@hasna/skills 0.5.4 → 0.5.5

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join6 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.4",
+  version: "0.5.5",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -461,7 +461,40 @@ function publicPrincipal(partial = {}) {
 // src/server/rows.ts
 import { randomUUID } from "crypto";
 
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
 // src/lib/skill-bundle.ts
+var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
   ".ds_store",
@@ -598,6 +631,136 @@ var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
   timeoutMs: 5000
 });
 
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
+
 // src/server/rows.ts
 function nowIso() {
   return new Date().toISOString();
@@ -1083,10 +1246,16 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
       const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
       const tombstoned = previous?.tombstoned_at != null;
+      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+      }
+      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
       const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
       if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
         throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
@@ -1160,8 +1329,9 @@ class SqliteSkillsStore {
            tombstoned_at = NULL,
            tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
-         WHERE skills_registry.tombstoned_at IS NOT NULL
-            OR skills_registry.revision_id = ?
+         WHERE (skills_registry.tombstoned_at IS NOT NULL OR skills_registry.revision_id = ?)
+           AND (? = 0 OR (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
+             AND skills_registry.revision_id = ?))
          RETURNING *`, [
         orgId,
         input.slug,
@@ -1179,6 +1349,8 @@ class SqliteSkillsStore {
         revisionId,
         now,
         now,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL,
+        input.seedBundledOnly ? 1 : 0,
         input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
       if (!row) {