prpm 1.1.13 → 1.1.15

package/dist/index.js

@@ -113,6 +113,16 @@ function setPackageIntegrity(lockfile, packageId, tarballBuffer, format) {
   const hash = (0, import_crypto.createHash)("sha256").update(tarballBuffer).digest("hex");
   lockfile.packages[lockfileKey].integrity = `sha256-${hash}`;
 }
+function verifyPackageIntegrity(lockfile, packageId, tarballBuffer, format) {
+  const lockfileKey = getLockfileKey(packageId, format);
+  const pkg = lockfile.packages[lockfileKey];
+  if (!pkg || !pkg.integrity) {
+    return false;
+  }
+  const hash = (0, import_crypto.createHash)("sha256").update(tarballBuffer).digest("hex");
+  const expectedHash = pkg.integrity.replace("sha256-", "");
+  return hash === expectedHash;
+}
 function getLockedVersion(lockfile, packageId, format) {
   var _a;
   if (!lockfile) {
@@ -10881,6 +10891,364 @@ var init_schema_files = __esm({
   }
 });
 
+// ../converters/dist/format-registry.json
+var format_registry_default;
+var init_format_registry = __esm({
+  "../converters/dist/format-registry.json"() {
+    format_registry_default = {
+      $schema: "../schemas/format-registry.schema.json",
+      version: "1.0.0",
+      formats: {
+        cursor: {
+          name: "Cursor",
+          description: "Cursor AI coding rules and agents",
+          documentationUrl: "https://cursor.com/docs/context/rules",
+          rootFiles: [".cursorrules"],
+          subtypes: {
+            rule: {
+              directory: ".cursor/rules",
+              filePatterns: ["*.mdc", "*.md"],
+              fileExtension: ".mdc"
+            },
+            agent: {
+              directory: ".cursor/agents",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            "slash-command": {
+              directory: ".cursor/commands",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        claude: {
+          name: "Claude Code",
+          description: "Claude AI skills, agents, commands, and hooks",
+          documentationUrl: "https://code.claude.com/docs",
+          defaultSubtype: "agent",
+          subtypes: {
+            skill: {
+              directory: ".claude/skills",
+              filePatterns: ["SKILL.md"],
+              nested: true,
+              nestedIndicator: "SKILL.md",
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            agent: {
+              directory: ".claude/agents",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            "slash-command": {
+              directory: ".claude/commands",
+              filePatterns: ["*.md"],
+              nested: true,
+              fileExtension: ".md"
+            },
+            hook: {
+              directory: ".claude",
+              scanDirectory: ".claude/hooks",
+              filePatterns: ["hook.json"],
+              nested: true,
+              nestedIndicator: "hook.json",
+              fileExtension: ".json"
+            }
+          }
+        },
+        continue: {
+          name: "Continue",
+          description: "Continue AI coding rules and prompts",
+          documentationUrl: "https://docs.continue.dev",
+          rootFiles: [".continuerules"],
+          subtypes: {
+            rule: {
+              directory: ".continue/rules",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            prompt: {
+              directory: ".continue/prompts",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        windsurf: {
+          name: "Windsurf",
+          description: "Windsurf AI coding rules",
+          documentationUrl: "https://windsurf.run",
+          subtypes: {
+            rule: {
+              directory: ".windsurf/rules",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        copilot: {
+          name: "GitHub Copilot",
+          description: "GitHub Copilot instructions and chat modes",
+          documentationUrl: "https://docs.github.com/en/copilot",
+          subtypes: {
+            rule: {
+              directory: ".github/instructions",
+              filePatterns: ["*.instructions.md"],
+              fileExtension: ".instructions.md"
+            },
+            chatmode: {
+              directory: ".github/chatmodes",
+              filePatterns: ["*.chatmode.md"],
+              fileExtension: ".chatmode.md"
+            }
+          }
+        },
+        kiro: {
+          name: "Kiro",
+          description: "Kiro steering files, hooks, and agents",
+          documentationUrl: "https://kiro.dev",
+          subtypes: {
+            rule: {
+              directory: ".kiro/steering",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            hook: {
+              directory: ".kiro/hooks",
+              filePatterns: ["*.kiro.hook"],
+              fileExtension: ".kiro.hook"
+            },
+            agent: {
+              directory: ".kiro/agents",
+              filePatterns: ["*.json"],
+              fileExtension: ".json"
+            }
+          }
+        },
+        gemini: {
+          name: "Gemini CLI",
+          description: "Gemini CLI custom commands",
+          documentationUrl: "https://geminicli.com",
+          subtypes: {
+            "slash-command": {
+              directory: ".gemini/commands",
+              filePatterns: ["*.toml"],
+              fileExtension: ".toml"
+            }
+          }
+        },
+        opencode: {
+          name: "OpenCode",
+          description: "OpenCode agents, commands, and tools",
+          documentationUrl: "https://opencode.ai",
+          subtypes: {
+            agent: {
+              directory: ".opencode/agent",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            "slash-command": {
+              directory: ".opencode/command",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            tool: {
+              directory: ".opencode/tool",
+              filePatterns: ["*.md", "*.json"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        droid: {
+          name: "Factory Droid",
+          description: "Factory Droid skills, commands, and hooks",
+          documentationUrl: "https://docs.factory.ai",
+          subtypes: {
+            skill: {
+              directory: ".factory/skills",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            "slash-command": {
+              directory: ".factory/commands",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            },
+            hook: {
+              directory: ".factory/hooks",
+              filePatterns: ["*.json", "*.js"],
+              fileExtension: ".json"
+            }
+          }
+        },
+        trae: {
+          name: "Trae",
+          description: "Trae AI coding rules",
+          subtypes: {
+            rule: {
+              directory: ".trae/rules",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        zencoder: {
+          name: "Zencoder",
+          description: "Zencoder AI coding rules",
+          subtypes: {
+            rule: {
+              directory: ".zencoder/rules",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        generic: {
+          name: "Generic Prompts",
+          description: "Generic AI prompts",
+          subtypes: {
+            prompt: {
+              directory: ".prompts",
+              filePatterns: ["*.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        "agents.md": {
+          name: "AGENTS.md",
+          description: "OpenAI AGENTS.md project instructions",
+          rootFiles: ["AGENTS.md"],
+          subtypes: {
+            rule: {
+              directory: ".",
+              filePatterns: ["AGENTS.md"],
+              fileExtension: ".md"
+            },
+            skill: {
+              directory: ".openskills",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            agent: {
+              directory: ".openagents",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            }
+          }
+        },
+        "gemini.md": {
+          name: "GEMINI.md",
+          description: "Gemini GEMINI.md project instructions",
+          rootFiles: ["GEMINI.md"],
+          subtypes: {
+            rule: {
+              directory: ".",
+              filePatterns: ["GEMINI.md"],
+              fileExtension: ".md"
+            },
+            skill: {
+              directory: ".openskills",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            agent: {
+              directory: ".openagents",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            }
+          }
+        },
+        "claude.md": {
+          name: "CLAUDE.md",
+          description: "Claude CLAUDE.md project instructions",
+          rootFiles: ["CLAUDE.md"],
+          subtypes: {
+            rule: {
+              directory: ".",
+              filePatterns: ["CLAUDE.md"],
+              fileExtension: ".md"
+            },
+            skill: {
+              directory: ".openskills",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            agent: {
+              directory: ".openagents",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            }
+          }
+        },
+        aider: {
+          name: "Aider",
+          description: "Aider CONVENTIONS.md project instructions",
+          rootFiles: ["CONVENTIONS.md"],
+          subtypes: {
+            rule: {
+              directory: ".",
+              filePatterns: ["CONVENTIONS.md"],
+              fileExtension: ".md"
+            },
+            skill: {
+              directory: ".openskills",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            },
+            agent: {
+              directory: ".openagents",
+              filePatterns: ["*.md"],
+              nested: true,
+              usesPackageSubdirectory: true,
+              fileExtension: ".md"
+            }
+          }
+        },
+        replit: {
+          name: "Replit",
+          description: "Replit replit.md configuration",
+          rootFiles: ["replit.md"],
+          subtypes: {
+            rule: {
+              directory: ".",
+              filePatterns: ["replit.md"],
+              fileExtension: ".md"
+            }
+          }
+        },
+        mcp: {
+          name: "MCP",
+          description: "Model Context Protocol tools",
+          subtypes: {
+            tool: {
+              directory: ".mcp/tools",
+              filePatterns: ["*.json"],
+              fileExtension: ".json"
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // ../converters/dist/format-registry.js
 function getFormatRegistry() {
   return formatRegistry;
@@ -10953,17 +11321,13 @@ function findFormatByRootFile(filename) {
   }
   return void 0;
 }
-var import_fs6, import_url2, import_path7, currentDir, formatRegistryData, formatRegistry;
-var init_format_registry = __esm({
+var formatRegistry;
+var init_format_registry2 = __esm({
   "../converters/dist/format-registry.js"() {
     "use strict";
     init_cjs_shims();
-    import_fs6 = require("fs");
-    import_url2 = require("url");
-    import_path7 = require("path");
-    currentDir = (0, import_path7.dirname)((0, import_url2.fileURLToPath)(importMetaUrl));
-    formatRegistryData = JSON.parse((0, import_fs6.readFileSync)((0, import_path7.join)(currentDir, "format-registry.json"), "utf-8"));
-    formatRegistry = formatRegistryData;
+    init_format_registry();
+    formatRegistry = format_registry_default;
   }
 });
 
@@ -11107,7 +11471,7 @@ var init_dist = __esm({
     init_taxonomy_utils();
     init_validation();
     init_schema_files();
-    init_format_registry();
+    init_format_registry2();
   }
 });
 
@@ -11131,23 +11495,23 @@ function getDestinationDir2(format, subtype, name) {
 }
 async function ensureDirectoryExists(dirPath) {
   try {
-    await import_fs7.promises.mkdir(dirPath, { recursive: true });
+    await import_fs6.promises.mkdir(dirPath, { recursive: true });
   } catch (error) {
     throw new Error(`Failed to create directory ${dirPath}: ${error}`);
   }
 }
 async function saveFile(filePath, content) {
   try {
-    const dir = import_path8.default.dirname(filePath);
+    const dir = import_path7.default.dirname(filePath);
     await ensureDirectoryExists(dir);
-    await import_fs7.promises.writeFile(filePath, content, "utf-8");
+    await import_fs6.promises.writeFile(filePath, content, "utf-8");
   } catch (error) {
     throw new Error(`Failed to save file ${filePath}: ${error}`);
   }
 }
 async function fileExists(filePath) {
   try {
-    await import_fs7.promises.access(filePath);
+    await import_fs6.promises.access(filePath);
     return true;
   } catch {
     return false;
@@ -11155,7 +11519,7 @@ async function fileExists(filePath) {
 }
 async function directoryExists(dirPath) {
   try {
-    const stats = await import_fs7.promises.stat(dirPath);
+    const stats = await import_fs6.promises.stat(dirPath);
     return stats.isDirectory();
   } catch {
     return false;
@@ -11210,13 +11574,13 @@ function stripAuthorNamespace2(packageId) {
   const parts = packageId.split("/");
   return parts[parts.length - 1];
 }
-var import_fs7, import_path8;
+var import_fs6, import_path7;
 var init_filesystem = __esm({
   "src/core/filesystem.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs7 = require("fs");
-    import_path8 = __toESM(require("path"));
+    import_fs6 = require("fs");
+    import_path7 = __toESM(require("path"));
     init_dist();
   }
 });
@@ -11236,7 +11600,7 @@ function generateSkillXML(entry) {
   const resourceType = entry.resourceType || "skill";
   const tag = resourceType === "agent" ? "agent" : "skill";
   const mainFile = entry.mainFile || (resourceType === "agent" ? "AGENT.md" : "SKILL.md");
-  const fullPath = import_path9.default.join(entry.skillPath, mainFile);
+  const fullPath = import_path8.default.join(entry.skillPath, mainFile);
   return `<${tag}>
 <name>${escapeXML(entry.name)}</name>
 <description>${escapeXML(entry.description)}</description>
@@ -11306,7 +11670,7 @@ async function readAgentsMdManifest(agentsPath = "AGENTS.md") {
       afterManifest: ""
     };
   }
-  const content = await import_fs8.promises.readFile(agentsPath, "utf-8");
+  const content = await import_fs7.promises.readFile(agentsPath, "utf-8");
   let manifestStart = "<!-- PRPM_MANIFEST_START -->";
   let manifestEnd = "<!-- PRPM_MANIFEST_END -->";
   let startIdx = content.indexOf(manifestStart);
@@ -11364,7 +11728,7 @@ async function addSkillToManifest(entry, agentsPath = "AGENTS.md") {
   newContent += "\n\n";
   newContent += generateManifestFooter(hasAgents, agentsXML);
   newContent += afterManifest;
-  await import_fs8.promises.writeFile(agentsPath, newContent.trim() + "\n", "utf-8");
+  await import_fs7.promises.writeFile(agentsPath, newContent.trim() + "\n", "utf-8");
 }
 async function removeSkillFromManifest(skillName, agentsPath = "AGENTS.md") {
   const { beforeManifest, manifest, afterManifest } = await readAgentsMdManifest(agentsPath);
@@ -11376,9 +11740,9 @@ async function removeSkillFromManifest(skillName, agentsPath = "AGENTS.md") {
   if (updatedResources.length === 0) {
     const newContent2 = (beforeManifest + afterManifest).trim();
     if (newContent2) {
-      await import_fs8.promises.writeFile(agentsPath, newContent2 + "\n", "utf-8");
+      await import_fs7.promises.writeFile(agentsPath, newContent2 + "\n", "utf-8");
     } else {
-      await import_fs8.promises.unlink(agentsPath);
+      await import_fs7.promises.unlink(agentsPath);
     }
     return;
   }
@@ -11394,7 +11758,7 @@ async function removeSkillFromManifest(skillName, agentsPath = "AGENTS.md") {
   newContent += "\n\n";
   newContent += generateManifestFooter(hasAgents, agentsXML);
   newContent += afterManifest;
-  await import_fs8.promises.writeFile(agentsPath, newContent.trim() + "\n", "utf-8");
+  await import_fs7.promises.writeFile(agentsPath, newContent.trim() + "\n", "utf-8");
 }
 function parseSkillsFromManifest(manifestXML) {
   const resources = [];
@@ -11451,13 +11815,13 @@ function escapeXML(str2) {
 function unescapeXML(str2) {
   return str2.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 }
-var import_fs8, import_path9;
+var import_fs7, import_path8;
 var init_agents_md_progressive = __esm({
   "src/core/agents-md-progressive.ts"() {
     "use strict";
     init_cjs_shims();
-    import_fs8 = require("fs");
-    import_path9 = __toESM(require("path"));
+    import_fs7 = require("fs");
+    import_path8 = __toESM(require("path"));
     init_filesystem();
   }
 });
@@ -13989,6 +14353,26 @@ async function handleInstall(packageSpec, options) {
     }
     console.log(`   \u2B07\uFE0F  Downloading...`);
     const tarball = await client.downloadPackage(tarballUrl);
+    const lockfileKeyForVerification = getLockfileKey(packageId, targetFormat);
+    const existingEntry = lockfile == null ? void 0 : lockfile.packages[lockfileKeyForVerification];
+    if (existingEntry == null ? void 0 : existingEntry.integrity) {
+      console.log(`   \u{1F512} Verifying integrity...`);
+      const isValid = verifyPackageIntegrity(lockfile, packageId, tarball, targetFormat);
+      if (!isValid) {
+        throw new CLIError(
+          `\u274C Integrity verification failed for ${packageId}
+
+The downloaded package does not match the expected hash from prpm.lock.
+This could indicate:
+  \u2022 A corrupted download
+  \u2022 A modified package on the registry
+  \u2022 A potential security issue
+
+\u{1F4A1} To force installation anyway, delete the package from prpm.lock and retry.`
+        );
+      }
+      console.log(`   \u2713 Integrity verified`);
+    }
     console.log(`   \u{1F4C2} Extracting...`);
     const effectiveFormat = format || pkg.format;
     const effectiveSubtype = options.subtype || pkg.subtype;
@@ -14146,7 +14530,7 @@ async function handleInstall(packageSpec, options) {
       destDir = getDestinationDir2(effectiveFormat, effectiveSubtype, pkg.name);
       if (locationOverride && effectiveFormat === "cursor") {
         const relativeDestDir = destDir.startsWith("./") ? destDir.slice(2) : destDir;
-        destDir = import_path11.default.join(locationOverride, relativeDestDir);
+        destDir = import_path10.default.join(locationOverride, relativeDestDir);
         console.log(`   \u{1F4C1} Installing Cursor package to custom location: ${destDir}`);
       }
       let mainFile = extractedFiles[0].content;
@@ -14167,7 +14551,7 @@ async function handleInstall(packageSpec, options) {
           const manifestFilename = getManifestFilename(effectiveFormat);
           let targetPath = manifestFilename;
           if (locationOverride) {
-            targetPath = import_path11.default.join(locationOverride, `${manifestFilename.replace(".md", ".override.md")}`);
+            targetPath = import_path10.default.join(locationOverride, `${manifestFilename.replace(".md", ".override.md")}`);
             console.log(`   \u{1F4C1} Installing to custom location: ${targetPath}`);
           }
           destPath = targetPath;
@@ -14278,7 +14662,7 @@ async function handleInstall(packageSpec, options) {
       destDir = getDestinationDir2(effectiveFormat, effectiveSubtype, pkg.name);
       if (locationOverride && effectiveFormat === "cursor") {
         const relativeDestDir = destDir.startsWith("./") ? destDir.slice(2) : destDir;
-        destDir = import_path11.default.join(locationOverride, relativeDestDir);
+        destDir = import_path10.default.join(locationOverride, relativeDestDir);
         console.log(`   \u{1F4C1} Installing Cursor package to custom location: ${destDir}`);
       }
       const packageName = stripAuthorNamespace2(packageId);
@@ -14452,6 +14836,18 @@ ${afterFrontmatter}`;
     await telemetry.shutdown();
   }
 }
+function isPathSafe(targetDir, filePath) {
+  const resolvedPath = import_path10.default.resolve(targetDir, filePath);
+  const resolvedTarget = import_path10.default.resolve(targetDir);
+  return resolvedPath.startsWith(resolvedTarget + import_path10.default.sep) || resolvedPath === resolvedTarget;
+}
+function hasUnsafePathPatterns(filePath) {
+  if (filePath.includes("..")) return true;
+  if (filePath.startsWith("/")) return true;
+  if (/^[a-zA-Z]:/.test(filePath)) return true;
+  if (filePath.includes("\0")) return true;
+  return false;
+}
 async function extractTarball(tarball, packageId) {
   let decompressed;
   try {
@@ -14467,7 +14863,7 @@ async function extractTarball(tarball, packageId) {
   } catch (error) {
     throw new CLIError(`Package decompression failed: ${error.message}`);
   }
-  const tmpDir = await import_promises2.default.mkdtemp(import_path11.default.join(import_os3.default.tmpdir(), "prpm-"));
+  const tmpDir = await import_promises2.default.mkdtemp(import_path10.default.join(import_os3.default.tmpdir(), "prpm-"));
   const cleanup = async () => {
     try {
       await import_promises2.default.rm(tmpDir, { recursive: true, force: true });
@@ -14486,7 +14882,29 @@ async function extractTarball(tarball, packageId) {
   try {
     const extract2 = tar.extract({
       cwd: tmpDir,
-      strict: false
+      strict: true,
+      // Enable strict mode to reject malformed archives
+      // Security: filter out dangerous entries before extraction
+      filter: (entryPath, entry) => {
+        const entryType = "type" in entry ? entry.type : null;
+        if (entryType === "SymbolicLink" || entryType === "Link") {
+          console.warn(`   \u26A0\uFE0F  Blocked symlink in package: ${entryPath}`);
+          return false;
+        }
+        if ("isSymbolicLink" in entry && entry.isSymbolicLink()) {
+          console.warn(`   \u26A0\uFE0F  Blocked symlink in package: ${entryPath}`);
+          return false;
+        }
+        if (hasUnsafePathPatterns(entryPath)) {
+          console.warn(`   \u26A0\uFE0F  Blocked unsafe path in package: ${entryPath}`);
+          return false;
+        }
+        if (!isPathSafe(tmpDir, entryPath)) {
+          console.warn(`   \u26A0\uFE0F  Blocked path traversal attempt: ${entryPath}`);
+          return false;
+        }
+        return true;
+      }
     });
     await (0, import_promises.pipeline)(import_stream.Readable.from(decompressed), extract2);
     const extractedFiles = await collectExtractedFiles(tmpDir, excludedNames, import_promises2.default);
@@ -14511,11 +14929,11 @@ async function collectExtractedFiles(rootDir, excludedNames, fs14) {
   const files = [];
   const dirs = [rootDir];
   while (dirs.length > 0) {
-    const currentDir2 = dirs.pop();
-    if (!currentDir2) continue;
-    const entries = await fs14.readdir(currentDir2, { withFileTypes: true });
+    const currentDir = dirs.pop();
+    if (!currentDir) continue;
+    const entries = await fs14.readdir(currentDir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = import_path11.default.join(currentDir2, entry.name);
+      const fullPath = import_path10.default.join(currentDir, entry.name);
       if (entry.isDirectory()) {
         dirs.push(fullPath);
         continue;
@@ -14527,7 +14945,7 @@ async function collectExtractedFiles(rootDir, excludedNames, fs14) {
         continue;
       }
       const content = await fs14.readFile(fullPath, "utf-8");
-      const relativePath = import_path11.default.relative(rootDir, fullPath).split(import_path11.default.sep).join("/");
+      const relativePath = import_path10.default.relative(rootDir, fullPath).split(import_path10.default.sep).join("/");
       files.push({
         name: relativePath,
         content
@@ -14561,11 +14979,11 @@ async function installFromLockfile(options) {
         console.log(`  Installing ${displayName}...`);
         let locationOverride = options.location;
         if (!locationOverride && lockEntry.format === "agents.md" && lockEntry.installedPath) {
-          const baseName = import_path11.default.basename(lockEntry.installedPath);
+          const baseName = import_path10.default.basename(lockEntry.installedPath);
           if (baseName === "AGENTS.override.md") {
-            locationOverride = import_path11.default.dirname(lockEntry.installedPath);
+            locationOverride = import_path10.default.dirname(lockEntry.installedPath);
           } else if (baseName !== "AGENTS.md") {
-            locationOverride = import_path11.default.dirname(lockEntry.installedPath);
+            locationOverride = import_path10.default.dirname(lockEntry.installedPath);
           }
         }
         const manifestFile = (_a = lockEntry.progressiveDisclosure) == null ? void 0 : _a.manifestPath;
@@ -14644,7 +15062,7 @@ function createInstallCommand() {
   });
   return command;
 }
-var import_commander11, import_chalk, import_registry_client5, import_stream, import_promises, tar, import_path11, import_zlib, import_promises2, import_os3, import_semver;
+var import_commander11, import_chalk, import_registry_client5, import_stream, import_promises, tar, import_path10, import_zlib, import_promises2, import_os3, import_semver;
 var init_install = __esm({
   "src/commands/install.ts"() {
     "use strict";
@@ -14661,7 +15079,7 @@ var init_install = __esm({
     tar = __toESM(require("tar"));
     init_errors();
     init_prompts();
-    import_path11 = __toESM(require("path"));
+    import_path10 = __toESM(require("path"));
     import_zlib = __toESM(require("zlib"));
     import_promises2 = __toESM(require("fs/promises"));
     import_os3 = __toESM(require("os"));
@@ -14678,8 +15096,8 @@ var init_install = __esm({
 // src/index.ts
 init_cjs_shims();
 var import_commander29 = require("commander");
-var import_fs19 = require("fs");
-var import_path22 = require("path");
+var import_fs18 = require("fs");
+var import_path21 = require("path");
 
 // src/commands/list.ts
 init_cjs_shims();
@@ -14839,7 +15257,7 @@ var import_commander2 = require("commander");
 init_lockfile();
 init_filesystem();
 init_types();
-var import_fs9 = require("fs");
+var import_fs8 = require("fs");
 init_errors();
 init_agents_md_progressive();
 var readline = __toESM(require("readline"));
@@ -14940,7 +15358,7 @@ async function handleUninstall(name, options = {}) {
       if (pkg.format === "claude" && pkg.subtype === "hook" && pkg.hookMetadata) {
         const settingsPath = pkg.installedPath || ".claude/settings.json";
         try {
-          const settingsContent = await import_fs9.promises.readFile(settingsPath, "utf-8");
+          const settingsContent = await import_fs8.promises.readFile(settingsPath, "utf-8");
           const settings = JSON.parse(settingsContent);
           if (settings.hooks) {
             let removedCount = 0;
@@ -14957,7 +15375,7 @@ async function handleUninstall(name, options = {}) {
                 }
               }
             }
-            await import_fs9.promises.writeFile(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
+            await import_fs8.promises.writeFile(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
             console.log(`   \u{1FA9D} Removed ${removedCount} hook(s) from ${settingsPath}`);
           }
         } catch (error) {
@@ -14982,12 +15400,12 @@ async function handleUninstall(name, options = {}) {
         throw new CLIError(`Cannot uninstall ${name}: installation path unknown`, 1);
       }
       try {
-        const stats = await import_fs9.promises.stat(targetPath);
+        const stats = await import_fs8.promises.stat(targetPath);
         if (stats.isDirectory()) {
-          await import_fs9.promises.rm(targetPath, { recursive: true, force: true });
+          await import_fs8.promises.rm(targetPath, { recursive: true, force: true });
           console.log(`   \u{1F5D1}\uFE0F  Deleted directory: ${targetPath}`);
         } else if (stats.isFile()) {
-          await import_fs9.promises.unlink(targetPath);
+          await import_fs8.promises.unlink(targetPath);
           console.log(`   \u{1F5D1}\uFE0F  Deleted file: ${targetPath}`);
         }
       } catch (error) {
@@ -15016,17 +15434,17 @@ function createUninstallCommand() {
 // src/commands/index.ts
 init_cjs_shims();
 var import_commander3 = require("commander");
-var import_fs10 = require("fs");
-var import_path10 = __toESM(require("path"));
+var import_fs9 = require("fs");
+var import_path9 = __toESM(require("path"));
 init_lockfile();
 init_filesystem();
 init_errors();
 async function scanDirectory(dirPath, format, subtype) {
   try {
-    const files = await import_fs10.promises.readdir(dirPath, { withFileTypes: true });
+    const files = await import_fs9.promises.readdir(dirPath, { withFileTypes: true });
     const results = [];
     for (const file of files) {
-      const fullPath = import_path10.default.join(dirPath, file.name);
+      const fullPath = import_path9.default.join(dirPath, file.name);
       if (file.isFile()) {
         const id = generateId(file.name);
         results.push({
@@ -15039,11 +15457,11 @@ async function scanDirectory(dirPath, format, subtype) {
         const isCursorAgent = format === "cursor" && subtype === "agent";
         if (isClaudeType || isCursorAgent) {
           try {
-            const subFiles = await import_fs10.promises.readdir(fullPath, { withFileTypes: true });
+            const subFiles = await import_fs9.promises.readdir(fullPath, { withFileTypes: true });
             for (const subFile of subFiles) {
               const isValidFile = subFile.isFile() && (subFile.name === "SKILL.md" || subFile.name === "AGENT.md" || subFile.name === "skill.md" || subFile.name === "agent.md");
               if (isValidFile) {
-                const subFilePath = import_path10.default.join(fullPath, subFile.name);
+                const subFilePath = import_path9.default.join(fullPath, subFile.name);
                 const id = file.name;
                 results.push({
                   filePath: subFilePath,
@@ -15105,7 +15523,7 @@ async function handleIndex(options = {}) {
             id: file.id,
             version: "0.0.0",
             // Local files don't have versions
-            tarballUrl: `file://${import_path10.default.resolve(file.filePath)}`,
+            tarballUrl: `file://${import_path9.default.resolve(file.filePath)}`,
             format: dir.format,
             subtype: dir.subtype
           });
@@ -15932,8 +16350,8 @@ init_install();
 init_cjs_shims();
 var import_commander13 = require("commander");
 var import_promises7 = require("fs/promises");
-var import_path18 = require("path");
-var import_fs16 = require("fs");
+var import_path17 = require("path");
+var import_fs15 = require("fs");
 var tar2 = __toESM(require("tar"));
 var import_os4 = require("os");
 var import_crypto2 = require("crypto");
@@ -16106,19 +16524,19 @@ function validateMarketplaceJson(data) {
 init_cjs_shims();
 var import_ajv2 = __toESM(require("ajv"));
 var import_ajv_formats2 = __toESM(require("ajv-formats"));
-var import_fs11 = require("fs");
-var import_path12 = require("path");
+var import_fs10 = require("fs");
+var import_path11 = require("path");
 var schema2;
 var schemaCandidates = [
   // Source file layout (src/core → ../../schemas)
-  (0, import_path12.join)(__dirname, "../../schemas/prpm-manifest.schema.json"),
+  (0, import_path11.join)(__dirname, "../../schemas/prpm-manifest.schema.json"),
   // Bundled layout (dist/index.js → ../schemas)
-  (0, import_path12.join)(__dirname, "../schemas/prpm-manifest.schema.json")
+  (0, import_path11.join)(__dirname, "../schemas/prpm-manifest.schema.json")
 ];
 for (const candidate of schemaCandidates) {
   try {
-    if ((0, import_fs11.existsSync)(candidate)) {
-      schema2 = JSON.parse((0, import_fs11.readFileSync)(candidate, "utf-8"));
+    if ((0, import_fs10.existsSync)(candidate)) {
+      schema2 = JSON.parse((0, import_fs10.readFileSync)(candidate, "utf-8"));
       break;
     }
   } catch {
@@ -16173,8 +16591,8 @@ function getManifestSchema() {
 // src/utils/license-extractor.ts
 init_cjs_shims();
 var import_promises3 = require("fs/promises");
-var import_path13 = require("path");
-var import_fs12 = require("fs");
+var import_path12 = require("path");
+var import_fs11 = require("fs");
 var LICENSE_FILE_PATTERNS = [
   "LICENSE",
   "LICENSE.md",
@@ -16223,9 +16641,9 @@ function generateLicenseUrl(repositoryUrl, fileName) {
 async function extractLicenseInfo(repositoryUrl) {
   const cwd = process.cwd();
   for (const fileName of LICENSE_FILE_PATTERNS) {
-    const filePath = (0, import_path13.join)(cwd, fileName);
+    const filePath = (0, import_path12.join)(cwd, fileName);
     try {
-      await (0, import_promises3.access)(filePath, import_fs12.constants.R_OK);
+      await (0, import_promises3.access)(filePath, import_fs11.constants.R_OK);
       const text = await (0, import_promises3.readFile)(filePath, "utf-8");
       const type2 = detectLicenseType(text);
       const url = generateLicenseUrl(repositoryUrl, fileName);
@@ -16259,7 +16677,7 @@ function validateLicenseInfo(licenseInfo, packageName) {
 // src/utils/snippet-extractor.ts
 init_cjs_shims();
 var import_promises4 = require("fs/promises");
-var import_path14 = require("path");
+var import_path13 = require("path");
 var MAX_SNIPPET_LENGTH = 2e3;
 async function extractSnippet(manifest) {
   const cwd = process.cwd();
@@ -16275,7 +16693,7 @@ async function extractSnippet(manifest) {
       const firstFile = manifest.files[0];
       fileName = typeof firstFile === "string" ? firstFile : firstFile.path;
     }
-    const fullPath = (0, import_path14.join)(cwd, fileName);
+    const fullPath = (0, import_path13.join)(cwd, fileName);
     const stats = await (0, import_promises4.stat)(fullPath);
     if (stats.isDirectory()) {
       console.warn(`\u26A0\uFE0F  Skipping snippet extraction: "${fullPath}" is a directory`);
@@ -16537,8 +16955,8 @@ async function validatePackageFiles(manifest) {
 init_cjs_shims();
 var import_commander12 = require("commander");
 var import_promises6 = require("fs/promises");
-var import_path17 = require("path");
-var import_fs15 = require("fs");
+var import_path16 = require("path");
+var import_fs14 = require("fs");
 var readline4 = __toESM(require("readline/promises"));
 var import_process = require("process");
 init_types();
@@ -16546,8 +16964,8 @@ init_errors();
 
 // src/core/package-scanner.ts
 init_cjs_shims();
-var import_fs13 = require("fs");
-var import_path15 = __toESM(require("path"));
+var import_fs12 = require("fs");
+var import_path14 = __toESM(require("path"));
 init_dist();
 function buildScanConfigs() {
   const configs = [];
@@ -16573,7 +16991,7 @@ function buildScanConfigs() {
 var SCAN_CONFIGS = buildScanConfigs();
 async function extractMetadata2(filePath) {
   try {
-    const content = await import_fs13.promises.readFile(filePath, "utf-8");
+    const content = await import_fs12.promises.readFile(filePath, "utf-8");
     const metadata = {};
     const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
     if (frontmatterMatch) {
@@ -16626,7 +17044,7 @@ function matchesPattern(filename, patterns) {
 }
 async function directoryExists2(dirPath) {
   try {
-    const stats = await import_fs13.promises.stat(dirPath);
+    const stats = await import_fs12.promises.stat(dirPath);
     return stats.isDirectory();
   } catch {
     return false;
@@ -16634,7 +17052,7 @@ async function directoryExists2(dirPath) {
 }
 async function fileExists2(filePath) {
   try {
-    await import_fs13.promises.access(filePath);
+    await import_fs12.promises.access(filePath);
     return true;
   } catch {
     return false;
@@ -16642,21 +17060,21 @@ async function fileExists2(filePath) {
 }
 async function scanDirectory2(config, cwd) {
   const packages = [];
-  const fullDir = import_path15.default.join(cwd, config.directory);
+  const fullDir = import_path14.default.join(cwd, config.directory);
   if (!await directoryExists2(fullDir)) {
     return packages;
   }
-  const entries = await import_fs13.promises.readdir(fullDir, { withFileTypes: true });
+  const entries = await import_fs12.promises.readdir(fullDir, { withFileTypes: true });
   if (config.nested) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const packageDir = import_path15.default.join(fullDir, entry.name);
+      const packageDir = import_path14.default.join(fullDir, entry.name);
       if (config.nestedIndicator) {
-        const indicatorPath = import_path15.default.join(packageDir, config.nestedIndicator);
+        const indicatorPath = import_path14.default.join(packageDir, config.nestedIndicator);
         if (!await fileExists2(indicatorPath)) continue;
         const packageFiles = await collectPackageFiles(packageDir, config.directory, entry.name);
         const metadata = await extractMetadata2(indicatorPath);
-        const relativePath = import_path15.default.join(config.directory, entry.name, config.nestedIndicator);
+        const relativePath = import_path14.default.join(config.directory, entry.name, config.nestedIndicator);
         packages.push({
           name: metadata.name || filenameToPackageName(entry.name),
           format: config.format,
@@ -16667,12 +17085,12 @@ async function scanDirectory2(config, cwd) {
           primaryFile: relativePath
         });
       } else {
-        const subEntries = await import_fs13.promises.readdir(packageDir, { withFileTypes: true });
+        const subEntries = await import_fs12.promises.readdir(packageDir, { withFileTypes: true });
         for (const subEntry of subEntries) {
           if (!subEntry.isFile()) continue;
           if (!matchesPattern(subEntry.name, config.patterns)) continue;
-          const filePath = import_path15.default.join(packageDir, subEntry.name);
-          const relativePath = import_path15.default.join(config.directory, entry.name, subEntry.name);
+          const filePath = import_path14.default.join(packageDir, subEntry.name);
+          const relativePath = import_path14.default.join(config.directory, entry.name, subEntry.name);
           const metadata = await extractMetadata2(filePath);
           packages.push({
             name: metadata.name || filenameToPackageName(entry.name),
@@ -16690,8 +17108,8 @@ async function scanDirectory2(config, cwd) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (!matchesPattern(entry.name, config.patterns)) continue;
-      const filePath = import_path15.default.join(fullDir, entry.name);
-      const relativePath = import_path15.default.join(config.directory, entry.name);
+      const filePath = import_path14.default.join(fullDir, entry.name);
+      const relativePath = import_path14.default.join(config.directory, entry.name);
       const metadata = await extractMetadata2(filePath);
       packages.push({
         name: metadata.name || filenameToPackageName(entry.name),
@@ -16709,24 +17127,24 @@ async function scanDirectory2(config, cwd) {
 async function collectPackageFiles(packageDir, baseDir, packageName) {
   const files = [];
   async function walkDir(dir, relativeBase) {
-    const entries = await import_fs13.promises.readdir(dir, { withFileTypes: true });
+    const entries = await import_fs12.promises.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = import_path15.default.join(dir, entry.name);
-      const relativePath = import_path15.default.join(relativeBase, entry.name);
+      const fullPath = import_path14.default.join(dir, entry.name);
+      const relativePath = import_path14.default.join(relativeBase, entry.name);
       if (entry.isDirectory()) {
         if (["node_modules", "dist", ".git", "coverage"].includes(entry.name)) {
           continue;
         }
         await walkDir(fullPath, relativePath);
       } else if (entry.isFile()) {
-        const ext = import_path15.default.extname(entry.name).toLowerCase();
+        const ext = import_path14.default.extname(entry.name).toLowerCase();
         if ([".md", ".json", ".js", ".ts", ".toml"].includes(ext)) {
           files.push(relativePath);
         }
       }
     }
   }
-  await walkDir(packageDir, import_path15.default.join(baseDir, packageName));
+  await walkDir(packageDir, import_path14.default.join(baseDir, packageName));
   return files;
 }
 function buildRootManifestFiles() {
@@ -16749,7 +17167,7 @@ async function scanForPackages(cwd = process.cwd()) {
     allPackages.push(...packages);
   }
   for (const { file, format } of ROOT_MANIFEST_FILES) {
-    const filePath = import_path15.default.join(cwd, file);
+    const filePath = import_path14.default.join(cwd, file);
     if (await fileExists2(filePath)) {
       const metadata = await extractMetadata2(filePath);
       allPackages.push({
@@ -16763,7 +17181,7 @@ async function scanForPackages(cwd = process.cwd()) {
       });
     }
   }
-  const copilotInstructionsPath = import_path15.default.join(cwd, ".github/copilot-instructions.md");
+  const copilotInstructionsPath = import_path14.default.join(cwd, ".github/copilot-instructions.md");
   if (await fileExists2(copilotInstructionsPath)) {
     const metadata = await extractMetadata2(copilotInstructionsPath);
     allPackages.push({
@@ -16781,12 +17199,12 @@ async function scanForPackages(cwd = process.cwd()) {
 
 // src/core/package-reconciler.ts
 init_cjs_shims();
-var import_fs14 = require("fs");
-var import_path16 = __toESM(require("path"));
+var import_fs13 = require("fs");
+var import_path15 = __toESM(require("path"));
 async function readManifest(cwd = process.cwd()) {
   try {
-    const manifestPath = import_path16.default.join(cwd, "prpm.json");
-    const content = await import_fs14.promises.readFile(manifestPath, "utf-8");
+    const manifestPath = import_path15.default.join(cwd, "prpm.json");
+    const content = await import_fs13.promises.readFile(manifestPath, "utf-8");
     const raw = JSON.parse(content);
     if ("packages" in raw && Array.isArray(raw.packages)) {
       return {
@@ -16812,7 +17230,7 @@ async function readManifest(cwd = process.cwd()) {
 }
 async function fileExists3(filePath) {
   try {
-    await import_fs14.promises.access(filePath);
+    await import_fs13.promises.access(filePath);
     return true;
   } catch {
     return false;
@@ -16868,7 +17286,7 @@ async function reconcilePackages(detected, manifest, cwd = process.cwd()) {
     const manifestPkg = manifest[mi];
     let anyFileExists = false;
     for (const file of manifestPkg.files) {
-      const fullPath = import_path16.default.join(cwd, file);
+      const fullPath = import_path15.default.join(cwd, file);
       if (await fileExists3(fullPath)) {
         anyFileExists = true;
         break;
@@ -16937,7 +17355,7 @@ function createManifestFromDetected(packages, defaults) {
       files: pkg.files
     };
   }
-  const projectName = import_path16.default.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  const projectName = import_path15.default.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-");
   return {
     name: `${projectName}-packages`,
     version: "1.0.0",
@@ -17316,12 +17734,12 @@ function getDefaultAuthor() {
 async function createExampleFiles(format, files, packageName) {
   const templates = EXAMPLE_TEMPLATES[format] || {};
   for (const file of files) {
-    const filePath = (0, import_path17.join)(process.cwd(), file);
-    const dirPath = (0, import_path17.join)(filePath, "..");
-    if (!(0, import_fs15.existsSync)(dirPath)) {
+    const filePath = (0, import_path16.join)(process.cwd(), file);
+    const dirPath = (0, import_path16.join)(filePath, "..");
+    if (!(0, import_fs14.existsSync)(dirPath)) {
       await (0, import_promises6.mkdir)(dirPath, { recursive: true });
     }
-    if ((0, import_fs15.existsSync)(filePath)) {
+    if ((0, import_fs14.existsSync)(filePath)) {
       console.log(`  Skipping ${file} (already exists)`);
       continue;
     }
@@ -17335,8 +17753,8 @@ Add your content here.
   }
 }
 async function createReadme(config) {
-  const readmePath = (0, import_path17.join)(process.cwd(), "README.md");
-  if ((0, import_fs15.existsSync)(readmePath)) {
+  const readmePath = (0, import_path16.join)(process.cwd(), "README.md");
+  if ((0, import_fs14.existsSync)(readmePath)) {
     console.log("  Skipping README.md (already exists)");
     return;
   }
@@ -17439,8 +17857,8 @@ async function reviewMissingPackage(rl, pkg, index, total) {
   return await confirm(rl, "\n  Remove from prpm.json?", true);
 }
 async function smartInit(options) {
-  const manifestPath = (0, import_path17.join)(process.cwd(), "prpm.json");
-  const hasManifest = (0, import_fs15.existsSync)(manifestPath);
+  const manifestPath = (0, import_path16.join)(process.cwd(), "prpm.json");
+  const hasManifest = (0, import_fs14.existsSync)(manifestPath);
   console.log("\nScanning for packages...\n");
   const detected = await scanForPackages();
   const existingManifest = hasManifest ? await readManifest() : null;
@@ -17572,8 +17990,8 @@ Create multi-package prpm.json with these ${detected.length} packages?` : "\nCre
   }
 }
 async function classicInit(options) {
-  const manifestPath = (0, import_path17.join)(process.cwd(), "prpm.json");
-  if ((0, import_fs15.existsSync)(manifestPath) && !options.force) {
+  const manifestPath = (0, import_path16.join)(process.cwd(), "prpm.json");
+  if ((0, import_fs14.existsSync)(manifestPath) && !options.force) {
     throw new Error(
       "prpm.json already exists. Use --force to overwrite, or run this command in a different directory."
     );
@@ -17769,7 +18187,7 @@ function createInitCommand() {
 
 // src/commands/publish.ts
 async function findAndLoadManifests() {
-  const prpmJsonPath = (0, import_path18.join)(process.cwd(), "prpm.json");
+  const prpmJsonPath = (0, import_path17.join)(process.cwd(), "prpm.json");
   let prpmJsonExists = false;
   let prpmJsonError = null;
   try {
@@ -17821,7 +18239,7 @@ async function findAndLoadManifests() {
       throw error;
     }
   }
-  const marketplaceJsonPath = (0, import_path18.join)(process.cwd(), ".claude", "marketplace.json");
+  const marketplaceJsonPath = (0, import_path17.join)(process.cwd(), ".claude", "marketplace.json");
   try {
     const content = await (0, import_promises7.readFile)(marketplaceJsonPath, "utf-8");
     const marketplaceData = JSON.parse(content);
@@ -17837,7 +18255,7 @@ async function findAndLoadManifests() {
     return { manifests, collections: [], source: ".claude/marketplace.json" };
   } catch (error) {
   }
-  const marketplaceJsonPluginPath = (0, import_path18.join)(process.cwd(), ".claude-plugin", "marketplace.json");
+  const marketplaceJsonPluginPath = (0, import_path17.join)(process.cwd(), ".claude-plugin", "marketplace.json");
   try {
     const content = await (0, import_promises7.readFile)(marketplaceJsonPluginPath, "utf-8");
     const marketplaceData = JSON.parse(content);
@@ -17970,8 +18388,8 @@ function getSafePackageName(manifest, userInfo, fallbackName) {
   return manifest.name;
 }
 async function createTarball(manifest) {
-  const tmpDir = (0, import_path18.join)((0, import_os4.tmpdir)(), `prpm-${(0, import_crypto2.randomBytes)(8).toString("hex")}`);
-  const tarballPath = (0, import_path18.join)(tmpDir, "package.tar.gz");
+  const tmpDir = (0, import_path17.join)((0, import_os4.tmpdir)(), `prpm-${(0, import_crypto2.randomBytes)(8).toString("hex")}`);
+  const tarballPath = (0, import_path17.join)(tmpDir, "package.tar.gz");
   try {
     await (0, import_promises7.mkdir)(tmpDir, { recursive: true });
     const filePaths = normalizeFilePaths2(manifest.files);
@@ -18028,14 +18446,14 @@ async function handlePublish(options) {
       throw new CLIError('\u274C Not logged in. Run "prpm login" first.', 1);
     }
     console.log("\u{1F4E6} Publishing package...\n");
-    const prpmJsonPath = (0, import_path18.join)(process.cwd(), "prpm.json");
-    const marketplaceJsonPath = (0, import_path18.join)(process.cwd(), ".claude", "marketplace.json");
-    const marketplaceJsonPluginPath = (0, import_path18.join)(process.cwd(), ".claude-plugin", "marketplace.json");
-    const hasManifest = (0, import_fs16.existsSync)(prpmJsonPath) || (0, import_fs16.existsSync)(marketplaceJsonPath) || (0, import_fs16.existsSync)(marketplaceJsonPluginPath);
+    const prpmJsonPath = (0, import_path17.join)(process.cwd(), "prpm.json");
+    const marketplaceJsonPath = (0, import_path17.join)(process.cwd(), ".claude", "marketplace.json");
+    const marketplaceJsonPluginPath = (0, import_path17.join)(process.cwd(), ".claude-plugin", "marketplace.json");
+    const hasManifest = (0, import_fs15.existsSync)(prpmJsonPath) || (0, import_fs15.existsSync)(marketplaceJsonPath) || (0, import_fs15.existsSync)(marketplaceJsonPluginPath);
     if (!hasManifest) {
       console.log("No prpm.json found. Let's create one first.\n");
       await smartInit({});
-      if (!(0, import_fs16.existsSync)(prpmJsonPath)) {
+      if (!(0, import_fs15.existsSync)(prpmJsonPath)) {
         throw new CLIError("No prpm.json was created. Cannot publish without a manifest.", 1);
       }
       console.log("\n\u{1F4E6} Continuing with publish...\n");
@@ -18044,7 +18462,7 @@ async function handlePublish(options) {
     const { manifests, collections, source } = await findAndLoadManifests();
     if (source === "prpm.json (multi-package)" || source === "prpm.json") {
       try {
-        const prpmJsonPath2 = (0, import_path18.join)(process.cwd(), "prpm.json");
+        const prpmJsonPath2 = (0, import_path17.join)(process.cwd(), "prpm.json");
         const prpmContent = await (0, import_promises7.readFile)(prpmJsonPath2, "utf-8");
         const prpmManifest = JSON.parse(prpmContent);
         if (prpmManifest.scripts) {
@@ -19222,15 +19640,15 @@ function createConfigCommand() {
 init_cjs_shims();
 var import_commander21 = require("commander");
 var import_promises8 = require("fs/promises");
-var import_path19 = require("path");
+var import_path18 = require("path");
 init_telemetry();
 init_lockfile();
 init_errors();
 function detectPackageInfo(filePath, content) {
-  const fileName = (0, import_path19.basename)(filePath);
+  const fileName = (0, import_path18.basename)(filePath);
   const lowerFileName = fileName.toLowerCase();
   if (fileName === "SKILL.md") {
-    const dirName = (0, import_path19.basename)((0, import_path19.join)(filePath, ".."));
+    const dirName = (0, import_path18.basename)((0, import_path18.join)(filePath, ".."));
     return {
       format: "claude",
       subtype: "skill",
@@ -19282,8 +19700,8 @@ async function scanDirectory3(dirPath, baseDir, scanDir, maxDepth = 5, currentDe
   try {
     const entries = await (0, import_promises8.readdir)(dirPath, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_path19.join)(dirPath, entry.name);
-      const relativePath = (0, import_path19.relative)(baseDir, fullPath);
+      const fullPath = (0, import_path18.join)(dirPath, entry.name);
+      const relativePath = (0, import_path18.relative)(baseDir, fullPath);
       if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist" || entry.name === "build") {
         continue;
       }
@@ -19420,7 +19838,7 @@ async function handleCatalog(directories, options) {
       success = true;
       return;
     }
-    const prpmJsonPath = options.output || (0, import_path19.join)(process.cwd(), "prpm.json");
+    const prpmJsonPath = options.output || (0, import_path18.join)(process.cwd(), "prpm.json");
     let manifest;
     if (options.append) {
       try {
@@ -19458,7 +19876,7 @@ async function handleCatalog(directories, options) {
       }
       let description = `${discovered.format} ${discovered.subtype}`;
       try {
-        const firstFilePath = (0, import_path19.join)(process.cwd(), discovered.scanDir, discovered.files[0]);
+        const firstFilePath = (0, import_path18.join)(process.cwd(), discovered.scanDir, discovered.files[0]);
         const content = await (0, import_promises8.readFile)(firstFilePath, "utf-8");
         const extractedDesc = extractDescription6(content);
         if (extractedDesc) {
@@ -20709,57 +21127,57 @@ function createStarredCommand() {
 init_cjs_shims();
 var import_commander27 = require("commander");
 var import_promises9 = require("fs/promises");
-var import_path20 = require("path");
-var import_fs17 = require("fs");
+var import_path19 = require("path");
+var import_fs16 = require("fs");
 var import_readline = require("readline");
 var import_chalk2 = __toESM(require_source());
 init_errors();
 init_dist();
 function getDefaultPath(format, filename, subtype, customName) {
-  const baseName = customName || (0, import_path20.basename)(filename, (0, import_path20.extname)(filename));
+  const baseName = customName || (0, import_path19.basename)(filename, (0, import_path19.extname)(filename));
   switch (format) {
     case "cursor":
       if (subtype === "slash-command") {
-        return (0, import_path20.join)(process.cwd(), ".cursor", "commands", `${baseName}.md`);
+        return (0, import_path19.join)(process.cwd(), ".cursor", "commands", `${baseName}.md`);
       }
-      return (0, import_path20.join)(process.cwd(), ".cursor", "rules", `${baseName}.mdc`);
+      return (0, import_path19.join)(process.cwd(), ".cursor", "rules", `${baseName}.mdc`);
     case "claude":
       if (subtype === "skill") {
-        return (0, import_path20.join)(process.cwd(), ".claude", "skills", baseName, "SKILL.md");
+        return (0, import_path19.join)(process.cwd(), ".claude", "skills", baseName, "SKILL.md");
       } else if (subtype === "slash-command") {
-        return (0, import_path20.join)(process.cwd(), ".claude", "commands", `${baseName}.md`);
+        return (0, import_path19.join)(process.cwd(), ".claude", "commands", `${baseName}.md`);
       } else {
-        return (0, import_path20.join)(process.cwd(), ".claude", "agents", `${baseName}.md`);
+        return (0, import_path19.join)(process.cwd(), ".claude", "agents", `${baseName}.md`);
       }
     case "windsurf":
-      return (0, import_path20.join)(process.cwd(), ".windsurf", "rules", `${baseName}.md`);
+      return (0, import_path19.join)(process.cwd(), ".windsurf", "rules", `${baseName}.md`);
     case "kiro":
       if (subtype === "hook") {
-        return (0, import_path20.join)(process.cwd(), ".kiro", "hooks", `${baseName}.kiro.hook`);
+        return (0, import_path19.join)(process.cwd(), ".kiro", "hooks", `${baseName}.kiro.hook`);
       }
       if (subtype === "agent") {
-        return (0, import_path20.join)(process.cwd(), ".kiro", "agents", `${baseName}.json`);
+        return (0, import_path19.join)(process.cwd(), ".kiro", "agents", `${baseName}.json`);
       }
-      return (0, import_path20.join)(process.cwd(), ".kiro", "steering", `${baseName}.md`);
+      return (0, import_path19.join)(process.cwd(), ".kiro", "steering", `${baseName}.md`);
     case "copilot":
-      return (0, import_path20.join)(process.cwd(), ".github", "instructions", `${baseName}.instructions.md`);
+      return (0, import_path19.join)(process.cwd(), ".github", "instructions", `${baseName}.instructions.md`);
     case "continue":
       if (subtype === "slash-command" || subtype === "prompt") {
-        return (0, import_path20.join)(process.cwd(), ".continue", "prompts", `${baseName}.md`);
+        return (0, import_path19.join)(process.cwd(), ".continue", "prompts", `${baseName}.md`);
       }
-      return (0, import_path20.join)(process.cwd(), ".continue", "rules", `${baseName}.md`);
+      return (0, import_path19.join)(process.cwd(), ".continue", "rules", `${baseName}.md`);
     case "agents.md":
-      return (0, import_path20.join)(process.cwd(), "agents.md");
+      return (0, import_path19.join)(process.cwd(), "agents.md");
     case "gemini":
-      return (0, import_path20.join)(process.cwd(), ".gemini", "commands", `${baseName}.toml`);
+      return (0, import_path19.join)(process.cwd(), ".gemini", "commands", `${baseName}.toml`);
     case "ruler":
-      return (0, import_path20.join)(process.cwd(), ".ruler", `${baseName}.md`);
+      return (0, import_path19.join)(process.cwd(), ".ruler", `${baseName}.md`);
     default:
       throw new CLIError(`Unknown format: ${format}`);
   }
 }
 function detectFormat(content, filepath) {
-  const ext = (0, import_path20.extname)(filepath).toLowerCase();
+  const ext = (0, import_path19.extname)(filepath).toLowerCase();
   if (ext === ".mdc" || filepath.includes(".cursor/rules") || filepath.includes(".cursor/commands")) {
     return "cursor";
   }
@@ -20781,7 +21199,7 @@ function detectFormat(content, filepath) {
   if (filepath.includes(".continue/rules") || filepath.includes(".continue/prompts") || filepath.includes(".continuerules")) {
     return "continue";
   }
-  if ((0, import_path20.basename)(filepath) === "agents.md") {
+  if ((0, import_path19.basename)(filepath) === "agents.md") {
     return "agents.md";
   }
   if (ext === ".toml" || filepath.includes(".gemini/commands")) {
@@ -20939,14 +21357,14 @@ async function handleConvert(sourcePath, options) {
     }
     console.log(import_chalk2.default.green(`\u2713 Converted from ${sourceFormat} to ${options.to}`));
     const outputPath = options.output || getDefaultPath(options.to, sourcePath, options.subtype, options.name);
-    if ((0, import_fs17.existsSync)(outputPath) && !options.yes) {
+    if ((0, import_fs16.existsSync)(outputPath) && !options.yes) {
       const shouldOverwrite = await confirmOverwrite(outputPath);
       if (!shouldOverwrite) {
         console.log(import_chalk2.default.yellow("\n\u2716 Conversion cancelled"));
         return;
       }
     }
-    const outputDir = (0, import_path20.dirname)(outputPath);
+    const outputDir = (0, import_path19.dirname)(outputPath);
     await (0, import_promises9.mkdir)(outputDir, { recursive: true });
     console.log(import_chalk2.default.dim("Writing converted file..."));
     await (0, import_promises9.writeFile)(outputPath, result.content, "utf-8");
@@ -21012,8 +21430,8 @@ Valid subtypes: ${validSubtypes.join(", ")}`
 // src/commands/export.ts
 init_cjs_shims();
 var import_commander28 = require("commander");
-var import_fs18 = require("fs");
-var import_path21 = require("path");
+var import_fs17 = require("fs");
+var import_path20 = require("path");
 var import_chalk3 = __toESM(require_source());
 init_errors();
 init_lockfile();
@@ -21029,17 +21447,17 @@ async function exportToRuler(options) {
   }
   console.log(import_chalk3.default.green(`\u2713 Found ${packages.length} installed package${packages.length === 1 ? "" : "s"}`));
   console.log();
-  const outputDir = options.output || (0, import_path21.join)(process.cwd(), ".ruler");
+  const outputDir = options.output || (0, import_path20.join)(process.cwd(), ".ruler");
   let rulerExists = false;
   try {
-    await import_fs18.promises.access(outputDir);
+    await import_fs17.promises.access(outputDir);
     rulerExists = true;
   } catch {
   }
   if (!rulerExists) {
     console.log(import_chalk3.default.yellow(`\u26A0 ${outputDir} directory not found`));
     console.log(import_chalk3.default.dim("Creating .ruler directory..."));
-    await import_fs18.promises.mkdir(outputDir, { recursive: true });
+    await import_fs17.promises.mkdir(outputDir, { recursive: true });
     console.log(import_chalk3.default.green(`\u2713 Created ${outputDir}/`));
     console.log();
   }
@@ -21053,11 +21471,11 @@ async function exportToRuler(options) {
       continue;
     }
     try {
-      const content = await import_fs18.promises.readFile(pkg.installedPath, "utf-8");
+      const content = await import_fs17.promises.readFile(pkg.installedPath, "utf-8");
       const rulerContent = createRulerFormat(pkg.id, pkg.version, content, pkg.format, pkg.subtype);
       const rulerFilename = `${packageName}.md`;
-      const rulerPath = (0, import_path21.join)(outputDir, rulerFilename);
-      await import_fs18.promises.writeFile(rulerPath, rulerContent, "utf-8");
+      const rulerPath = (0, import_path20.join)(outputDir, rulerFilename);
+      await import_fs17.promises.writeFile(rulerPath, rulerContent, "utf-8");
       console.log(import_chalk3.default.green(`\u2713 Exported ${pkg.id} \u2192 ${rulerFilename}`));
       exportedCount++;
     } catch (error) {
@@ -21096,9 +21514,9 @@ function createRulerFormat(packageId, version, content, format, subtype) {
   return frontmatter + contentWithoutFrontmatter;
 }
 async function ensureRulerConfig(rulerDir) {
-  const configPath = (0, import_path21.join)((0, import_path21.dirname)(rulerDir), "ruler.toml");
+  const configPath = (0, import_path20.join)((0, import_path20.dirname)(rulerDir), "ruler.toml");
   try {
-    await import_fs18.promises.access(configPath);
+    await import_fs17.promises.access(configPath);
     console.log(import_chalk3.default.dim("\u2139 ruler.toml already exists (not modified)"));
   } catch {
     const basicConfig = `# Ruler Configuration
@@ -21124,7 +21542,7 @@ async function ensureRulerConfig(rulerDir) {
 # [agents.github-copilot]
 # enabled = false
 `;
-    await import_fs18.promises.writeFile(configPath, basicConfig, "utf-8");
+    await import_fs17.promises.writeFile(configPath, basicConfig, "utf-8");
     console.log(import_chalk3.default.green(`\u2713 Created ruler.toml configuration template`));
   }
 }
@@ -21194,8 +21612,8 @@ init_telemetry();
 init_errors();
 function getVersion() {
   try {
-    const packageJsonPath = (0, import_path22.join)(__dirname, "../package.json");
-    const packageJson = JSON.parse((0, import_fs19.readFileSync)(packageJsonPath, "utf-8"));
+    const packageJsonPath = (0, import_path21.join)(__dirname, "../package.json");
+    const packageJson = JSON.parse((0, import_fs18.readFileSync)(packageJsonPath, "utf-8"));
     return packageJson.version || "0.0.0";
   } catch {
     return "0.0.0";