dsh-skill-hub 0.0.1 → 0.2.0

package/lib/types/repo.d.ts

@@ -0,0 +1,133 @@
+/**
+ * GitHub repository skill discovery/import helpers.
+ *
+ * Kept dependency-free and mostly pure so the root/origin rules are easy to
+ * test. The two supported roots mirror the repositories we care about:
+ * `skills/**` (standard skill bundles) and `design-templates/**` (template
+ * skill bundles in nexu-io/open-design).
+ */
+import type { RepoRoot, RepoSkillEntry } from './protocol.ts';
+/** Supported skill roots in a GitHub repo. */
+export declare const REPO_ROOTS: readonly RepoRoot[];
+/** Parsed GitHub repository reference. */
+export interface RepoRef {
+    owner: string;
+    repo: string;
+    /** Explicit branch/tag when supplied; undefined means use the default branch. */
+    ref?: string;
+}
+/** One file inside a GitHub repo tree. */
+export interface RepoTreeItem {
+    path: string;
+    type: 'blob' | 'tree';
+    size?: number;
+}
+/** One file belonging to a skill directory. */
+export interface RepoFile {
+    path: string;
+    size: number;
+}
+/** Fetch failure carrying a useful HTTP status for the route layer. */
+export declare class RepoFetchError extends Error {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}
+/** Override the GitHub token at runtime ('' falls back to the env var). */
+export declare function setGithubToken(token: string | undefined): void;
+/** Authorization header for api.github.com / raw.githubusercontent.com calls. */
+export declare function githubAuthHeaders(): Record<string, string>;
+/**
+ * Build a RepoFetchError; when the response shows an exhausted rate limit,
+ * report the reset time instead of a bare HTTP status.
+ */
+export declare function fetchError(context: string, response: Response, fallbackStatus?: number): RepoFetchError;
+/** `owner/repo` slug for a parsed reference. */
+export declare function repoSlug(ref: RepoRef): string;
+/**
+ * Normalize a GitHub URL or `owner/repo`/`owner/repo@ref` input.
+ * Only github.com URLs are accepted in v1.
+ */
+export declare function normalizeRepoInput(input: string): RepoRef | null;
+/**
+ * Load repo metadata and the recursive git tree at the given ref. The meta
+ * request always resolves the default branch (used when ref is absent); the
+ * tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
+ * the exact same content a later download would fetch.
+ */
+export declare function loadRepoTree(repo: string, ref?: string, fetchImpl?: typeof fetch): Promise<{
+    ref: string;
+    tree: RepoTreeItem[];
+}>;
+/** Collect every file inside a skill directory, including SKILL.md itself. */
+export declare function collectRepoSkillFiles(tree: readonly RepoTreeItem[], dir: string): RepoFile[];
+/** Compute an origin collection name. Multiple roots split by root, one root keeps the repo slug. */
+export declare function originForRoot(repo: string, rootsPresent: ReadonlySet<RepoRoot>, root: RepoRoot): string;
+/** Discover importable skills from a repo tree. Invalid names are ignored. */
+export declare function discoverRepoEntries(tree: readonly RepoTreeItem[], repo: string, existingNames?: ReadonlySet<string>): RepoSkillEntry[];
+/** Run an async worker over items with a bounded concurrency. */
+export declare function mapConcurrent<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
+/**
+ * Download one GitHub file as a buffer. Tries raw.githubusercontent.com
+ * first (no API quota); on any failure falls back to the api.github.com
+ * contents endpoint with the raw media type (rate-limited, but reachable
+ * from networks that block the raw host).
+ */
+export declare function downloadGitHubFile(repo: string, ref: string, path: string, fetchImpl?: typeof fetch): Promise<Buffer>;
+/**
+ * Download a full skill directory into a temporary dir, validate SKILL.md,
+ * then atomically rename it into place. The target root is created when missing.
+ * Callers pass a target root and a skill entry plus its collected files.
+ */
+export declare function downloadRepoSkill(repo: string, ref: string, entry: RepoSkillEntry, files: readonly RepoFile[], targetRoot: string, fetchImpl?: typeof fetch): Promise<{
+    targetDir: string;
+    skillPath: string;
+}>;
+/**
+ * The latest non-prerelease release tag of a repo, or undefined when the
+ * repo has no releases (GitHub's /releases/latest skips prereleases/drafts).
+ */
+export declare function getLatestReleaseTag(repo: string, fetchImpl?: typeof fetch): Promise<string | undefined>;
+/** Branch names of a repo, default branch first (one GitHub API request). */
+export declare function listRepoBranches(repo: string, fetchImpl?: typeof fetch): Promise<string[]>;
+/**
+ * Fetch the latest commit of a repo (explicit ref or default branch) with
+ * its tree SHA. One GitHub API request; the tree SHA is used to diff the
+ * upstream tree on change (one extra request).
+ */
+export declare function getLatestCommit(repo: string, ref?: string, fetchImpl?: typeof fetch): Promise<{
+    commitSha: string;
+    treeSha: string;
+}>;
+/** Load the recursive git tree at an explicit tree SHA (one API request). */
+export declare function loadRepoTreeAt(repo: string, treeSha: string, fetchImpl?: typeof fetch): Promise<RepoTreeItem[]>;
+/** Build a path→size manifest for one skill directory from a repo tree. */
+export declare function skillManifest(tree: readonly RepoTreeItem[], dir: string): Record<string, number>;
+/**
+ * The real upstream directory of one tracked skill. Source records keep only
+ * the short name and top-level root (e.g. root "skills", name "ask-matt"),
+ * but upstream repos may nest skills under category directories
+ * (skills/engineering/ask-matt/) or move them between categories. Resolution
+ * order: exact match under the top-level root in the upstream tree, then the
+ * manifest's recorded blob path, then any same-name skill in the tree, then
+ * the flat root/name fallback. Passing the tree paths makes the lookup
+ * resilient to incomplete manifests and upstream moves.
+ */
+export declare function skillDirOf(source: {
+    root: RepoRoot;
+    manifest?: Record<string, number>;
+}, name: string, treePaths?: readonly string[]): string;
+/**
+ * Diff one source record against an upstream tree at treeSha: which tracked
+ * skills disappeared (no SKILL.md blob) and which changed (manifest baseline
+ * differs, or no baseline exists — treated as changed). Pure over the tree.
+ */
+export declare function diffRemoteSkills(tree: readonly RepoTreeItem[], source: {
+    root: RepoRoot;
+    skills: readonly string[];
+    manifest?: Record<string, number>;
+}): {
+    updated: string[];
+    deleted: string[];
+};
+/** Minimal RepoSkillEntry for a tracked skill name (sync re-downloads by name). */
+export declare function repoSkillEntry(name: string, root: RepoRoot, repo: string): RepoSkillEntry;

package/lib/types/routes.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The /api/skill-hub route family: full catalog (enabled skills from the
+ * official registry + hub-disabled skills + discovery diagnostics), skill
+ * detail, enable/disable toggle, new-skill scaffold, user groups (tags +
+ * origin collections), and upstream source tracking (check/sync/follow
+ * upstream deletion into a restorable trash). Every route carries a
+ * loopback-only trust fence — these endpoints rename files under the user's
+ * skill roots, so LAN-exposed dsh web deployments must not serve them.
+ *
+ * Every handler is declared through the local `route()` wrapper, which owns
+ * the shared request fences (loopback trust, HTTP method, master switch,
+ * JSON body) exactly once, so a new route cannot forget them.
+ */
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import type { SkillDefinition, SkillSummary } from '@deepseek-ai/dsh-skill';
+import { type HubConfig } from './protocol.ts';
+import { type SkillHubStore } from './store.ts';
+import type { SkillStatsReader } from './stats.ts';
+/** Lookup options the hub forwards to the registry (cwd selects project roots). */
+export interface SkillLookupLike {
+    cwd?: string;
+}
+/** Route family dependencies (narrow structural view of ctx.skills for tests). */
+export interface SkillHubRouteDeps {
+    skills: {
+        snapshot(options?: SkillLookupLike): Promise<{
+            skills: SkillSummary[];
+            complete: boolean;
+        }>;
+        get(name: string, options?: SkillLookupLike): Promise<SkillDefinition | undefined>;
+    };
+    store: SkillHubStore;
+    /** DSH home override (tests isolate the writable roots; defaults to ~/.dsh). */
+    home?: string;
+    /** Invalidate the registry catalog cache after hub-driven mutations. */
+    invalidate?: () => void;
+    /** Optional invocation-count reader; absent means the stats route reports unavailable. */
+    stats?: SkillStatsReader;
+    /** Resolves the current plugin config; business routes honour the master switch. */
+    config?: () => HubConfig;
+    /** Resolves the raw saved config layer (fields the user explicitly overrode). */
+    saved?: () => Partial<HubConfig>;
+    /** Persist a config patch and re-sync plugin surfaces; resolves with the fresh config. */
+    updateConfig?: (patch: Partial<HubConfig>) => Promise<HubConfig>;
+}
+/**
+ * Build every /api/skill-hub route.
+ * @param deps - skill registry view + sidecar store.
+ * @returns the exact-path routes.
+ */
+export declare function makeRoutes(deps: SkillHubRouteDeps): WebRoute[];

package/lib/types/skillfs.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Skill filesystem operations for the writable roots and the hub provider's
+ * discovery. Toggling works by renaming the discovery file (SKILL.md inside
+ * a directory bundle, or the flat <name>.md) to a .disabled name; the
+ * watcher (ours or the preset's official filesystem provider) then updates
+ * the live catalog by itself.
+ *
+ * Frontmatter parsing mirrors @deepseek-ai/dsh-skill-filesystem semantics:
+ * required name (kebab-case) + description, optional whenToUse, invocation
+ * booleans with the same defaults (modelInvocable defaults true,
+ * userInvocable defaults true), legacy keys rejected, and the returned
+ * content is the body after the frontmatter block, trimmed.
+ */
+import type { DiagnosticEntry, TrashEntry, WritableRoot } from './protocol.ts';
+/** Root ids this module may write to. */
+export declare const WRITABLE_ROOTS: readonly WritableRoot[];
+/** Resolve the absolute directory of one writable root. */
+export declare function rootPath(root: WritableRoot, home?: string): string;
+/** Root of an absolute skill file path, or undefined when not user-owned. */
+export declare function rootOfPath(path: string, home?: string): WritableRoot | undefined;
+/**
+ * Scaffold a directory-bundle skill: <root>/<name>/SKILL.md with a frontmatter
+ * template. Refuses non-kebab-case names.
+ * @returns the created SKILL.md path.
+ */
+export declare function createSkill(root: WritableRoot, name: string, description: string, home?: string): Promise<string>;
+/**
+ * Disable one skill file by renaming it out of discovery shapes. Accepts
+ * either the SKILL.md of a directory bundle or a flat .md.
+ * @returns the absolute path after renaming.
+ */
+export declare function disableSkill(path: string): Promise<string>;
+/** Re-enable a previously disabled file (reverse of disableSkill). */
+export declare function enableSkill(disabledPath: string): Promise<string>;
+/**
+ * Move a skill (directory bundle or flat .md file) into the root's trash.
+ * The skill stays recoverable: the source is renamed into
+ * <root>/.trash/<name>-<timestamp>. A directory bundle is addressed by its
+ * SKILL.md path and moved as a whole directory.
+ * @returns the trashed path plus the original path that was moved.
+ */
+export declare function trashSkill(sourcePath: string): Promise<{
+    path: string;
+    source: string;
+}>;
+/** Restore a trashed skill (directory or flat file) to its original location. */
+export declare function restoreSkill(entry: TrashEntry, home?: string): Promise<string>;
+/** Permanently delete one trashed skill (directory or flat file). */
+export declare function clearTrash(entry: TrashEntry, home?: string): Promise<string>;
+/** One parsed frontmatter outcome (official provider semantics). */
+export interface FrontmatterValue {
+    name: string;
+    description: string;
+    whenToUse?: string;
+    invocation: {
+        modelInvocable: boolean;
+        userInvocable: boolean;
+    };
+    /** Instruction body after the frontmatter block, trimmed. */
+    content: string;
+}
+/** Parse a SKILL.md the way the official filesystem provider does. */
+export declare function parseFrontmatter(text: string): {
+    value: FrontmatterValue;
+} | {
+    error: string;
+};
+/** One discoverable skill file in a scanned root. */
+export interface SkillEntry {
+    /** Absolute path of the discovery file (SKILL.md or the flat .md). */
+    path: string;
+    /** Directory serving as the resource base (bundle dir or the root itself). */
+    directory: string;
+    kind: 'directory' | 'flat';
+}
+/**
+ * Scan one skills root for discovery files: directory bundles (SKILL.md)
+ * and flat <name>.md files. Hub-disabled files (.disabled) are excluded;
+ * dot-prefixed entries (including .trash and .system) are always skipped.
+ */
+export declare function scanRoot(base: string): Promise<SkillEntry[]>;
+/** Scan one writable root. */
+export declare function listSkillEntries(root: WritableRoot, home?: string): Promise<SkillEntry[]>;
+/**
+ * Walk up from cwd (max 32 levels) for a project marker (.dsh or .git);
+ * falls back to cwd itself. The provider roots project skills here.
+ */
+export declare function findProjectRoot(cwd: string): Promise<string>;
+/**
+ * Scan one writable root for files the provider ignores, so the GUI can
+ * show why a skill never appears (the zcode-style diagnostics lesson: a
+ * missing frontmatter must be visible, not silent). .disabled files belong
+ * to the hub and are skipped.
+ */
+export declare function scanDiagnostics(root: WritableRoot, home?: string): Promise<DiagnosticEntry[]>;

package/lib/types/stats.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Trigger statistics: how often each skill was actually invoked. The count
+ * comes from the local session logs, read through the host's `sessionQuery`
+ * service (which transparently decompresses the on-disk JSONL.zstd artifacts).
+ *
+ * A skill is invoked two ways, both recorded in the log:
+ *  - model-invoked: a `tool/call` event for the `skill` tool, whose raw
+ *    `arguments` JSON names the requested skill (see @deepseek-ai/dsh-tool-skill);
+ *  - user-explicit: a `user/message` event whose `source.kind ===
+ *    'skill-invocation'` (the MessageSourceMap augmentation from
+ *    @deepseek-ai/dsh-skill).
+ *
+ * Counting is per-skill-name, not per-source: a name may resolve to different
+ * files across projects, but the model-facing identity is the kebab-case name.
+ */
+import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session';
+import type { SkillStat } from './protocol.ts';
+/** Narrow structural view of the session-query service (kept loose for tests). */
+export interface SessionQueryLike {
+    listSessions(signal?: AbortSignal): Promise<Array<{
+        header: {
+            id: SessionId;
+        };
+    }>>;
+    readSession(id: SessionId): Promise<{
+        events: SessionEvent[];
+    }>;
+}
+/** Per-skill invocation stats in one session's event log. */
+export interface InvocationStat {
+    count: number;
+    /** Unix epoch ms of the most recent invocation in this batch. */
+    lastUsed: number;
+}
+/** Collect per-skill invocation counts and last-used times from one session. */
+export declare function countSkillInvocations(events: readonly SessionEvent[]): Map<string, InvocationStat>;
+/** Scan every session and total per-skill counts, keeping the latest lastUsed. */
+export declare function readSkillStats(query: SessionQueryLike): Promise<SkillStat[]>;
+/** A memoized stats reader (the panel polls, but logs change slowly). */
+export type SkillStatsReader = () => Promise<SkillStat[]>;
+/**
+ * Wrap a query in a stale-while-revalidate cache: responses never wait for a
+ * full session-log scan. While the TTL is fresh the cached totals are
+ * returned; after expiry the stale totals are returned immediately and a
+ * single background rescan refreshes them — the panel's next poll picks the
+ * fresh numbers. A full scan decompresses every session log and can take
+ * seconds, so it must never sit on the request path.
+ */
+export declare function createSkillStatsReader(query: SessionQueryLike, ttlMs?: number): SkillStatsReader;

package/lib/types/store.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Hub sidecar store: remembers which skills the hub toggled off and the
+ * user's organization/tracking records. Disabling renames the skill's
+ * SKILL.md (or flat .md) out of the filesystem provider's discovery shapes,
+ * so the provider catalog alone cannot see disabled skills; this store keeps
+ * name/path/root so the GUI can list them and re-enable. It also persists
+ * user tag groups, upstream source records (repo + commit snapshot for
+ * update checks), the market source list, and the trash (skills removed
+ * after upstream deletion).
+ *
+ * State file: $DSH_HOME/dsh-skill-hub.json — a small JSON document written
+ * atomically (tmp file + rename).
+ */
+import type { DisabledSkill, HubConfig, MarketSourceRecord, RepoRoot, SkillTag, SourceRecord, TrashEntry } from './protocol.ts';
+/** 默认场景名（系统预置的兜底场景，新技能自动归入）。 */
+export declare const DEFAULT_SCENE_NAME = "\u901A\u7528";
+/** Resolve the DSH home directory (the filesystem provider's user-dsh root base). */
+export declare function dshHome(): string;
+/** Resolve the sidecar state path (injectable in tests). */
+export declare function statePath(home?: string): string;
+/** Current sidecar schema version. Bump on breaking shape changes and add a migration below. */
+export declare const STORE_VERSION = 3;
+/**
+ * Business-rule failure the routes layer can map onto a 4xx status instead
+ * of a blanket 500: user input is invalid (validation → 400), the target
+ * does not exist (not-found → 404), or the operation conflicts with an
+ * invariant (conflict → 409).
+ */
+export declare class StoreError extends Error {
+    readonly kind: 'validation' | 'not-found' | 'conflict';
+    constructor(kind: StoreError['kind'], message: string);
+}
+/** Sidecar state owner. */
+export declare class SkillHubStore {
+    private readonly file;
+    private entries;
+    private config;
+    private tagsById;
+    private sourcesByRepo;
+    private marketSources;
+    private trashByName;
+    private loaded;
+    /** Serializes persist runs: concurrent mutators must not let an earlier
+     *  snapshot overwrite a later one (rename is atomic, ordering is not). */
+    private writeChain;
+    constructor(file?: string);
+    private ensureLoaded;
+    /**
+     * 保证存在默认场景：没有任何 default 标记的 tag 时创建「通用」。
+     * 新技能创建后自动归入它；用户可改名，但默认场景不可删除。
+     */
+    private ensureDefaultTag;
+    listDisabled(): Promise<DisabledSkill[]>;
+    getDisabled(name: string): Promise<DisabledSkill | undefined>;
+    addDisabled(entry: DisabledSkill): Promise<void>;
+    removeDisabled(name: string): Promise<void>;
+    /** The hub's saved runtime configuration (fields absent here mean "not overridden"). */
+    getConfig(): Promise<Partial<HubConfig>>;
+    /**
+     * Persist a runtime-config patch, merged over the saved values. A field
+     * whose patch value is undefined is removed from the saved layer, so the
+     * setting re-inherits its default (the web card's "reset" path).
+     */
+    setConfig(config: Partial<HubConfig>): Promise<void>;
+    /** All user-defined tag groups, in creation order. */
+    listTags(): Promise<SkillTag[]>;
+    /** One tag by id (undefined when absent). */
+    getTag(id: string): Promise<SkillTag | undefined>;
+    /**
+     * Create (no id) or rename (with id) a tag. Returns the saved tag.
+     * Creating assigns a fresh UUID; renaming keeps members.
+     */
+    saveTag(input: {
+        id?: string;
+        name: string;
+    }): Promise<SkillTag>;
+    /** Delete a tag by id (no-op when absent). The default scene cannot be deleted. */
+    deleteTag(id: string): Promise<void>;
+    /** The default scene (「通用」), guaranteed to exist after ensureLoaded. */
+    getDefaultTag(): Promise<SkillTag | undefined>;
+    /** Append one skill name to a tag (deduplicated; no-op when already a member). */
+    addSkillToTag(id: string, name: string): Promise<SkillTag | undefined>;
+    /**
+     * Replace a tag's member list wholesale (idempotent). Deduplicates and
+     * drops blank names; unknown skill names are kept (they may arrive later),
+     * the routes layer filters against the live catalog before persisting.
+     */
+    setTagMembers(id: string, skillNames: readonly string[]): Promise<SkillTag | undefined>;
+    /** Remove one skill from every tag group (used when the skill is deleted). */
+    removeSkillFromTags(name: string): Promise<void>;
+    /** All source records, sorted by repo. */
+    listSources(): Promise<SourceRecord[]>;
+    /** One source record by repo (undefined when absent). */
+    getSource(repo: string): Promise<SourceRecord | undefined>;
+    /** The source record that tracks a skill name (undefined when untracked). */
+    getSourceForSkill(name: string): Promise<SourceRecord | undefined>;
+    /** Remove a source record entirely (no-op when absent). */
+    deleteSource(repo: string): Promise<void>;
+    /**
+     * Upsert one skill into a source record. When the repo has no record yet a
+     * new one is created (root + commit snapshot from the caller).
+     */
+    addSourceSkill(repo: string, root: RepoRoot, commitSha: string, ref: string | undefined, skillName: string): Promise<void>;
+    /** Replace a source's skill list (used after sync/confirm-delete). */
+    setSourceSkills(repo: string, skills: readonly string[]): Promise<SourceRecord | undefined>;
+    /** Remove one skill from every source record (used when the skill is deleted). */
+    removeSkillFromSources(name: string): Promise<void>;
+    /** Update a source's commit snapshot. */
+    setSourceCommit(repo: string, commitSha: string): Promise<void>;
+    /** Update a source's pinned ref (release tag / branch) when the market syncs. */
+    setSourceRef(repo: string, ref: string): Promise<void>;
+    /**
+     * Merge per-path manifest entries into a source (incremental imports).
+     * When `dir` is given, every baseline path under that skill directory is
+     * dropped first, so files the upstream removed never linger in the
+     * baseline and skew later update diffs.
+     */
+    mergeSourceManifest(repo: string, manifest: Record<string, number>, dir?: string): Promise<void>;
+    /** skillName → collection name for every recorded origin (derived from sources). */
+    listOrigins(): Promise<Record<string, string>>;
+    /** The user's market sources, in addition order. */
+    listMarketSources(): Promise<MarketSourceRecord[]>;
+    /** One market source by repo (undefined when absent). */
+    getMarketSource(repo: string): Promise<MarketSourceRecord | undefined>;
+    /** Add a repo (deduplicated), optionally with a pinned ref. Returns the fresh list. */
+    addMarketSource(repo: string, ref?: string): Promise<MarketSourceRecord[]>;
+    /** Remove a repo (no-op when absent). Returns the fresh list. */
+    removeMarketSource(repo: string): Promise<MarketSourceRecord[]>;
+    /** Pin a market source to an explicit ref (branch/tag). Returns the record. */
+    setMarketSourceRef(repo: string, ref: string): Promise<MarketSourceRecord | undefined>;
+    /** Record the commit a market source's pinned ref resolved to (update baseline). */
+    setMarketSourceCommit(repo: string, commitSha: string): Promise<void>;
+    /** All trashed skills, newest first. */
+    listTrash(): Promise<TrashEntry[]>;
+    /** One trash entry by skill name (undefined when absent). */
+    getTrash(name: string): Promise<TrashEntry | undefined>;
+    /** Record a trashed skill. */
+    addTrash(entry: TrashEntry): Promise<void>;
+    /** Remove a trash record (after restore). */
+    removeTrash(name: string): Promise<void>;
+    private persist;
+}

package/lib/types/update.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Self-update check for dsh-skill-hub, mirroring cc-switch's behavior:
+ * query GitHub's latest release and compare it to the installed version.
+ *
+ * This stays dependency-free: Node's global fetch is used and the version
+ * comparison is a small semver-subset parser (the plugin only publishes
+ * plain x.y.z tags, optionally prefixed with `v`).
+ */
+import type { UpdateCheckResponse } from './protocol.ts';
+/** Repository checked for releases. Keep in sync with package.json. */
+export declare const UPDATE_REPO = "cheshireez/dsh-skill-hub";
+export declare const CURRENT_VERSION: string;
+/** Normalize a release tag (`v1.2.3` → `1.2.3`) and parse it numerically. */
+export declare function parseVersion(tag: string): [number, number, number] | null;
+/** Compare two dotted version strings: negative when a < b, 0 equal, positive when a > b. */
+export declare function compareVersions(a: string, b: string): number;
+/** True when latest is strictly newer than current. */
+export declare function isUpdateAvailable(currentVersion: string, latestVersion: string): boolean;
+/** Best-effort GitHub latest-release lookup. Always resolves with ok:true. */
+export declare function checkLatestRelease(repo?: string, fetchImpl?: typeof fetch): Promise<UpdateCheckResponse>;

package/package.json

@@ -1,7 +1,101 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.0.1",
-  "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog (every root + third-party providers), toggle skills on/off, surface frontmatter diagnostics, and manage your skill library from the web GUI — the full manager beyond the read-only dsh-skill-manager browser.",
+  "version": "0.2.0",
+  "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
+  "type": "module",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  },
+  "dependencies": {
+    "js-yaml": "^4.1.0",
+    "schemastery": "^3.18.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-query": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.6",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-query": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.6",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.20.0",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "^18.3.5",
+    "lightningcss": "1.32.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "schemastery": "^3.18.0",
+    "tsdown": "0.22.2",
+    "typescript": "~5.7.2",
+    "vitest": "^3.0.0"
+  },
+  "files": [
+    "lib/**/*.js",
+    "lib/**/*.js.map",
+    "lib/**/*.d.ts",
+    "lib/**/*.d.ts.map",
+    "src",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "CONTRIBUTING.md"
+  ],
   "keywords": [
     "dsh-plugin",
     "dsh",
@@ -9,15 +103,25 @@
     "skill",
     "skills",
     "skill-manager",
-    "agent-skills"
+    "agent-skills",
+    "skill-hub"
   ],
   "license": "MIT",
-  "type": "module",
-  "engines": {
-    "node": "^22.19.0 || >=24.0.0"
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsdown",
+    "bundle": "tsdown",
+    "watch": "tsdown --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prebuild": "node -e \"require('fs').rmSync('lib',{recursive:true,force:true})\""
   },
-  "files": [
-    "README.md",
-    "LICENSE"
-  ]
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cheshireez/dsh-skill-hub.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cheshireez/dsh-skill-hub/issues"
+  },
+  "homepage": "https://github.com/cheshireez/dsh-skill-hub"
+}