crewly 1.0.7 → 1.0.10

package/dist/backend/backend/src/services/marketplace/marketplace-submission.service.js

@@ -0,0 +1,339 @@
+/**
+ * Marketplace Submission Service
+ *
+ * Handles skill submissions to the marketplace, including validation,
+ * archive storage, and review workflow management.
+ *
+ * Submissions are stored locally in ~/.crewly/marketplace/submissions/
+ * with a manifest.json tracking all submissions and their status.
+ *
+ * @module services/marketplace/marketplace-submission.service
+ */
+import path from 'path';
+import { homedir } from 'os';
+import { mkdir, readFile, writeFile, copyFile, rm } from 'fs/promises';
+import { existsSync } from 'fs';
+import { createHash, randomUUID } from 'crypto';
+import * as tar from 'tar';
+import { MARKETPLACE_CONSTANTS } from '../../constants.js';
+const MARKETPLACE_DIR = path.join(homedir(), '.crewly', MARKETPLACE_CONSTANTS.DIR_NAME);
+const SUBMISSIONS_DIR = path.join(MARKETPLACE_DIR, MARKETPLACE_CONSTANTS.SUBMISSIONS_DIR);
+const SUBMISSIONS_MANIFEST_PATH = path.join(SUBMISSIONS_DIR, 'manifest.json');
+/** Kebab-case pattern for skill IDs */
+const KEBAB_CASE_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+/** Semver pattern (major.minor.patch) */
+const SEMVER_RE = /^\d+\.\d+\.\d+$/;
+/**
+ * Loads the submissions manifest from disk.
+ *
+ * Returns an empty manifest if the file does not exist or is unparsable.
+ *
+ * @returns The submissions manifest
+ */
+export async function loadSubmissionsManifest() {
+    try {
+        const data = await readFile(SUBMISSIONS_MANIFEST_PATH, 'utf-8');
+        return JSON.parse(data);
+    }
+    catch {
+        return { schemaVersion: 1, submissions: [] };
+    }
+}
+/**
+ * Saves the submissions manifest to disk.
+ *
+ * Creates the submissions directory if it does not exist.
+ *
+ * @param manifest - The manifest to persist
+ */
+export async function saveSubmissionsManifest(manifest) {
+    await mkdir(SUBMISSIONS_DIR, { recursive: true });
+    await writeFile(SUBMISSIONS_MANIFEST_PATH, JSON.stringify(manifest, null, 2) + '\n');
+}
+/**
+ * Validates a skill.json manifest from a submitted archive.
+ *
+ * @param manifest - Parsed skill.json content
+ * @returns Array of validation error messages (empty if valid)
+ */
+function validateSkillManifest(manifest) {
+    const errors = [];
+    if (!manifest.id || typeof manifest.id !== 'string') {
+        errors.push('skill.json missing required field: id');
+    }
+    else if (!KEBAB_CASE_RE.test(manifest.id)) {
+        errors.push(`skill.json id must be kebab-case: "${manifest.id}"`);
+    }
+    if (!manifest.name || typeof manifest.name !== 'string') {
+        errors.push('skill.json missing required field: name');
+    }
+    if (!manifest.description || typeof manifest.description !== 'string') {
+        errors.push('skill.json missing required field: description');
+    }
+    if (!manifest.version || typeof manifest.version !== 'string') {
+        errors.push('skill.json missing required field: version');
+    }
+    else if (!SEMVER_RE.test(manifest.version)) {
+        errors.push(`skill.json version must be semver (x.y.z): "${manifest.version}"`);
+    }
+    if (!manifest.category || typeof manifest.category !== 'string') {
+        errors.push('skill.json missing required field: category');
+    }
+    if (!Array.isArray(manifest.assignableRoles) || manifest.assignableRoles.length === 0) {
+        errors.push('skill.json must have a non-empty assignableRoles array');
+    }
+    if (!Array.isArray(manifest.tags) || manifest.tags.length === 0) {
+        errors.push('skill.json must have a non-empty tags array');
+    }
+    return errors;
+}
+/**
+ * Submits a skill package (tar.gz archive) to the marketplace for review.
+ *
+ * Performs the following steps:
+ * 1. Verifies the archive exists and is a tar.gz
+ * 2. Extracts and validates skill.json from the archive
+ * 3. Checks for duplicate submissions
+ * 4. Stores the archive in the submissions directory
+ * 5. Creates a submission record in the manifest
+ *
+ * @param archivePath - Path to the tar.gz archive to submit
+ * @returns Operation result with the submission record
+ */
+export async function submitSkill(archivePath) {
+    try {
+        if (!existsSync(archivePath)) {
+            return { success: false, message: `Archive not found: ${archivePath}` };
+        }
+        if (!archivePath.endsWith('.tar.gz')) {
+            return { success: false, message: 'Archive must be a .tar.gz file' };
+        }
+        // Extract skill.json first, then read archive for checksum (avoids reading file twice)
+        let skillManifest;
+        try {
+            skillManifest = await extractSkillJson(archivePath);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { success: false, message: `Invalid skill archive: ${msg}` };
+        }
+        // Compute checksum
+        const archiveData = await readFile(archivePath);
+        const hash = createHash('sha256').update(archiveData).digest('hex');
+        const checksum = `sha256:${hash}`;
+        // Validate skill.json
+        const validationErrors = validateSkillManifest(skillManifest);
+        if (validationErrors.length > 0) {
+            return { success: false, message: `Validation failed: ${validationErrors.join('; ')}` };
+        }
+        const skillId = skillManifest.id;
+        // Check for duplicate submissions
+        const manifest = await loadSubmissionsManifest();
+        const existing = manifest.submissions.find((s) => s.skillId === skillId && s.status === 'pending');
+        if (existing) {
+            return { success: false, message: `Skill "${skillId}" already has a pending submission` };
+        }
+        // Store the archive
+        await mkdir(SUBMISSIONS_DIR, { recursive: true });
+        const storedArchiveName = `${skillId}-${skillManifest.version}.tar.gz`;
+        const storedArchivePath = path.join(SUBMISSIONS_DIR, storedArchiveName);
+        await copyFile(archivePath, storedArchivePath);
+        // Create submission record
+        const submission = {
+            id: randomUUID(),
+            skillId,
+            name: skillManifest.name,
+            description: skillManifest.description,
+            author: skillManifest.author || 'Community',
+            version: skillManifest.version,
+            category: skillManifest.category,
+            tags: skillManifest.tags,
+            license: skillManifest.license || 'MIT',
+            status: 'pending',
+            archivePath: storedArchivePath,
+            checksum,
+            sizeBytes: archiveData.length,
+            metadata: {
+                assignableRoles: skillManifest.assignableRoles,
+                triggers: skillManifest.triggers || [],
+            },
+            submittedAt: new Date().toISOString(),
+        };
+        manifest.submissions.push(submission);
+        await saveSubmissionsManifest(manifest);
+        return {
+            success: true,
+            message: `Skill "${submission.name}" submitted for review`,
+            submission,
+        };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return { success: false, message: `Submission failed: ${msg}` };
+    }
+}
+/**
+ * Lists all submissions, optionally filtered by status.
+ *
+ * @param status - Optional status filter
+ * @returns Array of submissions
+ */
+export async function listSubmissions(status) {
+    const manifest = await loadSubmissionsManifest();
+    if (status) {
+        return manifest.submissions.filter((s) => s.status === status);
+    }
+    return manifest.submissions;
+}
+/**
+ * Gets a single submission by ID.
+ *
+ * @param id - Submission ID
+ * @returns The submission, or null if not found
+ */
+export async function getSubmission(id) {
+    const manifest = await loadSubmissionsManifest();
+    return manifest.submissions.find((s) => s.id === id) || null;
+}
+/**
+ * Reviews a submission — approving or rejecting it.
+ *
+ * When approved, the skill is added to the local registry and becomes
+ * available for installation. When rejected, the archive is removed.
+ *
+ * @param id - Submission ID
+ * @param action - 'approve' or 'reject'
+ * @param notes - Optional review notes
+ * @returns Operation result
+ */
+export async function reviewSubmission(id, action, notes) {
+    const manifest = await loadSubmissionsManifest();
+    const submission = manifest.submissions.find((s) => s.id === id);
+    if (!submission) {
+        return { success: false, message: `Submission not found: ${id}` };
+    }
+    if (submission.status !== 'pending') {
+        return { success: false, message: `Submission already ${submission.status}` };
+    }
+    const newStatus = action === 'approve' ? 'approved' : 'rejected';
+    submission.status = newStatus;
+    submission.reviewedAt = new Date().toISOString();
+    submission.reviewNotes = notes;
+    if (action === 'approve') {
+        // Add to local registry by creating the item in the assets directory
+        const assetsDir = path.join(MARKETPLACE_DIR, 'assets', 'skills', submission.skillId);
+        await mkdir(assetsDir, { recursive: true });
+        const assetArchiveName = `${submission.skillId}-${submission.version}.tar.gz`;
+        const assetPath = path.join(assetsDir, assetArchiveName);
+        if (existsSync(submission.archivePath)) {
+            await copyFile(submission.archivePath, assetPath);
+        }
+        // Add to local registry file
+        await addToLocalRegistry(submission, assetArchiveName);
+    }
+    else {
+        // Remove archive for rejected submissions
+        if (existsSync(submission.archivePath)) {
+            await rm(submission.archivePath, { force: true });
+        }
+    }
+    await saveSubmissionsManifest(manifest);
+    return {
+        success: true,
+        message: action === 'approve'
+            ? `Approved "${submission.name}" — now available in marketplace`
+            : `Rejected "${submission.name}"`,
+    };
+}
+/**
+ * Adds an approved submission to the local registry file.
+ *
+ * The local registry augments the remote registry so that locally
+ * published skills appear in the marketplace alongside remote ones.
+ *
+ * @param submission - The approved submission
+ * @param archiveFilename - Name of the archive file in assets/
+ */
+async function addToLocalRegistry(submission, archiveFilename) {
+    const localRegistryPath = path.join(MARKETPLACE_DIR, MARKETPLACE_CONSTANTS.LOCAL_REGISTRY_FILE);
+    let registry;
+    try {
+        const data = await readFile(localRegistryPath, 'utf-8');
+        registry = JSON.parse(data);
+    }
+    catch {
+        registry = { items: [] };
+    }
+    // Remove any existing entry for this skill
+    registry.items = registry.items.filter((i) => i.id !== submission.skillId);
+    // Add the new entry
+    const item = {
+        id: submission.skillId,
+        type: 'skill',
+        name: submission.name,
+        description: submission.description,
+        author: submission.author,
+        version: submission.version,
+        category: submission.category,
+        tags: submission.tags,
+        license: submission.license,
+        downloads: 0,
+        rating: 0,
+        createdAt: submission.submittedAt,
+        updatedAt: submission.reviewedAt || submission.submittedAt,
+        assets: {
+            archive: `skills/${submission.skillId}/${archiveFilename}`,
+            checksum: submission.checksum,
+            sizeBytes: submission.sizeBytes,
+        },
+        metadata: submission.metadata,
+    };
+    registry.items.push(item);
+    await writeFile(localRegistryPath, JSON.stringify(registry, null, 2) + '\n');
+}
+/**
+ * Extracts and parses skill.json from a tar.gz archive.
+ *
+ * Handles archives with various prefix structures (skill-id/skill.json,
+ * skill-name/skill.json, or flat skill.json).
+ *
+ * @param archivePath - Path to the tar.gz archive
+ * @returns Parsed skill.json content
+ * @throws Error if skill.json is not found or invalid
+ */
+async function extractSkillJson(archivePath) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const chunks = [];
+        const extract = tar.t({
+            file: archivePath,
+            onReadEntry: (entry) => {
+                const entryPath = entry.path;
+                // Match skill.json at any level
+                if (entryPath.endsWith('skill.json') && !settled) {
+                    settled = true;
+                    entry.on('data', (chunk) => chunks.push(chunk));
+                    entry.on('end', () => {
+                        try {
+                            const content = Buffer.concat(chunks).toString('utf-8');
+                            resolve(JSON.parse(content));
+                        }
+                        catch (err) {
+                            reject(new Error(`Invalid JSON in skill.json: ${err instanceof Error ? err.message : String(err)}`));
+                        }
+                    });
+                }
+            },
+        });
+        extract.then(() => {
+            if (!settled) {
+                reject(new Error('skill.json not found in archive'));
+            }
+        }).catch((err) => {
+            if (!settled) {
+                reject(err);
+            }
+        });
+    });
+}
+//# sourceMappingURL=marketplace-submission.service.js.map

package/dist/backend/backend/src/services/marketplace/marketplace-submission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace-submission.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/marketplace/marketplace-submission.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAQ3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACxF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;AAC1F,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;AAE9E,uCAAuC;AACvC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,yCAAyC;AACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAA6B;IACzE,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAiC;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAY,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAiB,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,+CAA+C,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAK,QAAQ,CAAC,eAA6B,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAK,QAAQ,CAAC,IAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB;IACnD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,WAAW,EAAE,EAAE,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;QACvE,CAAC;QAED,uFAAuF;QACvF,IAAI,aAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,GAAG,EAAE,EAAE,CAAC;QACtE,CAAC;QAED,mBAAmB;QACnB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,UAAU,IAAI,EAAE,CAAC;QAElC,sBAAsB;QACtB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,EAAY,CAAC;QAE3C,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CACvD,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,OAAO,oCAAoC,EAAE,CAAC;QAC5F,CAAC;QAED,oBAAoB;QACpB,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,iBAAiB,GAAG,GAAG,OAAO,IAAI,aAAa,CAAC,OAAiB,SAAS,CAAC;QACjF,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxE,MAAM,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAE/C,2BAA2B;QAC3B,MAAM,UAAU,GAA0B;YACxC,EAAE,EAAE,UAAU,EAAE;YAChB,OAAO;YACP,IAAI,EAAE,aAAa,CAAC,IAAc;YAClC,WAAW,EAAE,aAAa,CAAC,WAAqB;YAChD,MAAM,EAAG,aAAa,CAAC,MAAiB,IAAI,WAAW;YACvD,OAAO,EAAE,aAAa,CAAC,OAAiB;YACxC,QAAQ,EAAE,aAAa,CAAC,QAA6C;YACrE,IAAI,EAAE,aAAa,CAAC,IAAgB;YACpC,OAAO,EAAG,aAAa,CAAC,OAAkB,IAAI,KAAK;YACnD,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,iBAAiB;YAC9B,QAAQ;YACR,SAAS,EAAE,WAAW,CAAC,MAAM;YAC7B,QAAQ,EAAE;gBACR,eAAe,EAAE,aAAa,CAAC,eAAe;gBAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,EAAE;aACvC;YACD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAExC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,UAAU,UAAU,CAAC,IAAI,wBAAwB;YAC1D,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,GAAG,EAAE,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAyB;IAC7D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,MAA4B,EAC5B,KAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,uBAAuB,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAqB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IACnF,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,qEAAqE;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,gBAAgB,GAAG,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,SAAS,CAAC;QAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEzD,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QAED,6BAA6B;QAC7B,MAAM,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM,KAAK,SAAS;YAC3B,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,kCAAkC;YAChE,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,GAAG;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAC/B,UAAiC,EACjC,eAAuB;IAEvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAEhG,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACxD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;IAE3E,oBAAoB;IACpB,MAAM,IAAI,GAAoB;QAC5B,EAAE,EAAE,UAAU,CAAC,OAAO;QACtB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,QAAQ,EAAE,UAAU,CAAC,QAAuC;QAC5D,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,UAAU,CAAC,WAAW;QACjC,SAAS,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW;QAC1D,MAAM,EAAE;YACN,OAAO,EAAE,UAAU,UAAU,CAAC,OAAO,IAAI,eAAe,EAAE;YAC1D,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;QACD,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC;IAEF,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;YACpB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;gBAC7B,gCAAgC;gBAChC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjD,OAAO,GAAG,IAAI,CAAC;oBACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;wBACnB,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;4BACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC,CAAC;wBAC1D,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;wBACvG,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/backend/src/services/marketplace/marketplace.service.d.ts

@@ -7,10 +7,11 @@
  *
  * @module services/marketplace/marketplace.service
  */
-import { MarketplaceRegistry, MarketplaceItemWithStatus, MarketplaceFilter, InstalledItemsManifest, InstalledItemRecord } from '../../types/marketplace.types.js';
+import { MarketplaceRegistry, MarketplaceItemWithStatus, MarketplaceFilter, InstalledItemsManifest, InstalledItemRecord, type MarketplaceItemType } from '../../types/marketplace.types.js';
 /**
  * Fetches the marketplace registry from the Crewly webapp API.
- * Uses in-memory caching with a 1-hour TTL.
+ * Uses in-memory caching with a 1-hour TTL. Concurrent callers share
+ * the same in-flight request to avoid duplicate network fetches.
  *
  * On network failure, falls back to the previously cached registry
  * if one is available. Throws only when no cached data exists.
@@ -79,19 +80,7 @@ export declare function getInstalledItems(): Promise<InstalledItemRecord[]>;
  * @returns Matching items with install status
  */
 export declare function searchItems(query: string): Promise<MarketplaceItemWithStatus[]>;
-/**
- * Returns the local install path for a marketplace item.
- *
- * Maps item types to directory names:
- * - 'skill' -> 'skills'
- * - 'model' -> 'models'
- * - 'role'  -> 'roles'
- *
- * @param type - The marketplace item type
- * @param id - The marketplace item ID
- * @returns Absolute path to the item's install directory
- */
-export declare function getInstallPath(type: string, id: string): string;
+export declare function getInstallPath(type: MarketplaceItemType, id: string): string;
 /**
  * Resets the in-memory registry cache.
  *

package/dist/backend/backend/src/services/marketplace/marketplace.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"marketplace.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/marketplace/marketplace.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,mBAAmB,EAEnB,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAa1C;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBtF;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAOpE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAKnF;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAoChG;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAG9E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAErF;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}
+{"version":3,"file":"marketplace.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/marketplace/marketplace.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,mBAAmB,EAEnB,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACzB,MAAM,kCAAkC,CAAC;AAyB1C;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuBtF;AA+HD;;;;;;;GAOG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAOpE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAOnF;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAuChG;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAG9E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAErF;AA0CD,wBAAgB,cAAc,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC"}

package/dist/backend/backend/src/services/marketplace/marketplace.service.js

@@ -10,17 +10,29 @@
 import { homedir } from 'os';
 import path from 'path';
 import { readFile, writeFile, mkdir } from 'fs/promises';
-const MARKETPLACE_BASE_URL = 'https://crewly.stevesprompt.com';
-const REGISTRY_ENDPOINT = '/api/registry';
-const CACHE_TTL = 60 * 60 * 1000; // 1 hour
+import { MARKETPLACE_CONSTANTS } from '../../constants.js';
 const CREWLY_HOME = path.join(homedir(), '.crewly');
-const MARKETPLACE_DIR = path.join(CREWLY_HOME, 'marketplace');
-const MANIFEST_PATH = path.join(MARKETPLACE_DIR, 'manifest.json');
+const MARKETPLACE_DIR = path.join(CREWLY_HOME, MARKETPLACE_CONSTANTS.DIR_NAME);
+const MANIFEST_PATH = path.join(MARKETPLACE_DIR, MARKETPLACE_CONSTANTS.MANIFEST_FILE);
+const LOCAL_REGISTRY_PATH = path.join(MARKETPLACE_DIR, MARKETPLACE_CONSTANTS.LOCAL_REGISTRY_FILE);
+/** Pattern for valid marketplace item IDs: lowercase alphanumeric with hyphens */
+const VALID_ITEM_ID_PATTERN = /^[a-z0-9][a-z0-9\-]*$/;
 let cachedRegistry = null;
 let cacheTimestamp = 0;
+let fetchInFlight = null;
+/**
+ * Validates that a marketplace item ID is safe (no path traversal).
+ *
+ * @param id - The item ID to validate
+ * @returns True if the ID matches the allowed pattern
+ */
+function isValidItemId(id) {
+    return VALID_ITEM_ID_PATTERN.test(id);
+}
 /**
  * Fetches the marketplace registry from the Crewly webapp API.
- * Uses in-memory caching with a 1-hour TTL.
+ * Uses in-memory caching with a 1-hour TTL. Concurrent callers share
+ * the same in-flight request to avoid duplicate network fetches.
  *
  * On network failure, falls back to the previously cached registry
  * if one is available. Throws only when no cached data exists.
@@ -31,19 +43,140 @@ let cacheTimestamp = 0;
  */
 export async function fetchRegistry(forceRefresh = false) {
     const now = Date.now();
-    if (!forceRefresh && cachedRegistry && now - cacheTimestamp < CACHE_TTL) {
+    if (!forceRefresh && cachedRegistry && now - cacheTimestamp < MARKETPLACE_CONSTANTS.CACHE_TTL) {
         return cachedRegistry;
     }
-    const url = `${MARKETPLACE_BASE_URL}${REGISTRY_ENDPOINT}`;
-    const res = await fetch(url);
-    if (!res.ok) {
-        if (cachedRegistry)
-            return cachedRegistry;
-        throw new Error(`Failed to fetch registry: ${res.status} ${res.statusText}`);
+    // When forceRefresh is true, wait for any in-flight request to complete
+    // before starting a new fetch to avoid returning stale data
+    if (forceRefresh && fetchInFlight) {
+        await fetchInFlight.catch(() => { });
+        // Fall through to start a new fetch
+    }
+    // Deduplicate concurrent requests
+    if (fetchInFlight) {
+        return fetchInFlight;
+    }
+    fetchInFlight = doFetchRegistry(now).finally(() => {
+        fetchInFlight = null;
+    });
+    return fetchInFlight;
+}
+/**
+ * Internal fetch implementation. Separated to enable in-flight deduplication.
+ *
+ * Fetches from two sources in parallel:
+ * 1. Public registry -- GitHub raw content (config/skills/registry.json in crewly repo)
+ * 2. Premium registry -- crewly.stevesprompt.com/api/registry/skills (private/paid skills)
+ *
+ * Results are merged with local registry items (locally published skills).
+ *
+ * When both remote sources fail and no local items exist, the empty registry
+ * is returned but NOT cached so the next call will retry immediately.
+ */
+async function doFetchRegistry(now) {
+    // Fetch public and premium registries in parallel
+    const [publicResult, premiumResult] = await Promise.allSettled([
+        fetchPublicRegistry(),
+        fetchPremiumRegistry(),
+    ]);
+    const publicItems = publicResult.status === 'fulfilled' ? publicResult.value : [];
+    const premiumItems = premiumResult.status === 'fulfilled' ? premiumResult.value : [];
+    // If both failed and we have a cache, return cache
+    if (publicItems.length === 0 && premiumItems.length === 0 && cachedRegistry) {
+        return cachedRegistry;
+    }
+    // Merge: public + premium (premium overwrites by ID if conflict)
+    const mergedMap = new Map();
+    for (const item of publicItems) {
+        mergedMap.set(item.id, item);
+    }
+    for (const item of premiumItems) {
+        mergedMap.set(item.id, item);
+    }
+    // Merge locally published skills
+    const localItems = await loadLocalRegistry();
+    for (const item of localItems) {
+        if (!mergedMap.has(item.id)) {
+            mergedMap.set(item.id, item);
+        }
+    }
+    const registry = {
+        schemaVersion: MARKETPLACE_CONSTANTS.SCHEMA_VERSION,
+        lastUpdated: new Date().toISOString(),
+        cdnBaseUrl: MARKETPLACE_CONSTANTS.PUBLIC_CDN_BASE,
+        items: Array.from(mergedMap.values()),
+    };
+    // Only cache non-empty registries so that next call retries on total failure
+    if (mergedMap.size > 0) {
+        cachedRegistry = registry;
+        cacheTimestamp = now;
+    }
+    return registry;
+}
+/**
+ * Fetches items from the public registry (GitHub raw content).
+ *
+ * @returns Array of public marketplace items, empty on failure
+ */
+async function fetchPublicRegistry() {
+    try {
+        const res = await fetch(MARKETPLACE_CONSTANTS.PUBLIC_REGISTRY_URL, {
+            signal: AbortSignal.timeout(MARKETPLACE_CONSTANTS.REGISTRY_FETCH_TIMEOUT),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            return data.items || [];
+        }
+    }
+    catch {
+        // Public registry unavailable -- continue with empty
+    }
+    return [];
+}
+/**
+ * Fetches items from the premium registry (crewly.stevesprompt.com).
+ *
+ * @returns Array of premium marketplace items with premium flag, empty on failure
+ */
+async function fetchPremiumRegistry() {
+    try {
+        const url = `${MARKETPLACE_CONSTANTS.PREMIUM_BASE_URL}${MARKETPLACE_CONSTANTS.PREMIUM_REGISTRY_ENDPOINT}`;
+        const res = await fetch(url, {
+            signal: AbortSignal.timeout(MARKETPLACE_CONSTANTS.REGISTRY_FETCH_TIMEOUT),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            return (data.items || []).map((item) => ({
+                ...item,
+                metadata: { ...item.metadata, premium: true },
+            }));
+        }
+    }
+    catch {
+        // Premium registry unavailable -- continue without premium skills
+    }
+    return [];
+}
+/**
+ * Loads locally published marketplace items from the local registry file.
+ *
+ * These are skills that were submitted and approved through the local
+ * submission workflow.
+ *
+ * @returns Array of locally published marketplace items
+ */
+async function loadLocalRegistry() {
+    try {
+        const data = await readFile(LOCAL_REGISTRY_PATH, 'utf-8');
+        const registry = JSON.parse(data);
+        if (!Array.isArray(registry.items)) {
+            return [];
+        }
+        return registry.items;
+    }
+    catch {
+        return [];
     }
-    cachedRegistry = (await res.json());
-    cacheTimestamp = now;
-    return cachedRegistry;
 }
 /**
  * Loads the locally installed items manifest from disk.
@@ -84,7 +217,9 @@ export async function getItem(id) {
     const item = registry.items.find((i) => i.id === id);
     if (!item)
         return null;
-    return enrichWithStatus(item, await loadManifest());
+    const manifest = await loadManifest();
+    const installedMap = new Map(manifest.items.map((r) => [r.id, r]));
+    return enrichWithStatusFromMap(item, installedMap);
 }
 /**
  * Lists marketplace items with optional filtering, enriched with install status.
@@ -98,7 +233,8 @@ export async function getItem(id) {
  */
 export async function listItems(filter) {
     const registry = await fetchRegistry();
-    let items = registry.items;
+    // Shallow copy to avoid mutating the cached registry's items array via .sort()
+    let items = [...registry.items];
     if (filter?.type) {
         items = items.filter((i) => i.type === filter.type);
     }
@@ -125,7 +261,9 @@ export async function listItems(filter) {
             items.sort((a, b) => b.downloads - a.downloads);
     }
     const manifest = await loadManifest();
-    return items.map((i) => enrichWithStatus(i, manifest));
+    // Use Map for O(n+m) enrichment instead of O(n*m) linear scan per item
+    const installedMap = new Map(manifest.items.map((r) => [r.id, r]));
+    return items.map((i) => enrichWithStatusFromMap(i, installedMap));
 }
 /**
  * Returns marketplace items that have updates available.
@@ -160,17 +298,14 @@ export async function searchItems(query) {
     return listItems({ search: query });
 }
 /**
- * Enriches a marketplace item with its local install status.
- *
- * Compares the registry item against the local manifest to determine
- * whether the item is not installed, installed, or has an update available.
+ * Enriches a marketplace item with its local install status using a pre-built Map.
  *
  * @param item - The marketplace item from the registry
- * @param manifest - The local installed items manifest
+ * @param installedMap - Map of installed item ID to record for O(1) lookup
  * @returns The item enriched with installStatus and optional installedVersion
  */
-function enrichWithStatus(item, manifest) {
-    const installed = manifest.items.find((r) => r.id === item.id);
+function enrichWithStatusFromMap(item, installedMap) {
+    const installed = installedMap.get(item.id);
     if (!installed) {
         return { ...item, installStatus: 'not_installed' };
     }
@@ -190,9 +325,18 @@ function enrichWithStatus(item, manifest) {
  * @param type - The marketplace item type
  * @param id - The marketplace item ID
  * @returns Absolute path to the item's install directory
+ * @throws Error if the id contains path traversal characters
  */
+const TYPE_DIR_MAP = {
+    skill: 'skills',
+    model: 'models',
+    role: 'roles',
+};
 export function getInstallPath(type, id) {
-    const typeDir = type === 'skill' ? 'skills' : type === 'model' ? 'models' : 'roles';
+    if (!isValidItemId(id)) {
+        throw new Error(`Invalid marketplace item ID "${id}": must match ${VALID_ITEM_ID_PATTERN}`);
+    }
+    const typeDir = TYPE_DIR_MAP[type];
     return path.join(MARKETPLACE_DIR, typeDir, id);
 }
 /**
@@ -203,5 +347,6 @@ export function getInstallPath(type, id) {
 export function resetRegistryCache() {
     cachedRegistry = null;
     cacheTimestamp = 0;
+    fetchInFlight = null;
 }
 //# sourceMappingURL=marketplace.service.js.map