feat(pack): add mcpb bundling support with cvm manifest conventions

.changeset/feat-cvmb-bundling.md

@@ -0,0 +1,5 @@
+---
+'cvmi': minor
+---
+
+Added `.cvmb` (CVM Bundle) support: a new `cvmi pack` command packages an MCP server into a signed `.cvmb` bundle (ZIP archive with a `manifest.json`), and `cvmi serve <bundle.cvmb>` extracts, verifies, and runs it. Bundles support both `stdio` (Gateway-wrapped) and `cvm` (native Nostr transport) modes, typed `user_config` with secrets handling, Merkle-tree `content_hash` integrity binding, and Nostr Schnorr manifest signatures via `nostr-tools`.

AGENTS.md

@@ -8,14 +8,15 @@ This file provides guidance to AI coding agents working on the `cvmi` CLI codeba
 
 ## Commands
 
-| Command              | Description                                         |
-| -------------------- | --------------------------------------------------- |
-| `cvmi`               | Show banner with available commands                 |
-| `cvmi add <pkg>`     | Install skills from git repos, URLs, or local paths |
-| `cvmi check`         | Check for available skill updates                   |
-| `cvmi update`        | Update all skills to latest versions                |
-| `cvmi pn` / `cn`     | Compile a server to TypeScript code                 |
-| `cvmi generate-lock` | Match installed skills to sources via API           |
+| Command              | Description                                               |
+| -------------------- | --------------------------------------------------------- |
+| `cvmi`               | Show banner with available commands                       |
+| `cvmi add <pkg>`     | Install skills from git repos, URLs, or local paths       |
+| `cvmi pack`          | Package an MCP server into a distributable `.cvmb` bundle |
+| `cvmi check`         | Check for available skill updates                         |
+| `cvmi update`        | Update all skills to latest versions                      |
+| `cvmi pn` / `cn`     | Compile a server to TypeScript code                       |
+| `cvmi generate-lock` | Match installed skills to sources via API                 |
 
 Aliases: `cvmi a`, `cvmi i`, `cvmi install` all work for `add`.
 
@@ -25,6 +26,8 @@ Aliases: `cvmi a`, `cvmi i`, `cvmi install` all work for `add`.
 src/
 ├── cli.ts           # Main entry point, command routing, init/check/update
 ├── cli.test.ts      # CLI tests
+├── pack.ts          # Pack command implementation
+├── pack/            # Pack utilities (extract, cvm-manifest, pack-init)
 ├── add.ts           # Core add command logic
 ├── add.test.ts      # Add command tests
 ├── cn/              # Client generation (ctxcn) module

package.json

@@ -95,6 +95,9 @@
   "dependencies": {
     "@contextvm/sdk": "^0.11.14",
     "@modelcontextprotocol/sdk": "^1.27.1",
+    "archiver": "^8.0.0",
+    "canonicalize": "^2.1.0",
+    "extract-zip": "^2.0.1",
     "json-schema-to-typescript": "15.0.4",
     "nostr-tools": "^2.23.3",
     "xdg-basedir": "^5.1.0",
@@ -103,6 +106,7 @@
   "devDependencies": {
     "@changesets/cli": "^2.30.0",
     "@clack/prompts": "^0.11.0",
+    "@types/archiver": "^8.0.0",
     "@types/bun": "latest",
     "@types/node": "^22.19.15",
     "gray-matter": "^4.0.3",