@hasna/skills 0.10.46 → 0.10.47

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.46",
+  version: "0.10.47",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -976,6 +976,7 @@ function rowToSkill(row) {
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
     ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
     lifecycle: row.lifecycle === "archived" ? "archived" : "active",
     ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
     ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
@@ -987,6 +988,7 @@ function rowToPublishedSelectionState(row) {
     slug: String(row.slug),
     version: String(row.version),
     current: row.skill_exists ? {
+      ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
       lifecycle: row.lifecycle === "archived" ? "archived" : "active",
       ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {}
     } : null,
@@ -1636,7 +1638,7 @@ class SqliteSkillsStore {
           continue;
         insertTag.run(orgId, input.slug, tag);
       }
-      return rowToSkill(row);
+      return this.getSkillSync(input.principal, input.slug);
     })();
   }
   async listSkills(principal) {
@@ -1673,7 +1675,7 @@ class SqliteSkillsStore {
       const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
       if (!row)
         throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     }).immediate();
   }
   getSkillSync(principal, slug) {
@@ -1744,7 +1746,7 @@ class SqliteSkillsStore {
          SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
          WHERE org_id = ? AND slug = ?
          RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     })();
   }
   async purgeExpiredTombstones(principal) {
@@ -1781,7 +1783,7 @@ class SqliteSkillsStore {
       return [];
     const requested = JSON.stringify(selections2.map(({ slug, version }) => ({ slug, version })));
     return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
-         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
          v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
        FROM json_each(?) q
        LEFT JOIN skills_registry r ON r.org_id = ? AND r.slug = json_extract(q.value, '$.slug')

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.46",
+  version: "0.10.47",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -35189,6 +35189,7 @@ function rowToSkill(row) {
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
     ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
     lifecycle: row.lifecycle === "archived" ? "archived" : "active",
     ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
     ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
@@ -35200,6 +35201,7 @@ function rowToPublishedSelectionState(row) {
     slug: String(row.slug),
     version: String(row.version),
     current: row.skill_exists ? {
+      ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
       lifecycle: row.lifecycle === "archived" ? "archived" : "active",
       ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {}
     } : null,
@@ -35862,7 +35864,7 @@ class SqliteSkillsStore {
           continue;
         insertTag.run(orgId, input.slug, tag);
       }
-      return rowToSkill(row);
+      return this.getSkillSync(input.principal, input.slug);
     })();
   }
   async listSkills(principal) {
@@ -35899,7 +35901,7 @@ class SqliteSkillsStore {
       const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
       if (!row)
         throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     }).immediate();
   }
   getSkillSync(principal, slug) {
@@ -35970,7 +35972,7 @@ class SqliteSkillsStore {
          SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
          WHERE org_id = ? AND slug = ?
          RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     })();
   }
   async purgeExpiredTombstones(principal) {
@@ -36007,7 +36009,7 @@ class SqliteSkillsStore {
       return [];
     const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
     return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
-         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
          v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
        FROM json_each(?) q
        LEFT JOIN skills_registry r ON r.org_id = ? AND r.slug = json_extract(q.value, '$.slug')
@@ -37409,7 +37411,7 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
   if (actual !== found.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
-  return { version: found, bytes };
+  return { version: found, bytes, authorizationEpoch: resolved.record.authorizationEpoch };
 }
 function publishVersionOf(manifest) {
   const version2 = optionalString(manifest.version);
@@ -37649,6 +37651,7 @@ async function validatePublished(store, principal, selections2) {
     if (!state2.bundleAvailable)
       throw new SkillRequestError(503, "SELECTION_BUNDLE_UNAVAILABLE", "Selected bundle is unavailable");
   }
+  return states;
 }
 async function body2(request, limit) {
   if (!request.body)
@@ -37709,6 +37712,7 @@ async function handleProfileApi(store, principal, request, parts, config) {
       capabilities: [
         "skills.registry",
         "skills.versions",
+        "skills.session-pin-renewal",
         ...store.selectionStore && store.executionGrantStore ? ["skills.execution-grants"] : [],
         ...store.selectionStore ? ["skills.profiles", "skills.station-state"] : []
       ],
@@ -37754,6 +37758,7 @@ async function handleProfileApi(store, principal, request, parts, config) {
     const authority2 = skillsApiRequestUrl(normalizeSkillsApiOrigin(config.publicBaseUrl), "/api/v1/").replace(/\/+$/, "");
     const revision = "x".repeat(128);
     const projected = resolvedProfileSnapshot({ id, workspaceId: principal.orgId, revision, selections: selections2 }, authority2);
+    projected.selections = projected.selections.map((selection2) => ({ ...selection2, authorizationEpoch: "0".repeat(32) }));
     if (profileDocumentBytes(projected) > MAX_RESOLVED_PROFILE_BYTES || profileDocumentBytes({ profileId: id, profileRevision: revision, selections: selections2 }) > Math.min(config.requestBodyLimitBytes, MAX_PROFILE_DOCUMENT_BYTES)) {
       throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "The complete resolved profile and station/session receipts must fit the advertised profile limits");
     }
@@ -37775,7 +37780,17 @@ async function handleProfileApi(store, principal, request, parts, config) {
     const result = resolvedProfileSnapshot(profile2, authority2);
     if (result.selections.length > MAX_PROFILE_SELECTIONS || profileDocumentBytes(result) > MAX_RESOLVED_PROFILE_BYTES)
       throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "Resolved profile exceeds the advertised profile limits");
-    await validatePublished(store, principal, profile2.selections);
+    const states = await validatePublished(store, principal, profile2.selections);
+    if (new URL(request.url).searchParams.get("pinAuthorization") === "epoch-v1") {
+      result.selections = result.selections.map((selection2, index) => {
+        const epoch = states[index].current?.authorizationEpoch;
+        if (!epoch || !/^[a-f0-9]{32}$/.test(epoch))
+          throw new SkillRequestError(503, "PIN_AUTHORIZATION_UNAVAILABLE", "The selection lifecycle fence is unavailable");
+        return { ...selection2, authorizationEpoch: epoch };
+      });
+    }
+    if (profileDocumentBytes(result) > MAX_RESOLVED_PROFILE_BYTES)
+      throw new SkillRequestError(413, "PROFILE_TOO_LARGE", "Resolved profile exceeds the advertised profile limits");
     return json2(result, 200, profile2.revision);
   }
   if (resource === "stations" && parts.length === 3 && child === "state") {
@@ -43171,6 +43186,7 @@ class MemorySkillsStore {
       updatedAt: now,
       revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
       revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      authorizationEpoch: previous?.authorizationEpoch ?? randomUUID6().replaceAll("-", ""),
       lifecycle: previous?.lifecycle ?? "active",
       ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
       ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
@@ -43214,6 +43230,7 @@ class MemorySkillsStore {
         slug,
         version: version2,
         current: current?.orgId === principal.orgId ? {
+          authorizationEpoch: current.authorizationEpoch,
           lifecycle: current.lifecycle,
           ...current.tombstonedAt ? { tombstonedAt: current.tombstonedAt } : {}
         } : null,
@@ -43242,6 +43259,7 @@ class MemorySkillsStore {
     }
     const next2 = {
       ...current,
+      authorizationEpoch: current.lifecycle === patch.lifecycle ? current.authorizationEpoch : randomUUID6().replaceAll("-", ""),
       lifecycle: patch.lifecycle,
       updatedAt: nowIso(),
       revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
@@ -43286,7 +43304,7 @@ class MemorySkillsStore {
     if (!current.tombstonedAt) {
       const tombstoned = nowIso();
       const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
-      const next2 = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      const next2 = { ...current, authorizationEpoch: randomUUID6().replaceAll("-", ""), tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
       this.skills.set(skillKey(principal.orgId, slug), next2);
       return next2;
     }
@@ -44040,7 +44058,7 @@ class PostgresSkillsStore {
     const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
     const rows = await this.sql`
       SELECT q.value->>'slug' AS slug, q.value->>'version' AS version,
-        r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+        r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
         v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
       FROM jsonb_array_elements(${requested}::text::jsonb) WITH ORDINALITY AS q(value, ordinal)
       LEFT JOIN skills_registry r ON r.org_id = ${principal.orgId} AND r.slug = q.value->>'slug'
@@ -44336,13 +44354,14 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
       return json4(skillVersionPayload(version2, current));
     }
     if (request.method === "GET" && id && subresource === "versions" && childId && parts[4] === "bundle" && !parts[5]) {
-      const { version: version2, bytes } = await readSkillVersionBundle(store, artifactStorage, principal, id, childId);
+      const { version: version2, bytes, authorizationEpoch } = await readSkillVersionBundle(store, artifactStorage, principal, id, childId);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
         "Content-Disposition": `attachment; filename="${version2.slug}-${version2.version}.tar.gz"`,
         "X-Skill-Bundle-Sha256": version2.bundleSha256,
         "X-Skill-Version": version2.version,
+        ...authorizationEpoch ? { "X-Skill-Authorization-Epoch": authorizationEpoch } : {},
         ETag: `"${version2.bundleSha256}"`,
         "Cache-Control": "no-store"
       };

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.46",
+  version: "0.10.47",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -34937,6 +34937,7 @@ function rowToSkill(row) {
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
     ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
     lifecycle: row.lifecycle === "archived" ? "archived" : "active",
     ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
     ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
@@ -34948,6 +34949,7 @@ function rowToPublishedSelectionState(row) {
     slug: String(row.slug),
     version: String(row.version),
     current: row.skill_exists ? {
+      ...typeof row.authorization_epoch === "string" ? { authorizationEpoch: row.authorization_epoch } : {},
       lifecycle: row.lifecycle === "archived" ? "archived" : "active",
       ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {}
     } : null,
@@ -35597,7 +35599,7 @@ class SqliteSkillsStore {
           continue;
         insertTag.run(orgId, input.slug, tag);
       }
-      return rowToSkill(row);
+      return this.getSkillSync(input.principal, input.slug);
     })();
   }
   async listSkills(principal) {
@@ -35634,7 +35636,7 @@ class SqliteSkillsStore {
       const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
       if (!row)
         throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     }).immediate();
   }
   getSkillSync(principal, slug) {
@@ -35705,7 +35707,7 @@ class SqliteSkillsStore {
          SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
          WHERE org_id = ? AND slug = ?
          RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
-      return rowToSkill(row);
+      return this.getSkillSync(principal, slug);
     })();
   }
   async purgeExpiredTombstones(principal) {
@@ -35742,7 +35744,7 @@ class SqliteSkillsStore {
       return [];
     const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
     return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
-         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
          v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
        FROM json_each(?) q
        LEFT JOIN skills_registry r ON r.org_id = ? AND r.slug = json_extract(q.value, '$.slug')
@@ -36700,6 +36702,7 @@ class MemorySkillsStore {
       updatedAt: now,
       revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
       revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      authorizationEpoch: previous?.authorizationEpoch ?? randomUUID5().replaceAll("-", ""),
       lifecycle: previous?.lifecycle ?? "active",
       ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
       ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
@@ -36743,6 +36746,7 @@ class MemorySkillsStore {
         slug,
         version: version2,
         current: current?.orgId === principal.orgId ? {
+          authorizationEpoch: current.authorizationEpoch,
           lifecycle: current.lifecycle,
           ...current.tombstonedAt ? { tombstonedAt: current.tombstonedAt } : {}
         } : null,
@@ -36771,6 +36775,7 @@ class MemorySkillsStore {
     }
     const next2 = {
       ...current,
+      authorizationEpoch: current.lifecycle === patch.lifecycle ? current.authorizationEpoch : randomUUID5().replaceAll("-", ""),
       lifecycle: patch.lifecycle,
       updatedAt: nowIso(),
       revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
@@ -36815,7 +36820,7 @@ class MemorySkillsStore {
     if (!current.tombstonedAt) {
       const tombstoned = nowIso();
       const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
-      const next2 = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      const next2 = { ...current, authorizationEpoch: randomUUID5().replaceAll("-", ""), tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
       this.skills.set(skillKey(principal.orgId, slug), next2);
       return next2;
     }
@@ -37569,7 +37574,7 @@ class PostgresSkillsStore {
     const requested = JSON.stringify(selections2.map(({ slug, version: version2 }) => ({ slug, version: version2 })));
     const rows = await this.sql`
       SELECT q.value->>'slug' AS slug, q.value->>'version' AS version,
-        r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
+        r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at, r.authorization_epoch,
         v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
       FROM jsonb_array_elements(${requested}::text::jsonb) WITH ORDINALITY AS q(value, ordinal)
       LEFT JOIN skills_registry r ON r.org_id = ${principal.orgId} AND r.slug = q.value->>'slug'