@hasna/skills 0.1.72 → 0.2.1

package/dist/cli/commands/install.d.ts

@@ -2,4 +2,20 @@
  * pin / unpin / update — project skill preference commands
  */
 import type { Command } from "commander";
+import { type InstallResult } from "../../lib/installer.js";
 export declare function registerInstall(parent: Command): void;
+/**
+ * `skills pin name@version` (hasna/apps#1630): the exact version is FETCHED, digest-verified,
+ * and written to the machine corpus before the pin is recorded, so the project pin names a
+ * version this machine actually holds. Without an instance there is nothing to fetch from,
+ * and a pin that claims a version it never saw is refused rather than written.
+ */
+export declare function pinExactVersion(name: string, version: string, options: {
+    useRemote: boolean;
+    overwrite: boolean;
+    pull?: (spec: string) => Promise<{
+        success: boolean;
+        version?: string;
+        error?: string;
+    }>;
+}): Promise<InstallResult>;

package/dist/cli/commands/publish.d.ts

@@ -5,6 +5,11 @@ export interface PushSkillOptions {
     dryRun?: boolean;
     json?: boolean;
     version?: string;
+    /**
+     * When the instance already holds this name@version with different content, publish under
+     * the next patch version instead of failing (hasna/apps#1630).
+     */
+    forceNewVersion?: boolean;
     client?: RemoteSkillsClient | null;
     /** Overrides the corpus location. Tests only. */
     rootDir?: string;
@@ -22,6 +27,16 @@ export interface PushSkillResult {
     published: boolean;
     status?: number;
     response?: unknown;
+    /** The version the instance recorded (after any --force-new-version bump). */
+    version?: string;
+    /**
+     * True when the publish was idempotent: the version this push ended on already
+     * existed on the instance with these exact bytes, so nothing new was recorded
+     * (hasna/apps#1671). Distinct from a fresh "published as X".
+     */
+    alreadyPublished?: boolean;
+    /** Per-file digests and provenance sent alongside the bundle. */
+    manifest?: SkillVersionManifest;
 }
 export declare class PushSkillError extends Error {
     readonly detail?: string[] | undefined;
@@ -29,4 +44,38 @@ export declare class PushSkillError extends Error {
 }
 export declare function registerPublish(parent: Command): void;
 export declare function pushSkill(name: string, options?: PushSkillOptions): Promise<PushSkillResult>;
+/** 1.2.3 -> 1.2.4; anything non-semver gets a numeric suffix so the bump is still unique. */
+export declare function bumpPatch(version: string): string;
+export interface SkillVersionManifest {
+    files: Array<{
+        path: string;
+        sha256: string;
+        byteSize: number;
+    }>;
+    fileCount: number;
+    unpackedByteSize: number;
+    bundleSha256: string;
+    provenance: {
+        machine: string;
+        agent: string | null;
+        cliVersion: string;
+        gitRemote: string | null;
+        gitSha: string | null;
+        packedAt: string;
+    };
+}
+/**
+ * What travels beside the bundle as manifest.json (hasna/apps#1630): a digest per file so a
+ * pull can be checked file by file, and where the bytes came from. No secrets, no absolute
+ * paths beyond the machine name.
+ */
+export declare function buildVersionManifest(skillDir: string, packed: PackedSkillBundle): SkillVersionManifest;
+/**
+ * Strip userinfo (username/password) from a git remote URL before it is recorded in a
+ * version manifest. Only URL schemes where userinfo is HTTP-style credentials are
+ * stripped: an ssh login user (`ssh://git@host/...`, or scp-style `git@host:path`,
+ * which never parses as a URL) is the transport user, not an embedded credential, and
+ * passes through unchanged.
+ */
+export declare function sanitizeGitRemote(url: string | null): string | null;
 export type { PackedSkillBundle };

package/dist/cli/commands/registry.d.ts

@@ -8,3 +8,8 @@ export declare function registerRegistry(parent: Command): void;
  * step.
  */
 export declare function registerPull(parent: Command): void;
+/**
+ * `skills versions <name>` — every immutable published version of a skill on the configured
+ * instance, newest first, with the one the instance currently serves marked (hasna/apps#1630).
+ */
+export declare function registerVersions(parent: Command): void;