hubbits 0.1.0

package/dist/index.js

@@ -0,0 +1,4316 @@
+import { defineCommand, runMain } from 'citty';
+import * as p5 from '@clack/prompts';
+import pc5 from 'picocolors';
+import open from 'open';
+import { ofetch, FetchError } from 'ofetch';
+import { existsSync, readdirSync, mkdirSync, writeFileSync, readFileSync, createWriteStream, createReadStream, unlinkSync } from 'fs';
+import { homedir } from 'os';
+import { join, resolve, basename, relative } from 'path';
+import ora from 'ora';
+import yaml from 'js-yaml';
+import { mkdir, readdir, stat } from 'fs/promises';
+import { z } from 'zod';
+import { pipeline } from 'stream/promises';
+import { createGunzip, createGzip } from 'zlib';
+import { extract as extract$1, pack as pack$1 } from 'tar-stream';
+
+// src/index.ts
+var HUBBITS_DIR = join(homedir(), ".hubbits");
+var CONFIG_PATH = join(HUBBITS_DIR, "config.json");
+var CREDENTIALS_PATH = join(HUBBITS_DIR, "credentials.json");
+var DEFAULT_REGISTRY_URL = "https://api.hubbits.dev";
+function ensureDir() {
+  if (!existsSync(HUBBITS_DIR)) {
+    mkdirSync(HUBBITS_DIR, { recursive: true });
+  }
+}
+function readJsonFile(path) {
+  try {
+    if (!existsSync(path)) return null;
+    const raw = readFileSync(path, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(path, data) {
+  ensureDir();
+  writeFileSync(path, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+}
+var DEFAULT_CONFIG = {
+  registry_url: DEFAULT_REGISTRY_URL
+};
+function readConfig() {
+  const stored = readJsonFile(CONFIG_PATH);
+  return { ...DEFAULT_CONFIG, ...stored };
+}
+function readCredentials() {
+  return readJsonFile(CREDENTIALS_PATH);
+}
+function writeCredentials(credentials) {
+  writeJsonFile(CREDENTIALS_PATH, credentials);
+}
+function deleteCredentials() {
+  try {
+    if (existsSync(CREDENTIALS_PATH)) {
+      unlinkSync(CREDENTIALS_PATH);
+    }
+  } catch {
+  }
+}
+({
+  /** ~/.hubbits/cache/ */
+  cacheDir: join(HUBBITS_DIR, "cache"),
+  /** ~/.hubbits/progress/ */
+  progressDir: join(HUBBITS_DIR, "progress")
+});
+
+// src/lib/auth.ts
+var TOKEN_ENV_VAR = "HUBBITS_TOKEN";
+function getToken() {
+  const envToken = process.env[TOKEN_ENV_VAR];
+  if (envToken) return envToken;
+  const creds = readCredentials();
+  if (!creds) return null;
+  return creds.token;
+}
+function saveToken(credentials) {
+  writeCredentials(credentials);
+}
+function clearToken() {
+  deleteCredentials();
+}
+function getAuthState() {
+  const envToken = process.env[TOKEN_ENV_VAR];
+  if (envToken) {
+    return { token: envToken };
+  }
+  const creds = readCredentials();
+  if (!creds) return null;
+  if (creds.expires_at) {
+    const expiresAt = new Date(creds.expires_at);
+    if (Date.now() > expiresAt.getTime() - 6e4) {
+      return null;
+    }
+  }
+  return creds;
+}
+async function pollDeviceFlow(deviceCode, pollFn, options) {
+  const { interval, expiresIn, onTick } = options;
+  const startTime = Date.now();
+  const timeoutMs = expiresIn * 1e3;
+  const intervalMs = interval * 1e3;
+  while (Date.now() - startTime < timeoutMs) {
+    await sleep(intervalMs);
+    onTick?.();
+    const result = await pollFn(deviceCode);
+    if (result.status === "success") {
+      saveToken({
+        token: result.token,
+        expires_at: result.expires_at,
+        username: result.username,
+        email: result.email
+      });
+      return result;
+    }
+    if (result.status === "expired" || result.status === "error") {
+      return result;
+    }
+  }
+  return { status: "expired" };
+}
+function sleep(ms) {
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
+}
+
+// src/lib/api.ts
+var ApiError = class extends Error {
+  statusCode;
+  code;
+  details;
+  constructor(statusCode, code, message, details) {
+    super(message);
+    this.name = "ApiError";
+    this.statusCode = statusCode;
+    this.code = code;
+    this.details = details;
+  }
+};
+function createApiClient(options = {}) {
+  const getBaseURL = () => options.baseURL ?? readConfig().registry_url;
+  async function request(path, fetchOptions = {}) {
+    const baseURL = getBaseURL();
+    const token = options.token ?? getToken();
+    const incomingHeaders = fetchOptions.headers ?? {};
+    const headers = {
+      "User-Agent": "hubbits-cli/0.1.0",
+      ...incomingHeaders
+    };
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    const retry = fetchOptions.retry ?? 2;
+    try {
+      const response = await ofetch(path, {
+        baseURL,
+        method: fetchOptions.method,
+        body: fetchOptions.body,
+        headers,
+        retry,
+        retryDelay: 1e3
+      });
+      return response;
+    } catch (error2) {
+      if (error2 instanceof FetchError) {
+        const status = error2.statusCode ?? 0;
+        const body = error2.data;
+        if (status === 401) {
+          clearToken();
+          throw new ApiError(
+            401,
+            body?.error?.code ?? "UNAUTHORIZED",
+            "Authentication expired. Please run `hubbits login` to re-authenticate.",
+            body?.error?.details
+          );
+        }
+        if (body?.error) {
+          throw new ApiError(
+            status,
+            body.error.code,
+            body.error.message,
+            body.error.details
+          );
+        }
+        throw new ApiError(
+          status,
+          "NETWORK_ERROR",
+          `Request failed: ${error2.message}`
+        );
+      }
+      throw error2;
+    }
+  }
+  return {
+    /** Raw request method */
+    request,
+    // -- Auth --
+    /** Start device flow (get device code + user code) */
+    async startDeviceFlow() {
+      return request("/api/v1/auth/device", {
+        method: "POST"
+      });
+    },
+    /** Poll device flow authorization */
+    async pollDeviceFlow(deviceCode) {
+      return request(`/api/v1/auth/device/poll?device_code=${encodeURIComponent(deviceCode)}`, {
+        retry: 0
+        // Don't retry polling requests
+      });
+    },
+    /** Validate a PAT token */
+    async validateToken(token) {
+      return request("/api/v1/users/me", {
+        headers: { Authorization: `Bearer ${token}` }
+      });
+    },
+    /** Get current authenticated user info */
+    async getCurrentUser() {
+      return request("/api/v1/users/me");
+    },
+    // -- Search --
+    /** Search packages */
+    async searchPackages(query, params) {
+      const searchParams = new URLSearchParams({ q: query });
+      if (params?.category) searchParams.set("category", params.category);
+      if (params?.difficulty) searchParams.set("difficulty", params.difficulty);
+      if (params?.pricing) searchParams.set("pricing", params.pricing);
+      if (params?.sort) searchParams.set("sort", params.sort);
+      if (params?.page) searchParams.set("page", String(params.page));
+      if (params?.per_page) searchParams.set("per_page", String(params.per_page));
+      return request(`/api/v1/packages?${searchParams.toString()}`);
+    },
+    // -- Package --
+    /** Get package details */
+    async getPackage(name) {
+      return request(`/api/v1/packages/${encodeURIComponent(name)}`);
+    },
+    /** Get package details by scope/name */
+    async getPackageByScope(scope, name) {
+      return request(`/api/v1/packages/${encodeURIComponent(scope)}/${encodeURIComponent(name)}`);
+    },
+    /** Get specific version details */
+    async getPackageVersion(scope, name, version) {
+      return request(`/api/v1/packages/${encodeURIComponent(scope)}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`);
+    },
+    // -- Download --
+    /** Get download URL for a package version */
+    async getDownloadUrl(scope, name, version) {
+      return request(`/api/v1/download/${encodeURIComponent(scope)}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`);
+    },
+    /** Download a file from a URL (returns raw ArrayBuffer) */
+    async downloadFile(url) {
+      const response = await ofetch(url, {
+        responseType: "arrayBuffer",
+        retry: 2,
+        retryDelay: 1e3,
+        headers: {
+          "User-Agent": "hubbits-cli/0.1.0"
+        }
+      });
+      return response;
+    },
+    // -- Publish --
+    /** Request a presigned upload URL for publishing (step 1) */
+    async requestPublish(manifest, digest, fileSize) {
+      return request("/api/v1/packages/publish", {
+        method: "PUT",
+        body: { manifest, digest, file_size: fileSize }
+      });
+    },
+    /** Confirm a publish after uploading (step 2) */
+    async confirmPublish(scope, name, version, digest, manifest) {
+      return request("/api/v1/packages/publish/confirm", {
+        method: "POST",
+        body: { scope, name, version, digest, manifest }
+      });
+    },
+    /** Upload a file to a presigned URL */
+    async uploadFile(url, data) {
+      await ofetch(url, {
+        method: "PUT",
+        body: data,
+        headers: {
+          "Content-Type": "application/gzip",
+          "Content-Length": String(data.length)
+        },
+        retry: 2,
+        retryDelay: 1e3
+      });
+    },
+    // -- GitHub --
+    /** Fetch GitHub repo metadata for import pre-fill */
+    async getGithubRepoInfo(repoUrl) {
+      return request(`/api/v1/github/repo-info?url=${encodeURIComponent(repoUrl)}`);
+    }
+  };
+}
+var _jsonMode = false;
+var _quietMode = false;
+var _verboseMode = false;
+function setOutputMode(opts) {
+  _jsonMode = opts.json ?? false;
+  _quietMode = opts.quiet ?? false;
+  _verboseMode = opts.verbose ?? false;
+}
+function isJsonMode() {
+  return _jsonMode;
+}
+function outputJson(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function success(message) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log(`${pc5.green("\u2713")} ${message}`);
+}
+function error(message) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.error(`${pc5.red("\u2717")} ${message}`);
+}
+function warning(message) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.warn(`${pc5.yellow("\u26A0")} ${message}`);
+}
+function info(message) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log(`${pc5.blue("\u2139")} ${message}`);
+}
+function hint(message) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log(`${pc5.dim("\u2192")} ${message}`);
+}
+function debug(message) {
+  if (!_verboseMode) return;
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log(`${pc5.dim("[debug]")} ${pc5.dim(message)}`);
+}
+function newline() {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log();
+}
+function field(label, value) {
+  if (_quietMode) return;
+  if (_jsonMode) return;
+  console.log(`  ${pc5.dim(label + ":")} ${value}`);
+}
+function table(columns, rows) {
+  if (_quietMode) return;
+  if (_jsonMode) {
+    outputJson(rows);
+    return;
+  }
+  if (rows.length === 0) {
+    info("No results found.");
+    return;
+  }
+  const widths = {};
+  for (const col of columns) {
+    widths[col.key] = col.width ?? col.label.length;
+    for (const row of rows) {
+      const val = col.format ? col.format(row[col.key]) : String(row[col.key] ?? "");
+      widths[col.key] = Math.max(widths[col.key], val.length);
+    }
+    widths[col.key] = Math.min(widths[col.key], 50);
+  }
+  const header = columns.map((col) => pc5.bold(pad(col.label, widths[col.key], col.align))).join("  ");
+  console.log(header);
+  console.log(pc5.dim(columns.map((col) => "\u2500".repeat(widths[col.key])).join("  ")));
+  for (const row of rows) {
+    const line = columns.map((col) => {
+      const val = col.format ? col.format(row[col.key]) : String(row[col.key] ?? "");
+      return pad(truncate(val, widths[col.key]), widths[col.key], col.align);
+    }).join("  ");
+    console.log(line);
+  }
+}
+function spinner(text3) {
+  if (_quietMode || _jsonMode) {
+    return {
+      start: () => spinner(text3),
+      stop: () => spinner(text3),
+      succeed: () => spinner(text3),
+      fail: () => spinner(text3),
+      warn: () => spinner(text3),
+      info: () => spinner(text3),
+      text: "",
+      isSpinning: false
+    };
+  }
+  return ora({ text: text3, color: "cyan" }).start();
+}
+function errorWithFix(message, fix) {
+  error(message);
+  if (fix) {
+    hint(`Fix: ${fix}`);
+  }
+}
+function pad(str, width, align = "left") {
+  if (str.length >= width) return str;
+  const padding = " ".repeat(width - str.length);
+  return align === "right" ? padding + str : str + padding;
+}
+function truncate(str, maxWidth) {
+  if (str.length <= maxWidth) return str;
+  return str.slice(0, maxWidth - 1) + "\u2026";
+}
+
+// src/commands/login.ts
+var login_default = defineCommand({
+  meta: {
+    name: "login",
+    description: "Authenticate with the Hubbits registry"
+  },
+  args: {
+    token: {
+      type: "string",
+      description: "Personal access token (for CI/CD)"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const existing = getAuthState();
+    if (existing && !args.token) {
+      const displayName = existing.username ?? existing.email ?? "authenticated user";
+      if (isJsonMode()) {
+        outputJson({ status: "already_authenticated", username: existing.username, email: existing.email });
+        return;
+      }
+      info(`Already logged in as ${pc5.bold(displayName)}.`);
+      hint("Run `hubbits logout` first to switch accounts.");
+      return;
+    }
+    const api2 = createApiClient();
+    if (args.token) {
+      debug(`Validating provided token...`);
+      const s = spinner("Validating token...");
+      try {
+        const result = await api2.validateToken(args.token);
+        s.succeed("Token validated.");
+        if (result.data) {
+          saveToken({
+            token: args.token,
+            username: result.data.username,
+            email: result.data.email
+          });
+          if (isJsonMode()) {
+            outputJson({ status: "ok", username: result.data.username, email: result.data.email });
+            return;
+          }
+          success(`Logged in as ${pc5.bold(result.data.username)} (${result.data.email})`);
+          hint("Next: `hubbits search` to find packages or `hubbits create` to start building.");
+        }
+      } catch (err) {
+        s.fail("Token validation failed.");
+        if (err instanceof ApiError) {
+          errorWithFix(err.message, "Check that your token is correct and not expired.");
+        } else {
+          error("Failed to validate token.");
+        }
+        process.exit(1);
+      }
+      return;
+    }
+    p5.intro(pc5.bold("Hubbits Login"));
+    await loginWithDeviceFlow(api2);
+  }
+});
+async function loginWithDeviceFlow(api2) {
+  const s = spinner("Starting device authorization...");
+  debug("POST /api/v1/auth/device");
+  try {
+    const result = await api2.startDeviceFlow();
+    if (!result.data) {
+      s.fail("Failed to start device flow.");
+      error("Server returned an unexpected response.");
+      process.exit(1);
+    }
+    const { device_code, user_code, verification_url, expires_in, interval } = result.data;
+    s.stop();
+    newline();
+    info(`Open the following URL in your browser:`);
+    console.log(`  ${pc5.bold(pc5.underline(verification_url))}`);
+    newline();
+    info(`Enter the code: ${pc5.bold(pc5.cyan(user_code))}`);
+    newline();
+    try {
+      await open(verification_url);
+      info("Browser opened automatically.");
+    } catch {
+    }
+    const pollSpinner = spinner("Waiting for authorization...");
+    const pollFn = async (deviceCode) => {
+      try {
+        const tokenResult = await api2.pollDeviceFlow(deviceCode);
+        if (tokenResult.data?.access_token) {
+          return {
+            status: "success",
+            token: tokenResult.data.access_token
+          };
+        }
+        return { status: "pending" };
+      } catch (err) {
+        if (err instanceof ApiError) {
+          if (err.code === "AUTHORIZATION_PENDING") return { status: "pending" };
+          if (err.code === "SLOW_DOWN") return { status: "pending" };
+          if (err.code === "EXPIRED" || err.code === "EXPIRED_TOKEN") return { status: "expired" };
+          return { status: "error", message: err.message };
+        }
+        return { status: "pending" };
+      }
+    };
+    const pollResult = await pollDeviceFlow(device_code, pollFn, {
+      interval,
+      expiresIn: expires_in
+    });
+    if (pollResult.status === "success") {
+      let username;
+      let email;
+      try {
+        const userResult = await api2.validateToken(pollResult.token);
+        if (userResult.data) {
+          username = userResult.data.username;
+          email = userResult.data.email;
+        }
+      } catch {
+      }
+      saveToken({
+        token: pollResult.token,
+        username,
+        email
+      });
+      pollSpinner.succeed("Authorized!");
+      if (isJsonMode()) {
+        outputJson({ status: "ok", username, email });
+        return;
+      }
+      const displayName = username ?? email ?? "user";
+      success(`Logged in as ${pc5.bold(displayName)}`);
+      hint("Next: `hubbits search` to find packages or `hubbits create` to start building.");
+    } else if (pollResult.status === "expired") {
+      pollSpinner.fail("Authorization expired.");
+      errorWithFix("The verification code has expired.", "Run `hubbits login` to try again.");
+      process.exit(1);
+    } else if (pollResult.status === "error") {
+      pollSpinner.fail("Authorization failed.");
+      errorWithFix(pollResult.message, "Run `hubbits login` to try again.");
+      process.exit(1);
+    }
+  } catch (err) {
+    s.fail("Failed to start device flow.");
+    if (err instanceof ApiError) {
+      errorWithFix(err.message, "Check your network connection and try again.");
+    } else {
+      errorWithFix("An unexpected error occurred.", "Check your network connection and try again.");
+    }
+    process.exit(1);
+  }
+}
+var logout_default = defineCommand({
+  meta: {
+    name: "logout",
+    description: "Log out from the Hubbits registry"
+  },
+  args: {
+    force: {
+      type: "boolean",
+      alias: "f",
+      description: "Skip confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const auth = getAuthState();
+    if (!auth) {
+      if (isJsonMode()) {
+        outputJson({ status: "not_authenticated" });
+        return;
+      }
+      info("You are not currently logged in.");
+      hint("Run `hubbits login` to authenticate.");
+      return;
+    }
+    const displayName = auth.username ?? auth.email ?? "current session";
+    if (!args.force && !args.json && !args.quiet) {
+      const confirm4 = await p5.confirm({
+        message: `Log out from ${pc5.bold(displayName)}?`
+      });
+      if (p5.isCancel(confirm4) || !confirm4) {
+        p5.cancel("Logout cancelled.");
+        return;
+      }
+    }
+    clearToken();
+    if (isJsonMode()) {
+      outputJson({ status: "ok", message: "Logged out successfully." });
+      return;
+    }
+    success(`Logged out from ${pc5.bold(displayName)}.`);
+    hint("Run `hubbits login` to log in again.");
+  }
+});
+var search_default = defineCommand({
+  meta: {
+    name: "search",
+    description: "Search for hubbits on the registry"
+  },
+  args: {
+    query: {
+      type: "positional",
+      description: "Search query",
+      required: true
+    },
+    category: {
+      type: "string",
+      alias: "c",
+      description: "Filter by category (learning, entertainment, productivity, wellness)"
+    },
+    difficulty: {
+      type: "string",
+      alias: "d",
+      description: "Filter by difficulty (beginner, intermediate, advanced)"
+    },
+    pricing: {
+      type: "string",
+      description: "Filter by pricing (free, paid, freemium)"
+    },
+    sort: {
+      type: "string",
+      alias: "s",
+      description: "Sort by (relevance, downloads, stars, updated, created)",
+      default: "relevance"
+    },
+    page: {
+      type: "string",
+      description: "Page number",
+      default: "1"
+    },
+    limit: {
+      type: "string",
+      description: "Results per page",
+      default: "20"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const query = args.query;
+    const page = parseInt(args.page, 10) || 1;
+    const perPage = parseInt(args.limit, 10) || 20;
+    const api2 = createApiClient();
+    const s = spinner(`Searching for "${query}"...`);
+    debug(`GET /api/v1/packages?q=${query}&page=${page}&per_page=${perPage}`);
+    try {
+      const result = await api2.searchPackages(query, {
+        category: args.category,
+        difficulty: args.difficulty,
+        pricing: args.pricing,
+        sort: args.sort,
+        page,
+        per_page: perPage
+      });
+      s.stop();
+      if (isJsonMode()) {
+        outputJson(result);
+        return;
+      }
+      const items = result.data?.items ?? [];
+      const total = result.data?.pagination.total ?? 0;
+      if (items.length === 0) {
+        info(`No packages found for "${pc5.bold(query)}".`);
+        hint("Try a different search term or check `hubbits search --help` for filters.");
+        return;
+      }
+      success(`Found ${total} package${total === 1 ? "" : "s"} for "${pc5.bold(query)}"`);
+      newline();
+      const columns = [
+        {
+          key: "name",
+          label: "Name",
+          width: 30,
+          format: (v) => pc5.cyan(String(v))
+        },
+        {
+          key: "description",
+          label: "Description",
+          width: 40
+        },
+        {
+          key: "category",
+          label: "Category",
+          width: 14,
+          format: (v) => formatCategory(String(v ?? ""))
+        },
+        {
+          key: "downloads",
+          label: "Downloads",
+          width: 10,
+          align: "right",
+          format: (v) => formatNumber(Number(v))
+        },
+        {
+          key: "stars",
+          label: "Stars",
+          width: 6,
+          align: "right",
+          format: (v) => formatNumber(Number(v))
+        }
+      ];
+      table(columns, items.map((item) => ({
+        name: item.name,
+        description: item.description,
+        category: item.category,
+        downloads: item.downloads,
+        stars: item.stars
+      })));
+      if ((result.data?.pagination.total_pages ?? 0) > 1) {
+        newline();
+        info(
+          `Page ${result.data?.pagination.page}/${result.data?.pagination.total_pages} (${total} total results)`
+        );
+        if ((result.data?.pagination.page ?? 0) < (result.data?.pagination.total_pages ?? 0)) {
+          hint(`Next page: \`hubbits search "${query}" --page ${(result.data?.pagination.page ?? 0) + 1}\``);
+        }
+      }
+      newline();
+      hint(`Download a package: \`hubbits pull <package-name>\``);
+    } catch (err) {
+      s.fail("Search failed.");
+      if (err instanceof ApiError) {
+        errorWithFix(err.message, "Check your network connection and try again.");
+      } else {
+        errorWithFix("An unexpected error occurred.", "Check your network connection and try again.");
+      }
+      process.exit(1);
+    }
+  }
+});
+function formatNumber(n) {
+  if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}K`;
+  return String(n);
+}
+function formatCategory(cat) {
+  const colors = {
+    learning: pc5.blue,
+    entertainment: pc5.magenta,
+    productivity: pc5.green,
+    wellness: pc5.yellow
+  };
+  const colorFn = colors[cat] ?? pc5.dim;
+  return colorFn(cat || "-");
+}
+var template_default = defineCommand({
+  meta: {
+    name: "template",
+    description: "Scaffold a new hubbit with cross-platform AI editor support"
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Package name (lowercase, hyphens allowed)",
+      required: false
+    },
+    category: {
+      type: "string",
+      alias: "c",
+      description: "Package category (learning, entertainment, productivity, wellness)"
+    },
+    difficulty: {
+      type: "string",
+      alias: "d",
+      description: "Difficulty level (beginner, intermediate, advanced)"
+    },
+    description: {
+      type: "string",
+      description: "Package description"
+    },
+    author: {
+      type: "string",
+      alias: "a",
+      description: "Author name"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    let options;
+    if (args.name !== void 0 && !isValidName(args.name)) {
+      errorWithFix(
+        `Invalid package name: "${args.name}"`,
+        "Use lowercase letters, numbers, and hyphens. Must start with a letter."
+      );
+      process.exit(1);
+    }
+    if (args.name && args.category && args.difficulty && args.description) {
+      options = {
+        name: args.name,
+        category: args.category,
+        difficulty: args.difficulty,
+        description: args.description,
+        author: args.author
+      };
+    } else {
+      options = await interactiveCreate(args.name);
+    }
+    const targetDir = resolve(process.cwd(), options.name);
+    if (existsSync(targetDir)) {
+      const entries = readdirSync(targetDir);
+      if (entries.length > 0) {
+        errorWithFix(
+          `Directory "${options.name}" already exists and is not empty.`,
+          "Choose a different name, or remove the existing directory first."
+        );
+        process.exit(1);
+      }
+    }
+    const files = scaffoldTemplate(targetDir, options);
+    if (isJsonMode()) {
+      outputJson({ status: "ok", name: options.name, path: targetDir, files });
+      return;
+    }
+    newline();
+    success(`Created ${pc5.bold(options.name)}/`);
+    for (const file of files) {
+      console.log(`  ${pc5.dim("\u251C\u2500\u2500")} ${file}`);
+    }
+    newline();
+    printSetupGuide(options.name);
+  }
+});
+async function interactiveCreate(initialName) {
+  p5.intro(pc5.bold("Create a new Hubbit"));
+  const name = initialName ?? await (async () => {
+    const val = await p5.text({
+      message: "Package name:",
+      placeholder: "my-awesome-hubbit",
+      validate(value) {
+        if (!value) return "Package name is required.";
+        if (!isValidName(value)) {
+          return "Use lowercase letters, numbers, and hyphens. Must start with a letter and not end with a hyphen.";
+        }
+      }
+    });
+    if (p5.isCancel(val)) {
+      p5.cancel("Cancelled.");
+      process.exit(0);
+    }
+    return val;
+  })();
+  const category = await p5.select({
+    message: "Category:",
+    options: [
+      { value: "learning", label: "Learning", hint: "Educational courses and tutorials" },
+      { value: "entertainment", label: "Entertainment", hint: "Games, stories, and fun" },
+      { value: "productivity", label: "Productivity", hint: "Tools and workflows" },
+      { value: "wellness", label: "Wellness", hint: "Health and wellbeing" }
+    ]
+  });
+  if (p5.isCancel(category)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const difficulty = await p5.select({
+    message: "Difficulty:",
+    options: [
+      { value: "beginner", label: "Beginner" },
+      { value: "intermediate", label: "Intermediate" },
+      { value: "advanced", label: "Advanced" },
+      { value: "beginner-to-intermediate", label: "Beginner to Intermediate" },
+      { value: "intermediate-to-advanced", label: "Intermediate to Advanced" }
+    ]
+  });
+  if (p5.isCancel(difficulty)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const description = await p5.text({
+    message: "Description:",
+    placeholder: "A brief description of your Hubbit",
+    validate(value) {
+      if (!value) return "Description is required.";
+      if (value.length > 500) return "Description must be 500 characters or fewer.";
+    }
+  });
+  if (p5.isCancel(description)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const author = await p5.text({
+    message: "Author (optional):",
+    placeholder: "Your Name"
+  });
+  if (p5.isCancel(author)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  p5.outro(pc5.dim("Scaffolding..."));
+  return {
+    name,
+    category,
+    difficulty,
+    description,
+    author: author || void 0
+  };
+}
+function scaffoldTemplate(targetDir, options) {
+  const files = [];
+  const dirs = [
+    "",
+    ".claude",
+    ".claude/skills",
+    ".claude/skills/play",
+    ".claude/skills/hint",
+    ".claude/skills/next",
+    ".claude/skills/progress",
+    ".claude/skills/verify",
+    ".github",
+    "engine",
+    "content",
+    `content/ch01-getting-started`,
+    `content/ch01-getting-started/challenges`,
+    ".player"
+  ];
+  for (const dir of dirs) {
+    mkdirSync(join(targetDir, dir), { recursive: true });
+  }
+  function write(relPath, content, mode) {
+    writeFileSync(join(targetDir, relPath), content, void 0);
+    files.push(relPath);
+  }
+  write("AGENTS.md", generateAgents(options));
+  write("CLAUDE.md", generateClaudeMd(options));
+  write("GEMINI.md", generateThinWrapper(options));
+  write(".cursorrules", generateThinWrapper(options));
+  write(".clinerules", generateThinWrapper(options));
+  write(".windsurfrules", generateThinWrapper(options));
+  write(".github/copilot-instructions.md", generateThinWrapper(options));
+  write(".claude/skills/play/SKILL.md", generatePlaySkill(options));
+  write(".claude/skills/hint/SKILL.md", generateHintSkill(options));
+  write(".claude/skills/next/SKILL.md", generateNextSkill(options));
+  write(".claude/skills/progress/SKILL.md", generateProgressSkill(options));
+  write(".claude/skills/verify/SKILL.md", generateVerifySkill(options));
+  write("engine/rules.md", generateRules(options));
+  write("engine/narrator.md", generateNarrator(options));
+  write("engine/validation.md", generateValidation(options));
+  write("content/ch01-getting-started/README.md", generateChapterReadme(options));
+  write("content/ch01-getting-started/challenges/.gitkeep", "");
+  write(".player/progress.yaml.template", generateProgressTemplate(options));
+  write(".gitignore", generateGitignore());
+  write("hubbit.yaml", generateManifest(options));
+  write("README.md", generateReadme(options));
+  return files;
+}
+function printSetupGuide(name) {
+  const divider = pc5.dim("\u2500".repeat(56));
+  console.log(pc5.bold("  Next: publish your hubbit on GitHub"));
+  newline();
+  console.log(divider);
+  newline();
+  console.log(`  ${pc5.cyan(pc5.bold("Step 1"))}  Initialize git`);
+  newline();
+  console.log(`  Run in your terminal:`);
+  console.log(`    ${pc5.yellow(`cd ${name} && git init && git add . && git commit -m "feat: init"`)}`);
+  newline();
+  console.log(`  Or paste this into your AI editor:`);
+  newline();
+  console.log(pc5.dim("  \u250C" + "\u2500".repeat(54) + "\u2510"));
+  console.log(pc5.dim("  \u2502") + ` Initialize git for my new project in ./${name}.   ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2502") + ` Run: git init && git add . &&                     ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2502") + ` git commit -m "feat: init"                        ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2514" + "\u2500".repeat(54) + "\u2518"));
+  newline();
+  console.log(divider);
+  newline();
+  console.log(`  ${pc5.cyan(pc5.bold("Step 2"))}  Create a GitHub repo and push`);
+  newline();
+  console.log(`  Or paste this into your AI editor:`);
+  newline();
+  const truncatedName = name.length > 40 ? name.slice(0, 37) + "..." : name;
+  console.log(pc5.dim("  \u250C" + "\u2500".repeat(54) + "\u2510"));
+  console.log(pc5.dim("  \u2502") + ` Create a public GitHub repo named:                ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2502") + ` "${truncatedName}"` + " ".repeat(Math.max(0, 53 - truncatedName.length - 2)) + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2502") + ` Push my local commits to it. Use the gh CLI or    ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2502") + ` guide me through the GitHub web UI.               ` + pc5.dim("\u2502"));
+  console.log(pc5.dim("  \u2514" + "\u2500".repeat(54) + "\u2518"));
+  newline();
+  console.log(divider);
+  newline();
+  console.log(`  ${pc5.cyan(pc5.bold("Step 3"))}  Register on Hubbits`);
+  newline();
+  console.log(`  Once your repo is live, run:`);
+  console.log(`    ${pc5.yellow(`hubbits create import https://github.com/<you>/${name}`)}`);
+  newline();
+  console.log(divider);
+  newline();
+  hint("Run `hubbits validate` at any time to check your hubbit.yaml");
+  newline();
+}
+function generateAgents(options) {
+  return `# ${options.name} \u2014 Interactive AI Experience
+
+You are the guide for **${options.name}**. ${options.description}
+
+## Quick Start
+
+When the user opens this project and says anything like "let's play", "start", or "begin":
+
+1. Read \`engine/rules.md\` \u2014 your core behavior rules
+2. Read \`engine/narrator.md\` \u2014 tone, persona, story context
+3. Read \`.player/progress.yaml\` \u2014 check their current state
+4. Welcome them and guide them to where they left off
+
+## Critical Rules
+
+- ALWAYS read \`engine/rules.md\` before interacting
+- NEVER solve challenges for the user \u2014 only give hints
+- Track progress by updating \`.player/progress.yaml\` after each milestone
+- Respond in the user's language (auto-detect from their first message)
+
+## Commands
+
+These work as natural conversation prompts:
+
+- "let's play" / "start" \u2014 Start or resume
+- "hint" / "I'm stuck" \u2014 Get a progressive hint
+- "verify" / "check my work" \u2014 Verify challenge solution
+- "progress" \u2014 See how far they've come
+- "next" \u2014 Move to the next lesson or challenge
+
+## File Structure
+
+\`\`\`
+engine/         \u2014 Rules, narrator persona, validation logic
+content/        \u2014 Chapters with lessons and challenges
+.player/        \u2014 Player state (do not commit progress.yaml)
+\`\`\`
+`;
+}
+function generateClaudeMd(options) {
+  return `# ${options.name}
+
+You are the guide for **${options.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+
+## Claude Code Skills
+
+This project includes slash commands in \`.claude/skills/\`:
+
+- \`/play\` \u2014 Start or resume the experience
+- \`/hint\` \u2014 Get a progressive hint for the current challenge
+- \`/next\` \u2014 Move to the next lesson or challenge
+- \`/progress\` \u2014 Show current progress
+- \`/verify\` \u2014 Verify challenge solution
+`;
+}
+function generateThinWrapper(options) {
+  return `# ${options.name}
+
+You are the guide for **${options.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+`;
+}
+function generatePlaySkill(options) {
+  return `---
+name: play
+description: Start or resume the ${options.name} experience. Use when the user says "let's play", "start", "begin", or opens the project for the first time.
+---
+
+# Start / Resume
+
+You are the guide for ${options.name}. Follow these steps:
+
+## Step 1: Load Engine
+
+Read in order:
+- \`engine/rules.md\` \u2014 your behavior rules (teaching mode vs challenge mode)
+- \`engine/narrator.md\` \u2014 your persona, tone, and story context
+
+## Step 2: Check Player State
+
+Read \`.player/progress.yaml\`.
+
+### New Player (started_at is empty)
+
+1. Detect the user's language from their first message (default: en)
+2. Update \`.player/progress.yaml\`: set \`started_at\`, \`language\`
+3. Welcome them warmly
+4. Introduce Chapter 1 (read \`content/ch01-getting-started/README.md\`)
+5. Ask: "Ready to start the first lesson, or jump straight to the challenge?"
+
+### Returning Player
+
+1. Welcome them back
+2. Summarize where they left off
+3. Offer: continue, replay chapter, or jump ahead
+
+## Step 3: Begin
+
+Navigate to the correct lesson or challenge based on progress.
+
+$ARGUMENTS
+`;
+}
+function generateHintSkill(options) {
+  return `---
+name: hint
+description: Give a progressive hint for the current challenge in ${options.name}. Use when the user says "hint", "I'm stuck", "help", or "I don't know what to do".
+---
+
+# Give a Hint
+
+Read \`engine/rules.md\` for hint level behavior.
+
+## Steps
+
+1. Check \`.player/progress.yaml\` for the current challenge
+2. Read the challenge file to understand the expected outcome
+3. Check the hint count already used (track in progress.yaml)
+4. Give a hint at the appropriate level:
+   - **Hint 1**: Conceptual \u2014 "Think about how X relates to Y..."
+   - **Hint 2**: Directional \u2014 "Try looking at Z..."
+   - **Hint 3**: Near-solution \u2014 "The answer involves doing W to..."
+5. Do NOT give the solution directly
+
+$ARGUMENTS
+`;
+}
+function generateNextSkill(options) {
+  return `---
+name: next
+description: Move to the next lesson or challenge in ${options.name}. Use when the user says "next", "continue", "what's next", or finishes a lesson.
+---
+
+# Next Lesson or Challenge
+
+## Steps
+
+1. Read \`.player/progress.yaml\` to find current position
+2. Determine what comes next:
+   - If in a lesson \u2192 present the next lesson (or the chapter challenge if done)
+   - If challenge was completed \u2192 move to next chapter
+   - If all chapters done \u2192 congratulate and suggest contributing
+3. Update \`progress.yaml\` to reflect the new position
+4. Present the next content
+
+$ARGUMENTS
+`;
+}
+function generateProgressSkill(options) {
+  return `---
+name: progress
+description: Show the user's progress in ${options.name}. Use when the user says "progress", "how am I doing", "show my progress", or "where am I".
+---
+
+# Show Progress
+
+## Steps
+
+1. Read \`.player/progress.yaml\`
+2. Display a summary:
+   - Chapters completed vs total
+   - Current chapter and lesson
+   - Challenges solved
+   - Time spent (if tracked)
+3. Encourage them with a short motivational message
+
+$ARGUMENTS
+`;
+}
+function generateVerifySkill(options) {
+  return `---
+name: verify
+description: Verify the user's solution to the current challenge in ${options.name}. Use when the user says "verify", "check my work", "did I get it right", or "check".
+---
+
+# Verify Solution
+
+Read \`engine/validation.md\` for verification rules.
+
+## Steps
+
+1. Read \`.player/progress.yaml\` for current challenge
+2. Read the challenge file for expected outcome
+3. Ask the user to show their work (output, code, or result)
+4. Compare against expected outcome:
+   - **Correct**: celebrate, update \`progress.yaml\` to mark challenge completed, suggest \`/next\`
+   - **Incorrect**: give a specific hint about what's wrong (no solution)
+
+$ARGUMENTS
+`;
+}
+function generateRules(options) {
+  return `# ${options.name} \u2014 Rules
+
+## Two Modes
+
+### Teaching Mode (during lessons)
+
+- Explain concepts clearly with examples
+- Ask questions to check understanding
+- Use analogies to make ideas concrete
+- Pace yourself \u2014 don't overwhelm
+
+### Challenge Mode (during challenges)
+
+- NEVER give the answer directly
+- Use progressive hints (conceptual \u2192 directional \u2192 near-solution)
+- Let the user struggle productively \u2014 that's where learning happens
+- Celebrate when they solve it
+
+## Session Flow
+
+1. Read \`engine/narrator.md\` to load your persona
+2. Read \`.player/progress.yaml\` to check state
+3. Welcome the user and orient them
+4. Present current lesson or challenge
+5. Track progress after each milestone
+
+## Language Detection
+
+- Detect the user's language from their first message
+- Respond in that language throughout
+- Keep chapter/lesson titles and technical terms in English
+- Record detected language as IETF tag in \`progress.yaml\` \u2192 \`player.language\`
+
+## Progress Tracking
+
+Update \`.player/progress.yaml\` when:
+- A lesson is completed
+- A challenge is solved
+- The session ends (update \`last_played\`)
+`;
+}
+function generateNarrator(options) {
+  return `# ${options.name} \u2014 Narrator
+
+## Persona
+
+- **Name**: Guide
+- **Tone**: Encouraging, patient, and knowledgeable
+- **Style**: Clear explanations with real-world examples
+- **Approach**: Socratic \u2014 ask questions, don't just lecture
+
+## Story Context
+
+${options.description}
+
+## Greeting Templates
+
+### New User
+"Welcome! I'm your guide for ${options.name}.
+${options.description}
+Ready to dive in? Let's start with Chapter 1."
+
+### Returning User
+"Welcome back! Last time you [summary from progress.yaml].
+Ready to pick up where you left off?"
+
+### After Completing a Challenge
+"Excellent work! You've solved [challenge name].
+Here's the key insight: [brief explanation].
+Up next: [preview of what's coming]"
+
+### When Stuck
+"No worries \u2014 this one is tricky.
+Think about [concept]. What happens when you [action]?
+Take your time."
+`;
+}
+function generateValidation(options) {
+  return `# ${options.name} \u2014 Validation
+
+## How to Verify Challenges
+
+When the user asks to verify their work:
+
+1. Read the current challenge requirements from the challenge file
+2. Ask the user to show their result (output, code, screenshot, etc.)
+3. Compare against the expected outcome
+4. Give feedback:
+
+### Correct
+
+- Celebrate clearly: "That's exactly right!"
+- Explain why it works (reinforce the learning)
+- Update \`.player/progress.yaml\`:
+  \`\`\`yaml
+  chapters:
+    ch01-getting-started:
+      challenges:
+        challenge_01: completed
+  \`\`\`
+- Suggest \`/next\` to continue
+
+### Incorrect
+
+- Be specific: "The result is close, but [what's different]"
+- Give a targeted hint (not the solution)
+- Let them try again
+
+## Progress Updates
+
+Always update \`last_played\` at the end of each session:
+
+\`\`\`yaml
+player:
+  last_played: <today's date>
+\`\`\`
+`;
+}
+function generateChapterReadme(options) {
+  return `# Chapter 1: Getting Started
+
+> Part of [${options.name}](../../hubbit.yaml)
+
+## Overview
+
+[TODO: Write your chapter overview here. What will the user learn? Why does it matter?]
+
+## Lessons
+
+### Lesson 1: Introduction
+
+[TODO: Write your first lesson here. Introduce the core concept.]
+
+### Lesson 2: Core Concepts
+
+[TODO: Dive deeper. Explain the main ideas with examples.]
+
+### Lesson 3: Putting It Together
+
+[TODO: Connect the concepts. Show how they work together in practice.]
+
+## Challenge
+
+See the \`challenges/\` directory for the hands-on exercise.
+
+After completing the challenge, run \`/verify\` to check your work.
+`;
+}
+function generateProgressTemplate(options) {
+  return `# Progress template for ${options.name}
+# This file is committed to git as the clean starting state.
+# The live progress.yaml (in .player/) is gitignored.
+
+version: 1
+
+player:
+  started_at: null
+  last_played: null
+  language: auto
+
+chapters:
+  ch01-getting-started:
+    status: not_started   # not_started | in_progress | completed
+    started_at: null
+    completed_at: null
+    lessons:
+      lesson_01: not_started
+      lesson_02: not_started
+      lesson_03: not_started
+    challenges:
+      challenge_01: not_started
+`;
+}
+function generateGitignore() {
+  return `.player/progress.yaml
+!.player/progress.yaml.template
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/
+node_modules/
+*.log
+`;
+}
+function generateManifest(options) {
+  const authorLine = options.author ? `author: "${options.author}"` : '# author: "Your Name"';
+  return `# Hubbit Manifest
+# Documentation: https://hubbits.dev/docs/manifest
+
+spec_version: 1
+name: "${options.name}"
+version: "0.1.0"
+${authorLine}
+description: "${escapeYaml(options.description)}"
+
+category: ${options.category}
+difficulty: ${options.difficulty}
+language: auto
+estimated_time: "1-2 hours"
+license: MIT
+
+tags:
+  - ${options.category}
+  # Add more tags here
+
+pricing: free
+
+# GitHub repository (set by \`hubbits create import\`)
+# repository: "https://github.com/<you>/${options.name}"
+
+# Compatible AI editors
+compatible_with:
+  - claude-code
+  - cursor
+  - windsurf
+  - copilot
+
+# AI persona configuration
+persona:
+  name: "Guide"
+  tone: "encouraging"
+  traits:
+    - "patient"
+    - "knowledgeable"
+  constraints:
+    - "Never give answers directly; guide with hints"
+    - "Celebrate progress"
+
+# Curriculum structure
+curriculum:
+  type: linear
+  chapters:
+    - id: ch01-getting-started
+      title: "Chapter 1: Getting Started"
+      lessons: 3
+      challenges: 1
+      unlock_condition: null
+
+# Runtime configuration
+runtime:
+  local: true
+  cloud: false
+
+# AI engine requirements
+engines:
+  ai:
+    min_context_window: 100000
+    modalities:
+      - text
+    features:
+      - tool_use
+`;
+}
+function generateReadme(options) {
+  return `# ${options.name}
+
+> ${options.description}
+
+An interactive AI-driven experience. Open this project in your AI editor and type **"let's play"** to begin.
+
+---
+
+## How It Works
+
+1. Pull this package: \`hubbits pull <scope>/${options.name}\`
+2. Open it in your AI editor (Claude Code, Cursor, Windsurf, Copilot, etc.)
+3. Type **"let's play"**
+4. Your AI becomes your guide
+
+---
+
+## Commands
+
+\`\`\`
+"let's play"     Start or resume
+"hint"           Get a progressive hint
+"verify"         Check your work
+"progress"       See how far you've come
+"next"           Move forward
+\`\`\`
+
+---
+
+## Project Structure
+
+\`\`\`
+AGENTS.md                   \u2190 Universal AI entry point
+CLAUDE.md                   \u2190 Claude Code + skills
+.cursorrules                \u2190 Cursor
+.windsurfrules              \u2190 Windsurf
+.github/copilot-instructions.md  \u2190 GitHub Copilot
+
+engine/                     \u2190 AI behavior (rules, narrator, validation)
+content/                    \u2190 Chapters with lessons and challenges
+.player/                    \u2190 Your progress (not committed)
+\`\`\`
+
+---
+
+## License
+
+MIT
+`;
+}
+function isValidName(name) {
+  if (name.length === 0 || name.length > 214) return false;
+  return /^[a-z][a-z0-9-]*[a-z0-9]$/.test(name) || /^[a-z]$/.test(name);
+}
+function escapeYaml(str) {
+  return str.replace(/"/g, '\\"');
+}
+var import_default = defineCommand({
+  meta: {
+    name: "import",
+    description: "Import a GitHub repo as a hubbit"
+  },
+  args: {
+    url: {
+      type: "positional",
+      description: "GitHub repository URL (e.g. https://github.com/user/repo)",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const repoUrl = args.url;
+    if (!isGithubUrl(repoUrl)) {
+      errorWithFix(
+        `Invalid GitHub URL: "${repoUrl}"`,
+        "Provide a full GitHub repo URL, e.g. https://github.com/user/repo"
+      );
+      process.exit(1);
+    }
+    const packageDir = resolve(process.cwd());
+    const fetchSpinner = spinner("Fetching repo info from GitHub...");
+    const api2 = createApiClient();
+    let repoInfo;
+    try {
+      const result = await api2.getGithubRepoInfo(repoUrl);
+      if (!result.data) {
+        fetchSpinner.fail("Failed to fetch repo info.");
+        errorWithFix("No data returned from GitHub.", "Check that the repo is public.");
+        process.exit(1);
+      }
+      repoInfo = result.data;
+      fetchSpinner.succeed(`Found: ${pc5.bold(repoInfo.name)} \u2014 ${repoInfo.description || pc5.dim("no description")}`);
+    } catch (err) {
+      fetchSpinner.fail("Failed to fetch repo info.");
+      if (err instanceof ApiError) {
+        errorWithFix(err.message, "Make sure the repo is public and the URL is correct.");
+      } else {
+        errorWithFix("Network error.", "Check your connection and try again.");
+      }
+      process.exit(1);
+    }
+    const manifestPath = findManifestFile(packageDir);
+    if (manifestPath) {
+      const updated = setRepositoryField(manifestPath, repoUrl);
+      if (updated) {
+        success(`Updated ${pc5.dim("hubbit.yaml")} \u2014 set repository: ${pc5.cyan(repoUrl)}`);
+      } else {
+        info(`${pc5.dim("hubbit.yaml")} already has a repository field.`);
+      }
+    } else {
+      if (!args.yes && !args.json && !args.quiet) {
+        newline();
+        info("No hubbit.yaml found in the current directory.");
+        info("A minimal manifest will be created from GitHub metadata:");
+        newline();
+        field("Name", repoInfo.name);
+        field("Description", repoInfo.description || "(empty)");
+        field("License", repoInfo.license || "(none)");
+        if (repoInfo.tags.length > 0) field("Tags", repoInfo.tags.slice(0, 5).join(", "));
+        newline();
+        const confirmed = await p5.confirm({ message: "Create hubbit.yaml?" });
+        if (p5.isCancel(confirmed) || !confirmed) {
+          p5.cancel("Import cancelled.");
+          process.exit(0);
+        }
+      }
+      const manifestContent = generateMinimalManifest(repoInfo, repoUrl);
+      writeFileSync(join(packageDir, "hubbit.yaml"), manifestContent, "utf-8");
+      success(`Created ${pc5.dim("hubbit.yaml")} from GitHub metadata.`);
+    }
+    if (isJsonMode()) {
+      outputJson({
+        status: "ok",
+        repository: repoUrl,
+        manifest: manifestPath ?? join(packageDir, "hubbit.yaml"),
+        next: "hubbits publish"
+      });
+      return;
+    }
+    newline();
+    success("Ready to publish!");
+    newline();
+    field("Repository", pc5.cyan(repoUrl));
+    field("Directory", packageDir);
+    newline();
+    hint(`Run ${pc5.bold("hubbits publish")} to publish your hubbit to the registry.`);
+    hint("Run `hubbits validate` first to check for any issues.");
+    newline();
+  }
+});
+function findManifestFile(dir) {
+  for (const name of ["hubbit.yaml", "hubbit.yml"]) {
+    const p7 = join(dir, name);
+    if (existsSync(p7)) return p7;
+  }
+  return null;
+}
+function setRepositoryField(manifestPath, repoUrl) {
+  const content = readFileSync(manifestPath, "utf-8");
+  const repoLine = `repository: "${repoUrl}"`;
+  const realMatch = content.match(/^repository:(.*)$/m);
+  if (realMatch) {
+    if (realMatch[0] === repoLine) return false;
+    const updated2 = content.replace(/^repository:.*$/gm, repoLine);
+    writeFileSync(manifestPath, updated2, "utf-8");
+    return true;
+  }
+  if (/^#\s*repository:/m.test(content)) {
+    const updated2 = content.replace(/^#\s*repository:.*$/m, repoLine);
+    writeFileSync(manifestPath, updated2, "utf-8");
+    return true;
+  }
+  const updated = content.trimEnd() + `
+repository: "${repoUrl}"
+`;
+  writeFileSync(manifestPath, updated, "utf-8");
+  return true;
+}
+function generateMinimalManifest(info2, repoUrl) {
+  const name = toHubbitName(info2.name);
+  const description = escapeYaml2(info2.description || `A hubbit based on ${info2.name}`);
+  const license = info2.license ? `license: ${info2.license}` : "# license: MIT";
+  const tagsBlock = info2.tags.length > 0 ? "tags:\n" + info2.tags.slice(0, 10).map((t) => `  - ${t}`).join("\n") : "# tags: []";
+  return `# Hubbit Manifest
+# Documentation: https://hubbits.dev/docs/manifest
+
+spec_version: 1
+name: "${name}"
+version: "${info2.version ?? "0.1.0"}"
+description: "${description}"
+
+${license}
+${tagsBlock}
+
+category: learning
+difficulty: beginner
+language: auto
+pricing: free
+repository: "${repoUrl}"
+
+compatible_with:
+  - claude-code
+  - cursor
+  - windsurf
+  - copilot
+
+runtime:
+  local: true
+  cloud: false
+`;
+}
+function isGithubUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.hostname === "github.com" && u.pathname.split("/").filter(Boolean).length >= 2;
+  } catch {
+    return false;
+  }
+}
+function toHubbitName(name) {
+  const result = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return result.length > 0 ? result : "my-hubbit";
+}
+function escapeYaml2(str) {
+  return str.replace(/"/g, '\\"');
+}
+
+// src/commands/create/index.ts
+var create_default = defineCommand({
+  meta: {
+    name: "create",
+    description: "Create a new hubbit or import from GitHub"
+  },
+  subCommands: {
+    template: template_default,
+    import: import_default
+  }
+});
+var init_default = defineCommand({
+  meta: {
+    name: "init",
+    description: "Initialize a hubbit in the current directory"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const cwd = process.cwd();
+    const cwdName = basename(cwd);
+    const yamlPath = join(cwd, "hubbit.yaml");
+    const authState = getAuthState();
+    const loggedInUsername = authState?.username ?? void 0;
+    if (existsSync(yamlPath)) {
+      if (isJsonMode()) {
+        outputJson({ status: "exists", path: yamlPath });
+        return;
+      }
+      info("hubbit.yaml already exists in this directory.");
+      newline();
+      hint("Validate: `hubbits validate`");
+      hint("Publish:  `hubbits publish`");
+      return;
+    }
+    const entries = readdirSync(cwd).filter(
+      (e) => e !== ".git" && e !== ".DS_Store" && e !== "Thumbs.db"
+    );
+    if (entries.length === 0) {
+      const meta2 = await interactiveFullMeta(cwdName, loggedInUsername);
+      const files = scaffoldInto(cwd, meta2);
+      if (isJsonMode()) {
+        outputJson({ status: "ok", mode: "scaffold", path: cwd, files });
+        return;
+      }
+      newline();
+      success(`Scaffolded hubbit into ${pc5.bold(cwdName)}/`);
+      for (const file of files) {
+        console.log(`  ${pc5.dim("\u251C\u2500\u2500")} ${file}`);
+      }
+      newline();
+      printPostScaffoldGuide(cwdName);
+      return;
+    }
+    const meta = await interactiveYamlOnly(cwdName, loggedInUsername);
+    writeFileSync(yamlPath, generateManifest2(meta));
+    if (isJsonMode()) {
+      outputJson({ status: "ok", mode: "yaml_only", path: yamlPath });
+      return;
+    }
+    newline();
+    success(`Created ${pc5.bold("hubbit.yaml")}`);
+    newline();
+    console.log(`  ${pc5.dim("\u251C\u2500\u2500")} hubbit.yaml`);
+    newline();
+    console.log(pc5.bold("  Next steps:"));
+    newline();
+    console.log(`  1. Review ${pc5.yellow("hubbit.yaml")} and fill in any details`);
+    console.log(`  2. Commit and push to GitHub`);
+    console.log(`  3. Run ${pc5.yellow("hubbits publish")} to publish`);
+    newline();
+    hint("Validate your manifest: `hubbits validate`");
+    newline();
+  }
+});
+async function interactiveFullMeta(defaultName, username) {
+  p5.intro(pc5.bold("Initialize a Hubbit"));
+  const name = await p5.text({
+    message: "Package name:",
+    placeholder: defaultName || "my-awesome-hubbit",
+    initialValue: isValidName2(defaultName) ? defaultName : "",
+    validate(value) {
+      if (!value) return "Package name is required.";
+      if (!isValidName2(value)) {
+        return "Use lowercase letters, numbers, and hyphens. Must start with a letter.";
+      }
+    }
+  });
+  if (p5.isCancel(name)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const category = await p5.select({
+    message: "Category:",
+    options: [
+      { value: "learning", label: "Learning", hint: "Educational courses and tutorials" },
+      { value: "entertainment", label: "Entertainment", hint: "Games, stories, and fun" },
+      { value: "productivity", label: "Productivity", hint: "Tools and workflows" },
+      { value: "wellness", label: "Wellness", hint: "Health and wellbeing" }
+    ]
+  });
+  if (p5.isCancel(category)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const difficulty = await p5.select({
+    message: "Difficulty:",
+    options: [
+      { value: "beginner", label: "Beginner" },
+      { value: "intermediate", label: "Intermediate" },
+      { value: "advanced", label: "Advanced" },
+      { value: "beginner-to-intermediate", label: "Beginner to Intermediate" },
+      { value: "intermediate-to-advanced", label: "Intermediate to Advanced" }
+    ]
+  });
+  if (p5.isCancel(difficulty)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const description = await p5.text({
+    message: "Description:",
+    placeholder: "A brief description of your Hubbit",
+    validate(value) {
+      if (!value) return "Description is required.";
+      if (value.length > 500) return "Description must be 500 characters or fewer.";
+    }
+  });
+  if (p5.isCancel(description)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  let author = username;
+  if (!author) {
+    const authorInput = await p5.text({
+      message: "Author (optional):",
+      placeholder: "Your Name"
+    });
+    if (p5.isCancel(authorInput)) {
+      p5.cancel("Cancelled.");
+      process.exit(0);
+    }
+    author = authorInput || void 0;
+  }
+  p5.outro(pc5.dim("Scaffolding..."));
+  return {
+    name,
+    category,
+    difficulty,
+    description,
+    version: "0.1.0",
+    pricing: "free",
+    author
+  };
+}
+async function interactiveYamlOnly(defaultName, username) {
+  p5.intro(pc5.bold("Create hubbit.yaml"));
+  const name = await p5.text({
+    message: "Package name:",
+    placeholder: defaultName || "my-awesome-hubbit",
+    initialValue: isValidName2(defaultName) ? defaultName : "",
+    validate(value) {
+      if (!value) return "Package name is required.";
+      if (!isValidName2(value)) {
+        return "Use lowercase letters, numbers, and hyphens. Must start with a letter.";
+      }
+    }
+  });
+  if (p5.isCancel(name)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const version = await p5.text({
+    message: "Version:",
+    placeholder: "0.1.0",
+    initialValue: "0.1.0",
+    validate(value) {
+      if (!value) return "Version is required.";
+      if (!/^\d+\.\d+\.\d+/.test(value)) return "Must be a valid SemVer (e.g., 0.1.0).";
+    }
+  });
+  if (p5.isCancel(version)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const description = await p5.text({
+    message: "Description:",
+    placeholder: "A brief description of your Hubbit",
+    validate(value) {
+      if (!value) return "Description is required.";
+      if (value.length > 500) return "Description must be 500 characters or fewer.";
+    }
+  });
+  if (p5.isCancel(description)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const category = await p5.select({
+    message: "Category:",
+    options: [
+      { value: "learning", label: "Learning" },
+      { value: "entertainment", label: "Entertainment" },
+      { value: "productivity", label: "Productivity" },
+      { value: "wellness", label: "Wellness" }
+    ]
+  });
+  if (p5.isCancel(category)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const difficulty = await p5.select({
+    message: "Difficulty:",
+    options: [
+      { value: "beginner", label: "Beginner" },
+      { value: "intermediate", label: "Intermediate" },
+      { value: "advanced", label: "Advanced" },
+      { value: "beginner-to-intermediate", label: "Beginner to Intermediate" },
+      { value: "intermediate-to-advanced", label: "Intermediate to Advanced" }
+    ]
+  });
+  if (p5.isCancel(difficulty)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  const pricing = await p5.select({
+    message: "Pricing:",
+    options: [
+      { value: "free", label: "Free" },
+      { value: "paid", label: "Paid" }
+    ]
+  });
+  if (p5.isCancel(pricing)) {
+    p5.cancel("Cancelled.");
+    process.exit(0);
+  }
+  p5.outro(pc5.dim("Generating hubbit.yaml..."));
+  return {
+    name,
+    version,
+    description,
+    category,
+    difficulty,
+    pricing,
+    author: username
+  };
+}
+function scaffoldInto(targetDir, meta) {
+  const files = [];
+  const dirs = [
+    ".claude/skills/play",
+    ".claude/skills/hint",
+    ".claude/skills/next",
+    ".claude/skills/progress",
+    ".claude/skills/verify",
+    ".github",
+    "engine",
+    "content/ch01-getting-started/challenges",
+    ".player"
+  ];
+  for (const dir of dirs) {
+    mkdirSync(join(targetDir, dir), { recursive: true });
+  }
+  function write(relPath, content) {
+    writeFileSync(join(targetDir, relPath), content);
+    files.push(relPath);
+  }
+  write("AGENTS.md", `# ${meta.name} \u2014 Interactive AI Experience
+
+You are the guide for **${meta.name}**. ${meta.description}
+
+## Quick Start
+
+When the user opens this project and says anything like "let's play", "start", or "begin":
+
+1. Read \`engine/rules.md\` \u2014 your core behavior rules
+2. Read \`engine/narrator.md\` \u2014 tone, persona, story context
+3. Read \`.player/progress.yaml\` \u2014 check their current state
+4. Welcome them and guide them to where they left off
+
+## Critical Rules
+
+- ALWAYS read \`engine/rules.md\` before interacting
+- NEVER solve challenges for the user \u2014 only give hints
+- Track progress by updating \`.player/progress.yaml\` after each milestone
+- Respond in the user's language (auto-detect from their first message)
+`);
+  write("CLAUDE.md", `# ${meta.name}
+
+You are the guide for **${meta.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+
+## Claude Code Skills
+
+- \`/play\` \u2014 Start or resume the experience
+- \`/hint\` \u2014 Get a progressive hint for the current challenge
+- \`/next\` \u2014 Move to the next lesson or challenge
+- \`/progress\` \u2014 Show current progress
+- \`/verify\` \u2014 Verify challenge solution
+`);
+  write("GEMINI.md", `# ${meta.name}
+
+You are the guide for **${meta.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+`);
+  write(".cursorrules", `# ${meta.name}
+
+You are the guide for **${meta.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+`);
+  write(".windsurfrules", `# ${meta.name}
+
+You are the guide for **${meta.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+`);
+  write(".github/copilot-instructions.md", `# ${meta.name}
+
+You are the guide for **${meta.name}**. Read and follow all instructions in \`AGENTS.md\`.
+
+**Critical:** NEVER solve challenges for the user \u2014 only give hints.
+`);
+  write(".claude/skills/play/SKILL.md", `---
+name: play
+description: Start or resume the ${meta.name} experience.
+---
+
+# Start / Resume
+
+1. Read \`engine/rules.md\` and \`engine/narrator.md\`
+2. Read \`.player/progress.yaml\` to check player state
+3. Welcome them and guide them to the right starting point
+
+$ARGUMENTS
+`);
+  write(".claude/skills/hint/SKILL.md", `---
+name: hint
+description: Give a progressive hint for the current challenge in ${meta.name}.
+---
+
+# Give a Hint
+
+1. Check \`.player/progress.yaml\` for the current challenge
+2. Give a hint at the appropriate level (conceptual \u2192 directional \u2192 near-solution)
+3. Do NOT give the solution directly
+
+$ARGUMENTS
+`);
+  write(".claude/skills/next/SKILL.md", `---
+name: next
+description: Move to the next lesson or challenge in ${meta.name}.
+---
+
+# Next Lesson
+
+1. Read \`.player/progress.yaml\` to find current position
+2. Present the next lesson or challenge
+3. Update progress.yaml
+
+$ARGUMENTS
+`);
+  write(".claude/skills/progress/SKILL.md", `---
+name: progress
+description: Show the user's progress in ${meta.name}.
+---
+
+# Show Progress
+
+1. Read \`.player/progress.yaml\`
+2. Show chapters completed, current position, and time spent
+
+$ARGUMENTS
+`);
+  write(".claude/skills/verify/SKILL.md", `---
+name: verify
+description: Verify the user's solution to the current challenge in ${meta.name}.
+---
+
+# Verify Solution
+
+1. Read \`.player/progress.yaml\` for current challenge
+2. Ask user to show their work
+3. Compare against expected outcome \u2014 celebrate if correct, hint if not
+
+$ARGUMENTS
+`);
+  write("engine/rules.md", `# ${meta.name} \u2014 Rules
+
+## Teaching Mode
+
+- Explain concepts clearly with examples
+- Ask questions to check understanding
+
+## Challenge Mode
+
+- NEVER give the answer directly
+- Use progressive hints (conceptual \u2192 directional \u2192 near-solution)
+- Celebrate when they solve it
+`);
+  write("engine/narrator.md", `# ${meta.name} \u2014 Narrator
+
+## Persona
+
+- **Tone**: Encouraging, patient, knowledgeable
+- **Style**: Socratic \u2014 ask questions, don't just lecture
+
+## Story Context
+
+${meta.description}
+`);
+  write("engine/validation.md", `# ${meta.name} \u2014 Validation
+
+When the user asks to verify their work:
+
+1. Read the current challenge requirements
+2. Ask the user to show their result
+3. Compare and give feedback \u2014 celebrate correct, hint if not
+4. Update \`.player/progress.yaml\` on success
+`);
+  write("content/ch01-getting-started/README.md", `# Chapter 1: Getting Started
+
+> Part of [${meta.name}](../../hubbit.yaml)
+
+## Overview
+
+[TODO: Write your chapter overview here.]
+
+## Lessons
+
+### Lesson 1: Introduction
+
+[TODO: Write your first lesson here.]
+
+## Challenge
+
+See the \`challenges/\` directory.
+`);
+  write("content/ch01-getting-started/challenges/.gitkeep", "");
+  write(".player/progress.yaml.template", `version: 1
+
+player:
+  started_at: null
+  last_played: null
+  language: auto
+
+chapters:
+  ch01-getting-started:
+    status: not_started
+    lessons:
+      lesson_01: not_started
+    challenges:
+      challenge_01: not_started
+`);
+  write(".gitignore", `.player/progress.yaml
+!.player/progress.yaml.template
+.DS_Store
+Thumbs.db
+`);
+  write("hubbit.yaml", generateManifest2(meta));
+  write("README.md", `# ${meta.name}
+
+> ${meta.description}
+
+Open this project in your AI editor and type **"let's play"** to begin.
+
+## How It Works
+
+1. Pull this package: \`hubbits pull <scope>/${meta.name}\`
+2. Open in your AI editor (Claude Code, Cursor, Windsurf, Copilot, etc.)
+3. Type **"let's play"**
+
+## License
+
+MIT
+`);
+  return files;
+}
+function generateManifest2(meta) {
+  const authorLine = meta.author ? `author: "${meta.author}"` : '# author: "Your Name"';
+  return `# Hubbit Manifest
+# Documentation: https://hubbits.dev/docs/manifest
+
+spec_version: 1
+name: "${meta.name}"
+version: "${meta.version}"
+${authorLine}
+description: "${meta.description.replace(/"/g, '\\"')}"
+
+category: ${meta.category}
+difficulty: ${meta.difficulty}
+language: auto
+${meta.pricing === "paid" ? "" : "# "}estimated_time: "1-2 hours"
+license: MIT
+
+tags:
+  - ${meta.category}
+  # Add more tags here
+
+pricing: ${meta.pricing}
+
+# GitHub repository (required for CLI publish)
+# repository: "https://github.com/<you>/${meta.name}"
+
+# Compatible AI editors
+compatible_with:
+  - claude-code
+  - cursor
+  - windsurf
+  - copilot
+
+# AI persona configuration
+persona:
+  name: "Guide"
+  tone: "encouraging"
+  traits:
+    - "patient"
+    - "knowledgeable"
+  constraints:
+    - "Never give answers directly; guide with hints"
+    - "Celebrate progress"
+`;
+}
+function printPostScaffoldGuide(name) {
+  const divider = pc5.dim("\u2500".repeat(56));
+  console.log(pc5.bold("  Next: publish your hubbit on GitHub"));
+  newline();
+  console.log(divider);
+  newline();
+  console.log(`  ${pc5.cyan(pc5.bold("Step 1"))}  Commit and push to GitHub`);
+  newline();
+  console.log(`    ${pc5.yellow(`git add . && git commit -m "feat: init ${name}"`)}`);
+  console.log(`    ${pc5.yellow(`git push -u origin main`)}`);
+  newline();
+  console.log(divider);
+  newline();
+  console.log(`  ${pc5.cyan(pc5.bold("Step 2"))}  Publish to Hubbits`);
+  newline();
+  console.log(`    ${pc5.yellow(`hubbits publish`)}`);
+  newline();
+  console.log(divider);
+  newline();
+  hint("Validate your manifest at any time: `hubbits validate`");
+  newline();
+}
+function isValidName2(name) {
+  if (!name || name.length === 0 || name.length > 214) return false;
+  return /^[a-z][a-z0-9-]*[a-z0-9]$/.test(name) || /^[a-z]$/.test(name);
+}
+var VALID_CATEGORIES = ["learning", "entertainment", "productivity", "wellness"];
+var VALID_DIFFICULTIES = ["beginner", "intermediate", "advanced", "beginner-to-intermediate", "intermediate-to-advanced"];
+var VALID_PRICING = ["free", "paid", "freemium"];
+var VALID_MODALITIES = ["text", "image", "audio"];
+var VALID_FEATURES = ["tool_use", "vision", "code_execution"];
+var VALID_CURRICULUM_TYPES = ["linear", "branching", "open-world"];
+var NAME_PATTERN = /^[a-z][a-z0-9-]*[a-z0-9]$/;
+var SINGLE_CHAR_NAME = /^[a-z]$/;
+var SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$/;
+var validate_default = defineCommand({
+  meta: {
+    name: "validate",
+    description: "Validate a hubbit.yaml manifest"
+  },
+  args: {
+    path: {
+      type: "positional",
+      description: "Path to hubbit.yaml or directory containing it",
+      required: false
+    },
+    strict: {
+      type: "boolean",
+      description: "Treat warnings as errors (for publishing)",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const inputPath = args.path ?? process.cwd();
+    const resolvedPath = resolve(inputPath);
+    const yamlPath = resolvedPath.endsWith(".yaml") || resolvedPath.endsWith(".yml") ? resolvedPath : existsSync(join(resolvedPath, "hubbit.yaml")) ? join(resolvedPath, "hubbit.yaml") : join(resolvedPath, "hubbit.yml");
+    debug(`Validating: ${yamlPath}`);
+    if (!existsSync(yamlPath)) {
+      if (isJsonMode()) {
+        outputJson({ valid: false, errors: [{ field: "file", message: "hubbit.yaml not found" }], warnings: [] });
+        process.exit(1);
+      }
+      errorWithFix(
+        `hubbit.yaml not found in ${basename(resolvedPath) === "hubbit.yaml" ? "the specified path" : resolvedPath}`,
+        "Run `hubbits create` to scaffold a new Hubbit, or check you are in the correct directory."
+      );
+      process.exit(1);
+    }
+    let rawContent;
+    let parsed;
+    try {
+      rawContent = readFileSync(yamlPath, "utf-8");
+    } catch {
+      errorWithFix("Failed to read hubbit.yaml.", "Check file permissions.");
+      process.exit(1);
+    }
+    try {
+      parsed = yaml.load(rawContent, { schema: yaml.FAILSAFE_SCHEMA });
+    } catch (err) {
+      const yamlError = err;
+      if (isJsonMode()) {
+        outputJson({ valid: false, errors: [{ field: "yaml", message: yamlError.message }], warnings: [] });
+        process.exit(1);
+      }
+      errorWithFix(
+        `Invalid YAML syntax: ${yamlError.message}`,
+        "Check your hubbit.yaml for syntax errors (indentation, colons, quotes)."
+      );
+      process.exit(1);
+    }
+    if (!parsed || typeof parsed !== "object") {
+      if (isJsonMode()) {
+        outputJson({ valid: false, errors: [{ field: "yaml", message: "hubbit.yaml is empty or not an object" }], warnings: [] });
+        process.exit(1);
+      }
+      errorWithFix(
+        "hubbit.yaml is empty or not a valid manifest.",
+        "A hubbit.yaml must contain at least `spec_version` and `name`."
+      );
+      process.exit(1);
+    }
+    const manifest = parsed;
+    const result = validateManifest(manifest);
+    if (args.strict) {
+      for (const w of result.warnings) {
+        result.errors.push({ ...w, severity: "error" });
+      }
+      result.warnings = [];
+      result.valid = result.errors.length === 0;
+    }
+    if (isJsonMode()) {
+      outputJson({
+        valid: result.valid,
+        errors: result.errors.map((e) => ({ field: e.field, message: e.message })),
+        warnings: result.warnings.map((w) => ({ field: w.field, message: w.message })),
+        manifest: result.valid ? result.manifest : void 0
+      });
+      if (!result.valid) process.exit(1);
+      return;
+    }
+    if (result.errors.length > 0) {
+      error(`Validation failed with ${result.errors.length} error${result.errors.length === 1 ? "" : "s"}:`);
+      newline();
+      for (const err of result.errors) {
+        console.log(`  ${pc5.red("\u2717")} ${pc5.bold(err.field)}: ${err.message}`);
+      }
+    }
+    if (result.warnings.length > 0) {
+      if (result.errors.length > 0) newline();
+      warning(`${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"}:`);
+      newline();
+      for (const w of result.warnings) {
+        console.log(`  ${pc5.yellow("\u26A0")} ${pc5.bold(w.field)}: ${w.message}`);
+      }
+    }
+    if (result.valid && result.manifest) {
+      const m = result.manifest;
+      const nameVersion = m.version ? `${m.name}@${m.version}` : m.name;
+      newline();
+      success(`Valid hubbit.yaml (${pc5.bold(nameVersion)})`);
+      if (result.warnings.length > 0) {
+        hint("Fix warnings before publishing with `hubbits publish`.");
+      } else {
+        hint("Ready to publish? Run `hubbits publish`");
+      }
+    } else {
+      newline();
+      hint("Fix the errors above and run `hubbits validate` again.");
+      process.exit(1);
+    }
+  }
+});
+function validateManifest(raw) {
+  const errors = [];
+  const warnings = [];
+  coerceTypes(raw);
+  if (raw.spec_version === void 0) {
+    errors.push({ field: "spec_version", message: "Required. Must be 1.", severity: "error" });
+  } else if (raw.spec_version !== 1) {
+    errors.push({ field: "spec_version", message: `Must be 1, got ${JSON.stringify(raw.spec_version)}.`, severity: "error" });
+  }
+  if (!raw.name || typeof raw.name !== "string") {
+    errors.push({ field: "name", message: "Required. Must be a non-empty string.", severity: "error" });
+  } else {
+    const name = raw.name;
+    if (name.length > 214) {
+      errors.push({ field: "name", message: "Must be 214 characters or fewer.", severity: "error" });
+    } else if (!NAME_PATTERN.test(name) && !SINGLE_CHAR_NAME.test(name)) {
+      errors.push({ field: "name", message: "Must be lowercase letters, numbers, and hyphens. Must start with a letter and not end with a hyphen.", severity: "error" });
+    }
+  }
+  if (raw.version !== void 0) {
+    if (typeof raw.version !== "string") {
+      errors.push({ field: "version", message: "Must be a string.", severity: "error" });
+    } else if (!SEMVER_PATTERN.test(raw.version)) {
+      errors.push({ field: "version", message: `Must be valid SemVer (e.g., "1.0.0"), got "${raw.version}".`, severity: "error" });
+    }
+  } else {
+    warnings.push({ field: "version", message: "Missing. Required for publishing.", severity: "warning" });
+  }
+  if (raw.author !== void 0) {
+    if (typeof raw.author !== "string" && typeof raw.author !== "object") {
+      errors.push({ field: "author", message: "Must be a string or object { name, url?, email? }.", severity: "error" });
+    } else if (typeof raw.author === "object" && raw.author !== null) {
+      const a = raw.author;
+      if (!a.name || typeof a.name !== "string") {
+        errors.push({ field: "author.name", message: "Required when author is an object.", severity: "error" });
+      }
+    }
+  } else {
+    warnings.push({ field: "author", message: "Missing. Required for publishing.", severity: "warning" });
+  }
+  if (raw.description !== void 0) {
+    if (typeof raw.description !== "string") {
+      errors.push({ field: "description", message: "Must be a string.", severity: "error" });
+    } else if (raw.description.length > 500) {
+      errors.push({ field: "description", message: "Must be 500 characters or fewer.", severity: "error" });
+    }
+  } else {
+    warnings.push({ field: "description", message: "Missing. Required for publishing.", severity: "warning" });
+  }
+  if (raw.category !== void 0) {
+    if (!VALID_CATEGORIES.includes(raw.category)) {
+      errors.push({ field: "category", message: `Must be one of: ${VALID_CATEGORIES.join(", ")}. Got "${raw.category}".`, severity: "error" });
+    }
+  }
+  if (raw.difficulty !== void 0) {
+    if (!VALID_DIFFICULTIES.includes(raw.difficulty)) {
+      errors.push({ field: "difficulty", message: `Must be one of: ${VALID_DIFFICULTIES.join(", ")}. Got "${raw.difficulty}".`, severity: "error" });
+    }
+  }
+  if (raw.pricing !== void 0) {
+    if (!VALID_PRICING.includes(raw.pricing)) {
+      errors.push({ field: "pricing", message: `Must be one of: ${VALID_PRICING.join(", ")}. Got "${raw.pricing}".`, severity: "error" });
+    }
+  }
+  if (raw.tags !== void 0) {
+    if (!Array.isArray(raw.tags)) {
+      errors.push({ field: "tags", message: "Must be an array of strings.", severity: "error" });
+    } else {
+      if (raw.tags.length > 30) {
+        errors.push({ field: "tags", message: "Must have 30 or fewer tags.", severity: "error" });
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const tag of raw.tags) {
+        if (typeof tag !== "string") {
+          errors.push({ field: "tags", message: `Each tag must be a string. Got ${JSON.stringify(tag)}.`, severity: "error" });
+          break;
+        }
+        if (!/^[a-z0-9-]+$/.test(tag)) {
+          errors.push({ field: "tags", message: `Tag "${tag}" must be lowercase letters, numbers, and hyphens.`, severity: "error" });
+        }
+        if (seen.has(tag)) {
+          warnings.push({ field: "tags", message: `Duplicate tag: "${tag}".`, severity: "warning" });
+        }
+        seen.add(tag);
+      }
+    }
+  }
+  if (raw.language !== void 0) {
+    if (typeof raw.language !== "string") {
+      errors.push({ field: "language", message: 'Must be a string ("auto" or ISO 639-1 code).', severity: "error" });
+    }
+  }
+  if (raw.estimated_time !== void 0) {
+    if (typeof raw.estimated_time !== "string") {
+      errors.push({ field: "estimated_time", message: 'Must be a string (e.g., "10-15 hours").', severity: "error" });
+    }
+  }
+  if (raw.runtime !== void 0) {
+    if (typeof raw.runtime !== "object" || raw.runtime === null) {
+      errors.push({ field: "runtime", message: "Must be an object.", severity: "error" });
+    } else {
+      const rt = raw.runtime;
+      if (rt.local !== void 0 && typeof rt.local !== "boolean") {
+        errors.push({ field: "runtime.local", message: "Must be a boolean.", severity: "error" });
+      }
+      if (rt.cloud !== void 0 && typeof rt.cloud !== "boolean") {
+        errors.push({ field: "runtime.cloud", message: "Must be a boolean.", severity: "error" });
+      }
+    }
+  }
+  if (raw.engines !== void 0) {
+    if (typeof raw.engines !== "object" || raw.engines === null) {
+      errors.push({ field: "engines", message: "Must be an object.", severity: "error" });
+    } else {
+      const eng = raw.engines;
+      if (eng.ai !== void 0) {
+        if (typeof eng.ai !== "object" || eng.ai === null) {
+          errors.push({ field: "engines.ai", message: "Must be an object.", severity: "error" });
+        } else {
+          const ai = eng.ai;
+          if (ai.min_context_window !== void 0 && typeof ai.min_context_window !== "number") {
+            errors.push({ field: "engines.ai.min_context_window", message: "Must be a number.", severity: "error" });
+          }
+          if (ai.modalities !== void 0) {
+            if (!Array.isArray(ai.modalities)) {
+              errors.push({ field: "engines.ai.modalities", message: "Must be an array.", severity: "error" });
+            } else {
+              for (const m of ai.modalities) {
+                if (!VALID_MODALITIES.includes(m)) {
+                  errors.push({ field: "engines.ai.modalities", message: `Invalid modality: "${m}". Must be one of: ${VALID_MODALITIES.join(", ")}.`, severity: "error" });
+                }
+              }
+            }
+          }
+          if (ai.features !== void 0) {
+            if (!Array.isArray(ai.features)) {
+              errors.push({ field: "engines.ai.features", message: "Must be an array.", severity: "error" });
+            } else {
+              for (const f of ai.features) {
+                if (!VALID_FEATURES.includes(f)) {
+                  errors.push({ field: "engines.ai.features", message: `Invalid feature: "${f}". Must be one of: ${VALID_FEATURES.join(", ")}.`, severity: "error" });
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  if (raw.persona !== void 0) {
+    if (typeof raw.persona !== "object" || raw.persona === null) {
+      errors.push({ field: "persona", message: "Must be an object.", severity: "error" });
+    } else {
+      const p7 = raw.persona;
+      if (p7.name !== void 0 && typeof p7.name !== "string") {
+        errors.push({ field: "persona.name", message: "Must be a string.", severity: "error" });
+      }
+      if (p7.traits !== void 0 && !Array.isArray(p7.traits)) {
+        errors.push({ field: "persona.traits", message: "Must be an array of strings.", severity: "error" });
+      }
+      if (p7.constraints !== void 0 && !Array.isArray(p7.constraints)) {
+        errors.push({ field: "persona.constraints", message: "Must be an array of strings.", severity: "error" });
+      }
+    }
+  }
+  if (raw.curriculum !== void 0) {
+    if (typeof raw.curriculum !== "object" || raw.curriculum === null) {
+      errors.push({ field: "curriculum", message: "Must be an object.", severity: "error" });
+    } else {
+      const cur = raw.curriculum;
+      if (cur.type !== void 0 && !VALID_CURRICULUM_TYPES.includes(cur.type)) {
+        errors.push({ field: "curriculum.type", message: `Must be one of: ${VALID_CURRICULUM_TYPES.join(", ")}. Got "${cur.type}".`, severity: "error" });
+      }
+      if (cur.chapters !== void 0) {
+        if (!Array.isArray(cur.chapters)) {
+          errors.push({ field: "curriculum.chapters", message: "Must be an array.", severity: "error" });
+        } else {
+          const chapterIds = /* @__PURE__ */ new Set();
+          for (let i = 0; i < cur.chapters.length; i++) {
+            const ch = cur.chapters[i];
+            if (!ch.id || typeof ch.id !== "string") {
+              errors.push({ field: `curriculum.chapters[${i}].id`, message: "Required. Must be a string.", severity: "error" });
+            } else {
+              if (chapterIds.has(ch.id)) {
+                errors.push({ field: `curriculum.chapters[${i}].id`, message: `Duplicate chapter ID: "${ch.id}".`, severity: "error" });
+              }
+              chapterIds.add(ch.id);
+            }
+            if (!ch.title || typeof ch.title !== "string") {
+              errors.push({ field: `curriculum.chapters[${i}].title`, message: "Required. Must be a string.", severity: "error" });
+            }
+          }
+        }
+      }
+    }
+  }
+  if (raw.compatible_with !== void 0) {
+    if (!Array.isArray(raw.compatible_with)) {
+      errors.push({ field: "compatible_with", message: "Must be an array of strings.", severity: "error" });
+    } else {
+      for (const c of raw.compatible_with) {
+        if (typeof c !== "string") {
+          errors.push({ field: "compatible_with", message: "Each item must be a string.", severity: "error" });
+          break;
+        }
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings,
+    manifest: errors.length === 0 ? raw : void 0
+  };
+}
+function coerceTypes(raw) {
+  if (typeof raw.spec_version === "string") {
+    const n = Number(raw.spec_version);
+    if (!Number.isNaN(n)) raw.spec_version = n;
+  }
+  if (raw.runtime && typeof raw.runtime === "object") {
+    const rt = raw.runtime;
+    coerceBool(rt, "local");
+    coerceBool(rt, "cloud");
+    if (rt.cloud_requires && typeof rt.cloud_requires === "object") {
+      coerceBool(rt.cloud_requires, "sandbox");
+    }
+  }
+  if (raw.engines && typeof raw.engines === "object") {
+    const eng = raw.engines;
+    if (eng.ai && typeof eng.ai === "object") {
+      const ai = eng.ai;
+      coerceNum(ai, "min_context_window");
+      coerceNum(ai, "recommended_context_window");
+    }
+  }
+  if (raw.curriculum && typeof raw.curriculum === "object") {
+    const cur = raw.curriculum;
+    if (Array.isArray(cur.chapters)) {
+      for (const ch of cur.chapters) {
+        if (ch && typeof ch === "object") {
+          const chapter = ch;
+          coerceNum(chapter, "lessons");
+          coerceNum(chapter, "challenges");
+        }
+      }
+    }
+  }
+}
+function coerceBool(obj, key) {
+  if (typeof obj[key] === "string") {
+    if (obj[key] === "true") obj[key] = true;
+    else if (obj[key] === "false") obj[key] = false;
+  }
+}
+function coerceNum(obj, key) {
+  if (typeof obj[key] === "string") {
+    const n = Number(obj[key]);
+    if (!Number.isNaN(n)) obj[key] = n;
+  }
+}
+var AuthorObjectSchema = z.object({
+  name: z.string().min(1),
+  url: z.string().url().optional(),
+  email: z.string().email().optional()
+});
+var AuthorSchema = z.union([
+  z.string().min(1),
+  AuthorObjectSchema
+]);
+var CloudRequiresSchema = z.object({
+  sandbox: z.preprocess((v) => v === "true" || v === true, z.boolean()).optional()
+});
+var RuntimeSchema = z.object({
+  local: z.preprocess((v) => v === "true" || v === true, z.boolean()).optional(),
+  cloud: z.preprocess((v) => v === "true" || v === true, z.boolean()).optional(),
+  cloud_requires: CloudRequiresSchema.optional()
+});
+var AIModalitySchema = z.enum(["text", "image", "audio"]);
+var AIFeatureSchema = z.enum(["tool_use", "vision", "code_execution"]);
+var AIEngineSchema = z.object({
+  min_context_window: z.coerce.number().int().min(1).optional(),
+  recommended_context_window: z.coerce.number().int().min(1).optional(),
+  modalities: z.array(AIModalitySchema).optional(),
+  features: z.array(AIFeatureSchema).optional()
+});
+var EnginesSchema = z.object({
+  ai: AIEngineSchema.optional()
+});
+var RequiresSchema = z.object({
+  tools: z.array(z.string().min(1)).optional(),
+  optional: z.array(z.string().min(1)).optional()
+});
+var PersonaSchema = z.object({
+  name: z.string().min(1).optional(),
+  tone: z.string().min(1).optional(),
+  traits: z.array(z.string().min(1)).optional(),
+  constraints: z.array(z.string().min(1)).optional()
+});
+var ChapterSchema = z.object({
+  id: z.string().min(2).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+  title: z.string().min(1),
+  lessons: z.coerce.number().int().min(0).optional(),
+  challenges: z.coerce.number().int().min(0).optional(),
+  unlock_condition: z.string().nullable().optional()
+});
+var CurriculumSchema = z.object({
+  type: z.enum(["linear", "branching", "open-world"]).optional(),
+  chapters: z.array(ChapterSchema).optional()
+});
+var HubbitManifestSchema = z.object({
+  /** Manifest 格式版本，目前唯一合法值為 1 */
+  spec_version: z.coerce.number().pipe(z.literal(1)),
+  /** 包名稱（小寫字母、數字、連字號） */
+  name: z.string().min(2).max(214).regex(/^[a-z][a-z0-9-]*[a-z0-9]$/, "Name must start with a lowercase letter, end with a letter or digit, and contain only lowercase letters, digits, and hyphens"),
+  /** 語意化版本號（SemVer 2.0.0） */
+  version: z.string().regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/, "Version must be a valid SemVer 2.0.0 string").optional(),
+  /** 包的作者 */
+  author: AuthorSchema.optional(),
+  /** 包的簡短描述 */
+  description: z.string().min(1).max(500).optional(),
+  /** SPDX 授權識別碼 */
+  license: z.string().optional(),
+  /** 搜尋用標籤 */
+  tags: z.array(z.string().min(2).max(50).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/)).max(30).optional(),
+  /** 預定義的包分類 */
+  category: z.enum(["learning", "entertainment", "productivity", "wellness"]).optional(),
+  /** 內容難度級別 */
+  difficulty: z.enum(["beginner", "intermediate", "advanced", "beginner-to-intermediate", "intermediate-to-advanced"]).optional(),
+  /** 預估完成時間 */
+  estimated_time: z.string().max(50).optional(),
+  /** 內容語言 */
+  language: z.string().optional(),
+  /** 運行時支援設定 */
+  runtime: RuntimeSchema.optional(),
+  /** AI 模型運行環境需求 */
+  engines: EnginesSchema.optional(),
+  /** 系統工具依賴 */
+  requires: RequiresSchema.optional(),
+  /** 已測試相容的 AI 編輯器或客戶端列表 */
+  compatible_with: z.array(z.string().min(1)).optional(),
+  /** AI 角色定義 */
+  persona: PersonaSchema.optional(),
+  /** 課程或劇情結構 */
+  curriculum: CurriculumSchema.optional(),
+  /** 定價模式 */
+  pricing: z.enum(["free", "paid", "freemium"]).optional(),
+  /** 第三方工具的擴展資料命名空間 */
+  extensions: z.record(z.unknown()).optional(),
+  /** 原始碼倉庫 URL */
+  repository: z.string().url().optional(),
+  /** 包的首頁 URL */
+  homepage: z.string().url().optional(),
+  /** 圖示檔案的相對路徑 */
+  icon: z.string().optional(),
+  /** Banner 圖片的相對路徑 */
+  banner: z.string().optional()
+});
+function parseManifest(yamlString) {
+  if (/!![\w.]+/.test(yamlString)) {
+    return {
+      success: false,
+      errors: ["YAML custom type tags (!! syntax) are not allowed for security reasons"]
+    };
+  }
+  let raw;
+  try {
+    raw = yaml.load(yamlString, {
+      schema: yaml.FAILSAFE_SCHEMA
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      errors: [`YAML parse error: ${message}`]
+    };
+  }
+  if (raw == null || typeof raw !== "object") {
+    return {
+      success: false,
+      errors: ["YAML content must be a mapping (object)"]
+    };
+  }
+  const result = HubbitManifestSchema.safeParse(raw);
+  if (!result.success) {
+    const errors = result.error.issues.map((issue) => {
+      const path = issue.path.join(".");
+      return path ? `${path}: ${issue.message}` : issue.message;
+    });
+    return { success: false, errors };
+  }
+  return {
+    success: true,
+    data: result.data,
+    errors: []
+  };
+}
+function validateManifest2(data) {
+  const schemaResult = HubbitManifestSchema.safeParse(data);
+  if (!schemaResult.success) {
+    const errors = schemaResult.error.issues.map((issue) => {
+      const path = issue.path.join(".");
+      return path ? `${path}: ${issue.message}` : issue.message;
+    });
+    return { success: false, errors };
+  }
+  const manifest = schemaResult.data;
+  const publishErrors = [];
+  if (!manifest.version) {
+    publishErrors.push("version is required for publishing");
+  }
+  if (!manifest.author) {
+    publishErrors.push("author is required for publishing");
+  }
+  if (!manifest.description) {
+    publishErrors.push("description is required for publishing");
+  }
+  if (publishErrors.length > 0) {
+    return { success: false, data: manifest, errors: publishErrors };
+  }
+  return {
+    success: true,
+    data: manifest,
+    errors: []
+  };
+}
+
+// ../../packages/core/dist/hash.js
+async function sha256(data) {
+  const input = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", input);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var MAX_FILE_SIZE = 10 * 1024 * 1024;
+var MAX_TOTAL_SIZE = 50 * 1024 * 1024;
+var MAX_FILE_COUNT = 500;
+var ArchiveSecurityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ArchiveSecurityError";
+  }
+};
+async function pack(directory) {
+  const resolvedDir = resolve(directory);
+  const files = await collectFiles(resolvedDir, resolvedDir);
+  if (files.length > MAX_FILE_COUNT) {
+    throw new ArchiveSecurityError(`Too many files: ${files.length} exceeds the limit of ${MAX_FILE_COUNT}`);
+  }
+  let totalSize = 0;
+  for (const file of files) {
+    totalSize += file.size;
+  }
+  if (totalSize > MAX_TOTAL_SIZE) {
+    throw new ArchiveSecurityError(`Total size ${totalSize} bytes exceeds the limit of ${MAX_TOTAL_SIZE} bytes`);
+  }
+  return new Promise((resolvePromise, reject) => {
+    const packStream = pack$1();
+    const chunks = [];
+    const gzip = createGzip();
+    gzip.on("data", (chunk) => chunks.push(chunk));
+    gzip.on("end", () => resolvePromise(Buffer.concat(chunks)));
+    gzip.on("error", reject);
+    packStream.pipe(gzip);
+    (async () => {
+      for (const file of files) {
+        await new Promise((res, rej) => {
+          const entry = packStream.entry({ name: file.relativePath, size: file.size }, (err) => {
+            if (err)
+              rej(err);
+            else
+              res();
+          });
+          const readStream = createReadStream(file.absolutePath);
+          readStream.on("error", rej);
+          readStream.pipe(entry);
+        });
+      }
+      packStream.finalize();
+    })().catch(reject);
+  });
+}
+async function extract(archive, destination) {
+  const resolvedDest = resolve(destination);
+  await mkdir(resolvedDest, { recursive: true });
+  let totalSize = 0;
+  let fileCount = 0;
+  const extractStream = extract$1();
+  const processEntries = new Promise((resolvePromise, reject) => {
+    extractStream.on("entry", (header, stream, next) => {
+      try {
+        if (header.type === "symlink" || header.type === "link") {
+          stream.resume();
+          reject(new ArchiveSecurityError(`Symlinks/hardlinks not allowed: ${header.name}`));
+          return;
+        }
+        const entryPath = resolve(resolvedDest, header.name ?? "");
+        if (!entryPath.startsWith(resolvedDest + "/") && entryPath !== resolvedDest) {
+          stream.resume();
+          reject(new ArchiveSecurityError(`Path traversal detected: ${header.name}`));
+          return;
+        }
+        const entrySize = header.size ?? 0;
+        if (entrySize > MAX_FILE_SIZE) {
+          stream.resume();
+          reject(new ArchiveSecurityError(`File too large: ${header.name} (${entrySize} bytes, limit ${MAX_FILE_SIZE})`));
+          return;
+        }
+        totalSize += entrySize;
+        if (totalSize > MAX_TOTAL_SIZE) {
+          stream.resume();
+          reject(new ArchiveSecurityError(`Total extracted size exceeds limit of ${MAX_TOTAL_SIZE} bytes`));
+          return;
+        }
+        fileCount++;
+        if (fileCount > MAX_FILE_COUNT) {
+          stream.resume();
+          reject(new ArchiveSecurityError(`Too many files: exceeds the limit of ${MAX_FILE_COUNT}`));
+          return;
+        }
+        if (header.type === "directory") {
+          mkdir(entryPath, { recursive: true }).then(() => {
+            stream.resume();
+            next();
+          }).catch(reject);
+          return;
+        }
+        const dir = entryPath.substring(0, entryPath.lastIndexOf("/"));
+        mkdir(dir, { recursive: true }).then(() => {
+          const writeStream = createWriteStream(entryPath);
+          stream.pipe(writeStream);
+          writeStream.on("finish", next);
+          writeStream.on("error", reject);
+        }).catch(reject);
+      } catch (err) {
+        stream.resume();
+        reject(err);
+      }
+    });
+    extractStream.on("finish", resolvePromise);
+    extractStream.on("error", reject);
+  });
+  const { Readable } = await import('stream');
+  const sourceStream = Readable.from(archive);
+  const gunzip = createGunzip();
+  await Promise.all([
+    pipeline(sourceStream, gunzip, extractStream),
+    processEntries
+  ]);
+}
+async function collectFiles(dir, rootDir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const absolutePath = join(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new ArchiveSecurityError(`Symlinks not allowed: ${absolutePath}`);
+    }
+    if (entry.isDirectory()) {
+      const subFiles = await collectFiles(absolutePath, rootDir);
+      files.push(...subFiles);
+    } else if (entry.isFile()) {
+      const fileStat = await stat(absolutePath);
+      if (fileStat.size > MAX_FILE_SIZE) {
+        throw new ArchiveSecurityError(`File too large: ${absolutePath} (${fileStat.size} bytes, limit ${MAX_FILE_SIZE})`);
+      }
+      files.push({
+        absolutePath,
+        relativePath: relative(rootDir, absolutePath),
+        size: fileStat.size
+      });
+    }
+  }
+  return files;
+}
+
+// ../../packages/core/dist/scanner.js
+var THREAT_PATTERNS = [
+  // === 直接注入 ===
+  {
+    id: "INJ-001",
+    category: "injection",
+    severity: "critical",
+    pattern: /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|prompts?|rules?)/i,
+    description: "Ignore previous instructions pattern"
+  },
+  {
+    id: "INJ-002",
+    category: "injection",
+    severity: "critical",
+    pattern: /disregard\s+(all\s+)?(previous|prior|your)\s+(instructions?|programming|guidelines?)/i,
+    description: "Disregard instructions pattern"
+  },
+  {
+    id: "INJ-003",
+    category: "injection",
+    severity: "high",
+    pattern: /you\s+are\s+now\s+(a|an|in)\s+(unrestricted|unfiltered|uncensored)/i,
+    description: "Unrestricted mode activation"
+  },
+  {
+    id: "INJ-004",
+    category: "injection",
+    severity: "high",
+    pattern: /new\s+(instructions?|role|persona|system\s*prompt)/i,
+    description: "System prompt override attempt"
+  },
+  {
+    id: "INJ-005",
+    category: "injection",
+    severity: "critical",
+    pattern: /<\|(?:im_start|im_end|endoftext|system|user|assistant)\|>/,
+    description: "LLM special token injection"
+  },
+  // === Jailbreak ===
+  {
+    id: "JB-001",
+    category: "jailbreak",
+    severity: "critical",
+    pattern: /\bDAN\b.*\bdo\s+anything\s+now\b/i,
+    description: "DAN jailbreak pattern"
+  },
+  {
+    id: "JB-002",
+    category: "jailbreak",
+    severity: "high",
+    pattern: /developer\s+mode|god\s+mode|admin\s+mode|debug\s+mode/i,
+    description: "Privileged mode activation"
+  },
+  {
+    id: "JB-003",
+    category: "jailbreak",
+    severity: "high",
+    pattern: /bypass\s+(safety|content|ethical)\s+(filter|restriction|guideline)/i,
+    description: "Safety bypass attempt"
+  },
+  // === 資料外洩 ===
+  {
+    id: "EXF-001",
+    category: "exfiltration",
+    severity: "critical",
+    pattern: /base64\s*(encode|decode).*\.(env|credentials|key|secret|token|password)/i,
+    description: "Credential exfiltration via encoding"
+  },
+  {
+    id: "EXF-002",
+    category: "exfiltration",
+    severity: "critical",
+    pattern: /(curl|wget|fetch|http)\s+.*(webhook|ngrok|requestbin|pipedream)/i,
+    description: "Data exfiltration via HTTP"
+  },
+  {
+    id: "EXF-003",
+    category: "exfiltration",
+    severity: "high",
+    pattern: /read\s+(and\s+)?(send|transmit|post|upload)\s+.*\.(env|config|key)/i,
+    description: "File read and transmit pattern"
+  },
+  // === Persona 劫持 ===
+  {
+    id: "PH-001",
+    category: "persona_hijack",
+    severity: "high",
+    pattern: /your\s+(new\s+)?(personality|identity|character|name)\s+(is|will\s+be|shall\s+be)/i,
+    description: "Persona override attempt"
+  },
+  {
+    id: "PH-002",
+    category: "persona_hijack",
+    severity: "medium",
+    pattern: /from\s+now\s+on.*(act|behave|respond|pretend)\s+as/i,
+    description: "Behavioral override"
+  },
+  // === HTML / Markdown 注入 ===
+  {
+    id: "HTML-001",
+    category: "html_injection",
+    severity: "critical",
+    pattern: /<script[\s>]/i,
+    description: "Embedded script tag"
+  },
+  {
+    id: "HTML-002",
+    category: "html_injection",
+    severity: "high",
+    pattern: /javascript\s*:/i,
+    description: "JavaScript URI scheme"
+  },
+  {
+    id: "HTML-003",
+    category: "html_injection",
+    severity: "high",
+    pattern: /on(error|load|click|mouseover|focus|blur|submit|change)\s*=/i,
+    description: "HTML event handler injection"
+  },
+  // === 隱藏內容 ===
+  {
+    id: "HID-001",
+    category: "hidden",
+    severity: "critical",
+    pattern: /\u200b|\u200c|\u200d|\u2060|\ufeff/,
+    description: "Zero-width characters detected \u2014 may contain hidden instructions"
+  },
+  {
+    id: "HID-002",
+    category: "hidden",
+    severity: "high",
+    pattern: /<!--[\s\S]*?(?:ignore|disregard|override|act as)[\s\S]*?-->/i,
+    description: "Hidden instructions in HTML comment"
+  },
+  // === Shell 危險指令 ===
+  {
+    id: "SH-001",
+    category: "shell",
+    severity: "critical",
+    pattern: /rm\s+-rf\s+[/~]/,
+    description: "Destructive rm -rf command"
+  },
+  {
+    id: "SH-002",
+    category: "shell",
+    severity: "critical",
+    pattern: /curl\s+[^|]*\|\s*(?:ba)?sh/i,
+    description: "Remote code execution via curl | bash"
+  },
+  {
+    id: "SH-003",
+    category: "shell",
+    severity: "high",
+    pattern: /(?:nc|netcat|ncat)\s+.*-e\s+.*sh/i,
+    description: "Reverse shell pattern"
+  }
+];
+var PERMISSION_PATTERNS = [
+  // file_access
+  {
+    type: "file_access",
+    pattern: /\bread\s+(the\s+)?file\b/i,
+    description: "Reads files from the filesystem"
+  },
+  {
+    type: "file_access",
+    pattern: /\bwrite\s+to\b/i,
+    description: "Writes data to the filesystem"
+  },
+  {
+    type: "file_access",
+    pattern: /\bopen\s+the\s+file\b/i,
+    description: "Opens files from the filesystem"
+  },
+  {
+    type: "file_access",
+    pattern: /\baccess\s+\S*\.json\b/i,
+    description: "Accesses JSON files"
+  },
+  {
+    type: "file_access",
+    pattern: /~\/\./,
+    description: "Accesses dotfiles in home directory"
+  },
+  // network_access
+  {
+    type: "network_access",
+    pattern: /\bcurl\b/i,
+    description: "Uses curl for network requests"
+  },
+  {
+    type: "network_access",
+    pattern: /\bwget\b/i,
+    description: "Uses wget for network requests"
+  },
+  {
+    type: "network_access",
+    pattern: /\bfetch\s*\(/i,
+    description: "Uses fetch() for network requests"
+  },
+  {
+    type: "network_access",
+    pattern: /https?:\/\//i,
+    description: "References HTTP/HTTPS URLs"
+  },
+  {
+    type: "network_access",
+    pattern: /\bAPI\s+endpoint\b/i,
+    description: "References API endpoints"
+  },
+  // shell_execution
+  {
+    type: "shell_execution",
+    pattern: /\.sh\b/,
+    description: "References shell script files"
+  },
+  {
+    type: "shell_execution",
+    pattern: /\b(?:bash|sh|zsh)\s+-c\b/i,
+    description: "Invokes shell with command flag"
+  },
+  {
+    type: "shell_execution",
+    pattern: /\bexec\s*\(/i,
+    description: "Uses exec() to run commands"
+  },
+  // env_access
+  {
+    type: "env_access",
+    pattern: /\bprocess\.env\b/,
+    description: "Accesses process environment variables"
+  },
+  {
+    type: "env_access",
+    pattern: /\$HOME\b/,
+    description: "References $HOME environment variable"
+  },
+  {
+    type: "env_access",
+    pattern: /\$PATH\b/,
+    description: "References $PATH environment variable"
+  },
+  {
+    type: "env_access",
+    pattern: /\.env\b/,
+    description: "References .env file"
+  },
+  {
+    type: "env_access",
+    pattern: /\benvironment\s+variable\b/i,
+    description: "References environment variables"
+  }
+];
+function detectPermissions(content, filename) {
+  const permissions = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const pp of PERMISSION_PATTERNS) {
+    const match = pp.pattern.exec(content);
+    if (match) {
+      const key = `${pp.type}:${pp.description}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        permissions.push({
+          type: pp.type,
+          description: pp.description,
+          evidence: match[0].slice(0, 100),
+          file: filename
+        });
+      }
+    }
+  }
+  return permissions;
+}
+function determineRiskLevel(findings) {
+  const hasCriticalOrHigh = findings.some((f) => f.severity === "critical" || f.severity === "high");
+  const hasMediumOrLow = findings.some((f) => f.severity === "medium" || f.severity === "low");
+  if (hasCriticalOrHigh)
+    return "danger";
+  if (hasMediumOrLow)
+    return "warning";
+  return "safe";
+}
+function findLineNumber(content, pattern) {
+  const match = pattern.exec(content);
+  if (!match)
+    return void 0;
+  const beforeMatch = content.slice(0, match.index);
+  return beforeMatch.split("\n").length;
+}
+function scanPromptInjection(content, filename) {
+  const findings = [];
+  for (const threat of THREAT_PATTERNS) {
+    if (threat.pattern.test(content)) {
+      findings.push({
+        ruleId: threat.id,
+        category: threat.category,
+        severity: threat.severity,
+        description: threat.description,
+        file: filename,
+        line: findLineNumber(content, threat.pattern)
+      });
+    }
+  }
+  const riskLevel = determineRiskLevel(findings);
+  const permissions = detectPermissions(content, filename);
+  return {
+    riskLevel,
+    safe: riskLevel === "safe",
+    findings,
+    issues: findings.map((f) => `[${f.severity.toUpperCase()}] ${f.ruleId}: ${f.description}`),
+    permissions,
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    scannerVersion: "2.0.0"
+  };
+}
+
+// src/commands/pull.ts
+function parseIdentifier(input) {
+  const versionSplit = input.split("@");
+  if (versionSplit.length > 2) {
+    return null;
+  }
+  const nameWithScope = versionSplit[0];
+  const version = versionSplit.length === 2 ? versionSplit[1] : void 0;
+  if (!nameWithScope) return null;
+  const slashIndex = nameWithScope.indexOf("/");
+  if (slashIndex === -1) {
+    return { scope: "", name: nameWithScope, version };
+  }
+  const scope = nameWithScope.slice(0, slashIndex);
+  const name = nameWithScope.slice(slashIndex + 1);
+  if (!scope || !name) return null;
+  return { scope, name, version };
+}
+var pull_default = defineCommand({
+  meta: {
+    name: "pull",
+    description: "Download a hubbit from the registry"
+  },
+  args: {
+    package: {
+      type: "positional",
+      description: "Package identifier (scope/name or scope/name@version)",
+      required: true
+    },
+    output: {
+      type: "string",
+      alias: "o",
+      description: "Output directory (defaults to package name)"
+    },
+    force: {
+      type: "boolean",
+      alias: "f",
+      description: "Overwrite existing directory",
+      default: false
+    },
+    "skip-verify": {
+      type: "boolean",
+      description: "Skip SHA-256 integrity verification",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const parsed = parseIdentifier(args.package);
+    if (!parsed) {
+      errorWithFix(
+        `Invalid package identifier: "${args.package}"`,
+        'Use the format: scope/name or scope/name@version (e.g., "eric/learn-docker@1.0.0")'
+      );
+      process.exit(1);
+    }
+    if (!parsed.scope) {
+      errorWithFix(
+        `Missing scope in package identifier: "${args.package}"`,
+        'Use the format: scope/name (e.g., "eric/learn-docker")'
+      );
+      process.exit(1);
+    }
+    const { scope, name, version: requestedVersion } = parsed;
+    const fullName = `${scope}/${name}`;
+    debug(`Parsed: scope=${scope}, name=${name}, version=${requestedVersion ?? "latest"}`);
+    const api2 = createApiClient();
+    const s = spinner(`Resolving ${pc5.cyan(fullName)}...`);
+    let resolvedVersion;
+    let downloadSha256;
+    try {
+      if (requestedVersion) {
+        debug(`GET /api/v1/packages/${scope}/${name}/${requestedVersion}`);
+        const versionResult = await api2.getPackageVersion(scope, name, requestedVersion);
+        if (!versionResult.data) {
+          s.fail("Package version not found.");
+          errorWithFix(
+            `Version "${requestedVersion}" not found for "${fullName}".`,
+            `Run \`hubbits search ${name}\` to find available packages.`
+          );
+          process.exit(1);
+        }
+        resolvedVersion = versionResult.data.version;
+        downloadSha256 = versionResult.data.digest;
+      } else {
+        debug(`GET /api/v1/packages/${scope}/${name}`);
+        const pkgResult = await api2.getPackageByScope(scope, name);
+        if (!pkgResult.data) {
+          s.fail("Package not found.");
+          errorWithFix(
+            `Package "${fullName}" not found.`,
+            `Run \`hubbits search ${name}\` to find available packages.`
+          );
+          process.exit(1);
+        }
+        resolvedVersion = pkgResult.data.latest_version;
+        if (!resolvedVersion || resolvedVersion === "0.0.0") {
+          s.fail("No published version.");
+          errorWithFix(
+            `Package "${fullName}" has no published versions.`,
+            "The package may still be in development."
+          );
+          process.exit(1);
+        }
+      }
+      s.text = `Resolved ${pc5.cyan(fullName)}@${pc5.yellow(resolvedVersion)}`;
+      debug(`Resolved version: ${resolvedVersion}`);
+    } catch (err) {
+      s.fail("Failed to resolve package.");
+      handleApiError(err, fullName);
+      process.exit(1);
+    }
+    s.text = `Downloading ${pc5.cyan(fullName)}@${pc5.yellow(resolvedVersion)}...`;
+    let downloadUrl;
+    let expectedSha256;
+    try {
+      debug(`GET /api/v1/download/${scope}/${name}/${resolvedVersion}`);
+      const dlResult = await api2.getDownloadUrl(scope, name, resolvedVersion);
+      if (!dlResult.data) {
+        s.fail("Failed to get download URL.");
+        error("Server returned an unexpected response.");
+        process.exit(1);
+      }
+      downloadUrl = dlResult.data.download_url;
+      expectedSha256 = dlResult.data.sha256 ?? downloadSha256 ?? "";
+      debug(`Download URL: ${downloadUrl}`);
+      debug(`Expected SHA-256: ${expectedSha256}`);
+    } catch (err) {
+      s.fail("Failed to get download URL.");
+      handleApiError(err, fullName);
+      process.exit(1);
+    }
+    let archiveBuffer;
+    try {
+      debug("Downloading tarball...");
+      const arrayBuffer = await api2.downloadFile(downloadUrl);
+      archiveBuffer = Buffer.from(arrayBuffer);
+      debug(`Downloaded ${archiveBuffer.length} bytes`);
+    } catch {
+      s.fail("Download failed.");
+      errorWithFix(
+        "Failed to download the package archive.",
+        "Check your network connection and try again."
+      );
+      process.exit(1);
+    }
+    if (!args["skip-verify"] && expectedSha256) {
+      s.text = "Verifying integrity...";
+      debug("Computing SHA-256 digest...");
+      const computedHash = await sha256(archiveBuffer);
+      debug(`Computed SHA-256: ${computedHash}`);
+      if (computedHash !== expectedSha256) {
+        s.fail("Integrity check failed.");
+        errorWithFix(
+          `SHA-256 mismatch!
+  Expected: ${expectedSha256}
+  Got:      ${computedHash}`,
+          "The downloaded file may be corrupted. Try running `hubbits pull` again."
+        );
+        if (isJsonMode()) {
+          outputJson({
+            status: "error",
+            error: "integrity_mismatch",
+            expected_sha256: expectedSha256,
+            computed_sha256: computedHash
+          });
+        }
+        process.exit(1);
+      }
+      debug("SHA-256 verified.");
+    } else if (args["skip-verify"]) {
+      debug("Skipping SHA-256 verification (--skip-verify)");
+    } else {
+      debug("No expected SHA-256 available, skipping verification");
+    }
+    const outputDir = args.output ? resolve(args.output) : resolve(process.cwd(), name);
+    if (existsSync(outputDir) && !args.force) {
+      s.fail("Directory already exists.");
+      errorWithFix(
+        `Directory "${name}" already exists.`,
+        "Use `--force` to overwrite or `--output` to specify a different directory."
+      );
+      if (isJsonMode()) {
+        outputJson({
+          status: "error",
+          error: "directory_exists",
+          path: outputDir
+        });
+      }
+      process.exit(1);
+    }
+    s.text = `Extracting to ${pc5.dim(outputDir)}...`;
+    debug(`Extracting to: ${outputDir}`);
+    try {
+      await mkdir(outputDir, { recursive: true });
+      await extract(archiveBuffer, outputDir);
+    } catch (err) {
+      s.fail("Extraction failed.");
+      const errMsg = err instanceof Error ? err.message : String(err);
+      if (errMsg.includes("Symlinks") || errMsg.includes("Path traversal") || errMsg.includes("too large")) {
+        errorWithFix(
+          `Security check failed: ${errMsg}`,
+          "This package archive contains unsafe content and cannot be extracted."
+        );
+      } else {
+        errorWithFix(
+          `Failed to extract package: ${errMsg}`,
+          "The archive may be corrupted. Try running `hubbits pull` again."
+        );
+      }
+      process.exit(1);
+    }
+    s.succeed(`Downloaded ${pc5.cyan(fullName)}@${pc5.yellow(resolvedVersion)}`);
+    if (isJsonMode()) {
+      outputJson({
+        status: "ok",
+        package: fullName,
+        version: resolvedVersion,
+        sha256: expectedSha256 || null,
+        path: outputDir,
+        size: archiveBuffer.length
+      });
+      return;
+    }
+    newline();
+    field("Package", pc5.cyan(fullName));
+    field("Version", pc5.yellow(resolvedVersion));
+    if (expectedSha256) {
+      field("SHA-256", pc5.dim(expectedSha256.slice(0, 16) + "..."));
+    }
+    field("Size", formatBytes(archiveBuffer.length));
+    field("Path", outputDir);
+    newline();
+    hint(`Open \`${name}/\` in your AI editor and type "let's play" to begin`);
+    hint(`View contents: \`ls ${name}/\``);
+  }
+});
+function handleApiError(err, packageName) {
+  if (err instanceof ApiError) {
+    switch (err.statusCode) {
+      case 404:
+        errorWithFix(
+          `Package "${packageName}" not found.`,
+          `Run \`hubbits search\` to find available packages.`
+        );
+        break;
+      case 401:
+        errorWithFix(
+          "Authentication required.",
+          "Run `hubbits login` to authenticate first."
+        );
+        break;
+      case 403:
+        errorWithFix(
+          err.message || "Access denied.",
+          "You may need to purchase this package first. Visit https://hubbits.dev to buy it."
+        );
+        break;
+      default:
+        errorWithFix(err.message, "Check your network connection and try again.");
+    }
+  } else {
+    errorWithFix(
+      "An unexpected error occurred.",
+      "Check your network connection and try again."
+    );
+  }
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+var SCANNABLE_EXTENSIONS = [".yaml", ".yml", ".md", ".txt"];
+var MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
+var publish_default = defineCommand({
+  meta: {
+    name: "publish",
+    description: "Publish the current hubbit to the registry"
+  },
+  args: {
+    path: {
+      type: "positional",
+      description: "Path to the package directory (defaults to current directory)",
+      required: false
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Validate and pack but do not upload",
+      default: false
+    },
+    "skip-scan": {
+      type: "boolean",
+      description: "Skip security scan (not recommended)",
+      default: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON",
+      default: false
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress output",
+      default: false
+    },
+    verbose: {
+      type: "boolean",
+      description: "Show debug information",
+      default: false
+    }
+  },
+  async run({ args }) {
+    setOutputMode({ json: args.json, quiet: args.quiet, verbose: args.verbose });
+    const packageDir = resolve(args.path ?? process.cwd());
+    const auth = getAuthState();
+    if (!auth) {
+      errorWithFix(
+        "You must be logged in to publish packages.",
+        "Run `hubbits login` to authenticate first."
+      );
+      if (isJsonMode()) {
+        outputJson({ status: "error", error: "not_authenticated" });
+      }
+      process.exit(1);
+    }
+    debug(`Authenticated as: ${auth.username ?? auth.email ?? "token"}`);
+    const yamlPath = findManifestFile2(packageDir);
+    if (!yamlPath) {
+      errorWithFix(
+        `No hubbit.yaml found in ${packageDir}`,
+        "Run `hubbits create` to scaffold a new package, or check you are in the correct directory."
+      );
+      if (isJsonMode()) {
+        outputJson({ status: "error", error: "manifest_not_found", path: packageDir });
+      }
+      process.exit(1);
+    }
+    debug(`Reading manifest: ${yamlPath}`);
+    let rawYaml;
+    try {
+      rawYaml = readFileSync(yamlPath, "utf-8");
+    } catch {
+      errorWithFix("Failed to read hubbit.yaml.", "Check file permissions.");
+      process.exit(1);
+    }
+    const parseResult = parseManifest(rawYaml);
+    if (!parseResult.success) {
+      if (isJsonMode()) {
+        outputJson({ status: "error", error: "invalid_manifest", errors: parseResult.errors });
+        process.exit(1);
+      }
+      error("Invalid hubbit.yaml:");
+      newline();
+      for (const err of parseResult.errors) {
+        console.log(`  ${pc5.red("\u2717")} ${err}`);
+      }
+      newline();
+      hint("Run `hubbits validate` for detailed validation.");
+      process.exit(1);
+    }
+    const manifest = {
+      ...parseResult.data,
+      ...!parseResult.data.author && auth.username ? { author: auth.username } : {}
+    };
+    const validationResult = validateManifest2(manifest);
+    if (!validationResult.success) {
+      if (isJsonMode()) {
+        outputJson({ status: "error", error: "validation_failed", errors: validationResult.errors });
+        process.exit(1);
+      }
+      error("Manifest validation failed for publishing:");
+      newline();
+      for (const err of validationResult.errors) {
+        console.log(`  ${pc5.red("\u2717")} ${err}`);
+      }
+      newline();
+      hint("Run `hubbits validate --strict` to check all publishing requirements.");
+      process.exit(1);
+    }
+    const packageName = manifest.name;
+    const packageVersion = manifest.version;
+    debug(`Package: ${packageName}@${packageVersion}`);
+    if (!args["skip-scan"]) {
+      const scanSpinner = spinner("Scanning for security threats...");
+      const scanIssues = await scanDirectory(packageDir);
+      if (scanIssues.length > 0) {
+        const criticalOrHigh = scanIssues.filter(
+          (i) => i.startsWith("[CRITICAL]") || i.startsWith("[HIGH]")
+        );
+        if (criticalOrHigh.length > 0) {
+          scanSpinner.fail("Security scan found threats.");
+          newline();
+          error(`Found ${criticalOrHigh.length} security issue${criticalOrHigh.length === 1 ? "" : "s"}:`);
+          newline();
+          for (const issue of scanIssues) {
+            const color = issue.startsWith("[CRITICAL]") ? pc5.red : issue.startsWith("[HIGH]") ? pc5.yellow : pc5.dim;
+            console.log(`  ${color(issue)}`);
+          }
+          newline();
+          if (isJsonMode()) {
+            outputJson({ status: "error", error: "security_scan_failed", issues: scanIssues });
+            process.exit(1);
+          }
+          errorWithFix(
+            "Package contains potential security threats and cannot be published.",
+            "Review and fix the issues above. Use `--skip-scan` to bypass (not recommended)."
+          );
+          process.exit(1);
+        }
+        scanSpinner.warn(`Security scan found ${scanIssues.length} warning${scanIssues.length === 1 ? "" : "s"}.`);
+        for (const issue of scanIssues) {
+          console.log(`  ${pc5.dim(issue)}`);
+        }
+      } else {
+        scanSpinner.succeed("Security scan passed.");
+      }
+    } else {
+      debug("Skipping security scan (--skip-scan)");
+    }
+    const packSpinner = spinner("Packing archive...");
+    let archiveBuffer;
+    try {
+      debug(`Packing directory: ${packageDir}`);
+      archiveBuffer = await pack(packageDir);
+      debug(`Archive size: ${archiveBuffer.length} bytes`);
+      if (archiveBuffer.length > MAX_PACKAGE_SIZE) {
+        packSpinner.fail("Package too large.");
+        errorWithFix(
+          `Package size (${formatBytes2(archiveBuffer.length)}) exceeds the maximum of ${formatBytes2(MAX_PACKAGE_SIZE)}.`,
+          "Remove unnecessary files or large assets to reduce the package size."
+        );
+        process.exit(1);
+      }
+      packSpinner.succeed(`Packed ${formatBytes2(archiveBuffer.length)}`);
+    } catch (err) {
+      packSpinner.fail("Packing failed.");
+      const errMsg = err instanceof Error ? err.message : String(err);
+      errorWithFix(
+        `Failed to pack archive: ${errMsg}`,
+        "Check file permissions and ensure no symlinks exist in the package directory."
+      );
+      process.exit(1);
+    }
+    const digestSpinner = spinner("Computing digest...");
+    const digest = await sha256(archiveBuffer);
+    digestSpinner.succeed(`Digest: ${pc5.dim(digest.slice(0, 16) + "...")}`);
+    debug(`SHA-256: ${digest}`);
+    if (args["dry-run"]) {
+      newline();
+      success(`Dry run complete for ${pc5.bold(packageName)}@${pc5.yellow(packageVersion)}`);
+      newline();
+      field("Package", packageName);
+      field("Version", packageVersion);
+      field("Size", formatBytes2(archiveBuffer.length));
+      field("SHA-256", digest);
+      newline();
+      hint("Remove `--dry-run` to publish for real.");
+      if (isJsonMode()) {
+        outputJson({
+          status: "dry_run",
+          package: packageName,
+          version: packageVersion,
+          size: archiveBuffer.length,
+          sha256: digest
+        });
+      }
+      return;
+    }
+    if (!args.yes && !args.json && !args.quiet) {
+      newline();
+      info(`About to publish:`);
+      field("Package", pc5.cyan(packageName));
+      field("Version", pc5.yellow(packageVersion));
+      field("Size", formatBytes2(archiveBuffer.length));
+      if (auth.username) {
+        field("Author", auth.username);
+      }
+      newline();
+      const confirmed = await p5.confirm({
+        message: `Publish ${pc5.bold(packageName)}@${pc5.yellow(packageVersion)}?`
+      });
+      if (p5.isCancel(confirmed) || !confirmed) {
+        p5.cancel("Publish cancelled.");
+        process.exit(0);
+      }
+    }
+    const api2 = createApiClient();
+    const publishSpinner = spinner("Requesting upload URL...");
+    let uploadUrl;
+    let resolvedScope;
+    let resolvedName;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        debug("PUT /api/v1/packages/publish");
+        const result = await api2.requestPublish(
+          manifest,
+          digest,
+          archiveBuffer.length
+        );
+        if (!result.data) {
+          publishSpinner.fail("Failed to initiate publish.");
+          error("Server returned an unexpected response.");
+          process.exit(1);
+        }
+        uploadUrl = result.data.upload_url;
+        resolvedScope = result.data.scope;
+        resolvedName = result.data.name;
+        debug(`Upload URL received for ${resolvedScope}/${resolvedName}@${result.data.version}`);
+        break;
+      } catch (err) {
+        if (err instanceof ApiError && err.statusCode === 429 && attempt < 2) {
+          const waitSec = parseRetryAfter(err.message) ?? 60;
+          for (let t = waitSec; t > 0; t--) {
+            publishSpinner.text = `Rate limited \u2014 retrying in ${t}s...`;
+            await sleep2(1e3);
+          }
+          publishSpinner.text = "Requesting upload URL...";
+          continue;
+        }
+        publishSpinner.fail("Publish request failed.");
+        handlePublishError(err, packageName, packageVersion);
+        process.exit(1);
+      }
+    }
+    publishSpinner.text = "Uploading package...";
+    try {
+      debug(`Uploading ${archiveBuffer.length} bytes...`);
+      await api2.uploadFile(uploadUrl, archiveBuffer);
+      debug("Upload complete.");
+    } catch {
+      publishSpinner.fail("Upload failed.");
+      errorWithFix(
+        "Failed to upload the package archive.",
+        "Check your network connection and try again."
+      );
+      process.exit(1);
+    }
+    publishSpinner.text = "Confirming publish...";
+    let confirmResult;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        debug("POST /api/v1/packages/publish/confirm");
+        confirmResult = await api2.confirmPublish(
+          resolvedScope,
+          resolvedName,
+          packageVersion,
+          digest,
+          manifest
+        );
+        break;
+      } catch (err) {
+        if (err instanceof ApiError && err.statusCode === 429 && attempt < 2) {
+          const waitSec = parseRetryAfter(err.message) ?? 60;
+          for (let t = waitSec; t > 0; t--) {
+            publishSpinner.text = `Rate limited \u2014 retrying confirmation in ${t}s...`;
+            await sleep2(1e3);
+          }
+          publishSpinner.text = "Confirming publish...";
+          continue;
+        }
+        publishSpinner.fail("Publish confirmation failed.");
+        handlePublishError(err, packageName, packageVersion);
+        process.exit(1);
+      }
+    }
+    if (!confirmResult?.data) {
+      publishSpinner.fail("Publish confirmation failed.");
+      error("Server returned an unexpected response.");
+      process.exit(1);
+    }
+    publishSpinner.succeed("Published!");
+    const confirmedData = confirmResult.data;
+    const fullPublishedName = confirmedData.name;
+    const publishUrl = confirmedData.url;
+    if (isJsonMode()) {
+      outputJson({
+        status: "ok",
+        package: fullPublishedName,
+        version: packageVersion,
+        sha256: digest,
+        size: archiveBuffer.length,
+        signature: confirmedData.signature,
+        url: publishUrl
+      });
+      return;
+    }
+    newline();
+    success(`Published ${pc5.bold(pc5.cyan(fullPublishedName))}@${pc5.yellow(packageVersion)}`);
+    newline();
+    field("URL", publishUrl);
+    field("SHA-256", pc5.dim(digest.slice(0, 16) + "..."));
+    field("Size", formatBytes2(archiveBuffer.length));
+    if (confirmedData.signature) {
+      field("Signature", pc5.dim(confirmedData.signature.slice(0, 16) + "..."));
+    }
+    newline();
+    hint(`View: ${publishUrl}`);
+    hint(`Install: \`hubbits pull ${fullPublishedName}\``);
+  }
+});
+async function scanDirectory(dir) {
+  const allIssues = [];
+  try {
+    const files = collectScannableFiles(dir, dir);
+    debug(`Scanning ${files.length} file(s) for security threats...`);
+    for (const filePath of files) {
+      try {
+        const content = readFileSync(filePath, "utf-8");
+        const result = scanPromptInjection(content);
+        if (result.issues.length > 0) {
+          const relPath = filePath.slice(dir.length + 1);
+          for (const issue of result.issues) {
+            allIssues.push(`${relPath}: ${issue}`);
+          }
+        }
+      } catch {
+        debug(`Skipping unreadable file: ${filePath}`);
+      }
+    }
+  } catch (err) {
+    debug(`Security scan error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return allIssues;
+}
+function collectScannableFiles(dir, rootDir) {
+  const files = [];
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.name.startsWith(".") || entry.name === "node_modules") {
+        continue;
+      }
+      if (entry.isDirectory() && !entry.isSymbolicLink()) {
+        files.push(...collectScannableFiles(fullPath, rootDir));
+      } else if (entry.isFile()) {
+        const ext = entry.name.slice(entry.name.lastIndexOf("."));
+        if (SCANNABLE_EXTENSIONS.includes(ext)) {
+          files.push(fullPath);
+        }
+      }
+    }
+  } catch {
+  }
+  return files;
+}
+function findManifestFile2(dir) {
+  const candidates = ["hubbit.yaml", "hubbit.yml"];
+  for (const name of candidates) {
+    const filePath = join(dir, name);
+    if (existsSync(filePath)) return filePath;
+  }
+  return null;
+}
+function handlePublishError(err, packageName, version) {
+  if (err instanceof ApiError) {
+    switch (err.statusCode) {
+      case 401:
+        errorWithFix(
+          "Authentication expired.",
+          "Run `hubbits login` to re-authenticate."
+        );
+        break;
+      case 403:
+        errorWithFix(
+          err.message || "You do not have permission to publish this package.",
+          "Check that you are the package owner, or create a new package with a different name."
+        );
+        break;
+      case 409:
+        errorWithFix(
+          `Version "${version}" already exists for "${packageName}".`,
+          `Bump the version in hubbit.yaml and try again.`
+        );
+        break;
+      case 422:
+        error(`Validation error: ${err.message}`);
+        if (err.details) {
+          for (const [fieldName, msgs] of Object.entries(err.details)) {
+            for (const msg of msgs) {
+              console.log(`  ${pc5.red("\u2717")} ${fieldName}: ${msg}`);
+            }
+          }
+        }
+        hint("Fix the validation errors above and try again.");
+        break;
+      default:
+        errorWithFix(err.message, "Check your network connection and try again.");
+    }
+  } else {
+    errorWithFix(
+      "An unexpected error occurred.",
+      "Check your network connection and try again."
+    );
+  }
+}
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function parseRetryAfter(message) {
+  const match = message.match(/retry after (\d+)/i);
+  return match ? parseInt(match[1], 10) : null;
+}
+function sleep2(ms) {
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
+}
+var COMMANDS = [
+  "login",
+  "logout",
+  "search",
+  "init",
+  "create",
+  "validate",
+  "pull",
+  "publish",
+  "completion"
+];
+var SHELLS = ["zsh", "bash", "fish", "powershell"];
+var completion_default = defineCommand({
+  meta: {
+    name: "completion",
+    description: "Generate shell tab-completion script"
+  },
+  args: {
+    shell: {
+      type: "positional",
+      description: "Shell to generate completions for (zsh | bash | fish | powershell)",
+      required: false
+    }
+  },
+  run({ args }) {
+    const shell = args.shell ?? detectShell();
+    if (!shell || !SHELLS.includes(shell)) {
+      errorWithFix(
+        `Unknown shell: "${shell ?? ""}"`,
+        `Run \`hubbits completion <shell>\` where shell is one of: ${SHELLS.join(", ")}`
+      );
+      process.exit(1);
+    }
+    const script = generateScript(shell);
+    process.stdout.write(script + "\n");
+  }
+});
+function detectShell() {
+  const shell = process.env.SHELL ?? "";
+  if (shell.endsWith("zsh")) return "zsh";
+  if (shell.endsWith("bash")) return "bash";
+  if (shell.endsWith("fish")) return "fish";
+  if (process.platform === "win32") return "powershell";
+  return null;
+}
+function generateScript(shell) {
+  switch (shell) {
+    case "zsh":
+      return zshScript();
+    case "bash":
+      return bashScript();
+    case "fish":
+      return fishScript();
+    case "powershell":
+      return powershellScript();
+  }
+}
+function zshScript() {
+  return `# Hubbits CLI \u2014 zsh completion
+# Add to ~/.zshrc:  source <(hubbits completion zsh)
+
+_hubbits_completions() {
+  local -a commands
+  commands=(
+    ${COMMANDS.map((c) => `'${c}:${cmdDescription(c)}'`).join("\n    ")}
+  )
+
+  if (( CURRENT == 2 )); then
+    _describe 'hubbits command' commands
+  elif (( CURRENT >= 3 )); then
+    case \${words[2]} in
+      completion)
+        local -a shells
+        shells=('zsh:zsh completion' 'bash:bash completion' 'fish:fish completion' 'powershell:PowerShell completion')
+        _describe 'shell' shells
+        ;;
+      pull|validate)
+        _files
+        ;;
+    esac
+  fi
+}
+
+if [[ -n "\${ZSH_VERSION:-}" ]]; then
+  if (( \${+functions[compdef]} )); then
+    compdef _hubbits_completions hubbits
+  else
+    autoload -Uz compinit && compinit
+    compdef _hubbits_completions hubbits
+  fi
+fi`;
+}
+function bashScript() {
+  const cmdsQuoted = COMMANDS.map((c) => `"${c}"`).join(" ");
+  return `# Hubbits CLI \u2014 bash completion
+# Add to ~/.bashrc:  source <(hubbits completion bash)
+
+_hubbits_completions() {
+  local cur prev words
+  _init_completion 2>/dev/null || {
+    COMPREPLY=()
+    cur=\${COMP_WORDS[COMP_CWORD]}
+    prev=\${COMP_WORDS[COMP_CWORD-1]}
+  }
+
+  local commands=(${cmdsQuoted})
+
+  if [[ \${COMP_CWORD} -eq 1 ]]; then
+    COMPREPLY=( $(compgen -W "\${commands[*]}" -- "$cur") )
+    return
+  fi
+
+  case "$prev" in
+    completion)
+      COMPREPLY=( $(compgen -W "zsh bash fish powershell" -- "$cur") )
+      ;;
+    pull|validate)
+      COMPREPLY=( $(compgen -f -- "$cur") )
+      ;;
+  esac
+}
+
+complete -F _hubbits_completions hubbits`;
+}
+function fishScript() {
+  const cmdCompletions = COMMANDS.map(
+    (c) => `complete -c hubbits -f -n '__fish_use_subcommand' -a '${c}' -d '${cmdDescription(c)}'`
+  ).join("\n");
+  return `# Hubbits CLI \u2014 fish completion
+# Save to ~/.config/fish/completions/hubbits.fish
+
+# Disable file completions for hubbits
+complete -c hubbits -f
+
+# Top-level subcommands
+${cmdCompletions}
+
+# completion subcommand \u2014 shell argument
+complete -c hubbits -n '__fish_seen_subcommand_from completion' -a 'zsh'        -d 'zsh completion script'
+complete -c hubbits -n '__fish_seen_subcommand_from completion' -a 'bash'       -d 'bash completion script'
+complete -c hubbits -n '__fish_seen_subcommand_from completion' -a 'fish'       -d 'fish completion script'
+complete -c hubbits -n '__fish_seen_subcommand_from completion' -a 'powershell' -d 'PowerShell completion script'
+
+# pull / validate \u2014 allow file paths
+complete -c hubbits -n '__fish_seen_subcommand_from pull validate' -a '(__fish_complete_path)'`;
+}
+function powershellScript() {
+  const cmdsArray = COMMANDS.map((c) => `'${c}'`).join(", ");
+  return `# Hubbits CLI \u2014 PowerShell completion
+# Add to your PowerShell profile ($PROFILE):
+#   Invoke-Expression (hubbits completion powershell)
+
+Register-ArgumentCompleter -Native -CommandName @('hubbits') -ScriptBlock {
+  param($wordToComplete, $commandAst, $cursorPosition)
+
+  $commands = @(${cmdsArray})
+  $shells   = @('zsh', 'bash', 'fish', 'powershell')
+
+  $tokens = $commandAst.CommandElements
+  $subCmd = if ($tokens.Count -ge 2) { $tokens[1].ToString() } else { $null }
+
+  if ($tokens.Count -le 2) {
+    # Complete top-level commands
+    $commands | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
+      [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
+    }
+  } elseif ($subCmd -eq 'completion') {
+    $shells | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
+      [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', "$_ completion script")
+    }
+  }
+}`;
+}
+function cmdDescription(cmd) {
+  const descriptions = {
+    login: "Log in to your Hubbits account",
+    logout: "Log out of your Hubbits account",
+    search: "Search for hubbits",
+    init: "Initialize a new hubbit in the current directory",
+    create: "Create a new hubbit or import from GitHub",
+    validate: "Validate a hubbit.yaml manifest",
+    pull: "Download a hubbit package",
+    publish: "Publish a hubbit package",
+    completion: "Generate shell tab-completion script"
+  };
+  return descriptions[cmd] ?? cmd;
+}
+
+// src/index.ts
+if (process.env.HUBBITS_CWD) {
+  process.chdir(process.env.HUBBITS_CWD);
+}
+var main = defineCommand({
+  meta: {
+    name: "hubbits",
+    version: "0.1.0",
+    description: "Hubbits CLI - Interactive AI experience manager"
+  },
+  args: {
+    version: {
+      type: "boolean",
+      alias: "v",
+      description: "Show version"
+    }
+  },
+  subCommands: {
+    login: login_default,
+    logout: logout_default,
+    search: search_default,
+    init: init_default,
+    create: create_default,
+    validate: validate_default,
+    pull: pull_default,
+    publish: publish_default,
+    completion: completion_default
+  },
+  run({ args, rawArgs }) {
+    if (args.version) {
+      console.log("hubbits/0.1.0");
+      return;
+    }
+    if (rawArgs.some((a) => !a.startsWith("-"))) return;
+    console.log("Hubbits CLI v0.1.0");
+    console.log("Run `hubbits --help` for available commands.");
+  }
+});
+runMain(main);