@nanmicoder/dsh-skills-hub 0.0.1 → 0.0.3

package/lib/market/install-service.js

@@ -22,7 +22,8 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { clawhubProvider } from "./clawhub-provider.js";
 import { skillhubProvider } from "./skillhub-provider.js";
-import { getMarketSkillDetail } from "./market-service.js";
+import { getMarketSkillDetail, resolveMarketSkill, withMarketOwner } from "./market-service.js";
+import { withProviderConfiguration } from "./provider-fetch.js";
 import { INSTALL_META_FILE, parseInstalledMeta, readSkillHeadline, } from "../skills/installed.js";
 import { MARKET_ERROR_CODES, MARKET_LIMITS, sanitizeDirName, skillId, } from "./types.js";
 const providers = {
@@ -103,9 +104,14 @@ function hasErrorCode(error, code) {
     return typeof error === 'object' && error !== null && error.code === code;
 }
 /** The upstream detail for a skill, or the market's own "not installable" verdict. */
-async function loadDetail(source, slug) {
-    const { skill } = await getMarketSkillDetail(source, slug);
-    return skill;
+async function loadDetail(source, slug, owner) {
+    const detail = await resolveMarketSkill(source, slug, owner);
+    // The bytes must belong to the author the reader chose: a registry that
+    // answers for another owner is refused rather than installed.
+    if (owner && detail.author.handle && detail.author.handle !== owner) {
+        throw new MarketInstallError(409, MARKET_ERROR_CODES.notInstallable, `Skill ${slug} resolved to ${detail.author.handle}, not the requested ${owner}`);
+    }
+    return detail;
 }
 /**
  * Refuse to publish over anything we do not own.
@@ -155,7 +161,11 @@ async function readJsonIfExists(filePath) {
  * @throws {import('./types.ts').MarketUpstreamError} for upstream failures,
  *   unwrapped so the route can classify them (404 vs 502).
  */
-export async function installMarketSkill(source, slug, options) {
+export function installMarketSkill(source, slug, options) {
+    // One owner for the manifest, the file list and every file read.
+    return withProviderConfiguration(() => withMarketOwner(source, slug, options.owner, () => installMarketSkillWithConfiguration(source, slug, options)));
+}
+async function installMarketSkillWithConfiguration(source, slug, options) {
     const dirName = sanitizeDirName(slug);
     if (dirName === null) {
         throw new MarketInstallError(400, MARKET_ERROR_CODES.notInstallable, `Skill slug cannot be used as a directory name: ${slug}`);
@@ -168,7 +178,7 @@ export async function installMarketSkill(source, slug, options) {
     if (inFlight.has(lockKey)) {
         throw new MarketInstallError(409, MARKET_ERROR_CODES.installInProgress, `Install already in progress: ${id}`);
     }
-    const task = performInstall(source, slug, dirName, id, options.skillsRoot);
+    const task = performInstall(source, slug, dirName, id, options.skillsRoot, options.owner);
     // Store a settled-safe copy: the lock exists to reject *concurrent* work, and
     // an unhandled rejection here would crash the host on every failed install.
     inFlight.set(lockKey, task.catch(() => undefined));
@@ -179,17 +189,16 @@ export async function installMarketSkill(source, slug, options) {
         inFlight.delete(lockKey);
     }
 }
-async function performInstall(source, slug, dirName, id, skillsRootInput) {
+async function performInstall(source, slug, dirName, id, skillsRootInput, requestedOwner) {
     const skillsRoot = path.resolve(skillsRootInput);
-    const detail = await loadDetail(source, slug);
+    const detail = await loadDetail(source, slug, requestedOwner);
     if (detail.installState === 'installed') {
         throw new MarketInstallError(409, MARKET_ERROR_CODES.alreadyInstalled, `Skill already installed: ${id}`);
     }
     if (detail.installState === 'not-installable') {
         throw new MarketInstallError(400, MARKET_ERROR_CODES.notInstallable, `Skill is not installable (${detail.notInstallableReason ?? 'unknown'}): ${slug}`);
     }
-    // The cached detail may be older than the provider's version index, so the
-    // file list is fetched fresh at install time (mirrors the reference).
+    // Re-read the file inventory for the freshly resolved manifest version.
     const files = await providers[source].listFiles(slug, detail.version);
     if (files.length === 0 || !files.some((file) => file.path === 'SKILL.md')) {
         throw new MarketInstallError(400, MARKET_ERROR_CODES.notInstallable, `Skill has no installable SKILL.md: ${slug}`);
@@ -250,10 +259,14 @@ async function performInstall(source, slug, dirName, id, skillsRootInput) {
             ledger.push({ path: segments.join('/'), sha256: digest });
         }
         const installedAt = new Date().toISOString();
+        // The author is recorded so "view in marketplace" and later reads find this
+        // exact skill again, not another one sharing its slug.
+        const owner = detail.author.handle || requestedOwner;
         const meta = {
             id,
             source,
             slug,
+            ...(owner ? { owner } : {}),
             ...(detail.version === undefined ? {} : { version: detail.version }),
             installedAt,
             files: ledger,
@@ -369,7 +382,7 @@ export async function uninstallMarketSkill(source, slug, options) {
  */
 async function refreshRemovedSkill(source, slug, id, dirName, meta, headline) {
     try {
-        const { skill } = await getMarketSkillDetail(source, slug);
+        const { skill } = await getMarketSkillDetail(source, slug, { owner: meta.owner });
         return { ...skill, installState: 'installable', notInstallableReason: undefined, installedInfo: undefined };
     }
     catch {

package/lib/market/market-service.js

@@ -5,19 +5,24 @@
  * cross-source dedupe, per-source health/degradation reporting, TTL caching
  * (stale-while-error) and locally-computed install state.
  *
- * The module is deliberately free of DSH services and of the filesystem: the
+ * The module is deliberately free of DSH services: the
  * "what is installed locally" question is answered by an injected
  * `InstalledLookup` (see `setInstalledLookup`), so this file can be unit-tested
  * by pointing the providers at a stub server.
  */
-import { getSourceHealth, markSourceHealth, MARKET_TTL, marketCache } from "./cache.js";
-import { clawhubProvider } from "./clawhub-provider.js";
+import { getSourceHealth, markSourceHealth, marketCache, noteMarketStat } from "./cache.js";
+import { getProviderBase, withProviderConfiguration } from "./provider-fetch.js";
+import { clawhubOwnerFor, clawhubProvider, setClawhubOwnerHints, withClawhubOwner } from "./clawhub-provider.js";
+import { catalogCategories, catalogClawhubOwners, catalogEntryFor, catalogEntryToSkill, filterCatalog, getCatalog, } from "../catalog/catalog.js";
 import { skillhubProvider } from "./skillhub-provider.js";
 import { MARKET_LIMITS, MARKET_SOURCES, detectMarketLanguage, sanitizeDirName, skillId, } from "./types.js";
 const providers = {
     clawhub: clawhubProvider,
     skillhub: skillhubProvider,
 };
+// Catalogue entries name an exact ClawHub owner; detail, files and install must
+// resolve the same skill the card showed.
+setClawhubOwnerHints(catalogClawhubOwners());
 /** Nothing is installed until the host installs its real lookup. */
 const EMPTY_INSTALLED_LOOKUP = {
     has: () => false,
@@ -128,7 +133,9 @@ export function dedupeSkills(items) {
     for (const item of copies) {
         if (item.source === 'skillhub' && item.upstream?.slug) {
             const original = byClawhubSlug.get(item.upstream.slug);
-            if (original) {
+            // Same slug, different author: the mirror copies another skill.
+            const sameAuthor = !item.upstream.owner || !original?.author.handle || item.upstream.owner === original.author.handle;
+            if (original && sameAuthor) {
                 original.mirrors = [...(original.mirrors ?? []), item.id];
                 // Enrich the original with SkillHub-only data.
                 if (!original.iconUrl && item.iconUrl)
@@ -154,23 +161,35 @@ export function dedupeSkills(items) {
  * segment so every key is obviously source-scoped.
  */
 function providerPageCacheKey(source, kind, params) {
-    return `${kind}:${source}:${JSON.stringify([params.q ?? null, params.cursor ?? null, params.limit])}`;
+    return `${kind}:${source}:${JSON.stringify([getProviderBase(source), params.q ?? null, params.cursor ?? null, params.limit])}`;
 }
-async function fetchProviderPage(source, params) {
+async function fetchProviderPage(source, params, cache, options = {}) {
     const isSearch = Boolean(params.q);
     const cacheKey = providerPageCacheKey(source, isSearch ? 'search' : 'list', params);
-    const ttl = isSearch ? MARKET_TTL.search : MARKET_TTL.list;
-    const cached = marketCache.get(cacheKey);
-    if (cached) {
-        return { page: cached, status: { status: 'ok', fetchedAt: Date.now(), fromCache: true } };
+    const forced = options.force === true;
+    if (forced) {
+        // A reader asked for this page on purpose; the entry is still rewritten
+        // below, so the refresh costs one request and then serves everyone again.
+        noteMarketStat('forcedRefreshes');
+    }
+    else {
+        const hit = await cache.getRecord(cacheKey);
+        if (hit) {
+            noteMarketStat('hits');
+            // The real fetch time travels with the payload: a hit is a snapshot, and
+            // the panel has to be able to say how old it is.
+            return { page: hit.value, status: { status: 'ok', fetchedAt: hit.storedAt, fromCache: true } };
+        }
     }
+    noteMarketStat('misses');
     try {
         const q = params.q;
         const page = isSearch && q !== undefined
             ? await providers[source].search({ q, cursor: params.cursor, limit: params.limit })
             : await providers[source].list({ cursor: params.cursor, limit: params.limit });
-        marketCache.set(cacheKey, page, ttl);
-        return { page, status: { status: 'ok', fetchedAt: Date.now(), fromCache: false } };
+        noteMarketStat('upstreamRequests');
+        const storedAt = await cache.set(cacheKey, page);
+        return { page, status: { status: 'ok', fetchedAt: storedAt, fromCache: false } };
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -181,8 +200,9 @@ async function fetchProviderPage(source, params) {
         markSourceHealth(source, 'failed', message);
         // Stale-while-error: a degraded source still serves its last good page, so a
         // temporary upstream outage does not empty the panel.
-        const stale = marketCache.getStale(cacheKey);
+        const stale = await cache.getStale(cacheKey);
         if (stale) {
+            noteMarketStat('staleServed');
             return {
                 page: stale.value,
                 status: { status: 'cached', fetchedAt: stale.storedAt, fromCache: true, error: message },
@@ -191,7 +211,13 @@ async function fetchProviderPage(source, params) {
         return { page: null, status: { ...getSourceHealth(source), fromCache: false, error: message } };
     }
 }
-export async function listMarketSkills(params) {
+export function listMarketSkills(params) {
+    if (params.scope !== 'market')
+        return Promise.resolve(listCatalogSkills(params));
+    const cache = marketCache;
+    return withProviderConfiguration(() => listMarketSkillsWithCache(params, cache));
+}
+async function listMarketSkillsWithCache(params, cache) {
     const cursor = decodeCursor(params.cursor);
     const isFirstPage = !params.cursor;
     const activeSources = params.source === 'all' ? MARKET_SOURCES : [params.source];
@@ -207,7 +233,7 @@ export async function listMarketSkills(params) {
         // ClawHub search has no pagination: ask it for one big page and let the
         // aggregate cap apply, instead of pretending a second page exists.
         const limit = q && source === 'clawhub' ? MARKET_LIMITS.searchResultCap : params.limit;
-        outcomes.set(source, await fetchProviderPage(source, { q, cursor: providerCursor, limit }));
+        outcomes.set(source, await fetchProviderPage(source, { q, cursor: providerCursor, limit }, cache, { force: params.refresh === true }));
     }));
     let merged = [];
     const nextCursor = {};
@@ -238,21 +264,94 @@ export async function listMarketSkills(params) {
     }
     return { items: merged, nextCursor: encodeCursor(nextCursor), sources };
 }
+// ─── Curated catalogue ───────────────────────────────────────────────────────
+const CATALOG_CURSOR_PREFIX = 'catalog:';
+/** Provenance of every catalogue answer: one snapshot, read when it was generated. */
+function catalogStatus() {
+    return { status: 'ok', fetchedAt: getCatalog().generatedAt, fromCache: true };
+}
+/**
+ * One page of the curated catalogue.
+ *
+ * Everything is local, so every filter — security and installed included — runs
+ * before pagination: a page is always full until the list is exhausted, which
+ * is what keeps infinite scroll from stalling on a filtered-out page.
+ */
+export function listCatalogSkills(params) {
+    let items = filterCatalog({ q: params.q, category: params.category, source: params.source })
+        .map(catalogEntryToSkill)
+        .map((item) => annotateInstallState(item));
+    if (params.security !== 'all')
+        items = items.filter((item) => item.securityStatus === params.security);
+    if (params.installed !== 'all') {
+        items = items.filter((item) => params.installed === 'installed' ? item.installState === 'installed' : item.installState !== 'installed');
+    }
+    const raw = params.cursor?.startsWith(CATALOG_CURSOR_PREFIX) ? params.cursor.slice(CATALOG_CURSOR_PREFIX.length) : '';
+    const offset = Math.max(0, Number.parseInt(raw, 10) || 0);
+    const end = offset + params.limit;
+    const status = catalogStatus();
+    return {
+        items: items.slice(offset, end),
+        nextCursor: end < items.length ? `${CATALOG_CURSOR_PREFIX}${end}` : null,
+        total: items.length,
+        sources: { clawhub: status, skillhub: status },
+    };
+}
+export function listMarketCategories() {
+    return { items: catalogCategories(), status: catalogStatus() };
+}
 // ─── Detail / file content ───────────────────────────────────────────────────
-export async function getMarketSkillDetail(source, slug) {
-    const cacheKey = `detail:${source}:${slug}`;
-    let detail = marketCache.get(cacheKey);
-    let sourceStatus = { status: 'ok', fetchedAt: Date.now(), fromCache: true };
-    if (!detail) {
+export function getMarketSkillDetail(source, slug, options = {}) {
+    const cache = marketCache;
+    return withProviderConfiguration(() => withMarketOwner(source, slug, options.owner, () => getMarketSkillDetailWithCache(source, slug, options, cache))).then((result) => ({ ...result, skill: withCatalogMetadata(result.skill) }));
+}
+/**
+ * Overlay the catalogue's editorial fields on a live detail.
+ *
+ * Upstream stays authoritative for everything it owns (version, files,
+ * security, stats); the catalogue only adds what upstream does not have — our
+ * category, the editor's pick and the reader-facing Chinese summary.
+ */
+function withCatalogMetadata(detail) {
+    const entry = catalogEntryFor(detail.source, detail.slug);
+    if (!entry)
+        return detail;
+    return {
+        ...detail,
+        category: entry.category,
+        featured: entry.featured === true ? true : undefined,
+        summary: entry.summary || detail.summary,
+        tags: detail.tags.length > 0 ? detail.tags : [...entry.tags],
+    };
+}
+async function getMarketSkillDetailWithCache(source, slug, options, cache) {
+    const cacheKey = `detail:${source}:${JSON.stringify([getProviderBase(source), slug, ...ownerKeyPart(source, slug)])}`;
+    const forced = options.force === true;
+    if (forced)
+        noteMarketStat('forcedRefreshes');
+    const hit = forced ? undefined : await cache.getRecord(cacheKey);
+    let detail;
+    let sourceStatus;
+    if (hit) {
+        noteMarketStat('hits');
+        detail = hit.value;
+        sourceStatus = { status: 'ok', fetchedAt: hit.storedAt, fromCache: true };
+    }
+    else {
+        noteMarketStat('misses');
         try {
             detail = await providers[source].detail(slug);
-            marketCache.set(cacheKey, detail, MARKET_TTL.detail);
-            sourceStatus = { status: 'ok', fetchedAt: Date.now(), fromCache: false };
+            noteMarketStat('upstreamRequests');
+            const storedAt = await cache.set(cacheKey, detail);
+            sourceStatus = { status: 'ok', fetchedAt: storedAt, fromCache: false };
         }
         catch (error) {
-            const stale = marketCache.getStale(cacheKey);
+            if (options.allowStale === false)
+                throw error;
+            const stale = await cache.getStale(cacheKey);
             if (!stale)
                 throw error;
+            noteMarketStat('staleServed');
             detail = stale.value;
             sourceStatus = {
                 status: 'cached',
@@ -274,13 +373,36 @@ export function isValidMarketFilePath(filePath) {
         return false;
     return true;
 }
-export async function getMarketFileContent(source, slug, filePath) {
+export function getMarketFileContent(source, slug, filePath, owner) {
+    const cache = marketCache;
+    return withProviderConfiguration(() => withMarketOwner(source, slug, owner, () => getMarketFileContentWithCache(source, slug, filePath, cache)));
+}
+/**
+ * Pin a ClawHub read to the owner the reader asked for. ClawHub slugs are
+ * shared across authors, so `clawhub:<slug>` alone does not name one skill.
+ */
+export function withMarketOwner(source, slug, owner, operation) {
+    return source === 'clawhub' ? withClawhubOwner(slug, owner, operation) : operation();
+}
+/**
+ * Cache keys of owner-dependent reads carry the owner the read will use, so a
+ * snapshot of one author's skill is never served for another's. Appended only
+ * when known, keeping unambiguous slugs' keys unchanged.
+ */
+function ownerKeyPart(source, slug) {
+    const owner = source === 'clawhub' ? clawhubOwnerFor(slug) : undefined;
+    return owner ? [`owner=${owner}`] : [];
+}
+async function getMarketFileContentWithCache(source, slug, filePath, cache) {
     // JSON-encoded for the same reason as the list keys: slug and filePath are
     // both caller-controlled, so a `:`-joined key is ambiguous.
-    const cacheKey = `file:${source}:${JSON.stringify([slug, filePath])}`;
-    const cached = marketCache.get(cacheKey);
-    if (cached)
-        return cached;
+    const cacheKey = `file:${source}:${JSON.stringify([getProviderBase(source), slug, filePath, ...ownerKeyPart(source, slug)])}`;
+    const cached = await cache.getRecord(cacheKey);
+    if (cached) {
+        noteMarketStat('hits');
+        return cached.value;
+    }
+    noteMarketStat('misses');
     const fetched = await providers[source].fetchFile(slug, filePath);
     let content = fetched.content;
     let truncated = false;
@@ -295,7 +417,7 @@ export async function getMarketFileContent(source, slug, filePath) {
         size: fetched.size,
         truncated,
     };
-    marketCache.set(cacheKey, result, MARKET_TTL.fileContent);
+    await cache.set(cacheKey, result);
     return result;
 }
 // ─── Status ──────────────────────────────────────────────────────────────────
@@ -305,8 +427,15 @@ export function getMarketStatus() {
         skillhub: getSourceHealth('skillhub'),
     };
 }
-/** Look up a single skill (used by install) — the detail path, bypassing list. */
-export async function resolveMarketSkill(source, slug) {
-    const { skill } = await getMarketSkillDetail(source, slug);
+/**
+ * Look up a single skill for an install (the detail path, bypassing the list).
+ *
+ * Always forced: a cached manifest is a snapshot of the *catalogue*, and
+ * installing is the one action that has to be authorized by what upstream says
+ * right now — the file bytes are fetched fresh and hash-verified against the
+ * list, so the list must come from the same generation as those bytes.
+ */
+export async function resolveMarketSkill(source, slug, owner) {
+    const { skill } = await getMarketSkillDetail(source, slug, { force: true, allowStale: false, owner });
     return skill;
 }

package/lib/market/provider-fetch.js

@@ -10,6 +10,7 @@
  * `process.env` at module scope, so the module (and every provider built on it)
  * is directly unit-testable by pointing the bases at a local stub.
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { markSourceHealth } from "./cache.js";
 import { MARKET_ERROR_CODES, MARKET_LIMITS, MarketUpstreamError } from "./types.js";
 const DEFAULT_CONFIG = {
@@ -20,6 +21,11 @@ const DEFAULT_CONFIG = {
     userAgent: 'dsh-skills-hub',
 };
 let currentConfig = { ...DEFAULT_CONFIG };
+const requestConfig = new AsyncLocalStorage();
+/** Keep cache keys and all chained upstream reads on one configuration snapshot. */
+export function withProviderConfiguration(operation) {
+    return requestConfig.run(requestConfig.getStore() ?? currentConfig, operation);
+}
 /** Strip trailing slashes so `new URL('/api/...', base)` never doubles a separator. */
 function normalizeBaseUrl(value) {
     return value.replace(/\/+$/, '');
@@ -51,7 +57,8 @@ export function configureProviderFetch(config) {
 }
 /** Base URL of one upstream, as resolved from the active configuration. */
 export function getProviderBase(source) {
-    return source === 'clawhub' ? currentConfig.clawhubBaseUrl : currentConfig.skillhubBaseUrl;
+    const config = requestConfig.getStore() ?? currentConfig;
+    return source === 'clawhub' ? config.clawhubBaseUrl : config.skillhubBaseUrl;
 }
 /**
  * An upstream answered with a non-2xx status (or a retryable 429/5xx).
@@ -93,7 +100,7 @@ function requestHeaders(init, userAgent) {
  * provider can map it to a meaningful error.
  */
 export async function providerFetch(source, url, init) {
-    const config = currentConfig;
+    const config = requestConfig.getStore() ?? currentConfig;
     const attempts = Math.max(1, config.retries + 1);
     let lastError;
     for (let attempt = 0; attempt < attempts; attempt++) {

package/lib/market/skillhub-provider.js

@@ -13,7 +13,7 @@ import { getProviderBase, providerFetch, providerFetchJson, readResponseTextWith
 import { detectMarketLanguage, MARKET_ERROR_CODES, MARKET_LIMITS, MarketUpstreamError, skillId, } from "./types.js";
 // The frontmatter parser is shared with the ClawHub provider: both sources hand
 // us a raw SKILL.md and the detail contract promises a frontmatter-free body.
-import { parseFrontmatter } from "./clawhub-provider.js";
+import { meaningfulChangelog, parseFrontmatter } from "./clawhub-provider.js";
 import { markSourceHealth } from "./cache.js";
 /**
  * Vendor statuses that mean "no findings". Anything else (suspicious,
@@ -88,8 +88,9 @@ function parseUpstream(item) {
     try {
         const segments = new URL(upstreamUrl).pathname.split('/').filter(Boolean);
         const slug = segments[segments.length - 1];
+        const owner = segments.length > 1 ? segments[segments.length - 2] : undefined;
         if (slug)
-            return { source: 'clawhub', slug };
+            return { source: 'clawhub', slug, ...(owner ? { owner } : {}) };
     }
     catch {
         // Malformed upstream URL — treat as a native entry.
@@ -200,6 +201,7 @@ export const skillhubProvider = {
         }
         const security = mapSecurity(data.securityReports, data.skill.verified === undefined ? undefined : Boolean(data.skill.verified));
         const version = asString(data.latestVersion?.version) || item.version;
+        const changelog = meaningfulChangelog(data.latestVersion?.changelog);
         let files = [];
         try {
             files = await skillhubProvider.listFiles(slug);
@@ -242,6 +244,8 @@ export const skillhubProvider = {
             },
             securityStatus: security.status,
             securityReports: security.reports.length ? security.reports : undefined,
+            ...(changelog ? { changelog: { version, text: changelog, publishedAt: asNumber(data.latestVersion?.createdAt) } } : {}),
+            pageUrl: `https://skillhub.cn/skills/${encodeURIComponent(slug)}`,
             description,
             ...(descriptionFrontmatter ? { descriptionFrontmatter } : {}),
             files: files.map((file) => ({

package/lib/market/types.js

@@ -70,7 +70,8 @@ export function sanitizeDirName(slug) {
     return name;
 }
 const LANG_MAP = {
-    md: 'markdown', ts: 'typescript', tsx: 'typescript',
+    md: 'markdown', markdown: 'markdown', mdx: 'markdown',
+    ts: 'typescript', tsx: 'typescript',
     js: 'javascript', jsx: 'javascript', mjs: 'javascript', cjs: 'javascript',
     json: 'json', yaml: 'yaml', yml: 'yaml', sh: 'bash', bash: 'bash', zsh: 'bash',
     py: 'python', toml: 'toml', css: 'css', html: 'html',

package/lib/skills/installed.js

@@ -57,6 +57,9 @@ export function parseInstalledMeta(value) {
     const version = typeof candidate['version'] === 'string' && candidate['version'] !== ''
         ? candidate['version']
         : undefined;
+    const owner = typeof candidate['owner'] === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(candidate['owner'])
+        ? candidate['owner']
+        : undefined;
     const files = [];
     const rawFiles = candidate['files'];
     if (Array.isArray(rawFiles)) {
@@ -75,6 +78,7 @@ export function parseInstalledMeta(value) {
         id,
         source: source,
         slug,
+        ...(owner === undefined ? {} : { owner }),
         ...(version === undefined ? {} : { version }),
         installedAt,
         files,
@@ -289,6 +293,7 @@ async function readDirectorySkill(rootPath, dirName) {
         id: meta.id,
         source: meta.source,
         slug: meta.slug,
+        ...(meta.owner === undefined ? {} : { owner: meta.owner }),
         ...(version === undefined ? {} : { version }),
         installedAt: meta.installedAt,
         ...shared,