@hasna/skills 0.10.76 → 0.10.78

package/dist/lib/private-publication-customer.d.ts

@@ -1,7 +1,11 @@
 import { RemotePrivatePublicationsClient } from "./remote-private-publications.js";
 import type { RemoteWorkspaceContext } from "./remote-workspace-selection.js";
-/** Capture host profile before fresh verification. Neither the session nor a
- * signed upload capability is written to the host's credentials. */
+/** Capture before code input, so a later profile/origin change cannot retarget consent. */
+export declare function preparePrivatePublicationSession(requested?: RemoteWorkspaceContext): {
+    origin: string;
+    verify(email: string, code: string): Promise<RemotePrivatePublicationsClient>;
+};
+/** Neither the session nor a signed upload capability is saved to host credentials. */
 export declare function privatePublicationSession(email: string, code: string, requested?: RemoteWorkspaceContext): Promise<RemotePrivatePublicationsClient>;
 export declare function privatePublicationCustomerError(error: unknown): {
     error: string;

package/dist/lib/registry-types.d.ts

@@ -5,6 +5,8 @@ export type SkillKind = "executable" | "instruction";
  */
 export type SkillSource = "official" | "custom" | "remote" | "private" | "private-hosted" | "upstream" | "extension";
 export interface SkillMeta {
+    /** Immutable server UUID, when supplied and validated by a remote metadata read. */
+    id?: string;
     name: string;
     displayName: string;
     description: string;

package/dist/lib/remote-private-publications.d.ts

@@ -1,5 +1,20 @@
 import { type RemoteWorkspaceSession } from "./remote-workspace-selection.js";
 export declare const PRIVATE_PUBLICATION_MAX_BYTES: number;
+export interface CreatePrivateSkillInput {
+    slug: string;
+    displayName: string;
+    description?: string;
+    visibility?: "private" | "team";
+    confirm: true;
+}
+/** Only validated identifiers and enums are returned; server free text stays private. */
+export interface CreatedPrivateSkill {
+    id: string;
+    slug: string;
+    visibility: "private" | "team";
+    sourceType: "private_hosted";
+    ownerOrganizationId: string;
+}
 export type PrivatePublicationState = "awaiting_upload" | "queued" | "verifying" | "needs_attention" | "committed" | "rejected" | "cancelled" | "expired";
 export interface PrivatePublicationDeclaration {
     idempotencyKey: string;
@@ -45,6 +60,8 @@ export declare class PrivatePublicationError extends Error {
 }
 export declare const publicationUuid: (v: unknown) => v is string;
 export declare const publicationSha256: (bytes: Uint8Array | string) => string;
+/** Validate and capture before verification or any await. Confirmation is local only. */
+export declare function checkedPrivateSkillCreate(value: unknown): Omit<Required<CreatePrivateSkillInput>, "confirm">;
 export declare function checkedPublicationDeclaration(value: unknown): PrivatePublicationDeclaration;
 export declare function checkedPublicationView(value: unknown, skillId: string, intentId?: string, declaration?: PrivatePublicationDeclaration): PrivatePublicationView;
 /** Explicit hosted contract, unrelated to registry publishSkill and its content revisions.
@@ -56,6 +73,11 @@ export declare class RemotePrivatePublicationsClient {
     readonly userId: string;
     readonly membershipId: string;
     constructor(apiUrl: string, session: RemoteWorkspaceSession);
+    /** One session-only POST. An uncertain result must be inspected, never replayed. */
+    createSkill(input: CreatePrivateSkillInput, options?: {
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<CreatedPrivateSkill>;
     getCapability(options?: {
         timeoutMs?: number;
         signal?: AbortSignal;

package/dist/lib/sign-in.d.ts

@@ -119,7 +119,7 @@ export declare function clearPendingDeviceSignIn(env?: Env, origin?: string): vo
  * Store the key a sign-in produced, bound to the instance that issued it.
  * A session-only answer (a token, no key) mints a CLI key first.
  */
-export declare function persistSignIn(result: SignInResult, origin: string, env?: Env, issuedBy?: StoredKeyIssuer): Promise<string>;
+export declare function persistSignIn(result: SignInResult, origin: string, env?: Env, issuedBy?: StoredKeyIssuer, assertUnchanged?: () => void): Promise<string>;
 /**
  * What happened to server-side revocation.
  *

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute7 } from "path";
 // package.json
-var version = "0.10.76";
+var version = "0.10.78";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -1955,7 +1955,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version2, capability) {
   return typeof version2 === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version2) && MEASURED_CODEX_CAPABILITIES[version2].includes(capability);

package/dist/sdk/index.d.ts

@@ -60,7 +60,7 @@ export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLea
 export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "../lib/remote-invitations.js";
 export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "../lib/remote-invitations.js";
 export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "../lib/remote-invitation-recovery.js";
-export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
+export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
 export { preparePrivatePublication, readPrivatePublicationRecovery, continuePrivatePublication, inspectPrivatePublication, type PrivatePublicationRecovery, type PrivatePublicationResult } from "../lib/private-publication-recovery.js";
 export { createSkillOperationClient, SkillOperationClientError, SKILL_OPERATION_LIMITS, type SkillOperationClient, type SkillOperationTransport, type SkillOperationRequest, type SkillOperationResult, type SkillOperationJson, type SkillOperationRefusal, type SkillOperationClientErrorCode } from "./operations.js";
 export type { RemoteCreditCheckoutOptions, RemoteCreditCheckout, RemoteCreditCheckoutErrorCode } from "../lib/remote-credit-checkout.js";