@hasna/skills 0.10.77 → 0.10.78

package/bin/mcp.js

@@ -23,7 +23,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.77",
+    version: "0.10.78",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -22805,7 +22805,8 @@ var init_codex_native_compatibility = __esm(() => {
     "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
     "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-    "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+    "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+    "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
   };
   SUPPORTED_CODEX_HOOK_VERSIONS = Object.freeze(Object.keys(MEASURED_CODEX_CAPABILITIES).filter((version2) => supportsCodexNativeCapability(version2, "hooks")));
 });
@@ -39120,6 +39121,7 @@ function normalizeRemoteSkill(skill) {
   if (!name)
     throw new Error("Remote skill requires name or slug");
   return {
+    ...skill.id !== undefined ? { id: skill.id } : {},
     name,
     displayName: skill.displayName || titleize(name),
     description: skill.description || "",
@@ -39224,11 +39226,12 @@ var init_remote_registry = __esm(() => {
     details: exports_external.array(exports_external.string()).optional()
   }).passthrough();
   remoteSkillSchema = exports_external.object({
+    id: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/).optional(),
     name: exports_external.string().min(1).optional(),
     slug: exports_external.string().min(1).optional(),
     displayName: exports_external.string().optional(),
     description: exports_external.string().optional(),
-    category: exports_external.string().optional(),
+    category: exports_external.string().nullable().optional(),
     tags: exports_external.array(exports_external.string()).optional(),
     dependencies: exports_external.array(exports_external.string()).optional(),
     version: exports_external.string().optional(),
@@ -41617,6 +41620,24 @@ var init_remote_invitation_recovery = __esm(() => {
 
 // src/lib/remote-private-publications.ts
 import { createHash as createHash26 } from "crypto";
+function checkedPrivateSkillCreate(value) {
+  const refuse5 = (field3, accepted) => {
+    throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", `Invalid ${field3}. ${accepted}`);
+  };
+  if (!record10(value) || !Object.keys(value).every((key2) => ["slug", "displayName", "description", "visibility", "confirm"].includes(key2)))
+    return refuse5("create input", "Provide only slug, displayName, description, visibility and confirm.");
+  if (value.confirm !== true)
+    throw new PrivatePublicationError("SKILL_CREATE_CONFIRM_REQUIRED", "Explicit confirmation is required to create this skill.");
+  if (typeof value.slug !== "string" || value.slug.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.slug))
+    return refuse5("slug", "Use lowercase kebab-case, at most 128 characters.");
+  if (typeof value.displayName !== "string" || !value.displayName.trim() || value.displayName.length > 256 || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value.displayName))
+    return refuse5("displayName", "Use nonempty text, at most 256 characters, without control characters.");
+  if (value.description !== undefined && (typeof value.description !== "string" || Buffer.byteLength(value.description) > 8192 || /[\p{Cc}\p{Cs}]/u.test(value.description.replace(/[\r\n\t]/g, ""))))
+    return refuse5("description", "Use text of at most 8192 UTF-8 bytes, without control characters other than tabs and newlines.");
+  if (value.visibility !== undefined && value.visibility !== "private" && value.visibility !== "team")
+    return refuse5("visibility", "Use private or team.");
+  return Object.freeze({ slug: value.slug, displayName: value.displayName.trim(), description: value.description ?? "", visibility: value.visibility ?? "private" });
+}
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -41636,11 +41657,11 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid4();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
   const controller = new AbortController;
   let reader;
   let response;
-  const timeout2 = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  const timeout2 = new PrivatePublicationError(create ? "SKILL_CREATE_UNCONFIRMED" : "PUBLICATION_UNCONFIRMED", create ? "Skill creation could not be confirmed. Inspect the workspace for this slug before another create; do not retry automatically." : "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
   let timer;
   let abort;
   try {
@@ -41680,11 +41701,19 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record10(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
-        if (code && failures2[code][0] === response.status)
-          throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        const known = create ? skillCreateFailures : failures2;
+        const code = record10(body) && typeof body.code === "string" && Object.hasOwn(known, body.code) ? body.code : null;
+        if (code && known[code][0] === response.status)
+          throw new PrivatePublicationError(code, known[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        if (create) {
+          if (response.status >= 500)
+            throw timeout2;
+          throw new PrivatePublicationError("SKILL_CREATE_REQUEST_FAILED", "The server refused skill creation.", false, response.status);
+        }
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
       }
+      if (create && response.status !== 201)
+        return invalid4();
       return body;
     })(), new Promise((_, reject) => {
       abort = () => {
@@ -41731,6 +41760,15 @@ class RemotePrivatePublicationsClient {
     this.membershipId = checked.user.membershipId;
     Object.freeze(this);
   }
+  async createSkill(input2, options = {}) {
+    const body = checkedPrivateSkillCreate(input2);
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", "Invalid timeoutMs. Use an integer from 1 to 15000.");
+    const value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/skills"), { method: "POST", body: JSON.stringify(body) }, this.#token, true, options.timeoutMs, options.signal, true);
+    if (!record10(value) || !publicationUuid(value.id) || value.slug !== body.slug || value.displayName !== body.displayName || value.description !== body.description || value.visibility !== body.visibility || value.sourceType !== "private_hosted" || !record10(value.metadata) || value.metadata.ownerOrganizationId !== this.organizationId)
+      throw new PrivatePublicationError("SKILL_CREATE_UNCONFIRMED", "Skill creation returned an unbound result. Inspect the workspace for this slug before another create; do not retry automatically.", true);
+    return Object.freeze({ id: value.id, slug: body.slug, visibility: body.visibility, sourceType: "private_hosted", ownerOrganizationId: this.organizationId });
+  }
   async getCapability(options = {}) {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
@@ -41873,7 +41911,7 @@ class RemotePrivatePublicationsClient {
     }
   }
 }
-var PRIVATE_PUBLICATION_MAX_BYTES, failures2, PrivatePublicationError, bad = () => {
+var PRIVATE_PUBLICATION_MAX_BYTES, skillCreateFailures, failures2, PrivatePublicationError, bad = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
@@ -41883,6 +41921,16 @@ var init_remote_private_publications = __esm(() => {
   init_remote_workspace_selection();
   init_skill_contract();
   PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+  skillCreateFailures = {
+    INVALID_SLUG: [400, "Provide a lowercase kebab-case skill slug."],
+    INVALID_DISPLAY_NAME: [400, "Provide a nonempty skill display name."],
+    INVALID_VISIBILITY: [400, "Use private or team visibility for source publication."],
+    SESSION_EXPIRED: [401, "Sign in again before creating a private skill."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required to create a private skill."],
+    ACCOUNT_UNAVAILABLE: [403, "The current account membership cannot create a private skill."],
+    PLAN_REQUIRED: [403, "Private and team skills require the Pro plan."],
+    SLUG_CONFLICT: [409, "This skill slug already exists. Inspect the existing skill before publishing."]
+  };
   failures2 = {
     INVALID_REQUEST: [400, "The publication request is invalid."],
     SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
@@ -48312,15 +48360,42 @@ var init_remote_invitation_tools = __esm(() => {
 });
 
 // src/lib/private-publication-customer.ts
+function preparePrivatePublicationSession(requested) {
+  const selectors = [
+    "HASNA_PROFILE",
+    "HASNA_HOME",
+    "HASNA_CONFIG_HOME",
+    "HASNA_STATION",
+    "HASNA_SKILLS_API_URL",
+    "SKILLS_API_URL",
+    "HASNA_SKILLS_API_KEY_OVERRIDE",
+    "HASNA_SKILLS_API_KEY_REF",
+    "HASNA_SKILLS_API_KEY",
+    "SKILLS_API_KEY"
+  ];
+  const before = new Map(selectors.map((key2) => [key2, process.env[key2]]));
+  const profile = selectedSkillsProfile(process.env), pending = prepareProfileWorkspace("Manage private publications");
+  const captured = requested ? { ...requested } : undefined;
+  const unchanged3 = () => {
+    if (selectors.some((key2) => process.env[key2] !== before.get(key2)) || selectedSkillsProfile(process.env) !== profile)
+      throw new PrivatePublicationError("PUBLICATION_TARGET_CHANGED", "The selected profile or server changed during verification. Start again with a stable target; no skill action was sent.");
+  };
+  return { origin: pending.origin, async verify(email5, code2) {
+    unchanged3();
+    const target = await pending.resolve();
+    const context2 = captured ?? target.context;
+    if (!context2 || !publicationUuid(context2.userId) || !publicationUuid(context2.membershipId) || target.context && (context2.userId !== target.context.userId || context2.membershipId !== target.context.membershipId))
+      throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
+    unchanged3();
+    target.unchanged();
+    const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email5, code2, context2);
+    unchanged3();
+    target.unchanged();
+    return client;
+  } };
+}
 async function privatePublicationSession(email5, code2, requested) {
-  const target = await captureProfileWorkspace("Manage private publications");
-  const context2 = requested ?? target.context;
-  if (!context2 || !publicationUuid(context2.userId) || !publicationUuid(context2.membershipId) || target.context && (context2.userId !== target.context.userId || context2.membershipId !== target.context.membershipId))
-    throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
-  target.unchanged();
-  const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email5, code2, context2);
-  target.unchanged();
-  return client;
+  return preparePrivatePublicationSession(requested).verify(email5, code2);
 }
 function privatePublicationCustomerError(error61) {
   return error61 instanceof PrivatePublicationError ? { error: error61.message, code: error61.code, uncertain: error61.uncertain } : { error: "The publication action could not be confirmed. Preserve the recovery directory and inspect the same intent; credentials were not changed.", code: "PUBLICATION_ACTION_UNCONFIRMED", uncertain: true };
@@ -48329,6 +48404,7 @@ var init_private_publication_customer = __esm(() => {
   init_remote_auth();
   init_remote_private_publications();
   init_workspace_profile();
+  init_instance_credentials();
 });
 
 // src/lib/private-publication-recovery.ts

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.77",
+  version: "0.10.78",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.77",
+  version: "0.10.78",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.77",
+  version: "0.10.78",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/runtime-mcp.d.ts

@@ -1,4 +1,5 @@
 export declare function handleMcp(options: {
     register?: string;
     json: boolean;
+    apiUrl?: string;
 }): Promise<void>;

package/dist/index.d.ts

@@ -53,7 +53,7 @@ export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLea
 export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "./lib/remote-invitations.js";
 export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "./lib/remote-invitations.js";
 export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "./lib/remote-invitation-recovery.js";
-export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "./lib/remote-private-publications.js";
+export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "./lib/remote-private-publications.js";
 export { preparePrivatePublication, readPrivatePublicationRecovery, continuePrivatePublication, inspectPrivatePublication, type PrivatePublicationRecovery, type PrivatePublicationResult } from "./lib/private-publication-recovery.js";
 export { HttpProfileClient, createProfileClient, type ProfileClient, type AuthenticatedProfilePrincipal, type AuthenticatedProfileRole } from "./lib/profile-client.js";
 export type { SkillSelection, SkillProfile, ResolvedSkillSelection, ResolvedSkillProfile, StationSkillStateInput, StationSkillState } from "./types/skill-selection.js";

package/dist/index.js

@@ -9405,7 +9405,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version, capability) {
   return typeof version === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version) && MEASURED_CODEX_CAPABILITIES[version].includes(capability);
@@ -15446,7 +15447,7 @@ import { basename as basename13, dirname as dirname24, isAbsolute as isAbsolute2
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute25, join as join36, resolve as resolve24 } from "path";
 // package.json
-var version = "0.10.77";
+var version = "0.10.78";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -44843,11 +44844,12 @@ var remoteAvailabilitySchema = exports_external.object({
   details: exports_external.array(exports_external.string()).optional()
 }).passthrough();
 var remoteSkillSchema = exports_external.object({
+  id: exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/).optional(),
   name: exports_external.string().min(1).optional(),
   slug: exports_external.string().min(1).optional(),
   displayName: exports_external.string().optional(),
   description: exports_external.string().optional(),
-  category: exports_external.string().optional(),
+  category: exports_external.string().nullable().optional(),
   tags: exports_external.array(exports_external.string()).optional(),
   dependencies: exports_external.array(exports_external.string()).optional(),
   version: exports_external.string().optional(),
@@ -44908,6 +44910,7 @@ function normalizeRemoteSkill(skill) {
   if (!name)
     throw new Error("Remote skill requires name or slug");
   return {
+    ...skill.id !== undefined ? { id: skill.id } : {},
     name,
     displayName: skill.displayName || titleize(name),
     description: skill.description || "",
@@ -48385,6 +48388,16 @@ async function requestInvitationEmail(origin, action, input2) {
 // src/lib/remote-private-publications.ts
 import { createHash as createHash34 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+var skillCreateFailures = {
+  INVALID_SLUG: [400, "Provide a lowercase kebab-case skill slug."],
+  INVALID_DISPLAY_NAME: [400, "Provide a nonempty skill display name."],
+  INVALID_VISIBILITY: [400, "Use private or team visibility for source publication."],
+  SESSION_EXPIRED: [401, "Sign in again before creating a private skill."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required to create a private skill."],
+  ACCOUNT_UNAVAILABLE: [403, "The current account membership cannot create a private skill."],
+  PLAN_REQUIRED: [403, "Private and team skills require the Pro plan."],
+  SLUG_CONFLICT: [409, "This skill slug already exists. Inspect the existing skill before publishing."]
+};
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
   SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
@@ -48431,6 +48444,24 @@ var record11 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var exact = (v, keys2) => record11(v) && Object.keys(v).sort().join(",") === keys2.sort().join(",");
 var date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
 var publicationSha256 = (bytes) => createHash34("sha256").update(bytes).digest("hex");
+function checkedPrivateSkillCreate(value) {
+  const refuse6 = (field3, accepted) => {
+    throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", `Invalid ${field3}. ${accepted}`);
+  };
+  if (!record11(value) || !Object.keys(value).every((key2) => ["slug", "displayName", "description", "visibility", "confirm"].includes(key2)))
+    return refuse6("create input", "Provide only slug, displayName, description, visibility and confirm.");
+  if (value.confirm !== true)
+    throw new PrivatePublicationError("SKILL_CREATE_CONFIRM_REQUIRED", "Explicit confirmation is required to create this skill.");
+  if (typeof value.slug !== "string" || value.slug.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.slug))
+    return refuse6("slug", "Use lowercase kebab-case, at most 128 characters.");
+  if (typeof value.displayName !== "string" || !value.displayName.trim() || value.displayName.length > 256 || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value.displayName))
+    return refuse6("displayName", "Use nonempty text, at most 256 characters, without control characters.");
+  if (value.description !== undefined && (typeof value.description !== "string" || Buffer.byteLength(value.description) > 8192 || /[\p{Cc}\p{Cs}]/u.test(value.description.replace(/[\r\n\t]/g, ""))))
+    return refuse6("description", "Use text of at most 8192 UTF-8 bytes, without control characters other than tabs and newlines.");
+  if (value.visibility !== undefined && value.visibility !== "private" && value.visibility !== "team")
+    return refuse6("visibility", "Use private or team.");
+  return Object.freeze({ slug: value.slug, displayName: value.displayName.trim(), description: value.description ?? "", visibility: value.visibility ?? "private" });
+}
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -48450,11 +48481,11 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid4();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
   const controller = new AbortController;
   let reader;
   let response;
-  const timeout2 = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  const timeout2 = new PrivatePublicationError(create ? "SKILL_CREATE_UNCONFIRMED" : "PUBLICATION_UNCONFIRMED", create ? "Skill creation could not be confirmed. Inspect the workspace for this slug before another create; do not retry automatically." : "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
   let timer;
   let abort;
   try {
@@ -48494,11 +48525,19 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal)
         return invalid4();
       }
       if (!response.ok) {
-        const code = record11(body) && typeof body.code === "string" && Object.hasOwn(failures2, body.code) ? body.code : null;
-        if (code && failures2[code][0] === response.status)
-          throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        const known = create ? skillCreateFailures : failures2;
+        const code = record11(body) && typeof body.code === "string" && Object.hasOwn(known, body.code) ? body.code : null;
+        if (code && known[code][0] === response.status)
+          throw new PrivatePublicationError(code, known[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        if (create) {
+          if (response.status >= 500)
+            throw timeout2;
+          throw new PrivatePublicationError("SKILL_CREATE_REQUEST_FAILED", "The server refused skill creation.", false, response.status);
+        }
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
       }
+      if (create && response.status !== 201)
+        return invalid4();
       return body;
     })(), new Promise((_, reject) => {
       abort = () => {
@@ -48545,6 +48584,15 @@ class RemotePrivatePublicationsClient {
     this.membershipId = checked.user.membershipId;
     Object.freeze(this);
   }
+  async createSkill(input2, options = {}) {
+    const body = checkedPrivateSkillCreate(input2);
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", "Invalid timeoutMs. Use an integer from 1 to 15000.");
+    const value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/skills"), { method: "POST", body: JSON.stringify(body) }, this.#token, true, options.timeoutMs, options.signal, true);
+    if (!record11(value) || !publicationUuid(value.id) || value.slug !== body.slug || value.displayName !== body.displayName || value.description !== body.description || value.visibility !== body.visibility || value.sourceType !== "private_hosted" || !record11(value.metadata) || value.metadata.ownerOrganizationId !== this.organizationId)
+      throw new PrivatePublicationError("SKILL_CREATE_UNCONFIRMED", "Skill creation returned an unbound result. Inspect the workspace for this slug before another create; do not retry automatically.", true);
+    return Object.freeze({ id: value.id, slug: body.slug, visibility: body.visibility, sourceType: "private_hosted", ownerOrganizationId: this.organizationId });
+  }
   async getCapability(options = {}) {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();

package/dist/lib/mcp-registration-environment.d.ts

@@ -0,0 +1,2 @@
+/** Safe selectors for a later MCP process. Credentials still resolve in that process. */
+export declare function skillsMcpRegistrationEnvironment(env?: Record<string, string | undefined>, origin?: string): Record<string, string>;

package/dist/lib/private-publication-customer.d.ts

@@ -1,7 +1,11 @@
 import { RemotePrivatePublicationsClient } from "./remote-private-publications.js";
 import type { RemoteWorkspaceContext } from "./remote-workspace-selection.js";
-/** Capture host profile before fresh verification. Neither the session nor a
- * signed upload capability is written to the host's credentials. */
+/** Capture before code input, so a later profile/origin change cannot retarget consent. */
+export declare function preparePrivatePublicationSession(requested?: RemoteWorkspaceContext): {
+    origin: string;
+    verify(email: string, code: string): Promise<RemotePrivatePublicationsClient>;
+};
+/** Neither the session nor a signed upload capability is saved to host credentials. */
 export declare function privatePublicationSession(email: string, code: string, requested?: RemoteWorkspaceContext): Promise<RemotePrivatePublicationsClient>;
 export declare function privatePublicationCustomerError(error: unknown): {
     error: string;

package/dist/lib/registry-types.d.ts

@@ -5,6 +5,8 @@ export type SkillKind = "executable" | "instruction";
  */
 export type SkillSource = "official" | "custom" | "remote" | "private" | "private-hosted" | "upstream" | "extension";
 export interface SkillMeta {
+    /** Immutable server UUID, when supplied and validated by a remote metadata read. */
+    id?: string;
     name: string;
     displayName: string;
     description: string;

package/dist/lib/remote-private-publications.d.ts

@@ -1,5 +1,20 @@
 import { type RemoteWorkspaceSession } from "./remote-workspace-selection.js";
 export declare const PRIVATE_PUBLICATION_MAX_BYTES: number;
+export interface CreatePrivateSkillInput {
+    slug: string;
+    displayName: string;
+    description?: string;
+    visibility?: "private" | "team";
+    confirm: true;
+}
+/** Only validated identifiers and enums are returned; server free text stays private. */
+export interface CreatedPrivateSkill {
+    id: string;
+    slug: string;
+    visibility: "private" | "team";
+    sourceType: "private_hosted";
+    ownerOrganizationId: string;
+}
 export type PrivatePublicationState = "awaiting_upload" | "queued" | "verifying" | "needs_attention" | "committed" | "rejected" | "cancelled" | "expired";
 export interface PrivatePublicationDeclaration {
     idempotencyKey: string;
@@ -45,6 +60,8 @@ export declare class PrivatePublicationError extends Error {
 }
 export declare const publicationUuid: (v: unknown) => v is string;
 export declare const publicationSha256: (bytes: Uint8Array | string) => string;
+/** Validate and capture before verification or any await. Confirmation is local only. */
+export declare function checkedPrivateSkillCreate(value: unknown): Omit<Required<CreatePrivateSkillInput>, "confirm">;
 export declare function checkedPublicationDeclaration(value: unknown): PrivatePublicationDeclaration;
 export declare function checkedPublicationView(value: unknown, skillId: string, intentId?: string, declaration?: PrivatePublicationDeclaration): PrivatePublicationView;
 /** Explicit hosted contract, unrelated to registry publishSkill and its content revisions.
@@ -56,6 +73,11 @@ export declare class RemotePrivatePublicationsClient {
     readonly userId: string;
     readonly membershipId: string;
     constructor(apiUrl: string, session: RemoteWorkspaceSession);
+    /** One session-only POST. An uncertain result must be inspected, never replayed. */
+    createSkill(input: CreatePrivateSkillInput, options?: {
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<CreatedPrivateSkill>;
     getCapability(options?: {
         timeoutMs?: number;
         signal?: AbortSignal;

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute7 } from "path";
 // package.json
-var version = "0.10.77";
+var version = "0.10.78";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -1955,7 +1955,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version2, capability) {
   return typeof version2 === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version2) && MEASURED_CODEX_CAPABILITIES[version2].includes(capability);

package/dist/sdk/index.d.ts

@@ -60,7 +60,7 @@ export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLea
 export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "../lib/remote-invitations.js";
 export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "../lib/remote-invitations.js";
 export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "../lib/remote-invitation-recovery.js";
-export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
+export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
 export { preparePrivatePublication, readPrivatePublicationRecovery, continuePrivatePublication, inspectPrivatePublication, type PrivatePublicationRecovery, type PrivatePublicationResult } from "../lib/private-publication-recovery.js";
 export { createSkillOperationClient, SkillOperationClientError, SKILL_OPERATION_LIMITS, type SkillOperationClient, type SkillOperationTransport, type SkillOperationRequest, type SkillOperationResult, type SkillOperationJson, type SkillOperationRefusal, type SkillOperationClientErrorCode } from "./operations.js";
 export type { RemoteCreditCheckoutOptions, RemoteCreditCheckout, RemoteCreditCheckoutErrorCode } from "../lib/remote-credit-checkout.js";

package/dist/sdk/index.js

@@ -32371,7 +32371,7 @@ var init_event_sink = __esm(() => {
   init_dist();
 });
 // package.json
-var version = "0.10.77";
+var version = "0.10.78";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -39103,7 +39103,8 @@ var MEASURED_CODEX_CAPABILITIES = {
   "codex-cli 0.160.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.161.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
   "codex-cli 0.162.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
-  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
+  "codex-cli 0.162.1": ["hooks", "qualified-skill-catalog", "installed-plugin-review"],
+  "codex-cli 0.163.0": ["hooks", "qualified-skill-catalog", "installed-plugin-review"]
 };
 function supportsCodexNativeCapability(version2, capability) {
   return typeof version2 === "string" && Object.hasOwn(MEASURED_CODEX_CAPABILITIES, version2) && MEASURED_CODEX_CAPABILITIES[version2].includes(capability);
@@ -98372,6 +98373,16 @@ async function requestInvitationEmail(origin, action, input2) {
 // src/lib/remote-private-publications.ts
 import { createHash as createHash45 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
+var skillCreateFailures = {
+  INVALID_SLUG: [400, "Provide a lowercase kebab-case skill slug."],
+  INVALID_DISPLAY_NAME: [400, "Provide a nonempty skill display name."],
+  INVALID_VISIBILITY: [400, "Use private or team visibility for source publication."],
+  SESSION_EXPIRED: [401, "Sign in again before creating a private skill."],
+  INTERACTIVE_SESSION_REQUIRED: [403, "An interactive account session is required to create a private skill."],
+  ACCOUNT_UNAVAILABLE: [403, "The current account membership cannot create a private skill."],
+  PLAN_REQUIRED: [403, "Private and team skills require the Pro plan."],
+  SLUG_CONFLICT: [409, "This skill slug already exists. Inspect the existing skill before publishing."]
+};
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
   SESSION_EXPIRED: [401, "Sign in again to manage this publication."],
@@ -98418,6 +98429,24 @@ var record12 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var exact = (v2, keys4) => record12(v2) && Object.keys(v2).sort().join(",") === keys4.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
 var publicationSha256 = (bytes) => createHash45("sha256").update(bytes).digest("hex");
+function checkedPrivateSkillCreate(value) {
+  const refuse8 = (field3, accepted) => {
+    throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", `Invalid ${field3}. ${accepted}`);
+  };
+  if (!record12(value) || !Object.keys(value).every((key2) => ["slug", "displayName", "description", "visibility", "confirm"].includes(key2)))
+    return refuse8("create input", "Provide only slug, displayName, description, visibility and confirm.");
+  if (value.confirm !== true)
+    throw new PrivatePublicationError("SKILL_CREATE_CONFIRM_REQUIRED", "Explicit confirmation is required to create this skill.");
+  if (typeof value.slug !== "string" || value.slug.length > 128 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.slug))
+    return refuse8("slug", "Use lowercase kebab-case, at most 128 characters.");
+  if (typeof value.displayName !== "string" || !value.displayName.trim() || value.displayName.length > 256 || /[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value.displayName))
+    return refuse8("displayName", "Use nonempty text, at most 256 characters, without control characters.");
+  if (value.description !== undefined && (typeof value.description !== "string" || Buffer.byteLength(value.description) > 8192 || /[\p{Cc}\p{Cs}]/u.test(value.description.replace(/[\r\n\t]/g, ""))))
+    return refuse8("description", "Use text of at most 8192 UTF-8 bytes, without control characters other than tabs and newlines.");
+  if (value.visibility !== undefined && value.visibility !== "private" && value.visibility !== "team")
+    return refuse8("visibility", "Use private or team.");
+  return Object.freeze({ slug: value.slug, displayName: value.displayName.trim(), description: value.description ?? "", visibility: value.visibility ?? "private" });
+}
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash5(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -98437,11 +98466,11 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid7();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
   const controller = new AbortController;
   let reader;
   let response;
-  const timeout2 = new PrivatePublicationError("PUBLICATION_UNCONFIRMED", "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
+  const timeout2 = new PrivatePublicationError(create ? "SKILL_CREATE_UNCONFIRMED" : "PUBLICATION_UNCONFIRMED", create ? "Skill creation could not be confirmed. Inspect the workspace for this slug before another create; do not retry automatically." : "No confirmed publication result. Inspect the saved intent before retrying.", mutation);
   let timer;
   let abort;
   try {
@@ -98481,11 +98510,19 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal)
         return invalid7();
       }
       if (!response.ok) {
-        const code = record12(body4) && typeof body4.code === "string" && Object.hasOwn(failures2, body4.code) ? body4.code : null;
-        if (code && failures2[code][0] === response.status)
-          throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        const known = create ? skillCreateFailures : failures2;
+        const code = record12(body4) && typeof body4.code === "string" && Object.hasOwn(known, body4.code) ? body4.code : null;
+        if (code && known[code][0] === response.status)
+          throw new PrivatePublicationError(code, known[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
+        if (create) {
+          if (response.status >= 500)
+            throw timeout2;
+          throw new PrivatePublicationError("SKILL_CREATE_REQUEST_FAILED", "The server refused skill creation.", false, response.status);
+        }
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
       }
+      if (create && response.status !== 201)
+        return invalid7();
       return body4;
     })(), new Promise((_, reject) => {
       abort = () => {
@@ -98532,6 +98569,15 @@ class RemotePrivatePublicationsClient {
     this.membershipId = checked.user.membershipId;
     Object.freeze(this);
   }
+  async createSkill(input2, options = {}) {
+    const body4 = checkedPrivateSkillCreate(input2);
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      throw new PrivatePublicationError("INVALID_SKILL_CREATE_INPUT", "Invalid timeoutMs. Use an integer from 1 to 15000.");
+    const value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/skills"), { method: "POST", body: JSON.stringify(body4) }, this.#token, true, options.timeoutMs, options.signal, true);
+    if (!record12(value) || !publicationUuid(value.id) || value.slug !== body4.slug || value.displayName !== body4.displayName || value.description !== body4.description || value.visibility !== body4.visibility || value.sourceType !== "private_hosted" || !record12(value.metadata) || value.metadata.ownerOrganizationId !== this.organizationId)
+      throw new PrivatePublicationError("SKILL_CREATE_UNCONFIRMED", "Skill creation returned an unbound result. Inspect the workspace for this slug before another create; do not retry automatically.", true);
+    return Object.freeze({ id: value.id, slug: body4.slug, visibility: body4.visibility, sourceType: "private_hosted", ownerOrganizationId: this.organizationId });
+  }
   async getCapability(options = {}) {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.77",
+  "version": "0.10.78",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {