@hasna/skills 0.10.90 → 0.10.91

package/dist/index.js

@@ -16369,7 +16369,7 @@ import { basename as basename15, dirname as dirname27, isAbsolute as isAbsolute2
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute25, join as join39, resolve as resolve25 } from "path";
 // package.json
-var version = "0.10.90";
+var version = "0.10.91";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -16416,6 +16416,7 @@ var package_default = {
     "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
+    "THIRD_PARTY_NOTICES",
     "README.md",
     "!dist/**/*test-utils.d.ts",
     "!dist/**/*fixtures.d.ts"
@@ -16423,9 +16424,9 @@ var package_default = {
   main: "./dist/index.js",
   types: "./dist/index.d.ts",
   scripts: {
-    clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    clean: "rm -rf bin/ dist/ THIRD_PARTY_NOTICES",
+    build: "bun run clean && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/secrets --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts && bun scripts/third-party-notices.ts",
+    "build:js": "rm -rf dist && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -16476,7 +16477,6 @@ var package_default = {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
     "@hasna/events": "0.1.18",
-    "@hasna/secrets": "0.4.2",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -16488,6 +16488,9 @@ var package_default = {
     zod: "^4.3.6",
     "@hasna/contracts": "1.3.5"
   },
+  optionalDependencies: {
+    "@hasna/secrets": "0.4.2"
+  },
   engines: {
     bun: ">=1.0.0"
   },
@@ -17715,6 +17718,9 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
     completed = await completePointerCredential(SKILLS_APP, pointer, explicitVault ? snapshotEnv : env);
   } catch (error) {
     const translated = asSkillsFleetCredentialError(error, pointer.pointerVaultKey);
+    if (translated?.message.includes("(@hasna/secrets) is not installed")) {
+      throw new SkillsFleetCredentialError(`${translated.message} @hasna/secrets is optional and private: install it with access to it.`, "MISSING_API_CREDENTIAL");
+    }
     if (translated)
       throw translated;
     throw error;

package/dist/lib/execution-secrets.d.ts

@@ -28,7 +28,23 @@ export interface SelectedSecretScope {
     profileId: string;
     cwd: string;
 }
-export declare function selectedSecretBindingsTemplate(scope: SelectedSecretScope, names: string[], createClient?: () => SelectedSecretsClient): SelectedSecretBindings;
+/**
+ * The part of the @hasna/secrets SDK entry Skills uses. Skills typechecks and
+ * builds without the optional package: src/types/hasna-secrets-sdk.d.ts declares
+ * this much of the module, and src/lib/secrets-sdk-types.test.ts checks both
+ * against the real package wherever that is installed.
+ */
+export interface SecretsSdk {
+    createSecretsClientFromEnv(env?: Record<string, string | undefined>): SelectedSecretsClient;
+}
+/**
+ * The independently configured Secrets SDK. @hasna/secrets is an optional
+ * dependency that only an install with access to it receives (SH-00058), and
+ * the build keeps it external, so it is loaded here, when a vault grant needs
+ * it, and nowhere else.
+ */
+export declare function defaultSecretsClientFactory(load?: () => Promise<SecretsSdk>): Promise<() => SelectedSecretsClient>;
+export declare function selectedSecretBindingsTemplate(scope: SelectedSecretScope, names: string[], createClient: () => SelectedSecretsClient): SelectedSecretBindings;
 /** Runtime controls must not be supplied as credentials, even by a reviewed binding. */
 export declare function declaredSecretNames(value: unknown): string[];
 /** Reading is bounded and rejects symlinks/devices. Parsing errors never echo file contents. */

package/dist/runtime-prerequisites.js

@@ -49,7 +49,7 @@ var __require = import.meta.require;
 // src/runtime-prerequisites.ts
 import { isAbsolute as isAbsolute7 } from "path";
 // package.json
-var version = "0.10.90";
+var version = "0.10.91";
 var package_default = {
   name: "@hasna/skills",
   version,
@@ -96,6 +96,7 @@ var package_default = {
     "docs/runtime-activation.md",
     "schemas/",
     "LICENSE",
+    "THIRD_PARTY_NOTICES",
     "README.md",
     "!dist/**/*test-utils.d.ts",
     "!dist/**/*fixtures.d.ts"
@@ -103,9 +104,9 @@ var package_default = {
   main: "./dist/index.js",
   types: "./dist/index.d.ts",
   scripts: {
-    clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
+    clean: "rm -rf bin/ dist/ THIRD_PARTY_NOTICES",
+    build: "bun run clean && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/cli/index.tsx --outdir ./bin --target bun && bun build --external @hasna/secrets --external @modelcontextprotocol/sdk ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build --external @hasna/secrets --external @hasna/contracts/kernel-lock ./src/server/maintenance.ts --outfile ./bin/maintenance.js --target bun && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts && bun scripts/third-party-notices.ts",
+    "build:js": "rm -rf dist && bun build --external @hasna/secrets ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts ./src/runtime-prerequisites.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist && bun scripts/stage-kernel-lock-assets.ts",
     test: "bun test --timeout 30000",
     dev: "bun run ./src/cli/index.tsx",
     "dev:watch": "bun --watch run ./src/cli/index.tsx",
@@ -156,7 +157,6 @@ var package_default = {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
     "@hasna/events": "0.1.18",
-    "@hasna/secrets": "0.4.2",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -168,6 +168,9 @@ var package_default = {
     zod: "^4.3.6",
     "@hasna/contracts": "1.3.5"
   },
+  optionalDependencies: {
+    "@hasna/secrets": "0.4.2"
+  },
   engines: {
     bun: ">=1.0.0"
   },