@hasna/skills 0.7.3 → 0.8.1

package/dist/sdk/registry.d.ts

@@ -1,8 +1,8 @@
 /**
  * Registry + version service seam.
  *
- * The registry half wraps the shipped server registry (src/server/registry.ts): the
- * merged catalog, slug resolution, and SKILL.md docs. The version service is the seam
+ * Unscoped registry helpers are retained as empty compatibility exports. Private
+ * catalogs require an authenticated RemoteSkillsClient. The version service is the seam
  * for skills_registry versioning — the `version` column a published record carries, and
  * the contract sibling work (hasna.skill.v1, skill-hash) builds on.
  */
@@ -16,7 +16,7 @@ export interface RegistryService {
     getSkillMd(slug: string): string | null;
     isValidSlug(slug: string): boolean;
 }
-/** Current implementation: the bundled registry served by the shipped server. */
+/** @deprecated Always empty. Use RemoteSkillsClient with the account's credentials. */
 export declare const bundledRegistry: RegistryService;
 /** Resolves the effective version of a published skill record. */
 export interface RegistryVersionService {

package/dist/server/config.d.ts

@@ -3,12 +3,11 @@ export interface SkillsServerConfig {
     port: number;
     databaseUrl?: string;
     bootstrapApiKey?: string;
-    /** Publish the bundled corpus as versioned skills on boot (default on; set HASNA_SKILLS_SEED_BUNDLED_CORPUS=0 to skip). */
-    seedBundledCorpus: boolean;
     artifactBucket?: string;
     artifactPrefix: string;
     /** Optional expiring run-output namespace; immutable bundles retain artifactPrefix. */
     runArtifactPrefix?: string;
+    /** @deprecated Unversioned execution is retired; this flag cannot enable it. */
     inlineWorker: boolean;
     /**
      * HMAC key for signing served skill bundles. When set, the bundle endpoint adds

package/dist/server/handlers.d.ts

@@ -1,3 +1,6 @@
-import { ArtifactStorage } from "./artifact-storage.js";
+import type { ArtifactStorage } from "./artifact-storage.js";
 import type { ServerRunRecord, SkillsProductStore } from "./types.js";
-export declare function executeRun(store: SkillsProductStore, run: ServerRunRecord, storage?: ArtifactStorage): Promise<ServerRunRecord>;
+export declare const LEGACY_EXECUTION_RETIRED = "LEGACY_EXECUTION_RETIRED";
+export declare const LEGACY_EXECUTION_GUIDANCE = "Unversioned runs have been retired. Publish and select a versioned executable, then use skills run <name>@<version> --target cloud.";
+/** Drain old unversioned records without executing embedded skill implementations. */
+export declare function executeRun(store: SkillsProductStore, run: ServerRunRecord, _storage?: ArtifactStorage): Promise<ServerRunRecord>;

package/dist/server/registry.d.ts

@@ -1,5 +1,8 @@
-import { type SkillMeta } from "../lib/registry.js";
+import type { SkillMeta } from "../lib/registry-types.js";
 export declare function isValidSkillSlug(slug: string): boolean;
+/** @deprecated No shared catalog exists. Use the authenticated RemoteSkillsClient. */
 export declare function listServerSkills(): SkillMeta[];
-export declare function getServerSkill(slug: string): SkillMeta | null;
-export declare function getServerSkillMd(slug: string): string | null;
+/** @deprecated Unscoped lookup cannot select an organization's private skill. */
+export declare function getServerSkill(_slug: string): SkillMeta | null;
+/** @deprecated Unscoped lookup never reads the server's filesystem. */
+export declare function getServerSkillMd(_slug: string): string | null;

package/dist/server/skills-api.d.ts

@@ -59,19 +59,12 @@ export declare function parseIfMatch(value: string | null): string | undefined;
  * so an object whose digest another row still references survives.
  */
 export declare function tombstoneStatus(store: SkillsProductStore, artifactStorage: ArtifactStorage, principal: ApiPrincipal, record: ServerSkillRecord): Promise<"live" | "purged" | Record<string, unknown>>;
-/**
- * Bundled corpus plus this org's published skills, published winning on a slug collision.
- *
- * Same rule as the CLI-side merge in src/lib/registry-merge.ts and for the same reason: an
- * organization that published `deploy-notes` on their own instance meant to override the
- * bundled `deploy-notes` there.
- */
+/** List only records belonging to the authenticated organization. */
 export declare function listMergedSkills(store: SkillsProductStore, principal: ApiPrincipal): Promise<Record<string, unknown>[]>;
 /**
  * What a read of one slug resolves to: the org's published row (live or tombstoned) or
- * nothing. The bundled-corpus fallback is the callers' decision, not this resolver's —
- * a tombstoned slug must answer 410 even when a bundled skill of the same name exists,
- * because the caller asked for the skill this instance serves under that slug.
+ * nothing. Tombstones retain their 410 response until expiry; no machine-local
+ * content can substitute for an absent or deleted organization record.
  */
 export type SkillReadResolution = {
     kind: "published";
@@ -83,41 +76,16 @@ export type SkillReadResolution = {
     kind: "absent";
 };
 export declare function resolvePublishedSkill(store: SkillsProductStore, artifactStorage: ArtifactStorage, principal: ApiPrincipal, slug: string): Promise<SkillReadResolution>;
-/**
- * Distinct tags across the org's registry view: the org's published tags (the
- * indexed store query over the skills_tags projection, in both backends) plus
- * the bundled corpus's, which is a fixed in-process set. The route serves the
- * same universe GET /api/v1/skills serves, so a client can take any tag this
- * list returns and filter with it. Sorted, de-duplicated, and emptied of blank
- * entries to match the client contract (non-empty tag names).
- */
+/** Distinct, non-empty tags in the authenticated organization's published catalog. */
 export declare function listOrgTags(store: SkillsProductStore, principal: ApiPrincipal): Promise<string[]>;
-/**
- * The merged registry view (bundled + published) filtered to skills carrying an
- * exact tag. Same merge rules and payloads as listMergedSkills - the tag filter
- * narrows what GET /api/v1/skills would have returned, it does not switch to a
- * different universe. The published half comes from the indexed store query;
- * only the static bundled corpus is filtered in-process, and a bundled skill
- * whose slug a published row occupies is excluded so published-wins precedence
- * holds for tag reads exactly as it does for the unfiltered view.
- */
+/** The same organization catalog filtered through the store's indexed tag query. */
 export declare function listMergedSkillsByTag(store: SkillsProductStore, principal: ApiPrincipal, tag: string): Promise<Record<string, unknown>[]>;
 /**
  * The minimal per-skill wire row the tag/sync summary routes serve: the client's
  * RemoteSkillSummary contract ({ slug, name?, version?, updatedAt? }).
  */
 export declare function skillSummary(skill: Record<string, unknown>): Record<string, unknown>;
-/**
- * The principal's pins filtered to slugs whose skill (bundled or published, in
- * this org's merged view) carries the exact tag. A pin carries no tag of its
- * own - the filter resolves each pinned slug against the registry view, the
- * same way the rest of the surface treats a pin as a fact about a skill.
- *
- * Published pins come from the indexed store query (skills_tags projection);
- * the bundled-corpus half is resolved in-process against the static corpus and
- * excludes slugs a published row occupies, so every pinned slug resolves
- * through exactly one path (published wins) and no pin can appear twice.
- */
+/** Only published skills in this organization can contribute tags to its pins. */
 export declare function listPinsByTag(store: SkillsProductStore, principal: ApiPrincipal, tag: string): Promise<Record<string, unknown>[]>;
 export declare function getMergedSkill(store: SkillsProductStore, artifactStorage: ArtifactStorage, principal: ApiPrincipal, slug: string): Promise<Record<string, unknown> | null>;
 /**

package/dist/storage.js

@@ -52,14 +52,14 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
-  readdirSync as readdirSync2,
-  statSync as statSync2,
+  readdirSync,
+  statSync,
   writeFileSync as writeFileSync3
 } from "fs";
 import { dirname as dirname2, join as join4, normalize, relative, sep } from "path";
 
 // src/lib/config.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { join as join2, dirname } from "path";
 
 // src/lib/retired-settings.ts
@@ -171,12 +171,6 @@ function exactDataRoot() {
   }
   return;
 }
-function hasExactOverride(env = process.env) {
-  return Boolean(env[DATA_DIR_ENV]?.trim()) || Boolean(env[HASNA_SKILLS_HOME_ENV]?.trim()) || Boolean(env[SKILLS_HOME_ENV]?.trim());
-}
-function hasOperatorOverride(env = process.env) {
-  return hasExactOverride(env) || Boolean(env.HASNA_DATA_HOME?.trim());
-}
 function getDataRoot() {
   const exact = exactDataRoot();
   if (exact)
@@ -210,24 +204,6 @@ function validKeys() {
 function allowedValues(key) {
   return ENUM_KEYS[key];
 }
-function mergeDirectoryContents(sourceDir, targetDir) {
-  if (!existsSync2(sourceDir))
-    return;
-  mkdirSync(targetDir, { recursive: true });
-  for (const entry of readdirSync(sourceDir)) {
-    const sourcePath = join2(sourceDir, entry);
-    const targetPath = join2(targetDir, entry);
-    try {
-      const sourceStat = statSync(sourcePath);
-      if (sourceStat.isDirectory()) {
-        mergeDirectoryContents(sourcePath, targetPath);
-        continue;
-      }
-      if (!existsSync2(targetPath))
-        copyFileSync(sourcePath, targetPath);
-    } catch {}
-  }
-}
 function normalizeConfigValue(key, value) {
   if (typeof value !== "string")
     return;
@@ -249,19 +225,6 @@ function getDataDir() {
   try {
     mkdirSync(root, { recursive: true });
   } catch {}
-  if (hasOperatorOverride())
-    return root;
-  const home = effectiveHome();
-  const oldDir = join2(home, ".skills");
-  const oldConfigFile = join2(home, ".skillsrc");
-  try {
-    mergeDirectoryContents(oldDir, root);
-  } catch {}
-  if (existsSync2(oldConfigFile) && !existsSync2(join2(root, "config.json"))) {
-    try {
-      copyFileSync(oldConfigFile, join2(root, "config.json"));
-    } catch {}
-  }
   return root;
 }
 function getDataDirReadOnly() {
@@ -994,9 +957,9 @@ function parsePositiveInteger(value) {
 }
 function walkFiles(dir) {
   const files = [];
-  for (const entry of readdirSync2(dir)) {
+  for (const entry of readdirSync(dir)) {
     const full = join4(dir, entry);
-    const stats = statSync2(full);
+    const stats = statSync(full);
     if (stats.isDirectory())
       files.push(...walkFiles(full));
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.7.3",
+  "version": "0.8.1",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
@@ -85,7 +85,8 @@
   "author": "Hasna",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@hasna/contracts": "1.0.2",
+    "@hasna/contracts": "1.1.0",
+    "@hasna/secrets": "0.4.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",

package/dist/lib/registry-data/business-marketing.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const BUSINESS_MARKETING_SKILLS: SkillMeta[];

package/dist/lib/registry-data/communication.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const COMMUNICATION_SKILLS: SkillMeta[];

package/dist/lib/registry-data/content-generation.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const CONTENT_GENERATION_SKILLS: SkillMeta[];

package/dist/lib/registry-data/data-analysis.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const DATA_ANALYSIS_SKILLS: SkillMeta[];

package/dist/lib/registry-data/design-branding.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const DESIGN_BRANDING_SKILLS: SkillMeta[];

package/dist/lib/registry-data/development-tools.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const DEVELOPMENT_TOOLS_SKILLS: SkillMeta[];

package/dist/lib/registry-data/education-learning.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const EDUCATION_LEARNING_SKILLS: SkillMeta[];

package/dist/lib/registry-data/event-management.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const EVENT_MANAGEMENT_SKILLS: SkillMeta[];

package/dist/lib/registry-data/finance-compliance.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const FINANCE_COMPLIANCE_SKILLS: SkillMeta[];

package/dist/lib/registry-data/health-wellness.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const HEALTH_WELLNESS_SKILLS: SkillMeta[];

package/dist/lib/registry-data/media-processing.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const MEDIA_PROCESSING_SKILLS: SkillMeta[];

package/dist/lib/registry-data/productivity-organization.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const PRODUCTIVITY_ORGANIZATION_SKILLS: SkillMeta[];

package/dist/lib/registry-data/project-management.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const PROJECT_MANAGEMENT_SKILLS: SkillMeta[];

package/dist/lib/registry-data/research-writing.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const RESEARCH_WRITING_SKILLS: SkillMeta[];

package/dist/lib/registry-data/science-academic.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const SCIENCE_ACADEMIC_SKILLS: SkillMeta[];

package/dist/lib/registry-data/travel-lifestyle.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const TRAVEL_LIFESTYLE_SKILLS: SkillMeta[];

package/dist/lib/registry-data/web-browser.d.ts

@@ -1,2 +0,0 @@
-import type { SkillMeta } from "../registry-types.js";
-export declare const WEB_BROWSER_SKILLS: SkillMeta[];

package/dist/server/seed-bundled.d.ts

@@ -1,20 +0,0 @@
-import type { ArtifactStorage } from "./artifact-storage.js";
-import type { ApiPrincipal, SkillsProductStore } from "./types.js";
-export interface SeedBundledCorpusOptions {
-    store: SkillsProductStore;
-    artifactStorage: ArtifactStorage;
-    principal: ApiPrincipal;
-    /** Version recorded for every seeded skill. Defaults to the package version. */
-    version?: string;
-    log?: (line: string) => void;
-}
-export interface SeedBundledCorpusResult {
-    version: string;
-    seeded: string[];
-    skipped: string[];
-    failed: Array<{
-        slug: string;
-        error: string;
-    }>;
-}
-export declare function seedBundledCorpus(options: SeedBundledCorpusOptions): Promise<SeedBundledCorpusResult>;