@second196/skillhub-cli 0.1.2

package/dist/clients/api-client.d.ts

@@ -0,0 +1,3 @@
+export declare function serviceUrl(value: string): string;
+export declare function apiRequest<T>(base: string, path: string, init?: RequestInit): Promise<T>;
+export declare function download(base: string, path: string): Promise<Uint8Array>;

package/dist/clients/api-client.js

@@ -0,0 +1,29 @@
+import { CliError } from '../shared/errors.js';
+import { EXIT_CODE } from '../shared/constants.js';
+export function serviceUrl(value) { return value.replace(/\/+$/, ''); }
+export async function apiRequest(base, path, init) {
+    let response;
+    try {
+        response = await fetch(`${serviceUrl(base)}${path}`, init);
+    }
+    catch (_error) {
+        throw new CliError('无法连接 Skill Hub 服务', 'SERVICE_UNREACHABLE', EXIT_CODE.network);
+    }
+    if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new CliError(body.message || `服务返回 ${response.status}`, `HTTP_${response.status}`, response.status >= 500 ? EXIT_CODE.network : EXIT_CODE.generic);
+    }
+    return await response.json();
+}
+export async function download(base, path) {
+    let response;
+    try {
+        response = await fetch(`${serviceUrl(base)}${path}`);
+    }
+    catch (_error) {
+        throw new CliError('无法连接 Skill Hub 服务', 'SERVICE_UNREACHABLE', EXIT_CODE.network);
+    }
+    if (!response.ok)
+        throw new CliError(`下载失败（${response.status}）`, `HTTP_${response.status}`, response.status >= 500 ? EXIT_CODE.network : EXIT_CODE.generic);
+    return new Uint8Array(await response.arrayBuffer());
+}

package/dist/commands/install.d.ts

@@ -0,0 +1,8 @@
+export interface InstallOptions {
+    slug: string;
+    serviceUrl: string;
+    target: string;
+    version?: string;
+    json: boolean;
+}
+export declare function installCommand(options: InstallOptions): Promise<string>;

package/dist/commands/install.js

@@ -0,0 +1,19 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { unzipSync } from 'fflate';
+import { download } from '../clients/api-client.js';
+export async function installCommand(options) {
+    const query = options.version ? `?version=${encodeURIComponent(options.version)}` : '';
+    const archive = await download(options.serviceUrl, `/api/skills/${encodeURIComponent(options.slug)}/download${query}`);
+    const files = unzipSync(archive);
+    const root = resolve(options.target, options.slug);
+    await mkdir(root, { recursive: true });
+    for (const [path, content] of Object.entries(files)) {
+        const output = resolve(root, path);
+        if (!output.startsWith(root + '/') && output !== root)
+            throw new Error('安装包路径不安全');
+        await mkdir(dirname(output), { recursive: true });
+        await writeFile(output, content);
+    }
+    return options.json ? JSON.stringify({ ok: true, slug: options.slug, target: root, fileCount: Object.keys(files).length }) : `安装成功：${options.slug}\n目录：${root}\n文件：${Object.keys(files).length} 个`;
+}

package/dist/commands/list.d.ts

@@ -0,0 +1,6 @@
+export interface ListOptions {
+    serviceUrl: string;
+    category?: string;
+    json: boolean;
+}
+export declare function listCommand(options: ListOptions): Promise<string>;

package/dist/commands/list.js

@@ -0,0 +1,8 @@
+import { apiRequest } from '../clients/api-client.js';
+export async function listCommand(options) {
+    const params = new URLSearchParams({ includeOffline: 'true' });
+    if (options.category)
+        params.set('category', options.category);
+    const items = await apiRequest(options.serviceUrl, `/api/skills?${params}`);
+    return options.json ? JSON.stringify(items) : (items.length ? items.map(item => `${item.name}  ${item.slug}  [${item.category}]  v${item.version_label}  ${item.status === 'ACTIVE' ? '已上架' : '已下架'}`).join('\n') : '暂无技能');
+}

package/dist/commands/upload.d.ts

@@ -0,0 +1,7 @@
+export interface UploadOptions {
+    inputPath: string;
+    serviceUrl: string;
+    category: string;
+    json: boolean;
+}
+export declare function uploadCommand(options: UploadOptions): Promise<string>;

package/dist/commands/upload.js

@@ -0,0 +1,11 @@
+import { basename } from 'node:path';
+import { prepareSkillPackage } from '../services/skill-package-service.js';
+import { apiRequest } from '../clients/api-client.js';
+export async function uploadCommand(options) {
+    const prepared = await prepareSkillPackage(options.inputPath);
+    const form = new FormData();
+    form.append('file', new Blob([prepared.archive]), `${basename(options.inputPath)}.zip`);
+    form.append('category', options.category);
+    const result = await apiRequest(options.serviceUrl, '/api/skills', { method: 'POST', body: form });
+    return options.json ? JSON.stringify({ ok: true, ...result }) : `上传成功：${String(result.name)}\n标识：${String(result.slug)}\n版本：${String(result.version_label)}`;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import { cac } from 'cac';
+import { uploadCommand } from './commands/upload.js';
+import { listCommand } from './commands/list.js';
+import { installCommand } from './commands/install.js';
+import { formatError } from './shared/output.js';
+const cli = cac('skillhub');
+cli.command('upload <input-path>', '上传 ZIP、目录或单个 SKILL.md')
+    .option('--service-url <url>', 'Skill Hub 服务地址', { default: 'http://127.0.0.1:8080' })
+    .option('--category <category>', '技能分类', { default: '其他' })
+    .option('--json', '输出 JSON')
+    .action(async (inputPath, options) => run(() => uploadCommand({ inputPath, serviceUrl: options.serviceUrl, category: options.category, json: Boolean(options.json) }), Boolean(options.json)));
+cli.command('list', '查询平台中的全部技能')
+    .option('--service-url <url>', 'Skill Hub 服务地址', { default: 'http://127.0.0.1:8080' })
+    .option('--category <category>', '按分类筛选')
+    .option('--json', '输出 JSON')
+    .action(async (options) => run(() => listCommand({ serviceUrl: options.serviceUrl, category: options.category, json: Boolean(options.json) }), Boolean(options.json)));
+cli.command('install <slug>', '下载并安装技能到本地目录')
+    .option('--service-url <url>', 'Skill Hub 服务地址', { default: 'http://127.0.0.1:8080' })
+    .option('--target <directory>', '安装目录', { default: '.skills' })
+    .option('--version <digest>', '指定版本摘要')
+    .option('--json', '输出 JSON')
+    .action(async (slug, options) => run(() => installCommand({ slug, serviceUrl: options.serviceUrl, target: options.target, version: options.version, json: Boolean(options.json) }), Boolean(options.json)));
+cli.help();
+cli.version('0.1.2');
+cli.parse();
+async function run(action, json) {
+    try {
+        process.stdout.write(`${await action()}\n`);
+    }
+    catch (error) {
+        process.stderr.write(`${formatError(error, json)}\n`);
+        process.exitCode = 1;
+    }
+}

package/dist/platform/archive.d.ts

@@ -0,0 +1,4 @@
+import { type PackageFile, type PackageLimitOverrides, type PackageLimits } from '../shared/types.js';
+export declare function createArchive(files: PackageFile[], overrides?: PackageLimitOverrides): Uint8Array;
+export declare function readArchive(archive: Uint8Array, overrides?: PackageLimitOverrides): PackageFile[];
+export declare function resolvePackageLimits(overrides?: PackageLimitOverrides): PackageLimits;

package/dist/platform/archive.js

@@ -0,0 +1,193 @@
+import { unzipSync, zipSync } from 'fflate';
+import { normalizePackagePath } from './paths.js';
+import { PackageValidationError } from '../shared/errors.js';
+import { DEFAULT_PACKAGE_LIMITS } from '../shared/types.js';
+const END_OF_CENTRAL_DIRECTORY = 0x06054b50;
+const CENTRAL_DIRECTORY_ENTRY = 0x02014b50;
+const LOCAL_FILE_HEADER = 0x04034b50;
+const ZIP64_16 = 0xffff;
+const ZIP64_32 = 0xffffffff;
+const FIXED_ZIP_TIME = new Date(1980, 0, 1, 0, 0, 0);
+export function createArchive(files, overrides = {}) {
+    const limits = resolvePackageLimits(overrides);
+    validateFiles(files, limits);
+    const entries = {};
+    for (const file of [...files].sort((left, right) => compareUtf8(left.path, right.path))) {
+        entries[file.path] = [file.content, {
+                attrs: 0o100644 << 16,
+                mtime: FIXED_ZIP_TIME,
+                os: 3
+            }];
+    }
+    const archive = zipSync(entries, { level: 6, mtime: FIXED_ZIP_TIME, os: 3 });
+    if (archive.byteLength > limits.maxArchiveBytes) {
+        throw new PackageValidationError('Skill 压缩包超过大小限制', 'PACKAGE_ARCHIVE_TOO_LARGE');
+    }
+    return archive;
+}
+export function readArchive(archive, overrides = {}) {
+    const limits = resolvePackageLimits(overrides);
+    if (archive.byteLength > limits.maxArchiveBytes) {
+        throw new PackageValidationError('Skill 压缩包超过大小限制', 'PACKAGE_ARCHIVE_TOO_LARGE');
+    }
+    const entries = inspectCentralDirectory(archive, limits);
+    let unzipped;
+    try {
+        unzipped = unzipSync(archive);
+    }
+    catch (_error) {
+        throw new PackageValidationError('Skill ZIP 无法解压', 'INVALID_SKILL_ARCHIVE');
+    }
+    const files = entries
+        .filter((entry) => !entry.directory)
+        .map((entry) => {
+        const content = unzipped[entry.rawPath];
+        if (content === undefined || content.byteLength !== entry.uncompressedSize) {
+            throw new PackageValidationError('Skill ZIP 条目大小不一致', 'INVALID_SKILL_ARCHIVE', { path: entry.path });
+        }
+        return { path: entry.path, content };
+    });
+    validateFiles(files, limits);
+    return files.sort((left, right) => compareUtf8(left.path, right.path));
+}
+export function resolvePackageLimits(overrides = {}) {
+    return { ...DEFAULT_PACKAGE_LIMITS, ...overrides };
+}
+function inspectCentralDirectory(archive, limits) {
+    const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
+    const eocdOffset = findEndOfCentralDirectory(view);
+    if (eocdOffset < 0)
+        invalidArchive();
+    const disk = view.getUint16(eocdOffset + 4, true);
+    const centralDisk = view.getUint16(eocdOffset + 6, true);
+    const entriesOnDisk = view.getUint16(eocdOffset + 8, true);
+    const entryCount = view.getUint16(eocdOffset + 10, true);
+    const centralSize = view.getUint32(eocdOffset + 12, true);
+    const centralOffset = view.getUint32(eocdOffset + 16, true);
+    const commentLength = view.getUint16(eocdOffset + 20, true);
+    if (entryCount === ZIP64_16 || centralSize === ZIP64_32 || centralOffset === ZIP64_32) {
+        throw new PackageValidationError('暂不支持 ZIP64 Skill 包', 'UNSUPPORTED_SKILL_ARCHIVE');
+    }
+    if (disk !== 0 || centralDisk !== 0 || entriesOnDisk !== entryCount) {
+        throw new PackageValidationError('暂不支持分卷 Skill ZIP', 'UNSUPPORTED_SKILL_ARCHIVE');
+    }
+    if (entryCount > limits.maxFiles + limits.maxFiles) {
+        throw new PackageValidationError('Skill 包文件数量超过限制', 'PACKAGE_FILE_COUNT_EXCEEDED');
+    }
+    if (eocdOffset + 22 + commentLength !== archive.byteLength || centralOffset + centralSize > eocdOffset) {
+        invalidArchive();
+    }
+    const paths = new Set();
+    const entries = [];
+    let fileCount = 0;
+    let expandedBytes = 0;
+    let offset = centralOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (offset + 46 > eocdOffset || view.getUint32(offset, true) !== CENTRAL_DIRECTORY_ENTRY)
+            invalidArchive();
+        const flags = view.getUint16(offset + 8, true);
+        if ((flags & 0x1) !== 0) {
+            throw new PackageValidationError('不支持加密 Skill ZIP', 'UNSUPPORTED_SKILL_ARCHIVE');
+        }
+        const uncompressedSize = view.getUint32(offset + 24, true);
+        const pathLength = view.getUint16(offset + 28, true);
+        const extraLength = view.getUint16(offset + 30, true);
+        const entryCommentLength = view.getUint16(offset + 32, true);
+        const externalAttributes = view.getUint32(offset + 38, true);
+        const localHeaderOffset = view.getUint32(offset + 42, true);
+        if (uncompressedSize === ZIP64_32 || localHeaderOffset === ZIP64_32) {
+            throw new PackageValidationError('暂不支持 ZIP64 Skill 包', 'UNSUPPORTED_SKILL_ARCHIVE');
+        }
+        const pathStart = offset + 46;
+        const pathEnd = pathStart + pathLength;
+        const nextOffset = pathEnd + extraLength + entryCommentLength;
+        if (pathEnd > eocdOffset || nextOffset > eocdOffset)
+            invalidArchive();
+        const rawPath = decodePath(archive.subarray(pathStart, pathEnd));
+        const directory = rawPath.endsWith('/');
+        const path = normalizePackagePath(directory ? rawPath.slice(0, -1) : rawPath, limits.maxPathLength);
+        if (paths.has(path)) {
+            throw new PackageValidationError('Skill 包包含重复路径', 'DUPLICATE_PACKAGE_PATH', { path });
+        }
+        paths.add(path);
+        const unixMode = externalAttributes >>> 16;
+        if ((unixMode & 0xf000) === 0xa000) {
+            throw new PackageValidationError('Skill 包不允许符号链接', 'SYMLINK_NOT_ALLOWED', { path });
+        }
+        validateLocalHeader(view, archive, localHeaderOffset, rawPath);
+        if (!directory) {
+            fileCount += 1;
+            expandedBytes += uncompressedSize;
+            if (fileCount > limits.maxFiles) {
+                throw new PackageValidationError('Skill 包文件数量超过限制', 'PACKAGE_FILE_COUNT_EXCEEDED');
+            }
+            if (uncompressedSize > limits.maxSingleFileBytes) {
+                throw new PackageValidationError('Skill 包内单个文件超过大小限制', 'PACKAGE_FILE_TOO_LARGE', { path });
+            }
+            if (expandedBytes > limits.maxExpandedBytes) {
+                throw new PackageValidationError('Skill 包解压后超过大小限制', 'PACKAGE_EXPANDED_TOO_LARGE');
+            }
+        }
+        entries.push({ rawPath, path, directory, uncompressedSize, localHeaderOffset });
+        offset = nextOffset;
+    }
+    if (offset !== centralOffset + centralSize)
+        invalidArchive();
+    return entries;
+}
+function validateLocalHeader(view, archive, offset, expectedPath) {
+    if (offset + 30 > archive.byteLength || view.getUint32(offset, true) !== LOCAL_FILE_HEADER)
+        invalidArchive();
+    const pathLength = view.getUint16(offset + 26, true);
+    const extraLength = view.getUint16(offset + 28, true);
+    const pathStart = offset + 30;
+    const pathEnd = pathStart + pathLength;
+    if (pathEnd + extraLength > archive.byteLength || decodePath(archive.subarray(pathStart, pathEnd)) !== expectedPath) {
+        invalidArchive();
+    }
+}
+function validateFiles(files, limits) {
+    if (files.length > limits.maxFiles) {
+        throw new PackageValidationError('Skill 包文件数量超过限制', 'PACKAGE_FILE_COUNT_EXCEEDED');
+    }
+    const paths = new Set();
+    let expandedBytes = 0;
+    for (const file of files) {
+        const path = normalizePackagePath(file.path, limits.maxPathLength);
+        if (path !== file.path || paths.has(path)) {
+            throw new PackageValidationError('Skill 包包含重复路径', 'DUPLICATE_PACKAGE_PATH', { path });
+        }
+        paths.add(path);
+        if (file.content.byteLength > limits.maxSingleFileBytes) {
+            throw new PackageValidationError('Skill 包内单个文件超过大小限制', 'PACKAGE_FILE_TOO_LARGE', { path });
+        }
+        expandedBytes += file.content.byteLength;
+        if (expandedBytes > limits.maxExpandedBytes) {
+            throw new PackageValidationError('Skill 包解压后超过大小限制', 'PACKAGE_EXPANDED_TOO_LARGE');
+        }
+    }
+}
+function decodePath(bytes) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch (_error) {
+        throw new PackageValidationError('Skill 包路径必须使用 UTF-8', 'INVALID_PACKAGE_PATH_ENCODING');
+    }
+}
+function findEndOfCentralDirectory(view) {
+    if (view.byteLength < 22)
+        return -1;
+    const minimumOffset = Math.max(0, view.byteLength - 0xffff - 22);
+    for (let offset = view.byteLength - 22; offset >= minimumOffset; offset -= 1) {
+        if (view.getUint32(offset, true) === END_OF_CENTRAL_DIRECTORY)
+            return offset;
+    }
+    return -1;
+}
+function invalidArchive() {
+    throw new PackageValidationError('Skill ZIP 目录结构无效', 'INVALID_SKILL_ARCHIVE');
+}
+function compareUtf8(left, right) {
+    return Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}

package/dist/platform/paths.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizePackagePath(value: string, maxLength: number): string;
+export declare function shouldExcludePackagePath(value: string): boolean;

package/dist/platform/paths.js

@@ -0,0 +1,41 @@
+import { PackageValidationError } from '../shared/errors.js';
+const WINDOWS_ABSOLUTE_PATH = /^[a-zA-Z]:/;
+const EXCLUDED_DIRECTORIES = new Set(['.git', '.skillhub']);
+const EXCLUDED_FILES = new Set([
+    '.env',
+    '.npmrc',
+    '.pypirc',
+    '.netrc',
+    'credentials.json',
+    'id_rsa',
+    'id_ed25519'
+]);
+export function normalizePackagePath(value, maxLength) {
+    if (value.length === 0 || value.includes('\0') || value.includes('\\')) {
+        throw unsafePath(value);
+    }
+    if (value.startsWith('/') || WINDOWS_ABSOLUTE_PATH.test(value)) {
+        throw unsafePath(value);
+    }
+    const normalized = value.normalize('NFC');
+    const segments = normalized.split('/');
+    if (segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')) {
+        throw unsafePath(value);
+    }
+    if (Array.from(normalized).length > maxLength) {
+        throw new PackageValidationError('Skill 包内路径超过长度限制', 'PACKAGE_PATH_TOO_LONG', { path: normalized });
+    }
+    return normalized;
+}
+export function shouldExcludePackagePath(value) {
+    const segments = value.replace(/\\/g, '/').split('/');
+    const fileName = segments[segments.length - 1]?.toLowerCase() ?? '';
+    return segments.some((segment) => EXCLUDED_DIRECTORIES.has(segment.toLowerCase()))
+        || EXCLUDED_FILES.has(fileName)
+        || fileName.startsWith('.env.')
+        || fileName.endsWith('.pem')
+        || fileName.endsWith('.key');
+}
+function unsafePath(path) {
+    return new PackageValidationError('Skill 包包含不安全路径', 'UNSAFE_PACKAGE_PATH', { path });
+}

package/dist/services/skill-package-service.d.ts

@@ -0,0 +1,2 @@
+import { type PackageLimitOverrides, type PreparedSkillPackage } from '../shared/types.js';
+export declare function prepareSkillPackage(inputPath: string, overrides?: PackageLimitOverrides): Promise<PreparedSkillPackage>;

package/dist/services/skill-package-service.js

@@ -0,0 +1,192 @@
+import { createHash } from 'node:crypto';
+import { lstat, readFile, readdir } from 'node:fs/promises';
+import { join, relative, resolve } from 'node:path';
+import { parseDocument } from 'yaml';
+import { z } from 'zod';
+import { createArchive, readArchive, resolvePackageLimits } from '../platform/archive.js';
+import { normalizePackagePath, shouldExcludePackagePath } from '../platform/paths.js';
+import { PackageValidationError } from '../shared/errors.js';
+const SEMANTIC_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const metadataSchema = z.object({
+    name: z.string().trim().min(1).max(100),
+    description: z.string().trim().min(1).max(2000),
+    version: z.string().trim().regex(SEMANTIC_VERSION).optional().default('0.0.0')
+}).passthrough();
+export async function prepareSkillPackage(inputPath, overrides = {}) {
+    const limits = resolvePackageLimits(overrides);
+    let inputStat;
+    try {
+        inputStat = await lstat(inputPath);
+    }
+    catch (_error) {
+        throw new PackageValidationError('Skill 路径不存在或不可读', 'SKILL_PATH_NOT_READABLE');
+    }
+    if (inputStat.isSymbolicLink()) {
+        throw new PackageValidationError('Skill 路径不允许是符号链接', 'SYMLINK_NOT_ALLOWED');
+    }
+    let sourceType;
+    let archive;
+    let files;
+    if (inputStat.isDirectory()) {
+        sourceType = 'DIRECTORY';
+        files = await readDirectoryFiles(inputPath, overrides);
+        archive = createArchive(files, overrides);
+    }
+    else if (inputStat.isFile()) {
+        if (inputPath.toLowerCase().endsWith('.md')) {
+            sourceType = 'DIRECTORY';
+            const content = new Uint8Array(await readFile(inputPath));
+            files = [{ path: 'SKILL.md', content }];
+            archive = createArchive(files, overrides);
+        }
+        else {
+            sourceType = 'ZIP';
+            if (inputStat.size > limits.maxArchiveBytes) {
+                throw new PackageValidationError('Skill 压缩包超过大小限制', 'PACKAGE_ARCHIVE_TOO_LARGE');
+            }
+            archive = new Uint8Array(await readFile(inputPath));
+            files = readArchive(archive, overrides);
+            const sensitiveEntry = files.find((file) => shouldExcludePackagePath(file.path));
+            if (sensitiveEntry !== undefined) {
+                throw new PackageValidationError('Skill ZIP 包含版本库或凭据文件', 'SENSITIVE_PACKAGE_PATH', { path: sensitiveEntry.path });
+            }
+        }
+    }
+    else {
+        throw new PackageValidationError('Skill 路径必须是目录或 ZIP 文件', 'UNSUPPORTED_SKILL_PATH');
+    }
+    if (files.length === 0) {
+        throw new PackageValidationError('Skill 包不能为空', 'EMPTY_SKILL_PACKAGE');
+    }
+    files = normalizePackageRoot(files);
+    if (sourceType === 'ZIP')
+        archive = createArchive(files, overrides);
+    const skillFile = files.find((file) => file.path === 'SKILL.md');
+    if (skillFile === undefined) {
+        throw new PackageValidationError('Skill 包根目录缺少 SKILL.md', 'SKILL_FILE_REQUIRED');
+    }
+    const metadata = parseMetadata(skillFile.content);
+    const manifest = createManifest(files);
+    const manifestJson = JSON.stringify(manifest);
+    const normalizedVersion = JSON.stringify({ metadata, manifest });
+    return {
+        sourceType,
+        archive,
+        artifactDigest: sha256(archive),
+        versionDigest: sha256(normalizedVersion),
+        manifestDigest: sha256(manifestJson),
+        metadata,
+        manifest
+    };
+}
+function normalizePackageRoot(files) {
+    if (files.some((file) => file.path === 'SKILL.md'))
+        return files;
+    const skillFiles = files.filter((file) => file.path.endsWith('/SKILL.md'));
+    if (skillFiles.length !== 1)
+        return files;
+    const prefix = skillFiles[0].path.slice(0, -'SKILL.md'.length);
+    if (!files.every((file) => file.path.startsWith(prefix)))
+        return files;
+    return files.map((file) => ({ ...file, path: file.path.slice(prefix.length) }));
+}
+async function readDirectoryFiles(rootPath, overrides) {
+    const limits = resolvePackageLimits(overrides);
+    const root = resolve(rootPath);
+    const files = [];
+    let expandedBytes = 0;
+    async function visit(directory) {
+        let entries;
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        }
+        catch (_error) {
+            throw new PackageValidationError('Skill 目录不可读', 'SKILL_PATH_NOT_READABLE');
+        }
+        entries.sort((left, right) => Buffer.compare(Buffer.from(left.name, 'utf8'), Buffer.from(right.name, 'utf8')));
+        for (const entry of entries) {
+            const absolutePath = join(directory, entry.name);
+            const relativePath = normalizePackagePath(relative(root, absolutePath).replace(/\\/g, '/'), limits.maxPathLength);
+            if (shouldExcludePackagePath(relativePath))
+                continue;
+            const entryStat = await lstat(absolutePath);
+            if (entryStat.isSymbolicLink()) {
+                throw new PackageValidationError('Skill 包不允许符号链接', 'SYMLINK_NOT_ALLOWED', { path: relativePath });
+            }
+            if (entryStat.isDirectory()) {
+                await visit(absolutePath);
+                continue;
+            }
+            if (!entryStat.isFile())
+                continue;
+            if (files.length + 1 > limits.maxFiles) {
+                throw new PackageValidationError('Skill 包文件数量超过限制', 'PACKAGE_FILE_COUNT_EXCEEDED');
+            }
+            if (entryStat.size > limits.maxSingleFileBytes) {
+                throw new PackageValidationError('Skill 包内单个文件超过大小限制', 'PACKAGE_FILE_TOO_LARGE', { path: relativePath });
+            }
+            expandedBytes += entryStat.size;
+            if (expandedBytes > limits.maxExpandedBytes) {
+                throw new PackageValidationError('Skill 包解压后超过大小限制', 'PACKAGE_EXPANDED_TOO_LARGE');
+            }
+            try {
+                const content = new Uint8Array(await readFile(absolutePath));
+                files.push({ path: relativePath, content });
+            }
+            catch (_error) {
+                throw new PackageValidationError('Skill 包包含不可读文件', 'SKILL_FILE_NOT_READABLE', { path: relativePath });
+            }
+        }
+    }
+    await visit(root);
+    return files;
+}
+function parseMetadata(content) {
+    let markdown;
+    try {
+        markdown = new TextDecoder('utf-8', { fatal: true }).decode(content);
+    }
+    catch (_error) {
+        throw new PackageValidationError('SKILL.md 必须使用 UTF-8', 'INVALID_SKILL_ENCODING');
+    }
+    const lines = markdown.replace(/^\uFEFF/, '').split(/\r?\n/);
+    if (lines[0] !== '---') {
+        throw new PackageValidationError('SKILL.md 缺少 YAML frontmatter', 'INVALID_SKILL_FRONTMATTER');
+    }
+    const closingIndex = lines.findIndex((line, index) => index > 0 && (line === '---' || line === '...'));
+    if (closingIndex < 0) {
+        throw new PackageValidationError('SKILL.md 的 YAML frontmatter 未闭合', 'INVALID_SKILL_FRONTMATTER');
+    }
+    const document = parseDocument(lines.slice(1, closingIndex).join('\n'), {
+        schema: 'core',
+        strict: true,
+        uniqueKeys: true
+    });
+    if (document.errors.length > 0) {
+        throw new PackageValidationError('SKILL.md 的 YAML frontmatter 无法解析', 'INVALID_SKILL_FRONTMATTER');
+    }
+    let value;
+    try {
+        value = document.toJS({ maxAliasCount: 0 });
+    }
+    catch (_error) {
+        throw new PackageValidationError('SKILL.md 的 YAML frontmatter 不安全', 'INVALID_SKILL_FRONTMATTER');
+    }
+    const result = metadataSchema.safeParse(value);
+    if (!result.success) {
+        throw new PackageValidationError('SKILL.md 的名称、描述或版本无效', 'INVALID_SKILL_METADATA');
+    }
+    return {
+        name: result.data.name,
+        description: result.data.description,
+        version: result.data.version
+    };
+}
+function createManifest(files) {
+    return [...files]
+        .sort((left, right) => Buffer.compare(Buffer.from(left.path, 'utf8'), Buffer.from(right.path, 'utf8')))
+        .map((file) => ({ path: file.path, size: file.content.byteLength, digest: sha256(file.content) }));
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}

package/dist/shared/constants.d.ts

@@ -0,0 +1,9 @@
+export declare const DEFAULT_SERVICE_URL = "http://127.0.0.1:8080";
+export declare const EXIT_CODE: {
+    readonly success: 0;
+    readonly generic: 1;
+    readonly usage: 2;
+    readonly authentication: 3;
+    readonly network: 4;
+    readonly validation: 5;
+};

package/dist/shared/constants.js

@@ -0,0 +1,9 @@
+export const DEFAULT_SERVICE_URL = 'http://127.0.0.1:8080';
+export const EXIT_CODE = {
+    success: 0,
+    generic: 1,
+    usage: 2,
+    authentication: 3,
+    network: 4,
+    validation: 5
+};

package/dist/shared/errors.d.ts

@@ -0,0 +1,9 @@
+export declare class CliError extends Error {
+    readonly code: string;
+    readonly exitCode: number;
+    readonly details: Record<string, unknown>;
+    constructor(message: string, code: string, exitCode: number, details?: Record<string, unknown>);
+}
+export declare class PackageValidationError extends CliError {
+    constructor(message: string, code: string, details?: Record<string, unknown>);
+}

package/dist/shared/errors.js

@@ -0,0 +1,19 @@
+import { EXIT_CODE } from './constants.js';
+export class CliError extends Error {
+    code;
+    exitCode;
+    details;
+    constructor(message, code, exitCode, details = {}) {
+        super(message);
+        this.code = code;
+        this.exitCode = exitCode;
+        this.details = details;
+        this.name = 'CliError';
+    }
+}
+export class PackageValidationError extends CliError {
+    constructor(message, code, details = {}) {
+        super(message, code, EXIT_CODE.validation, details);
+        this.name = 'PackageValidationError';
+    }
+}

package/dist/shared/output.d.ts

@@ -0,0 +1 @@
+export declare function formatError(error: unknown, json: boolean): string;

package/dist/shared/output.js

@@ -0,0 +1,9 @@
+import { CliError } from './errors.js';
+export function formatError(error, json) {
+    const cliError = error instanceof CliError
+        ? error
+        : new CliError(error instanceof Error ? error.message : '未知错误', 'UNEXPECTED_ERROR', 1);
+    return json
+        ? JSON.stringify({ ok: false, code: cliError.code, message: cliError.message, ...cliError.details })
+        : `错误：${cliError.message}`;
+}

package/dist/shared/types.d.ts

@@ -0,0 +1,32 @@
+export interface PackageLimits {
+    maxArchiveBytes: number;
+    maxExpandedBytes: number;
+    maxSingleFileBytes: number;
+    maxFiles: number;
+    maxPathLength: number;
+}
+export interface PackageFile {
+    path: string;
+    content: Uint8Array;
+}
+export interface SkillPackageMetadata {
+    name: string;
+    description: string;
+    version: string;
+}
+export interface SkillPackageManifestEntry {
+    path: string;
+    size: number;
+    digest: string;
+}
+export interface PreparedSkillPackage {
+    sourceType: 'DIRECTORY' | 'ZIP';
+    archive: Uint8Array;
+    artifactDigest: string;
+    versionDigest: string;
+    manifestDigest: string;
+    metadata: SkillPackageMetadata;
+    manifest: SkillPackageManifestEntry[];
+}
+export declare const DEFAULT_PACKAGE_LIMITS: PackageLimits;
+export type PackageLimitOverrides = Partial<PackageLimits>;

package/dist/shared/types.js

@@ -0,0 +1,7 @@
+export const DEFAULT_PACKAGE_LIMITS = {
+    maxArchiveBytes: 10 * 1024 * 1024,
+    maxExpandedBytes: 100 * 1024 * 1024,
+    maxSingleFileBytes: 10 * 1024 * 1024,
+    maxFiles: 1000,
+    maxPathLength: 255
+};

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@second196/skillhub-cli",
+  "version": "0.1.2",
+  "description": "Skill Hub CLI for uploading, discovering, and installing skills",
+  "type": "module",
+  "bin": {
+    "skillhub": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/index.js",
+    "test": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "cac": "6.7.14",
+    "fflate": "0.8.2",
+    "yaml": "2.8.3",
+    "zod": "3.24.1"
+  },
+  "devDependencies": {
+    "@types/node": "20.12.7",
+    "typescript": "5.4.2"
+  }
+}