@hasna/skills 0.1.31 → 0.1.33

package/bin/mcp.js

@@ -6921,7 +6921,13 @@ function formatCost(cents) {
   return `$${(cents / 100).toFixed(2)}`;
 }
 function getAllPremiumSlugs() {
-  return [...PREMIUM_SKILLS.map((s) => s.slug), ARTICLE_GENERATION_SLUG];
+  return [
+    ...new Set([
+      ...PREMIUM_SKILLS.map((skill) => skill.slug),
+      ...MEDIA_GENERATION_PRICES.map((price) => price.slug),
+      ARTICLE_GENERATION_SLUG
+    ])
+  ].sort();
 }
 var MUSIC_ALBUM_SLUG = "music-album", MUSIC_ALBUM_SONG_COUNTS, MUSIC_ALBUM_COST_CENTS_PER_SONG = 150, PREMIUM_SKILLS, ARTICLE_GENERATION_SLUG = "blog-article", ARTICLE_MAX_COUNT = 12, ARTICLE_COUNT_ERROR, ARTICLE_INTERNAL_COST_CENTS = 5, ARTICLE_MARKUP_MULTIPLIER = 5, ARTICLE_USER_COST_CENTS, ARTICLE_TONES, ARTICLE_LENGTHS, MEDIA_GENERATION_PRICES, premiumIndex, mediaSlugs;
 var init_pricing = __esm(() => {
@@ -7064,12 +7070,19 @@ import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync
 import { join as join6, dirname as dirname2 } from "path";
 import { homedir as homedir3 } from "os";
 function validKeys() {
-  return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
+  return ["mode", ...Object.keys(ENUM_KEYS), ...STRING_KEYS];
+}
+function allowedValues(key) {
+  if (key === "mode")
+    return MODE_VALUES;
+  return ENUM_KEYS[key];
 }
 function normalizeConfigValue(key, value) {
   if (typeof value !== "string")
     return;
-  const allowed = ENUM_KEYS[key];
+  if (key === "mode")
+    return MODE_ALIASES[value.trim().toLowerCase()];
+  const allowed = allowedValues(key);
   if (allowed)
     return allowed.includes(value) ? value : undefined;
   if (key === "apiUrl") {
@@ -7127,15 +7140,23 @@ function loadConfig() {
   const projectConfig = readConfigFile(getConfigPath("project"));
   return { ...globalConfig2, ...projectConfig };
 }
-var ENUM_KEYS, STRING_KEYS;
+var ENUM_KEYS, STRING_KEYS, MODE_VALUES, MODE_ALIASES;
 var init_config = __esm(() => {
   ENUM_KEYS = {
-    mode: ["local", "skills.md"],
     defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
     defaultScope: ["global", "project"],
     format: ["compact", "json", "csv"]
   };
   STRING_KEYS = ["apiUrl"];
+  MODE_VALUES = ["local", "hosted"];
+  MODE_ALIASES = {
+    local: "local",
+    offline: "local",
+    hosted: "hosted",
+    remote: "hosted",
+    "skills.md": "hosted",
+    skillsmd: "hosted"
+  };
 });
 
 // src/lib/auth-store.ts
@@ -7148,14 +7169,14 @@ __export(exports_auth_store, {
   getApiKey: () => getApiKey,
   clearAuthConfig: () => clearAuthConfig
 });
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, unlinkSync } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4, unlinkSync } from "fs";
 import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 function getAuthConfig() {
   if (cachedConfig !== undefined)
     return cachedConfig;
   try {
-    const raw = readFileSync7(AUTH_FILE, "utf-8");
+    const raw = readFileSync7(existsSync7(AUTH_FILE) ? AUTH_FILE : LEGACY_AUTH_FILE, "utf-8");
     const config2 = JSON.parse(raw);
     if (!config2.apiKey || !config2.email) {
       cachedConfig = null;
@@ -7169,7 +7190,7 @@ function getAuthConfig() {
   }
 }
 function saveAuthConfig(config2) {
-  mkdirSync4(AUTH_DIR, { recursive: true });
+  mkdirSync4(AUTH_DIR, { recursive: true, mode: 448 });
   writeFileSync4(AUTH_FILE, JSON.stringify(config2, null, 2) + `
 `, { mode: 384 });
   cachedConfig = config2;
@@ -7178,6 +7199,9 @@ function clearAuthConfig() {
   try {
     unlinkSync(AUTH_FILE);
   } catch {}
+  try {
+    unlinkSync(LEGACY_AUTH_FILE);
+  } catch {}
   cachedConfig = null;
 }
 function getApiKey() {
@@ -7200,11 +7224,12 @@ function normalizeSkillsApiOrigin(apiUrl) {
 function getApiUrl() {
   return normalizeSkillsApiOrigin(process.env.SKILLS_API_URL || loadConfig().apiUrl || "https://skills.md");
 }
-var AUTH_DIR, AUTH_FILE, cachedConfig;
+var AUTH_DIR, AUTH_FILE, LEGACY_AUTH_FILE, cachedConfig;
 var init_auth_store = __esm(() => {
   init_config();
-  AUTH_DIR = join7(homedir4(), ".skills");
+  AUTH_DIR = join7(homedir4(), ".hasna", "skills");
   AUTH_FILE = join7(AUTH_DIR, "auth.json");
+  LEGACY_AUTH_FILE = join7(homedir4(), ".skills", "auth.json");
 });
 
 // src/lib/remote-client.ts
@@ -21768,7 +21793,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.1.31",
+  version: "0.1.33",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -32882,7 +32907,7 @@ function registerDiscoveryTools(server) {
 }
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
 import { join as join8 } from "path";
 
 // src/lib/run-state.ts
@@ -33271,13 +33296,13 @@ function registerOperationTools(server) {
     });
     if (isPremiumSkill2(skillName) && !apiKey) {
       const cost = formatCost2(costCents ?? 0);
-      const error48 = `${skillName} is a hosted skill (${cost}). Run: skills setup --mode skills.md && skills auth login`;
+      const error48 = `${skillName} is a hosted skill (${cost}). Run: skills setup --mode hosted && skills auth login`;
       writeRunLogs(runContext, "", error48 + `
 `);
       const run = completeSkillRun(runContext, { status: "failed", error: error48, costCents });
       return mcpError("AUTH_REQUIRED", `${error48}. Local run metadata: ${run.paths.runDir}/run.json`, ["skills auth login"]);
     }
-    if (apiKey) {
+    if (isPremiumSkill2(skillName) && apiKey) {
       try {
         const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
         const client = new RemoteSkillsClient2(apiKey);
@@ -33307,14 +33332,11 @@ function registerOperationTools(server) {
           nextActions: remoteRunNextActions(remoteRunId)
         });
       } catch (err) {
-        console.error(`[skills] skills.md API failed for ${skillName}, falling back to local:`, err.message);
-        if (isPremiumSkill2(skillName)) {
-          const error48 = `Hosted skill ${skillName} requires skills.md access: ${err.message}`;
-          writeRunLogs(runContext, "", error48 + `
+        const error48 = `Hosted skill ${skillName} requires hosted access: ${err.message}`;
+        writeRunLogs(runContext, "", error48 + `
 `);
-          const localRun2 = completeSkillRun(runContext, { status: "failed", error: error48 });
-          return mcpError("PLATFORM_ERROR", `${error48}. Local run metadata: ${localRun2.paths.runDir}/run.json`);
-        }
+        const localRun2 = completeSkillRun(runContext, { status: "failed", error: error48 });
+        return mcpError("PLATFORM_ERROR", `${error48}. Local run metadata: ${localRun2.paths.runDir}/run.json`);
       }
     }
     const result = await runSkill(skillName, runArgs, {
@@ -33350,7 +33372,7 @@ function registerOperationTools(server) {
     const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
     const apiKey = getApiKey2();
     if (!apiKey) {
-      return mcpError("AUTH_REQUIRED", "Remote run status requires skills.md access. Run: skills auth login", ["skills auth login"]);
+      return mcpError("AUTH_REQUIRED", "Remote run status requires hosted access. Run: skills auth login", ["skills auth login"]);
     }
     const localRun = findSkillRun(run_id);
     const remoteRunId = localRun?.remoteRunId || run_id;
@@ -33436,7 +33458,7 @@ function registerOperationTools(server) {
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync7(agentSkillsPath);
+      const exists = existsSync8(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
@@ -33462,7 +33484,7 @@ function registerOperationTools(server) {
 }
 
 // src/lib/feedback.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir5 } from "os";
 import { dirname as dirname3, join as join9 } from "path";
 import { Database } from "bun:sqlite";
@@ -33472,7 +33494,7 @@ function getFeedbackDbPath() {
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname3(dbPath);
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     mkdirSync5(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
@@ -33621,14 +33643,14 @@ function registerResourceMetaTools(server) {
 }
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
 import { join as join10 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join10(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync9(path)) {
+  if (existsSync10(path)) {
     try {
       return JSON.parse(readFileSync8(path, "utf-8"));
     } catch {}
@@ -33638,7 +33660,7 @@ function loadSchedules(targetDir = process.cwd()) {
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join10(targetDir, ".skills");
-  if (!existsSync9(dir))
+  if (!existsSync10(dir))
     mkdirSync6(dir, { recursive: true });
   writeFileSync5(path, JSON.stringify(data, null, 2));
 }
@@ -33799,7 +33821,8 @@ function removeSchedule(idOrName, targetDir) {
 }
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync10, lstatSync, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
+init_pricing();
+import { existsSync as existsSync11, lstatSync, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
 import { isAbsolute, join as join11, normalize } from "path";
 var DOC_FILES = ["SKILL.md", "README.md", "CLAUDE.md"];
 var RESERVED_SKILL_ENTRIES = new Set([
@@ -33863,6 +33886,25 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function isHostedPackageMetadata(pkg) {
+  const skills = asRecord(pkg.skills);
+  if (!skills)
+    return false;
+  const runtime = typeof skills.runtime === "string" ? skills.runtime.trim().toLowerCase() : "";
+  const source = typeof skills.source === "string" ? skills.source.trim().toLowerCase() : "";
+  return runtime === "hosted" || source === "remote" || source === "private-hosted";
+}
+function isHostedMetadataSkill(skillName, frontmatter, registryMeta, packageDeclaresHosted) {
+  if (packageDeclaresHosted)
+    return true;
+  if (isPremiumSkill(skillName))
+    return true;
+  if (frontmatter?.source === "private-hosted")
+    return true;
+  if (frontmatter?.source === "remote" && !registryMeta?.tags.includes("local"))
+    return true;
+  return false;
+}
 function parseSkillFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match)
@@ -33912,11 +33954,13 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   const bareName = name;
   const issues = [];
   const warnings = [];
+  let packageDeclaresHosted = false;
+  let packageSkillSource;
   const metadata = {
     binCommands: [],
     docFiles: []
   };
-  if (!existsSync10(skillPath)) {
+  if (!existsSync11(skillPath)) {
     add(issues, "skill.dir_missing", `Skill directory not found: ${skillPath}`);
     return {
       name: bareName,
@@ -33943,14 +33987,14 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   for (const docFile of DOC_FILES) {
-    if (existsSync10(join11(skillPath, docFile)))
+    if (existsSync11(join11(skillPath, docFile)))
       metadata.docFiles.push(docFile);
   }
   if (metadata.docFiles.length === 0) {
     add(issues, "skill.docs_missing", "Missing documentation file: expected SKILL.md, README.md, or CLAUDE.md");
   }
   const skillMdPath = join11(skillPath, "SKILL.md");
-  if (existsSync10(skillMdPath)) {
+  if (existsSync11(skillMdPath)) {
     const frontmatter = parseSkillFrontmatter(readFileSync9(skillMdPath, "utf-8"));
     if (!frontmatter) {
       add(warnings, "skill.frontmatter_missing", "SKILL.md has no YAML frontmatter");
@@ -33985,7 +34029,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     add(warnings, "skill.skill_md_missing", "Missing SKILL.md; registry docs may need generated agent-facing instructions");
   }
   const pkgPath = join11(skillPath, "package.json");
-  if (!existsSync10(pkgPath)) {
+  if (!existsSync11(pkgPath)) {
     add(issues, "package.missing", "Missing package.json");
   } else {
     try {
@@ -33994,6 +34038,13 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
       if (!packageRecord) {
         add(issues, "package.invalid_shape", "package.json must be an object");
       } else {
+        packageDeclaresHosted = isHostedPackageMetadata(pkg);
+        const skillsRecord = asRecord(pkg.skills);
+        if (skillsRecord && typeof skillsRecord.source === "string") {
+          packageSkillSource = skillsRecord.source;
+        }
+        const hostedMetadata2 = isHostedMetadataSkill(bareName, metadata.skillMdFrontmatter, registryMeta, packageDeclaresHosted);
+        metadata.runtime = hostedMetadata2 ? "hosted" : "local";
         if (typeof pkg.name === "string") {
           metadata.packageName = pkg.name;
           if (pkg.name !== bareName) {
@@ -34010,12 +34061,18 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
           ...metadata.provenance ?? { directoryName: bareName },
           ...typeof pkg.name === "string" ? { packageName: pkg.name } : {},
           ...typeof pkg.version === "string" && pkg.version.trim() ? { packageVersion: pkg.version } : {},
-          ...registryMeta?.source ? { registrySource: registryMeta.source } : {}
+          ...registryMeta?.source ? { registrySource: registryMeta.source } : {},
+          ...packageSkillSource ? { packageSkillSource } : {}
         };
         const binRecord = asRecord(pkg.bin);
         if (!binRecord || Object.keys(binRecord).length === 0) {
-          add(issues, "package.bin_missing", "package.json missing non-empty bin object");
+          if (!hostedMetadata2) {
+            add(issues, "package.bin_missing", "package.json missing non-empty bin object");
+          }
         } else {
+          if (hostedMetadata2) {
+            add(issues, "package.hosted_bin_forbidden", "Hosted metadata packages must not expose a local bin entry");
+          }
           for (const [command, target] of Object.entries(binRecord)) {
             if (!VALID_BIN_COMMAND.test(command)) {
               add(issues, "package.bin_command_invalid", `package.json bin command '${command}' must use lowercase letters, numbers, dots, underscores, or hyphens`);
@@ -34030,7 +34087,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
               continue;
             }
             const targetPath = join11(skillPath, target);
-            if (!existsSync10(targetPath)) {
+            if (!existsSync11(targetPath)) {
               add(warnings, "package.bin_target_missing", `package.json bin '${command}' target '${target}' is not present before build`);
             } else if (statSync3(targetPath).isDirectory()) {
               add(issues, "package.bin_target_directory", `package.json bin '${command}' target '${target}' must point to a file, not a directory`);
@@ -34042,13 +34099,19 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
       add(issues, "package.invalid_json", `package.json is invalid JSON: ${error48.message}`);
     }
   }
+  const hostedMetadata = isHostedMetadataSkill(bareName, metadata.skillMdFrontmatter, registryMeta, packageDeclaresHosted);
+  metadata.runtime = hostedMetadata ? "hosted" : "local";
   const srcDir = join11(skillPath, "src");
-  if (!existsSync10(srcDir)) {
+  if (hostedMetadata) {
+    if (existsSync11(srcDir)) {
+      add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
+    }
+  } else if (!existsSync11(srcDir)) {
     add(issues, "skill.src_missing", "Missing src/ directory");
-  } else if (!existsSync10(join11(srcDir, "index.ts")) && !existsSync10(join11(srcDir, "index.js"))) {
+  } else if (!existsSync11(join11(srcDir, "index.ts")) && !existsSync11(join11(srcDir, "index.js"))) {
     add(issues, "skill.src_index_missing", "Missing src/index.ts or src/index.js");
   } else {
-    const indexPath = existsSync10(join11(srcDir, "index.ts")) ? join11(srcDir, "index.ts") : join11(srcDir, "index.js");
+    const indexPath = existsSync11(join11(srcDir, "index.ts")) ? join11(srcDir, "index.ts") : join11(srcDir, "index.js");
     const size = statSync3(indexPath).size;
     if (size < 50)
       add(warnings, "skill.src_index_minimal", `Source entry point is very small (${size}B)`);

package/dist/cli/commands/runtime.d.ts

@@ -1,5 +1,5 @@
 /**
- * run / mcp / serve / self-update — runtime commands
+ * run / mcp / self-update — runtime commands
  */
 import type { Command } from "commander";
 export declare function registerRuntime(parent: Command): void;

package/dist/cli/onboarding.d.ts

@@ -0,0 +1,13 @@
+import type { Command } from "commander";
+import { type SkillsConfig } from "../lib/config.js";
+export interface FirstRunOnboardingInput {
+    argv: string[];
+    commandName?: string;
+    config: SkillsConfig;
+    isInteractive: boolean;
+    testMode?: boolean;
+}
+export declare function getRootCommandName(actionCommand: Command): string;
+export declare function shouldShowFirstRunOnboarding(input: FirstRunOnboardingInput): boolean;
+export declare function getFirstRunOnboardingMessage(): string;
+export declare function maybePrintFirstRunOnboarding(actionCommand: Command, argv: string[], isInteractive: boolean): void;