@senior-skills/registry 0.0.0-stage → 1.0.0

package/dist/factory.d.ts

@@ -0,0 +1,24 @@
+import { type Clock, type CommandRunner, type FileSystem, type Hasher, type HttpClient, type Logger, type PackageExtractor, type RegistryConfig, type RegistryFactory, type SkillRegistry } from '@senior-skills/core';
+export interface DefaultRegistryFactoryOptions {
+    readonly fs: FileSystem;
+    readonly hasher: Hasher;
+    readonly http: HttpClient;
+    readonly commands: CommandRunner;
+    readonly clock: Clock;
+    readonly logger: Logger;
+    readonly extractor: PackageExtractor;
+    readonly cacheDir: string;
+    readonly ttlSeconds?: number;
+}
+/**
+ * Builds a driver for a configured registry.
+ *
+ * Exists so the CLI's composition root can stay free of registry-kind imports and so adding a
+ * fourth kind is a change here rather than a change in every command.
+ */
+export declare class DefaultRegistryFactory implements RegistryFactory {
+    private readonly options;
+    constructor(options: DefaultRegistryFactoryOptions);
+    create(config: RegistryConfig): SkillRegistry;
+}
+//# sourceMappingURL=factory.d.ts.map

package/dist/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAK7B,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;gBAE5C,OAAO,EAAE,6BAA6B;IAIlD,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa;CAmD9C"}

package/dist/factory.js

@@ -0,0 +1,69 @@
+import { AgentSkillsError, ErrorCode, } from '@senior-skills/core';
+import { GitRegistry } from "./git-registry.js";
+import { HttpRegistry } from "./http-registry.js";
+import { LocalRegistry } from "./local-registry.js";
+/**
+ * Builds a driver for a configured registry.
+ *
+ * Exists so the CLI's composition root can stay free of registry-kind imports and so adding a
+ * fourth kind is a change here rather than a change in every command.
+ */
+export class DefaultRegistryFactory {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    create(config) {
+        const { fs, hasher, http, commands, clock, logger, extractor, cacheDir } = this.options;
+        const ttlSeconds = this.options.ttlSeconds ?? 3600;
+        switch (config.kind) {
+            case 'local':
+                return new LocalRegistry({
+                    name: config.name,
+                    root: toLocalPath(fs, config.url),
+                    fs,
+                    hasher,
+                    trusted: config.trusted,
+                });
+            case 'git':
+                return new GitRegistry({
+                    name: config.name,
+                    url: config.url,
+                    ...(config.ref === undefined ? {} : { ref: config.ref }),
+                    cacheDir,
+                    fs,
+                    hasher,
+                    commands,
+                    clock,
+                    logger,
+                    trusted: config.trusted,
+                    ttlSeconds,
+                });
+            case 'http':
+                return new HttpRegistry({
+                    name: config.name,
+                    url: config.url,
+                    http,
+                    fs,
+                    hasher,
+                    clock,
+                    extractor,
+                    cacheDir,
+                    trusted: config.trusted,
+                    ttlSeconds,
+                });
+            default:
+                throw new AgentSkillsError(ErrorCode.USAGE, `Unknown registry kind "${String(config.kind)}" for "${config.name}"`, { hints: ['Supported kinds: local, git, http'], data: { config } });
+        }
+    }
+}
+function toLocalPath(fs, url) {
+    if (!url.startsWith('file://'))
+        return fs.resolve(url);
+    // `file:///C:/x` and `file:///home/x` both need the leading slash handling that
+    // `new URL().pathname` gets wrong on Windows.
+    const parsed = new URL(url);
+    const decoded = decodeURIComponent(parsed.pathname);
+    return fs.resolve(/^\/[a-zA-Z]:/.test(decoded) ? decoded.slice(1) : decoded);
+}
+//# sourceMappingURL=factory.js.map

package/dist/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,GAWV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAcpD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAAgC;IAExD,YAAY,OAAsC;QAChD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,MAAsB;QAC3B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACxF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAEnD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,IAAI,aAAa,CAAC;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;oBACjC,EAAE;oBACF,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YAEL,KAAK,KAAK;gBACR,OAAO,IAAI,WAAW,CAAC;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;oBACxD,QAAQ;oBACR,EAAE;oBACF,MAAM;oBACN,QAAQ;oBACR,KAAK;oBACL,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU;iBACX,CAAC,CAAC;YAEL,KAAK,MAAM;gBACT,OAAO,IAAI,YAAY,CAAC;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,IAAI;oBACJ,EAAE;oBACF,MAAM;oBACN,KAAK;oBACL,SAAS;oBACT,QAAQ;oBACR,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU;iBACX,CAAC,CAAC;YAEL;gBACE,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,KAAK,EACf,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,GAAG,EACrE,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACnE,CAAC;QACN,CAAC;IACH,CAAC;CACF;AAED,SAAS,WAAW,CAAC,EAAc,EAAE,GAAW;IAC9C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvD,gFAAgF;IAChF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC"}

package/dist/federation.d.ts

@@ -0,0 +1,36 @@
+import { type FederatedRegistry, type FetchedPackage, type IndexVersionEntry, type RefreshOptions, type RegistryKind, type SearchQuery, type SemanticVersion, type SkillManifest, type SkillRegistry, type SkillSummary } from '@senior-skills/core';
+/**
+ * An ordered set of registries presented as one.
+ *
+ * Precedence is **name-scoped**: the first registry publishing *any* version of a name owns
+ * that name outright, and a later registry cannot inject a higher version of it. That is the
+ * npm `.npmrc` model rather than "highest version anywhere wins", and the difference is a
+ * security property — it is what closes the dependency-confusion hole that has repeatedly
+ * been used against npm and PyPI.
+ *
+ * A caller that genuinely wants a specific source qualifies the reference
+ * (`company:java-performance`), which bypasses precedence entirely.
+ */
+export declare class RegistryFederation implements FederatedRegistry {
+    readonly name = "<federation>";
+    readonly kind: RegistryKind;
+    readonly trusted: boolean;
+    private readonly registries;
+    private readonly owners;
+    constructor(registries: readonly SkillRegistry[]);
+    members(): readonly SkillRegistry[];
+    named(name: string): SkillRegistry | undefined;
+    ownerOf(name: string): Promise<string | undefined>;
+    refresh(options?: RefreshOptions): Promise<void>;
+    /**
+     * Aggregates across every registry, labelling shadowed duplicates rather than dropping them.
+     * A user searching for a name their company registry overrides should be able to see that.
+     */
+    search(query: SearchQuery): Promise<readonly SkillSummary[]>;
+    has(name: string): Promise<boolean>;
+    versions(name: string): Promise<readonly IndexVersionEntry[]>;
+    manifest(name: string, version: SemanticVersion): Promise<SkillManifest>;
+    fetch(name: string, version: SemanticVersion): Promise<FetchedPackage>;
+    private require;
+}
+//# sourceMappingURL=federation.d.ts.map

package/dist/federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../src/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IAC1D,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAW;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAEpD,UAAU,EAAE,SAAS,aAAa,EAAE;IAKhD,OAAO,IAAI,SAAS,aAAa,EAAE;IAInC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIxC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAkBlD,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtD;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAoB5D,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAK7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAKxE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAK9D,OAAO;CAwBtB"}

package/dist/federation.js

@@ -0,0 +1,121 @@
+import { AgentSkillsError, ErrorCode, } from '@senior-skills/core';
+/**
+ * An ordered set of registries presented as one.
+ *
+ * Precedence is **name-scoped**: the first registry publishing *any* version of a name owns
+ * that name outright, and a later registry cannot inject a higher version of it. That is the
+ * npm `.npmrc` model rather than "highest version anywhere wins", and the difference is a
+ * security property — it is what closes the dependency-confusion hole that has repeatedly
+ * been used against npm and PyPI.
+ *
+ * A caller that genuinely wants a specific source qualifies the reference
+ * (`company:java-performance`), which bypasses precedence entirely.
+ */
+export class RegistryFederation {
+    name = '<federation>';
+    kind = 'local';
+    trusted;
+    registries;
+    owners = new Map();
+    constructor(registries) {
+        this.registries = registries;
+        this.trusted = registries.every((registry) => registry.trusted);
+    }
+    members() {
+        return this.registries;
+    }
+    named(name) {
+        return this.registries.find((registry) => registry.name === name);
+    }
+    async ownerOf(name) {
+        if (this.owners.has(name))
+            return this.owners.get(name);
+        for (const registry of this.registries) {
+            // One unreachable registry must not hide a name a lower-precedence one can serve, but it
+            // also must not silently promote the next registry to owner — so failures are skipped
+            // here and surfaced by `doctor`, which is the command whose job that is.
+            const has = await registry.has(name).catch(() => false);
+            if (has) {
+                this.owners.set(name, registry.name);
+                return registry.name;
+            }
+        }
+        this.owners.set(name, undefined);
+        return undefined;
+    }
+    async refresh(options) {
+        this.owners.clear();
+        const failures = [];
+        for (const registry of this.registries) {
+            try {
+                await registry.refresh(options);
+            }
+            catch (error) {
+                failures.push(error instanceof AgentSkillsError
+                    ? error
+                    : new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, String(error)));
+            }
+        }
+        // Every registry failed: this is not a partial outage, it is "no registries work".
+        if (failures.length > 0 && failures.length === this.registries.length) {
+            throw new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, 'No registry could be reached', {
+                details: failures.map((failure) => `  ${failure.message}`),
+                hints: ['senior-skills doctor   to diagnose', 'senior-skills registry list'],
+            });
+        }
+    }
+    /**
+     * Aggregates across every registry, labelling shadowed duplicates rather than dropping them.
+     * A user searching for a name their company registry overrides should be able to see that.
+     */
+    async search(query) {
+        const seen = new Map();
+        const results = [];
+        for (const registry of this.registries) {
+            const found = await registry.search(query).catch(() => []);
+            for (const summary of found) {
+                const owner = seen.get(summary.name);
+                if (owner === undefined) {
+                    seen.set(summary.name, registry.name);
+                    results.push(summary);
+                }
+                else {
+                    results.push({ ...summary, shadowedBy: owner });
+                }
+            }
+        }
+        return query.limit === undefined ? results : results.slice(0, query.limit);
+    }
+    async has(name) {
+        return (await this.ownerOf(name)) !== undefined;
+    }
+    async versions(name) {
+        const registry = await this.require(name);
+        return registry.versions(name);
+    }
+    async manifest(name, version) {
+        const registry = await this.require(name);
+        return registry.manifest(name, version);
+    }
+    async fetch(name, version) {
+        const registry = await this.require(name);
+        return registry.fetch(name, version);
+    }
+    async require(name) {
+        const owner = await this.ownerOf(name);
+        const registry = owner === undefined ? undefined : this.named(owner);
+        if (registry === undefined) {
+            throw new AgentSkillsError(ErrorCode.SKILL_NOT_FOUND, `Skill "${name}" was not found in any configured registry`, {
+                details: [
+                    '',
+                    'Searched, in precedence order:',
+                    ...this.registries.map((member, index) => `  ${index + 1}. ${member.name} (${member.kind})`),
+                ],
+                hints: [`senior-skills search ${name}`, 'senior-skills registry list'],
+                data: { name, registries: this.registries.map((member) => member.name) },
+            });
+        }
+        return registry;
+    }
+}
+//# sourceMappingURL=federation.js.map

package/dist/federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../src/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,GAWV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,cAAc,CAAC;IACtB,IAAI,GAAiB,OAAO,CAAC;IAC7B,OAAO,CAAU;IAET,UAAU,CAA2B;IACrC,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,YAAY,UAAoC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAExD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,yFAAyF;YACzF,sFAAsF;YACtF,yEAAyE;YACzE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrC,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CACX,KAAK,YAAY,gBAAgB;oBAC/B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,oBAAoB,EAAE,8BAA8B,EAAE;gBACzF,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC1D,KAAK,EAAE,CAAC,oCAAoC,EAAE,6BAA6B,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAwB;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAAwB;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAErE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,eAAe,EACzB,UAAU,IAAI,4CAA4C,EAC1D;gBACE,OAAO,EAAE;oBACP,EAAE;oBACF,gCAAgC;oBAChC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CACpB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,GAAG,CACrE;iBACF;gBACD,KAAK,EAAE,CAAC,wBAAwB,IAAI,EAAE,EAAE,6BAA6B,CAAC;gBACtE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;aACzE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/git-registry.d.ts

@@ -0,0 +1,58 @@
+import { type Clock, type CommandRunner, type FileSystem, type Hasher, type Logger, type RegistryKind } from '@senior-skills/core';
+import { LocalRegistry } from './local-registry.ts';
+export interface GitRegistryOptions {
+    readonly name: string;
+    /** Clone URL, optionally with a `#ref` suffix. */
+    readonly url: string;
+    readonly ref?: string;
+    readonly cacheDir: string;
+    readonly fs: FileSystem;
+    readonly hasher: Hasher;
+    readonly commands: CommandRunner;
+    readonly clock: Clock;
+    readonly logger: Logger;
+    readonly trusted?: boolean;
+    readonly ttlSeconds?: number;
+}
+/**
+ * A registry backed by a git repository.
+ *
+ * This is the v1 default because it requires no infrastructure: a public repository with
+ * `registry/skills.yaml` and a `skills/` directory *is* a registry, and its write path is a
+ * pull request — which is a better review surface for content that becomes agent instructions
+ * than an upload API would be.
+ *
+ * The clone is shallow (`--depth 1`), stored under the CLI cache, and refreshed on a TTL.
+ * Once it is on disk the behaviour is exactly {@link LocalRegistry}'s, which is why this class
+ * only has to deal with fetching.
+ */
+export declare class GitRegistry extends LocalRegistry {
+    readonly kind: RegistryKind;
+    private readonly url;
+    private readonly ref;
+    private readonly cloneDir;
+    private readonly commands;
+    private readonly clock;
+    private readonly logger;
+    private readonly ttlSeconds;
+    private refreshed;
+    constructor(options: GitRegistryOptions);
+    refresh(): Promise<void>;
+    protected ensureAvailable(): Promise<string>;
+    protected resolvedLocation(directory: string): string;
+    private sync;
+    private isStale;
+    private assertGitAvailable;
+    private git;
+}
+/** `https://host/repo.git#main` → `{ url, ref }`. An explicit `ref` option wins. */
+export declare function splitRef(url: string, ref?: string): {
+    url: string;
+    ref: string | undefined;
+};
+/**
+ * Cache directory name for a clone. Readable prefix plus a hash, so a user can tell which
+ * cache belongs to which registry without the path depending on unsanitised URL characters.
+ */
+export declare function cacheKey(url: string, ref: string | undefined): string;
+//# sourceMappingURL=git-registry.d.ts.map

package/dist/git-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-registry.d.ts","sourceRoot":"","sources":["../src/git-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;;;;;;GAWG;AACH,qBAAa,WAAY,SAAQ,aAAa;IAC5C,SAAkB,IAAI,EAAE,YAAY,CAAS;IAE7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,kBAAkB;IAsBxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;cAMd,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;cAKxC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;YAKhD,IAAI;YAgDJ,OAAO;YAYP,kBAAkB;YAgBlB,GAAG;CAwBlB;AAED,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAK5F;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAcrE"}

package/dist/git-registry.js

@@ -0,0 +1,162 @@
+import { AgentSkillsError, ErrorCode, } from '@senior-skills/core';
+import { LocalRegistry } from "./local-registry.js";
+const CACHE_MARKER = '.senior-skills-fetched-at';
+/**
+ * A registry backed by a git repository.
+ *
+ * This is the v1 default because it requires no infrastructure: a public repository with
+ * `registry/skills.yaml` and a `skills/` directory *is* a registry, and its write path is a
+ * pull request — which is a better review surface for content that becomes agent instructions
+ * than an upload API would be.
+ *
+ * The clone is shallow (`--depth 1`), stored under the CLI cache, and refreshed on a TTL.
+ * Once it is on disk the behaviour is exactly {@link LocalRegistry}'s, which is why this class
+ * only has to deal with fetching.
+ */
+export class GitRegistry extends LocalRegistry {
+    kind = 'git';
+    url;
+    ref;
+    cloneDir;
+    commands;
+    clock;
+    logger;
+    ttlSeconds;
+    refreshed = false;
+    constructor(options) {
+        const { url, ref } = splitRef(options.url, options.ref);
+        const cloneDir = options.fs.join(options.cacheDir, 'git', cacheKey(url, ref));
+        super({
+            name: options.name,
+            root: cloneDir,
+            fs: options.fs,
+            hasher: options.hasher,
+            trusted: options.trusted ?? true,
+            kind: 'git',
+        });
+        this.url = url;
+        this.ref = ref;
+        this.cloneDir = cloneDir;
+        this.commands = options.commands;
+        this.clock = options.clock;
+        this.logger = options.logger;
+        this.ttlSeconds = options.ttlSeconds ?? 3600;
+    }
+    async refresh() {
+        this.refreshed = false;
+        await this.sync(true);
+        await super.refresh();
+    }
+    async ensureAvailable() {
+        await this.sync(false);
+        return this.cloneDir;
+    }
+    resolvedLocation(directory) {
+        const relative = this.fs.relative(this.cloneDir, directory).replace(/\\/g, '/');
+        return `${this.url}${this.ref === undefined ? '' : `#${this.ref}`}:${relative}`;
+    }
+    async sync(force) {
+        if (this.refreshed && !force)
+            return;
+        const cloned = await this.fs.exists(this.fs.join(this.cloneDir, '.git'));
+        if (cloned && !force && !(await this.isStale())) {
+            this.refreshed = true;
+            return;
+        }
+        await this.assertGitAvailable();
+        if (!cloned) {
+            // A stale partial clone from an interrupted run would make `git fetch` fail confusingly.
+            await this.fs.remove(this.cloneDir).catch(() => undefined);
+            await this.fs.mkdirp(this.fs.dirname(this.cloneDir));
+            this.logger.debug(`Cloning registry "${this.name}" from ${this.url}`);
+            await this.git([
+                'clone',
+                '--depth',
+                '1',
+                ...(this.ref === undefined ? [] : ['--branch', this.ref]),
+                '--',
+                this.url,
+                this.cloneDir,
+            ], this.fs.dirname(this.cloneDir));
+        }
+        else {
+            this.logger.debug(`Refreshing registry "${this.name}"`);
+            await this.git(['fetch', '--depth', '1', 'origin', ...(this.ref === undefined ? [] : [this.ref])], this.cloneDir);
+            await this.git(['reset', '--hard', this.ref === undefined ? 'FETCH_HEAD' : `origin/${this.ref}`], this.cloneDir);
+        }
+        await this.fs.writeFile(this.fs.join(this.cloneDir, CACHE_MARKER), this.clock.now().toISOString());
+        this.refreshed = true;
+    }
+    async isStale() {
+        const marker = this.fs.join(this.cloneDir, CACHE_MARKER);
+        if (!(await this.fs.exists(marker)))
+            return true;
+        try {
+            const fetchedAt = Date.parse(await this.fs.readTextFile(marker));
+            if (Number.isNaN(fetchedAt))
+                return true;
+            return this.clock.now().getTime() - fetchedAt > this.ttlSeconds * 1000;
+        }
+        catch {
+            return true;
+        }
+    }
+    async assertGitAvailable() {
+        if ((await this.commands.which('git')) !== undefined)
+            return;
+        throw new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, `Registry "${this.name}" needs git`, {
+            details: [`git was not found on PATH, and "${this.name}" is a git registry.`],
+            hints: [
+                'Install git: https://git-scm.com/downloads',
+                'Or configure an http registry instead: senior-skills registry add <name> <https url>',
+            ],
+            data: { registry: this.name, url: this.url },
+        });
+    }
+    async git(args, cwd) {
+        // core.longpaths: on Windows, git refuses paths past MAX_PATH (260) by default, and a
+        // registry checkout under ~/.senior-skills/cache plus a skill's reference path can exceed
+        // it — the clone then half-succeeds and every later sync fails. The setting is read only
+        // by Git for Windows; elsewhere it is inert.
+        const result = await this.commands.run('git', ['-c', 'core.longpaths=true', ...args], {
+            cwd,
+            timeoutMs: 120_000,
+        });
+        if (result.code === 0)
+            return;
+        throw new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, `Could not reach registry "${this.name}"`, {
+            details: [`git ${args.join(' ')}`, '', result.stderr.trim() || result.stdout.trim()],
+            hints: [
+                'Check the URL and your network access',
+                'For a private repository, make sure your git credentials are configured',
+            ],
+            data: { registry: this.name, url: this.url, exitCode: result.code },
+        });
+    }
+}
+/** `https://host/repo.git#main` → `{ url, ref }`. An explicit `ref` option wins. */
+export function splitRef(url, ref) {
+    const hash = url.lastIndexOf('#');
+    if (hash === -1)
+        return { url, ref };
+    const fromUrl = url.slice(hash + 1);
+    return { url: url.slice(0, hash), ref: ref ?? (fromUrl === '' ? undefined : fromUrl) };
+}
+/**
+ * Cache directory name for a clone. Readable prefix plus a hash, so a user can tell which
+ * cache belongs to which registry without the path depending on unsanitised URL characters.
+ */
+export function cacheKey(url, ref) {
+    const slug = url
+        .replace(/^https?:\/\//, '')
+        .replace(/\.git$/, '')
+        .replace(/[^a-zA-Z0-9]+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, 48);
+    let hash = 5381;
+    for (const character of `${url}#${ref ?? ''}`) {
+        hash = ((hash << 5) + hash + character.charCodeAt(0)) >>> 0;
+    }
+    return `${slug}-${hash.toString(36)}`;
+}
+//# sourceMappingURL=git-registry.js.map

package/dist/git-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-registry.js","sourceRoot":"","sources":["../src/git-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,GAOV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAiBpD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAY,SAAQ,aAAa;IAC1B,IAAI,GAAiB,KAAK,CAAC;IAE5B,GAAG,CAAS;IACZ,GAAG,CAAqB;IACxB,QAAQ,CAAS;IACjB,QAAQ,CAAgB;IACxB,KAAK,CAAQ;IACb,MAAM,CAAS;IACf,UAAU,CAAS;IAC5B,SAAS,GAAG,KAAK,CAAC;IAE1B,YAAY,OAA2B;QACrC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAE9E,KAAK,CAAC;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC/C,CAAC;IAEQ,KAAK,CAAC,OAAO;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAEkB,KAAK,CAAC,eAAe;QACtC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEkB,gBAAgB,CAAC,SAAiB;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChF,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAc;QAC/B,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK;YAAE,OAAO;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAEzE,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,yFAAyF;YACzF,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,GAAG,CACZ;gBACE,OAAO;gBACP,SAAS;gBACT,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzD,IAAI;gBACJ,IAAI,CAAC,GAAG;gBACR,IAAI,CAAC,QAAQ;aACd,EACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,GAAG,CACZ,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAClF,IAAI,CAAC,QAAQ,CACd,CAAC;YACF,MAAM,IAAI,CAAC,GAAG,CACZ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,EACjF,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CACrB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EACzC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO;QAC7D,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,oBAAoB,EAC9B,aAAa,IAAI,CAAC,IAAI,aAAa,EACnC;YACE,OAAO,EAAE,CAAC,mCAAmC,IAAI,CAAC,IAAI,sBAAsB,CAAC;YAC7E,KAAK,EAAE;gBACL,4CAA4C;gBAC5C,sFAAsF;aACvF;YACD,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAC7C,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,IAAuB,EAAE,GAAW;QACpD,sFAAsF;QACtF,0FAA0F;QAC1F,yFAAyF;QACzF,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,EAAE;YACpF,GAAG;YACH,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAE9B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,oBAAoB,EAC9B,6BAA6B,IAAI,CAAC,IAAI,GAAG,EACzC;YACE,OAAO,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpF,KAAK,EAAE;gBACL,uCAAuC;gBACvC,yEAAyE;aAC1E;YACD,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE;SACpE,CACF,CAAC;IACJ,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAY;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAuB;IAC3D,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC"}

package/dist/http-registry.d.ts

@@ -0,0 +1,50 @@
+import { type Clock, type FetchedPackage, type FileSystem, type Hasher, type HttpClient, type IndexVersionEntry, type PackageExtractor, type RegistryKind, type SearchQuery, type SemanticVersion, type SkillManifest, type SkillRegistry, type SkillSummary } from '@senior-skills/core';
+export interface HttpRegistryOptions {
+    readonly name: string;
+    /** URL of the index document, e.g. `https://skills.example.com/index.json`. */
+    readonly url: string;
+    readonly http: HttpClient;
+    readonly fs: FileSystem;
+    readonly hasher: Hasher;
+    readonly clock: Clock;
+    readonly extractor: PackageExtractor;
+    readonly cacheDir: string;
+    readonly trusted?: boolean;
+    readonly ttlSeconds?: number;
+}
+/**
+ * A registry served over HTTPS: an index document plus `.tar.gz` payloads.
+ *
+ * Exists so a static bucket — or a future hosted service — can speak the identical protocol
+ * with no client change. Transport security is enforced by the HTTP client (plaintext is
+ * refused outside loopback), and payload safety by the shared {@link SafeExtractor}, so this
+ * class is only responsible for caching and for turning HTTP status codes into good errors.
+ */
+export declare class HttpRegistry implements SkillRegistry {
+    readonly name: string;
+    readonly kind: RegistryKind;
+    readonly trusted: boolean;
+    private readonly url;
+    private readonly http;
+    private readonly fs;
+    private readonly hasher;
+    private readonly clock;
+    private readonly extractor;
+    private readonly cacheDir;
+    private readonly ttlSeconds;
+    private index;
+    private fetchedAt;
+    constructor(options: HttpRegistryOptions);
+    refresh(): Promise<void>;
+    search(query: SearchQuery): Promise<readonly SkillSummary[]>;
+    has(name: string): Promise<boolean>;
+    versions(name: string): Promise<readonly IndexVersionEntry[]>;
+    manifest(name: string, version: SemanticVersion): Promise<SkillManifest>;
+    fetch(name: string, version: SemanticVersion): Promise<FetchedPackage>;
+    private download;
+    private loadIndex;
+    private cachePath;
+    private writeCache;
+    private readCache;
+}
+//# sourceMappingURL=http-registry.d.ts.map

package/dist/http-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-registry.d.ts","sourceRoot":"","sources":["../src/http-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,KAAK,EACV,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAU;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,SAAS,CAAK;gBAEV,OAAO,EAAE,mBAAmB;IAalC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU5D,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAK7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YA6C9D,QAAQ;YAoBR,SAAS;IA6BvB,OAAO,CAAC,SAAS;YAIH,UAAU;YAIV,SAAS;CAKxB"}

package/dist/http-registry.js

@@ -0,0 +1,137 @@
+import { AgentSkillsError, ErrorCode, computePackageIntegrity, parseRegistryIndex, } from '@senior-skills/core';
+import { matches, toSummaries } from "./search.js";
+/**
+ * A registry served over HTTPS: an index document plus `.tar.gz` payloads.
+ *
+ * Exists so a static bucket — or a future hosted service — can speak the identical protocol
+ * with no client change. Transport security is enforced by the HTTP client (plaintext is
+ * refused outside loopback), and payload safety by the shared {@link SafeExtractor}, so this
+ * class is only responsible for caching and for turning HTTP status codes into good errors.
+ */
+export class HttpRegistry {
+    name;
+    kind = 'http';
+    trusted;
+    url;
+    http;
+    fs;
+    hasher;
+    clock;
+    extractor;
+    cacheDir;
+    ttlSeconds;
+    index;
+    fetchedAt = 0;
+    constructor(options) {
+        this.name = options.name;
+        this.url = options.url;
+        this.http = options.http;
+        this.fs = options.fs;
+        this.hasher = options.hasher;
+        this.clock = options.clock;
+        this.extractor = options.extractor;
+        this.cacheDir = options.cacheDir;
+        this.trusted = options.trusted ?? true;
+        this.ttlSeconds = options.ttlSeconds ?? 3600;
+    }
+    async refresh() {
+        this.index = undefined;
+        this.fetchedAt = 0;
+        await this.loadIndex();
+    }
+    async search(query) {
+        const index = await this.loadIndex();
+        return toSummaries(index.skills.filter((skill) => matches(skill, query.text)), this.name, query.limit, query.text);
+    }
+    async has(name) {
+        return (await this.loadIndex()).skills.some((skill) => skill.name === name);
+    }
+    async versions(name) {
+        const index = await this.loadIndex();
+        return index.skills.find((skill) => skill.name === name)?.versions ?? [];
+    }
+    async manifest(name, version) {
+        return (await this.fetch(name, version)).pkg.manifest;
+    }
+    async fetch(name, version) {
+        const entry = (await this.versions(name)).find((candidate) => candidate.version === version);
+        if (entry === undefined) {
+            throw new AgentSkillsError(ErrorCode.VERSION_NOT_FOUND, `${name}@${version} is not published in "${this.name}"`, { data: { name, version, registry: this.name } });
+        }
+        if (entry.tarball === undefined) {
+            throw new AgentSkillsError(ErrorCode.REGISTRY_INVALID_INDEX, `${name}@${version} in "${this.name}" has no "tarball"`, {
+                details: ['An http registry must serve packages as .tar.gz URLs.'],
+                data: { name, version, registry: this.name },
+            });
+        }
+        const tarballUrl = new URL(entry.tarball, this.url).toString();
+        const bytes = await this.download(tarballUrl, `${name}@${version}`);
+        const pkg = await this.extractor.extract(bytes, tarballUrl);
+        if (pkg.manifest.name !== name || pkg.manifest.version !== version) {
+            // The index said one thing and the payload another. Treat it as an attack, not a typo.
+            throw new AgentSkillsError(ErrorCode.INTEGRITY_MISMATCH, `Registry "${this.name}" served ${pkg.manifest.name}@${pkg.manifest.version} for ${name}@${version}`, {
+                hints: ['Do not install this. Report it to the registry maintainers.'],
+                data: { registry: this.name, requested: `${name}@${version}` },
+            });
+        }
+        return {
+            pkg,
+            registry: this.name,
+            resolved: tarballUrl,
+            integrity: computePackageIntegrity(pkg, this.hasher),
+        };
+    }
+    async download(url, label) {
+        const response = await this.http.get(url, { timeoutMs: 60_000 });
+        if (response.status === 404) {
+            throw new AgentSkillsError(ErrorCode.SKILL_NOT_FOUND, `${label} was not found at ${url}`, {
+                hints: ['The registry index may be out of date; try `senior-skills doctor`'],
+                data: { url, registry: this.name },
+            });
+        }
+        if (response.status >= 400) {
+            throw new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, `Registry "${this.name}" returned HTTP ${response.status} for ${label}`, { data: { url, status: response.status, registry: this.name } });
+        }
+        return response.body;
+    }
+    async loadIndex() {
+        const now = this.clock.now().getTime();
+        if (this.index !== undefined && now - this.fetchedAt < this.ttlSeconds * 1000)
+            return this.index;
+        let text;
+        try {
+            const response = await this.http.get(this.url, { timeoutMs: 30_000 });
+            if (response.status >= 400) {
+                throw new AgentSkillsError(ErrorCode.REGISTRY_UNAVAILABLE, `Registry "${this.name}" returned HTTP ${response.status}`, { details: [this.url], data: { url: this.url, status: response.status } });
+            }
+            text = new TextDecoder().decode(response.body);
+            // Cache on disk so `search` and `info` keep working when the network is unavailable.
+            await this.writeCache(text).catch(() => undefined);
+        }
+        catch (error) {
+            const cached = await this.readCache();
+            if (cached === undefined)
+                throw error;
+            text = cached;
+        }
+        this.index = parseRegistryIndex(text, { source: this.url, fallbackName: this.name });
+        this.fetchedAt = now;
+        return this.index;
+    }
+    cachePath() {
+        return this.fs.join(this.cacheDir, 'http', `${sanitise(this.name)}.index`);
+    }
+    async writeCache(text) {
+        await this.fs.writeFile(this.cachePath(), text);
+    }
+    async readCache() {
+        const path = this.cachePath();
+        if (!(await this.fs.exists(path)))
+            return undefined;
+        return this.fs.readTextFile(path);
+    }
+}
+function sanitise(name) {
+    return name.replace(/[^a-zA-Z0-9._-]+/g, '-');
+}
+//# sourceMappingURL=http-registry.js.map

package/dist/http-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-registry.js","sourceRoot":"","sources":["../src/http-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,uBAAuB,EACvB,kBAAkB,GAenB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBnD;;;;;;;GAOG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,CAAS;IACb,IAAI,GAAiB,MAAM,CAAC;IAC5B,OAAO,CAAU;IAET,GAAG,CAAS;IACZ,IAAI,CAAa;IACjB,EAAE,CAAa;IACf,MAAM,CAAS;IACf,KAAK,CAAQ;IACb,SAAS,CAAmB;IAC5B,QAAQ,CAAS;IACjB,UAAU,CAAS;IAC5B,KAAK,CAA4B;IACjC,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,OAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,WAAW,CAChB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAC1D,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAwB;QACnD,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAAwB;QAChD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAE7F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,iBAAiB,EAC3B,GAAG,IAAI,IAAI,OAAO,yBAAyB,IAAI,CAAC,IAAI,GAAG,EACvD,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,sBAAsB,EAChC,GAAG,IAAI,IAAI,OAAO,QAAQ,IAAI,CAAC,IAAI,oBAAoB,EACvD;gBACE,OAAO,EAAE,CAAC,uDAAuD,CAAC;gBAClE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;aAC7C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE5D,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACnE,uFAAuF;YACvF,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,kBAAkB,EAC5B,aAAa,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,QAAQ,IAAI,IAAI,OAAO,EAAE,EACpG;gBACE,KAAK,EAAE,CAAC,6DAA6D,CAAC;gBACtE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE;aAC/D,CACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;SACrD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,KAAa;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,KAAK,qBAAqB,GAAG,EAAE,EAAE;gBACxF,KAAK,EAAE,CAAC,mEAAmE,CAAC;gBAC5E,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,oBAAoB,EAC9B,aAAa,IAAI,CAAC,IAAI,mBAAmB,QAAQ,CAAC,MAAM,QAAQ,KAAK,EAAE,EACvE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;YAC3E,OAAO,IAAI,CAAC,KAAK,CAAC;QAEpB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,oBAAoB,EAC9B,aAAa,IAAI,CAAC,IAAI,mBAAmB,QAAQ,CAAC,MAAM,EAAE,EAC1D,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,qFAAqF;YACrF,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC;YACtC,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@senior-skills/registry` — where skills come from.
+ *
+ * Three interchangeable drivers behind one interface, plus the federation that gives an
+ * ordered list of them precedence semantics. Nothing here knows about agents or installation.
+ */
+export { DefaultRegistryFactory, type DefaultRegistryFactoryOptions } from './factory.ts';
+export { RegistryFederation } from './federation.ts';
+export { GitRegistry, cacheKey, splitRef, type GitRegistryOptions } from './git-registry.ts';
+export { HttpRegistry, type HttpRegistryOptions } from './http-registry.ts';
+export { INDEX_RELATIVE_PATH, LocalRegistry, type LocalRegistryOptions } from './local-registry.ts';
+export { matches, score, toSummaries } from './search.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@senior-skills/registry` — where skills come from.
+ *
+ * Three interchangeable drivers behind one interface, plus the federation that gives an
+ * ordered list of them precedence semantics. Nothing here knows about agents or installation.
+ */
+export { DefaultRegistryFactory } from "./factory.js";
+export { RegistryFederation } from "./federation.js";
+export { GitRegistry, cacheKey, splitRef } from "./git-registry.js";
+export { HttpRegistry } from "./http-registry.js";
+export { INDEX_RELATIVE_PATH, LocalRegistry } from "./local-registry.js";
+export { matches, score, toSummaries } from "./search.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAsC,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAA2B,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAA4B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/local-registry.d.ts

@@ -0,0 +1,40 @@
+import { type FetchedPackage, type FileSystem, type Hasher, type IndexVersionEntry, type RegistryKind, type SearchQuery, type SemanticVersion, type SkillManifest, type SkillRegistry, type SkillSummary } from '@senior-skills/core';
+export declare const INDEX_RELATIVE_PATH = "registry/skills.yaml";
+export interface LocalRegistryOptions {
+    readonly name: string;
+    /** Absolute path of the registry checkout root (the directory holding `registry/`). */
+    readonly root: string;
+    readonly fs: FileSystem;
+    readonly hasher: Hasher;
+    readonly trusted?: boolean;
+    readonly kind?: RegistryKind;
+}
+/**
+ * A registry backed by a directory on disk.
+ *
+ * Used directly (`senior-skills registry add local ./my-skills`), as the test double for the
+ * whole registry protocol, and as the second half of {@link GitRegistry}, which clones into a
+ * cache directory and then reads it exactly like this.
+ */
+export declare class LocalRegistry implements SkillRegistry {
+    readonly name: string;
+    readonly kind: RegistryKind;
+    readonly trusted: boolean;
+    protected readonly fs: FileSystem;
+    protected readonly hasher: Hasher;
+    private readonly root;
+    private index;
+    constructor(options: LocalRegistryOptions);
+    /** Overridden by GitRegistry to refresh the clone before the index is read. */
+    protected ensureAvailable(): Promise<string>;
+    refresh(): Promise<void>;
+    search(query: SearchQuery): Promise<readonly SkillSummary[]>;
+    has(name: string): Promise<boolean>;
+    versions(name: string): Promise<readonly IndexVersionEntry[]>;
+    manifest(name: string, version: SemanticVersion): Promise<SkillManifest>;
+    fetch(name: string, version: SemanticVersion): Promise<FetchedPackage>;
+    protected resolvedLocation(directory: string): string;
+    private loadPackage;
+    private loadIndex;
+}
+//# sourceMappingURL=local-registry.d.ts.map

package/dist/local-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-registry.d.ts","sourceRoot":"","sources":["../src/local-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IAClC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,KAAK,CAA4B;gBAE7B,OAAO,EAAE,oBAAoB;IASzC,+EAA+E;cAC/D,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAKxB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAM5D,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAK7D,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAU5E,SAAS,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;YAIvC,WAAW;YA8BX,SAAS;CAwBxB"}

package/dist/local-registry.js

@@ -0,0 +1,101 @@
+import { AgentSkillsError, ErrorCode, computePackageIntegrity, loadPackageFromDirectory, parseRegistryIndex, } from '@senior-skills/core';
+import { matches, toSummaries } from "./search.js";
+export const INDEX_RELATIVE_PATH = 'registry/skills.yaml';
+/**
+ * A registry backed by a directory on disk.
+ *
+ * Used directly (`senior-skills registry add local ./my-skills`), as the test double for the
+ * whole registry protocol, and as the second half of {@link GitRegistry}, which clones into a
+ * cache directory and then reads it exactly like this.
+ */
+export class LocalRegistry {
+    name;
+    kind;
+    trusted;
+    fs;
+    hasher;
+    root;
+    index;
+    constructor(options) {
+        this.name = options.name;
+        this.kind = options.kind ?? 'local';
+        this.trusted = options.trusted ?? true;
+        this.fs = options.fs;
+        this.hasher = options.hasher;
+        this.root = options.root;
+    }
+    /** Overridden by GitRegistry to refresh the clone before the index is read. */
+    async ensureAvailable() {
+        return this.root;
+    }
+    async refresh() {
+        this.index = undefined;
+        await this.loadIndex();
+    }
+    async search(query) {
+        const index = await this.loadIndex();
+        const found = index.skills.filter((skill) => matches(skill, query.text));
+        return toSummaries(found, this.name, query.limit);
+    }
+    async has(name) {
+        const index = await this.loadIndex();
+        return index.skills.some((skill) => skill.name === name);
+    }
+    async versions(name) {
+        const index = await this.loadIndex();
+        return index.skills.find((skill) => skill.name === name)?.versions ?? [];
+    }
+    async manifest(name, version) {
+        return (await this.loadPackage(name, version)).pkg.manifest;
+    }
+    async fetch(name, version) {
+        const { pkg, directory } = await this.loadPackage(name, version);
+        return {
+            pkg,
+            registry: this.name,
+            resolved: this.resolvedLocation(directory),
+            integrity: computePackageIntegrity(pkg, this.hasher),
+        };
+    }
+    resolvedLocation(directory) {
+        return `file://${directory.replace(/\\/g, '/')}`;
+    }
+    async loadPackage(name, version) {
+        const root = await this.ensureAvailable();
+        const entry = (await this.versions(name)).find((candidate) => candidate.version === version);
+        if (entry === undefined) {
+            throw new AgentSkillsError(ErrorCode.VERSION_NOT_FOUND, `${name}@${version} is not published in "${this.name}"`, {
+                hints: [`senior-skills info ${name}   to see published versions`],
+                data: { name, version, registry: this.name },
+            });
+        }
+        if (entry.path === undefined) {
+            throw new AgentSkillsError(ErrorCode.REGISTRY_INVALID_INDEX, `${name}@${version} in "${this.name}" has no "path"`, {
+                details: ['A local or git registry serves packages from a directory, not a tarball.'],
+                data: { name, version, registry: this.name },
+            });
+        }
+        const directory = this.fs.join(root, ...entry.path.split('/'));
+        const loaded = await loadPackageFromDirectory(this.fs, directory);
+        return { pkg: loaded.pkg, directory };
+    }
+    async loadIndex() {
+        if (this.index !== undefined)
+            return this.index;
+        const root = await this.ensureAvailable();
+        const path = this.fs.join(root, ...INDEX_RELATIVE_PATH.split('/'));
+        if (!(await this.fs.exists(path))) {
+            throw new AgentSkillsError(ErrorCode.REGISTRY_INVALID_INDEX, `Registry "${this.name}" has no ${INDEX_RELATIVE_PATH}`, {
+                details: [`Looked in: ${root}`],
+                hints: ['A registry is a directory containing registry/skills.yaml and skills/'],
+                data: { registry: this.name, root },
+            });
+        }
+        this.index = parseRegistryIndex(await this.fs.readTextFile(path), {
+            source: path,
+            fallbackName: this.name,
+        });
+        return this.index;
+    }
+}
+//# sourceMappingURL=local-registry.js.map

package/dist/local-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-registry.js","sourceRoot":"","sources":["../src/local-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,GAYnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAY1D;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,CAAS;IACb,IAAI,CAAe;IACnB,OAAO,CAAU;IAEP,EAAE,CAAa;IACf,MAAM,CAAS;IACjB,IAAI,CAAS;IACtB,KAAK,CAA4B;IAEzC,YAAY,OAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,+EAA+E;IACrE,KAAK,CAAC,eAAe;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAwB;QACnD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAAwB;QAChD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC1C,SAAS,EAAE,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,gBAAgB,CAAC,SAAiB;QAC1C,OAAO,UAAU,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,OAAwB;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAE7F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,iBAAiB,EAC3B,GAAG,IAAI,IAAI,OAAO,yBAAyB,IAAI,CAAC,IAAI,GAAG,EACvD;gBACE,KAAK,EAAE,CAAC,sBAAsB,IAAI,8BAA8B,CAAC;gBACjE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;aAC7C,CACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,sBAAsB,EAChC,GAAG,IAAI,IAAI,OAAO,QAAQ,IAAI,CAAC,IAAI,iBAAiB,EACpD;gBACE,OAAO,EAAE,CAAC,0EAA0E,CAAC;gBACrF,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;aAC7C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEhD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,sBAAsB,EAChC,aAAa,IAAI,CAAC,IAAI,YAAY,mBAAmB,EAAE,EACvD;gBACE,OAAO,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC;gBAC/B,KAAK,EAAE,CAAC,uEAAuE,CAAC;gBAChF,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;aACpC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;YAChE,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI,CAAC,IAAI;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF"}

package/dist/search.d.ts

@@ -0,0 +1,10 @@
+import type { IndexSkillEntry, SkillSummary } from '@senior-skills/core';
+/**
+ * Search ranking, shared by every registry implementation so results are ordered the same way
+ * whatever the backend. Intentionally simple: substring scoring over name, keywords and
+ * description, which is the right amount of machinery for an index that fits in memory.
+ */
+export declare function matches(skill: IndexSkillEntry, rawQuery: string): boolean;
+export declare function score(skill: IndexSkillEntry, rawQuery: string): number;
+export declare function toSummaries(skills: readonly IndexSkillEntry[], registry: string, limit?: number, query?: string): readonly SkillSummary[];
+//# sourceMappingURL=search.d.ts.map

package/dist/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../src/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOzE;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYtE;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,KAAK,SAAK,GACT,SAAS,YAAY,EAAE,CAezB"}

package/dist/search.js

@@ -0,0 +1,47 @@
+/**
+ * Search ranking, shared by every registry implementation so results are ordered the same way
+ * whatever the backend. Intentionally simple: substring scoring over name, keywords and
+ * description, which is the right amount of machinery for an index that fits in memory.
+ */
+export function matches(skill, rawQuery) {
+    const query = rawQuery.trim().toLowerCase();
+    if (query === '')
+        return true;
+    const terms = query.split(/\s+/).filter(Boolean);
+    const haystack = `${skill.name} ${skill.keywords.join(' ')} ${skill.description}`.toLowerCase();
+    return terms.every((term) => haystack.includes(term));
+}
+export function score(skill, rawQuery) {
+    const query = rawQuery.trim().toLowerCase();
+    if (query === '')
+        return 0;
+    const name = skill.name.toLowerCase();
+    if (name === query)
+        return 100;
+    if (name.startsWith(query))
+        return 80;
+    if (name.includes(query))
+        return 60;
+    if (skill.keywords.some((keyword) => keyword.toLowerCase() === query))
+        return 50;
+    if (skill.keywords.some((keyword) => keyword.toLowerCase().includes(query)))
+        return 30;
+    if (skill.description.toLowerCase().includes(query))
+        return 10;
+    return 0;
+}
+export function toSummaries(skills, registry, limit, query = '') {
+    const ranked = [...skills].sort((a, b) => {
+        const difference = score(b, query) - score(a, query);
+        return difference !== 0 ? difference : a.name.localeCompare(b.name);
+    });
+    const summaries = ranked.map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+        keywords: skill.keywords,
+        latest: skill.latest,
+        registry,
+    }));
+    return limit === undefined ? summaries : summaries.slice(0, limit);
+}
+//# sourceMappingURL=search.js.map

package/dist/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../src/search.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAsB,EAAE,QAAgB;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAChG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAsB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IAE3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAAkC,EAClC,QAAgB,EAChB,KAAc,EACd,KAAK,GAAG,EAAE;IAEV,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAgB,EAAE,CAAC,CAAC;QACrD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;KACT,CAAC,CAAC,CAAC;IAEJ,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@senior-skills/registry",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Local, Git and HTTP skill registries with precedence-aware federation",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robsonkades/senior-skills.git",
+    "directory": "packages/registry"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@senior-skills/core": "1.0.0"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.