@papi-ai/skills 0.1.1 → 0.1.2

package/lib/manifest.mjs

@@ -49,6 +49,47 @@ function walk(root, dir, out) {
   }
 }
 
+/**
+ * task-2163: owner-only skills that must NEVER ship in the public @papi-ai/skills
+ * pack — they expose internal owner workflow or commercial detail. This is the
+ * distribution security control expressed as a RULE, not hand-curation: the
+ * manifest build asserts none of these are present in skills/ and fails CLOSED
+ * if one ever leaks. Superset of the handoff strip-list (caveman, stream-mode,
+ * owner-actions, crm, burn, build-in-public) plus the owner/commercial and
+ * host-loop skills that are out of scope for the shared pack.
+ */
+export const OWNER_ONLY_SKILLS = new Set([
+  'caveman',
+  'stream-mode',
+  'owner-actions',
+  'crm',
+  'burn',
+  'burn-dashboard',
+  'build-in-public',
+  'broadcast-compose',
+  'cold-outbound',
+  'winback',
+  'papi-auto', // host-loop (papi-auto-class), out of scope for the pack
+]);
+
+/**
+ * Assert no owner-only skill is present in the given skill-name list. Throws a
+ * descriptive error naming the offenders so the pack build fails CLOSED rather
+ * than silently shipping internal workflow. Pure — callers pass the scanned
+ * names, so it is trivially testable and reusable by any future packer.
+ */
+export function assertNoOwnerOnlySkills(names) {
+  const leaked = names.filter((n) => OWNER_ONLY_SKILLS.has(n));
+  if (leaked.length > 0) {
+    throw new Error(
+      `@papi-ai/skills refusing to build: owner-only skill(s) present in the public pack — ${leaked.join(', ')}. ` +
+      `These expose internal owner/commercial workflow and must never ship. Remove them from packages/skills/skills/ ` +
+      `(they belong in .claude/skills/ only); if one is genuinely generalizable, remove it from OWNER_ONLY_SKILLS in ` +
+      `lib/manifest.mjs with justification.`,
+    );
+  }
+}
+
 /** Load and parse the package manifest. Throws if missing/malformed. */
 export function loadManifest(packageRoot = PACKAGE_ROOT) {
   const raw = readFileSync(join(packageRoot, 'manifest.json'), 'utf8');

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.1",
-  "generatedAt": "2026-07-13T08:27:41.473Z",
+  "packageVersion": "0.1.2",
+  "generatedAt": "2026-08-01T18:51:37.168Z",
   "skills": [
     {
       "name": "check-mcp",
@@ -31,7 +31,7 @@
     {
       "name": "papi-install",
       "kind": "eager",
-      "checksum": "3ade812fcdfd7964"
+      "checksum": "2b8a7ae5832fcad0"
     },
     {
       "name": "papi-plan",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/skills",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "PAPI's shareable Claude Code skill bundle — single source of truth, installed (not copied) into projects with pinned versioning",
   "license": "Elastic-2.0",
   "type": "module",

package/skills/papi-install/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: papi-install
-description: Connect PAPI (Persistent Adaptive Planning Intelligence) to this project — one command, no config editing. Use when the user says "install papi", "set up papi", "connect papi", "add papi", or asks how to get structured plan/build/review cycles for their project. Also use when PAPI tools are expected but no papi MCP server is configured.
+description: Connect PAPI (Persistent Adaptive Project Intelligence) to this project — one command, no config editing. Use when the user says "install papi", "set up papi", "connect papi", "add papi", or asks how to get structured plan/build/review cycles for their project. Also use when PAPI tools are expected but no papi MCP server is configured.
 ---
 
 # Install PAPI