apps 0.0.1-beta.33 → 0.0.1-beta.35

package/js/mcp/stdio.js

@@ -3,37 +3,40 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "../chunk-GMMS4BY3.js";
+} from "../chunk-IA3VSGR4.js";
 import {
   protocolRouter
-} from "../chunk-TEV5IMOM.js";
+} from "../chunk-5CQMUXW7.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-3BHBWZLD.js";
-import "../chunk-AYM2FUI5.js";
-import "../chunk-2SRLJHPM.js";
-import "../chunk-OX233L7N.js";
-import "../chunk-E6C2DUIA.js";
-import "../chunk-5JVNM3CQ.js";
-import "../chunk-75JKK3ZE.js";
-import "../chunk-4OKYLVU4.js";
+import "../chunk-UWOIEJ56.js";
+import "../chunk-JU7F4PRK.js";
+import "../chunk-YYK6GEMC.js";
+import "../chunk-SRB2WDU7.js";
+import "../chunk-FFTALB6S.js";
+import "../chunk-KBXQOJYW.js";
+import "../chunk-IU7CCCUC.js";
+import "../chunk-VBVOPW4U.js";
+import "../chunk-ENJCQWVF.js";
+import "../chunk-NHUHTWAF.js";
 import {
   McpError,
   ProcessConfig
-} from "../chunk-N72RKJ5E.js";
-import "../chunk-UMCMZFXW.js";
-import "../chunk-5DLG2FVN.js";
-import "../chunk-HW3DPBZR.js";
-import "../chunk-ETLILMHY.js";
-import "../chunk-MFHUR5SB.js";
-import "../chunk-O3OAFU7Q.js";
-import "../chunk-6KG4DZD7.js";
-import "../chunk-FBBXFFFJ.js";
-import "../chunk-QYM4STZW.js";
-import "../chunk-CJY5X26R.js";
+} from "../chunk-5KNA2Z5I.js";
+import "../chunk-73AV3JVU.js";
+import "../chunk-BI6R577B.js";
+import "../chunk-I7CNZ4CM.js";
+import "../chunk-KZFV3WCJ.js";
+import "../chunk-TADLIUEU.js";
+import "../chunk-POOIHRPF.js";
+import "../chunk-Y3XN4X4Q.js";
+import "../chunk-BI45HZWM.js";
+import "../chunk-PHO7HXTC.js";
+import "../chunk-V5DWGYRK.js";
+import "../chunk-KOOJUMLR.js";
 import {
   Effect_exports,
   Schema_exports
-} from "../chunk-EXGKN554.js";
+} from "../chunk-IJQ5LE74.js";
 import "../chunk-CZ7CSFO4.js";
 
 // src/implementation/mcp-stdio.ts

package/js/mcp.js

@@ -1,54 +1,57 @@
 import {
   mcpClientEffect,
   mcpHealthEffect
-} from "./chunk-AKKJDDOT.js";
+} from "./chunk-LUROQKFP.js";
 import {
   catalogCache,
   catalogScope
-} from "./chunk-WWSRAE5Y.js";
+} from "./chunk-YW333DH3.js";
 import {
   adaptMcpTool
-} from "./chunk-GMMS4BY3.js";
+} from "./chunk-IA3VSGR4.js";
 import {
   protocolOperations
-} from "./chunk-TEV5IMOM.js";
+} from "./chunk-5CQMUXW7.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-3BHBWZLD.js";
+import "./chunk-UWOIEJ56.js";
 import {
   cacheKey
-} from "./chunk-AYM2FUI5.js";
+} from "./chunk-JU7F4PRK.js";
 import {
   operationDescription
-} from "./chunk-2SRLJHPM.js";
-import "./chunk-OX233L7N.js";
-import "./chunk-E6C2DUIA.js";
-import "./chunk-5JVNM3CQ.js";
+} from "./chunk-YYK6GEMC.js";
+import "./chunk-SRB2WDU7.js";
+import "./chunk-FFTALB6S.js";
+import "./chunk-KBXQOJYW.js";
+import "./chunk-IU7CCCUC.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-75JKK3ZE.js";
-import "./chunk-4OKYLVU4.js";
+} from "./chunk-VBVOPW4U.js";
+import "./chunk-ENJCQWVF.js";
+import "./chunk-NHUHTWAF.js";
 import {
   McpCredentialsUnverified,
   McpError,
   McpServerHeader,
   McpToolMetadata,
   McpToolsOptions
-} from "./chunk-N72RKJ5E.js";
-import "./chunk-UMCMZFXW.js";
-import "./chunk-5DLG2FVN.js";
-import "./chunk-HW3DPBZR.js";
-import "./chunk-ETLILMHY.js";
-import "./chunk-MFHUR5SB.js";
-import "./chunk-O3OAFU7Q.js";
-import "./chunk-6KG4DZD7.js";
-import "./chunk-FBBXFFFJ.js";
-import "./chunk-QYM4STZW.js";
-import "./chunk-CJY5X26R.js";
+} from "./chunk-5KNA2Z5I.js";
+import "./chunk-73AV3JVU.js";
+import "./chunk-BI6R577B.js";
+import "./chunk-I7CNZ4CM.js";
+import "./chunk-KZFV3WCJ.js";
+import "./chunk-TADLIUEU.js";
+import "./chunk-POOIHRPF.js";
+import "./chunk-Y3XN4X4Q.js";
+import "./chunk-BI45HZWM.js";
+import "./chunk-PHO7HXTC.js";
+import "./chunk-V5DWGYRK.js";
+import "./chunk-KOOJUMLR.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-EXGKN554.js";
+} from "./chunk-IJQ5LE74.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/implementation/mcp-catalog.ts
@@ -74,7 +77,7 @@ var mcpCatalog = (options, kinds) => Effect_exports.gen(function* () {
     signal: options.signal,
     timeoutMs: options.timeoutMs
   }).pipe(Effect_exports.mapError(invalid));
-  const cache = yield* catalogScope(options, invalid);
+  const cache = yield* catalogScope(options, options.headers, invalid);
   const id = yield* cacheKey({ url: parsed.url });
   const key = ["mcp-catalog-v3", id, "current"];
   const changed = cache === void 0 ? void 0 : invoke(() => cache.invalidate(key));

package/js/openapi.js

@@ -8,7 +8,7 @@ import {
 import {
   protocolOperations,
   protocolRouter
-} from "./chunk-TEV5IMOM.js";
+} from "./chunk-5CQMUXW7.js";
 import {
   OpenapiCompileError,
   OpenapiCompileErrorCode,
@@ -21,63 +21,67 @@ import {
   OpenapiSkippedOperation,
   OpenapiToolsOptions,
   defaultOpenapiResponseLimits,
-  failOnNetworkRefusal,
   isOpenapiFileSchema,
   isOpenapiJsonSequence,
   isOpenapiReadMethod,
   isOpenapiTextMedia,
   openapiBinaryResultSchema,
   openapiMediaKind
-} from "./chunk-2SRLJHPM.js";
-import "./chunk-OX233L7N.js";
+} from "./chunk-YYK6GEMC.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-SRB2WDU7.js";
+import "./chunk-FFTALB6S.js";
 import {
   fromPromise,
   nativeOperation,
   routerDeclaration,
   toPromise
-} from "./chunk-75JKK3ZE.js";
+} from "./chunk-VBVOPW4U.js";
 import {
   accountProviderError,
   httpProviderError
-} from "./chunk-4OKYLVU4.js";
+} from "./chunk-ENJCQWVF.js";
+import "./chunk-NHUHTWAF.js";
 import {
   ApiErrorRecovery,
   ApiErrorResponse,
-  NetworkRefused,
   OpenapiResponseError,
   RouterMeta,
   defaultOpenapiErrorLimits
-} from "./chunk-N72RKJ5E.js";
-import "./chunk-UMCMZFXW.js";
+} from "./chunk-5KNA2Z5I.js";
+import "./chunk-73AV3JVU.js";
 import {
+  NetworkRefused,
   ProviderError,
   cacheLimits
-} from "./chunk-5DLG2FVN.js";
-import "./chunk-HW3DPBZR.js";
-import "./chunk-ETLILMHY.js";
+} from "./chunk-BI6R577B.js";
+import "./chunk-I7CNZ4CM.js";
+import "./chunk-KZFV3WCJ.js";
 import {
   FetchHttpClient_exports
-} from "./chunk-MFHUR5SB.js";
+} from "./chunk-TADLIUEU.js";
 import {
   jsonSchema,
   lazyJsonSchemaDecoder,
   once,
   wrap
-} from "./chunk-O3OAFU7Q.js";
-import "./chunk-6KG4DZD7.js";
+} from "./chunk-POOIHRPF.js";
+import "./chunk-Y3XN4X4Q.js";
 import {
   JsonObject
-} from "./chunk-FBBXFFFJ.js";
-import "./chunk-QYM4STZW.js";
+} from "./chunk-BI45HZWM.js";
+import "./chunk-PHO7HXTC.js";
+import "./chunk-V5DWGYRK.js";
 import {
   HttpClientRequest_exports,
   HttpClient_exports
-} from "./chunk-CJY5X26R.js";
+} from "./chunk-KOOJUMLR.js";
 import {
+  Base64_exports,
   Deferred_exports,
   Duration_exports,
   Effect_exports,
-  Encoding_exports,
   Exit_exports,
   JsonPointer_exports,
   JsonSchema_exports,
@@ -85,7 +89,7 @@ import {
   SchemaIssue_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-EXGKN554.js";
+} from "./chunk-IJQ5LE74.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/implementation/swagger-client.ts
@@ -391,8 +395,7 @@ function createRequest(config) {
           data.set(chunk, offset);
           offset += chunk.length;
         }
-        if (!isOpenapiTextMedia(contentType))
-          return { base64: Encoding_exports.encodeBase64(data), contentType };
+        if (!isOpenapiTextMedia(contentType)) return { base64: Base64_exports.encode(data), contentType };
         const text = new TextDecoder().decode(data);
         return contentType.includes("json") && !isOpenapiJsonSequence(contentType) ? yield* Schema_exports.decodeUnknownEffect(Schema_exports.fromJsonString(Schema_exports.Json))(text).pipe(
           Effect_exports.mapError(() => unreadable)

package/js/react.js

@@ -2,11 +2,11 @@ import {
   AsyncResult_exports,
   AtomRegistry_exports,
   queryCommitted
-} from "./chunk-6ZJ2H6P4.js";
-import "./chunk-DASNNAP4.js";
+} from "./chunk-A4O72Z3A.js";
+import "./chunk-HDAQBRT5.js";
 import {
   Option_exports
-} from "./chunk-EXGKN554.js";
+} from "./chunk-IJQ5LE74.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/react.ts

package/js/skills/effect.js

@@ -1,11 +1,12 @@
 import {
   folderSkillsEffect,
   skillFromFiles
-} from "../chunk-OX233L7N.js";
-import "../chunk-HW3DPBZR.js";
-import "../chunk-QYM4STZW.js";
-import "../chunk-CJY5X26R.js";
-import "../chunk-EXGKN554.js";
+} from "../chunk-FFTALB6S.js";
+import "../chunk-I7CNZ4CM.js";
+import "../chunk-PHO7HXTC.js";
+import "../chunk-V5DWGYRK.js";
+import "../chunk-KOOJUMLR.js";
+import "../chunk-IJQ5LE74.js";
 import "../chunk-CZ7CSFO4.js";
 export {
   folderSkillsEffect,

package/js/skills.js

@@ -1,15 +1,25 @@
 import {
-  catalogCache
-} from "./chunk-WWSRAE5Y.js";
-import "./chunk-AYM2FUI5.js";
+  catalogCache,
+  catalogScope
+} from "./chunk-YW333DH3.js";
+import "./chunk-JU7F4PRK.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-SRB2WDU7.js";
 import {
   folderSkillsEffect,
   skillFromFiles
-} from "./chunk-OX233L7N.js";
+} from "./chunk-FFTALB6S.js";
 import {
+  accountProviderError,
   httpProviderError
-} from "./chunk-4OKYLVU4.js";
-import "./chunk-5DLG2FVN.js";
+} from "./chunk-ENJCQWVF.js";
+import "./chunk-NHUHTWAF.js";
+import {
+  NetworkRefused,
+  ProviderError,
+  networkRefusalStatus
+} from "./chunk-BI6R577B.js";
 import {
   AppSkillMetadata,
   AppSkillSource,
@@ -19,25 +29,28 @@ import {
   SkillLoadFailed,
   SkillServiceName,
   skillLoadLimits
-} from "./chunk-HW3DPBZR.js";
+} from "./chunk-I7CNZ4CM.js";
+import "./chunk-KZFV3WCJ.js";
 import {
   FetchHttpClient_exports
-} from "./chunk-MFHUR5SB.js";
+} from "./chunk-TADLIUEU.js";
 import {
   wrap
-} from "./chunk-O3OAFU7Q.js";
-import "./chunk-FBBXFFFJ.js";
-import "./chunk-QYM4STZW.js";
+} from "./chunk-POOIHRPF.js";
+import "./chunk-BI45HZWM.js";
+import "./chunk-PHO7HXTC.js";
+import "./chunk-V5DWGYRK.js";
 import {
   HttpBody_exports,
   HttpClient_exports
-} from "./chunk-CJY5X26R.js";
+} from "./chunk-KOOJUMLR.js";
 import {
+  Base64_exports,
   Effect_exports,
   Ref_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-EXGKN554.js";
+} from "./chunk-IJQ5LE74.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/implementation/inflate.ts
@@ -600,6 +613,11 @@ var withService = (service) => (effect) => service === void 0 || !Schema_exports
     }) : error
   )
 );
+var refusedRequest = (refused) => new SkillLoadFailed({
+  reason: "source",
+  status: networkRefusalStatus,
+  message: refused.message.slice(0, 500)
+});
 var parse = (schema, input) => Schema_exports.decodeUnknownEffect(schema)(input).pipe(Effect_exports.mapError(() => failed("document")));
 var resourcePath = (path) => {
   if (!Schema_exports.is(SkillFilePath)(path)) return false;
@@ -615,23 +633,31 @@ var resourcePath = (path) => {
 var pathUrl = (base, path) => new URL(path.split("/").map(encodeURIComponent).join("/"), base).href;
 var reader = (transport) => Effect_exports.gen(function* () {
   const budget = yield* Ref_exports.make(0);
-  const fetchBytes = (url, post) => Effect_exports.gen(function* () {
+  const fetchBytes = (url, request = {}) => Effect_exports.gen(function* () {
     const parsed = yield* Effect_exports.try({
       try: () => new URL(url),
       catch: () => failed("source")
     });
     if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.hash)
       return yield* failed("source");
+    const refused = request.refused ?? refusedRequest;
     const client = HttpClient_exports.withScope(yield* HttpClient_exports.HttpClient);
     const headers = {
       "User-Agent": "executor-skills",
       Accept: "application/json, text/plain",
-      "Cache-Control": "no-cache"
+      "Cache-Control": "no-cache",
+      ...request.headers
     };
-    const response = yield* (post === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
-      headers: { ...headers, ...post.headers },
-      body: HttpBody_exports.uint8Array(post.body, post.headers["Content-Type"])
-    })).pipe(Effect_exports.mapError(() => failed("request")));
+    const response = yield* (request.body === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
+      headers,
+      body: HttpBody_exports.uint8Array(request.body, request.headers?.["Content-Type"])
+    })).pipe(
+      // `ctx.fetch` rejects a request Executor's app network refused.
+      Effect_exports.mapError(
+        (error) => Schema_exports.is(NetworkRefused)(error.cause) ? refused(error.cause) : failed("request")
+      )
+    );
+    yield* failOnNetworkRefusal(response).pipe(Effect_exports.mapError(refused));
     if (response.status < 200 || response.status >= 300)
       return yield* rejected(response.status, response.headers);
     const chunks = [];
@@ -661,7 +687,7 @@ var reader = (transport) => Effect_exports.gen(function* () {
     Effect_exports.provideService(FetchHttpClient_exports.RequestInit, { redirect: "manual" }),
     Effect_exports.provideService(FetchHttpClient_exports.Fetch, transport.fetch ?? globalThis.fetch)
   );
-  const read = (url) => fetchBytes(url).pipe(
+  const read = (url, request = {}) => fetchBytes(url, request).pipe(
     Effect_exports.flatMap(
       (result) => Effect_exports.try({
         try: () => new TextDecoder("utf-8", { fatal: true }).decode(result),
@@ -680,21 +706,40 @@ var git = (run) => Effect_exports.tryPromise({
   try: async () => run(),
   catch: (error) => error instanceof InflateLimitExceeded ? failed("limit") : unreadable()
 });
-var resolveCommit = (remote, repo, ref) => Effect_exports.gen(function* () {
+var githubHosts = ["github.com", "raw.githubusercontent.com"];
+var githubRequests = (remote, repo, token) => {
+  const refused = (host) => (refusal) => refusal.refusal.reason === "credential_host" ? new SkillLoadFailed({
+    reason: "source",
+    status: networkRefusalStatus,
+    message: `Executor did not send the GitHub token to ${host}. The account's provider must declare hosts ${githubHosts.join(" and ")}; reconnect an account connected with other hosts.`
+  }) : refusedRequest(refusal);
+  const upload = (body) => remote.fetchBytes(`https://${githubHosts[0]}/${repo}.git/git-upload-pack`, {
+    body,
+    headers: {
+      ...gitRequestHeaders,
+      ...token === void 0 ? {} : { Authorization: `Basic ${Base64_exports.encode(`x-access-token:${token}`)}` }
+    },
+    refused: refused(githubHosts[0])
+  });
+  const file = (commit, path) => remote.read(pathUrl(`https://${githubHosts[1]}/${repo}/${commit}/`, path), {
+    ...token === void 0 ? {} : { headers: { Authorization: `token ${token}` } },
+    refused: refused(githubHosts[1])
+  });
+  return { repo, authenticated: token !== void 0, upload, file };
+};
+var resolveCommit = (github, ref) => Effect_exports.gen(function* () {
+  const { repo } = github;
   if (ref !== void 0 && /^[a-f0-9]{40}$/.test(ref)) return ref;
   const names = refCandidates(ref);
-  const response = yield* remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-    body: lsRefsRequest(names),
-    headers: gitRequestHeaders
-  }).pipe(
-    // GitHub asks for credentials when a repository is missing or private.
-    Effect_exports.mapError(
-      (error) => error.status === 401 || error.status === 404 ? new SkillLoadFailed({
+  const response = yield* github.upload(lsRefsRequest(names)).pipe(
+    Effect_exports.mapError((error) => {
+      const hidden = error.reason === "request" && (error.status === 404 || error.status === 401 && !github.authenticated);
+      return hidden ? new SkillLoadFailed({
         reason: "source",
-        message: `GitHub has no public repository named ${repo}.`,
+        message: github.authenticated ? `GitHub has no repository named ${repo} that the account's token can read.` : `GitHub has no public repository named ${repo}. To read a private repository, pass a GitHub account and its token.`,
         status: error.status
-      }) : error
-    )
+      }) : error;
+    })
   );
   const refs = yield* git(() => parseLsRefs(response));
   const commit = names.map((name) => refs.get(name)).find((sha) => sha !== void 0);
@@ -705,10 +750,7 @@ var resolveCommit = (remote, repo, ref) => Effect_exports.gen(function* () {
     });
   return commit;
 });
-var listFiles = (remote, repo, commit, path) => remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-  body: treeFetchRequest(commit),
-  headers: gitRequestHeaders
-}).pipe(
+var listFiles = (github, commit, path) => github.upload(treeFetchRequest(commit)).pipe(
   Effect_exports.flatMap(
     (response) => git(
       () => parseTreeFetch(response, commit, path, { objectBytes: skillLoadLimits.fileBytes })
@@ -721,8 +763,8 @@ var SkillDirectories = Schema_exports.Array(
     files: Schema_exports.Array(Schema_exports.Struct({ path: Schema_exports.String, mode: Schema_exports.String }))
   })
 );
-var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(function* () {
-  const files = yield* listFiles(remote, repo, commit, path);
+var skillDirectories = (github, commit, path) => Effect_exports.gen(function* () {
+  const files = yield* listFiles(github, commit, path);
   const documents = files.filter(
     (file) => file.path === "SKILL.md" || file.path.endsWith("/SKILL.md")
   );
@@ -734,15 +776,21 @@ var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(functi
     return yield* failed("limit");
   return directories;
 });
-var cachedSkillDirectories = (cache, transport, repo, commit, path) => Effect_exports.tryPromise({
+var cachedSkillDirectories = (cache, transport, options, commit) => Effect_exports.tryPromise({
   try: () => cache.get({
-    key: ["apps/githubSkills/directories", 1, repo, commit, path ?? null],
+    key: ["apps/githubSkills/directories", 1, options.repo, commit, options.path ?? null],
     schema: wrap(SkillDirectories, false),
     freshFor: "7 days",
     load: (context) => Effect_exports.runPromise(
-      // Keep the author's fetch, as every other read in this load does.
+      // Keep the author's fetch and this read's token, as every other request in it does.
       reader({ fetch: transport.fetch, signal: context.signal }).pipe(
-        Effect_exports.flatMap((remote) => skillDirectories(remote, repo, commit, path))
+        Effect_exports.flatMap(
+          (remote) => skillDirectories(
+            githubRequests(remote, options.repo, options.token),
+            commit,
+            options.path
+          )
+        )
       ),
       { signal: context.signal }
     )
@@ -769,20 +817,42 @@ var cachedCatalog = (options, prefix, load) => options.cache === void 0 ? load(o
     })
   )
 );
+var GitHubToken = Schema_exports.String.check(Schema_exports.isPattern(/^[\x21-\x7e]+$/));
+var scopeMessages = {
+  "missing-account": "A GitHub token needs its account. Pass account: ctx.accounts.<slot> with it.",
+  "unselected-account": "The GitHub account is not one of this app's selected accounts."
+};
+var githubCache = (options) => options.account !== void 0 && !Schema_exports.is(GitHubToken)(options.token) ? Effect_exports.fail(
+  new SkillLoadFailed({
+    reason: "source",
+    message: "The GitHub account was passed without a valid token."
+  })
+) : catalogScope(
+  options,
+  options.token,
+  (problem) => new SkillLoadFailed({ reason: "source", message: scopeMessages[problem] })
+);
+var attributed = (account) => (error) => account !== void 0 && error.reason === "request" && (error.status === 401 || error.status === 403) ? accountProviderError(
+  new ProviderError({
+    reason: error.status === 401 ? "unauthorized" : "rejected",
+    status: error.status
+  }),
+  account.id
+) : error;
 var githubSkillsEffect = (options) => Effect_exports.gen(function* () {
   if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repo) || options.path !== void 0 && !resourcePath(options.path))
     return yield* failed("source");
+  const cache = yield* githubCache(options);
   return yield* cachedCatalog(
-    options,
+    cache === void 0 ? options : { ...options, cache },
     ["apps/githubSkills/catalog", 1, options.repo, options.ref ?? null, options.path ?? null],
-    (transport, cache) => githubCatalog(options, transport, cache)
+    (transport, cache2) => githubCatalog(options, transport, cache2)
   );
-}).pipe(withService("GitHub"));
+}).pipe(withService("GitHub"), Effect_exports.mapError(attributed(options.account)));
 var githubCatalog = (options, transport, cache) => Effect_exports.gen(function* () {
-  const remote = yield* reader(transport);
-  const commit = yield* resolveCommit(remote, options.repo, options.ref);
-  const resources = yield* cache === void 0 ? skillDirectories(remote, options.repo, commit, options.path) : cachedSkillDirectories(cache, transport, options.repo, commit, options.path);
-  const base = `https://raw.githubusercontent.com/${options.repo}/${commit}/`;
+  const github = githubRequests(yield* reader(transport), options.repo, options.token);
+  const commit = yield* resolveCommit(github, options.ref);
+  const resources = yield* cache === void 0 ? skillDirectories(github, commit, options.path) : cachedSkillDirectories(cache, transport, options, commit);
   const skills = yield* Effect_exports.forEach(
     resources,
     ({ directory, files }) => Effect_exports.gen(function* () {
@@ -792,7 +862,7 @@ var githubCatalog = (options, transport, cache) => Effect_exports.gen(function*
           const path = file.path.slice(directory.length);
           if (!resourcePath(file.path) || !resourcePath(path) || file.mode === "120000")
             return yield* failed("source");
-          return { path, content: yield* remote.read(pathUrl(base, file.path)) };
+          return { path, content: yield* github.file(commit, file.path) };
         }),
         { concurrency: skillLoadLimits.concurrency }
       );