@hasna/skills 0.10.59 → 0.10.61

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.59",
+  version: "0.10.61",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -62,6 +62,7 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
@@ -75,8 +76,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -210,7 +211,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.59",
+  version: "0.10.61",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24177,6 +24177,7 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
@@ -24190,8 +24191,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -42934,7 +42935,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.59",
+  version: "0.10.61",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24180,6 +24180,7 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
@@ -24193,8 +24194,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -36412,7 +36413,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/dist/cli/commands/claude-installer-capture.d.ts

@@ -0,0 +1,28 @@
+/** Execute one fixed, read-only Claude installer witness operation through this installed CLI. */
+export declare function captureClaudeInstallerRequest(requestPath: string): {
+    schema: string;
+    producer: {
+        schema: "skills.cli-producer-identity/v1";
+        configuredCommandPath: string;
+        physicalLauncher: {
+            path: string;
+            sha256: string;
+        };
+        runtimeEntry: {
+            path: string;
+            sha256: string;
+        };
+        runtime: {
+            path: string;
+            sha256: string;
+        };
+        package: {
+            name: "@hasna/skills";
+            version: string;
+            manifestSha256: string;
+        };
+    };
+    operation: unknown;
+    result: unknown;
+};
+export declare function safeClaudeInstallerCaptureError(error: unknown): string;

package/dist/cli/commands/runtime-launcher.d.ts

@@ -1,4 +1,4 @@
-export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v1";
+export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v2";
 /** The variable the launcher uses to hand the caller's directory to the CLI. */
 export declare const LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
 /** Bun runtime flags that remove every working-directory configuration source. */
@@ -7,42 +7,50 @@ export declare const PINNED_LAUNCHER_BUN_FLAGS: readonly ["--config=/dev/null",
  * Environment names passed through `env -i`, by exact name. Everything else,
  * including `BUN_*`, `NODE_OPTIONS`, `DYLD_*`, `LD_*` and proxy settings, is
  * dropped. The handling is total on purpose: a name is either listed here,
- * matches a prefix below, or never reaches the runtime.
+ * matches a prefix below, and passes the server-owned profile policy.
  */
-export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "DATABASE_URL", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4"];
+export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4"];
 /** Environment name prefixes passed through, for the app's own documented overrides. */
 export declare const PINNED_LAUNCHER_ENV_PREFIXES: readonly ["HASNA", "SKILLS", "SKILL", "MCP", "XDG", "LC", "AWS"];
 /** The allowlisted subset of an environment, by the same rule the launcher applies. */
-export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>): Record<string, string>;
+export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>, profile?: LauncherProfile): Record<string, string>;
 export type LauncherShape = "symlink" | "pinned";
-export interface PinnedLauncherBinding {
+export type LauncherFormat = "v1" | "v2";
+export type LauncherProfile = "client" | "server";
+export interface LauncherMetadata {
+    format?: LauncherFormat;
+    profile?: LauncherProfile;
+}
+export interface PinnedLauncherBinding extends LauncherMetadata {
     runtime: string;
     cwd: string;
     entry: string;
 }
+/** Role follows the package's public bin/entry contract, never a path substring. */
+export declare function launcherProfileForBin(name: string, entry: string): LauncherProfile;
 export type LauncherState = {
     shape: "symlink";
     linkTarget: string;
     target: string;
-} | {
+} | ({
     shape: "pinned";
     runtime: string;
     cwd: string;
     target: string;
     sha256: string;
-};
+} & LauncherMetadata);
 export type InspectedLauncher = {
     kind: "symlink";
     linkTarget: string;
     target: string;
-} | {
+} | ({
     kind: "pinned";
     runtime: string;
     cwd: string;
     target: string;
     sha256: string;
     text: string;
-} | {
+} & LauncherMetadata) | {
     kind: "foreign";
 };
 /** The exact launcher text for one Bun binary, trusted directory and entry. Deterministic. */
@@ -76,9 +84,9 @@ export declare function pinnedLauncherText(state: {
     cwd: string;
     target: string;
     sha256: string;
-}): string;
+} & LauncherMetadata): string;
 /** Build the pinned state for an entry under the given Bun binary and trusted directory. */
-export declare function pinnedLauncherState(runtime: string, cwd: string, target: string): Extract<LauncherState, {
+export declare function pinnedLauncherState(runtime: string, cwd: string, target: string, metadata?: LauncherMetadata): Extract<LauncherState, {
     shape: "pinned";
 }>;
 /**