feat: cloud integration (auth, protocol, pull)

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
 
       - run: pnpm i
 
-      - run: pnpm build
+      - run: pnpm -r build
 
       - run: pnpm publish -r --access public --no-git-checks
         env:

.github/workflows/test.yml

@@ -25,6 +25,7 @@ jobs:
           node-version: lts/*
           cache: pnpm
       - run: pnpm i
+      - run: pnpm --filter skilld-protocol build
       - run: pnpm lint
       - run: pnpm typecheck
       - run: pnpm build

build.config.ts

@@ -5,12 +5,14 @@ export default defineBuildConfig({
     {
       type: 'bundle',
       input: [
-        './src/index.ts',
         './src/cli-entry.ts',
         './src/cli.ts',
         './src/prepare.ts',
         './src/retriv/worker.ts',
       ],
+      rolldown: {
+        external: ['@napi-rs/keyring', /@napi-rs\/keyring-/],
+      },
     },
   ],
 })

package.json

@@ -31,14 +31,6 @@
     "cursor",
     "codex"
   ],
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.mts",
-      "import": "./dist/index.mjs"
-    }
-  },
-  "main": "./dist/index.mjs",
-  "types": "./dist/index.d.mts",
   "bin": {
     "skilld": "./dist/cli-entry.mjs"
   },
@@ -57,7 +49,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest",
     "test:run": "vitest run",
-    "release": "pnpm build && bumpp -x \"npx changelogen --output=CHANGELOG.md\"",
+    "release": "pnpm -r build && bumpp -r -x \"npx changelogen --output=CHANGELOG.md\"",
     "prepack": "pnpm run build",
     "prepare": "test -z \"$CI\" && skilld prepare || true"
   },
@@ -79,18 +71,23 @@
     "pathe": "catalog:",
     "retriv": "catalog:",
     "semver": "catalog:",
+    "skilld-protocol": "workspace:*",
     "sqlite-vec": "catalog:deps",
     "std-env": "catalog:",
     "typebox": "catalog:",
     "typescript": "catalog:",
     "unagent": "catalog:"
   },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.1.6"
+  },
   "devDependencies": {
     "@antfu/eslint-config": "catalog:dev-lint",
     "@types/node": "catalog:dev-build",
     "@types/semver": "catalog:",
     "@vitest/coverage-v8": "catalog:dev-test",
     "bumpp": "catalog:",
+    "eslint": "catalog:dev-lint",
     "obuild": "catalog:dev-build",
     "tsx": "catalog:",
     "vitest": "catalog:dev-test"

packages/protocol/README.md

@@ -0,0 +1,21 @@
+# skilld-protocol
+
+Wire shapes and constants shared between the [skilld CLI](https://github.com/skilld-dev/skilld) and [skilld.dev](https://skilld.dev). The single source of truth for everything that crosses that boundary: telemetry, audit, auth, device flow, collection manifests.
+
+## Install
+
+```sh
+pnpm add skilld-protocol
+```
+
+ESM-only. Node ≥18. One peer-free dep: `zod` v4.
+
+## Subpaths
+
+- `skilld-protocol/wire` — every endpoint shape as a zod schema (suffix `Schema`) and the matching inferred TS type (no suffix). Use `import { FooSchema }` for runtime validation; `import type { Foo }` for the type.
+- `skilld-protocol/constants` — readonly tuples backing the closed enums plus their inferred unions.
+- `skilld-protocol/test-fixtures` — canonical payloads each consumer round-trips through their schema on CI.
+
+## Repo
+
+This package lives inside the [skilld CLI](https://github.com/skilld-dev/skilld) monorepo at `packages/protocol`. The CLI consumes it as a workspace dep; skilld.dev consumes the published npm version.

packages/protocol/build.config.ts

@@ -0,0 +1,15 @@
+import { defineBuildConfig } from 'obuild/config'
+
+export default defineBuildConfig({
+  entries: [
+    {
+      type: 'bundle',
+      input: [
+        './src/wire.ts',
+        './src/constants.ts',
+        './src/test-fixtures.ts',
+      ],
+      outDir: './dist',
+    },
+  ],
+})

packages/protocol/eslint.config.mjs

@@ -0,0 +1,8 @@
+import antfu from '@antfu/eslint-config'
+
+export default antfu({
+  type: 'lib',
+  typescript: true,
+  stylistic: true,
+  ignores: ['dist', 'node_modules'],
+})

packages/protocol/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "skilld-protocol",
+  "type": "module",
+  "version": "0.2.2",
+  "description": "Wire shapes and constants shared between the skilld CLI and skilld.dev",
+  "author": {
+    "name": "Harlan Wilton",
+    "email": "harlan@harlanzw.com",
+    "url": "https://harlanzw.com/"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/skilld-dev/skilld.git",
+    "directory": "packages/protocol"
+  },
+  "keywords": ["skilld", "protocol", "zod", "schema"],
+  "sideEffects": false,
+  "exports": {
+    "./wire": {
+      "types": "./dist/wire.d.mts",
+      "import": "./dist/wire.mjs"
+    },
+    "./constants": {
+      "types": "./dist/constants.d.mts",
+      "import": "./dist/constants.mjs"
+    },
+    "./test-fixtures": {
+      "types": "./dist/test-fixtures.d.mts",
+      "import": "./dist/test-fixtures.mjs"
+    }
+  },
+  "files": ["dist"],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "obuild",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "publint": "publint",
+    "attw": "pnpm pack && attw skilld-protocol-*.tgz --ignore-rules no-resolution cjs-resolves-to-esm && rm skilld-protocol-*.tgz",
+    "prepack": "pnpm build"
+  },
+  "dependencies": {
+    "zod": "catalog:"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "catalog:dev-lint",
+    "@arethetypeswrong/cli": "catalog:",
+    "@types/node": "catalog:dev-build",
+    "eslint": "catalog:dev-lint",
+    "obuild": "catalog:dev-build",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:dev-test"
+  }
+}

packages/protocol/src/constants.ts

@@ -0,0 +1,63 @@
+/**
+ * Canonical readonly tuples for closed enums and their inferred TS unions.
+ *
+ * The wire schemas import these tuples for `z.enum(...)`. The TS unions are
+ * exported for tooling (autocomplete, exhaustive switches). Telemetry surface
+ * is intentionally open on the wire (`z.string().min(1).max(32)` in
+ * `wire/telemetry.ts`) so the CLI can ship new surfaces without a coordinated
+ * protocol bump; the closed tuple here is the *currently canonical* list.
+ */
+
+export const TELEMETRY_EVENTS = [
+  'install',
+  'install-failed',
+  'update',
+  'audit-warn',
+  'audit-fail',
+  'audit-blocked',
+  'auth-flow',
+  'pull-checklist',
+] as const
+
+export const TELEMETRY_SURFACES = [
+  'cli:add',
+  'cli:pull',
+  'cli:prepare',
+  'cli:update',
+  'cli:wizard',
+  'cli:auth',
+] as const
+
+export const SOURCE_KINDS = [
+  'npm',
+  'gh',
+  'crate',
+  'collection',
+  'curator',
+] as const
+
+export const AUDIT_STATUSES = [
+  'pass',
+  'warn',
+  'fail',
+  'unaudited',
+] as const
+
+export const AUDIT_ENTRY_STATUSES = [
+  'pass',
+  'warn',
+  'fail',
+] as const
+
+export const AUTH_FLOWS = [
+  'pkce',
+  'device',
+  'oidc',
+] as const
+
+export type TelemetryEvent = typeof TELEMETRY_EVENTS[number]
+export type TelemetrySurface = typeof TELEMETRY_SURFACES[number]
+export type SourceKind = typeof SOURCE_KINDS[number]
+export type AuditStatus = typeof AUDIT_STATUSES[number]
+export type AuditEntryStatus = typeof AUDIT_ENTRY_STATUSES[number]
+export type AuthFlow = typeof AUTH_FLOWS[number]