@hasna/skills 0.10.60 → 0.10.62

package/bin/migrate.js

@@ -25,7 +25,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.60",
+  version: "0.10.62",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -62,9 +62,11 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
+    "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
     "README.md",
@@ -75,8 +77,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -153,6 +155,10 @@ var package_default = {
   homepage: "https://github.com/hasna/skills/tree/main/apps/skills",
   bugs: {
     url: "https://github.com/hasna/skills/issues"
+  },
+  skillsRuntimePrerequisites: {
+    version: 1,
+    entry: "dist/runtime-prerequisites.js"
   }
 };
 
@@ -210,7 +216,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/bin/server.js

@@ -24140,7 +24140,7 @@ restoreLaunchCwd();
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.60",
+  version: "0.10.62",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24177,9 +24177,11 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
+    "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
     "README.md",
@@ -24190,8 +24192,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -24268,6 +24270,10 @@ var package_default = {
   homepage: "https://github.com/hasna/skills/tree/main/apps/skills",
   bugs: {
     url: "https://github.com/hasna/skills/issues"
+  },
+  skillsRuntimePrerequisites: {
+    version: 1,
+    entry: "dist/runtime-prerequisites.js"
   }
 };
 
@@ -42934,7 +42940,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/bin/worker.js

@@ -24143,7 +24143,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.60",
+  version: "0.10.62",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -24180,9 +24180,11 @@ var package_default = {
     "!dist/test-preload.d.ts",
     "!dist/platform",
     "bin/",
+    "native/kernel-lock-acl-darwin",
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
+    "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
     "README.md",
@@ -24193,8 +24195,8 @@ var package_default = {
   types: "./dist/index.d.ts",
   scripts: {
     clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/contracts/kernel-lock ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build --external @hasna/contracts/kernel-lock ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -24271,6 +24273,10 @@ var package_default = {
   homepage: "https://github.com/hasna/skills/tree/main/apps/skills",
   bugs: {
     url: "https://github.com/hasna/skills/issues"
+  },
+  skillsRuntimePrerequisites: {
+    version: 1,
+    entry: "dist/runtime-prerequisites.js"
   }
 };
 
@@ -36412,7 +36418,7 @@ function resolveServerConfig(env = process.env) {
   return {
     host,
     port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    databaseUrl: env[DATABASE_URL_ENV] || env.SKILLS_DATABASE_URL || env.DATABASE_URL || undefined,
     bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),

package/dist/cli/commands/runtime-copyfile.d.ts

@@ -24,6 +24,7 @@ export declare function rollbackCopyfileAliases(receiptId: string, options?: {
 export declare function updateCopyfileRuntime(version: string, options?: {
     homeDir?: string;
     pathValue?: string;
+    cwd?: string;
     registryOrigin?: string;
     fetcher?: typeof fetch;
     minReleaseAge?: number;

package/dist/cli/commands/runtime-launcher.d.ts

@@ -1,4 +1,4 @@
-export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v1";
+export declare const PINNED_LAUNCHER_SCHEMA = "hasna-skills-pinned-launcher-v2";
 /** The variable the launcher uses to hand the caller's directory to the CLI. */
 export declare const LAUNCH_CWD_VARIABLE = "HASNA_SKILLS_LAUNCH_CWD";
 /** Bun runtime flags that remove every working-directory configuration source. */
@@ -7,42 +7,50 @@ export declare const PINNED_LAUNCHER_BUN_FLAGS: readonly ["--config=/dev/null",
  * Environment names passed through `env -i`, by exact name. Everything else,
  * including `BUN_*`, `NODE_OPTIONS`, `DYLD_*`, `LD_*` and proxy settings, is
  * dropped. The handling is total on purpose: a name is either listed here,
- * matches a prefix below, or never reaches the runtime.
+ * matches a prefix below, and passes the server-owned profile policy.
  */
-export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "DATABASE_URL", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4"];
+export declare const PINNED_LAUNCHER_ENV_NAMES: readonly ["HOME", "PATH", "TMPDIR", "TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION", "COLORTERM", "LANG", "USER", "LOGNAME", "SHELL", "TZ", "NO_COLOR", "FORCE_COLOR", "CI", "COLUMNS", "LINES", "EDITOR", "VISUAL", "PAGER", "SSH_AUTH_SOCK", "TERMINAL_CWD", "CODEX_HOME", "HERMES_HOME", "HERMES_ENABLE_PROJECT_PLUGINS", "HOST", "PORT", "NODE_ENV", "AGENT_ID", "ECS_CONTAINER_METADATA_URI_V4"];
 /** Environment name prefixes passed through, for the app's own documented overrides. */
 export declare const PINNED_LAUNCHER_ENV_PREFIXES: readonly ["HASNA", "SKILLS", "SKILL", "MCP", "XDG", "LC", "AWS"];
 /** The allowlisted subset of an environment, by the same rule the launcher applies. */
-export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>): Record<string, string>;
+export declare function pinnedLauncherEnvironment(env: Record<string, string | undefined>, profile?: LauncherProfile): Record<string, string>;
 export type LauncherShape = "symlink" | "pinned";
-export interface PinnedLauncherBinding {
+export type LauncherFormat = "v1" | "v2";
+export type LauncherProfile = "client" | "server";
+export interface LauncherMetadata {
+    format?: LauncherFormat;
+    profile?: LauncherProfile;
+}
+export interface PinnedLauncherBinding extends LauncherMetadata {
     runtime: string;
     cwd: string;
     entry: string;
 }
+/** Role follows the package's public bin/entry contract, never a path substring. */
+export declare function launcherProfileForBin(name: string, entry: string): LauncherProfile;
 export type LauncherState = {
     shape: "symlink";
     linkTarget: string;
     target: string;
-} | {
+} | ({
     shape: "pinned";
     runtime: string;
     cwd: string;
     target: string;
     sha256: string;
-};
+} & LauncherMetadata);
 export type InspectedLauncher = {
     kind: "symlink";
     linkTarget: string;
     target: string;
-} | {
+} | ({
     kind: "pinned";
     runtime: string;
     cwd: string;
     target: string;
     sha256: string;
     text: string;
-} | {
+} & LauncherMetadata) | {
     kind: "foreign";
 };
 /** The exact launcher text for one Bun binary, trusted directory and entry. Deterministic. */
@@ -76,9 +84,9 @@ export declare function pinnedLauncherText(state: {
     cwd: string;
     target: string;
     sha256: string;
-}): string;
+} & LauncherMetadata): string;
 /** Build the pinned state for an entry under the given Bun binary and trusted directory. */
-export declare function pinnedLauncherState(runtime: string, cwd: string, target: string): Extract<LauncherState, {
+export declare function pinnedLauncherState(runtime: string, cwd: string, target: string, metadata?: LauncherMetadata): Extract<LauncherState, {
     shape: "pinned";
 }>;
 /**