@sky.ui.pro/core 0.0.6 → 0.0.7

package/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes to `@sky.ui.pro/core` are documented here.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+## [0.0.7] - 2026-07-07
+
+### Changed
+
+- **Breaking install flow:** removed npm `postinstall` and the `tar` dependency from the published stub. Run `npx sky.ui.pro install` after `npm install` to download and hydrate the licensed artifact.
+- Stub `package.json` no longer ships `scripts/` in the npm tarball.
+- Peer dependency on `@sky.ui/core` bumped to `^0.0.7`.
+
+### Added
+
+- TypeScript stub declarations at `dist/stub/index.d.ts`.
+- `CHANGELOG.md` and npm metadata (`keywords`, `author`, `engines`).
+
+## [0.0.6]
+
+### Added
+
+- Initial npm stub with postinstall-based hydration (superseded in `0.0.7`).

package/README.md

@@ -1,96 +1,107 @@
-# @sky.ui.pro/core
-
-Pro-tier Lit web components for Sky UI. Extends the free catalog with advanced components such as data tables, flow editors, and rich inputs.
-
-Requires an active Sky UI Pro subscription. Install alongside `@sky.ui/core` when your app uses both tiers.
-
-## Install
-
-```bash
-npx sky.ui.pro login
-npm install "@sky.ui.pro/core"
-```
-
-> Quote scoped names (`"@sky.ui/…"`) — required in PowerShell. See [powershell-scoped-packages.md](https://gitlab.com/sky_ui/sky-ui/-/blob/main/docs/powershell-scoped-packages.md).
-
-For CI/CD, set `SKY_UI_AUTH_TOKEN` to your account's CI/CD token before `npm ci`.
-
-Manage tokens on your [Sky UI account](https://library.sky-ui.com/account). No `.npmrc` file is required.
-
-| Token | Use |
-|-------|-----|
-| Personal (`sk_pt_…`) | Local development and MCP |
-| CI/CD (`sk_ci_…`) | Pipelines (`SKY_UI_AUTH_TOKEN`) |
-
-Peer dependencies match `@sky.ui/core` (`lit`, and optional `@lit-labs/motion`, `@lit-labs/virtualizer`, `@lit/context`, `d3`, `three`).
-
-## Quick start
-
-```js
-import { SkyTable, SkyFlow } from '@sky.ui.pro/core';
-```
-
-```html
-<sky-table></sky-table>
-```
-
-Import only the Pro components you use for tree-shaken production bundles.
-
-Per-component paths are also supported:
-
-```js
-import '@sky.ui.pro/core/sky-table';
-```
-
-## Auto-import resolvers
-
-Use resolvers from `@sky.ui.pro/core/auto-import` with `unplugin-vue-components` or your bundler's component plugin, alongside the free-tier setup in [`@sky.ui/core`](https://www.npmjs.com/package/@sky.ui/core).
-
-## Bundler plugins (Vite, Webpack, Rollup)
-
-Pro packages mirror the free-tier plugin surface. Bundler plugins auto-import components and **validate your access token at build/dev time** (no runtime checks in shipped apps).
-
-**Vite** (`@sky.ui.pro/core/vite`):
-
-```js
-import { SkyUIProMainVitePlugin } from '@sky.ui.pro/core/vite';
-
-export default {
-  plugins: [
-    SkyUIProMainVitePlugin({
-      mode: 'auto-import', // or 'vue' with unplugin-vue-components
-    }),
-  ],
-};
-```
-
-**Webpack** (`@sky.ui.pro/core/webpack`): `SkyUIProMainWebpackPlugin()`
-
-**Rollup** (`@sky.ui.pro/core/rollup`): `SkyUIProMainRollupPlugin({ mode: 'auto-import' })`
-
-Vue / React Pro wrappers expose the same three bundlers at `@sky.ui.pro/vue/vite|webpack|rollup` and `@sky.ui.pro/react/vite|webpack|rollup`.
-
-For resolver-only setup, use `@sky.ui.pro/core/auto-import` with `unplugin-vue-components`, alongside [`@sky.ui/core`](https://www.npmjs.com/package/@sky.ui/core) bundler plugins for free components.
-
-## Framework wrappers
-
-| Package | Description |
-|---------|-------------|
-| [`@sky.ui.pro/vue`](https://www.npmjs.com/package/@sky.ui.pro/vue) | Vue 3 SFC wrappers |
-| [`@sky.ui.pro/react`](https://www.npmjs.com/package/@sky.ui.pro/react) | React wrappers |
-
-Free-tier equivalents: [`@sky.ui/vue`](https://www.npmjs.com/package/@sky.ui/vue), [`@sky.ui/react`](https://www.npmjs.com/package/@sky.ui/react).
-
-## Custom Elements Manifest
-
-Component metadata is published at `@sky.ui.pro/core/custom-elements.json`.
-
-## Updates window
-
-Annual plans include one year of updates. You keep using versions released during your active window even after it ends; renew to receive newer releases.
-
-## License
-
-[Sky UI Pro Commercial License](https://unpkg.com/@sky.ui.pro/core/LICENSE.md) — requires an active Sky UI Pro subscription.
-
-Documentation: [library.sky-ui.com](https://library.sky-ui.com)
+# @sky.ui.pro/core
+
+Pro-tier Lit web components for Sky UI. Extends the free catalog with advanced components such as data tables, flow editors, and rich inputs.
+
+Requires an active Sky UI Pro subscription. Install alongside `@sky.ui/core` when your app uses both tiers.
+
+## Install
+
+```bash
+npx sky.ui.pro login
+npx sky.ui.pro install
+```
+
+Or install manually, then hydrate:
+
+```bash
+npm install "@sky.ui.pro/core"
+npx sky.ui.pro install --framework=core
+```
+
+> Quote scoped names (`"@sky.ui/…"`) — required in PowerShell. See [powershell-scoped-packages.md](https://gitlab.com/sky_ui/sky-ui/-/blob/main/docs/powershell-scoped-packages.md).
+
+For CI/CD:
+
+```bash
+SKY_UI_AUTH_TOKEN=sk_ci_… npx sky.ui.pro install --yes --framework=core
+```
+
+Manage tokens on your [Sky UI account](https://library.sky-ui.com/account). No `.npmrc` file is required.
+
+| Token | Use |
+|-------|-----|
+| Personal (`sk_pt_…`) | Local development and MCP |
+| CI/CD (`sk_ci_…`) | Pipelines (`SKY_UI_AUTH_TOKEN`) |
+
+Peer dependencies match `@sky.ui/core` (`lit`, and optional `@lit-labs/motion`, `@lit-labs/virtualizer`, `@lit/context`, `d3`, `three`).
+
+## Quick start
+
+```js
+import { SkyTable, SkyFlow } from '@sky.ui.pro/core';
+```
+
+```html
+<sky-table></sky-table>
+```
+
+Import only the Pro components you use for tree-shaken production bundles.
+
+Per-component paths are also supported:
+
+```js
+import '@sky.ui.pro/core/sky-table';
+```
+
+## Auto-import resolvers
+
+Use resolvers from `@sky.ui.pro/core/auto-import` with `unplugin-vue-components` or your bundler's component plugin, alongside the free-tier setup in [`@sky.ui/core`](https://www.npmjs.com/package/@sky.ui/core).
+
+## Bundler plugins (Vite, Webpack, Rollup)
+
+Pro packages mirror the free-tier plugin surface. Bundler plugins auto-import components and **validate your access token at build/dev time** (no runtime checks in shipped apps).
+
+**Vite** (`@sky.ui.pro/core/vite`):
+
+```js
+import { SkyUIProMainVitePlugin } from '@sky.ui.pro/core/vite';
+
+export default {
+  plugins: [
+    SkyUIProMainVitePlugin({
+      mode: 'auto-import', // or 'vue' with unplugin-vue-components
+    }),
+  ],
+};
+```
+
+**Webpack** (`@sky.ui.pro/core/webpack`): `SkyUIProMainWebpackPlugin()`
+
+**Rollup** (`@sky.ui.pro/core/rollup`): `SkyUIProMainRollupPlugin({ mode: 'auto-import' })`
+
+Vue / React Pro wrappers expose the same three bundlers at `@sky.ui.pro/vue/vite|webpack|rollup` and `@sky.ui.pro/react/vite|webpack|rollup`.
+
+For resolver-only setup, use `@sky.ui.pro/core/auto-import` with `unplugin-vue-components`, alongside [`@sky.ui/core`](https://www.npmjs.com/package/@sky.ui/core) bundler plugins for free components.
+
+## Framework wrappers
+
+| Package | Description |
+|---------|-------------|
+| [`@sky.ui.pro/vue`](https://www.npmjs.com/package/@sky.ui.pro/vue) | Vue 3 SFC wrappers |
+| [`@sky.ui.pro/react`](https://www.npmjs.com/package/@sky.ui.pro/react) | React wrappers |
+
+Free-tier equivalents: [`@sky.ui/vue`](https://www.npmjs.com/package/@sky.ui/vue), [`@sky.ui/react`](https://www.npmjs.com/package/@sky.ui/react).
+
+## Custom Elements Manifest
+
+Component metadata is published at `@sky.ui.pro/core/custom-elements.json`.
+
+## Updates window
+
+Annual plans include one year of updates. You keep using versions released during your active window even after it ends; renew to receive newer releases.
+
+## License
+
+[Sky UI Pro Commercial License](https://unpkg.com/@sky.ui.pro/core/LICENSE.md) — requires an active Sky UI Pro subscription.
+
+Documentation: [library.sky-ui.com](https://library.sky-ui.com)

package/dist/stub/index.d.ts

@@ -0,0 +1,3 @@
+/** Stub entry — run `npx sky.ui.pro install` for the full Pro package. */
+declare const stub: Record<string, unknown>;
+export default stub;

package/dist/stub/index.js

@@ -1,2 +1,2 @@
-/** Placeholder until postinstall hydrates the full package from the private registry. */
-export default {};
+/** Placeholder until sky.ui.pro CLI hydrates the full package from the private registry. */
+export default {};

package/package.json

@@ -1,27 +1,34 @@
 {
   "name": "@sky.ui.pro/core",
-  "version": "0.0.6",
-  "description": "Sky UI Pro web components — installs full package via postinstall (online license).",
+  "version": "0.0.7",
+  "description": "Sky UI Pro web components — run npx sky.ui.pro install after npm install.",
+  "keywords": [
+    "sky-ui",
+    "pro",
+    "web-components",
+    "lit",
+    "design-system",
+    "ui"
+  ],
+  "author": "Sky UI",
+  "engines": {
+    "node": ">=18"
+  },
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
   "main": "./dist/stub/index.js",
+  "types": "./dist/stub/index.d.ts",
   "exports": {
     ".": "./dist/stub/index.js"
   },
   "files": [
-    "scripts",
     "dist/stub",
     "README.md",
-    "LICENSE.md"
+    "LICENSE.md",
+    "CHANGELOG.md"
   ],
-  "scripts": {
-    "postinstall": "node ./scripts/postinstall.mjs"
-  },
-  "dependencies": {
-    "tar": "^7.4.3"
-  },
   "peerDependencies": {
-    "@sky.ui/core": "^0.0.6",
+    "@sky.ui/core": "^0.0.7",
     "lit": ">=3 <4"
   },
   "peerDependenciesMeta": {

package/scripts/lib/merge-manifest.mjs

@@ -1,81 +0,0 @@
-/**
- * Merge public npm stub manifest with GitLab artifact manifest after postinstall hydration.
- */
-
-export const ARTIFACT_MANIFEST_SIDECAR = ".sky-ui-pro-artifact-manifest.json";
-
-const PRO_ARTIFACT_PREFIX = "@sky.ui.pro-artifact/";
-const PRO_PUBLIC_PREFIX = "@sky.ui.pro/";
-
-/** Rename @sky.ui.pro-artifact/* deps to @sky.ui.pro/* for installed packages. */
-export function renameProArtifactDeps(deps) {
-  if (!deps || typeof deps !== "object") return deps;
-  const out = { ...deps };
-  for (const [key, value] of Object.entries(out)) {
-    if (key.startsWith(PRO_ARTIFACT_PREFIX)) {
-      const next = `${PRO_PUBLIC_PREFIX}${key.slice(PRO_ARTIFACT_PREFIX.length)}`;
-      if (!(next in out)) out[next] = value;
-      delete out[key];
-    }
-  }
-  return out;
-}
-
-/** True when exports already point at hydrated artifact paths (not stub-only). */
-export function hasHydratedExports(manifest) {
-  const exp = manifest?.exports;
-  if (!exp || typeof exp !== "object") return false;
-  if (exp["./vite"] || exp["./webpack"] || exp["./rollup"] || exp["./license"]) return true;
-  const root = exp["."];
-  if (typeof root === "string") {
-    return root.includes("dist/index") || (root.includes("/dist/") && !root.includes("/stub/"));
-  }
-  if (root && typeof root === "object") {
-    const imp = root.import ?? root.default ?? root.module;
-    return typeof imp === "string" && imp.includes("dist/index");
-  }
-  return false;
-}
-
-/**
- * Build installed package.json: artifact resolution surface + public stub identity.
- * @param {Record<string, unknown>} stub
- * @param {Record<string, unknown>} artifact
- */
-export function mergeHydratedManifest(stub, artifact) {
-  const stubDeps = stub.dependencies && typeof stub.dependencies === "object" ? stub.dependencies : {};
-  const tarVersion = stubDeps.tar;
-
-  const merged = {
-    name: stub.name,
-    version: stub.version,
-    description: stub.description ?? artifact.description,
-    type: stub.type ?? artifact.type,
-    license: stub.license ?? artifact.license,
-    main: artifact.main,
-    module: artifact.module,
-    types: artifact.types,
-    sideEffects: artifact.sideEffects,
-    exports: artifact.exports,
-    peerDependencies: {
-      ...renameProArtifactDeps(artifact.peerDependencies),
-      ...(stub.peerDependencies ?? {}),
-    },
-    dependencies: {
-      ...renameProArtifactDeps(artifact.dependencies),
-      ...(tarVersion ? { tar: tarVersion } : {}),
-    },
-    scripts: stub.scripts?.postinstall ? { postinstall: stub.scripts.postinstall } : {},
-    skyUiPro: stub.skyUiPro,
-    publishConfig: stub.publishConfig,
-    repository: stub.repository,
-    bugs: stub.bugs,
-    homepage: stub.homepage,
-  };
-
-  if (artifact.peerDependenciesMeta && typeof artifact.peerDependenciesMeta === "object") {
-    merged.peerDependenciesMeta = artifact.peerDependenciesMeta;
-  }
-
-  return merged;
-}

package/scripts/lib/project-env.mjs

@@ -1,150 +0,0 @@
-#!/usr/bin/env node
-/**
- * Unified Sky UI Pro / CLI project `.env` loading.
- * Source of truth — synced to @sky.ui/cli and copied into @sky.ui.pro/* stubs on sync:pro-npm.
- *
- * Loads only `SKY_UI_*` keys. Shell env always wins (existing process.env is never overwritten).
- * Search order: INIT_CWD → npm local prefix → SKY_UI_PROJECT_ROOT → cwd → project roots.
- */
-import { access, readFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-
-export const SKY_UI_ENV_PREFIX = "SKY_UI_";
-
-/** Filenames tried in each project directory (later files override earlier within the same dir). */
-export const SKY_UI_ENV_FILES = [".env", ".env.local"];
-
-/** Documented variables (for README / tooling — not enforced here). */
-export const SKY_UI_ENV_VARS = [
-  "SKY_UI_API_URL",
-  "SKY_UI_AUTH_TOKEN",
-  "SKY_UI_PERSONAL_TOKEN",
-  "SKY_UI_PROJECT_ROOT",
-  "SKY_UI_PRO_FRAMEWORK",
-  "SKY_UI_PRO_LENIENT",
-  "SKY_UI_PRO_LICENSE_LENIENT",
-  "SKY_UI_PRO_SKIP_POSTINSTALL",
-  "SKY_UI_PRO_STRICT",
-  "SKY_UI_NPM_REGISTRY",
-];
-
-export async function pathExists(p) {
-  try {
-    await access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function normalizeDirKey(dir) {
-  return dir.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
-}
-
-function shouldLoadKey(key) {
-  return key.startsWith(SKY_UI_ENV_PREFIX);
-}
-
-function envAlreadySet(key) {
-  const v = process.env[key];
-  return typeof v === "string" && v.trim().length > 0;
-}
-
-function unquote(value) {
-  if (
-    (value.startsWith('"') && value.endsWith('"')) ||
-    (value.startsWith("'") && value.endsWith("'"))
-  ) {
-    return value.slice(1, -1);
-  }
-  return value;
-}
-
-/** Parse and apply one `.env` file. Does not overwrite non-empty process.env values. */
-export async function loadEnvFile(envFilePath) {
-  try {
-    const raw = await readFile(envFilePath, "utf8");
-    for (const line of raw.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq <= 0) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (!shouldLoadKey(key)) continue;
-      if (envAlreadySet(key)) continue;
-      process.env[key] = unquote(trimmed.slice(eq + 1).trim());
-    }
-  } catch {
-    /* missing or unreadable */
-  }
-}
-
-/** Load `.env` (+ `.env.local`) from a project directory. */
-export async function loadProjectEnv(cwd = process.cwd()) {
-  for (const name of SKY_UI_ENV_FILES) {
-    await loadEnvFile(join(cwd, name));
-  }
-}
-
-/** Walk up to find the nearest directory containing `package.json`. */
-export async function findProjectRoot(startDir, maxDepth = 12) {
-  let dir = startDir;
-  for (let i = 0; i < maxDepth; i++) {
-    if (await pathExists(join(dir, "package.json"))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return startDir;
-}
-
-/**
- * Directories to scan for `.env`, in priority order (first match wins per key;
- * later dirs only fill keys still unset).
- */
-export async function collectEnvSearchDirs(options = {}) {
-  const { pkgRoot, extraDirs = [] } = options;
-  const seen = new Set();
-  const ordered = [];
-
-  const push = (dir) => {
-    if (!dir || typeof dir !== "string") return;
-    const key = normalizeDirKey(dir);
-    if (seen.has(key)) return;
-    seen.add(key);
-    ordered.push(dir);
-  };
-
-  push(process.env.INIT_CWD);
-  push(process.env.npm_config_local_prefix);
-  push(process.env.SKY_UI_PROJECT_ROOT?.trim());
-  push(process.cwd());
-
-  const cwdRoot = await findProjectRoot(process.cwd());
-  push(cwdRoot);
-
-  if (pkgRoot) {
-    push(await findProjectRoot(dirname(pkgRoot)));
-  }
-
-  for (const dir of extraDirs) {
-    push(dir);
-  }
-
-  return ordered;
-}
-
-/**
- * Load Sky UI env from consumer project `.env` files.
- * @param {{ pkgRoot?: string, extraDirs?: string[] }} [options]
- */
-export async function loadConsumerProjectEnv(options = {}) {
-  for (const dir of await collectEnvSearchDirs(options)) {
-    await loadProjectEnv(dir);
-  }
-}
-
-/** @deprecated Alias used by postinstall — prefer loadConsumerProjectEnv */
-export async function loadInstallProjectEnv(pkgRoot) {
-  return loadConsumerProjectEnv({ pkgRoot });
-}

package/scripts/lib/token.mjs

@@ -1,147 +0,0 @@
-#!/usr/bin/env node
-/**
- * Shared token resolution and online license validation for @sky.ui.pro postinstall.
- */
-import { access, readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-export { loadConsumerProjectEnv, loadInstallProjectEnv } from "./project-env.mjs";
-
-export const SKY_UI_HOME = join(homedir(), ".sky.ui");
-export const LEGACY_SKY_UI_HOME = join(homedir(), ".sky-ui");
-export const cacheRoot = join(SKY_UI_HOME, "cache");
-export const legacyCacheRoot = join(LEGACY_SKY_UI_HOME, "cache");
-export const ENTITLEMENT_MARKER = ".sky-ui-pro-installed.json";
-
-export async function exists(p) {
-  try {
-    await access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export function resolveApiBase(pkg) {
-  const fromEnv = process.env.SKY_UI_API_URL?.trim();
-  if (fromEnv) return fromEnv.replace(/\/api\/?$/, "").replace(/\/$/, "");
-  const fromPkg = pkg?.skyUiPro?.apiBase?.trim();
-  if (fromPkg) return fromPkg.replace(/\/$/, "");
-  return "https://library.sky-ui.com";
-}
-
-export function licenseValidateUrl(apiBase) {
-  const host = String(apiBase).replace(/\/api\/?$/, "").replace(/\/$/, "");
-  return `${host}/api/license/validate`;
-}
-
-export async function resolveToken() {
-  const envCi = process.env.SKY_UI_AUTH_TOKEN?.trim();
-  if (envCi) return envCi;
-  const envPersonal = process.env.SKY_UI_PERSONAL_TOKEN?.trim();
-  if (envPersonal) return envPersonal;
-  for (const credPath of [
-    join(SKY_UI_HOME, "credentials.json"),
-    join(LEGACY_SKY_UI_HOME, "credentials.json"),
-  ]) {
-    if (!(await exists(credPath))) continue;
-    const creds = JSON.parse(await readFile(credPath, "utf8"));
-    if (typeof creds.personalToken === "string" && creds.personalToken.trim()) {
-      return creds.personalToken.trim();
-    }
-    if (typeof creds.authToken === "string" && creds.authToken.trim()) {
-      return creds.authToken.trim();
-    }
-  }
-  return null;
-}
-
-export function isAccessTokenFormat(token) {
-  return typeof token === "string" && (token.startsWith("sk_pt_") || token.startsWith("sk_ci_"));
-}
-
-/**
- * @returns {{ active: boolean, status?: string, error?: string, renewalEmailSent?: boolean }}
- */
-export async function validateAccessTokenOnline(token, apiBase) {
-  if (!token || !isAccessTokenFormat(token)) {
-    return { active: false, status: "missing" };
-  }
-  try {
-    const res = await fetch(licenseValidateUrl(apiBase), {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json",
-        Accept: "application/json",
-      },
-      body: "{}",
-    });
-    const data = await res.json().catch(() => ({}));
-    if (res.ok && data.active) {
-      return { active: true, status: "active", tokenKind: data.tokenKind };
-    }
-    return {
-      active: false,
-      status: data.status ?? (res.status === 401 ? "invalid" : "inactive"),
-      error: data.error,
-      renewalEmailSent: Boolean(data.renewalEmailSent),
-    };
-  } catch (err) {
-    return {
-      active: false,
-      status: "network_error",
-      error: err instanceof Error ? err.message : String(err),
-    };
-  }
-}
-
-export function formatRenewalEmailHint(result) {
-  if (!result?.renewalEmailSent) return "";
-  return "\n  Renewal instructions were sent to your account email.\n  https://library.sky-ui.com/pricing";
-}
-
-export function isInstallStrict() {
-  if (process.env.SKY_UI_PRO_LENIENT === "1") return false;
-  if (process.env.SKY_UI_PRO_STRICT === "0") return false;
-  return true;
-}
-
-export function entitlementMarkerPath(pkgRoot) {
-  return join(pkgRoot, ENTITLEMENT_MARKER);
-}
-
-export async function writeEntitlementMarker(pkgRoot, { name, version, status = "active" }) {
-  const { writeFile } = await import("node:fs/promises");
-  await writeFile(
-    entitlementMarkerPath(pkgRoot),
-    `${JSON.stringify(
-      {
-        name,
-        version,
-        status,
-        validatedAt: new Date().toISOString(),
-      },
-      null,
-      2,
-    )}\n`,
-    "utf8",
-  );
-}
-
-/** True when package was not hydrated (stub-only install). */
-export async function isStubOnlyPackage(pkgRoot) {
-  const pluginsDir = join(pkgRoot, "plugins", "vite-plugin.js");
-  if (await exists(pluginsDir)) return false;
-  const distIndex = join(pkgRoot, "dist", "index.js");
-  if (await exists(distIndex)) return false;
-  const stubPath = join(pkgRoot, "dist", "stub", "index.js");
-  if (!(await exists(stubPath))) return true;
-  try {
-    const stub = await readFile(stubPath, "utf8");
-    return /export\s+default\s+\{\s*\}/.test(stub);
-  } catch {
-    return true;
-  }
-}

package/scripts/postinstall.mjs

@@ -1,287 +0,0 @@
-#!/usr/bin/env node
-/**
- * Downloads the full @sky.ui.pro/* artifact from the Sky UI npm proxy (GitLab upstream).
- * Cache restore re-validates the access token; install fails closed without a valid token.
- */
-import { createWriteStream } from "node:fs";
-import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { pipeline } from "node:stream/promises";
-import { extract } from "tar";
-import {
-  ARTIFACT_MANIFEST_SIDECAR,
-  hasHydratedExports,
-  mergeHydratedManifest,
-} from "./lib/merge-manifest.mjs";
-import {
-  ENTITLEMENT_MARKER,
-  cacheRoot,
-  exists,
-  isInstallStrict,
-  legacyCacheRoot,
-  loadInstallProjectEnv,
-  resolveApiBase,
-  resolveToken,
-  validateAccessTokenOnline,
-  writeEntitlementMarker,
-  formatRenewalEmailHint,
-} from "./lib/token.mjs";
-
-const scriptDir = dirname(fileURLToPath(import.meta.url));
-const pkgRoot = join(scriptDir, "..");
-
-const SKIP_COPY_TO_INSTALL = new Set([ENTITLEMENT_MARKER, ARTIFACT_MANIFEST_SIDECAR]);
-
-async function readJson(p) {
-  return JSON.parse(await readFile(p, "utf8"));
-}
-
-async function writeJson(p, data) {
-  await writeFile(p, `${JSON.stringify(data, null, 2)}\n`, "utf8");
-}
-
-function packageSlug(name) {
-  return name.replace(/^@/, "").replace("/", "-");
-}
-
-function cacheVersionDir(root, slug, version) {
-  return join(root, slug, version);
-}
-
-async function copyDirectoryContents(src, dest, { skip = SKIP_COPY_TO_INSTALL } = {}) {
-  await mkdir(dest, { recursive: true });
-  for (const entry of await readdir(src, { withFileTypes: true })) {
-    if (skip.has(entry.name)) continue;
-    await cp(join(src, entry.name), join(dest, entry.name), { recursive: true, force: true });
-  }
-}
-
-/** Drop cached versions other than the one being installed (HeroUI cache policy). */
-async function enforceCachePolicy(slug, version) {
-  const slugDir = join(cacheRoot, slug);
-  if (!(await exists(slugDir))) return;
-  for (const entry of await readdir(slugDir, { withFileTypes: true })) {
-    if (entry.name === version || entry.name === ".gitignore") continue;
-    await rm(join(slugDir, entry.name), { recursive: true, force: true });
-  }
-}
-
-async function readArtifactManifestSidecar(cacheDir) {
-  const sidecar = join(cacheDir, ARTIFACT_MANIFEST_SIDECAR);
-  if (!(await exists(sidecar))) return null;
-  return readJson(sidecar);
-}
-
-/** Read artifact package.json from cached tarball (legacy caches without sidecar). */
-async function readArtifactManifestFromTarball(slug, version) {
-  const tgz = join(cacheRoot, `${slug}-${version}.tgz`);
-  if (!(await exists(tgz))) return null;
-  const stagingDir = await mkdtemp(join(tmpdir(), `sky.ui.pro-manifest-${slug}-${version}-`));
-  try {
-    await extract({ file: tgz, cwd: stagingDir, strip: 1 });
-    return readJson(join(stagingDir, "package.json"));
-  } catch {
-    return null;
-  } finally {
-    await rm(stagingDir, { recursive: true, force: true });
-  }
-}
-
-async function resolveArtifactManifest(stubManifest, slug, version, cacheDir) {
-  const sidecar = cacheDir ? await readArtifactManifestSidecar(cacheDir) : null;
-  if (sidecar) return sidecar;
-  return readArtifactManifestFromTarball(slug, version);
-}
-
-async function applyHydratedManifest(targetRoot, stubManifest, artifactManifest) {
-  const merged = mergeHydratedManifest(stubManifest, artifactManifest);
-  await writeJson(join(targetRoot, "package.json"), merged);
-  return merged;
-}
-
-async function finalizeHydratedManifest(targetRoot, stubManifest, slug, version, cacheDir) {
-  const current = await readJson(join(targetRoot, "package.json"));
-  if (hasHydratedExports(current)) {
-    return current;
-  }
-  const artifactManifest = await resolveArtifactManifest(stubManifest, slug, version, cacheDir);
-  if (!artifactManifest) return current;
-  return applyHydratedManifest(targetRoot, stubManifest, artifactManifest);
-}
-
-async function restoreFromCache(slug, version, target, stubManifest) {
-  for (const root of [cacheRoot, legacyCacheRoot]) {
-    const src = cacheVersionDir(root, slug, version);
-    if (!(await exists(src))) continue;
-    const entries = await readdir(src);
-    if (entries.length === 0) continue;
-    await copyDirectoryContents(src, target);
-    await finalizeHydratedManifest(target, stubManifest, slug, version, src);
-    return { cacheDir: src };
-  }
-  return null;
-}
-
-async function saveToCache(slug, version, source, artifactManifest) {
-  const dest = cacheVersionDir(cacheRoot, slug, version);
-  await rm(dest, { recursive: true, force: true });
-  await mkdir(dest, { recursive: true });
-  await copyDirectoryContents(source, dest);
-  if (artifactManifest) {
-    await writeJson(join(dest, ARTIFACT_MANIFEST_SIDECAR), artifactManifest);
-  }
-}
-
-async function invalidateCache(slug, version) {
-  for (const root of [cacheRoot, legacyCacheRoot]) {
-    const dir = cacheVersionDir(root, slug, version);
-    if (await exists(dir)) {
-      await rm(dir, { recursive: true, force: true });
-    }
-  }
-  const tgz = join(cacheRoot, `${slug}-${version}.tgz`);
-  if (await exists(tgz)) await rm(tgz, { force: true });
-}
-
-function tarballFileName(name, version) {
-  return `${name.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
-}
-
-function tarballUrl(apiBase, name, version) {
-  const base = apiBase.replace(/\/$/, "");
-  const scopePath = name.replace("/", "%2f");
-  const file = tarballFileName(name, version);
-  return `${base}/npm/${scopePath}/-/${file}`;
-}
-
-function printMissingToken(name, apiBase) {
-  console.warn(`
-[@sky.ui.pro] Missing install token — ${name} was not downloaded.
-
-  Local dev:
-    npx sky.ui.pro login
-    or  export SKY_UI_PERSONAL_TOKEN=sk_pt_…
-
-  CI / pipelines:
-    export SKY_UI_AUTH_TOKEN=sk_ci_…
-
-  Or add SKY_UI_PERSONAL_TOKEN / SKY_UI_AUTH_TOKEN to your project .env
-  API host (SKY_UI_API_URL): ${apiBase}
-
-  Then re-run:  npm install "${name}"
-  Docs: https://library.sky-ui.com/docs/getting-started
-
-  Maintainer escape hatch: SKY_UI_PRO_LENIENT=1
-`);
-}
-
-function printInvalidToken(name, result, apiBase) {
-  console.error(
-    `[@sky.ui.pro] License validation failed for ${name}: ${result.status ?? "inactive"}${
-      result.error ? ` — ${result.error}` : ""
-    }`,
-  );
-  console.error(`[@sky.ui.pro] API host: ${apiBase}`);
-  const renewalHint = formatRenewalEmailHint(result);
-  console.error(`
-  Renew or regenerate your token, then re-run:  npm install "${name}"${renewalHint}
-`);
-}
-
-async function installFromTarball(tgzPath, slug, version, stubManifest) {
-  const stagingDir = await mkdtemp(join(tmpdir(), `sky.ui.pro-${slug}-${version}-`));
-  try {
-    await extract({ file: tgzPath, cwd: stagingDir, strip: 1 });
-    const artifactManifest = await readJson(join(stagingDir, "package.json"));
-    await copyDirectoryContents(stagingDir, pkgRoot);
-    await applyHydratedManifest(pkgRoot, stubManifest, artifactManifest);
-    await saveToCache(slug, version, pkgRoot, artifactManifest);
-  } finally {
-    await rm(stagingDir, { recursive: true, force: true });
-  }
-}
-
-async function main() {
-  if (process.env.SKY_UI_PRO_SKIP_POSTINSTALL === "1") return;
-
-  await loadInstallProjectEnv(pkgRoot);
-
-  const pkg = await readJson(join(pkgRoot, "package.json"));
-  const { name, version } = pkg;
-  if (!name?.startsWith("@sky.ui.pro/") || !version) {
-    console.warn("[@sky.ui.pro] postinstall: invalid package.json name/version");
-    return;
-  }
-
-  const stubManifest = structuredClone(pkg);
-  const slug = packageSlug(name);
-  const apiBase = resolveApiBase(pkg);
-  const strict = isInstallStrict();
-
-  await enforceCachePolicy(slug, version);
-
-  const token = await resolveToken();
-  const cacheAvailable =
-    (await exists(cacheVersionDir(cacheRoot, slug, version))) ||
-    (await exists(cacheVersionDir(legacyCacheRoot, slug, version)));
-
-  if (cacheAvailable) {
-    if (!token) {
-      printMissingToken(name, apiBase);
-      if (strict) process.exit(1);
-      return;
-    }
-    const validation = await validateAccessTokenOnline(token, apiBase);
-    if (validation.active) {
-      if (await restoreFromCache(slug, version, pkgRoot, stubManifest)) {
-        await writeEntitlementMarker(pkgRoot, { name, version, status: validation.status ?? "active" });
-        console.log(`[@sky.ui.pro] Restored ${name}@${version} from cache.`);
-        return;
-      }
-    } else {
-      printInvalidToken(name, validation, apiBase);
-      await invalidateCache(slug, version);
-      if (strict) process.exit(1);
-      return;
-    }
-  }
-
-  if (!token) {
-    printMissingToken(name, apiBase);
-    if (strict) process.exit(1);
-    return;
-  }
-
-  const preDownloadValidation = await validateAccessTokenOnline(token, apiBase);
-  if (!preDownloadValidation.active) {
-    printInvalidToken(name, preDownloadValidation, apiBase);
-    if (strict) process.exit(1);
-    return;
-  }
-
-  const url = tarballUrl(apiBase, name, version);
-  const res = await fetch(url, {
-    headers: { Authorization: `Bearer ${token}`, Accept: "application/octet-stream" },
-  });
-
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    console.error(`[@sky.ui.pro] Download failed (${res.status}) ${url}`);
-    if (body) console.error(body.slice(0, 500));
-    process.exit(1);
-  }
-
-  await mkdir(cacheRoot, { recursive: true });
-  const tgzPath = join(cacheRoot, `${slug}-${version}.tgz`);
-  await pipeline(res.body, createWriteStream(tgzPath));
-  await installFromTarball(tgzPath, slug, version, stubManifest);
-  await writeEntitlementMarker(pkgRoot, { name, version, status: "active" });
-  console.log(`[@sky.ui.pro] Installed ${name}@${version}`);
-}
-
-main().catch((err) => {
-  console.error("[@sky.ui.pro] postinstall error:", err instanceof Error ? err.message : err);
-  process.exit(1);
-});