# Contributing

Thank you for looking. This project is maintained by one person with heavy use of Claude Code; clear, small changes are the easiest to accept.

# Two ways to contribute

Publish an artifact. Accounts and namespaces are created by the operator in V1. Write to contact@spboucher.ai with the namespace you would like and a line about what you plan to publish. Then follow /docs/publishing.

Change the registry itself. Read CLAUDE.md, docs/IMPLEMENTATION_PLAN.md and the ADRs first. Open an issue or email before a large change.

# Local setup

Requirements: Node 20 or newer (developed on 26), pnpm 11, PostgreSQL 17 running locally with the citext and pg_trgm extensions available.

pnpm install
createdb skills_dev
cp .env.example .env && chmod 600 .env     # fill DATABASE_URL, TOKEN_PEPPER (openssl rand -hex 32), DATA_DIR
pnpm db:migrate
pnpm admin:bootstrap --email you@example.org --name "You" --namespace yourns
pnpm dev

# Checks before you propose a change

pnpm typecheck
pnpm test          # unit + integration; needs a local PostgreSQL where you can create databases
pnpm test:e2e      # when you touched the UI

Integration tests create a database named skills_test_<random> and a temporary data directory per test file and drop both afterwards. Set TEST_ADMIN_DATABASE_URL if your PostgreSQL is not on the default socket.

# Rules

• No feature without a test when it touches authentication, authorization, upload handling, release state or audit. Look at tests/integration for the style: tests go through handleApi like a real client.
• Never weaken or skip a security test to get green.
• Never edit an applied migration; add a new numbered file.
• Shared limits, scopes and enumerations belong in packages/registry-core/src/constants.ts.
• Authorization is enforced in services, not in UI code.
• No secrets in code, tests, fixtures, docs or commit messages. Test fixtures that need token-shaped strings build them at runtime.
• No fabricated numbers, ratings or testimonials anywhere in the product or docs.
• Update docs/IMPLEMENTATION_PLAN.md when a status changes, and add an ADR when you make a decision someone will later ask "why" about.
• Keep documentation honest about what is implemented, tested and planned.

# Licence

By contributing you agree that your contribution is licensed under the MIT licence of this repository. Artifacts you publish to the registry keep the licence you declare for them.