hngr 0.6.0 → 0.7.0

package/dist/{catalog-r53AMymQ.mjs → catalog-yVsOzNKU.mjs}

@@ -42,6 +42,7 @@ const EXCLUDED_PATHS = [
 	"/api/v1/capabilities/{capability_id}/versions/{version}/content",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/files",
 	"/api/v1/capabilities/{capability_id}/versions/{version}/file",
+	"/api/v1/capabilities/{capability_id}/versions/{version}/derive",
 	"/api/v1/auth/methods",
 	"/api/v1/auth/oidc/login",
 	"/api/v1/auth/oidc/callback",
@@ -1479,6 +1480,42 @@ const COMMANDS = deriveCommands({
 				}
 			}
 		},
+		"/api/v1/capabilities/{capability_id}/versions/{version}/derive": { "post": {
+			"operationId": "deriveCapabilityVersion",
+			"summary": "Publish a new Version by editing the files of the current Skill Version.",
+			"description": "Derives a new Version from the package of `{version}` by replacing the\nlisted entries and publishes it through the same pipeline as\n`publishCapabilityVersion`: CalVer allocation, the current-version\nswitch and the `capability.version_published` Audit Event all follow\nthe existing publishing rules. Only a Skill Capability accepts this\noperation; an MCP Capability answers 400.\n\n`{version}` must be the Capability's Current Version; any other CalVer\nanswers 409 `/problems/version-conflict`. The check runs again after\nthe Capability row is locked, so a concurrent publish is reported\nrather than silently replaced. Each `edits` path is matched exactly\nagainst a non-directory entry of the baseline package (case\nsensitive); an unknown path, a directory, a non-text entry, an entry\nlarger than 256 KiB, or more than 1 MiB of edits in total answers 400.\n\nThe new Version inherits the baseline Version's `readme` unchanged,\nincluding a null value, for which the existing display rule falls back\nto the package's `SKILL.md`. The request has no README field. This\noperation does not increment `download_count`.\n\nThe caller must manage the Capability's Namespace, under the same\nrules as `publishCapabilityVersion`: a deleted or unavailable\nCapability, one in an unusable Namespace, and a private one the caller\ndoes not manage answer 404. A replayed `Idempotency-Key` returns the\nfirst response without deriving again.\n",
+			"security": [{ "sessionCookie": [] }, { "bearerToken": [] }],
+			"parameters": [
+				{ "$ref": "#/components/parameters/CapabilityID" },
+				{
+					"name": "version",
+					"in": "path",
+					"required": true,
+					"schema": { "$ref": "#/components/schemas/CalVer" }
+				},
+				{ "$ref": "#/components/parameters/IdempotencyKey" }
+			],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeriveCapabilityVersionRequest" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "The Capability with its new current version.",
+					"headers": { "Location": {
+						"description": "`/api/v1/capabilities/{capability_id}/versions/{version}`",
+						"schema": { "type": "string" }
+					} },
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/Capability" } } }
+				},
+				"400": { "$ref": "#/components/responses/Problem" },
+				"401": { "$ref": "#/components/responses/Problem" },
+				"403": { "$ref": "#/components/responses/Problem" },
+				"404": { "$ref": "#/components/responses/Problem" },
+				"409": { "$ref": "#/components/responses/Problem" },
+				"default": { "$ref": "#/components/responses/Problem" }
+			}
+		} },
 		"/api/v1/capabilities/{capability_id}/versions/{version}/content": { "get": {
 			"operationId": "lookupCapabilityContent",
 			"summary": "Return the Content of one Version of a Capability.",
@@ -3412,6 +3449,34 @@ const COMMANDS = deriveCommands({
 				},
 				"additionalProperties": false
 			},
+			"DeriveCapabilityVersionRequest": {
+				"type": "object",
+				"required": ["edits"],
+				"properties": { "edits": {
+					"type": "array",
+					"description": "Entries to replace in the baseline package. Paths must be unique\nand must exist as non-directory entries of the baseline package.\n",
+					"minItems": 1,
+					"maxItems": 200,
+					"items": { "$ref": "#/components/schemas/DeriveCapabilityVersionEdit" }
+				} },
+				"additionalProperties": false
+			},
+			"DeriveCapabilityVersionEdit": {
+				"type": "object",
+				"required": ["path", "content"],
+				"properties": {
+					"path": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4096
+					},
+					"content": {
+						"type": "string",
+						"description": "UTF-8 text. The server enforces 256 KiB per entry and 1 MiB for\nthe whole request by UTF-8 byte length.\n"
+					}
+				},
+				"additionalProperties": false
+			},
 			"Capability": {
 				"type": "object",
 				"required": [

package/dist/{commands-_R93Y2z-.mjs → commands-KKAq0m6z.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-r53AMymQ.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-yVsOzNKU.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-DgHX7Fux.mjs";
 import { t as collectPages } from "./pagination-BXyFxGYA.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.6.0";
+var version = "0.7.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -7075,7 +7075,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-_R93Y2z-.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-KKAq0m6z.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7155,7 +7155,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7183,7 +7183,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-B92ip3mJ.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-BH59pgRw.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);

package/dist/{skills-B92ip3mJ.mjs → skills-BH59pgRw.mjs}

@@ -241,12 +241,12 @@ function readSkillPackage(buffer) {
 		if (seen.has(folded)) throw invalid$1(`entry ${JSON.stringify(name)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid$1("the package has no SKILL.md");
-	if (manifests.length > 1) throw invalid$1(`the package has more than one SKILL.md: ${manifests.map((entry) => entry.name).join(", ")}`);
 	const root = packageRoot$1(names);
 	const expectedManifest = `${root}SKILL.md`;
-	if (manifests[0]?.name !== expectedManifest) throw invalid$1(`found ${manifests[0]?.name}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!files.find((entry) => entry.name === expectedManifest)) {
+		const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
+		throw invalid$1(manifests.length === 0 ? "the package has no SKILL.md" : `found ${manifests.map((entry) => entry.name).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	let actualBytes = 0;
 	const entries = [];
 	let manifest;
@@ -455,11 +455,11 @@ async function packageSkillDirectory(dir) {
 		if (seen.has(folded)) throw invalid(`entry ${JSON.stringify(entry.path)} appears more than once`);
 		seen.add(folded);
 	}
-	const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
-	if (manifests.length === 0) throw invalid("the directory has no SKILL.md");
-	if (manifests.length > 1) throw invalid(`the directory has more than one SKILL.md: ${manifests.map((entry) => entry.path).join(", ")}`);
 	const expected = `${packageRoot(entries.map((entry) => entry.path))}SKILL.md`;
-	if (manifests[0]?.path !== expected) throw invalid(`found ${manifests[0]?.path}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	if (!entries.some((entry) => entry.path === expected)) {
+		const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
+		throw invalid(manifests.length === 0 ? "the directory has no SKILL.md" : `found ${manifests.map((entry) => entry.path).join(", ")}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	}
 	return {
 		zip: buildZip(entries),
 		fileCount: entries.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hngr",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The Hangar CLI: install skills and MCP servers into coding agents, and drive the Management API.",
   "keywords": [
     "hangar",