@hasna/skills 0.7.2 → 0.7.3

package/dist/lib/agent-discovery-bytes.d.ts

@@ -1,5 +1,6 @@
 export interface DiscoveryByteBudget {
     remaining: number;
+    pathMetadataRemaining?: number;
 }
 export declare function discoveryByteBudget(): DiscoveryByteBudget;
 /** Hash exact bytes without decoding them or following links. The budget spans one capture/verification. */

package/dist/lib/agent-discovery-path-bytes.d.ts

@@ -0,0 +1,5 @@
+import { type DiscoveryByteBudget } from "./agent-discovery-bytes.js";
+/** Bind path identity and exact bytes without importing or executing the file.
+ * Absence also has a digest: null cannot attest the path leading to an absence.
+ * Planned replacement is refused because its future inode is not knowable. */
+export declare function hashDiscoveryPathFile(path: string, budget: DiscoveryByteBudget, changes?: Map<string, string>): string;

package/dist/lib/agent-discovery.d.ts

@@ -4,7 +4,7 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes";
+    hashMode?: "bytes" | "path-bytes";
     format?: "json" | "toml" | "yaml";
     fields?: string[];
 }
@@ -30,6 +30,8 @@ export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding): vo
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */
 export declare function captureDiscoveryByteSources(paths: string[]): DiscoverySource[];
+/** Capture executable/source path identity, including links and absent targets. */
+export declare function captureDiscoveryPathSources(paths: string[]): DiscoverySource[];
 /** Project settings can introduce a higher-precedence discovery source. Until
  * its native merge format is supported, refuse that layer rather than certify
  * the home-only inventory. Ordinary unrelated project settings remain usable. */

package/dist/lib/agent-policy-limits.d.ts

@@ -5,6 +5,10 @@ export declare const AGENT_POLICY_LIMITS: Readonly<{
     discoverySources: 2048;
     discoveryRawSourceBytes: number;
     discoveryRawTotalBytes: number;
+    discoveryPathLinks: 40;
+    discoveryPathSteps: 256;
+    discoveryPathSourceMetadataBytes: number;
+    discoveryPathTotalMetadataBytes: number;
     discoveryRoots: 512;
     discoveryDirectories: 64;
     discoveryDirectoryEntries: 20000;

package/dist/lib/portable-skills-types.d.ts

@@ -114,6 +114,8 @@ export interface PortPortableSkillOptions extends PortableSkillOptions {
 }
 export interface BulkPortPortableSkillOptions extends PortableSkillOptions {
     overwrite?: boolean;
+    /** Explicitly permit imported names that shadow bundled official skills. */
+    allowShadow?: boolean;
     /** When false, the first failure is rethrown. Defaults to true (skip-on-error). */
     continueOnError?: boolean;
 }

package/dist/lib/release-dependencies.d.ts

@@ -0,0 +1,27 @@
+/** Verifies installed resolution against the selected standalone frozen lock.
+ * This is a graph/version check; the separate frozen installer receipt binds
+ * registry integrity. Package payload attestation is not inferred from version. */
+export declare function verifyProducerDependencies(packageRoot: string): {
+    status: string;
+    package: {
+        name: string;
+        version: string;
+    };
+    manifestSha256: string;
+    lockSha256: string;
+    nodeCount: number;
+    edgeCount: number;
+    nodes: {
+        lockKey: string;
+        name: string;
+        version: string;
+        manifestSha256: string;
+        relativePath: string;
+    }[];
+    edges: {
+        from: string;
+        name: string;
+        to: string | null;
+        optionalAbsent?: boolean;
+    }[];
+};