@oh-my-pi/pi-wire 18.2.10 → 18.2.11

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [18.2.11] - 2026-09-23
+
+### Added
+
+- Added public API contract and authentication schemas for the Skillshare registry.
+
 ## [18.2.5] - 2026-09-17
 
 ### Added

package/dist/types/skillshare.d.ts

@@ -0,0 +1,293 @@
+/**
+ * Wire contract for Skillshare (`skills.omp.sh`): an npm-style registry for
+ * omp skills. Shared by the omp CLI (`omp skill …`), the Go server
+ * (`stencil/apps/skills`), and its web UI (which mirrors this file).
+ *
+ * Packages are scoped: `@scope/name`. A scope is a Stencil username claimed on
+ * first publish and bound to the account's immutable `sub` forever (usernames
+ * can be renamed and recycled; scopes cannot). `name` is the SKILL.md
+ * frontmatter `name`. Published versions are immutable.
+ *
+ * Registry fields ride in SKILL.md `metadata` (the Agent Skills frontmatter is
+ * closed to name/description/license/compatibility/metadata/allowed-tools):
+ * `metadata.version` (semver, required to publish), `metadata.keywords`
+ * (comma-separated), `metadata.repository`, `metadata.homepage`.
+ */
+/** Default registry; `skills.registryUrl` overrides it. */
+export declare const DEFAULT_SKILLS_URL = "https://skills.omp.sh";
+/** Scopes are Stencil usernames (or registry orgs): lowercase letters, digits, underscores; 3–32 chars. */
+export declare const SKILL_SCOPE_RE: RegExp;
+/** Registry skill names: ASCII kebab-case, 1–64 chars, no leading/trailing/double hyphens. */
+export declare const SKILL_NAME_RE: RegExp;
+export declare const SKILL_NAME_MAX = 64;
+/** `@scope/name`, optionally `@version-or-range-or-tag`. */
+export declare const SKILL_SPEC_RE: RegExp;
+/** Publish limits, enforced by both the CLI and the server. */
+export declare const SKILL_LIMITS: {
+    /** Compressed `.tgz` upload. */
+    readonly tarballBytes: number;
+    /** Sum of all file sizes after unpacking. */
+    readonly unpackedBytes: number;
+    readonly files: 1000;
+    /** Longest path inside the package. */
+    readonly pathLength: 255;
+    readonly descriptionLength: 1024;
+    readonly keywords: 20;
+    readonly keywordLength: 50;
+    readonly deprecationLength: 500;
+};
+/** Paths excluded from packs in addition to `.skillignore` entries. */
+export declare const SKILL_DEFAULT_IGNORES: readonly [".git", ".DS_Store", "node_modules", "__pycache__", "*.pyc", "evals", ".skillignore"];
+/**
+ * Publish request: `PUT SKILLS_ROUTES.publish(scope, name, version)`, body is
+ * the `.tgz` (gzip tar; entries are paths relative to the skill root, regular
+ * files only, sorted, mtime 0, mode 0644 or 0755). Auth: `Authorization:
+ * Bearer <Stencil access token | registry publish token>`.
+ */
+export declare const SKILL_HEADERS: {
+    /** Required: SRI `sha512-<base64>` of the body. */
+    readonly integrity: "X-Skill-Integrity";
+    /** Optional dist-tag to point at the new version (default `latest` for stable, none for prereleases). */
+    readonly tag: "X-Skill-Tag";
+    /** Optional base64(JSON {@link SkillReportedProvenance}); shown as "reported". */
+    readonly provenance: "X-Skill-Provenance";
+    /** Optional GitHub Actions OIDC token (audience {@link SKILLS_OIDC_AUDIENCE}); verified server-side. */
+    readonly githubOidc: "X-Skill-GitHub-OIDC";
+};
+/** Audience CI must request for GitHub Actions OIDC tokens. */
+export declare const SKILLS_OIDC_AUDIENCE = "skills.omp.sh";
+/** Env var holding a registry publish token for CI (`sks_…`); wins over the Stencil login. */
+export declare const SKILLS_TOKEN_ENV = "SKILLS_TOKEN";
+/** Public identity of an account: current username + avatar seed (hash of the immutable sub). */
+export interface SkillUser {
+    username: string;
+    /** Hex seed for the generated dither avatar; never the raw sub. */
+    avatar: string;
+}
+export interface SkillReportedProvenance {
+    ompVersion: string;
+    gitRemote?: string;
+    gitCommit?: string;
+}
+/** Provenance proven by a verified GitHub Actions OIDC token. */
+export interface SkillVerifiedProvenance {
+    kind: "github-actions";
+    repository: string;
+    workflow: string;
+    ref: string;
+    sha: string;
+    runUrl: string;
+}
+export interface SkillProvenance {
+    publisher: SkillUser;
+    /** Publish came from a registry token rather than an interactive login. */
+    viaToken: boolean;
+    reported?: SkillReportedProvenance;
+    verified?: SkillVerifiedProvenance;
+}
+export interface SkillFile {
+    /** POSIX path relative to the skill root. */
+    path: string;
+    size: number;
+    /** Hex SHA-256 of the content. */
+    sha256: string;
+    executable: boolean;
+}
+/** One version as listed in a packument. */
+export interface SkillVersionSummary {
+    version: string;
+    publishedAt: number;
+    publisher: SkillUser;
+    integrity: string;
+    size: number;
+    unpackedSize: number;
+    fileCount: number;
+    /** Ships executables or anything under `scripts/`. */
+    hasScripts: boolean;
+    yanked: boolean;
+    deprecated?: string;
+}
+/** Daily download counts, oldest first: `[YYYY-MM-DD, count]`. */
+export type SkillDownloadSeries = [day: string, count: number][];
+/** `GET SKILLS_ROUTES.packument`: everything about a package. */
+export interface SkillPackument {
+    scope: string;
+    name: string;
+    /** From the `latest` version. */
+    description: string;
+    keywords: string[];
+    license?: string;
+    repository?: string;
+    homepage?: string;
+    owners: SkillUser[];
+    /** e.g. `{ latest: "1.2.0", next: "2.0.0-beta.1" }`. */
+    distTags: Record<string, string>;
+    versions: Record<string, SkillVersionSummary>;
+    createdAt: number;
+    updatedAt: number;
+    downloads: {
+        weekly: number;
+        total: number;
+        daily: SkillDownloadSeries;
+    };
+    /** Signed-in viewer may publish, tag, yank, deprecate, and manage owners. */
+    canManage: boolean;
+}
+/** `GET SKILLS_ROUTES.version`: one immutable version. `:version` may be a dist-tag. */
+export interface SkillVersionManifest extends SkillVersionSummary {
+    scope: string;
+    name: string;
+    description: string;
+    license?: string;
+    compatibility?: string;
+    allowedTools?: string;
+    /** SKILL.md `metadata` verbatim. */
+    metadata: Record<string, string>;
+    keywords: string[];
+    repository?: string;
+    homepage?: string;
+    files: SkillFile[];
+    /** Package path rendered as the README (`README.md` if present, else `SKILL.md`). */
+    readmePath: string;
+    provenance: SkillProvenance;
+}
+/** `GET SKILLS_ROUTES.readme`: sanitized HTML rendered at publish time. */
+export interface SkillReadme {
+    html: string;
+}
+/** `GET SKILLS_ROUTES.source`: one file for the code viewer. */
+export interface SkillSource {
+    path: string;
+    size: number;
+    /** Binary or over the view limit: no `html`, offer `SKILLS_ROUTES.file` instead. */
+    binary: boolean;
+    tooLarge: boolean;
+    /** Server-highlighted, sanitized HTML: one `<span class="line">` per line. */
+    html?: string;
+    lines?: number;
+}
+export interface SkillSearchHit {
+    scope: string;
+    name: string;
+    description: string;
+    keywords: string[];
+    version: string;
+    publisher: SkillUser;
+    updatedAt: number;
+    weeklyDownloads: number;
+    deprecated?: string;
+}
+export type SkillSearchSort = "relevance" | "downloads" | "recent";
+/** `GET SKILLS_ROUTES.search?q=&sort=&page=`. `q` accepts `owner:<scope>` and `keyword:<kw>` filters. */
+export interface SkillSearchResponse {
+    total: number;
+    page: number;
+    perPage: number;
+    hits: SkillSearchHit[];
+}
+/** `GET SKILLS_ROUTES.home`. */
+export interface SkillHome {
+    stats: {
+        packages: number;
+        versions: number;
+        publishers: number;
+        weeklyDownloads: number;
+    };
+    recent: SkillSearchHit[];
+    popular: SkillSearchHit[];
+    trending: SkillSearchHit[];
+    keywords: [keyword: string, count: number][];
+}
+/** `GET SKILLS_ROUTES.user`: a user or org scope page. */
+export interface SkillProfile {
+    user: SkillUser;
+    kind: "user" | "org";
+    scopes: string[];
+    packages: SkillSearchHit[];
+    /** Orgs only. */
+    members?: {
+        user: SkillUser;
+        role: SkillOrgRole;
+    }[];
+}
+export type SkillOrgRole = "owner" | "member";
+export interface SkillPublishResponse {
+    scope: string;
+    name: string;
+    version: string;
+    integrity: string;
+    /** Package page. */
+    url: string;
+    /** Dist-tags now pointing at this version. */
+    tags: string[];
+}
+/** Registry publish token (CI). The secret is shown once, at creation. */
+export interface SkillToken {
+    id: string;
+    name: string;
+    /** `@scope/name` packages the token may publish; empty = all packages the creator manages. */
+    packages: string[];
+    createdAt: number;
+    expiresAt?: number;
+    lastUsedAt?: number;
+}
+export interface SkillTokenCreated extends SkillToken {
+    /** `sks_…`; never retrievable again. */
+    token: string;
+}
+/** `GET SKILLS_ROUTES.me`. */
+export interface SkillSession {
+    user: SkillUser | null;
+    /** Sign-in is configured on this server. */
+    login: boolean;
+    admin: boolean;
+}
+/** Error body of every non-2xx JSON response. */
+export interface SkillError {
+    error: string;
+}
+/**
+ * HTTP routes, relative to the registry base URL. Mutations with a JSON body
+ * use the documented request shapes:
+ * - `tag` PUT `{ version }`, DELETE to remove (never `latest`)
+ * - `yank` POST `{ yanked: boolean }`
+ * - `deprecate` POST `{ message: string | null }`
+ * - `owner` PUT / DELETE (no body)
+ * - `tokens` POST `{ name, packages?: string[], expiresInDays?: number }`
+ * - `report` POST `{ reason: string }`
+ * - `takedown` POST `{ reason: string }` (admins)
+ * - `orgs` POST `{ name }`; `orgMember` PUT `{ role }` / DELETE
+ * - `importSkill` POST body = Claude `.skill` zip (bearer) → {@link SkillPublishResponse}
+ */
+export declare const SKILLS_ROUTES: {
+    readonly home: "/api/v1/home";
+    readonly search: "/api/v1/search";
+    readonly packument: (scope: string, name: string) => string;
+    readonly version: (scope: string, name: string, version: string) => string;
+    readonly readme: (scope: string, name: string, version: string) => string;
+    /** 302 to a signed R2 link; counts one download. */
+    readonly tarball: (scope: string, name: string, version: string) => string;
+    /** Raw file, same-origin: text as text/plain, sniffed raster images inline, everything else as an attachment. */
+    readonly file: (scope: string, name: string, version: string, path: string) => string;
+    readonly source: (scope: string, name: string, version: string, path: string) => string;
+    readonly publish: (scope: string, name: string, version: string) => string;
+    readonly tag: (scope: string, name: string, tag: string) => string;
+    readonly yank: (scope: string, name: string, version: string) => string;
+    readonly deprecate: (scope: string, name: string, version: string) => string;
+    readonly owner: (scope: string, name: string, username: string) => string;
+    readonly report: (scope: string, name: string) => string;
+    readonly takedown: (scope: string, name: string) => string;
+    readonly user: (username: string) => string;
+    readonly tokens: "/api/v1/tokens";
+    readonly token: (id: string) => string;
+    readonly orgs: "/api/v1/orgs";
+    readonly orgMember: (org: string, username: string) => string;
+    readonly importSkill: "/api/v1/import";
+    readonly me: "/api/me";
+    /** Web pages. */
+    readonly pages: {
+        readonly package: (scope: string, name: string) => string;
+        readonly user: (username: string) => string;
+        readonly search: (query: string) => string;
+    };
+};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-wire",
-	"version": "18.2.10",
+	"version": "18.2.11",
 	"description": "Shared wire protocol types for Oh My Pi packages",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",

package/src/skillshare.ts

@@ -0,0 +1,323 @@
+/**
+ * Wire contract for Skillshare (`skills.omp.sh`): an npm-style registry for
+ * omp skills. Shared by the omp CLI (`omp skill …`), the Go server
+ * (`stencil/apps/skills`), and its web UI (which mirrors this file).
+ *
+ * Packages are scoped: `@scope/name`. A scope is a Stencil username claimed on
+ * first publish and bound to the account's immutable `sub` forever (usernames
+ * can be renamed and recycled; scopes cannot). `name` is the SKILL.md
+ * frontmatter `name`. Published versions are immutable.
+ *
+ * Registry fields ride in SKILL.md `metadata` (the Agent Skills frontmatter is
+ * closed to name/description/license/compatibility/metadata/allowed-tools):
+ * `metadata.version` (semver, required to publish), `metadata.keywords`
+ * (comma-separated), `metadata.repository`, `metadata.homepage`.
+ */
+
+/** Default registry; `skills.registryUrl` overrides it. */
+export const DEFAULT_SKILLS_URL = "https://skills.omp.sh";
+
+/** Scopes are Stencil usernames (or registry orgs): lowercase letters, digits, underscores; 3–32 chars. */
+export const SKILL_SCOPE_RE = /^[a-z0-9][a-z0-9_]{2,31}$/;
+/** Registry skill names: ASCII kebab-case, 1–64 chars, no leading/trailing/double hyphens. */
+export const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export const SKILL_NAME_MAX = 64;
+/** `@scope/name`, optionally `@version-or-range-or-tag`. */
+export const SKILL_SPEC_RE = /^@([a-z0-9][a-z0-9_]{2,31})\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:@(.+))?$/;
+
+/** Publish limits, enforced by both the CLI and the server. */
+export const SKILL_LIMITS = {
+	/** Compressed `.tgz` upload. */
+	tarballBytes: 5 * 1024 * 1024,
+	/** Sum of all file sizes after unpacking. */
+	unpackedBytes: 20 * 1024 * 1024,
+	files: 1000,
+	/** Longest path inside the package. */
+	pathLength: 255,
+	descriptionLength: 1024,
+	keywords: 20,
+	keywordLength: 50,
+	deprecationLength: 500,
+} as const;
+
+/** Paths excluded from packs in addition to `.skillignore` entries. */
+export const SKILL_DEFAULT_IGNORES = [
+	".git",
+	".DS_Store",
+	"node_modules",
+	"__pycache__",
+	"*.pyc",
+	"evals",
+	".skillignore",
+] as const;
+
+/**
+ * Publish request: `PUT SKILLS_ROUTES.publish(scope, name, version)`, body is
+ * the `.tgz` (gzip tar; entries are paths relative to the skill root, regular
+ * files only, sorted, mtime 0, mode 0644 or 0755). Auth: `Authorization:
+ * Bearer <Stencil access token | registry publish token>`.
+ */
+export const SKILL_HEADERS = {
+	/** Required: SRI `sha512-<base64>` of the body. */
+	integrity: "X-Skill-Integrity",
+	/** Optional dist-tag to point at the new version (default `latest` for stable, none for prereleases). */
+	tag: "X-Skill-Tag",
+	/** Optional base64(JSON {@link SkillReportedProvenance}); shown as "reported". */
+	provenance: "X-Skill-Provenance",
+	/** Optional GitHub Actions OIDC token (audience {@link SKILLS_OIDC_AUDIENCE}); verified server-side. */
+	githubOidc: "X-Skill-GitHub-OIDC",
+} as const;
+
+/** Audience CI must request for GitHub Actions OIDC tokens. */
+export const SKILLS_OIDC_AUDIENCE = "skills.omp.sh";
+
+/** Env var holding a registry publish token for CI (`sks_…`); wins over the Stencil login. */
+export const SKILLS_TOKEN_ENV = "SKILLS_TOKEN";
+
+/** Public identity of an account: current username + avatar seed (hash of the immutable sub). */
+export interface SkillUser {
+	username: string;
+	/** Hex seed for the generated dither avatar; never the raw sub. */
+	avatar: string;
+}
+
+export interface SkillReportedProvenance {
+	ompVersion: string;
+	gitRemote?: string;
+	gitCommit?: string;
+}
+
+/** Provenance proven by a verified GitHub Actions OIDC token. */
+export interface SkillVerifiedProvenance {
+	kind: "github-actions";
+	repository: string;
+	workflow: string;
+	ref: string;
+	sha: string;
+	runUrl: string;
+}
+
+export interface SkillProvenance {
+	publisher: SkillUser;
+	/** Publish came from a registry token rather than an interactive login. */
+	viaToken: boolean;
+	reported?: SkillReportedProvenance;
+	verified?: SkillVerifiedProvenance;
+}
+
+export interface SkillFile {
+	/** POSIX path relative to the skill root. */
+	path: string;
+	size: number;
+	/** Hex SHA-256 of the content. */
+	sha256: string;
+	executable: boolean;
+}
+
+/** One version as listed in a packument. */
+export interface SkillVersionSummary {
+	version: string;
+	publishedAt: number;
+	publisher: SkillUser;
+	integrity: string;
+	size: number;
+	unpackedSize: number;
+	fileCount: number;
+	/** Ships executables or anything under `scripts/`. */
+	hasScripts: boolean;
+	yanked: boolean;
+	deprecated?: string;
+}
+
+/** Daily download counts, oldest first: `[YYYY-MM-DD, count]`. */
+export type SkillDownloadSeries = [day: string, count: number][];
+
+/** `GET SKILLS_ROUTES.packument`: everything about a package. */
+export interface SkillPackument {
+	scope: string;
+	name: string;
+	/** From the `latest` version. */
+	description: string;
+	keywords: string[];
+	license?: string;
+	repository?: string;
+	homepage?: string;
+	owners: SkillUser[];
+	/** e.g. `{ latest: "1.2.0", next: "2.0.0-beta.1" }`. */
+	distTags: Record<string, string>;
+	versions: Record<string, SkillVersionSummary>;
+	createdAt: number;
+	updatedAt: number;
+	downloads: { weekly: number; total: number; daily: SkillDownloadSeries };
+	/** Signed-in viewer may publish, tag, yank, deprecate, and manage owners. */
+	canManage: boolean;
+}
+
+/** `GET SKILLS_ROUTES.version`: one immutable version. `:version` may be a dist-tag. */
+export interface SkillVersionManifest extends SkillVersionSummary {
+	scope: string;
+	name: string;
+	description: string;
+	license?: string;
+	compatibility?: string;
+	allowedTools?: string;
+	/** SKILL.md `metadata` verbatim. */
+	metadata: Record<string, string>;
+	keywords: string[];
+	repository?: string;
+	homepage?: string;
+	files: SkillFile[];
+	/** Package path rendered as the README (`README.md` if present, else `SKILL.md`). */
+	readmePath: string;
+	provenance: SkillProvenance;
+}
+
+/** `GET SKILLS_ROUTES.readme`: sanitized HTML rendered at publish time. */
+export interface SkillReadme {
+	html: string;
+}
+
+/** `GET SKILLS_ROUTES.source`: one file for the code viewer. */
+export interface SkillSource {
+	path: string;
+	size: number;
+	/** Binary or over the view limit: no `html`, offer `SKILLS_ROUTES.file` instead. */
+	binary: boolean;
+	tooLarge: boolean;
+	/** Server-highlighted, sanitized HTML: one `<span class="line">` per line. */
+	html?: string;
+	lines?: number;
+}
+
+export interface SkillSearchHit {
+	scope: string;
+	name: string;
+	description: string;
+	keywords: string[];
+	version: string;
+	publisher: SkillUser;
+	updatedAt: number;
+	weeklyDownloads: number;
+	deprecated?: string;
+}
+
+export type SkillSearchSort = "relevance" | "downloads" | "recent";
+
+/** `GET SKILLS_ROUTES.search?q=&sort=&page=`. `q` accepts `owner:<scope>` and `keyword:<kw>` filters. */
+export interface SkillSearchResponse {
+	total: number;
+	page: number;
+	perPage: number;
+	hits: SkillSearchHit[];
+}
+
+/** `GET SKILLS_ROUTES.home`. */
+export interface SkillHome {
+	stats: { packages: number; versions: number; publishers: number; weeklyDownloads: number };
+	recent: SkillSearchHit[];
+	popular: SkillSearchHit[];
+	trending: SkillSearchHit[];
+	keywords: [keyword: string, count: number][];
+}
+
+/** `GET SKILLS_ROUTES.user`: a user or org scope page. */
+export interface SkillProfile {
+	user: SkillUser;
+	kind: "user" | "org";
+	scopes: string[];
+	packages: SkillSearchHit[];
+	/** Orgs only. */
+	members?: { user: SkillUser; role: SkillOrgRole }[];
+}
+
+export type SkillOrgRole = "owner" | "member";
+
+export interface SkillPublishResponse {
+	scope: string;
+	name: string;
+	version: string;
+	integrity: string;
+	/** Package page. */
+	url: string;
+	/** Dist-tags now pointing at this version. */
+	tags: string[];
+}
+
+/** Registry publish token (CI). The secret is shown once, at creation. */
+export interface SkillToken {
+	id: string;
+	name: string;
+	/** `@scope/name` packages the token may publish; empty = all packages the creator manages. */
+	packages: string[];
+	createdAt: number;
+	expiresAt?: number;
+	lastUsedAt?: number;
+}
+
+export interface SkillTokenCreated extends SkillToken {
+	/** `sks_…`; never retrievable again. */
+	token: string;
+}
+
+/** `GET SKILLS_ROUTES.me`. */
+export interface SkillSession {
+	user: SkillUser | null;
+	/** Sign-in is configured on this server. */
+	login: boolean;
+	admin: boolean;
+}
+
+/** Error body of every non-2xx JSON response. */
+export interface SkillError {
+	error: string;
+}
+
+const pkg = (scope: string, name: string) => `/api/v1/skills/@${scope}/${name}`;
+
+/**
+ * HTTP routes, relative to the registry base URL. Mutations with a JSON body
+ * use the documented request shapes:
+ * - `tag` PUT `{ version }`, DELETE to remove (never `latest`)
+ * - `yank` POST `{ yanked: boolean }`
+ * - `deprecate` POST `{ message: string | null }`
+ * - `owner` PUT / DELETE (no body)
+ * - `tokens` POST `{ name, packages?: string[], expiresInDays?: number }`
+ * - `report` POST `{ reason: string }`
+ * - `takedown` POST `{ reason: string }` (admins)
+ * - `orgs` POST `{ name }`; `orgMember` PUT `{ role }` / DELETE
+ * - `importSkill` POST body = Claude `.skill` zip (bearer) → {@link SkillPublishResponse}
+ */
+export const SKILLS_ROUTES = {
+	home: "/api/v1/home",
+	search: "/api/v1/search",
+	packument: (scope: string, name: string) => pkg(scope, name),
+	version: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}`,
+	readme: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}/readme`,
+	/** 302 to a signed R2 link; counts one download. */
+	tarball: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}/tarball`,
+	/** Raw file, same-origin: text as text/plain, sniffed raster images inline, everything else as an attachment. */
+	file: (scope: string, name: string, version: string, path: string) =>
+		`${pkg(scope, name)}/versions/${version}/files/${path}`,
+	source: (scope: string, name: string, version: string, path: string) =>
+		`${pkg(scope, name)}/versions/${version}/source/${path}`,
+	publish: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}`,
+	tag: (scope: string, name: string, tag: string) => `${pkg(scope, name)}/tags/${tag}`,
+	yank: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}/yank`,
+	deprecate: (scope: string, name: string, version: string) => `${pkg(scope, name)}/versions/${version}/deprecate`,
+	owner: (scope: string, name: string, username: string) => `${pkg(scope, name)}/owners/${username}`,
+	report: (scope: string, name: string) => `${pkg(scope, name)}/report`,
+	takedown: (scope: string, name: string) => `/api/v1/admin/skills/@${scope}/${name}/takedown`,
+	user: (username: string) => `/api/v1/users/${username}`,
+	tokens: "/api/v1/tokens",
+	token: (id: string) => `/api/v1/tokens/${id}`,
+	orgs: "/api/v1/orgs",
+	orgMember: (org: string, username: string) => `/api/v1/orgs/${org}/members/${username}`,
+	importSkill: "/api/v1/import",
+	me: "/api/me",
+	/** Web pages. */
+	pages: {
+		package: (scope: string, name: string) => `/@${scope}/${name}`,
+		user: (username: string) => `/~${username}`,
+		search: (query: string) => `/search?q=${encodeURIComponent(query)}`,
+	},
+} as const;