@nanmicoder/dsh-skills-hub 0.0.1 → 0.0.3

package/docs/RELEASE.md

@@ -1,8 +1,8 @@
-# Release 0.0.1
+# Release 0.0.3
 
-Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.1`. npm channel: `latest`. This is an initial plugin release, independent of the host's `0.2.0-rc.2` version.
+Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.3`. npm channel: `latest`. This plugin release is independent of the host's `0.2.0-rc.2` version and retains that exact compatibility cohort.
 
-## Before making the repository public
+## Before publication
 
 1. Run `pnpm install --frozen-lockfile` and `pnpm pack:check` on the intended release commit.
 2. Perform the exact-host acceptance described in [COMPATIBILITY.md](COMPATIBILITY.md), including a browser mount and real install/uninstall in a temporary skills root. Record the host tag, plugin commit, commands and results; fixture tests alone do not prove host acceptance.
@@ -11,7 +11,7 @@ Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`.
 
 ## GitHub Actions publication
 
-Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.1` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
+Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.3` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
 
 Configure npm Trusted Publishing for GitHub owner `NanmiCoder`, repository `dsh-skills-hub`, workflow `release.yml`, environment `npm`, allowing direct publication. OIDC uses `id-token: write`; routine releases need no local npm login and no stored npm token. The existing AgentTeams trust binding is package-specific and does not authorize this new package.
 
@@ -21,4 +21,4 @@ Before tagging, commit all source and generated artifacts, confirm the version a
 
 ## After publication / recovery
 
-Install `@nanmicoder/dsh-skills-hub@0.0.1` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.
+Install `@nanmicoder/dsh-skills-hub@0.0.3` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.

package/lib/catalog/catalog.js

@@ -0,0 +1,89 @@
+/**
+ * Curated catalogue — the marketplace's home list.
+ *
+ * The upstream registries hold ~80k ClawHub and ~110k SkillHub skills; nobody
+ * chooses from that. The home list is instead a few hundred skills reviewed in
+ * this repository (`catalog/curation.json`) and snapshotted by
+ * `scripts/catalog-refresh.mjs` into `skills.json`, which ships with the plugin.
+ *
+ * Only the *list* comes from the snapshot. Opening a card, reading a file and
+ * installing still go to the owning registry (through the usual cache), so a
+ * reader never installs the snapshot's version of anything.
+ */
+import data from './skills.json' with { type: 'json' };
+import { skillId, } from "../market/types.js";
+const catalog = data;
+export function getCatalog() {
+    return catalog;
+}
+const bySkillId = new Map(catalog.skills.map((entry) => [skillId(entry.source, entry.slug), entry]));
+export function catalogEntryFor(source, slug) {
+    return bySkillId.get(skillId(source, slug));
+}
+/** Category bar entries, in editorial order, with how many skills each holds. */
+export function catalogCategories() {
+    const counts = new Map();
+    for (const entry of catalog.skills)
+        counts.set(entry.category, (counts.get(entry.category) ?? 0) + 1);
+    return catalog.categories
+        .map((category, index) => ({ ...category, sortOrder: index, count: counts.get(category.key) ?? 0 }))
+        .filter((category) => category.count > 0);
+}
+/** ClawHub owners the catalogue pins, for the provider's slug disambiguation. */
+export function catalogClawhubOwners() {
+    return catalog.skills.filter((entry) => entry.source === 'clawhub').map((entry) => [entry.slug, entry.owner]);
+}
+export function catalogEntryToSkill(entry) {
+    return {
+        id: skillId(entry.source, entry.slug),
+        source: entry.source,
+        slug: entry.slug,
+        name: entry.name,
+        summary: entry.summary,
+        author: { handle: entry.owner },
+        stats: { ...entry.stats },
+        tags: [...entry.tags],
+        category: entry.category,
+        version: entry.version,
+        updatedAt: entry.updatedAt,
+        iconUrl: entry.iconUrl,
+        securityStatus: entry.security,
+        requiresApiKey: entry.requiresApiKey,
+        featured: entry.featured === true ? true : undefined,
+        installState: 'installable',
+    };
+}
+/** Fold case and width so `GitHub`, `github` and full-width input all match. */
+function fold(text) {
+    return text.normalize('NFKC').toLowerCase();
+}
+/**
+ * Entries matching every whitespace-separated term, in catalogue order.
+ *
+ * A name/slug hit ranks above a summary or tag hit: typing a skill's name
+ * should put that skill first, not the one that mentions it most.
+ */
+export function filterCatalog(params) {
+    const terms = fold(params.q ?? '').split(/\s+/).filter(Boolean);
+    const strong = [];
+    const weak = [];
+    for (const entry of catalog.skills) {
+        if (params.category && entry.category !== params.category)
+            continue;
+        if (params.source && params.source !== 'all' && entry.source !== params.source)
+            continue;
+        if (terms.length === 0) {
+            strong.push(entry);
+            continue;
+        }
+        const head = fold(`${entry.name} ${entry.slug}`);
+        const body = fold(`${entry.summary} ${entry.summaryEn ?? ''} ${entry.tags.join(' ')} ${entry.owner}`);
+        if (!terms.every((term) => head.includes(term) || body.includes(term)))
+            continue;
+        if (terms.every((term) => head.includes(term)))
+            strong.push(entry);
+        else
+            weak.push(entry);
+    }
+    return [...strong, ...weak];
+}