@skillctl/lockfile 0.4.0 → 0.5.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 xFurti, Gabry848
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 xFurti, Gabry848
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/schema.d.ts

@@ -1,9 +1,12 @@
 import { z } from 'zod';
-import type { SkillLockfile, LockfileEntry, Provenance } from '@skillctl/core';
+import { type SkillLockfile, type LockfileEntry, type Provenance } from '@skillctl/core';
 export declare const ProvenanceSchema: z.ZodObject<{
     type: z.ZodEnum<["github", "npm", "local", "skills.sh", "other"]>;
     commit: z.ZodOptional<z.ZodString>;
+    requestedRef: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
     tarballHash: z.ZodOptional<z.ZodString>;
+    tarballUrl: z.ZodOptional<z.ZodString>;
     subpath: z.ZodOptional<z.ZodString>;
     migratedFrom: z.ZodOptional<z.ZodEnum<["npx", "python-skillctl", "project-scan"]>>;
     originalHash: z.ZodOptional<z.ZodString>;
@@ -14,7 +17,10 @@ export declare const ProvenanceSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     type: "github" | "npm" | "local" | "skills.sh" | "other";
     commit?: string | undefined;
+    requestedRef?: string | undefined;
+    version?: string | undefined;
     tarballHash?: string | undefined;
+    tarballUrl?: string | undefined;
     subpath?: string | undefined;
     migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
     originalHash?: string | undefined;
@@ -25,7 +31,10 @@ export declare const ProvenanceSchema: z.ZodObject<{
 }, {
     type: "github" | "npm" | "local" | "skills.sh" | "other";
     commit?: string | undefined;
+    requestedRef?: string | undefined;
+    version?: string | undefined;
     tarballHash?: string | undefined;
+    tarballUrl?: string | undefined;
     subpath?: string | undefined;
     migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
     originalHash?: string | undefined;
@@ -44,7 +53,10 @@ export declare const LockfileEntrySchema: z.ZodObject<{
     provenance: z.ZodObject<{
         type: z.ZodEnum<["github", "npm", "local", "skills.sh", "other"]>;
         commit: z.ZodOptional<z.ZodString>;
+        requestedRef: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
         tarballHash: z.ZodOptional<z.ZodString>;
+        tarballUrl: z.ZodOptional<z.ZodString>;
         subpath: z.ZodOptional<z.ZodString>;
         migratedFrom: z.ZodOptional<z.ZodEnum<["npx", "python-skillctl", "project-scan"]>>;
         originalHash: z.ZodOptional<z.ZodString>;
@@ -55,7 +67,10 @@ export declare const LockfileEntrySchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         type: "github" | "npm" | "local" | "skills.sh" | "other";
         commit?: string | undefined;
+        requestedRef?: string | undefined;
+        version?: string | undefined;
         tarballHash?: string | undefined;
+        tarballUrl?: string | undefined;
         subpath?: string | undefined;
         migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
         originalHash?: string | undefined;
@@ -66,7 +81,10 @@ export declare const LockfileEntrySchema: z.ZodObject<{
     }, {
         type: "github" | "npm" | "local" | "skills.sh" | "other";
         commit?: string | undefined;
+        requestedRef?: string | undefined;
+        version?: string | undefined;
         tarballHash?: string | undefined;
+        tarballUrl?: string | undefined;
         subpath?: string | undefined;
         migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
         originalHash?: string | undefined;
@@ -85,7 +103,10 @@ export declare const LockfileEntrySchema: z.ZodObject<{
     provenance: {
         type: "github" | "npm" | "local" | "skills.sh" | "other";
         commit?: string | undefined;
+        requestedRef?: string | undefined;
+        version?: string | undefined;
         tarballHash?: string | undefined;
+        tarballUrl?: string | undefined;
         subpath?: string | undefined;
         migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
         originalHash?: string | undefined;
@@ -104,7 +125,10 @@ export declare const LockfileEntrySchema: z.ZodObject<{
     provenance: {
         type: "github" | "npm" | "local" | "skills.sh" | "other";
         commit?: string | undefined;
+        requestedRef?: string | undefined;
+        version?: string | undefined;
         tarballHash?: string | undefined;
+        tarballUrl?: string | undefined;
         subpath?: string | undefined;
         migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
         originalHash?: string | undefined;
@@ -127,7 +151,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         provenance: z.ZodObject<{
             type: z.ZodEnum<["github", "npm", "local", "skills.sh", "other"]>;
             commit: z.ZodOptional<z.ZodString>;
+            requestedRef: z.ZodOptional<z.ZodString>;
+            version: z.ZodOptional<z.ZodString>;
             tarballHash: z.ZodOptional<z.ZodString>;
+            tarballUrl: z.ZodOptional<z.ZodString>;
             subpath: z.ZodOptional<z.ZodString>;
             migratedFrom: z.ZodOptional<z.ZodEnum<["npx", "python-skillctl", "project-scan"]>>;
             originalHash: z.ZodOptional<z.ZodString>;
@@ -138,7 +165,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         }, "strip", z.ZodTypeAny, {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -149,7 +179,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         }, {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -168,7 +201,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         provenance: {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -187,7 +223,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         provenance: {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -197,6 +236,16 @@ export declare const SkillLockfileSchema: z.ZodObject<{
             signature?: string | undefined;
         };
     }>>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        migratedAt: z.ZodOptional<z.ZodString>;
+        toolVersion: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        migratedAt?: string | undefined;
+        toolVersion?: string | undefined;
+    }, {
+        migratedAt?: string | undefined;
+        toolVersion?: string | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     lockfileVersion: "1.0";
     skills: Record<string, {
@@ -209,7 +258,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         provenance: {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -220,6 +272,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         };
     }>;
     agents?: string[] | undefined;
+    metadata?: {
+        migratedAt?: string | undefined;
+        toolVersion?: string | undefined;
+    } | undefined;
 }, {
     lockfileVersion: "1.0";
     skills: Record<string, {
@@ -232,7 +288,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         provenance: {
             type: "github" | "npm" | "local" | "skills.sh" | "other";
             commit?: string | undefined;
+            requestedRef?: string | undefined;
+            version?: string | undefined;
             tarballHash?: string | undefined;
+            tarballUrl?: string | undefined;
             subpath?: string | undefined;
             migratedFrom?: "npx" | "python-skillctl" | "project-scan" | undefined;
             originalHash?: string | undefined;
@@ -243,6 +302,10 @@ export declare const SkillLockfileSchema: z.ZodObject<{
         };
     }>;
     agents?: string[] | undefined;
+    metadata?: {
+        migratedAt?: string | undefined;
+        toolVersion?: string | undefined;
+    } | undefined;
 }>;
 export type { LockfileEntry, SkillLockfile, Provenance };
 export declare function validateLockfile(input: unknown): SkillLockfile;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE/E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW3B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAEzD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAE9D"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE3G,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc3B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAC;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAEzD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAQ9D"}

package/dist/schema.js

@@ -1,8 +1,12 @@
 import { z } from 'zod';
+import { canonicalizeName } from '@skillctl/core';
 export const ProvenanceSchema = z.object({
     type: z.enum(['github', 'npm', 'local', 'skills.sh', 'other']),
     commit: z.string().optional(),
+    requestedRef: z.string().optional(),
+    version: z.string().optional(),
     tarballHash: z.string().optional(),
+    tarballUrl: z.string().url().optional(),
     subpath: z.string().optional(),
     migratedFrom: z.enum(['npx', 'python-skillctl', 'project-scan']).optional(),
     originalHash: z.string().optional(),
@@ -24,8 +28,18 @@ export const SkillLockfileSchema = z.object({
     lockfileVersion: z.literal('1.0'),
     agents: z.array(z.string()).optional(),
     skills: z.record(z.string(), LockfileEntrySchema),
+    metadata: z.object({
+        migratedAt: z.string().optional(),
+        toolVersion: z.string().optional(),
+    }).optional(),
 });
 export function validateLockfile(input) {
-    return SkillLockfileSchema.parse(input);
+    const lock = SkillLockfileSchema.parse(input);
+    for (const [key, entry] of Object.entries(lock.skills)) {
+        if (canonicalizeName(key) !== key || entry.name !== key) {
+            throw new Error(`Lockfile skill key/name mismatch or non-canonical name: ${key}`);
+        }
+    }
+    return lock;
 }
 //# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,kCAAkC,CAAC;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY;IAC7E,UAAU,EAAE,gBAAgB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC;CAClD,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAkB,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAA2D,MAAM,gBAAgB,CAAC;AAE3G,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,kCAAkC,CAAC;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY;IAC7E,UAAU,EAAE,gBAAgB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAkB,CAAC;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2DAA2D,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillctl/lockfile",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "agent-skills.lock YAML parser/generator with lockfileVersion and provenance for skillctl",
   "license": "MIT",
   "author": "xFurti & Gabry848",
@@ -8,12 +8,13 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "!dist/test"
   ],
   "dependencies": {
     "js-yaml": "^4.1.0",
     "zod": "^3.23.8",
-    "@skillctl/core": "0.4.0"
+    "@skillctl/core": "0.5.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
@@ -40,6 +41,6 @@
     "dev": "tsc -b --watch",
     "clean": "rimraf dist",
     "lint": "tsc --noEmit",
-    "test": "node --test ./dist/test/*.test.js 2>&1 || echo \"lockfile tests placeholder (fixtures+validation present; run build+manual)\" && exit 0"
+    "test": "node --test ./dist/test/*.test.js"
   }
 }

package/dist/test/lockfile-validation.test.d.ts

@@ -1,3 +0,0 @@
-declare function runTests(): Promise<void>;
-export { runTests };
-//# sourceMappingURL=lockfile-validation.test.d.ts.map

package/dist/test/lockfile-validation.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockfile-validation.test.d.ts","sourceRoot":"","sources":["../../src/test/lockfile-validation.test.ts"],"names":[],"mappings":"AAkBA,iBAAe,QAAQ,kBAgDtB;AAMD,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/test/lockfile-validation.test.js

@@ -1,55 +0,0 @@
-/**
- * Validation tests + fixtures for lockfile (YAML + detailed provenance).
- */
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-import yaml from 'js-yaml';
-import { validateLockfile } from '../schema.js';
-import { loadLockfile, saveLockfile, createEmptyLockfile, addOrUpdateEntry, makeLockEntry } from '../lockfile.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const fixturesDir = join(__dirname, '..', '..', 'fixtures');
-function loadFixtureText(name) {
-    return readFileSync(join(fixturesDir, name), 'utf8');
-}
-async function runTests() {
-    console.log('Running lockfile validation tests...');
-    const validYaml = loadFixtureText('example-agent-skills.lock');
-    const parsedValid = yaml.load(validYaml);
-    const lock = validateLockfile(parsedValid);
-    assert.equal(lock.lockfileVersion, '1.0');
-    assert.ok(lock.skills['web-design-guidelines']);
-    assert.equal(lock.skills['web-design-guidelines'].provenance.type, 'github');
-    console.log('✓ valid lock + provenance (github + skills.sh)');
-    // empty
-    const empty = createEmptyLockfile(['claude-code']);
-    assert.equal(empty.lockfileVersion, '1.0');
-    assert.deepEqual(empty.skills, {});
-    console.log('✓ createEmptyLockfile');
-    // add entry
-    const entry = makeLockEntry('foo-skill', 'github:acme/foo', 'github:acme/foo@deadbeef', 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', '/tmp/canonical/foo-skill', { type: 'github', commit: 'deadbeef' });
-    const updated = addOrUpdateEntry(empty, 'foo-skill', entry);
-    assert.ok(updated.skills['foo-skill']);
-    console.log('✓ addOrUpdateEntry + mixed source provenance');
-    // load from fixture disk
-    const loaded = await loadLockfile(join(fixturesDir, '..'), 'fixtures/example-agent-skills.lock');
-    assert.ok(loaded && loaded.skills['playwright']);
-    console.log('✓ loadLockfile YAML');
-    // invalid integrity
-    const badYaml = loadFixtureText('invalid-integrity.lock');
-    const badParsed = yaml.load(badYaml);
-    assert.throws(() => validateLockfile(badParsed), /integrity must be sha256/);
-    console.log('✓ rejects bad integrity hash');
-    // save roundtrip
-    const tmp = join(__dirname, 'tmp-lock-' + Date.now());
-    const p = await saveLockfile(updated, tmp, 'agent-skills.test.lock');
-    assert.ok(p.endsWith('.lock'));
-    console.log('✓ saveLockfile (YAML pnpm-style)');
-    console.log('All lockfile validation tests passed.');
-}
-if (import.meta.url === `file://${process.argv[1]}`) {
-    runTests().catch((e) => { console.error(e); process.exit(1); });
-}
-export { runTests };
-//# sourceMappingURL=lockfile-validation.test.js.map

package/dist/test/lockfile-validation.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockfile-validation.test.js","sourceRoot":"","sources":["../../src/test/lockfile-validation.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAElH,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAE5D,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAEpD,MAAM,SAAS,GAAG,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,QAAQ;IACR,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAErC,YAAY;IACZ,MAAM,KAAK,GAAG,aAAa,CACzB,WAAW,EACX,iBAAiB,EACjB,0BAA0B,EAC1B,yEAAyE,EACzE,0BAA0B,EAC1B,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CACvC,CAAC;IACF,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAE5D,yBAAyB;IACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,oCAAoC,CAAC,CAAC;IACjG,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAEnC,oBAAoB;IACpB,MAAM,OAAO,GAAG,eAAe,CAAC,wBAAwB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,iBAAiB;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AACvD,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}