@hasna/skills 0.1.62 → 0.1.64

package/bin/migrate.js

@@ -59,8 +59,10 @@ function resolveServerConfig(env = process.env) {
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
     inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
     requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
     skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
     publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
     nodeEnv,
     allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
@@ -273,6 +275,7 @@ var ANY_SEGMENT_EXCLUDES = new Set([
   ".docker"
 ]);
 var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
 var CREDENTIAL_FILENAMES = new Set([
   ".npmrc",
   ".pypirc",
@@ -412,6 +415,7 @@ function rowToRun(row) {
     ...typeof row.idempotency_key === "string" ? { idempotencyKey: row.idempotency_key } : {},
     correlationId: String(row.correlation_id),
     costCents: Number(row.cost_cents ?? 0),
+    leaseGeneration: Number(row.lease_generation ?? 0),
     ...typeof row.output_type === "string" ? { outputType: row.output_type } : {},
     ...typeof row.output_preview === "string" ? { outputPreview: row.output_preview } : {},
     ...typeof row.error_code === "string" ? { errorCode: row.error_code } : {},
@@ -443,6 +447,8 @@ function rowToArtifact(row) {
     storageKind: String(row.storage_kind),
     ...typeof row.storage_key === "string" ? { storageKey: row.storage_key } : {},
     ...typeof row.body_text === "string" ? { bodyText: row.body_text } : {},
+    visibility: String(row.visibility ?? "private") === "public" ? "public" : "private",
+    ...row.expires_at ? { expiresAt: dateString(row.expires_at) } : {},
     createdAt: dateString(row.created_at)
   };
 }
@@ -462,7 +468,20 @@ function rowToSkill(row) {
     ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
     ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
     createdAt: dateString(row.created_at),
-    updatedAt: dateString(row.updated_at)
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
   };
 }
 function rowToSkillBundle(row) {
@@ -514,9 +533,61 @@ function dateString(value) {
   return String(value);
 }
 
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId2, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId2;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
+  }
+}
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
+// src/lib/revision.ts
+import { createHash as createHash2 } from "crypto";
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash2("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
+}
+
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 var LAST_USED_RESOLUTION_MS = 60000;
 
 class SqliteSkillsStore {
@@ -536,12 +607,24 @@ class SqliteSkillsStore {
     if (options.migrate !== false) {
       applySqliteMigrations(this.db, options.migrationsDir);
     }
+    this.backfillLegacyRevisions();
     this.backend = {
       kind: "sqlite",
       durable: !inMemory,
       label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
     };
   }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
   get database() {
     return this.db;
   }
@@ -648,7 +731,8 @@ class SqliteSkillsStore {
       const id = String(candidate.id);
       const now = nowIso();
       const result = this.db.run(`UPDATE skills_runs
-         SET status = 'running', started_at = COALESCE(started_at, ?), locked_by = ?, locked_at = ?
+         SET status = 'running', started_at = COALESCE(started_at, ?), locked_by = ?, locked_at = ?,
+             lease_generation = lease_generation + 1
          WHERE id = ? AND status IN (${CLAIMABLE_STATUSES.map(() => "?").join(", ")})`, [now, workerId, now, id, ...CLAIMABLE_STATUSES]);
       if (result.changes !== 1) {
         this.db.exec("ROLLBACK");
@@ -687,6 +771,33 @@ class SqliteSkillsStore {
     ]);
     return row ? rowToRun(row) : null;
   }
+  async transitionRun(id, patch, expectedGeneration) {
+    const current = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
+    if (!current)
+      return null;
+    const stored = rowToRun(current);
+    if (stored.leaseGeneration !== expectedGeneration) {
+      throw new StaleLeaseGenerationError(id, expectedGeneration, stored.leaseGeneration, stored.status);
+    }
+    const run = { ...stored, ...patch };
+    const row = this.get(`UPDATE skills_runs
+       SET status = ?, output_type = ?, output_preview = ?, error_code = ?, error_message = ?, started_at = ?, completed_at = ?,
+           lease_generation = ?
+       WHERE id = ? AND lease_generation = ?
+       RETURNING *`, [
+      run.status,
+      run.outputType ?? null,
+      run.outputPreview ?? null,
+      run.errorCode ?? null,
+      run.errorMessage ?? null,
+      run.startedAt ?? null,
+      run.completedAt ?? null,
+      run.leaseGeneration,
+      id,
+      expectedGeneration
+    ]);
+    return row ? rowToRun(row) : null;
+  }
   async appendLog(id, orgId, level, message) {
     const row = this.get(`INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message, created_at)
        VALUES (?, ?, (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ?), ?, ?, ?)
@@ -700,8 +811,8 @@ class SqliteSkillsStore {
        ORDER BY l.sequence ASC`, [principal.orgId, id]).map(rowToLog);
   }
   async addArtifact(artifact) {
-    const row = this.get(`INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    const row = this.get(`INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        RETURNING *`, [
       artifact.id,
       artifact.runId,
@@ -714,6 +825,8 @@ class SqliteSkillsStore {
       artifact.storageKind,
       artifact.storageKey ?? null,
       artifact.bodyText ?? null,
+      artifact.visibility,
+      artifact.expiresAt ?? null,
       nowIso()
     ]);
     return rowToArtifact(row);
@@ -735,8 +848,29 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -757,8 +891,8 @@ class SqliteSkillsStore {
         ]);
       }
       const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
          ON CONFLICT (org_id, slug) DO UPDATE SET
            display_name = excluded.display_name,
            description = excluded.description,
@@ -776,7 +910,16 @@ class SqliteSkillsStore {
            bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
            bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
            published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
+         WHERE skills_registry.tombstoned_at IS NOT NULL
+            OR skills_registry.revision_id = ?
          RETURNING *`, [
         orgId,
         input.slug,
@@ -787,62 +930,165 @@ class SqliteSkillsStore {
         input.source,
         input.kind,
         input.version ?? null,
-        input.skillMd ?? null,
+        carriedSkillMd,
         input.bundle?.sha256 ?? null,
         input.bundle?.byteSize ?? null,
         input.principal.userId,
+        revisionId,
+        now,
         now,
-        now
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
       return rowToSkill(row);
     })();
   }
   async listSkills(principal) {
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const row = this.get(`UPDATE skills_registry
-       SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?, updated_at = ?
-       WHERE org_id = ? AND slug = ?
-       RETURNING *`, [
-      next.displayName,
-      next.description,
-      next.category,
-      JSON.stringify(next.tags),
-      next.kind,
-      next.version ?? null,
-      next.skillMd ?? null,
-      nowIso(),
-      principal.orgId,
-      slug
-    ]);
-    return row ? rowToSkill(row) : null;
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next.displayName,
+        next.description,
+        next.category,
+        JSON.stringify(next.tags),
+        next.kind,
+        next.version ?? null,
+        next.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return this.db.transaction(() => {
-      const existing = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       if (!existing)
-        return false;
-      this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (typeof existing.bundle_sha256 === "string")
-        this.collectOrphanBundle(principal.orgId, existing.bundle_sha256);
-      return true;
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
     })();
   }
   async getSkillBundle(principal, sha256) {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)