@hasna/skills 0.1.68 → 0.1.70

package/README.md

@@ -448,7 +448,7 @@ skills/                      # Public skill contracts and local OSS skills
 
 | Count | Value | Derived from |
 |---|---|---|
-| Catalog skills | 86 | `SKILLS.length` (`src/lib/registry-data/`) |
+| Catalog skills | 87 | `SKILLS.length` (`src/lib/registry-data/`) |
 | Categories | 17 | `CATEGORIES` (`src/lib/registry-types.ts`) |
 | MCP tools | 37 | `tools/list` against a live `buildServer()` |
 

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.1.68",
+    version: "0.1.70",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36882,6 +36882,10 @@ var init_package = __esm(() => {
       "./sdk": {
         import: "./dist/sdk/index.js",
         types: "./dist/sdk/index.d.ts"
+      },
+      "./admin-contract": {
+        import: "./dist/admin-contract.js",
+        types: "./dist/admin-contract.d.ts"
       }
     },
     files: [
@@ -36900,14 +36904,15 @@ var init_package = __esm(() => {
     types: "./dist/index.d.ts",
     scripts: {
       clean: "rm -rf bin/ dist/",
-      build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-      "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+      build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+      "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
       test: "bun test --timeout 30000",
       dev: "bun run ./src/cli/index.tsx",
       "dev:watch": "bun --watch run ./src/cli/index.tsx",
       "dev:mcp": "bun --watch run ./src/mcp/index.ts",
       "dev:server": "bun --watch run ./src/server/index.ts",
       "dev:worker": "bun --watch run ./src/server/worker.ts",
+      "docker:check": "bash scripts/docker-build-check.sh",
       migrate: "bun run ./src/server/migrate.ts",
       typecheck: "tsc --noEmit",
       "verify:release": "bun run scripts/release-guard.ts",
@@ -36940,7 +36945,8 @@ var init_package = __esm(() => {
       "@types/react": "^18.2.0",
       "bun-types": "1.3.14",
       "react-devtools-core": "^7.0.1",
-      typescript: "^5"
+      typescript: "^5",
+      yaml: "^2.9.0"
     },
     dependencies: {
       "@aws-sdk/client-ecs": "^3.1079.0",
@@ -38316,6 +38322,14 @@ var init_development_tools = __esm(() => {
       category: "Development Tools",
       tags: ["config", "validation", "schema", "linting"]
     },
+    {
+      name: "oss-app-two-backend-storage",
+      displayName: "OSS App Two-Backend Storage",
+      description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
+      category: "Development Tools",
+      tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
+      kind: "instruction"
+    },
     {
       name: "session-inject-monitor",
       displayName: "Session Inject Monitor",
@@ -62354,8 +62368,8 @@ var require_utils = __commonJS((exports, module) => {
   var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
   var HOST_DELIM_RE = /[@/?#:]/g;
   var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-  function reescapeHostDelimiters(host, isIP) {
-    const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+  function reescapeHostDelimiters(host, isIP2) {
+    const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
     re.lastIndex = 0;
     return host.replace(re, (ch) => HOST_DELIMS[ch]);
   }
@@ -62804,7 +62818,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
-    let isIP = false;
+    let isIP2 = false;
     if (options.reference === "suffix") {
       if (options.scheme) {
         uri = options.scheme + ":" + uri;
@@ -62853,9 +62867,9 @@ var require_fast_uri = __commonJS((exports, module) => {
         if (ipv4result === false) {
           const ipv6result = normalizeIPv6(parsed.host);
           parsed.host = ipv6result.host.toLowerCase();
-          isIP = ipv6result.isIPV6;
+          isIP2 = ipv6result.isIPV6;
         } else {
-          isIP = true;
+          isIP2 = true;
         }
       }
       if (parsed.scheme === undefined && parsed.userinfo === undefined && parsed.host === undefined && parsed.port === undefined && parsed.query === undefined && !parsed.path) {
@@ -62872,7 +62886,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       }
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
           try {
             parsed.host = new URL("http://" + parsed.host).hostname;
           } catch (e) {
@@ -62886,7 +62900,7 @@ var require_fast_uri = __commonJS((exports, module) => {
             parsed.scheme = unescape(parsed.scheme);
           }
           if (parsed.host !== undefined) {
-            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
           }
         }
         if (parsed.path) {
@@ -69902,7 +69916,7 @@ var init_server3 = __esm(() => {
   server = buildServer();
 });
 
-// ../../node_modules/.bun/@hono+node-server@1.19.17+470351d3cbe921c0/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.bun/@hono+node-server@1.19.17+2145b681a064c8e9/node_modules/@hono/node-server/dist/index.mjs
 import { Readable } from "stream";
 import crypto2 from "crypto";
 var GlobalRequest, Request, newHeadersFromIncoming = (incoming) => {
@@ -74195,7 +74209,7 @@ import process12 from "process";
 // ../../node_modules/.bun/ink@5.2.1+6e93904c7bfe2418/node_modules/ink/build/ink.js
 var import_react10 = __toESM(require_react(), 1);
 import process11 from "process";
-// ../../node_modules/.bun/es-toolkit@1.50.0/node_modules/es-toolkit/dist/function/debounce.mjs
+// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/function/debounce.mjs
 function debounce(func, debounceMs, { signal, edges } = {}) {
   let pendingThis = undefined;
   let pendingArgs = null;
@@ -74253,7 +74267,7 @@ function debounce(func, debounceMs, { signal, edges } = {}) {
   return debounced;
 }
 
-// ../../node_modules/.bun/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/function/debounce.mjs
+// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/compat/function/debounce.mjs
 function debounce2(func, debounceMs = 0, options = {}) {
   if (typeof options !== "object")
     options = {};
@@ -74293,7 +74307,7 @@ function debounce2(func, debounceMs = 0, options = {}) {
   return debounced;
 }
 
-// ../../node_modules/.bun/es-toolkit@1.50.0/node_modules/es-toolkit/dist/compat/function/throttle.mjs
+// ../../node_modules/.bun/es-toolkit@1.51.0/node_modules/es-toolkit/dist/compat/function/throttle.mjs
 function throttle(func, throttleMs = 0, options = {}) {
   const { leading = true, trailing = true } = options;
   return debounce2(func, throttleMs, {
@@ -76209,10 +76223,10 @@ var import_react_reconciler = __toESM(require_react_reconciler(), 1);
 var import_constants = __toESM(require_constants(), 1);
 import process3 from "process";
 
-// ../../node_modules/.bun/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
+// ../../node_modules/.bun/ansi-regex@6.3.0/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
   const ST = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
-  const osc = `(?:\\u001B\\][\\s\\S]*?${ST})`;
+  const osc = `(?:\\u001B\\][^\\u0007\\u001B\\u009C]*${ST})`;
   const csi = "[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]";
   const pattern = `${osc}|${csi}`;
   return new RegExp(pattern, onlyFirst ? undefined : "g");
@@ -79215,8 +79229,12 @@ import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
+import { lookup as dnsLookup } from "dns/promises";
+import { isIP } from "net";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
+import { request as nodeHttpRequest } from "http";
+import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID2 } from "crypto";
 function getPathValue(input, path) {
   return path.split(".").reduce((value, part) => {
@@ -79619,6 +79637,214 @@ function signPayload(secret, timestamp, body) {
   const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
   return `sha256=${digest}`;
 }
+var DEFAULT_MAX_REDIRECTS = 5;
+var IPV4_PRIVATE_RANGES = [
+  [0, 16777215],
+  [167772160, 184549375],
+  [1681915904, 1686110207],
+  [2130706432, 2147483647],
+  [2851995648, 2852061183],
+  [2886729728, 2887778303],
+  [3221225472, 3221225727],
+  [3221225984, 3221226239],
+  [3227017984, 3227018239],
+  [3232235520, 3232301055],
+  [3323068416, 3323199487],
+  [3325256704, 3325256959],
+  [3405803776, 3405804031],
+  [3758096384, 4294967295]
+];
+var IPV6_SPECIAL_PREFIXES = [
+  { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
+  { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
+  { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
+  { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
+  { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
+  { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
+  { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
+  { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
+  { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
+  { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
+  { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
+  { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
+];
+function isPrivateAddress(address) {
+  const normalized = stripZoneId(address);
+  const version = isIP(normalized);
+  if (version === 4) {
+    const integer = ipv4ToInt(normalized);
+    if (integer === undefined)
+      return true;
+    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer >= low && integer <= high);
+  }
+  if (version === 6) {
+    const groups = ipv6Groups(normalized);
+    if (!groups)
+      return true;
+    for (const prefix of IPV6_SPECIAL_PREFIXES) {
+      if (!ipv6MatchesPrefix(groups, prefix.groups, prefix.bits))
+        continue;
+      if (prefix.bits === 96 && groups[5] === 65535) {
+        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
+      }
+      if (prefix.bits === 16 && groups[0] === 8194) {
+        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
+      }
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+async function resolveWebhookTarget(url, policy = {}) {
+  const hostname = normalizeHostname(url.hostname);
+  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
+  if (allowlist.includes(hostname)) {
+    const version2 = isIP(hostname);
+    if (version2 === 4 || version2 === 6) {
+      return { hostname, addresses: [hostname] };
+    }
+    const lookup2 = policy.lookup ?? defaultTargetLookup;
+    let resolved2;
+    try {
+      resolved2 = await lookup2(hostname);
+    } catch {
+      throw new Error(`Webhook target ${hostname} could not be resolved`);
+    }
+    if (!Array.isArray(resolved2) || resolved2.length === 0) {
+      throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+    }
+    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
+    return { hostname, addresses };
+  }
+  const version = isIP(hostname);
+  if (version === 4 || version === 6) {
+    if (isPrivateAddress(hostname)) {
+      throw new Error(`Webhook target ${hostname} is a private or special-use address`);
+    }
+    return { hostname, addresses: [hostname] };
+  }
+  const lookup = policy.lookup ?? defaultTargetLookup;
+  let resolved;
+  try {
+    resolved = await lookup(hostname);
+  } catch {
+    throw new Error(`Webhook target ${hostname} could not be resolved`);
+  }
+  if (!Array.isArray(resolved) || resolved.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no addresses`);
+  }
+  const allowed = [];
+  for (const entry of resolved) {
+    const address = normalizeHostname(entry.address);
+    if (isPrivateAddress(address)) {
+      if (allowlist.includes(address)) {
+        allowed.push(address);
+        continue;
+      }
+      throw new Error(`Webhook target ${hostname} resolves to private or special-use address ${address}`);
+    }
+    allowed.push(address);
+  }
+  if (allowed.length === 0) {
+    throw new Error(`Webhook target ${hostname} resolved to no public addresses`);
+  }
+  return { hostname, addresses: allowed };
+}
+function normalizeMaxRedirects(value) {
+  if (value === undefined)
+    return DEFAULT_MAX_REDIRECTS;
+  if (!Number.isInteger(value) || value < 0)
+    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
+  return value;
+}
+var defaultTargetLookup = async (hostname) => {
+  return dnsLookup(hostname, { all: true, verbatim: false });
+};
+function normalizeHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]"))
+    return lower.slice(1, -1);
+  return lower;
+}
+function stripZoneId(address) {
+  const percent = address.indexOf("%");
+  return percent === -1 ? address : address.slice(0, percent);
+}
+function ipv4ToInt(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4)
+    return;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    value = value << 8 | octet;
+  }
+  return value >>> 0;
+}
+function ipv4IntToString(integer) {
+  return [
+    integer >>> 24 & 255,
+    integer >>> 16 & 255,
+    integer >>> 8 & 255,
+    integer & 255
+  ].join(".");
+}
+function ipv6Groups(address) {
+  const raw = stripZoneId(address);
+  const doubleColon = raw.indexOf("::");
+  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
+  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
+  const parseGroups = (text) => {
+    if (text === "")
+      return [];
+    const out = [];
+    for (const part of text.split(":")) {
+      if (part.includes(".")) {
+        const v4 = ipv4ToInt(part);
+        if (v4 === undefined)
+          return;
+        out.push(v4 >>> 16 & 65535, v4 & 65535);
+      } else {
+        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
+          return;
+        out.push(parseInt(part, 16));
+      }
+    }
+    return out;
+  };
+  const head2 = parseGroups(headText);
+  if (!head2)
+    return;
+  const tail2 = parseGroups(tailText);
+  if (!tail2)
+    return;
+  const total = head2.length + tail2.length;
+  if (doubleColon === -1) {
+    return total === 8 ? head2 : undefined;
+  }
+  if (total >= 8)
+    return;
+  return [...head2, ...new Array(8 - total).fill(0), ...tail2];
+}
+function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
+  let remaining = prefixBits;
+  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
+    const take2 = Math.min(16, remaining);
+    const mask = 65535 << 16 - take2 & 65535;
+    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
+      return false;
+    remaining -= take2;
+  }
+  return true;
+}
 function now2() {
   return new Date().toISOString();
 }
@@ -79649,9 +79875,18 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
+function normalizeWebhookUrl(raw) {
+  const url = new URL(raw);
+  if (url.username !== "" || url.password !== "") {
+    url.username = "";
+    url.password = "";
+  }
+  return url.toString();
+}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now2();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -79668,10 +79903,14 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
+  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
+  if (validateTargets) {
+    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
+  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
       method: "POST",
       headers,
       body,
@@ -79699,6 +79938,130 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function redirectKeepsBody(status) {
+  return status === 307 || status === 308;
+}
+async function pinnedNativeRequest(target, addresses, method2, headers, body, signal, tls) {
+  const isHttps = target.protocol === "https:";
+  if (!isHttps && target.protocol !== "http:") {
+    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
+  }
+  const defaultPort = isHttps ? 443 : 80;
+  const port = target.port ? Number(target.port) : defaultPort;
+  const requestOptions = {
+    hostname: target.hostname,
+    port,
+    path: `${target.pathname}${target.search}`,
+    method: method2,
+    headers,
+    ...tls?.ca ? { ca: tls.ca } : {},
+    lookup: (hostname, _options, callback) => {
+      const entries = addresses.map((address) => ({
+        address,
+        family: address.includes(":") ? 6 : 4
+      }));
+      callback(null, entries);
+    }
+  };
+  return new Promise((resolve, reject2) => {
+    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
+    const onAbort = () => {
+      const error = new Error("The operation was aborted.");
+      error.name = "AbortError";
+      request.destroy(error);
+    };
+    if (signal.aborted)
+      onAbort();
+    else
+      signal.addEventListener("abort", onAbort, { once: true });
+    request.on("error", reject2);
+    if (body !== undefined)
+      request.write(body);
+    request.end();
+    function onResponse(response) {
+      const chunks = [];
+      response.on("data", (chunk2) => chunks.push(Buffer.from(chunk2)));
+      response.on("error", reject2);
+      response.on("end", () => {
+        const headersRecord = {};
+        for (const [name, value] of Object.entries(response.headers)) {
+          if (typeof value === "string")
+            headersRecord[name] = value;
+          else if (Array.isArray(value))
+            headersRecord[name] = value.join(", ");
+        }
+        resolve(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+      });
+    }
+  });
+}
+async function dispatchValidatedWebhook(event, channel, input) {
+  const { body, headers, startedAt, options } = input;
+  const webhook = channel.webhook;
+  if (!webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const policy = options.webhookTargetPolicy ?? {};
+  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
+  try {
+    let target = new URL(normalizeWebhookUrl(webhook.url));
+    let requestHeaders = headers;
+    let method2 = "POST";
+    let requestBody = body;
+    let redirectsFollowed = 0;
+    for (;; ) {
+      const resolved = await resolveWebhookTarget(target, policy).catch((error) => {
+        throw new Error(`Webhook target rejected by SSRF guard: ${error.message}`);
+      });
+      const response = options.fetchImpl ? await options.fetchImpl(target, {
+        method: method2,
+        headers: requestHeaders,
+        body: requestBody,
+        signal: controller.signal,
+        redirect: "manual"
+      }) : await pinnedNativeRequest(target, resolved.addresses, method2, requestHeaders, requestBody, controller.signal, options.tls);
+      const location = response.headers.get("location");
+      if (isRedirectStatus(response.status) && location) {
+        if (redirectsFollowed >= maxRedirects) {
+          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
+        }
+        redirectsFollowed += 1;
+        const next = new URL(location, target);
+        target = next;
+        if (!redirectKeepsBody(response.status)) {
+          method2 = "GET";
+          requestBody = undefined;
+          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
+        }
+        continue;
+      }
+      const responseBody = truncate2(await response.text());
+      return {
+        attempt: 1,
+        status: response.ok ? "success" : "failed",
+        startedAt,
+        completedAt: now2(),
+        responseStatus: response.status,
+        responseBody,
+        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+      };
+    }
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now2(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function failedAttempt(startedAt, error) {
   return {
     attempt: 1,
@@ -79908,7 +80271,9 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now
+      now: options.now,
+      tls: options.tls,
+      webhookTargetPolicy: options.webhookTargetPolicy
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;

package/bin/mcp.js

@@ -12943,7 +12943,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.1.68",
+  version: "0.1.70",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12965,6 +12965,10 @@ var package_default = {
     "./sdk": {
       import: "./dist/sdk/index.js",
       types: "./dist/sdk/index.d.ts"
+    },
+    "./admin-contract": {
+      import: "./dist/admin-contract.js",
+      types: "./dist/admin-contract.d.ts"
     }
   },
   files: [
@@ -12983,14 +12987,15 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
     "dev:mcp": "bun --watch run ./src/mcp/index.ts",
     "dev:server": "bun --watch run ./src/server/index.ts",
     "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "docker:check": "bash scripts/docker-build-check.sh",
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
@@ -13023,7 +13028,8 @@ var package_default = {
     "@types/react": "^18.2.0",
     "bun-types": "1.3.14",
     "react-devtools-core": "^7.0.1",
-    typescript: "^5"
+    typescript: "^5",
+    yaml: "^2.9.0"
   },
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
@@ -21104,6 +21110,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
   },
+  {
+    name: "oss-app-two-backend-storage",
+    displayName: "OSS App Two-Backend Storage",
+    description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
+    category: "Development Tools",
+    tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
+    kind: "instruction"
+  },
   {
     name: "session-inject-monitor",
     displayName: "Session Inject Monitor",
@@ -26944,7 +26958,7 @@ var server = buildServer();
 // src/mcp/http.ts
 import { createServer } from "http";
 
-// ../../node_modules/.bun/@hono+node-server@1.19.17+470351d3cbe921c0/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.bun/@hono+node-server@1.19.17+2145b681a064c8e9/node_modules/@hono/node-server/dist/index.mjs
 import { Http2ServerRequest as Http2ServerRequest2, constants as h2constants } from "http2";
 import { Http2ServerRequest } from "http2";
 import { Readable } from "stream";