v0.2.0
The registry
- api
- registries
- security
The registry came to life behind a single typed contract, served as both an RPC endpoint and a REST + OpenAPI façade:
- Auth — browser device-flow sign-in and scoped API tokens
(
skh_live_…), behind a role-based permission model. - Safe publish — every publish runs the security scanner and enforces the archive limits; path-traversal, symlinks, and oversized or too-deep archives are rejected before anything is stored.
- Resolve and sync — skills, versions, dist-tags, orgs, registries, skillsets, and a sync manifest, all queryable, with full-text search across what you can read.
- Private by default, with the "not found, never forbidden" rule — you never learn that something exists if you're not allowed to see it.