@hasna/skills 0.9.17 → 0.9.18

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.17",
+    version: "0.9.18",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -48622,7 +48622,8 @@ async function resolveSkillsConnection(env3 = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env3);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env3);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -79049,7 +79050,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.17",
+    version: "0.9.18",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -21311,7 +21311,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error61) {
     const translated = asSkillsFleetCredentialError(error61, pointer.pointerVaultKey);
     if (translated)
@@ -52027,7 +52028,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.18",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.18",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.18",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.18",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10891,7 +10891,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -39095,7 +39096,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.17",
+  version: "0.9.18",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -33712,7 +33712,8 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
   }
   let completed;
   try {
-    completed = await completePointerCredential(SKILLS_APP, pointer, env);
+    const explicitVault = Boolean(snapshotEnv.HASNA_SECRETS_API_URL?.trim() && snapshotEnv.HASNA_SECRETS_API_KEY_OVERRIDE?.trim());
+    completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
     if (translated)
@@ -89665,7 +89666,20 @@ class RemoteSkillsClient {
       const url2 = new URL(upload.uploadUrl);
       if (url2.username || url2.password || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)))
         throw new Error("Unsafe input upload URL");
-      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers: { "Content-Type": file2.contentType ?? "application/octet-stream" }, redirect: "error", signal: AbortSignal.timeout(60000) });
+      const headers = new Headers({ "Content-Type": file2.contentType ?? "application/octet-stream" });
+      if (upload.uploadHeaders !== undefined) {
+        if (upload.uploadHeaders === null || typeof upload.uploadHeaders !== "object" || Array.isArray(upload.uploadHeaders))
+          throw new Error("Invalid input upload headers");
+        const seen = new Set;
+        for (const [name, value] of Object.entries(upload.uploadHeaders)) {
+          const lowerName = name.toLowerCase();
+          if (seen.has(lowerName) || !["if-none-match", "x-amz-tagging"].includes(lowerName) || typeof value !== "string" || value.length === 0 || value.length > 2048 || !/^[\x20-\x7e]+$/.test(value) || value.trim() !== value || lowerName === "if-none-match" && value !== "*")
+            throw new Error("Invalid input upload headers");
+          seen.add(lowerName);
+          headers.set(name, value);
+        }
+      }
+      const uploaded = await fetch(url2, { method: "PUT", body: file2.bytes, headers, redirect: "error", signal: AbortSignal.timeout(60000) });
       if (!uploaded.ok)
         throw new Error("Input upload failed");
       await uploaded.body?.cancel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.17",
+  "version": "0.9.18",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {