@hasna/skills 0.1.57 → 0.1.59

package/dist/lib/config.d.ts

@@ -1,5 +1,5 @@
 /**
- * Config file support for Open Skills
+ * Config file support for Hasna Skills
  *
  * Loads configuration from:
  *   1. Project-local: ./skills.config.json (highest priority)
@@ -9,7 +9,7 @@
  * Values from the project config override global config.
  */
 export interface SkillsConfig {
-    mode?: "local" | "hosted";
+    mode?: "local" | "self-hosted";
     defaultAgent?: "claude" | "codex" | "gemini" | "pi" | "opencode" | "all";
     defaultScope?: "global" | "project";
     format?: "compact" | "json" | "csv";

package/dist/lib/content-scan.d.ts

@@ -0,0 +1,69 @@
+/**
+ * content-scan.ts — scans skill BODIES (not just package.json/README) for content
+ * that must never ship in the public @hasna/skills package.
+ *
+ * Three finding categories:
+ *   - secret-value:     credential-shaped values (API keys, tokens, private keys)
+ *   - pii-contact:      personal contact PII (E.164 phone numbers)
+ *   - private-context:  internal/operational context that leaks the private fleet
+ *                       (fleet hostnames, home-directory paths with a real user,
+ *                       internal CLI invocations, internal infra/product names)
+ *
+ * All output is REDACTED: secret values are never emitted, phone numbers are masked
+ * to their country code, and only the rule id + a safe redacted marker are reported.
+ */
+export type ScanCategory = "secret-value" | "pii-contact" | "private-context";
+export interface ScanRule {
+    category: ScanCategory;
+    /** Stable, human-readable rule id (safe to print — never a secret value). */
+    id: string;
+    description: string;
+    pattern: RegExp;
+    /** Optional predicate to drop known-safe example matches (e.g. 555 phone numbers). */
+    isExample?: (match: string) => boolean;
+}
+export interface ScanFinding {
+    file: string;
+    line: number;
+    column: number;
+    category: ScanCategory;
+    ruleId: string;
+    /** Redacted marker — never contains a raw secret value. */
+    redacted: string;
+}
+export declare const SCAN_RULES: ScanRule[];
+/**
+ * Produce a redacted marker for a matched value. Secret values are NEVER emitted;
+ * phone numbers are reduced to their leading country context; private-context
+ * matches (hostnames, paths, CLI names — not credentials) are shown verbatim so a
+ * maintainer can locate and remove them.
+ */
+export declare function redactMatch(category: ScanCategory, ruleId: string, match: string): string;
+/**
+ * Scan a block of text and return redacted findings. `file` is used only for
+ * reporting; it is never read from disk here.
+ */
+export declare function scanText(text: string, file?: string): ScanFinding[];
+/** Read a file and scan its contents. Binary files are skipped and yield no findings. */
+export declare function scanFile(path: string, reportedName?: string): ScanFinding[];
+/**
+ * Scan a list of files. `nameFor` maps an absolute path to the name reported in
+ * findings (e.g. a repo-relative or package-relative path).
+ */
+export declare function scanFiles(paths: string[], nameFor?: (path: string) => string): ScanFinding[];
+export interface ScanAllowlistEntry {
+    /** Package-relative file path the exception applies to. */
+    file: string;
+    /** Rule id the exception applies to. */
+    ruleId: string;
+    /** Human-readable justification (shown in audits). */
+    reason: string;
+}
+/**
+ * Drop findings that match an explicit, documented allowlist entry. Matching is
+ * exact on (file, ruleId) so an exception can never silently suppress a different
+ * file or a different rule. Returns the surviving findings.
+ */
+export declare function applyAllowlist(findings: ScanFinding[], allowlist: ScanAllowlistEntry[]): ScanFinding[];
+/** Serialize findings as redacted JSON. Safe to print — contains no secret values. */
+export declare function toRedactedJson(findings: ScanFinding[]): string;

package/dist/lib/discovery.d.ts

@@ -3,6 +3,7 @@ import { type PublicSkillPricing } from "./pricing.js";
 export interface CompactSkillDiscovery {
     name: string;
     category: string;
+    description: string;
     pricing: PublicSkillPricing;
 }
 export type PublicSkillDiscovery<T extends SkillMeta = SkillMeta> = Omit<T, "description" | "tags"> & {

package/dist/lib/hosted-availability.d.ts

@@ -1,3 +1,4 @@
+import type { SkillAvailabilityMetadata } from "./registry-types.js";
 export interface HostedRunUnavailable {
     ok: false;
     status: 503;
@@ -9,3 +10,4 @@ export type HostedRunAvailability = {
     ok: true;
 } | HostedRunUnavailable;
 export declare function getHostedRunAvailability(slug: string): HostedRunAvailability;
+export declare function getHostedAvailabilityMetadata(slug: string): SkillAvailabilityMetadata;

package/dist/lib/packlist.d.ts

@@ -0,0 +1,13 @@
+/**
+ * packlist.ts — derive the REAL set of files that would be published to npm.
+ *
+ * Always resolve the package-visible file set from the packager itself
+ * (`npm pack --dry-run` / `bun pm pack --dry-run`), never from a hand-maintained
+ * copy of the `files` array. This guarantees the safety guards scan exactly what
+ * ships, including the effect of the `files` allow/deny globs.
+ */
+/**
+ * Return the sorted list of package-relative file paths that would be published.
+ * Prefers `npm pack` (authoritative for npm) and falls back to `bun pm pack`.
+ */
+export declare function getPackedFiles(cwd?: string): string[];

package/dist/lib/portable-skills.d.ts

@@ -1,8 +1,16 @@
-import type { SkillMeta } from "./registry-types.js";
+import type { SkillKind, SkillMeta } from "./registry-types.js";
 import { type SkillValidationResult } from "./skill-validation.js";
 export declare const PORTABLE_SKILL_STANDARD = "hasna.skill.v1";
 export declare const PORTABLE_SKILL_SCHEMA = "https://hasna.dev/schemas/skill.v1.json";
 export declare const PORTABLE_SKILL_DEFAULT_VERSION = "0.1.0";
+/**
+ * Artifact class of a portable skill.
+ * - `executable`: a runnable skill folder (package.json + bin + src entry).
+ * - `instruction`: a prose-only agent skill (SKILL.md primary, optional skill.json).
+ *
+ * Re-exports the canonical SkillKind (defined in registry-types) for existing consumers.
+ */
+export type { SkillKind };
 export interface PortableSkillInput {
     name: string;
     type: string;
@@ -25,6 +33,7 @@ export interface PortableSkillManifest {
     displayName?: string;
     category?: string;
     tags?: string[];
+    kind?: SkillKind;
     inputs: PortableSkillInput[];
     commands: PortableSkillCommand[];
 }
@@ -45,10 +54,39 @@ export interface PortableSkillOptions {
 export interface ScaffoldPortableSkillOptions extends PortableSkillOptions {
     description?: string;
     overwrite?: boolean;
+    kind?: SkillKind;
 }
 export interface PortPortableSkillOptions extends PortableSkillOptions {
     name?: string;
     overwrite?: boolean;
+    /**
+     * Permit an imported skill name that shadows a bundled official skill.
+     * Without this, `port` refuses to silently override the official corpus.
+     */
+    allowShadow?: boolean;
+}
+export interface BulkPortPortableSkillOptions extends PortableSkillOptions {
+    overwrite?: boolean;
+    /** When false, the first failure is rethrown. Defaults to true (skip-on-error). */
+    continueOnError?: boolean;
+}
+export interface BulkPortImportedEntry {
+    name: string;
+    path: string;
+    sourcePath: string;
+}
+export interface BulkPortSkippedEntry {
+    sourcePath: string;
+    name?: string;
+    reason: string;
+}
+export interface BulkPortResult {
+    root: string;
+    total: number;
+    succeeded: number;
+    failed: number;
+    imported: BulkPortImportedEntry[];
+    skipped: BulkPortSkippedEntry[];
 }
 export interface PortableSkillWriteResult {
     name: string;
@@ -73,7 +111,14 @@ export declare function findPortableSkill(name: string, options?: PortableSkillO
 export declare function listPortableSkills(options?: PortableSkillOptions): PortableSkillSummary[];
 export declare function listPortableSkillMetas(options?: PortableSkillOptions): SkillMeta[];
 export declare function readPortableSkillManifest(skillPath: string, fallbackName?: string): PortableSkillManifest;
+export declare function isOfficialSkillName(name: string): boolean;
 export declare function scaffoldPortableSkill(name: string, options?: ScaffoldPortableSkillOptions): PortableSkillWriteResult;
+/**
+ * Import every immediate subfolder of a directory as a portable skill.
+ * Skip-on-error by default: non-skill folders and per-skill failures are recorded
+ * in the summary instead of aborting the whole run.
+ */
+export declare function portPortableSkillDirectory(sourceDir: string, options?: BulkPortPortableSkillOptions): BulkPortResult;
 export declare function portPortableSkill(sourcePath: string, options?: PortPortableSkillOptions): PortableSkillWriteResult;
 export declare function validatePortableSkillDirectory(name: string, skillPath: string): SkillValidationResult;
 export declare function runPortableSkill(name: string, args: string[], options?: PortableSkillRunOptions): Promise<PortableSkillRunResult>;

package/dist/lib/project-state.d.ts

@@ -4,6 +4,9 @@
  * `.skills/` is runtime/output state plus optional project preferences. It is
  * not a skill source directory and must never contain copied skill definitions.
  */
+import type { SkillSource } from "./registry-types.js";
+/** Valid provenance sources for a project pin: skill sources plus project-local. */
+export type ProjectPinSource = SkillSource | "local";
 export declare const SKILLS_PROJECT_DIR = ".skills";
 export declare const PROJECT_CONFIG_FILE = "project.json";
 export declare const DEFAULT_EXPORT_DIR = ".skills/exports";
@@ -11,7 +14,7 @@ export interface ProjectSkillPin {
     name: string;
     pinnedAt: string;
     version: string;
-    source: "official" | "custom" | "remote" | "local";
+    source: ProjectPinSource;
 }
 export interface SkillsProjectConfig {
     version: 1;

package/dist/lib/public-boundary.d.ts

@@ -0,0 +1,31 @@
+/**
+ * public-boundary.ts — the public/private boundary for the published corpus.
+ *
+ * Some skills are PUBLIC (they ship in the open-source `@hasna/skills` package).
+ * Others are PRIVATE/TEAM (fleet-operational, PII-bearing, internal) and must
+ * NEVER enter the published npm files-list. This module lets a skill declare its
+ * visibility and provides enforcement that detects any private skill leaking into
+ * the real package file list.
+ *
+ * A skill is treated as PRIVATE (fully excluded from publish) when ANY of:
+ *   - `package.json` -> `skills.visibility` is one of team|private|internal
+ *   - `package.json` -> `skills.publish` is `false`
+ *   - a marker file `.private` exists in the skill directory
+ *   - `SKILL.md` frontmatter declares `visibility: team|private|internal`
+ *
+ * Note: `hosted` / `remote` / `private-hosted` skills are a DIFFERENT concept —
+ * they ship metadata (package.json) with their `src/` stripped. Those are premium
+ * hosted skills and are handled by the existing hosted-metadata boundary, not here.
+ */
+export type SkillVisibility = "public" | "team" | "private" | "internal";
+export declare function isPrivateVisibility(value: string | undefined): value is SkillVisibility;
+/** Determine whether a skill directory is private (must never be published). */
+export declare function isPrivateSkillDir(skillDir: string): boolean;
+/** List the slugs of every private skill under a `skills/` root, sorted. */
+export declare function listPrivateSkillSlugs(skillsRoot: string): string[];
+/**
+ * Given the real package file list and the set of private slugs, return every
+ * packed path that belongs to a private skill. A non-empty result means a private
+ * skill leaked into the publishable package.
+ */
+export declare function findPrivatePacklistLeaks(packedPaths: string[], privateSlugs: Iterable<string>): string[];

package/dist/lib/registry-types.d.ts

@@ -1,3 +1,9 @@
+export type SkillKind = "executable" | "instruction";
+/**
+ * Provenance sources for a skill. Kept in sync with VALID_PROVENANCE_SOURCES in
+ * skill-validation.ts (plus "extension" for private extension overlays).
+ */
+export type SkillSource = "official" | "custom" | "remote" | "private" | "private-hosted" | "upstream" | "extension";
 export interface SkillMeta {
     name: string;
     displayName: string;
@@ -6,8 +12,15 @@ export interface SkillMeta {
     tags: string[];
     dependencies?: string[];
     version?: string;
+    /**
+     * Artifact class of the skill. "executable" skills carry a runnable
+     * package.json/bin/src; "instruction" skills are SKILL.md-primary prose for
+     * agents. Missing kind defaults to "executable" during migration.
+     */
+    kind?: SkillKind;
     pricing?: SkillPricingMetadata;
-    source?: "official" | "custom" | "remote";
+    availability?: SkillAvailabilityMetadata;
+    source?: SkillSource;
 }
 export interface SkillPricingMetadata {
     tier?: "free" | "premium" | string;
@@ -21,6 +34,12 @@ export interface SkillPricingMetadata {
     quoteRequired?: boolean;
     description?: string;
 }
+export interface SkillAvailabilityMetadata {
+    status: "available" | "unavailable";
+    code?: string;
+    message?: string;
+    details?: string[];
+}
 export declare const CATEGORIES: readonly ["Development Tools", "Business & Marketing", "Productivity & Organization", "Project Management", "Content Generation", "Finance & Compliance", "Data & Analysis", "Media Processing", "Design & Branding", "Web & Browser", "Research & Writing", "Science & Academic", "Education & Learning", "Communication", "Health & Wellness", "Travel & Lifestyle", "Event Management"];
 export type Category = (typeof CATEGORIES)[number];
 export declare const BASIC_SKILL_NAMES: readonly ["image", "video", "audio", "music", "transcript", "audio-extract", "read-image", "read-pdf", "pdf-read", "pdf-to-markdown", "doc-read", "pdf-generate", "doc-generate", "read-csv", "read-excel", "excel", "convert"];

package/dist/lib/remote-registry.d.ts

@@ -2,8 +2,8 @@
  * Remote registry client.
  *
  * Local registry behavior remains the default. These helpers are opt-in and
- * read from SKILLS_API_URL or config.apiUrl so private SaaS products can expose
- * a compatible registry API without hard-coding any SaaS details upstream.
+ * read from SKILLS_API_URL or config.apiUrl so self-hosted services can expose
+ * a compatible registry API without hard-coding deployment details upstream.
  */
 import { type SkillsConfig } from "./config.js";
 import type { SkillMeta } from "./registry.js";

package/dist/lib/skill-validation.d.ts

@@ -1,5 +1,7 @@
 import type { SkillMeta } from "./registry.js";
+import type { SkillKind } from "./registry-types.js";
 import type { PortableSkillManifest } from "./portable-skills.js";
+export declare const VALID_SKILL_KINDS: readonly SkillKind[];
 export interface SkillValidationMessage {
     code: string;
     message: string;
@@ -18,7 +20,8 @@ export interface SkillValidationResult {
         skillMdFrontmatter?: SkillFrontmatter;
         portableManifest?: PortableSkillManifest;
         provenance?: SkillValidationProvenance;
-        runtime?: "local" | "hosted";
+        runtime?: "local" | "hosted" | "none";
+        kind?: SkillKind;
     };
 }
 export interface RegistryConsistencyResult {
@@ -35,6 +38,7 @@ export interface SkillFrontmatter {
     tags?: string[];
     version?: string;
     source?: string;
+    kind?: string;
 }
 export interface SkillValidationProvenance {
     directoryName: string;

package/dist/lib/skillinfo.d.ts

@@ -25,6 +25,21 @@ export declare function getSkillBestDoc(name: string): string | null;
  * Extract requirements from a skill's source files
  */
 export declare function getSkillRequirements(name: string): SkillRequirements | null;
+export interface SkillDependencyStatus {
+    name: string;
+    version: string;
+    installed: boolean;
+}
+/**
+ * Resolve npm dependency install status for a skill.
+ *
+ * A dependency counts as installed only when it is resolvable from the skill
+ * directory (the skill's own node_modules or any ancestor node_modules),
+ * matching how the skill imports it when it runs. This keeps the doctor/test
+ * readiness signal truthful: a runnable skill that imports `xlsx` is not
+ * "ready" until `xlsx` is actually installed, even if every env var is set.
+ */
+export declare function getSkillDependencyStatus(name: string): SkillDependencyStatus[];
 /**
  * Run a skill by name with given arguments
  */

package/dist/storage.js

@@ -36,14 +36,16 @@ var ENUM_KEYS = {
   format: ["compact", "json", "csv"]
 };
 var STRING_KEYS = ["apiUrl"];
-var MODE_VALUES = ["local", "hosted"];
+var MODE_VALUES = ["local", "self-hosted"];
 var MODE_ALIASES = {
   local: "local",
   offline: "local",
-  hosted: "hosted",
-  remote: "hosted",
-  "skills.md": "hosted",
-  skillsmd: "hosted"
+  "self-hosted": "self-hosted",
+  selfhosted: "self-hosted",
+  self_hosted: "self-hosted",
+  hosted: "self-hosted",
+  "skills.md": "self-hosted",
+  skillsmd: "self-hosted"
 };
 function validKeys() {
   return ["mode", ...Object.keys(ENUM_KEYS), ...STRING_KEYS];
@@ -178,6 +180,16 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/project-state.ts
+var VALID_PIN_SOURCES = [
+  "official",
+  "custom",
+  "remote",
+  "private",
+  "private-hosted",
+  "upstream",
+  "extension",
+  "local"
+];
 var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
@@ -302,7 +314,7 @@ function normalizeProjectConfig(raw) {
   };
 }
 function isPinSource(value) {
-  return value === "official" || value === "custom" || value === "remote" || value === "local";
+  return typeof value === "string" && VALID_PIN_SOURCES.includes(value);
 }
 
 // src/lib/native-storage.ts

package/docs/skill-standard.md

@@ -17,6 +17,34 @@ Portable skills live in one folder each:
 `skills port <path>` and `skills add <path>` copy an existing skill folder into
 this layout and add missing standard files.
 
+## Skill Kinds
+
+A skill declares its artifact class with the `kind` frontmatter field:
+
+- `kind: executable` (default when omitted) — a runnable skill folder with
+  `package.json`, a non-empty `bin`, and `src/index.ts`. `skills run` executes it.
+- `kind: instruction` — a `SKILL.md`-primary prose skill for coding agents.
+  `package.json`, `bin`, and `src/` are all optional. Instruction skills may still
+  bundle optional helper scripts (a `bin`/`src` is permitted, not forbidden), but
+  they are consumed by agents via `SKILL.md`, not executed. `skills run` on an
+  instruction skill returns a clear "not runnable — instruction skill" error
+  instead of executing a stub.
+
+Missing `kind` defaults to `executable` so the bundled corpus is unaffected.
+Migrated operational (prose) skills should set `kind: instruction` explicitly.
+
+Minimum `SKILL.md` frontmatter for an instruction skill:
+
+```yaml
+---
+name: skill-project
+description: Open or resume an existing Hasna repo project using the projects CLI.
+kind: instruction
+version: 0.1.0
+source: private
+---
+```
+
 ## Naming
 
 Skill names are lowercase slugs: letters, numbers, dots, underscores, and
@@ -107,10 +135,12 @@ skills validate my-skill --json
 Validation checks:
 
 - folder and name safety;
-- `SKILL.md` frontmatter compatibility;
-- `skill.json` standard, version, inputs, and commands;
-- `AGENTS.md` presence;
-- `package.json` and command entrypoint safety;
+- `SKILL.md` frontmatter compatibility (including a valid `kind`);
+- `skill.json` standard, version, inputs, and commands (relaxed for
+  `kind: instruction`, which needs neither `commands`, `inputs`, nor `AGENTS.md`);
+- `AGENTS.md` presence (executable skills only);
+- `package.json` and command entrypoint safety (`package.json`/`bin`/`src` are
+  optional for `kind: instruction`);
 - no reserved files such as `.env` or symlinks.
 
 ## Porting Existing Skills

package/migrations/0001_open_skills_self_hosted.sql

@@ -0,0 +1,129 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE IF NOT EXISTS organizations (
+  id text PRIMARY KEY,
+  slug text NOT NULL UNIQUE,
+  name text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS users (
+  id text PRIMARY KEY,
+  email text NOT NULL UNIQUE,
+  name text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS organization_members (
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  role text NOT NULL DEFAULT 'owner',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (org_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS api_keys (
+  id text PRIMARY KEY,
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  key_hash text NOT NULL UNIQUE,
+  scopes_json jsonb NOT NULL DEFAULT '["skills:read","runs:write"]'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz,
+  revoked_at timestamptz
+);
+
+CREATE TABLE IF NOT EXISTS skills_registry (
+  slug text PRIMARY KEY,
+  display_name text NOT NULL,
+  description text NOT NULL DEFAULT '',
+  category text NOT NULL DEFAULT 'Remote',
+  tags_json jsonb NOT NULL DEFAULT '[]'::jsonb,
+  source text NOT NULL DEFAULT 'bundled',
+  version text,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS skills_runs (
+  id text PRIMARY KEY,
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  user_id text NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  skill_slug text NOT NULL,
+  requested_slug text NOT NULL,
+  status text NOT NULL,
+  input_json jsonb NOT NULL DEFAULT '{}'::jsonb,
+  args_json jsonb NOT NULL DEFAULT '[]'::jsonb,
+  idempotency_key text,
+  correlation_id text NOT NULL,
+  cost_cents integer NOT NULL DEFAULT 0,
+  output_type text,
+  output_preview text,
+  error_code text,
+  error_message text,
+  locked_by text,
+  locked_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  started_at timestamptz,
+  completed_at timestamptz,
+  CHECK (status IN ('queued','waiting_for_approval','running','succeeded','failed','cancel_requested','cancelled','retrying','expired','refunded'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS skills_runs_org_idempotency_idx
+  ON skills_runs (org_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS skills_runs_org_created_idx ON skills_runs (org_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS skills_runs_status_created_idx ON skills_runs (status, created_at ASC);
+
+CREATE TABLE IF NOT EXISTS skills_run_logs (
+  id bigserial PRIMARY KEY,
+  run_id text NOT NULL REFERENCES skills_runs(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  sequence integer NOT NULL,
+  level text NOT NULL DEFAULT 'info',
+  message text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (run_id, sequence)
+);
+
+CREATE TABLE IF NOT EXISTS skills_artifacts (
+  id text PRIMARY KEY,
+  run_id text NOT NULL REFERENCES skills_runs(id) ON DELETE CASCADE,
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  file_name text NOT NULL,
+  relative_path text NOT NULL,
+  content_type text NOT NULL,
+  byte_size integer NOT NULL,
+  sha256 text NOT NULL,
+  storage_kind text NOT NULL DEFAULT 'db',
+  storage_key text,
+  body_text text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS skills_artifacts_run_idx ON skills_artifacts (run_id);
+
+CREATE TABLE IF NOT EXISTS skills_approvals (
+  id text PRIMARY KEY,
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  run_id text REFERENCES skills_runs(id) ON DELETE CASCADE,
+  approved_by_user_id text REFERENCES users(id) ON DELETE SET NULL,
+  policy_digest text NOT NULL,
+  status text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  decided_at timestamptz,
+  CHECK (status IN ('pending','approved','rejected','expired'))
+);
+
+CREATE TABLE IF NOT EXISTS skills_audit_events (
+  id bigserial PRIMARY KEY,
+  org_id text REFERENCES organizations(id) ON DELETE SET NULL,
+  user_id text REFERENCES users(id) ON DELETE SET NULL,
+  api_key_id text REFERENCES api_keys(id) ON DELETE SET NULL,
+  action text NOT NULL,
+  target_type text NOT NULL,
+  target_id text,
+  metadata_json jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@hasna/skills",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
     "skills": "bin/index.js",
-    "skills-mcp": "bin/mcp.js"
+    "skills-mcp": "bin/mcp.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-migrate": "bin/migrate.js"
   },
   "exports": {
     ".": {
@@ -23,6 +26,7 @@
     "!dist/platform",
     "!dist/server",
     "bin/",
+    "migrations/",
     "docs/skill-standard.md",
     "skills/",
     "!skills/**/node_modules",
@@ -35,11 +39,14 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "clean": "rm -rf bin/ dist/",
-    "build": "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/index.ts ./src/storage.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build": "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
     "test": "bun test",
     "dev": "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
     "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "migrate": "bun run ./src/server/migrate.ts",
     "typecheck": "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
     "prepack": "bun run build && bun run verify:release",
@@ -71,6 +78,7 @@
     "typescript": "^5"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1079.0",
     "@hasna/events": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "chalk": "^5.3.0",

package/skills/browse/README.md

@@ -6,7 +6,7 @@ data extraction.
 ## Usage
 
 ```bash
-skills setup --mode hosted
+skills setup --mode self-hosted
 skills auth login
 skills run browse --task "Find the top three announcements on example.com"
 ```

package/skills/browse/SKILL.md

@@ -13,7 +13,7 @@ logs stay server-side.
 ## Usage
 
 ```bash
-skills setup --mode hosted
+skills setup --mode self-hosted
 skills auth login
 skills run browse --task "Open example.com and summarize the page"
 skills runs status <run-id>

package/skills/deepresearch/README.md

@@ -6,7 +6,7 @@ citations, and downloadable artifacts.
 ## Usage
 
 ```bash
-skills setup --mode hosted
+skills setup --mode self-hosted
 skills auth login
 skills mcp --register
 skills run deepresearch "Compare React Server Components with traditional SSR" --depth deep