@hasna/skills 0.10.61 → 0.10.62

package/docs/runtime-activation.md

@@ -0,0 +1,23 @@
+# Runtime activation prerequisites
+
+A target package can declare `skillsRuntimePrerequisites` in its package manifest:
+
+```json
+{"version":1,"entry":"dist/runtime-prerequisites.js"}
+```
+
+The copyfile updater verifies the installed artifact and dependency closure, preserves its configuration preimages and writes a prepared rollout receipt. It then runs this exact target entry before moving the runtime or replacing any launcher. Unknown declarations, missing entries, unavailable checks and invalid responses refuse activation. A refusal retains the prepared receipt and preimages; the old runtime and launchers stay active.
+
+The target reader uses the existing consumer detector. It checks the dedicated Sumi path resolver only when Sumi is detected or configured, using the same schema, selectors and root conflict/alias checks as normal integration. It never starts native Sumi or reads its settings, credentials, models or sessions. Missing unrelated harnesses do not block activation.
+
+The check receives the actual HOME and caller directory as two positional arguments. Run the exact built target using the existing launcher isolation flags:
+
+```sh
+bun --config=/dev/null --no-env-file --no-macros --no-install /absolute/package/dist/runtime-prerequisites.js /absolute/home /absolute/caller-directory
+```
+
+Supply the station's PATH and documented Skills/Sumi/XDG path selectors through a scrubbed environment. Preserve the presence of unsupported `SUMI_CONFIG`/`SUMI_CONFIG_CONTENT` without projecting their contents. Credentials and Bun preload options are excluded. The check emits one JSON object with `schema: "skills.runtime-prerequisites.v1"`, `targetVersion`, `ok`, `checked` and `code`. Success exits 0 with `code: null`; a sanitized refusal exits 2. The updater bounds runtime and output, rejects stderr and binds a successful result to the target entry hash in the artifact-bound rollout receipt.
+
+Legacy targets with no declaration remain compatible and report `prerequisites.status: "not-declared"`; this is unverified, not a passed check. Deliberate receipt-based rollback remains separate and does not run the target check.
+
+Skills 0.10.61's installed updater predates this contract. Installing the repaired updater does not retroactively make that older updater check its target. The first installation must independently run the exact candidate reader under the reviewed retained-installer procedure before switching PATH. The new updater enforces declared checks on later updates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.61",
+  "version": "0.10.62",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {
@@ -41,6 +41,7 @@
     "migrations/",
     "docs/skill-standard.md",
     "docs/plugin-admission.md",
+    "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
     "README.md",
@@ -51,8 +52,8 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "clean": "rm -rf bin/ dist/",
-    "build": "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build": "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     "test": "bun test --timeout 30000",
     "dev": "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -129,5 +130,9 @@
   "homepage": "https://github.com/hasna/skills/tree/main/apps/skills",
   "bugs": {
     "url": "https://github.com/hasna/skills/issues"
+  },
+  "skillsRuntimePrerequisites": {
+    "version": 1,
+    "entry": "dist/runtime-prerequisites.js"
   }
 }