@poping/yome 0.0.2 → 0.0.4

package/dist/yomeSkills/login.js

@@ -0,0 +1,221 @@
+// `yome login` — provider-agnostic Yome login.
+//
+// Yome's identity model: user accounts live in Supabase (auth.users); GitHub
+// (and later Apple, WeChat, email) are *providers* attached to that account.
+// The CLI cannot hold a Supabase session directly, so the flow is:
+//
+//   1. Run a provider-specific browser login (currently only GitHub Device
+//      Flow).
+//   2. Take the provider token (e.g. GitHub access_token), POST it to
+//      /api/cli/auth/exchange. The hub:
+//        a. verifies the provider token with the provider,
+//        b. looks up the matching Yome user (must already exist — i.e.
+//           the user must have logged in on the website at least once),
+//        c. mints a fresh opaque "yome_token" tied to the Yome user_id.
+//   3. Persist {yome_token, yome_user_id, provider, …} to ~/.yome/auth.json.
+//
+// All future hub calls (publish, install metrics, …) use the yome_token,
+// never the GitHub token. The GitHub token never touches disk.
+//
+// All network calls accept a `fetcher` argument so tests can mock them
+// without monkey-patching globalThis.
+import { writeAuthState } from './auth.js';
+const GITHUB_DEVICE_CODE_URL = 'https://github.com/login/device/code';
+const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
+// Public OAuth App client_id for the "Yome" GitHub App. Same App as the
+// website (Web Flow callback to /auth/github/callback) — Device Flow is
+// enabled on the same App, so CLI + browser login share one identity.
+// Client IDs are NOT secrets; safe to bake into the published CLI.
+const DEFAULT_CLIENT_ID = 'Ov23li25VzpbbfedkWOB';
+const DEFAULT_SCOPES = 'read:user';
+const DEFAULT_HUB_BASE = 'https://yome.work';
+export function getClientId() {
+    return process.env.YOME_GITHUB_CLIENT_ID || DEFAULT_CLIENT_ID;
+}
+export function getHubBase() {
+    return process.env.YOME_HUB_BASE || DEFAULT_HUB_BASE;
+}
+// Default fetcher.
+//
+// Node's bundled undici defaults to a 10-second `connectTimeout` which
+// is unrealistic for GitHub from networks with high TLS-handshake
+// latency (notably mainland China). We install a long-timeout dispatcher
+// so that `fetch()` won't abort during the TLS handshake.
+//
+// We use a dynamic import of undici from the Node internals; if for any
+// reason that fails (e.g. we're on a runtime without undici) we just
+// fall back to the bare fetch and rely on the request-side AbortController.
+let _patchedAgent;
+async function getDispatcher() {
+    if (_patchedAgent !== undefined)
+        return _patchedAgent ?? null;
+    try {
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore: built-in module not typed in lib
+        const undici = await import('node:undici').catch(() => null) ?? await import('undici').catch(() => null);
+        if (!undici || !undici.Agent) {
+            _patchedAgent = null;
+            return null;
+        }
+        const Agent = undici.Agent;
+        _patchedAgent = new Agent({
+            connect: { timeout: 60_000 },
+            headersTimeout: 60_000,
+            bodyTimeout: 60_000,
+        });
+        return _patchedAgent;
+    }
+    catch {
+        _patchedAgent = null;
+        return null;
+    }
+}
+const realFetcher = async (url, init) => {
+    // Per-call AbortController as belt-and-braces. `dispatcher` is the
+    // primary remedy (controls TLS-handshake time); the controller catches
+    // anything that slips past.
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), 90_000);
+    const dispatcher = await getDispatcher();
+    const finalInit = {
+        ...init,
+        signal: controller.signal,
+        // Add the dispatcher only when undici is available; fetch will
+        // ignore unknown keys when running on plain node.
+        ...(dispatcher ? { dispatcher } : {}),
+    };
+    try {
+        return await fetch(url, finalInit);
+    }
+    finally {
+        clearTimeout(t);
+    }
+};
+export async function performLogin(opts = {}) {
+    const clientId = opts.clientId ?? getClientId();
+    const scopes = opts.scopes ?? DEFAULT_SCOPES;
+    const fetcher = opts.fetcher ?? realFetcher;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const timeoutMs = opts.timeoutMs ?? 600_000;
+    const hubBase = (opts.hubBase ?? getHubBase()).replace(/\/+$/, '');
+    if (!clientId || clientId.startsWith('Iv1.PLACEHOLDER')) {
+        return {
+            ok: false,
+            code: 'no_client_id',
+            reason: 'YOME_GITHUB_CLIENT_ID is not configured. Ask a yome.work maintainer for the OAuth App client_id and re-run with that env var set.',
+        };
+    }
+    // ── Phase 1 — GitHub Device Flow → ephemeral GitHub token ──────────
+    const dcResp = await fetcher(GITHUB_DEVICE_CODE_URL, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({ client_id: clientId, scope: scopes }),
+    });
+    if (!dcResp.ok) {
+        return { ok: false, code: 'github_failed', reason: `device_code request failed: HTTP ${dcResp.status}` };
+    }
+    const dc = (await dcResp.json());
+    if (!dc.user_code || !dc.device_code) {
+        return { ok: false, code: 'github_failed', reason: 'device_code response missing fields' };
+    }
+    if (opts.onPrompt)
+        opts.onPrompt(dc);
+    else
+        printPrompt(dc);
+    let githubToken = null;
+    const start = Date.now();
+    let intervalMs = (opts.pollIntervalMs ?? dc.interval * 1000) || 5000;
+    while (Date.now() - start < timeoutMs) {
+        await sleep(intervalMs);
+        const tResp = await fetcher(GITHUB_TOKEN_URL, {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                client_id: clientId,
+                device_code: dc.device_code,
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            }),
+        });
+        if (!tResp.ok)
+            continue;
+        const tok = (await tResp.json());
+        if (tok.access_token) {
+            githubToken = tok.access_token;
+            break;
+        }
+        if (tok.error === 'authorization_pending')
+            continue;
+        if (tok.error === 'slow_down') {
+            intervalMs += 5000;
+            continue;
+        }
+        if (tok.error === 'access_denied')
+            return { ok: false, code: 'user_denied', reason: 'user denied authorisation' };
+        if (tok.error === 'expired_token')
+            return { ok: false, code: 'expired', reason: 'device code expired before authorisation' };
+        return { ok: false, code: 'github_failed', reason: tok.error_description || tok.error || 'unknown token error' };
+    }
+    if (!githubToken)
+        return { ok: false, code: 'timeout', reason: 'timed out waiting for authorisation' };
+    // ── Phase 2 — exchange GitHub token for a Yome CLI token ───────────
+    const exResp = await fetcher(`${hubBase}/api/cli/auth/exchange`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            provider: 'github',
+            github_token: githubToken,
+            client_label: defaultClientLabel(),
+        }),
+    });
+    let exJson;
+    try {
+        exJson = (await exResp.json());
+    }
+    catch {
+        return { ok: false, code: 'network', reason: `exchange returned non-JSON (HTTP ${exResp.status})` };
+    }
+    if (!exResp.ok || !exJson.ok || !exJson.yome_token || !exJson.user_id) {
+        if (exJson.code === 'yome_user_not_found') {
+            return {
+                ok: false,
+                code: 'yome_user_not_found',
+                reason: exJson.error ?? 'GitHub account is not linked to a Yome account yet — please sign in once at https://yome.work to link.',
+            };
+        }
+        return {
+            ok: false,
+            code: 'exchange_failed',
+            reason: exJson.error ?? `exchange failed: HTTP ${exResp.status}`,
+        };
+    }
+    const state = {
+        yome_token: exJson.yome_token,
+        yome_user_id: exJson.user_id,
+        provider: 'github',
+        provider_login: exJson.login,
+        expires_at: exJson.expires_at ?? '',
+        obtained_at: new Date().toISOString(),
+    };
+    writeAuthState(state);
+    return { ok: true, state };
+}
+function printPrompt(dc) {
+    console.log('');
+    console.log('  ─── GitHub authorisation required ───');
+    console.log(`    Open: ${dc.verification_uri}`);
+    console.log(`    Code: ${dc.user_code}`);
+    console.log(`  (Code expires in ${Math.round(dc.expires_in / 60)} minutes)`);
+    console.log('');
+    console.log('Waiting for you to authorise…');
+}
+function defaultClientLabel() {
+    // "yome-cli on darwin"   → cheap human-readable hint for the future
+    // "active sessions" panel on the website. Not security-critical.
+    try {
+        return `yome-cli on ${process.platform}`;
+    }
+    catch {
+        return 'yome-cli';
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/yomeSkills/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/yomeSkills/login.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,cAAc;AACd,sEAAsE;AACtE,wCAAwC;AACxC,2DAA2D;AAC3D,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,sCAAsC;AAEtC,OAAO,EAAE,cAAc,EAAsB,MAAM,WAAW,CAAC;AAE/D,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAEvE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,iBAAiB,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC;AACvD,CAAC;AAoCD,mBAAmB;AACnB,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,yEAAyE;AACzE,0DAA0D;AAC1D,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,4EAA4E;AAE5E,IAAI,aAAsB,CAAC;AAC3B,KAAK,UAAU,aAAa;IAC1B,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAwB,IAAI,IAAI,CAAC;IACzE,IAAI,CAAC;QACH,6DAA6D;QAC7D,+CAA+C;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,IAAI,CAAE,MAAqD,CAAC,KAAK,EAAE,CAAC;YAC7E,aAAa,GAAG,IAAI,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAI,MAAoD,CAAC,KAAK,CAAC;QAC1E,aAAa,GAAG,IAAI,KAAK,CAAC;YACxB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,cAAc,EAAE,MAAM;YACtB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;IACzC,MAAM,SAAS,GAAgB;QAC7B,GAAG,IAAI;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,+DAA+D;QAC/D,kDAAkD;QAClD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvB,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AA4BF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEnE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,mIAAmI;SAC5I,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3G,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAmB,CAAC;IACnD,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;QAChC,WAAW,CAAC,EAAE,CAAC,CAAC;IAErB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,UAAU,EAAE,8CAA8C;aAC3D,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAc,CAAC;QAC9C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAAC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;YAAC,MAAM;QAAC,CAAC;QAChE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAAC,UAAU,IAAI,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClH,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QAC7H,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAEvG,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,wBAAwB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,kBAAkB,EAAE;SACnC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAiB,CAAC;IAAC,CAAC;IACvD,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAAC,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,wGAAwG;aACjI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,yBAAyB,MAAM,CAAC,MAAM,EAAE;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAkB;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,OAAO;QAC5B,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,MAAM,CAAC,KAAK;QAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB;IACzB,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,CAAC;QACH,OAAO,eAAe,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/yomeSkills/manifest.d.ts

@@ -0,0 +1,60 @@
+export interface SkillCommandSummary {
+    action: string;
+    desc?: string;
+    since?: string;
+}
+export interface SkillManifest {
+    schemaVersion?: number;
+    slug: string;
+    name?: string;
+    description?: string;
+    domain: string;
+    version: string;
+    official?: boolean;
+    homepage?: string;
+    repo?: string;
+    /**
+     * Structured L1 documentation — what the LLM sees in its system prompt
+     * for this skill. Three short fields, each one-line, each answers one
+     * specific question the model has when deciding whether to invoke:
+     *
+     *   when    — "user wants to ..."  (the trigger condition)
+     *   entry   — first command to discover the rest (typically `<domain> --help`)
+     *   effects — truthful side-effects so the model can warn / batch correctly
+     *
+     * Renderer (cli/src/context.ts → buildHubSkillsSection) emits a 3-row
+     * pipe-aligned block; if l1 is absent we fall back to `prompt_line`,
+     * then to `<domain> — <description>`.
+     */
+    l1?: {
+        when?: string;
+        entry?: string;
+        effects?: string;
+    };
+    /**
+     * Legacy single-line "elevator pitch". Used only as a fallback when
+     * `l1` is not provided. New skills should prefer `l1`.
+     */
+    prompt_line?: string;
+    platforms?: string[];
+    delivery?: Record<string, unknown>;
+    capabilities?: string[];
+    /** OS-level resources the skill needs (M9 security model). One of:
+     *  fs:read, fs:write, fs:delete, applescript, network, shell. */
+    system_capabilities?: string[];
+    tags?: string[];
+    license?: string;
+    author?: {
+        name?: string;
+        email?: string;
+        github?: string;
+    };
+    commands?: SkillCommandSummary[];
+}
+export declare function readManifest(skillDir: string): SkillManifest | null;
+export interface ValidationResult {
+    ok: boolean;
+    errors: string[];
+}
+/** Validate just enough to safely install. Schema-level checks are out of scope. */
+export declare function validateManifest(m: SkillManifest): ValidationResult;

package/dist/yomeSkills/manifest.js

@@ -0,0 +1,47 @@
+// Light-weight yome-skill.json reader. We don't bring in a JSON-Schema
+// validator because that would pull ajv (~50KB) into the CLI install size
+// for one validation. Instead we hand-check the few invariants the runtime
+// actually depends on: slug shape, version semver, domain identifier.
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+const SLUG_RE = /^@[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
+const DOMAIN_RE = /^[a-z][a-z0-9_]*$/;
+export function readManifest(skillDir) {
+    const path = join(skillDir, 'yome-skill.json');
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof data !== 'object' || data == null)
+        return null;
+    const m = data;
+    if (typeof m.slug !== 'string' || typeof m.domain !== 'string' || typeof m.version !== 'string') {
+        return null;
+    }
+    return m;
+}
+/** Validate just enough to safely install. Schema-level checks are out of scope. */
+export function validateManifest(m) {
+    const errors = [];
+    if (!SLUG_RE.test(m.slug))
+        errors.push(`invalid slug "${m.slug}" (expected @<owner>/<name>)`);
+    if (!DOMAIN_RE.test(m.domain))
+        errors.push(`invalid domain "${m.domain}"`);
+    if (!SEMVER_RE.test(m.version))
+        errors.push(`invalid version "${m.version}" (expected x.y.z)`);
+    return { ok: errors.length === 0, errors };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/yomeSkills/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/yomeSkills/manifest.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAsD5B,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAA6B,CAAC;AACvC,CAAC;AAOD,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,CAAgB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC;IAC9F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC;IAC/F,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC"}

package/dist/yomeSkills/paths.d.ts

@@ -0,0 +1,13 @@
+/** ~/.yome/skills */
+export declare function getYomeSkillsRoot(): string;
+/**
+ * Parse @<owner>/<name> into install path components. Returns null if the
+ * slug shape is wrong; callers should treat that as a CLI argument error.
+ */
+export declare function parseSlug(slug: string): {
+    owner: string;
+    name: string;
+    full: string;
+} | null;
+/** Installed location for a given slug: ~/.yome/skills/<owner>/<name>/ */
+export declare function installPathForSlug(slug: string): string | null;

package/dist/yomeSkills/paths.js

@@ -0,0 +1,33 @@
+// Path conventions for the yome-skill.json system (spec 4 / spec 8.5).
+//
+// We reuse ~/.yome/skills/ — the same directory the legacy markdown
+// SKILL.md system already uses — and disambiguate by manifest file:
+//   <yomeSkillsRoot>/<owner>/<name>/yome-skill.json   ← spec-style (this module)
+//   <yomeSkillsRoot>/<some-folder>/SKILL.md            ← legacy markdown skill
+// Both can coexist; loaders ignore directories without their expected manifest.
+import { homedir } from 'os';
+import { join } from 'path';
+/** ~/.yome/skills */
+export function getYomeSkillsRoot() {
+    return join(homedir(), '.yome', 'skills');
+}
+/**
+ * Parse @<owner>/<name> into install path components. Returns null if the
+ * slug shape is wrong; callers should treat that as a CLI argument error.
+ */
+export function parseSlug(slug) {
+    const m = /^@([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(slug);
+    if (!m)
+        return null;
+    const owner = m[1];
+    const name = m[2];
+    return { owner, name, full: `@${owner}/${name}` };
+}
+/** Installed location for a given slug: ~/.yome/skills/<owner>/<name>/ */
+export function installPathForSlug(slug) {
+    const p = parseSlug(slug);
+    if (!p)
+        return null;
+    return join(getYomeSkillsRoot(), p.owner, p.name);
+}
+//# sourceMappingURL=paths.js.map

package/dist/yomeSkills/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/yomeSkills/paths.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAEhF,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,qBAAqB;AACrB,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/yomeSkills/publish.d.ts

@@ -0,0 +1,18 @@
+export interface PublishOptions {
+    /** Override hub base URL (default = YOME_HUB_BASE or https://yome.work). */
+    hubBase?: string;
+    /** Skip clean-tree + git remote checks (use --force). */
+    force?: boolean;
+    /** Test seam — replaces global fetch. */
+    fetcher?: typeof fetch;
+}
+export interface PublishResult {
+    ok: boolean;
+    slug?: string;
+    version?: string;
+    /** 'created' for a brand-new version row, 'noop_same_sha' for an idempotent re-publish. */
+    outcome?: 'created' | 'noop_same_sha';
+    hubResponse?: unknown;
+    reason?: string;
+}
+export declare function publishSkill(cwd: string, opts?: PublishOptions): Promise<PublishResult>;

package/dist/yomeSkills/publish.js

@@ -0,0 +1,114 @@
+// `yome skill publish` — notify the hub about a new version of a skill
+// you maintain. Path A only (no tarball upload yet, no esbuild bundle).
+//
+// Pre-conditions:
+//   - cwd contains a valid yome-skill.json
+//   - cwd is a git repo with a github.com remote
+//   - working tree is clean (no uncommitted changes)
+//   - you are logged in (`yome login`) — we send the auth token to hub
+//
+// On success the hub upserts hub_skills (slug → repo) and inserts a
+// hub_skill_versions row at manifest.version. The hub end of this is
+// /api/hub/skills/<slug>/publish.
+import { existsSync, statSync } from 'fs';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'path';
+import { readManifest, validateManifest } from './manifest.js';
+import { readAuthState } from './auth.js';
+import { computeSkillSha256 } from './integrity.js';
+const DEFAULT_HUB_BASE = 'https://yome.work';
+export async function publishSkill(cwd, opts = {}) {
+    const abs = resolve(cwd);
+    if (!existsSync(abs) || !statSync(abs).isDirectory()) {
+        return { ok: false, reason: `cwd is not a directory: ${abs}` };
+    }
+    const manifest = readManifest(abs);
+    if (!manifest)
+        return { ok: false, reason: `${abs}/yome-skill.json missing or unreadable` };
+    const v = validateManifest(manifest);
+    if (!v.ok)
+        return { ok: false, reason: `manifest invalid: ${v.errors.join('; ')}` };
+    const auth = readAuthState();
+    if (!auth)
+        return { ok: false, reason: 'not logged in — run `yome login` first' };
+    const gitInfo = inspectGit(abs);
+    if (!gitInfo.ok && !opts.force)
+        return { ok: false, reason: gitInfo.reason };
+    const hubBase = (opts.hubBase ?? process.env.YOME_HUB_BASE ?? DEFAULT_HUB_BASE).replace(/\/$/, '');
+    const url = `${hubBase}/api/hub/skills/${encodeURIComponent(manifest.slug)}/publish`;
+    const body = buildPublishBody(manifest, gitInfo, abs);
+    const fetcher = opts.fetcher ?? fetch;
+    let resp;
+    try {
+        resp = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${auth.yome_token}`,
+                'User-Agent': 'yome-cli/0.1',
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (e) {
+        return { ok: false, reason: `publish request failed: ${e.message}` };
+    }
+    let parsed;
+    try {
+        parsed = await resp.json();
+    }
+    catch {
+        parsed = null;
+    }
+    if (!resp.ok) {
+        const reason = parsed && typeof parsed === 'object' && 'error' in parsed
+            ? String(parsed.error) : `HTTP ${resp.status}`;
+        return { ok: false, reason: `hub rejected publish: ${reason}` };
+    }
+    const outcome = parsed && typeof parsed === 'object' && 'outcome' in parsed
+        ? (parsed.outcome === 'noop_same_sha'
+            ? 'noop_same_sha'
+            : 'created')
+        : 'created';
+    return { ok: true, slug: manifest.slug, version: manifest.version, outcome, hubResponse: parsed };
+}
+function inspectGit(cwd) {
+    const probe = spawnSync('git', ['-C', cwd, 'rev-parse', '--is-inside-work-tree'], { encoding: 'utf-8' });
+    if (probe.status !== 0)
+        return { ok: false, reason: 'cwd is not a git repo' };
+    const remoteRes = spawnSync('git', ['-C', cwd, 'config', '--get', 'remote.origin.url'], { encoding: 'utf-8' });
+    if (remoteRes.status !== 0)
+        return { ok: false, reason: 'no remote.origin.url configured' };
+    const remote = remoteRes.stdout.trim();
+    const fullName = parseGithubFullName(remote);
+    if (!fullName)
+        return { ok: false, reason: `origin remote is not GitHub: ${remote}` };
+    const branchRes = spawnSync('git', ['-C', cwd, 'rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf-8' });
+    const branch = branchRes.status === 0 ? branchRes.stdout.trim() : 'main';
+    const shaRes = spawnSync('git', ['-C', cwd, 'rev-parse', 'HEAD'], { encoding: 'utf-8' });
+    const sha = shaRes.status === 0 ? shaRes.stdout.trim() : '';
+    const dirtyRes = spawnSync('git', ['-C', cwd, 'status', '--porcelain'], { encoding: 'utf-8' });
+    const isClean = dirtyRes.status === 0 && dirtyRes.stdout.trim().length === 0;
+    if (!isClean)
+        return { ok: false, reason: 'working tree is dirty (commit or stash before publishing, or use --force)', remote, fullName, branch, sha, isClean };
+    return { ok: true, remote, fullName, branch, sha, isClean };
+}
+function parseGithubFullName(s) {
+    const m = s.match(/github\.com[\/:]([\w.-]+\/[\w.-]+?)(?:\.git)?(?:\/|$)/);
+    return m ? m[1] : null;
+}
+function buildPublishBody(m, g, cwd) {
+    return {
+        slug: m.slug,
+        version: m.version,
+        domain: m.domain,
+        name: m.name ?? null,
+        description: m.description ?? null,
+        capabilities: m.capabilities ?? null,
+        github_full_name: g.fullName ?? null,
+        github_default_branch: g.branch ?? 'main',
+        git_sha: g.sha ?? null,
+        tarball_sha256: computeSkillSha256(cwd),
+    };
+}
+//# sourceMappingURL=publish.js.map

package/dist/yomeSkills/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/yomeSkills/publish.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,kBAAkB;AAClB,2CAA2C;AAC3C,iDAAiD;AACjD,qDAAqD;AACrD,uEAAuE;AACvE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,kCAAkC;AAElC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAqBpD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAuB,EAAE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,GAAG,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,wCAAwC,EAAE,CAAC;IAC5F,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAEpF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAElF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAE7E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,GAAG,OAAO,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;IACrF,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,UAAU,EAAE;gBAC1C,YAAY,EAAE,cAAc;aAC7B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA4B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,MAAM;YACtE,CAAC,CAAC,MAAM,CAAE,MAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GACX,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM;QACzD,CAAC,CAAC,CAAE,MAA+B,CAAC,OAAO,KAAK,eAAe;YAC3D,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACpG,CAAC;AAYD,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAE9E,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/G,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,MAAM,EAAE,EAAE,CAAC;IAEtF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAEzE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2EAA2E,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAEhK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAgBD,SAAS,gBAAgB,CAAC,CAAgB,EAAE,CAAa,EAAE,GAAW;IACpE,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;QACpC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QACpC,qBAAqB,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM;QACzC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;QACtB,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/yomeSkills/rollback.d.ts

@@ -0,0 +1,10 @@
+export interface RollbackResult {
+    ok: boolean;
+    slug?: string;
+    /** Version we rolled back TO (read from the restored manifest). */
+    restoredVersion?: string;
+    /** Version we rolled back FROM. */
+    previousVersion?: string;
+    reason?: string;
+}
+export declare function rollbackBySlug(slug: string): Promise<RollbackResult>;

package/dist/yomeSkills/rollback.js

@@ -0,0 +1,83 @@
+// `yome skill rollback <slug>` — swap back to the previous version.
+//
+// Spec 11.4-D requires "保留最近 2 个版本目录" — we keep one snapshot
+// (`<slug-dir>.previous/`) created by `install.ts` whenever it overwrites
+// an existing install. This module performs the atomic swap:
+//
+//   live  : ~/.yome/skills/<owner>/<name>            (current)
+//   prev  : ~/.yome/skills/<owner>/<name>.previous   (last good)
+//
+// rollback:
+//   prev  → swap-tmp → live   (i.e. live becomes previous, previous becomes live)
+//
+// After rollback the swap-tmp now holds what was live; we move it to the
+// `.previous` slot so the user can also rollback the rollback (one level
+// of undo, capped to keep disk usage bounded).
+//
+// Edge cases:
+//   - No `.previous` snapshot present → tell the user, exit cleanly.
+//   - Live install was uninstalled (no live dir) → restore previous in place.
+//   - Allowed-capabilities sidecar lives INSIDE the install dir, so it
+//     swaps with the rest. No extra work needed.
+//   - Index cache may now be stale → we refresh it.
+import { existsSync, renameSync, rmSync, mkdirSync } from 'fs';
+import { dirname } from 'path';
+import { installPathForSlug } from './paths.js';
+import { readManifest } from './manifest.js';
+import { refreshIndex } from './skillsIndex.js';
+export async function rollbackBySlug(slug) {
+    const live = installPathForSlug(slug);
+    if (!live)
+        return { ok: false, reason: `bad slug: ${slug}` };
+    const snap = `${live}.previous`;
+    if (!existsSync(snap)) {
+        return { ok: false, reason: `no rollback snapshot for ${slug} — nothing to roll back to` };
+    }
+    // Capture versions for the report (best-effort; manifest read is cheap).
+    const liveManifest = existsSync(live) ? readManifest(live) : null;
+    const prevManifest = readManifest(snap);
+    const previousVersion = liveManifest?.version;
+    const restoredVersion = prevManifest?.version;
+    // Atomic-ish swap. We need a temporary intermediate name because
+    // renameSync(live, snap) when snap already exists is destructive on POSIX.
+    // Sequence:
+    //   1. live  → tmp
+    //   2. snap  → live
+    //   3. tmp   → snap   (overwrite-protected: we rmSync first if it exists,
+    //                       though step 2 just moved it away)
+    const tmp = `${live}.swap-${process.pid}-${Date.now()}`;
+    try {
+        if (existsSync(live)) {
+            mkdirSync(dirname(live), { recursive: true });
+            renameSync(live, tmp);
+        }
+        renameSync(snap, live);
+        if (existsSync(tmp)) {
+            // step 3: archive what was live as the new previous
+            if (existsSync(snap))
+                rmSync(snap, { recursive: true, force: true });
+            renameSync(tmp, snap);
+        }
+    }
+    catch (err) {
+        // Best-effort recovery: try to put live back if we moved it but failed
+        // to install snap. Don't pretend everything is fine.
+        try {
+            if (existsSync(tmp) && !existsSync(live))
+                renameSync(tmp, live);
+        }
+        catch { /* ignore */ }
+        return { ok: false, slug, reason: `rename failed during rollback: ${err.message}` };
+    }
+    try {
+        refreshIndex();
+    }
+    catch { /* best effort */ }
+    return {
+        ok: true,
+        slug,
+        restoredVersion,
+        previousVersion,
+    };
+}
+//# sourceMappingURL=rollback.js.map

package/dist/yomeSkills/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/yomeSkills/rollback.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,6DAA6D;AAC7D,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,EAAE;AACF,YAAY;AACZ,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,+CAA+C;AAC/C,EAAE;AACF,cAAc;AACd,qEAAqE;AACrE,8EAA8E;AAC9E,uEAAuE;AACvE,iDAAiD;AACjD,oDAAoD;AAEpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAYhD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IAE7D,MAAM,IAAI,GAAG,GAAG,IAAI,WAAW,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,IAAI,4BAA4B,EAAE,CAAC;IAC7F,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,YAAY,EAAE,OAAO,CAAC;IAC9C,MAAM,eAAe,GAAG,YAAY,EAAE,OAAO,CAAC;IAE9C,iEAAiE;IACjE,2EAA2E;IAC3E,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,oDAAoD;YACpD,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAmC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,CAAC;QAAC,YAAY,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEnD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,eAAe;QACf,eAAe;KAChB,CAAC;AACJ,CAAC"}