apm-cli 0.18.0__tar.gz → 0.19.0__tar.gz

{apm_cli-0.18.0 → apm_cli-0.19.0}/AUTHORS

@@ -4,6 +4,7 @@
 
 * Daniel Meppiel (@danielmeppiel) — Microsoft
 * Sergio Sisternes (@sergio-sisternes-epam) — EPAM Systems
+* Nadav Yogev (@nadav-y) — JFrog
 
 Maintainers' work on APM is supported by their employers. Project
 decisions are made in the interest of APM and its users, independent

{apm_cli-0.18.0/src/apm_cli.egg-info → apm_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.18.0
+Version: 0.19.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License

{apm_cli-0.18.0 → apm_cli-0.19.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.18.0"
+version = "0.19.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/base.py

@@ -633,22 +633,25 @@ class MCPClientAdapter(ABC):
         return server_info
 
     @staticmethod
-    def _determine_config_key(server_url: str, server_name: str) -> str:
+    def _determine_config_key(server_url: str, server_name: str | None) -> str:
         """Return the configuration key to use for *server_url*/*server_name*.
 
-        The caller-supplied *server_name* takes precedence; if empty the last
-        path segment of *server_url* is used as a fallback, which mirrors the
-        convention ``owner/repo -> repo``.
+        The caller-supplied *server_name* takes precedence. If it is absent,
+        preserve npm-style scoped names such as ``@scope/name`` (one slash by
+        npm convention) while keeping the historical ``owner/repo -> repo``
+        fallback for registry paths.
 
         Args:
             server_url: Registry reference used as fallback source.
-            server_name: Explicit caller-supplied name (may be empty string).
+            server_name: Explicit caller-supplied name, if any.
 
         Returns:
             Non-empty configuration key string.
         """
         if server_name:
             return server_name
+        if server_url.startswith("@") and server_url.count("/") == 1:
+            return server_url
         if "/" in server_url:
             return server_url.split("/")[-1]
         return server_url

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/claude.py

@@ -239,12 +239,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                 _rich_error(f"MCP server '{server_url}' not found in registry")
                 return False
 
-            if server_name:
-                config_key = server_name
-            elif "/" in server_url:
-                config_key = server_url.split("/")[-1]
-            else:
-                config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
             ok = self.update_config({config_key: server_config})

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/codex.py

@@ -150,19 +150,7 @@ class CodexClientAdapter(MCPClientAdapter):
             if server_info is None:
                 return False
 
-            # Determine the server name for configuration key
-            if server_name:
-                # Use explicitly provided server name
-                config_key = server_name
-            else:  # noqa: PLR5501
-                # Extract name from server_url (part after last slash)
-                # For URLs like "microsoft/azure-devops-mcp" -> "azure-devops-mcp"
-                # For URLs like "github/github-mcp-server" -> "github-mcp-server"
-                if "/" in server_url:  # noqa: SIM108
-                    config_key = server_url.split("/")[-1]
-                else:
-                    # Fallback to full server_url if no slash
-                    config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             # Generate server configuration with environment variable resolution
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/copilot.py

@@ -206,19 +206,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             # Generate server configuration with environment and runtime variable resolution
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
 
-            # Determine the server name for configuration key
-            if server_name:
-                # Use explicitly provided server name
-                config_key = server_name
-            else:  # noqa: PLR5501
-                # Extract name from server_url (part after last slash)
-                # For URLs like "microsoft/azure-devops-mcp" -> "azure-devops-mcp"
-                # For URLs like "github/github-mcp-server" -> "github-mcp-server"
-                if "/" in server_url:  # noqa: SIM108
-                    config_key = server_url.split("/")[-1]
-                else:
-                    # Fallback to full server_url if no slash
-                    config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             # Update configuration using the chosen key
             self.update_config({config_key: server_config})

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -51,6 +51,9 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
     "agent-skills": {
         ".github/skills/": ".agents/skills/",
     },
+    "openclaw": {
+        ".github/skills/": ".agents/skills/",
+    },
 }
 
 

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/cli.py

@@ -4,6 +4,7 @@ Thin wiring layer  -- all command logic lives in ``apm_cli.commands.*`` modules.
 """
 
 import ctypes
+import logging
 import os
 import sys
 import warnings
@@ -61,6 +62,48 @@ _CLI_EPILOG = (
 )
 
 
+def _configure_logging(verbose: bool = False) -> None:
+    """Configure stdlib logging for the ``apm_cli`` package.
+
+    Two mechanisms activate debug-level output (either is sufficient):
+
+    * ``--verbose`` / ``-v`` flag on the ``apm`` command.
+    * ``APM_LOG_LEVEL=DEBUG`` environment variable (accepts any stdlib
+      level name: DEBUG, INFO, WARNING, ERROR, CRITICAL).
+
+    When neither is set the ``apm_cli`` logger defaults to WARNING so
+    routine runs stay silent.  A :class:`~apm_cli.core.auth.SecretRedactionFilter`
+    is always installed on the ``apm_cli`` logger to strip token-bearing
+    exception strings from debug records regardless of which mechanism
+    activated debug mode.
+    """
+    env_level_str = os.environ.get("APM_LOG_LEVEL", "").strip().upper()
+    env_level: int | None = (
+        getattr(logging, env_level_str, None) if env_level_str.isalpha() else None
+    )
+
+    if verbose:
+        level = logging.DEBUG
+    elif env_level is not None:
+        level = env_level
+    else:
+        level = logging.WARNING
+
+    logging.basicConfig(
+        level=level,
+        format="%(levelname)s %(name)s %(message)s",
+        stream=sys.stderr,
+    )
+    apm_logger = logging.getLogger("apm_cli")
+    apm_logger.setLevel(level)
+
+    # Install secret-redaction filter (idempotent: skip if already present).
+    from apm_cli.core.auth import SecretRedactionFilter
+
+    if not any(isinstance(f, SecretRedactionFilter) for f in apm_logger.filters):
+        apm_logger.addFilter(SecretRedactionFilter())
+
+
 @click.group(
     help="Agent Package Manager (APM): The package manager for AI-Native Development",
     epilog=_CLI_EPILOG,
@@ -73,10 +116,22 @@ _CLI_EPILOG = (
     is_eager=True,
     help="Show version and exit.",
 )
+@click.option(
+    "--verbose",
+    "-v",
+    is_flag=True,
+    default=False,
+    help="Enable debug-level logging (equivalent to APM_LOG_LEVEL=DEBUG).",
+)
 @click.pass_context
-def cli(ctx):
+def cli(ctx, verbose: bool) -> None:
     """Main entry point for the APM CLI."""
     ctx.ensure_object(dict)
+    ctx.obj["verbose"] = verbose
+
+    if verbose:
+        # Upgrade to DEBUG when the flag is set; env-var path runs in main().
+        _configure_logging(verbose=True)
 
     # Suppress only the agents-target deprecation warning so CLI users see
     # the formatted logger.warning() in the install phase, not a double print.
@@ -267,6 +322,7 @@ def _configure_encoding() -> None:
 
 def main():
     """Main entry point for the CLI."""
+    _configure_logging()  # honours APM_LOG_LEVEL env var; --verbose upgrades in cli()
     _configure_encoding()
     try:
         cli(obj={})

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/commands/audit.py

@@ -103,6 +103,39 @@ def _has_actionable_findings(
     )
 
 
+def _finding_source(finding: ScanFinding) -> str:
+    """Derive the scanner source from a finding's category prefix."""
+    if "/" in finding.category:
+        prefix = finding.category.split("/", 1)[0]
+        if prefix != "apm":
+            return prefix
+    return "apm"
+
+
+def _has_external_findings(rows: list[ScanFinding]) -> bool:
+    """Return True if any finding originates from an external scanner."""
+    return any(_finding_source(f) != "apm" for f in rows)
+
+
+def _source_counts(rows: list[ScanFinding]) -> dict[str, int]:
+    """Count findings by source for the table title."""
+    counts: dict[str, int] = {}
+    for f in rows:
+        src = _finding_source(f)
+        counts[src] = counts.get(src, 0) + 1
+    return counts
+
+
+def _findings_title(rows: list[ScanFinding], has_external: bool) -> str:
+    """Build the findings table title, with per-source counts when mixed."""
+    base = f"{STATUS_SYMBOLS['search']} Audit Findings"
+    if not has_external:
+        return f"{STATUS_SYMBOLS['search']} Content Scan Findings"
+    counts = _source_counts(rows)
+    parts = [f"{src}: {n}" for src, n in sorted(counts.items())]
+    return f"{base}  ({', '.join(parts)})"
+
+
 def _render_findings_table(
     findings_by_file: dict[str, list[ScanFinding]],
     verbose: bool = False,
@@ -124,6 +157,9 @@ def _render_findings_table(
     if not rows:
         return
 
+    has_external = _has_external_findings(rows)
+    title = _findings_title(rows, has_external)
+
     if console:
         try:
             from rich.table import Table
@@ -131,14 +167,19 @@ def _render_findings_table(
             from ..security.audit_report import relative_path_for_report
 
             table = Table(
-                title=f"{STATUS_SYMBOLS['search']} Content Scan Findings",
+                title=title,
                 show_header=True,
                 header_style="bold cyan",
             )
             table.add_column("Severity", style="bold", width=10)
+            if has_external:
+                table.add_column("Source", style="cyan", width=14)
             table.add_column("File", style="white")
             table.add_column("Location", style="dim", width=10)
-            table.add_column("Codepoint", style="bold white", width=10)
+            if has_external:
+                table.add_column("Category", style="bold white")
+            else:
+                table.add_column("Codepoint", style="bold white", width=10)
             table.add_column("Description", style="white")
 
             sev_styles = {
@@ -147,12 +188,26 @@ def _render_findings_table(
                 "info": "dim",
             }
             for f in rows:
+                category_or_codepoint = (
+                    f.category.split("/", 1)[1]
+                    if has_external and "/" in f.category
+                    else f.category
+                    if has_external
+                    else f.codepoint
+                )
+                row_cells = [f.severity.upper()]
+                if has_external:
+                    row_cells.append(_finding_source(f))
+                row_cells.extend(
+                    [
+                        relative_path_for_report(f.file),
+                        f"{f.line}:{f.column}",
+                        category_or_codepoint,
+                        f.description,
+                    ]
+                )
                 table.add_row(
-                    f.severity.upper(),
-                    relative_path_for_report(f.file),
-                    f"{f.line}:{f.column}",
-                    f.codepoint,
-                    f.description,
+                    *row_cells,
                     style=sev_styles.get(f.severity, "white"),
                 )
             console.print()
@@ -163,18 +218,17 @@ def _render_findings_table(
 
     # Fallback: plain text
     _rich_echo("")
-    _rich_echo(
-        f"{STATUS_SYMBOLS['search']} Content Scan Findings",
-        color="cyan",
-        bold=True,
-    )
+    _rich_echo(title, color="cyan", bold=True)
     for f in rows:
         sev_label = f.severity.upper()
         color = (
             "red" if f.severity == "critical" else ("yellow" if f.severity == "warning" else "dim")
         )
+        source_part = f" [{_finding_source(f)}]" if has_external else ""
+        detail = f.category if has_external else f.codepoint
         _rich_echo(
-            f"  {sev_label:<10} {f.file} {f.line}:{f.column}  {f.codepoint}  {f.description}",
+            f"  {sev_label:<10}{source_part} {f.file} {f.line}:{f.column}  {detail}  "
+            f"{f.description}",
             color=color,
         )
 
@@ -669,7 +723,7 @@ def _run_external_scanners(
         require_external_scanners_enabled("Ingesting external scanners with --external")
     except ExternalScannersFeatureDisabledError as exc:
         logger.error(str(exc))
-        sys.exit(2)
+        sys.exit(3)
 
     try:
         return run_external_scanners(
@@ -681,7 +735,7 @@ def _run_external_scanners(
         )
     except ExternalScanError as exc:
         logger.error(str(exc))
-        sys.exit(2)
+        sys.exit(3)
 
 
 def _audit_content_scan(
@@ -713,8 +767,9 @@ def _audit_content_scan(
 
     # --format json/sarif/markdown is incompatible with --strip / --dry-run
     if effective_format != "text" and (strip or dry_run):
-        logger.error(f"--format {effective_format} cannot be combined with --strip or --dry-run")
-        sys.exit(1)
+        raise click.UsageError(
+            f"--format {effective_format} cannot be combined with --strip or --dry-run"
+        )
 
     if file_path:
         # -- File mode: scan a single arbitrary file --
@@ -997,6 +1052,7 @@ def _audit_content_scan(
     help=(
         "Ingest findings from an external SARIF-native scanner "
         "(repeatable). Names: skillspector, sarif. "
+        "Not supported with --ci. "
         "Requires 'apm experimental enable external-scanners'. [experimental]"
     ),
 )
@@ -1070,6 +1126,8 @@ def audit(  # noqa: PLR0913 -- Click handler
            (including drift in --ci mode)
         2  Warning-only findings (suspicious but not critical), or
            usage error (mutually exclusive flags)
+        3  Configuration or infrastructure error (experimental feature
+           disabled, external scanner not installed or unavailable)
 
     \b
     Examples:
@@ -1084,6 +1142,8 @@ def audit(  # noqa: PLR0913 -- Click handler
         apm audit --ci -f json         # JSON CI report
         apm audit --ci -f sarif        # SARIF for GitHub Code Scanning
         apm audit -o report.sarif      # Write SARIF to file
+        apm audit --external skillspector                    # SkillSpector
+        apm audit --external sarif --external-sarif r.sarif  # Any SARIF
     """
     project_root = Path.cwd()
     logger = CommandLogger("audit", verbose=verbose)
@@ -1110,17 +1170,17 @@ def audit(  # noqa: PLR0913 -- Click handler
         if verbose:
             logger.warning("--verbose has no effect in --ci mode (output is structured)")
         if strip or dry_run or file_path or package:
-            logger.error("--ci cannot be combined with --strip, --dry-run, --file, or PACKAGE")
-            sys.exit(1)
+            raise click.UsageError(
+                "--ci cannot be combined with --strip, --dry-run, --file, or PACKAGE"
+            )
         if output_format == "markdown":
             logger.error("--ci does not support --format markdown. Use json or sarif.")
             sys.exit(1)
         if external:
-            logger.error(
+            raise click.UsageError(
                 "--ci does not support --external scanners yet. "
                 "Run external scanners in bare 'apm audit' mode."
             )
-            sys.exit(1)
 
         _audit_ci_gate(cfg, policy_source, no_cache, no_policy, no_fail_fast, no_drift)
         return  # _audit_ci_gate calls sys.exit; return guards against fall-through
@@ -1129,8 +1189,7 @@ def audit(  # noqa: PLR0913 -- Click handler
     # They cannot be combined with --strip/--dry-run (APM only knows how to
     # strip the Unicode characters its own scanner detects).
     if external and (strip or dry_run):
-        logger.error("--external cannot be combined with --strip or --dry-run")
-        sys.exit(1)
+        raise click.UsageError("--external cannot be combined with --strip or --dry-run")
     if external_sarif and not external:
         raise click.UsageError("--external-sarif requires '--external sarif'")
     # Orphan-flag guards: scanner-config flags are meaningless without a

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/commands/compile/cli.py

@@ -234,10 +234,21 @@ def _resolve_compile_target(target):
                 families.add("agents")
 
         if len(families) >= 2:
-            # Single-target copilot collapses {"vscode","agents"} to bare
-            # "vscode" for routing parity with single-string -t copilot.
+            # Collapse {"vscode","agents"} to bare "vscode" ONLY when the
+            # original target list contains no non-Copilot agents-family
+            # targets (e.g. codex, opencode, windsurf).  When mixed targets
+            # like [copilot, codex] are requested, keep the frozenset so
+            # downstream dedup logic knows non-Copilot targets also consume
+            # AGENTS.md (issue #1678).
             if families == {"vscode", "agents"}:
-                return "vscode"
+                _vscode_names = {"copilot", "vscode", "agents"}
+                has_non_vscode_agents = any(
+                    name in target_set
+                    for name, profile in KNOWN_TARGETS.items()
+                    if profile.compile_family == "agents" and name not in _vscode_names
+                )
+                if not has_non_vscode_agents:
+                    return "vscode"
             return frozenset(families)
         if "claude" in families:
             return "claude"

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/commands/experimental.py

@@ -244,7 +244,7 @@ def enable_flag(ctx, name: str, verbose: bool):
     from ..core.experimental import is_enabled
 
     if is_enabled(normalised):
-        logger.warning(f"{display_name(normalised)} is already enabled.")
+        logger.progress(f"{display_name(normalised)} is already enabled.")
         return
 
     flag = _enable_flag(normalised)
@@ -274,7 +274,7 @@ def disable_flag(ctx, name: str, verbose: bool):
     from ..core.experimental import is_enabled
 
     if not is_enabled(normalised):
-        logger.warning(f"{display_name(normalised)} is already disabled.")
+        logger.progress(f"{display_name(normalised)} is already disabled.")
         return
 
     _disable_flag(normalised)

{apm_cli-0.18.0 → apm_cli-0.19.0}/src/apm_cli/commands/publish.py

@@ -10,20 +10,21 @@ resolver (``apm experimental enable registries``).
 from __future__ import annotations
 
 import re
-import tarfile
+import zipfile
 from pathlib import Path
 
 import click
 
 from ..core.command_logger import CommandLogger
 from ..deps.registry.feature_gate import require_package_registry_enabled
+from ..utils.paths import portable_relpath
 
 _PUBLISH_HELP = """\
 Publish a package to a registry.
 
-Reads apm.yml for the package name/version, packs a flat registry archive
-(``apm.yml`` + ``.apm/`` at the tarball root — not ``apm pack`` plugin bundles),
-or uses a pre-built tarball via --tarball, then uploads to the registry via
+Reads apm.yml for the package name/version, packs a flat registry zip archive
+(``apm.yml`` + ``.apm/`` at the archive root — not ``apm pack`` plugin bundles),
+or uses a pre-built zip via --zip, then uploads to the registry via
 PUT /v1/packages/{owner}/{repo}/versions/{version}.
 
 Requires the 'registries' experimental feature:
@@ -37,8 +38,8 @@ Examples:
   # Choose a registry when multiple are configured:
   apm publish --registry corp-main
 
-  # Publish a pre-built tarball (skip the pack step):
-  apm publish --tarball ./build/my-package-1.0.0.tar.gz
+  # Publish a pre-built zip (skip the pack step):
+  apm publish --zip ./build/my-package-1.0.0.zip
 
   # Preview what would be uploaded:
   apm publish --dry-run
@@ -60,16 +61,16 @@ Examples:
     help="Package identity to publish as (owner/repo, e.g. acme/my-skill).",
 )
 @click.option(
-    "--tarball",
-    "tarball_path",
+    "--zip",
+    "zip_path",
     type=click.Path(exists=True, dir_okay=False),
     default=None,
-    help="Path to a pre-built .tar.gz tarball. Skips the pack step.",
+    help="Path to a pre-built .zip archive. Skips the pack step.",
 )
 @click.option("--dry-run", is_flag=True, default=False, help="Preview without uploading.")
 @click.option("--verbose", "-v", is_flag=True, help="Show detailed output.")
 @click.pass_context
-def publish_cmd(ctx, registry_name, package_id, tarball_path, dry_run, verbose):
+def publish_cmd(ctx, registry_name, package_id, zip_path, dry_run, verbose):
     """Publish a package version to a registry."""
     require_package_registry_enabled("apm publish")
 
@@ -100,18 +101,18 @@ def publish_cmd(ctx, registry_name, package_id, tarball_path, dry_run, verbose):
     registry_name = _resolve_registry_name(registry_name, registries)
     base_url = registries[registry_name]
 
-    # ----------------------------------------------------------- tarball
-    if tarball_path:
-        tarball = Path(tarball_path)
+    # ----------------------------------------------------------- zip archive
+    if zip_path:
+        archive = Path(zip_path)
     else:
-        tarball = _pack_archive(project_root, apm_yml_path, pkg, logger, verbose)
+        archive = _pack_archive(project_root, apm_yml_path, pkg, logger, verbose)
 
-    tarball_size = tarball.stat().st_size
+    archive_size = archive.stat().st_size
 
     # ----------------------------------------------------------- dry-run
     if dry_run:
         logger.info(f"Would publish {owner}/{repo}@{version} to {registry_name} ({base_url})")
-        logger.info(f"  tarball : {tarball}  ({tarball_size:,} bytes)")
+        logger.info(f"  archive : {archive}  ({archive_size:,} bytes)")
         logger.info("(dry-run — nothing uploaded)")
         return
 
@@ -124,9 +125,9 @@ def publish_cmd(ctx, registry_name, package_id, tarball_path, dry_run, verbose):
 
     logger.info(f"Publishing {owner}/{repo}@{version} to {registry_name} …")
 
-    tarball_bytes = tarball.read_bytes()
+    archive_bytes = archive.read_bytes()
     try:
-        result = client.publish_version(owner, repo, version, tarball_bytes)
+        result = client.publish_version(owner, repo, version, archive_bytes)
     except RegistryError as exc:
         _handle_publish_error(exc, owner, repo, version, registry_name, base_url)
 
@@ -184,14 +185,14 @@ def _resolve_registry_name(name: str | None, registries: dict[str, str]) -> str:
 
 
 def _pack_archive(project_root: Path, apm_yml_path: Path, pkg, logger, verbose: bool) -> Path:
-    """Build a flat registry tarball (``apm.yml`` + ``.apm/`` at archive root).
+    """Build a flat registry zip archive (``apm.yml`` + ``.apm/`` at archive root).
 
     Also includes ``README.md``, ``CHANGELOG.md``, and ``LICENSE`` (case-
     insensitive, no extension required for LICENSE) when present — matching
     npm's behaviour of bundling standard root-level documentation files.
 
     Registry servers and ``apm install`` expect the APM source layout at the
-    tarball root — not the ``apm pack --archive`` plugin bundle wrapper
+    archive root — not the ``apm pack --archive`` plugin bundle wrapper
     (``{name}-{version}/plugin.json``). See registry HTTP API §6.
     """
     apm_dir = project_root / ".apm"
@@ -199,10 +200,10 @@ def _pack_archive(project_root: Path, apm_yml_path: Path, pkg, logger, verbose:
         raise click.ClickException(
             "Registry publish requires a flat APM package (.apm/ directory).\n"
             "Add .apm/ with your primitives (skills, instructions, etc.), "
-            "or pass --tarball with a pre-built flat archive."
+            "or pass --zip with a pre-built flat archive."
         )
 
-    archive_name = f"{pkg.name}-{pkg.version}.tar.gz"
+    archive_name = f"{pkg.name}-{pkg.version}.zip"
     dest = project_root / archive_name
     if dest.exists():
         dest.unlink()
@@ -210,21 +211,20 @@ def _pack_archive(project_root: Path, apm_yml_path: Path, pkg, logger, verbose:
     if verbose:
         logger.info(f"Packing flat registry archive -> {dest.name}")
 
-    def _tar_filter(ti: tarfile.TarInfo) -> tarfile.TarInfo | None:
-        # Skip macOS AppleDouble sidecars (._*) that break registry validation.
-        if any(part.startswith("._") for part in Path(ti.name).parts):
-            return None
-        if Path(ti.name).name == ".DS_Store":
-            return None
-        return ti
+    def _should_skip(path: Path) -> bool:
+        # Skip macOS AppleDouble sidecars (._*) and .DS_Store that break registry validation.
+        return any(part.startswith("._") for part in path.parts) or path.name == ".DS_Store"
 
     # Standard root-level doc files included when present (npm parity).
     # Matched case-insensitively; LICENSE has no required extension.
     _DOC_CANDIDATES = ("README.md", "CHANGELOG.md", "LICENSE", "LICENCE")
 
-    with tarfile.open(dest, mode="w:gz") as tar:
-        tar.add(apm_yml_path, arcname="apm.yml", filter=_tar_filter, recursive=False)
-        tar.add(apm_dir, arcname=".apm", filter=_tar_filter)
+    with zipfile.ZipFile(dest, mode="w", compression=zipfile.ZIP_DEFLATED) as zf:
+        if not _should_skip(apm_yml_path):
+            zf.write(apm_yml_path, arcname="apm.yml")
+        for file in sorted(apm_dir.rglob("*")):
+            if file.is_file() and not file.is_symlink() and not _should_skip(file):
+                zf.write(file, arcname=portable_relpath(file, project_root))
         for candidate in _DOC_CANDIDATES:
             # Case-insensitive match against actual filenames in project root.
             match = next(
@@ -235,8 +235,8 @@ def _pack_archive(project_root: Path, apm_yml_path: Path, pkg, logger, verbose:
                 ),
                 None,
             )
-            if match:
-                tar.add(match, arcname=match.name, filter=_tar_filter, recursive=False)
+            if match and not _should_skip(match):
+                zf.write(match, arcname=match.name)
                 if verbose:
                     logger.info(f"  bundling {match.name}")