && env["TERM"] !== "dumb");
+  }
+  paint(text, ...colours) {
+    if (!this.colour || colours.length === 0) return text;
+    return `${colours.map((c) => CODES[c]).join("")}${text}${CODES.reset}`;
+  }
+  /** Data goes to stdout so it can be piped; everything else to stderr. */
+  data(text) {
+    this.out.write(text);
+  }
+  line(text = "") {
+    if (this.quiet) return;
+    this.err.write(`${text}
+`);
+  }
+  message(kind, text, detail) {
+    const mark = this.paint(SYMBOL[kind], KIND_COLOUR[kind], "bold");
+    const tail = detail === void 0 ? "" : ` ${this.paint(detail, "dim")}`;
+    if (kind === "error" && this.quiet) {
+      this.err.write(`${mark} ${text}${tail}
+`);
+      return;
+    }
+    this.line(`${mark} ${text}${tail}`);
+  }
+  success(text, detail) {
+    this.message("success", text, detail);
+  }
+  error(text, detail) {
+    this.message("error", text, detail);
+  }
+  warn(text, detail) {
+    this.message("warn", text, detail);
+  }
+  info(text, detail) {
+    this.message("info", text, detail);
+  }
+  /** Two aligned columns, as a help screen or a summary. */
+  table(rows, indent = "  ") {
+    const width = rows.reduce((n, [left]) => Math.max(n, left.length), 0);
+    for (const [left, right] of rows) {
+      this.line(
+        `${indent}${this.paint(left.padEnd(width), "cyan")}  ${this.paint(right, "dim")}`
+      );
+    }
+  }
+  heading(text) {
+    this.line(this.paint(text, "bold"));
+  }
+};
+
+// src/embed.ts
+var DEFAULT_MODEL_ID = "Xenova/all-MiniLM-L6-v2";
+var ENTRY_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS entry_vector (
+    name TEXT NOT NULL,
+    model_id TEXT NOT NULL,
+    dims INTEGER NOT NULL,
+    description_hash TEXT NOT NULL,
+    vector BLOB NOT NULL,
+    PRIMARY KEY (name, model_id)
+  );
+`;
+var TRANSFORMERS = "@huggingface/transformers";
+async function loadEmbedder(modelId = DEFAULT_MODEL_ID) {
+  let module;
+  try {
+    module = await import(TRANSFORMERS);
+  } catch {
+    return null;
+  }
+  const factory = module.pipeline;
+  if (typeof factory !== "function") return null;
+  const encode = await factory("feature-extraction", modelId);
+  let dims = 0;
+  return {
+    modelId,
+    get dims() {
+      return dims;
+    },
+    async embed(text) {
+      const output = await encode(text, { pooling: "mean", normalize: true });
+      const vector = Float32Array.from(output.data);
+      dims = vector.length;
+      return vector;
+    }
+  };
+}
+function describeHash(description) {
+  let hash = 2166136261;
+  for (let i = 0; i < description.length; i++) {
+    hash ^= description.charCodeAt(i);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+async function openEntryVectors(path) {
+  const opened = await openDatabase(path);
+  if (opened === null) return null;
+  const db = opened.db;
+  db.exec(ENTRY_SCHEMA);
+  return {
+    read(modelId) {
+      const out = /* @__PURE__ */ new Map();
+      const rows = db.prepare(
+        "SELECT name, dims, vector FROM entry_vector WHERE model_id = ?"
+      ).all(modelId);
+      for (const row of rows) {
+        const bytes = row.vector;
+        const vector = new Float32Array(
+          bytes.buffer.slice(
+            bytes.byteOffset,
+            bytes.byteOffset + bytes.byteLength
+          )
+        );
+        if (vector.length === row.dims) out.set(row.name, vector);
+      }
+      return out;
+    },
+    stale(modelId, entries) {
+      const rows = db.prepare(
+        "SELECT name, description_hash FROM entry_vector WHERE model_id = ?"
+      ).all(modelId);
+      const stored = new Map(
+        rows.map((row) => [row.name, row.description_hash])
+      );
+      const out = [];
+      for (const [name, description] of entries) {
+        if (stored.get(name) !== describeHash(description)) out.push(name);
+      }
+      return out;
+    },
+    write(modelId, name, description, vector) {
+      db.prepare(
+        `INSERT INTO entry_vector (name, model_id, dims, description_hash, vector)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(name, model_id) DO UPDATE SET
+           dims = excluded.dims,
+           description_hash = excluded.description_hash,
+           vector = excluded.vector`
+      ).run(
+        name,
+        modelId,
+        vector.length,
+        describeHash(description),
+        new Uint8Array(vector.buffer, vector.byteOffset, vector.byteLength)
+      );
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+
+// src/commands/roots.ts
+var CATALOG_OPTIONS = [
+  {
+    name: "root",
+    describe: "A node_modules directory to walk. Repeatable.",
+    repeat: true,
+    placeholder: "<dir>"
+  },
+  {
+    name: "scope",
+    describe: "Only packages whose names start with this. Repeatable.",
+    repeat: true,
+    placeholder: "<prefix>"
+  }
+];
+function rootsFrom(context) {
+  const given = many(context.args, "root");
+  return given.length > 0 ? given : [`${context.cwd}/node_modules`];
+}
+function catalogFrom(context) {
+  const scopes = many(context.args, "scope");
+  const roots = rootsFrom(context);
+  return readCatalog(scopes.length > 0 ? { roots, scopes } : { roots });
+}
+
+// src/commands/reindex.ts
+function indexPath(root) {
+  return `${root}/.cache/pmcp/vectors.sqlite`;
+}
+var indexCommand = {
+  name: "index",
+  describe: "Encode the catalog so ranking can be semantic",
+  usage: "pmcp index [--root <dir>] [--model <id>]",
+  options: [
+    ...CATALOG_OPTIONS,
+    {
+      name: "model",
+      describe: "Encoder to use. Rows from another model are never scored.",
+      placeholder: "<id>"
+    },
+    {
+      name: "json",
+      describe: "Emit JSON rather than a summary.",
+      boolean: true
+    },
+    {
+      name: "dry-run",
+      describe: "Report what would be encoded and write nothing.",
+      boolean: true
+    }
+  ],
+  async run(context) {
+    const entries = catalogFrom(context);
+    if (entries.length === 0) {
+      context.ui.error("no skills to index", rootsFrom(context).join(" "));
+      return 1;
+    }
+    const dryRun = context.args.flags.has("dry-run");
+    const model = one(context.args, "model");
+    const embedder = await loadEmbedder(model);
+    if (embedder === null) {
+      context.ui.error(
+        "semantic ranking needs an encoder that is not installed"
+      );
+      context.ui.info("npm install --save-dev @huggingface/transformers");
+      context.ui.info("ranking stays lexical until then, which is the default");
+      return 3;
+    }
+    const store = await openEntryVectors(
+      indexPath(rootsFrom(context)[0] ?? ".")
+    );
+    if (store === null) {
+      context.ui.error(
+        "no sqlite in this runtime, so vectors cannot be stored"
+      );
+      return 1;
+    }
+    try {
+      const descriptions = new Map(entries.map((e) => [e.name, e.description]));
+      const stale = new Set(store.stale(embedder.modelId, descriptions));
+      const todo = entries.filter((entry2) => stale.has(entry2.name));
+      context.ui.info(
+        `${todo.length} of ${entries.length} to encode`,
+        embedder.modelId
+      );
+      if (dryRun) {
+        for (const entry2 of todo)
+          context.ui.line(`  would encode ${entry2.name}`);
+        context.ui.info("dry run, nothing written");
+        return 0;
+      }
+      for (const entry2 of todo) {
+        const vector = await embedder.embed(entry2.description);
+        store.write(embedder.modelId, entry2.name, entry2.description, vector);
+      }
+      const indexed = store.read(embedder.modelId).size;
+      if (context.args.flags.has("json")) {
+        context.ui.data(
+          `${JSON.stringify(
+            {
+              model: embedder.modelId,
+              encoded: todo.length,
+              indexed,
+              catalog: entries.length
+            },
+            null,
+            2
+          )}
+`
+        );
+      }
+      if (indexed < entries.length) {
+        context.ui.warn(
+          `indexed ${indexed} of ${entries.length}`,
+          "ranking stays lexical"
+        );
+        return 1;
+      }
+      context.ui.success(`indexed ${indexed} skills`, embedder.modelId);
+      return 0;
+    } finally {
+      store.close();
+    }
+  }
+};
+
+// src/commands/list.ts
+var listCommand = {
+  name: "list",
+  describe: "List the skills discovered in node_modules",
+  usage: "pmcp list [--root <dir>] [--scope <prefix>] [--json]",
+  options: [
+    ...CATALOG_OPTIONS,
+    { name: "json", describe: "Emit JSON rather than a table.", boolean: true }
+  ],
+  run(context) {
+    const entries = catalogFrom(context);
+    if (context.args.flags.has("json")) {
+      context.ui.data(`${JSON.stringify(entries, null, 2)}
+`);
+      return entries.length > 0 ? 0 : 1;
+    }
+    if (entries.length === 0) {
+      context.ui.error("no skills found", rootsFrom(context).join(" "));
+      return 1;
+    }
+    context.ui.table(entries.map((entry2) => [entry2.name, entry2.description]));
+    context.ui.success(`${entries.length} skills`);
+    return 0;
+  }
+};
+
+// src/commands/serve.ts
+var serveCommand = {
+  name: "serve",
+  describe: "Run the MCP server on stdio (the default with no command)",
+  usage: "pmcp serve [--root <dir>] [--scope <prefix>]",
+  options: [...CATALOG_OPTIONS],
+  run(context) {
+    serve(rootsFrom(context), many(context.args, "scope"));
+    return 0;
+  }
+};
+
+// src/remote/session.ts
+import {
+  chmodSync,
+  closeSync,
+  fchmodSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  writeSync
+} from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function globalDir(home = homedir(), env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  return xdg !== void 0 && xdg !== "" ? join(xdg, "pmcp") : join(home, ".pmcp");
+}
+var form = (fields) => new URLSearchParams(fields).toString();
+var FORM_HEADERS = { "content-type": "application/x-www-form-urlencoded" };
+function validateIssuerUrl(value, issuer) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.origin !== new URL(issuer).origin || url.username || url.password || url.hash) {
+    throw new Error("OAuth endpoint must stay on the issuer origin");
+  }
+}
+async function discover(issuer, fetcher2) {
+  const base = issuer.replace(/\/+$/, "");
+  const source = new URL(base);
+  if (source.protocol !== "https:" || source.username || source.password || source.search || source.hash) {
+    throw new Error("the issuer must be a plain HTTPS origin");
+  }
+  const res = await fetcher2(`${base}/.well-known/oauth-authorization-server`);
+  if (!res.ok)
+    throw new Error(`issuer did not answer discovery (${res.status})`);
+  const body = await res.json();
+  if (!body.token_endpoint || !body.device_authorization_endpoint) {
+    throw new Error("issuer advertises no device grant");
+  }
+  for (const endpoint of [
+    body.token_endpoint,
+    body.device_authorization_endpoint,
+    body.revocation_endpoint
+  ]) {
+    if (endpoint !== void 0) validateIssuerUrl(endpoint, base);
+  }
+  const grants = body.grant_types_supported ?? [];
+  if (grants.length > 0 && !grants.includes(DEVICE_GRANT)) {
+    throw new Error("issuer does not support the device grant");
+  }
+  return body;
+}
+async function startDevice(metadata, request, fetcher2, now = Date.now) {
+  const res = await fetcher2(metadata.device_authorization_endpoint, {
+    method: "POST",
+    headers: FORM_HEADERS,
+    body: form({
+      client_id: request.clientId,
+      resource: request.resource,
+      scope: request.scope
+    })
+  });
+  const body = await res.json();
+  if (!res.ok) {
+    throw new Error(
+      String(body["error"] ?? `device request failed (${res.status})`)
+    );
+  }
+  const deviceCode = body["device_code"];
+  const userCode = body["user_code"];
+  const verificationUri = body["verification_uri"];
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new Error("device response is missing a field");
+  }
+  const interval = Number(body["interval"] ?? 5);
+  const expires = Number(body["expires_in"] ?? 600);
+  const complete = body["verification_uri_complete"];
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...typeof complete === "string" ? { verificationUriComplete: complete } : {},
+    intervalMs: (Number.isFinite(interval) ? interval : 5) * 1e3,
+    expiresAt: now() + (Number.isFinite(expires) ? expires : 600) * 1e3
+  };
+}
+async function pollOnce(metadata, request, fetcher2, now = Date.now) {
+  const res = await fetcher2(metadata.token_endpoint, {
+    method: "POST",
+    headers: FORM_HEADERS,
+    body: form({
+      grant_type: DEVICE_GRANT,
+      device_code: request.deviceCode,
+      client_id: request.clientId
+    })
+  });
+  const body = await res.json();
+  if (res.ok) {
+    const token = body["access_token"];
+    if (typeof token !== "string")
+      throw new Error("token response has no token");
+    const expiresIn = Number(body["expires_in"]);
+    const refresh = body["refresh_token"];
+    const scope = body["scope"];
+    return {
+      kind: "granted",
+      session: {
+        issuer: request.issuer,
+        accessToken: token,
+        ...typeof refresh === "string" ? { refreshToken: refresh } : {},
+        ...Number.isFinite(expiresIn) ? { expiresAt: now() + expiresIn * 1e3 } : {},
+        ...typeof scope === "string" ? { scope } : {}
+      }
+    };
+  }
+  switch (body["error"]) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    default:
+      return { kind: "denied" };
+  }
+}
+var sessionPath = (home) => join(globalDir(home), "session.json");
+function readSession(home) {
+  try {
+    return JSON.parse(readFileSync(sessionPath(home), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeSession(session, home) {
+  const path = sessionPath(home);
+  const directory = globalDir(home);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  chmodSync(directory, 448);
+  const fd = openSync(path, "w", 384);
+  try {
+    fchmodSync(fd, 384);
+    writeSync(fd, `${JSON.stringify(session, null, 2)}
+`);
+  } finally {
+    closeSync(fd);
+  }
+}
+function clearSession(home) {
+  try {
+    rmSync(sessionPath(home));
+  } catch {
+  }
+}
+async function revoke(metadata, session, clientId, fetcher2) {
+  if (!metadata.revocation_endpoint) return false;
+  validateIssuerUrl(metadata.revocation_endpoint, session.issuer);
+  let revoked = true;
+  const tokens = [session.refreshToken, session.accessToken].filter(
+    (token) => typeof token === "string" && token !== ""
+  );
+  for (const token of tokens) {
+    try {
+      const res = await fetcher2(metadata.revocation_endpoint, {
+        method: "POST",
+        headers: FORM_HEADERS,
+        body: form({ token, client_id: clientId })
+      });
+      if (!res.ok) revoked = false;
+    } catch {
+      revoked = false;
+    }
+  }
+  return revoked;
+}
+
+// src/commands/session.ts
+var DEFAULT_ISSUER = "https://auth.pmcp.build";
+var DEFAULT_CLIENT = "https://auth.pmcp.build/oauth-client.json";
+var DEFAULT_RESOURCE = "https://api.pmcp.build";
+var DEFAULT_SCOPE = "pmcp:catalog:read pmcp:distribution:read";
+var fetcher = (url, init) => fetch(url, init);
+var setting = (env, name, fallback) => env[name] ?? fallback;
+var wait = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var loginCommand = {
+  name: "login",
+  describe: "Sign in on this machine, to obtain skills this project lacks",
+  usage: "pmcp login [--issuer <url>]",
+  options: [
+    {
+      name: "issuer",
+      describe: "override the auth issuer",
+      placeholder: "<url>"
+    }
+  ],
+  async run({ ui, args, env }) {
+    const issuer = args.options.get("issuer")?.[0] ?? setting(env, "PMCP_AUTH_ISSUER", DEFAULT_ISSUER);
+    const clientId = setting(env, "PMCP_OAUTH_CLIENT_ID", DEFAULT_CLIENT);
+    const resource = setting(env, "PMCP_OAUTH_RESOURCE", DEFAULT_RESOURCE);
+    const scope = setting(env, "PMCP_OAUTH_SCOPE", DEFAULT_SCOPE);
+    let metadata;
+    try {
+      metadata = await discover(issuer, fetcher);
+    } catch (error) {
+      ui.error("cannot sign in", error.message);
+      return 1;
+    }
+    let start;
+    try {
+      start = await startDevice(
+        metadata,
+        { clientId, resource, scope },
+        fetcher
+      );
+    } catch (error) {
+      ui.error("cannot start sign-in", error.message);
+      return 1;
+    }
+    ui.info("open", start.verificationUriComplete ?? start.verificationUri);
+    ui.info("code", start.userCode);
+    ui.line();
+    ui.info("waiting", "approve it and this finishes on its own");
+    let interval = start.intervalMs;
+    for (; ; ) {
+      if (Date.now() >= start.expiresAt) {
+        ui.error("expired", "the code timed out; run pmcp login again");
+        return 1;
+      }
+      await wait(interval);
+      const outcome = await pollOnce(
+        metadata,
+        { clientId, deviceCode: start.deviceCode, issuer },
+        fetcher
+      );
+      if (outcome.kind === "granted" && outcome.session) {
+        writeSession(outcome.session);
+        ui.success("signed in", issuer);
+        return 0;
+      }
+      if (outcome.kind === "slow_down") interval += 5e3;
+      if (outcome.kind === "denied") {
+        ui.error("declined", "the request was not approved");
+        return 1;
+      }
+      if (outcome.kind === "expired") {
+        ui.error("expired", "the code timed out; run pmcp login again");
+        return 1;
+      }
+    }
+  }
+};
+var logoutCommand = {
+  name: "logout",
+  describe: "Forget the sign-in on this machine",
+  usage: "pmcp logout",
+  async run({ ui, env }) {
+    const session = readSession();
+    if (!session) {
+      ui.info("not signed in", "nothing to forget");
+      return 0;
+    }
+    const clientId = setting(env, "PMCP_OAUTH_CLIENT_ID", DEFAULT_CLIENT);
+    clearSession();
+    try {
+      const metadata = await discover(session.issuer, fetcher);
+      const revoked = await revoke(metadata, session, clientId, fetcher);
+      ui.success(
+        "signed out",
+        revoked ? "token revoked" : "local copy removed"
+      );
+    } catch {
+      ui.success("signed out", "local copy removed");
+    }
+    return 0;
+  }
+};
+var whoamiCommand = {
+  name: "whoami",
+  describe: "Whether this machine is signed in, and to what",
+  usage: "pmcp whoami [--json]",
+  options: [
+    { name: "json", describe: "Print the answer as JSON.", boolean: true }
+  ],
+  run({ ui, args }) {
+    const session = readSession();
+    if (!session) {
+      if (args.flags.has("json")) {
+        ui.data(`${JSON.stringify({ signedIn: false }, null, 2)}
+`);
+      } else {
+        ui.data("not signed in\n");
+        ui.info("sign in", "run pmcp login");
+      }
+      return 1;
+    }
+    const left = session.expiresAt === void 0 ? void 0 : session.expiresAt - Date.now();
+    const answer = {
+      signedIn: true,
+      issuer: session.issuer,
+      ...session.scope === void 0 ? {} : { scope: session.scope },
+      ...left === void 0 ? {} : { expiresInMinutes: Math.max(0, Math.floor(left / 6e4)) }
+    };
+    if (args.flags.has("json")) {
+      ui.data(`${JSON.stringify(answer, null, 2)}
+`);
+      return 0;
+    }
+    ui.data(`issuer ${answer.issuer}
+`);
+    if (answer.scope !== void 0) ui.data(`scope ${answer.scope}
+`);
+    if (left !== void 0) {
+      ui.data(
+        left > 0 ? `token valid for ${String(answer.expiresInMinutes)} min
+` : "token expired, run pmcp login\n"
+      );
+    }
+    return 0;
+  }
+};
+
+// src/installed.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2, resolve } from "path";
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function absent(error) {
+  return object(error) && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+function packageName(name) {
+  return /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/u.test(name);
+}
+function locate(name, project) {
+  let directory = project;
+  for (; ; ) {
+    let source;
+    try {
+      source = readFileSync2(
+        join2(directory, "node_modules", name, "package.json"),
+        "utf8"
+      );
+    } catch (error) {
+      if (!absent(error)) return { name, reason: "unreadable_manifest" };
+      const parent = dirname(directory);
+      if (parent === directory) return { name, reason: "not_installed" };
+      directory = parent;
+      continue;
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(source);
+    } catch {
+      return { name, reason: "invalid_manifest" };
+    }
+    if (!object(manifest) || typeof manifest.name !== "string" || !packageName(manifest.name) || typeof manifest.version !== "string" || manifest.version.trim() === "") {
+      return { name, reason: "invalid_manifest" };
+    }
+    return {
+      name: manifest.name,
+      requestedAs: name,
+      version: manifest.version
+    };
+  }
+}
+function readInstalledDependencies(projectDirectory) {
+  const project = resolve(projectDirectory);
+  const manifest = JSON.parse(
+    readFileSync2(join2(project, "package.json"), "utf8")
+  );
+  if (!object(manifest))
+    throw new Error("project package.json must contain an object");
+  const names = /* @__PURE__ */ new Set();
+  for (const field of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies"
+  ]) {
+    const declared = manifest[field];
+    if (declared === void 0) continue;
+    if (!object(declared)) throw new Error(`${field} must contain an object`);
+    for (const [name, range] of Object.entries(declared)) {
+      if (!packageName(name) || typeof range !== "string") {
+        throw new Error(`invalid dependency declaration in ${field}`);
+      }
+      names.add(name);
+    }
+  }
+  const dependencies = [];
+  const issues = [];
+  for (const name of [...names].sort()) {
+    const result = locate(name, project);
+    if ("reason" in result) issues.push(result);
+    else dependencies.push(result);
+  }
+  return { dependencies, issues };
+}
+
+// src/install/plan.ts
+import { createHash } from "crypto";
+import { existsSync, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join3, relative, resolve as resolve2, sep } from "path";
+import semver from "semver";
+function matchingSkills(catalog, inventory) {
+  const matches = [];
+  for (const dependency of inventory.dependencies) {
+    for (const entry2 of catalog.entries) {
+      const target2 = entry2.targets.find(
+        (target3) => target3.packageName === dependency.name
+      );
+      if (target2 && semver.satisfies(dependency.version, target2.range)) {
+        matches.push({
+          targetName: dependency.name,
+          targetVersion: dependency.version,
+          verified: target2.verifiedVersions.includes(dependency.version),
+          entry: entry2
+        });
+      }
+    }
+  }
+  return matches;
+}
+var LOCKS = [
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "bun.lock",
+  "bun.lockb",
+  "yarn.lock",
+  "pnpm-lock.yaml"
+];
+function fingerprint(files) {
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(file).update("\0");
+    try {
+      hash.update(readFileSync3(file));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      hash.update("absent");
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function manifestAt(directory) {
+  const value = JSON.parse(
+    readFileSync3(join3(directory, "package.json"), "utf8")
+  );
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("invalid project manifest");
+  return value;
+}
+function installContext(directory) {
+  const project = resolve2(directory);
+  const manifest = manifestAt(project);
+  let root = project;
+  let ancestor = project;
+  for (; ; ) {
+    if (ancestor !== project && existsSync(join3(ancestor, "package.json"))) {
+      const candidate = manifestAt(ancestor);
+      if (candidate.workspaces !== void 0) {
+        root = ancestor;
+        break;
+      }
+      if (LOCKS.some((file) => existsSync(join3(ancestor, file)))) break;
+    }
+    if (existsSync(join3(ancestor, ".git")) || dirname2(ancestor) === ancestor)
+      break;
+    ancestor = dirname2(ancestor);
+  }
+  const owner = manifestAt(root);
+  const lockNames = LOCKS.filter((file) => existsSync(join3(root, file)));
+  const lockManagers = new Set(
+    lockNames.map((file) => {
+      if (file.startsWith("bun.")) return "bun";
+      if (file === "package-lock.json" || file === "npm-shrinkwrap.json")
+        return "npm";
+      return "unsupported";
+    })
+  );
+  if (lockManagers.size > 1 || lockManagers.has("unsupported"))
+    throw new Error("conflicting or unsupported package manager lockfiles");
+  const declared = owner.packageManager?.match(
+    /^(npm|bun)@\d+\.\d+\.\d+(?:[-+].+)?$/u
+  )?.[1];
+  if (owner.packageManager !== void 0 && !declared)
+    throw new Error("only npm and Bun projects are supported");
+  const locked = [...lockManagers][0];
+  if (declared && locked && declared !== locked)
+    throw new Error("packageManager and lockfile disagree");
+  const manager = declared ?? locked;
+  if (manager !== "npm" && manager !== "bun")
+    throw new Error(
+      "declare packageManager or install project dependencies first"
+    );
+  if (root !== project && LOCKS.some((file) => existsSync(join3(project, file)))) {
+    throw new Error(
+      "nested project has its own lockfile; resolve the workspace boundary first"
+    );
+  }
+  const files = [
+    .../* @__PURE__ */ new Set([
+      join3(root, "package.json"),
+      join3(project, "package.json"),
+      ...LOCKS.map((file) => join3(root, file))
+    ])
+  ];
+  return {
+    project,
+    root,
+    manager,
+    manifest,
+    files,
+    fingerprint: fingerprint(files)
+  };
+}
+function planInstall(options) {
+  if (options.inventory.issues.length)
+    throw new Error(
+      "resolve missing or invalid installed dependencies before changing skills"
+    );
+  const { context, catalog } = options;
+  const matched = matchingSkills(catalog, options.inventory);
+  const available = new Set(
+    matched.map((match) => match.entry.delivery.packageName)
+  );
+  if (options.sync && (options.selected.length || options.all))
+    throw new Error("sync accepts neither package arguments nor --all");
+  if (!options.sync && !options.all && options.selected.length === 0)
+    throw new Error("select a skill package or pass --all");
+  for (const name of options.selected)
+    if (!available.has(name))
+      throw new Error(
+        "a selected skill package does not match the installed dependencies"
+      );
+  const wanted = new Set(options.selected);
+  const entries = /* @__PURE__ */ new Map();
+  const published = /* @__PURE__ */ new Map();
+  for (const match of matched) {
+    const entry2 = match.entry;
+    const name = entry2.delivery.packageName;
+    const declared = Object.hasOwn(
+      context.manifest.devDependencies ?? {},
+      name
+    );
+    if (options.sync ? !declared : !options.all && !wanted.has(name)) continue;
+    if (Object.hasOwn(context.manifest.dependencies ?? {}, name) || Object.hasOwn(context.manifest.optionalDependencies ?? {}, name)) {
+      throw new Error(
+        "a skill package is already declared outside devDependencies"
+      );
+    }
+    const identity = `${name}@${entry2.delivery.version}`;
+    const hash = published.get(identity);
+    if (hash && hash !== entry2.delivery.integrity)
+      throw new Error("conflicting integrity for one package version");
+    published.set(identity, entry2.delivery.integrity);
+    const current = entries.get(name);
+    if (!current || semver.gt(entry2.delivery.version, current.delivery.version))
+      entries.set(name, entry2);
+  }
+  const changes = [...entries.values()].filter((entry2) => {
+    const installed = options.inventory.dependencies.find(
+      (dependency) => dependency.requestedAs === entry2.delivery.packageName
+    );
+    if (installed && installed.name !== entry2.delivery.packageName)
+      throw new Error("skill package aliases require explicit migration");
+    if (installed && semver.gt(installed.version, entry2.delivery.version))
+      throw new Error("catalog would downgrade an installed skill package");
+    return !installed || installed.version !== entry2.delivery.version;
+  }).map((entry2) => entry2.delivery).sort((a, b) => a.packageName.localeCompare(b.packageName));
+  const specs = changes.map((entry2) => `${entry2.packageName}@${entry2.version}`);
+  let args;
+  if (context.manager === "npm") {
+    args = [
+      "install",
+      "--save-dev",
+      "--save-exact",
+      "--ignore-scripts",
+      "--no-audit",
+      "--no-fund"
+    ];
+    if (context.project !== context.root)
+      args.push(
+        `--workspace=${relative(context.root, context.project).split(sep).join("/")}`
+      );
+  } else {
+    args = ["add", "--dev", "--exact", "--ignore-scripts"];
+  }
+  args.push(...specs);
+  return {
+    catalogRevision: catalog.revision,
+    context,
+    changes,
+    command: {
+      executable: context.manager,
+      args,
+      cwd: context.manager === "npm" ? context.root : context.project
+    }
+  };
+}
+
+// src/commands/remote-options.ts
+import { resolve as resolve3 } from "path";
+
+// src/remote/catalog.ts
+import { readFileSync as readFileSync4, statSync } from "fs";
+import semver2 from "semver";
+import { z } from "zod";
+var npmName = z.string().max(214).regex(/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u);
+var version = z.string().refine(
+  (value) => semver2.valid(value) !== null && semver2.valid(value) === value.split("+")[0]
+);
+var target = z.object({
+  packageName: npmName,
+  range: z.string().min(1).refine((value) => semver2.validRange(value) !== null),
+  verifiedVersions: z.array(version).min(1)
+}).refine(
+  (value) => value.verifiedVersions.every((item) => semver2.satisfies(item, value.range))
+);
+var deliveryName = npmName.refine(
+  (value) => value.startsWith("@modootoday/pmcp-")
+);
+var entry = z.object({
+  productId: z.string().min(1),
+  title: z.string().min(1),
+  summary: z.string().min(1),
+  delivery: z.object({
+    packageName: deliveryName,
+    version,
+    integrity: z.string().regex(/^sha512-[A-Za-z0-9+/]{86}==$/u)
+  }),
+  skillRevision: z.number().int().positive(),
+  contentDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
+  evidence: z.object({
+    verifiedOn: z.string().regex(/^\d{4}-\d{2}-\d{2}$/u).optional(),
+    examplesExecuted: z.number().int().positive()
+  }),
+  // Optional for the same reason the service makes it optional: a snapshot
+  // published before previews existed cannot grow one, and a client that
+  // demands it rejects the whole catalog rather than one older entry.
+  preview: z.object({
+    headings: z.array(z.string().min(1)),
+    example: z.string().min(1)
+  }).optional(),
+  targets: z.array(target).min(1)
+});
+var responseSchema = z.object({
+  schemaVersion: z.literal(1),
+  requestId: z.string().min(1),
+  catalog: z.object({
+    revision: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/u),
+    publishedAt: z.string().datetime(),
+    entries: z.array(entry)
+  })
+});
+var MAX_CATALOG_BYTES = 5 * 1024 * 1024;
+var DEFAULT_API_ORIGIN = "https://api.pmcp.build";
+function parseCatalog(value) {
+  const parsed = responseSchema.safeParse(value);
+  if (!parsed.success)
+    throw new Error("the service returned an invalid catalog");
+  const identities = /* @__PURE__ */ new Set();
+  for (const entry2 of parsed.data.catalog.entries) {
+    const identity = JSON.stringify([entry2.productId, entry2.skillRevision]);
+    if (identities.has(identity))
+      throw new Error("the catalog contains duplicate revisions");
+    identities.add(identity);
+  }
+  return parsed.data.catalog;
+}
+function catalogEndpoint(origin) {
+  const url = new URL(origin);
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error(
+      "the API origin must be an HTTPS origin without credentials or a path"
+    );
+  }
+  return new URL("/v1/catalog", url).href;
+}
+function readCatalogFile(path) {
+  const stat = statSync(path);
+  if (!stat.isFile() || stat.size > MAX_CATALOG_BYTES)
+    throw new Error("catalog file exceeds the supported size");
+  const bytes = readFileSync4(path);
+  if (bytes.byteLength > MAX_CATALOG_BYTES)
+    throw new Error("catalog file exceeds the supported size");
+  return parseCatalog(JSON.parse(bytes.toString("utf8")));
+}
+async function fetchCatalog(origin, fetcher2 = fetch) {
+  const response = await fetcher2(catalogEndpoint(origin), {
+    method: "GET",
+    headers: { accept: "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok)
+    throw new Error(`catalog request failed (${response.status})`);
+  if (!response.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
+    throw new Error("catalog response is not JSON");
+  }
+  if (!response.body) throw new Error("catalog response has no body");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_CATALOG_BYTES)
+        throw new Error("catalog response exceeds the supported size");
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return parseCatalog(JSON.parse(new TextDecoder().decode(bytes)));
+}
+
+// src/commands/remote-options.ts
+var REMOTE_OPTIONS = [
+  {
+    name: "project",
+    describe: "Project directory containing package.json.",
+    placeholder: "<dir>"
+  },
+  { name: "api", describe: "Catalog API origin.", placeholder: "<origin>" },
+  {
+    name: "catalog",
+    describe: "Use a saved catalog response without network access.",
+    placeholder: "<file>"
+  },
+  { name: "json", describe: "Print machine-readable results.", boolean: true }
+];
+function projectFrom(context) {
+  return resolve3(context.cwd, one(context.args, "project") ?? ".");
+}
+function apiOrigin(context) {
+  return one(context.args, "api") ?? context.env["PMCP_API_ORIGIN"] ?? DEFAULT_API_ORIGIN;
+}
+async function remoteCatalog(context) {
+  const file = one(context.args, "catalog");
+  if (file) {
+    if (one(context.args, "api"))
+      throw new Error("choose --catalog or --api, not both");
+    return readCatalogFile(resolve3(context.cwd, file));
+  }
+  return fetchCatalog(apiOrigin(context));
+}
+
+// src/commands/available.ts
+var availableCommand = {
+  name: "available",
+  describe: "Find provided skills matching this project's installed dependencies",
+  usage: "pmcp available [--project <dir>] [--catalog <file>] [--json]",
+  options: REMOTE_OPTIONS,
+  async run(context) {
+    if (context.args.positional.length)
+      throw new ArgumentError("available takes no package arguments");
+    const inventory = readInstalledDependencies(projectFrom(context));
+    const catalog = await remoteCatalog(context);
+    const matches = matchingSkills(catalog, inventory);
+    if (context.args.flags.has("json")) {
+      context.ui.data(
+        `${JSON.stringify({ catalogRevision: catalog.revision, matches, issues: inventory.issues }, null, 2)}
+`
+      );
+    } else {
+      for (const match of matches) {
+        const status = match.verified ? "verified" : "compatible, not verified at this exact version";
+        context.ui.data(
+          `${match.targetName}@${match.targetVersion}	${match.entry.delivery.packageName}@${match.entry.delivery.version}	${status}
+`
+        );
+        const { verifiedOn, examplesExecuted } = match.entry.evidence;
+        context.ui.line(
+          `    ${examplesExecuted} examples executed${verifiedOn ? ` on ${verifiedOn}` : ""}`
+        );
+        const headings = match.entry.preview?.headings ?? [];
+        if (headings.length > 0) {
+          context.ui.line(`    ${headings.join(" \xB7 ")}`);
+        }
+      }
+      context.ui.info(`${matches.length} matching skills`, catalog.revision);
+      if (matches.length > 0) {
+        context.ui.info(
+          "preview",
+          "pmcp preview <package> shows a full example before you subscribe"
+        );
+      }
+      for (const issue of inventory.issues)
+        context.ui.warn(issue.reason, issue.name);
+    }
+    return inventory.issues.length ? 1 : 0;
+  }
+};
+
+// src/commands/preview.ts
+var previewCommand = {
+  name: "preview",
+  describe: "Show what a skill contains before subscribing",
+  usage: "pmcp preview <skill-package> [--json]",
+  options: REMOTE_OPTIONS,
+  async run(context) {
+    const [requested, ...extra] = context.args.positional;
+    if (!requested || extra.length) {
+      throw new ArgumentError("name one skill package to preview");
+    }
+    const catalog = await remoteCatalog(context);
+    const entry2 = catalog.entries.find(
+      (candidate) => candidate.delivery.packageName === requested || candidate.productId === requested
+    );
+    if (!entry2) {
+      context.ui.error("no such skill", requested);
+      return 1;
+    }
+    if (context.args.flags.has("json")) {
+      context.ui.data(
+        `${JSON.stringify(
+          {
+            productId: entry2.productId,
+            title: entry2.title,
+            summary: entry2.summary,
+            package: `${entry2.delivery.packageName}@${entry2.delivery.version}`,
+            evidence: entry2.evidence,
+            targets: entry2.targets,
+            preview: entry2.preview
+          },
+          null,
+          2
+        )}
+`
+      );
+      return 0;
+    }
+    context.ui.data(`${entry2.title}
+
+${entry2.summary}
+
+`);
+    context.ui.data(
+      `${entry2.evidence.examplesExecuted} examples executed${entry2.evidence.verifiedOn ? ` on ${entry2.evidence.verifiedOn}` : ""}, against ${entry2.targets.map(
+        (target2) => `${target2.packageName}@${target2.verifiedVersions.join(", ")}`
+      ).join("; ")}
+
+`
+    );
+    if (!entry2.preview) {
+      context.ui.data(
+        "This entry was published before previews were recorded, so there is no sample to show.\n"
+      );
+      return 0;
+    }
+    if (entry2.preview.headings.length > 0) {
+      context.ui.data("Contents\n");
+      for (const heading of entry2.preview.headings) {
+        context.ui.data(`  ${heading}
+`);
+      }
+      context.ui.data("\n");
+    }
+    context.ui.data(
+      `One example from this skill
+
+${entry2.preview.example}
+`
+    );
+    return 0;
+  }
+};
+
+// src/commands/install.ts
+import { createInterface } from "readline/promises";
+
+// src/install/apply.ts
+import { spawnSync } from "child_process";
+function environment(userConfig, base) {
+  return userConfig ? {
+    ...base,
+    NPM_CONFIG_USERCONFIG: userConfig,
+    npm_config_userconfig: userConfig
+  } : base;
+}
+function createPackageManagerRunner(userConfig, baseEnv = process.env, verifiedIntegrity) {
+  return {
+    integrity(packageSpec, plan) {
+      const alreadyVerified = verifiedIntegrity?.get(packageSpec);
+      if (alreadyVerified) return alreadyVerified;
+      const { manager, project } = plan.context;
+      const args = manager === "npm" ? ["view", packageSpec, "dist.integrity", "--json"] : ["info", packageSpec, "dist.integrity", "--json"];
+      const result = spawnSync(manager, args, {
+        cwd: project,
+        env: environment(userConfig, baseEnv),
+        encoding: "utf8",
+        shell: false,
+        timeout: 3e4,
+        maxBuffer: 1024 * 1024
+      });
+      if (result.error || result.status !== 0) {
+        const detail = `${result.error?.message ?? ""} ${result.stderr ?? ""}`.replace(/pmcp_[A-Za-z0-9_-]{43}/gu, "[redacted]").trim().slice(0, 300);
+        throw new Error(
+          `package manager could not verify registry integrity${detail ? `: ${detail}` : ""}`
+        );
+      }
+      const value = JSON.parse(result.stdout.trim());
+      if (typeof value !== "string")
+        throw new Error("registry returned no package integrity");
+      return value;
+    },
+    install(plan) {
+      const args = [...plan.command.args];
+      const result = spawnSync(plan.command.executable, args, {
+        cwd: plan.command.cwd,
+        env: environment(userConfig, baseEnv),
+        stdio: ["inherit", "pipe", "pipe"],
+        encoding: "utf8",
+        shell: false,
+        maxBuffer: 8 * 1024 * 1024
+      });
+      if (result.error)
+        throw new Error(
+          "package manager execution failed; inspect the project before retrying"
+        );
+      if (result.stdout) process.stderr.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+      return result.status ?? 1;
+    }
+  };
+}
+var packageManagerRunner = createPackageManagerRunner();
+function applyInstallPlan(plan, runner = packageManagerRunner) {
+  if (!plan.changes.length) return 0;
+  if (fingerprint(plan.context.files) !== plan.context.fingerprint)
+    throw new Error("project changed after planning; create a new plan");
+  for (const entry2 of plan.changes) {
+    const integrity = runner.integrity(
+      `${entry2.packageName}@${entry2.version}`,
+      plan
+    );
+    if (integrity !== entry2.integrity)
+      throw new Error(
+        "registry integrity differs from the catalog; nothing was installed"
+      );
+  }
+  if (fingerprint(plan.context.files) !== plan.context.fingerprint)
+    throw new Error("project changed during registry verification");
+  const code = runner.install(plan);
+  if (code !== 0) return code;
+  const after = readInstalledDependencies(plan.context.project);
+  for (const entry2 of plan.changes) {
+    const found = after.dependencies.find(
+      (dependency) => dependency.requestedAs === entry2.packageName
+    );
+    if (!found || found.name !== entry2.packageName || found.version !== entry2.version) {
+      throw new Error(
+        "package manager exited successfully but the planned version is not installed"
+      );
+    }
+  }
+  return 0;
+}
+
+// src/install/verify-content.ts
+import { createHash as createHash2 } from "crypto";
+import { readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { join as join4, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+var SKILL = "SKILL.md";
+var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", ".cache"]);
+function skillFiles(root) {
+  const found = /* @__PURE__ */ new Map();
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (SKIP.has(name)) continue;
+      const path = join4(dir, name);
+      let stats;
+      try {
+        stats = statSync2(path);
+      } catch {
+        continue;
+      }
+      if (stats.isDirectory()) walk(path);
+      else if (name === SKILL)
+        found.set(
+          relative2(root, path).split(sep2).join("/"),
+          readFileSync5(path, "utf8")
+        );
+    }
+  };
+  walk(root);
+  return found;
+}
+function contentDigest(files) {
+  const hash = createHash2("sha256");
+  for (const path of [...files.keys()].sort()) {
+    const body = files.get(path);
+    hash.update(`${path.length}:${path}:${body.length}:${body}`);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function verifyInstalledContent(project, packageName2, expected) {
+  const root = resolve4(project, "node_modules", ...packageName2.split("/"));
+  const files = skillFiles(root);
+  const actual = contentDigest(files);
+  return {
+    packageName: packageName2,
+    expected,
+    actual,
+    matched: files.size > 0 && actual === expected,
+    skillCount: files.size
+  };
+}
+
+// src/remote/distribution.ts
+import { chmodSync as chmodSync2, mkdtempSync, rmSync as rmSync2, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+function api(origin, path) {
+  const base = new URL(catalogEndpoint(origin));
+  base.pathname = path;
+  return base.href;
+}
+function credential(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("invalid distribution credential response");
+  const row = value;
+  if (!row["credential"] || typeof row["credential"] !== "object" || Array.isArray(row["credential"])) {
+    throw new Error("invalid distribution credential response");
+  }
+  const item = row["credential"];
+  for (const key of ["id", "token", "registry", "scope", "expiresAt"]) {
+    if (typeof item[key] !== "string" || item[key] === "")
+      throw new Error("invalid distribution credential response");
+  }
+  const registry = new URL(item["registry"]);
+  if (registry.href !== "https://api.pmcp.build/npm/" || item["scope"] !== "@modootoday" || !/^pmcp_[A-Za-z0-9_-]{43}$/u.test(item["token"]) || !Number.isFinite(Date.parse(item["expiresAt"]))) {
+    throw new Error("invalid distribution credential response");
+  }
+  return item;
+}
+var REFUSALS = {
+  401: "sign in again before installing skills",
+  402: "your subscription does not include skill downloads",
+  403: "sign in again to approve skill downloads"
+};
+async function refusal(response, fallback) {
+  let requestId;
+  try {
+    const body = await response.json();
+    const value = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+    if (typeof value["requestId"] === "string" && value["requestId"] !== "") {
+      requestId = value["requestId"];
+    }
+  } catch {
+  }
+  const said = REFUSALS[response.status] ?? `${fallback} (${response.status})`;
+  return new Error(requestId ? `${said} [request ${requestId}]` : said);
+}
+async function issueDistributionCredential(accessToken, origin = DEFAULT_API_ORIGIN, fetcher2 = fetch) {
+  const response = await fetcher2(api(origin, "/v1/distribution/credentials"), {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      accept: "application/json"
+    }
+  });
+  if (!response.ok)
+    throw await refusal(response, "distribution credential request failed");
+  return credential(await response.json());
+}
+async function verifyRegistryIntegrity(entries, value, fetcher2 = fetch) {
+  const verified = /* @__PURE__ */ new Map();
+  for (const entry2 of entries) {
+    if (!entry2.packageName.startsWith(`${value.scope}/pmcp-`))
+      throw new Error(
+        "catalog delivery name is not a skill package for this credential"
+      );
+    const endpoint = new URL(
+      encodeURIComponent(entry2.packageName),
+      value.registry
+    );
+    const response = await fetcher2(endpoint, {
+      method: "GET",
+      redirect: "error",
+      signal: AbortSignal.timeout(15e3),
+      headers: {
+        authorization: `Bearer ${value.token}`,
+        accept: "application/json"
+      }
+    });
+    if (!response.ok)
+      throw await refusal(response, "registry metadata request failed");
+    const raw = await response.text();
+    if (raw.length > 2 * 1024 * 1024)
+      throw new Error("registry metadata exceeds the supported size");
+    const body = JSON.parse(raw);
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      throw new Error("registry returned invalid metadata");
+    const versions = body["versions"];
+    if (!versions || typeof versions !== "object" || Array.isArray(versions))
+      throw new Error("registry metadata contains no versions");
+    const release = versions[entry2.version];
+    if (!release || typeof release !== "object" || Array.isArray(release))
+      throw new Error("registry does not contain the catalog version");
+    const dist = release["dist"];
+    if (!dist || typeof dist !== "object" || Array.isArray(dist) || dist["integrity"] !== entry2.integrity) {
+      throw new Error("registry integrity differs from the catalog");
+    }
+    verified.set(`${entry2.packageName}@${entry2.version}`, entry2.integrity);
+  }
+  return verified;
+}
+async function revokeDistributionCredential(accessToken, id, origin = DEFAULT_API_ORIGIN, fetcher2 = fetch) {
+  try {
+    const response = await fetcher2(api(origin, "/v1/distribution/revoke"), {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15e3),
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ id })
+    });
+    return response.ok || response.status === 404;
+  } catch {
+    return false;
+  }
+}
+function temporaryRegistryConfig(value) {
+  const directory = mkdtempSync(join5(tmpdir(), "pmcp-registry-"));
+  chmodSync2(directory, 448);
+  const path = join5(directory, ".npmrc");
+  const registry = new URL(value.registry);
+  const auth = `//${registry.host}${registry.pathname}:_authToken=${value.token}`;
+  writeFileSync(path, `${value.scope}:registry=${registry.href}
+${auth}
+`, {
+    mode: 384
+  });
+  chmodSync2(path, 384);
+  return {
+    path,
+    environment: { HOME: directory },
+    close() {
+      rmSync2(directory, { recursive: true, force: true });
+    }
+  };
+}
+
+// src/commands/install.ts
+async function manage(context, sync) {
+  const dryRun = context.args.flags.has("dry-run");
+  const yes = context.args.flags.has("yes");
+  if (dryRun && yes)
+    throw new ArgumentError("choose --dry-run or --yes, not both");
+  if (sync && context.args.positional.length)
+    throw new ArgumentError("sync takes no package arguments");
+  if (!sync && !context.args.positional.length && !context.args.flags.has("all")) {
+    throw new ArgumentError("select a skill package or pass --all");
+  }
+  const project = projectFrom(context);
+  const install = installContext(project);
+  const inventory = readInstalledDependencies(project);
+  const catalog = await remoteCatalog(context);
+  const plan = planInstall({
+    context: install,
+    inventory,
+    catalog,
+    selected: context.args.positional,
+    all: context.args.flags.has("all"),
+    sync
+  });
+  const digests = new Map(
+    catalog.entries.map((entry2) => [
+      entry2.delivery.packageName,
+      entry2.contentDigest
+    ])
+  );
+  const mismatched = (packages) => packages.map(
+    (name) => verifyInstalledContent(project, name, digests.get(name) ?? "")
+  ).filter((check) => !check.matched);
+  const reportMismatch = (checks) => {
+    for (const check of checks) {
+      context.ui.error(
+        "installed content does not match the catalog",
+        `${check.packageName}: expected ${check.expected}, found ${check.actual} across ${check.skillCount} skill files`
+      );
+    }
+  };
+  const report = {
+    catalogRevision: plan.catalogRevision,
+    project,
+    changes: plan.changes,
+    command: plan.command
+  };
+  if (!context.args.flags.has("json")) {
+    context.ui.info("project", project);
+    for (const entry2 of plan.changes)
+      context.ui.line(`  ${entry2.packageName}@${entry2.version}`);
+    if (plan.changes.length)
+      context.ui.line(
+        `  ${plan.command.executable} ${plan.command.args.join(" ")}`
+      );
+  }
+  if (!dryRun && plan.changes.length === 0) {
+    const drifted = mismatched(
+      inventory.dependencies.filter((dependency) => digests.has(dependency.name)).map((dependency) => dependency.name)
+    );
+    if (drifted.length > 0) {
+      reportMismatch(drifted);
+      return 1;
+    }
+  }
+  if (dryRun || plan.changes.length === 0) {
+    const status = dryRun ? "planned" : "unchanged";
+    if (context.args.flags.has("json"))
+      context.ui.data(`${JSON.stringify({ status, ...report }, null, 2)}
+`);
+    else
+      context.ui.info(
+        status,
+        `${plan.changes.length} changes; nothing written`
+      );
+    return 0;
+  }
+  if (!yes) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY || context.args.flags.has("json")) {
+      throw new ArgumentError(
+        "use --yes to apply non-interactively or --dry-run to inspect the plan"
+      );
+    }
+    const prompt = createInterface({
+      input: process.stdin,
+      output: process.stderr
+    });
+    try {
+      const answer = await prompt.question(
+        "Update this project's dependencies and lockfile? [y/N] "
+      );
+      if (!/^y(?:es)?$/iu.test(answer.trim())) {
+        context.ui.info("cancelled", "nothing written");
+        return 1;
+      }
+    } finally {
+      prompt.close();
+    }
+  }
+  const session = readSession();
+  if (!session || session.expiresAt !== void 0 && session.expiresAt <= Date.now()) {
+    throw new Error("run pmcp login before installing paid skill packages");
+  }
+  const origin = apiOrigin(context);
+  const credential2 = await issueDistributionCredential(
+    session.accessToken,
+    origin
+  );
+  const registry = temporaryRegistryConfig(credential2);
+  let revoked = false;
+  try {
+    const verified = await verifyRegistryIntegrity(plan.changes, credential2);
+    const code = applyInstallPlan(
+      plan,
+      createPackageManagerRunner(
+        registry.path,
+        { ...process.env, ...registry.environment },
+        verified
+      )
+    );
+    if (code !== 0) {
+      context.ui.error(
+        "package manager failed",
+        `exit ${code}; inspect the project before retrying`
+      );
+      return code;
+    }
+    const wrong = mismatched(plan.changes.map((change) => change.packageName));
+    if (wrong.length > 0) {
+      reportMismatch(wrong);
+      return 1;
+    }
+    if (context.args.flags.has("json"))
+      context.ui.data(
+        `${JSON.stringify({ status: "applied", ...report }, null, 2)}
+`
+      );
+    else context.ui.success(`${plan.changes.length} skill packages installed`);
+    return 0;
+  } finally {
+    registry.close();
+    revoked = await revokeDistributionCredential(
+      session.accessToken,
+      credential2.id,
+      origin
+    );
+    if (!revoked)
+      context.ui.warn(
+        "temporary registry credential expires automatically",
+        credential2.expiresAt
+      );
+  }
+}
+var OPTIONS = [
+  ...REMOTE_OPTIONS,
+  {
+    name: "dry-run",
+    describe: "Show the plan without installing or changing files.",
+    boolean: true
+  },
+  {
+    name: "yes",
+    describe: "Approve the displayed project and lockfile changes.",
+    boolean: true
+  }
+];
+var installCommand = {
+  name: "install",
+  describe: "Install matching skill npm packages with the project's package manager",
+  usage: "pmcp install <skill-package>... | --all [--dry-run | --yes]",
+  options: [
+    ...OPTIONS,
+    {
+      name: "all",
+      describe: "Select all matching skill packages.",
+      boolean: true
+    }
+  ],
+  run: (context) => manage(context, false)
+};
+var syncCommand = {
+  name: "sync",
+  describe: "Update declared skill packages without removing other dependencies",
+  usage: "pmcp sync [--project <dir>] [--dry-run | --yes]",
+  options: OPTIONS,
+  run: (context) => manage(context, true)
+};
+
+// src/commands/index.ts
+var COMMANDS = [
+  serveCommand,
+  listCommand,
+  indexCommand,
+  loginCommand,
+  logoutCommand,
+  whoamiCommand,
+  availableCommand,
+  previewCommand,
+  installCommand,
+  syncCommand
+];
+var PLANNED = [];
+var GLOBAL = /* @__PURE__ */ new Set(["-q", "--quiet", "--no-color", "--color"]);
+function dispatch(argv, options = {}) {
+  const global = argv.filter((arg) => GLOBAL.has(arg));
+  const rest0 = argv.filter((arg) => !GLOBAL.has(arg));
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const ui = options.ui ?? new Ui({
+    env,
+    quiet: global.includes("-q") || global.includes("--quiet"),
+    ...global.includes("--no-color") ? { color: false } : global.includes("--color") ? { color: true } : {}
+  });
+  const [verb, ...rest] = rest0;
+  if (verb === void 0) {
+    return run(serveCommand, [], { ui, env, cwd });
+  }
+  if (verb === "--help" || verb === "-h" || verb === "help") {
+    const named = COMMANDS.find((command2) => command2.name === rest[0]);
+    if (named) printCommandHelp(ui, named);
+    else printHelp(ui, COMMANDS, PLANNED);
+    return 0;
+  }
+  if (verb === "--version") {
+    ui.data(`${VERSION}
+`);
+    return 0;
+  }
+  if (verb.startsWith("-")) {
+    return run(serveCommand, rest0, { ui, env, cwd });
+  }
+  const command = COMMANDS.find((candidate) => candidate.name === verb);
+  if (command === void 0) {
+    if (PLANNED.includes(verb))
+      ui.error(`"${verb}" is designed but not implemented yet`);
+    else ui.error(`unknown command "${verb}"`);
+    printHelp(ui, COMMANDS, PLANNED);
+    return 2;
+  }
+  if (rest.includes("--help") || rest.includes("-h")) {
+    printCommandHelp(ui, command);
+    return 0;
+  }
+  return run(command, rest, { ui, env, cwd });
+}
+var VERSION = "0.1.0";
+async function run(command, argv, context) {
+  try {
+    return await command.run({
+      ...context,
+      args: parseArgs(argv, command.options)
+    });
+  } catch (error) {
+    if (error instanceof ArgumentError) {
+      context.ui.error(error.message);
+      printCommandHelp(context.ui, command);
+      return 2;
+    }
+    context.ui.error(error instanceof Error ? error.message : "command failed");
+    return 1;
+  }
+}
+
+// src/cli.ts
+process.exitCode = await dispatch(process.argv.slice(2));
+//# sourceMappingURL=cli.js.map