@tankpkg/cli 0.4.2

package/dist/commands/link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../../src/commands/link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAuB,EAAE;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,UAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACrD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;IAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;QAC5D,CAAC,CAAC,UAAU,CAAC,WAAW;QACxB,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,SAAS,GAAG,oBAAoB,CAAC;gBAC/B,SAAS;gBACT,UAAU,EAAE,OAAO;gBACnB,kBAAkB,EAAE,uBAAuB,CAAC,OAAO,CAAC;gBACpD,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,oBAAoB,CAAC;YAC/B,SAAS;YACT,UAAU,EAAE,OAAO;YACnB,kBAAkB,EAAE,uBAAuB,CAAC,OAAO,CAAC;YACpD,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACrC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,UAAU,SAAS,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;AAC5E,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,14 @@
+export interface LoginOptions {
+    configDir?: string;
+    timeout?: number;
+    pollInterval?: number;
+}
+/**
+ * Start the CLI login flow:
+ * 1. Generate random state
+ * 2. POST /api/v1/cli-auth/start → get authUrl + sessionCode
+ * 3. Open browser to authUrl
+ * 4. Poll POST /api/v1/cli-auth/exchange until authorized or timeout
+ * 5. Write token + user to config
+ */
+export declare function loginCommand(options?: LoginOptions): Promise<void>;

package/dist/commands/login.js

@@ -0,0 +1,87 @@
+import open from 'open';
+import { getConfig, setConfig } from '../lib/config.js';
+import { logger } from '../lib/logger.js';
+import { authFlowLog } from '../lib/debug-logger.js';
+const DEFAULT_POLL_INTERVAL_MS = 2000;
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Start the CLI login flow:
+ * 1. Generate random state
+ * 2. POST /api/v1/cli-auth/start → get authUrl + sessionCode
+ * 3. Open browser to authUrl
+ * 4. Poll POST /api/v1/cli-auth/exchange until authorized or timeout
+ * 5. Write token + user to config
+ */
+export async function loginCommand(options = {}) {
+    const { configDir, timeout = DEFAULT_TIMEOUT_MS, pollInterval = DEFAULT_POLL_INTERVAL_MS, } = options;
+    const config = getConfig(configDir);
+    const baseUrl = config.registry;
+    // Step 1: Generate random state for CSRF protection
+    const state = crypto.randomUUID();
+    authFlowLog.info({ state: state.slice(0, 8) + '...' }, 'Login flow started');
+    // Step 2: Start auth session
+    logger.info('Starting login...');
+    const startRes = await fetch(`${baseUrl}/api/v1/cli-auth/start`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ state }),
+    });
+    if (!startRes.ok) {
+        const body = await startRes.json().catch(() => ({}));
+        authFlowLog.error({ status: startRes.status, error: body.error }, 'Start request failed');
+        throw new Error(`Failed to start auth session: ${body.error ?? startRes.statusText}`);
+    }
+    authFlowLog.info({ ok: startRes.ok, status: startRes.status }, 'Start response received');
+    const { authUrl, sessionCode } = (await startRes.json());
+    authFlowLog.info({ authUrl, sessionCode: sessionCode.slice(0, 8) + '...' }, 'Session created, opening browser');
+    // Step 3: Open browser
+    try {
+        await open(authUrl);
+        logger.info('Opened browser for authentication.');
+    }
+    catch {
+        // Browser failed to open — print URL for manual copy
+        logger.warn('Could not open browser automatically.');
+        logger.info(`Open this URL in your browser:\n  ${authUrl}`);
+    }
+    logger.info('Waiting for authorization...');
+    // Step 4: Poll exchange endpoint
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline) {
+        try {
+            const exchangeRes = await fetch(`${baseUrl}/api/v1/cli-auth/exchange`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ sessionCode, state }),
+            });
+            authFlowLog.debug({ status: exchangeRes.status, ok: exchangeRes.ok }, 'Exchange poll response');
+            if (exchangeRes.ok) {
+                const { token, user } = (await exchangeRes.json());
+                authFlowLog.info({ userName: user.name, userEmail: user.email }, 'Login successful, saving config');
+                // Step 5: Write to config
+                setConfig({ token, user: user }, configDir);
+                const displayName = user.name ?? user.email ?? 'unknown';
+                logger.success(`Logged in as ${displayName}`);
+                return;
+            }
+            // 400 means session not yet authorized — keep polling
+            // Any other error is unexpected
+            if (exchangeRes.status !== 400) {
+                const body = await exchangeRes.json().catch(() => ({}));
+                throw new Error(`Exchange failed: ${body.error ?? exchangeRes.statusText}`);
+            }
+        }
+        catch (err) {
+            authFlowLog.warn({ error: err instanceof Error ? err.message : String(err) }, 'Exchange poll error');
+            // If it's our own thrown error, re-throw
+            if (err instanceof Error && err.message.startsWith('Exchange failed:')) {
+                throw err;
+            }
+            // Network errors during polling are transient — keep trying
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    authFlowLog.error({}, 'Login timed out');
+    throw new Error('Login timed out. Please try again.');
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAQtD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAwB,EAAE;IAC3D,MAAM,EACJ,SAAS,EACT,OAAO,GAAG,kBAAkB,EAC5B,YAAY,GAAG,wBAAwB,GACxC,GAAG,OAAO,CAAC;IACZ,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEhC,oDAAoD;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE7E,6BAA6B;IAC7B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,wBAAwB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAG,IAA2B,CAAC,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAClH,MAAM,IAAI,KAAK,CACb,iCAAkC,IAA2B,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAE1F,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGtD,CAAC;IACF,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,kCAAkC,CAAC,CAAC;IAEhH,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAE5C,iCAAiC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IAEtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,2BAA2B,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAEhG,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;gBACnB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAGhD,CAAC;gBAEF,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;gBAEpG,0BAA0B;gBAC1B,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAuC,EAAE,EAAE,SAAS,CAAC,CAAC;gBAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;gBACzD,MAAM,CAAC,OAAO,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,sDAAsD;YACtD,gCAAgC;YAChC,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,oBAAqB,IAA2B,CAAC,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,CACnF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACrG,yCAAyC;YACzC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,4DAA4D;QAC9D,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACxD,CAAC"}

package/dist/commands/logout.d.ts

@@ -0,0 +1,9 @@
+export interface LogoutOptions {
+    configDir?: string;
+}
+/**
+ * Logout command: Remove token and user from config.
+ * If not logged in, prints "Not logged in" and returns.
+ * If logged in, removes token and user, prints success message.
+ */
+export declare function logoutCommand(options?: LogoutOptions): Promise<void>;

package/dist/commands/logout.js

@@ -0,0 +1,20 @@
+import { getConfig, setConfig } from '../lib/config.js';
+import { logger } from '../lib/logger.js';
+/**
+ * Logout command: Remove token and user from config.
+ * If not logged in, prints "Not logged in" and returns.
+ * If logged in, removes token and user, prints success message.
+ */
+export async function logoutCommand(options = {}) {
+    const { configDir } = options;
+    const config = getConfig(configDir);
+    // Check if logged in
+    if (!config.token) {
+        logger.warn('Not logged in. Run: tank login');
+        return;
+    }
+    // Remove token and user from config
+    setConfig({ token: undefined, user: undefined }, configDir);
+    logger.success('Logged out');
+}
+//# sourceMappingURL=logout.js.map

package/dist/commands/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAyB,EAAE;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAEpC,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,oCAAoC;IACpC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/permissions.d.ts

@@ -0,0 +1,4 @@
+export interface PermissionsOptions {
+    directory?: string;
+}
+export declare function permissionsCommand(options?: PermissionsOptions): Promise<void>;

package/dist/commands/permissions.js

@@ -0,0 +1,199 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import chalk from 'chalk';
+/**
+ * Parse a lockfile key like "@org/skill@1.0.0" into the skill name "@org/skill".
+ */
+function parseSkillName(key) {
+    const lastAt = key.lastIndexOf('@');
+    // For scoped packages, lastIndexOf('@') finds the version separator
+    // e.g. "@org/skill@1.0.0" → lastAt = 10, name = "@org/skill"
+    if (lastAt > 0) {
+        return key.slice(0, lastAt);
+    }
+    return key;
+}
+function collectPermissions(lockfile) {
+    const networkMap = new Map();
+    const fsReadMap = new Map();
+    const fsWriteMap = new Map();
+    const subprocessSkills = [];
+    for (const [key, entry] of Object.entries(lockfile.skills)) {
+        const skillName = parseSkillName(key);
+        const perms = entry.permissions;
+        if (perms.network?.outbound) {
+            for (const domain of perms.network.outbound) {
+                const existing = networkMap.get(domain) ?? [];
+                existing.push(skillName);
+                networkMap.set(domain, existing);
+            }
+        }
+        if (perms.filesystem?.read) {
+            for (const p of perms.filesystem.read) {
+                const existing = fsReadMap.get(p) ?? [];
+                existing.push(skillName);
+                fsReadMap.set(p, existing);
+            }
+        }
+        if (perms.filesystem?.write) {
+            for (const p of perms.filesystem.write) {
+                const existing = fsWriteMap.get(p) ?? [];
+                existing.push(skillName);
+                fsWriteMap.set(p, existing);
+            }
+        }
+        if (perms.subprocess === true) {
+            subprocessSkills.push(skillName);
+        }
+    }
+    const toEntries = (map) => Array.from(map.entries()).map(([value, skills]) => ({ value, skills }));
+    return {
+        networkOutbound: toEntries(networkMap),
+        filesystemRead: toEntries(fsReadMap),
+        filesystemWrite: toEntries(fsWriteMap),
+        subprocess: subprocessSkills,
+    };
+}
+/**
+ * Check if a domain is allowed by the budget's domain list.
+ * Supports wildcard matching: *.example.com matches sub.example.com
+ */
+function isDomainAllowed(domain, allowedDomains) {
+    for (const allowed of allowedDomains) {
+        if (allowed === domain)
+            return true;
+        if (allowed.startsWith('*.')) {
+            const suffix = allowed.slice(1);
+            if (domain.endsWith(suffix) || domain === allowed.slice(2)) {
+                return true;
+            }
+            if (domain === allowed)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a path is allowed by the budget's path list.
+ */
+function isPathAllowed(requestedPath, allowedPaths) {
+    for (const allowed of allowedPaths) {
+        if (allowed === requestedPath)
+            return true;
+        if (allowed.endsWith('/**')) {
+            const prefix = allowed.slice(0, -3);
+            if (requestedPath.startsWith(prefix))
+                return true;
+        }
+    }
+    return false;
+}
+function checkBudget(resolved, budget) {
+    const violations = [];
+    const budgetDomains = budget.network?.outbound ?? [];
+    for (const entry of resolved.networkOutbound) {
+        if (!isDomainAllowed(entry.value, budgetDomains)) {
+            violations.push({
+                category: 'network outbound',
+                value: entry.value,
+                skills: entry.skills,
+            });
+        }
+    }
+    const budgetReadPaths = budget.filesystem?.read ?? [];
+    for (const entry of resolved.filesystemRead) {
+        if (!isPathAllowed(entry.value, budgetReadPaths)) {
+            violations.push({
+                category: 'filesystem read',
+                value: entry.value,
+                skills: entry.skills,
+            });
+        }
+    }
+    const budgetWritePaths = budget.filesystem?.write ?? [];
+    for (const entry of resolved.filesystemWrite) {
+        if (!isPathAllowed(entry.value, budgetWritePaths)) {
+            violations.push({
+                category: 'filesystem write',
+                value: entry.value,
+                skills: entry.skills,
+            });
+        }
+    }
+    if (resolved.subprocess.length > 0 && budget.subprocess !== true) {
+        violations.push({
+            category: 'subprocess',
+            value: 'subprocess access',
+            skills: resolved.subprocess,
+        });
+    }
+    return violations;
+}
+function formatAttribution(skills) {
+    return chalk.gray('← ' + skills.join(', '));
+}
+function printPermissionSection(title, entries) {
+    console.log(`\n${chalk.bold(title)}:`);
+    if (entries.length === 0) {
+        console.log('  none');
+    }
+    else {
+        for (const entry of entries) {
+            console.log(`  ${entry.value}    ${formatAttribution(entry.skills)}`);
+        }
+    }
+}
+export async function permissionsCommand(options) {
+    const dir = options?.directory ?? process.cwd();
+    const lockfilePath = path.join(dir, 'skills.lock');
+    // 1. Read lockfile
+    if (!fs.existsSync(lockfilePath)) {
+        console.log('No skills installed.');
+        return;
+    }
+    const lockfileContent = fs.readFileSync(lockfilePath, 'utf-8');
+    const lockfile = JSON.parse(lockfileContent);
+    if (!lockfile.skills || Object.keys(lockfile.skills).length === 0) {
+        console.log('No skills installed.');
+        return;
+    }
+    // 2. Collect permissions
+    const resolved = collectPermissions(lockfile);
+    // 3. Display
+    console.log('\nResolved permissions for this project:\n');
+    printPermissionSection('Network (outbound)', resolved.networkOutbound);
+    printPermissionSection('Filesystem (read)', resolved.filesystemRead);
+    printPermissionSection('Filesystem (write)', resolved.filesystemWrite);
+    // Subprocess section
+    console.log(`\n${chalk.bold('Subprocess')}:`);
+    if (resolved.subprocess.length === 0) {
+        console.log('  none');
+    }
+    else {
+        console.log(`  allowed    ${formatAttribution(resolved.subprocess)}`);
+    }
+    // 4. Budget check
+    const skillsJsonPath = path.join(dir, 'skills.json');
+    let budget;
+    if (fs.existsSync(skillsJsonPath)) {
+        const skillsJsonContent = fs.readFileSync(skillsJsonPath, 'utf-8');
+        const skillsJson = JSON.parse(skillsJsonContent);
+        budget = skillsJson.permissions;
+    }
+    console.log('');
+    if (!budget) {
+        console.log(`Budget status: ${chalk.yellow('⚠ No budget defined')}`);
+        return;
+    }
+    const violations = checkBudget(resolved, budget);
+    if (violations.length === 0) {
+        console.log(`Budget status: ${chalk.green('✓ PASS')} (all within budget)`);
+    }
+    else {
+        console.log(`Budget status: ${chalk.red('✗ FAIL')}`);
+        for (const v of violations) {
+            console.log(chalk.red(`  - ${v.category}: "${v.value}" not in budget (requested by ${v.skills.join(', ')})`));
+        }
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/commands/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/commands/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAO1B;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,SAAS,kBAAkB,CAAC,QAAoB;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC;QAEhC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC9B,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAA0B,EAAqB,EAAE,CAClE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,eAAe,EAAE,SAAS,CAAC,UAAU,CAAC;QACtC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC;QACpC,eAAe,EAAE,SAAS,CAAC,UAAU,CAAC;QACtC,UAAU,EAAE,gBAAgB;KAC7B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,cAAwB;IAC/D,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,aAAqB,EAAE,YAAsB;IAClE,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,SAAS,WAAW,CAClB,QAA6B,EAC7B,MAAmB;IAEnB,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACjE,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,QAAQ,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,OAA0B;IAE1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEnD,mBAAmB;IACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAe,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEzD,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAE9C,aAAa;IACb,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAE1D,sBAAsB,CAAC,oBAAoB,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACvE,sBAAsB,CAAC,mBAAmB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACrE,sBAAsB,CAAC,oBAAoB,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEvE,qBAAqB;IACrB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gBAAgB,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,kBAAkB;IAClB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,MAA+B,CAAC;IAEpC,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,MAAM,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,UAAU,GAAe,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7D,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC;IAClC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,KAAK,iCAAiC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/publish.d.ts

@@ -0,0 +1,25 @@
+export interface PublishOptions {
+    directory?: string;
+    configDir?: string;
+    dryRun?: boolean;
+    private?: boolean;
+    visibility?: string;
+}
+/**
+ * Format bytes into a human-readable size string.
+ */
+export declare function formatSize(bytes: number): string;
+/**
+ * Publish a skill package to the Tank registry.
+ *
+ * Flow:
+ * 1. Check auth (token exists)
+ * 2. Read skills.json from directory
+ * 3. Pack directory into tarball
+ * 4. If --dry-run: print summary and exit
+ * 5. POST /api/v1/skills with manifest → get uploadUrl, skillId, versionId
+ * 6. PUT tarball to uploadUrl
+ * 7. POST /api/v1/skills/confirm with integrity data
+ * 8. Print success
+ */
+export declare function publishCommand(options?: PublishOptions): Promise<void>;

package/dist/commands/publish.js

@@ -0,0 +1,166 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import ora from 'ora';
+import { getConfig } from '../lib/config.js';
+import { logger } from '../lib/logger.js';
+import { pack } from '../lib/packer.js';
+import { USER_AGENT } from '../version.js';
+/**
+ * Format bytes into a human-readable size string.
+ */
+export function formatSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/**
+ * Publish a skill package to the Tank registry.
+ *
+ * Flow:
+ * 1. Check auth (token exists)
+ * 2. Read skills.json from directory
+ * 3. Pack directory into tarball
+ * 4. If --dry-run: print summary and exit
+ * 5. POST /api/v1/skills with manifest → get uploadUrl, skillId, versionId
+ * 6. PUT tarball to uploadUrl
+ * 7. POST /api/v1/skills/confirm with integrity data
+ * 8. Print success
+ */
+export async function publishCommand(options = {}) {
+    const { directory = process.cwd(), configDir, dryRun = false, private: privateFlag, visibility } = options;
+    // 1. Check auth
+    const config = getConfig(configDir);
+    if (!config.token) {
+        throw new Error('Not logged in. Run: tank login');
+    }
+    // 2. Read skills.json
+    const skillsJsonPath = path.join(directory, 'skills.json');
+    if (!fs.existsSync(skillsJsonPath)) {
+        throw new Error(`No skills.json found in ${directory}. Run: tank init`);
+    }
+    let manifest;
+    try {
+        const raw = fs.readFileSync(skillsJsonPath, 'utf-8');
+        manifest = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('Failed to read or parse skills.json');
+    }
+    if (visibility && visibility !== 'public' && visibility !== 'private') {
+        throw new Error("Invalid visibility. Use 'public' or 'private'");
+    }
+    const effectiveVisibility = visibility ?? (privateFlag ? 'private' : undefined);
+    if (effectiveVisibility) {
+        manifest.visibility = effectiveVisibility;
+    }
+    const name = manifest.name;
+    const version = manifest.version;
+    // 3. Pack
+    const spinner = ora('Packing...').start();
+    let packResult;
+    try {
+        packResult = await pack(directory);
+    }
+    catch (err) {
+        spinner.fail('Packing failed');
+        throw err;
+    }
+    const { tarball, integrity, fileCount, totalSize, readme, files } = packResult;
+    // 4. Dry run — print summary, verify auth with server, and exit
+    if (dryRun) {
+        spinner.stop();
+        logger.info(`name:    ${name}`);
+        logger.info(`version: ${version}`);
+        logger.info(`visibility: ${String(manifest.visibility ?? 'default')}`);
+        logger.info(`size:    ${formatSize(totalSize)} (${fileCount} files)`);
+        logger.info(`tarball: ${formatSize(tarball.length)} (compressed)`);
+        // Verify token with server to catch stale auth before real publish
+        try {
+            const verifyRes = await fetch(`${config.registry}/api/v1/auth/whoami`, {
+                method: 'GET',
+                headers: {
+                    'Authorization': `Bearer ${config.token}`,
+                    'User-Agent': USER_AGENT,
+                },
+            });
+            if (verifyRes.status === 401) {
+                logger.warn('Token is invalid or expired. Run: tank login');
+            }
+            else if (!verifyRes.ok) {
+                logger.warn('Could not verify token with server. Publish may fail.');
+            }
+            else {
+                logger.success('Auth verified with server.');
+            }
+        }
+        catch {
+            logger.warn('Could not reach server to verify token. Publish may fail.');
+        }
+        logger.success('Dry run complete — no files were uploaded.');
+        return;
+    }
+    // 5. Step 1: POST /api/v1/skills
+    spinner.text = 'Publishing...';
+    const headers = {
+        'Authorization': `Bearer ${config.token}`,
+        'Content-Type': 'application/json',
+        'User-Agent': USER_AGENT,
+    };
+    const step1Res = await fetch(`${config.registry}/api/v1/skills`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ manifest, readme, files }),
+    });
+    if (!step1Res.ok) {
+        spinner.fail('Publish failed');
+        const body = await step1Res.json().catch(() => ({}));
+        const errorMsg = body.error ?? step1Res.statusText;
+        if (step1Res.status === 401) {
+            throw new Error('Authentication failed. Your token may be expired or invalid. Run: tank login');
+        }
+        if (step1Res.status === 403) {
+            throw new Error(`Publish failed: ${errorMsg}`);
+        }
+        if (step1Res.status === 404) {
+            throw new Error(`Publish failed: ${errorMsg}`);
+        }
+        if (step1Res.status === 409) {
+            throw new Error('Version already exists. Bump the version in skills.json');
+        }
+        throw new Error(errorMsg);
+    }
+    const { uploadUrl, versionId } = (await step1Res.json());
+    // 6. Step 2: Upload tarball to signed URL
+    spinner.text = 'Uploading...';
+    const uploadRes = await fetch(uploadUrl, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/octet-stream' },
+        body: new Uint8Array(tarball),
+    });
+    if (!uploadRes.ok) {
+        spinner.fail('Upload failed');
+        throw new Error(`Failed to upload tarball: ${uploadRes.status} ${uploadRes.statusText}`);
+    }
+    // 7. Step 3: Confirm publish
+    spinner.text = 'Confirming...';
+    const confirmRes = await fetch(`${config.registry}/api/v1/skills/confirm`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({
+            versionId,
+            integrity,
+            fileCount,
+            tarballSize: totalSize,
+            readme,
+        }),
+    });
+    if (!confirmRes.ok) {
+        spinner.fail('Publish confirmation failed');
+        const body = await confirmRes.json().catch(() => ({}));
+        throw new Error(`Failed to confirm publish: ${body.error ?? confirmRes.statusText}`);
+    }
+    spinner.succeed(`Published ${name}@${version} (${formatSize(totalSize)}, ${fileCount} files)`);
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAU3C;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IACtC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAA0B,EAAE;IAC/D,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAE3G,gBAAgB;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,sBAAsB;IACtB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,kBAAkB,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACrD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,mBAAmB,GAAG,UAAU,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,mBAAmB,EAAE,CAAC;QACxB,QAAQ,CAAC,UAAU,GAAG,mBAAmB,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAc,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAiB,CAAC;IAE3C,UAAU;IACV,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1C,IAAI,UAA4C,CAAC;IACjD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAE/E,gEAAgE;IAChE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,SAAS,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEnE,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,qBAAqB,EAAE;gBACrE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;oBACzC,YAAY,EAAE,UAAU;iBACzB;aACF,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;iBAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,OAAO,CAAC,IAAI,GAAG,eAAe,CAAC;IAC/B,MAAM,OAAO,GAAG;QACd,eAAe,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;QACzC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,UAAU;KACzB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,gBAAgB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC;QAEnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAItD,CAAC;IAEF,0CAA0C;IAC1C,OAAO,CAAC,IAAI,GAAG,cAAc,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACvC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;QACvD,IAAI,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,IAAI,GAAG,eAAe,CAAC;IAC/B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,wBAAwB,EAAE;QACzE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS;YACT,SAAS;YACT,SAAS;YACT,WAAW,EAAE,SAAS;YACtB,MAAM;SACP,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;QAC7E,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,SAAS,CAAC,CAAC;AACjG,CAAC"}

package/dist/commands/remove.d.ts

@@ -0,0 +1,7 @@
+export interface RemoveOptions {
+    name: string;
+    directory?: string;
+    global?: boolean;
+    homedir?: string;
+}
+export declare function removeCommand(options: RemoveOptions): Promise<void>;