postmark

Run uv run "$HERE/scripts/invoke.py" — $HERE is the directory that holds this SKILL.md — with everything the user typed after the Skill name, verbatim and however many lines, on stdin. Exit 0: do what it prints. On any other exit, if you introduced a known construction error and can correct it while preserving the user's request and authority, account for effects already produced, submit the corrected invocation through the same shim, and continue from the failed boundary; a refusal before the operation starts consumes no operation. Otherwise show what it printed to the user verbatim and stop. Never repair input the user supplied, or automatically retry exact help, an unmet dependency, an unrelated failure, or a failure whose origin or valid correction is unknown.

Arguments

path is empty for the root form, ["setup"] or ["status"] otherwise. The root form's request is the instruction; with none, use the task established in the conversation, and if there is none, ask what the user wants done at Postmark.
Under setup, the first operand is the literal word account or the literal word server. After server, the second operand is the server's name exactly as Postmark shows it, spaces included.
--yes on setup asserts that the user means to replace a token the Credential File already holds — the rotation path. Where the account token is held, rotating a server's token is regenerating it in Postmark and running /postmark setup --yes server <name>, which fetches the new one; any other token is regenerated in Postmark, copied, and stored with setup --yes through the clipboard.

Tokens and the Credential File

Postmark issues a server token per server, which authorizes that one server's sending, templates, message streams, bounces, statistics, suppressions, message search and webhooks, and an account token, which authorizes servers, domains, sender signatures and data removals across the account. The Credential File, ~/.kntnt/postmark/credentials.json, holds the account token under account-token and each server token under server:<name>. The engine $HERE/scripts/postmark.py reads it and puts a token in its header and nowhere else. A credential Postmark returns in an answer — a server's ApiTokens and a webhook's HttpAuth password — the engine prints as [redacted], so a server's token reaches the Credential File only through setup server — read from the clipboard, or fetched by the engine's setup-server and handed to the Library over standard input — and never off a printed answer.

Never read, print or copy the Credential File yourself, and never ask the user to paste a token into the conversation. uv run "$LIBRARY/scripts/credentials.py" show --skill=postmark names the keys it holds and never a value.