pilothub 0.0.1 → 0.0.2

package/dist/skills.d.ts

@@ -0,0 +1,43 @@
+import { type Lockfile } from './schema/index.js';
+export type SkillOrigin = {
+    version: 1;
+    registry: string;
+    slug: string;
+    installedVersion: string;
+    installedAt: number;
+};
+export declare function extractZipToDir(zipBytes: Uint8Array, targetDir: string): Promise<void>;
+export declare function listTextFiles(root: string): Promise<{
+    relPath: string;
+    bytes: Uint8Array;
+    contentType?: string;
+}[]>;
+export type SkillFileHash = {
+    path: string;
+    sha256: string;
+    size: number;
+};
+export declare function sha256Hex(bytes: Uint8Array): string;
+export declare function buildSkillFingerprint(files: Array<{
+    path: string;
+    sha256: string;
+}>): string;
+export declare function hashSkillFiles(files: Array<{
+    relPath: string;
+    bytes: Uint8Array;
+}>): {
+    files: {
+        path: string;
+        sha256: string;
+        size: number;
+    }[];
+    fingerprint: string;
+};
+export declare function hashSkillZip(zipBytes: Uint8Array): {
+    files: SkillFileHash[];
+    fingerprint: string;
+};
+export declare function readLockfile(workdir: string): Promise<Lockfile>;
+export declare function writeLockfile(workdir: string, lock: Lockfile): Promise<void>;
+export declare function readSkillOrigin(skillFolder: string): Promise<SkillOrigin | null>;
+export declare function writeSkillOrigin(skillFolder: string, origin: SkillOrigin): Promise<void>;

package/dist/skills.js

@@ -0,0 +1,163 @@
+import { createHash } from 'node:crypto';
+import { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { unzipSync } from 'fflate';
+import ignore from 'ignore';
+import mime from 'mime';
+import { LockfileSchema, parseArk, TEXT_FILE_EXTENSION_SET } from './schema/index.js';
+export async function extractZipToDir(zipBytes, targetDir) {
+    const entries = unzipSync(zipBytes);
+    await mkdir(targetDir, { recursive: true });
+    for (const [rawPath, data] of Object.entries(entries)) {
+        const safePath = sanitizeRelPath(rawPath);
+        if (!safePath)
+            continue;
+        const outPath = join(targetDir, safePath);
+        await mkdir(dirname(outPath), { recursive: true });
+        await writeFile(outPath, data);
+    }
+}
+export async function listTextFiles(root) {
+    const files = [];
+    const absRoot = resolve(root);
+    const ig = ignore();
+    ig.add(['.git/', 'node_modules/', '.pilothub/']);
+    await addIgnoreFile(ig, join(absRoot, '.gitignore'));
+    await addIgnoreFile(ig, join(absRoot, '.pilothubignore'));
+    await walk(absRoot, async (absPath) => {
+        const relPath = normalizePath(relative(absRoot, absPath));
+        if (!relPath)
+            return;
+        if (ig.ignores(relPath))
+            return;
+        const ext = relPath.split('.').at(-1)?.toLowerCase() ?? '';
+        if (!ext || !TEXT_FILE_EXTENSION_SET.has(ext))
+            return;
+        const buffer = await readFile(absPath);
+        const contentType = mime.getType(relPath) ?? 'text/plain';
+        files.push({ relPath, bytes: new Uint8Array(buffer), contentType });
+    });
+    return files;
+}
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export function buildSkillFingerprint(files) {
+    const normalized = files
+        .filter((file) => Boolean(file.path) && Boolean(file.sha256))
+        .map((file) => ({ path: file.path, sha256: file.sha256 }))
+        .sort((a, b) => a.path.localeCompare(b.path));
+    const payload = normalized.map((file) => `${file.path}:${file.sha256}`).join('\n');
+    return createHash('sha256').update(payload).digest('hex');
+}
+export function hashSkillFiles(files) {
+    const hashed = files.map((file) => ({
+        path: file.relPath,
+        sha256: sha256Hex(file.bytes),
+        size: file.bytes.byteLength,
+    }));
+    return { files: hashed, fingerprint: buildSkillFingerprint(hashed) };
+}
+export function hashSkillZip(zipBytes) {
+    const entries = unzipSync(zipBytes);
+    const hashed = Object.entries(entries)
+        .map(([rawPath, bytes]) => {
+        const safePath = sanitizeZipPath(rawPath);
+        if (!safePath)
+            return null;
+        const ext = safePath.split('.').at(-1)?.toLowerCase() ?? '';
+        if (!ext || !TEXT_FILE_EXTENSION_SET.has(ext))
+            return null;
+        return { path: safePath, sha256: sha256Hex(bytes), size: bytes.byteLength };
+    })
+        .filter(Boolean);
+    return { files: hashed, fingerprint: buildSkillFingerprint(hashed) };
+}
+export async function readLockfile(workdir) {
+    const path = join(workdir, '.pilothub', 'lock.json');
+    try {
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        return parseArk(LockfileSchema, parsed, 'Lockfile');
+    }
+    catch {
+        return { version: 1, skills: {} };
+    }
+}
+export async function writeLockfile(workdir, lock) {
+    const path = join(workdir, '.pilothub', 'lock.json');
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(lock, null, 2)}\n`, 'utf8');
+}
+export async function readSkillOrigin(skillFolder) {
+    const path = join(skillFolder, '.pilothub', 'origin.json');
+    try {
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1)
+            return null;
+        if (!parsed.registry || !parsed.slug || !parsed.installedVersion)
+            return null;
+        if (typeof parsed.installedAt !== 'number' || !Number.isFinite(parsed.installedAt))
+            return null;
+        return {
+            version: 1,
+            registry: String(parsed.registry),
+            slug: String(parsed.slug),
+            installedVersion: String(parsed.installedVersion),
+            installedAt: parsed.installedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeSkillOrigin(skillFolder, origin) {
+    const path = join(skillFolder, '.pilothub', 'origin.json');
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(origin, null, 2)}\n`, 'utf8');
+}
+function normalizePath(path) {
+    return path
+        .split(sep)
+        .join('/')
+        .replace(/^\.\/+/, '');
+}
+function sanitizeRelPath(path) {
+    const normalized = path.replace(/^\.\/+/, '').replace(/^\/+/, '');
+    if (!normalized || normalized.endsWith('/'))
+        return null;
+    if (normalized.includes('..') || normalized.includes('\\'))
+        return null;
+    return normalized;
+}
+function sanitizeZipPath(path) {
+    return sanitizeRelPath(path);
+}
+async function walk(dir, onFile) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.name.startsWith('.'))
+            continue;
+        if (entry.name === 'node_modules')
+            continue;
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            await walk(full, onFile);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        await onFile(full);
+    }
+}
+async function addIgnoreFile(ig, path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        ig.add(raw.split(/\r?\n/));
+    }
+    catch {
+        // optional
+    }
+}
+//# sourceMappingURL=skills.js.map

package/dist/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAiB,cAAc,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAUpG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAoB,EAAE,SAAiB;IAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAwE,EAAE,CAAA;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;IACnB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAA;IAChD,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IACpD,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAEzD,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAM;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC1D,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,YAAY,CAAA;QACzD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC;AAID,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA8C;IAClF,MAAM,UAAU,GAAG,KAAK;SACrB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;SACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoD;IACjF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;KAC5B,CAAC,CAAC,CAAA;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAoB;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAoB,CAAA;IAErC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAA;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACzC,OAAO,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACnC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,IAAc;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAA;QACtD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAA;QAC7E,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/F,OAAO;YACL,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACjD,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB,EAAE,MAAmB;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;IAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACvE,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,MAAuC;IACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAQ;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACxB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAC7B,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAA6B,EAAE,IAAY;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;AACH,CAAC"}

package/dist/skills.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/skills.test.js

@@ -0,0 +1,144 @@
+/* @vitest-environment node */
+import { mkdir, mkdtemp, readFile, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { strToU8, zipSync } from 'fflate';
+import { describe, expect, it } from 'vitest';
+import { buildSkillFingerprint, extractZipToDir, hashSkillFiles, hashSkillZip, listTextFiles, readLockfile, readSkillOrigin, sha256Hex, writeLockfile, writeSkillOrigin, } from './skills';
+describe('skills', () => {
+    it('extracts zip into directory and skips traversal', async () => {
+        const dir = await mkdtemp(join(tmpdir(), 'pilothub-'));
+        const zip = zipSync({
+            'SKILL.md': strToU8('hello'),
+            '../evil.txt': strToU8('nope'),
+        });
+        await extractZipToDir(new Uint8Array(zip), dir);
+        expect((await readFile(join(dir, 'SKILL.md'), 'utf8')).trim()).toBe('hello');
+        await expect(stat(join(dir, '..', 'evil.txt'))).rejects.toBeTruthy();
+    });
+    it('writes and reads lockfile', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-work-'));
+        await writeLockfile(workdir, {
+            version: 1,
+            skills: { demo: { version: '1.0.0', installedAt: 1 } },
+        });
+        const read = await readLockfile(workdir);
+        expect(read.skills.demo?.version).toBe('1.0.0');
+    });
+    it('returns empty lockfile on invalid json', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-work-bad-'));
+        await mkdir(join(workdir, '.pilothub'), { recursive: true });
+        await writeFile(join(workdir, '.pilothub', 'lock.json'), '{', 'utf8');
+        const read = await readLockfile(workdir);
+        expect(read).toEqual({ version: 1, skills: {} });
+    });
+    it('returns empty lockfile on schema mismatch', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-work-schema-'));
+        await mkdir(join(workdir, '.pilothub'), { recursive: true });
+        await writeFile(join(workdir, '.pilothub', 'lock.json'), JSON.stringify({ version: 1, skills: 'nope' }), 'utf8');
+        const read = await readLockfile(workdir);
+        expect(read).toEqual({ version: 1, skills: {} });
+    });
+    it('skips dotfiles and node_modules when listing text files', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-files-'));
+        await writeFile(join(workdir, 'SKILL.md'), 'hi', 'utf8');
+        await writeFile(join(workdir, '.secret.txt'), 'no', 'utf8');
+        await mkdir(join(workdir, 'node_modules'), { recursive: true });
+        await writeFile(join(workdir, 'node_modules', 'a.txt'), 'no', 'utf8');
+        const files = await listTextFiles(workdir);
+        expect(files.map((file) => file.relPath)).toEqual(['SKILL.md']);
+    });
+    it('respects .gitignore and .pilothubignore', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-ignore-'));
+        await writeFile(join(workdir, '.gitignore'), 'ignored.md\n', 'utf8');
+        await writeFile(join(workdir, '.pilothubignore'), 'private.md\n', 'utf8');
+        await writeFile(join(workdir, 'SKILL.md'), 'hi', 'utf8');
+        await writeFile(join(workdir, 'ignored.md'), 'no', 'utf8');
+        await writeFile(join(workdir, 'private.md'), 'no', 'utf8');
+        await writeFile(join(workdir, 'public.json'), '{}', 'utf8');
+        const files = await listTextFiles(workdir);
+        const paths = files.map((file) => file.relPath).sort();
+        expect(paths).toEqual(['SKILL.md', 'public.json']);
+        expect(files.find((file) => file.relPath === 'SKILL.md')?.contentType).toMatch(/^text\//);
+        expect(files.find((file) => file.relPath === 'public.json')?.contentType).toBe('application/json');
+    });
+    it('falls back to text/plain for unknown text extensions', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-env-'));
+        await writeFile(join(workdir, 'SKILL.md'), 'hi', 'utf8');
+        await writeFile(join(workdir, 'config.env'), 'TOKEN=demo', 'utf8');
+        const files = await listTextFiles(workdir);
+        expect(files.find((file) => file.relPath === 'config.env')?.contentType).toBe('text/plain');
+    });
+    it('hashes skill files deterministically', async () => {
+        const { fingerprint } = hashSkillFiles([
+            { relPath: 'b.txt', bytes: strToU8('b') },
+            { relPath: 'a.txt', bytes: strToU8('a') },
+        ]);
+        const expected = buildSkillFingerprint([
+            { path: 'a.txt', sha256: sha256Hex(strToU8('a')) },
+            { path: 'b.txt', sha256: sha256Hex(strToU8('b')) },
+        ]);
+        expect(fingerprint).toBe(expected);
+    });
+    it('hashes text files inside a downloaded zip deterministically', () => {
+        const zip = zipSync({
+            'SKILL.md': strToU8('hello'),
+            'notes.md': strToU8('world'),
+            'image.png': strToU8('nope'),
+        });
+        const { fingerprint } = hashSkillZip(new Uint8Array(zip));
+        const expected = buildSkillFingerprint([
+            { path: 'SKILL.md', sha256: sha256Hex(strToU8('hello')) },
+            { path: 'notes.md', sha256: sha256Hex(strToU8('world')) },
+        ]);
+        expect(fingerprint).toBe(expected);
+    });
+    it('ignores unsafe or non-text entries when hashing zips', () => {
+        const zip = zipSync({
+            'SKILL.md': strToU8('hello'),
+            'folder/': strToU8(''),
+            '../evil.txt': strToU8('nope'),
+            'bad\\path.txt': strToU8('nope'),
+            'image.png': strToU8('nope'),
+        });
+        const { files } = hashSkillZip(new Uint8Array(zip));
+        expect(files).toEqual([{ path: 'SKILL.md', sha256: sha256Hex(strToU8('hello')), size: 5 }]);
+    });
+    it('builds fingerprints from valid entries only', () => {
+        const fingerprint = buildSkillFingerprint([
+            { path: '', sha256: '' },
+            { path: 'valid.txt', sha256: sha256Hex(strToU8('ok')) },
+        ]);
+        const expected = buildSkillFingerprint([
+            { path: 'valid.txt', sha256: sha256Hex(strToU8('ok')) },
+        ]);
+        expect(fingerprint).toBe(expected);
+    });
+    it('returns null for invalid skill origin metadata', async () => {
+        const workdir = await mkdtemp(join(tmpdir(), 'pilothub-origin-'));
+        expect(await readSkillOrigin(workdir)).toBeNull();
+        await mkdir(join(workdir, '.pilothub'), { recursive: true });
+        await writeFile(join(workdir, '.pilothub', 'origin.json'), JSON.stringify({ version: 2 }), 'utf8');
+        expect(await readSkillOrigin(workdir)).toBeNull();
+        await writeFile(join(workdir, '.pilothub', 'origin.json'), JSON.stringify({ version: 1, registry: 'demo', slug: 'x', installedAt: 1 }), 'utf8');
+        expect(await readSkillOrigin(workdir)).toBeNull();
+        await writeFile(join(workdir, '.pilothub', 'origin.json'), JSON.stringify({
+            version: 1,
+            registry: 'demo',
+            slug: 'x',
+            installedVersion: '0.1.0',
+            installedAt: 'nope',
+        }), 'utf8');
+        expect(await readSkillOrigin(workdir)).toBeNull();
+        const origin = {
+            version: 1,
+            registry: 'https://example.com',
+            slug: 'demo',
+            installedVersion: '1.2.3',
+            installedAt: 123,
+        };
+        await writeSkillOrigin(workdir, origin);
+        expect(await readSkillOrigin(workdir)).toEqual(origin);
+    });
+});
+//# sourceMappingURL=skills.test.js.map

package/dist/skills.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.test.js","sourceRoot":"","sources":["../src/skills.test.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,aAAa,EACb,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAEjB,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAA;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;YAC5B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC;SAC/B,CAAC,CAAA;QACF,MAAM,eAAe,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QAE/C,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5E,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAC/D,MAAM,aAAa,CAAC,OAAO,EAAE;YAC3B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE;SACvD,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACnE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAA;QACtE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EACvC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAC9C,MAAM,CACP,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACrE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACjE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;QACpE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;QACzE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAE3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAC5E,kBAAkB,CACnB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QAC9D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;QAClE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC;YACrC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACzC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;SAC1C,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACrC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;YAClD,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;SACnD,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;YAC5B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;YAC5B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAA;QACF,MAAM,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACrC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE;YACzD,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE;SAC1D,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACtB,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC;YAC9B,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;YAChC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAA;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,WAAW,GAAG,qBAAqB,CAAC;YACxC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACxB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE;SACxD,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACrC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE;SACxD,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAEjD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAEjD,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAC3E,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAEjD,MAAM,SAAS,CACb,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,GAAG;YACT,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,MAAM;SACpB,CAAC,EACF,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAEjD,MAAM,MAAM,GAAgB;YAC1B,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,qBAAqB;YAC/B,IAAI,EAAE,MAAM;YACZ,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,GAAG;SACjB,CAAA;QACD,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/types.d.ts

@@ -0,0 +1,7 @@
+export type Lockfile = {
+    version: 1;
+    skills: Record<string, {
+        version: string | null;
+        installedAt: number;
+    }>;
+};

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,84 +1,41 @@
 {
   "name": "pilothub",
-  "private": false,
-  "version": "0.0.1",
+  "version": "0.0.2",
+  "description": "PilotHub CLI \\u2014 install, update, search, and publish agent skills.",
+  "license": "MIT",
   "type": "module",
-  "workspaces": [
-    "packages/*"
+  "bin": {
+    "pilothub": "bin/pilothub.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
-    "preinstall": "bunx only-allow bun",
-    "dev": "bun --bun vite dev --port 3000",
-    "build": "bun --bun vite build",
-    "preview": "bun --bun vite preview",
-    "docs:list": "bun scripts/docs-list.ts",
-    "check:peers": "bun scripts/check-peer-deps.ts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:e2e": "vitest run -c vitest.e2e.config.ts",
-    "test:e2e:local": "bash scripts/run-playwright-local.sh",
-    "test:pw": "playwright test",
-    "coverage": "vitest run --coverage",
-    "convex:deploy": "bunx convex deploy --typecheck=disable --yes",
-    "lint": "bun run lint:biome && bun run lint:oxlint",
-    "lint:biome": "biome check .",
-    "lint:oxlint": "oxlint --type-aware --tsconfig ./tsconfig.oxlint.json ./src ./convex ./packages/pilothub/src ./packages/schema/src",
-    "format": "biome format --write ."
+    "build": "tsc -p tsconfig.json",
+    "dev": "node --enable-source-maps dist/cli.js",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@auth/core": "^0.37.4",
-    "@convex-dev/auth": "^0.0.90",
-    "@fontsource/bricolage-grotesque": "^5.2.10",
-    "@fontsource/ibm-plex-mono": "^5.2.7",
-    "@fontsource/manrope": "^5.2.8",
-    "@monaco-editor/react": "^4.7.0",
-    "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-toggle-group": "^1.1.11",
-    "@resvg/resvg-wasm": "^2.6.2",
-    "@tailwindcss/vite": "^4.1.18",
-    "@tanstack/react-devtools": "^0.9.2",
-    "@tanstack/react-router": "^1.151.6",
-    "@tanstack/react-router-devtools": "^1.151.6",
-    "@tanstack/react-start": "^1.152.0",
-    "@tanstack/router-plugin": "^1.151.6",
-    "@vercel/analytics": "^1.6.1",
-    "pilothub-schema": "0.0.2",
-    "clsx": "^2.1.1",
-    "convex": "^1.31.6",
-    "convex-helpers": "^0.1.111",
+    "@clack/prompts": "^0.11.0",
+    "arktype": "^2.1.29",
+    "commander": "^14.0.2",
     "fflate": "^0.8.2",
-    "h3": "2.0.1-rc.8",
-    "lucide-react": "^0.562.0",
-    "monaco-editor": "^0.55.1",
-    "nitro": "^3.0.1-alpha.1",
-    "react": "^19.2.3",
-    "react-dom": "^19.2.3",
-    "react-markdown": "^10.1.0",
-    "remark-gfm": "^4.0.1",
+    "ignore": "^7.0.5",
+    "json5": "^2.2.3",
+    "mime": "^4.1.0",
+    "ora": "^9.0.0",
+    "p-retry": "^7.1.1",
     "semver": "^7.7.3",
-    "tailwind-merge": "^3.4.0",
-    "tailwindcss": "^4.1.18",
-    "vite-tsconfig-paths": "^6.0.4",
-    "yaml": "^2.8.2"
+    "undici": "^7.16.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.11",
-    "@playwright/test": "^1.57.0",
-    "@tanstack/devtools-vite": "^0.4.1",
-    "@testing-library/dom": "^10.4.1",
-    "@testing-library/react": "^16.3.1",
     "@types/node": "^25.0.9",
-    "@types/react": "^19.2.8",
-    "@types/react-dom": "^19.2.3",
-    "@types/semver": "^7.7.1",
-    "@vitejs/plugin-react": "^5.1.2",
-    "@vitest/coverage-v8": "^4.0.17",
-    "jsdom": "^27.4.0",
-    "only-allow": "^1.2.1",
-    "oxlint": "^1.39.0",
-    "oxlint-tsgolint": "^0.11.1",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^4.0.17"
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=20"
   }
 }

package/.env.local.example

@@ -1,19 +0,0 @@
-# Frontend
-VITE_CONVEX_URL=
-VITE_CONVEX_SITE_URL=
-VITE_SOULHUB_SITE_URL=
-VITE_SOULHUB_HOST=
-VITE_SITE_MODE=
-SITE_URL=http://localhost:3000
-CONVEX_SITE_URL=
-
-# Convex Auth (GitHub OAuth App)
-AUTH_GITHUB_ID=
-AUTH_GITHUB_SECRET=
-
-# Convex Auth JWT keys (generated via @convex-dev/auth CLI)
-JWT_PRIVATE_KEY=
-JWKS=
-
-# Embeddings
-OPENAI_API_KEY=

package/.github/workflows/ci.yml

@@ -1,40 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.6
-
-      - name: Install
-        run: bun install --frozen-lockfile
-      - name: Peer deps
-        run: bun run check:peers
-
-      - name: Lint
-        run: bun run lint
-
-      - name: Test
-        run: bun run test
-
-      - name: Coverage
-        run: bun run coverage
-
-      - name: Typecheck packages
-        run: |
-          bunx tsc -p packages/schema/tsconfig.json --noEmit
-          bunx tsc -p packages/pilothub/tsconfig.json --noEmit
-
-      - name: Build
-        run: bun run build

package/.oxlintrc.json

@@ -1,3 +0,0 @@
-{
-  "ignorePatterns": ["node_modules", "dist", "coverage", "convex/_generated", ".tanstack", "public"]
-}

package/AGENTS.md

@@ -1,45 +0,0 @@
-# Repository Guidelines
-
-## Project Structure & Module Organization
-- `src/` — TanStack Start app code (routes, components, styles).
-- `convex/` — Convex backend (schema, queries/mutations/actions, HTTP routes).
-- `convex/_generated/` — generated Convex API/types; committed for builds.
-- `docs/` — product/spec docs (see `docs/spec.md`).
-- `public/` — static assets.
-
-## Build, Test, and Development Commands
-- `bun run dev` — local app server at `http://localhost:3000`.
-- `bun run build` — production build (Vite + Nitro).
-- `bun run preview` — preview built app.
-- `bunx convex dev` — Convex dev deployment + function watcher.
-- `bunx convex codegen` — regenerate `convex/_generated`.
-- `bun run lint` — Biome + oxlint (type-aware).
-- `bun run test` — Vitest (unit tests).
-- `bun run coverage` — coverage run; keep global >= 80%.
-
-## Coding Style & Naming Conventions
-- TypeScript strict; ESM.
-- Indentation: 2 spaces, single quotes (Biome).
-- Lint/format: Biome + oxlint (type-aware).
-- Convex function names: verb-first (`getBySlug`, `publishVersion`).
-
-## Testing Guidelines
-- Framework: Vitest 4 + jsdom.
-- Tests live in `src/**` and `convex/lib/**`.
-- Coverage threshold: 80% global (lines/functions/branches/statements).
-- Example: `convex/lib/skills.test.ts`.
-
-## Commit & Pull Request Guidelines
-- Commit messages: Conventional Commits (`feat:`, `fix:`, `chore:`, `docs:`…).
-- Keep changes scoped; avoid repo-wide search/replace.
-- PRs: include summary + test commands run. Add screenshots for UI changes.
-
-## Configuration & Security
-- Local env: `.env.local` (never commit secrets).
-- Convex env holds JWT keys; Vercel only needs `VITE_CONVEX_URL` + `VITE_CONVEX_SITE_URL`.
-- OAuth: GitHub OAuth App credentials required for login.
-
-## Convex Ops (Gotchas)
-- New Convex functions must be pushed before `convex run`: use `bunx convex dev --once` (dev) or `bunx convex deploy` (prod).
-- For non-interactive prod deploys, use `bunx convex deploy -y` to skip confirmation.
-- If `bunx convex run --env-file .env.local ...` returns `401 MissingAccessToken` despite `bunx convex login`, workaround: omit `--env-file` and use `--deployment-name <name>` / `--prod`.