prpm 0.0.11 → 0.0.13

package/dist/__tests__/e2e/test-helpers.js

@@ -77,7 +77,7 @@ async function createMockCollection(testDir, id, packages) {
 async function createMockConfig(configPath, options) {
     const config = {
         token: options.token || 'test-token-123',
-        registryUrl: options.registryUrl || 'http://localhost:3000',
+        registryUrl: options.registryUrl || 'http://localhost:3111',
     };
     await (0, promises_1.mkdir)((0, path_1.join)(configPath, '..'), { recursive: true });
     await (0, promises_1.writeFile)(configPath, JSON.stringify(config, null, 2));

package/dist/commands/catalog.js

@@ -0,0 +1,348 @@
+"use strict";
+/**
+ * Catalog command - Discover and catalog existing packages
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleCatalog = handleCatalog;
+exports.createCatalogCommand = createCatalogCommand;
+const commander_1 = require("commander");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const telemetry_1 = require("../core/telemetry");
+/**
+ * Detect format and subtype from file path and content
+ */
+function detectPackageInfo(filePath, content) {
+    const fileName = (0, path_1.basename)(filePath);
+    const lowerFileName = fileName.toLowerCase();
+    // Claude skills - SKILL.md files
+    if (fileName === 'SKILL.md') {
+        const dirName = (0, path_1.basename)((0, path_1.join)(filePath, '..'));
+        return {
+            format: 'claude',
+            subtype: 'skill',
+            name: dirName.toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    // Claude agents
+    if (filePath.includes('.claude/agents') || filePath.includes('.claude-plugin/agents')) {
+        return {
+            format: 'claude',
+            subtype: 'agent',
+            name: fileName.replace(/\.(md|txt)$/, '').toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    // Cursor rules
+    if (filePath.includes('.cursor/rules') || lowerFileName.endsWith('.mdc')) {
+        return {
+            format: 'cursor',
+            subtype: 'rule',
+            name: fileName.replace(/\.(md|mdc|txt)$/, '').toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    // Windsurf rules
+    if (filePath.includes('.windsurf/rules')) {
+        return {
+            format: 'windsurf',
+            subtype: 'rule',
+            name: fileName.replace(/\.(md|txt)$/, '').toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    // Continue config
+    if (filePath.includes('.continue/prompts')) {
+        return {
+            format: 'continue',
+            subtype: 'prompt',
+            name: fileName.replace(/\.(md|txt)$/, '').toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    // Generic markdown files in root that look like prompts
+    if (lowerFileName.endsWith('.md') && content.length > 50) {
+        return {
+            format: 'generic',
+            subtype: 'prompt',
+            name: fileName.replace(/\.md$/, '').toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+        };
+    }
+    return null;
+}
+/**
+ * Recursively scan directories for packages
+ */
+async function scanDirectory(dirPath, baseDir, scanDir, maxDepth = 5, currentDepth = 0) {
+    if (currentDepth > maxDepth) {
+        return [];
+    }
+    const discovered = [];
+    try {
+        const entries = await (0, promises_1.readdir)(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = (0, path_1.join)(dirPath, entry.name);
+            const relativePath = (0, path_1.relative)(baseDir, fullPath);
+            // Skip node_modules, .git, and other common dirs
+            if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist' || entry.name === 'build') {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                // Recursively scan subdirectories
+                const subDirPackages = await scanDirectory(fullPath, baseDir, scanDir, maxDepth, currentDepth + 1);
+                discovered.push(...subDirPackages);
+            }
+            else if (entry.isFile() && (entry.name.endsWith('.md') || entry.name.endsWith('.mdc') || entry.name.endsWith('.txt'))) {
+                // Check if this is a package file
+                try {
+                    const content = await (0, promises_1.readFile)(fullPath, 'utf-8');
+                    const packageInfo = detectPackageInfo(fullPath, content);
+                    if (packageInfo) {
+                        discovered.push({
+                            path: relativePath,
+                            format: packageInfo.format,
+                            subtype: packageInfo.subtype,
+                            name: packageInfo.name,
+                            files: [relativePath],
+                            scanDir,
+                        });
+                    }
+                }
+                catch (err) {
+                    // Skip files we can't read
+                }
+            }
+        }
+    }
+    catch (err) {
+        // Skip directories we can't read
+    }
+    return discovered;
+}
+/**
+ * Extract description from file content
+ * Tries multiple strategies:
+ * 1. YAML frontmatter (---\ndescription: ...\n---)
+ * 2. Markdown description field (description: ...)
+ * 3. First substantial paragraph after title
+ */
+function extractDescription(content) {
+    const lines = content.split('\n');
+    // Strategy 1: YAML frontmatter
+    if (lines[0]?.trim() === '---') {
+        let foundClosing = false;
+        let frontmatterLines = [];
+        for (let i = 1; i < lines.length && i < 50; i++) {
+            const line = lines[i];
+            if (line.trim() === '---') {
+                foundClosing = true;
+                break;
+            }
+            frontmatterLines.push(line);
+        }
+        if (foundClosing && frontmatterLines.length > 0) {
+            // Parse YAML-like frontmatter
+            for (const line of frontmatterLines) {
+                const match = line.match(/^description:\s*(.+)$/i);
+                if (match) {
+                    return match[1].trim().replace(/^["']|["']$/g, '').substring(0, 200);
+                }
+            }
+        }
+    }
+    // Strategy 2: Look for "description:" field anywhere in first 20 lines
+    for (let i = 0; i < Math.min(lines.length, 20); i++) {
+        const line = lines[i];
+        const match = line.match(/^description:\s*(.+)$/i);
+        if (match) {
+            return match[1].trim().replace(/^["']|["']$/g, '').substring(0, 200);
+        }
+    }
+    // Strategy 3: First substantial non-header paragraph
+    let foundTitle = false;
+    for (let i = 0; i < Math.min(lines.length, 30); i++) {
+        const line = lines[i].trim();
+        // Skip empty lines and YAML frontmatter
+        if (line === '' || line === '---') {
+            continue;
+        }
+        // Skip markdown headers
+        if (line.startsWith('#')) {
+            foundTitle = true;
+            continue;
+        }
+        // Found a substantial line after the title
+        if (foundTitle && line.length >= 20 && !line.startsWith('```')) {
+            return line.substring(0, 200);
+        }
+        // If no title found yet but line is substantial, use it
+        if (!foundTitle && line.length >= 30) {
+            return line.substring(0, 200);
+        }
+    }
+    return null;
+}
+/**
+ * Discover packages in specified directories
+ */
+async function handleCatalog(directories, options) {
+    const startTime = Date.now();
+    let success = false;
+    let error;
+    try {
+        console.log('🔍 Scanning for packages...\n');
+        const allDiscovered = [];
+        // Scan each directory
+        for (const dir of directories) {
+            console.log(`   Scanning ${dir}...`);
+            try {
+                const dirStat = await (0, promises_1.stat)(dir);
+                if (!dirStat.isDirectory()) {
+                    console.log(`   ⚠️  Skipping ${dir} (not a directory)`);
+                    continue;
+                }
+                const discovered = await scanDirectory(dir, dir, dir);
+                allDiscovered.push(...discovered);
+                console.log(`   Found ${discovered.length} package(s) in ${dir}`);
+            }
+            catch (err) {
+                console.log(`   ⚠️  Could not access ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        console.log(`\n✨ Discovered ${allDiscovered.length} package(s) total:\n`);
+        if (allDiscovered.length === 0) {
+            console.log('No packages found. Try scanning different directories.');
+            success = true;
+            return;
+        }
+        // Display discovered packages
+        const byFormat = new Map();
+        for (const pkg of allDiscovered) {
+            if (!byFormat.has(pkg.format)) {
+                byFormat.set(pkg.format, []);
+            }
+            byFormat.get(pkg.format).push(pkg);
+        }
+        for (const [format, packages] of byFormat.entries()) {
+            console.log(`📦 ${format} (${packages.length}):`);
+            for (const pkg of packages) {
+                console.log(`   - ${pkg.name} (${pkg.subtype}): ${pkg.path}`);
+            }
+            console.log('');
+        }
+        if (options.dryRun) {
+            console.log('🔍 Dry run - would update prpm.json\n');
+            success = true;
+            return;
+        }
+        // Load or create prpm.json
+        const prpmJsonPath = options.output || (0, path_1.join)(process.cwd(), 'prpm.json');
+        let manifest;
+        if (options.append) {
+            try {
+                const existingContent = await (0, promises_1.readFile)(prpmJsonPath, 'utf-8');
+                const existing = JSON.parse(existingContent);
+                // Check if it's a multi-package manifest
+                if ('packages' in existing && Array.isArray(existing.packages)) {
+                    manifest = existing;
+                }
+                else {
+                    // Convert single package to multi-package
+                    manifest = {
+                        name: 'multi-package',
+                        version: '1.0.0',
+                        packages: [existing],
+                    };
+                }
+            }
+            catch (err) {
+                // File doesn't exist, create new
+                manifest = {
+                    name: 'multi-package',
+                    version: '1.0.0',
+                    packages: [],
+                };
+            }
+        }
+        else {
+            manifest = {
+                name: 'multi-package',
+                version: '1.0.0',
+                packages: [],
+            };
+        }
+        // Convert discovered packages to manifests
+        const existingNames = new Set(manifest.packages.map(p => p.name));
+        let addedCount = 0;
+        for (const discovered of allDiscovered) {
+            // Skip if already exists
+            if (existingNames.has(discovered.name)) {
+                console.log(`   ⚠️  Skipping ${discovered.name} (already in prpm.json)`);
+                continue;
+            }
+            // Extract description from first file
+            let description = `${discovered.format} ${discovered.subtype}`;
+            try {
+                const firstFilePath = (0, path_1.join)(process.cwd(), discovered.scanDir, discovered.files[0]);
+                const content = await (0, promises_1.readFile)(firstFilePath, 'utf-8');
+                const extractedDesc = extractDescription(content);
+                if (extractedDesc) {
+                    description = extractedDesc;
+                }
+            }
+            catch (err) {
+                // Use default description
+            }
+            const packageManifest = {
+                name: discovered.name,
+                version: '1.0.0',
+                description,
+                author: '', // User should fill this in
+                format: discovered.format,
+                subtype: discovered.subtype,
+                files: discovered.files,
+            };
+            manifest.packages.push(packageManifest);
+            addedCount++;
+        }
+        // Write updated prpm.json
+        await (0, promises_1.writeFile)(prpmJsonPath, JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
+        console.log(`\n✅ Updated ${prpmJsonPath}`);
+        console.log(`   Added ${addedCount} new package(s)`);
+        console.log(`   Total: ${manifest.packages.length} package(s)\n`);
+        console.log('💡 Next steps:');
+        console.log('   1. Review and edit package metadata in prpm.json');
+        console.log('   2. Add author, license, and other fields');
+        console.log('   3. Run: prpm publish --dry-run to validate');
+        console.log('   4. Run: prpm publish to publish packages\n');
+        success = true;
+    }
+    catch (err) {
+        error = err instanceof Error ? err.message : String(err);
+        console.error(`\n❌ Failed to catalog packages: ${error}\n`);
+        process.exit(1);
+    }
+    finally {
+        await telemetry_1.telemetry.track({
+            command: 'catalog',
+            success,
+            error,
+            duration: Date.now() - startTime,
+            data: {
+                directories: directories.length,
+            },
+        });
+        await telemetry_1.telemetry.shutdown();
+    }
+}
+/**
+ * Create the catalog command
+ */
+function createCatalogCommand() {
+    return new commander_1.Command('catalog')
+        .description('Discover and catalog existing packages from directories')
+        .argument('[directories...]', 'Directories to scan for packages (defaults to current directory)', ['.'])
+        .option('-o, --output <path>', 'Output path for prpm.json (default: ./prpm.json)')
+        .option('-a, --append', 'Append to existing prpm.json instead of overwriting')
+        .option('--dry-run', 'Show what would be cataloged without making changes')
+        .action(async (directories, options) => {
+        await handleCatalog(directories, options);
+        process.exit(0);
+    });
+}

package/dist/commands/collections.js

@@ -47,6 +47,7 @@ const registry_client_1 = require("@pr-pm/registry-client");
 const user_config_1 = require("../core/user-config");
 const install_1 = require("./install");
 const telemetry_1 = require("../core/telemetry");
+const lockfile_1 = require("../core/lockfile");
 /**
  * Search collections by query
  */
@@ -494,6 +495,7 @@ async function handleCollectionInstall(collectionSpec, options) {
             return;
         }
         // Install packages sequentially
+        const installedPackageIds = [];
         for (let i = 0; i < packages.length; i++) {
             const pkg = packages[i];
             const progress = `${i + 1}/${packages.length}`;
@@ -501,8 +503,14 @@ async function handleCollectionInstall(collectionSpec, options) {
                 console.log(`\n  ${progress} Installing ${pkg.packageId}@${pkg.version}...`);
                 await (0, install_1.handleInstall)(`${pkg.packageId}@${pkg.version}`, {
                     as: pkg.format,
+                    fromCollection: {
+                        scope,
+                        name_slug,
+                        version: collection.version || version || '1.0.0',
+                    },
                 });
                 console.log(`  ${progress} ✓ ${pkg.packageId}`);
+                installedPackageIds.push(pkg.packageId);
                 packagesInstalled++;
             }
             catch (error) {
@@ -514,11 +522,22 @@ async function handleCollectionInstall(collectionSpec, options) {
                 }
             }
         }
+        // Update lockfile with collection info
+        const lockfile = (await (0, lockfile_1.readLockfile)()) || (0, lockfile_1.createLockfile)();
+        const collectionKey = `@${scope}/${name_slug}`;
+        (0, lockfile_1.addCollectionToLockfile)(lockfile, collectionKey, {
+            scope,
+            name_slug,
+            version: collection.version || version || '1.0.0',
+            packages: installedPackageIds,
+        });
+        await (0, lockfile_1.writeLockfile)(lockfile);
         console.log(`\n✅ Collection installed successfully!`);
         console.log(`   ${packagesInstalled}/${packages.length} packages installed`);
         if (packagesFailed > 0) {
             console.log(`   ${packagesFailed} optional packages failed`);
         }
+        console.log(`   🔒 Collection tracked in lock file`);
         console.log('');
         await telemetry_1.telemetry.track({
             command: 'collections:install',

package/dist/commands/install.js

@@ -364,6 +364,7 @@ async function handleInstall(packageSpec, options) {
             format: pkg.format, // Preserve original package format
             subtype: pkg.subtype, // Preserve original package subtype
             installedPath: destPath,
+            fromCollection: options.fromCollection,
         });
         (0, lockfile_1.setPackageIntegrity)(updatedLockfile, packageId, tarball);
         await (0, lockfile_1.writeLockfile)(updatedLockfile);

package/dist/commands/list.js

@@ -40,6 +40,13 @@ function getDestinationDir(type) {
             return '.prompts';
     }
 }
+/**
+ * Strip author namespace from package ID
+ */
+function stripAuthorNamespace(packageId) {
+    const parts = packageId.split('/');
+    return parts[parts.length - 1];
+}
 /**
  * Find the actual file location for a package
  */
@@ -47,11 +54,13 @@ async function findPackageLocation(id, format, subtype) {
     if (!format)
         return null;
     const baseDir = getDestinationDir(format);
+    // Strip author namespace to get actual package name used in file system
+    const packageName = stripAuthorNamespace(id);
     // Try different file extensions based on format
     const extensions = format === 'cursor' ? ['.mdc', '.md'] : ['.md'];
-    // Try direct file: <dir>/<id>.ext
+    // Try direct file: <dir>/<packageName>.ext
     for (const ext of extensions) {
-        const directPath = path_1.default.join(baseDir, `${id}${ext}`);
+        const directPath = path_1.default.join(baseDir, `${packageName}${ext}`);
         try {
             await fs_1.promises.access(directPath);
             return directPath;
@@ -60,9 +69,9 @@ async function findPackageLocation(id, format, subtype) {
             // File doesn't exist, continue
         }
     }
-    // Try subdirectory: <dir>/<id>/SKILL.md or <dir>/<id>/AGENT.md
+    // Try subdirectory: <dir>/<packageName>/SKILL.md or <dir>/<packageName>/AGENT.md
     if (subtype === 'skill') {
-        const skillPath = path_1.default.join(baseDir, id, 'SKILL.md');
+        const skillPath = path_1.default.join(baseDir, packageName, 'SKILL.md');
         try {
             await fs_1.promises.access(skillPath);
             return skillPath;
@@ -72,7 +81,7 @@ async function findPackageLocation(id, format, subtype) {
         }
     }
     if (subtype === 'agent' || format === 'claude') {
-        const agentPath = path_1.default.join(baseDir, id, 'AGENT.md');
+        const agentPath = path_1.default.join(baseDir, packageName, 'AGENT.md');
         try {
             await fs_1.promises.access(agentPath);
             return agentPath;

package/dist/commands/login.js

@@ -140,10 +140,21 @@ async function loginWithOAuth(registryUrl) {
         }
         // Create the CLI auth URL with session token, callback, and userId
         const callbackUrl = 'http://localhost:8765/callback';
-        // Determine webapp URL - default to production
-        const webappUrl = registryUrl.includes('localhost')
-            ? registryUrl.replace(':3000', ':5173') // Local: localhost:3000 → localhost:5173
-            : 'https://prpm.dev'; // Production: always use prpm.dev
+        // Determine webapp URL based on registry URL
+        let webappUrl;
+        if (registryUrl.includes('localhost') || registryUrl.includes('127.0.0.1')) {
+            // Local development: registry on port 3111, webapp on port 5173
+            webappUrl = registryUrl.replace(':3111', ':5173');
+        }
+        else if (registryUrl.includes('registry.prpm.dev')) {
+            // Production: always use prpm.dev webapp
+            webappUrl = 'https://prpm.dev';
+        }
+        else {
+            // Custom registry: assume webapp is on same host without port
+            const url = new URL(registryUrl);
+            webappUrl = `${url.protocol}//${url.hostname}`;
+        }
         const authUrl = `${webappUrl}/cli-auth?sessionToken=${encodeURIComponent(connectSessionToken)}&cliCallback=${encodeURIComponent(callbackUrl)}&userId=${encodeURIComponent(userId)}`;
         console.log(`   Please open this link in your browser to authenticate:`);
         console.log(`   ${authUrl}\n`);

package/dist/commands/publish.js

@@ -54,27 +54,88 @@ const snippet_extractor_1 = require("../utils/snippet-extractor");
 /**
  * Try to find and load manifest files
  * Checks for:
- * 1. prpm.json (native format) - returns single manifest
+ * 1. prpm.json (native format) - returns single manifest or array of packages
  * 2. .claude/marketplace.json (Claude format) - returns all plugins as separate manifests
  * 3. .claude-plugin/marketplace.json (Claude format - alternative location) - returns all plugins
  */
 async function findAndLoadManifests() {
     // Try prpm.json first (native format)
     const prpmJsonPath = (0, path_1.join)(process.cwd(), 'prpm.json');
+    let prpmJsonExists = false;
+    let prpmJsonError = null;
     try {
         const content = await (0, promises_1.readFile)(prpmJsonPath, 'utf-8');
-        const manifest = JSON.parse(content);
+        prpmJsonExists = true;
+        // Try to parse JSON
+        let manifest;
+        try {
+            manifest = JSON.parse(content);
+        }
+        catch (parseError) {
+            // JSON parse error - provide specific error message
+            const error = parseError;
+            throw new Error(`Invalid JSON in prpm.json:\n\n` +
+                `${error.message}\n\n` +
+                `Please check your prpm.json file for syntax errors:\n` +
+                `  - Missing or extra commas\n` +
+                `  - Unclosed quotes or brackets\n` +
+                `  - Invalid JSON syntax\n\n` +
+                `You can validate your JSON at https://jsonlint.com/`);
+        }
+        // Check if this is a multi-package manifest
+        if ('packages' in manifest && Array.isArray(manifest.packages)) {
+            const multiManifest = manifest;
+            // Validate each package in the array
+            const validatedManifests = multiManifest.packages.map((pkg, idx) => {
+                // Inherit top-level fields if not specified in package - using explicit undefined checks
+                const packageWithDefaults = {
+                    name: pkg.name,
+                    version: pkg.version,
+                    description: pkg.description,
+                    format: pkg.format,
+                    files: pkg.files,
+                    author: pkg.author !== undefined ? pkg.author : multiManifest.author,
+                    license: pkg.license !== undefined ? pkg.license : multiManifest.license,
+                    repository: pkg.repository !== undefined ? pkg.repository : multiManifest.repository,
+                    homepage: pkg.homepage !== undefined ? pkg.homepage : multiManifest.homepage,
+                    documentation: pkg.documentation !== undefined ? pkg.documentation : multiManifest.documentation,
+                    organization: pkg.organization !== undefined ? pkg.organization : multiManifest.organization,
+                    private: pkg.private !== undefined ? pkg.private : multiManifest.private,
+                    tags: pkg.tags !== undefined ? pkg.tags : multiManifest.tags,
+                    keywords: pkg.keywords !== undefined ? pkg.keywords : multiManifest.keywords,
+                    subtype: pkg.subtype,
+                    dependencies: pkg.dependencies,
+                    peerDependencies: pkg.peerDependencies,
+                    engines: pkg.engines,
+                    main: pkg.main,
+                };
+                // Debug: Log inheritance only if DEBUG env var is set
+                if (process.env.DEBUG) {
+                    console.log(`\n🔍 Package ${pkg.name} inheritance:`);
+                    console.log(`   - Package-level private: ${pkg.private}`);
+                    console.log(`   - Top-level private: ${multiManifest.private}`);
+                    console.log(`   - Inherited private: ${packageWithDefaults.private}`);
+                    console.log('');
+                }
+                return validateManifest(packageWithDefaults);
+            });
+            return { manifests: validatedManifests, source: 'prpm.json (multi-package)' };
+        }
+        // Single package manifest
         const validated = validateManifest(manifest);
         return { manifests: [validated], source: 'prpm.json' };
     }
     catch (error) {
-        // If it's a validation error, throw it immediately (don't try marketplace.json)
-        if (error instanceof Error && (error.message.includes('Manifest validation failed') ||
+        // Store error for later
+        prpmJsonError = error;
+        // If it's a validation or parsing error, throw it immediately (don't try marketplace.json)
+        if (prpmJsonExists && error instanceof Error && (error.message.includes('Invalid JSON') ||
+            error.message.includes('Manifest validation failed') ||
             error.message.includes('Claude skill') ||
             error.message.includes('SKILL.md'))) {
             throw error;
         }
-        // Otherwise, prpm.json not found or invalid JSON, try marketplace.json
+        // Otherwise, prpm.json not found or other error, try marketplace.json
     }
     // Try .claude/marketplace.json (Claude format)
     const marketplaceJsonPath = (0, path_1.join)(process.cwd(), '.claude', 'marketplace.json');
@@ -302,6 +363,29 @@ async function handlePublish(options) {
             console.log('   Could not fetch user organizations, publishing as personal packages');
         }
         console.log('');
+        // Check for duplicate package names
+        if (manifests.length > 1) {
+            const nameMap = new Map();
+            const duplicates = [];
+            manifests.forEach((manifest, index) => {
+                const existingIndex = nameMap.get(manifest.name);
+                if (existingIndex !== undefined) {
+                    duplicates.push(`  - "${manifest.name}" appears in positions ${existingIndex + 1} and ${index + 1}`);
+                }
+                else {
+                    nameMap.set(manifest.name, index);
+                }
+            });
+            if (duplicates.length > 0) {
+                console.error('❌ Duplicate package names detected:\n');
+                duplicates.forEach(dup => console.error(dup));
+                console.error('\n⚠️  Each package must have a unique name.');
+                console.error('   Package names are globally unique per author/organization.');
+                console.error('   If you want to publish the same package for different formats,');
+                console.error('   use different names (e.g., "react-rules-cursor" vs "react-rules-claude").\n');
+                throw new Error('Cannot publish packages with duplicate names');
+            }
+        }
         // Track published packages
         const publishedPackages = [];
         const failedPackages = [];
@@ -316,6 +400,39 @@ async function handlePublish(options) {
                 console.log(`${'='.repeat(60)}\n`);
             }
             try {
+                // Debug: Log access override logic only if DEBUG env var is set
+                if (process.env.DEBUG) {
+                    console.log(`\n🔍 Before access override:`);
+                    console.log(`   - manifest.private: ${manifest.private}`);
+                    console.log(`   - options.access: ${options.access}`);
+                }
+                // Determine access level:
+                // 1. If --access flag is provided, it overrides manifest setting
+                // 2. Otherwise, use manifest setting (defaults to false/public if not specified)
+                let isPrivate;
+                if (options.access !== undefined) {
+                    // CLI flag explicitly provided - use it
+                    isPrivate = options.access === 'private';
+                    if (process.env.DEBUG) {
+                        console.log(`   - Using CLI flag override: ${options.access}`);
+                    }
+                }
+                else {
+                    // No CLI flag - use manifest setting
+                    isPrivate = manifest.private || false;
+                    if (process.env.DEBUG) {
+                        console.log(`   - Using manifest setting: ${isPrivate}`);
+                    }
+                }
+                if (process.env.DEBUG) {
+                    console.log(`   - calculated isPrivate: ${isPrivate}`);
+                }
+                // Update manifest with final private setting
+                manifest.private = isPrivate;
+                if (process.env.DEBUG) {
+                    console.log(`   - final manifest.private: ${manifest.private}`);
+                    console.log('');
+                }
                 let selectedOrgId;
                 // Check if organization is specified in manifest
                 if (manifest.organization && userInfo) {
@@ -334,6 +451,7 @@ async function handlePublish(options) {
                 console.log(`   Package: ${manifest.name}@${manifest.version}`);
                 console.log(`   Format: ${manifest.format} | Subtype: ${manifest.subtype}`);
                 console.log(`   Description: ${manifest.description}`);
+                console.log(`   Access: ${manifest.private ? 'private' : 'public'}`);
                 if (selectedOrgId && userInfo) {
                     const selectedOrg = userInfo.organizations.find((org) => org.id === selectedOrgId);
                     console.log(`   Publishing to: ${selectedOrg?.name || 'organization'}`);
@@ -512,7 +630,7 @@ async function handlePublish(options) {
 function createPublishCommand() {
     return new commander_1.Command('publish')
         .description('Publish a package to the registry')
-        .option('--access <type>', 'Package access (public or private)', 'public')
+        .option('--access <type>', 'Package access (public or private) - overrides manifest setting')
         .option('--tag <tag>', 'NPM-style tag (e.g., latest, beta)', 'latest')
         .option('--dry-run', 'Validate package without publishing')
         .action(async (options) => {

package/dist/core/filesystem.js

@@ -13,12 +13,19 @@ exports.deleteFile = deleteFile;
 exports.fileExists = fileExists;
 exports.generateId = generateId;
 exports.stripAuthorNamespace = stripAuthorNamespace;
+exports.getInstalledFilePath = getInstalledFilePath;
+exports.getInstalledFilePaths = getInstalledFilePaths;
 const fs_1 = require("fs");
 const path_1 = __importDefault(require("path"));
 /**
  * Get the destination directory for a package based on format and subtype
+ * @param format - Package format (cursor, claude, etc.)
+ * @param subtype - Package subtype (skill, agent, rule, etc.)
+ * @param name - Package name (optional, only needed for Claude skills which create subdirectories)
  */
 function getDestinationDir(format, subtype, name) {
+    // Strip author namespace from package name to avoid nested directories
+    const packageName = stripAuthorNamespace(name);
     switch (format) {
         case 'cursor':
             if (subtype === 'agent')
@@ -27,8 +34,11 @@ function getDestinationDir(format, subtype, name) {
                 return '.cursor/commands';
             return '.cursor/rules';
         case 'claude':
+            // Only create subdirectory for skills if name is provided
+            if (subtype === 'skill' && packageName)
+                return `.claude/skills/${packageName}`;
             if (subtype === 'skill')
-                return `.claude/skills/${name}`;
+                return '.claude/skills';
             if (subtype === 'slash-command')
                 return '.claude/commands';
             if (subtype === 'agent')
@@ -124,7 +134,50 @@ function generateId(filename) {
  * stripAuthorNamespace('git-workflow-manager') // 'git-workflow-manager'
  */
 function stripAuthorNamespace(packageId) {
+    // Handle undefined or empty string
+    if (!packageId) {
+        return '';
+    }
     // Split by '/' and get the last segment (the actual package name)
     const parts = packageId.split('/');
     return parts[parts.length - 1];
 }
+/**
+ * Get the expected installed file path for a package
+ * This matches the logic used by the install command to determine where files are placed
+ *
+ * @param packageName - Full package name (e.g., '@prpm/typescript-rules')
+ * @param format - Package format
+ * @param subtype - Package subtype
+ * @param fileName - Optional specific file name (defaults to main file)
+ * @returns Path where the file will be installed relative to working directory
+ */
+function getInstalledFilePath(packageName, format, subtype, fileName) {
+    const destDir = getDestinationDir(format, subtype, packageName);
+    const packageBaseName = stripAuthorNamespace(packageName);
+    // If a specific file name is provided, use it
+    if (fileName) {
+        return path_1.default.join(destDir, fileName);
+    }
+    // Claude skills always use SKILL.md
+    if (format === 'claude' && subtype === 'skill') {
+        return path_1.default.join(destDir, 'SKILL.md');
+    }
+    // Determine file extension
+    const fileExtension = format === 'cursor' ? 'mdc' : 'md';
+    // For other formats, use package name as filename
+    return path_1.default.join(destDir, `${packageBaseName}.${fileExtension}`);
+}
+/**
+ * Get all expected installed file paths for a multi-file package
+ *
+ * @param packageName - Full package name
+ * @param format - Package format
+ * @param subtype - Package subtype
+ * @param fileNames - Array of file names in the package
+ * @returns Array of paths where files will be installed
+ */
+function getInstalledFilePaths(packageName, format, subtype, fileNames) {
+    const destDir = getDestinationDir(format, subtype, packageName);
+    return fileNames.map(fileName => path_1.default.join(destDir, fileName));
+}

package/dist/core/lockfile.js

@@ -18,6 +18,10 @@ exports.addPackage = addPackage;
 exports.removePackage = removePackage;
 exports.listPackages = listPackages;
 exports.getPackage = getPackage;
+exports.addCollectionToLockfile = addCollectionToLockfile;
+exports.getCollectionFromLockfile = getCollectionFromLockfile;
+exports.removeCollectionFromLockfile = removeCollectionFromLockfile;
+exports.listCollectionsFromLockfile = listCollectionsFromLockfile;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
@@ -75,6 +79,7 @@ function addToLockfile(lockfile, packageId, packageInfo) {
         format: packageInfo.format,
         subtype: packageInfo.subtype,
         installedPath: packageInfo.installedPath,
+        fromCollection: packageInfo.fromCollection,
     };
     lockfile.generated = new Date().toISOString();
 }
@@ -237,3 +242,50 @@ async function getPackage(packageId) {
     }
     return lockfile.packages[packageId];
 }
+/**
+ * Add or update collection in lock file
+ */
+function addCollectionToLockfile(lockfile, collectionKey, collectionInfo) {
+    if (!lockfile.collections) {
+        lockfile.collections = {};
+    }
+    lockfile.collections[collectionKey] = {
+        scope: collectionInfo.scope,
+        name_slug: collectionInfo.name_slug,
+        version: collectionInfo.version,
+        installedAt: new Date().toISOString(),
+        packages: collectionInfo.packages,
+    };
+    lockfile.generated = new Date().toISOString();
+}
+/**
+ * Get collection from lock file
+ */
+function getCollectionFromLockfile(lockfile, collectionKey) {
+    if (!lockfile || !lockfile.collections) {
+        return null;
+    }
+    return lockfile.collections[collectionKey] || null;
+}
+/**
+ * Remove collection from lock file
+ */
+function removeCollectionFromLockfile(lockfile, collectionKey) {
+    if (!lockfile.collections) {
+        return;
+    }
+    delete lockfile.collections[collectionKey];
+    lockfile.generated = new Date().toISOString();
+}
+/**
+ * List all collections in lock file
+ */
+function listCollectionsFromLockfile(lockfile) {
+    if (!lockfile || !lockfile.collections) {
+        return [];
+    }
+    return Object.entries(lockfile.collections).map(([key, collection]) => ({
+        key,
+        ...collection,
+    }));
+}

package/dist/core/user-config.js

@@ -1,58 +1,124 @@
 "use strict";
 /**
- * User configuration management for ~/.prpmrc
+ * User configuration management for ~/.prpmrc and .prpmrc
  * Stores global settings like registry URL and authentication token
+ * Supports both user-level (~/.prpmrc) and repository-level (.prpmrc) config
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConfig = getConfig;
 exports.saveConfig = saveConfig;
+exports.saveRepoConfig = saveRepoConfig;
+exports.getRepoConfig = getRepoConfig;
+exports.getUserConfig = getUserConfig;
 exports.updateConfig = updateConfig;
 exports.clearAuth = clearAuth;
 exports.getRegistryUrl = getRegistryUrl;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const os_1 = require("os");
-const CONFIG_FILE = (0, path_1.join)((0, os_1.homedir)(), '.prpmrc');
+const USER_CONFIG_FILE = (0, path_1.join)((0, os_1.homedir)(), '.prpmrc');
+const REPO_CONFIG_FILE = '.prpmrc';
 const DEFAULT_REGISTRY_URL = 'https://registry.prpm.dev';
 /**
- * Get user configuration
+ * Load configuration from a file
  */
-async function getConfig() {
+async function loadConfigFile(filePath) {
     try {
-        const data = await fs_1.promises.readFile(CONFIG_FILE, 'utf-8');
-        const config = JSON.parse(data);
-        // Allow environment variable to override registry URL
-        if (process.env.PRPM_REGISTRY_URL) {
-            config.registryUrl = process.env.PRPM_REGISTRY_URL;
-        }
-        else if (!config.registryUrl) {
-            config.registryUrl = DEFAULT_REGISTRY_URL;
-        }
-        return config;
+        const data = await fs_1.promises.readFile(filePath, 'utf-8');
+        return JSON.parse(data);
     }
     catch (error) {
-        // If file doesn't exist, return default config
         if (error.code === 'ENOENT') {
-            return {
-                registryUrl: process.env.PRPM_REGISTRY_URL || DEFAULT_REGISTRY_URL,
-                telemetryEnabled: true,
-            };
+            return null;
         }
-        throw new Error(`Failed to read user config: ${error}`);
+        throw new Error(`Failed to read config from ${filePath}: ${error}`);
+    }
+}
+/**
+ * Get merged configuration from user and repository levels
+ * Priority: CLI flags > environment > repo config > user config > defaults
+ */
+async function getConfig() {
+    // Load user-level config (~/.prpmrc)
+    const userConfig = await loadConfigFile(USER_CONFIG_FILE);
+    // Load repository-level config (./prpmrc)
+    const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+    const repoConfig = await loadConfigFile(repoConfigPath);
+    // Merge configs (repo overrides user)
+    const config = {
+        ...userConfig,
+        ...repoConfig,
+    };
+    // Deep merge nested objects
+    if (userConfig?.cursor || repoConfig?.cursor) {
+        config.cursor = {
+            ...userConfig?.cursor,
+            ...repoConfig?.cursor,
+        };
+    }
+    if (userConfig?.claude || repoConfig?.claude) {
+        config.claude = {
+            ...userConfig?.claude,
+            ...repoConfig?.claude,
+        };
+    }
+    if (userConfig?.collections || repoConfig?.collections) {
+        config.collections = {
+            ...userConfig?.collections,
+            ...repoConfig?.collections,
+        };
+    }
+    // Allow environment variable to override registry URL
+    if (process.env.PRPM_REGISTRY_URL) {
+        config.registryUrl = process.env.PRPM_REGISTRY_URL;
     }
+    else if (!config.registryUrl) {
+        config.registryUrl = DEFAULT_REGISTRY_URL;
+    }
+    // Set defaults
+    if (config.telemetryEnabled === undefined) {
+        config.telemetryEnabled = true;
+    }
+    return config;
 }
 /**
- * Save user configuration
+ * Save user configuration to ~/.prpmrc
  */
 async function saveConfig(config) {
     try {
         const data = JSON.stringify(config, null, 2);
-        await fs_1.promises.writeFile(CONFIG_FILE, data, 'utf-8');
+        await fs_1.promises.writeFile(USER_CONFIG_FILE, data, 'utf-8');
     }
     catch (error) {
         throw new Error(`Failed to save user config: ${error}`);
     }
 }
+/**
+ * Save repository configuration to ./.prpmrc
+ */
+async function saveRepoConfig(config) {
+    try {
+        const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+        const data = JSON.stringify(config, null, 2);
+        await fs_1.promises.writeFile(repoConfigPath, data, 'utf-8');
+    }
+    catch (error) {
+        throw new Error(`Failed to save repository config: ${error}`);
+    }
+}
+/**
+ * Get repository-level configuration only
+ */
+async function getRepoConfig() {
+    const repoConfigPath = (0, path_1.join)(process.cwd(), REPO_CONFIG_FILE);
+    return await loadConfigFile(repoConfigPath);
+}
+/**
+ * Get user-level configuration only
+ */
+async function getUserConfig() {
+    return await loadConfigFile(USER_CONFIG_FILE);
+}
 /**
  * Update specific config values
  */

package/dist/index.js

@@ -25,6 +25,7 @@ const upgrade_1 = require("./commands/upgrade");
 const schema_1 = require("./commands/schema");
 const init_1 = require("./commands/init");
 const config_1 = require("./commands/config");
+const catalog_1 = require("./commands/catalog");
 const telemetry_2 = require("./core/telemetry");
 // Read version from package.json
 function getVersion() {
@@ -44,6 +45,7 @@ program
     .version(getVersion());
 // Package creation commands
 program.addCommand((0, init_1.createInitCommand)());
+program.addCommand((0, catalog_1.createCatalogCommand)());
 // Registry commands (new)
 program.addCommand((0, search_1.createSearchCommand)());
 program.addCommand((0, install_1.createInstallCommand)());

package/dist/utils/snippet-extractor.js

@@ -8,30 +8,45 @@ exports.extractSnippet = extractSnippet;
 exports.validateSnippet = validateSnippet;
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
+const filesystem_1 = require("../core/filesystem");
 const MAX_SNIPPET_LENGTH = 2000;
 /**
  * Extract a preview snippet from package files
- * Takes the first file in the package and extracts ~2000 characters
+ * Uses the same path logic as the install command to determine where files will be placed
  */
 async function extractSnippet(manifest) {
     const cwd = process.cwd();
     try {
-        // Get the first file from the manifest
-        const firstFile = manifest.files[0];
-        if (!firstFile) {
+        // Validate manifest has required fields
+        if (!manifest.format || !manifest.name || !manifest.subtype) {
+            console.warn('⚠️  Cannot extract snippet: manifest missing format, name, or subtype');
             return null;
         }
-        // Get file path (handle both string and object formats)
-        const filePath = typeof firstFile === 'string'
-            ? firstFile
-            : firstFile.path;
-        // If there's a main file specified, prefer that
-        const targetFile = manifest.main || filePath;
-        const fullPath = (0, path_1.join)(cwd, targetFile);
+        // Determine which file to extract snippet from
+        let targetFilePath;
+        if (manifest.main) {
+            // If main file is specified, use it directly (for multi-file packages)
+            targetFilePath = (0, filesystem_1.getInstalledFilePath)(manifest.name, manifest.format, manifest.subtype, manifest.main);
+        }
+        else if (manifest.files && manifest.files.length > 0) {
+            // Get the first file from the manifest
+            const firstFile = manifest.files[0];
+            const fileName = typeof firstFile === 'string'
+                ? firstFile
+                : firstFile.path;
+            // For single-file packages or when no main is specified,
+            // use the format-aware path construction
+            targetFilePath = (0, filesystem_1.getInstalledFilePath)(manifest.name, manifest.format, manifest.subtype, fileName);
+        }
+        else {
+            // No files specified, try to construct the default path
+            targetFilePath = (0, filesystem_1.getInstalledFilePath)(manifest.name, manifest.format, manifest.subtype);
+        }
+        const fullPath = (0, path_1.join)(cwd, targetFilePath);
         // Check if path is a directory
         const stats = await (0, promises_1.stat)(fullPath);
         if (stats.isDirectory()) {
-            console.warn(`⚠️  Skipping snippet extraction: "${targetFile}" is a directory`);
+            console.warn(`⚠️  Skipping snippet extraction: "${targetFilePath}" is a directory`);
             return null;
         }
         // Read the file content

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prpm",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "description": "Prompt Package Manager CLI - Install and manage prompt-based files",
   "main": "dist/index.js",
   "bin": {
@@ -45,8 +45,8 @@
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.0",
-    "@pr-pm/registry-client": "^1.2.5",
-    "@pr-pm/types": "^0.1.5",
+    "@pr-pm/registry-client": "^1.2.7",
+    "@pr-pm/types": "^0.1.7",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^11.1.0",

package/schemas/prpm-manifest.schema.json

@@ -148,6 +148,11 @@
         "my-company"
       ]
     },
+    "private": {
+      "type": "boolean",
+      "description": "Whether the package is private. Private packages are only accessible to the owner/organization members. Defaults to false (public).",
+      "default": false
+    },
     "tags": {
       "type": "array",
       "description": "Package tags for categorization",
@@ -354,6 +359,14 @@
           "node": ">=18.0.0"
         }
       ]
+    },
+    "packages": {
+      "type": "array",
+      "description": "Array of packages to publish from a single manifest (multi-package publishing). Packages inherit top-level fields unless overridden.",
+      "items": {
+        "$ref": "#"
+      },
+      "minItems": 1
     }
   },
   "additionalProperties": false,
@@ -491,6 +504,51 @@
       "files": [
         ".windsurfrules"
       ]
+    },
+    {
+      "name": "@company/private-package",
+      "version": "1.0.0",
+      "description": "A private package only accessible to organization members",
+      "format": "claude",
+      "subtype": "skill",
+      "author": "Company Team",
+      "organization": "my-company",
+      "private": true,
+      "license": "Proprietary",
+      "files": [
+        "internal-skill.md",
+        "README.md"
+      ]
+    },
+    {
+      "name": "@username/multi-package-example",
+      "version": "1.0.0",
+      "description": "Multi-package manifest example",
+      "author": "Your Name",
+      "license": "MIT",
+      "repository": "https://github.com/username/multi-package",
+      "packages": [
+        {
+          "name": "@username/package-one",
+          "version": "1.0.0",
+          "description": "First package in the multi-package manifest",
+          "format": "claude",
+          "subtype": "skill",
+          "files": [
+            "package-one/SKILL.md"
+          ]
+        },
+        {
+          "name": "@username/package-two",
+          "version": "1.0.0",
+          "description": "Second package with different settings",
+          "format": "cursor",
+          "private": true,
+          "files": [
+            "package-two/.cursor/rules/main.mdc"
+          ]
+        }
+      ]
     }
   ]
 }