@hasna/skills 0.1.64 → 0.1.66

package/bin/worker.js

@@ -32848,23 +32848,40 @@ function concat(chunks) {
   return merged;
 }
 
-// src/server/auth.ts
-import { createHash as createHash3 } from "crypto";
-function hashApiKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
-}
-function publicPrincipal(partial = {}) {
-  return {
-    apiKeyId: partial.apiKeyId || "key_dev",
-    orgId: partial.orgId || "org_dev",
-    orgSlug: partial.orgSlug || "dev",
-    orgName: partial.orgName || "Development",
-    userId: partial.userId || "user_dev",
-    email: partial.email || "dev@example.com",
-    role: partial.role || "owner",
-    scopes: partial.scopes || ["skills:read", "runs:write"]
-  };
-}
+// src/sdk/governance.ts
+var DEFAULT_OUTPUT_GOVERNANCE = {
+  defaultVisibility: "private",
+  redactPatterns: [
+    /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+    /\bsk_[A-Za-z0-9_-]{8,}\b/g,
+    /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+    /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+    /\bAKIA[A-Z0-9]{12,}\b/g,
+    /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+    /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
+    /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
+  ],
+  perOutputBytes: 10 * 1024 * 1024,
+  perRunTotalBytes: 100 * 1024 * 1024,
+  artifactTtlSeconds: 30 * 24 * 60 * 60
+};
+var DEFAULT_RUN_QUOTA = {
+  cpu: 1,
+  memoryMB: 2048,
+  durationSeconds: 3600,
+  networkMB: 100,
+  artifactBytes: 100 * 1024 * 1024
+};
+
+// src/server/database-url.ts
+import { isAbsolute, join as join3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { homedir as homedir2 } from "os";
 
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
@@ -32901,54 +32918,7 @@ function assertNoRetiredModeEnvVars(env, options) {
   throw new RetiredSettingError(names[0], `${names.join(", ")} ${names.length === 1 ? "is" : "are"} no longer read. ` + "Deployment modes were removed: where a server keeps its data is decided by the " + `database it is given, not by a declared label. Set ${options.replacement} to a ` + "postgres:// URL to use PostgreSQL, or leave it unset for the on-box SQLite database. " + `Then unset ${names.join(" and ")}. ` + "Refused rather than ignored, because a discarded setting looks exactly like a " + "working one until something needs the data.");
 }
 
-// src/server/config.ts
-var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
-var SKILLS_ENV_NAMESPACE = "SKILLS";
-function resolveServerConfig(env = process.env) {
-  assertNoRetiredModeEnvVars(env, {
-    app: SKILLS_ENV_NAMESPACE,
-    replacement: DATABASE_URL_ENV
-  });
-  const nodeEnv = env.NODE_ENV || "development";
-  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
-  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
-  return {
-    host,
-    port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
-    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
-    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
-    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
-    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
-    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
-    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
-    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
-    nodeEnv,
-    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
-  };
-}
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function normalizePrefix(value) {
-  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
-}
-
-// src/server/database-url.ts
-import { isAbsolute, join as join3 } from "path";
-import { fileURLToPath } from "url";
-
 // src/lib/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
 function mergeDirectoryContents(sourceDir, targetDir) {
   if (!existsSync(sourceDir))
     return;
@@ -33059,39 +33029,66 @@ function looksLikeSqlitePath(value) {
   return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
 }
 
-// src/server/handlers.ts
-import { createHash as createHash5 } from "crypto";
+// src/server/sqlite-store.ts
+import { Database } from "bun:sqlite";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 
-// src/server/store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+// src/server/auth.ts
+import { createHash as createHash3 } from "crypto";
+function hashApiKey(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+function publicPrincipal(partial = {}) {
+  return {
+    apiKeyId: partial.apiKeyId || "key_dev",
+    orgId: partial.orgId || "org_dev",
+    orgSlug: partial.orgSlug || "dev",
+    orgName: partial.orgName || "Development",
+    userId: partial.userId || "user_dev",
+    email: partial.email || "dev@example.com",
+    role: partial.role || "owner",
+    scopes: partial.scopes || ["skills:read", "runs:write"]
+  };
+}
 
-// src/server/types.ts
-class StaleLeaseGenerationError extends Error {
-  runId;
-  expectedGeneration;
-  currentGeneration;
-  status;
-  constructor(runId, expectedGeneration, currentGeneration, status) {
-    super(`late transition rejected for run ${runId}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
-    this.name = "StaleLeaseGenerationError";
-    this.runId = runId;
-    this.expectedGeneration = expectedGeneration;
-    this.currentGeneration = currentGeneration;
-    this.status = status;
+// src/server/migrations-dir.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var MIGRATION_DIALECTS = ["postgres", "sqlite"];
+var MAX_WALK_UP = 6;
+function findMigrationsRoot(startDirs = defaultStartDirs()) {
+  for (const start of startDirs) {
+    let dir = start;
+    for (let level = 0;level < MAX_WALK_UP; level += 1) {
+      const candidate = join4(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
+        return candidate;
+      const parent = dirname3(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
   }
+  return null;
 }
-
-class SkillRevisionConflictError extends Error {
-  slug;
-  expectedRevisionId;
-  currentRevisionId;
-  constructor(slug, expectedRevisionId, currentRevisionId) {
-    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
-    this.name = "SkillRevisionConflictError";
-    this.slug = slug;
-    this.expectedRevisionId = expectedRevisionId;
-    this.currentRevisionId = currentRevisionId;
+function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
+  if (!root3) {
+    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
+  const dir = join4(root3, dialect);
+  if (!existsSync2(dir)) {
+    throw new Error(`migrations directory not found: ${dir}`);
+  }
+  return dir;
+}
+function defaultStartDirs() {
+  const dirs = [import.meta.dir];
+  const cwd = process.cwd();
+  if (cwd && cwd !== import.meta.dir)
+    dirs.push(cwd);
+  return dirs;
 }
 
 // src/server/rows.ts
@@ -33239,6 +33236,35 @@ function dateString(value) {
   return String(value);
 }
 
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId2, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId2;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
+  }
+}
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
 function revisionIdOf(content) {
@@ -33261,50 +33287,6 @@ function revisionIdOfRecord(record) {
   return revisionIdOf(record);
 }
 
-// src/server/sqlite-store.ts
-import { Database } from "bun:sqlite";
-import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/server/migrations-dir.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-var MIGRATION_DIALECTS = ["postgres", "sqlite"];
-var MAX_WALK_UP = 6;
-function findMigrationsRoot(startDirs = defaultStartDirs()) {
-  for (const start of startDirs) {
-    let dir = start;
-    for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join4(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
-        return candidate;
-      const parent = dirname3(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
-  }
-  return null;
-}
-function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
-  if (!root3) {
-    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
-  }
-  const dir = join4(root3, dialect);
-  if (!existsSync2(dir)) {
-    throw new Error(`migrations directory not found: ${dir}`);
-  }
-  return dir;
-}
-function defaultStartDirs() {
-  const dirs = [import.meta.dir];
-  const cwd = process.cwd();
-  if (cwd && cwd !== import.meta.dir)
-    dirs.push(cwd);
-  return dirs;
-}
-
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
@@ -33895,7 +33877,51 @@ function parseScopes(value) {
   }
 }
 
+// src/server/config.ts
+var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
+var SKILLS_ENV_NAMESPACE = "SKILLS";
+function resolveServerConfig(env = process.env) {
+  assertNoRetiredModeEnvVars(env, {
+    app: SKILLS_ENV_NAMESPACE,
+    replacement: DATABASE_URL_ENV
+  });
+  const nodeEnv = env.NODE_ENV || "development";
+  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
+  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
+  return {
+    host,
+    port,
+    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
+    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
+    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
+    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
+    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    nodeEnv,
+    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
+  };
+}
+function localOrigin(host, port) {
+  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizePrefix(value) {
+  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
+}
+
+// src/server/handlers.ts
+import { createHash as createHash5 } from "crypto";
+
 // src/server/store.ts
+import { randomUUID as randomUUID3 } from "crypto";
 function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
   return {
     slug: input.slug,
@@ -34298,17 +34324,17 @@ class PostgresSkillsStore {
     });
   }
   async createRun(input) {
-    if (input.idempotencyKey) {
-      const existing = await this.sql`
-        SELECT * FROM skills_runs
-        WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
-        LIMIT 1
-      `;
-      if (existing[0])
-        return rowToRun(existing[0]);
-    }
-    const id = runId();
     return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
         VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
@@ -34850,7 +34876,9 @@ async function completeRun(store, run, preview) {
   return next ?? run;
 }
 async function failRun(store, run, code, message) {
-  await store.appendLog(run.id, run.orgId, "error", message);
+  try {
+    await store.appendLog(run.id, run.orgId, "error", message);
+  } catch {}
   const next = await fencedTransition(store, run, {
     status: "failed",
     errorCode: code,
@@ -34864,7 +34892,9 @@ async function fencedTransition(store, run, patch) {
     return store.updateRun(run.id, patch);
   const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
   if (!next) {
-    await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    try {
+      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    } catch {}
   }
   return next;
 }

package/dist/index.d.ts

@@ -31,6 +31,6 @@ export { SKILLS_CLI_MCP_PARITY, findSkillsParityForCliCommand, findSkillsParityF
 export { createRegistrySyncArtifact, writeRegistrySyncArtifact, type RegistrySyncArtifact, type RegistrySyncOptions, type RegistrySyncSkill, } from "./lib/registry-sync.js";
 export { MCP_CONTRACT_SCHEMA_VERSION, createMcpContractManifest, createSkillMcpMetadata, describeMcpToolContracts, getMcpResourceContracts, getMcpToolDescriptions, listMcpToolContracts, summarizeMcpToolContract, type DescribedMcpToolContract, type JsonSchemaObject, type McpContractManifest, type McpResourceContract, type McpToolCategory, type McpToolContract, type McpToolSideEffect, type SkillMcpMetadata, type SkillMcpSchemaContract, type UnknownMcpToolContract, } from "./lib/mcp-contracts.js";
 export { getFeedbackDbPath, saveFeedback, type FeedbackCategory, type FeedbackInput, type FeedbackResult, } from "./lib/feedback.js";
-export { SKILLS_NATIVE_STORAGE_ENV, SKILLS_NATIVE_STORAGE_FALLBACK_ENV, SKILLS_STORAGE_ENV, SKILLS_STORAGE_FALLBACK_ENV, SKILLS_STORAGE_TABLES, STORAGE_TABLES, SkillsPostgresSyncStore, SkillsS3ObjectStore, buildSkillsS3ObjectUrl, createSkillsPostgresSyncStore, createSkillsS3ObjectStore, createSkillsSnapshotSyncRecord, exportSkillsLocalSnapshot, getSkillsNativeStorageStatus, getSkillsStorageDatabaseEnv, getSkillsStorageDatabaseUrl, getSkillsStorageStatus, getStorageDatabaseEnv, getStorageDatabaseUrl, getStorageStatus, importSkillsLocalSnapshot, planSkillsS3SnapshotUpload, resolveSkillsNativeStorageConfig, resolveStorageConfig, signSkillsAwsV4Request, skillsPostgresSyncSchemaSql, uploadSkillsSnapshotFilesToS3, type AwsCredentials, type SignSkillsAwsV4RequestOptions, type SkillsFetch, type SkillsLocalSnapshot, type SkillsNativeStorageConfig, type SkillsNativeStorageStatus, type SkillsPostgresQueryClient, type SkillsS3ObjectStoreOptions, type SkillsS3PutObjectOptions, type SkillsS3SnapshotPlanEntry, type SkillsS3StoredObject, type SkillsSnapshotFile, type SkillsStorageTable, type SkillsSyncRecord, } from "./lib/native-storage.js";
+export { SKILLS_NATIVE_STORAGE_ENV, SKILLS_NATIVE_STORAGE_FALLBACK_ENV, SKILLS_STORAGE_ENV, SKILLS_STORAGE_FALLBACK_ENV, SKILLS_STORAGE_TABLES, STORAGE_TABLES, SkillsPostgresSyncStore, SkillsS3ObjectStore, buildSkillsS3ObjectUrl, createSkillsPostgresSyncStore, createSkillsS3ObjectStore, createSkillsSnapshotSyncRecord, exportSkillsLocalSnapshot, getSkillsNativeStorageStatus, getSkillsStorageDatabaseEnv, getSkillsStorageDatabaseUrl, getSkillsStorageStatus, getStorageDatabaseEnv, getStorageDatabaseUrl, getStorageStatus, importSkillsLocalSnapshot, planSkillsS3SnapshotUpload, resolveSkillsNativeStorageConfig, resolveStorageConfig, signSkillsAwsV4Request, skillsPostgresSyncSchemaSql, storageCapabilities, uploadSkillsSnapshotFilesToS3, type AwsCredentials, type SignSkillsAwsV4RequestOptions, type SkillsFetch, type SkillsLocalSnapshot, type SkillsNativeStorageConfig, type SkillsNativeStorageStatus, type SkillsPostgresQueryClient, type SkillsS3ObjectStoreOptions, type SkillsS3PutObjectOptions, type SkillsS3SnapshotPlanEntry, type SkillsS3StoredObject, type SkillsSnapshotFile, type SkillsStorageTable, type SkillsSyncRecord, } from "./lib/native-storage.js";
 export { SKILL_ALIASES, normalizeSkillSlug, resolveSkillAlias, type SkillAlias, } from "./lib/skill-aliases.js";
 export type { SkillResponse, SkillDetailResponse, CategoryResponse, TagResponse, InstallResponse, RemoveResponse, VersionResponse, ExportResponse, ImportResponse, SearchResponse, CategoryInstallResponse, ErrorResponse, } from "./types/api.js";