@skild/core 0.1.3 → 0.1.4

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-type SkildErrorCode = 'INVALID_SOURCE' | 'NOT_A_DIRECTORY' | 'EMPTY_INSTALL_DIR' | 'ALREADY_INSTALLED' | 'SKILL_NOT_FOUND' | 'MISSING_METADATA' | 'INVALID_SKILL';
+type SkildErrorCode = 'INVALID_SOURCE' | 'NOT_A_DIRECTORY' | 'EMPTY_INSTALL_DIR' | 'ALREADY_INSTALLED' | 'SKILL_NOT_FOUND' | 'MISSING_METADATA' | 'INVALID_SKILL' | 'MISSING_REGISTRY_CONFIG' | 'REGISTRY_RESOLVE_FAILED' | 'REGISTRY_DOWNLOAD_FAILED' | 'INTEGRITY_MISMATCH' | 'NETWORK_TIMEOUT';
 declare class SkildError extends Error {
     readonly code: SkildErrorCode;
     readonly details?: Record<string, unknown>;
@@ -8,7 +8,7 @@ declare class SkildError extends Error {
 declare const PLATFORMS: readonly ["claude", "codex", "copilot"];
 type Platform = (typeof PLATFORMS)[number];
 type InstallScope = 'global' | 'project';
-type SourceType = 'local' | 'github-url' | 'degit-shorthand';
+type SourceType = 'local' | 'github-url' | 'degit-shorthand' | 'registry';
 interface InstallOptions {
     platform?: Platform;
     scope?: InstallScope;
@@ -42,6 +42,16 @@ interface SkillValidationResult {
 interface InstallRecord {
     schemaVersion: 1;
     name: string;
+    /**
+     * Optional stable identifier for display and CLI input.
+     * Example: "@publisher/skill" (directory name remains filesystem-safe).
+     */
+    canonicalName?: string;
+    /**
+     * For `sourceType === "registry"`, the base registry URL used when resolving this Skill.
+     * Example: "https://registry.skild.sh"
+     */
+    registryUrl?: string;
     platform: Platform;
     scope: InstallScope;
     source: string;
@@ -62,6 +72,7 @@ interface LockEntry {
     scope: InstallScope;
     source: string;
     sourceType: SourceType;
+    registryUrl?: string;
     installedAt: string;
     updatedAt?: string;
     installDir: string;
@@ -77,8 +88,22 @@ interface GlobalConfig {
     defaultPlatform: Platform;
     defaultScope: InstallScope;
 }
+interface RegistryAuth {
+    schemaVersion: 1;
+    registryUrl: string;
+    token: string;
+    publisher?: {
+        id?: string;
+        handle?: string;
+        email?: string;
+    };
+    updatedAt: string;
+}
 
 declare function loadOrCreateGlobalConfig(): GlobalConfig;
+declare function loadRegistryAuth(): RegistryAuth | null;
+declare function saveRegistryAuth(auth: RegistryAuth): void;
+declare function clearRegistryAuth(): void;
 
 declare function getSkillsDir(platform: Platform, scope: InstallScope): string;
 declare function getSkillInstallDir(platform: Platform, scope: InstallScope, skillName: string): string;
@@ -92,11 +117,47 @@ interface InitOptions {
 }
 declare function initSkill(name: string, options?: InitOptions): string;
 
+declare function fetchWithTimeout(input: RequestInfo | URL, init?: RequestInit, timeoutMs?: number): Promise<Response>;
+
+declare const DEFAULT_REGISTRY_URL = "https://registry.skild.sh";
+interface RegistrySpecifier {
+    canonicalName: string;
+    versionOrTag: string;
+}
+interface RegistryResolvedVersion {
+    canonicalName: string;
+    version: string;
+    integrity: string;
+    tarballUrl: string;
+    publishedAt?: string;
+}
+declare function parseRegistrySpecifier(input: string): RegistrySpecifier;
+declare function canonicalNameToInstallDirName(canonicalName: string): string;
+declare function splitCanonicalName(canonicalName: string): {
+    scope: string;
+    name: string;
+};
+declare function resolveRegistryUrl(explicit?: string): string;
+declare function resolveRegistryVersion(registryUrl: string, spec: RegistrySpecifier): Promise<RegistryResolvedVersion>;
+declare function searchRegistrySkills(registryUrl: string, query: string, limit?: number): Promise<Array<{
+    name: string;
+    description?: string;
+    targets_json?: string;
+    created_at?: string;
+    updated_at?: string;
+}>>;
+declare function downloadAndExtractTarball(resolved: RegistryResolvedVersion, tempRoot: string, stagingDir: string): Promise<void>;
+
 interface InstallInput {
     source: string;
     nameOverride?: string;
 }
 declare function installSkill(input: InstallInput, options?: InstallOptions): Promise<InstallRecord>;
+declare function installRegistrySkill(input: {
+    spec: string;
+    registryUrl?: string;
+    nameOverride?: string;
+}, options?: InstallOptions): Promise<InstallRecord>;
 interface ListedSkill {
     name: string;
     installDir: string;
@@ -121,4 +182,4 @@ declare function uninstallSkill(name: string, options?: InstallOptions & {
 }): void;
 declare function updateSkill(name?: string, options?: UpdateOptions): Promise<InstallRecord[]>;
 
-export { type GlobalConfig, type InstallOptions, type InstallRecord, type InstallScope, type ListOptions, type Lockfile, PLATFORMS, type Platform, SkildError, type SkillFrontmatter, type SkillValidationIssue, type SkillValidationResult, type UpdateOptions, getSkillInfo, getSkillInstallDir, getSkillsDir, initSkill, installSkill, listAllSkills, listSkills, loadOrCreateGlobalConfig, uninstallSkill, updateSkill, validateSkill, validateSkillDir };
+export { DEFAULT_REGISTRY_URL, type GlobalConfig, type InstallOptions, type InstallRecord, type InstallScope, type ListOptions, type Lockfile, PLATFORMS, type Platform, type RegistryAuth, SkildError, type SkillFrontmatter, type SkillValidationIssue, type SkillValidationResult, type UpdateOptions, canonicalNameToInstallDirName, clearRegistryAuth, downloadAndExtractTarball, fetchWithTimeout, getSkillInfo, getSkillInstallDir, getSkillsDir, initSkill, installRegistrySkill, installSkill, listAllSkills, listSkills, loadOrCreateGlobalConfig, loadRegistryAuth, parseRegistrySpecifier, resolveRegistryUrl, resolveRegistryVersion, saveRegistryAuth, searchRegistrySkills, splitCanonicalName, uninstallSkill, updateSkill, validateSkill, validateSkillDir };

package/dist/index.js

@@ -52,6 +52,9 @@ function getProjectLockPath() {
 function getGlobalConfigPath() {
   return path.join(getSkildGlobalDir(), "config.json");
 }
+function getGlobalRegistryAuthPath() {
+  return path.join(getSkildGlobalDir(), "registry-auth.json");
+}
 function getGlobalLockPath() {
   return path.join(getSkildGlobalDir(), "lock.json");
 }
@@ -74,6 +77,14 @@ function writeJsonFile(filePath, value) {
   ensureDir(path2.dirname(filePath));
   fs2.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
 }
+function writeJsonFilePrivate(filePath, value) {
+  ensureDir(path2.dirname(filePath));
+  fs2.writeFileSync(filePath, JSON.stringify(value, null, 2) + "\n", "utf8");
+  try {
+    fs2.chmodSync(filePath, 384);
+  } catch {
+  }
+}
 function loadOrCreateGlobalConfig() {
   const filePath = getGlobalConfigPath();
   const existing = readJsonFile(filePath);
@@ -86,6 +97,16 @@ function loadOrCreateGlobalConfig() {
   writeJsonFile(filePath, created);
   return created;
 }
+function loadRegistryAuth() {
+  return readJsonFile(getGlobalRegistryAuthPath());
+}
+function saveRegistryAuth(auth) {
+  writeJsonFilePrivate(getGlobalRegistryAuthPath(), auth);
+}
+function clearRegistryAuth() {
+  const filePath = getGlobalRegistryAuthPath();
+  if (fs2.existsSync(filePath)) fs2.rmSync(filePath);
+}
 function loadLockfile(lockPath) {
   return readJsonFile(lockPath);
 }
@@ -207,41 +228,166 @@ echo "${name}: run script placeholder"
   return targetDir;
 }
 
+// src/http.ts
+async function fetchWithTimeout(input, init = {}, timeoutMs = 1e4) {
+  const ms = Math.max(1, timeoutMs);
+  const controller = new AbortController();
+  const existingSignal = init.signal;
+  const timer = setTimeout(() => controller.abort(), ms);
+  try {
+    const res = await fetch(input, { ...init, signal: controller.signal });
+    return res;
+  } catch (error) {
+    if (existingSignal?.aborted) throw error;
+    const name = error instanceof Error ? error.name : "";
+    if (name === "AbortError") {
+      throw new SkildError("NETWORK_TIMEOUT", `Request timed out after ${ms}ms.`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/registry.ts
+import fs5 from "fs";
+import path5 from "path";
+import crypto from "crypto";
+import * as tar from "tar";
+var DEFAULT_REGISTRY_URL = "https://registry.skild.sh";
+function parseRegistrySpecifier(input) {
+  const raw = input.trim();
+  if (!raw.startsWith("@") || !raw.includes("/")) {
+    throw new SkildError("INVALID_SOURCE", `Invalid registry specifier "${input}". Expected @publisher/skill[@version].`);
+  }
+  const slash = raw.indexOf("/");
+  const at = raw.lastIndexOf("@");
+  const hasVersion = at > slash;
+  const canonicalName = hasVersion ? raw.slice(0, at) : raw;
+  const versionOrTag = hasVersion ? raw.slice(at + 1) : "latest";
+  if (!/^@[a-z0-9][a-z0-9-]{1,31}\/[a-z0-9][a-z0-9-]{1,63}$/.test(canonicalName)) {
+    throw new SkildError("INVALID_SOURCE", `Invalid skill name "${canonicalName}". Expected @publisher/skill (lowercase letters/digits/dashes).`);
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9.+-]*$/.test(versionOrTag)) {
+    throw new SkildError("INVALID_SOURCE", `Invalid version or tag "${versionOrTag}".`);
+  }
+  return { canonicalName, versionOrTag };
+}
+function canonicalNameToInstallDirName(canonicalName) {
+  const match = canonicalName.match(/^@([^/]+)\/(.+)$/);
+  if (!match) return canonicalName;
+  const [, scope, name] = match;
+  return `${scope}__${name}`;
+}
+function splitCanonicalName(canonicalName) {
+  const match = canonicalName.match(/^@([^/]+)\/(.+)$/);
+  if (!match) {
+    throw new SkildError("INVALID_SOURCE", `Invalid skill name "${canonicalName}". Expected @publisher/skill.`);
+  }
+  return { scope: match[1], name: match[2] };
+}
+function resolveRegistryUrl(explicit) {
+  const fromEnv = process.env.SKILD_REGISTRY_URL?.trim();
+  if (explicit?.trim()) return explicit.trim().replace(/\/+$/, "");
+  if (fromEnv) return fromEnv.replace(/\/+$/, "");
+  return DEFAULT_REGISTRY_URL;
+}
+async function resolveRegistryVersion(registryUrl, spec) {
+  const { scope, name } = splitCanonicalName(spec.canonicalName);
+  const url = `${registryUrl}/skills/${encodeURIComponent(scope)}/${encodeURIComponent(name)}/versions/${encodeURIComponent(spec.versionOrTag)}`;
+  const res = await fetchWithTimeout(url, { headers: { accept: "application/json" } }, 1e4);
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Failed to resolve ${spec.canonicalName}@${spec.versionOrTag} (${res.status}). ${text}`.trim());
+  }
+  const json = await res.json();
+  if (!json?.ok || !json.tarballUrl || !json.integrity || !json.version) {
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Invalid registry response for ${spec.canonicalName}@${spec.versionOrTag}.`);
+  }
+  const tarballUrl = json.tarballUrl.startsWith("http") ? json.tarballUrl : `${registryUrl}${json.tarballUrl}`;
+  return { canonicalName: spec.canonicalName, version: json.version, integrity: json.integrity, tarballUrl, publishedAt: json.publishedAt };
+}
+function sha256Hex(buffer) {
+  const h = crypto.createHash("sha256");
+  h.update(buffer);
+  return h.digest("hex");
+}
+async function searchRegistrySkills(registryUrl, query, limit = 50) {
+  const q = query.trim();
+  const url = new URL(`${registryUrl}/skills`);
+  if (q) url.searchParams.set("q", q);
+  url.searchParams.set("limit", String(Math.min(Math.max(limit, 1), 100)));
+  const res = await fetchWithTimeout(url.toString(), { headers: { accept: "application/json" } }, 1e4);
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Failed to search skills (${res.status}). ${text}`.trim());
+  }
+  const json = await res.json();
+  if (!json?.ok || !Array.isArray(json.skills)) {
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", "Invalid registry response for /skills.");
+  }
+  return json.skills;
+}
+async function downloadAndExtractTarball(resolved, tempRoot, stagingDir) {
+  const res = await fetchWithTimeout(resolved.tarballUrl, {}, 3e4);
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new SkildError("REGISTRY_DOWNLOAD_FAILED", `Failed to download tarball (${res.status}). ${text}`.trim());
+  }
+  const arrayBuf = await res.arrayBuffer();
+  const buf = Buffer.from(arrayBuf);
+  const computed = sha256Hex(buf);
+  if (computed !== resolved.integrity) {
+    throw new SkildError(
+      "INTEGRITY_MISMATCH",
+      `Integrity mismatch for ${resolved.canonicalName}@${resolved.version}. Expected ${resolved.integrity}, got ${computed}.`
+    );
+  }
+  const tarballPath = path5.join(tempRoot, "skill.tgz");
+  fs5.mkdirSync(stagingDir, { recursive: true });
+  fs5.writeFileSync(tarballPath, buf);
+  try {
+    await tar.x({ file: tarballPath, cwd: stagingDir, gzip: true });
+  } catch (error) {
+    throw error;
+  }
+}
+
 // src/lifecycle.ts
-import path7 from "path";
-import fs6 from "fs";
+import path8 from "path";
+import fs7 from "fs";
 import degit from "degit";
 
 // src/source.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/fs.ts
-import fs5 from "fs";
-import path5 from "path";
-import crypto from "crypto";
+import fs6 from "fs";
+import path6 from "path";
+import crypto2 from "crypto";
 function pathExists(filePath) {
-  return fs5.existsSync(filePath);
+  return fs6.existsSync(filePath);
 }
 function isDirectory(filePath) {
   try {
-    return fs5.statSync(filePath).isDirectory();
+    return fs6.statSync(filePath).isDirectory();
   } catch {
     return false;
   }
 }
 function isDirEmpty(dir) {
   try {
-    const entries = fs5.readdirSync(dir);
+    const entries = fs6.readdirSync(dir);
     return entries.length === 0;
   } catch {
     return true;
   }
 }
 function copyDir(src, dest) {
-  fs5.cpSync(src, dest, { recursive: true });
+  fs6.cpSync(src, dest, { recursive: true });
 }
 function removeDir(dir) {
-  if (fs5.existsSync(dir)) fs5.rmSync(dir, { recursive: true, force: true });
+  if (fs6.existsSync(dir)) fs6.rmSync(dir, { recursive: true, force: true });
 }
 function sanitizeForPathSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -249,24 +395,24 @@ function sanitizeForPathSegment(value) {
 function createTempDir(parentDir, prefix) {
   ensureDir(parentDir);
   const safePrefix = sanitizeForPathSegment(prefix || "tmp");
-  const template = path5.join(parentDir, `.skild-${safePrefix}-`);
-  return fs5.mkdtempSync(template);
+  const template = path6.join(parentDir, `.skild-${safePrefix}-`);
+  return fs6.mkdtempSync(template);
 }
 function replaceDirAtomic(sourceDir, destDir) {
-  const backupDir = fs5.existsSync(destDir) ? `${destDir}.bak-${Date.now()}` : null;
+  const backupDir = fs6.existsSync(destDir) ? `${destDir}.bak-${Date.now()}` : null;
   try {
-    if (backupDir) fs5.renameSync(destDir, backupDir);
-    fs5.renameSync(sourceDir, destDir);
+    if (backupDir) fs6.renameSync(destDir, backupDir);
+    fs6.renameSync(sourceDir, destDir);
     if (backupDir) removeDir(backupDir);
   } catch (error) {
     try {
-      if (!fs5.existsSync(destDir) && backupDir && fs5.existsSync(backupDir)) {
-        fs5.renameSync(backupDir, destDir);
+      if (!fs6.existsSync(destDir) && backupDir && fs6.existsSync(backupDir)) {
+        fs6.renameSync(backupDir, destDir);
       }
     } catch {
     }
     try {
-      if (fs5.existsSync(sourceDir)) removeDir(sourceDir);
+      if (fs6.existsSync(sourceDir)) removeDir(sourceDir);
     } catch {
     }
     throw error;
@@ -277,11 +423,11 @@ function listFilesRecursive(rootDir) {
   const stack = [rootDir];
   while (stack.length) {
     const current = stack.pop();
-    const entries = fs5.readdirSync(current, { withFileTypes: true });
+    const entries = fs6.readdirSync(current, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name === ".skild") continue;
       if (entry.name === ".git") continue;
-      const full = path5.join(current, entry.name);
+      const full = path6.join(current, entry.name);
       if (entry.isDirectory()) stack.push(full);
       else if (entry.isFile()) results.push(full);
     }
@@ -291,12 +437,12 @@ function listFilesRecursive(rootDir) {
 }
 function hashDirectoryContent(rootDir) {
   const files = listFilesRecursive(rootDir);
-  const h = crypto.createHash("sha256");
+  const h = crypto2.createHash("sha256");
   for (const filePath of files) {
-    const rel = path5.relative(rootDir, filePath);
+    const rel = path6.relative(rootDir, filePath);
     h.update(rel);
     h.update("\0");
-    h.update(fs5.readFileSync(filePath));
+    h.update(fs6.readFileSync(filePath));
     h.update("\0");
   }
   return h.digest("hex");
@@ -304,7 +450,7 @@ function hashDirectoryContent(rootDir) {
 
 // src/source.ts
 function resolveLocalPath(source) {
-  const resolved = path6.resolve(source);
+  const resolved = path7.resolve(source);
   return pathExists(resolved) ? resolved : null;
 }
 function classifySource(source) {
@@ -319,7 +465,7 @@ function classifySource(source) {
 }
 function extractSkillName(source) {
   const local = resolveLocalPath(source);
-  if (local) return path6.basename(local) || "unknown-skill";
+  if (local) return path7.basename(local) || "unknown-skill";
   const cleaned = source.replace(/[#?].*$/, "");
   const treeMatch = cleaned.match(/\/tree\/[^/]+\/(.+?)(?:\/)?$/);
   if (treeMatch) return treeMatch[1].split("/").pop() || "unknown-skill";
@@ -377,14 +523,14 @@ async function installSkill(input, options = {}) {
   ensureDir(skillsDir);
   const skillName = input.nameOverride || extractSkillName(source);
   const installDir = getSkillInstallDir(platform, scope, skillName);
-  if (fs6.existsSync(installDir) && !options.force) {
+  if (fs7.existsSync(installDir) && !options.force) {
     throw new SkildError("ALREADY_INSTALLED", `Skill "${skillName}" is already installed at ${installDir}. Use --force, or uninstall first.`, {
       skillName,
       installDir
     });
   }
   const tempRoot = createTempDir(skillsDir, skillName);
-  const stagingDir = path7.join(tempRoot, "staging");
+  const stagingDir = path8.join(tempRoot, "staging");
   try {
     const localPath = resolveLocalPath(source);
     if (localPath) {
@@ -408,7 +554,7 @@ async function installSkill(input, options = {}) {
       installedAt: (/* @__PURE__ */ new Date()).toISOString(),
       installDir,
       contentHash,
-      hasSkillMd: fs6.existsSync(path7.join(installDir, "SKILL.md")),
+      hasSkillMd: fs7.existsSync(path8.join(installDir, "SKILL.md")),
       skill: {
         frontmatter: validation.frontmatter,
         validation
@@ -432,14 +578,71 @@ async function installSkill(input, options = {}) {
     removeDir(tempRoot);
   }
 }
+async function installRegistrySkill(input, options = {}) {
+  const { platform, scope } = resolvePlatformAndScope(options);
+  const registryUrl = resolveRegistryUrl(input.registryUrl);
+  const spec = parseRegistrySpecifier(input.spec);
+  const canonicalName = spec.canonicalName;
+  const skillsDir = getSkillsDir(platform, scope);
+  ensureDir(skillsDir);
+  const installName = input.nameOverride || canonicalNameToInstallDirName(canonicalName);
+  const installDir = getSkillInstallDir(platform, scope, installName);
+  if (fs7.existsSync(installDir) && !options.force) {
+    throw new SkildError("ALREADY_INSTALLED", `Skill "${canonicalName}" is already installed at ${installDir}. Use --force, or uninstall first.`, {
+      skillName: canonicalName,
+      installDir
+    });
+  }
+  const tempRoot = createTempDir(skillsDir, installName);
+  const stagingDir = path8.join(tempRoot, "staging");
+  try {
+    const resolved = await resolveRegistryVersion(registryUrl, spec);
+    await downloadAndExtractTarball(resolved, tempRoot, stagingDir);
+    assertNonEmptyInstall(stagingDir, input.spec);
+    replaceDirAtomic(stagingDir, installDir);
+    const contentHash = hashDirectoryContent(installDir);
+    const validation = validateSkillDir(installDir);
+    const record = {
+      schemaVersion: 1,
+      name: installName,
+      canonicalName,
+      registryUrl,
+      platform,
+      scope,
+      source: input.spec,
+      sourceType: "registry",
+      installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      installDir,
+      contentHash,
+      hasSkillMd: fs7.existsSync(path8.join(installDir, "SKILL.md")),
+      skill: { validation, frontmatter: validation.frontmatter }
+    };
+    writeInstallRecord(installDir, record);
+    const lockEntry = {
+      name: installName,
+      platform,
+      scope,
+      source: input.spec,
+      sourceType: "registry",
+      registryUrl,
+      installedAt: record.installedAt,
+      installDir: record.installDir,
+      contentHash: record.contentHash
+    };
+    upsertLockEntry(scope, lockEntry);
+    return record;
+  } finally {
+    removeDir(tempRoot);
+  }
+}
 function listSkills(options = {}) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const skillsDir = getSkillsDir(platform, scope);
-  if (!fs6.existsSync(skillsDir)) return [];
-  const entries = fs6.readdirSync(skillsDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("."));
+  if (!fs7.existsSync(skillsDir)) return [];
+  const entries = fs7.readdirSync(skillsDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("."));
   return entries.map((e) => {
-    const dir = path7.join(skillsDir, e.name);
-    const hasSkillMd = fs6.existsSync(path7.join(dir, "SKILL.md"));
+    const dir = path8.join(skillsDir, e.name);
+    const hasSkillMd = fs7.existsSync(path8.join(dir, "SKILL.md"));
     const record = readInstallRecord(dir);
     return { name: e.name, installDir: dir, hasSkillMd, record };
   }).sort((a, b) => a.name.localeCompare(b.name));
@@ -457,7 +660,7 @@ function listAllSkills(options = {}) {
 function getSkillInfo(name, options = {}) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const installDir = getSkillInstallDir(platform, scope, name);
-  if (!fs6.existsSync(installDir)) {
+  if (!fs7.existsSync(installDir)) {
     throw new SkildError("SKILL_NOT_FOUND", `Skill "${name}" not found in ${getSkillsDir(platform, scope)}`, { name, platform, scope });
   }
   const record = readInstallRecord(installDir);
@@ -474,7 +677,7 @@ function validateSkill(nameOrPath, options = {}) {
 function uninstallSkill(name, options = {}) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const installDir = getSkillInstallDir(platform, scope, name);
-  if (!fs6.existsSync(installDir)) {
+  if (!fs7.existsSync(installDir)) {
     throw new SkildError("SKILL_NOT_FOUND", `Skill "${name}" not found in ${getSkillsDir(platform, scope)}`, { name, platform, scope });
   }
   const record = readInstallRecord(installDir);
@@ -490,24 +693,42 @@ async function updateSkill(name, options = {}) {
   const results = [];
   for (const target of targets) {
     const record = getSkillInfo(target.name, { platform, scope });
-    const updated = await installSkill({ source: record.source, nameOverride: record.name }, { platform, scope, force: true });
-    updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const updated = record.sourceType === "registry" ? await installRegistrySkill(
+      { spec: record.source, nameOverride: record.name, registryUrl: record.registryUrl || loadRegistryAuth()?.registryUrl },
+      { platform, scope, force: true }
+    ) : await installSkill({ source: record.source, nameOverride: record.name }, { platform, scope, force: true });
+    updated.installedAt = record.installedAt;
+    updated.updatedAt = now;
     writeInstallRecord(updated.installDir, updated);
     results.push(updated);
   }
   return results;
 }
 export {
+  DEFAULT_REGISTRY_URL,
   PLATFORMS,
   SkildError,
+  canonicalNameToInstallDirName,
+  clearRegistryAuth,
+  downloadAndExtractTarball,
+  fetchWithTimeout,
   getSkillInfo,
   getSkillInstallDir,
   getSkillsDir,
   initSkill,
+  installRegistrySkill,
   installSkill,
   listAllSkills,
   listSkills,
   loadOrCreateGlobalConfig,
+  loadRegistryAuth,
+  parseRegistrySpecifier,
+  resolveRegistryUrl,
+  resolveRegistryVersion,
+  saveRegistryAuth,
+  searchRegistrySkills,
+  splitCanonicalName,
   uninstallSkill,
   updateSkill,
   validateSkill,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skild/core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Skild core library (headless) for installing, validating, and managing Agent Skills locally.",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,8 @@
   ],
   "dependencies": {
     "degit": "^2.8.4",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.1.0",
+    "tar": "^7.4.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",