@promptscript/cli 1.12.1 → 1.13.0

package/index.js

@@ -11760,6 +11760,14 @@ var init_base_formatter = __esm({
       referencesMode() {
         return "none";
       }
+      /**
+       * Default pass-through for injected skill content. Formatters whose target
+       * tools restrict skill frontmatter (e.g. Factory AI) override this hook to
+       * filter unsupported fields before the compiler writes the file.
+       */
+      transformInjectedSkillContent(content) {
+        return content;
+      }
       /**
        * Generate a provenance comment for a reference file.
        */
@@ -16365,6 +16373,24 @@ ${lines.join("\n")}
         }
         return filtered;
       }
+      /**
+       * Filter the frontmatter of an externally-supplied SKILL.md file (such as
+       * the bundled PromptScript skill injected by the compiler) so it only
+       * contains fields Factory AI recognises. The body is preserved verbatim.
+       * Files without a YAML frontmatter block are returned unchanged.
+       */
+      transformInjectedSkillContent(content) {
+        if (!content.startsWith("---")) return content;
+        const closing = content.indexOf("\n---", 3);
+        if (closing === -1) return content;
+        const rawFrontmatter = content.slice(4, closing);
+        const body = content.slice(closing + 4);
+        const filteredLines = this.filterFactoryFrontmatter(rawFrontmatter);
+        const filteredFrontmatter = filteredLines.join("\n");
+        return `---
+${filteredFrontmatter}
+---${body}`;
+      }
     };
   }
 });
@@ -20847,9 +20873,9 @@ var require_rate_limit = __commonJS({
       let ttl = 0;
       let ttlInSeconds = 0;
       try {
-        const res = await new Promise((resolve21, reject) => {
+        const res = await new Promise((resolve22, reject) => {
           store.incr(key, (err, res2) => {
-            err ? reject(err) : resolve21(res2);
+            err ? reject(err) : resolve22(res2);
           }, timeWindow, max);
         });
         current = res.current;
@@ -20956,12 +20982,12 @@ var init_health = __esm({
 
 // packages/server/src/source-dirs.ts
 import { readFile as readFile24 } from "fs/promises";
-import { join as join21, dirname as dirname12 } from "path";
+import { join as join23, dirname as dirname14 } from "path";
 import { parse as parseYaml13 } from "yaml";
 async function readProjectConfig(workspace) {
   for (const filename of CONFIG_FILENAMES) {
     try {
-      const raw = await readFile24(join21(workspace, filename), "utf-8");
+      const raw = await readFile24(join23(workspace, filename), "utf-8");
       const config = parseYaml13(raw);
       if (config) return config;
     } catch {
@@ -20972,10 +20998,10 @@ async function readProjectConfig(workspace) {
 async function resolveSourceDir(workspace) {
   for (const filename of CONFIG_FILENAMES) {
     try {
-      const raw = await readFile24(join21(workspace, filename), "utf-8");
+      const raw = await readFile24(join23(workspace, filename), "utf-8");
       const config = parseYaml13(raw);
       if (config?.input?.entry) {
-        return dirname12(config.input.entry);
+        return dirname14(config.input.entry);
       }
     } catch {
     }
@@ -20989,9 +21015,9 @@ async function resolveFileGlobs(workspace) {
 async function resolveWatchPaths(workspace) {
   const sourceDir = await resolveSourceDir(workspace);
   return [
-    join21(workspace, sourceDir),
-    join21(workspace, "promptscript.yaml"),
-    join21(workspace, "promptscript.yml")
+    join23(workspace, sourceDir),
+    join23(workspace, "promptscript.yaml"),
+    join23(workspace, "promptscript.yml")
   ];
 }
 var DEFAULT_SOURCE_DIR, CONFIG_FILENAMES;
@@ -21018,13 +21044,13 @@ var init_config2 = __esm({
 });
 
 // packages/server/src/path-guard.ts
-import { resolve as resolve20, relative as relative4, isAbsolute as isAbsolute6 } from "path";
+import { resolve as resolve21, relative as relative4, isAbsolute as isAbsolute6 } from "path";
 function resolveSafePath(workspace, requestedPath) {
   const decoded = decodeURIComponent(requestedPath);
   if (isAbsolute6(decoded)) {
     throw new PathTraversalError(requestedPath);
   }
-  const resolved = resolve20(workspace, decoded);
+  const resolved = resolve21(workspace, decoded);
   const rel = relative4(workspace, resolved);
   if (rel.startsWith("..") || isAbsolute6(rel)) {
     throw new PathTraversalError(requestedPath);
@@ -21046,7 +21072,7 @@ var init_path_guard = __esm({
 
 // packages/server/src/routes/files.ts
 import { readFile as readFile25, writeFile as writeFile13, unlink as unlink2, stat as stat3, mkdir as mkdir10 } from "fs/promises";
-import { dirname as dirname13 } from "path";
+import { dirname as dirname15 } from "path";
 import fg from "fast-glob";
 function registerRoutes(app, workspace, readOnly) {
   app.get("/api/files", async () => {
@@ -21106,7 +21132,7 @@ function registerRoutes(app, workspace, readOnly) {
           return reply.status(409).send({ error: "File already exists" });
         } catch {
         }
-        await mkdir10(dirname13(resolved), { recursive: true });
+        await mkdir10(dirname15(resolved), { recursive: true });
         await writeFile13(resolved, request.body.content, "utf-8");
         return reply.status(201).send({ path: filePath, status: "created" });
       } catch (err) {
@@ -21332,14 +21358,14 @@ init_src();
 init_init();
 import { Command } from "commander";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname14 } from "path";
+import { dirname as dirname16 } from "path";
 
 // packages/cli/src/commands/compile.ts
 init_src();
-import { resolve as resolve7, dirname as dirname8, isAbsolute as isAbsolute5 } from "path";
+import { resolve as resolve8, dirname as dirname9, isAbsolute as isAbsolute5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { writeFile as writeFile4, mkdir as mkdir4, readFile as readFile12 } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import chokidar from "chokidar";
 
 // packages/cli/src/config/loader.ts
@@ -21403,6 +21429,56 @@ async function loadConfig(customPath) {
 
 // packages/cli/src/commands/compile.ts
 init_loader();
+
+// packages/cli/src/prettier/post-format.ts
+import { resolve as resolve4 } from "path";
+var MARKDOWN_RE = /\.(md|mdx|markdown)$/i;
+async function postFormatWithPrettier(outputs, projectRoot, logger) {
+  let prettier;
+  try {
+    prettier = await import("prettier");
+  } catch {
+    logger.verbose("Prettier not available; skipping markdown post-format.");
+    return;
+  }
+  const queue = [];
+  for (const output of outputs.values()) {
+    collectOutputs(output, queue);
+  }
+  for (const output of queue) {
+    if (!MARKDOWN_RE.test(output.path)) continue;
+    const absPath = resolve4(projectRoot, output.path);
+    let config = null;
+    try {
+      config = await prettier.resolveConfig(absPath);
+    } catch (err) {
+      logger.verbose(
+        `Could not resolve Prettier config for ${output.path}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    try {
+      output.content = await prettier.format(output.content, {
+        ...config ?? {},
+        filepath: absPath,
+        parser: "markdown"
+      });
+    } catch (err) {
+      logger.verbose(
+        `Prettier rejected ${output.path}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+}
+function collectOutputs(output, into) {
+  into.push(output);
+  if (output.additionalFiles) {
+    for (const child of output.additionalFiles) {
+      collectOutputs(child, into);
+    }
+  }
+}
+
+// packages/cli/src/commands/compile.ts
 init_console();
 
 // packages/compiler/src/compiler.ts
@@ -21419,7 +21495,7 @@ import { basename as basename11, dirname as dirname7, join as join8 } from "path
 // packages/resolver/src/loader.ts
 init_src();
 import { readFile as readFile7 } from "fs/promises";
-import { resolve as resolve4, dirname as dirname5, basename as basename7, isAbsolute as isAbsolute2, relative } from "path";
+import { resolve as resolve5, dirname as dirname5, basename as basename7, isAbsolute as isAbsolute2, relative } from "path";
 
 // packages/resolver/src/alias-resolver.ts
 init_src();
@@ -21509,8 +21585,8 @@ var FileLoader = class {
   options;
   constructor(options) {
     this.registryPath = options.registryPath;
-    this.localPath = resolve4(options.localPath ?? process.cwd());
-    this.projectRoot = resolve4(
+    this.localPath = resolve5(options.localPath ?? process.cwd());
+    this.projectRoot = resolve5(
       options.projectRoot ?? (basename7(this.localPath) === ".promptscript" ? dirname5(this.localPath) : this.localPath)
     );
     this.options = options;
@@ -21553,11 +21629,11 @@ var FileLoader = class {
         const namespace = match[1];
         const segments = match[2];
         const fileName2 = segments.endsWith(".prs") || segments.endsWith(".md") ? segments : `${segments}.prs`;
-        return resolve4(this.registryPath, `@${namespace}`, fileName2);
+        return resolve5(this.registryPath, `@${namespace}`, fileName2);
       }
     }
     const fileName = path.endsWith(".prs") || path.endsWith(".md") ? path : `${path}.prs`;
-    return resolve4(this.localPath, fileName);
+    return resolve5(this.localPath, fileName);
   }
   /**
    * Resolve a PathReference to an absolute path.
@@ -21570,7 +21646,7 @@ var FileLoader = class {
     if (ref.isRelative) {
       const dir = dirname5(fromFile);
       const rawPath = ref.raw.endsWith(".prs") || ref.raw.endsWith(".md") ? ref.raw : `${ref.raw}.prs`;
-      const resolved = resolve4(dir, rawPath);
+      const resolved = resolve5(dir, rawPath);
       const rel = relative(this.projectRoot, resolved);
       if (rel.startsWith("..") || isAbsolute2(rel)) {
         throw new Error(`Path traversal outside project root is not allowed: ${ref.raw}`);
@@ -22511,7 +22587,7 @@ function uniqueConcat3(parent, child) {
 // packages/resolver/src/skills.ts
 init_src();
 import { readFile as readFile8, readdir as readdir2, access, lstat, realpath } from "fs/promises";
-import { basename as basename8, resolve as resolve5, dirname as dirname6, relative as relative2, normalize as normalize2, isAbsolute as isAbsolute3, sep as sep2 } from "path";
+import { basename as basename8, resolve as resolve6, dirname as dirname6, relative as relative2, normalize as normalize2, isAbsolute as isAbsolute3, sep as sep2 } from "path";
 function parseSkillMd(content) {
   const lines = content.split("\n");
   let inFrontmatter = false;
@@ -22957,10 +23033,10 @@ function parseSkillIgnore(content) {
   return { patterns };
 }
 function isIgnoredByRules(relPath, rules) {
-  const basename14 = relPath.split("/").pop() ?? relPath;
+  const basename16 = relPath.split("/").pop() ?? relPath;
   let ignored = false;
   for (const { regex, matchPath, negated } of rules.patterns) {
-    const target = matchPath ? relPath : basename14;
+    const target = matchPath ? relPath : basename16;
     if (regex.test(target)) {
       ignored = !negated;
     }
@@ -22968,7 +23044,7 @@ function isIgnoredByRules(relPath, rules) {
   return ignored;
 }
 async function loadSkillIgnore(skillDir) {
-  const ignorePath = resolve5(skillDir, ".skillignore");
+  const ignorePath = resolve6(skillDir, ".skillignore");
   try {
     const content = await readFile8(ignorePath, "utf-8");
     return parseSkillIgnore(content);
@@ -23014,7 +23090,7 @@ async function discoverSkillResources(skillDir, logger = noopLogger2) {
     }
     if (entry.isSymbolicLink()) continue;
     if (SKIP_FILES.has(entry.name)) continue;
-    const fullPath = resolve5(entry.parentPath, entry.name);
+    const fullPath = resolve6(entry.parentPath, entry.name);
     const relPath = relative2(skillDir, fullPath);
     const relPathNormalized = relPath.split(sep2).join("/");
     const pathSegments = relPath.split(sep2);
@@ -23073,7 +23149,7 @@ async function resolveSkillReferences(references, basePath, logger) {
         column: 0
       });
     }
-    const fullPath = resolve5(basePath, ref);
+    const fullPath = resolve6(basePath, ref);
     let content;
     try {
       content = await readFile8(fullPath, "utf-8");
@@ -23145,8 +23221,8 @@ async function discoverSkillDirs(basePath) {
       if (!entry.isDirectory()) continue;
       if (SKIP_DIRS.has(entry.name)) continue;
       if (!isSafeSkillName(entry.name)) continue;
-      const subDir = resolve5(dir, entry.name);
-      const skillMd = resolve5(subDir, "SKILL.md");
+      const subDir = resolve6(dir, entry.name);
+      const skillMd = resolve6(subDir, "SKILL.md");
       if (await fileExists(skillMd)) {
         if (!result.has(entry.name)) {
           result.set(entry.name, subDir);
@@ -23173,9 +23249,9 @@ async function resolveNativeSkills(ast, registryPath, sourceFile, localPath, opt
   const isSkillsDir = sourceDir.includes("@skills") || sourceDir.endsWith("/skills");
   const discoveredSkillPaths = /* @__PURE__ */ new Map();
   if (!isSkillsDir && localPath) {
-    const discoveryDirs = [resolve5(localPath, "skills")];
+    const discoveryDirs = [resolve6(localPath, "skills")];
     if (options?.universalDir && localPath) {
-      discoveryDirs.push(resolve5(localPath, "..", options.universalDir, "skills"));
+      discoveryDirs.push(resolve6(localPath, "..", options.universalDir, "skills"));
     }
     for (const dir of discoveryDirs) {
       const discovered = await discoverSkillDirs(dir);
@@ -23196,7 +23272,7 @@ async function resolveNativeSkills(ast, registryPath, sourceFile, localPath, opt
   }
   let sharedResources = [];
   if (localPath) {
-    const sharedDir = resolve5(localPath, "shared");
+    const sharedDir = resolve6(localPath, "shared");
     if (await fileExists(sharedDir)) {
       try {
         sharedResources = await discoverSkillResources(sharedDir, logger);
@@ -23217,12 +23293,12 @@ async function resolveNativeSkills(ast, registryPath, sourceFile, localPath, opt
       continue;
     }
     const skillObj = skillValue;
-    const skillMdPath = isSkillsDir ? resolve5(sourceDir, skillName, "SKILL.md") : await (async () => {
+    const skillMdPath = isSkillsDir ? resolve6(sourceDir, skillName, "SKILL.md") : await (async () => {
       const discoveredDir = discoveredSkillPaths.get(skillName);
-      if (discoveredDir) return resolve5(discoveredDir, "SKILL.md");
-      const localCandidate = localPath ? resolve5(localPath, "skills", skillName, "SKILL.md") : null;
-      const universalCandidate = options?.universalDir && localPath ? resolve5(localPath, "..", options.universalDir, "skills", skillName, "SKILL.md") : null;
-      const registryCandidate = resolve5(registryPath, "@skills", skillName, "SKILL.md");
+      if (discoveredDir) return resolve6(discoveredDir, "SKILL.md");
+      const localCandidate = localPath ? resolve6(localPath, "skills", skillName, "SKILL.md") : null;
+      const universalCandidate = options?.universalDir && localPath ? resolve6(localPath, "..", options.universalDir, "skills", skillName, "SKILL.md") : null;
+      const registryCandidate = resolve6(registryPath, "@skills", skillName, "SKILL.md");
       if (localCandidate && await fileExists(localCandidate)) return localCandidate;
       if (universalCandidate && await fileExists(universalCandidate))
         return universalCandidate;
@@ -23312,7 +23388,7 @@ async function discoverCommandFiles(dir, logger = noopLogger2) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
       if (entry.isSymbolicLink()) continue;
       const cmdName = "/" + entry.name.replace(/\.md$/, "");
-      const fullPath = resolve5(dir, entry.name);
+      const fullPath = resolve6(dir, entry.name);
       try {
         const fileStat = await lstat(fullPath);
         if (fileStat.isSymbolicLink()) continue;
@@ -23343,11 +23419,11 @@ async function resolveNativeCommands(ast, sourceFile, localPath, options) {
   if (!localPath) return ast;
   const logger = options?.logger ?? noopLogger2;
   const allCommands = {};
-  const localCommands = await discoverCommandFiles(resolve5(localPath, "commands"), logger);
+  const localCommands = await discoverCommandFiles(resolve6(localPath, "commands"), logger);
   Object.assign(allCommands, localCommands);
   if (options?.universalDir) {
     const universalCommands = await discoverCommandFiles(
-      resolve5(localPath, "..", options.universalDir, "commands"),
+      resolve6(localPath, "..", options.universalDir, "commands"),
       logger
     );
     for (const [name, value] of Object.entries(universalCommands)) {
@@ -23428,7 +23504,7 @@ async function discoverAgentFiles(dir, logger = noopLogger2) {
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
       if (entry.isSymbolicLink()) continue;
-      const fullPath = resolve5(dir, entry.name);
+      const fullPath = resolve6(dir, entry.name);
       try {
         const fileStat = await lstat(fullPath);
         if (fileStat.isSymbolicLink()) continue;
@@ -23492,11 +23568,11 @@ async function resolveNativeAgents(ast, sourceFile, localPath, options) {
   if (!localPath) return ast;
   const logger = options?.logger ?? noopLogger2;
   const allAgents = {};
-  const localAgents = await discoverAgentFiles(resolve5(localPath, "agents"), logger);
+  const localAgents = await discoverAgentFiles(resolve6(localPath, "agents"), logger);
   Object.assign(allAgents, localAgents);
   if (options?.universalDir) {
     const universalAgents = await discoverAgentFiles(
-      resolve5(localPath, "..", options.universalDir, "agents"),
+      resolve6(localPath, "..", options.universalDir, "agents"),
       logger
     );
     for (const [name, value] of Object.entries(universalAgents)) {
@@ -25124,7 +25200,7 @@ var RegistryCache = class {
 
 // packages/resolver/src/auto-discovery.ts
 import { readFile as readFile10, readdir as readdir3, access as access2, lstat as lstat2 } from "fs/promises";
-import { resolve as resolve6, basename as basename10 } from "path";
+import { resolve as resolve7, basename as basename10 } from "path";
 var CONTEXT_FILES = ["CLAUDE.md", ".clinerules", ".cursorrules"];
 async function fileExists2(path) {
   try {
@@ -25160,9 +25236,9 @@ async function discoverSkills(dir) {
   const properties = {};
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    let skillMdPath = resolve6(dir, entry.name, "SKILL.md");
+    let skillMdPath = resolve7(dir, entry.name, "SKILL.md");
     if (!await fileExists2(skillMdPath)) {
-      const dirnameMdPath = resolve6(dir, entry.name, `${entry.name}.md`);
+      const dirnameMdPath = resolve7(dir, entry.name, `${entry.name}.md`);
       if (await fileExists2(dirnameMdPath)) {
         skillMdPath = dirnameMdPath;
       } else {
@@ -25189,7 +25265,7 @@ async function discoverSkills(dir) {
   return Object.keys(properties).length > 0 ? properties : null;
 }
 async function discoverRootSkill(dir) {
-  const skillMdPath = resolve6(dir, "SKILL.md");
+  const skillMdPath = resolve7(dir, "SKILL.md");
   if (!await fileExists2(skillMdPath)) return null;
   try {
     const raw = await readFile10(skillMdPath, "utf-8");
@@ -25220,7 +25296,7 @@ async function discoverAgents(dir) {
   const properties = {};
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const fullPath = resolve6(dir, entry.name);
+    const fullPath = resolve7(dir, entry.name);
     try {
       const stat4 = await lstat2(fullPath);
       if (stat4.isSymbolicLink()) continue;
@@ -25256,7 +25332,7 @@ async function discoverCommands(dir) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
     if (entry.name === "SKILL.md") continue;
-    const fullPath = resolve6(dir, entry.name);
+    const fullPath = resolve7(dir, entry.name);
     try {
       const stat4 = await lstat2(fullPath);
       if (stat4.isSymbolicLink()) continue;
@@ -25273,7 +25349,7 @@ async function discoverCommands(dir) {
 }
 async function discoverContext(dir) {
   for (const fileName of CONTEXT_FILES) {
-    const fullPath = resolve6(dir, fileName);
+    const fullPath = resolve7(dir, fileName);
     if (!await fileExists2(fullPath)) continue;
     try {
       const content = await readFile10(fullPath, "utf-8");
@@ -25303,7 +25379,7 @@ async function discoverNativeContent(dir) {
   const subSkills = await discoverSkills(dir);
   const wrappedSkillResults = await Promise.all(
     SKILL_WRAPPER_DIRS.map(async (name) => {
-      const candidate = resolve6(dir, name);
+      const candidate = resolve7(dir, name);
       if (!await safeIsDirectory(candidate)) return null;
       return discoverSkills(candidate);
     })
@@ -25324,7 +25400,7 @@ async function discoverNativeContent(dir) {
   const rootAgents = await discoverAgents(dir) ?? {};
   const wrappedAgents = {};
   for (const name of AGENT_WRAPPER_DIRS) {
-    const candidate = resolve6(dir, name);
+    const candidate = resolve7(dir, name);
     if (await safeIsDirectory(candidate)) {
       const found = await discoverAgents(candidate);
       if (found) Object.assign(wrappedAgents, found);
@@ -25337,7 +25413,7 @@ async function discoverNativeContent(dir) {
   const rootCommands = await discoverCommands(dir) ?? {};
   const wrappedCommands = {};
   for (const name of COMMAND_WRAPPER_DIRS) {
-    const candidate = resolve6(dir, name);
+    const candidate = resolve7(dir, name);
     if (await safeIsDirectory(candidate)) {
       const found = await discoverCommands(candidate);
       if (found) Object.assign(wrappedCommands, found);
@@ -25838,6 +25914,12 @@ var Resolver = class {
             errors.push(new ResolveError(e.message, e.location));
           }
         }
+      } else if (isMdPath) {
+        errors.push(
+          new ResolveError(
+            `Cannot resolve registry import: file '${subPath}' not found in ${repoUrl} (looked for ${resolvedFullPath}). Verify the path inside the repository.`
+          )
+        );
       } else {
         const discoverDir = isRoot ? cachePath : join8(cachePath, subPath);
         this.logger.debug(`No .prs found, trying auto-discovery: ${discoverDir}`);
@@ -26080,7 +26162,7 @@ var HttpRegistry = class {
    * Sleep for specified milliseconds.
    */
   sleep(ms) {
-    return new Promise((resolve21) => setTimeout(resolve21, ms));
+    return new Promise((resolve22) => setTimeout(resolve22, ms));
   }
   /**
    * Fetch with timeout.
@@ -26224,9 +26306,251 @@ function createHttpRegistry(options) {
 // packages/resolver/src/vendor-registry.ts
 init_src();
 
+// packages/resolver/src/skill-validation.ts
+import { basename as basename12, dirname as dirname8, join as join10 } from "path";
+import { existsSync as existsSync11 } from "fs";
+function validateSkillFrontmatter(rawContent, options = {}) {
+  const issues = [];
+  if (!hasFrontmatterDelimiters(rawContent)) {
+    issues.push({
+      severity: "error",
+      code: "SK001",
+      message: "SKILL.md must start with a YAML frontmatter block delimited by `---` lines."
+    });
+    return { valid: false, issues };
+  }
+  const parsed = parseSkillMd(rawContent);
+  validateName(parsed, options, issues);
+  validateDescription(parsed, issues);
+  validateCompatibility(parsed.rawFrontmatter, issues);
+  validateLicense(parsed.rawFrontmatter, issues);
+  validateBody(parsed.content, issues);
+  validateReferences(parsed.references, options.filePath, issues);
+  validateAllowedTools(parsed.rawFrontmatter, issues);
+  const hasErrors = issues.some((i) => i.severity === "error");
+  return { valid: !hasErrors, issues };
+}
+var NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var MAX_NAME_LEN = 64;
+var MIN_DESC_LEN = 1;
+var MAX_DESC_LEN = 1024;
+var MAX_COMPATIBILITY_LEN = 500;
+var SHORT_DESC_WARN_LEN = 40;
+var MAX_BODY_LINES = 500;
+function validateName(parsed, options, issues) {
+  const name = parsed.name;
+  if (!name || name.length === 0) {
+    issues.push({
+      severity: "error",
+      code: "SK002",
+      field: "name",
+      message: "`name` is required in SKILL.md frontmatter."
+    });
+    return;
+  }
+  if (name.length > MAX_NAME_LEN) {
+    issues.push({
+      severity: "error",
+      code: "SK003",
+      field: "name",
+      message: `\`name\` must be at most ${MAX_NAME_LEN} characters (got ${name.length}).`
+    });
+  }
+  if (!NAME_PATTERN.test(name)) {
+    issues.push({
+      severity: "error",
+      code: "SK004",
+      field: "name",
+      message: `\`name\` "${name}" is invalid. Use lowercase letters, digits, and single hyphens only. Cannot start or end with a hyphen or contain consecutive hyphens.`
+    });
+  }
+  if (options.filePath) {
+    const parentDir = basename12(dirname8(options.filePath));
+    if (parentDir && parentDir !== name) {
+      issues.push({
+        severity: "error",
+        code: "SK005",
+        field: "name",
+        message: `\`name\` "${name}" must match the parent directory name "${parentDir}".`
+      });
+    }
+  }
+  if (options.existingNames?.has(name)) {
+    issues.push({
+      severity: "error",
+      code: "SK006",
+      field: "name",
+      message: `Skill name "${name}" collides with an already-installed skill. Two skills cannot share the same name (they would be written to the same output folder).`
+    });
+  }
+}
+function validateDescription(parsed, issues) {
+  const fromRaw = parsed.rawFrontmatter ? extractScalarField(parsed.rawFrontmatter, "description") : void 0;
+  const description = fromRaw !== void 0 ? fromRaw : parsed.description;
+  if (!description || description.trim().length < MIN_DESC_LEN) {
+    issues.push({
+      severity: "error",
+      code: "SK010",
+      field: "description",
+      message: "`description` is required and must be non-empty."
+    });
+    return;
+  }
+  if (description.length > MAX_DESC_LEN) {
+    issues.push({
+      severity: "error",
+      code: "SK011",
+      field: "description",
+      message: `\`description\` must be at most ${MAX_DESC_LEN} characters (got ${description.length}).`
+    });
+  }
+  if (description.length < SHORT_DESC_WARN_LEN) {
+    issues.push({
+      severity: "warning",
+      code: "SK012",
+      field: "description",
+      message: `\`description\` is very short (${description.length} chars). The spec recommends describing both what the skill does AND when to use it so agents can match it to tasks.`
+    });
+  } else if (!/\bwhen\b|\buse\b/i.test(description)) {
+    issues.push({
+      severity: "warning",
+      code: "SK013",
+      field: "description",
+      message: '`description` should mention WHEN to use the skill (e.g. "Use when \u2026"). This improves agent trigger accuracy.'
+    });
+  }
+}
+function validateCompatibility(rawFrontmatter, issues) {
+  if (!rawFrontmatter) return;
+  const value = extractScalarField(rawFrontmatter, "compatibility");
+  if (value === void 0) return;
+  if (value.length > MAX_COMPATIBILITY_LEN) {
+    issues.push({
+      severity: "error",
+      code: "SK020",
+      field: "compatibility",
+      message: `\`compatibility\` must be at most ${MAX_COMPATIBILITY_LEN} characters (got ${value.length}).`
+    });
+  }
+}
+function validateLicense(rawFrontmatter, issues) {
+  if (!rawFrontmatter) {
+    issues.push({
+      severity: "warning",
+      code: "SK030",
+      field: "license",
+      message: "`license` is missing. Enterprises typically require an explicit license declaration before adopting a third-party skill."
+    });
+    return;
+  }
+  const value = extractScalarField(rawFrontmatter, "license");
+  if (value === void 0 || value.length === 0) {
+    issues.push({
+      severity: "warning",
+      code: "SK030",
+      field: "license",
+      message: "`license` is missing. Enterprises typically require an explicit license declaration before adopting a third-party skill."
+    });
+  }
+}
+function validateBody(body, issues) {
+  const lines = body.split("\n").length;
+  if (lines > MAX_BODY_LINES) {
+    issues.push({
+      severity: "warning",
+      code: "SK040",
+      message: `SKILL.md body has ${lines} lines (>${MAX_BODY_LINES}). The spec recommends splitting long content into separate files under references/ for progressive disclosure.`
+    });
+  }
+}
+function validateReferences(references, filePath, issues) {
+  if (!references || references.length === 0) return;
+  if (!filePath) return;
+  const skillDir = dirname8(filePath);
+  for (const ref of references) {
+    if (ref.startsWith("/") || ref.startsWith("..")) {
+      issues.push({
+        severity: "error",
+        code: "SK050",
+        field: "references",
+        message: `Reference "${ref}" must be a relative path inside the skill directory (no leading "/" or "..").`
+      });
+      continue;
+    }
+    const target = join10(skillDir, ref);
+    if (!existsSync11(target)) {
+      issues.push({
+        severity: "error",
+        code: "SK051",
+        field: "references",
+        message: `Reference "${ref}" listed in frontmatter does not exist (looked for ${target}).`
+      });
+    }
+  }
+}
+function validateAllowedTools(rawFrontmatter, issues) {
+  if (!rawFrontmatter) return;
+  const value = extractScalarField(rawFrontmatter, "allowed-tools");
+  if (value === void 0) return;
+  const tokens = value.split(/\s+/).filter((t) => t.length > 0);
+  for (const token of tokens) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*(\([^)]*\))?$/.test(token)) {
+      issues.push({
+        severity: "warning",
+        code: "SK060",
+        field: "allowed-tools",
+        message: `\`allowed-tools\` entry "${token}" does not match the expected \`Tool\` or \`Tool(scope:pattern)\` shape.`
+      });
+    }
+  }
+}
+function hasFrontmatterDelimiters(content) {
+  const lines = content.split("\n");
+  let first2 = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if ((lines[i] ?? "").trim() === "---") {
+      first2 = i;
+      break;
+    }
+  }
+  if (first2 === -1) return false;
+  for (let i = first2 + 1; i < lines.length; i++) {
+    if ((lines[i] ?? "").trim() === "---") return true;
+  }
+  return false;
+}
+function extractScalarField(rawFrontmatter, field) {
+  const lines = rawFrontmatter.split("\n");
+  const pattern = new RegExp(`^${escapeRegex(field)}:\\s*(?:"([^"]*)"|'([^']*)'|(.*))\\s*$`);
+  for (const line of lines) {
+    const match = line.match(pattern);
+    if (match) {
+      return (match[1] ?? match[2] ?? match[3] ?? "").trim();
+    }
+  }
+  return void 0;
+}
+function escapeRegex(input2) {
+  return input2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function formatSkillValidationIssues(issues) {
+  return issues.map((i) => {
+    const tag = i.severity === "error" ? "\u2717" : "\u26A0";
+    const field = i.field ? ` [${i.field}]` : "";
+    return `  ${tag} ${i.code}${field}: ${i.message}`;
+  }).join("\n");
+}
+
 // packages/resolver/src/index.ts
 init_src();
 
+// packages/resolver/src/reference-hasher.ts
+import { createHash as createHash2 } from "crypto";
+function hashContent(content) {
+  const hex = createHash2("sha256").update(content).digest("hex");
+  return `sha256-${hex}`;
+}
+
 // packages/validator/src/validator.ts
 init_src();
 
@@ -29679,7 +30003,7 @@ var Compiler = class _Compiler {
         outputPathOwners.set(skillPath, `${formatter.name}:promptscript-skill`);
         const skillOutput = {
           path: skillPath,
-          content: this.options.skillContent
+          content: formatter.transformInjectedSkillContent ? formatter.transformInjectedSkillContent(this.options.skillContent) : this.options.skillContent
         };
         outputs.set(skillPath, addMarkerToOutput(skillOutput, sourceLabel, "promptscript"));
         this.logger.verbose(`  \u2192 ${skillPath} (auto-injected promptscript skill)`);
@@ -29760,12 +30084,12 @@ var Compiler = class _Compiler {
    */
   async watch(entryPath, options = {}) {
     const { default: chokidar2 } = await import("chokidar");
-    const { dirname: dirname15, resolve: resolve21 } = await import("path");
-    const baseDir = dirname15(resolve21(entryPath));
+    const { dirname: dirname17, resolve: resolve22 } = await import("path");
+    const baseDir = dirname17(resolve22(entryPath));
     const includePatterns = options.include ?? ["**/*.prs"];
     const excludePatterns = options.exclude ?? ["**/node_modules/**"];
     const debounceMs = options.debounce ?? 300;
-    const watchPatterns = includePatterns.map((p) => resolve21(baseDir, p));
+    const watchPatterns = includePatterns.map((p) => resolve22(baseDir, p));
     let debounceTimer = null;
     let pendingChanges = [];
     const handleChange = async (changedFiles) => {
@@ -29940,7 +30264,7 @@ var Pager = class {
       }
       return;
     }
-    return new Promise((resolve21) => {
+    return new Promise((resolve22) => {
       const pagerCmd = getPagerCommand();
       const [cmd, ...args] = pagerCmd.split(" ");
       if (cmd === "less" && !args.includes("-R")) {
@@ -29948,7 +30272,7 @@ var Pager = class {
       }
       if (!cmd) {
         console.log(content);
-        resolve21();
+        resolve22();
         return;
       }
       const pager = spawn(cmd, args, {
@@ -29961,17 +30285,17 @@ var Pager = class {
       });
       pager.on("error", (_err) => {
         console.log(content);
-        resolve21();
+        resolve22();
       });
       pager.on("close", () => {
-        resolve21();
+        resolve22();
       });
       if (pager.stdin) {
         pager.stdin.write(content);
         pager.stdin.end();
       } else {
         console.log(content);
-        resolve21();
+        resolve22();
       }
     });
   }
@@ -29984,7 +30308,7 @@ function createPager(enabled = true) {
 init_services();
 
 // packages/cli/src/utils/registry-resolver.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function resolveRegistryPath(config) {
   if (config.registry?.git) {
     const gitConfig = config.registry.git;
@@ -29998,7 +30322,7 @@ async function resolveRegistryPath(config) {
     if (isValid) {
       const subPath2 = gitConfig.path ?? "";
       return {
-        path: subPath2 ? join10(cachePath, subPath2) : cachePath,
+        path: subPath2 ? join11(cachePath, subPath2) : cachePath,
         isRemote: true,
         source: "git"
       };
@@ -30027,7 +30351,7 @@ async function resolveRegistryPath(config) {
     }
     const subPath = gitConfig.path ?? "";
     return {
-      path: subPath ? join10(cachePath, subPath) : cachePath,
+      path: subPath ? join11(cachePath, subPath) : cachePath,
       isRemote: true,
       source: "git"
     };
@@ -30077,17 +30401,17 @@ function detectOutputConflicts(targets) {
 
 // packages/cli/src/commands/compile.ts
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname8(__filename2);
+var __dirname2 = dirname9(__filename2);
 async function loadBundledSkillContent(logger) {
   const skillRelPath = "skills/promptscript/SKILL.md";
   const candidates = [
-    resolve7(__dirname2, skillRelPath),
+    resolve8(__dirname2, skillRelPath),
     // bundled: dist/packages/cli/skills/...
-    resolve7(__dirname2, "..", "..", skillRelPath)
+    resolve8(__dirname2, "..", "..", skillRelPath)
     // dev: packages/cli/skills/...
   ];
   for (const candidate of candidates) {
-    if (existsSync11(candidate)) {
+    if (existsSync12(candidate)) {
       try {
         const content = await readFile12(candidate, "utf-8");
         logger.debug(
@@ -30104,8 +30428,8 @@ async function loadBundledSkillContent(logger) {
 }
 function findConfigInDir(dir) {
   for (const file of CONFIG_FILES) {
-    const fullPath = resolve7(dir, file);
-    if (existsSync11(fullPath)) {
+    const fullPath = resolve8(dir, file);
+    if (existsSync12(fullPath)) {
       return fullPath;
     }
   }
@@ -30161,7 +30485,7 @@ function getBuildProfile(config, buildName) {
 }
 function resolveOutputBase(projectRoot, output) {
   if (!output) return projectRoot;
-  return isAbsolute5(output) ? output : resolve7(projectRoot, output);
+  return isAbsolute5(output) ? output : resolve8(projectRoot, output);
 }
 async function isPromptScriptGenerated2(filePath) {
   try {
@@ -30205,13 +30529,13 @@ async function writeOutputs(outputs, options, _config, services) {
   const targetErrors = [];
   async function safeWrite(path, content) {
     try {
-      await mkdir4(dirname8(path), { recursive: true });
+      await mkdir4(dirname9(path), { recursive: true });
       await writeFile4(path, content, "utf-8");
       return true;
     } catch (err) {
       const nodeErr = err;
       if (nodeErr.code === "ENOTDIR") {
-        const conflictPath = nodeErr.path ?? dirname8(path);
+        const conflictPath = nodeErr.path ?? dirname9(path);
         const msg = `Cannot create directory because '${conflictPath}' already exists as a file. Remove it or disable this target.`;
         targetErrors.push(msg);
         ConsoleOutput.error(msg);
@@ -30227,8 +30551,8 @@ async function writeOutputs(outputs, options, _config, services) {
     }
   }
   for (const output of outputs.values()) {
-    const outputPath = options.output ? resolve7(options.output, output.path) : resolve7(output.path);
-    const fileExists3 = existsSync11(outputPath);
+    const outputPath = options.output ? resolve8(options.output, output.path) : resolve8(output.path);
+    const fileExists3 = existsSync12(outputPath);
     if (options.dryRun) {
       if (fileExists3) {
         const isGenerated2 = await isPromptScriptGenerated2(outputPath);
@@ -30361,7 +30685,7 @@ async function compileCommand(options, services = createDefaultServices()) {
   const spinner = createSpinner("Loading configuration...").start();
   const logger = createCliLogger();
   try {
-    const projectRoot = options.cwd ? resolve7(options.cwd) : process.cwd();
+    const projectRoot = options.cwd ? resolve8(options.cwd) : process.cwd();
     logger.verbose("Loading configuration...");
     const configPath = options.config ? options.config : options.cwd ? findConfigInDir(projectRoot) : void 0;
     const config = await loadConfig(configPath);
@@ -30401,7 +30725,7 @@ Disable one of the conflicting targets or assign a custom output path.`
       }
     }
     let lockfile;
-    const lockfilePath = resolve7(projectRoot, "promptscript.lock");
+    const lockfilePath = resolve8(projectRoot, "promptscript.lock");
     try {
       const lockfileContent = await readFile12(lockfilePath, "utf-8");
       const parsed = parseYaml5(lockfileContent, { maxAliasCount: 100 });
@@ -30421,7 +30745,7 @@ Disable one of the conflicting targets or assign a custom output path.`
     if (config.includePromptScriptSkill !== false) {
       skillContent = await loadBundledSkillContent(logger);
     }
-    const localPath = resolve7(projectRoot, ".promptscript");
+    const localPath = resolve8(projectRoot, ".promptscript");
     const compiler = new Compiler({
       resolver: {
         registryPath,
@@ -30441,8 +30765,8 @@ Disable one of the conflicting targets or assign a custom output path.`
       ignoreHashes: options.ignoreHashes
     });
     const entry = buildProfile?.entry ?? config.input?.entry;
-    const entryPath = entry ? resolve7(projectRoot, entry) : resolve7(localPath, "project.prs");
-    if (!existsSync11(entryPath)) {
+    const entryPath = entry ? resolve8(projectRoot, entry) : resolve8(localPath, "project.prs");
+    if (!existsSync12(entryPath)) {
       spinner.fail("Entry file not found");
       ConsoleOutput.error(`File not found: ${entryPath}`);
       ConsoleOutput.muted("Run: prs init");
@@ -30467,6 +30791,7 @@ Disable one of the conflicting targets or assign a custom output path.`
       ...options,
       output: resolveOutputBase(projectRoot, configuredOutput)
     };
+    await postFormatWithPrettier(result.outputs, projectRoot, logger);
     const writeResult = await writeOutputs(result.outputs, effectiveOptions, config, services);
     if (writeResult.unchanged.length > 0) {
       ConsoleOutput.muted(`Unchanged ${writeResult.unchanged.length} file(s)`);
@@ -30480,7 +30805,7 @@ Disable one of the conflicting targets or assign a custom output path.`
       ConsoleOutput.newline();
       ConsoleOutput.info("Watching for changes... (Ctrl+C to stop)");
       watchForChanges(
-        resolve7(projectRoot, ".promptscript"),
+        resolve8(projectRoot, ".promptscript"),
         () => compileCommand({ ...options, watch: false }, services)
       );
     }
@@ -30531,8 +30856,8 @@ function watchForChanges(dir, callback) {
 }
 
 // packages/cli/src/commands/validate.ts
-import { resolve as resolve8, join as join11 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync4, writeFileSync, readdirSync } from "fs";
+import { resolve as resolve9, join as join12 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync4, writeFileSync, readdirSync } from "fs";
 init_console();
 init_src();
 init_src2();
@@ -30641,7 +30966,7 @@ function discoverPrsFiles(dir) {
   try {
     const entries = readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join11(dir, entry.name);
+      const fullPath = join12(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...discoverPrsFiles(fullPath));
       } else if (entry.name.endsWith(".prs")) {
@@ -30681,8 +31006,8 @@ async function validateCommand(options) {
       formatters: []
       // No formatters needed for validation only
     });
-    const entryPath = resolve8("./.promptscript/project.prs");
-    if (!existsSync12(entryPath)) {
+    const entryPath = resolve9("./.promptscript/project.prs");
+    if (!existsSync13(entryPath)) {
       handleEntryNotFound(entryPath, isJsonFormat, spinner);
       return;
     }
@@ -30764,8 +31089,8 @@ ${fixedCount} file(s) fixed.`);
 
 // packages/cli/src/commands/pull.ts
 import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { existsSync as existsSync13 } from "fs";
-import { resolve as resolve9, dirname as dirname9 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { resolve as resolve10, dirname as dirname10 } from "path";
 init_console();
 async function pullCommand(options) {
   const spinner = createSpinner("Loading configuration...").start();
@@ -30790,8 +31115,8 @@ async function pullCommand(options) {
     }
     spinner.text = `Fetching ${inheritPath}...`;
     const content = await registry2.fetch(inheritPath);
-    const destPath = resolve9("./.promptscript/.inherited", inheritPath);
-    if (existsSync13(destPath) && !options.force && !options.dryRun) {
+    const destPath = resolve10("./.promptscript/.inherited", inheritPath);
+    if (existsSync14(destPath) && !options.force && !options.dryRun) {
       spinner.warn("File already exists (use --force to overwrite)");
       ConsoleOutput.muted(destPath);
       return;
@@ -30801,12 +31126,12 @@ async function pullCommand(options) {
       ConsoleOutput.newline();
       ConsoleOutput.dryRun(`Would fetch: ${config.inherit}`);
       ConsoleOutput.dryRun(`       to: ${destPath}`);
-      if (existsSync13(destPath)) {
+      if (existsSync14(destPath)) {
         ConsoleOutput.dryRun("(would overwrite existing file)");
       }
       return;
     }
-    await mkdir5(dirname9(destPath), { recursive: true });
+    await mkdir5(dirname10(destPath), { recursive: true });
     await writeFile5(destPath, content, "utf-8");
     spinner.succeed("Pulled from registry");
     ConsoleOutput.success(destPath);
@@ -30849,10 +31174,10 @@ async function createRegistry(config, options, spinner) {
   }
   const registryPath = config.registry?.path ?? "./registry";
   spinner.text = `Using local registry: ${registryPath}...`;
-  if (!existsSync13(registryPath)) {
+  if (!existsSync14(registryPath)) {
     throw new Error(`Local registry path not found: ${registryPath}`);
   }
-  return createFileSystemRegistry(resolve9(registryPath));
+  return createFileSystemRegistry(resolve10(registryPath));
 }
 function parseInheritPath(inheritPath) {
   const versionIndex = inheritPath.lastIndexOf("@");
@@ -30899,9 +31224,9 @@ function handlePullError(error, spinner) {
 }
 
 // packages/cli/src/commands/diff.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 import { readFile as readFile13 } from "fs/promises";
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 init_console();
 import chalk2 from "chalk";
 function configureColors(options) {
@@ -30936,9 +31261,9 @@ function printNewFilePreview(content, showFull, pager) {
   }
 }
 async function compareOutput(_name, output, _config, showFull, pager) {
-  const outputPath = resolve10(output.path);
+  const outputPath = resolve11(output.path);
   const newContent = output.content;
-  if (!existsSync14(outputPath)) {
+  if (!existsSync15(outputPath)) {
     pager.write(chalk2.green(`+ ${outputPath} (new file)`));
     pager.write("");
     printNewFilePreview(newContent, showFull, pager);
@@ -30978,8 +31303,8 @@ async function diffCommand(options) {
       formatters: targets,
       customConventions: config.customConventions
     });
-    const entryPath = resolve10("./.promptscript/project.prs");
-    if (!existsSync14(entryPath)) {
+    const entryPath = resolve11("./.promptscript/project.prs");
+    if (!existsSync15(entryPath)) {
       spinner.fail("Entry file not found");
       ConsoleOutput.error(`File not found: ${entryPath}`);
       ConsoleOutput.muted("Run: prs init");
@@ -31047,8 +31372,8 @@ function printSimpleDiff(existingLines, newLines, showFull, pager) {
 }
 
 // packages/cli/src/commands/check.ts
-import { existsSync as existsSync15 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { resolve as resolve12 } from "path";
 init_console();
 async function checkCommand(_options) {
   const spinner = createSpinner("Checking project health...").start();
@@ -31111,7 +31436,7 @@ async function checkCommand(_options) {
       });
     }
     const entryPath = config.input?.entry ?? ".promptscript/project.prs";
-    if (existsSync15(entryPath)) {
+    if (existsSync16(entryPath)) {
       results.push({
         name: "Entry file",
         status: "ok",
@@ -31126,8 +31451,8 @@ async function checkCommand(_options) {
       hasErrors = true;
     }
     if (config.registry?.path) {
-      const registryPath = resolve11(config.registry.path);
-      if (existsSync15(registryPath)) {
+      const registryPath = resolve12(config.registry.path);
+      if (existsSync16(registryPath)) {
         results.push({
           name: "Registry path",
           status: "ok",
@@ -31212,21 +31537,21 @@ function printResults(results) {
 init_src();
 init_console();
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname10 } from "path";
+import { dirname as dirname11 } from "path";
 
 // packages/cli/src/utils/version-check.ts
 init_console();
 import { homedir as homedir3 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { readFile as readFile14, writeFile as writeFile6, mkdir as mkdir6 } from "fs/promises";
 var NPM_REGISTRY_URL = "https://registry.npmjs.org/@promptscript/cli/latest";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 3e3;
 function getCacheDir() {
-  return join12(homedir3(), ".promptscript", ".cache");
+  return join13(homedir3(), ".promptscript", ".cache");
 }
 function getCachePath() {
-  return join12(getCacheDir(), "version.json");
+  return join13(getCacheDir(), "version.json");
 }
 async function readCache() {
   try {
@@ -31365,7 +31690,7 @@ function printUpdateNotification(info) {
 
 // packages/cli/src/commands/update-check.ts
 var __filename3 = fileURLToPath3(import.meta.url);
-var __dirname3 = dirname10(__filename3);
+var __dirname3 = dirname11(__filename3);
 async function updateCheckCommand() {
   const currentVersion = getPackageVersion(__dirname3, "./package.json");
   console.log(`@promptscript/cli v${currentVersion}`);
@@ -31393,7 +31718,7 @@ init_services();
 init_console();
 
 // packages/cli/src/utils/registry-scaffolder.ts
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var SEED_BASE = `@meta {
   id: "@core/base"
   syntax: "1.0.0"
@@ -31494,14 +31819,14 @@ async function scaffoldRegistry(options, services) {
   const createdFiles = [];
   await fs4.mkdir(directory, { recursive: true });
   const manifest = generateManifest(name, description, namespaces, seed);
-  const manifestPath = join13(directory, "registry-manifest.yaml");
+  const manifestPath = join14(directory, "registry-manifest.yaml");
   await fs4.writeFile(manifestPath, manifest, "utf-8");
   createdFiles.push(manifestPath);
   const readme = generateReadme(name, description, namespaces);
-  const readmePath = join13(directory, "README.md");
+  const readmePath = join14(directory, "README.md");
   await fs4.writeFile(readmePath, readme, "utf-8");
   createdFiles.push(readmePath);
-  const gitignorePath = join13(directory, ".gitignore");
+  const gitignorePath = join14(directory, ".gitignore");
   await fs4.writeFile(
     gitignorePath,
     ".DS_Store\nnode_modules/\n*.log\n*.swp\n*.bak\n.env*\n",
@@ -31509,20 +31834,20 @@ async function scaffoldRegistry(options, services) {
   );
   createdFiles.push(gitignorePath);
   for (const ns of namespaces) {
-    const nsDir = join13(directory, ns);
+    const nsDir = join14(directory, ns);
     await fs4.mkdir(nsDir, { recursive: true });
     if (seed && ns === "@core") {
-      const basePath = join13(nsDir, "base.prs");
+      const basePath = join14(nsDir, "base.prs");
       await fs4.writeFile(basePath, SEED_BASE, "utf-8");
       createdFiles.push(basePath);
-      const qualityPath = join13(nsDir, "quality.prs");
+      const qualityPath = join14(nsDir, "quality.prs");
       await fs4.writeFile(qualityPath, SEED_QUALITY, "utf-8");
       createdFiles.push(qualityPath);
-      const securityPath = join13(nsDir, "security.prs");
+      const securityPath = join14(nsDir, "security.prs");
       await fs4.writeFile(securityPath, SEED_SECURITY, "utf-8");
       createdFiles.push(securityPath);
     } else {
-      const gitkeepPath = join13(nsDir, ".gitkeep");
+      const gitkeepPath = join14(nsDir, ".gitkeep");
       await fs4.writeFile(gitkeepPath, "", "utf-8");
       createdFiles.push(gitkeepPath);
     }
@@ -31631,7 +31956,7 @@ Then reference configs with \`@inherit\` or \`@use\`:
 }
 
 // packages/cli/src/utils/resolve-target-directory.ts
-import { join as join14, resolve as resolve12 } from "path";
+import { join as join15, resolve as resolve13 } from "path";
 
 // packages/cli/src/utils/slugify.ts
 function slugify(name) {
@@ -31642,7 +31967,7 @@ function slugify(name) {
 async function resolveTargetDirectory(options, services) {
   const { cwd, directoryArg, registryName, nonInteractive } = options;
   if (directoryArg) {
-    return resolve12(directoryArg);
+    return resolve13(directoryArg);
   }
   const empty = await isDirectoryEmpty(cwd, services.fs);
   if (empty && nonInteractive) {
@@ -31656,9 +31981,9 @@ async function resolveTargetDirectory(options, services) {
         { name: `Subdirectory (./${slugify(registryName)})`, value: "subdirectory" }
       ]
     });
-    return choice === "here" ? cwd : join14(cwd, slugify(registryName));
+    return choice === "here" ? cwd : join15(cwd, slugify(registryName));
   }
-  return join14(cwd, slugify(registryName));
+  return join15(cwd, slugify(registryName));
 }
 async function isDirectoryEmpty(dir, fs4) {
   const entries = await fs4.readdir(dir);
@@ -31749,15 +32074,15 @@ async function registryInitCommand(directory, options, services = createDefaultS
 // packages/cli/src/commands/registry/validate.ts
 init_services();
 init_console();
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 
 // packages/cli/src/utils/registry-validator.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function validateRegistry(registryPath, services) {
   const { fs: fs4 } = services;
   const issues = [];
-  const manifestPath = join15(registryPath, "registry-manifest.yaml");
+  const manifestPath = join16(registryPath, "registry-manifest.yaml");
   if (!fs4.existsSync(manifestPath)) {
     return {
       valid: false,
@@ -31849,7 +32174,7 @@ async function validateRegistry(registryPath, services) {
       });
     }
     if (entry.path) {
-      const prsPath = join15(registryPath, entry.path);
+      const prsPath = join16(registryPath, entry.path);
       if (!fs4.existsSync(prsPath)) {
         issues.push({
           severity: "error",
@@ -31884,7 +32209,7 @@ async function validateRegistry(registryPath, services) {
     });
   }
   for (const ns of namespaceNames) {
-    const nsDir = join15(registryPath, ns);
+    const nsDir = join16(registryPath, ns);
     if (fs4.existsSync(nsDir)) {
       try {
         const files = await fs4.readdir(nsDir);
@@ -31898,7 +32223,7 @@ async function validateRegistry(registryPath, services) {
               issues.push({
                 severity: "warning",
                 message: `Orphaned .prs file not in catalog: ${relativePath}`,
-                path: join15(nsDir, file)
+                path: join16(nsDir, file)
               });
             }
           }
@@ -31949,7 +32274,7 @@ function detectCircularDependencies(catalog) {
 
 // packages/cli/src/commands/registry/validate.ts
 async function registryValidateCommand(path, options, services = createDefaultServices()) {
-  const registryPath = resolve13(path ?? ".");
+  const registryPath = resolve14(path ?? ".");
   const spinner = createSpinner("Validating registry...").start();
   try {
     const result = await validateRegistry(registryPath, services);
@@ -32001,10 +32326,10 @@ async function registryValidateCommand(path, options, services = createDefaultSe
 // packages/cli/src/commands/registry/publish.ts
 init_services();
 init_console();
-import { resolve as resolve14, join as join16 } from "path";
+import { resolve as resolve15, join as join17 } from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 async function registryPublishCommand(path, options, services = createDefaultServices()) {
-  const registryPath = resolve14(path ?? ".");
+  const registryPath = resolve15(path ?? ".");
   try {
     if (!options.force) {
       const spinner2 = createSpinner("Validating registry...").start();
@@ -32024,7 +32349,7 @@ async function registryPublishCommand(path, options, services = createDefaultSer
         `Registry valid (${result.stats.catalogEntries} entries, ${result.stats.prsFiles} files)`
       );
     }
-    const manifestPath = join16(registryPath, "registry-manifest.yaml");
+    const manifestPath = join17(registryPath, "registry-manifest.yaml");
     if (services.fs.existsSync(manifestPath)) {
       const content = await services.fs.readFile(manifestPath, "utf-8");
       const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
@@ -32152,8 +32477,8 @@ async function registryListCommand() {
 // packages/cli/src/commands/registry/add.ts
 init_console();
 import { readFile as readFile16, writeFile as writeFile7, mkdir as mkdir7 } from "fs/promises";
-import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname11 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { dirname as dirname12 } from "path";
 import { parse as parseYaml8, stringify as stringifyYaml } from "yaml";
 init_user_config();
 async function registryAddCommand(alias, url, options) {
@@ -32183,12 +32508,12 @@ async function registryAddCommand(alias, url, options) {
   }
 }
 async function addToGlobalConfig(alias, url) {
-  const configDir = dirname11(USER_CONFIG_PATH);
-  if (!existsSync16(configDir)) {
+  const configDir = dirname12(USER_CONFIG_PATH);
+  if (!existsSync17(configDir)) {
     await mkdir7(configDir, { recursive: true });
   }
   let config = { version: "1" };
-  if (existsSync16(USER_CONFIG_PATH)) {
+  if (existsSync17(USER_CONFIG_PATH)) {
     const content = await readFile16(USER_CONFIG_PATH, "utf-8");
     const parsed = parseYaml8(content);
     if (parsed && typeof parsed === "object") {
@@ -32238,8 +32563,8 @@ function registerRegistryCommands(registry2) {
 
 // packages/cli/src/commands/lock.ts
 import { writeFile as writeFile8, readFile as readFile18 } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync19 } from "fs";
+import { resolve as resolve16 } from "path";
 import { parse as parseYaml9, stringify as stringifyYaml2 } from "yaml";
 init_console();
 init_src();
@@ -32247,9 +32572,9 @@ init_src();
 // packages/cli/src/commands/lock-scanner.ts
 init_src2();
 import { readFile as readFile17 } from "fs/promises";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 async function collectRemoteImports(entryPath, options) {
-  if (!existsSync17(entryPath)) {
+  if (!existsSync18(entryPath)) {
     return [];
   }
   const loader = new FileLoader({
@@ -32286,7 +32611,7 @@ async function collectRemoteImports(entryPath, options) {
           results.push(marker);
         }
       } else {
-        if (existsSync17(resolved)) {
+        if (existsSync18(resolved)) {
           await scan(resolved);
         }
       }
@@ -32312,8 +32637,8 @@ async function lockCommand(options) {
     const aliases = config.registries ?? {};
     const aliasEntries = Object.entries(aliases);
     const projectRoot = process.cwd();
-    const localPath = resolve15(projectRoot, ".promptscript");
-    const entryPath = config.input?.entry ? resolve15(projectRoot, config.input.entry) : resolve15(localPath, "project.prs");
+    const localPath = resolve16(projectRoot, ".promptscript");
+    const entryPath = config.input?.entry ? resolve16(projectRoot, config.input.entry) : resolve16(localPath, "project.prs");
     const scannedImports = await collectRemoteImports(entryPath, {
       localPath,
       registries: config.registries
@@ -32324,7 +32649,7 @@ async function lockCommand(options) {
       return;
     }
     let existing = { version: LOCKFILE_VERSION, dependencies: {} };
-    if (existsSync18(LOCKFILE_PATH)) {
+    if (existsSync19(LOCKFILE_PATH)) {
       try {
         const raw = await readFile18(LOCKFILE_PATH, "utf-8");
         const parsed = parseYaml9(raw, { maxAliasCount: 100 });
@@ -32393,7 +32718,7 @@ async function lockCommand(options) {
 
 // packages/cli/src/commands/update.ts
 import { writeFile as writeFile9, readFile as readFile19 } from "fs/promises";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { parse as parseYaml10, stringify as stringifyYaml3 } from "yaml";
 init_console();
 init_src();
@@ -32416,7 +32741,7 @@ async function updateCommand(packageArg, options) {
       return;
     }
     let existing = { version: LOCKFILE_VERSION, dependencies: {} };
-    if (existsSync19(LOCKFILE_PATH)) {
+    if (existsSync20(LOCKFILE_PATH)) {
       try {
         const raw = await readFile19(LOCKFILE_PATH, "utf-8");
         const parsed = parseYaml10(raw, { maxAliasCount: 100 });
@@ -32480,12 +32805,12 @@ async function updateCommand(packageArg, options) {
 init_console();
 init_src();
 import { readFile as readFile20, writeFile as writeFile10, mkdir as mkdir8, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync20 } from "fs";
-import { join as join17, resolve as resolve16 } from "path";
+import { existsSync as existsSync21 } from "fs";
+import { join as join18, resolve as resolve17 } from "path";
 import { homedir as homedir4 } from "os";
 import { parse as parseYaml11 } from "yaml";
 var VENDOR_DIR = ".promptscript/vendor";
-var CACHE_BASE = join17(homedir4(), ".promptscript", "cache", "registries");
+var CACHE_BASE = join18(homedir4(), ".promptscript", "cache", "registries");
 async function vendorSyncCommand(options) {
   const spinner = createSpinner("Syncing vendor directory...").start();
   try {
@@ -32503,13 +32828,13 @@ async function vendorSyncCommand(options) {
     }
     const results = [];
     for (const [repoUrl, dep] of deps) {
-      const cacheDir = join17(CACHE_BASE, repoUrl.replace(/[/:]/g, "_"), dep.version);
-      if (!existsSync20(cacheDir)) {
+      const cacheDir = join18(CACHE_BASE, repoUrl.replace(/[/:]/g, "_"), dep.version);
+      if (!existsSync21(cacheDir)) {
         results.push({ repoUrl, status: "missing" });
         continue;
       }
       if (!options.dryRun) {
-        const vendorTarget = resolve16(VENDOR_DIR, repoUrl.replace(/[/:]/g, "_"));
+        const vendorTarget = resolve17(VENDOR_DIR, repoUrl.replace(/[/:]/g, "_"));
         await mkdir8(vendorTarget, { recursive: true });
         await copyDirectory(cacheDir, vendorTarget);
       }
@@ -32555,7 +32880,7 @@ async function vendorCheckCommand(_options) {
       spinner.warn("No dependencies in lockfile");
       return;
     }
-    if (!existsSync20(VENDOR_DIR)) {
+    if (!existsSync21(VENDOR_DIR)) {
       spinner.fail("Vendor directory does not exist");
       ConsoleOutput.muted("Run: prs vendor sync");
       process.exitCode = 1;
@@ -32563,8 +32888,8 @@ async function vendorCheckCommand(_options) {
     }
     const issues = [];
     for (const [repoUrl] of deps) {
-      const vendorTarget = resolve16(VENDOR_DIR, repoUrl.replace(/[/:]/g, "_"));
-      if (!existsSync20(vendorTarget)) {
+      const vendorTarget = resolve17(VENDOR_DIR, repoUrl.replace(/[/:]/g, "_"));
+      if (!existsSync21(vendorTarget)) {
         issues.push({ repoUrl, issue: "missing from vendor directory" });
       }
     }
@@ -32587,7 +32912,7 @@ async function vendorCheckCommand(_options) {
   }
 }
 async function loadLockfile() {
-  if (!existsSync20(LOCKFILE_PATH)) {
+  if (!existsSync21(LOCKFILE_PATH)) {
     return null;
   }
   try {
@@ -32601,8 +32926,8 @@ async function loadLockfile() {
 async function copyDirectory(src, dest) {
   const entries = await readdir5(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = join17(src, entry.name);
-    const destPath = join17(dest, entry.name);
+    const srcPath = join18(src, entry.name);
+    const destPath = join18(dest, entry.name);
     if (entry.isDirectory()) {
       await mkdir8(destPath, { recursive: true });
       await copyDirectory(srcPath, destPath);
@@ -32614,12 +32939,12 @@ async function copyDirectory(src, dest) {
 }
 
 // packages/cli/src/commands/resolve-cmd.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join19 } from "path";
 import { homedir as homedir5 } from "os";
 init_user_config();
 init_console();
-var CACHE_BASE2 = join18(homedir5(), ".promptscript", "cache", "registries");
+var CACHE_BASE2 = join19(homedir5(), ".promptscript", "cache", "registries");
 async function resolveCommand(importPath, _options) {
   try {
     const configFile = findConfigFile();
@@ -32661,11 +32986,11 @@ async function resolveCommand(importPath, _options) {
       }
       const { repoUrl, path, version } = expanded;
       const cacheVersion = version ?? "latest";
-      const cacheDir = join18(CACHE_BASE2, repoUrl.replace(/[/:]/g, "_"), cacheVersion);
-      const cacheExists = existsSync21(cacheDir);
+      const cacheDir = join19(CACHE_BASE2, repoUrl.replace(/[/:]/g, "_"), cacheVersion);
+      const cacheExists = existsSync22(cacheDir);
       const filePath = path.endsWith(".prs") ? path : `${path}.prs`;
-      const cachedFile = join18(cacheDir, filePath);
-      const fileExists3 = cacheExists && existsSync21(cachedFile);
+      const cachedFile = join19(cacheDir, filePath);
+      const fileExists3 = cacheExists && existsSync22(cachedFile);
       ConsoleOutput.newline();
       console.log(`  Alias:    ${aliasName} \u2192 ${repoUrl}`);
       console.log(`  Repo:     ${repoUrl}`);
@@ -32682,7 +33007,7 @@ async function resolveCommand(importPath, _options) {
       ConsoleOutput.newline();
     } else {
       const resolvedPath = importPath.endsWith(".prs") ? importPath : `${importPath}.prs`;
-      const exists = existsSync21(resolvedPath);
+      const exists = existsSync22(resolvedPath);
       ConsoleOutput.newline();
       console.log(`  Import:   ${importPath}`);
       console.log(`  Type:     local file`);
@@ -32699,8 +33024,8 @@ async function resolveCommand(importPath, _options) {
 }
 
 // packages/cli/src/commands/inspect.ts
-import { existsSync as existsSync22 } from "fs";
-import { resolve as resolve17, basename as basename12 } from "path";
+import { existsSync as existsSync23 } from "fs";
+import { resolve as resolve18, basename as basename13 } from "path";
 init_console();
 async function inspectCommand(skillName, options) {
   const isJson = options.format === "json";
@@ -32713,8 +33038,8 @@ async function inspectCommand(skillName, options) {
       localPath: "./.promptscript",
       registries: config.registries
     });
-    const entryPath = resolve17("./.promptscript/project.prs");
-    if (!existsSync22(entryPath)) {
+    const entryPath = resolve18("./.promptscript/project.prs");
+    if (!existsSync23(entryPath)) {
       spinner.stop();
       ConsoleOutput.error(`Entry file not found: ${entryPath}`);
       process.exitCode = 1;
@@ -32786,7 +33111,7 @@ function summarizeValue(val) {
   return String(val);
 }
 function shortPath(source) {
-  return basename12(source);
+  return basename13(source);
 }
 function getPropertySource(propName, trace, baseSource) {
   for (let i = trace.length - 1; i >= 0; i--) {
@@ -32894,8 +33219,8 @@ init_console();
 // packages/cli/src/commands/import.ts
 init_src3();
 init_console();
-import { resolve as resolve18, join as join19, basename as basename13 } from "path";
-import { writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync23 } from "fs";
+import { resolve as resolve19, join as join20, basename as basename14 } from "path";
+import { writeFileSync as writeFileSync2, mkdirSync, existsSync as existsSync24 } from "fs";
 import { stat as stat2, readdir as readdir6, readFile as readFile21, writeFile as writeFile11, mkdir as mkdir9 } from "fs/promises";
 function parseInstructionFrontmatter(content) {
   const match = /^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/.exec(content);
@@ -32923,10 +33248,10 @@ async function importDirectory(dirPath) {
   }
   const lines = ["@meta {", '  version: "1.0"', "}", "", "@guards {"];
   for (const filename of instructionFiles) {
-    const filePath = join19(dirPath, filename);
+    const filePath = join20(dirPath, filename);
     const content = await readFile21(filePath, "utf-8");
     const frontmatter = parseInstructionFrontmatter(content);
-    const entryName = basename13(filename).replace(/\.instructions\.md$/i, "");
+    const entryName = basename14(filename).replace(/\.instructions\.md$/i, "");
     if (frontmatter) {
       const globPatterns = frontmatter.applyTo.map((p) => `"${p}"`).join(", ");
       lines.push(`  ${entryName}(${globPatterns}) {`);
@@ -32949,7 +33274,7 @@ async function importDirectory(dirPath) {
   return lines.join("\n");
 }
 async function importCommand(file, options) {
-  const filepath = resolve18(file);
+  const filepath = resolve19(file);
   const inputStat = await stat2(filepath).catch(() => null);
   if (inputStat?.isDirectory()) {
     const prsContent = await importDirectory(filepath);
@@ -32959,7 +33284,7 @@ async function importCommand(file, options) {
     }
     const outputDir = options.output ?? ".promptscript";
     await mkdir9(outputDir, { recursive: true });
-    const outputPath = join19(outputDir, "imported.prs");
+    const outputPath = join20(outputDir, "imported.prs");
     await writeFile11(outputPath, prsContent);
     console.log(`\u2714 Imported directory to ${outputPath}`);
     return;
@@ -32981,11 +33306,11 @@ async function importCommand(file, options) {
       console.log(result.prsContent);
       return;
     }
-    const outputDir = resolve18(options.output ?? ".promptscript");
-    if (!existsSync23(outputDir)) {
+    const outputDir = resolve19(options.output ?? ".promptscript");
+    if (!existsSync24(outputDir)) {
       mkdirSync(outputDir, { recursive: true });
     }
-    const outputPath = resolve18(outputDir, "imported.prs");
+    const outputPath = resolve19(outputDir, "imported.prs");
     writeFileSync2(outputPath, result.prsContent, "utf-8");
     ConsoleOutput.success(`Written to ${outputPath}`);
     if (options.validate) {
@@ -33100,18 +33425,18 @@ async function detectMarker(filePath) {
 }
 
 // packages/cli/src/hooks/debounce-lock.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync24, writeFileSync as writeFileSync4, unlinkSync, statSync } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync25, writeFileSync as writeFileSync4, unlinkSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var STALE_THRESHOLD_MS = 3e4;
 function getLockPath(projectDir) {
-  const hash = createHash2("md5").update(projectDir).digest("hex").slice(0, 12);
-  return join20(tmpdir(), `prs-compile-${hash}.lock`);
+  const hash = createHash3("md5").update(projectDir).digest("hex").slice(0, 12);
+  return join21(tmpdir(), `prs-compile-${hash}.lock`);
 }
 function acquireLock(projectDir) {
   const lockPath = getLockPath(projectDir);
-  if (existsSync24(lockPath)) {
+  if (existsSync25(lockPath)) {
     try {
       const stat4 = statSync(lockPath);
       const age = Date.now() - stat4.mtimeMs;
@@ -33219,9 +33544,10 @@ Usage: echo '{"file_path":"..."}' | prs hook ${action}
 init_hooks();
 
 // packages/cli/src/commands/skills.ts
-import { writeFile as writeFile12, readFile as readFile23, readdir as readdir7 } from "fs/promises";
-import { resolve as resolve19 } from "path";
-import { existsSync as existsSync25 } from "fs";
+import { writeFile as writeFile12, readFile as readFile23, readdir as readdir7, mkdtemp, rm } from "fs/promises";
+import { resolve as resolve20, join as join22, basename as basename15, dirname as dirname13 } from "path";
+import { existsSync as existsSync26 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
 import { parse as parseYaml12, stringify as stringifyYaml4 } from "yaml";
 init_console();
 init_src();
@@ -33241,6 +33567,77 @@ function normalizeSkillSource(input2) {
   }
   return source;
 }
+function extractSubPath(source) {
+  const parts = source.replace(/^https?:\/\//, "").split("/");
+  return parts.length > 3 ? parts.slice(3).join("/") : "";
+}
+function deriveSkillFolderName(source) {
+  const subPath = extractSubPath(source);
+  if (!subPath) return void 0;
+  if (!subPath.toLowerCase().endsWith(".md")) return void 0;
+  const parent = dirname13(subPath);
+  if (parent === "." || parent === "") return void 0;
+  return basename15(parent);
+}
+function collectExistingSkillNames(lockfile, exclude) {
+  const names = /* @__PURE__ */ new Set();
+  for (const [key, dep] of Object.entries(lockfile.dependencies)) {
+    if (dep.source !== "md") continue;
+    if (exclude && key === exclude) continue;
+    const name = deriveSkillFolderName(key);
+    if (name) names.add(name);
+  }
+  return names;
+}
+async function fetchAndValidateRemoteSkill(source, options) {
+  const subPath = extractSubPath(source);
+  if (!subPath || !subPath.toLowerCase().endsWith(".md")) {
+    return void 0;
+  }
+  const repoUrl = extractRepoUrl(source);
+  const tmp = await mkdtemp(join22(tmpdir2(), "prs-skill-validate-"));
+  try {
+    const gitRegistry = createGitRegistry({ url: repoUrl });
+    await gitRegistry.cloneAtTag(repoUrl, options.version, tmp);
+    const filePath = join22(tmp, subPath);
+    if (!existsSync26(filePath)) {
+      return {
+        content: "",
+        integrity: "",
+        valid: false,
+        issues: [
+          {
+            severity: "error",
+            code: "SK000",
+            message: `File '${subPath}' does not exist in ${repoUrl} at ${options.version}.`
+          }
+        ]
+      };
+    }
+    const content = await readFile23(filePath, "utf-8");
+    const integrity = hashContent(Buffer.from(content, "utf-8"));
+    const result = validateSkillFrontmatter(content, {
+      filePath,
+      existingNames: options.existingNames
+    });
+    return { content, integrity, valid: result.valid, issues: result.issues };
+  } finally {
+    await rm(tmp, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+function printValidationIssues(issues) {
+  if (issues.length === 0) return;
+  ConsoleOutput.newline();
+  const formatted = formatSkillValidationIssues(issues);
+  for (const line of formatted.split("\n")) {
+    if (line.includes("\u2717")) {
+      ConsoleOutput.error(line);
+    } else {
+      ConsoleOutput.warn(line);
+    }
+  }
+}
 var HEADER_DIRECTIVES = ["@use ", "@inherit ", "@meta "];
 function extractRepoUrl(source) {
   const parts = source.replace(/^https?:\/\//, "").split("/");
@@ -33268,8 +33665,8 @@ function validateRemoteSource(source) {
 }
 async function resolveEntryFile(fileFlag) {
   if (fileFlag) {
-    const resolved = resolve19(fileFlag);
-    if (!existsSync25(resolved)) {
+    const resolved = resolve20(fileFlag);
+    if (!existsSync26(resolved)) {
       throw new Error(`File not found: ${resolved}`);
     }
     return resolved;
@@ -33279,24 +33676,24 @@ async function resolveEntryFile(fileFlag) {
     try {
       const config = await loadConfig();
       if (config.input?.entry) {
-        const entryPath = resolve19(config.input.entry);
-        if (existsSync25(entryPath)) {
+        const entryPath = resolve20(config.input.entry);
+        if (existsSync26(entryPath)) {
           return entryPath;
         }
       }
     } catch {
     }
   }
-  const promptscriptDir = resolve19(".promptscript");
-  if (existsSync25(promptscriptDir)) {
+  const promptscriptDir = resolve20(".promptscript");
+  if (existsSync26(promptscriptDir)) {
     const entries = await readdir7(promptscriptDir);
     const prsFiles = entries.filter((f) => f.endsWith(".prs"));
     if (prsFiles.length === 1) {
-      return resolve19(promptscriptDir, prsFiles[0]);
+      return resolve20(promptscriptDir, prsFiles[0]);
     }
     if (prsFiles.length > 1) {
       if (prsFiles.includes("project.prs")) {
-        return resolve19(promptscriptDir, "project.prs");
+        return resolve20(promptscriptDir, "project.prs");
       }
       throw new Error(
         `Multiple .prs files found in .promptscript/. Use --file to specify which one.`
@@ -33340,7 +33737,7 @@ function extractUsePath(line) {
 }
 async function loadLockfile2() {
   const defaultLockfile = { version: LOCKFILE_VERSION, dependencies: {} };
-  if (!existsSync25(LOCKFILE_PATH)) {
+  if (!existsSync26(LOCKFILE_PATH)) {
     return defaultLockfile;
   }
   try {
@@ -33359,6 +33756,14 @@ async function saveLockfile(lockfile) {
 async function skillsAddCommand(rawSource, options) {
   const spinner = createSpinner("Adding skill...").start();
   try {
+    if (/^http:\/\//i.test(rawSource.trim())) {
+      spinner.fail("Plain HTTP sources are not allowed (security)");
+      ConsoleOutput.error(
+        "Use https:// or git@host:owner/repo. Cleartext git transport is rejected to prevent man-in-the-middle attacks."
+      );
+      process.exitCode = 1;
+      return;
+    }
     const source = normalizeSkillSource(rawSource);
     const sourceError = validateRemoteSource(source);
     if (sourceError) {
@@ -33387,15 +33792,52 @@ async function skillsAddCommand(rawSource, options) {
       process.exitCode = 1;
       return;
     }
+    const lockfile = await loadLockfile2();
+    let integrity = "sha256-pending";
+    let validationFailed = false;
+    if (!options.skipValidation) {
+      spinner.text = "Validating SKILL.md frontmatter...";
+      try {
+        const fetched = await fetchAndValidateRemoteSkill(source, {
+          existingNames: collectExistingSkillNames(lockfile),
+          version: "main"
+        });
+        if (fetched) {
+          integrity = fetched.integrity || integrity;
+          const hasErrors = !fetched.valid;
+          const hasWarnings = fetched.issues.some((i) => i.severity === "warning");
+          if (hasErrors || options.strict && hasWarnings) {
+            spinner.fail("SKILL.md failed validation");
+            printValidationIssues(fetched.issues);
+            ConsoleOutput.newline();
+            ConsoleOutput.muted(
+              "Re-run with --skip-validation to bypass (not recommended) or fix the upstream SKILL.md."
+            );
+            process.exitCode = 1;
+            validationFailed = true;
+          } else if (fetched.issues.length > 0) {
+            spinner.warn("SKILL.md has validation warnings");
+            printValidationIssues(fetched.issues);
+            spinner.start("Adding skill...");
+          }
+        }
+      } catch (err) {
+        spinner.warn("Could not validate SKILL.md ahead of time");
+        ConsoleOutput.muted(
+          `Reason: ${err instanceof Error ? err.message : String(err)}. Proceeding without frontmatter check.`
+        );
+        spinner.start("Adding skill...");
+      }
+    }
+    if (validationFailed) return;
     const insertionPoint = findInsertionPoint(lines);
     const newLine = `@use ${source}`;
     lines.splice(insertionPoint, 0, newLine);
     const updatedContent = lines.join("\n");
-    const lockfile = await loadLockfile2();
     const lockEntry = {
       version: "latest",
       commit: validation.headCommit ?? "0000000000000000000000000000000000000000",
-      integrity: "sha256-pending",
+      integrity,
       source: "md"
     };
     lockfile.dependencies[source] = lockEntry;
@@ -33523,10 +33965,39 @@ async function skillsUpdateCommand(name, options) {
           });
           continue;
         }
+        let integrity = dep.integrity ?? "sha256-pending";
+        if (!options.skipValidation) {
+          try {
+            const fetched = await fetchAndValidateRemoteSkill(key, {
+              existingNames: collectExistingSkillNames(lockfile, key),
+              version: dep.version === "latest" ? "main" : dep.version
+            });
+            if (fetched) {
+              integrity = fetched.integrity || integrity;
+              const hasErrors = !fetched.valid;
+              const hasWarnings = fetched.issues.some((i) => i.severity === "warning");
+              if (hasErrors || options.strict && hasWarnings) {
+                skipped.push({
+                  key,
+                  reason: "SKILL.md failed validation after update"
+                });
+                printValidationIssues(fetched.issues);
+                continue;
+              } else if (hasWarnings) {
+                ConsoleOutput.warn(`${key}: validation warnings`);
+                printValidationIssues(fetched.issues);
+              }
+            }
+          } catch (err) {
+            ConsoleOutput.warn(
+              `${key}: could not re-validate (${err instanceof Error ? err.message : String(err)})`
+            );
+          }
+        }
         lockfile.dependencies[key] = {
           version: dep.version ?? "latest",
           commit: validation.headCommit,
-          integrity: dep.integrity ?? "sha256-pending",
+          integrity,
           source: "md",
           fetchedAt
         };
@@ -33573,7 +34044,7 @@ async function skillsUpdateCommand(name, options) {
 
 // packages/cli/src/cli.ts
 var __filename4 = fileURLToPath4(import.meta.url);
-var __dirname4 = dirname14(__filename4);
+var __dirname4 = dirname16(__filename4);
 var program = new Command();
 program.name("prs").description("PromptScript CLI - Standardize AI instructions").version(getPackageVersion(__dirname3, "./package.json")).option("--verbose", "Enable verbose output").option("--debug", "Enable debug output (includes verbose)").option("--quiet", "Suppress non-error output").hook("preAction", async (thisCommand, actionCommand) => {
   const opts = thisCommand.opts();
@@ -33632,10 +34103,10 @@ program.command("resolve <import>").description("Show full resolution chain for
 program.command("hook").argument("<action>", "Hook action: pre-edit or post-edit").description("Hook handler invoked by AI tools (not for direct use)").action(hookCommand);
 program.command("hooks").argument("<action>", "Action: install or uninstall").argument("[tool]", "Tool: claude, gemini, copilot, cursor, windsurf, factory, cline").option("--all", "Install/uninstall for all detected tools").description("Manage PromptScript hooks for AI tools").action(hooksCommand);
 var skills = program.command("skills").description("Manage PromptScript skills");
-skills.command("add <source>").description("Add a remote skill to the project").option("-f, --file <file>", "Target .prs file to modify").option("--dry-run", "Preview changes without writing").action((source, opts) => skillsAddCommand(source, opts));
+skills.command("add <source>").description("Add a remote skill to the project").option("-f, --file <file>", "Target .prs file to modify").option("--dry-run", "Preview changes without writing").option("--skip-validation", "Skip SKILL.md frontmatter validation (not recommended)").option("--strict", "Treat validation warnings as errors").action((source, opts) => skillsAddCommand(source, opts));
 skills.command("remove <name>").description("Remove a skill from the project").option("--dry-run", "Preview changes without writing").action((name, opts) => skillsRemoveCommand(name, opts));
 skills.command("list").description("List skills imported in the current project").action(() => skillsListCommand());
-skills.command("update [name]").description("Update lock entries for markdown-sourced skills").option("--dry-run", "Preview changes without writing").action((name, opts) => skillsUpdateCommand(name, opts));
+skills.command("update [name]").description("Update lock entries for markdown-sourced skills").option("--dry-run", "Preview changes without writing").option("--skip-validation", "Skip SKILL.md frontmatter validation (not recommended)").option("--strict", "Treat validation warnings as errors").action((name, opts) => skillsUpdateCommand(name, opts));
 var registry = program.command("registry").description("Manage PromptScript registries");
 registerRegistryCommands(registry);
 function run(args = process.argv) {