crewx 0.8.7-rc.21 → 0.8.7-rc.22

package/dist-server/domain/market/market.service.js

@@ -1,1447 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var MarketService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MarketService = void 0;
-exports.boolToTrustLevel = boolToTrustLevel;
-exports.maxTrustLevel = maxTrustLevel;
-exports.trustLevelToIsVerified = trustLevelToIsVerified;
-const common_1 = require("@nestjs/common");
-const fs_1 = require("fs");
-const promises_1 = require("fs/promises");
-const path_1 = require("path");
-const os_1 = require("os");
-const crypto_1 = require("crypto");
-const child_process_1 = require("child_process");
-const yaml = __importStar(require("js-yaml"));
-const zod_1 = require("zod");
-const skill_1 = require("@crewx/skill");
-const workspace_context_store_js_1 = require("../../common/workspace-context.store.js");
-const analytics_client_js_1 = require("../../common/analytics.client.js");
-// --- Zod schemas ---
-const MarketPackageTypeSchema = zod_1.z.enum(['skill', 'template', 'workflow', 'plugin']);
-const TemplateEntrySchema = zod_1.z.object({
-    name: zod_1.z.string(),
-    displayName: zod_1.z.string().optional(),
-    description: zod_1.z.string().optional(),
-    author: zod_1.z.string().optional(),
-    version: zod_1.z.string().optional(),
-    tags: zod_1.z.array(zod_1.z.string()).optional(),
-    type: MarketPackageTypeSchema.optional().default('skill'),
-    path: zod_1.z.string().optional(),
-    features: zod_1.z.array(zod_1.z.string()).optional(),
-    crewxVersion: zod_1.z.string().optional(),
-});
-const MarketplaceRegistryEntrySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    name: zod_1.z.string().optional(),
-    url: zod_1.z.string(),
-    type: zod_1.z.string().optional(),
-    trust: zod_1.z.enum(['trusted', 'verified', 'unverified']).optional(),
-    verified: zod_1.z.boolean().optional(),
-    default: zod_1.z.boolean().optional(),
-    tokenEnv: zod_1.z.string().optional(),
-    allow: zod_1.z.array(zod_1.z.string()).optional(),
-});
-const MarketplaceConfigSchema = zod_1.z.object({
-    version: zod_1.z.string().optional(),
-    forceDisabled: zod_1.z.array(zod_1.z.string()).optional(),
-    forceEnabled: zod_1.z.array(zod_1.z.string()).optional(),
-    deny: zod_1.z.array(zod_1.z.string()).optional(),
-    registries: zod_1.z.array(MarketplaceRegistryEntrySchema),
-});
-const VALID_REGISTRY_SOURCE_TYPES = new Set(['crewx', 'codex', 'claude']);
-const TRUST_RANK = { trusted: 2, verified: 1, unverified: 0 };
-function boolToTrustLevel(isVerified, isDefault, source) {
-    if (source === 'builtin')
-        return 'trusted';
-    if (isDefault || isVerified)
-        return 'verified';
-    return 'unverified';
-}
-function maxTrustLevel(a, b) {
-    return TRUST_RANK[a] >= TRUST_RANK[b] ? a : b;
-}
-function trustLevelToIsVerified(level) {
-    return level !== 'unverified';
-}
-// --- Constants ---
-const DEFAULT_REGISTRY_URL = 'https://github.com/sowonlabs/crewx-templates';
-const DEFAULT_REGISTRY_NAME = 'crewx-templates';
-const MARKETPLACE_REMOTE_URL = 'https://raw.githubusercontent.com/sowonlabs/crewx-templates/main/marketplace.json';
-const MARKETPLACE_CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24h
-function loadBundledMarketplace() {
-    try {
-        const bundlePath = (0, path_1.join)(__dirname, 'default-marketplace.json');
-        const raw = JSON.parse((0, fs_1.readFileSync)(bundlePath, 'utf-8'));
-        const result = MarketplaceConfigSchema.safeParse(raw);
-        return result.success ? result.data : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Cache TTL: 15 minutes (§4.3 rate limit)
-const CACHE_TTL_MS = 15 * 60 * 1000;
-let MarketService = MarketService_1 = class MarketService {
-    logger = new common_1.Logger(MarketService_1.name);
-    analytics;
-    constructor(analytics) {
-        this.analytics = analytics;
-    }
-    // In-memory cache for templates.json fetches
-    templateCache = new Map();
-    marketplaceMemoryCache = null;
-    marketplaceRefreshPending = false;
-    get skillsDir() {
-        return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), 'skills');
-    }
-    get configPath() {
-        return process.env.CREWX_CONFIG || (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), 'crewx.yaml');
-    }
-    get registryCachePath() {
-        return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), '.crewx', 'registry.json');
-    }
-    get lockFilePath() {
-        return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), '.crewx', 'skills.lock.json');
-    }
-    get marketplacePath() {
-        return (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'marketplace.json');
-    }
-    get marketplaceCachePath() {
-        return (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'marketplace.cache.json');
-    }
-    get workspaceMarketplacePath() {
-        return (0, path_1.join)((0, workspace_context_store_js_1.getWorkspacePath)(), '.crewx', 'marketplace.json');
-    }
-    // --- Path traversal guard ---
-    validateItemName(name) {
-        if (name.includes('..') || name.includes('/') || name.includes('\\')) {
-            throw new common_1.BadRequestException('Invalid skill name');
-        }
-        const resolved = (0, path_1.resolve)(this.skillsDir, name);
-        if (!resolved.startsWith((0, path_1.resolve)(this.skillsDir))) {
-            throw new common_1.BadRequestException('Path traversal detected');
-        }
-    }
-    // --- Registry CRUD ---
-    listRegistries() {
-        const entries = this.loadRegistries();
-        const registries = entries.map((r) => ({
-            ...r,
-            isVerified: trustLevelToIsVerified(r.trustLevel),
-            itemCount: this.getCachedItemCount(r.id),
-        }));
-        return { registries };
-    }
-    addRegistry(url, tokenEnv) {
-        if (!url || typeof url !== 'string') {
-            throw new common_1.BadRequestException('url is required');
-        }
-        const parsed = this.parseGitHubUrl(url);
-        if (!parsed) {
-            throw new common_1.BadRequestException('Invalid GitHub repository URL. Expected format: https://github.com/{owner}/{repo}');
-        }
-        if (tokenEnv !== undefined) {
-            this.validateTokenEnv(tokenEnv);
-        }
-        const mpConfig = this.loadMarketplaceJson();
-        if (mpConfig?.forceDisabled?.length) {
-            const disabledSet = new Set(mpConfig.forceDisabled);
-            const parsedInput = this.parseGitHubUrl(url);
-            const blockedByPolicy = mpConfig.registries.some((r) => {
-                if (!disabledSet.has(r.id))
-                    return false;
-                const parsedBlocked = this.parseGitHubUrl(r.url);
-                if (!parsedInput || !parsedBlocked)
-                    return false;
-                return (parsedInput.owner.toLowerCase() === parsedBlocked.owner.toLowerCase() &&
-                    parsedInput.repo.toLowerCase() === parsedBlocked.repo.toLowerCase());
-            });
-            if (blockedByPolicy) {
-                throw new common_1.BadRequestException('This registry is blocked by marketplace policy (forceDisabled)');
-            }
-        }
-        const entries = this.loadRegistries();
-        // Check duplicate URL
-        const normalized = this.normalizeUrl(url);
-        const exists = entries.some((r) => this.normalizeUrl(r.url) === normalized);
-        if (exists) {
-            throw new common_1.BadRequestException('Registry with this URL already exists');
-        }
-        const entry = {
-            id: (0, crypto_1.randomUUID)(),
-            name: parsed.repo,
-            url: normalized,
-            type: 'crewx',
-            trustLevel: 'unverified',
-            isDefault: false,
-            addedAt: new Date().toISOString(),
-            source: 'workspace',
-            ...(tokenEnv ? { tokenEnv } : {}),
-        };
-        entries.push(entry);
-        this.saveRegistries(entries);
-        return { ...entry, isVerified: trustLevelToIsVerified(entry.trustLevel), itemCount: 0 };
-    }
-    deleteRegistry(id) {
-        const entries = this.loadRegistries();
-        const idx = entries.findIndex((r) => r.id === id);
-        if (idx === -1) {
-            throw new common_1.NotFoundException(`Registry '${id}' not found`);
-        }
-        if (entries[idx].isDefault) {
-            throw new common_1.BadRequestException('Cannot delete the default registry');
-        }
-        if (entries[idx].source === 'global') {
-            throw new common_1.BadRequestException('Cannot delete official registry from marketplace policy');
-        }
-        entries.splice(idx, 1);
-        this.saveRegistries(entries);
-        this.templateCache.delete(id);
-    }
-    // --- Market item listing ---
-    async listMarketItems(registryId) {
-        const entries = this.loadRegistries();
-        const registry = entries.find((r) => r.id === registryId);
-        if (!registry) {
-            throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
-        }
-        const templates = await this.fetchTemplates(registry);
-        const [installedNames, installStats] = await Promise.all([
-            this.getInstalledItemNames(),
-            this.analytics.fetchInstallStats(templates.map((t) => t.name)),
-        ]);
-        const installedSlugs = new Set([...installedNames].map((n) => n.toLowerCase().replace(/[\s_]+/g, '-')));
-        const items = templates.map((t) => ({
-            name: t.name,
-            displayName: t.displayName || t.name,
-            description: t.description || '',
-            author: t.author || '',
-            version: t.version || '0.0.0',
-            tags: t.tags || [],
-            type: t.type || 'template',
-            trustLevel: registry.trustLevel,
-            isVerified: trustLevelToIsVerified(registry.trustLevel),
-            isInstalled: installedNames.has(t.name) ||
-                installedSlugs.has(t.name.toLowerCase().replace(/[\s_]+/g, '-')),
-            registryId: registry.id,
-            registryName: registry.name,
-            installCount: installStats[t.name]?.unique ?? 0,
-        }));
-        return { items };
-    }
-    async listAllMarketItems() {
-        const registries = this.loadRegistries();
-        const [installedNames, ...templateResults] = await Promise.all([
-            this.getInstalledItemNames(),
-            ...registries.map((registry) => this.fetchTemplates(registry)
-                .then((templates) => ({ registry, templates }))
-                .catch(() => ({ registry, templates: [] }))),
-        ]);
-        const installedSlugs = new Set([...installedNames].map((n) => n.toLowerCase().replace(/[\s_]+/g, '-')));
-        const allNames = templateResults.flatMap(({ templates }) => templates.map((t) => t.name));
-        const installStats = await this.analytics.fetchInstallStats(allNames);
-        const items = [];
-        for (const { registry, templates } of templateResults) {
-            for (const t of templates) {
-                items.push({
-                    name: t.name,
-                    displayName: t.displayName || t.name,
-                    description: t.description || '',
-                    author: t.author || '',
-                    version: t.version || '0.0.0',
-                    tags: t.tags || [],
-                    type: t.type || 'template',
-                    trustLevel: registry.trustLevel,
-                    isVerified: trustLevelToIsVerified(registry.trustLevel),
-                    isInstalled: installedNames.has(t.name) ||
-                        installedSlugs.has(t.name.toLowerCase().replace(/[\s_]+/g, '-')),
-                    registryId: registry.id,
-                    registryName: registry.name,
-                    installCount: installStats[t.name]?.unique ?? 0,
-                });
-            }
-        }
-        return { items };
-    }
-    // --- Install / Uninstall ---
-    async installMarketItem(registryId, marketName) {
-        this.validateItemName(marketName);
-        const entries = this.loadRegistries();
-        const registry = entries.find((r) => r.id === registryId);
-        if (!registry) {
-            throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
-        }
-        // Deny list: block packages listed in marketplace.json deny[]
-        const mpConfig = this.loadMarketplaceJson();
-        if (mpConfig?.deny?.length) {
-            const denySet = new Set(mpConfig.deny.map((d) => d.toLowerCase()));
-            if (denySet.has(marketName.toLowerCase())) {
-                throw new common_1.BadRequestException(`Package '${marketName}' is blocked by marketplace policy (deny list).`);
-            }
-        }
-        const templates = await this.fetchTemplates(registry);
-        const template = templates.find((t) => t.name === marketName);
-        if (!template) {
-            throw new common_1.NotFoundException(`Skill '${marketName}' not found in registry '${registry.name}'`);
-        }
-        // Block exec/plugin from unverified registries (security policy — 마켓-설계서 6.1)
-        if (registry.trustLevel === 'unverified') {
-            if (template.type === 'exec') {
-                throw new common_1.BadRequestException('Unverified registry exec skill installation is blocked for security.\n' +
-                    'Use a verified registry or manually copy the skill files.');
-            }
-            if (template.type === 'plugin') {
-                throw new common_1.BadRequestException('Unverified registry plugin installation is blocked for security.\n' +
-                    'Use a verified registry or manually copy the plugin files.');
-            }
-        }
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed) {
-            throw new common_1.BadRequestException('Invalid registry URL');
-        }
-        const skillPath = template.path || marketName;
-        const targetDir = (0, path_1.join)(this.skillsDir, marketName);
-        const tempDir = (0, path_1.join)(this.skillsDir, `.tmp-${marketName}-${Date.now()}`);
-        try {
-            // 1. Fetch GitHub Trees API to get full file list
-            const treesUrl = `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/git/trees/main?recursive=1`;
-            const treesRes = await fetch(treesUrl, { headers: this.getGitHubHeaders(registry) });
-            if (!treesRes.ok) {
-                throw new Error(`Trees API: HTTP ${treesRes.status} ${treesRes.statusText}`);
-            }
-            const treesData = await treesRes.json();
-            // 2. Filter: blobs under skillPath/ with safety exclusions
-            const BLOCKED_PREFIXES = ['node_modules/', '.git/'];
-            const skillPrefix = `${skillPath}/`;
-            const files = treesData.tree.filter((item) => {
-                if (item.type !== 'blob')
-                    return false;
-                if (!item.path.startsWith(skillPrefix))
-                    return false;
-                const relPath = item.path.slice(skillPrefix.length);
-                if (!relPath)
-                    return false;
-                // Safety filter: block node_modules/, .git/, and .env files
-                if (BLOCKED_PREFIXES.some((p) => relPath.startsWith(p)))
-                    return false;
-                if (relPath === '.env' || relPath.startsWith('.env/'))
-                    return false;
-                return true;
-            });
-            if (files.length === 0) {
-                throw new Error(`No files found in skill directory '${skillPath}'`);
-            }
-            // 3. Download all files to tempDir
-            if (!(0, fs_1.existsSync)(this.skillsDir)) {
-                (0, fs_1.mkdirSync)(this.skillsDir, { recursive: true });
-            }
-            (0, fs_1.mkdirSync)(tempDir, { recursive: true });
-            const resolvedTempDir = (0, path_1.resolve)(tempDir);
-            for (const file of files) {
-                const relPath = file.path.slice(skillPrefix.length);
-                // Path traversal guard
-                const destPath = (0, path_1.resolve)((0, path_1.join)(tempDir, relPath));
-                if (!destPath.startsWith(resolvedTempDir + path_1.sep) && destPath !== resolvedTempDir) {
-                    throw new Error(`Path traversal detected: ${relPath}`);
-                }
-                const destFileDir = (0, path_1.dirname)(destPath);
-                if (!(0, fs_1.existsSync)(destFileDir)) {
-                    (0, fs_1.mkdirSync)(destFileDir, { recursive: true });
-                }
-                const rawUrl = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/${file.path}`;
-                const fileContent = await this.fetchUrlBytes(rawUrl, this.getGitHubHeaders(registry));
-                (0, fs_1.writeFileSync)(destPath, fileContent);
-            }
-            // 3.5. Compute treeSha early (needed for Step 5.5 and Step 8)
-            const treeSha = treesData.tree.find((item) => item.type === 'tree' && item.path === skillPath)?.sha ?? '';
-            // 4. Trust check: exec skill from unverified registry → block
-            if (registry.trustLevel === 'unverified' && this.isExecItem(template, tempDir)) {
-                throw new common_1.BadRequestException('Unverified registry exec skill installation is blocked for security. ' +
-                    'Use a verified registry or manually copy the skill files.');
-            }
-            // 5. Atomic rename: backup-rename pattern for safe rollback
-            const backupDir = (0, fs_1.existsSync)(targetDir)
-                ? (0, path_1.join)(this.skillsDir, `.backup-${marketName}-${Date.now()}`)
-                : null;
-            if (backupDir) {
-                (0, fs_1.renameSync)(targetDir, backupDir);
-            }
-            try {
-                (0, fs_1.renameSync)(tempDir, targetDir);
-                if (backupDir && (0, fs_1.existsSync)(backupDir)) {
-                    (0, fs_1.rmSync)(backupDir, { recursive: true, force: true });
-                }
-            }
-            catch (renameErr) {
-                if (backupDir && (0, fs_1.existsSync)(backupDir)) {
-                    (0, fs_1.renameSync)(backupDir, targetDir);
-                }
-                throw renameErr;
-            }
-            // 5.5. Ensure SKILL.md exists and inject metadata.source (§3.3)
-            const skillMdPath = (0, path_1.join)(targetDir, 'SKILL.md');
-            if (!(0, fs_1.existsSync)(skillMdPath)) {
-                const defaultContent = [
-                    '---',
-                    `name: ${template.displayName || marketName}`,
-                    `description: "${template.description || ''}"`,
-                    `version: ${template.version || '0.0.0'}`,
-                    '---',
-                    '',
-                    `# ${template.displayName || marketName}`,
-                    '',
-                    template.description || '',
-                    '',
-                ].join('\n');
-                (0, fs_1.writeFileSync)(skillMdPath, defaultContent, 'utf-8');
-            }
-            const installedAt = new Date().toISOString();
-            this.injectSourceMetadata(skillMdPath, {
-                registry: `${parsed.owner}/${parsed.repo}`,
-                type: registry.type,
-                path: template.path ?? marketName,
-                version: template.version ?? '0.0.0',
-                treeSha,
-                installedAt,
-            });
-            // 6. Install npm dependencies if package.json exists
-            if ((0, fs_1.existsSync)((0, path_1.join)(targetDir, 'package.json'))) {
-                this.logger.log(`Installing npm dependencies for '${marketName}'`);
-                (0, child_process_1.execSync)('npm install --production --ignore-scripts', { cwd: targetDir });
-            }
-            // 7. Record install tracking in registry.json
-            this.updateRegistryInstallRecord(marketName, {
-                version: template.version,
-                registryId: registry.id,
-                installedAt,
-            });
-            // 8. Write lockfile entry (treeSha reused from Step 3.5)
-            const fileShas = {};
-            for (const item of treesData.tree) {
-                if (item.type === 'blob' && item.path.startsWith(skillPrefix)) {
-                    const relPath = item.path.slice(skillPrefix.length);
-                    if (relPath)
-                        fileShas[relPath] = item.sha;
-                }
-            }
-            const lockEntry = {
-                name: marketName,
-                version: template.version ?? '0.0.0',
-                registryId: registry.id,
-                registryUrl: registry.url,
-                treeSha,
-                fileShas,
-                installedAt,
-            };
-            const lock = this.loadLockFile();
-            lock.skills[marketName] = lockEntry;
-            this.saveLockFile(lock);
-            // Cache GitHub metadata (non-blocking — best-effort)
-            this.cacheGitHubMetadata(marketName, registry).catch((err) => {
-                this.logger.warn(`Failed to cache GitHub metadata for '${marketName}': ${err}`);
-            });
-            this.logger.log(`Installed skill '${marketName}' to ${targetDir}`);
-            this.analytics.track('market.install', {
-                item_name: marketName,
-                item_type: template.type || 'template',
-                item_version: template.version || '0.0.0',
-                registry_id: registryId,
-            });
-            return { installed: true, path: targetDir };
-        }
-        catch (err) {
-            // Cleanup temp dir on any failure
-            if ((0, fs_1.existsSync)(tempDir)) {
-                (0, fs_1.rmSync)(tempDir, { recursive: true, force: true });
-            }
-            if (err instanceof common_1.BadRequestException || err instanceof common_1.NotFoundException) {
-                throw err;
-            }
-            this.logger.error(`Failed to install skill '${marketName}': ${err}`);
-            throw new common_1.BadRequestException(`Failed to install skill '${marketName}': ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    isExecItem(template, tempDir) {
-        if (template.type === 'exec')
-            return true;
-        const pkgPath = (0, path_1.join)(tempDir, 'package.json');
-        if ((0, fs_1.existsSync)(pkgPath)) {
-            try {
-                const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf-8'));
-                if (pkg.bin || pkg.main)
-                    return true;
-            }
-            catch {
-                // ignore malformed package.json
-            }
-        }
-        return false;
-    }
-    injectSourceMetadata(skillMdPath, source) {
-        const raw = (0, fs_1.readFileSync)(skillMdPath, 'utf-8');
-        const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)/);
-        let frontmatter;
-        let body;
-        if (fmMatch) {
-            frontmatter = yaml.load(fmMatch[1]) ?? {};
-            body = fmMatch[2] ?? '';
-        }
-        else {
-            frontmatter = {};
-            body = raw;
-        }
-        const existingMetadata = frontmatter.metadata != null && typeof frontmatter.metadata === 'object'
-            ? frontmatter.metadata
-            : {};
-        frontmatter.metadata = {
-            ...existingMetadata,
-            version: frontmatter.version ?? source.version,
-            source,
-        };
-        const yamlStr = yaml.dump(frontmatter, { lineWidth: -1 });
-        (0, fs_1.writeFileSync)(skillMdPath, `---\n${yamlStr}---\n${body}`, 'utf-8');
-    }
-    updateRegistryInstallRecord(itemName, info) {
-        const cache = this.loadRegistryCache();
-        const existing = cache[itemName];
-        cache[itemName] = {
-            authors: existing?.authors ?? [],
-            stars: existing?.stars ?? 0,
-            license: existing?.license ?? '',
-            updatedAt: existing?.updatedAt ?? '',
-            fetchedAt: existing?.fetchedAt ?? '',
-            version: info.version,
-            registryId: info.registryId,
-            installedAt: info.installedAt,
-        };
-        this.saveRegistryCache(cache);
-    }
-    async fetchUrlBytes(url, headers) {
-        const response = await fetch(url, headers ? { headers } : undefined);
-        if (!response.ok) {
-            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-        }
-        return new Uint8Array(await response.arrayBuffer());
-    }
-    uninstallMarketItem(name) {
-        this.validateItemName(name);
-        const targetDir = (0, path_1.join)(this.skillsDir, name);
-        if ((0, fs_1.existsSync)(targetDir)) {
-            (0, fs_1.rmSync)(targetDir, { recursive: true, force: true });
-        }
-        const lock = this.loadLockFile();
-        delete lock.skills[name];
-        this.saveLockFile(lock);
-        this.logger.log(`Uninstalled skill '${name}'`);
-        this.analytics.track('market.uninstall', {
-            item_name: name,
-            item_type: 'skill',
-        });
-    }
-    // --- Installed items ---
-    resolveItemSource(dir, projectRoot) {
-        const nmDir = (0, path_1.join)(projectRoot, 'node_modules') + path_1.sep;
-        if (!dir.startsWith(nmDir) && dir !== (0, path_1.join)(projectRoot, 'node_modules')) {
-            return 'local';
-        }
-        const relFromNm = dir.slice(nmDir.length);
-        return relFromNm.startsWith(`@crewx${path_1.sep}`) ? 'builtin' : 'node_modules';
-    }
-    async listInstalledMarkets() {
-        const projectRoot = (0, path_1.dirname)(this.skillsDir);
-        const nmDir = (0, path_1.join)(projectRoot, 'node_modules');
-        const engine = new skill_1.SkillEngine(projectRoot, (0, fs_1.existsSync)(nmDir) ? [nmDir] : []);
-        const discovered = engine.discover();
-        const items = [];
-        for (const item of discovered) {
-            const source = this.resolveItemSource(item.dir, projectRoot);
-            if (source === 'local') {
-                const skillMdPath = item.skillMdPath ?? (0, path_1.join)(item.dir, 'SKILL.md');
-                const { frontmatter } = (0, fs_1.existsSync)(skillMdPath)
-                    ? await this.parseSkillMdAsync(skillMdPath)
-                    : { frontmatter: {} };
-                const installSource = this.detectInstallSource(item.name);
-                const cached = this.getGitHubCacheEntry(item.name);
-                let updatedAt = cached?.updatedAt;
-                if (!updatedAt) {
-                    try {
-                        updatedAt = (await (0, promises_1.stat)(skillMdPath)).mtime.toISOString();
-                    }
-                    catch {
-                        // ignore stat errors
-                    }
-                }
-                const localTrust = installSource === 'builtin' ? 'trusted' : 'unverified';
-                items.push({
-                    name: item.name,
-                    displayName: item.name,
-                    description: item.description || frontmatter.description || '',
-                    author: frontmatter.author || '',
-                    version: item.version || frontmatter.version || '0.0.0',
-                    tags: frontmatter.tags ? String(frontmatter.tags).split(',').map((t) => t.trim()) : [],
-                    type: item.type,
-                    trustLevel: localTrust,
-                    isVerified: trustLevelToIsVerified(localTrust),
-                    isInstalled: true,
-                    source,
-                    installSource,
-                    registryId: cached?.registryId,
-                    authors: cached?.authors,
-                    updatedAt,
-                    stars: cached?.stars,
-                    license: cached?.license,
-                });
-            }
-            else {
-                const nmTrust = source === 'builtin' ? 'trusted' : 'unverified';
-                items.push({
-                    name: item.name,
-                    displayName: item.name,
-                    description: item.description || '',
-                    author: '',
-                    version: item.version || '0.0.0',
-                    tags: [],
-                    type: item.type,
-                    trustLevel: nmTrust,
-                    isVerified: trustLevelToIsVerified(nmTrust),
-                    isInstalled: false,
-                    source,
-                });
-            }
-        }
-        return { items };
-    }
-    async checkUpdates() {
-        const registries = this.loadRegistries();
-        const installed = await this.listInstalledMarkets();
-        const cache = this.loadRegistryCache();
-        const updates = [];
-        const registryTemplates = new Map();
-        for (const item of installed.items) {
-            if (item.installSource !== 'registry')
-                continue;
-            const cached = cache[item.name];
-            if (!cached?.registryId)
-                continue;
-            const registry = registries.find((r) => r.id === cached.registryId);
-            if (!registry)
-                continue;
-            let templates = registryTemplates.get(registry.id);
-            if (!templates) {
-                try {
-                    templates = await this.fetchTemplates(registry);
-                    registryTemplates.set(registry.id, templates);
-                }
-                catch {
-                    continue;
-                }
-            }
-            const remote = templates.find((t) => t.name === item.name);
-            if (!remote?.version || !cached.version)
-                continue;
-            const hasUpdate = remote.version !== cached.version;
-            const isCustomized = await this.checkIsCustomized(item.name);
-            updates.push({
-                name: item.name,
-                hasUpdate,
-                installedVersion: cached.version,
-                remoteVersion: remote.version,
-                isCustomized,
-            });
-        }
-        return { updates };
-    }
-    async checkIsCustomized(_skillName) {
-        // Disabled: GitHub tree SHA vs local SHA-256 mismatch (SQA #9)
-        return false;
-    }
-    async getInstalledMarketDetail(name) {
-        this.validateItemName(name);
-        const entryPath = (0, path_1.join)(this.skillsDir, name);
-        if (!(0, fs_1.existsSync)(entryPath) || !(0, fs_1.statSync)(entryPath).isDirectory()) {
-            throw new common_1.NotFoundException(`Installed skill '${name}' not found`);
-        }
-        const skillMdPath = (0, path_1.join)(entryPath, 'SKILL.md');
-        if (!(0, fs_1.existsSync)(skillMdPath)) {
-            throw new common_1.NotFoundException(`Installed skill '${name}' not found`);
-        }
-        const { frontmatter, body } = this.parseSkillMd(skillMdPath);
-        const installSource = this.detectInstallSource(name);
-        const cached = this.getGitHubCacheEntry(name);
-        let updatedAt = cached?.updatedAt;
-        if (!updatedAt) {
-            try {
-                updatedAt = (0, fs_1.statSync)(skillMdPath).mtime.toISOString();
-            }
-            catch {
-                // ignore stat errors
-            }
-        }
-        const detailTrust = installSource === 'builtin' ? 'trusted' : 'unverified';
-        return {
-            name: frontmatter.name || name,
-            displayName: frontmatter.name || name,
-            description: frontmatter.description || '',
-            author: frontmatter.author || '',
-            version: frontmatter.version || '0.0.0',
-            tags: frontmatter.tags ? frontmatter.tags.split(',').map((t) => t.trim()) : [],
-            type: 'skill',
-            trustLevel: detailTrust,
-            isVerified: trustLevelToIsVerified(detailTrust),
-            isInstalled: true,
-            installSource,
-            authors: cached?.authors,
-            updatedAt,
-            stars: cached?.stars,
-            license: cached?.license,
-            body,
-        };
-    }
-    parseSkillMd(filePath) {
-        try {
-            const content = (0, fs_1.readFileSync)(filePath, 'utf-8');
-            return this.parseFrontmatter(content);
-        }
-        catch {
-            return { frontmatter: {}, body: '' };
-        }
-    }
-    async parseSkillMdAsync(filePath) {
-        try {
-            const content = await (0, promises_1.readFile)(filePath, 'utf-8');
-            return this.parseFrontmatter(content);
-        }
-        catch {
-            return { frontmatter: {}, body: '' };
-        }
-    }
-    parseFrontmatter(content) {
-        const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)/);
-        if (!match)
-            return { frontmatter: {}, body: content };
-        const result = {};
-        const lines = match[1].split('\n');
-        for (const line of lines) {
-            const colonIdx = line.indexOf(':');
-            if (colonIdx === -1)
-                continue;
-            const key = line.slice(0, colonIdx).trim();
-            let value = line.slice(colonIdx + 1).trim();
-            // Strip surrounding quotes
-            if ((value.startsWith('"') && value.endsWith('"')) ||
-                (value.startsWith("'") && value.endsWith("'"))) {
-                value = value.slice(1, -1);
-            }
-            if (key)
-                result[key] = value;
-        }
-        return { frontmatter: result, body: match[2] || '' };
-    }
-    async getRemoteSkillDetail(registryId, skillName) {
-        this.validateItemName(skillName);
-        const entries = this.loadRegistries();
-        const registry = entries.find((r) => r.id === registryId);
-        if (!registry) {
-            throw new common_1.NotFoundException(`Registry '${registryId}' not found`);
-        }
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed) {
-            return { body: '' };
-        }
-        const templates = await this.fetchTemplates(registry);
-        const template = templates.find((t) => t.name === skillName);
-        const skillPath = template?.path || skillName;
-        const candidates = registry.type === 'claude'
-            ? [`${skillPath}/SKILL.md`, `${skillPath}/README.md`]
-            : [`skills/${skillPath}/SKILL.md`, `${skillPath}/SKILL.md`, `skills/${skillPath}/README.md`, `${skillPath}/README.md`];
-        const headers = this.getGitHubHeaders(registry);
-        for (const candidate of candidates) {
-            const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/${candidate}`;
-            try {
-                const content = await this.fetchUrl(url, headers);
-                const { body } = this.parseFrontmatter(content);
-                return { body: body.trim() ? body : content };
-            }
-            catch {
-                continue;
-            }
-        }
-        return { body: '' };
-    }
-    detectInstallSource(itemName) {
-        const builtinDir = (0, path_1.join)(process.cwd(), 'packages', 'built-in', 'skill', 'skills', itemName);
-        if ((0, fs_1.existsSync)(builtinDir)) {
-            return 'builtin';
-        }
-        const cache = this.loadRegistryCache();
-        if (cache[itemName]?.installedAt || cache[itemName]?.fetchedAt) {
-            return 'registry';
-        }
-        return 'custom';
-    }
-    // --- Lockfile helpers ---
-    loadLockFile() {
-        if (!(0, fs_1.existsSync)(this.lockFilePath)) {
-            return { lockVersion: 1, generatedAt: new Date().toISOString(), skills: {} };
-        }
-        const data = JSON.parse((0, fs_1.readFileSync)(this.lockFilePath, 'utf-8'));
-        if (data.lockVersion !== 1) {
-            throw new Error(`Unsupported lock version: ${data.lockVersion}`);
-        }
-        return data;
-    }
-    saveLockFile(lock) {
-        lock.generatedAt = new Date().toISOString();
-        const dir = (0, path_1.dirname)(this.lockFilePath);
-        if (!(0, fs_1.existsSync)(dir)) {
-            (0, fs_1.mkdirSync)(dir, { recursive: true });
-        }
-        (0, fs_1.writeFileSync)(this.lockFilePath, JSON.stringify(lock, null, 2) + '\n', 'utf-8');
-    }
-    // --- GitHub cache helpers ---
-    loadRegistryCache() {
-        if (!(0, fs_1.existsSync)(this.registryCachePath))
-            return {};
-        try {
-            return JSON.parse((0, fs_1.readFileSync)(this.registryCachePath, 'utf-8'));
-        }
-        catch {
-            return {};
-        }
-    }
-    saveRegistryCache(cache) {
-        const dir = (0, path_1.join)(this.registryCachePath, '..');
-        if (!(0, fs_1.existsSync)(dir)) {
-            (0, fs_1.mkdirSync)(dir, { recursive: true });
-        }
-        (0, fs_1.writeFileSync)(this.registryCachePath, JSON.stringify(cache, null, 2), 'utf-8');
-    }
-    getGitHubCacheEntry(itemName) {
-        const cache = this.loadRegistryCache();
-        return cache[itemName];
-    }
-    async fetchGitHubAuthors(registry) {
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed)
-            return [];
-        try {
-            const res = await fetch(`https://api.github.com/repos/${parsed.owner}/${parsed.repo}/contributors?per_page=5`, { headers: this.getGitHubHeaders(registry) });
-            if (!res.ok)
-                return [];
-            const contributors = await res.json();
-            return contributors.map((c) => ({
-                login: c.login,
-                avatarUrl: c.avatar_url,
-                profileUrl: c.html_url,
-                contributions: c.contributions,
-            }));
-        }
-        catch {
-            return [];
-        }
-    }
-    async fetchGitHubRepoMeta(registry) {
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed)
-            return null;
-        try {
-            const res = await fetch(`https://api.github.com/repos/${parsed.owner}/${parsed.repo}`, { headers: this.getGitHubHeaders(registry) });
-            if (!res.ok)
-                return null;
-            const data = await res.json();
-            return {
-                stars: data.stargazers_count ?? 0,
-                license: data.license?.spdx_id ?? '',
-                updatedAt: data.pushed_at ?? '',
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    async cacheGitHubMetadata(itemName, registry) {
-        const [authors, meta] = await Promise.all([
-            this.fetchGitHubAuthors(registry),
-            this.fetchGitHubRepoMeta(registry),
-        ]);
-        const cache = this.loadRegistryCache();
-        cache[itemName] = {
-            ...(cache[itemName] ?? {}),
-            authors,
-            stars: meta?.stars ?? 0,
-            license: meta?.license ?? '',
-            updatedAt: meta?.updatedAt ?? '',
-            fetchedAt: new Date().toISOString(),
-        };
-        this.saveRegistryCache(cache);
-    }
-    getGitHubHeaders(registry) {
-        const headers = {
-            Accept: 'application/vnd.github.v3+json',
-            'User-Agent': 'crewx-ui',
-        };
-        const tokenEnvName = registry?.tokenEnv;
-        const token = tokenEnvName ? process.env[tokenEnvName] : process.env.GITHUB_TOKEN;
-        if (token) {
-            headers['Authorization'] = `token ${token}`;
-        }
-        return headers;
-    }
-    validateTokenEnv(tokenEnv) {
-        if (!/^[A-Z_][A-Z0-9_]*$/.test(tokenEnv)) {
-            throw new common_1.BadRequestException('tokenEnv must match pattern ^[A-Z_][A-Z0-9_]*$ (uppercase letters, digits, underscores only)');
-        }
-    }
-    // --- Internal helpers ---
-    isPlainObject(val) {
-        return Object.prototype.toString.call(val) === '[object Object]';
-    }
-    loadConfig() {
-        if (!(0, fs_1.existsSync)(this.configPath)) {
-            return {};
-        }
-        try {
-            const content = (0, fs_1.readFileSync)(this.configPath, 'utf-8');
-            const parsed = yaml.load(content);
-            if (!this.isPlainObject(parsed)) {
-                return {};
-            }
-            return parsed;
-        }
-        catch {
-            return {};
-        }
-    }
-    saveConfig(config) {
-        (0, fs_1.writeFileSync)(this.configPath, yaml.dump(config, { lineWidth: -1 }), 'utf-8');
-    }
-    parseRegistrySourceType(raw) {
-        return typeof raw === 'string' && VALID_REGISTRY_SOURCE_TYPES.has(raw)
-            ? raw
-            : 'crewx';
-    }
-    yamlToRegistryEntry(item) {
-        return {
-            id: item.id || `reg-${(0, crypto_1.randomUUID)()}`,
-            name: item.name || '',
-            url: item.url || '',
-            type: this.parseRegistrySourceType(item.type),
-            trustLevel: boolToTrustLevel(!!item.verified, !!item.default),
-            isDefault: !!item.default,
-            addedAt: item.addedAt || new Date().toISOString(),
-            ...(item.tokenEnv ? { tokenEnv: item.tokenEnv } : {}),
-        };
-    }
-    registryEntryToYaml(entry) {
-        return {
-            id: entry.id,
-            name: entry.name,
-            url: entry.url,
-            type: entry.type,
-            verified: trustLevelToIsVerified(entry.trustLevel),
-            default: entry.isDefault,
-            addedAt: entry.addedAt,
-            ...(entry.tokenEnv ? { tokenEnv: entry.tokenEnv } : {}),
-        };
-    }
-    loadMarketplaceJson() {
-        // 1. Memory cache (process lifetime)
-        if (this.marketplaceMemoryCache) {
-            const age = Date.now() - this.marketplaceMemoryCache.fetchedAt;
-            if (age >= MARKETPLACE_CACHE_TTL_MS && !this.marketplaceRefreshPending) {
-                this.marketplaceRefreshPending = true;
-                this.refreshMarketplaceRemote();
-            }
-            return this.marketplaceMemoryCache.config;
-        }
-        // 2. User-managed override (~/.crewx/marketplace.json)
-        if ((0, fs_1.existsSync)(this.marketplacePath)) {
-            try {
-                const raw = JSON.parse((0, fs_1.readFileSync)(this.marketplacePath, 'utf-8'));
-                const result = MarketplaceConfigSchema.safeParse(raw);
-                if (result.success) {
-                    const config = result.data;
-                    this.marketplaceMemoryCache = { config, fetchedAt: Date.now() };
-                    return config;
-                }
-                this.logger.warn(`Invalid marketplace.json schema: ${result.error.message}`);
-            }
-            catch {
-                this.logger.warn('Failed to parse marketplace.json');
-            }
-        }
-        // 3. Disk cache (~/.crewx/marketplace.cache.json)
-        const diskCache = this.loadMarketplaceDiskCache();
-        if (diskCache) {
-            this.marketplaceMemoryCache = diskCache;
-            if (Date.now() - diskCache.fetchedAt >= MARKETPLACE_CACHE_TTL_MS && !this.marketplaceRefreshPending) {
-                this.marketplaceRefreshPending = true;
-                this.refreshMarketplaceRemote();
-            }
-            return diskCache.config;
-        }
-        // 4. No local data — return null, let loadRegistries() handle fallback.
-        return null;
-    }
-    loadMarketplaceDiskCache() {
-        if (!(0, fs_1.existsSync)(this.marketplaceCachePath))
-            return null;
-        try {
-            const raw = JSON.parse((0, fs_1.readFileSync)(this.marketplaceCachePath, 'utf-8'));
-            if (!raw || typeof raw.fetchedAt !== 'number' || !raw.config)
-                return null;
-            const result = MarketplaceConfigSchema.safeParse(raw.config);
-            if (!result.success)
-                return null;
-            return {
-                config: result.data,
-                etag: raw.etag,
-                lastModified: raw.lastModified,
-                fetchedAt: raw.fetchedAt,
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    saveMarketplaceDiskCache(cache) {
-        try {
-            const dir = (0, path_1.dirname)(this.marketplaceCachePath);
-            if (!(0, fs_1.existsSync)(dir))
-                (0, fs_1.mkdirSync)(dir, { recursive: true });
-            (0, fs_1.writeFileSync)(this.marketplaceCachePath, JSON.stringify(cache, null, 2), 'utf-8');
-        }
-        catch {
-            this.logger.warn('Failed to save marketplace disk cache');
-        }
-    }
-    refreshMarketplaceRemote() {
-        const existing = this.marketplaceMemoryCache;
-        const headers = {};
-        if (existing?.etag)
-            headers['If-None-Match'] = existing.etag;
-        if (existing?.lastModified)
-            headers['If-Modified-Since'] = existing.lastModified;
-        fetch(MARKETPLACE_REMOTE_URL, { headers, signal: AbortSignal.timeout(10_000) })
-            .then(async (res) => {
-            if (res.status === 304) {
-                if (existing) {
-                    existing.fetchedAt = Date.now();
-                    this.saveMarketplaceDiskCache(existing);
-                }
-                return;
-            }
-            if (!res.ok)
-                return;
-            const text = await res.text();
-            const parsed = MarketplaceConfigSchema.safeParse(JSON.parse(text));
-            if (!parsed.success)
-                return;
-            const cache = {
-                config: parsed.data,
-                etag: res.headers.get('etag') ?? undefined,
-                lastModified: res.headers.get('last-modified') ?? undefined,
-                fetchedAt: Date.now(),
-            };
-            this.marketplaceMemoryCache = cache;
-            this.saveMarketplaceDiskCache(cache);
-        })
-            .catch(() => {
-            // Network failure — seed disk cache from bundled default if nothing cached yet
-            if (!this.marketplaceMemoryCache && !(0, fs_1.existsSync)(this.marketplaceCachePath)) {
-                const bundled = loadBundledMarketplace();
-                if (bundled) {
-                    const cache = { config: bundled, fetchedAt: Date.now() };
-                    this.marketplaceMemoryCache = cache;
-                    this.saveMarketplaceDiskCache(cache);
-                }
-            }
-        })
-            .finally(() => {
-            this.marketplaceRefreshPending = false;
-        });
-    }
-    loadWorkspaceMarketplaceJson() {
-        if (!(0, fs_1.existsSync)(this.workspaceMarketplacePath))
-            return null;
-        try {
-            const raw = JSON.parse((0, fs_1.readFileSync)(this.workspaceMarketplacePath, 'utf-8'));
-            const result = MarketplaceConfigSchema.safeParse(raw);
-            if (!result.success) {
-                this.logger.warn(`Invalid workspace marketplace.json schema: ${result.error.message}`);
-                return null;
-            }
-            return result.data;
-        }
-        catch {
-            this.logger.warn('Failed to parse workspace marketplace.json');
-            return null;
-        }
-    }
-    marketplaceEntryToRegistry(item) {
-        const trust = item.trust ?? boolToTrustLevel(item.verified ?? true, !!item.default);
-        return {
-            id: item.id,
-            name: item.name || '',
-            url: item.url,
-            type: this.parseRegistrySourceType(item.type),
-            trustLevel: trust,
-            isDefault: !!item.default,
-            addedAt: new Date().toISOString(),
-            ...(item.tokenEnv ? { tokenEnv: item.tokenEnv } : {}),
-        };
-    }
-    isBuiltinExempt(reg) {
-        return (reg.name.startsWith('@crewx/') ||
-            this.normalizeUrl(reg.url) === this.normalizeUrl(DEFAULT_REGISTRY_URL));
-    }
-    mergeRegistries(global, workspace, forceDisabled) {
-        const disabledSet = new Set(forceDisabled);
-        const merged = new Map();
-        for (const reg of global) {
-            if (!disabledSet.has(reg.id) || this.isBuiltinExempt(reg)) {
-                merged.set(this.normalizeUrl(reg.url), { ...reg, source: 'global' });
-            }
-        }
-        for (const reg of workspace) {
-            if (disabledSet.has(reg.id) && !this.isBuiltinExempt(reg))
-                continue;
-            const key = this.normalizeUrl(reg.url);
-            if (merged.has(key))
-                continue;
-            merged.set(key, { ...reg, source: 'workspace', trustLevel: 'unverified' });
-        }
-        return Array.from(merged.values());
-    }
-    loadRegistries() {
-        const mpConfig = this.loadMarketplaceJson();
-        const wsMpConfig = this.loadWorkspaceMarketplaceJson();
-        const config = this.loadConfig();
-        const registriesYaml = config?.skills?.registries;
-        if (!mpConfig && !wsMpConfig) {
-            // No marketplace.json anywhere — seed disk cache from remote for next restart
-            if (!this.marketplaceRefreshPending) {
-                this.marketplaceRefreshPending = true;
-                this.refreshMarketplaceRemote();
-            }
-            if (!registriesYaml || registriesYaml.length === 0) {
-                const defaults = this.getDefaultRegistries();
-                this.saveRegistries(defaults);
-                return defaults;
-            }
-            try {
-                const entries = registriesYaml.map((item) => this.yamlToRegistryEntry(item));
-                return this.ensureDefaultRegistry(entries);
-            }
-            catch {
-                const defaults = this.getDefaultRegistries();
-                this.saveRegistries(defaults);
-                return defaults;
-            }
-        }
-        const globalRegistries = mpConfig
-            ? mpConfig.registries.map((r) => this.marketplaceEntryToRegistry(r))
-            : [];
-        const forceDisabled = mpConfig?.forceDisabled ?? [];
-        let workspaceRegistries = [];
-        if (wsMpConfig) {
-            workspaceRegistries = wsMpConfig.registries.map((r) => this.marketplaceEntryToRegistry(r));
-        }
-        if (registriesYaml && registriesYaml.length > 0) {
-            try {
-                const yamlEntries = registriesYaml.map((item) => this.yamlToRegistryEntry(item));
-                workspaceRegistries = [...workspaceRegistries, ...yamlEntries];
-            }
-            catch {
-                // ignore workspace parse errors
-            }
-        }
-        const merged = this.mergeRegistries(globalRegistries, workspaceRegistries, forceDisabled);
-        return this.ensureDefaultRegistry(merged);
-    }
-    saveRegistries(entries) {
-        const config = this.loadConfig();
-        if (!this.isPlainObject(config.skills)) {
-            config.skills = {};
-        }
-        const persistable = entries.filter((e) => e.source !== 'global');
-        config.skills.registries = persistable.map((e) => this.registryEntryToYaml(e));
-        this.saveConfig(config);
-    }
-    getDefaultRegistries() {
-        return [
-            {
-                id: 'default-crewx-templates',
-                name: DEFAULT_REGISTRY_NAME,
-                url: DEFAULT_REGISTRY_URL,
-                type: 'crewx',
-                trustLevel: 'verified',
-                isDefault: true,
-                addedAt: new Date().toISOString(),
-            },
-        ];
-    }
-    ensureDefaultRegistry(entries) {
-        const defaultUrl = this.normalizeUrl(DEFAULT_REGISTRY_URL);
-        const officialEntry = entries.find((r) => this.normalizeUrl(r.url) === defaultUrl);
-        if (!officialEntry) {
-            entries.unshift(this.getDefaultRegistries()[0]);
-            this.saveRegistries(entries);
-        }
-        else if (!officialEntry.isDefault || officialEntry.trustLevel === 'unverified') {
-            officialEntry.isDefault = true;
-            officialEntry.trustLevel = 'verified';
-            this.saveRegistries(entries);
-        }
-        return entries;
-    }
-    async fetchTemplates(registry) {
-        const cached = this.templateCache.get(registry.id);
-        if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
-            return cached.data;
-        }
-        if (registry.type === 'claude') {
-            return this.fetchClaudeTemplates(registry);
-        }
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed) {
-            this.logger.warn(`Invalid registry URL: ${registry.url}`);
-            return [];
-        }
-        const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/templates.json`;
-        try {
-            const content = await this.fetchUrl(url, this.getGitHubHeaders(registry));
-            const json = JSON.parse(content);
-            const rawTemplates = json.templates || [];
-            const templates = [];
-            for (const raw of rawTemplates) {
-                const result = TemplateEntrySchema.safeParse(raw);
-                if (result.success) {
-                    templates.push(result.data);
-                }
-                else {
-                    this.logger.warn(`Skipping invalid template entry: ${JSON.stringify(result.error.flatten().fieldErrors)}`);
-                }
-            }
-            this.templateCache.set(registry.id, {
-                data: templates,
-                fetchedAt: Date.now(),
-            });
-            return templates;
-        }
-        catch (err) {
-            this.logger.warn(`Failed to fetch templates.json from ${registry.url}: ${err}`);
-            return [];
-        }
-    }
-    async fetchClaudeTemplates(registry) {
-        const parsed = this.parseGitHubUrl(registry.url);
-        if (!parsed) {
-            this.logger.warn(`Invalid registry URL: ${registry.url}`);
-            return [];
-        }
-        const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/main/.claude-plugin/marketplace.json`;
-        try {
-            const content = await this.fetchUrl(url, this.getGitHubHeaders(registry));
-            const json = JSON.parse(content);
-            const author = json.owner?.name ?? parsed.owner;
-            const version = json.metadata?.version ?? '1.0.0';
-            const templates = [];
-            for (const plugin of json.plugins ?? []) {
-                if (plugin.skills && plugin.skills.length > 0) {
-                    for (const skillRef of plugin.skills) {
-                        const skillPath = skillRef.replace(/^\.\//, '');
-                        const skillName = skillPath.split('/').pop() ?? skillPath;
-                        const displayName = skillName
-                            .split('-')
-                            .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
-                            .join(' ');
-                        templates.push({
-                            name: skillName,
-                            displayName,
-                            description: plugin.description,
-                            path: skillPath,
-                            type: 'skill',
-                            author,
-                            version,
-                        });
-                    }
-                }
-                else if (plugin.source != null) {
-                    const discovered = await this.discoverSkillsViaSource(plugin.source, parsed, registry);
-                    for (const skillName of discovered) {
-                        const displayName = skillName
-                            .split('-')
-                            .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
-                            .join(' ');
-                        templates.push({
-                            name: skillName,
-                            displayName,
-                            description: plugin.description,
-                            path: `skills/${skillName}`,
-                            type: 'skill',
-                            author,
-                            version,
-                        });
-                    }
-                }
-            }
-            this.templateCache.set(registry.id, {
-                data: templates,
-                fetchedAt: Date.now(),
-            });
-            return templates;
-        }
-        catch (err) {
-            this.logger.warn(`Failed to fetch .claude-plugin/marketplace.json from ${registry.url}: ${err}`);
-            return [];
-        }
-    }
-    async discoverSkillsViaSource(source, registryParsed, registry) {
-        let owner;
-        let repo;
-        let ref = 'main';
-        let basePath = '';
-        if (typeof source === 'string') {
-            owner = registryParsed.owner;
-            repo = registryParsed.repo;
-            basePath = source.replace(/^\.\//, '').replace(/\/+$/, '');
-        }
-        else {
-            if (source.url) {
-                const srcParsed = this.parseGitHubUrl(source.url);
-                if (!srcParsed)
-                    return [];
-                owner = srcParsed.owner;
-                repo = srcParsed.repo;
-            }
-            else {
-                owner = registryParsed.owner;
-                repo = registryParsed.repo;
-            }
-            if (source.ref)
-                ref = source.ref;
-            basePath = (source.path ?? '').replace(/^\.\//, '').replace(/\/+$/, '');
-        }
-        try {
-            const treesUrl = `https://api.github.com/repos/${owner}/${repo}/git/trees/${ref}?recursive=1`;
-            const treesRes = await fetch(treesUrl, { headers: this.getGitHubHeaders(registry) });
-            if (!treesRes.ok)
-                return [];
-            const treesData = await treesRes.json();
-            const skillsPrefix = basePath ? `${basePath}/skills/` : 'skills/';
-            const skillNames = new Set();
-            for (const item of treesData.tree) {
-                if (item.type !== 'blob')
-                    continue;
-                if (!item.path.startsWith(skillsPrefix))
-                    continue;
-                const rel = item.path.slice(skillsPrefix.length);
-                const parts = rel.split('/');
-                if (parts.length === 2 && parts[1] === 'SKILL.md') {
-                    skillNames.add(parts[0]);
-                }
-            }
-            return [...skillNames];
-        }
-        catch {
-            return [];
-        }
-    }
-    async fetchUrl(url, headers) {
-        const response = await fetch(url, headers ? { headers } : undefined);
-        if (!response.ok) {
-            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-        }
-        return response.text();
-    }
-    parseGitHubUrl(url) {
-        const match = url.match(/(?:https?:\/\/)?github\.com\/([^/]+)\/([^/.]+)/);
-        if (!match)
-            return null;
-        return { owner: match[1], repo: match[2] };
-    }
-    normalizeUrl(url) {
-        return url
-            .replace(/\.git$/, '')
-            .replace(/\/+$/, '')
-            .toLowerCase();
-    }
-    async getInstalledItemNames() {
-        if (!(0, fs_1.existsSync)(this.skillsDir))
-            return new Set();
-        try {
-            const entries = await (0, promises_1.readdir)(this.skillsDir);
-            const names = new Set();
-            for (const entry of entries) {
-                const entryPath = (0, path_1.join)(this.skillsDir, entry);
-                try {
-                    if ((await (0, promises_1.stat)(entryPath)).isDirectory()) {
-                        if ((0, fs_1.existsSync)((0, path_1.join)(entryPath, 'SKILL.md'))) {
-                            names.add(entry);
-                        }
-                    }
-                }
-                catch {
-                    // skip inaccessible entries
-                }
-            }
-            return names;
-        }
-        catch {
-            return new Set();
-        }
-    }
-    getCachedItemCount(registryId) {
-        const cached = this.templateCache.get(registryId);
-        return cached ? cached.data.length : 0;
-    }
-};
-exports.MarketService = MarketService;
-exports.MarketService = MarketService = MarketService_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [analytics_client_js_1.AnalyticsService])
-], MarketService);