vskill 0.1.1 → 0.1.2

package/dist/commands/submit.js

@@ -1,8 +1,9 @@
 // ---------------------------------------------------------------------------
-// vskill submit -- submit a skill for verification
+// vskill submit -- open browser for skill submission via GitHub OAuth
 // ---------------------------------------------------------------------------
-import { submitSkill } from "../api/client.js";
+import { openBrowser } from "../utils/browser.js";
 import { bold, green, red, dim, cyan } from "../utils/output.js";
+import { validateRepoSegment, validateSkillName } from "../utils/validation.js";
 export async function submitCommand(source, opts) {
     // Parse owner/repo
     const parts = source.split("/");
@@ -11,24 +12,33 @@ export async function submitCommand(source, opts) {
         process.exit(1);
     }
     const [owner, repo] = parts;
-    const repoUrl = `https://github.com/${owner}/${repo}`;
-    console.log(dim(`Submitting ${bold(`${owner}/${repo}`)} for verification...\n`));
+    if (!validateRepoSegment(owner) || !validateRepoSegment(repo)) {
+        console.error(red("Invalid owner/repo name. ") + dim("Only letters, numbers, dots, hyphens, and underscores are allowed."));
+        process.exit(1);
+    }
+    if (opts.skill && !validateSkillName(opts.skill)) {
+        console.error(red("Invalid skill name. ") + dim("Path traversal patterns are not allowed."));
+        process.exit(1);
+    }
+    const submitUrl = new URL("https://verified-skill.com/submit");
+    submitUrl.searchParams.set("repo", `${owner}/${repo}`);
+    if (opts.skill) {
+        submitUrl.searchParams.set("skill", opts.skill);
+    }
+    const url = submitUrl.toString();
+    console.log(dim(`Opening browser to submit ${bold(`${owner}/${repo}`)} for verification...\n`));
     try {
-        const result = await submitSkill({
-            repoUrl,
-            skillName: repo,
-            email: opts.email,
-        });
-        console.log(green("Submission received!\n"));
-        console.log(`${bold("Submission ID:")} ${result.id}`);
-        console.log(`${bold("Status:")}        ${result.status}`);
-        console.log(`${bold("Track at:")}      ${cyan(result.trackingUrl || `https://verified-skill.com/submissions/${result.id}`)}`);
-        console.log(dim("\nYou will receive updates as the review progresses."));
+        await openBrowser(url);
+        console.log(green("Browser opened!\n"));
+        console.log(`Complete your submission in the browser at:`);
+        console.log(cyan(url));
+        console.log(dim("\nYou will authenticate with GitHub and complete the submission there."));
     }
     catch (err) {
-        console.error(red("Submission failed: ") +
+        console.error(red("Could not open browser: ") +
             dim(err.message));
-        process.exit(1);
+        console.log(`\nOpen this URL manually in your browser:`);
+        console.log(cyan(url));
     }
 }
 //# sourceMappingURL=submit.js.map

package/dist/commands/submit.js.map

@@ -1 +1 @@
-{"version":3,"file":"submit.js","sourceRoot":"","sources":["../../src/commands/submit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAMjE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,IAAmB;IAEnB,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CACzD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,sBAAsB,KAAK,IAAI,IAAI,EAAE,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,OAAO;YACP,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,0CAA0C,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,CACjH,CAAC;QACF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,sDAAsD,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,qBAAqB,CAAC;YACxB,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAC9B,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"submit.js","sourceRoot":"","sources":["../../src/commands/submit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAMhF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,IAAmB;IAEnB,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CACzD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,2BAA2B,CAAC,GAAG,GAAG,CAAC,oEAAoE,CAAC,CAC7G,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,sBAAsB,CAAC,GAAG,GAAG,CAAC,0CAA0C,CAAC,CAC9E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC/D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAEhG,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,CAAC,0BAA0B,CAAC;YAC7B,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAC9B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/commands/submit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/submit.test.js

@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+// ---------------------------------------------------------------------------
+// Mock the browser opener module (will be created in submit.ts)
+// ---------------------------------------------------------------------------
+const mockOpenBrowser = vi.fn().mockResolvedValue(undefined);
+vi.mock("../utils/browser.js", () => ({
+    openBrowser: (...args) => mockOpenBrowser(...args),
+}));
+// ---------------------------------------------------------------------------
+// Mock utils/output (suppress console output in tests)
+// ---------------------------------------------------------------------------
+vi.mock("../utils/output.js", () => ({
+    bold: (s) => s,
+    green: (s) => s,
+    red: (s) => s,
+    yellow: (s) => s,
+    dim: (s) => s,
+    cyan: (s) => s,
+}));
+// ---------------------------------------------------------------------------
+// Import module under test AFTER mocks
+// ---------------------------------------------------------------------------
+const { submitCommand } = await import("./submit.js");
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(console, "log").mockImplementation(() => { });
+    vi.spyOn(console, "error").mockImplementation(() => { });
+});
+describe("submitCommand", () => {
+    // TC-001: Given owner/repo arg, constructs correct URL with repo query param
+    describe("TC-001: constructs URL with repo query param", () => {
+        it("opens browser with https://verified-skill.com/submit?repo=owner/repo", async () => {
+            await submitCommand("myorg/myskill", {});
+            expect(mockOpenBrowser).toHaveBeenCalledOnce();
+            const url = mockOpenBrowser.mock.calls[0][0];
+            expect(url).toBe("https://verified-skill.com/submit?repo=myorg%2Fmyskill");
+        });
+    });
+    // TC-002: Given --skill flag, URL includes skill query param
+    describe("TC-002: URL includes skill query param when --skill provided", () => {
+        it("appends &skill=skillName to the URL", async () => {
+            await submitCommand("myorg/myskill", { skill: "my-awesome-skill" });
+            expect(mockOpenBrowser).toHaveBeenCalledOnce();
+            const url = mockOpenBrowser.mock.calls[0][0];
+            expect(url).toBe("https://verified-skill.com/submit?repo=myorg%2Fmyskill&skill=my-awesome-skill");
+        });
+    });
+    // TC-003: Invalid source format still rejected
+    describe("TC-003: rejects invalid source format", () => {
+        it("exits with error for source without slash", async () => {
+            const exitError = new Error("process.exit");
+            const mockExit = vi
+                .spyOn(process, "exit")
+                .mockImplementation(() => { throw exitError; });
+            await expect(submitCommand("invalid-source", {})).rejects.toThrow("process.exit");
+            expect(mockExit).toHaveBeenCalledWith(1);
+            expect(mockOpenBrowser).not.toHaveBeenCalled();
+            mockExit.mockRestore();
+        });
+    });
+    // TC-004: Prints message telling user to complete in browser
+    describe("TC-004: prints browser instructions", () => {
+        it("logs a message about completing submission in browser", async () => {
+            const consoleSpy = vi.spyOn(console, "log");
+            await submitCommand("myorg/myskill", {});
+            const allOutput = consoleSpy.mock.calls.map((c) => c.join(" ")).join("\n");
+            expect(allOutput).toContain("browser");
+        });
+    });
+});
+//# sourceMappingURL=submit.test.js.map

package/dist/commands/submit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit.test.js","sourceRoot":"","sources":["../../src/commands/submit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAC9E,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAE7D,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,WAAW,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAC9E,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;CACvB,CAAC,CAAC,CAAC;AAEJ,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAC9E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;AAEtD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAC5D,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,aAAa,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAEzC,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;YACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;QAC5E,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,aAAa,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAEpE,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;YACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACd,+EAA+E,CAChF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,EAAE;iBAChB,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;iBACtB,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAElD,MAAM,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAElF,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAE/C,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE5C,MAAM,aAAa,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAEzC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -17,8 +17,10 @@ program
 });
 program
     .command("add <source>")
-    .description("Install a skill from GitHub with security scanning")
+    .description("Install a skill from GitHub or local plugin directory")
     .option("--skill <name>", "Skill name within a multi-skill repo")
+    .option("--plugin <name>", "Plugin name from marketplace.json")
+    .option("--plugin-dir <path>", "Local plugin directory path")
     .option("--global", "Install to global agent directories")
     .option("--force", "Install even if scan finds issues")
     .action(async (source, opts) => {
@@ -41,6 +43,16 @@ program
     const { listCommand } = await import("./commands/list.js");
     await listCommand(opts);
 });
+program
+    .command("remove <skill-name>")
+    .description("Remove an installed skill from all agents")
+    .option("--global", "Only remove from global agent directories")
+    .option("--local", "Only remove from local agent directories")
+    .option("--force", "Skip confirmation and proceed even if not in lockfile")
+    .action(async (skillName, opts) => {
+    const { removeCommand } = await import("./commands/remove.js");
+    await removeCommand(skillName, opts);
+});
 program
     .command("find <query>")
     .description("Search the verified-skill.com registry")
@@ -59,10 +71,17 @@ program
 program
     .command("submit <source>")
     .description("Submit a skill for verification on verified-skill.com")
-    .option("--email <email>", "Email for submission updates")
+    .option("--skill <name>", "Skill name within a multi-skill repo")
     .action(async (source, opts) => {
     const { submitCommand } = await import("./commands/submit.js");
     await submitCommand(source, opts);
 });
+program
+    .command("blocklist [subcommand] [name]")
+    .description("Manage the malicious skills blocklist")
+    .action(async (subcommand, name) => {
+    const { blocklistCommand } = await import("./commands/blocklist.js");
+    await blocklistCommand(subcommand || "list", name);
+});
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,qEAAqE,CAAC;KAClF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEzC,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;KAChE,MAAM,CAAC,UAAU,EAAE,qCAAqC,CAAC;KACzD,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,UAAU,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;IAC9B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,2CAA2C,CAAC;KACxD,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,KAAyB,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;KACzD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,qEAAqE,CAAC;KAClF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEzC,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;KAChE,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,CAAC;KAC9D,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;KAC5D,MAAM,CAAC,UAAU,EAAE,qCAAqC,CAAC;KACzD,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC;KACvD,MAAM,CAAC,UAAU,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,qBAAqB,CAAC;KAC9B,WAAW,CAAC,2CAA2C,CAAC;KACxD,MAAM,CAAC,UAAU,EAAE,2CAA2C,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,IAAI,EAAE,EAAE;IACxC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;IAC9B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,2CAA2C,CAAC;KACxD,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,KAAyB,EAAE,IAAI,EAAE,EAAE;IAChD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,+BAA+B,CAAC;KACxC,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,UAAmB,EAAE,IAAa,EAAE,EAAE;IACnD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACrE,MAAM,gBAAgB,CAAC,UAAU,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/lockfile/lockfile.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lockfile/lockfile.test.js

@@ -0,0 +1,196 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+// ---------------------------------------------------------------------------
+// Mock node:fs
+// ---------------------------------------------------------------------------
+const mockReadFileSync = vi.fn();
+const mockWriteFileSync = vi.fn();
+const mockExistsSync = vi.fn();
+vi.mock("node:fs", () => ({
+    readFileSync: (...args) => mockReadFileSync(...args),
+    writeFileSync: (...args) => mockWriteFileSync(...args),
+    existsSync: (...args) => mockExistsSync(...args),
+}));
+// Import after mock is set up
+const { readLockfile, writeLockfile, ensureLockfile, addSkillToLock, removeSkillFromLock, } = await import("./lockfile.js");
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+const TEST_DIR = "/tmp/test-project";
+const LOCK_PATH = `${TEST_DIR}/vskill.lock`;
+function makeLock(overrides = {}) {
+    return {
+        version: 1,
+        agents: [],
+        skills: {},
+        createdAt: "2026-01-01T00:00:00.000Z",
+        updatedAt: "2026-01-01T00:00:00.000Z",
+        ...overrides,
+    };
+}
+function makeEntry(overrides = {}) {
+    return {
+        version: "1.0.0",
+        sha: "abc123",
+        tier: "SCANNED",
+        installedAt: "2026-01-01T00:00:00.000Z",
+        source: "registry",
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-02-17T12:00:00.000Z"));
+});
+afterEach(() => {
+    vi.useRealTimers();
+});
+describe("readLockfile", () => {
+    it("returns null when file does not exist", () => {
+        mockExistsSync.mockReturnValue(false);
+        const result = readLockfile(TEST_DIR);
+        expect(result).toBeNull();
+        expect(mockExistsSync).toHaveBeenCalledWith(LOCK_PATH);
+        expect(mockReadFileSync).not.toHaveBeenCalled();
+    });
+    it("returns null on invalid JSON", () => {
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue("not valid json {{{");
+        const result = readLockfile(TEST_DIR);
+        expect(result).toBeNull();
+    });
+    it("parses a valid lockfile", () => {
+        const lock = makeLock({ agents: ["claude"] });
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue(JSON.stringify(lock));
+        const result = readLockfile(TEST_DIR);
+        expect(result).toEqual(lock);
+        expect(mockReadFileSync).toHaveBeenCalledWith(LOCK_PATH, "utf-8");
+    });
+});
+describe("writeLockfile", () => {
+    it("writes JSON with updated timestamp", () => {
+        const lock = makeLock();
+        writeLockfile(lock, TEST_DIR);
+        expect(lock.updatedAt).toBe("2026-02-17T12:00:00.000Z");
+        expect(mockWriteFileSync).toHaveBeenCalledWith(LOCK_PATH, JSON.stringify(lock, null, 2) + "\n", "utf-8");
+    });
+});
+describe("ensureLockfile", () => {
+    it("creates a new lockfile when none exists", () => {
+        mockExistsSync.mockReturnValue(false);
+        const result = ensureLockfile(TEST_DIR);
+        expect(result.version).toBe(1);
+        expect(result.agents).toEqual([]);
+        expect(result.skills).toEqual({});
+        expect(result.createdAt).toBe("2026-02-17T12:00:00.000Z");
+        expect(mockWriteFileSync).toHaveBeenCalled();
+    });
+    it("returns existing lockfile without writing", () => {
+        const existing = makeLock({ agents: ["cursor"] });
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue(JSON.stringify(existing));
+        const result = ensureLockfile(TEST_DIR);
+        expect(result).toEqual(existing);
+        expect(mockWriteFileSync).not.toHaveBeenCalled();
+    });
+});
+describe("addSkillToLock", () => {
+    it("adds a skill entry to the lockfile", () => {
+        const existing = makeLock();
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue(JSON.stringify(existing));
+        const entry = makeEntry({ version: "2.0.0", tier: "VERIFIED" });
+        addSkillToLock("my-skill", entry, TEST_DIR);
+        // writeLockfile should have been called with the skill added
+        expect(mockWriteFileSync).toHaveBeenCalledTimes(1);
+        const writtenJson = JSON.parse(mockWriteFileSync.mock.calls[0][1].trimEnd());
+        expect(writtenJson.skills["my-skill"]).toEqual(entry);
+    });
+});
+describe("removeSkillFromLock", () => {
+    it("removes a skill entry from the lockfile", () => {
+        const existing = makeLock({
+            skills: {
+                "skill-a": makeEntry(),
+                "skill-b": makeEntry({ version: "3.0.0" }),
+            },
+        });
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue(JSON.stringify(existing));
+        removeSkillFromLock("skill-a", TEST_DIR);
+        expect(mockWriteFileSync).toHaveBeenCalledTimes(1);
+        const writtenJson = JSON.parse(mockWriteFileSync.mock.calls[0][1].trimEnd());
+        expect(writtenJson.skills).not.toHaveProperty("skill-a");
+        expect(writtenJson.skills).toHaveProperty("skill-b");
+    });
+    it("is a no-op when no lockfile exists", () => {
+        mockExistsSync.mockReturnValue(false);
+        removeSkillFromLock("nonexistent", TEST_DIR);
+        expect(mockWriteFileSync).not.toHaveBeenCalled();
+    });
+});
+// ---------------------------------------------------------------------------
+// TC-008: Extended entry with marketplace field round-trips
+// ---------------------------------------------------------------------------
+describe("lockfile extended fields", () => {
+    it("TC-008: extended entry with marketplace field round-trips", () => {
+        const extendedEntry = makeEntry({
+            marketplace: "specweave",
+            pluginDir: true,
+            scope: "user",
+            installedPath: "~/.claude/plugins/cache/specweave/sw/1.0.0",
+        });
+        const lock = makeLock({ skills: { "sw-frontend": extendedEntry } });
+        mockExistsSync.mockReturnValue(true);
+        // Write the lockfile
+        writeLockfile(lock, TEST_DIR);
+        // Capture what was written
+        const writtenJson = JSON.parse(mockWriteFileSync.mock.calls[0][1].trimEnd());
+        // Simulate reading it back
+        mockReadFileSync.mockReturnValue(JSON.stringify(writtenJson));
+        const readBack = readLockfile(TEST_DIR);
+        expect(readBack).not.toBeNull();
+        const entry = readBack.skills["sw-frontend"];
+        expect(entry.marketplace).toBe("specweave");
+        expect(entry.pluginDir).toBe(true);
+        expect(entry.scope).toBe("user");
+        expect(entry.installedPath).toBe("~/.claude/plugins/cache/specweave/sw/1.0.0");
+        // Original fields still present
+        expect(entry.version).toBe("1.0.0");
+        expect(entry.sha).toBe("abc123");
+        expect(entry.tier).toBe("SCANNED");
+        expect(entry.source).toBe("registry");
+    });
+    // TC-009: Backward-compatible with existing entries
+    it("TC-009: backward-compatible with existing entries", () => {
+        // Old-format entry with only the original fields
+        const oldEntry = {
+            version: "1.0.0",
+            sha: "abc123",
+            tier: "SCANNED",
+            installedAt: "2026-01-01T00:00:00.000Z",
+            source: "registry",
+        };
+        const lock = makeLock({ skills: { "old-skill": oldEntry } });
+        mockExistsSync.mockReturnValue(true);
+        mockReadFileSync.mockReturnValue(JSON.stringify(lock));
+        const result = readLockfile(TEST_DIR);
+        expect(result).not.toBeNull();
+        const entry = result.skills["old-skill"];
+        expect(entry.version).toBe("1.0.0");
+        expect(entry.sha).toBe("abc123");
+        expect(entry.tier).toBe("SCANNED");
+        expect(entry.installedAt).toBe("2026-01-01T00:00:00.000Z");
+        expect(entry.source).toBe("registry");
+        // New fields should be undefined
+        expect(entry.marketplace).toBeUndefined();
+        expect(entry.pluginDir).toBeUndefined();
+        expect(entry.scope).toBeUndefined();
+        expect(entry.installedPath).toBeUndefined();
+    });
+});
+//# sourceMappingURL=lockfile.test.js.map

package/dist/lockfile/lockfile.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.test.js","sourceRoot":"","sources":["../../src/lockfile/lockfile.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGzE,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAClC,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE/B,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxB,YAAY,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;IAC/D,aAAa,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;IACjE,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;CAC5D,CAAC,CAAC,CAAC;AAEJ,8BAA8B;AAC9B,MAAM,EACJ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAElC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,MAAM,SAAS,GAAG,GAAG,QAAQ,cAAc,CAAC;AAE5C,SAAS,QAAQ,CAAC,YAAiC,EAAE;IACnD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,0BAA0B;QACrC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,YAAqC,EAAE;IACxD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0BAA0B;QACvC,MAAM,EAAE,UAAU;QAClB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,EAAE,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QAExB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAC5C,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACpC,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1D,MAAM,CAAC,iBAAiB,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC5B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE5C,6DAA6D;QAC7D,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC7C,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC;YACxB,MAAM,EAAE;gBACN,SAAS,EAAE,SAAS,EAAE;gBACtB,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAC3C;SACF,CAAC,CAAC;QACH,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3D,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEzC,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC7C,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEtC,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAC9E,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,aAAa,GAAG,SAAS,CAAC;YAC9B,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,MAAM;YACb,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QACpE,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAErC,qBAAqB;QACrB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE9B,2BAA2B;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC7C,CAAC;QAEF,2BAA2B;QAC3B,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,QAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAC9B,4CAA4C,CAC7C,CAAC;QACF,gCAAgC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,iDAAiD;QACjD,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,OAAO;YAChB,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,0BAA0B;YACvC,MAAM,EAAE,UAAU;SACnB,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE7D,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,iCAAiC;QACjC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lockfile/types.d.ts

@@ -4,6 +4,14 @@ export interface SkillLockEntry {
     tier: string;
     installedAt: string;
     source: string;
+    /** Marketplace origin (e.g. "specweave") */
+    marketplace?: string;
+    /** Whether this entry is a plugin directory (not a single SKILL.md) */
+    pluginDir?: boolean;
+    /** Installation scope: user-global or project-local */
+    scope?: "user" | "project";
+    /** Absolute path where the plugin was installed */
+    installedPath?: string;
 }
 export interface VskillLock {
     version: 1;

package/dist/marketplace/index.d.ts

@@ -0,0 +1,2 @@
+export type { MarketplacePlugin, MarketplaceManifest } from "./marketplace.js";
+export { getAvailablePlugins, getPluginSource, getPluginVersion, } from "./marketplace.js";

package/dist/marketplace/index.js

@@ -0,0 +1,2 @@
+export { getAvailablePlugins, getPluginSource, getPluginVersion, } from "./marketplace.js";
+//# sourceMappingURL=index.js.map

package/dist/marketplace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/marketplace/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/marketplace/marketplace.d.ts

@@ -0,0 +1,34 @@
+export interface MarketplacePlugin {
+    name: string;
+    source: string;
+    version: string;
+    description?: string;
+}
+export interface MarketplaceManifest {
+    name: string;
+    version: string;
+    plugins: MarketplacePlugin[];
+}
+/**
+ * Parse marketplace.json content and extract available plugins.
+ *
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Array of plugin entries, or empty array on parse failure
+ */
+export declare function getAvailablePlugins(content: string): MarketplacePlugin[];
+/**
+ * Get the source path for a named plugin from marketplace.json.
+ *
+ * @param name - Plugin name to look up (e.g. "sw-frontend")
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Source path (e.g. "./plugins/specweave-frontend") or null
+ */
+export declare function getPluginSource(name: string, content: string): string | null;
+/**
+ * Get the version for a named plugin from marketplace.json.
+ *
+ * @param name - Plugin name to look up
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Version string or null if not found
+ */
+export declare function getPluginVersion(name: string, content: string): string | null;

package/dist/marketplace/marketplace.js

@@ -0,0 +1,51 @@
+// ---------------------------------------------------------------------------
+// Marketplace.json parser -- parse .claude-plugin/marketplace.json
+// ---------------------------------------------------------------------------
+// ---- Parser ---------------------------------------------------------------
+/**
+ * Parse marketplace.json content and extract available plugins.
+ *
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Array of plugin entries, or empty array on parse failure
+ */
+export function getAvailablePlugins(content) {
+    try {
+        const manifest = JSON.parse(content);
+        if (!Array.isArray(manifest.plugins))
+            return [];
+        return manifest.plugins.map((p) => ({
+            name: p.name,
+            source: p.source,
+            version: p.version,
+            ...(p.description ? { description: p.description } : {}),
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Get the source path for a named plugin from marketplace.json.
+ *
+ * @param name - Plugin name to look up (e.g. "sw-frontend")
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Source path (e.g. "./plugins/specweave-frontend") or null
+ */
+export function getPluginSource(name, content) {
+    const plugins = getAvailablePlugins(content);
+    const found = plugins.find((p) => p.name === name);
+    return found?.source ?? null;
+}
+/**
+ * Get the version for a named plugin from marketplace.json.
+ *
+ * @param name - Plugin name to look up
+ * @param content - Raw JSON string from marketplace.json
+ * @returns Version string or null if not found
+ */
+export function getPluginVersion(name, content) {
+    const plugins = getAvailablePlugins(content);
+    const found = plugins.find((p) => p.name === name);
+    return found?.version ?? null;
+}
+//# sourceMappingURL=marketplace.js.map

package/dist/marketplace/marketplace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.js","sourceRoot":"","sources":["../../src/marketplace/marketplace.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAiB9E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;AAChC,CAAC"}

package/dist/marketplace/marketplace.test.d.ts

@@ -0,0 +1 @@
+export {};