@skillfm/local 2.2.0 → 2.5.0

package/dist/skill-installer/bundle-fetcher.js

@@ -0,0 +1,133 @@
+// skill-installer/bundle-fetcher.ts
+// Fetches the skill bundle tarball from brain, writes to a tmp file, verifies sha256.
+import { createHash } from 'node:crypto';
+import { createWriteStream, mkdirSync, unlinkSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import { SKILL_BUNDLE_ERROR_CODES, SKILL_INSTALL_ERROR_CODES, mapServerErrorToInstallError, } from '@skillfm/contracts/skill-distribution';
+import { classifyNetworkError } from './errors.js';
+const FETCH_TIMEOUT_MS = 60_000; // B4 step: 60s timeout
+/**
+ * Fetch bundle tarball from brain and stream to tmpPath.
+ * Returns version + checksum from response headers.
+ * Throws FetchError-shaped object on failure.
+ */
+export async function fetchBundle(opts) {
+    const { apiBaseUrl, agentToken, slug, version, tmpPath } = opts;
+    // Ensure tmp dir exists
+    mkdirSync(dirname(tmpPath), { recursive: true });
+    const query = version ? `?version=${encodeURIComponent(version)}` : '';
+    const url = `${apiBaseUrl}/v1/skills/${encodeURIComponent(slug)}/bundle.tar.gz${query}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'X-Agent-Token': agentToken,
+                'X-Skillfm-Local-Version': '2.5.0',
+                Accept: 'application/gzip',
+            },
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!res.ok) {
+            // Try to parse error body
+            let code = SKILL_INSTALL_ERROR_CODES.INTERNAL;
+            let message = `HTTP ${res.status}`;
+            let details;
+            try {
+                const body = (await res.json());
+                if (body?.error?.code) {
+                    code = mapServerErrorToInstallError(body.error.code);
+                    message = body.error.message || message;
+                    details = body.error.details;
+                }
+            }
+            catch {
+                // Body not parseable
+            }
+            const err = new Error(message);
+            err.installCode = code;
+            err.installDetails = details;
+            throw err;
+        }
+        // Read required response headers
+        const skillVersion = res.headers.get('x-skill-version');
+        const checksumSha256 = res.headers.get('x-skill-checksum-sha256');
+        const manifestVersion = res.headers.get('x-skill-manifest-version') || 'v0.2';
+        if (!skillVersion) {
+            const err = new Error('Missing X-Skill-Version header from brain');
+            err.installCode = SKILL_INSTALL_ERROR_CODES.INTERNAL;
+            throw err;
+        }
+        if (!checksumSha256) {
+            const err = new Error('Missing X-Skill-Checksum-Sha256 header from brain');
+            err.installCode = SKILL_INSTALL_ERROR_CODES.INTERNAL;
+            throw err;
+        }
+        // Stream body to tmp file
+        if (!res.body) {
+            const err = new Error('No response body');
+            err.installCode = SKILL_INSTALL_ERROR_CODES.INTERNAL;
+            throw err;
+        }
+        const writer = createWriteStream(tmpPath);
+        await pipeline(Readable.fromWeb(res.body), writer);
+        return {
+            tmpPath,
+            version: skillVersion,
+            checksumSha256,
+            manifestVersion,
+        };
+    }
+    catch (err) {
+        clearTimeout(timer);
+        // Already classified
+        if (err.installCode) {
+            throw err;
+        }
+        // Network error
+        const code = classifyNetworkError(err);
+        const netErr = new Error(`Network error fetching bundle: ${err.message}`);
+        netErr.installCode = code;
+        throw netErr;
+    }
+}
+/**
+ * Compute SHA-256 hex of a file.
+ */
+export async function computeFileSha256(filePath) {
+    const { createReadStream } = await import('node:fs');
+    return new Promise((resolve, reject) => {
+        const hash = createHash('sha256');
+        const stream = createReadStream(filePath);
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('end', () => resolve(hash.digest('hex')));
+        stream.on('error', reject);
+    });
+}
+/**
+ * Verify sha256 of tmpPath matches expected.
+ * Returns true if match, false if mismatch.
+ */
+export async function verifyChecksum(filePath, expected) {
+    const actual = await computeFileSha256(filePath);
+    return actual.toLowerCase() === expected.toLowerCase();
+}
+/**
+ * Delete tmp file silently (cleanup).
+ */
+export function deleteTmpFile(filePath) {
+    try {
+        if (existsSync(filePath))
+            unlinkSync(filePath);
+    }
+    catch {
+        // Ignore
+    }
+}
+// Re-export for convenience
+export { SKILL_BUNDLE_ERROR_CODES };
+//# sourceMappingURL=bundle-fetcher.js.map

package/dist/skill-installer/bundle-fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-fetcher.js","sourceRoot":"","sources":["../../src/skill-installer/bundle-fetcher.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sFAAsF;AAEtF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,uBAAuB;AAexD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAMjC;IACC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEhE,wBAAwB;IACxB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,UAAU,cAAc,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC;IAExF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU;gBAC3B,yBAAyB,EAAE,OAAO;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,0BAA0B;YAC1B,IAAI,IAAI,GAA0B,yBAAyB,CAAC,QAAQ,CAAC;YACrE,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,OAA4C,CAAC;YAEjD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC3D,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBACtB,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;oBACxC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAG5B,CAAC;YACF,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC;QAE9E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAEhE,CAAC;YACF,GAAG,CAAC,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAExE,CAAC;YACF,GAAG,CAAC,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAEvC,CAAC;YACF,GAAG,CAAC,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,EAAE,MAAM,CAAC,CAAC;QAE7F,OAAO;YACL,OAAO;YACP,OAAO,EAAE,YAAY;YACrB,cAAc;YACd,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,qBAAqB;QACrB,IAAK,GAAgC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,gBAAgB;QAChB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,KAAK,CACtB,kCAAmC,GAAa,CAAC,OAAO,EAAE,CACT,CAAC;QACpD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,MAAM,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,4BAA4B;AAC5B,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/skill-installer/errors.d.ts

@@ -0,0 +1,12 @@
+import { mapServerErrorToInstallError } from '@skillfm/contracts/skill-distribution';
+import type { SkillInstallErrorCode } from '@skillfm/contracts/skill-distribution';
+export { mapServerErrorToInstallError };
+/**
+ * Classify a caught network/fetch error into a SkillInstallErrorCode.
+ * Network-layer errors (ENETUNREACH, ECONNRESET, ETIMEDOUT, AbortError, fetch failed)
+ * all map to NETWORK.UNREACHABLE.
+ */
+export declare function classifyNetworkError(err: unknown): SkillInstallErrorCode;
+/** Hints shown to the agent for each error code */
+export declare const INSTALL_ERROR_HINTS: Partial<Record<SkillInstallErrorCode, string>>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/skill-installer/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/skill-installer/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAgBxE;AAED,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAc9E,CAAC"}

package/dist/skill-installer/errors.js

@@ -0,0 +1,42 @@
+// skill-installer/errors.ts
+// Maps server SKILL.BUNDLE.* codes + network errors to SkillInstallErrorCode.
+// Directly re-exports + extends mapServerErrorToInstallError from contracts.
+import { mapServerErrorToInstallError, SKILL_INSTALL_ERROR_CODES, } from '@skillfm/contracts/skill-distribution';
+export { mapServerErrorToInstallError };
+/**
+ * Classify a caught network/fetch error into a SkillInstallErrorCode.
+ * Network-layer errors (ENETUNREACH, ECONNRESET, ETIMEDOUT, AbortError, fetch failed)
+ * all map to NETWORK.UNREACHABLE.
+ */
+export function classifyNetworkError(err) {
+    const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
+    if (msg.includes('enetunreach') ||
+        msg.includes('econnreset') ||
+        msg.includes('econnrefused') ||
+        msg.includes('enotfound') ||
+        msg.includes('etimedout') ||
+        msg.includes('abort') ||
+        msg.includes('fetch failed') ||
+        msg.includes('network') ||
+        msg.includes('timeout')) {
+        return SKILL_INSTALL_ERROR_CODES.NETWORK_UNREACHABLE;
+    }
+    return SKILL_INSTALL_ERROR_CODES.INTERNAL;
+}
+/** Hints shown to the agent for each error code */
+export const INSTALL_ERROR_HINTS = {
+    [SKILL_INSTALL_ERROR_CODES.NETWORK_UNREACHABLE]: '网络异常，待会儿再试',
+    [SKILL_INSTALL_ERROR_CODES.AGENT_NOT_BOUND]: "先跑 `skillfm-local activate`",
+    [SKILL_INSTALL_ERROR_CODES.SKILL_NOT_FOUND]: 'slug 不存在，是不是拼错了',
+    [SKILL_INSTALL_ERROR_CODES.SKILL_ACCESS_DENIED]: '你的订阅不允许装这个 skill',
+    [SKILL_INSTALL_ERROR_CODES.SKILL_NOT_READY]: 'skill 暂未发布，稍后重试',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_CHECKSUM_MISMATCH]: '下载损坏，已自动重试 1 次',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_EXTRACT_FAILED]: '解压失败，bundle 可能损坏',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_NPM_CI_FAILED]: 'skill 依赖装不上',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_MISSING_SERVER_JS]: 'bundle 损坏，请联系 SkillFM',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_DISK_FULL]: '磁盘空间不足',
+    [SKILL_INSTALL_ERROR_CODES.BUNDLE_LOCK_BUSY]: '同一 skill 正在安装中，请稍候',
+    [SKILL_INSTALL_ERROR_CODES.INPUT_BAD_SLUG]: 'slug 格式无效，应为小写字母/数字/短横线，2-64 字符',
+    [SKILL_INSTALL_ERROR_CODES.INTERNAL]: '内部错误，请重试',
+};
+//# sourceMappingURL=errors.js.map

package/dist/skill-installer/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/skill-installer/errors.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAG/C,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,IACE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EACvB,CAAC;QACD,OAAO,yBAAyB,CAAC,mBAAmB,CAAC;IACvD,CAAC;IACD,OAAO,yBAAyB,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAmD;IACjF,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IAC7D,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,6BAA6B;IAC1E,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IAC9D,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,EAAE,kBAAkB;IACnE,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,iBAAiB;IAC9D,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,EAAE,gBAAgB;IACtE,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,EAAE,kBAAkB;IACrE,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,EAAE,aAAa;IAC/D,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,EAAE,uBAAuB;IAC7E,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,EAAE,QAAQ;IACtD,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,EAAE,oBAAoB;IAClE,CAAC,yBAAyB,CAAC,cAAc,CAAC,EAAE,iCAAiC;IAC7E,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,UAAU;CACjD,CAAC"}

package/dist/skill-installer/index.d.ts

@@ -0,0 +1,20 @@
+import type { SkillInstallResult } from '@skillfm/contracts/skill-distribution';
+export interface InstallSkillOptions {
+    slug: string;
+    version?: string;
+    /** Override api base url (defaults to config.apiBaseUrl) */
+    apiBaseUrl?: string;
+    /** Override agent token (defaults to config.brainKey) */
+    agentToken?: string;
+    /** Override skills root directory (defaults to ~/.skillfm/skills/) — useful in tests */
+    skillsRoot?: string;
+}
+/**
+ * Install a SkillFM official skill bundle.
+ * Implements B1-B12 from SKILL-INSTALL-CALL-SEQUENCE.md §2.2.
+ *
+ * B12 (cleanup) is guaranteed via try/finally.
+ * Returns SkillInstallResult.
+ */
+export declare function installSkill(opts: InstallSkillOptions): Promise<SkillInstallResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/skill-installer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skill-installer/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAShF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8KzF"}

package/dist/skill-installer/index.js

@@ -0,0 +1,193 @@
+// skill-installer/index.ts
+// installSkill() — main orchestration function.
+// Implements CALL-SEQUENCE §2.2 steps B1-B12.
+import { existsSync, symlinkSync, rmSync, cpSync } from 'node:fs';
+import { SKILL_SLUG_REGEX, SKILL_INSTALL_ERROR_CODES, } from '@skillfm/contracts/skill-distribution';
+import { acquireLock } from './lockfile.js';
+import { fetchBundle, verifyChecksum, deleteTmpFile } from './bundle-fetcher.js';
+import { extractBundle } from './tar-extractor.js';
+import { runNpmCi, verifyServerJs } from './npm-installer.js';
+import { buildInstallPaths, DEFAULT_SKILLS_ROOT } from './paths.js';
+import { INSTALL_ERROR_HINTS } from './errors.js';
+/**
+ * Install a SkillFM official skill bundle.
+ * Implements B1-B12 from SKILL-INSTALL-CALL-SEQUENCE.md §2.2.
+ *
+ * B12 (cleanup) is guaranteed via try/finally.
+ * Returns SkillInstallResult.
+ */
+export async function installSkill(opts) {
+    const { slug, version, skillsRoot } = opts;
+    // B1: Validate slug
+    if (!SKILL_SLUG_REGEX.test(slug)) {
+        return makeError(SKILL_INSTALL_ERROR_CODES.INPUT_BAD_SLUG, `Invalid slug "${slug}" — must match /^[a-z0-9-]{2,64}$/`);
+    }
+    // B2: Read config for agent_token + api_base_url
+    const { config } = await import('../mcp-stdio/config.js');
+    const apiBaseUrl = opts.apiBaseUrl ?? config.apiBaseUrl;
+    const agentToken = opts.agentToken ?? config.brainKey;
+    if (!agentToken) {
+        return makeError(SKILL_INSTALL_ERROR_CODES.AGENT_NOT_BOUND, 'No agent_token found. Run `skillfm-local activate` first.');
+    }
+    const resolvedSkillsRoot = skillsRoot ?? DEFAULT_SKILLS_ROOT;
+    // We need a preliminary paths object to build the lock path
+    // (version is unknown until after fetch, but lock path only needs slug)
+    const { join } = await import('node:path');
+    const lockPath = join(resolvedSkillsRoot, '.locks', `${slug}.lock`);
+    // B3: Acquire lock
+    let releaseLock = null;
+    let tmpPath = null;
+    try {
+        try {
+            releaseLock = await acquireLock(lockPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code === 'BUNDLE.LOCK_BUSY') {
+                return makeError(SKILL_INSTALL_ERROR_CODES.BUNDLE_LOCK_BUSY, `Another install of "${slug}" is in progress. Please wait.`);
+            }
+            throw err;
+        }
+        // B4+B5: Fetch bundle + stream to tmp
+        let fetchResult;
+        try {
+            // Build a preliminary tmpPath (version placeholder)
+            const tmpPaths = buildInstallPaths(slug, version ?? 'tmp', resolvedSkillsRoot);
+            tmpPath = tmpPaths.tmpTarball;
+            fetchResult = await fetchBundle({
+                apiBaseUrl,
+                agentToken,
+                slug,
+                version,
+                tmpPath,
+            });
+            tmpPath = fetchResult.tmpPath;
+        }
+        catch (err) {
+            const e = err;
+            return makeError(e.installCode ?? SKILL_INSTALL_ERROR_CODES.INTERNAL, e.message, e.installDetails);
+        }
+        const { version: resolvedVersion, checksumSha256 } = fetchResult;
+        // B6: Verify sha256 (auto-retry once on mismatch)
+        let checksumOk = await verifyChecksum(tmpPath, checksumSha256);
+        if (!checksumOk) {
+            // Retry once: re-fetch
+            deleteTmpFile(tmpPath);
+            try {
+                const retryPaths = buildInstallPaths(slug, resolvedVersion, resolvedSkillsRoot);
+                tmpPath = retryPaths.tmpTarball;
+                const retryResult = await fetchBundle({
+                    apiBaseUrl,
+                    agentToken,
+                    slug,
+                    version: resolvedVersion,
+                    tmpPath,
+                });
+                tmpPath = retryResult.tmpPath;
+                checksumOk = await verifyChecksum(tmpPath, retryResult.checksumSha256);
+            }
+            catch (retryErr) {
+                const e = retryErr;
+                return makeError(e.installCode ?? SKILL_INSTALL_ERROR_CODES.INTERNAL, e.message);
+            }
+            if (!checksumOk) {
+                return makeError(SKILL_INSTALL_ERROR_CODES.BUNDLE_CHECKSUM_MISMATCH, `Bundle checksum mismatch for "${slug}@${resolvedVersion}" after retry`);
+            }
+        }
+        // Build final paths with resolved version
+        const paths = buildInstallPaths(slug, resolvedVersion, resolvedSkillsRoot);
+        const { installDir, versionlessLink } = paths;
+        // B7+B8: Extract tarball + validate required files
+        try {
+            await extractBundle({ tmpPath, installDir });
+        }
+        catch (err) {
+            const e = err;
+            return makeError(e.installCode ?? SKILL_INSTALL_ERROR_CODES.BUNDLE_EXTRACT_FAILED, e.message);
+        }
+        // B9: npm ci
+        try {
+            await runNpmCi(installDir);
+        }
+        catch (err) {
+            const e = err;
+            return makeError(e.installCode ?? SKILL_INSTALL_ERROR_CODES.BUNDLE_NPM_CI_FAILED, e.message, e.details);
+        }
+        // B10: Verify runtime/server.js still exists
+        try {
+            verifyServerJs(installDir);
+        }
+        catch (err) {
+            const e = err;
+            return makeError(e.installCode ?? SKILL_INSTALL_ERROR_CODES.BUNDLE_MISSING_SERVER_JS, e.message);
+        }
+        // B11: Create/update versionless symlink
+        // macOS/Linux: symlink; Windows fallback: copy
+        try {
+            await updateVersionlessLink(versionlessLink, installDir);
+        }
+        catch (linkErr) {
+            // Not fatal — log a warning but don't fail install
+            process.stderr.write(`[skill-installer] warn: failed to create versionless link ${versionlessLink}: ${linkErr.message}\n`);
+        }
+        return {
+            ok: true,
+            slug,
+            version: resolvedVersion,
+            install_dir: installDir,
+            hint_for_agent: 'skill 已就绪。下一步 run-skill 起 daemon',
+        };
+    }
+    finally {
+        // B12: Cleanup — always run
+        if (tmpPath)
+            deleteTmpFile(tmpPath);
+        if (releaseLock)
+            releaseLock();
+    }
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+function makeError(code, message, details) {
+    return {
+        ok: false,
+        error: code,
+        message,
+        details,
+        hint_for_agent: INSTALL_ERROR_HINTS[code],
+    };
+}
+/**
+ * Update the versionless symlink <slug> → <slug>@<version>.
+ * On Windows (no symlink privilege), fall back to recursive copy.
+ */
+async function updateVersionlessLink(versionlessLink, installDir) {
+    // Remove existing link/dir if present
+    if (existsSync(versionlessLink)) {
+        try {
+            const { lstatSync } = await import('node:fs');
+            const stat = lstatSync(versionlessLink);
+            if (stat.isSymbolicLink() || stat.isDirectory()) {
+                rmSync(versionlessLink, { recursive: true, force: true });
+            }
+        }
+        catch {
+            // Ignore
+        }
+    }
+    // Try symlink first
+    if (process.platform !== 'win32') {
+        symlinkSync(installDir, versionlessLink);
+        return;
+    }
+    // Windows fallback: copy
+    try {
+        symlinkSync(installDir, versionlessLink);
+    }
+    catch {
+        // Symlink failed (no admin) — use recursive copy
+        cpSync(installDir, versionlessLink, { recursive: true });
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/skill-installer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skill-installer/index.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,gDAAgD;AAChD,8CAA8C;AAE9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAElE,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAclD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE3C,oBAAoB;IACpB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CACd,yBAAyB,CAAC,cAAc,EACxC,iBAAiB,IAAI,oCAAoC,CAC1D,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC;IAEtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CACd,yBAAyB,CAAC,eAAe,EACzC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,IAAI,mBAAmB,CAAC;IAE7D,4DAA4D;IAC5D,wEAAwE;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAEpE,mBAAmB;IACnB,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAElC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClC,OAAO,SAAS,CACd,yBAAyB,CAAC,gBAAgB,EAC1C,uBAAuB,IAAI,gCAAgC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sCAAsC;QACtC,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,oDAAoD;YACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC/E,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC;YAE9B,WAAW,GAAG,MAAM,WAAW,CAAC;gBAC9B,UAAU;gBACV,UAAU;gBACV,IAAI;gBACJ,OAAO;gBACP,OAAO;aACR,CAAC,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAGT,CAAC;YACF,OAAO,SAAS,CACd,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC,QAAQ,EACnD,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,cAAc,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC;QAEjE,kDAAkD;QAClD,IAAI,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,uBAAuB;YACvB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;gBAChF,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC;oBACpC,UAAU;oBACV,UAAU;oBACV,IAAI;oBACJ,OAAO,EAAE,eAAe;oBACxB,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;gBAC9B,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,QAAiB,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,QAA2D,CAAC;gBACtE,OAAO,SAAS,CACd,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC,QAAQ,EACnD,CAAC,CAAC,OAAO,CACV,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,SAAS,CACd,yBAAyB,CAAC,wBAAwB,EAClD,iCAAiC,IAAI,IAAI,eAAe,eAAe,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC3E,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;QAE9C,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAAsD,CAAC;YACjE,OAAO,SAAS,CACd,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC,qBAAqB,EAChE,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QAED,aAAa;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAGT,CAAC;YACF,OAAO,SAAS,CACd,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC,oBAAoB,EAC/D,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAAsD,CAAC;YACjE,OAAO,SAAS,CACd,CAAC,CAAC,WAAW,IAAI,yBAAyB,CAAC,wBAAwB,EACnE,CAAC,CAAC,OAAO,CACV,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6DAA6D,eAAe,KAAM,OAAiB,CAAC,OAAO,IAAI,CAChH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,OAAO,EAAE,eAAe;YACxB,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,kCAAkC;SACnD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,4BAA4B;QAC5B,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,WAAW;YAAE,WAAW,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,SAAS,CAChB,IAA2B,EAC3B,OAAe,EACf,OAAiC;IAEjC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,IAAI;QACX,OAAO;QACP,OAAO;QACP,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAClC,eAAuB,EACvB,UAAkB;IAElB,sCAAsC;IACtC,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAChD,MAAM,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC;QACH,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;QACjD,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/skill-installer/lockfile.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Acquire a lock for the given lockFile path.
+ * Returns a release function.
+ * Throws with code BUNDLE.LOCK_BUSY if lock is not acquired within timeout.
+ */
+export declare function acquireLock(lockPath: string): Promise<() => void>;
+export declare function releaseLock(lockPath: string): void;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/skill-installer/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/skill-installer/lockfile.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CA0BvE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQlD"}

package/dist/skill-installer/lockfile.js

@@ -0,0 +1,52 @@
+// skill-installer/lockfile.ts
+// Provides mutex locking via mkdir atomicity (POSIX mkdir is atomic).
+// ~/.skillfm/skills/.locks/<slug>.lock is a directory (not a file).
+// mkdir succeeds only for the first caller; subsequent callers get EEXIST → busy.
+import { mkdirSync, rmdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+const LOCK_TIMEOUT_MS = 2 * 60 * 1000; // 2 minutes
+const POLL_INTERVAL_MS = 500;
+/**
+ * Acquire a lock for the given lockFile path.
+ * Returns a release function.
+ * Throws with code BUNDLE.LOCK_BUSY if lock is not acquired within timeout.
+ */
+export async function acquireLock(lockPath) {
+    // Ensure parent dir exists
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        try {
+            // mkdir is atomic on POSIX — only one caller can succeed
+            mkdirSync(lockPath, { recursive: false });
+            // Acquired
+            return () => releaseLock(lockPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code !== 'EEXIST') {
+                // Unexpected error
+                throw err;
+            }
+            // Lock is held — wait and retry
+            await sleep(POLL_INTERVAL_MS);
+        }
+    }
+    const err = new Error(`lock busy for more than ${LOCK_TIMEOUT_MS / 1000}s: ${lockPath}`);
+    err.code = 'BUNDLE.LOCK_BUSY';
+    throw err;
+}
+export function releaseLock(lockPath) {
+    try {
+        if (existsSync(lockPath)) {
+            rmdirSync(lockPath);
+        }
+    }
+    catch {
+        // Ignore errors during cleanup — lock may have been force-released
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/skill-installer/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/skill-installer/lockfile.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,sEAAsE;AACtE,oEAAoE;AACpE,kFAAkF;AAElF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,2BAA2B;IAC3B,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAE9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,yDAAyD;YACzD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,WAAW;YACX,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,mBAAmB;gBACnB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,gCAAgC;YAChC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,eAAe,GAAG,IAAI,MAAM,QAAQ,EAAE,CAAC,CAAC;IACxF,GAA6B,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACzD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/skill-installer/npm-installer.d.ts

@@ -0,0 +1,16 @@
+export interface NpmInstallResult {
+    exitCode: number;
+    stderr: string;
+    stdout: string;
+}
+/**
+ * Run `npm ci --omit=dev` in installDir.
+ * Returns exitCode + collected stderr on failure.
+ * Throws with installCode = BUNDLE.NPM_CI_FAILED on non-zero exit or timeout.
+ */
+export declare function runNpmCi(installDir: string): Promise<NpmInstallResult>;
+/**
+ * Verify that runtime/server.js still exists after npm ci.
+ */
+export declare function verifyServerJs(installDir: string): void;
+//# sourceMappingURL=npm-installer.d.ts.map

package/dist/skill-installer/npm-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-installer.d.ts","sourceRoot":"","sources":["../../src/skill-installer/npm-installer.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiE5E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CASvD"}

package/dist/skill-installer/npm-installer.js

@@ -0,0 +1,83 @@
+// skill-installer/npm-installer.ts
+// Runs `npm ci --omit=dev` in the install directory with a configurable timeout.
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { SKILL_INSTALL_ERROR_CODES } from '@skillfm/contracts/skill-distribution';
+/** Default npm ci timeout in ms. Override with SKILLFM_NPM_CI_TIMEOUT_MS env. */
+const DEFAULT_NPM_CI_TIMEOUT_MS = 180_000;
+function getNpmCiTimeoutMs() {
+    const envVal = process.env.SKILLFM_NPM_CI_TIMEOUT_MS;
+    if (envVal) {
+        const parsed = parseInt(envVal, 10);
+        if (!isNaN(parsed) && parsed > 0)
+            return parsed;
+    }
+    return DEFAULT_NPM_CI_TIMEOUT_MS;
+}
+/**
+ * Run `npm ci --omit=dev` in installDir.
+ * Returns exitCode + collected stderr on failure.
+ * Throws with installCode = BUNDLE.NPM_CI_FAILED on non-zero exit or timeout.
+ */
+export async function runNpmCi(installDir) {
+    const timeoutMs = getNpmCiTimeoutMs();
+    return new Promise((resolve, reject) => {
+        const stderrChunks = [];
+        const stdoutChunks = [];
+        const child = spawn('npm', ['ci', '--omit=dev'], {
+            cwd: installDir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                // Reduce npm output noise
+                npm_config_loglevel: 'warn',
+            },
+        });
+        child.stdout.on('data', (chunk) => stdoutChunks.push(chunk.toString()));
+        child.stderr.on('data', (chunk) => stderrChunks.push(chunk.toString()));
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+            const timeoutErr = new Error(`npm ci timed out after ${timeoutMs / 1000}s in ${installDir}. ` +
+                `Consider setting SKILLFM_NPM_CI_TIMEOUT_MS to a higher value.`);
+            timeoutErr.installCode = SKILL_INSTALL_ERROR_CODES.BUNDLE_NPM_CI_FAILED;
+            reject(timeoutErr);
+        }, timeoutMs);
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            const exitCode = code ?? 1;
+            const stderr = stderrChunks.join('');
+            const stdout = stdoutChunks.join('');
+            if (exitCode !== 0) {
+                const failErr = new Error(`npm ci failed with exit code ${exitCode}: ${stderr.slice(0, 500)}`);
+                failErr.installCode = SKILL_INSTALL_ERROR_CODES.BUNDLE_NPM_CI_FAILED;
+                failErr.details = {
+                    exit_code: exitCode,
+                    stderr: stderr.slice(0, 1000),
+                    install_dir: installDir,
+                };
+                reject(failErr);
+                return;
+            }
+            resolve({ exitCode, stderr, stdout });
+        });
+        child.on('error', (spawnErr) => {
+            clearTimeout(timer);
+            const err = new Error(`Failed to spawn npm: ${spawnErr.message}`);
+            err.installCode = SKILL_INSTALL_ERROR_CODES.BUNDLE_NPM_CI_FAILED;
+            reject(err);
+        });
+    });
+}
+/**
+ * Verify that runtime/server.js still exists after npm ci.
+ */
+export function verifyServerJs(installDir) {
+    const serverJs = join(installDir, 'runtime', 'server.js');
+    if (!existsSync(serverJs)) {
+        const err = new Error(`runtime/server.js missing after npm ci in ${installDir}`);
+        err.installCode = SKILL_INSTALL_ERROR_CODES.BUNDLE_MISSING_SERVER_JS;
+        throw err;
+    }
+}
+//# sourceMappingURL=npm-installer.js.map

package/dist/skill-installer/npm-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-installer.js","sourceRoot":"","sources":["../../src/skill-installer/npm-installer.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,iFAAiF;AAEjF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAGlF,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAClD,CAAC;IACD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkB;IAC/C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IAEtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE;YAC/C,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,0BAA0B;gBAC1B,mBAAmB,EAAE,MAAM;aAC5B;SACF,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEhF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,KAAK,CAC1B,0BAA0B,SAAS,GAAG,IAAI,QAAQ,UAAU,IAAI;gBAChE,+DAA+D,CACd,CAAC;YACpD,UAAU,CAAC,WAAW,GAAG,yBAAyB,CAAC,oBAAoB,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAErC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,gCAAgC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAIpE,CAAC;gBACF,OAAO,CAAC,WAAW,GAAG,yBAAyB,CAAC,oBAAoB,CAAC;gBACrE,OAAO,CAAC,OAAO,GAAG;oBAChB,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC7B,WAAW,EAAE,UAAU;iBACxB,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,wBAAwB,QAAQ,CAAC,OAAO,EAAE,CACO,CAAC;YACpD,GAAG,CAAC,WAAW,GAAG,yBAAyB,CAAC,oBAAoB,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,6CAA6C,UAAU,EAAE,CACR,CAAC;QACpD,GAAG,CAAC,WAAW,GAAG,yBAAyB,CAAC,wBAAwB,CAAC;QACrE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/skill-installer/paths.d.ts

@@ -0,0 +1,4 @@
+import type { SkillInstallPaths } from '@skillfm/contracts/skill-distribution';
+export declare const DEFAULT_SKILLS_ROOT: string;
+export declare function buildInstallPaths(slug: string, version: string, skillsRoot?: string): SkillInstallPaths;
+//# sourceMappingURL=paths.d.ts.map

package/dist/skill-installer/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/skill-installer/paths.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,eAAO,MAAM,mBAAmB,QAAwC,CAAC;AAEzE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,UAAU,GAAE,MAA4B,GACvC,iBAAiB,CAQnB"}

package/dist/skill-installer/paths.js

@@ -0,0 +1,16 @@
+// skill-installer/paths.ts
+// Construct SkillInstallPaths (§7 of skill-distribution.ts contract)
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+export const DEFAULT_SKILLS_ROOT = join(homedir(), '.skillfm', 'skills');
+export function buildInstallPaths(slug, version, skillsRoot = DEFAULT_SKILLS_ROOT) {
+    const rand = randomBytes(4).toString('hex');
+    return {
+        installDir: join(skillsRoot, `${slug}@${version}`),
+        versionlessLink: join(skillsRoot, slug),
+        lockFile: join(skillsRoot, '.locks', `${slug}.lock`),
+        tmpTarball: join(skillsRoot, '.cache', `${slug}-${version}-${rand}.tar.gz`),
+    };
+}
+//# sourceMappingURL=paths.js.map