@hasna/skills 0.10.66 → 0.10.67

package/README.md

@@ -2534,6 +2534,28 @@ untrusted byte entries, not arbitrary JavaScript proxies or hostile host code.
 `ContentHashInputError` reports fixed invalid-input, limit, abort or timeout codes
 without including file contents or paths in its messages.
 
+### Requirements from explicit content
+
+`@hasna/skills/sdk` exports `getSkillRequirementsFromContent`, the parser behind
+`skills requires`, for content the caller already holds, such as verified
+bundle entries:
+
+```ts
+import { getSkillRequirementsFromContent, type SkillMeta, type SkillRequirements } from "@hasna/skills/sdk";
+
+declare const meta: SkillMeta | undefined; // the skill's catalog record, if known
+const requirements: SkillRequirements = getSkillRequirementsFromContent(
+  "write-brief", [skillMd, readme, envExample], packageJson.dependencies, meta);
+// { envVars, systemDeps, cliCommand: "skills run write-brief", dependencies }
+```
+
+The result depends only on the arguments. It reads no registry, file,
+environment, install state or network, and does not change its inputs; the
+returned `dependencies` is the object you passed. When `meta.tags` includes
+`premium` or `remote`, the skill is treated as hosted: provider keys such as
+`OPENAI_API_KEY` are omitted, `SKILLS_API_KEY` and `SKILL_API_KEY` are dropped,
+and `HASNA_SKILLS_API_KEY` is listed.
+
 ## Invitation email recovery
 
 An existing account with no usable membership can explicitly recover access by

package/bin/index.js

@@ -36888,7 +36888,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.66",
+    version: "0.10.67",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -53828,7 +53828,9 @@ function codexLocalMarketplaceMapsPlugin(text2, marketplace, plugin) {
   try {
     hashNativeJsonControls(text2);
     const value = JSON.parse(text2);
-    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !(typeof value.interface === "string" || Number.isSafeInteger(value.interface)) || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
+    const marketplaceInterface = plainObject(value) ? value.interface : undefined;
+    const validInterface = typeof marketplaceInterface === "string" || Number.isSafeInteger(marketplaceInterface) || plainObject(marketplaceInterface) && exactKeys(marketplaceInterface, [], ["displayName"]) && typeof marketplaceInterface.displayName === "string" && marketplaceInterface.displayName.trim().length > 0;
+    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !validInterface || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
       return false;
     const rows = value.plugins.filter((row2) => plainObject(row2) && row2.name === plugin);
     if (rows.length !== 1)
@@ -54185,7 +54187,7 @@ function reviewedHookControls(root, read2) {
   if (!plainObject(manifest) || !exactKeys(manifest, ["name", "version", "hooks"], ["description"]) || !identifier3(manifest.name) || typeof manifest.version !== "string" || manifest.version !== basename9(root) || manifest.hooks !== "./hooks/hooks.json" || manifest.description !== undefined && (typeof manifest.description !== "string" || !manifest.description.trim() || manifest.description.length > 1024))
     refuse4();
   const manifestRecord = manifest;
-  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"]) || !plainObject(hooks.hooks))
+  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"], ["description"]) || !plainObject(hooks.hooks) || hooks.description !== undefined && typeof hooks.description !== "string")
     refuse4();
   const hookTable = hooks.hooks;
   const events = Object.entries(hookTable);
@@ -54312,7 +54314,7 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse4();
     if ([".app.json", ".mcp.json"].includes(base2) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
       refuse4();
-    if (parts.includes("hooks") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base2 !== "hooks" : base2 !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join25(cacheRoot, parts[0], parts[1]))))
+    if ((parts[3] === "hooks" || base2 === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base2 !== "hooks" : base2 !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join25(cacheRoot, parts[0], parts[1]))))
       refuse4();
   }
 }
@@ -59211,9 +59213,7 @@ function generateSkillMd(name) {
 function extractEnvVars(text2) {
   const envVars = new Set;
   for (const pattern of [ENV_VAR_PATTERN, GENERIC_ENV_PATTERN]) {
-    pattern.lastIndex = 0;
-    let match;
-    while ((match = pattern.exec(text2)) !== null) {
+    for (const match of text2.matchAll(pattern)) {
       envVars.add(match[1]);
     }
   }

package/bin/mcp.js

@@ -23,7 +23,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.66",
+    version: "0.10.67",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -33706,7 +33706,9 @@ function codexLocalMarketplaceMapsPlugin(text2, marketplace, plugin) {
   try {
     hashNativeJsonControls(text2);
     const value = JSON.parse(text2);
-    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !(typeof value.interface === "string" || Number.isSafeInteger(value.interface)) || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
+    const marketplaceInterface = plainObject(value) ? value.interface : undefined;
+    const validInterface = typeof marketplaceInterface === "string" || Number.isSafeInteger(marketplaceInterface) || plainObject(marketplaceInterface) && exactKeys(marketplaceInterface, [], ["displayName"]) && typeof marketplaceInterface.displayName === "string" && marketplaceInterface.displayName.trim().length > 0;
+    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !validInterface || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
       return false;
     const rows = value.plugins.filter((row2) => plainObject(row2) && row2.name === plugin);
     if (rows.length !== 1)
@@ -34063,7 +34065,7 @@ function reviewedHookControls(root, read) {
   if (!plainObject(manifest) || !exactKeys(manifest, ["name", "version", "hooks"], ["description"]) || !identifier3(manifest.name) || typeof manifest.version !== "string" || manifest.version !== basename7(root) || manifest.hooks !== "./hooks/hooks.json" || manifest.description !== undefined && (typeof manifest.description !== "string" || !manifest.description.trim() || manifest.description.length > 1024))
     refuse3();
   const manifestRecord = manifest;
-  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"]) || !plainObject(hooks.hooks))
+  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"], ["description"]) || !plainObject(hooks.hooks) || hooks.description !== undefined && typeof hooks.description !== "string")
     refuse3();
   const hookTable = hooks.hooks;
   const events = Object.entries(hookTable);
@@ -34190,7 +34192,7 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse3();
     if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
       refuse3();
-    if (parts.includes("hooks") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join19(cacheRoot, parts[0], parts[1]))))
+    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join19(cacheRoot, parts[0], parts[1]))))
       refuse3();
   }
 }
@@ -35475,9 +35477,7 @@ function detectProjectSkills(cwd = process.cwd()) {
 function extractEnvVars(text2) {
   const envVars = new Set;
   for (const pattern of [ENV_VAR_PATTERN, GENERIC_ENV_PATTERN]) {
-    pattern.lastIndex = 0;
-    let match;
-    while ((match = pattern.exec(text2)) !== null) {
+    for (const match of text2.matchAll(pattern)) {
       envVars.add(match[1]);
     }
   }

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.66",
+  version: "0.10.67",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.66",
+  version: "0.10.67",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.66",
+  version: "0.10.67",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -11922,7 +11922,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
   });
 }
 // package.json
-var version = "0.10.66";
+var version = "0.10.67";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -16225,7 +16225,9 @@ function codexLocalMarketplaceMapsPlugin(text2, marketplace, plugin) {
   try {
     hashNativeJsonControls(text2);
     const value = JSON.parse(text2);
-    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !(typeof value.interface === "string" || Number.isSafeInteger(value.interface)) || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
+    const marketplaceInterface = plainObject(value) ? value.interface : undefined;
+    const validInterface = typeof marketplaceInterface === "string" || Number.isSafeInteger(marketplaceInterface) || plainObject(marketplaceInterface) && exactKeys(marketplaceInterface, [], ["displayName"]) && typeof marketplaceInterface.displayName === "string" && marketplaceInterface.displayName.trim().length > 0;
+    if (!plainObject(value) || !exactKeys(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !validInterface || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
       return false;
     const rows = value.plugins.filter((row2) => plainObject(row2) && row2.name === plugin);
     if (rows.length !== 1)
@@ -16601,7 +16603,7 @@ function reviewedHookControls(root, read2) {
   if (!plainObject(manifest) || !exactKeys(manifest, ["name", "version", "hooks"], ["description"]) || !identifier3(manifest.name) || typeof manifest.version !== "string" || manifest.version !== basename8(root) || manifest.hooks !== "./hooks/hooks.json" || manifest.description !== undefined && (typeof manifest.description !== "string" || !manifest.description.trim() || manifest.description.length > 1024))
     refuse4();
   const manifestRecord = manifest;
-  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"]) || !plainObject(hooks.hooks))
+  if (!plainObject(hooks) || !exactKeys(hooks, ["hooks"], ["description"]) || !plainObject(hooks.hooks) || hooks.description !== undefined && typeof hooks.description !== "string")
     refuse4();
   const hookTable = hooks.hooks;
   const events = Object.entries(hookTable);
@@ -16728,7 +16730,7 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse4();
     if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
       refuse4();
-    if (parts.includes("hooks") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join20(cacheRoot, parts[0], parts[1]))))
+    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join20(cacheRoot, parts[0], parts[1]))))
       refuse4();
   }
 }
@@ -21095,9 +21097,7 @@ var GENERIC_ENV_PATTERN = /\b((?:OPENAI|ANTHROPIC|GEMINI|XAI|ELEVENLABS|DEEPGRAM
 function extractEnvVars(text2) {
   const envVars = new Set;
   for (const pattern of [ENV_VAR_PATTERN, GENERIC_ENV_PATTERN]) {
-    pattern.lastIndex = 0;
-    let match;
-    while ((match = pattern.exec(text2)) !== null) {
+    for (const match of text2.matchAll(pattern)) {
       envVars.add(match[1]);
     }
   }

package/dist/lib/skillinfo.d.ts

@@ -23,8 +23,18 @@ export declare function getSkillBestDoc(name: string, file?: string): string | n
  * Extract requirements from a skill's source files
  */
 export declare function getSkillRequirements(name: string): SkillRequirements | null;
-/** Shared parser for verified bundle content and explicit local authoring files. */
-export declare function getSkillRequirementsFromContent(name: string, texts: string[], dependencies?: Record<string, string>, meta?: SkillMeta): SkillRequirements;
+/**
+ * Shared parser for verified bundle content and explicit local authoring files.
+ * Public through `@hasna/skills/sdk`.
+ *
+ * The result depends only on the arguments: `texts` are the documentation
+ * contents to scan (for example SKILL.md, README.md, CLAUDE.md, .env.example),
+ * `dependencies` is the skill package's dependency map and `meta` its catalog
+ * record. It reads no registry, file, environment, install state or network,
+ * and never mutates its inputs; the returned `dependencies` is the caller's
+ * object, not a copy.
+ */
+export declare function getSkillRequirementsFromContent(name: string, texts: readonly string[], dependencies?: Record<string, string>, meta?: SkillMeta): SkillRequirements;
 export interface SkillDependencyStatus {
     name: string;
     version: string;

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute5 } from "path";
 // package.json
-var version = "0.10.66";
+var version = "0.10.67";
 var package_default = {
   name: "@hasna/skills",
   version,

package/dist/sdk/index.d.ts

@@ -44,6 +44,7 @@ export * from "../lib/remote-recurring-contract.js";
 export { RecurringInputError, RemoteRecurringError, RemoteRecurringUnavailableError, RemoteRecurringReadError, RemoteRecurringUnconfirmedError } from "../lib/remote-recurring.js";
 export type { RecurringCapability, RecurringListOptions, RemoteRecurringErrorCode } from "../lib/remote-recurring.js";
 export { canonicalJson, canonicalJsonSha256 } from "../lib/canonical-json.js";
+export { getSkillRequirementsFromContent, type SkillRequirements } from "../lib/skillinfo.js";
 export type { RemoteQuoteUnavailableCode } from "../lib/remote-client.js";
 export { RemoteCreditApprovalError, type RemoteRunApproval, type RemoteRunQuote, type RemoteCreditPack } from "../lib/remote-account.js";
 export { type RemoteInputFile, type RemoteInputFileDescriptor } from "../lib/remote-files.js";

package/dist/sdk/index.js

@@ -32371,7 +32371,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
-var version = "0.10.66";
+var version = "0.10.67";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -40684,7 +40684,9 @@ function codexLocalMarketplaceMapsPlugin(text, marketplace, plugin) {
   try {
     hashNativeJsonControls(text);
     const value = JSON.parse(text);
-    if (!plainObject(value) || !exactKeys2(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !(typeof value.interface === "string" || Number.isSafeInteger(value.interface)) || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
+    const marketplaceInterface = plainObject(value) ? value.interface : undefined;
+    const validInterface = typeof marketplaceInterface === "string" || Number.isSafeInteger(marketplaceInterface) || plainObject(marketplaceInterface) && exactKeys2(marketplaceInterface, [], ["displayName"]) && typeof marketplaceInterface.displayName === "string" && marketplaceInterface.displayName.trim().length > 0;
+    if (!plainObject(value) || !exactKeys2(value, ["interface", "name", "plugins"]) || value.name !== marketplace || !validInterface || !Array.isArray(value.plugins) || value.plugins.length < 1 || value.plugins.length > 4096)
       return false;
     const rows = value.plugins.filter((row2) => plainObject(row2) && row2.name === plugin);
     if (rows.length !== 1)
@@ -41060,7 +41062,7 @@ function reviewedHookControls(root, read) {
   if (!plainObject(manifest) || !exactKeys2(manifest, ["name", "version", "hooks"], ["description"]) || !identifier4(manifest.name) || typeof manifest.version !== "string" || manifest.version !== basename5(root) || manifest.hooks !== "./hooks/hooks.json" || manifest.description !== undefined && (typeof manifest.description !== "string" || !manifest.description.trim() || manifest.description.length > 1024))
     refuse5();
   const manifestRecord = manifest;
-  if (!plainObject(hooks) || !exactKeys2(hooks, ["hooks"]) || !plainObject(hooks.hooks))
+  if (!plainObject(hooks) || !exactKeys2(hooks, ["hooks"], ["description"]) || !plainObject(hooks.hooks) || hooks.description !== undefined && typeof hooks.description !== "string")
     refuse5();
   const hookTable = hooks.hooks;
   const events = Object.entries(hookTable);
@@ -41187,7 +41189,7 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       refuse5();
     if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
       refuse5();
-    if (parts.includes("hooks") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join15(cacheRoot, parts[0], parts[1]))))
+    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join15(cacheRoot, parts[0], parts[1]))))
       refuse5();
   }
 }
@@ -51554,9 +51556,7 @@ var GENERIC_ENV_PATTERN = /\b((?:OPENAI|ANTHROPIC|GEMINI|XAI|ELEVENLABS|DEEPGRAM
 function extractEnvVars(text2) {
   const envVars = new Set;
   for (const pattern of [ENV_VAR_PATTERN, GENERIC_ENV_PATTERN]) {
-    pattern.lastIndex = 0;
-    let match;
-    while ((match = pattern.exec(text2)) !== null) {
+    for (const match of text2.matchAll(pattern)) {
       envVars.add(match[1]);
     }
   }
@@ -97724,6 +97724,7 @@ export {
   inspectSkillSession,
   inspectSkillBundle,
   inspectPrivatePublication,
+  getSkillRequirementsFromContent,
   getServerSkillMd,
   getServerSkill,
   expiresAtFor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.66",
+  "version": "0.10.67",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {