@xopcai/xopc 0.0.29 → 0.0.31

package/dist/src/agent/skills/marketplace/adapters/skillhub/registry-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/skillhub/registry-client.ts"],"sourcesContent":["/**\n * HTTP client for api.skillhub.cn (registry: detail, files, versions, batch, skillsets, download).\n */\n\nimport { fetch } from 'undici';\nimport { MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\n\nconst SKILLHUB_API_BASE = 'https://api.skillhub.cn';\n\n/** Max bytes when fetching SKILL.md / README for marketplace preview (redirects to COS). */\nexport const MAX_SKILLHUB_README_BYTES = 512 * 1024;\n\nfunction basenameSkillPath(p: string): string {\n  const norm = p.replace(/\\\\/g, '/');\n  const parts = norm.split('/');\n  return parts[parts.length - 1] || norm;\n}\n\n/**\n * Prefer SKILL.md, then README.md, then HOW_TO_USE.md (basename match, any directory depth).\n */\nexport function pickSkillHubDocFilePath(files: SkillHubFile[]): string | null {\n  const rows = files.map((f) => ({\n    path: f.path.replace(/\\\\/g, '/'),\n    base: basenameSkillPath(f.path).toLowerCase(),\n  }));\n  const firstBase = (name: string) => rows.find((r) => r.base === name.toLowerCase());\n  const skillMd = firstBase('SKILL.md') ?? firstBase('skill.md');\n  if (skillMd) return skillMd.path;\n  const readme = firstBase('README.md') ?? firstBase('readme.md');\n  if (readme) return readme.path;\n  const how = firstBase('HOW_TO_USE.md');\n  if (how) return how.path;\n  return null;\n}\n\nfunction assertSkillHubReadmeResponseUrl(finalUrl: string): void {\n  let u: URL;\n  try {\n    u = new URL(finalUrl);\n  } catch {\n    throw new Error('Invalid SkillHub file response URL');\n  }\n  if (u.protocol !== 'https:') {\n    throw new Error('SkillHub file response must use HTTPS');\n  }\n  const host = u.hostname.toLowerCase();\n  if (host === 'api.skillhub.cn') return;\n  if (host.endsWith('.myqcloud.com')) return;\n  throw new Error('SkillHub file redirect host is not allowlisted');\n}\n\n/**\n * Fetches a single text file from the registry (follows redirect to COS when applicable).\n */\nexport async function getSkillHubSkillFileText(\n  slug: string,\n  filePath: string,\n  version?: string,\n): Promise<string> {\n  const enc = encodeURIComponent(slug.trim());\n  const normPath = filePath.replace(/\\\\/g, '/');\n  const sp = new URLSearchParams({ path: normPath });\n  if (version?.trim()) sp.set('version', version.trim());\n  const url = `${SKILLHUB_API_BASE}/api/v1/skills/${enc}/file?${sp.toString()}`;\n  const res = await fetch(url, {\n    redirect: 'follow',\n    headers: { Accept: 'text/markdown,text/plain,*/*' },\n  });\n  if (!res.ok) {\n    const text = await res.text().catch(() => '');\n    let msg = `SkillHub file request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { message?: string; error?: string };\n      if (typeof j.message === 'string') msg = j.message;\n      else if (typeof j.error === 'string') msg = j.error;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  assertSkillHubReadmeResponseUrl(res.url);\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILLHUB_README_BYTES) {\n      throw new Error(`SkillHub file exceeds maximum size (${MAX_SKILLHUB_README_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  if (ab.byteLength > MAX_SKILLHUB_README_BYTES) {\n    throw new Error(`SkillHub file exceeds maximum size (${MAX_SKILLHUB_README_BYTES} bytes)`);\n  }\n  return new TextDecoder('utf-8').decode(ab);\n}\n\n/** skillhub.cn skill metadata */\nexport interface SkillHubSkill {\n  slug: string;\n  displayName: string;\n  summary: string;\n  summary_zh?: string;\n  category: string;\n  iconUrl: string | null;\n  source: string;\n  labels: {\n    requires_api_key?: string;\n  };\n  stats: {\n    downloads: number;\n    installs: number;\n    stars: number;\n    comments: number;\n    versions: number;\n  };\n  createdAt: number;\n  updatedAt: number;\n  tags: Record<string, string>;\n}\n\nexport interface SkillHubSkillDetail {\n  skill: SkillHubSkill;\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    createdAt: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n  owner: {\n    handle: string;\n    displayName: string;\n    image: string | null;\n  };\n}\n\nexport interface SkillHubFile {\n  path: string;\n  sha256: string;\n  size: number;\n}\n\nexport interface SkillHubVersion {\n  slug: string;\n  version: string;\n  createdAt: number;\n  changelog: string | null;\n  securityReports?: {\n    keen?: { status: string; statusText: string; reportUrl?: string };\n    sanbu?: { status: string; statusText: string; reportUrl?: string };\n  };\n}\n\nexport interface SkillHubSkillset {\n  id: number;\n  slug: string;\n  displayName: string;\n  summary: string;\n  scene: string;\n  subScene: string;\n  content: string;\n  skillSlugs: string[];\n  skillCount: number;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface SkillHubSkillsetListResponse {\n  skillSets: SkillHubSkillset[];\n  total: number;\n}\n\n/** Official taxonomy from GET /api/v1/categories (registry). */\nexport interface SkillHubRegistryCategoryItem {\n  key: string;\n  name: string;\n  nameEn: string;\n  sortOrder: number;\n  active: boolean;\n}\n\n/**\n * SkillHub registry category taxonomy (ids align with {@link SkillHubSkill.category}).\n */\nexport async function listSkillHubRegistryCategories(): Promise<SkillHubRegistryCategoryItem[]> {\n  const raw = await fetchJson<{ count?: number; items?: SkillHubRegistryCategoryItem[] }>(\n    `${SKILLHUB_API_BASE}/api/v1/categories`,\n  );\n  const items = Array.isArray(raw.items) ? raw.items : [];\n  return items.filter(\n    (c) =>\n      c &&\n      typeof c.key === 'string' &&\n      c.key.trim().length > 0 &&\n      (c as SkillHubRegistryCategoryItem).active !== false,\n  );\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nasync function fetchJson<T>(url: string, init?: any): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: {\n      Accept: 'application/json',\n      ...(init?.headers as Record<string, string> | undefined),\n    },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `SkillHub request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { message?: string; error?: string };\n      if (j.message) msg = j.message;\n      else if (j.error) msg = j.error;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('SkillHub returned invalid JSON');\n  }\n}\n\nexport async function getSkillHubSkill(slug: string): Promise<SkillHubSkillDetail> {\n  const enc = encodeURIComponent(slug.trim());\n  const url = `${SKILLHUB_API_BASE}/api/v1/skills/${enc}`;\n  return fetchJson<SkillHubSkillDetail>(url);\n}\n\nexport async function getSkillHubSkillFiles(\n  slug: string,\n  version?: string,\n): Promise<{ files: SkillHubFile[]; version: string }> {\n  const enc = encodeURIComponent(slug.trim());\n  const sp = version ? `?version=${encodeURIComponent(version)}` : '';\n  const url = `${SKILLHUB_API_BASE}/api/v1/skills/${enc}/files${sp}`;\n  return fetchJson<{ files: SkillHubFile[]; version: string }>(url);\n}\n\nexport async function getSkillHubSkillVersions(slug: string): Promise<SkillHubVersion[]> {\n  const enc = encodeURIComponent(slug.trim());\n  const url = `${SKILLHUB_API_BASE}/api/v1/skills/${enc}/versions`;\n  return fetchJson<SkillHubVersion[]>(url);\n}\n\nexport async function downloadSkillHubZipBuffer(\n  slug: string,\n  version?: string,\n): Promise<{ buffer: Buffer; version: string }> {\n  const enc = encodeURIComponent(slug.trim());\n  let url = `${SKILLHUB_API_BASE}/api/v1/download?slug=${enc}`;\n  if (version?.trim()) {\n    url += `&version=${encodeURIComponent(version.trim())}`;\n  }\n\n  const res = await fetch(url, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n\n  let resolvedVersion = version ?? '1.0.0';\n  if (!version?.trim()) {\n    try {\n      const files = await getSkillHubSkillFiles(slug);\n      resolvedVersion = files.version;\n    } catch {\n      // Use default version\n    }\n  }\n\n  return { buffer: buf, version: resolvedVersion };\n}\n\nexport interface SkillHubSkillsetListParams {\n  page?: number;\n  pageSize?: number;\n  keyword?: string;\n  scene?: string;\n}\n\nexport async function listSkillHubSkillsets(\n  opts: SkillHubSkillsetListParams = {},\n): Promise<SkillHubSkillsetListResponse> {\n  const page = opts.page ?? 1;\n  const pageSize = opts.pageSize ?? 20;\n  const sp = new URLSearchParams({ page: String(page), pageSize: String(pageSize) });\n  if (opts.keyword?.trim()) sp.set('keyword', opts.keyword.trim());\n  if (opts.scene?.trim()) sp.set('scene', opts.scene.trim());\n  const url = `${SKILLHUB_API_BASE}/api/v1/skillsets?${sp.toString()}`;\n  return fetchJson<SkillHubSkillsetListResponse>(url);\n}\n\nexport async function getSkillHubSkillset(slug: string): Promise<SkillHubSkillset> {\n  const enc = encodeURIComponent(slug.trim());\n  const url = `${SKILLHUB_API_BASE}/api/v1/skillsets/${enc}`;\n  return fetchJson<SkillHubSkillset>(url);\n}\n\nexport async function batchGetSkillHubSkills(slugs: string[]): Promise<SkillHubSkillDetail[]> {\n  if (slugs.length === 0) return [];\n\n  const response = await fetchJson<{ count: number; items: SkillHubSkillDetail[]; missing: string[] }>(\n    `${SKILLHUB_API_BASE}/api/v1/skills/batch`,\n    {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ slugs }),\n    },\n  );\n  return response.items ?? [];\n}\n\nconst SKILLSET_DISCOVERY_PAGE_CAP = 25;\nconst MAX_DEFAULT_SLUGS = 200;\n\nexport async function getDefaultSkillSlugs(): Promise<string[]> {\n  const slugs = new Set<string>();\n  let page = 1;\n  const pageSize = 50;\n  let total = Infinity;\n  while (page <= SKILLSET_DISCOVERY_PAGE_CAP && slugs.size < MAX_DEFAULT_SLUGS) {\n    const response = await listSkillHubSkillsets({ page, pageSize });\n    total = response.total;\n    for (const skillset of response.skillSets) {\n      for (const slug of skillset.skillSlugs) {\n        slugs.add(slug);\n      }\n    }\n    if (page * pageSize >= total) break;\n    page += 1;\n  }\n  return Array.from(slugs).slice(0, MAX_DEFAULT_SLUGS);\n}\n\nexport async function searchSkillHubSkills(\n  query: string,\n  maxSlugs = 200,\n): Promise<{ slugs: string[]; total: number }> {\n  const keyword = query.trim();\n  if (!keyword) {\n    return { slugs: [], total: 0 };\n  }\n\n  const slugs: string[] = [];\n  const seen = new Set<string>();\n  let page = 1;\n  const batchSize = 50;\n\n  while (page <= SKILLSET_DISCOVERY_PAGE_CAP) {\n    const response = await listSkillHubSkillsets({ page, pageSize: batchSize, keyword });\n    const totalSkillsets = response.total;\n    for (const skillset of response.skillSets) {\n      for (const slug of skillset.skillSlugs) {\n        if (!seen.has(slug)) {\n          seen.add(slug);\n          slugs.push(slug);\n        }\n      }\n    }\n    if (page * batchSize >= totalSkillsets) break;\n    page += 1;\n  }\n\n  const capped = slugs.slice(0, maxSlugs);\n  return { slugs: capped, total: capped.length };\n}\n"],"mappings":";;;;;;AAOA,MAAM,oBAAoB;;AAG1B,MAAa,4BAA4B,MAAM;AAE/C,SAAS,kBAAkB,GAAmB;CAC5C,MAAM,OAAO,EAAE,QAAQ,OAAO,IAAI;CAClC,MAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAO,MAAM,MAAM,SAAS,MAAM;;;;;AAMpC,SAAgB,wBAAwB,OAAsC;CAC5E,MAAM,OAAO,MAAM,KAAK,OAAO;EAC7B,MAAM,EAAE,KAAK,QAAQ,OAAO,IAAI;EAChC,MAAM,kBAAkB,EAAE,KAAK,CAAC,aAAa;EAC9C,EAAE;CACH,MAAM,aAAa,SAAiB,KAAK,MAAM,MAAM,EAAE,SAAS,KAAK,aAAa,CAAC;CACnF,MAAM,UAAU,UAAU,WAAW,IAAI,UAAU,WAAW;AAC9D,KAAI,QAAS,QAAO,QAAQ;CAC5B,MAAM,SAAS,UAAU,YAAY,IAAI,UAAU,YAAY;AAC/D,KAAI,OAAQ,QAAO,OAAO;CAC1B,MAAM,MAAM,UAAU,gBAAgB;AACtC,KAAI,IAAK,QAAO,IAAI;AACpB,QAAO;;AAGT,SAAS,gCAAgC,UAAwB;CAC/D,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,SAAS;SACf;AACN,QAAM,IAAI,MAAM,qCAAqC;;AAEvD,KAAI,EAAE,aAAa,SACjB,OAAM,IAAI,MAAM,wCAAwC;CAE1D,MAAM,OAAO,EAAE,SAAS,aAAa;AACrC,KAAI,SAAS,kBAAmB;AAChC,KAAI,KAAK,SAAS,gBAAgB,CAAE;AACpC,OAAM,IAAI,MAAM,iDAAiD;;;;;AAMnE,eAAsB,yBACpB,MACA,UACA,SACiB;CACjB,MAAM,MAAM,mBAAmB,KAAK,MAAM,CAAC;CAC3C,MAAM,WAAW,SAAS,QAAQ,OAAO,IAAI;CAC7C,MAAM,KAAK,IAAI,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAClD,KAAI,SAAS,MAAM,CAAE,IAAG,IAAI,WAAW,QAAQ,MAAM,CAAC;CAEtD,MAAM,MAAM,MAAM,MAAM,GADT,kBAAkB,iBAAiB,IAAI,QAAQ,GAAG,UAAU,IAC9C;EAC3B,UAAU;EACV,SAAS,EAAE,QAAQ,gCAAgC;EACpD,CAAC;AACF,KAAI,CAAC,IAAI,IAAI;EACX,MAAM,OAAO,MAAM,IAAI,MAAM,CAAC,YAAY,GAAG;EAC7C,IAAI,MAAM,iCAAiC,IAAI,OAAO;AACtD,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,OAAO,EAAE,YAAY,SAAU,OAAM,EAAE;YAClC,OAAO,EAAE,UAAU,SAAU,OAAM,EAAE;UACxC;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,iCAAgC,IAAI,IAAI;CACxC,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,OACxB,OAAM,IAAI,MAAM,uCAAuC,0BAA0B,SAAS;;CAG9F,MAAM,KAAK,MAAM,IAAI,aAAa;AAClC,KAAI,GAAG,aAAA,OACL,OAAM,IAAI,MAAM,uCAAuC,0BAA0B,SAAS;AAE5F,QAAO,IAAI,YAAY,QAAQ,CAAC,OAAO,GAAG;;;;;AA6F5C,eAAsB,iCAA0E;CAC9F,MAAM,MAAM,MAAM,UAChB,GAAG,kBAAkB,oBACtB;AAED,SADc,MAAM,QAAQ,IAAI,MAAM,GAAG,IAAI,QAAQ,EAAE,EAC1C,QACV,MACC,KACA,OAAO,EAAE,QAAQ,YACjB,EAAE,IAAI,MAAM,CAAC,SAAS,KACrB,EAAmC,WAAW,MAClD;;AAIH,eAAe,UAAa,KAAa,MAAwB;CAC/D,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GACP,QAAQ;GACR,GAAI,MAAM;GACX;EACF,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,4BAA4B,IAAI,OAAO;AACjD,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,QAAS,OAAM,EAAE;YACd,EAAE,MAAO,OAAM,EAAE;UACpB;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,iCAAiC;;;AAIrD,eAAsB,iBAAiB,MAA4C;AAGjF,QAAO,UAA+B,GADvB,kBAAkB,iBADrB,mBAAmB,KAAK,MAAM,CACW,GACX;;AAG5C,eAAsB,sBACpB,MACA,SACqD;AAIrD,QAAO,UAAsD,GAD9C,kBAAkB,iBAFrB,mBAAmB,KAAK,MAAM,CAEW,CAAC,QAD3C,UAAU,YAAY,mBAAmB,QAAQ,KAAK,KAEA;;AAGnE,eAAsB,yBAAyB,MAA0C;AAGvF,QAAO,UAA6B,GADrB,kBAAkB,iBADrB,mBAAmB,KAAK,MAAM,CACW,CAAC,WACd;;AAG1C,eAAsB,0BACpB,MACA,SAC8C;CAE9C,IAAI,MAAM,GAAG,kBAAkB,wBADnB,mBAAmB,KAAK,MAAM,CACgB;AAC1D,KAAI,SAAS,MAAM,CACjB,QAAO,YAAY,mBAAmB,QAAQ,MAAM,CAAC;CAGvD,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,UAAU,UAAU,CAAC;AACpD,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAGrE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAI9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;CAG5E,IAAI,kBAAkB,WAAW;AACjC,KAAI,CAAC,SAAS,MAAM,CAClB,KAAI;AAEF,qBAAkB,MADE,sBAAsB,KAAK,EACvB;SAClB;AAKV,QAAO;EAAE,QAAQ;EAAK,SAAS;EAAiB;;AAUlD,eAAsB,sBACpB,OAAmC,EAAE,EACE;CACvC,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,KAAK,IAAI,gBAAgB;EAAE,MAAM,OAAO,KAAK;EAAE,UAAU,OAAO,SAAS;EAAE,CAAC;AAClF,KAAI,KAAK,SAAS,MAAM,CAAE,IAAG,IAAI,WAAW,KAAK,QAAQ,MAAM,CAAC;AAChE,KAAI,KAAK,OAAO,MAAM,CAAE,IAAG,IAAI,SAAS,KAAK,MAAM,MAAM,CAAC;AAE1D,QAAO,UAAwC,GADhC,kBAAkB,oBAAoB,GAAG,UAAU,GACf;;AAGrD,eAAsB,oBAAoB,MAAyC;AAGjF,QAAO,UAA4B,GADpB,kBAAkB,oBADrB,mBAAmB,KAAK,MAAM,CACc,GACjB;;AAGzC,eAAsB,uBAAuB,OAAiD;AAC5F,KAAI,MAAM,WAAW,EAAG,QAAO,EAAE;AAUjC,SAAO,MARgB,UACrB,GAAG,kBAAkB,uBACrB;EACE,QAAQ;EACR,SAAS,EAAE,gBAAgB,oBAAoB;EAC/C,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;EAChC,CACF,EACe,SAAS,EAAE;;AAG7B,MAAM,8BAA8B;AACpC,MAAM,oBAAoB;AAE1B,eAAsB,uBAA0C;CAC9D,MAAM,wBAAQ,IAAI,KAAa;CAC/B,IAAI,OAAO;CACX,MAAM,WAAW;CACjB,IAAI,QAAQ;AACZ,QAAO,QAAQ,+BAA+B,MAAM,OAAO,mBAAmB;EAC5E,MAAM,WAAW,MAAM,sBAAsB;GAAE;GAAM;GAAU,CAAC;AAChE,UAAQ,SAAS;AACjB,OAAK,MAAM,YAAY,SAAS,UAC9B,MAAK,MAAM,QAAQ,SAAS,WAC1B,OAAM,IAAI,KAAK;AAGnB,MAAI,OAAO,YAAY,MAAO;AAC9B,UAAQ;;AAEV,QAAO,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,kBAAkB;;AAGtD,eAAsB,qBACpB,OACA,WAAW,KACkC;CAC7C,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,CAAC,QACH,QAAO;EAAE,OAAO,EAAE;EAAE,OAAO;EAAG;CAGhC,MAAM,QAAkB,EAAE;CAC1B,MAAM,uBAAO,IAAI,KAAa;CAC9B,IAAI,OAAO;CACX,MAAM,YAAY;AAElB,QAAO,QAAQ,6BAA6B;EAC1C,MAAM,WAAW,MAAM,sBAAsB;GAAE;GAAM,UAAU;GAAW;GAAS,CAAC;EACpF,MAAM,iBAAiB,SAAS;AAChC,OAAK,MAAM,YAAY,SAAS,UAC9B,MAAK,MAAM,QAAQ,SAAS,WAC1B,KAAI,CAAC,KAAK,IAAI,KAAK,EAAE;AACnB,QAAK,IAAI,KAAK;AACd,SAAM,KAAK,KAAK;;AAItB,MAAI,OAAO,aAAa,eAAgB;AACxC,UAAQ;;CAGV,MAAM,SAAS,MAAM,MAAM,GAAG,SAAS;AACvC,QAAO;EAAE,OAAO;EAAQ,OAAO,OAAO;EAAQ"}

package/dist/src/agent/skills/marketplace/adapters/skillhub/skillhub-fetch-cache.d.ts

@@ -0,0 +1,12 @@
+/**
+ * In-memory TTL cache for SkillHub HTTP reads used by the marketplace adapter
+ * (curated index, default slug discovery, batch skill metadata, registry category taxonomy).
+ *
+ * `XOPC_SKILLHUB_CACHE_MS`: TTL in milliseconds (default 300_000). Set to `0` to disable.
+ */
+import type { SkillHubCuratedIndex, SkillHubEcosystemUrls } from './ecosystem-client.js';
+import type { SkillHubRegistryCategoryItem, SkillHubSkillDetail } from './registry-client.js';
+export declare function cachedFetchSkillHubCuratedIndex(urls: SkillHubEcosystemUrls): Promise<SkillHubCuratedIndex>;
+export declare function cachedGetDefaultSkillSlugs(): Promise<string[]>;
+export declare function cachedListSkillHubRegistryCategories(): Promise<SkillHubRegistryCategoryItem[]>;
+export declare function cachedBatchGetSkillHubSkills(slugs: string[]): Promise<SkillHubSkillDetail[]>;

package/dist/src/agent/skills/marketplace/adapters/skillhub/skillhub-fetch-cache.js

@@ -0,0 +1,90 @@
+import { fetchSkillHubCuratedIndex } from "./ecosystem-client.js";
+import { batchGetSkillHubSkills, getDefaultSkillSlugs, listSkillHubRegistryCategories } from "./registry-client.js";
+//#region src/agent/skills/marketplace/adapters/skillhub/skillhub-fetch-cache.ts
+const DEFAULT_CACHE_MS = 300 * 1e3;
+const MAX_BATCH_CACHE_KEYS = 48;
+function cacheTtlMs() {
+	const raw = process.env.XOPC_SKILLHUB_CACHE_MS?.trim();
+	if (raw === "0" || raw === "false") return 0;
+	const n = Number(raw);
+	if (!Number.isFinite(n) || n < 0) return DEFAULT_CACHE_MS;
+	return n;
+}
+const curatedByIndexUrl = /* @__PURE__ */ new Map();
+let defaultSlugsEntry;
+let registryCategoriesEntry;
+const batchBySlugsKey = /* @__PURE__ */ new Map();
+function getFresh(entry) {
+	if (!entry || entry.expiresAt <= Date.now()) return void 0;
+	return entry.value;
+}
+function evictOldestBatchKey() {
+	const first = batchBySlugsKey.keys().next().value;
+	if (first !== void 0) batchBySlugsKey.delete(first);
+}
+function batchSlugsCacheKey(slugs) {
+	if (slugs.length === 0) return "";
+	return [...slugs].sort().join("\n");
+}
+async function cachedFetchSkillHubCuratedIndex(urls) {
+	const ttl = cacheTtlMs();
+	const key = urls.skillsIndexUrl;
+	if (ttl > 0) {
+		const hit = getFresh(curatedByIndexUrl.get(key));
+		if (hit) return hit;
+	}
+	const value = await fetchSkillHubCuratedIndex(urls);
+	if (ttl > 0) curatedByIndexUrl.set(key, {
+		value,
+		expiresAt: Date.now() + ttl
+	});
+	return value;
+}
+async function cachedGetDefaultSkillSlugs() {
+	const ttl = cacheTtlMs();
+	if (ttl > 0) {
+		const hit = getFresh(defaultSlugsEntry);
+		if (hit) return hit;
+	}
+	const value = await getDefaultSkillSlugs();
+	if (ttl > 0) defaultSlugsEntry = {
+		value,
+		expiresAt: Date.now() + ttl
+	};
+	return value;
+}
+async function cachedListSkillHubRegistryCategories() {
+	const ttl = cacheTtlMs();
+	if (ttl > 0) {
+		const hit = getFresh(registryCategoriesEntry);
+		if (hit) return hit;
+	}
+	const value = await listSkillHubRegistryCategories();
+	if (ttl > 0) registryCategoriesEntry = {
+		value,
+		expiresAt: Date.now() + ttl
+	};
+	return value;
+}
+async function cachedBatchGetSkillHubSkills(slugs) {
+	if (slugs.length === 0) return [];
+	const ttl = cacheTtlMs();
+	const key = batchSlugsCacheKey(slugs);
+	if (ttl > 0) {
+		const hit = getFresh(batchBySlugsKey.get(key));
+		if (hit) return hit;
+	}
+	const value = await batchGetSkillHubSkills(slugs);
+	if (ttl > 0) {
+		while (batchBySlugsKey.size >= MAX_BATCH_CACHE_KEYS) evictOldestBatchKey();
+		batchBySlugsKey.set(key, {
+			value,
+			expiresAt: Date.now() + ttl
+		});
+	}
+	return value;
+}
+//#endregion
+export { cachedBatchGetSkillHubSkills, cachedFetchSkillHubCuratedIndex, cachedGetDefaultSkillSlugs, cachedListSkillHubRegistryCategories };
+
+//# sourceMappingURL=skillhub-fetch-cache.js.map

package/dist/src/agent/skills/marketplace/adapters/skillhub/skillhub-fetch-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillhub-fetch-cache.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/skillhub/skillhub-fetch-cache.ts"],"sourcesContent":["/**\n * In-memory TTL cache for SkillHub HTTP reads used by the marketplace adapter\n * (curated index, default slug discovery, batch skill metadata, registry category taxonomy).\n *\n * `XOPC_SKILLHUB_CACHE_MS`: TTL in milliseconds (default 300_000). Set to `0` to disable.\n */\n\nimport type { SkillHubCuratedIndex, SkillHubEcosystemUrls } from './ecosystem-client.js';\nimport { fetchSkillHubCuratedIndex } from './ecosystem-client.js';\nimport type { SkillHubRegistryCategoryItem, SkillHubSkillDetail } from './registry-client.js';\nimport {\n  batchGetSkillHubSkills,\n  getDefaultSkillSlugs,\n  listSkillHubRegistryCategories,\n} from './registry-client.js';\n\nconst DEFAULT_CACHE_MS = 5 * 60 * 1000;\nconst MAX_BATCH_CACHE_KEYS = 48;\n\ntype CacheEntry<T> = { value: T; expiresAt: number };\n\nfunction cacheTtlMs(): number {\n  const raw = process.env.XOPC_SKILLHUB_CACHE_MS?.trim();\n  if (raw === '0' || raw === 'false') return 0;\n  const n = Number(raw);\n  if (!Number.isFinite(n) || n < 0) return DEFAULT_CACHE_MS;\n  return n;\n}\n\nconst curatedByIndexUrl = new Map<string, CacheEntry<SkillHubCuratedIndex>>();\nlet defaultSlugsEntry: CacheEntry<string[]> | undefined;\nlet registryCategoriesEntry: CacheEntry<SkillHubRegistryCategoryItem[]> | undefined;\nconst batchBySlugsKey = new Map<string, CacheEntry<SkillHubSkillDetail[]>>();\n\nfunction getFresh<T>(entry: CacheEntry<T> | undefined): T | undefined {\n  if (!entry || entry.expiresAt <= Date.now()) return undefined;\n  return entry.value;\n}\n\nfunction evictOldestBatchKey(): void {\n  const first = batchBySlugsKey.keys().next().value;\n  if (first !== undefined) batchBySlugsKey.delete(first);\n}\n\nfunction batchSlugsCacheKey(slugs: string[]): string {\n  if (slugs.length === 0) return '';\n  return [...slugs].sort().join('\\n');\n}\n\nexport async function cachedFetchSkillHubCuratedIndex(urls: SkillHubEcosystemUrls): Promise<SkillHubCuratedIndex> {\n  const ttl = cacheTtlMs();\n  const key = urls.skillsIndexUrl;\n  if (ttl > 0) {\n    const hit = getFresh(curatedByIndexUrl.get(key));\n    if (hit) return hit;\n  }\n  const value = await fetchSkillHubCuratedIndex(urls);\n  if (ttl > 0) curatedByIndexUrl.set(key, { value, expiresAt: Date.now() + ttl });\n  return value;\n}\n\nexport async function cachedGetDefaultSkillSlugs(): Promise<string[]> {\n  const ttl = cacheTtlMs();\n  if (ttl > 0) {\n    const hit = getFresh(defaultSlugsEntry);\n    if (hit) return hit;\n  }\n  const value = await getDefaultSkillSlugs();\n  if (ttl > 0) defaultSlugsEntry = { value, expiresAt: Date.now() + ttl };\n  return value;\n}\n\nexport async function cachedListSkillHubRegistryCategories(): Promise<SkillHubRegistryCategoryItem[]> {\n  const ttl = cacheTtlMs();\n  if (ttl > 0) {\n    const hit = getFresh(registryCategoriesEntry);\n    if (hit) return hit;\n  }\n  const value = await listSkillHubRegistryCategories();\n  if (ttl > 0) registryCategoriesEntry = { value, expiresAt: Date.now() + ttl };\n  return value;\n}\n\nexport async function cachedBatchGetSkillHubSkills(slugs: string[]): Promise<SkillHubSkillDetail[]> {\n  if (slugs.length === 0) return [];\n  const ttl = cacheTtlMs();\n  const key = batchSlugsCacheKey(slugs);\n  if (ttl > 0) {\n    const hit = getFresh(batchBySlugsKey.get(key));\n    if (hit) return hit;\n  }\n  const value = await batchGetSkillHubSkills(slugs);\n  if (ttl > 0) {\n    while (batchBySlugsKey.size >= MAX_BATCH_CACHE_KEYS) evictOldestBatchKey();\n    batchBySlugsKey.set(key, { value, expiresAt: Date.now() + ttl });\n  }\n  return value;\n}\n"],"mappings":";;;AAgBA,MAAM,mBAAmB,MAAS;AAClC,MAAM,uBAAuB;AAI7B,SAAS,aAAqB;CAC5B,MAAM,MAAM,QAAQ,IAAI,wBAAwB,MAAM;AACtD,KAAI,QAAQ,OAAO,QAAQ,QAAS,QAAO;CAC3C,MAAM,IAAI,OAAO,IAAI;AACrB,KAAI,CAAC,OAAO,SAAS,EAAE,IAAI,IAAI,EAAG,QAAO;AACzC,QAAO;;AAGT,MAAM,oCAAoB,IAAI,KAA+C;AAC7E,IAAI;AACJ,IAAI;AACJ,MAAM,kCAAkB,IAAI,KAAgD;AAE5E,SAAS,SAAY,OAAiD;AACpE,KAAI,CAAC,SAAS,MAAM,aAAa,KAAK,KAAK,CAAE,QAAO,KAAA;AACpD,QAAO,MAAM;;AAGf,SAAS,sBAA4B;CACnC,MAAM,QAAQ,gBAAgB,MAAM,CAAC,MAAM,CAAC;AAC5C,KAAI,UAAU,KAAA,EAAW,iBAAgB,OAAO,MAAM;;AAGxD,SAAS,mBAAmB,OAAyB;AACnD,KAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK;;AAGrC,eAAsB,gCAAgC,MAA4D;CAChH,MAAM,MAAM,YAAY;CACxB,MAAM,MAAM,KAAK;AACjB,KAAI,MAAM,GAAG;EACX,MAAM,MAAM,SAAS,kBAAkB,IAAI,IAAI,CAAC;AAChD,MAAI,IAAK,QAAO;;CAElB,MAAM,QAAQ,MAAM,0BAA0B,KAAK;AACnD,KAAI,MAAM,EAAG,mBAAkB,IAAI,KAAK;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAK,CAAC;AAC/E,QAAO;;AAGT,eAAsB,6BAAgD;CACpE,MAAM,MAAM,YAAY;AACxB,KAAI,MAAM,GAAG;EACX,MAAM,MAAM,SAAS,kBAAkB;AACvC,MAAI,IAAK,QAAO;;CAElB,MAAM,QAAQ,MAAM,sBAAsB;AAC1C,KAAI,MAAM,EAAG,qBAAoB;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAK;AACvE,QAAO;;AAGT,eAAsB,uCAAgF;CACpG,MAAM,MAAM,YAAY;AACxB,KAAI,MAAM,GAAG;EACX,MAAM,MAAM,SAAS,wBAAwB;AAC7C,MAAI,IAAK,QAAO;;CAElB,MAAM,QAAQ,MAAM,gCAAgC;AACpD,KAAI,MAAM,EAAG,2BAA0B;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAK;AAC7E,QAAO;;AAGT,eAAsB,6BAA6B,OAAiD;AAClG,KAAI,MAAM,WAAW,EAAG,QAAO,EAAE;CACjC,MAAM,MAAM,YAAY;CACxB,MAAM,MAAM,mBAAmB,MAAM;AACrC,KAAI,MAAM,GAAG;EACX,MAAM,MAAM,SAAS,gBAAgB,IAAI,IAAI,CAAC;AAC9C,MAAI,IAAK,QAAO;;CAElB,MAAM,QAAQ,MAAM,uBAAuB,MAAM;AACjD,KAAI,MAAM,GAAG;AACX,SAAO,gBAAgB,QAAQ,qBAAsB,sBAAqB;AAC1E,kBAAgB,IAAI,KAAK;GAAE;GAAO,WAAW,KAAK,KAAK,GAAG;GAAK,CAAC;;AAElE,QAAO"}

package/dist/src/agent/skills/marketplace/adapters/store/adapter.d.ts

@@ -0,0 +1,2 @@
+import type { SkillsMarketplaceAdapter } from '../../adapter.types.js';
+export declare const storeMarketplaceAdapter: SkillsMarketplaceAdapter;

package/dist/src/agent/skills/marketplace/adapters/store/adapter.js

@@ -0,0 +1,35 @@
+import { downloadSkillZipBuffer, fetchMarketplacePackageDetail, listSkillPackages, resolveSkillZipDownloadUrl, resolveSkillsStoreBaseUrl, skillIdForMarketplaceInstall } from "./store-api-client.js";
+//#region src/agent/skills/marketplace/adapters/store/adapter.ts
+const storeMarketplaceAdapter = {
+	id: "store",
+	async listCategories(_config) {
+		return [];
+	},
+	async listPackages(config, params) {
+		const response = await listSkillPackages(resolveSkillsStoreBaseUrl(config), params);
+		return {
+			items: response.items,
+			meta: response.meta,
+			provider: "store"
+		};
+	},
+	async getPackageDetail(config, packageName) {
+		return {
+			...await fetchMarketplacePackageDetail(resolveSkillsStoreBaseUrl(config), packageName),
+			provider: "store"
+		};
+	},
+	async downloadPackage(config, packageName, version) {
+		const base = resolveSkillsStoreBaseUrl(config);
+		const { downloadUrl, version: resolvedVersion } = await resolveSkillZipDownloadUrl(base, packageName, version);
+		return {
+			buffer: await downloadSkillZipBuffer(base, downloadUrl),
+			skillId: skillIdForMarketplaceInstall(packageName) ?? packageName,
+			version: resolvedVersion
+		};
+	}
+};
+//#endregion
+export { storeMarketplaceAdapter };
+
+//# sourceMappingURL=adapter.js.map

package/dist/src/agent/skills/marketplace/adapters/store/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/adapter.ts"],"sourcesContent":["import type { Config } from '../../../../../config/schema.js';\nimport {\n  downloadSkillZipBuffer,\n  fetchMarketplacePackageDetail,\n  listSkillPackages,\n  resolveSkillZipDownloadUrl,\n  resolveSkillsStoreBaseUrl,\n  skillIdForMarketplaceInstall,\n} from './store-api-client.js';\n\nimport type { SkillsMarketplaceAdapter } from '../../adapter.types.js';\n\nexport const storeMarketplaceAdapter: SkillsMarketplaceAdapter = {\n  id: 'store',\n\n  async listCategories(_config) {\n    return [];\n  },\n\n  async listPackages(config, params) {\n    const base = resolveSkillsStoreBaseUrl(config);\n    const response = await listSkillPackages(base, params);\n    return {\n      items: response.items,\n      meta: response.meta,\n      provider: 'store',\n    };\n  },\n\n  async getPackageDetail(config, packageName) {\n    const base = resolveSkillsStoreBaseUrl(config);\n    const detail = await fetchMarketplacePackageDetail(base, packageName);\n    return { ...detail, provider: 'store' };\n  },\n\n  async downloadPackage(config, packageName, version) {\n    const base = resolveSkillsStoreBaseUrl(config);\n    const { downloadUrl, version: resolvedVersion } = await resolveSkillZipDownloadUrl(\n      base,\n      packageName,\n      version,\n    );\n    const buffer = await downloadSkillZipBuffer(base, downloadUrl);\n    return {\n      buffer,\n      skillId: skillIdForMarketplaceInstall(packageName) ?? packageName,\n      version: resolvedVersion,\n    };\n  },\n};\n"],"mappings":";;AAYA,MAAa,0BAAoD;CAC/D,IAAI;CAEJ,MAAM,eAAe,SAAS;AAC5B,SAAO,EAAE;;CAGX,MAAM,aAAa,QAAQ,QAAQ;EAEjC,MAAM,WAAW,MAAM,kBADV,0BAA0B,OACM,EAAE,OAAO;AACtD,SAAO;GACL,OAAO,SAAS;GAChB,MAAM,SAAS;GACf,UAAU;GACX;;CAGH,MAAM,iBAAiB,QAAQ,aAAa;AAG1C,SAAO;GAAE,GAAG,MADS,8BADR,0BAA0B,OACgB,EAAE,YAAY;GACjD,UAAU;GAAS;;CAGzC,MAAM,gBAAgB,QAAQ,aAAa,SAAS;EAClD,MAAM,OAAO,0BAA0B,OAAO;EAC9C,MAAM,EAAE,aAAa,SAAS,oBAAoB,MAAM,2BACtD,MACA,aACA,QACD;AAED,SAAO;GACL,QAAA,MAFmB,uBAAuB,MAAM,YAAY;GAG5D,SAAS,6BAA6B,YAAY,IAAI;GACtD,SAAS;GACV;;CAEJ"}

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.d.ts

@@ -0,0 +1,124 @@
+/**
+ * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).
+ * Used by the store marketplace adapter and SSRF-safe download helpers.
+ *
+ * Facade: {@link ../../../skills-marketplace.js}.
+ */
+import type { Config } from '../../../../../config/schema.js';
+import type { SkillMarkdownPreviewPayload } from '../../../types.js';
+export type SkillsMarketplaceProvider = 'store' | 'skillhub';
+export interface SkillsStoreListParams {
+    q?: string;
+    page?: number;
+    pageSize?: number;
+    sort?: 'downloads' | 'newest';
+    /** Adapter-defined category id (exact match against package `categories`). */
+    category?: string;
+}
+/** Category option for marketplace filter chips (from adapter). */
+export interface MarketplaceCategoryOption {
+    id: string;
+    label: string;
+}
+/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */
+export interface SkillsStorePackageListItem {
+    id: string;
+    name: string;
+    type: string;
+    description: string;
+    downloads: number;
+    author: {
+        username: string;
+        avatarUrl: string | null;
+    };
+    latestVersion?: string;
+    updatedAt: string;
+    /** Taxonomy / tags from the marketplace (adapter-specific). */
+    categories?: string[];
+    tags?: string[];
+    stars?: number;
+    /** Short provenance label for the row (e.g. ClawHub). */
+    sourceLabel?: string;
+}
+/** Unified marketplace package list item (works for all adapters). */
+export type MarketplacePackageListItem = SkillsStorePackageListItem;
+export interface SkillsStoreListResponse {
+    items: SkillsStorePackageListItem[];
+    meta: {
+        page: number;
+        pageSize: number;
+        total: number;
+        totalPages: number;
+    };
+}
+export declare function resolveSkillsStoreBaseUrl(config: Config): string;
+export declare function getStoreOrigin(baseUrl: string): string;
+/**
+ * Allow only HTTPS URLs whose origin matches the configured store base (SSRF guard).
+ */
+export declare function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL;
+export declare function listSkillPackages(storeBaseUrl: string, params: SkillsStoreListParams): Promise<SkillsStoreListResponse>;
+/** GET /api/v1/packages/:name — published skill package (public). */
+export interface MarketplacePackageDetail {
+    id: string;
+    name: string;
+    type: string;
+    description: string;
+    readme: string | null;
+    downloads: number;
+    author: {
+        username: string;
+        avatarUrl: string | null;
+    };
+    latestVersion: {
+        version: string;
+        changelog: string | null;
+        publishedAt: string;
+    };
+}
+export declare function fetchMarketplacePackageDetail(storeBaseUrl: string, packageName: string): Promise<MarketplacePackageDetail>;
+export declare function resolveSkillZipDownloadUrl(storeBaseUrl: string, packageName: string, version?: string): Promise<{
+    downloadUrl: string;
+    version: string;
+}>;
+export declare function downloadSkillZipBuffer(storeBaseUrl: string, downloadUrl: string): Promise<Buffer>;
+export declare function skillIdForMarketplaceInstall(packageName: string): string | undefined;
+/**
+ * Unified marketplace list response (adapter fills `provider`).
+ */
+export interface UnifiedMarketplaceListResponse {
+    items: MarketplacePackageListItem[];
+    meta: {
+        page: number;
+        pageSize: number;
+        total: number;
+        totalPages: number;
+    };
+    provider: SkillsMarketplaceProvider;
+}
+/**
+ * Unified marketplace package detail response.
+ */
+export interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {
+    provider: SkillsMarketplaceProvider;
+    /** When set (e.g. SkillHub SKILL.md), gateway console renders structured meta + body like installed skills. */
+    skillDocPreview?: SkillMarkdownPreviewPayload;
+    /** SkillHub-specific fields */
+    skillHubInfo?: {
+        category: string;
+        installs: number;
+        stars: number;
+        securityReports?: {
+            keen?: {
+                status: string;
+                statusText: string;
+                reportUrl?: string;
+            };
+            sanbu?: {
+                status: string;
+                statusText: string;
+                reportUrl?: string;
+            };
+        };
+    };
+}

package/dist/src/agent/skills/{skills-store-client.js → marketplace/adapters/store/store-api-client.js}

@@ -1,5 +1,5 @@
-import { MAX_SKILL_ZIP_BYTES, isValidSkillId } from "./managed-store.js";
-//#region src/agent/skills/skills-store-client.ts
+import { MAX_SKILL_ZIP_BYTES, isValidSkillId } from "../../../managed-store.js";
+//#region src/agent/skills/marketplace/adapters/store/store-api-client.ts
 const DEFAULT_STORE_BASE = "https://store.xopc.ai";
 function resolveSkillsStoreBaseUrl(config) {
 	const env = process.env.XOPC_SKILLS_STORE_URL?.trim();
@@ -69,6 +69,7 @@ async function listSkillPackages(storeBaseUrl, params) {
 	if (params.page != null) sp.set("page", String(params.page));
 	if (params.pageSize != null) sp.set("pageSize", String(params.pageSize));
 	if (params.sort) sp.set("sort", params.sort);
+	if (params.category?.trim()) sp.set("category", params.category.trim());
 	return fetchJson(`${base}/api/v1/packages?${sp.toString()}`);
 }
 async function fetchMarketplacePackageDetail(storeBaseUrl, packageName) {
@@ -116,4 +117,4 @@ function skillIdForMarketplaceInstall(packageName) {
 //#endregion
 export { assertDownloadUrlAllowed, downloadSkillZipBuffer, fetchMarketplacePackageDetail, getStoreOrigin, listSkillPackages, resolveSkillZipDownloadUrl, resolveSkillsStoreBaseUrl, skillIdForMarketplaceInstall };
 
-//# sourceMappingURL=skills-store-client.js.map
+//# sourceMappingURL=store-api-client.js.map

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-api-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/store-api-client.ts"],"sourcesContent":["/**\n * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).\n * Used by the store marketplace adapter and SSRF-safe download helpers.\n *\n * Facade: {@link ../../../skills-marketplace.js}.\n */\n\nimport type { Config } from '../../../../../config/schema.js';\nimport { isValidSkillId, MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\nimport type { SkillMarkdownPreviewPayload } from '../../../types.js';\n\nconst DEFAULT_STORE_BASE = 'https://store.xopc.ai';\n\nexport type SkillsMarketplaceProvider = 'store' | 'skillhub';\n\nexport interface SkillsStoreListParams {\n  q?: string;\n  page?: number;\n  pageSize?: number;\n  sort?: 'downloads' | 'newest';\n  /** Adapter-defined category id (exact match against package `categories`). */\n  category?: string;\n}\n\n/** Category option for marketplace filter chips (from adapter). */\nexport interface MarketplaceCategoryOption {\n  id: string;\n  label: string;\n}\n\n/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */\nexport interface SkillsStorePackageListItem {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion?: string;\n  updatedAt: string;\n  /** Taxonomy / tags from the marketplace (adapter-specific). */\n  categories?: string[];\n  tags?: string[];\n  stars?: number;\n  /** Short provenance label for the row (e.g. ClawHub). */\n  sourceLabel?: string;\n}\n\n/** Unified marketplace package list item (works for all adapters). */\nexport type MarketplacePackageListItem = SkillsStorePackageListItem;\n\nexport interface SkillsStoreListResponse {\n  items: SkillsStorePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n}\n\nexport function resolveSkillsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_SKILLS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  const fromConfig = config.gateway?.skillsStoreBaseUrl?.trim();\n  if (fromConfig) {\n    try {\n      return normalizeBaseUrl(new URL(fromConfig).toString());\n    } catch {\n      return DEFAULT_STORE_BASE;\n    }\n  }\n  return DEFAULT_STORE_BASE;\n}\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nexport function getStoreOrigin(baseUrl: string): string {\n  const u = new URL(baseUrl);\n  return `${u.protocol}//${u.host}`;\n}\n\n/**\n * Allow only HTTPS URLs whose origin matches the configured store base (SSRF guard).\n */\nexport function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL {\n  let u: URL;\n  try {\n    u = new URL(downloadUrl);\n  } catch {\n    throw new Error('Invalid download URL from store');\n  }\n  if (u.protocol !== 'https:') {\n    throw new Error('Download URL must use HTTPS');\n  }\n  const allowed = new URL(storeBaseUrl);\n  if (u.host !== allowed.host) {\n    throw new Error('Download URL host does not match skills store');\n  }\n  return u;\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: { Accept: 'application/json', ...init?.headers },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `Store request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { error?: { message?: string } };\n      if (j.error?.message) msg = j.error.message;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('Store returned invalid JSON');\n  }\n}\n\nexport async function listSkillPackages(\n  storeBaseUrl: string,\n  params: SkillsStoreListParams,\n): Promise<SkillsStoreListResponse> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const sp = new URLSearchParams();\n  sp.set('type', 'skill');\n  if (params.q?.trim()) sp.set('q', params.q.trim());\n  if (params.page != null) sp.set('page', String(params.page));\n  if (params.pageSize != null) sp.set('pageSize', String(params.pageSize));\n  if (params.sort) sp.set('sort', params.sort);\n  if (params.category?.trim()) sp.set('category', params.category.trim());\n\n  const url = `${base}/api/v1/packages?${sp.toString()}`;\n  return fetchJson<SkillsStoreListResponse>(url);\n}\n\n/** GET /api/v1/packages/:name — published skill package (public). */\nexport interface MarketplacePackageDetail {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  readme: string | null;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    publishedAt: string;\n  };\n}\n\nexport async function fetchMarketplacePackageDetail(\n  storeBaseUrl: string,\n  packageName: string,\n): Promise<MarketplacePackageDetail> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  return fetchJson<MarketplacePackageDetail>(`${base}/api/v1/packages/${enc}`);\n}\n\nexport async function resolveSkillZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName);\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n\n  const pkg = await fetchJson<{\n    name: string;\n    latestVersion: { downloadUrl: string; version: string };\n  }>(`${base}/api/v1/packages/${enc}`);\n  if (!pkg.latestVersion?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(pkg.latestVersion.downloadUrl, base);\n  return {\n    downloadUrl: pkg.latestVersion.downloadUrl,\n    version: pkg.latestVersion.version,\n  };\n}\n\nexport async function downloadSkillZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\nexport function skillIdForMarketplaceInstall(packageName: string): string | undefined {\n  const trimmed = packageName.trim();\n  if (!trimmed) return undefined;\n  return isValidSkillId(trimmed) ? trimmed : undefined;\n}\n\n/**\n * Unified marketplace list response (adapter fills `provider`).\n */\nexport interface UnifiedMarketplaceListResponse {\n  items: MarketplacePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n  provider: SkillsMarketplaceProvider;\n}\n\n/**\n * Unified marketplace package detail response.\n */\nexport interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {\n  provider: SkillsMarketplaceProvider;\n  /** When set (e.g. SkillHub SKILL.md), gateway console renders structured meta + body like installed skills. */\n  skillDocPreview?: SkillMarkdownPreviewPayload;\n  /** SkillHub-specific fields */\n  skillHubInfo?: {\n    category: string;\n    installs: number;\n    stars: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n}\n"],"mappings":";;AAWA,MAAM,qBAAqB;AA6C3B,SAAgB,0BAA0B,QAAwB;CAChE,MAAM,MAAM,QAAQ,IAAI,uBAAuB,MAAM;AACrD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;CAIV,MAAM,aAAa,OAAO,SAAS,oBAAoB,MAAM;AAC7D,KAAI,WACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;SACjD;AACN,SAAO;;AAGX,QAAO;;AAGT,SAAS,iBAAiB,KAAqB;AAC7C,QAAO,IAAI,QAAQ,OAAO,GAAG;;AAG/B,SAAgB,eAAe,SAAyB;CACtD,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,QAAO,GAAG,EAAE,SAAS,IAAI,EAAE;;;;;AAM7B,SAAgB,yBAAyB,aAAqB,cAA2B;CACvF,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,YAAY;SAClB;AACN,QAAM,IAAI,MAAM,kCAAkC;;AAEpD,KAAI,EAAE,aAAa,SACjB,OAAM,IAAI,MAAM,8BAA8B;CAEhD,MAAM,UAAU,IAAI,IAAI,aAAa;AACrC,KAAI,EAAE,SAAS,QAAQ,KACrB,OAAM,IAAI,MAAM,gDAAgD;AAElE,QAAO;;AAGT,eAAe,UAAa,KAAa,MAAgC;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GAAE,QAAQ;GAAoB,GAAG,MAAM;GAAS;EAC1D,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,yBAAyB,IAAI,OAAO;AAC9C,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,OAAO,QAAS,OAAM,EAAE,MAAM;UAC9B;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,8BAA8B;;;AAIlD,eAAsB,kBACpB,cACA,QACkC;CAClC,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,KAAK,IAAI,iBAAiB;AAChC,IAAG,IAAI,QAAQ,QAAQ;AACvB,KAAI,OAAO,GAAG,MAAM,CAAE,IAAG,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAClD,KAAI,OAAO,QAAQ,KAAM,IAAG,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC;AAC5D,KAAI,OAAO,YAAY,KAAM,IAAG,IAAI,YAAY,OAAO,OAAO,SAAS,CAAC;AACxE,KAAI,OAAO,KAAM,IAAG,IAAI,QAAQ,OAAO,KAAK;AAC5C,KAAI,OAAO,UAAU,MAAM,CAAE,IAAG,IAAI,YAAY,OAAO,SAAS,MAAM,CAAC;AAGvE,QAAO,UAAmC,GAD3B,KAAK,mBAAmB,GAAG,UAAU,GACN;;AAmBhD,eAAsB,8BACpB,cACA,aACmC;AAGnC,QAAO,UAAoC,GAF9B,iBAAiB,aAEoB,CAAC,mBADvC,mBAAmB,YAAY,MAAM,CACwB,GAAG;;AAG9E,eAAsB,2BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY;AAC3C,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAGlB,GAAG,KAAK,mBAAmB,IAAI,YAJxB,mBAAmB,QAAQ,MAAM,CAII,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAGrE,MAAM,MAAM,MAAM,UAGf,GAAG,KAAK,mBAAmB,MAAM;AACpC,KAAI,CAAC,IAAI,eAAe,YACtB,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,IAAI,cAAc,aAAa,KAAK;AAC7D,QAAO;EACL,aAAa,IAAI,cAAc;EAC/B,SAAS,IAAI,cAAc;EAC5B;;AAGH,eAAsB,uBACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAE3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAErE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAG9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;AAE5E,QAAO;;AAGT,SAAgB,6BAA6B,aAAyC;CACpF,MAAM,UAAU,YAAY,MAAM;AAClC,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,QAAO,eAAe,QAAQ,GAAG,UAAU,KAAA"}

package/dist/src/agent/skills/marketplace/resolve-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { Config } from '../../../config/schema.js';
+import type { SkillsMarketplaceProvider } from './adapters/store/store-api-client.js';
+import type { SkillsMarketplaceAdapter } from './adapter.types.js';
+export declare function resolveSkillsMarketplaceProvider(config: Config): SkillsMarketplaceProvider;
+export declare function getMarketplaceProviderDisplayName(provider: SkillsMarketplaceProvider): string;
+export declare function getMarketplaceAdapter(config: Config): SkillsMarketplaceAdapter;

package/dist/src/agent/skills/marketplace/resolve-adapter.js

@@ -0,0 +1,26 @@
+import { skillhubMarketplaceAdapter } from "./adapters/skillhub/adapter.js";
+import { storeMarketplaceAdapter } from "./adapters/store/adapter.js";
+//#region src/agent/skills/marketplace/resolve-adapter.ts
+function resolveSkillsMarketplaceProvider(config) {
+	const env = process.env.XOPC_SKILLS_MARKETPLACE_PROVIDER?.trim().toLowerCase();
+	if (env === "skillhub" || env === "store") return env;
+	const fromConfig = config.gateway?.skillsMarketplaceProvider;
+	if (fromConfig === "skillhub" || fromConfig === "store") return fromConfig;
+	return "skillhub";
+}
+function getMarketplaceProviderDisplayName(provider) {
+	switch (provider) {
+		case "skillhub": return "SkillHub (skillhub.cn)";
+		default: return "xopc Store (store.xopc.ai)";
+	}
+}
+function getMarketplaceAdapter(config) {
+	switch (resolveSkillsMarketplaceProvider(config)) {
+		case "skillhub": return skillhubMarketplaceAdapter;
+		default: return storeMarketplaceAdapter;
+	}
+}
+//#endregion
+export { getMarketplaceAdapter, getMarketplaceProviderDisplayName, resolveSkillsMarketplaceProvider };
+
+//# sourceMappingURL=resolve-adapter.js.map

package/dist/src/agent/skills/marketplace/resolve-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-adapter.js","names":[],"sources":["../../../../../src/agent/skills/marketplace/resolve-adapter.ts"],"sourcesContent":["import type { Config } from '../../../config/schema.js';\nimport type { SkillsMarketplaceProvider } from './adapters/store/store-api-client.js';\n\nimport type { SkillsMarketplaceAdapter } from './adapter.types.js';\nimport { skillhubMarketplaceAdapter } from './adapters/skillhub/adapter.js';\nimport { storeMarketplaceAdapter } from './adapters/store/adapter.js';\n\nexport function resolveSkillsMarketplaceProvider(config: Config): SkillsMarketplaceProvider {\n  const env = process.env.XOPC_SKILLS_MARKETPLACE_PROVIDER?.trim().toLowerCase();\n  if (env === 'skillhub' || env === 'store') {\n    return env;\n  }\n  const fromConfig = config.gateway?.skillsMarketplaceProvider;\n  if (fromConfig === 'skillhub' || fromConfig === 'store') {\n    return fromConfig;\n  }\n  return 'skillhub';\n}\n\nexport function getMarketplaceProviderDisplayName(provider: SkillsMarketplaceProvider): string {\n  switch (provider) {\n    case 'skillhub':\n      return 'SkillHub (skillhub.cn)';\n    case 'store':\n    default:\n      return 'xopc Store (store.xopc.ai)';\n  }\n}\n\nexport function getMarketplaceAdapter(config: Config): SkillsMarketplaceAdapter {\n  const id = resolveSkillsMarketplaceProvider(config);\n  switch (id) {\n    case 'skillhub':\n      return skillhubMarketplaceAdapter;\n    default:\n      return storeMarketplaceAdapter;\n  }\n}\n"],"mappings":";;;AAOA,SAAgB,iCAAiC,QAA2C;CAC1F,MAAM,MAAM,QAAQ,IAAI,kCAAkC,MAAM,CAAC,aAAa;AAC9E,KAAI,QAAQ,cAAc,QAAQ,QAChC,QAAO;CAET,MAAM,aAAa,OAAO,SAAS;AACnC,KAAI,eAAe,cAAc,eAAe,QAC9C,QAAO;AAET,QAAO;;AAGT,SAAgB,kCAAkC,UAA6C;AAC7F,SAAQ,UAAR;EACE,KAAK,WACH,QAAO;EAET,QACE,QAAO;;;AAIb,SAAgB,sBAAsB,QAA0C;AAE9E,SADW,iCAAiC,OAClC,EAAV;EACE,KAAK,WACH,QAAO;EACT,QACE,QAAO"}

package/dist/src/agent/skills/parse-skill-metadata.d.ts

@@ -0,0 +1,5 @@
+import type { SkillMetadata } from './types.js';
+/**
+ * Maps SKILL.md YAML frontmatter to {@link SkillMetadata} (Hermes / xopc shapes).
+ */
+export declare function parseSkillMetadata(frontmatter: Record<string, unknown>): SkillMetadata;

package/dist/src/agent/skills/parse-skill-metadata.js

@@ -0,0 +1,27 @@
+//#region src/agent/skills/parse-skill-metadata.ts
+/**
+* Maps SKILL.md YAML frontmatter to {@link SkillMetadata} (Hermes / xopc shapes).
+*/
+function parseSkillMetadata(frontmatter) {
+	const xopcMeta = frontmatter.metadata?.xopc;
+	const metadata = {
+		name: frontmatter.name || "",
+		description: frontmatter.description || "",
+		emoji: xopcMeta?.emoji || frontmatter.emoji || void 0,
+		homepage: frontmatter.homepage || void 0,
+		os: xopcMeta?.os || frontmatter.os || void 0,
+		requires: xopcMeta?.requires || frontmatter.requires || void 0,
+		install: xopcMeta?.install || frontmatter.install || void 0
+	};
+	if (xopcMeta) metadata.xopc = {
+		emoji: xopcMeta.emoji,
+		requires: xopcMeta.requires,
+		install: xopcMeta.install,
+		os: xopcMeta.os
+	};
+	return metadata;
+}
+//#endregion
+export { parseSkillMetadata };
+
+//# sourceMappingURL=parse-skill-metadata.js.map

package/dist/src/agent/skills/parse-skill-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-skill-metadata.js","names":[],"sources":["../../../../src/agent/skills/parse-skill-metadata.ts"],"sourcesContent":["import type { SkillInstallSpec, SkillMetadata, SkillRequires } from './types.js';\n\n/**\n * Maps SKILL.md YAML frontmatter to {@link SkillMetadata} (Hermes / xopc shapes).\n */\nexport function parseSkillMetadata(frontmatter: Record<string, unknown>): SkillMetadata {\n  const meta = frontmatter.metadata as Record<string, unknown> | undefined;\n  const xopcMeta = meta?.xopc as Record<string, unknown> | undefined;\n\n  const metadata: SkillMetadata = {\n    name: (frontmatter.name as string) || '',\n    description: (frontmatter.description as string) || '',\n    emoji: (xopcMeta?.emoji as string) || (frontmatter.emoji as string) || undefined,\n    homepage: (frontmatter.homepage as string) || undefined,\n    os:\n      (xopcMeta?.os as Array<'darwin' | 'linux' | 'win32'>) ||\n      (frontmatter.os as Array<'darwin' | 'linux' | 'win32'>) ||\n      undefined,\n    requires:\n      (xopcMeta?.requires as SkillRequires) || (frontmatter.requires as SkillRequires) || undefined,\n    install:\n      (xopcMeta?.install as SkillInstallSpec[]) || (frontmatter.install as SkillInstallSpec[]) || undefined,\n  };\n\n  if (xopcMeta) {\n    metadata.xopc = {\n      emoji: xopcMeta.emoji as string | undefined,\n      requires: xopcMeta.requires as SkillRequires | undefined,\n      install: xopcMeta.install as SkillInstallSpec[] | undefined,\n      os: xopcMeta.os as Array<'darwin' | 'linux' | 'win32'> | undefined,\n    };\n  }\n\n  return metadata;\n}\n"],"mappings":";;;;AAKA,SAAgB,mBAAmB,aAAqD;CAEtF,MAAM,WADO,YAAY,UACF;CAEvB,MAAM,WAA0B;EAC9B,MAAO,YAAY,QAAmB;EACtC,aAAc,YAAY,eAA0B;EACpD,OAAQ,UAAU,SAAqB,YAAY,SAAoB,KAAA;EACvE,UAAW,YAAY,YAAuB,KAAA;EAC9C,IACG,UAAU,MACV,YAAY,MACb,KAAA;EACF,UACG,UAAU,YAA+B,YAAY,YAA8B,KAAA;EACtF,SACG,UAAU,WAAmC,YAAY,WAAkC,KAAA;EAC/F;AAED,KAAI,SACF,UAAS,OAAO;EACd,OAAO,SAAS;EAChB,UAAU,SAAS;EACnB,SAAS,SAAS;EAClB,IAAI,SAAS;EACd;AAGH,QAAO"}

package/dist/src/agent/skills/skill-markdown-preview-from-raw.d.ts

@@ -0,0 +1,6 @@
+import type { SkillMarkdownPreviewPayload } from './types.js';
+/** Same payload shape as `getSkillMarkdownSource`, built from raw SKILL.md text only. */
+export declare function buildSkillMarkdownPreviewFromRaw(raw: string, fallback: {
+    name: string;
+    description: string;
+}): SkillMarkdownPreviewPayload;

package/dist/src/agent/skills/skill-markdown-preview-from-raw.js

@@ -0,0 +1,64 @@
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
+import { parseSkillToolConditions } from "./skill-tool-gating.js";
+import { parseRequiredEnvVarNames } from "./required-env-vars.js";
+import { parseSkillMetadata } from "./parse-skill-metadata.js";
+//#region src/agent/skills/skill-markdown-preview-from-raw.ts
+/**
+* SkillHub / hand-authored SKILL.md sometimes uses a single first line:
+* `name: slug description: long text...` without `---` YAML fences.
+*/
+function splitFlatNameDescriptionFirstLine(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const nl = trimmed.indexOf("\n");
+	const firstLine = (nl === -1 ? trimmed : trimmed.slice(0, nl)).trim();
+	const rest = nl === -1 ? "" : trimmed.slice(nl + 1).trim();
+	const m = firstLine.match(/^name:\s+(\S+)\s+description:\s+(.+)$/i);
+	if (!m) return null;
+	return {
+		name: m[1],
+		description: m[2].trim(),
+		body: rest
+	};
+}
+/** Same payload shape as `getSkillMarkdownSource`, built from raw SKILL.md text only. */
+function buildSkillMarkdownPreviewFromRaw(raw, fallback) {
+	const flat = splitFlatNameDescriptionFirstLine(raw);
+	if (flat) {
+		const metadata = parseSkillMetadata({
+			name: flat.name,
+			description: flat.description
+		});
+		return {
+			name: flat.name,
+			description: flat.description || fallback.description.trim(),
+			bodyMarkdown: flat.body.trim(),
+			disableModelInvocation: false,
+			metadata,
+			toolConditions: void 0,
+			requiredEnvVarNames: void 0
+		};
+	}
+	const { frontmatter, content } = parseFrontmatter(raw.trim());
+	const fm = frontmatter;
+	const name = typeof fm.name === "string" && fm.name.trim() || fallback.name;
+	const description = (typeof fm.description === "string" ? fm.description.trim() : "") || fallback.description.trim() || "";
+	const metadata = parseSkillMetadata(fm);
+	if (!metadata.name.trim()) metadata.name = name;
+	if (!metadata.description.trim()) metadata.description = description;
+	const toolConditions = parseSkillToolConditions(fm);
+	const requiredEnvVarNames = parseRequiredEnvVarNames(fm);
+	return {
+		name,
+		description,
+		bodyMarkdown: content.trim(),
+		disableModelInvocation: fm["disable-model-invocation"] === true,
+		metadata,
+		toolConditions,
+		requiredEnvVarNames: requiredEnvVarNames.length > 0 ? requiredEnvVarNames : void 0
+	};
+}
+//#endregion
+export { buildSkillMarkdownPreviewFromRaw };
+
+//# sourceMappingURL=skill-markdown-preview-from-raw.js.map

package/dist/src/agent/skills/skill-markdown-preview-from-raw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-markdown-preview-from-raw.js","names":[],"sources":["../../../../src/agent/skills/skill-markdown-preview-from-raw.ts"],"sourcesContent":["import { parseFrontmatter } from '../../markdown/frontmatter.js';\nimport { parseRequiredEnvVarNames } from './required-env-vars.js';\nimport { parseSkillMetadata } from './parse-skill-metadata.js';\nimport { parseSkillToolConditions } from './skill-tool-gating.js';\nimport type { SkillMarkdownPreviewPayload } from './types.js';\n\n/**\n * SkillHub / hand-authored SKILL.md sometimes uses a single first line:\n * `name: slug description: long text...` without `---` YAML fences.\n */\nfunction splitFlatNameDescriptionFirstLine(raw: string): { name: string; description: string; body: string } | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  const nl = trimmed.indexOf('\\n');\n  const firstLine = (nl === -1 ? trimmed : trimmed.slice(0, nl)).trim();\n  const rest = nl === -1 ? '' : trimmed.slice(nl + 1).trim();\n  const m = firstLine.match(/^name:\\s+(\\S+)\\s+description:\\s+(.+)$/i);\n  if (!m) return null;\n  return { name: m[1], description: m[2].trim(), body: rest };\n}\n\n/** Same payload shape as `getSkillMarkdownSource`, built from raw SKILL.md text only. */\nexport function buildSkillMarkdownPreviewFromRaw(\n  raw: string,\n  fallback: { name: string; description: string },\n): SkillMarkdownPreviewPayload {\n  const flat = splitFlatNameDescriptionFirstLine(raw);\n  if (flat) {\n    const fm = { name: flat.name, description: flat.description };\n    const metadata = parseSkillMetadata(fm);\n    return {\n      name: flat.name,\n      description: flat.description || fallback.description.trim(),\n      bodyMarkdown: flat.body.trim(),\n      disableModelInvocation: false,\n      metadata,\n      toolConditions: undefined,\n      requiredEnvVarNames: undefined,\n    };\n  }\n\n  const { frontmatter, content } = parseFrontmatter(raw.trim());\n  const fm = frontmatter as Record<string, unknown>;\n  const name = (typeof fm.name === 'string' && fm.name.trim()) || fallback.name;\n  const descFromFm = typeof fm.description === 'string' ? fm.description.trim() : '';\n  const description = descFromFm || fallback.description.trim() || '';\n  const metadata = parseSkillMetadata(fm);\n  if (!metadata.name.trim()) metadata.name = name;\n  if (!metadata.description.trim()) metadata.description = description;\n\n  const toolConditions = parseSkillToolConditions(fm);\n  const requiredEnvVarNames = parseRequiredEnvVarNames(fm);\n\n  return {\n    name,\n    description,\n    bodyMarkdown: content.trim(),\n    disableModelInvocation: fm['disable-model-invocation'] === true,\n    metadata,\n    toolConditions,\n    requiredEnvVarNames: requiredEnvVarNames.length > 0 ? requiredEnvVarNames : undefined,\n  };\n}\n"],"mappings":";;;;;;;;;AAUA,SAAS,kCAAkC,KAAyE;CAClH,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,KAAK,QAAQ,QAAQ,KAAK;CAChC,MAAM,aAAa,OAAO,KAAK,UAAU,QAAQ,MAAM,GAAG,GAAG,EAAE,MAAM;CACrE,MAAM,OAAO,OAAO,KAAK,KAAK,QAAQ,MAAM,KAAK,EAAE,CAAC,MAAM;CAC1D,MAAM,IAAI,UAAU,MAAM,yCAAyC;AACnE,KAAI,CAAC,EAAG,QAAO;AACf,QAAO;EAAE,MAAM,EAAE;EAAI,aAAa,EAAE,GAAG,MAAM;EAAE,MAAM;EAAM;;;AAI7D,SAAgB,iCACd,KACA,UAC6B;CAC7B,MAAM,OAAO,kCAAkC,IAAI;AACnD,KAAI,MAAM;EAER,MAAM,WAAW,mBAAmB;GADvB,MAAM,KAAK;GAAM,aAAa,KAAK;GACV,CAAC;AACvC,SAAO;GACL,MAAM,KAAK;GACX,aAAa,KAAK,eAAe,SAAS,YAAY,MAAM;GAC5D,cAAc,KAAK,KAAK,MAAM;GAC9B,wBAAwB;GACxB;GACA,gBAAgB,KAAA;GAChB,qBAAqB,KAAA;GACtB;;CAGH,MAAM,EAAE,aAAa,YAAY,iBAAiB,IAAI,MAAM,CAAC;CAC7D,MAAM,KAAK;CACX,MAAM,OAAQ,OAAO,GAAG,SAAS,YAAY,GAAG,KAAK,MAAM,IAAK,SAAS;CAEzE,MAAM,eADa,OAAO,GAAG,gBAAgB,WAAW,GAAG,YAAY,MAAM,GAAG,OAC9C,SAAS,YAAY,MAAM,IAAI;CACjE,MAAM,WAAW,mBAAmB,GAAG;AACvC,KAAI,CAAC,SAAS,KAAK,MAAM,CAAE,UAAS,OAAO;AAC3C,KAAI,CAAC,SAAS,YAAY,MAAM,CAAE,UAAS,cAAc;CAEzD,MAAM,iBAAiB,yBAAyB,GAAG;CACnD,MAAM,sBAAsB,yBAAyB,GAAG;AAExD,QAAO;EACL;EACA;EACA,cAAc,QAAQ,MAAM;EAC5B,wBAAwB,GAAG,gCAAgC;EAC3D;EACA;EACA,qBAAqB,oBAAoB,SAAS,IAAI,sBAAsB,KAAA;EAC7E"}

package/dist/src/agent/skills/skill-view-path.d.ts

@@ -1,7 +1,8 @@
 /**
  * Resolve safe paths for skill_view: only SKILL.md (default) or files under allowlisted subdirs.
+ * Also provides localized SKILL.md resolution for multi-language display.
  */
-import type { Skill } from './types.js';
+import type { Skill, SkillMarkdownPreviewPayload } from './types.js';
 export type ResolveSkillFileResult = {
     ok: true;
     absolutePath: string;
@@ -14,3 +15,18 @@ export type ResolveSkillFileResult = {
  * Other paths must live under references/, templates/, scripts/, or assets/.
  */
 export declare function resolveSkillReadablePath(skill: Skill, subPath: string | undefined): ResolveSkillFileResult;
+/**
+ * Resolve a localized SKILL.md for display (e.g. SKILL-zh.md, SKILL-en.md).
+ * Falls back to the base SKILL.md content if no localized file exists.
+ *
+ * This is the **display** path — execution always reads the base SKILL.md.
+ */
+export declare function resolveLocalizedSkillMarkdown(skill: Skill, lang?: string): SkillMarkdownPreviewPayload | null;
+/**
+ * Lightweight localized name/description lookup (frontmatter only) for list views.
+ * Reuses the same SKILL-{lang}.md resolution as {@link resolveLocalizedSkillMarkdown}.
+ */
+export declare function resolveLocalizedSkillMeta(skill: Skill, lang: string): {
+    name: string;
+    description: string;
+} | null;