prpm 0.0.11 → 0.0.12

package/dist/__tests__/e2e/test-helpers.js

@@ -77,7 +77,7 @@ async function createMockCollection(testDir, id, packages) {
 async function createMockConfig(configPath, options) {
     const config = {
         token: options.token || 'test-token-123',
-        registryUrl: options.registryUrl || 'http://localhost:3000',
+        registryUrl: options.registryUrl || 'http://localhost:3111',
     };
     await (0, promises_1.mkdir)((0, path_1.join)(configPath, '..'), { recursive: true });
     await (0, promises_1.writeFile)(configPath, JSON.stringify(config, null, 2));

package/dist/commands/list.js

@@ -40,6 +40,13 @@ function getDestinationDir(type) {
             return '.prompts';
     }
 }
+/**
+ * Strip author namespace from package ID
+ */
+function stripAuthorNamespace(packageId) {
+    const parts = packageId.split('/');
+    return parts[parts.length - 1];
+}
 /**
  * Find the actual file location for a package
  */
@@ -47,11 +54,13 @@ async function findPackageLocation(id, format, subtype) {
     if (!format)
         return null;
     const baseDir = getDestinationDir(format);
+    // Strip author namespace to get actual package name used in file system
+    const packageName = stripAuthorNamespace(id);
     // Try different file extensions based on format
     const extensions = format === 'cursor' ? ['.mdc', '.md'] : ['.md'];
-    // Try direct file: <dir>/<id>.ext
+    // Try direct file: <dir>/<packageName>.ext
     for (const ext of extensions) {
-        const directPath = path_1.default.join(baseDir, `${id}${ext}`);
+        const directPath = path_1.default.join(baseDir, `${packageName}${ext}`);
         try {
             await fs_1.promises.access(directPath);
             return directPath;
@@ -60,9 +69,9 @@ async function findPackageLocation(id, format, subtype) {
             // File doesn't exist, continue
         }
     }
-    // Try subdirectory: <dir>/<id>/SKILL.md or <dir>/<id>/AGENT.md
+    // Try subdirectory: <dir>/<packageName>/SKILL.md or <dir>/<packageName>/AGENT.md
     if (subtype === 'skill') {
-        const skillPath = path_1.default.join(baseDir, id, 'SKILL.md');
+        const skillPath = path_1.default.join(baseDir, packageName, 'SKILL.md');
         try {
             await fs_1.promises.access(skillPath);
             return skillPath;
@@ -72,7 +81,7 @@ async function findPackageLocation(id, format, subtype) {
         }
     }
     if (subtype === 'agent' || format === 'claude') {
-        const agentPath = path_1.default.join(baseDir, id, 'AGENT.md');
+        const agentPath = path_1.default.join(baseDir, packageName, 'AGENT.md');
         try {
             await fs_1.promises.access(agentPath);
             return agentPath;

package/dist/commands/login.js

@@ -140,10 +140,21 @@ async function loginWithOAuth(registryUrl) {
         }
         // Create the CLI auth URL with session token, callback, and userId
         const callbackUrl = 'http://localhost:8765/callback';
-        // Determine webapp URL - default to production
-        const webappUrl = registryUrl.includes('localhost')
-            ? registryUrl.replace(':3000', ':5173') // Local: localhost:3000 → localhost:5173
-            : 'https://prpm.dev'; // Production: always use prpm.dev
+        // Determine webapp URL based on registry URL
+        let webappUrl;
+        if (registryUrl.includes('localhost') || registryUrl.includes('127.0.0.1')) {
+            // Local development: registry on port 3111, webapp on port 5173
+            webappUrl = registryUrl.replace(':3111', ':5173');
+        }
+        else if (registryUrl.includes('registry.prpm.dev')) {
+            // Production: always use prpm.dev webapp
+            webappUrl = 'https://prpm.dev';
+        }
+        else {
+            // Custom registry: assume webapp is on same host without port
+            const url = new URL(registryUrl);
+            webappUrl = `${url.protocol}//${url.hostname}`;
+        }
         const authUrl = `${webappUrl}/cli-auth?sessionToken=${encodeURIComponent(connectSessionToken)}&cliCallback=${encodeURIComponent(callbackUrl)}&userId=${encodeURIComponent(userId)}`;
         console.log(`   Please open this link in your browser to authenticate:`);
         console.log(`   ${authUrl}\n`);

package/dist/commands/publish.js

@@ -54,27 +54,88 @@ const snippet_extractor_1 = require("../utils/snippet-extractor");
 /**
  * Try to find and load manifest files
  * Checks for:
- * 1. prpm.json (native format) - returns single manifest
+ * 1. prpm.json (native format) - returns single manifest or array of packages
  * 2. .claude/marketplace.json (Claude format) - returns all plugins as separate manifests
  * 3. .claude-plugin/marketplace.json (Claude format - alternative location) - returns all plugins
  */
 async function findAndLoadManifests() {
     // Try prpm.json first (native format)
     const prpmJsonPath = (0, path_1.join)(process.cwd(), 'prpm.json');
+    let prpmJsonExists = false;
+    let prpmJsonError = null;
     try {
         const content = await (0, promises_1.readFile)(prpmJsonPath, 'utf-8');
-        const manifest = JSON.parse(content);
+        prpmJsonExists = true;
+        // Try to parse JSON
+        let manifest;
+        try {
+            manifest = JSON.parse(content);
+        }
+        catch (parseError) {
+            // JSON parse error - provide specific error message
+            const error = parseError;
+            throw new Error(`Invalid JSON in prpm.json:\n\n` +
+                `${error.message}\n\n` +
+                `Please check your prpm.json file for syntax errors:\n` +
+                `  - Missing or extra commas\n` +
+                `  - Unclosed quotes or brackets\n` +
+                `  - Invalid JSON syntax\n\n` +
+                `You can validate your JSON at https://jsonlint.com/`);
+        }
+        // Check if this is a multi-package manifest
+        if ('packages' in manifest && Array.isArray(manifest.packages)) {
+            const multiManifest = manifest;
+            // Validate each package in the array
+            const validatedManifests = multiManifest.packages.map((pkg, idx) => {
+                // Inherit top-level fields if not specified in package - using explicit undefined checks
+                const packageWithDefaults = {
+                    name: pkg.name,
+                    version: pkg.version,
+                    description: pkg.description,
+                    format: pkg.format,
+                    files: pkg.files,
+                    author: pkg.author !== undefined ? pkg.author : multiManifest.author,
+                    license: pkg.license !== undefined ? pkg.license : multiManifest.license,
+                    repository: pkg.repository !== undefined ? pkg.repository : multiManifest.repository,
+                    homepage: pkg.homepage !== undefined ? pkg.homepage : multiManifest.homepage,
+                    documentation: pkg.documentation !== undefined ? pkg.documentation : multiManifest.documentation,
+                    organization: pkg.organization !== undefined ? pkg.organization : multiManifest.organization,
+                    private: pkg.private !== undefined ? pkg.private : multiManifest.private,
+                    tags: pkg.tags !== undefined ? pkg.tags : multiManifest.tags,
+                    keywords: pkg.keywords !== undefined ? pkg.keywords : multiManifest.keywords,
+                    subtype: pkg.subtype,
+                    dependencies: pkg.dependencies,
+                    peerDependencies: pkg.peerDependencies,
+                    engines: pkg.engines,
+                    main: pkg.main,
+                };
+                // Debug: Log inheritance only if DEBUG env var is set
+                if (process.env.DEBUG) {
+                    console.log(`\n🔍 Package ${pkg.name} inheritance:`);
+                    console.log(`   - Package-level private: ${pkg.private}`);
+                    console.log(`   - Top-level private: ${multiManifest.private}`);
+                    console.log(`   - Inherited private: ${packageWithDefaults.private}`);
+                    console.log('');
+                }
+                return validateManifest(packageWithDefaults);
+            });
+            return { manifests: validatedManifests, source: 'prpm.json (multi-package)' };
+        }
+        // Single package manifest
         const validated = validateManifest(manifest);
         return { manifests: [validated], source: 'prpm.json' };
     }
     catch (error) {
-        // If it's a validation error, throw it immediately (don't try marketplace.json)
-        if (error instanceof Error && (error.message.includes('Manifest validation failed') ||
+        // Store error for later
+        prpmJsonError = error;
+        // If it's a validation or parsing error, throw it immediately (don't try marketplace.json)
+        if (prpmJsonExists && error instanceof Error && (error.message.includes('Invalid JSON') ||
+            error.message.includes('Manifest validation failed') ||
             error.message.includes('Claude skill') ||
             error.message.includes('SKILL.md'))) {
             throw error;
         }
-        // Otherwise, prpm.json not found or invalid JSON, try marketplace.json
+        // Otherwise, prpm.json not found or other error, try marketplace.json
     }
     // Try .claude/marketplace.json (Claude format)
     const marketplaceJsonPath = (0, path_1.join)(process.cwd(), '.claude', 'marketplace.json');
@@ -316,6 +377,39 @@ async function handlePublish(options) {
                 console.log(`${'='.repeat(60)}\n`);
             }
             try {
+                // Debug: Log access override logic only if DEBUG env var is set
+                if (process.env.DEBUG) {
+                    console.log(`\n🔍 Before access override:`);
+                    console.log(`   - manifest.private: ${manifest.private}`);
+                    console.log(`   - options.access: ${options.access}`);
+                }
+                // Determine access level:
+                // 1. If --access flag is provided, it overrides manifest setting
+                // 2. Otherwise, use manifest setting (defaults to false/public if not specified)
+                let isPrivate;
+                if (options.access !== undefined) {
+                    // CLI flag explicitly provided - use it
+                    isPrivate = options.access === 'private';
+                    if (process.env.DEBUG) {
+                        console.log(`   - Using CLI flag override: ${options.access}`);
+                    }
+                }
+                else {
+                    // No CLI flag - use manifest setting
+                    isPrivate = manifest.private || false;
+                    if (process.env.DEBUG) {
+                        console.log(`   - Using manifest setting: ${isPrivate}`);
+                    }
+                }
+                if (process.env.DEBUG) {
+                    console.log(`   - calculated isPrivate: ${isPrivate}`);
+                }
+                // Update manifest with final private setting
+                manifest.private = isPrivate;
+                if (process.env.DEBUG) {
+                    console.log(`   - final manifest.private: ${manifest.private}`);
+                    console.log('');
+                }
                 let selectedOrgId;
                 // Check if organization is specified in manifest
                 if (manifest.organization && userInfo) {
@@ -334,6 +428,7 @@ async function handlePublish(options) {
                 console.log(`   Package: ${manifest.name}@${manifest.version}`);
                 console.log(`   Format: ${manifest.format} | Subtype: ${manifest.subtype}`);
                 console.log(`   Description: ${manifest.description}`);
+                console.log(`   Access: ${manifest.private ? 'private' : 'public'}`);
                 if (selectedOrgId && userInfo) {
                     const selectedOrg = userInfo.organizations.find((org) => org.id === selectedOrgId);
                     console.log(`   Publishing to: ${selectedOrg?.name || 'organization'}`);
@@ -512,7 +607,7 @@ async function handlePublish(options) {
 function createPublishCommand() {
     return new commander_1.Command('publish')
         .description('Publish a package to the registry')
-        .option('--access <type>', 'Package access (public or private)', 'public')
+        .option('--access <type>', 'Package access (public or private) - overrides manifest setting')
         .option('--tag <tag>', 'NPM-style tag (e.g., latest, beta)', 'latest')
         .option('--dry-run', 'Validate package without publishing')
         .action(async (options) => {

package/dist/core/filesystem.js

@@ -17,8 +17,13 @@ const fs_1 = require("fs");
 const path_1 = __importDefault(require("path"));
 /**
  * Get the destination directory for a package based on format and subtype
+ * @param format - Package format (cursor, claude, etc.)
+ * @param subtype - Package subtype (skill, agent, rule, etc.)
+ * @param name - Package name (optional, only needed for Claude skills which create subdirectories)
  */
 function getDestinationDir(format, subtype, name) {
+    // Strip author namespace from package name to avoid nested directories
+    const packageName = stripAuthorNamespace(name);
     switch (format) {
         case 'cursor':
             if (subtype === 'agent')
@@ -27,8 +32,11 @@ function getDestinationDir(format, subtype, name) {
                 return '.cursor/commands';
             return '.cursor/rules';
         case 'claude':
+            // Only create subdirectory for skills if name is provided
+            if (subtype === 'skill' && packageName)
+                return `.claude/skills/${packageName}`;
             if (subtype === 'skill')
-                return `.claude/skills/${name}`;
+                return '.claude/skills';
             if (subtype === 'slash-command')
                 return '.claude/commands';
             if (subtype === 'agent')
@@ -124,6 +132,10 @@ function generateId(filename) {
  * stripAuthorNamespace('git-workflow-manager') // 'git-workflow-manager'
  */
 function stripAuthorNamespace(packageId) {
+    // Handle undefined or empty string
+    if (!packageId) {
+        return '';
+    }
     // Split by '/' and get the last segment (the actual package name)
     const parts = packageId.split('/');
     return parts[parts.length - 1];

package/dist/core/user-config.js

@@ -1,58 +1,124 @@
 "use strict";
 /**
- * User configuration management for ~/.prpmrc
+ * User configuration management for ~/.prpmrc and .prpmrc
  * Stores global settings like registry URL and authentication token
+ * Supports both user-level (~/.prpmrc) and repository-level (.prpmrc) config
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConfig = getConfig;
 exports.saveConfig = saveConfig;
+exports.saveRepoConfig = saveRepoConfig;
+exports.getRepoConfig = getRepoConfig;
+exports.getUserConfig = getUserConfig;
 exports.updateConfig = updateConfig;
 exports.clearAuth = clearAuth;
 exports.getRegistryUrl = getRegistryUrl;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const os_1 = require("os");
-const CONFIG_FILE = (0, path_1.join)((0, os_1.homedir)(), '.prpmrc');
+const USER_CONFIG_FILE = (0, path_1.join)((0, os_1.homedir)(), '.prpmrc');
+const REPO_CONFIG_FILE = '.prpmrc';
 const DEFAULT_REGISTRY_URL = 'https://registry.prpm.dev';
 /**
- * Get user configuration
+ * Load configuration from a file
  */
-async function getConfig() {
+async function loadConfigFile(filePath) {
     try {
-        const data = await fs_1.promises.readFile(CONFIG_FILE, 'utf-8');
-        const config = JSON.parse(data);
-        // Allow environment variable to override registry URL
-        if (process.env.PRPM_REGISTRY_URL) {
-            config.registryUrl = process.env.PRPM_REGISTRY_URL;
-        }
-        else if (!config.registryUrl) {
-            config.registryUrl = DEFAULT_REGISTRY_URL;
-        }
-        return config;
+        const data = await fs_1.promises.readFile(filePath, 'utf-8');
+        return JSON.parse(data);
     }
     catch (error) {
-        // If file doesn't exist, return default config
         if (error.code === 'ENOENT') {
-            return {
-                registryUrl: process.env.PRPM_REGISTRY_URL || DEFAULT_REGISTRY_URL,
-                telemetryEnabled: true,
-            };
+            return null;
         }
-        throw new Error(`Failed to read user config: ${error}`);
+        throw new Error(`Failed to read config from ${filePath}: ${error}`);
+    }
+}
+/**
+ * Get merged configuration from user and repository levels
+ * Priority: CLI flags > environment > repo config > user config > defaults
+ */
+async function getConfig() {
+    // Load user-level config (~/.prpmrc)
+    const userConfig = await loadConfigFile(USER_CONFIG_FILE);
+    // Load repository-level config (./prpmrc)
+    const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+    const repoConfig = await loadConfigFile(repoConfigPath);
+    // Merge configs (repo overrides user)
+    const config = {
+        ...userConfig,
+        ...repoConfig,
+    };
+    // Deep merge nested objects
+    if (userConfig?.cursor || repoConfig?.cursor) {
+        config.cursor = {
+            ...userConfig?.cursor,
+            ...repoConfig?.cursor,
+        };
+    }
+    if (userConfig?.claude || repoConfig?.claude) {
+        config.claude = {
+            ...userConfig?.claude,
+            ...repoConfig?.claude,
+        };
+    }
+    if (userConfig?.collections || repoConfig?.collections) {
+        config.collections = {
+            ...userConfig?.collections,
+            ...repoConfig?.collections,
+        };
+    }
+    // Allow environment variable to override registry URL
+    if (process.env.PRPM_REGISTRY_URL) {
+        config.registryUrl = process.env.PRPM_REGISTRY_URL;
     }
+    else if (!config.registryUrl) {
+        config.registryUrl = DEFAULT_REGISTRY_URL;
+    }
+    // Set defaults
+    if (config.telemetryEnabled === undefined) {
+        config.telemetryEnabled = true;
+    }
+    return config;
 }
 /**
- * Save user configuration
+ * Save user configuration to ~/.prpmrc
  */
 async function saveConfig(config) {
     try {
         const data = JSON.stringify(config, null, 2);
-        await fs_1.promises.writeFile(CONFIG_FILE, data, 'utf-8');
+        await fs_1.promises.writeFile(USER_CONFIG_FILE, data, 'utf-8');
     }
     catch (error) {
         throw new Error(`Failed to save user config: ${error}`);
     }
 }
+/**
+ * Save repository configuration to ./.prpmrc
+ */
+async function saveRepoConfig(config) {
+    try {
+        const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+        const data = JSON.stringify(config, null, 2);
+        await fs_1.promises.writeFile(repoConfigPath, data, 'utf-8');
+    }
+    catch (error) {
+        throw new Error(`Failed to save repository config: ${error}`);
+    }
+}
+/**
+ * Get repository-level configuration only
+ */
+async function getRepoConfig() {
+    const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+    return await loadConfigFile(repoConfigPath);
+}
+/**
+ * Get user-level configuration only
+ */
+async function getUserConfig() {
+    return await loadConfigFile(USER_CONFIG_FILE);
+}
 /**
  * Update specific config values
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prpm",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "description": "Prompt Package Manager CLI - Install and manage prompt-based files",
   "main": "dist/index.js",
   "bin": {
@@ -45,8 +45,8 @@
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.0",
-    "@pr-pm/registry-client": "^1.2.5",
-    "@pr-pm/types": "^0.1.5",
+    "@pr-pm/registry-client": "^1.2.6",
+    "@pr-pm/types": "^0.1.6",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^11.1.0",

package/schemas/prpm-manifest.schema.json

@@ -148,6 +148,11 @@
         "my-company"
       ]
     },
+    "private": {
+      "type": "boolean",
+      "description": "Whether the package is private. Private packages are only accessible to the owner/organization members. Defaults to false (public).",
+      "default": false
+    },
     "tags": {
       "type": "array",
       "description": "Package tags for categorization",
@@ -354,6 +359,14 @@
           "node": ">=18.0.0"
         }
       ]
+    },
+    "packages": {
+      "type": "array",
+      "description": "Array of packages to publish from a single manifest (multi-package publishing). Packages inherit top-level fields unless overridden.",
+      "items": {
+        "$ref": "#"
+      },
+      "minItems": 1
     }
   },
   "additionalProperties": false,
@@ -491,6 +504,51 @@
       "files": [
         ".windsurfrules"
       ]
+    },
+    {
+      "name": "@company/private-package",
+      "version": "1.0.0",
+      "description": "A private package only accessible to organization members",
+      "format": "claude",
+      "subtype": "skill",
+      "author": "Company Team",
+      "organization": "my-company",
+      "private": true,
+      "license": "Proprietary",
+      "files": [
+        "internal-skill.md",
+        "README.md"
+      ]
+    },
+    {
+      "name": "@username/multi-package-example",
+      "version": "1.0.0",
+      "description": "Multi-package manifest example",
+      "author": "Your Name",
+      "license": "MIT",
+      "repository": "https://github.com/username/multi-package",
+      "packages": [
+        {
+          "name": "@username/package-one",
+          "version": "1.0.0",
+          "description": "First package in the multi-package manifest",
+          "format": "claude",
+          "subtype": "skill",
+          "files": [
+            "package-one/SKILL.md"
+          ]
+        },
+        {
+          "name": "@username/package-two",
+          "version": "1.0.0",
+          "description": "Second package with different settings",
+          "format": "cursor",
+          "private": true,
+          "files": [
+            "package-two/.cursor/rules/main.mdc"
+          ]
+        }
+      ]
     }
   ]
 }