v0.3.0

Minor Changes

• 39179a9: Add a client-side-js skill covering how to serve client-side JavaScript modules. Val Town has no build step, so this explains the actual mechanics agents otherwise have to reverse-engineer: serveFile transpiling .ts/.tsx/.jsx to browser-ready JS per request, loading a module with <script type="module">, how the browser resolves local imports (explicit extensions) and third-party deps (full ESM URLs), and the esm.town direct-serve alternative. Fills a gap between react-ui (JSX/styling conventions) and http-endpoints (handler/CORS), and is framework-agnostic.

• e6d1ac8: Add a restricted-access skill covering app access (httpPrivacy) — the axis that controls who can call a val's HTTP endpoints, independent of the privacy setting that controls who can read its code. Explains what agents can't infer from a failed request: access is granted to whole organizations (a viewer needs a grant and membership in the granted org, rechecked on every request), so an unauthenticated caller gets a 302 to a login page rather than the val's response — which surfaces as fetch_val_endpoint refusing to follow a redirect, or an API client receiving login HTML where it expected JSON, neither of which is a bug in the val's code. Also covers project-scoped bypass tokens for webhooks and other machine callers, and the X-Val-Town-User → GET /v3/val/viewer exchange for identifying a human viewer inside a restricted val.

  The most consequential piece is disambiguation from std/oauth: both answer "make my app require a login," but restricted access gates at the platform edge before your code runs and admits organizations, while std/oauth runs inside the val and gives it its own logged-in users. Applying both to one val makes visitors authenticate twice. The oauth skill gains a reciprocal pointer, and http-endpoints no longer describes an endpoint URL as unconditionally public.

• cfd550a: Adds a skill for creating new skills

• 4715341: Remove the templates skill. Its catalog of official starters is now served live by the Val Town find_templates tool (which lists the public vals under the templates org), so a hand-maintained catalog in this package is no longer needed and would only drift. The remix/template guidance it carried lives in the app's system prompt and the find_templates tool description.

Patch Changes

• d14627f: Teach the immutable asset-caching pattern (serveImmutableFile / immutableFileUrl from std/utils) in the client-side-js, http-endpoints, and react-ui skills: the never-cached HTML shell stamps /__immutable/<version>/... URLs, served with Cache-Control: immutable; publishing bumps the version, invalidating automatically (old-version URLs 404). Measured: repeat visits 665ms → 157ms with zero asset requests.