@hasna/skills 0.10.46 → 0.10.48

package/dist/lib/agent-discovery.d.ts

@@ -7,7 +7,7 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes" | "path-bytes" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "sumi-settings-v1";
+    hashMode?: "bytes" | "path-bytes" | "claude-plugin-manifest-v1" | "claude-plugin-registry" | "claude-marketplace-registry" | "claude-settings-v1" | "claude-settings-v2" | "claude-settings-v3" | "claude-marketplace-registry-v2" | "codex-settings-v1" | "codex-settings-v2" | "codex-settings-v3" | "codex-settings-v4" | "sumi-settings-v1";
     managedPlugins?: ManagedPluginRegistrationWitness[];
     format?: "json" | "toml" | "yaml";
     fields?: string[];

package/dist/lib/claude-plugin-manifest-witness.d.ts

@@ -0,0 +1,9 @@
+export declare const CLAUDE_PLUGIN_MANIFEST_LIMITS: Readonly<{
+    bytes: number;
+    depth: 32;
+    nodes: 65536;
+    stringCharacters: 16384;
+}>;
+export declare function hashClaudePluginManifest(text: string): string;
+/** Project only the exact raw manifest bytes that the explicit review attested. */
+export declare function projectReviewedClaudePluginManifest(text: string, reviewedSha256: string): string;

package/dist/lib/profile-client.d.ts

@@ -4,6 +4,8 @@ export interface ProfileClient {
     /** Stable whoami subject; raw credential/key identities are intentionally excluded. */
     resolvePrincipal?(): Promise<AuthenticatedProfilePrincipal>;
     resolveProfile(id: string): Promise<ResolvedSkillProfile>;
+    /** Optional on older authorities/embedders; absence never authorizes old versions. */
+    supportsPinRenewal?(): Promise<boolean>;
     recordStation(id: string, state: StationSkillStateInput): Promise<StationSkillState>;
     getBundle(slug: string, version: string): Promise<Response | null>;
 }
@@ -15,15 +17,17 @@ export interface AuthenticatedProfilePrincipal {
 }
 export declare class HttpProfileClient implements ProfileClient {
     private key;
+    private signal?;
     readonly authority: string;
     private origin;
-    constructor(key: string, origin: string);
+    constructor(key: string, origin: string, signal?: AbortSignal | undefined);
     private requestRoute;
     private request;
     private read;
+    supportsPinRenewal(): Promise<boolean>;
     resolveProfile(id: string): Promise<ResolvedSkillProfile>;
     resolvePrincipal(): Promise<AuthenticatedProfilePrincipal>;
     recordStation(id: string, input: StationSkillStateInput): Promise<StationSkillState>;
     getBundle(slug: string, version: string): Promise<Response | null>;
 }
-export declare function createProfileClient(): Promise<ProfileClient>;
+export declare function createProfileClient(signal?: AbortSignal): Promise<ProfileClient>;

package/dist/lib/remote-files.d.ts

@@ -12,7 +12,7 @@ export interface RemoteInputFileDescriptor {
 }
 export declare function describeRemoteFiles(files: RemoteInputFile[]): RemoteInputFileDescriptor[];
 export declare function sha256(bytes: Uint8Array): string;
-export declare function readBoundedResponse(response: Response, maximum: number): Promise<Uint8Array>;
+export declare function readBoundedResponse(response: Response, maximum: number, signal?: AbortSignal): Promise<Uint8Array>;
 /** Small inline inputs for agent transports; larger files belong in the CLI/SDK. */
 export declare function decodeRemoteFiles(files: Array<{
     name: string;

package/dist/lib/selection-cache.d.ts

@@ -46,6 +46,11 @@ export declare function selectionBundlePath(selection: ResolvedSkillSelection, o
 export declare function writeSelectionJson(path: string, value: unknown): void;
 export declare function readSelectionJson<T>(path: string): T | null;
 export declare function readCachedSelection(selection: ResolvedSkillSelection, options?: SelectionCacheOptions): Promise<SkillBundleEntry[] | null>;
+/** Verify an authenticated exact-version response without changing any cache or receipt. */
+export declare function verifySelectionBundleResponse(selection: ResolvedSkillSelection, response: Response | null, signal?: AbortSignal, deadline?: number): Promise<{
+    bytes: Uint8Array;
+    entries: SkillBundleEntry[];
+}>;
 export declare function cacheSelectionBundle(selection: ResolvedSkillSelection, response: Response | null, options?: SelectionCacheOptions): Promise<SkillBundleEntry[]>;
 export declare function activateSelectionProfile(profile: ResolvedSkillProfile, options?: SelectionCacheOptions): CachedSelectionProfile;
 export declare function readSelectionProfile(profileId: string, options?: SelectionCacheOptions): CachedSelectionProfile | null;

package/dist/lib/selection-resolver.d.ts

@@ -49,6 +49,7 @@ export declare function loadSelectedSkill(spec: string, profileId: string, optio
         file: string;
         source: string;
         verifiedAt: string;
+        authorizationEpoch?: string;
         authority: string;
         workspaceId: string;
         profileRevision: string;

package/dist/lib/session-reconciliation.d.ts

@@ -30,10 +30,13 @@ export declare function inspectSkillSession(sessionId: string, options?: Selecti
     selectionCount: number;
     loadedCount: number;
 };
+/** Fits inside the managed context child's 6.5-second ceiling, including CLI work. */
+export declare const SESSION_RENEWAL_TIMEOUT_MS = 4000;
 /**
- * Managed hooks may move an expired pin only when every skill already loaded
- * by this session is still selected with exactly the same behavior and bytes.
- * The old receipt is archived and replaced under its exact snapshot lock.
+ * Renew authorization for the complete immutable pin; never manufacture a
+ * profile combining historical loaded versions with current unloaded versions.
+ * Current profile membership/lifecycle authorizes unchanged pins. Historical
+ * versions additionally require the authenticated exact-version bundle read.
  */
 export declare function reconcileSkillSessionIfSafe(sessionId: string, profileId: string, options?: SessionReconciliationOptions): Promise<boolean>;
 /** Explicit review for changed loaded selections or intentional profile migration. */