@rayul/kordis 0.1.12 → 0.1.14

package/assets/kordis-publishing/SKILL.md

@@ -25,6 +25,18 @@ Publish a valid, AI-review-passing version. ALWAYS dry-run first.
   `version` differs from that result, the API rejects with `usage`. Either
   drop the `version` field on updates, set `--bump` to match, or align
   them.
+- RECOMMENDED: **omit `version:` from frontmatter on update pushes** and
+  use only `--bump patch|minor|major` to control versioning. Having both
+  is the most common push failure.
+
+## Deleting a package
+
+There is **no `kordis delete` CLI command**. Options:
+- Web UI: `https://kordis.store/p/<full_slug>` (if a delete button is available)
+- Registry owner: soft-delete via the prod Postgres
+  (`UPDATE packages SET deleted_at = NOW() WHERE full_slug = '...'`)
+- Workaround: push a new version with `visibility: unlisted` or a
+  deprecation notice in the body
 
 If the body contains third-party content, MUST preserve the original copyright
 and license text inside the body and link to source via `homepage`.

package/assets/kordis-using/SKILL.md

@@ -27,6 +27,14 @@ DEFAULT to `read` when you spontaneously want to consult a skill. DEFAULT to
 - Trust gate: only `review_status=passed` returned by default. To get a
   `pending_review` body, pass `--allow-pending` AFTER warning the user the
   package has not been AI-reviewed.
+- Note: `jit_blocked` fires for BOTH ineligible types AND packages still
+  under review. Check `kordis info --json` to distinguish: `review_status`
+  tells you which case you're in.
+
+`pull` vs `read` on pending packages: `pull` writes files even while
+`review_status=pending_review`; `read` blocks. When you need the content
+immediately (e.g. to verify a package you just pushed), use `pull` with
+`--tool <name>` — it bypasses the JIT trust gate.
 
 ## Commands
 

package/dist/index.js

@@ -842,6 +842,9 @@ var init_client = __esm({
       getPackage(username, slug) {
         return this.request(`/api/packages/${username}/${slug}`);
       }
+      deletePackage(username, slug) {
+        return this.request(`/api/packages/${username}/${slug}`, { method: "DELETE" });
+      }
       getContent(username, slug, opts = {}) {
         return this.request(
           `/api/packages/${username}/${slug}/content`,
@@ -972,7 +975,7 @@ var init_src2 = __esm({
 
 // src/index.ts
 init_src2();
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/commands/login.ts
 import { Command } from "commander";
@@ -1361,8 +1364,10 @@ function parseFrontmatter(source) {
   try {
     parsed = parseYaml(raw);
   } catch (err) {
+    const msg = err.message;
+    const hint = msg.includes("Nested mapping") || msg.includes("compact mapping") ? ' Hint: if a field value (e.g. description) contains a colon, wrap the entire value in quotes: description: "Use when... Trigger: X".' : "";
     throw new FrontmatterParseError(
-      `YAML frontmatter is malformed: ${err.message}`,
+      `YAML frontmatter is malformed: ${msg}${hint}`,
       { cause: err }
     );
   }
@@ -1408,6 +1413,14 @@ function pushCommand() {
       } else {
         content = await readFile3(abs, "utf8");
       }
+      let nameFromFm = null;
+      try {
+        const fm = parseFrontmatter(content).frontmatter ?? {};
+        const v = fm["name"];
+        if (typeof v === "string") nameFromFm = v;
+      } catch (err) {
+        throw new Error(err.message);
+      }
       let targetUser = null;
       let targetSlug = null;
       if (opts.slug && opts.slug.includes("/")) {
@@ -1417,13 +1430,6 @@ function pushCommand() {
           targetSlug = s2;
         }
       } else {
-        let nameFromFm = null;
-        try {
-          const fm = parseFrontmatter(content).frontmatter ?? {};
-          const v = fm["name"];
-          if (typeof v === "string") nameFromFm = v;
-        } catch {
-        }
         if (bundle.username && (opts.slug || nameFromFm)) {
           targetUser = bundle.username;
           targetSlug = opts.slug ?? nameFromFm;
@@ -2917,9 +2923,48 @@ function unstarCommand() {
   });
 }
 
+// src/commands/delete.ts
+import { Command as Command12 } from "commander";
+import prompts from "prompts";
+function deleteCommand() {
+  return new Command12("delete").description("permanently delete a package you own").argument("<full_slug>", "package identifier {username}/{slug}").option("--force", "skip the confirmation prompt").action(async (fullSlug, opts) => {
+    const [username, slug] = fullSlug.split("/");
+    if (!username || !slug) {
+      throw new Error('full_slug must be "{username}/{slug}"');
+    }
+    const bundle = await useClient();
+    const detail = await bundle.api.getPackage(username, slug);
+    if (!opts.force) {
+      printHuman(c.yellow(`  \u26A0  You are about to permanently delete:`));
+      printHuman(`     ${c.bold(detail.full_slug)}  v${detail.current_version}`);
+      printHuman(`     "${detail.description?.slice(0, 80) ?? ""}"`);
+      printHuman(c.yellow(`  The slug cannot be reused after deletion. This cannot be undone via the CLI.`));
+      printHuman("");
+      const { confirmed } = await prompts({
+        type: "confirm",
+        name: "confirmed",
+        message: `Delete ${c.bold(fullSlug)}?`,
+        initial: false
+      });
+      if (!confirmed) {
+        printHuman(c.gray("Aborted."));
+        process.exit(0);
+      }
+    }
+    await bundle.authedRequest((api) => api.deletePackage(username, slug));
+    printDual({
+      json: { status: "deleted", full_slug: fullSlug },
+      human: () => {
+        printHuman(c.green(`\u2713 Deleted ${c.bold(fullSlug)}`));
+        printHuman(c.gray(`  The package is no longer visible. Slug "${fullSlug}" is reserved permanently.`));
+      }
+    });
+  });
+}
+
 // src/index.ts
 function buildProgram() {
-  const program = new Command12("kordis").version(VERSION).description("Kordis \u2014 registry for agentic-coding packages").option("--json", "emit JSON output to stdout (default: human)", false).hook("preAction", (thisCommand) => {
+  const program = new Command13("kordis").version(VERSION).description("Kordis \u2014 registry for agentic-coding packages").option("--json", "emit JSON output to stdout (default: human)", false).hook("preAction", (thisCommand) => {
     const opts = thisCommand.optsWithGlobals();
     if (opts.json) setJsonMode(true);
   });
@@ -2934,6 +2979,7 @@ function buildProgram() {
   program.addCommand(commentCommand());
   program.addCommand(starCommand());
   program.addCommand(unstarCommand());
+  program.addCommand(deleteCommand());
   program.addCommand(setupCommand());
   return program;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",