@mortar-ai/skill 0.1.0 → 0.2.0

package/README.md

@@ -1,8 +1,8 @@
 # @mortar-ai/skill
 
-[Claude Code](https://claude.ai/code) skill package for building on
-**Mortar** (the BaaS that AI bundles talk to).  Drop it into your skills
-directory + Claude becomes instantly Mortar-fluent: knows the SDK
+[Agent Skills](https://agentskills.io/) package for building on **Mortar** (the
+BaaS that AI bundles talk to). Install the canonical `SKILL.md` into a compatible
+agent's skill directory to teach it the SDK
 accessors, CLI commands, MCP tools, and — most importantly — the
 tenant-isolation + `auth.tenant_id()` RLS rules that are the easiest
 thing to get wrong.
@@ -17,6 +17,12 @@ mortar-skill-install
 
 Then restart Claude Code (or `/skill reload`).
 
+The same versioned `SKILL.md` is packaged into Fabric Harness. `manifest.json`
+binds the npm version and Harness preinstall to its SHA-256 digest; the Fabric
+Server rejects a Market install when the running Harness reports different
+bytes. npm is an external distribution channel and is not required by Fabric at
+runtime.
+
 Pairs naturally with the [Mortar MCP server](../mcp) — the skill teaches Claude
 *how* to think about Mortar; the MCP gives it live tools to *act* on a
 project.  Install both for the full Supabase-plugin-equivalent
@@ -56,6 +62,19 @@ Useful for team-shared skill repositories or in-repo skill packs.
 Re-run `mortar-skill-install` after `npm update @mortar-ai/skill`.
 Idempotent — overwrites in place.
 
+## Maintainer release
+
+`SKILL.md` is the only hand-edited instruction source. Regenerate the manifest
+and Harness copy before testing or publishing:
+
+```bash
+npm run sync
+npm run check
+npm pack --dry-run
+```
+
+Never edit `fabric/harness/internal/skills/preinstalled/mortar/` directly.
+
 ## License
 
 Apache-2.0 (same as the rest of Mortar).

package/{mortar-skill.md → SKILL.md}

@@ -62,12 +62,6 @@ below; if platform provisioning fails, report that platform failure.
    code using the injected singleton.
 5. Type-check and build. Handle every `{ data, error }` result in UI code.
 
-Example schema operations (the tool schema is authoritative for all fields):
-
-```json
-{"kind":"create_table","table":"todos","access":"private","columns":[{"name":"title","type":"text","required":true},{"name":"done","type":"bool"},{"name":"user_id","type":"uuid","required":true}]}
-```
-
 Supported migration kinds are `create_table`, `drop_table`, `set_table_access`,
 `add_column`, `drop_column`, `create_index`, `set_bucket_access`, `deploy_function`, `delete_function`,
 `upsert_cron`, and `delete_cron`. Destructive and backend-changing operations
@@ -110,20 +104,11 @@ const { data: created, error: insertError } = await mortar
   .select()
   .single();
 
-const { data: updated, error: updateError } = await mortar
-  .from('todos')
-  .update({ done: true })
-  .eq('id', todoId)
-  .select();
-
-const { error: deleteError } = await mortar
-  .from('todos')
-  .delete()
-  .eq('id', todoId);
 ```
 
-Useful chaining includes `eq`, `neq`, `gt/gte`, `lt/lte`, `like/ilike`, `in`,
-`is`, `order`, `range`, `limit`, `single`, and `maybeSingle`.
+Updates and deletes use the same filter chain. Useful operators include `eq`,
+`neq`, ranges, `like/ilike`, `in`, `is`, `order`, `limit`, `single`, and
+`maybeSingle`.
 
 ## App-user authentication
 
@@ -139,15 +124,12 @@ const verified = await mortar.auth.verifyOtp({ email, token });
 
 const { data: sessionData } = await mortar.auth.getSession();
 const { data: userData, error: userError } = await mortar.auth.getUser();
-
-const { data: listener } = mortar.auth.onAuthStateChange((event, session) => {
-  // INITIAL_SESSION | SIGNED_IN | SIGNED_OUT | TOKEN_REFRESHED
-});
-listener.subscription.unsubscribe();
-
 await mortar.auth.signOut();
 ```
 
+Use `onAuthStateChange` when UI must react to session changes, and unsubscribe
+the returned subscription during cleanup.
+
 Password reset starts with `mortar.auth.resetPasswordForEmail(email)`; confirm via
 `passwordResetConfirm(email, token, newPassword)`. Never store or pass session
 tokens manually unless the user explicitly needs a server integration.
@@ -180,16 +162,9 @@ budget, but clients should still lazy-load visible media and cache/reuse each
 URL instead of signing again on every render. Signing authorizes a possible
 download; it does not prove bytes were served and must never be described or
 modeled as an object-egress charge. Only provider-observed access-log or billing
-reconciliation may record actual object egress. Use the third
-`createSignedUrl` argument to bound only the signing request when the UI needs
-a deadline:
-
-```ts
-const { data: signed, error } = await bucket.createSignedUrl(path, 900, {
-  signal: controller.signal,
-  timeoutMs: 10_000,
-});
-```
+reconciliation may record actual object egress. The optional third
+`createSignedUrl` argument (`{ signal, timeoutMs }`) bounds only the signing
+request when the UI needs a deadline.
 
 `bucket.download(path)` uses JavaScript `fetch()` against the object store and
 therefore needs a matching bucket CORS rule in browsers. Appunvs-managed Mortar
@@ -223,26 +198,10 @@ realtime only notifies peers.
 
 ## Compute and analytics
 
-Invoke only functions already deployed through `mortar_migrate`:
-
-```ts
-const response = await mortar.compute.invoke({
-  name: 'summarize',
-  method: 'POST',
-  body: JSON.stringify({ text }),
-  contentType: 'application/json',
-});
-if (!response.ok) throw new Error(await response.text());
-```
-
-Analytics calls are fire-and-forget except `flush`:
-
-```ts
-mortar.analytics.track('pageview', { path: location.pathname });
-mortar.analytics.identify(user.id, { plan: 'free' });
-mortar.analytics.captureError(error, { screen: 'checkout' });
-await mortar.analytics.flush();
-```
+Invoke only functions already deployed through `mortar_migrate`; check
+`response.ok` and read the response body. Analytics provides `track`,
+`identify`, `captureError`, and `flush`; events are fire-and-forget except
+`flush`.
 
 ## Boundary for non-Fabric development
 

package/bin/install.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * mortar-skill-install — copies mortar-skill.md into the user's Claude
+ * mortar-skill-install — copies the canonical SKILL.md into the user's Claude
  * Code skills directory.
  *
  * Default destination: `~/.claude/skills/mortar/SKILL.md`.  Override
@@ -26,7 +26,7 @@ function parseFlags(argv) {
 
 function main() {
   const flags = parseFlags(process.argv);
-  const src = resolve(__dirname, '..', 'mortar-skill.md');
+  const src = resolve(__dirname, '..', 'SKILL.md');
   if (!existsSync(src)) {
     console.error(`mortar-skill: source missing at ${src}`);
     process.exit(1);

package/index.js

@@ -9,7 +9,8 @@
 const { readFileSync } = require('node:fs');
 const { resolve } = require('node:path');
 
-const SKILL_PATH = resolve(__dirname, 'mortar-skill.md');
+const SKILL_PATH = resolve(__dirname, 'SKILL.md');
+const MANIFEST_PATH = resolve(__dirname, 'manifest.json');
 
 module.exports = {
   /**
@@ -20,5 +21,9 @@ module.exports = {
   skillContents() {
     return readFileSync(SKILL_PATH, 'utf8');
   },
+  manifest() {
+    return JSON.parse(readFileSync(MANIFEST_PATH, 'utf8'));
+  },
   SKILL_PATH,
+  MANIFEST_PATH,
 };

package/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": 1,
+  "id": "mortar",
+  "version": "0.2.0",
+  "content_sha256": "sha256:dd11d5e635f47e64303927fd4af21b0f8a9aef8836a17c3a592eecb69cc75325",
+  "source_repo": "liamxujia/appunvs",
+  "source_path": "mortar/skill/SKILL.md",
+  "distributions": [
+    "harness_preinstalled",
+    "npm"
+  ],
+  "npm": {
+    "package": "@mortar-ai/skill",
+    "version": "0.2.0"
+  }
+}

package/package.json

@@ -1,12 +1,16 @@
 {
   "name": "@mortar-ai/skill",
-  "version": "0.1.0",
-  "description": "Claude Code skill package for building on Mortar (BaaS). Drop `mortar-skill.md` into ~/.claude/skills/mortar/ to give Claude expert-level guidance about the Mortar SDK / CLI / MCP, tenant isolation + auth.tenant_id() RLS, and the 9 primitive × feature model.",
+  "version": "0.2.0",
+  "description": "Agent skill package for building Fabric applications on Mortar (BaaS), distributed from one versioned SKILL.md with a content-addressed manifest.",
   "main": "index.js",
-  "files": ["mortar-skill.md", "index.js", "README.md"],
+  "files": ["SKILL.md", "manifest.json", "index.js", "README.md"],
   "bin": {
     "mortar-skill-install": "bin/install.js"
   },
+  "scripts": {
+    "sync": "node scripts/sync-distributions.js",
+    "check": "node scripts/sync-distributions.js --check"
+  },
   "publishConfig": { "access": "public" },
   "license": "Apache-2.0"
 }