@hasna/skills 0.8.10 → 0.8.11

package/docs/plugin-admission.md

@@ -173,6 +173,29 @@ new loaders still require their dedicated review. API failure refuses an update;
 stale projection as synchronized. Claude may retain its previous installation
 after a refused update, whose existing local drift checks continue to apply.
 
+## Marketplace registry timestamps
+
+For an explicitly reviewed `known_marketplaces.json`,
+`captureClaudeMarketplaceRegistry(path)` emits a separate
+`claude-marketplace-registry` witness. It preserves every marketplace name,
+source, install location and unknown value. Only a valid UTC `lastUpdated`
+timestamp can vary, and only for exact rows containing `source`,
+`installLocation` and `lastUpdated`, with a recognized GitHub repository or local
+directory source. Rows with any extra field, including `autoUpdate`, retain
+their entire contents in the digest. Registration changes still refuse.
+
+This mode is opt-in for reviewed Claude discovery. It cannot project fields,
+carry managed-plugin rules, accept an absent registry or synthesize registry
+changes during hook installation. It does not replace the separate settings,
+installed-plugin, marketplace catalog, loader, root or payload witnesses.
+Capture requires a bounded regular file with strict UTF-8 and unambiguous JSON;
+links, duplicate keys and concurrent file replacement refuse.
+
+Existing byte witnesses retain their exact behavior. A prior hash mismatch is
+not proof of a timestamp-only change: review the complete current registration
+and its complementary sources before explicitly replacing an old witness.
+Capturing this witness does not write a policy or approve native registration.
+
 ## Verification and limits
 
 Unit tests cover provenance and mapping failures, offline/revoked authorities,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.8.10",
+  "version": "0.8.11",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
@@ -62,10 +62,11 @@
     "typecheck": "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
     "verify:consumer-types": "bun run scripts/consumer-types.ts",
-    "prepare": "bun run build:js",
-    "prepack": "bun run build && bun run verify:release && bun run verify:consumer-types",
+    "prepack": "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
     "prepublishOnly": "bun run verify:producer && bun run typecheck && bun run test",
-    "verify:producer": "bun run scripts/release-dependencies.ts"
+    "verify:producer": "bun run scripts/release-dependencies.ts",
+    "verify:generated": "HASNA_SKILLS_RELEASE_ARTIFACT_TEST=1 bun test src/lib/release-artifacts.test.ts",
+    "verify:consumer-credentials": "bun run scripts/consumer-credentials.ts"
   },
   "keywords": [
     "skills",
@@ -87,7 +88,6 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@hasna/contracts": "1.1.0",
-    "@hasna/secrets": "0.4.2",
     "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
@@ -100,6 +100,7 @@
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
     "@hasna/events": "0.1.18",
+    "@hasna/secrets": "0.4.2",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",