@skild/core 0.2.0 → 0.2.3

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-type SkildErrorCode = 'INVALID_SOURCE' | 'NOT_A_DIRECTORY' | 'EMPTY_INSTALL_DIR' | 'ALREADY_INSTALLED' | 'SKILL_NOT_FOUND' | 'MISSING_METADATA' | 'INVALID_SKILL' | 'MISSING_REGISTRY_CONFIG' | 'REGISTRY_RESOLVE_FAILED' | 'REGISTRY_DOWNLOAD_FAILED' | 'INTEGRITY_MISMATCH' | 'NETWORK_TIMEOUT';
+type SkildErrorCode = 'INVALID_SOURCE' | 'INVALID_DEPENDENCY' | 'INVALID_DEPENDENCIES' | 'NOT_A_DIRECTORY' | 'EMPTY_INSTALL_DIR' | 'ALREADY_INSTALLED' | 'SKILL_NOT_FOUND' | 'MISSING_METADATA' | 'INVALID_SKILL' | 'DEPENDENCY_CONFLICT' | 'DEPENDENCY_CYCLE' | 'VERSION_CONFLICT' | 'MISSING_REGISTRY_CONFIG' | 'REGISTRY_RESOLVE_FAILED' | 'REGISTRY_DOWNLOAD_FAILED' | 'INTEGRITY_MISMATCH' | 'NETWORK_TIMEOUT';
 declare class SkildError extends Error {
     readonly code: SkildErrorCode;
     readonly details?: Record<string, unknown>;
@@ -9,6 +9,7 @@ declare const PLATFORMS: readonly ["claude", "codex", "copilot"];
 type Platform = (typeof PLATFORMS)[number];
 type InstallScope = 'global' | 'project';
 type SourceType = 'local' | 'github-url' | 'degit-shorthand' | 'registry';
+type DependencySourceType = SourceType | 'inline';
 interface InstallOptions {
     platform?: Platform;
     scope?: InstallScope;
@@ -27,6 +28,8 @@ interface SkillFrontmatter {
     name: string;
     description: string;
     version?: string;
+    dependencies?: string[];
+    skillset?: boolean;
     [key: string]: unknown;
 }
 interface SkillValidationIssue {
@@ -52,6 +55,7 @@ interface InstallRecord {
      * Example: "https://registry.skild.sh"
      */
     registryUrl?: string;
+    resolvedVersion?: string;
     platform: Platform;
     scope: InstallScope;
     source: string;
@@ -61,11 +65,23 @@ interface InstallRecord {
     installDir: string;
     contentHash: string;
     hasSkillMd: boolean;
+    skillset?: boolean;
+    dependencies?: string[];
+    installedDependencies?: InstalledDependency[];
+    dependedBy?: string[];
     skill?: {
         frontmatter?: SkillFrontmatter;
         validation?: SkillValidationResult;
     };
 }
+interface InstalledDependency {
+    name: string;
+    source: string;
+    sourceType: DependencySourceType;
+    canonicalName?: string;
+    installDir?: string;
+    inlinePath?: string;
+}
 interface LockEntry {
     name: string;
     platform: Platform;
@@ -179,7 +195,8 @@ declare function validateSkill(nameOrPath: string, options?: {
 }): SkillValidationResult;
 declare function uninstallSkill(name: string, options?: InstallOptions & {
     allowMissingMetadata?: boolean;
+    withDeps?: boolean;
 }): void;
 declare function updateSkill(name?: string, options?: UpdateOptions): Promise<InstallRecord[]>;
 
-export { DEFAULT_REGISTRY_URL, type GlobalConfig, type InstallOptions, type InstallRecord, type InstallScope, type ListOptions, type Lockfile, PLATFORMS, type Platform, type RegistryAuth, SkildError, type SkillFrontmatter, type SkillValidationIssue, type SkillValidationResult, type UpdateOptions, canonicalNameToInstallDirName, clearRegistryAuth, downloadAndExtractTarball, fetchWithTimeout, getSkillInfo, getSkillInstallDir, getSkillsDir, initSkill, installRegistrySkill, installSkill, listAllSkills, listSkills, loadOrCreateGlobalConfig, loadRegistryAuth, parseRegistrySpecifier, resolveRegistryUrl, resolveRegistryVersion, saveRegistryAuth, searchRegistrySkills, splitCanonicalName, uninstallSkill, updateSkill, validateSkill, validateSkillDir };
+export { DEFAULT_REGISTRY_URL, type DependencySourceType, type GlobalConfig, type InstallOptions, type InstallRecord, type InstallScope, type InstalledDependency, type ListOptions, type Lockfile, PLATFORMS, type Platform, type RegistryAuth, SkildError, type SkillFrontmatter, type SkillValidationIssue, type SkillValidationResult, type UpdateOptions, canonicalNameToInstallDirName, clearRegistryAuth, downloadAndExtractTarball, fetchWithTimeout, getSkillInfo, getSkillInstallDir, getSkillsDir, initSkill, installRegistrySkill, installSkill, listAllSkills, listSkills, loadOrCreateGlobalConfig, loadRegistryAuth, parseRegistrySpecifier, resolveRegistryUrl, resolveRegistryVersion, saveRegistryAuth, searchRegistrySkills, splitCanonicalName, uninstallSkill, updateSkill, validateSkill, validateSkillDir };

package/dist/index.js

@@ -183,6 +183,15 @@ function validateSkillDir(skillDir) {
   if (!frontmatter.description || typeof frontmatter.description !== "string") {
     issues.push({ level: "error", message: 'Frontmatter "description" is required and must be a string' });
   }
+  if (frontmatter.skillset !== void 0 && typeof frontmatter.skillset !== "boolean") {
+    issues.push({ level: "error", message: 'Frontmatter "skillset" must be a boolean when provided' });
+  }
+  if (frontmatter.dependencies !== void 0) {
+    const deps = frontmatter.dependencies;
+    if (!Array.isArray(deps) || deps.some((dep) => typeof dep !== "string")) {
+      issues.push({ level: "error", message: 'Frontmatter "dependencies" must be an array of strings when provided' });
+    }
+  }
   return { ok: issues.every((i) => i.level !== "error"), issues, frontmatter };
 }
 
@@ -254,6 +263,7 @@ import fs5 from "fs";
 import path5 from "path";
 import crypto from "crypto";
 import * as tar from "tar";
+import semver from "semver";
 var DEFAULT_REGISTRY_URL = "https://registry.skild.sh";
 function parseRegistrySpecifier(input) {
   const raw = input.trim();
@@ -268,7 +278,7 @@ function parseRegistrySpecifier(input) {
   if (!/^@[a-z0-9][a-z0-9-]{1,31}\/[a-z0-9][a-z0-9-]{1,63}$/.test(canonicalName)) {
     throw new SkildError("INVALID_SOURCE", `Invalid skill name "${canonicalName}". Expected @publisher/skill (lowercase letters/digits/dashes).`);
   }
-  if (!/^[A-Za-z0-9][A-Za-z0-9.+-]*$/.test(versionOrTag)) {
+  if (!versionOrTag || /\s/.test(versionOrTag)) {
     throw new SkildError("INVALID_SOURCE", `Invalid version or tag "${versionOrTag}".`);
   }
   return { canonicalName, versionOrTag };
@@ -294,15 +304,35 @@ function resolveRegistryUrl(explicit) {
 }
 async function resolveRegistryVersion(registryUrl, spec) {
   const { scope, name } = splitCanonicalName(spec.canonicalName);
-  const url = `${registryUrl}/skills/${encodeURIComponent(scope)}/${encodeURIComponent(name)}/versions/${encodeURIComponent(spec.versionOrTag)}`;
+  const versionOrTag = spec.versionOrTag;
+  const range = semver.validRange(versionOrTag);
+  if (range && !semver.valid(versionOrTag)) {
+    const metaUrl = `${registryUrl}/skills/${encodeURIComponent(scope)}/${encodeURIComponent(name)}`;
+    const metaRes = await fetchWithTimeout(metaUrl, { headers: { accept: "application/json" } }, 1e4);
+    if (!metaRes.ok) {
+      const text = await metaRes.text().catch(() => "");
+      throw new SkildError("REGISTRY_RESOLVE_FAILED", `Failed to resolve ${spec.canonicalName}@${versionOrTag} (${metaRes.status}). ${text}`.trim());
+    }
+    const meta = await metaRes.json();
+    if (!meta?.ok || !Array.isArray(meta.versions)) {
+      throw new SkildError("REGISTRY_RESOLVE_FAILED", `Invalid registry response for ${spec.canonicalName}@${versionOrTag}.`);
+    }
+    const versions = meta.versions.map((v) => v.version).filter((v) => semver.valid(v));
+    const matched = semver.maxSatisfying(versions, range);
+    if (!matched) {
+      throw new SkildError("REGISTRY_RESOLVE_FAILED", `No published version satisfies ${spec.canonicalName}@${versionOrTag}.`);
+    }
+    return resolveRegistryVersion(registryUrl, { canonicalName: spec.canonicalName, versionOrTag: matched });
+  }
+  const url = `${registryUrl}/skills/${encodeURIComponent(scope)}/${encodeURIComponent(name)}/versions/${encodeURIComponent(versionOrTag)}`;
   const res = await fetchWithTimeout(url, { headers: { accept: "application/json" } }, 1e4);
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Failed to resolve ${spec.canonicalName}@${spec.versionOrTag} (${res.status}). ${text}`.trim());
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Failed to resolve ${spec.canonicalName}@${versionOrTag} (${res.status}). ${text}`.trim());
   }
   const json = await res.json();
   if (!json?.ok || !json.tarballUrl || !json.integrity || !json.version) {
-    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Invalid registry response for ${spec.canonicalName}@${spec.versionOrTag}.`);
+    throw new SkildError("REGISTRY_RESOLVE_FAILED", `Invalid registry response for ${spec.canonicalName}@${versionOrTag}.`);
   }
   const tarballUrl = json.tarballUrl.startsWith("http") ? json.tarballUrl : `${registryUrl}${json.tarballUrl}`;
   return { canonicalName: spec.canonicalName, version: json.version, integrity: json.integrity, tarballUrl, publishedAt: json.publishedAt };
@@ -487,6 +517,117 @@ function toDegitPath(url) {
 }
 
 // src/lifecycle.ts
+function normalizeDependencies(raw) {
+  if (raw === void 0 || raw === null) return [];
+  if (!Array.isArray(raw)) {
+    throw new SkildError("INVALID_DEPENDENCIES", 'Frontmatter "dependencies" must be an array of strings.');
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (typeof item !== "string") {
+      throw new SkildError("INVALID_DEPENDENCIES", 'Frontmatter "dependencies" must be an array of strings.');
+    }
+    const trimmed = item.trim();
+    if (!trimmed) {
+      throw new SkildError("INVALID_DEPENDENCIES", "Dependencies cannot contain empty values.");
+    }
+    if (seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+function isRelativeDependency(dep) {
+  return dep.startsWith("./") || dep.startsWith("../");
+}
+function resolveInlineDependency(raw, baseDir, rootDir) {
+  const resolved = path8.resolve(baseDir, raw);
+  const relToRoot = path8.relative(rootDir, resolved);
+  if (relToRoot.startsWith("..") || path8.isAbsolute(relToRoot)) {
+    throw new SkildError("INVALID_DEPENDENCY", `Inline dependency path escapes the skill root: ${raw}`);
+  }
+  if (!isDirectory(resolved)) {
+    throw new SkildError("INVALID_DEPENDENCY", `Inline dependency is not a directory: ${raw}`);
+  }
+  const validation = validateSkillDir(resolved);
+  if (!validation.ok) {
+    throw new SkildError("INVALID_DEPENDENCY", `Inline dependency is not a valid skill: ${raw}`, { issues: validation.issues });
+  }
+  const normalizedInlinePath = relToRoot.split(path8.sep).join("/");
+  return {
+    sourceType: "inline",
+    source: raw,
+    name: path8.basename(resolved) || raw,
+    inlinePath: normalizedInlinePath,
+    inlineDir: resolved
+  };
+}
+function normalizeDependencyInput(raw) {
+  if (!raw.toLowerCase().startsWith("github:")) return raw;
+  const trimmed = raw.slice("github:".length).trim().replace(/^\/+/, "");
+  if (!trimmed) {
+    throw new SkildError("INVALID_DEPENDENCY", 'Invalid GitHub dependency: missing repo after "github:".');
+  }
+  return trimmed;
+}
+function parseDependency(raw, baseDir, rootDir) {
+  const cleaned = normalizeDependencyInput(raw).trim();
+  if (!cleaned) {
+    throw new SkildError("INVALID_DEPENDENCY", "Dependencies cannot contain empty values.");
+  }
+  if (isRelativeDependency(cleaned)) {
+    return resolveInlineDependency(cleaned, baseDir, rootDir);
+  }
+  if (cleaned.startsWith("@")) {
+    return { sourceType: "registry", source: cleaned, spec: parseRegistrySpecifier(cleaned) };
+  }
+  if (/^https?:\/\//i.test(cleaned) || cleaned.includes("github.com")) {
+    return { sourceType: "github-url", source: cleaned };
+  }
+  if (/^[^/]+\/[^/]+/.test(cleaned)) {
+    return { sourceType: "degit-shorthand", source: cleaned };
+  }
+  throw new SkildError("INVALID_DEPENDENCY", `Unsupported dependency source "${raw}".`);
+}
+function getFrontmatterFromDir(dir) {
+  const skillMd = readSkillMd(dir);
+  if (!skillMd) return null;
+  return parseSkillFrontmatter(skillMd);
+}
+function getDependencyKeyFromRecord(record) {
+  if (record.sourceType === "registry") {
+    return `registry:${record.canonicalName || record.source}`;
+  }
+  if (record.sourceType === "local") {
+    const resolved = resolveLocalPath(record.source);
+    return `local:${resolved || record.source}`;
+  }
+  return `${record.sourceType}:${record.source}`;
+}
+function addDependedBy(record, dependerName) {
+  const current = new Set(record.dependedBy || []);
+  current.add(dependerName);
+  record.dependedBy = Array.from(current).sort();
+  writeInstallRecord(record.installDir, record);
+}
+function removeDependedBy(record, dependerName) {
+  if (!record.dependedBy) return;
+  const next = record.dependedBy.filter((name) => name !== dependerName);
+  record.dependedBy = next.length ? next : void 0;
+  writeInstallRecord(record.installDir, record);
+}
+function dedupeInstalledDependencies(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const entry of entries) {
+    const key = entry.sourceType === "inline" ? `inline:${entry.inlinePath || entry.name}` : `external:${entry.installDir || entry.source}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(entry);
+  }
+  return out;
+}
 async function cloneRemote(degitSrc, targetPath) {
   const emitter = degit(degitSrc, { force: true, verbose: false });
   await emitter.clone(targetPath);
@@ -515,7 +656,7 @@ function resolvePlatformAndScope(options) {
     scope: options.scope || config.defaultScope
   };
 }
-async function installSkill(input, options = {}) {
+async function installSkillBase(input, options = {}) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const source = input.source;
   const sourceType = classifySource(source);
@@ -578,7 +719,7 @@ async function installSkill(input, options = {}) {
     removeDir(tempRoot);
   }
 }
-async function installRegistrySkill(input, options = {}) {
+async function installRegistrySkillBase(input, options = {}, resolved) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const registryUrl = resolveRegistryUrl(input.registryUrl);
   const spec = parseRegistrySpecifier(input.spec);
@@ -596,8 +737,8 @@ async function installRegistrySkill(input, options = {}) {
   const tempRoot = createTempDir(skillsDir, installName);
   const stagingDir = path8.join(tempRoot, "staging");
   try {
-    const resolved = await resolveRegistryVersion(registryUrl, spec);
-    await downloadAndExtractTarball(resolved, tempRoot, stagingDir);
+    const resolvedVersion = resolved || await resolveRegistryVersion(registryUrl, spec);
+    await downloadAndExtractTarball(resolvedVersion, tempRoot, stagingDir);
     assertNonEmptyInstall(stagingDir, input.spec);
     replaceDirAtomic(stagingDir, installDir);
     const contentHash = hashDirectoryContent(installDir);
@@ -611,6 +752,7 @@ async function installRegistrySkill(input, options = {}) {
       scope,
       source: input.spec,
       sourceType: "registry",
+      resolvedVersion: resolvedVersion.version,
       installedAt: (/* @__PURE__ */ new Date()).toISOString(),
       installDir,
       contentHash,
@@ -635,6 +777,196 @@ async function installRegistrySkill(input, options = {}) {
     removeDir(tempRoot);
   }
 }
+function createInstallContext(options, registryUrl) {
+  const { platform, scope } = resolvePlatformAndScope(options);
+  return {
+    platform,
+    scope,
+    force: Boolean(options.force),
+    registryUrl,
+    active: /* @__PURE__ */ new Set(),
+    inlineActive: /* @__PURE__ */ new Set()
+  };
+}
+function formatVersionConflict(input) {
+  const lines = [
+    "Version conflict detected",
+    `  Installed: ${input.name}@${input.installedVersion || "unknown"} (required by ${input.installedBy})`,
+    `  Requested: ${input.name}@${input.requested} (required by ${input.requestedBy})`,
+    "",
+    "Please resolve manually."
+  ];
+  return lines.join("\n");
+}
+async function ensureExternalDependencyInstalled(dep, ctx, dependerName) {
+  if (dep.sourceType === "registry") {
+    const registryUrl = resolveRegistryUrl(ctx.registryUrl);
+    const spec = dep.spec || parseRegistrySpecifier(dep.source);
+    const resolved = await resolveRegistryVersion(registryUrl, spec);
+    const installName2 = canonicalNameToInstallDirName(spec.canonicalName);
+    const installDir2 = getSkillInstallDir(ctx.platform, ctx.scope, installName2);
+    if (fs7.existsSync(installDir2) && !ctx.force) {
+      const existing = readInstallRecord(installDir2);
+      if (!existing) {
+        throw new SkildError(
+          "MISSING_METADATA",
+          `Skill "${spec.canonicalName}" is missing install metadata (.skild/install.json). Use --force to reinstall.`,
+          { installDir: installDir2 }
+        );
+      }
+      const installedVersion = existing.resolvedVersion || existing.skill?.frontmatter?.version;
+      if (installedVersion && installedVersion !== resolved.version) {
+        const installedBy = existing.dependedBy?.length ? existing.dependedBy.join(", ") : "unknown";
+        throw new SkildError(
+          "VERSION_CONFLICT",
+          formatVersionConflict({
+            name: spec.canonicalName,
+            installedVersion,
+            requested: spec.versionOrTag,
+            installedBy,
+            requestedBy: dependerName
+          }),
+          { installDir: installDir2 }
+        );
+      }
+      addDependedBy(existing, dependerName);
+      await processDependenciesForSkill(existing, ctx);
+      return existing;
+    }
+    const record2 = await installRegistrySkillBase(
+      { spec: dep.source, registryUrl },
+      { platform: ctx.platform, scope: ctx.scope, force: ctx.force },
+      resolved
+    );
+    addDependedBy(record2, dependerName);
+    await processDependenciesForSkill(record2, ctx);
+    return record2;
+  }
+  if (dep.sourceType === "local") {
+    throw new SkildError("INVALID_DEPENDENCY", `Dependencies cannot reference local absolute paths: ${dep.source}`);
+  }
+  const installName = extractSkillName(dep.source);
+  const installDir = getSkillInstallDir(ctx.platform, ctx.scope, installName);
+  if (fs7.existsSync(installDir) && !ctx.force) {
+    const existing = readInstallRecord(installDir);
+    if (!existing) {
+      throw new SkildError(
+        "MISSING_METADATA",
+        `Skill "${installName}" is missing install metadata (.skild/install.json). Use --force to reinstall.`,
+        { installDir }
+      );
+    }
+    if (existing.source !== dep.source) {
+      throw new SkildError(
+        "DEPENDENCY_CONFLICT",
+        `Dependency conflict detected for "${installName}". Installed from ${existing.source}, requested ${dep.source}.`,
+        { installDir }
+      );
+    }
+    addDependedBy(existing, dependerName);
+    await processDependenciesForSkill(existing, ctx);
+    return existing;
+  }
+  const record = await installSkillBase(
+    { source: dep.source },
+    { platform: ctx.platform, scope: ctx.scope, force: ctx.force }
+  );
+  addDependedBy(record, dependerName);
+  await processDependenciesForSkill(record, ctx);
+  return record;
+}
+async function processInlineDependencies(inlineDir, rootDir, ctx, dependerName) {
+  const key = `inline:${inlineDir}`;
+  if (ctx.inlineActive.has(key)) {
+    throw new SkildError("DEPENDENCY_CYCLE", `Inline dependency cycle detected at ${inlineDir}`);
+  }
+  ctx.inlineActive.add(key);
+  try {
+    const frontmatter = getFrontmatterFromDir(inlineDir);
+    if (!frontmatter) return [];
+    const dependencies = normalizeDependencies(frontmatter.dependencies);
+    const installedDeps = [];
+    for (const depRaw of dependencies) {
+      const parsed = parseDependency(depRaw, inlineDir, rootDir);
+      if (parsed.sourceType === "inline") {
+        installedDeps.push({
+          name: parsed.name,
+          source: depRaw,
+          sourceType: "inline",
+          inlinePath: parsed.inlinePath
+        });
+        const nested = await processInlineDependencies(parsed.inlineDir, rootDir, ctx, dependerName);
+        installedDeps.push(...nested);
+      } else {
+        const depRecord = await ensureExternalDependencyInstalled(parsed, ctx, dependerName);
+        installedDeps.push({
+          name: depRecord.name,
+          source: depRaw,
+          sourceType: depRecord.sourceType,
+          canonicalName: depRecord.canonicalName,
+          installDir: depRecord.installDir
+        });
+      }
+    }
+    return installedDeps;
+  } finally {
+    ctx.inlineActive.delete(key);
+  }
+}
+async function processDependenciesForSkill(record, ctx) {
+  const key = getDependencyKeyFromRecord(record);
+  if (ctx.active.has(key)) {
+    throw new SkildError("DEPENDENCY_CYCLE", `Dependency cycle detected for ${record.name}`);
+  }
+  ctx.active.add(key);
+  try {
+    const frontmatter = record.skill?.frontmatter || getFrontmatterFromDir(record.installDir);
+    if (!frontmatter) return;
+    const dependencies = normalizeDependencies(frontmatter.dependencies);
+    const skillset = frontmatter.skillset === true;
+    const installedDeps = [];
+    for (const depRaw of dependencies) {
+      const parsed = parseDependency(depRaw, record.installDir, record.installDir);
+      if (parsed.sourceType === "inline") {
+        installedDeps.push({
+          name: parsed.name,
+          source: depRaw,
+          sourceType: "inline",
+          inlinePath: parsed.inlinePath
+        });
+        const nested = await processInlineDependencies(parsed.inlineDir, record.installDir, ctx, record.name);
+        installedDeps.push(...nested);
+      } else {
+        const depRecord = await ensureExternalDependencyInstalled(parsed, ctx, record.name);
+        installedDeps.push({
+          name: depRecord.name,
+          source: depRaw,
+          sourceType: depRecord.sourceType,
+          canonicalName: depRecord.canonicalName,
+          installDir: depRecord.installDir
+        });
+      }
+    }
+    record.skillset = skillset ? true : void 0;
+    record.dependencies = dependencies.length ? dependencies : void 0;
+    record.installedDependencies = installedDeps.length ? dedupeInstalledDependencies(installedDeps) : void 0;
+    writeInstallRecord(record.installDir, record);
+  } finally {
+    ctx.active.delete(key);
+  }
+}
+async function installSkill(input, options = {}) {
+  const ctx = createInstallContext(options);
+  const record = await installSkillBase(input, options);
+  await processDependenciesForSkill(record, ctx);
+  return record;
+}
+async function installRegistrySkill(input, options = {}) {
+  const ctx = createInstallContext(options, input.registryUrl);
+  const record = await installRegistrySkillBase(input, options);
+  await processDependenciesForSkill(record, ctx);
+  return record;
+}
 function listSkills(options = {}) {
   const { platform, scope } = resolvePlatformAndScope(options);
   const skillsDir = getSkillsDir(platform, scope);
@@ -675,7 +1007,14 @@ function validateSkill(nameOrPath, options = {}) {
   return validateSkillDir(dir);
 }
 function uninstallSkill(name, options = {}) {
+  const visited = /* @__PURE__ */ new Set();
+  uninstallSkillInternal(name, options, visited);
+}
+function uninstallSkillInternal(name, options, visited) {
   const { platform, scope } = resolvePlatformAndScope(options);
+  const key = `${platform}:${scope}:${name}`;
+  if (visited.has(key)) return;
+  visited.add(key);
   const installDir = getSkillInstallDir(platform, scope, name);
   if (!fs7.existsSync(installDir)) {
     throw new SkildError("SKILL_NOT_FOUND", `Skill "${name}" not found in ${getSkillsDir(platform, scope)}`, { name, platform, scope });
@@ -684,6 +1023,19 @@ function uninstallSkill(name, options = {}) {
   if (!record && !options.allowMissingMetadata) {
     throw new SkildError("MISSING_METADATA", `Skill "${name}" is missing install metadata. Use --force to uninstall anyway.`, { name, installDir });
   }
+  const dependerName = record?.name || name;
+  if (record?.installedDependencies?.length) {
+    for (const dep of record.installedDependencies) {
+      if (dep.sourceType === "inline") continue;
+      const depInstallDir = dep.installDir || getSkillInstallDir(platform, scope, dep.name);
+      const depRecord = readInstallRecord(depInstallDir);
+      if (!depRecord) continue;
+      removeDependedBy(depRecord, dependerName);
+      if (options.withDeps && (!depRecord.dependedBy || depRecord.dependedBy.length === 0)) {
+        uninstallSkillInternal(depRecord.name, options, visited);
+      }
+    }
+  }
   removeDir(installDir);
   removeLockEntry(scope, name);
 }
@@ -699,6 +1051,7 @@ async function updateSkill(name, options = {}) {
       { platform, scope, force: true }
     ) : await installSkill({ source: record.source, nameOverride: record.name }, { platform, scope, force: true });
     updated.installedAt = record.installedAt;
+    updated.dependedBy = record.dependedBy;
     updated.updatedAt = now;
     writeInstallRecord(updated.installDir, updated);
     results.push(updated);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skild/core",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "description": "Skild core library (headless) for installing, validating, and managing Agent Skills locally.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,11 +19,13 @@
   "dependencies": {
     "degit": "^2.8.4",
     "js-yaml": "^4.1.0",
+    "semver": "^7.6.3",
     "tar": "^7.4.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.10.0",
+    "@types/semver": "^7.5.8",
     "tsup": "^8.0.0",
     "typescript": "^5.3.0"
   },