@petercjl/product-asset-set 0.1.1 → 0.1.2

package/INSTALL.md

@@ -2,4 +2,6 @@
 
 > 请安装 `@petercjl/product-asset-set` 提供的 Skill。
 
-当前 Agent 从 npm 获取并核对指定版本，读取包内 `skills/product-asset-set/SKILL.md`。按自身支持的安装及注册方式，将该目录和全部资源实体复制到自己的 Skill 环境。保留已存在的非受管文件和本地改动，安装后核对版本、文件哈希与实际加载状态。运行本地校验工具需要 Node.js 22 或更新版本。图像执行能力以 Skill 的能力声明为准。
+当前 Agent 先识别自己的 Skill 目录，从 npm 获取指定版本并通过标准管理 CLI 的 skill source 读取当前来源和合同。以明确的 Agent 名称和完整目标目录执行 skill install，实体安装包含完整 Skill 和目标自有运行时。已有未受管副本先核对来源、保留备份。安装后核对 skill status 的版本、哈希与 current 状态，并按当前宿主的机制注册和刷新加载。版本一致只是身份检查，实际资源由 SHA-256 校验。npm 脚本被禁用时，同样完成上述交接。
+
+目标参数 --target 表示精确 Skill 目录，由当前 Agent 解析。任何满足所需能力的 Agent 均可安装。管理 CLI 与本地资产工具需要 Node.js 22+。媒体服务权限由任务入口单独核实。

package/README.md

@@ -1,9 +1,9 @@
 # product-asset-set
 
-Build reusable product reference image sets.
-
-请把下面的提示词交给当前使用的 Agent。
+制作可复用的独立产品参考图组及资产说明，每张图按实际用途选择画幅。
 
 > 请安装 `@petercjl/product-asset-set` 提供的 Skill。
 
-[安装说明](INSTALL.md) · [更新说明](UPDATE.md)
+> 请检查并更新 `@petercjl/product-asset-set` 提供的 Skill。
+
+面向当前使用的 Agent，由其解析自己的安装目录并完成注册。包提供通用管理 CLI、完整 Skill 和独立运行时安装。安装与更新不授予媒体服务权限。[安装说明](INSTALL.md) · [更新与恢复](UPDATE.md)

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,11 @@
+Management lifecycle helpers are adapted from @petercjl/portable-skill-creator 0.2.1.
+
+MIT License
+
+Copyright (c) 2026 petercjl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/UPDATE.md

@@ -2,4 +2,8 @@
 
 > 请检查并更新 `@petercjl/product-asset-set` 提供的 Skill。
 
-当前 Agent 先定位自己的已安装副本，再从 npm 获取稳定版本。保留可恢复备份，核对包版本和资源，更新同一个实体安装，即使版本相同也检查资源是否完整。按自身机制刷新注册，验证已加载版本与文件哈希；有本地编辑时先保留编辑，再处理冲突。
+当前 Agent 先定位自己的明确目标，读取 skill source 中的管理合同并检查 skill status。普通任务 prepare 自动检测稳定版更新，缓存最长一天，离线回退五分钟；AGENT_PACKAGE_UPDATE_CHECK=0 可停用检测。update check 和 update status 提供只读检查，update policy --mode off|notify --yes 配置所选安装的通知模式。默认通知，有明确更新授权后才替换。
+
+update install --agent NAME --target EXACT_DIRECTORY --yes 获取候选，保留替换前的副本，核对身份后同步该目标的 Skill 与自有运行时。相同版本也修复缺失文件，已完整同步时返回 verified no-op。保留本地编辑与宿主界面元数据。更新回执提供新入口，当前 Agent 随后加载该入口和 Skill，按宿主机制确认发现状态。
+
+失败或结果未知时，先读取 update operation，恢复已获取的候选用 update resume，需回退时用 update rollback；两者均要求所选目标和明确的 --yes。恢复保持原事务及备份，避免重复 npm 获取。父集合管理安装显示 owner，由所属集合进行更新。0.1.0、0.1.1 只有实体复制安装，没有历史管理 CLI；迁移时核对旧副本并先保留可恢复备份。

package/bin/product-asset-set.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import {main} from '../lib/cli.mjs';
+main(process.argv.slice(2)).catch(error=>{
+  process.stderr.write(JSON.stringify({ok:false,error:{code:error.code??'INTERNAL_ERROR',message:error.message,...error.details}})+'\n');
+  process.exitCode=1;
+});

package/capabilities.json

@@ -0,0 +1,514 @@
+{
+  "ok": true,
+  "schemaVersion": 1,
+  "package": "@petercjl/product-asset-set",
+  "version": "0.1.2",
+  "skills": [
+    "product-asset-set"
+  ],
+  "agentEligibility": "capability-based",
+  "commandContracts": {
+    "version": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "help": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "capabilities": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "doctor": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "install-notice": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "prepare": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--state-dir": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "local-write"
+    },
+    "skill source": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--name": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "skill status": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--name": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "skill install": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--name": {
+          "type": "string"
+        },
+        "--owner": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "local-write"
+    },
+    "skill update": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--name": {
+          "type": "string"
+        },
+        "--owner": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "local-write"
+    },
+    "update check": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--state-dir": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "update status": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--state-dir": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "update policy": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--state-dir": {
+          "type": "string"
+        },
+        "--mode": {
+          "type": "string"
+        },
+        "--yes": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "local-write",
+      "writeCondition": "Only an explicit --mode with --yes changes policy."
+    },
+    "update install": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--yes": {
+          "type": "boolean"
+        },
+        "--state-dir": {
+          "type": "string"
+        },
+        "--package-file": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "package-and-skill-update"
+    },
+    "update operation": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "update resume": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--yes": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "local-write"
+    },
+    "update rollback": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--agent": {
+          "type": "string"
+        },
+        "--target": {
+          "type": "string"
+        },
+        "--yes": {
+          "type": "boolean"
+        }
+      },
+      "sideEffects": "local-write"
+    },
+    "asset check": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--guide": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "none"
+    },
+    "asset write": {
+      "options": {
+        "--json": {
+          "type": "boolean"
+        },
+        "--help": {
+          "type": "boolean"
+        },
+        "--directory": {
+          "type": "string"
+        },
+        "--plan": {
+          "type": "string"
+        }
+      },
+      "sideEffects": "local-write"
+    }
+  },
+  "maintenanceContract": {
+    "schemaVersion": 1,
+    "source": {
+      "name": {
+        "field": "name",
+        "type": "string"
+      },
+      "package": {
+        "field": "package",
+        "type": "string"
+      },
+      "version": {
+        "field": "version",
+        "type": "string"
+      },
+      "path": {
+        "field": "path",
+        "type": "string"
+      }
+    },
+    "status": {
+      "name": {
+        "field": "name",
+        "type": "string"
+      },
+      "package": {
+        "field": "package",
+        "type": "string"
+      },
+      "version": {
+        "field": "version",
+        "type": "string"
+      },
+      "target": {
+        "field": "target",
+        "type": "string"
+      },
+      "installed": {
+        "field": "installed",
+        "type": "boolean"
+      },
+      "managed": {
+        "field": "managed",
+        "type": "boolean"
+      },
+      "current": {
+        "field": "current",
+        "type": "boolean"
+      },
+      "edited": {
+        "field": "edited",
+        "type": "string[]"
+      },
+      "verification": {
+        "field": "verification",
+        "type": "object"
+      },
+      "recovery": {
+        "field": "recovery",
+        "type": "object"
+      }
+    },
+    "targetOptions": {
+      "--target": {
+        "kind": "skill-directory"
+      }
+    },
+    "agentEligibility": "valid-name-with-generic-fallback",
+    "hostDiscoveryAuthority": "host"
+  },
+  "discoveryContract": {
+    "schemaVersion": 1,
+    "entryPoints": [
+      {
+        "argv": [
+          "capabilities",
+          "--json"
+        ],
+        "result": "manifest"
+      }
+    ],
+    "commandsField": "commandContracts",
+    "version": {
+      "command": "version",
+      "argv": [
+        "version",
+        "--json"
+      ],
+      "fields": {
+        "package": {
+          "field": "package",
+          "type": "string"
+        },
+        "version": {
+          "field": "version",
+          "type": "string"
+        }
+      }
+    },
+    "skillCollection": {
+      "namesField": "skills",
+      "default": "product-asset-set",
+      "selector": {
+        "option": "--name",
+        "type": "string"
+      },
+      "enumeration": {
+        "argv": [
+          "skill",
+          "source",
+          "--json"
+        ],
+        "itemsField": "sources",
+        "completeField": "complete"
+      },
+      "namedSource": [
+        "skill",
+        "source",
+        "--name",
+        "{skill}",
+        "--json"
+      ]
+    }
+  },
+  "installationLifecycle": {
+    "skillRequired": true,
+    "updateRequiresSkillSync": true,
+    "required_components": [
+      "cli",
+      "skill"
+    ],
+    "installGuide": "INSTALL.md",
+    "updateGuide": "UPDATE.md",
+    "source": [
+      "skill",
+      "source",
+      "--json"
+    ],
+    "install": "skill install --agent {agent} --target {target} --json",
+    "update": "update install --agent {agent} --target {target} --yes --json",
+    "verification": "skill status --agent {agent} --target {target} --json",
+    "hostDiscoveryAuthority": "host",
+    "physicalIsolation": true,
+    "runtimeEntry": "{target}/.runtime/bin/product-asset-set.mjs",
+    "agentNeutral": true,
+    "targetRequired": true,
+    "hostRegistrationRequired": true,
+    "installationMode": "copy",
+    "sharedLinksAllowed": false,
+    "isolatedRuntimeRequired": true
+  },
+  "automaticUpdates": {
+    "trigger": "ordinary task entry prepare",
+    "channel": "latest",
+    "ttlHours": 24,
+    "timeoutMs": 1500,
+    "optOut": "AGENT_PACKAGE_UPDATE_CHECK=0",
+    "automaticInstall": false,
+    "policy": "advisory-only; explicit install authorization required",
+    "enabledByDefault": true,
+    "intervalHours": 24,
+    "configuration": "update status and update policy --mode off|notify --yes",
+    "disable": "AGENT_PACKAGE_UPDATE_CHECK=0",
+    "recovery": "offline backoff keeps installed state; malformed cache is preserved",
+    "defaultMode": "notify"
+  },
+  "historicalUpdater": {
+    "status": "first-management-release",
+    "previousPublishedVersions": [
+      "0.1.0",
+      "0.1.1"
+    ],
+    "previousUpdater": "absent; previous packages were binless and host-copied",
+    "migration": "Existing unowned physical copies require a verified backup before managed installation."
+  },
+  "requiredCapabilities": [
+    "filesystem.read-write",
+    "command.execute",
+    "media.image.inspect"
+  ],
+  "runtime": {
+    "node": ">=22",
+    "dependencies": []
+  },
+  "adapters": {
+    "generic": {
+      "status": "implemented",
+      "destination": "caller-resolved explicit exact directory"
+    }
+  }
+}

package/lib/cli.mjs

@@ -0,0 +1,53 @@
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import * as core from './core.mjs';
+
+export async function main(args) {
+  const words=[],options={};
+  for(let i=0;i<args.length;i++){
+    const arg=args[i];
+    if(arg==='--version'){words.push('version');continue;}
+    if(!arg.startsWith('--')){words.push(arg);continue;}
+    const key=arg.slice(2);
+    if(Object.hasOwn(options,key))core.fail('INVALID_ARGUMENT','Duplicate option: '+arg);
+    if(['json','yes','help'].includes(key))options[key]=true;
+    else {
+      if(!args[i+1]||args[i+1].startsWith('--'))core.fail('INVALID_ARGUMENT','Missing value for '+arg);
+      options[key]=args[++i];
+    }
+  }
+  const command=words.join(' ')||'help';
+  const manifest=core.readJSON(path.join(core.root,'capabilities.json'));
+  const contract=manifest.commandContracts[command];
+  if(!contract)core.fail('INVALID_ARGUMENT','Unknown command: '+command);
+  for(const key of Object.keys(options))if(!Object.hasOwn(contract.options,'--'+key))core.fail('INVALID_ARGUMENT','Unsupported option --'+key);
+  if(options.name&&options.name!==core.name)core.fail('SKILL_NOT_FOUND',options.name);
+  let result;
+  if(command==='help'||options.help)result={...manifest,commands:manifest.commandContracts,options:contract.options};
+  else if(command==='version')result={ok:true,package:core.pkg.name,version:core.pkg.version};
+  else if(command==='capabilities')result=manifest;
+  else if(command==='install-notice')result={ok:true,partial:true,message:'Read INSTALL.md and UPDATE.md. Resolve skill source, install the complete Skill and runtime into the current Agent’s explicit directory, and verify host discovery.'};
+  else if(command==='doctor')result=core.doctor();
+  else if(command==='prepare')result={...core.doctor(),update:await core.checkUpdate(options,true)};
+  else if(command==='skill source'){
+    const item={ok:true,name:core.name,package:core.pkg.name,version:core.pkg.version,source:core.source,path:core.source};
+    result={...manifest,...item,complete:true,sources:[item],provenance:{ownership:core.exists(path.join(core.root,'.git'))?'git-source':'package',registryContentVerified:false}};
+  }else if(command==='skill status')result=core.status(options);
+  else if(command==='skill install'||command==='skill update')result=core.install(options);
+  else if(command==='update check')result=await core.checkUpdate(options);
+  else if(command==='update status'||command==='update policy')result=core.updatePolicy(options);
+  else if(command==='update operation')result=core.updateOperation(options);
+  else if(command==='update resume')result=core.resume(options);
+  else if(command==='update rollback')result=core.rollback(options);
+  else if(command==='update install')result=await core.update(options);
+  else if(command==='asset check'||command==='asset write'){
+    const required=command==='asset check'?['guide']:['directory','plan'];
+    for(const field of required)if(!options[field])core.fail('INVALID_ARGUMENT','Missing --'+field);
+    const operation=command==='asset check'?['check',options.guide]:['write',options.directory,options.plan];
+    const child=spawnSync(process.execPath,[path.join(core.source,'scripts/asset-guide.mjs'),...operation],{encoding:'utf8',timeout:30000,windowsHide:true});
+    try{result=JSON.parse(child.stdout||child.stderr);}catch{core.fail('ASSET_OPERATION_FAILED','Asset tool returned no structured result');}
+    if(child.status!==0)process.exitCode=1;
+  }
+  process.stdout.write(command==='version'&&!options.json?core.pkg.version+'\n':JSON.stringify(result,null,2)+'\n');
+  if(result?.ok===false)process.exitCode=1;
+}

package/lib/core.mjs

@@ -0,0 +1,280 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+
+export const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+export const name = pkg.name.split('/')[1];
+export const source = path.join(root, 'skills', name);
+export const receiptName = '.product-skill-install.json';
+export const readJSON = p => JSON.parse(fs.readFileSync(p, 'utf8'));
+export const exists = p => {try {fs.lstatSync(p); return true;} catch(e) {if(e.code==='ENOENT') return false; throw e;}};
+export function fail(code, message, details={}) {throw Object.assign(new Error(message), {code, details});}
+export function create(p, bytes) {if(exists(p)) fail('TARGET_EXISTS', 'Refusing existing file', {path:p}); fs.mkdirSync(path.dirname(p),{recursive:true}); fs.writeFileSync(p,bytes,{flag:'wx'});}
+export function files(dir, prefix='') {
+  return fs.readdirSync(dir,{withFileTypes:true}).sort((a,b)=>a.name.localeCompare(b.name)).flatMap(d=>{
+    const rel=path.posix.join(prefix,d.name), p=path.join(dir,d.name);
+    if(d.isSymbolicLink()) fail('UNSAFE_LINK','Symbolic links are not distributable resources',{path:p});
+    if(!d.isDirectory()&&!d.isFile()) fail('UNSAFE_RESOURCE','Expected a regular file',{path:p});
+    return d.isDirectory()?files(p,rel):[rel];
+  });
+}
+export const hash = p => crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex');
+export function hashes(dir) {return Object.fromEntries(files(dir).map(f=>[f,hash(path.join(dir,f))]));}
+export function copy(from,to) {if(exists(to)) fail('TARGET_EXISTS','Copy destination exists',{path:to}); fs.cpSync(from,to,{recursive:true,dereference:false,errorOnExist:true,force:false});}
+export function targetOf(o) {
+  if(!o.agent || !/^[a-z][a-z0-9-]{0,63}$/.test(o.agent)) fail('INVALID_AGENT','Supply a valid Agent identifier and its resolved --target');
+  if(!o.target || !path.isAbsolute(o.target)) fail('TARGET_REQUIRED','--target must be the absolute exact Skill directory resolved by the current Agent');
+  const t=path.resolve(o.target);
+  const ownInstalledRuntime = root===path.join(t,'.runtime');
+  if(t===path.parse(t).root || t===os.homedir() || t===root || t===source || (!ownInstalledRuntime&&root.startsWith(t+path.sep)) || t.startsWith(root+path.sep)) fail('UNSAFE_TARGET','Target overlaps a protected or source directory');
+  let p=path.dirname(t);
+  while(p!==path.dirname(p)) {if(exists(p)&&fs.lstatSync(p).isSymbolicLink()) fail('UNSAFE_TARGET','Parent path contains a symlink',{path:p}); p=path.dirname(p);}
+  return t;
+}
+export function operation(target) {
+  const p=target+'.operation.json';
+  if(!exists(p)) return null;
+  if(fs.lstatSync(p).isSymbolicLink()) fail('UNMANAGED_OPERATION','Operation record is a symlink');
+  const data=readJSON(p);
+  if(data.package!==pkg.name||data.target!==target) fail('UNMANAGED_OPERATION','Operation record belongs to another owner',{path:p});
+  return data;
+}
+function saveOperation(target,fields) {
+  const previous=operation(target),p=target+'.operation.json';
+  if(previous) fs.renameSync(p,p+'.backup-'+crypto.randomUUID());
+  create(p,JSON.stringify({...previous,...fields,package:pkg.name,target,updatedAt:new Date().toISOString()},null,2)+'\n');
+}
+export function status(o) {
+  const target=targetOf(o), installed=exists(target), rp=path.join(target,receiptName);
+  const op=operation(target),pending=Boolean(op&&op.phase!=='complete');
+  let receipt=null;
+  if(installed && !fs.lstatSync(target).isSymbolicLink() && exists(rp)) {
+    try {receipt=readJSON(rp);}catch {fail('INVALID_RECEIPT','Receipt is malformed; preserve it before recovery',{path:rp});}
+  }
+  const managed=Boolean(receipt?.package===pkg.name && receipt?.name===name && receipt?.target===target && receipt?.agent===o.agent);
+  if(managed && (!receipt.hashes || typeof receipt.hashes!=='object' || Object.entries(receipt.hashes).some(([f,h])=>path.isAbsolute(f)||f.split(/[\\/]/).includes('..')||typeof h!=='string'||!/^[a-f0-9]{64}$/.test(h)))) fail('INVALID_RECEIPT','Receipt hashes missing or unsafe');
+  const edited=managed?Object.entries(receipt.hashes).filter(([f,h])=>exists(path.join(target,f)) && (fs.lstatSync(path.join(target,f)).isSymbolicLink() || hash(path.join(target,f))!==h)).map(([f])=>f):[];
+  const missing=managed?Object.keys(receipt.hashes).filter(f=>!exists(path.join(target,f))):[];
+  const canonical=managed && Object.entries(hashes(source)).filter(([f])=>!f.startsWith('agents/')).every(([f,h])=>exists(path.join(target,f))&&hash(path.join(target,f))===h) && runtimeFiles().every(f=>exists(path.join(target,'.runtime',f))&&hash(path.join(target,'.runtime',f))===hash(path.join(root,f))) && exists(path.join(target,'.runtime/skill-integrity.json')) && hash(path.join(target,'.runtime/skill-integrity.json'))===hash(path.join(root,'skill-integrity.json'));
+  const verified=managed && edited.length===0 && missing.length===0;
+  return {ok:true,name,package:pkg.name,version:pkg.version,installedVersion:receipt?.version??null,target,agent:o.agent,installed,managed,current:Boolean(verified&&canonical&&receipt.version===pkg.version&&!pending),edited,missing,owner:receipt?.owner??'self',verification:{verified,algorithm:'sha256'},recovery:{required:pending||(managed&&!verified),backup:op?.backup??receipt?.backup??null,operation:op},entry:path.join(target,'.runtime','bin',name+'.mjs'),hostDiscovery:{authority:'host',status:'pending'}};
+}
+export function install(o) {
+  const before=status(o), t=before.target;
+  if(before.installed&&!before.managed) fail('UNMANAGED_TARGET','Existing Skill is user-owned; move it to a verified backup before installing',{target:t});
+  if(before.edited.length) fail('LOCAL_EDITS','Managed files have local edits; preserve and reconcile them first',{edited:before.edited});
+  if(before.current) return {...before,changed:false};
+  if(!doctor().ok) fail('SOURCE_INTEGRITY_FAILED','Verify the acquired package before installation');
+  fs.mkdirSync(path.dirname(t),{recursive:true});
+  const lock=t+'.install-lock';
+  try {fs.mkdirSync(lock);} catch(e) {if(e.code==='EEXIST') fail('LOCKED','Another maintenance operation may be active',{lock});throw e;}
+  let stage,backup=before.recovery.required?before.recovery.backup:null,activated=false;
+  try {
+    stage=fs.mkdtempSync(t+'.stage-');
+    for(const f of files(source)) {const p=path.join(stage,f);fs.mkdirSync(path.dirname(p),{recursive:true});fs.copyFileSync(path.join(source,f),p,fs.constants.COPYFILE_EXCL);}
+    const runtime=path.join(stage,'.runtime');fs.mkdirSync(runtime);
+    for(const f of [...runtimeFiles(),'skill-integrity.json']) {const p=path.join(runtime,f);fs.mkdirSync(path.dirname(p),{recursive:true});fs.copyFileSync(path.join(root,f),p,fs.constants.COPYFILE_EXCL);}
+    if(before.installed) {
+      const again=status(o);
+      if(again.edited.length||!again.managed) fail('LOCAL_EDITS','Concurrent modification detected');
+      backup=fs.mkdtempSync(t+'.backup-');
+      copy(t,path.join(backup,'skill'));
+      for(const f of files(t)) {
+        if(f===receiptName || f.startsWith('agents/') || f.startsWith('.runtime/') || Object.hasOwn(readJSON(path.join(t,receiptName)).hashes,f)) continue;
+        if(exists(path.join(stage,f))) fail('UNMANAGED_COLLISION','Unmanaged file collides with new managed resource',{file:f,backup});
+        fs.mkdirSync(path.dirname(path.join(stage,f)),{recursive:true});fs.copyFileSync(path.join(t,f),path.join(stage,f));
+      }
+      const metadata=path.join(t,'agents');
+      if(exists(metadata)) fs.cpSync(metadata,path.join(stage,'agents'),{recursive:true,force:true});
+    }
+    const owned=Object.keys(hashes(source)).filter(f=>!f.startsWith('agents/')).concat([...runtimeFiles(),'skill-integrity.json'].map(f=>'.runtime/'+f));
+    const digest=Object.fromEntries(owned.map(f=>[f,hash(path.join(stage,f))]));
+    create(path.join(stage,receiptName),JSON.stringify({schemaVersion:1,name,package:pkg.name,version:pkg.version,target:t,agent:o.agent,owner:o.owner??before.owner,hashes:digest,backup,installedAt:new Date().toISOString()},null,2)+'\n');
+    saveOperation(t,{phase:'synchronizing',agent:o.agent,version:pkg.version,backup});
+    if(before.installed) {
+      try {fs.renameSync(t,path.join(backup,'previous'));activated=true;}
+      catch(e) {
+        if(!['EPERM','EACCES','EBUSY'].includes(e.code)) throw e;
+        activated=true;
+        // Recoverable copy fallback for a live host that locks directory rename.
+        const old=readJSON(path.join(t,receiptName));
+        for(const f of Object.keys(old.hashes)) if(exists(path.join(t,f))) fs.rmSync(path.join(t,f),{force:true});
+        fs.rmSync(path.join(t,receiptName));
+        fs.cpSync(stage,t,{recursive:true,force:true});
+        fs.rmSync(stage,{recursive:true});stage=null;
+      }
+    }
+    if(stage) {fs.renameSync(stage,t);stage=null;activated=true;}
+    const verified=status(o);
+    if(!verified.verification.verified) fail('VERIFICATION_FAILED','Skill synchronization incomplete',{backup,target:t});
+    saveOperation(t,{phase:'complete',agent:o.agent,version:pkg.version,backup});
+    return {...status(o),changed:true,backup,physicalCopy:true};
+  } catch(e) {
+    if(activated&&backup&&exists(path.join(backup,'skill'))) {
+      if(exists(t)) fs.rmSync(t,{recursive:true,force:true});
+      copy(path.join(backup,'skill'),t);
+    }
+    if(operation(t)) saveOperation(t,{phase:'failed-sync',backup,error:e.code??'SYSTEM_ERROR'});
+    e.details={...e.details,backup,target:t,recovery:backup?'Original copy is in backup/skill; inspect state before retrying':'Inspect target and lock before retrying'};
+    throw e;
+  } finally {if(stage&&exists(stage)) fs.rmSync(stage,{recursive:true,force:true});fs.rmSync(lock,{recursive:true,force:true});}
+}
+export function runtimeFiles() {
+  return ['package.json','capabilities.json','README.md','INSTALL.md','UPDATE.md','THIRD_PARTY_NOTICES.md',...['bin','lib','skills'].flatMap(d=>files(path.join(root,d)).map(f=>d+'/'+f))];
+}
+export function doctor() {
+  const expected=readJSON(path.join(root,'skill-integrity.json'));
+  const observed=Object.fromEntries(runtimeFiles().map(file=>[file,hash(path.join(root,file))]));
+  const valid=Object.keys(expected).length===Object.keys(observed).length&&Object.entries(expected).every(([file,value])=>observed[file]===value);
+  return {ok:valid,package:pkg.name,version:pkg.version,node:process.version,local_ready:valid,
+    integrity:{verified:valid,algorithm:'sha256'},service_access:'not-probed',hostDiscovery:{authority:'host',status:'pending'}};
+}
+function cacheDir(o={}) {
+  const value=o['state-dir']??process.env.PRODUCT_SKILL_STATE_DIR??path.join(os.homedir(),'.local','state',name);
+  if(!path.isAbsolute(value)) fail('INVALID_INPUT','State directory must be absolute');
+  return value;
+}
+function policy(o) {
+  const file=path.join(cacheDir(o),'update-policy.json');
+  const data=exists(file)?readJSON(file):{mode:'notify'};
+  if(!['off','notify'].includes(data.mode)) fail('INVALID_POLICY','Preserve invalid update policy before repair');
+  return data;
+}
+export function updatePolicy(o) {
+  const current=policy(o);
+  if(o.mode){
+    if(!o.yes) fail('CONFIRMATION_REQUIRED','Policy changes require --yes');
+    if(!['off','notify'].includes(o.mode)) fail('INVALID_ARGUMENT','Policy supports off or notify');
+    const file=path.join(cacheDir(o),'update-policy.json');
+    if(exists(file)) fs.renameSync(file,file+'.backup-'+crypto.randomUUID());
+    create(file,JSON.stringify({mode:o.mode})+'\n');
+  }
+  return {ok:true,mode:o.mode??current.mode,automaticInstall:false,channel:'latest',timeoutMs:1500,ttlHours:24,disable:'AGENT_PACKAGE_UPDATE_CHECK=0',owner:runtimeOwner()};
+}
+function runtimeOwner() {
+  const receipt=path.join(root,'..',receiptName);
+  return exists(receipt)?readJSON(receipt).owner??'self':'self';
+}
+export function compareVersions(a,b) {
+  const aa=a.split('.').map(Number),bb=b.split('.').map(Number);
+  for(let i=0;i<3;i++) if(aa[i]!==bb[i]) return aa[i]-bb[i];
+  return 0;
+}
+async function queryRegistry() {
+  const url=process.env.PRODUCT_SKILL_REGISTRY_URL??'https://registry.npmjs.org';
+  try {
+    const response=await fetch(url+'/'+encodeURIComponent(pkg.name)+'/latest',{signal:AbortSignal.timeout(1500)});
+    if(!response.ok) throw Error('registry-status-'+response.status);
+    const data=await response.json();
+    if(data.name!==pkg.name||!/^\d+\.\d+\.\d+$/.test(data.version)) throw Error('invalid-registry-identity');
+    return {ok:true,package:pkg.name,current:pkg.version,latest:data.version,available:compareVersions(data.version,pkg.version)>0,checkedAt:Date.now(),channel:'latest',automaticInstall:false};
+  } catch {
+    return {ok:false,code:'REGISTRY_UNAVAILABLE',checkedAt:Date.now(),retained:true};
+  }
+}
+export async function checkUpdate(o={},automatic=false) {
+  if(runtimeOwner()!=='self') return {ok:true,deferred:true,owner:runtimeOwner(),reason:'parent-managed'};
+  if(process.env.AGENT_PACKAGE_UPDATE_CHECK==='0') return {ok:true,disabled:true};
+  const settings=policy(o);
+  if(automatic&&settings.mode==='off') return {ok:true,disabled:true};
+  if(!automatic) return queryRegistry();
+  const dir=cacheDir(o),cache=path.join(dir,'update-cache.json');
+  let previous=null;
+  if(exists(cache)){
+    try{previous=readJSON(cache);}catch{return {ok:false,code:'INVALID_CACHE',cache,preserved:true};}
+    if(typeof previous.checkedAt!=='number'||previous.package!==pkg.name) return {ok:false,code:'INVALID_CACHE',cache,preserved:true};
+    const ttl=previous.ok?86400000:300000;
+    if(Date.now()-previous.checkedAt<ttl) return {...previous,cached:true};
+  }
+  fs.mkdirSync(dir,{recursive:true});
+  const lock=path.join(dir,'update-check-lock');
+  try{fs.mkdirSync(lock);}catch(e){if(e.code==='EEXIST')return {ok:true,deferred:true,reason:'concurrent-check'};throw e;}
+  try{
+    const result={...await queryRegistry(),package:pkg.name};
+    const pending=path.join(dir,'update-cache-'+crypto.randomUUID()+'.json');
+    create(pending,JSON.stringify(result)+'\n');
+    if(exists(cache)) fs.renameSync(cache,cache+'.previous-'+crypto.randomUUID());
+    fs.renameSync(pending,cache);
+    return result;
+  }finally{fs.rmSync(lock,{recursive:true,force:true});}
+}
+function npmEntry() {
+  if(process.env.npm_execpath?.endsWith('npm-cli.js')&&exists(process.env.npm_execpath)) return process.env.npm_execpath;
+  for(const directory of (process.env.PATH??'').split(path.delimiter)){
+    for(const command of process.platform==='win32'?['npm.cmd','npm']:['npm']){
+      const file=path.join(directory,command);
+      if(!exists(file))continue;
+      const real=fs.realpathSync(file);
+      const candidates=[real,path.join(path.dirname(real),'node_modules/npm/bin/npm-cli.js'),path.join(path.dirname(real),'../lib/node_modules/npm/bin/npm-cli.js')];
+      const entry=candidates.find(candidate=>candidate.endsWith('npm-cli.js')&&exists(candidate));
+      if(entry)return entry;
+    }
+  }
+  fail('NPM_UNAVAILABLE','A stable npm CLI is required for package acquisition');
+}
+export function updateOperation(o) {
+  const target=targetOf(o);
+  return {ok:true,package:pkg.name,version:pkg.version,target,operation:operation(target),hostDiscovery:{authority:'host',status:'pending'}};
+}
+export function resume(o) {
+  const before=status(o),op=operation(before.target);
+  if(!o.yes)fail('CONFIRMATION_REQUIRED','Recovery requires --yes');
+  if(before.edited.length)fail('LOCAL_EDITS','Preserve edits before recovery',{edited:before.edited});
+  if(!op?.candidateEntry||!exists(op.candidateEntry)) fail('RECOVERY_REQUIRED','No acquired candidate entry; inspect operation or roll back',{operation:op});
+  const actual=readJSON(path.join(path.dirname(op.candidateEntry),'../package.json'));
+  if(actual.name!==pkg.name||actual.version!==op.to) fail('VERSION_MISMATCH','Recorded candidate identity mismatch');
+  const sync=spawnSync(process.execPath,[op.candidateEntry,'skill','update','--agent',o.agent,'--target',before.target,'--json'],{encoding:'utf8',timeout:120000,windowsHide:true,env:{...process.env,AGENT_PACKAGE_UPDATE_CHECK:'0'}});
+  let data;
+  try{data=JSON.parse(sync.stdout||sync.stderr);}catch{}
+  if(sync.status!==0||data?.current!==true) fail('SKILL_SYNC_FAILED','Verified candidate retained; resume without another npm installation',{stage:'skill-synchronization',exitCode:sync.status,child:data,operation:op});
+  return {ok:true,package:pkg.name,version:actual.version,packageChanged:true,transaction:op.transaction,entry:data.entry,synchronization:data,hostDiscovery:{authority:'host',status:'pending'}};
+}
+export function rollback(o) {
+  if(!o.yes)fail('CONFIRMATION_REQUIRED','Rollback requires --yes');
+  const before=status(o),op=operation(before.target),snapshot=op?.transaction&&path.join(op.transaction,'before');
+  if(before.edited.length)fail('LOCAL_EDITS','Preserve edits before rollback',{edited:before.edited});
+  if(!snapshot||!exists(snapshot)) fail('RECOVERY_REQUIRED','No pre-acquisition snapshot exists',{operation:op});
+  files(snapshot);
+  const pending=fs.mkdtempSync(before.target+'.rollback-');
+  copy(snapshot,path.join(pending,'restored'));
+  const held=path.join(pending,'previous');
+  if(exists(before.target))fs.renameSync(before.target,held);
+  try{fs.renameSync(path.join(pending,'restored'),before.target);}
+  catch(error){if(exists(held))fs.renameSync(held,before.target);throw error;}
+  saveOperation(before.target,{phase:'complete',rolledBack:true});
+  return {...status(o),rolledBack:true,backup:pending};
+}
+export async function update(o) {
+  if(!o.yes)fail('CONFIRMATION_REQUIRED','Package update requires --yes');
+  const before=status(o);
+  if(before.owner!=='self')fail('PARENT_MANAGED','Update this installation through its collection owner',{owner:before.owner});
+  if(before.installed&&!before.managed)fail('UNMANAGED_TARGET','Resolve existing user-owned target before acquisition');
+  if(before.edited.length)fail('LOCAL_EDITS','Reconcile local edits before package acquisition',{edited:before.edited});
+  const previous=operation(before.target);
+  if(previous&&previous.phase!=='complete')fail('RECOVERY_REQUIRED','Inspect the original operation; resume or roll back without acquiring again',{operation:previous});
+  if(exists(path.join(root,'.git')))fail('SOURCE_CHECKOUT','Update this source checkout through Git; install a packed version for package maintenance');
+  const check=o['package-file']?null:await checkUpdate(o);
+  if(check&&!check.ok)fail(check.code,'Registry evidence unavailable; current installation retained');
+  if(check&&!check.available)return {...install(o),packageChanged:false,update:check};
+  if(o['package-file']&&(!path.isAbsolute(o['package-file'])||!exists(o['package-file'])))fail('INVALID_INPUT','--package-file must identify an existing absolute tarball');
+  fs.mkdirSync(path.dirname(before.target),{recursive:true});
+  const lock=before.target+'.update-lock';
+  try{fs.mkdirSync(lock);}catch(e){if(e.code==='EEXIST')fail('LOCKED','Package acquisition is already active');throw e;}
+  try{
+    const transaction=fs.mkdtempSync(before.target+'.update-');
+    if(before.installed)copy(before.target,path.join(transaction,'before'));
+    const candidate=path.join(transaction,'candidate/node_modules',...pkg.name.split('/'));
+    const candidateEntry=path.join(candidate,'bin',name+'.mjs');
+    saveOperation(before.target,{phase:'acquisition',agent:o.agent,from:pkg.version,to:check?.latest??null,transaction,preReplacementBackup:before.installed?path.join(transaction,'before'):null,candidateEntry});
+    const result=spawnSync(process.execPath,[npmEntry(),'install','--prefix',path.join(transaction,'candidate'),'--ignore-scripts','--no-audit','--no-fund',o['package-file']??pkg.name+'@'+check.latest],{encoding:'utf8',timeout:120000,windowsHide:true,env:{...process.env,npm_config_dry_run:'false',npm_config_json:'false'}});
+    if(result.status!==0)fail('ACQUISITION_FAILED','npm acquisition failed; original target retained',{stage:'package-acquisition',exitCode:result.status,signal:result.signal,transaction});
+    const actual=readJSON(path.join(candidate,'package.json'));
+    if(actual.name!==pkg.name||!/^\d+\.\d+\.\d+$/.test(actual.version)||compareVersions(actual.version,pkg.version)<0||check&&actual.version!==check.latest)fail('VERSION_MISMATCH','Candidate identity mismatch; original target retained',{transaction});
+    saveOperation(before.target,{phase:'candidate-ready',to:actual.version});
+    return resume(o);
+  }finally{fs.rmSync(lock,{recursive:true,force:true});}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@petercjl/product-asset-set",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Build reusable product reference image sets.",
   "license": "UNLICENSED",
   "repository": {
@@ -14,7 +14,13 @@
     "skills",
     "INSTALL.md",
     "UPDATE.md",
-    "scripts/verify-package.mjs"
+    "scripts/verify-package.mjs",
+    "bin",
+    "lib",
+    "capabilities.json",
+    "skill-integrity.json",
+    "THIRD_PARTY_NOTICES.md",
+    "scripts/sync-version.mjs"
   ],
   "publishConfig": {
     "access": "public"
@@ -27,13 +33,19 @@
         "path": "skills/product-asset-set"
       }
     ],
-    "installation": "host-managed-physical-copy",
+    "installation": "managed-physical-copy",
     "installGuide": "INSTALL.md",
     "updateGuide": "UPDATE.md"
   },
   "scripts": {
     "check": "node scripts/verify-package.mjs",
     "prepack": "node scripts/verify-package.mjs",
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs",
+    "version": "node scripts/sync-version.mjs --write",
+    "postinstall": "node bin/product-asset-set.mjs install-notice"
+  },
+  "type": "module",
+  "bin": {
+    "product-asset-set": "bin/product-asset-set.mjs"
   }
 }

package/scripts/sync-version.mjs

@@ -0,0 +1,39 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
+const name=pkg.name.split('/')[1];
+function inventory(dir,prefix=''){
+ return fs.readdirSync(dir,{withFileTypes:true}).sort((a,b)=>a.name.localeCompare(b.name)).flatMap(item=>{
+  const rel=path.posix.join(prefix,item.name),file=path.join(dir,item.name);
+  if(item.isDirectory())return inventory(file,rel);
+  if(!item.isFile())throw Error('Only physical resources are distributable: '+file);
+  return [rel];
+ });
+}
+const resources=['package.json','capabilities.json','README.md','INSTALL.md','UPDATE.md','THIRD_PARTY_NOTICES.md',...['bin','lib','skills'].flatMap(dir=>inventory(path.join(root,dir)).map(file=>dir+'/'+file))];
+if(process.argv.includes('--write')){
+ const capFile=path.join(root,'capabilities.json');
+ const cap=JSON.parse(fs.readFileSync(capFile,'utf8'));
+ cap.version=pkg.version;
+ fs.writeFileSync(capFile,JSON.stringify(cap,null,2)+'\n');
+ const skill=path.join(root,'skills',name);
+ fs.writeFileSync(path.join(skill,'package.json'),JSON.stringify({name,version:pkg.version,package:pkg.name},null,2)+'\n');
+ const file=path.join(skill,'SKILL.md');
+ const text=fs.readFileSync(file,'utf8');
+ const frontmatter='metadata:\n  package: "'+pkg.name+'"\n  version: "'+pkg.version+'"\n';
+ fs.writeFileSync(file,text.replace(/\n(?:metadata:\n  package: .*\n  version: .*\n)?---\n/, '\n'+frontmatter+'---\n'));
+ const actual=[...new Set([...resources,'skills/'+name+'/package.json'])].sort();
+ const hashes=Object.fromEntries(actual.map(file=>[file,createHash('sha256').update(fs.readFileSync(path.join(root,file))).digest('hex')]));
+ fs.writeFileSync(path.join(root,'skill-integrity.json'),JSON.stringify(hashes,null,2)+'\n');
+}else{
+ const cap=JSON.parse(fs.readFileSync(path.join(root,'capabilities.json'),'utf8'));
+ const nested=JSON.parse(fs.readFileSync(path.join(root,'skills',name,'package.json'),'utf8'));
+ if(cap.package!==pkg.name||cap.version!==pkg.version||nested.version!==pkg.version||nested.package!==pkg.name)throw Error('Release identity mismatch');
+ const manifest=JSON.parse(fs.readFileSync(path.join(root,'skill-integrity.json'),'utf8'));
+ const actual=[...new Set(resources)].sort();
+ if(JSON.stringify(Object.keys(manifest).sort())!==JSON.stringify(actual))throw Error('Integrity scope drift');
+ for(const file of actual)if(manifest[file]!==createHash('sha256').update(fs.readFileSync(path.join(root,file))).digest('hex'))throw Error('Release integrity drift: '+file);
+}

package/scripts/verify-package.mjs

@@ -22,3 +22,10 @@ function verifyTree(directory) {
 verifyTree(skill.path);
 const result = spawnSync(process.execPath, ['--check', join(skill.path, 'scripts', 'asset-guide.mjs')], {stdio:'inherit'});
 assert.equal(result.status, 0);
+
+const identityCheck=spawnSync(process.execPath,['scripts/sync-version.mjs'],{stdio:'inherit'});
+assert.equal(identityCheck.status,0);
+assert.ok(pkg.bin[skill.name]);
+const metadata=spawnSync(process.execPath,[pkg.bin[skill.name],'version','--json'],{encoding:'utf8'});
+assert.equal(metadata.status,0);
+assert.equal(JSON.parse(metadata.stdout).version,pkg.version);

package/skill-integrity.json

@@ -0,0 +1,18 @@
+{
+  "INSTALL.md": "cb2478c191d82f35719bfe81bab0c901d2397a56a25b613b30fc006b6527bd5c",
+  "README.md": "416fbd27489b1a2af74e98a0caf62cb60fe32247e8efc9b3dc4ec91e3b08c20e",
+  "THIRD_PARTY_NOTICES.md": "a5034bf4b0b527c89ecc5b0c6fc9eef5869b94541b93c4e55bde1da47bf407b8",
+  "UPDATE.md": "6612edc7807be29ba8e9ea3a1814ed8afa29a7bb26ea6565568e0d242bd59058",
+  "bin/product-asset-set.mjs": "25cdc4f8f7dc59f31205cdaec7273a8362ce9eec728803131e724568b8b5fc0f",
+  "capabilities.json": "b837c7c51f9097e8734b4d513c0a7c8241bd0e20ee09906731fca6ff23d678f1",
+  "lib/cli.mjs": "f25d170ba55b703b3bdf476e0621c74a30eec75a246d34b9b490367c05aae07b",
+  "lib/core.mjs": "339dfcd79abebca4a776e8a6e8b907d6e6ce4a027dc3a4808596d5e9cd797260",
+  "package.json": "4846c15d5d8700c4abe0cc404c1b85e7444de7e2d3e23613912b71f2fdf34f5a",
+  "skills/product-asset-set/SKILL.md": "8de7a640e9381e4215723c555411379cea3e5224d145ee20048de0842be1f981",
+  "skills/product-asset-set/adapters/generic.json": "38258c58db4b17105b1018c7aab9e00e59a372267f525005ddc2027f735e123a",
+  "skills/product-asset-set/agents/openai.yaml": "67bd446b7e2b81468af6cf5d968c7130f8f045161604223913ac0b32ddf94f77",
+  "skills/product-asset-set/capabilities.json": "81f067f1d6e070bd9cde5cbf2ae2283bf36eaf6f46ec9204d9982e4e3ca4d100",
+  "skills/product-asset-set/package.json": "682d712ad9da337679e37344f70bdb23e2952f0773ed18c2c2629e4a132b15c4",
+  "skills/product-asset-set/references/asset-format.md": "0719d9457ed59418e578925c16cc27bee38d10d4b1161cb5dd94293bd591c9d4",
+  "skills/product-asset-set/scripts/asset-guide.mjs": "412e4827b09def5e8532be566173029e36f36e00783739551c1eeb7a9404f555"
+}

package/skills/product-asset-set/SKILL.md

@@ -1,12 +1,17 @@
 ---
 name: product-asset-set
 description: 从产品原图、使用场景或详情页制作可复用的独立高清产品参考图组，交付资产说明.txt，支持逐张验收、修订和定稿。
+metadata:
+  package: "@petercjl/product-asset-set"
+  version: "0.1.2"
 ---
 
 # 产品资产生成
 
 输入是产品资料、可选的指定款色与形态基准。交付一个版本目录，包含独立高清 PNG 和一份 UTF-8 `资产说明.txt`。Agent 根据每张图的产品自然形态、拍摄角度和证据用途独立选择画幅，同一图组可同时包含横图、竖图和方图。用户明确指定的尺寸优先；与关键证据完整性冲突时说明取舍并确认。结束时提供版本目录、各图链接及用途；若用户想继续替换，提示另行提供目标场景和这套资产。
 
+普通任务入口先执行 `node <本 Skill 目录>/.runtime/bin/product-asset-set.mjs prepare --json`，进行有界更新检测及本地诊断；源码开发使用包内 bin 入口。父集合管理的安装由所属集合统一更新。安装、更新和恢复遵循包根目录 INSTALL.md / UPDATE.md，执行入口为当前目标自有运行时。
+
 1. **核对来源与形态。** 逐个打开实际文件，记录路径、编号、哈希和观察。每个查看结果与同次调用的文件标识绑定；文件名与描述冲突时，单独重开该文件核实。详情页查看全部商品相关区域，必要时按原像素裁切。比较轮廓、比例和可见结构，区分透视、遮挡与正常受压。如果有真实冲突或无法排除冲突，展示对应原图，等待用户指定基准对象；已有明确选择则复用。记录基准与相关素材各自的证据职责。
 2. **规划独立图片。** 至少包含一张完整全貌（`overall`）和一张有可辨参照物或人物的相对尺度（`scale`）。按新增证据规划 `structure`、`texture`、`marking` 或 `use`。同一用途优先留最清楚的一张。为每张分配稳定编号，列出画幅、目标尺寸、选择理由、证据来源、保留内容、编辑范围和验收点。先确定产品与必要参照物的自然朝向，再选择能完整容纳主体且主体占比足够的画幅。横向长条产品全貌优先评估 16:9 或 3:2，竖向产品或人物使用图优先评估 3:4、2:3 或 9:16，紧凑全貌和局部细节可用 1:1 或 4:3；按实际内容选择。产品的摆放、姿态和比例服从原始参考，避免为了适配画幅而旋转成长对角线、悬浮或改变产品形态。源图缺少必要证据时请求补图，可交付清楚标明缺口的阶段性预览。
 3. **先全貌，再逐张制作。** 优先用原照片和原人物、动作、场景。需要生成时，发现当前宿主的参考图编辑能力，核对所选画幅、服务支持的尺寸和费用，按授权每次生成一张。先对照原始基准验收全貌，再做依赖该全貌的图片。使用场景图由原图提供人物和使用关系，产品身份由基准参考提供。提示词聚焦构图和必要编辑，产品结构与材质服从参考。记录每张实际输出尺寸和比例。实际比例与计划略有偏差时，先看完整性与主体可读性；需要精确比例时仅采用保留关键证据的等比整理。逐张查看真实结果，验收身份、用途、清晰度和主体占比。每次调用记录原始输入、请求、可用的真实任务标识和结果；未知提交先查原任务。

package/skills/product-asset-set/capabilities.json

@@ -50,5 +50,9 @@
         "authorization": "Approved inputs, provider and generation budget"
       }
     }
-  ]
+  ],
+  "host_resolution": {
+    "fallback_adapter": "generic",
+    "destination": "caller-resolved explicit exact directory"
+  }
 }

package/skills/product-asset-set/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "product-asset-set",
+  "version": "0.1.2",
+  "package": "@petercjl/product-asset-set"
+}