@huynle/hub 0.7.3 → 0.8.0

package/src/central/profiles/import.ts

@@ -0,0 +1,139 @@
+// Importing a skills/commands bundle into profile content (HWA-14). A bundle is a bounded list of text files
+// {path, text}, in the layout harnesses already use:
+//
+//   AGENTS.md or CLAUDE.md          → instructions (at most one)
+//   skills/<name>/SKILL.md          → a skill (front matter `description`; `name` must match the folder)
+//   commands/<name>.md              → a command (front matter `description`; `$ARGUMENTS` → `{{arguments}}`)
+//
+// Anything else (scripts, hook folders, package/requirements manifests, harness settings) is `unsupported`:
+// profiles never carry code to run or dependencies to install. Front matter that would grant tools
+// (`allowed-tools`) or pick a model is dropped with a note: a profile confers no authority. Text only; nothing is
+// fetched, executed or written to disk. The result goes through the same content rules as any version.
+import { isSlug, PROFILE_LIMITS, type ProfileCommand, type ProfileSkill, type ProfileVersionContent } from "../../protocol"
+import { checkContent, ProfileContentError } from "./content"
+
+export const IMPORT_LIMITS = {
+  /** One instructions file, every skill and every command. */
+  files: 1 + PROFILE_LIMITS.skillsPerProfile + PROFILE_LIMITS.commandsPerProfile,
+  pathChars: 200,
+  /** Total bytes of the files' text. */
+  bytes: PROFILE_LIMITS.versionBytes,
+  notes: 64,
+} as const
+
+export interface BundleFile {
+  readonly path: string
+  readonly text: string
+}
+
+export interface ImportResult {
+  readonly content: ProfileVersionContent
+  /** What was dropped or defaulted, per file; bounded, never file text. */
+  readonly notes: string[]
+}
+
+const INSTRUCTION_FILES = new Set(["AGENTS.md", "CLAUDE.md"])
+const SKILL_PATH = /^skills\/([^/]+)\/SKILL\.md$/
+const COMMAND_PATH = /^commands\/([^/]+)\.md$/
+const SAFE_PATH = /^[A-Za-z0-9._/-]+$/
+
+const invalid = (message: string) => new ProfileContentError("invalid", message)
+const shown = (path: string) => (SAFE_PATH.test(path) && path.length <= IMPORT_LIMITS.pathChars ? path : "(unprintable path)")
+
+function checkPath(path: string): void {
+  if (!path || path.length > IMPORT_LIMITS.pathChars) throw invalid(`file paths must be 1–${IMPORT_LIMITS.pathChars} characters`)
+  if (path.includes("\\") || path.startsWith("/") || path.split("/").some((s) => s === "" || s === "." || s === "..")) {
+    throw invalid(`${shown(path)}: paths must be relative, with / separators and no . or .. segments`)
+  }
+}
+
+interface FrontMatter {
+  readonly fields: Record<string, string>
+  readonly body: string
+}
+
+/** `---\nkey: value\n---\nbody`; text without front matter is all body. */
+function frontMatter(text: string): FrontMatter {
+  if (!text.startsWith("---\n")) return { fields: {}, body: text }
+  const end = text.indexOf("\n---", 3)
+  if (end < 0) return { fields: {}, body: text }
+  const after = text.indexOf("\n", end + 4)
+  const body = after < 0 ? "" : text.slice(after + 1)
+  const fields: Record<string, string> = {}
+  for (const line of text.slice(4, end).split("\n")) {
+    const match = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line)
+    if (!match) continue
+    fields[match[1]!.toLowerCase()] = match[2]!.trim().replace(/^(["'])(.*)\1$/, "$2")
+  }
+  return { fields, body }
+}
+
+function ignored(path: string, fields: Record<string, string>, keep: readonly string[], notes: string[]): void {
+  for (const key of Object.keys(fields)) {
+    if (keep.includes(key)) continue
+    if (key === "allowed-tools") notes.push(`${path}: allowed-tools ignored (profiles grant no tool permissions)`)
+    else notes.push(`${path}: ${key} ignored`)
+  }
+}
+
+function describe(path: string, fields: Record<string, string>, fallback: string, notes: string[]): string {
+  const description = fields.description?.trim()
+  if (description) return description
+  notes.push(`${path}: no description; using a default`)
+  return fallback
+}
+
+/** Converts a bundle to normalized version content; throws ProfileContentError (invalid / unsupported). */
+export function importBundle(files: unknown): ImportResult {
+  if (!Array.isArray(files)) throw invalid("files must be a list of {path, text}")
+  if (files.length > IMPORT_LIMITS.files) throw invalid(`at most ${IMPORT_LIMITS.files} files`)
+  let bytes = 0
+  const seen = new Set<string>()
+  for (const file of files) {
+    if (typeof file !== "object" || file === null || Array.isArray(file)) throw invalid("each file must be {path, text}")
+    const { path, text, ...rest } = file as Record<string, unknown>
+    if (typeof path !== "string" || typeof text !== "string" || Object.keys(rest).length) throw invalid("each file must be {path, text} with text content")
+    checkPath(path)
+    if (seen.has(path)) throw invalid(`${shown(path)} appears twice`)
+    seen.add(path)
+    bytes += new TextEncoder().encode(text).length
+  }
+  if (bytes > IMPORT_LIMITS.bytes) throw invalid(`bundle is too large (more than ${IMPORT_LIMITS.bytes} bytes)`)
+
+  let instructions: string | undefined
+  const skills: ProfileSkill[] = []
+  const commands: ProfileCommand[] = []
+  const notes: string[] = []
+  for (const file of files as BundleFile[]) {
+    const { path } = file
+    const text = file.text.replace(/\r\n?/g, "\n")
+    if (INSTRUCTION_FILES.has(path)) {
+      if (instructions !== undefined) throw invalid("only one of AGENTS.md and CLAUDE.md")
+      instructions = text
+      continue
+    }
+    const skill = SKILL_PATH.exec(path)
+    const command = COMMAND_PATH.exec(path)
+    if (skill || command) {
+      const name = (skill ?? command)![1]!
+      if (!isSlug(name)) throw invalid(`${shown(path)}: names must be 2–40 lowercase letters, digits or dashes`)
+      const { fields, body } = frontMatter(text)
+      if (skill) {
+        if (fields.name !== undefined && fields.name !== name) notes.push(`${path}: name ${isSlug(fields.name) ? fields.name : "(invalid)"} differs from its folder; using ${name}`)
+        ignored(path, fields, ["name", "description"], notes)
+        skills.push({ name, description: describe(path, fields, `Skill ${name}`, notes), body })
+      } else {
+        ignored(path, fields, ["description"], notes)
+        if (/\$[1-9]/.test(body)) notes.push(`${path}: positional $1…$9 are kept as text; use {{name}} parameters`)
+        commands.push({ name, description: describe(path, fields, `Command ${name}`, notes), template: body.replaceAll("$ARGUMENTS", "{{arguments}}") })
+      }
+      continue
+    }
+    throw new ProfileContentError(
+      "unsupported",
+      `${shown(path)}: only AGENTS.md or CLAUDE.md, skills/<name>/SKILL.md and commands/<name>.md are imported; profiles carry no scripts, hooks, settings or dependency manifests`,
+    )
+  }
+  const content = checkContent({ ...(instructions !== undefined ? { instructions } : {}), skills, commands })
+  return { content, notes: notes.slice(0, IMPORT_LIMITS.notes) }
+}

package/src/central/profiles/routes.ts

@@ -0,0 +1,356 @@
+// The profile registry on /api/agent (HWA-14; contract: Profiles in docs/plans/2026-10-30-hub-workspaces-artifacts-
+// contracts.md):
+//
+//   POST   /profiles                                         {name, title, description?, tags?, content}   manage
+//   POST   /profiles/import                                  {name, title, description?, tags?, files}     manage
+//   GET    /profiles?state=active|archived|all&limit&cursor                                                read
+//   GET    /profiles?include=usage,summary                   + {usage: {id → counts}, hidden?, summaries: {id → latest counts}} (RP-08)
+//   GET    /profiles/:id                                     → {profile, latest} (latest: version summary) read
+//   GET    /profiles/:id/usage?limit&cursor                  where it is used (usage.ts; per-category scopes) read
+//   PATCH  /profiles/:id                                     {expectedRevision, title?, description?, tags?, state?, metadata?, projects?}  manage
+//   GET    /profiles/:id/versions?limit&cursor               the retained history, newest first            read
+//   POST   /profiles/:id/versions                            {expectedRevision, content | fromVersion | files}  manage
+//   GET    /profiles/:id/versions/:version                   the immutable version in full                 read
+//   GET    /profiles/:id/versions/:version/skills/:name      one skill body (on-demand loading)            read
+//   POST   /profiles/:id/versions/:version/commands/:name/render  {params} → {prompt, secretRefs}         read
+//   GET    /sessions/:addr/profile                           {assignment, profile, version summary} | {assignment: null}
+//   PUT    /sessions/:addr/profile                           {profileID, version, expectedRevision}        assign
+//   DELETE /sessions/:addr/profile?expectedRevision=n                                                      assign
+//   GET    /sessions/:addr/profile/skills/:name              the pinned version's skill
+//   POST   /sessions/:addr/profile/commands/:name/render     the pinned version's command, rendered
+//
+// Who: users, always (their own records; another user's are not_found). App tokens by scope: profiles:read,
+// profiles:manage, profiles:assign; session-addressed routes also need sessions:read (resolving an address
+// reveals a session). Session tokens only read their OWN pinned profile (summary, skills, command rendering);
+// they never list, create, version, archive or assign. Rendering returns text and confers nothing: sending it
+// to a session goes through the existing prompt verb and its grants. Assigning pins a version; it grants no
+// authority and does not by itself change a running session (HWA-15 applies pins through the spoke). An app's pin
+// also needs a usable prompt grant on the session (authorizePin, HWA-15); the answer's ack is `pending` until the
+// spoke acknowledges, `unsupported` or `pending` + `offline` (see apply.ts). Unpinning stops re-applying the pin;
+// what a running session already applied stays until it restarts (no clear op in v1).
+// Creates accept Idempotency-Key. Every change is in the admin audit (IDs only) and the journal (compact events).
+import { type AgentProfileVersion, PROFILE_SCOPES } from "../../protocol"
+import type { AgentContext, AgentRoute } from "../agent/routes"
+import type { AgentEvents, EventInput } from "../agent/events"
+import { AgentError } from "../agent/errors"
+import type { Store } from "../store"
+import { ProfileContentError, parseTemplate, renderTemplate, secretReferences, contentBytes } from "./content"
+import { profileArchivedEvent, profileAssignedEvent, profileCreatedEvent, profileVersionEvent } from "./events"
+import { Idempotency } from "./idempotency"
+import type { PinAuthorizer } from "./apply"
+import { importBundle } from "./import"
+import { contentError, type ProfileStore } from "./store"
+import { boundedText, PROFILE_JSON_BODY_MAX } from "../agent/body"
+import { ProfileUsage, usageView } from "./usage"
+
+const PREFIX = "/api/agent"
+const NO_STORE = { "cache-control": "no-store" }
+const [READ_SCOPE, MANAGE_SCOPE, ASSIGN_SCOPE] = PROFILE_SCOPES
+const READ = { scope: READ_SCOPE } as const
+const MANAGE = { scope: MANAGE_SCOPE } as const
+const ASSIGN = { scope: ASSIGN_SCOPE } as const
+/** Session-addressed reads: sessions (their own only) and apps with profiles:read (+ sessions:read). */
+const SESSION_READ = { session: true, scope: READ_SCOPE } as const
+
+export interface ProfileRoutesDeps {
+  readonly profiles: ProfileStore
+  readonly directory: { resolveOne(userID: string, addr: string): { readonly sessionID: string } }
+  readonly events?: Pick<AgentEvents, "append">
+  readonly audit?: Pick<Store, "audit">
+  /** Idempotent creates; one over the profiles' StateStore when absent. */
+  readonly idempotency?: Idempotency
+  /**
+   * (HWA-15) Checks an app's pin beyond its scopes (pinAuthorizer: a usable prompt grant on the session). Without
+   * it apps cannot pin at all (fail closed); users always can.
+   */
+  readonly authorizePin?: PinAuthorizer
+  /** (RP-08) Where profiles are used; without it every category reads as unused. */
+  readonly usage?: ProfileUsage
+}
+
+/** A version without its bodies: what clients list before loading a skill on demand. */
+export function versionSummary(version: AgentProfileVersion) {
+  const { content } = version
+  return {
+    profileID: version.profileID,
+    version: version.version,
+    digest: version.digest,
+    createdAt: version.createdAt,
+    bytes: contentBytes(content),
+    instructions: content.instructions !== undefined,
+    ...(content.model !== undefined ? { model: content.model } : {}),
+    skills: content.skills.map(({ name, description }) => ({ name, description })),
+    commands: content.commands.map(({ name, description, template }) => {
+      const parsed = parseTemplate(template)
+      return { name, description, params: parsed.ok ? parsed.params : [] }
+    }),
+    secretRefs: secretReferences(content),
+  }
+}
+
+const ok = (body: unknown, status = 200) => Response.json(body, { status, headers: NO_STORE })
+
+async function bodyOf(request: Request): Promise<Record<string, unknown>> {
+  const raw = JSON.parse(await boundedText(request, PROFILE_JSON_BODY_MAX)) as unknown
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new AgentError("invalid", "Body must be a JSON object")
+  return raw as Record<string, unknown>
+}
+
+function only(body: Record<string, unknown>, allowed: readonly string[]): void {
+  for (const key of Object.keys(body)) if (!allowed.includes(key)) throw new AgentError("invalid", `unknown field ${/^[A-Za-z0-9_-]{1,40}$/.test(key) ? key : "(unprintable)"}`)
+}
+
+function versionParam(raw: string | undefined): number {
+  if (!raw || !/^[1-9][0-9]{0,8}$/.test(raw)) throw new AgentError("invalid", "version must be a version number")
+  return Number(raw)
+}
+
+function intParam(url: URL, name: string): number | undefined {
+  const raw = url.searchParams.get(name)
+  return raw === null ? undefined : /^-?[0-9]{1,12}$/.test(raw) ? Number(raw) : Number.NaN
+}
+
+function importContent(files: unknown) {
+  try {
+    return importBundle(files)
+  } catch (cause) {
+    throw cause instanceof ProfileContentError ? contentError(cause) : cause
+  }
+}
+
+function render(version: AgentProfileVersion, name: string, body: Record<string, unknown>) {
+  only(body, ["params"])
+  const params = body.params ?? {}
+  if (typeof params !== "object" || params === null || Array.isArray(params)) throw new AgentError("invalid", "params must be an object of text values")
+  const command = version.content.commands.find((c) => c.name === name)
+  if (!command) throw new AgentError("not_found", `No command ${name} in version ${version.version}`)
+  let prompt: string
+  try {
+    prompt = renderTemplate(command.template, params as Record<string, unknown>)
+  } catch (cause) {
+    throw contentError(cause)
+  }
+  const parsed = parseTemplate(command.template)
+  return { prompt, secretRefs: parsed.ok ? parsed.secrets : [], profileID: version.profileID, version: version.version, command: name }
+}
+
+function skillOf(version: AgentProfileVersion, name: string) {
+  const skill = version.content.skills.find((s) => s.name === name)
+  if (!skill) throw new AgentError("not_found", `No skill ${name} in version ${version.version}`)
+  return { skill, profileID: version.profileID, version: version.version }
+}
+
+export function profileRoutes(deps: ProfileRoutesDeps): AgentRoute[] {
+  const { profiles, directory } = deps
+  const idempotency = deps.idempotency ?? new Idempotency({ state: profiles.state })
+  const usage = deps.usage ?? new ProfileUsage({ profiles })
+
+  async function changed(context: AgentContext, action: string, target: string, event?: EventInput): Promise<void> {
+    await deps.audit?.audit({ actor: context.user.id, action, target, detail: context.actor.kind })
+    if (event) await deps.events?.append(context.user.id, event).catch((cause) => console.error(`[hub] ${event.type} event failed: ${(cause as Error).message}`))
+  }
+
+  /** The session a session-addressed route names, for this caller. */
+  function sessionTarget(context: AgentContext): string {
+    const { actor, user } = context
+    if (actor.kind === "app" && !actor.scopes.includes("sessions:read")) throw new AgentError("forbidden", "Session profile routes also need scope sessions:read")
+    const sessionID = directory.resolveOne(user.id, context.params.addr!).sessionID
+    if (actor.kind === "session" && sessionID !== actor.sessionID) throw new AgentError("forbidden", "A session token can only read its own profile")
+    return sessionID
+  }
+
+  async function version(userID: string, id: string, number: number): Promise<AgentProfileVersion> {
+    const found = await profiles.version(userID, id, number)
+    if (!found) throw new AgentError("not_found", `No version ${number} of profile ${id}`)
+    return found
+  }
+
+  /** The pinned version of the addressed session. */
+  async function pinned(context: AgentContext): Promise<AgentProfileVersion> {
+    const sessionID = sessionTarget(context)
+    const assignment = await profiles.assignment(context.user.id, sessionID)
+    if (!assignment) throw new AgentError("not_found", `Session ${sessionID} has no profile`)
+    return version(context.user.id, assignment.profileID, assignment.version)
+  }
+
+  const create = (path: string, input: (body: Record<string, unknown>) => { body: Record<string, unknown>; notes?: string[] }): AgentRoute => ({
+    method: "POST",
+    path,
+    allow: MANAGE,
+    async handle(context) {
+      const raw = await bodyOf(context.request)
+      return idempotency.run(context.user.id, `POST ${context.url.pathname}`, context.request.headers.get("idempotency-key"), raw, async () => {
+        const { body, notes } = input(raw)
+        const { profile, version } = await profiles.create(context.user.id, body)
+        await changed(context, "profile.create", profile.id, profileCreatedEvent(profile.id, profile.revision))
+        return { status: 201, body: { profile, version: versionSummary(version), ...(notes ? { notes } : {}) } }
+      })
+    },
+  })
+
+  return [
+    create(`${PREFIX}/profiles`, (body) => ({ body })),
+    create(`${PREFIX}/profiles/import`, (body) => {
+      only(body, ["name", "title", "description", "tags", "metadata", "projects", "files"])
+      const { files, ...rest } = body
+      const { content, notes } = importContent(files)
+      return { body: { ...rest, content }, notes }
+    }),
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles`,
+      allow: READ,
+      async handle({ url, user, actor }) {
+        const limit = intParam(url, "limit")
+        const state = url.searchParams.get("state") ?? undefined
+        const cursor = url.searchParams.get("cursor") ?? undefined
+        const include = url.searchParams.getAll("include").flatMap((i) => i.split(","))
+        if (include.some((i) => i !== "usage" && i !== "summary")) throw new AgentError("invalid", "include must be usage and/or summary")
+        const page = await profiles.list(user.id, { ...(limit !== undefined ? { limit } : {}), ...(state ? { state } : {}), ...(cursor ? { cursor } : {}) })
+        return ok({
+          ...page,
+          ...(include.includes("summary") ? { summaries: await profiles.summaries(user.id, page.items.map((p) => p.id)) } : {}),
+          ...(include.includes("usage") ? await usage.counts(user.id, page.items, usageView(actor)) : {}),
+        })
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles/:id/usage`,
+      allow: READ,
+      async handle({ params, url, user, actor }) {
+        const limit = intParam(url, "limit")
+        const cursor = url.searchParams.get("cursor") ?? undefined
+        return ok(await usage.usage(user.id, params.id!, usageView(actor), { ...(limit !== undefined ? { limit } : {}), ...(cursor !== undefined ? { cursor } : {}) }))
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles/:id`,
+      allow: READ,
+      async handle({ params, user }) {
+        const profile = await profiles.get(user.id, params.id!)
+        if (!profile) throw new AgentError("not_found", `No profile ${params.id}`)
+        const latest = await profiles.version(user.id, profile.id, profile.latestVersion)
+        return ok({ profile, ...(latest ? { latest: versionSummary(latest) } : {}) })
+      },
+    },
+    {
+      method: "PATCH",
+      path: `${PREFIX}/profiles/:id`,
+      allow: MANAGE,
+      async handle(context) {
+        const { before, after } = await profiles.updateWithPrior(context.user.id, context.params.id!, await bodyOf(context.request))
+        const event = before.state !== after.state ? profileArchivedEvent(after.id, after.state === "archived", after.revision) : undefined
+        await changed(context, "profile.update", after.id, event)
+        return ok({ profile: after })
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles/:id/versions`,
+      allow: READ,
+      async handle({ params, url, user }) {
+        const limit = intParam(url, "limit")
+        const cursor = url.searchParams.get("cursor") ?? undefined
+        return ok(await profiles.history(user.id, params.id!, { ...(limit !== undefined ? { limit } : {}), ...(cursor ? { cursor } : {}) }))
+      },
+    },
+    {
+      method: "POST",
+      path: `${PREFIX}/profiles/:id/versions`,
+      allow: MANAGE,
+      async handle(context) {
+        const raw = await bodyOf(context.request)
+        return idempotency.run(context.user.id, `POST ${context.url.pathname}`, context.request.headers.get("idempotency-key"), raw, async () => {
+          only(raw, ["expectedRevision", "content", "fromVersion", "files"])
+          const sources = ["content", "fromVersion", "files"].filter((k) => raw[k] !== undefined)
+          if (sources.length !== 1) throw new AgentError("invalid", "Send exactly one of content, fromVersion or files")
+          const imported = raw.files !== undefined ? importContent(raw.files) : undefined
+          const { profile, version } = await profiles.addVersion(context.user.id, context.params.id!, {
+            expectedRevision: raw.expectedRevision,
+            ...(imported ? { content: imported.content } : raw.content !== undefined ? { content: raw.content } : { fromVersion: raw.fromVersion }),
+          })
+          await changed(context, "profile.version", profile.id, profileVersionEvent(profile.id, version.version, profile.revision))
+          return { status: 201, body: { profile, version: versionSummary(version), ...(imported ? { notes: imported.notes } : {}) } }
+        })
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles/:id/versions/:version`,
+      allow: READ,
+      handle: async ({ params, user }) => ok({ version: await version(user.id, params.id!, versionParam(params.version)) }),
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/profiles/:id/versions/:version/skills/:name`,
+      allow: READ,
+      handle: async ({ params, user }) => ok(skillOf(await version(user.id, params.id!, versionParam(params.version)), params.name!)),
+    },
+    {
+      method: "POST",
+      path: `${PREFIX}/profiles/:id/versions/:version/commands/:name/render`,
+      allow: READ,
+      async handle({ params, user, request }) {
+        const body = await bodyOf(request)
+        return ok(render(await version(user.id, params.id!, versionParam(params.version)), params.name!, body))
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/sessions/:addr/profile`,
+      allow: SESSION_READ,
+      async handle(context) {
+        const sessionID = sessionTarget(context)
+        const assignment = await profiles.assignment(context.user.id, sessionID)
+        if (!assignment) return ok({ assignment: null })
+        const [profile, pinnedVersion] = await Promise.all([profiles.get(context.user.id, assignment.profileID), profiles.version(context.user.id, assignment.profileID, assignment.version)])
+        return ok({ assignment, ...(profile ? { profile } : {}), ...(pinnedVersion ? { version: versionSummary(pinnedVersion) } : {}) })
+      },
+    },
+    {
+      method: "PUT",
+      path: `${PREFIX}/sessions/:addr/profile`,
+      allow: ASSIGN,
+      async handle(context) {
+        const sessionID = sessionTarget(context)
+        const body = await bodyOf(context.request)
+        only(body, ["profileID", "version", "expectedRevision"])
+        if (context.actor.kind !== "user") {
+          if (!deps.authorizePin) throw new AgentError("forbidden", "This hub does not let apps pin profiles")
+          await deps.authorizePin(context.actor, context.user.id, sessionID)
+        }
+        const assignment = await profiles.assign(context.user.id, sessionID, body)
+        await changed(context, "profile.assign", sessionID, profileAssignedEvent(sessionID, assignment.profileID, assignment.version, assignment.revision))
+        return ok({ assignment })
+      },
+    },
+    {
+      method: "DELETE",
+      path: `${PREFIX}/sessions/:addr/profile`,
+      allow: ASSIGN,
+      async handle(context) {
+        const sessionID = sessionTarget(context)
+        await profiles.unassign(context.user.id, sessionID, intParam(context.url, "expectedRevision"))
+        await changed(context, "profile.unassign", sessionID)
+        return new Response(null, { status: 204, headers: NO_STORE })
+      },
+    },
+    {
+      method: "GET",
+      path: `${PREFIX}/sessions/:addr/profile/skills/:name`,
+      allow: SESSION_READ,
+      handle: async (context) => ok(skillOf(await pinned(context), context.params.name!)),
+    },
+    {
+      method: "POST",
+      path: `${PREFIX}/sessions/:addr/profile/commands/:name/render`,
+      allow: SESSION_READ,
+      async handle(context) {
+        const body = await bodyOf(context.request)
+        return ok(render(await pinned(context), context.params.name!, body))
+      },
+    },
+  ]
+}