@soku-ai/cli 0.1.0-alpha.0

package/dist/http/client.d.ts

@@ -0,0 +1,12 @@
+/** Thin fetch wrapper that injects the bearer token + active workspace headers,
+ * and translates the server's auth errors into the CLI's exit-code contract. */
+interface RequestOptions {
+    method?: string;
+    body?: unknown;
+    /** Require the active org/brand headers (data endpoints). */
+    workspace?: boolean;
+    apiBase?: string;
+}
+export declare function apiRequest<T = unknown>(path: string, opts?: RequestOptions): Promise<T>;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/http/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA;gFACgF;AAMhF,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CA6EjG"}

package/dist/http/client.js

@@ -0,0 +1,91 @@
+/** Thin fetch wrapper that injects the bearer token + active workspace headers,
+ * and translates the server's auth errors into the CLI's exit-code contract. */
+import { clearToken, loadToken } from '../auth/store.js';
+import { loadConfig, resolveApiBaseUrl } from '../config.js';
+import { emitError, ExitCode } from '../output/envelope.js';
+export async function apiRequest(path, opts = {}) {
+    const token = await loadToken();
+    if (!token) {
+        emitError('not_authenticated', 'No Soku session found.', ExitCode.AUTH, 'Run `soku auth login` (or set SOKU_TOKEN).');
+    }
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+    };
+    if (opts.body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    if (opts.workspace) {
+        const cfg = loadConfig();
+        const orgId = process.env.SOKU_ORG_ID || cfg.activeOrgId;
+        const brandId = process.env.SOKU_BRAND_ID || cfg.activeBrandId;
+        if (!orgId || !brandId) {
+            emitError('no_workspace', 'No active workspace selected.', ExitCode.USAGE, 'Run `soku org use <id>` then `soku brand use <id>`.');
+        }
+        headers['X-Soku-Org'] = orgId;
+        headers['X-Soku-Brand'] = brandId;
+    }
+    const base = resolveApiBaseUrl(opts.apiBase);
+    let res;
+    try {
+        res = await fetch(`${base}${path}`, {
+            method: opts.method ?? 'GET',
+            headers,
+            body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+        });
+    }
+    catch (err) {
+        return emitError('network_error', `Could not reach ${base}: ${err.message}`, ExitCode.RUNTIME, 'Behind a proxy? Set ALL_PROXY.');
+    }
+    const text = await res.text();
+    const parsed = text ? safeJson(text) : null;
+    if (res.status === 401) {
+        // Any 401 means this token is no longer usable (expired, revoked, deleted
+        // key, or rotated signing key). Drop it so the next run re-authenticates
+        // cleanly instead of looping on a dead credential.
+        const code = parsed?.error ?? 'unauthorized';
+        await clearToken();
+        return emitError('unauthorized', `Authentication failed (${code}).`, ExitCode.AUTH, 'Run `soku auth login`.');
+    }
+    if (res.status === 403) {
+        return emitError('forbidden', describeError(parsed) ?? 'Access denied.', ExitCode.AUTH);
+    }
+    if (res.status === 404) {
+        return emitError('not_found', describeError(parsed) ?? 'Not found.', ExitCode.NOT_FOUND);
+    }
+    if (res.status >= 400) {
+        return emitError('request_failed', describeError(parsed) ?? `HTTP ${res.status}`, ExitCode.RUNTIME);
+    }
+    return parsed;
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function describeError(parsed) {
+    if (parsed && typeof parsed === 'object') {
+        const obj = parsed;
+        const detail = obj.detail;
+        if (detail?.message)
+            return String(detail.message);
+        // The shared data dispatcher returns { ok: false, error: <string | object> }.
+        // Unwrap a nested error object so the user sees the real message, not
+        // "[object Object]".
+        if (obj.error && typeof obj.error === 'object') {
+            const err = obj.error;
+            if (err.message)
+                return String(err.message);
+            if (err.code)
+                return String(err.code);
+        }
+        if (obj.error)
+            return String(obj.error);
+        if (obj.message)
+            return String(obj.message);
+    }
+    return null;
+}
+//# sourceMappingURL=client.js.map

package/dist/http/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA;gFACgF;AAEhF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAU3D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAc,IAAY,EAAE,OAAuB,EAAE;IACnF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,CACP,mBAAmB,EACnB,wBAAwB,EACxB,QAAQ,CAAC,IAAI,EACb,4CAA4C,CAC7C,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,MAAM,EAAE,kBAAkB;KAC3B,CAAA;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;IAEzE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAA;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAA;QAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,SAAS,CACP,cAAc,EACd,+BAA+B,EAC/B,QAAQ,CAAC,KAAK,EACd,qDAAqD,CACtD,CAAA;QACH,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;QAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAA;IACnC,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACtE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,SAAS,CACd,eAAe,EACf,mBAAmB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EACpD,QAAQ,CAAC,OAAO,EAChB,gCAAgC,CACjC,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,0EAA0E;QAC1E,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,IAAI,GAAI,MAAoC,EAAE,KAAK,IAAI,cAAc,CAAA;QAC3E,MAAM,UAAU,EAAE,CAAA;QAClB,OAAO,SAAS,CACd,cAAc,EACd,0BAA0B,IAAI,IAAI,EAClC,QAAQ,CAAC,IAAI,EACb,wBAAwB,CACzB,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IACrG,CAAC;IAED,OAAO,MAAW,CAAA;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAiC,CAAA;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAA6C,CAAA;QAChE,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAClD,8EAA8E;QAC9E,sEAAsE;QACtE,qBAAqB;QACrB,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAgC,CAAA;YAChD,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+/** Soku CLI entry point. */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,4BAA4B"}

package/dist/index.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/** Soku CLI entry point. */
+import { Command } from 'commander';
+import { registerAuthCommands } from './commands/auth.js';
+import { registerBrandCommands } from './commands/brand.js';
+import { registerCallCommand } from './commands/call.js';
+import { registerEgressCommands } from './commands/egress.js';
+import { registerGeneratedCommands } from './commands/generated.js';
+import { registerOrgCommands } from './commands/org.js';
+import { registerResourceCommands } from './commands/resources.js';
+import { registerReviewCommands } from './commands/review.js';
+import { registerSkillCommand } from './commands/skill.js';
+import { maybeNotifyUpdate, registerUpdateCheckCommand } from './update-check.js';
+import { emitError, ExitCode } from './output/envelope.js';
+import { CLI_VERSION } from './version.js';
+const program = new Command();
+program
+    .name('soku')
+    .description('Call Soku ads/GA4 data capabilities from any AI agent or shell.')
+    .version(CLI_VERSION);
+registerAuthCommands(program);
+registerOrgCommands(program);
+registerBrandCommands(program);
+registerResourceCommands(program);
+registerGeneratedCommands(program);
+registerCallCommand(program);
+registerEgressCommands(program);
+registerReviewCommands(program);
+registerSkillCommand(program);
+registerUpdateCheckCommand(program);
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    if (actionCommand.name() === 'update-check')
+        return;
+    await maybeNotifyUpdate();
+});
+program.parseAsync(process.argv).catch((err) => {
+    emitError('unexpected', err instanceof Error ? err.message : String(err), ExitCode.RUNTIME);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,4BAA4B;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,iEAAiE,CAAC;KAC9E,OAAO,CAAC,WAAW,CAAC,CAAA;AAEvB,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAA;AACjC,yBAAyB,CAAC,OAAO,CAAC,CAAA;AAClC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAA;AAEnC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;IAC9D,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,cAAc;QAAE,OAAM;IACnD,MAAM,iBAAiB,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA;AAEF,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtD,SAAS,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC7F,CAAC,CAAC,CAAA"}

package/dist/output/envelope.d.ts

@@ -0,0 +1,45 @@
+/** Output + exit-code conventions shared by every command.
+ *
+ * Agents/pipes get JSON (`!isTty()`); humans at a terminal get a readable view
+ * (tables, friendly lines). Pass a `human` renderer to `emitSuccess` for the
+ * TTY view; without one it falls back to pretty JSON. Errors are a structured
+ * envelope on stderr (JSON when piped, a colored line at a TTY) with a semantic
+ * exit code.
+ */
+export declare const ExitCode: {
+    readonly OK: 0;
+    readonly USAGE: 1;
+    readonly AUTH: 2;
+    readonly NOT_FOUND: 4;
+    readonly RUNTIME: 5;
+};
+export type ExitCodeValue = (typeof ExitCode)[keyof typeof ExitCode];
+export interface ErrorEnvelope {
+    ok: false;
+    error: {
+        type: string;
+        message: string;
+        hint?: string;
+    };
+}
+export declare function isTty(): boolean;
+export declare const bold: (t: string) => string;
+export declare const dim: (t: string) => string;
+export declare const green: (t: string) => string;
+export declare const red: (t: string) => string;
+export declare const cyan: (t: string) => string;
+export interface Column {
+    key: string;
+    header: string;
+}
+/** Render an aligned text table from a list of row objects. */
+export declare function table(rows: Array<Record<string, unknown>>, columns: Column[]): string;
+/** Print a success result and exit 0.
+ *
+ * @param data    machine-readable payload (always used for the JSON/agent path)
+ * @param human   optional renderer for the TTY view; receives `data`
+ */
+export declare function emitSuccess<T>(data: T, human?: (data: T) => string): never;
+/** Print a structured error to stderr and exit with the given code. */
+export declare function emitError(type: string, message: string, code?: ExitCodeValue, hint?: string): never;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/output/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/output/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAA;IACT,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,wBAAgB,KAAK,IAAI,OAAO,CAE/B;AAMD,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,WAAkB,CAAA;AAChD,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,WAAkB,CAAA;AAC/C,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,WAAmB,CAAA;AAClD,eAAO,MAAM,GAAG,GAAI,GAAG,MAAM,WAAmB,CAAA;AAChD,eAAO,MAAM,IAAI,GAAI,GAAG,MAAM,WAAmB,CAAA;AAEjD,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAaD,+DAA+D;AAC/D,wBAAgB,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAcrF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAAG,KAAK,CAS1E;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAgC,EACtC,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAaP"}

package/dist/output/envelope.js

@@ -0,0 +1,86 @@
+/** Output + exit-code conventions shared by every command.
+ *
+ * Agents/pipes get JSON (`!isTty()`); humans at a terminal get a readable view
+ * (tables, friendly lines). Pass a `human` renderer to `emitSuccess` for the
+ * TTY view; without one it falls back to pretty JSON. Errors are a structured
+ * envelope on stderr (JSON when piped, a colored line at a TTY) with a semantic
+ * exit code.
+ */
+export const ExitCode = {
+    OK: 0,
+    USAGE: 1,
+    AUTH: 2,
+    NOT_FOUND: 4,
+    RUNTIME: 5,
+};
+export function isTty() {
+    return Boolean(process.stdout.isTTY);
+}
+// ── Minimal ANSI styling (no dependency); no-op when not a TTY ──────────────
+function style(code, text) {
+    return isTty() ? `\x1b[${code}m${text}\x1b[0m` : text;
+}
+export const bold = (t) => style('1', t);
+export const dim = (t) => style('2', t);
+export const green = (t) => style('32', t);
+export const red = (t) => style('31', t);
+export const cyan = (t) => style('36', t);
+// eslint-disable-next-line no-control-regex
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+/** Visible length, ignoring ANSI color escapes (so colored cells align). */
+function visibleLen(s) {
+    return s.replace(ANSI_RE, '').length;
+}
+/** padEnd that accounts for invisible ANSI escapes in the value. */
+function padVisible(s, width) {
+    return s + ' '.repeat(Math.max(0, width - visibleLen(s)));
+}
+/** Render an aligned text table from a list of row objects. */
+export function table(rows, columns) {
+    if (rows.length === 0)
+        return dim('(none)');
+    const cell = (r, k) => {
+        const v = r[k];
+        return v === null || v === undefined ? '' : String(v);
+    };
+    const widths = columns.map((c) => Math.max(c.header.length, ...rows.map((r) => visibleLen(cell(r, c.key)))));
+    const line = (cells) => cells.map((c, i) => padVisible(c, widths[i])).join('  ');
+    const header = bold(line(columns.map((c) => c.header)));
+    const body = rows.map((r) => line(columns.map((c) => cell(r, c.key)))).join('\n');
+    return `${header}\n${body}`;
+}
+/** Print a success result and exit 0.
+ *
+ * @param data    machine-readable payload (always used for the JSON/agent path)
+ * @param human   optional renderer for the TTY view; receives `data`
+ */
+export function emitSuccess(data, human) {
+    if (!isTty()) {
+        process.stdout.write(`${JSON.stringify({ ok: true, data })}\n`);
+    }
+    else if (human) {
+        process.stdout.write(`${human(data)}\n`);
+    }
+    else {
+        process.stdout.write(`${JSON.stringify(data, null, 2)}\n`);
+    }
+    process.exit(ExitCode.OK);
+}
+/** Print a structured error to stderr and exit with the given code. */
+export function emitError(type, message, code = ExitCode.RUNTIME, hint) {
+    if (isTty()) {
+        let out = `${red('✖')} ${message}`;
+        if (hint)
+            out += `\n  ${dim(hint)}`;
+        process.stderr.write(`${out}\n`);
+    }
+    else {
+        const envelope = {
+            ok: false,
+            error: { type, message, ...(hint ? { hint } : {}) },
+        };
+        process.stderr.write(`${JSON.stringify(envelope)}\n`);
+    }
+    process.exit(code);
+}
+//# sourceMappingURL=envelope.js.map

package/dist/output/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/output/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,SAAS,EAAE,CAAC;IACZ,OAAO,EAAE,CAAC;CACF,CAAA;AAaV,MAAM,UAAU,KAAK;IACnB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtC,CAAC;AAED,+EAA+E;AAC/E,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AACD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAChD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC/C,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAClD,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAChD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAOjD,4CAA4C;AAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAA;AACjC,4EAA4E;AAC5E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;AACtC,CAAC;AACD,oEAAoE;AACpE,SAAS,UAAU,CAAC,CAAS,EAAE,KAAa;IAC1C,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,KAAK,CAAC,IAAoC,EAAE,OAAiB;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,CAAS,EAAU,EAAE;QAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACd,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAA;IACD,MAAM,IAAI,GAAG,CAAC,KAAe,EAAU,EAAE,CACvC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAI,IAAO,EAAE,KAA2B;IACjE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC3B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,OAAe,EACf,OAAsB,QAAQ,CAAC,OAAO,EACtC,IAAa;IAEb,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAA;QAClC,IAAI,IAAI;YAAE,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAA;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAkB;YAC9B,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpD,CAAA;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC"}

package/dist/output/unwrap.d.ts

@@ -0,0 +1,11 @@
+/** Collapse the data dispatcher's result envelope to a single layer.
+ *
+ * `/api/cli/call/*` returns the shared dispatcher envelope `{ ok, data, error }`.
+ * Without unwrapping, the CLI's own `emitSuccess` would nest it a second time
+ * (`{ ok: true, data: { ok: true, data: ... } }`). Callers pass the raw result
+ * through this first so success output is a single `{ ok: true, data: ... }`.
+ */
+/** Return the dispatcher's inner `data`, or exit with a structured error when
+ * the dispatcher reported `ok: false`. Non-envelope results pass through. */
+export declare function unwrapDispatch(result: unknown): unknown;
+//# sourceMappingURL=unwrap.d.ts.map

package/dist/output/unwrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unwrap.d.ts","sourceRoot":"","sources":["../../src/output/unwrap.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmBH;6EAC6E;AAC7E,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAavD"}

package/dist/output/unwrap.js

@@ -0,0 +1,33 @@
+/** Collapse the data dispatcher's result envelope to a single layer.
+ *
+ * `/api/cli/call/*` returns the shared dispatcher envelope `{ ok, data, error }`.
+ * Without unwrapping, the CLI's own `emitSuccess` would nest it a second time
+ * (`{ ok: true, data: { ok: true, data: ... } }`). Callers pass the raw result
+ * through this first so success output is a single `{ ok: true, data: ... }`.
+ */
+import { emitError, ExitCode } from './envelope.js';
+function isDispatchEnvelope(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'ok' in value &&
+        typeof value.ok === 'boolean');
+}
+/** Return the dispatcher's inner `data`, or exit with a structured error when
+ * the dispatcher reported `ok: false`. Non-envelope results pass through. */
+export function unwrapDispatch(result) {
+    if (!isDispatchEnvelope(result))
+        return result;
+    if (result.ok)
+        return result.data ?? null;
+    const err = result.error;
+    let message = 'Action failed.';
+    if (typeof err === 'string') {
+        message = err;
+    }
+    else if (err && typeof err === 'object') {
+        const obj = err;
+        message = String(obj.message ?? obj.code ?? JSON.stringify(err));
+    }
+    return emitError('action_failed', message, ExitCode.RUNTIME);
+}
+//# sourceMappingURL=unwrap.js.map

package/dist/output/unwrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unwrap.js","sourceRoot":"","sources":["../../src/output/unwrap.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAQnD,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,IAAI,IAAI,KAAK;QACb,OAAQ,KAAyB,CAAC,EAAE,KAAK,SAAS,CACnD,CAAA;AACH,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC9C,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,IAAI,IAAI,CAAA;IAEzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;IACxB,IAAI,OAAO,GAAG,gBAAgB,CAAA;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,GAAG,CAAA;IACf,CAAC;SAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,GAA8B,CAAA;QAC1C,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC9D,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,24 @@
+/** Resolve a user-supplied reference (id, slug, or name) to a list item. */
+interface Named {
+    id: string;
+    slug?: string | null;
+    name?: string | null;
+}
+export type MatchResult<T> = {
+    kind: 'match';
+    item: T;
+} | {
+    kind: 'ambiguous';
+    matches: T[];
+} | {
+    kind: 'none';
+};
+/**
+ * Resolve a reference by exact id, then exact slug (both unique), then
+ * case-insensitive name. Names are NOT unique, so a name that matches more than
+ * one item returns ``ambiguous`` (the caller should ask for a slug/id) rather
+ * than silently picking the first.
+ */
+export declare function matchRef<T extends Named>(items: T[], ref: string): MatchResult<T>;
+export {};
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,UAAU,KAAK;IACb,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,CAAC,EAAE,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAajF"}

package/dist/resolve.js

@@ -0,0 +1,24 @@
+/** Resolve a user-supplied reference (id, slug, or name) to a list item. */
+/**
+ * Resolve a reference by exact id, then exact slug (both unique), then
+ * case-insensitive name. Names are NOT unique, so a name that matches more than
+ * one item returns ``ambiguous`` (the caller should ask for a slug/id) rather
+ * than silently picking the first.
+ */
+export function matchRef(items, ref) {
+    const r = ref.trim();
+    const byId = items.find((i) => i.id === r);
+    if (byId)
+        return { kind: 'match', item: byId };
+    const bySlug = items.find((i) => i.slug != null && i.slug === r);
+    if (bySlug)
+        return { kind: 'match', item: bySlug };
+    const lower = r.toLowerCase();
+    const byName = items.filter((i) => (i.name ?? '').toLowerCase() === lower);
+    if (byName.length === 1)
+        return { kind: 'match', item: byName[0] };
+    if (byName.length > 1)
+        return { kind: 'ambiguous', matches: byName };
+    return { kind: 'none' };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAa5E;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAkB,KAAU,EAAE,GAAW;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1C,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAE9C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IAChE,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAElD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACpE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC"}

package/dist/skills/unzip.d.ts

@@ -0,0 +1,14 @@
+/** Safe in-memory unzip for skill bundles downloaded from the CDN.
+ *
+ * Mirrors the server's `packages/services/marketplace/zip_safety.py` rules so a
+ * bundle the packer produces is one the CLI will accept: strip a single top
+ * folder, reject path traversal / absolute / backslash / symlink-ish paths,
+ * enforce an extension whitelist + count/size caps, and require SKILL.md at the
+ * (stripped) root. Pure — returns a relpath→bytes map without touching disk, so
+ * it is unit-testable and the caller decides where to write. */
+export declare class UnzipError extends Error {
+    constructor(message: string);
+}
+/** Unzip + validate; returns a stripped relpath → bytes map. Throws UnzipError. */
+export declare function safeUnzip(data: Uint8Array): Map<string, Uint8Array>;
+//# sourceMappingURL=unzip.d.ts.map

package/dist/skills/unzip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unzip.d.ts","sourceRoot":"","sources":["../../src/skills/unzip.ts"],"names":[],"mappings":"AAAA;;;;;;;gEAOgE;AAUhE,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AA+BD,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAoCnE"}

package/dist/skills/unzip.js

@@ -0,0 +1,86 @@
+/** Safe in-memory unzip for skill bundles downloaded from the CDN.
+ *
+ * Mirrors the server's `packages/services/marketplace/zip_safety.py` rules so a
+ * bundle the packer produces is one the CLI will accept: strip a single top
+ * folder, reject path traversal / absolute / backslash / symlink-ish paths,
+ * enforce an extension whitelist + count/size caps, and require SKILL.md at the
+ * (stripped) root. Pure — returns a relpath→bytes map without touching disk, so
+ * it is unit-testable and the caller decides where to write. */
+import { unzipSync } from 'fflate';
+const ALLOWED_EXTENSIONS = new Set(['.md', '.json', '.txt', '.yaml', '.yml', '.csv']);
+const MAX_FILE_COUNT = 100;
+const MAX_SINGLE_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+const SKILL_MANIFEST = 'SKILL.md';
+export class UnzipError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UnzipError';
+    }
+}
+function isMacMetadata(name) {
+    if (name.startsWith('__MACOSX/') || name.includes('/__MACOSX/'))
+        return true;
+    const base = name.split('/').pop() ?? '';
+    return base === '.DS_Store' || base.startsWith('._');
+}
+/** If every entry sits under the same top-level dir, return that dir; else null. */
+function singleTopFolder(names) {
+    const first = names[0].split('/', 1)[0];
+    if (!first || first === names[0])
+        return null; // already flat
+    const ok = names.every((n) => n.startsWith(`${first}/`) && n !== `${first}/`);
+    return ok ? first : null;
+}
+function checkPath(rel) {
+    if (!rel || rel.startsWith('/') || rel.includes('\\')) {
+        throw new UnzipError(`unsafe path: ${rel}`);
+    }
+    if (rel.split('/').some((seg) => seg === '..' || seg === '.')) {
+        throw new UnzipError(`path traversal: ${rel}`);
+    }
+}
+function extOf(rel) {
+    const base = rel.split('/').pop() ?? '';
+    const dot = base.lastIndexOf('.');
+    return dot >= 0 ? base.slice(dot).toLowerCase() : '';
+}
+/** Unzip + validate; returns a stripped relpath → bytes map. Throws UnzipError. */
+export function safeUnzip(data) {
+    let raw;
+    try {
+        raw = unzipSync(data);
+    }
+    catch (err) {
+        throw new UnzipError(`corrupt zip: ${err.message}`);
+    }
+    const names = Object.keys(raw).filter((n) => !n.endsWith('/') && !isMacMetadata(n));
+    if (names.length === 0)
+        throw new UnzipError('empty zip');
+    if (names.length > MAX_FILE_COUNT) {
+        throw new UnzipError(`too many files: ${names.length} > ${MAX_FILE_COUNT}`);
+    }
+    const top = singleTopFolder(names);
+    const out = new Map();
+    let total = 0;
+    for (const name of names) {
+        const rel = top ? name.slice(top.length + 1) : name;
+        checkPath(rel);
+        if (!ALLOWED_EXTENSIONS.has(extOf(rel))) {
+            throw new UnzipError(`disallowed extension: ${rel}`);
+        }
+        const bytes = raw[name];
+        if (bytes.length > MAX_SINGLE_FILE_BYTES) {
+            throw new UnzipError(`file too large: ${rel} (${bytes.length}B)`);
+        }
+        total += bytes.length;
+        if (total > MAX_TOTAL_BYTES)
+            throw new UnzipError(`bundle too large: ${total}B`);
+        out.set(rel, bytes);
+    }
+    if (!out.has(SKILL_MANIFEST)) {
+        throw new UnzipError(`${SKILL_MANIFEST} required at bundle root`);
+    }
+    return out;
+}
+//# sourceMappingURL=unzip.js.map

package/dist/skills/unzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unzip.js","sourceRoot":"","sources":["../../src/skills/unzip.ts"],"names":[],"mappings":"AAAA;;;;;;;gEAOgE;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAElC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AACrF,MAAM,cAAc,GAAG,GAAG,CAAA;AAC1B,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC9C,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,cAAc,GAAG,UAAU,CAAA;AAEjC,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAe;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,eAAe;IAC7D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAA;IAC7E,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,UAAU,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,IAAI,GAA+B,CAAA;IACnC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,gBAAiB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAAC,mBAAmB,KAAK,CAAC,MAAM,MAAM,cAAc,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAA;IACzC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACnD,SAAS,CAAC,GAAG,CAAC,CAAA;QACd,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,UAAU,CAAC,mBAAmB,GAAG,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;QACrB,IAAI,KAAK,GAAG,eAAe;YAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAA;QAChF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,GAAG,cAAc,0BAA0B,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/update-check.d.ts

@@ -0,0 +1,24 @@
+import { Command } from 'commander';
+export interface UpdateCheckResult {
+    packageName: string;
+    currentVersion: string;
+    latestVersion: string | null;
+    published: boolean;
+    updateAvailable: boolean;
+    installCommand: string;
+    checkedAt: string;
+    registryUrl: string;
+}
+interface CheckOptions {
+    currentVersion?: string;
+    registryUrl?: string;
+    useCache?: boolean;
+    fetchImpl?: typeof fetch;
+    now?: Date;
+}
+export declare function compareSemverish(a: string, b: string): number;
+export declare function checkForUpdate(opts?: CheckOptions): Promise<UpdateCheckResult>;
+export declare function maybeNotifyUpdate(): Promise<void>;
+export declare function registerUpdateCheckCommand(program: Command): void;
+export {};
+//# sourceMappingURL=update-check.d.ts.map

package/dist/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBnC,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,UAAU,YAAY;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAgED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAwBD,wBAAsB,cAAc,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwCxF;AASD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAavD;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+BjE"}