@rbbtsn0w/adg 0.1.0-alpha.1

package/src/types.ts

@@ -0,0 +1,140 @@
+/**
+ * ADG type definitions mirroring the JSON Schemas under ../schemas.
+ */
+
+export const ADG_SCHEMA_VERSION = "adg.plugin/v1";
+export const LOCK_VERSION = 2;
+
+export interface AdgAuthor {
+  name: string;
+  url?: string;
+  email?: string;
+}
+
+export interface AdgInterface {
+  displayName?: string;
+  icon?: string;
+  [key: string]: unknown;
+}
+
+export interface AdgDependency {
+  name: string;
+  version: string;
+}
+
+export interface AdgManifest {
+  schemaVersion: typeof ADG_SCHEMA_VERSION;
+  name: string;
+  version: string;
+  description: string;
+  author?: AdgAuthor;
+  license?: string;
+  category?: string;
+  interface?: AdgInterface;
+  skills?: string | string[];
+  agents?: string;
+  commands?: string;
+  apps?: string;
+  hooks?: string;
+  mcp?: string;
+  dependencies?: AdgDependency[];
+  strict?: boolean;
+  homepage?: string;
+  changelog?: string;
+}
+
+/**
+ * Discriminated source union shared by marketplace entries (where to find a
+ * plugin) and lock entries (where a plugin came from). `local.path` is relative
+ * to the file that holds it; `github`/`git` carry an optional sub-path for
+ * monorepos.
+ */
+export type PluginSource =
+  | { type: "local"; path: string }
+  | { type: "github"; repo: string; ref?: string; path?: string }
+  | { type: "git"; url: string; ref?: string; path?: string };
+
+export type SourceType = PluginSource["type"];
+
+/** Self-describing content digest, e.g. "sha256-<hex>". */
+export type Integrity = string;
+
+/** The component categories a plugin can expose. */
+export const COMPONENT_TYPES = ["skills", "agents", "commands", "mcp", "hooks", "apps"] as const;
+export type ComponentType = (typeof COMPONENT_TYPES)[number];
+
+/**
+ * A partial-install selection. It is independent of packaging: the copied/hashed
+ * file set is the manifest's declared payload (see `packageFilter`), while this
+ * selection only narrows what the generated runtime manifests *expose*. Absent
+ * selection = expose everything.
+ */
+export interface PluginSelection {
+  /** Component categories to expose. */
+  components: ComponentType[];
+  /** When "skills" is selected, expose only these skill names (else all). */
+  skills?: string[];
+}
+
+export interface LockEntry {
+  /** Upstream provenance the plugin was installed from. */
+  origin: PluginSource;
+  version: string;
+  /** Content digest of the installed directory (excluding generated adapters). */
+  folderHash: Integrity;
+  installedAt: string;
+  updatedAt: string;
+  dependencies?: Record<string, string>;
+  /** Partial-install selection; absent means the whole plugin is exposed. */
+  selection?: PluginSelection;
+}
+
+export interface PluginLock {
+  version: number;
+  plugins: Record<string, LockEntry>;
+  lastSelected?: string[];
+}
+
+/**
+ * Marketplace entry source, in the object form ADG generates for the runtime
+ * export (Codex / vercel-labs `plugins` write `{ source: "local", path }` into
+ * ~/.agents/plugins/marketplace.json). marketplace.json is a pure export for
+ * runtime consumption; ADG's richer provenance/integrity lives in the lock.
+ *
+ * Hand-authored source catalogs (.agents/.marketplace.json) may use the simpler
+ * string shorthand `"./asc"` (local path) or a remote tagged-union object — see
+ * marketplace.schema.json. ADG's own code only ever produces/consumes this
+ * object form, so callers handle it directly.
+ */
+export interface MarketplaceSource {
+  source: string;
+  path: string;
+}
+
+export interface MarketplacePlugin {
+  name: string;
+  source: MarketplaceSource;
+  policy?: {
+    installation?: "AVAILABLE" | "BLOCKED";
+    authentication?: "ON_INSTALL" | "NONE";
+  };
+  category?: string;
+}
+
+export interface Marketplace {
+  name: string;
+  description?: string;
+  owner?: { name?: string; email?: string; url?: string };
+  /** @deprecated prefer top-level `description`. */
+  interface?: { displayName?: string };
+  plugins: MarketplacePlugin[];
+}
+
+/** Structural equality for provenance/source comparison (collision checks). */
+export function sameSource(a: PluginSource, b: PluginSource): boolean {
+  if (a.type !== b.type) return false;
+  if (a.type === "local" && b.type === "local") return a.path === b.path;
+  if (a.type === "github" && b.type === "github") return a.repo === b.repo && a.path === b.path;
+  if (a.type === "git" && b.type === "git") return a.url === b.url && a.path === b.path;
+  return false;
+}

package/vendor/skills/LICENSE

@@ -0,0 +1,29 @@
+MIT License
+
+This directory vendors the `skills` CLI (https://github.com/vercel-labs/skills),
+which is distributed under the MIT License (declared in the upstream README and
+in the npm package's package.json `"license": "MIT"`). The upstream repository
+did not ship a standalone LICENSE file or an explicit copyright line; the
+copyright is held by the upstream authors (Vercel Labs and the `skills`
+contributors). The standard MIT terms below are reproduced here to satisfy the
+license's notice requirement for this redistribution.
+
+Copyright (c) Vercel Labs and the `skills` contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/skills/PROVENANCE.md

@@ -0,0 +1,60 @@
+# Vendored: skills CLI
+
+This directory is a **fork (verbatim vendoring) of the `skills` CLI source**,
+wrapped by `adg skills`.
+
+| Field | Value |
+|-------|-------|
+| Upstream repo | https://github.com/vercel-labs/skills |
+| npm package | `skills` (v1.5.11) |
+| Vendored commit | `be0dd25b4a8665894a56f45ef582cc02ca802c39` |
+| Vendored on | 2026-06-11 |
+| What was copied | `src/` (excluding `*.test.ts`) and `ThirdPartyNoticeText.txt` |
+
+## License — MIT
+
+The upstream `skills` is **MIT-licensed**, declared in two places:
+
+- the repository `README.md` (`## License` → `MIT`), and
+- the npm package `package.json` (`"license": "MIT"`, retained here).
+
+GitHub's API reports `license: null` only because the upstream repo ships no
+*standalone LICENSE file* (the API's detector keys on a LICENSE file, not a
+README section). This is a best-practice gap, not a missing grant — MIT use,
+modification and redistribution are permitted provided the copyright and
+permission notice are retained.
+
+To satisfy MIT's notice requirement for this redistribution, this directory
+includes a reconstructed [`LICENSE`](LICENSE) (standard MIT text + attribution
+to the upstream authors) and the upstream `ThirdPartyNoticeText.txt`. The
+upstream did not provide an explicit copyright line; attribution is to
+Vercel Labs and the `skills` contributors.
+
+Nice-to-have (not blocking): ask upstream to add a standalone `LICENSE` file so
+the grant is unambiguous and machine-detectable.
+
+Do not edit files under `src/` casually: keeping them close to upstream eases a
+future re-sync or clean-room replacement. ADG-side glue lives outside this
+directory.
+
+## Local patches (re-apply after any re-sync)
+
+These intentional deviations from upstream must be carried forward when
+re-vendoring. Each is marked inline with an `ADG patch:` comment.
+
+| File | Change | Why |
+|------|--------|-----|
+| `src/skill-lock.ts` → `getSkillLockPath()` | XDG global lock path `$XDG_STATE_HOME/skills/.skill-lock.json` → `$XDG_STATE_HOME/.agents/.skill-lock.json` | Keep the skills and plugins domains under one shared `.agents/` home in XDG mode, matching ADG's `globalPluginsDir()`. Upstream's `skills/` subpath split the root and scattered global state. See docs/agents-spec.md §1. |
+| `src/agents.ts` → `universal` agent `globalSkillsDir` (+ new `agentsHome` const) | `$XDG_CONFIG_HOME/agents/skills` → `<$XDG_STATE_HOME or ~>/.agents/skills` | Same root principle. Upstream's universal *global* dir used XDG-**config**, splitting it from its own *project* dir (`.agents/skills`) and from the lock. Now all share `$XDG_STATE_HOME/.agents` (or `~/.agents`). See docs/agents-spec.md §1. |
+| `src/blob.ts` → `fetchRepoTree` / `fetchTreeBranch` (+ `authMayHelp` on `BranchFetchResult`) | Retry authenticated on 401/403/404, not only on a rate-limit 403 | **Private-repo bug**: GitHub returns 404 to anonymous tree requests for private repos. Upstream only fell back to a token on rate limit, so private skills sources never used the token and always "failed to fetch tree". |
+| `src/skill-lock.ts` → `getGitHubToken` warning text | "GitHub rate limit reached" → "GitHub authentication needed" | The resolver is now also used to reach private repos, not just to recover from a rate limit. |
+| `src/update.ts` → `updateGlobalSkills` | Track `failedSources`; stop printing "All global skills are up to date" when a source could not be checked | The swallowed private-repo failure used to be masked by a false "up to date". Now surfaced, with a hint to set `GITHUB_TOKEN` / `gh auth login`, and counted in `failCount`. |
+| `src/update.ts` → `SELF_CLI_ENTRY` (both global + project update paths) | Re-invoke `<src>/cli.ts` instead of the built `../bin/cli.mjs` | We vendor `src/` only — the built `bin/cli.mjs` upstream re-invokes for each update does not exist here, so **every** update failed with "CLI entrypoint not found". Our entry is the TS source run via Node type-stripping, same as `adg skills`. |
+| `src/git.ts` → `createGitClient` | Add `unsafe: { allowUnsafeFilter: true }` to `simpleGit(...)` | simple-git ≥3.36 blocks `filter.*.smudge/clean` configs (RCE vector) and fails **every** clone with "Configuring filter.smudge is not permitted without enabling allowUnsafeFilter". The configs here set the LFS filter to EMPTY (disabling it), so opting in is safe and matches their intent. |
+| `src/git.ts` → `import simpleGit from 'simple-git'` | Default → named import `import { simpleGit } from 'simple-git'` | The default import is not callable under ADG's strict root tsconfig (NodeNext + verbatimModuleSyntax, no esModuleInterop); the named export is. Needed for `git.ts` to typecheck when a test imports it (e.g. via `use.ts`). |
+| `src/git.ts` → `createGitClient` env | Pass env via `.env({...})` instead of as a `simpleGit(...)` constructor option | **Latent runtime bug**: simple-git's factory only reads `baseDir`/`maxConcurrentProcesses`/`config`/`trimmed`/plugins from the options object and silently drops `env`, so `GIT_TERMINAL_PROMPT`/`GIT_LFS_SKIP_SMUDGE`/`GIT_SSH_COMMAND` never reached the spawned git (it inherited the full parent env). `.env(object)` is the documented API and sets the executor env actually used at spawn. |
+| `src/skills.ts` → `parseSkillMd` | Narrow `data.metadata` (frontmatter `unknown`) to `Record<string, unknown> \| undefined` before reading `.internal` / returning it | Behavior-preserving type fix so `skills.ts` typechecks under ADG's strict root tsconfig when reached via `use.ts`/tests. |
+| `src/update.ts` → both `spawnSync` self-CLI re-invokes (+ new `src/self-cli.ts`) | Forward `process.execArgv` (`[...process.execArgv, cliEntry, ...]`) via a shared `selfCliArgv()` helper | The re-invoked `cli.ts` child must inherit Node flags (e.g. `--experimental-strip-types`) to run TypeScript directly on Node 22.6–23.5, else it throws a `SyntaxError`. `selfCliArgv` lives in the dependency-free `self-cli.ts` so a regression test can import it without pulling `update.ts` → `remove.ts` → `detect-agent.ts` (same standalone rationale as `git-tree.ts`). |
+| `package.json` → `@vercel/detect-agent` dependency (not a vendored-source change) | `^0.1.0` → `^1.2.3` | `src/detect-agent.ts` (upstream, unpatched) imports `AgentResult` and expects `determineAgent(): Promise<AgentResult>` (object API). The stale `0.1.0` pin only exported `determineAgent(): Promise<string \| false>` and no `AgentResult`, which broke typecheck and left `cachedResult.isAgent` always `undefined` at runtime — agent auto-detection (non-interactive mode in `add`/`sync`/`remove`/`find`/`cli`) silently never fired. The `1.x` line restores the API the fork targets, so `detect-agent.ts` needs **no** local patch. Keep this dependency on `1.x` across re-vendoring. |
+| `src/git-tree.ts` (**new ADG file**) + `src/add.ts` clone-fallback branch | github source that falls back to a `git clone` now records the git **tree SHA** (`git rev-parse HEAD:<folder>`), not a sha256 content hash | Install and update must use ONE hash scheme per source. Update-check always uses the git tree SHA; the old clone fallback stored a sha256 content hash, so those skills were re-flagged on **every** update (a collection repo appeared to "fully update" each run). `git-tree.ts` is standalone (uses `child_process`, no simple-git) so it typechecks under ADG's strict tsconfig when a test imports it. |
+| `src/update.ts` → `updateGlobalSkills` self-heal | A github entry whose stored hash isn't a 40-hex tree SHA (legacy clone-fallback) is normalized to the current tree SHA and NOT flagged; lock rewritten once | Heals locks written before the fix above without a version bump / lock wipe, and stops the perpetual false "update". |

package/vendor/skills/ThirdPartyNoticeText.txt

@@ -0,0 +1,117 @@
+/*!----------------- Skills CLI ThirdPartyNotices -------------------------------------------------------
+
+The Skills CLI incorporates third party material from the projects listed below.
+The original copyright notice and the license under which this material was received
+are set forth below. These licenses and notices are provided for informational purposes only.
+
+---------------------------------------------
+Third Party Code Components
+--------------------------------------------
+
+================================================================================
+Package: @clack/prompts@0.11.0
+License: MIT
+Repository: https://github.com/bombshell-dev/clack
+--------------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) Nate Moore
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+================================================================================
+Package: picocolors@1.1.1
+License: ISC
+Repository: https://github.com/alexeyraspopov/picocolors
+--------------------------------------------------------------------------------
+
+ISC License
+
+Copyright (c) 2021-2024 Oleksii Raspopov, Kostiantyn Denysov, Anton Verinov
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+================================================================================
+Package: simple-git@3.30.0
+License: MIT
+Repository: https://github.com/steveukx/git-js
+--------------------------------------------------------------------------------
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+================================================================================
+Package: xdg-basedir@5.1.0
+License: MIT
+Repository: https://github.com/sindresorhus/xdg-basedir
+--------------------------------------------------------------------------------
+
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+================================================================================
+Package: yaml@2.8.3
+License: ISC
+Repository: https://github.com/eemeli/yaml
+--------------------------------------------------------------------------------
+
+Copyright Eemeli Aro <eemeli@gmail.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+
+================================================================================
+*/

package/vendor/skills/package.json

@@ -0,0 +1,143 @@
+{
+  "name": "skills",
+  "version": "1.5.11",
+  "description": "The open agent skills ecosystem",
+  "type": "module",
+  "bin": {
+    "skills": "./bin/cli.mjs",
+    "add-skill": "./bin/cli.mjs"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "ThirdPartyNoticeText.txt"
+  ],
+  "scripts": {
+    "build": "node scripts/generate-licenses.ts && obuild",
+    "generate-licenses": "node scripts/generate-licenses.ts",
+    "dev": "node src/cli.ts",
+    "exec:test": "node scripts/execute-tests.ts",
+    "prepublishOnly": "npm run build",
+    "format": "prettier --write \"src/**/*.ts\" \"scripts/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\" \"scripts/**/*.ts\"",
+    "prepare": "husky",
+    "test": "vitest",
+    "type-check": "tsc --noEmit",
+    "publish:snapshot": "npm version prerelease --preid=snapshot --no-git-tag-version && npm publish --tag snapshot"
+  },
+  "lint-staged": {
+    "src/**/*.ts": "prettier --write",
+    "scripts/**/*.ts": "prettier --write",
+    "tests/**/*.ts": "prettier --write"
+  },
+  "keywords": [
+    "cli",
+    "agent-skills",
+    "skills",
+    "ai-agents",
+    "aider-desk",
+    "amp",
+    "antigravity",
+    "antigravity-cli",
+    "astrbot",
+    "autohand-code",
+    "augment",
+    "bob",
+    "claude-code",
+    "openclaw",
+    "cline",
+    "codearts-agent",
+    "codebuddy",
+    "codemaker",
+    "codestudio",
+    "codex",
+    "command-code",
+    "continue",
+    "cortex",
+    "crush",
+    "cursor",
+    "deepagents",
+    "devin",
+    "dexto",
+    "droid",
+    "firebender",
+    "forgecode",
+    "gemini-cli",
+    "github-copilot",
+    "goose",
+    "hermes-agent",
+    "inference-sh",
+    "jazz",
+    "junie",
+    "iflow-cli",
+    "kilo",
+    "kimi-code-cli",
+    "kiro-cli",
+    "kode",
+    "lingma",
+    "loaf",
+    "mcpjam",
+    "mistral-vibe",
+    "moxby",
+    "mux",
+    "opencode",
+    "openhands",
+    "ona",
+    "pi",
+    "qoder",
+    "qoder-cn",
+    "qwen-code",
+    "replit",
+    "reasonix",
+    "rovodev",
+    "roo",
+    "tabnine-cli",
+    "terramind",
+    "tinycloud",
+    "trae",
+    "trae-cn",
+    "warp",
+    "windsurf",
+    "zed",
+    "zencoder",
+    "zenflow",
+    "neovate",
+    "pochi",
+    "promptscript",
+    "adal",
+    "universal"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vercel-labs/skills.git"
+  },
+  "homepage": "https://github.com/vercel-labs/skills#readme",
+  "bugs": {
+    "url": "https://github.com/vercel-labs/skills/issues"
+  },
+  "author": "",
+  "license": "MIT",
+  "devDependencies": {
+    "@clack/prompts": "^0.11.0",
+    "@types/bun": "latest",
+    "@types/node": "^22.10.0",
+    "@vercel/detect-agent": "^1.2.1",
+    "husky": "^9.1.7",
+    "lint-staged": "^16.2.7",
+    "obuild": "^0.4.22",
+    "picocolors": "^1.1.1",
+    "prettier": "^3.8.1",
+    "simple-git": "^3.27.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.17",
+    "xdg-basedir": "^5.1.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "packageManager": "pnpm@10.17.1",
+  "dependencies": {
+    "yaml": "^2.8.3"
+  }
+}