@hasna/skills 0.10.76 → 0.10.78

package/bin/mcp.js

@@ -23,7 +23,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.76",
+    version: "0.10.78",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -1087,6 +1087,10 @@ function skillsFileHasCredential(file) {
     return false;
   return /^\s*(?:export\s+)?(?:HASNA_SKILLS_API_KEY|SKILLS_API_KEY|HASNA_SKILLS_API_KEY_REF)\s*=\s*\S/m.test(text);
 }
+function skillsFileHasVaultReference(file) {
+  const text = readMetadataText(file);
+  return text !== null && /^\s*(?:export\s+)?HASNA_SKILLS_API_KEY_REF\s*=\s*\S/m.test(text);
+}
 var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
 var init_instance_credentials = __esm(() => {
   init_transport();
@@ -1121,6 +1125,20 @@ var init_local_opt_in = __esm(() => {
 // src/lib/product-default.ts
 var SKILLS_PRODUCT_DEFAULT_ORIGIN = "https://skills.md";
 
+// src/lib/credential-profile-command.ts
+function skillsShellArgument(value) {
+  return /^[A-Za-z0-9._:/-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
+function skillsApiUrlEnvironment(origin) {
+  return urlKeys.map((name) => `${name}=${skillsShellArgument(origin)}`).join(" ");
+}
+var urlKeys;
+var init_credential_profile_command = __esm(() => {
+  init_instance_credentials();
+  init_transport();
+  urlKeys = clientTransportEnvKeys("skills").apiUrlKeys;
+});
+
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
@@ -1145,6 +1163,8 @@ __export(exports_fleet_credentials, {
   gatewaySignInRefusal: () => gatewaySignInRefusal,
   credentialPairing: () => credentialPairing,
   configuredSkillsApiUrl: () => configuredSkillsApiUrl,
+  captureSkillsSignInTarget: () => captureSkillsSignInTarget,
+  assertSkillsSignInCredentialReplaceable: () => assertSkillsSignInCredentialReplaceable,
   SkillsFleetCredentialError: () => SkillsFleetCredentialError,
   SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
   SKILLS_CREDENTIAL_TIERS: () => SKILLS_CREDENTIAL_TIERS,
@@ -1450,8 +1470,24 @@ function gatewaySignInRefusal(target) {
   if (normalizeSkillsApiOrigin(target.origin) !== normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP)))
     return null;
   const cause = target.credentialSource ? `${target.credentialSource} holds a Skills credential for the internal gateway` : target.source === "--url" ? "--url names the internal gateway" : `${target.source} selects the internal gateway`;
-  const unset = target.credentialSource ?? (target.source === "--url" ? null : target.source);
-  return new SkillsFleetCredentialError(`${cause}, which has no sign-in service. Nothing was sent.` + (unset ? ` To sign in to the default server instead, first unset ${unset} (or remove it from where it is stored), then run: skills login.` : ""), "GATEWAY_AUTH_UNAVAILABLE", unset ? [`unset ${unset}`, "skills login"] : undefined);
+  const command = (SKILLS_API_URL_ENV_KEYS.includes(target.source) ? `${skillsApiUrlEnvironment(SKILLS_PRODUCT_DEFAULT_ORIGIN)} ` : "") + "skills --profile <new-profile> login";
+  return new SkillsFleetCredentialError(`${cause}, which has no sign-in service. Nothing was sent. ` + `Keep the fleet configuration and use a separate profile for product sign-in: ${command}.`, "GATEWAY_AUTH_UNAVAILABLE", [command]);
+}
+function assertSkillsSignInCredentialReplaceable(env = process.env, profile) {
+  const files = skillsProfileCredentialFiles(env, profile);
+  const verifyUnchanged = captureSkillsCredentialFiles(files);
+  const gateway = normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP));
+  const command = (SKILLS_API_URL_ENV_KEYS.some((name) => env[name]?.trim()) ? `${skillsApiUrlEnvironment(SKILLS_PRODUCT_DEFAULT_ORIGIN)} ` : "") + "skills --profile <new-profile> login";
+  for (const file of files) {
+    if (!skillsFileHasCredential(file))
+      continue;
+    const metadata = readSkillsInstanceMetadata(file);
+    const instance = metadata.binding ?? metadata.apiUrl;
+    if (skillsFileHasVaultReference(file) || !instance || normalizeSkillsApiOrigin(instance) === gateway) {
+      throw new SkillsFleetCredentialError("The selected profile contains a protected fleet credential or vault reference. Nothing was sent or changed. " + `Use a separate profile for product sign-in: ${command}.`, "STORED_CREDENTIAL_PROTECTED", [command]);
+    }
+  }
+  verifyUnchanged();
 }
 function explicitSignInOrigin(url) {
   if (!url.trim() || /[\x00-\x1f\x7f]/.test(url)) {
@@ -1479,13 +1515,15 @@ function resolveSkillsSignInOrigin(env = process.env, options = {}, explicitUrl)
     const snapshot = snapshotSkillsEnvironment(env);
     const resolvedOptions = snapshotSkillsOptions(env, options);
     const profile = resolvedOptions.credentials?.profile;
+    assertSkillsSignInCredentialReplaceable(snapshot, profile);
     const configured = configuredSkillsApiUrl(snapshot, resolvedOptions.credentials?.keychain, profile);
     const declared = configured && configured.source !== "default" ? configured : null;
     if (explicitUrl !== undefined) {
       const origin = explicitSignInOrigin(explicitUrl);
       const storedHere = declared ? skillsProfileCredentialFiles(snapshot, profile).includes(declared.source) : false;
       if (declared && !storedHere && normalizeSkillsApiOrigin(declared.value) !== origin) {
-        throw new SkillsFleetCredentialError(`--url ${origin} conflicts with ${declared.source}, which outranks the saved configuration and would ` + `shadow the key this sign-in stores. Unset ${declared.source} or pass the same URL.`, "INVALID_API_URL");
+        const command = `${skillsApiUrlEnvironment(origin)} skills --profile <new-profile> login`;
+        throw new SkillsFleetCredentialError(`--url ${origin} conflicts with ${declared.source}, which outranks the saved configuration and would ` + `shadow the key this sign-in stores. Keep the existing configuration and use a separate process and profile: ${command}.`, "INVALID_API_URL", [command]);
       }
       return { origin, source: "--url" };
     }
@@ -1517,6 +1555,14 @@ function resolveSkillsSignInOrigin(env = process.env, options = {}, explicitUrl)
     throw error;
   }
 }
+function captureSkillsSignInTarget(env = process.env, options = {}, explicitUrl) {
+  const snapshot = snapshotSkillsEnvironment(env);
+  const profile = options.credentials?.profile ?? selectedCliSkillsCredentialProfile();
+  const unchanged2 = captureSkillsCredentialFiles(skillsProfileCredentialFiles(snapshot, profile));
+  const target = resolveSkillsSignInOrigin(env, options, explicitUrl);
+  unchanged2();
+  return { ...target, unchanged: unchanged2 };
+}
 function requireSkillsFleet(action = "This command", env = process.env, options = {}) {
   const fleet = resolveSkillsFleet(env, options);
   if (fleet.mode === "hosted")
@@ -1528,6 +1574,7 @@ var init_fleet_credentials = __esm(() => {
   init_transport();
   init_instance_credentials();
   init_local_opt_in();
+  init_credential_profile_command();
   init_local_opt_in();
   ENV_KEYS = clientTransportEnvKeys(SKILLS_APP);
   SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
@@ -22758,7 +22805,8 @@ var init_codex_native_compatibility = __esm(() => {
     "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-    "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+    "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+    "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
   };
   SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version2) => supportsCodexNativeCapability(version2, "hooks")));
 });
@@ -32251,6 +32299,40 @@ var init_codex_settings_witness_v1 = __esm(() => {
   VERBOSITY = new Set(["low", "medium", "high"]);
 });
 
+// src/lib/codex-plugin-capability-paths.ts
+function foldCodexPluginEntryName(name) {
+  return name.toUpperCase().toLowerCase();
+}
+function codexPluginRootCapabilityEntry(name) {
+  const folded = foldCodexPluginEntryName(name);
+  return CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.includes(folded) ? folded : null;
+}
+function isCodexSkillDocumentName(name) {
+  return foldCodexPluginEntryName(name) === "skill.md";
+}
+var CODEX_PLUGIN_MANIFEST_LOCATIONS, CODEX_PLUGIN_MANIFEST_DIRECTORIES, CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES;
+var init_codex_plugin_capability_paths = __esm(() => {
+  CODEX_PLUGIN_MANIFEST_LOCATIONS = Object.freeze([
+    "plugin.json",
+    ".codex-plugin/plugin.json",
+    ".claude-plugin/plugin.json",
+    ".cursor-plugin/plugin.json"
+  ]);
+  CODEX_PLUGIN_MANIFEST_DIRECTORIES = Object.freeze([".codex-plugin", ".claude-plugin", ".cursor-plugin"]);
+  CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES = Object.freeze([
+    "plugin.json",
+    ".codex-plugin",
+    ".claude-plugin",
+    ".cursor-plugin",
+    "hooks",
+    "hooks.json",
+    ".mcp.json",
+    ".app.json",
+    "commands",
+    "agents"
+  ]);
+});
+
 // src/lib/codex-hook-mcp-dependencies.ts
 import { createHash as createHash12 } from "crypto";
 import { basename as basename7, dirname as dirname12, isAbsolute as isAbsolute12, join as join16, resolve as resolve11, sep as sep5 } from "path";
@@ -32395,15 +32477,13 @@ function captureCodexHookMcpDependencies(configPath, reviewed, configText, chang
       }
     };
     const root = join16(cacheRoot, identity2, selectCodexPluginVersion(versions2, selectionBudget));
-    const agent = read(join16(root, "plugin.json"));
+    const [agentPluginManifest, ...legacyManifests] = CODEX_PLUGIN_MANIFEST_LOCATIONS;
+    const agent = read(join16(root, agentPluginManifest));
     if (agent !== null) {
       const schema = JSON.parse(agent).$schema;
       need5(typeof schema !== "string" || !schema.startsWith("https://agent-plugins.org/schemas/"));
     }
-    const codex = read(join16(root, ".codex-plugin/plugin.json"));
-    const claude = read(join16(root, ".claude-plugin/plugin.json"));
-    const cursor = read(join16(root, ".cursor-plugin/plugin.json"));
-    const text2 = codex ?? claude ?? cursor;
+    const text2 = legacyManifests.map((location) => read(join16(root, location))).find((value) => value !== null) ?? null;
     if (text2 === null)
       continue;
     const manifest = JSON.parse(text2);
@@ -32425,6 +32505,7 @@ var init_codex_hook_mcp_dependencies = __esm(() => {
   init_claude_settings_witness();
   init_agent_discovery_directories();
   init_agent_discovery_bytes();
+  init_codex_plugin_capability_paths();
   events = new Set(["PreToolUse", "PermissionRequest", "PostToolUse", "PreCompact", "PostCompact", "SessionStart", "SessionEnd", "UserPromptSubmit", "SubagentStart", "SubagentStop", "Stop", "Interrupt"]);
 });
 
@@ -34007,9 +34088,10 @@ var CODEX_VENDOR_MARKETPLACES, CODEX_REMOTE_VENDOR_MARKETPLACES, OTHER_PLUGIN_CO
 var init_codex_vendor_refresh = __esm(() => {
   init_claude_settings_witness();
   init_codex_plugin_skill_controls();
+  init_codex_plugin_capability_paths();
   CODEX_VENDOR_MARKETPLACES = Object.freeze(["openai-bundled", "openai-curated", "openai-curated-remote"]);
   CODEX_REMOTE_VENDOR_MARKETPLACES = Object.freeze(["openai-curated-remote"]);
-  OTHER_PLUGIN_CONTROLS = Object.freeze(["plugin.json", ".claude-plugin", ".cursor-plugin", "hooks", "hooks.json", ".mcp.json", "commands", "agents"]);
+  OTHER_PLUGIN_CONTROLS = Object.freeze(CODEX_PLUGIN_ROOT_CAPABILITY_ENTRIES.filter((entry) => entry !== ".codex-plugin" && entry !== ".app.json"));
   VENDOR_MANIFEST_KEYS = Object.freeze(["name", "version", "description", "author", "homepage", "repository", "license", "keywords", "interface", "skills", "apps"]);
   DEFAULT_SKILLS_PATHS = Object.freeze(["./skills", "./skills/"]);
 });
@@ -35114,14 +35196,23 @@ function assertParents(cacheRoot, controls, appOnlyParents, hookParents, files,
       continue;
     const parent = join21(cacheRoot, parts[0], parts[1]);
     const root = join21(parent, parts[2]);
-    const base = parts[parts.length - 1];
-    if (parts.includes(".codex-plugin") && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
+    const base = parts[parts.length - 1], folded = foldCodexPluginEntryName(base);
+    if (parts.length === 3 && (codexPluginRootCapabilityEntry(base) !== null || isCodexSkillDocumentName(base)))
+      refuse3();
+    const rootEntry = parts.length >= 4 ? codexPluginRootCapabilityEntry(parts[3]) : null;
+    if (rootEntry !== null && rootEntry !== parts[3])
+      refuse3();
+    if (rootEntry !== null && !SEMANTIC_BOUND_ROOT_ENTRIES.includes(rootEntry))
       refuse3();
-    if ([".app.json", ".mcp.json"].includes(base) && (parts.length !== 4 || dirname16(member) !== root))
+    if (isCodexSkillDocumentName(base) && base !== "SKILL.md")
       refuse3();
-    if ([".app.json", ".mcp.json"].includes(base) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+    if (parts.some((part) => CODEX_PLUGIN_MANIFEST_DIRECTORIES.includes(foldCodexPluginEntryName(part))) && (parts.length < 4 || parts[3] !== ".codex-plugin" || (parts.length === 4 ? base !== ".codex-plugin" : parts.length !== 5 || base !== "plugin.json")))
       refuse3();
-    if ((parts[3] === "hooks" || base === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join21(cacheRoot, parts[0], parts[1]))))
+    if ([".app.json", ".mcp.json"].includes(folded) && (parts.length !== 4 || dirname16(member) !== root))
+      refuse3();
+    if ([".app.json", ".mcp.json"].includes(folded) && hookParents.some((reviewed) => reviewed.pluginParent === parent))
+      refuse3();
+    if ((rootEntry === "hooks" || folded === "hooks.json") && (![4, 5].includes(parts.length) || parts[3] !== "hooks" || (parts.length === 4 ? base !== "hooks" : base !== "hooks.json") || !hookParents.some((reviewed) => reviewed.pluginParent === join21(cacheRoot, parts[0], parts[1]))))
       refuse3();
   }
 }
@@ -35343,13 +35434,15 @@ function assertCodexSemanticCacheWitnessUnchanged(previous, current) {
   if (hash3(priorProjection) !== previous.sha256 || hash3(currentProjection) !== current.sha256 || canonical8(comparable(priorProjection)) !== canonical8(comparable(currentProjection)))
     refuse3();
 }
-var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1", identifier4 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value), digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value), refuse3 = () => {
+var CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA = "hasna.codex-semantic-cache-witness.v1", SEMANTIC_BOUND_ROOT_ENTRIES, identifier4 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value), digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value), refuse3 = () => {
   throw new Error("CODEX_SEMANTIC_CACHE_WITNESS_UNSUPPORTED: review Codex plugin cache identity and controls");
 }, MAX_DOCUMENT_BYTES, MAX_RECEIPT_BYTES, codexHookEvents;
 var init_codex_semantic_cache_witness = __esm(() => {
   init_claude_settings_witness();
   init_codex_plugin_skill_controls();
   init_codex_native_skill_catalog();
+  init_codex_plugin_capability_paths();
+  SEMANTIC_BOUND_ROOT_ENTRIES = Object.freeze([".codex-plugin", ".app.json", ".mcp.json", "hooks"]);
   MAX_DOCUMENT_BYTES = 1024 * 1024;
   MAX_RECEIPT_BYTES = 16 * 1024;
   codexHookEvents = new Set([
@@ -39028,6 +39121,7 @@ function normalizeRemoteSkill(skill) {
   if (!name)
     throw new Error("Remote skill requires name or slug");
   return {
+    ...skill.id !== undefined ? { id: skill.id } : {},
     name,
     displayName: skill.displayName || titleize(name),
     description: skill.description || "",
@@ -39132,11 +39226,12 @@ var init_remote_registry = __esm(() => {
     details: exports_external.array(exports_external.string()).optional()
   }).passthrough();
   remoteSkillSchema = exports_external.object({
+    id: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/).optional(),
     name: exports_external.string().min(1).optional(),
     slug: exports_external.string().min(1).optional(),
     displayName: exports_external.string().optional(),
     description: exports_external.string().optional(),
-    category: exports_external.string().optional(),
+    category: exports_external.string().nullable().optional(),
     tags: exports_external.array(exports_external.string()).optional(),
     dependencies: exports_external.array(exports_external.string()).optional(),
     version: exports_external.string().optional(),
@@ -41525,6 +41620,24 @@ var init_remote_invitation_recovery = __esm(() => {
 
 // src/lib/remote-private-publications.ts
 import { createHash as createHash26 } from "crypto";
+function checkedPrivateSkillCreate(value) {
+  const refuse5 = (field3, accepted) => {
+    throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", `Invalid ${field3}. ${accepted}`);
+  };
+  if (!record10(value) || !Object.keys(value).every((key2) => ["slug", "displayName", "description", "visibility", "confirm"].includes(key2)))
+    return refuse5("create input", "Provide only slug, displayName, description, visibility and confirm.");
+  if (value.confirm !== true)
+    throw new PrivatePublicationError("SKILL_CREATE_CONFIRM_REQUIRED", "Explicit confirmation is required to create this skill.");
+  if (typeof value.slug !== "string" || value.slug.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.slug))
+    return refuse5("slug", "Use lowercase kebab-case, at most 128 characters.");
+  if (typeof value.displayName !== "string" || !value.displayName.trim() || value.displayName.length > 256 || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value.displayName))
+    return refuse5("displayName", "Use nonempty text, at most 256 characters, without control characters.");
+  if (value.description !== undefined && (typeof value.description !== "string" || Buffer.byteLength(value.description) > 8192 || /[\p{Cc}\p{Cs}]/u.test(value.description.replace(/[\r\n\t]/g, ""))))
+    return refuse5("description", "Use text of at most 8192 UTF-8 bytes, without control characters other than tabs and newlines.");
+  if (value.visibility !== undefined && value.visibility !== "private" && value.visibility !== "team")
+    return refuse5("visibility", "Use private or team.");
+  return Object.freeze({ slug: value.slug, displayName: value.displayName.trim(), description: value.description ?? "", visibility: value.visibility ?? "private" });
+}
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -41544,11 +41657,11 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid4();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
   const controller = new AbortController;
   let reader;
   let response;
-  const timeout2 = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  const timeout2 = new PrivatePublicationError(create ? "SKILL_CREATE_UNCONFIRMED" : "PUBLICATION_UNCONFIRMED", create ? "Skill creation could not be confirmed. Inspect the workspace for this slug before another create; do not retry automatically." : "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
   let timer;
   let abort;
   try {
@@ -41588,11 +41701,19 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record10(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
-        if (code && failures2[code][0] === response.status)
-          throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        const known = create ? skillCreateFailures : failures2;
+        const code = record10(body) && typeof body.code === "string" && Object.hasOwn(known, body.code) ? body.code : null;
+        if (code && known[code][0] === response.status)
+          throw new PrivatePublicationError(code, known[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        if (create) {
+          if (response.status >= 500)
+            throw timeout2;
+          throw new PrivatePublicationError("SKILL_CREATE_REQUEST_FAILED", "The server refused skill creation.", false, response.status);
+        }
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
       }
+      if (create && response.status !== 201)
+        return invalid4();
       return body;
     })(), new Promise((_, reject) => {
       abort = () => {
@@ -41639,6 +41760,15 @@ class RemotePrivatePublicationsClient {
     this.membershipId = checked.user.membershipId;
     Object.freeze(this);
   }
+  async createSkill(input2, options = {}) {
+    const body = checkedPrivateSkillCreate(input2);
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", "Invalid timeoutMs. Use an integer from 1 to 15000.");
+    const value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/skills"), { method: "POST", body: JSON.stringify(body) }, this.#token, true, options.timeoutMs, options.signal, true);
+    if (!record10(value) || !publicationUuid(value.id) || value.slug !== body.slug || value.displayName !== body.displayName || value.description !== body.description || value.visibility !== body.visibility || value.sourceType !== "private_hosted" || !record10(value.metadata) || value.metadata.ownerOrganizationId !== this.organizationId)
+      throw new PrivatePublicationError("SKILL_CREATE_UNCONFIRMED", "Skill creation returned an unbound result. Inspect the workspace for this slug before another create; do not retry automatically.", true);
+    return Object.freeze({ id: value.id, slug: body.slug, visibility: body.visibility, sourceType: "private_hosted", ownerOrganizationId: this.organizationId });
+  }
   async getCapability(options = {}) {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
@@ -41781,7 +41911,7 @@ class RemotePrivatePublicationsClient {
     }
   }
 }
-var PRIVATE_PUBLICATION_MAX_BYTES, failures2, PrivatePublicationError, bad = () => {
+var PRIVATE_PUBLICATION_MAX_BYTES, skillCreateFailures, failures2, PrivatePublicationError, bad = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
@@ -41791,6 +41921,16 @@ var init_remote_private_publications = __esm(() => {
   init_remote_workspace_selection();
   init_skill_contract();
   PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+  skillCreateFailures = {
+    INVALID_SLUG: [400, "Provide a lowercase kebab-case skill slug."],
+    INVALID_DISPLAY_NAME: [400, "Provide a nonempty skill display name."],
+    INVALID_VISIBILITY: [400, "Use private or team visibility for source publication."],
+    SESSION_EXPIRED: [401, "Sign in again before creating a private skill."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required to create a private skill."],
+    ACCOUNT_UNAVAILABLE: [403, "The current account membership cannot create a private skill."],
+    PLAN_REQUIRED: [403, "Private and team skills require the Pro plan."],
+    SLUG_CONFLICT: [409, "This skill slug already exists. Inspect the existing skill before publishing."]
+  };
   failures2 = {
     INVALID_REQUEST: [400, "The publication request is invalid."],
     SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
@@ -48220,15 +48360,42 @@ var init_remote_invitation_tools = __esm(() => {
 });
 
 // src/lib/private-publication-customer.ts
+function preparePrivatePublicationSession(requested) {
+  const selectors = [
+    "HASNA_PROFILE",
+    "HASNA_HOME",
+    "HASNA_CONFIG_HOME",
+    "HASNA_STATION",
+    "HASNA_SKILLS_API_URL",
+    "SKILLS_API_URL",
+    "HASNA_SKILLS_API_KEY_OVERRIDE",
+    "HASNA_SKILLS_API_KEY_REF",
+    "HASNA_SKILLS_API_KEY",
+    "SKILLS_API_KEY"
+  ];
+  const before = new Map(selectors.map((key2) => [key2, process.env[key2]]));
+  const profile = selectedSkillsProfile(process.env), pending = prepareProfileWorkspace("Manage private publications");
+  const captured = requested ? { ...requested } : undefined;
+  const unchanged3 = () => {
+    if (selectors.some((key2) => process.env[key2] !== before.get(key2)) || selectedSkillsProfile(process.env) !== profile)
+      throw new PrivatePublicationError("PUBLICATION_TARGET_CHANGED", "The selected profile or server changed during verification. Start again with a stable target; no skill action was sent.");
+  };
+  return { origin: pending.origin, async verify(email5, code2) {
+    unchanged3();
+    const target = await pending.resolve();
+    const context2 = captured ?? target.context;
+    if (!context2 || !publicationUuid(context2.userId) || !publicationUuid(context2.membershipId) || target.context && (context2.userId !== target.context.userId || context2.membershipId !== target.context.membershipId))
+      throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
+    unchanged3();
+    target.unchanged();
+    const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email5, code2, context2);
+    unchanged3();
+    target.unchanged();
+    return client;
+  } };
+}
 async function privatePublicationSession(email5, code2, requested) {
-  const target = await captureProfileWorkspace("Manage private publications");
-  const context2 = requested ?? target.context;
-  if (!context2 || !publicationUuid(context2.userId) || !publicationUuid(context2.membershipId) || target.context && (context2.userId !== target.context.userId || context2.membershipId !== target.context.membershipId))
-    throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
-  target.unchanged();
-  const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email5, code2, context2);
-  target.unchanged();
-  return client;
+  return preparePrivatePublicationSession(requested).verify(email5, code2);
 }
 function privatePublicationCustomerError(error61) {
   return error61 instanceof PrivatePublicationError ? { error: error61.message, code: error61.code, uncertain: error61.uncertain } : { error: "The publication action could not be confirmed. Preserve the recovery directory and inspect the same intent; credentials were not changed.", code: "PUBLICATION_ACTION_UNCONFIRMED", uncertain: true };
@@ -48237,6 +48404,7 @@ var init_private_publication_customer = __esm(() => {
   init_remote_auth();
   init_remote_private_publications();
   init_workspace_profile();
+  init_instance_credentials();
 });
 
 // src/lib/private-publication-recovery.ts

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.76",
+  version: "0.10.78",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {