@hasna/skills 0.10.6 → 0.10.8

package/dist/lib/codex-hook-rpc.d.ts

@@ -1,4 +1,4 @@
-export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1"];
+export declare const SUPPORTED_CODEX_HOOK_VERSIONS: readonly ["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"];
 export interface CodexHookRpc {
     version: string;
     processId?: number;

package/dist/lib/release-review-linkage.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Release review linkage for @hasna/skills npm releases.
+ *
+ * WHY THIS EXISTS
+ *
+ * @hasna/skills 0.10.5 and 0.10.6 reached npm without the release authority's
+ * required pre-upload linkage: an independent reviewer's GO in git-prs and the
+ * git-publishing intent thread, bound to the exact candidate AND to the packed
+ * tarball that was uploaded. A published version cannot be unpublished, so the only
+ * place a release can refuse is BEFORE the upload.
+ *
+ * The binding lives in the annotated release tag message, which is created
+ * before the tag is pushed and is covered by the same protected-main ancestry
+ * the release workflow already requires:
+ *
+ *   @hasna/skills 0.10.7
+ *
+ *   <release notes>
+ *
+ *   Release-Review-Agent: <registered reviewer coding-agent identity>
+ *   Git-Publishing-Thread: <release intent thread id>
+ *   Git-Prs-GO: <message id of the independent GO in git-prs for this candidate>
+ *   Packed-SHA256: <64 lowercase hex>
+ *
+ * "EXACTLY" is enforced, not implied: each of the four linkage keys must appear
+ * exactly once, the linkage namespace is closed (a fifth Release-Review-* /
+ * Git-Publishing-* / Git-Prs-* / Packed-* key is a failure, so a field can never be silently
+ * swapped for a look-alike), values are strictly shaped, and the recorded
+ * Packed-SHA256 must equal the SHA-256 of the tarball this checkout actually
+ * packs. There is no fallback: a missing, duplicated, malformed or mismatched
+ * field refuses the release.
+ *
+ * The reviewer's digest must be produced with the release toolchain at the exact
+ * commit (see scripts/RELEASE.md): `npm pack --ignore-scripts` in apps/skills
+ * after `bun run build`, hashed with SHA-256. A digest taken from a different
+ * toolchain, a different commit or a differently-built tree does not match by
+ * design, and the mismatch is the gate doing its job.
+ *
+ * This module is pure: git and npm I/O stay in scripts/verify-release-review.ts,
+ * and the release workflow runs `bun run verify:release-review` before it is
+ * allowed to publish.
+ */
+export declare const SKILLS_RELEASE_REPOSITORY = "hasna/apps";
+export declare const SKILLS_RELEASE_REPOSITORY_URL = "https://github.com/hasna/apps.git";
+export declare const SKILLS_RELEASE_PACKAGE_PATH = "apps/skills";
+export declare const SKILLS_RELEASE_MANIFEST_PATH = "apps/skills/package.json";
+export declare const SKILLS_RELEASE_PACKAGE_NAME = "@hasna/skills";
+export declare const SKILLS_RELEASE_REGISTRY = "https://registry.npmjs.org";
+export declare const SKILLS_RELEASE_TAG_PREFIX = "npm/skills/v";
+/** Field names carried by the annotated release tag message, in required order. */
+export declare const RELEASE_REVIEW_LINKAGE_FIELDS: {
+    readonly reviewerAgent: "Release-Review-Agent";
+    readonly goThreadId: "Git-Publishing-Thread";
+    readonly goMessageId: "Git-Prs-GO";
+    readonly packedSha256: "Packed-SHA256";
+};
+export type ReleaseReviewLinkageFailure = {
+    check: string;
+    message: string;
+};
+export type ReleaseReviewLinkage = {
+    /** The registered coding-agent identity that performed the independent review. */
+    reviewerAgent: string;
+    /** Release intent thread in the git-publishing lane. */
+    goThreadId: string;
+    /** Message id of the independent GO in git-prs bound to this exact candidate. */
+    goMessageId: string;
+    /** SHA-256 of the packed release tarball, lowercase hex. */
+    packedSha256: string;
+};
+export type ReleaseReviewLinkageInput = {
+    tagMessage: string;
+    tag: string;
+    /** `git cat-file -t refs/tags/<tag>`; must be `tag` for an annotated tag. */
+    tagType: string;
+    /** `git rev-parse refs/tags/<tag>^{commit}`. */
+    tagCommit: string;
+    /** The exact checkout being released. */
+    releaseCommit: string;
+    packageName: string;
+    packageVersion: string;
+    repositoryUrl: string | undefined;
+    repositoryDirectory: string | undefined;
+    registry: string | undefined;
+    access: string | undefined;
+    /** SHA-256 computed from the tarball this checkout packs, when packing ran. */
+    packedSha256: string | undefined;
+};
+/** Resolve the semver a release tag carries, or undefined for any other tag. */
+export declare function parseSkillsReleaseTagVersion(tag: string): string | undefined;
+/**
+ * Parse the four linkage fields out of the annotated release tag message.
+ * Prose (subject and release notes) is allowed; the linkage namespace is not.
+ */
+export declare function parseReleaseReviewLinkage(tagMessage: string): {
+    linkage: Partial<ReleaseReviewLinkage>;
+    failures: ReleaseReviewLinkageFailure[];
+};
+/**
+ * The complete preflight: tagged candidate identity, package binding and the
+ * packed digest recorded in the tag. Returns every failure it finds so one run
+ * names all of them; any failure refuses the release.
+ */
+export declare function validateReleaseReviewLinkage(input: ReleaseReviewLinkageInput): ReleaseReviewLinkageFailure[];