@hasna/skills 0.10.45 → 0.10.47

package/dist/server/skills-api.d.ts

@@ -163,5 +163,6 @@ export declare function readSkillVersion(store: SkillsProductStore, principal: A
 export declare function readSkillVersionBundle(store: SkillsProductStore, artifactStorage: ArtifactStorage, principal: ApiPrincipal, slug: string, version: string): Promise<{
     version: ServerSkillVersion;
     bytes: OwnedBytes;
+    authorizationEpoch?: string;
 }>;
 export {};

package/dist/server/types.d.ts

@@ -217,6 +217,8 @@ export interface ServerSkillRecord {
      */
     tombstonedAt?: string;
     tombstonePurgeAfter?: string;
+    /** Changes on lifecycle breaks, not ordinary immutable-version publication. */
+    authorizationEpoch?: string;
     /** Catalog lifecycle state. Archived rows retain versions and bundles for explicit reads. */
     lifecycle: "active" | "archived";
     archivedAt?: string;
@@ -286,7 +288,7 @@ export interface PublishedSkillSelection {
 }
 /** Metadata only: bundle availability means its tenant-owned storage row exists. */
 export interface PublishedSkillSelectionState extends PublishedSkillSelection {
-    current: Pick<ServerSkillRecord, "lifecycle" | "tombstonedAt"> | null;
+    current: Pick<ServerSkillRecord, "lifecycle" | "tombstonedAt" | "authorizationEpoch"> | null;
     versionBundleSha256: string | null;
     bundleAvailable: boolean;
 }

package/dist/types/skill-selection.d.ts

@@ -19,6 +19,8 @@ export interface SkillProfile {
     updatedAt: string;
 }
 export interface ResolvedSkillSelection extends SkillSelection {
+    /** Server-minted lifecycle fence, absent on legacy authorities/snapshots. */
+    authorizationEpoch?: string;
     authority: string;
     workspaceId: string;
     profileRevision: string;

package/migrations/postgres/0011_skill_authorization_epoch.sql

@@ -0,0 +1,22 @@
+-- A new baseline is current authorization, never evidence of historical continuity.
+-- Clients lacking a recorded epoch may adopt one only from exact-current selections.
+ALTER TABLE skills_registry ADD COLUMN authorization_epoch text NOT NULL
+  DEFAULT replace(gen_random_uuid()::text, '-', '')
+  CHECK (authorization_epoch ~ '^[a-f0-9]{32}$');
+
+CREATE FUNCTION skills_registry_authorization_epoch() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    NEW.authorization_epoch := replace(gen_random_uuid()::text, '-', '');
+  ELSIF (OLD.tombstoned_at IS NULL AND NEW.tombstoned_at IS NOT NULL)
+        OR OLD.lifecycle IS DISTINCT FROM NEW.lifecycle THEN
+    NEW.authorization_epoch := replace(gen_random_uuid()::text, '-', '');
+  ELSE
+    NEW.authorization_epoch := OLD.authorization_epoch;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+CREATE TRIGGER skills_registry_authorization_epoch
+  BEFORE INSERT OR UPDATE ON skills_registry
+  FOR EACH ROW EXECUTE FUNCTION skills_registry_authorization_epoch();

package/migrations/sqlite/0011_skill_authorization_epoch.sql

@@ -0,0 +1,17 @@
+-- Snapshot epochs are server-owned. This baseline does not backfill local receipts.
+ALTER TABLE skills_registry ADD COLUMN authorization_epoch text;
+UPDATE skills_registry SET authorization_epoch = lower(hex(randomblob(16)));
+CREATE TRIGGER skills_registry_authorization_epoch_insert
+  AFTER INSERT ON skills_registry
+  BEGIN
+    UPDATE skills_registry SET authorization_epoch = lower(hex(randomblob(16)))
+      WHERE org_id = NEW.org_id AND slug = NEW.slug;
+  END;
+CREATE TRIGGER skills_registry_authorization_epoch_lifecycle
+  AFTER UPDATE OF tombstoned_at, lifecycle ON skills_registry
+  WHEN (OLD.tombstoned_at IS NULL AND NEW.tombstoned_at IS NOT NULL)
+       OR OLD.lifecycle IS NOT NEW.lifecycle
+  BEGIN
+    UPDATE skills_registry SET authorization_epoch = lower(hex(randomblob(16)))
+      WHERE org_id = NEW.org_id AND slug = NEW.slug;
+  END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.45",
+  "version": "0.10.47",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {