@hasna/skills 0.10.81 → 0.10.82

package/bin/mcp.js

@@ -23,7 +23,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.81",
+    version: "0.10.82",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -23031,7 +23031,7 @@ function hashClaudePluginCacheOrphanMarker(path, budget2, changes) {
   if (!before)
     return null;
   const uid = process.getuid?.();
-  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32)
+  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32 || (before.mode & 73) !== 0)
     throw new Error("Invalid Claude orphan marker file or owner");
   const fd = openSync7(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   try {
@@ -30444,7 +30444,7 @@ function safe2(path) {
 function same2(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget2, excludedRoots, omittedRoots = [], rows) {
+function capture(path, budget2, excludedRoots, omittedRoots = [], rows, claudeMarkers) {
   safe2(path);
   if (omittedRoots.some((root2) => path === root2 || path.startsWith(root2 + "/")))
     return { path, sha256: null };
@@ -30472,6 +30472,11 @@ function capture(path, budget2, excludedRoots, omittedRoots = [], rows) {
       need3(child2.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
       const stat = lstatSync8(child2);
       need3(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      if (claudeMarkers && isClaudePluginCacheOrphanMarker(child2)) {
+        need3(hashClaudePluginCacheOrphanMarker(child2) !== null, "Claude orphan marker changed while reading directory");
+        if (claudeMarkers === "omit")
+          continue;
+      }
       const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
 `;
       budget2.bytes += Buffer.byteLength(row);
@@ -30528,25 +30533,33 @@ function verifyDiscoveryDirectoryProjection(directories, omittedRoots, tolerance
       witnessChanged(new NativeDiscoveryWitnessChange("membership", directories[i].path, "Native discovery directory membership changed outside retired Codex roots"), tolerance, tolerance?.acceptsMembership(directories[i].path) === true);
     }
 }
-function captureDiscoveryDirectories(paths, excludedRoots = []) {
+function captureOrdinaryDirectories(paths, excludedRoots, claudeMarkers) {
   need3(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget2 = { entries: 0, bytes: 0 };
   for (const root of excludedRoots)
     safe2(root);
-  return paths.map((path) => capture(path, budget2, excludedRoots));
+  return paths.map((path) => capture(path, budget2, excludedRoots, [], undefined, claudeMarkers));
+}
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
+  return captureOrdinaryDirectories(paths, excludedRoots, "omit");
 }
 function verifyDiscoveryDirectories(directories, excludedRoots = [], tolerance) {
   need3(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need3(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
   const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
+  let legacy;
   for (let i = 0;i < directories.length; i++)
     if (current[i].sha256 !== directories[i].sha256) {
+      legacy ??= captureOrdinaryDirectories(directories.map((directory) => directory.path), excludedRoots, "retain");
+      if (legacy[i].sha256 === directories[i].sha256)
+        continue;
       witnessChanged(new NativeDiscoveryWitnessChange("membership", directories[i].path, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`), tolerance, tolerance?.acceptsMembership(directories[i].path) === true);
     }
 }
 var init_agent_discovery_directories = __esm(() => {
   init_agent_policy_limits();
+  init_claude_plugin_cache_marker();
   init_native_discovery_witness_change();
 });
 
@@ -41871,7 +41884,7 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid4();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false, readBinding) {
   const controller = new AbortController;
   let reader;
   let response;
@@ -41887,8 +41900,18 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal,
         redirect: "error",
         credentials: "omit",
         signal: controller.signal,
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` }
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+          ...readBinding ? {
+            "x-skills-user-id": readBinding.userId,
+            "x-skills-workspace-id": readBinding.organizationId,
+            "x-skills-membership-id": readBinding.membershipId
+          } : {}
+        }
       });
+      if (readBinding && response.ok && response.status !== 200)
+        return invalid4();
       const length = response.headers.get("content-length");
       if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
         return invalid4();
@@ -41956,6 +41979,81 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal,
       response?.body?.cancel().catch(() => {});
   }
 }
+function historyDate(value) {
+  if (typeof value !== "string")
+    return false;
+  const parts = /^(\d{4})-(\d{2})-(\d{2})(T| )(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-](\d{2})(?::(\d{2}))?)$/.exec(value);
+  if (!parts)
+    return false;
+  const [, y, m, d, separator, h, minute, second, fraction, zone, offsetHour, offsetMinute] = parts;
+  if (separator === " " ? zone === "Z" || (fraction?.length ?? 0) > 6 : zone !== "Z" && offsetMinute === undefined)
+    return false;
+  const year = Number(y), month = Number(m), day = Number(d);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return year > 0 && month >= 1 && month <= 12 && day >= 1 && day <= days[month - 1] && Number(h) <= 23 && Number(minute) <= 59 && Number(second) <= 59 && (zone === "Z" || Number(offsetHour) <= 23 && Number(offsetMinute ?? 0) <= 59);
+}
+function privateHistory(value, organizationId, skillId, limit, cursor2) {
+  if (!record10(value) || value.organizationId !== organizationId || value.skillId !== skillId || typeof value.slug !== "string" || !/^[a-z0-9-]+$/.test(value.slug) || !(value.currentVersion === null || historyText(value.currentVersion)) || !(value.currentVersionId === null || publicationUuid(value.currentVersionId)) || value.currentVersion === null !== (value.currentVersionId === null) || !(value.nextCursor === null || publicationUuid(value.nextCursor)) || !Array.isArray(value.versions) || value.versions.length > limit)
+    return historyResponse();
+  const seen = new Set;
+  let previous = cursor2;
+  const versions2 = value.versions.map((row) => {
+    if (!record10(row) || !publicationUuid(row.id) || seen.has(row.id) || previous !== undefined && row.id >= previous || !historyText(row.version) || !(row.releasedAt === null || historyDate(row.releasedAt)) || !historyDate(row.createdAt) || row.id === value.currentVersionId !== (row.version === value.currentVersion))
+      return historyResponse();
+    seen.add(row.id);
+    previous = row.id;
+    return Object.freeze({ id: row.id, version: row.version, releasedAt: row.releasedAt, createdAt: row.createdAt });
+  });
+  if (value.nextCursor !== null && (!versions2.length || value.nextCursor !== versions2.at(-1).id))
+    return historyResponse();
+  return Object.freeze({
+    organizationId,
+    skillId,
+    slug: value.slug,
+    currentVersion: value.currentVersion,
+    currentVersionId: value.currentVersionId,
+    versions: Object.freeze(versions2),
+    nextCursor: value.nextCursor
+  });
+}
+
+class RemotePrivateSkillHistoryClient {
+  apiOrigin;
+  organizationId;
+  userId;
+  membershipId;
+  #token;
+  constructor(apiUrl, session) {
+    const checked = parseWorkspaceSession(session, { userId: session?.user?.id, membershipId: session?.user?.membershipId });
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+    this.#token = checked.token;
+    this.organizationId = checked.organization.id;
+    this.userId = checked.user.id;
+    this.membershipId = checked.user.membershipId;
+    Object.freeze(this);
+  }
+  async listVersions(skillId, options = {}) {
+    if (!publicationUuid(skillId) || options.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 50) || options.cursor !== undefined && !publicationUuid(options.cursor) || options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      return historyInput();
+    const limit = options.limit ?? 20, cursor2 = options.cursor;
+    const query = new URLSearchParams;
+    if (options.limit !== undefined)
+      query.set("limit", String(limit));
+    if (cursor2 !== undefined)
+      query.set("cursor", cursor2);
+    const path = `/api/v1/skills/${skillId}/versions${query.size ? `?${query}` : ""}`;
+    let value;
+    try {
+      value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, path), { method: "GET" }, this.#token, false, options.timeoutMs, options.signal, false, this);
+    } catch (error61) {
+      if (error61 instanceof PrivatePublicationError && error61.code === "INVALID_PUBLICATION_RESPONSE")
+        return historyResponse();
+      throw new PrivatePublicationError("PRIVATE_HISTORY_UNAVAILABLE", "Unable to read private version history. Check the selected server, current membership and fresh sign-in; no skill or credential was changed.", false, error61 instanceof PrivatePublicationError ? error61.status : undefined);
+    }
+    return privateHistory(value, this.organizationId, skillId, limit, cursor2);
+  }
+}
 
 class RemotePrivatePublicationsClient {
   apiOrigin;
@@ -42129,7 +42227,11 @@ var PRIVATE_PUBLICATION_MAX_BYTES, skillCreateFailures, failures2, PrivatePublic
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash4 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record10 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record10(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash27("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash4 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record10 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record10(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash27("sha256").update(bytes).digest("hex"), historyInput = () => {
+  throw new PrivatePublicationError("INVALID_PRIVATE_HISTORY_INPUT", "Provide a private skill UUID, limit from 1 to 50, and an optional UUID cursor; timeoutMs must be from 1 to 15000.");
+}, historyResponse = () => {
+  throw new PrivatePublicationError("INVALID_PRIVATE_HISTORY_RESPONSE", "The server returned invalid private version history.");
+}, historyText = (value) => typeof value === "string" && value.length > 0 && value.length <= 128 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value);
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -42244,6 +42346,10 @@ class RemoteSkillsAuthClient {
     const origin = this.apiOrigin, captured = workspaceContext(context);
     return new RemotePrivatePublicationsClient(origin, await this.switchWorkspace(email4, code, captured));
   }
+  async openPrivateSkillHistory(email4, code, context) {
+    const origin = this.apiOrigin, captured = workspaceContext(context);
+    return new RemotePrivateSkillHistoryClient(origin, await this.switchWorkspace(email4, code, captured));
+  }
   requestInvitationEmailChallenge(input2) {
     return requestInvitationEmail(this.apiOrigin, "challenge", input2);
   }
@@ -48574,7 +48680,7 @@ var init_remote_invitation_tools = __esm(() => {
 });
 
 // src/lib/private-publication-customer.ts
-function preparePrivatePublicationSession(requested) {
+function preparePrivateSession(requested, action, open2) {
   const selectors = [
     "HASNA_PROFILE",
     "HASNA_HOME",
@@ -48588,7 +48694,7 @@ function preparePrivatePublicationSession(requested) {
     "SKILLS_API_KEY"
   ];
   const before = new Map(selectors.map((key2) => [key2, process.env[key2]]));
-  const profile = selectedSkillsProfile(process.env), pending = prepareProfileWorkspace("Manage private publications");
+  const profile = selectedSkillsProfile(process.env), pending = prepareProfileWorkspace(action);
   const captured = requested ? { ...requested } : undefined;
   const unchanged3 = () => {
     if (selectors.some((key2) => process.env[key2] !== before.get(key2)) || selectedSkillsProfile(process.env) !== profile)
@@ -48602,12 +48708,15 @@ function preparePrivatePublicationSession(requested) {
       throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide the observed user and membership IDs, or select an enrolled workspace profile.");
     unchanged3();
     target.unchanged();
-    const client = await new RemoteSkillsAuthClient(target.origin).openPrivatePublications(email5, code2, context2);
+    const client = await open2(new RemoteSkillsAuthClient(target.origin), email5, code2, context2);
     unchanged3();
     target.unchanged();
     return client;
   } };
 }
+function preparePrivatePublicationSession(requested) {
+  return preparePrivateSession(requested, "Manage private publications", (auth, email5, code2, context2) => auth.openPrivatePublications(email5, code2, context2));
+}
 async function privatePublicationSession(email5, code2, requested) {
   return preparePrivatePublicationSession(requested).verify(email5, code2);
 }

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.81",
+  version: "0.10.82",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.81",
+  version: "0.10.82",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.81",
+  version: "0.10.82",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.d.ts

@@ -53,7 +53,7 @@ export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLea
 export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "./lib/remote-invitations.js";
 export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "./lib/remote-invitations.js";
 export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "./lib/remote-invitation-recovery.js";
-export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "./lib/remote-private-publications.js";
+export { RemotePrivatePublicationsClient, RemotePrivateSkillHistoryClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type PrivateSkillVersion, type PrivateSkillVersionHistory, type PrivateSkillVersionHistoryOptions, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "./lib/remote-private-publications.js";
 export { preparePrivatePublication, readPrivatePublicationRecovery, continuePrivatePublication, inspectPrivatePublication, type PrivatePublicationRecovery, type PrivatePublicationResult } from "./lib/private-publication-recovery.js";
 export { HttpProfileClient, createProfileClient, type ProfileClient, type AuthenticatedProfilePrincipal, type AuthenticatedProfileRole } from "./lib/profile-client.js";
 export type { SkillSelection, SkillProfile, ResolvedSkillSelection, ResolvedSkillProfile, StationSkillStateInput, StationSkillState } from "./types/skill-selection.js";

package/dist/index.js

@@ -9643,7 +9643,7 @@ function hashClaudePluginCacheOrphanMarker(path, budget2, changes) {
   if (!before)
     return null;
   const uid = process.getuid?.();
-  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32)
+  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32 || (before.mode & 73) !== 0)
     throw new Error("Invalid Claude orphan marker file or owner");
   const fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
   try {
@@ -10269,7 +10269,7 @@ function safe2(path) {
 function same2(before, after) {
   return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
 }
-function capture(path, budget2, excludedRoots, omittedRoots = [], rows) {
+function capture(path, budget2, excludedRoots, omittedRoots = [], rows, claudeMarkers) {
   safe2(path);
   if (omittedRoots.some((root2) => path === root2 || path.startsWith(root2 + "/")))
     return { path, sha256: null };
@@ -10297,6 +10297,11 @@ function capture(path, budget2, excludedRoots, omittedRoots = [], rows) {
       need3(child2.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
       const stat = lstatSync7(child2);
       need3(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      if (claudeMarkers && isClaudePluginCacheOrphanMarker(child2)) {
+        need3(hashClaudePluginCacheOrphanMarker(child2) !== null, "Claude orphan marker changed while reading directory");
+        if (claudeMarkers === "omit")
+          continue;
+      }
       const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
 `;
       budget2.bytes += Buffer.byteLength(row);
@@ -10353,20 +10358,27 @@ function verifyDiscoveryDirectoryProjection(directories, omittedRoots, tolerance
       witnessChanged(new NativeDiscoveryWitnessChange("membership", directories[i].path, "Native discovery directory membership changed outside retired Codex roots"), tolerance, tolerance?.acceptsMembership(directories[i].path) === true);
     }
 }
-function captureDiscoveryDirectories(paths, excludedRoots = []) {
+function captureOrdinaryDirectories(paths, excludedRoots, claudeMarkers) {
   need3(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
   const budget2 = { entries: 0, bytes: 0 };
   for (const root of excludedRoots)
     safe2(root);
-  return paths.map((path) => capture(path, budget2, excludedRoots));
+  return paths.map((path) => capture(path, budget2, excludedRoots, [], undefined, claudeMarkers));
+}
+function captureDiscoveryDirectories(paths, excludedRoots = []) {
+  return captureOrdinaryDirectories(paths, excludedRoots, "omit");
 }
 function verifyDiscoveryDirectories(directories, excludedRoots = [], tolerance) {
   need3(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
   for (const directory of directories)
     need3(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
   const current = captureDiscoveryDirectories(directories.map((directory) => directory.path), excludedRoots);
+  let legacy;
   for (let i = 0;i < directories.length; i++)
     if (current[i].sha256 !== directories[i].sha256) {
+      legacy ??= captureOrdinaryDirectories(directories.map((directory) => directory.path), excludedRoots, "retain");
+      if (legacy[i].sha256 === directories[i].sha256)
+        continue;
       witnessChanged(new NativeDiscoveryWitnessChange("membership", directories[i].path, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`), tolerance, tolerance?.acceptsMembership(directories[i].path) === true);
     }
 }
@@ -15852,7 +15864,7 @@ import { basename as basename14, dirname as dirname25, isAbsolute as isAbsolute2
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute25, join as join37, resolve as resolve24 } from "path";
 // package.json
-var version = "0.10.81";
+var version = "0.10.82";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -49531,7 +49543,7 @@ function checkedPublicationView(value, skillId, intentId, declaration) {
     return invalid4();
   return Object.freeze({ ...value });
 }
-async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false) {
+async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal, create = false, readBinding) {
   const controller = new AbortController;
   let reader;
   let response;
@@ -49547,8 +49559,18 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal,
         redirect: "error",
         credentials: "omit",
         signal: controller.signal,
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` }
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+          ...readBinding ? {
+            "x-skills-user-id": readBinding.userId,
+            "x-skills-workspace-id": readBinding.organizationId,
+            "x-skills-membership-id": readBinding.membershipId
+          } : {}
+        }
       });
+      if (readBinding && response.ok && response.status !== 200)
+        return invalid4();
       const length = response.headers.get("content-length");
       if (length !== null && (!/^\d+$/.test(length) || Number(length) > 65536))
         return invalid4();
@@ -49616,6 +49638,88 @@ async function boundedJson(url2, init, token, mutation, budget3 = 15000, signal,
       response?.body?.cancel().catch(() => {});
   }
 }
+var historyInput = () => {
+  throw new PrivatePublicationError("INVALID_PRIVATE_HISTORY_INPUT", "Provide a private skill UUID, limit from 1 to 50, and an optional UUID cursor; timeoutMs must be from 1 to 15000.");
+};
+var historyResponse = () => {
+  throw new PrivatePublicationError("INVALID_PRIVATE_HISTORY_RESPONSE", "The server returned invalid private version history.");
+};
+var historyText = (value) => typeof value === "string" && value.length > 0 && value.length <= 128 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(value);
+function historyDate(value) {
+  if (typeof value !== "string")
+    return false;
+  const parts = /^(\d{4})-(\d{2})-(\d{2})(T| )(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-](\d{2})(?::(\d{2}))?)$/.exec(value);
+  if (!parts)
+    return false;
+  const [, y, m, d, separator, h, minute, second, fraction, zone, offsetHour, offsetMinute] = parts;
+  if (separator === " " ? zone === "Z" || (fraction?.length ?? 0) > 6 : zone !== "Z" && offsetMinute === undefined)
+    return false;
+  const year = Number(y), month = Number(m), day = Number(d);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return year > 0 && month >= 1 && month <= 12 && day >= 1 && day <= days[month - 1] && Number(h) <= 23 && Number(minute) <= 59 && Number(second) <= 59 && (zone === "Z" || Number(offsetHour) <= 23 && Number(offsetMinute ?? 0) <= 59);
+}
+function privateHistory(value, organizationId, skillId, limit, cursor2) {
+  if (!record11(value) || value.organizationId !== organizationId || value.skillId !== skillId || typeof value.slug !== "string" || !/^[a-z0-9-]+$/.test(value.slug) || !(value.currentVersion === null || historyText(value.currentVersion)) || !(value.currentVersionId === null || publicationUuid(value.currentVersionId)) || value.currentVersion === null !== (value.currentVersionId === null) || !(value.nextCursor === null || publicationUuid(value.nextCursor)) || !Array.isArray(value.versions) || value.versions.length > limit)
+    return historyResponse();
+  const seen = new Set;
+  let previous = cursor2;
+  const versions2 = value.versions.map((row) => {
+    if (!record11(row) || !publicationUuid(row.id) || seen.has(row.id) || previous !== undefined && row.id >= previous || !historyText(row.version) || !(row.releasedAt === null || historyDate(row.releasedAt)) || !historyDate(row.createdAt) || row.id === value.currentVersionId !== (row.version === value.currentVersion))
+      return historyResponse();
+    seen.add(row.id);
+    previous = row.id;
+    return Object.freeze({ id: row.id, version: row.version, releasedAt: row.releasedAt, createdAt: row.createdAt });
+  });
+  if (value.nextCursor !== null && (!versions2.length || value.nextCursor !== versions2.at(-1).id))
+    return historyResponse();
+  return Object.freeze({
+    organizationId,
+    skillId,
+    slug: value.slug,
+    currentVersion: value.currentVersion,
+    currentVersionId: value.currentVersionId,
+    versions: Object.freeze(versions2),
+    nextCursor: value.nextCursor
+  });
+}
+
+class RemotePrivateSkillHistoryClient {
+  apiOrigin;
+  organizationId;
+  userId;
+  membershipId;
+  #token;
+  constructor(apiUrl, session) {
+    const checked = parseWorkspaceSession(session, { userId: session?.user?.id, membershipId: session?.user?.membershipId });
+    this.apiOrigin = normalizeSkillsApiOrigin(apiUrl);
+    this.#token = checked.token;
+    this.organizationId = checked.organization.id;
+    this.userId = checked.user.id;
+    this.membershipId = checked.user.membershipId;
+    Object.freeze(this);
+  }
+  async listVersions(skillId, options = {}) {
+    if (!publicationUuid(skillId) || options.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 50) || options.cursor !== undefined && !publicationUuid(options.cursor) || options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
+      return historyInput();
+    const limit = options.limit ?? 20, cursor2 = options.cursor;
+    const query = new URLSearchParams;
+    if (options.limit !== undefined)
+      query.set("limit", String(limit));
+    if (cursor2 !== undefined)
+      query.set("cursor", cursor2);
+    const path = `/api/v1/skills/${skillId}/versions${query.size ? `?${query}` : ""}`;
+    let value;
+    try {
+      value = await boundedJson(skillsApiRequestUrl(this.apiOrigin, path), { method: "GET" }, this.#token, false, options.timeoutMs, options.signal, false, this);
+    } catch (error61) {
+      if (error61 instanceof PrivatePublicationError && error61.code === "INVALID_PUBLICATION_RESPONSE")
+        return historyResponse();
+      throw new PrivatePublicationError("PRIVATE_HISTORY_UNAVAILABLE", "Unable to read private version history. Check the selected server, current membership and fresh sign-in; no skill or credential was changed.", false, error61 instanceof PrivatePublicationError ? error61.status : undefined);
+    }
+    return privateHistory(value, this.organizationId, skillId, limit, cursor2);
+  }
+}
 
 class RemotePrivatePublicationsClient {
   apiOrigin;
@@ -49868,6 +49972,10 @@ class RemoteSkillsAuthClient {
     const origin = this.apiOrigin, captured = workspaceContext(context);
     return new RemotePrivatePublicationsClient(origin, await this.switchWorkspace(email4, code, captured));
   }
+  async openPrivateSkillHistory(email4, code, context) {
+    const origin = this.apiOrigin, captured = workspaceContext(context);
+    return new RemotePrivateSkillHistoryClient(origin, await this.switchWorkspace(email4, code, captured));
+  }
   requestInvitationEmailChallenge(input2) {
     return requestInvitationEmail(this.apiOrigin, "challenge", input2);
   }
@@ -53463,6 +53571,7 @@ export {
   RemoteRouteUnsupportedError,
   RemoteRequestError,
   RemoteQuoteUnavailableError,
+  RemotePrivateSkillHistoryClient,
   RemotePrivatePublicationsClient,
   RemoteInvitationEmailUnconfirmedError,
   RemoteInvitationEmailError,

package/dist/lib/agent-discovery-directories.d.ts

@@ -15,7 +15,8 @@ export declare function captureDiscoveryDirectoryProjection(paths: string[], omi
  * membership change is a NativeDiscoveryWitnessChange: thrown, unless the live
  * Codex prompt hook's tolerance accepts it. Invalid inventories always throw. */
 export declare function verifyDiscoveryDirectoryProjection(directories: DiscoveryDirectoryProjection[], omittedRoots: readonly string[], tolerance?: NativeDiscoveryWitnessTolerance): void;
-/** Read-only capture; callers must review both membership and source bytes. */
+/** Read-only membership capture, excluding validated Claude cleanup markers.
+ * Callers must still review source bytes; projected inventories remain exact. */
 export declare function captureDiscoveryDirectories(paths: string[], excludedRoots?: readonly string[]): DiscoveryDirectory[];
 /** A membership change is a NativeDiscoveryWitnessChange: thrown, unless the
  * live Codex prompt hook's tolerance accepts it. Invalid collections always throw. */

package/dist/lib/private-publication-customer.d.ts

@@ -1,10 +1,13 @@
 import { RemotePrivatePublicationsClient } from "./remote-private-publications.js";
 import type { RemoteWorkspaceContext } from "./remote-workspace-selection.js";
-/** Capture before code input, so a later profile/origin change cannot retarget consent. */
 export declare function preparePrivatePublicationSession(requested?: RemoteWorkspaceContext): {
     origin: string;
     verify(email: string, code: string): Promise<RemotePrivatePublicationsClient>;
 };
+export declare function preparePrivateSkillHistorySession(requested?: RemoteWorkspaceContext): {
+    origin: string;
+    verify(email: string, code: string): Promise<import("./remote-private-publications.js").RemotePrivateSkillHistoryClient>;
+};
 /** Neither the session nor a signed upload capability is saved to host credentials. */
 export declare function privatePublicationSession(email: string, code: string, requested?: RemoteWorkspaceContext): Promise<RemotePrivatePublicationsClient>;
 export declare function privatePublicationCustomerError(error: unknown): {

package/dist/lib/remote-auth.d.ts

@@ -1,5 +1,5 @@
 import { type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge } from "./remote-invitation-recovery.js";
-import { RemotePrivatePublicationsClient } from "./remote-private-publications.js";
+import { RemotePrivatePublicationsClient, RemotePrivateSkillHistoryClient } from "./remote-private-publications.js";
 import { type ListRemoteWorkspaceInvitations, type IssueRemoteWorkspaceInvitation, type ResendRemoteWorkspaceInvitation, type RevokeRemoteWorkspaceInvitation, type AcceptRemoteWorkspaceInvitation } from "./remote-invitations.js";
 import { type LeaveRemoteWorkspace } from "./remote-workspace-leave.js";
 import { type RemoteWorkspaceContext, type RemoteWorkspaceSession, type RemoteAccountWorkspaceDiscovery } from "./remote-workspace-selection.js";
@@ -26,6 +26,8 @@ export declare class RemoteSkillsAuthClient {
     constructor(apiUrl: string);
     /** One fresh workspace-bound session for an entire publication. No credentials are saved. */
     openPrivatePublications(email: string, code: string, context: RemoteWorkspaceContext): Promise<RemotePrivatePublicationsClient>;
+    /** Fresh workspace-bound, read-only private history session; no key is created or saved. */
+    openPrivateSkillHistory(email: string, code: string, context: RemoteWorkspaceContext): Promise<RemotePrivateSkillHistoryClient>;
     requestInvitationEmailChallenge(input: RequestInvitationEmailChallenge): Promise<import("./remote-invitation-recovery.js").RemoteInvitationEmailChallenge>;
     acceptInvitationEmailChallenge(input: AcceptInvitationEmailChallenge): Promise<import("./remote-invitation-recovery.js").RemoteInvitationEmailAcceptance>;
     requestCode(email: string): Promise<any>;

package/dist/lib/remote-private-publications.d.ts

@@ -64,6 +64,41 @@ export declare const publicationSha256: (bytes: Uint8Array | string) => string;
 export declare function checkedPrivateSkillCreate(value: unknown): Omit<Required<CreatePrivateSkillInput>, "confirm">;
 export declare function checkedPublicationDeclaration(value: unknown): PrivatePublicationDeclaration;
 export declare function checkedPublicationView(value: unknown, skillId: string, intentId?: string, declaration?: PrivatePublicationDeclaration): PrivatePublicationView;
+/** Metadata-only private history uses the existing interactive UUID route,
+ * distinct from the public slug/API-key version contract. */
+export interface PrivateSkillVersion {
+    id: string;
+    version: string;
+    releasedAt: string | null;
+    createdAt: string;
+}
+export interface PrivateSkillVersionHistory {
+    organizationId: string;
+    skillId: string;
+    slug: string;
+    currentVersion: string | null;
+    currentVersionId: string | null;
+    versions: readonly PrivateSkillVersion[];
+    nextCursor: string | null;
+}
+export interface PrivateSkillVersionHistoryOptions {
+    limit?: number;
+    cursor?: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+/** Read-only session consumer; permits viewer history without granting any publication action.
+ * Tokens stay in a private field and are never persisted or serialized. */
+export declare class RemotePrivateSkillHistoryClient {
+    #private;
+    readonly apiOrigin: string;
+    readonly organizationId: string;
+    readonly userId: string;
+    readonly membershipId: string;
+    constructor(apiUrl: string, session: RemoteWorkspaceSession);
+    /** One page and one GET. Follow nextCursor explicitly; an error never prints partial history. */
+    listVersions(skillId: string, options?: PrivateSkillVersionHistoryOptions): Promise<PrivateSkillVersionHistory>;
+}
 /** Explicit hosted contract, unrelated to registry publishSkill and its content revisions.
  * Session tokens stay in private fields and are never written to credentials. */
 export declare class RemotePrivatePublicationsClient {

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute7 } from "path";
 // package.json
-var version = "0.10.81";
+var version = "0.10.82";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -2554,7 +2554,7 @@ function hashClaudePluginCacheOrphanMarker(path, budget, changes) {
   if (!before)
     return null;
   const uid = process.getuid?.();
-  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32)
+  if (!before.isFile() || uid === undefined || before.uid !== uid || before.size > 32 || (before.mode & 73) !== 0)
     throw new Error("Invalid Claude orphan marker file or owner");
   const fd = openSync4(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   try {

package/dist/sdk/index.d.ts

@@ -61,7 +61,7 @@ export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLea
 export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "../lib/remote-invitations.js";
 export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "../lib/remote-invitations.js";
 export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "../lib/remote-invitation-recovery.js";
-export { RemotePrivatePublicationsClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
+export { RemotePrivatePublicationsClient, RemotePrivateSkillHistoryClient, PrivatePublicationError, PRIVATE_PUBLICATION_MAX_BYTES, type PrivateSkillVersion, type PrivateSkillVersionHistory, type PrivateSkillVersionHistoryOptions, type CreatePrivateSkillInput, type CreatedPrivateSkill, type PrivatePublicationDeclaration, type PrivatePublicationView, type PrivatePublicationState, type PrivatePublishingCapability } from "../lib/remote-private-publications.js";
 export { preparePrivatePublication, readPrivatePublicationRecovery, continuePrivatePublication, inspectPrivatePublication, type PrivatePublicationRecovery, type PrivatePublicationResult } from "../lib/private-publication-recovery.js";
 export { createSkillOperationClient, SkillOperationClientError, SKILL_OPERATION_LIMITS, type SkillOperationClient, type SkillOperationTransport, type SkillOperationRequest, type SkillOperationResult, type SkillOperationJson, type SkillOperationRefusal, type SkillOperationClientErrorCode } from "./operations.js";
 export type { RemoteCreditCheckoutOptions, RemoteCreditCheckout, RemoteCreditCheckoutErrorCode } from "../lib/remote-credit-checkout.js";