vskill 1.0.2 → 1.0.4

package/dist/eval-ui/index.html

@@ -46,7 +46,7 @@
         }
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DVbvMGAg.js"></script>
+    <script type="module" crossorigin src="/assets/index-BmriQsHr.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CycZyHaL.css">
     <link rel="stylesheet" crossorigin href="/assets/fonts-i7Lkz2zN.css">
   </head>

package/dist/lib/frontmatter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Frontmatter version upsert.
+ *
+ * After `vskill skill publish` succeeds, the registry returns the new
+ * version (which may have been auto-bumped server-side). To prevent the
+ * "phantom update available immediately after install" trap recorded in
+ * project_skill_version_publish_desync.md, the CLI writes the registry
+ * version back to the source SKILL.md frontmatter so that the next
+ * `vskill outdated` poll sees identical local + remote versions.
+ *
+ * Increment 0794 — US-002b / T-004.
+ */
+/**
+ * Insert or replace the top-level `version:` field in YAML frontmatter.
+ *
+ * Behaviour:
+ *   - If `version:` exists at column 1: replace its value (preserves
+ *     surrounding lines and quoting style of the source whenever possible).
+ *   - Else if `description:` exists at column 1: insert immediately after
+ *     the description block (skipping indented continuation lines).
+ *   - Else: append the version line at the end of the frontmatter.
+ *   - If the file has no frontmatter block at all: synthesise a minimal one.
+ *   - Indented `metadata.version` is never touched.
+ *
+ * Returns the full file content with the change applied. Pure function.
+ */
+export declare function upsertFrontmatterVersion(content: string, newVersion: string): string;
+/**
+ * Lightweight validation: round-trip the result through the frontmatter regex
+ * and ensure we still have a valid `---\n...\n---` block. Used by submit.ts
+ * as a defensive guard before writing back to disk (AC-US2b-04).
+ */
+export declare function validatesAsYamlFrontmatter(content: string): boolean;

package/dist/lib/frontmatter.js

@@ -0,0 +1,85 @@
+/**
+ * Frontmatter version upsert.
+ *
+ * After `vskill skill publish` succeeds, the registry returns the new
+ * version (which may have been auto-bumped server-side). To prevent the
+ * "phantom update available immediately after install" trap recorded in
+ * project_skill_version_publish_desync.md, the CLI writes the registry
+ * version back to the source SKILL.md frontmatter so that the next
+ * `vskill outdated` poll sees identical local + remote versions.
+ *
+ * Increment 0794 — US-002b / T-004.
+ */
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/;
+const TOP_VERSION_RE = /^version\s*:\s*[^\n]*\r?\n?/m;
+const HAS_DESCRIPTION_RE = /^description\s*:/m;
+/**
+ * Insert or replace the top-level `version:` field in YAML frontmatter.
+ *
+ * Behaviour:
+ *   - If `version:` exists at column 1: replace its value (preserves
+ *     surrounding lines and quoting style of the source whenever possible).
+ *   - Else if `description:` exists at column 1: insert immediately after
+ *     the description block (skipping indented continuation lines).
+ *   - Else: append the version line at the end of the frontmatter.
+ *   - If the file has no frontmatter block at all: synthesise a minimal one.
+ *   - Indented `metadata.version` is never touched.
+ *
+ * Returns the full file content with the change applied. Pure function.
+ */
+export function upsertFrontmatterVersion(content, newVersion) {
+    const match = content.match(FRONTMATTER_RE);
+    if (!match) {
+        return `---\nversion: ${newVersion}\n---\n${content}`;
+    }
+    const fmBody = match[1];
+    // Replace existing top-level `version:`
+    if (TOP_VERSION_RE.test(fmBody)) {
+        const newFm = fmBody.replace(TOP_VERSION_RE, (line) => {
+            // Preserve quoting style if present
+            const quotedMatch = line.match(/^version\s*:\s*("|')/);
+            if (quotedMatch) {
+                const quote = quotedMatch[1];
+                return `version: ${quote}${newVersion}${quote}\n`;
+            }
+            return `version: ${newVersion}\n`;
+        });
+        return content.replace(FRONTMATTER_RE, `---\n${newFm}\n---\n`);
+    }
+    // Insert after `description:` if present
+    const lines = fmBody.split(/\r?\n/);
+    const descIdx = lines.findIndex((line) => HAS_DESCRIPTION_RE.test(line));
+    let updatedLines;
+    if (descIdx >= 0) {
+        let insertAt = descIdx + 1;
+        // Skip continuation lines (indented under description)
+        while (insertAt < lines.length && /^\s+\S/.test(lines[insertAt]))
+            insertAt++;
+        updatedLines = [
+            ...lines.slice(0, insertAt),
+            `version: ${newVersion}`,
+            ...lines.slice(insertAt),
+        ];
+    }
+    else {
+        updatedLines = [...lines, `version: ${newVersion}`];
+    }
+    const newFm = updatedLines.join("\n");
+    return content.replace(FRONTMATTER_RE, `---\n${newFm}\n---\n`);
+}
+/**
+ * Lightweight validation: round-trip the result through the frontmatter regex
+ * and ensure we still have a valid `---\n...\n---` block. Used by submit.ts
+ * as a defensive guard before writing back to disk (AC-US2b-04).
+ */
+export function validatesAsYamlFrontmatter(content) {
+    const m = content.match(FRONTMATTER_RE);
+    if (!m)
+        return false;
+    // Sanity: no nested unclosed --- markers
+    const body = m[1];
+    if (/^---\s*$/m.test(body))
+        return false;
+    return true;
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/lib/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/lib/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAC1D,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,UAAkB;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,iBAAiB,UAAU,UAAU,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAExB,wCAAwC;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;YACpD,oCAAoC;YACpC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACvD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC7B,OAAO,YAAY,KAAK,GAAG,UAAU,GAAG,KAAK,IAAI,CAAC;YACpD,CAAC;YACD,OAAO,YAAY,UAAU,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,yCAAyC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,IAAI,YAAsB,CAAC;IAC3B,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;QAC3B,uDAAuD;QACvD,OAAO,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAAE,QAAQ,EAAE,CAAC;QAC7E,YAAY,GAAG;YACb,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;YAC3B,YAAY,UAAU,EAAE;YACxB,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;SACzB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,CAAC,GAAG,KAAK,EAAE,YAAY,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,yCAAyC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lockfile/authored.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Authored-skill tracking.
+ *
+ * Records skills that the current user has *published* (as opposed to
+ * *installed*). Source-origin skills don't appear in `vskill.lock` (only
+ * installs do), so without a separate manifest the `vskill outdated`
+ * poll silently ignores them — leaving publishers blind to their own
+ * downstream version drift (project_vskill_source_origin_update_tracking.md).
+ *
+ * File: `vskill.authored.json` at project root.
+ *
+ * Increment 0794 — US-006 / T-006.
+ */
+export interface AuthoredEntry {
+    /** Fully-qualified registry name, e.g. "owner/repo/skill". */
+    name: string;
+    /** Absolute or project-relative path to the source SKILL.md. */
+    sourcePath: string;
+    /** ISO timestamp of the most recent successful publish. */
+    publishedAt: string;
+}
+/**
+ * Insert or update an authored-skill entry. Idempotent: same name on the
+ * same source path is a no-op except for refreshing `publishedAt`.
+ */
+export declare function addAuthoredSkill(projectRoot: string, name: string, sourcePath: string, publishedAt?: string): void;
+/**
+ * Remove an authored-skill entry. No-op when the name is absent.
+ */
+export declare function removeAuthoredSkill(projectRoot: string, name: string): void;
+/**
+ * Read all authored entries as a flat array. Returns `[]` when the
+ * `vskill.authored.json` file is missing or unreadable (graceful degrade).
+ */
+export declare function readAuthored(projectRoot: string): AuthoredEntry[];

package/dist/lockfile/authored.js

@@ -0,0 +1,82 @@
+/**
+ * Authored-skill tracking.
+ *
+ * Records skills that the current user has *published* (as opposed to
+ * *installed*). Source-origin skills don't appear in `vskill.lock` (only
+ * installs do), so without a separate manifest the `vskill outdated`
+ * poll silently ignores them — leaving publishers blind to their own
+ * downstream version drift (project_vskill_source_origin_update_tracking.md).
+ *
+ * File: `vskill.authored.json` at project root.
+ *
+ * Increment 0794 — US-006 / T-006.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+const FILE_NAME = "vskill.authored.json";
+const SCHEMA_VERSION = 1;
+function authoredPath(projectRoot) {
+    return join(projectRoot, FILE_NAME);
+}
+function emptyFile() {
+    return { version: SCHEMA_VERSION, skills: {} };
+}
+function readFile(projectRoot) {
+    const filePath = authoredPath(projectRoot);
+    if (!existsSync(filePath))
+        return emptyFile();
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        // Backward-compatible read: tolerate older shapes.
+        if (parsed && typeof parsed === "object" && parsed.skills && typeof parsed.skills === "object") {
+            return {
+                version: typeof parsed.version === "number" ? parsed.version : SCHEMA_VERSION,
+                skills: parsed.skills,
+            };
+        }
+        return emptyFile();
+    }
+    catch {
+        return emptyFile();
+    }
+}
+function writeFile(projectRoot, file) {
+    const filePath = authoredPath(projectRoot);
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, JSON.stringify(file, null, 2) + "\n");
+}
+/**
+ * Insert or update an authored-skill entry. Idempotent: same name on the
+ * same source path is a no-op except for refreshing `publishedAt`.
+ */
+export function addAuthoredSkill(projectRoot, name, sourcePath, publishedAt) {
+    const file = readFile(projectRoot);
+    file.skills[name] = {
+        sourcePath,
+        publishedAt: publishedAt ?? new Date().toISOString(),
+    };
+    writeFile(projectRoot, file);
+}
+/**
+ * Remove an authored-skill entry. No-op when the name is absent.
+ */
+export function removeAuthoredSkill(projectRoot, name) {
+    const file = readFile(projectRoot);
+    if (!(name in file.skills))
+        return;
+    delete file.skills[name];
+    writeFile(projectRoot, file);
+}
+/**
+ * Read all authored entries as a flat array. Returns `[]` when the
+ * `vskill.authored.json` file is missing or unreadable (graceful degrade).
+ */
+export function readAuthored(projectRoot) {
+    const file = readFile(projectRoot);
+    return Object.entries(file.skills).map(([name, entry]) => ({
+        name,
+        sourcePath: entry.sourcePath,
+        publishedAt: entry.publishedAt,
+    }));
+}
+//# sourceMappingURL=authored.js.map

package/dist/lockfile/authored.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authored.js","sourceRoot":"","sources":["../../src/lockfile/authored.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,cAAc,GAAG,CAAC,CAAC;AAgBzB,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmB;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,mDAAmD;QACnD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/F,OAAO;gBACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;gBAC7E,MAAM,EAAE,MAAM,CAAC,MAAgC;aAChD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB,EAAE,IAAkB;IACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,IAAY,EACZ,UAAkB,EAClB,WAAoB;IAEpB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;QAClB,UAAU;QACV,WAAW,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAY;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO;IACnC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vskill",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "description": "Secure multi-platform AI skill installer — scan before you install",
   "bin": {