@hasna/skills 0.7.2 → 0.8.0

package/dist/lib/agent-discovery-bytes.d.ts

@@ -1,5 +1,6 @@
 export interface DiscoveryByteBudget {
     remaining: number;
+    pathMetadataRemaining?: number;
 }
 export declare function discoveryByteBudget(): DiscoveryByteBudget;
 /** Hash exact bytes without decoding them or following links. The budget spans one capture/verification. */

package/dist/lib/agent-discovery-path-bytes.d.ts

@@ -0,0 +1,5 @@
+import { type DiscoveryByteBudget } from "./agent-discovery-bytes.js";
+/** Bind path identity and exact bytes without importing or executing the file.
+ * Absence also has a digest: null cannot attest the path leading to an absence.
+ * Planned replacement is refused because its future inode is not knowable. */
+export declare function hashDiscoveryPathFile(path: string, budget: DiscoveryByteBudget, changes?: Map<string, string>): string;

package/dist/lib/agent-discovery.d.ts

@@ -4,7 +4,7 @@ export { captureDiscoveryDirectories, type DiscoveryDirectory } from "./agent-di
 export interface DiscoverySource {
     path: string;
     sha256: string | null;
-    hashMode?: "bytes";
+    hashMode?: "bytes" | "path-bytes";
     format?: "json" | "toml" | "yaml";
     fields?: string[];
 }
@@ -30,6 +30,8 @@ export declare function verifyAgentDiscovery(binding: AgentDiscoveryBinding): vo
 export declare function rebindAgentDiscovery(binding: AgentDiscoveryBinding, changes: Map<string, string>): AgentDiscoveryBinding;
 /** Capture full byte witnesses for reviewed source or executable files; never import or execute them. */
 export declare function captureDiscoveryByteSources(paths: string[]): DiscoverySource[];
+/** Capture executable/source path identity, including links and absent targets. */
+export declare function captureDiscoveryPathSources(paths: string[]): DiscoverySource[];
 /** Project settings can introduce a higher-precedence discovery source. Until
  * its native merge format is supported, refuse that layer rather than certify
  * the home-only inventory. Ordinary unrelated project settings remain usable. */

package/dist/lib/agent-policy-limits.d.ts

@@ -5,6 +5,10 @@ export declare const AGENT_POLICY_LIMITS: Readonly<{
     discoverySources: 2048;
     discoveryRawSourceBytes: number;
     discoveryRawTotalBytes: number;
+    discoveryPathLinks: 40;
+    discoveryPathSteps: 256;
+    discoveryPathSourceMetadataBytes: number;
+    discoveryPathTotalMetadataBytes: number;
     discoveryRoots: 512;
     discoveryDirectories: 64;
     discoveryDirectoryEntries: 20000;

package/dist/lib/config.d.ts

@@ -4,7 +4,6 @@
  * Loads configuration from:
  *   1. Project-local: ./skills.config.json (highest priority)
  *   2. Global: ~/.hasna/skills/config.json (JSON format, lowest priority)
- *      (backward compat: also checks ~/.skillsrc)
  *
  * Values from the project config override global config.
  */
@@ -83,35 +82,16 @@ export declare function isOwnerLayoutMigrated(appDir: string): boolean;
 /**
  * Get the data directory for skills global config/data.
  * Default: ~/.hasna/skills/, overridable with $HASNA_SKILLS_DIR.
- * Auto-migrates from ~/.skills/ and ~/.skillsrc without deleting legacy data.
+ * Legacy directories and configuration are never imported during resolution.
  */
 export declare function getDataDir(): string;
-/**
- * Write-free data-dir resolution for read-only paths (e.g. `sync --dry-run`).
- *
- * getDataDir() itself writes: it mkdirs the app folder, merges legacy ~/.skills
- * content and copies the legacy config file. A dry run must resolve the SAME
- * directory a real run would use without performing any of that — the app-home
- * resolver (getDataRoot) is already write-free, so this mirrors it directly.
- */
+/** Resolve the same app data root without creating directories. */
 export declare function getDataDirReadOnly(): string;
 /**
  * Get the config file path for a given scope, write-free (see getDataDirReadOnly).
  */
 export declare function getConfigPathReadOnly(scope: ConfigScope): string;
-/**
- * Load merged config (project-local overrides global) without the writes
- * getDataDir() performs on the write path.
- *
- * The write path folds the legacy ~/.skillsrc into canonical config.json as part of
- * getDataDir()'s migration — copied ONLY when canonical config.json is absent, and
- * the legacy migration is skipped entirely when a data-directory override is active.
- * This mirrors that FILE-LEVEL precedence, never field-level merging: canonical
- * config.json, when present, is the whole global config; legacy ~/.skillsrc is read
- * only in the exact situation the write path would copy it (no canonical file, no
- * override). Field-level merging would inherit stale legacy values beneath a
- * canonical config that omits them, so the two paths must agree exactly.
- */
+/** Read only the canonical global and explicitly selected project configuration. */
 export declare function loadConfigReadOnly(): SkillsConfig;
 /**
  * Get the config file path for a given scope

package/dist/lib/installer.d.ts

@@ -48,7 +48,7 @@ interface MetaFile {
     disabled?: string[];
 }
 /**
- * Get the path to a bundled skill in the package.
+ * Resolve a skill only inside the owned cache or an explicit authoring source.
  */
 export declare function getSkillPath(name: string): string;
 /**

package/dist/lib/portable-skills-types.d.ts

@@ -114,6 +114,8 @@ export interface PortPortableSkillOptions extends PortableSkillOptions {
 }
 export interface BulkPortPortableSkillOptions extends PortableSkillOptions {
     overwrite?: boolean;
+    /** Explicitly permit imported names that shadow bundled official skills. */
+    allowShadow?: boolean;
     /** When false, the first failure is rethrown. Defaults to true (skip-on-error). */
     continueOnError?: boolean;
 }

package/dist/lib/portable-skills.d.ts

@@ -20,7 +20,7 @@ export * from "./portable-skills-types.js";
  *      exists there (the record is the authority; a skills/ directory someone
  *      created by hand is not the corpus)
  *   3. `getDataDir()`         - <app folder>/installed (pre-migration corpus,
- *      with the legacy auto-copy migration), where the app folder is
+ *      without importing any legacy directories), where the app folder is
  *      $HASNA_SKILLS_DIR, else ~/.hasna/skills
  *
  * The app folder holds app data (config.json, skills.db, auth.json); the corpus

package/dist/lib/registry-data/index.d.ts

@@ -1,2 +1,3 @@
 import type { SkillMeta } from "../registry-types.js";
+/** @deprecated Skills are loaded from an account or an explicitly selected local source. */
 export declare const SKILLS: SkillMeta[];

package/dist/lib/registry-types.d.ts

@@ -38,5 +38,6 @@ export interface SkillAvailabilityMetadata {
 }
 export declare const CATEGORIES: readonly ["Development Tools", "Business & Marketing", "Productivity & Organization", "Project Management", "Content Generation", "Finance & Compliance", "Data & Analysis", "Media Processing", "Design & Branding", "Web & Browser", "Research & Writing", "Science & Academic", "Education & Learning", "Communication", "Health & Wellness", "Travel & Lifestyle", "Event Management"];
 export type Category = (typeof CATEGORIES)[number];
-export declare const BASIC_SKILL_NAMES: readonly ["blog-article", "ad-creative-pack", "email-sequence", "seo-content-pack", "social-content-calendar", "pitch-deck", "proposal-pack", "market-research-report"];
+/** @deprecated There is no software-owned default selection. Use an account profile. */
+export declare const BASIC_SKILL_NAMES: readonly string[];
 export type SkillRegistryProfile = "basic" | "all";

package/dist/lib/registry.d.ts

@@ -7,19 +7,9 @@ export { BASIC_SKILL_NAMES, CATEGORIES, SKILLS };
 export type { Category, SkillMeta, SkillRegistryProfile };
 export declare function isBasicSkillName(name: string): boolean;
 export declare function findExtensionSkillPath(name: string): string | null;
-/**
- * Load the full registry: official skills merged with a configured private
- * extension checkout and global custom skills from the canonical local corpus
- * — <app folder>/installed/<name>/ before the owner-layout migration, <app
- * folder>/skills/<name>/ after it (resolveCorpusRoot(), the one resolution
- * every discovery path shares) — plus the legacy ~/.hasna/skills/custom/<name>/
- * migration safety net.
- *
- * Custom skills take precedence over extensions, which take precedence over
- * official skills. Extension skills are read in place and never copied into the
- * corpus. Results are cached for 5 seconds.
- */
+/** Discover the Skills-owned cache and explicitly configured authoring sources. */
 export declare function loadRegistry(cwd?: string): SkillMeta[];
+/** Compatibility name for the caller's own catalog; no baked-in default selection. */
 export declare function loadBasicRegistry(cwd?: string): SkillMeta[];
 export declare function loadRegistryProfile(profile?: SkillRegistryProfile, cwd?: string): SkillMeta[];
 /** Invalidate the registry cache (e.g. after installing a custom skill). */

package/dist/lib/release-dependencies.d.ts

@@ -0,0 +1,30 @@
+type Context = Record<string, string | null>;
+/** Verifies installed resolution against the selected standalone frozen lock.
+ * This is a graph/version check; the separate frozen installer receipt binds
+ * registry integrity. Package payload attestation is not inferred from version. */
+export declare function verifyProducerDependencies(packageRoot: string): {
+    status: string;
+    package: {
+        name: string;
+        version: string;
+    };
+    manifestSha256: string;
+    lockSha256: string;
+    nodeCount: number;
+    edgeCount: number;
+    nodes: {
+        lockKey: string;
+        name: string;
+        version: string;
+        manifestSha256: string;
+        relativePath: string;
+        context: Context;
+    }[];
+    edges: {
+        from: string;
+        name: string;
+        to: string | null;
+        optionalAbsent?: boolean;
+    }[];
+};
+export {};

package/dist/lib/skill-aliases.d.ts

@@ -1,6 +1,5 @@
-export declare const SKILL_ALIASES: {
-    readonly "create-blog-article": "blog-article";
-};
+/** @deprecated Aliases belong to an account's selected profile, never the package. */
+export declare const SKILL_ALIASES: Readonly<Record<string, string>>;
 export type SkillAlias = keyof typeof SKILL_ALIASES;
 export declare function normalizeSkillSlug(name: string): string;
 export declare function resolveSkillAlias(name: string): string;

package/dist/mcp/mcp-test-client.d.ts

@@ -1,5 +1,5 @@
-export declare const EXPECTED_ALL_SKILL_COUNT: number;
-export declare const EXPECTED_BASIC_SKILL_COUNT: 8;
+export declare const EXPECTED_ALL_SKILL_COUNT: 12;
+export declare const EXPECTED_BASIC_SKILL_COUNT: 12;
 /**
  * Helper class to communicate with the MCP server over stdio.
  */

package/dist/sdk/executor.d.ts

@@ -1,9 +1,9 @@
 /**
- * Executor seam: what actually runs a claimed skill run.
+ * Compatibility seam for historical unversioned run records.
  *
- * The interface is the contract an embedder supplies an executor against. The current
- * implementation is the provider-free deterministic handler the shipped worker runs
- * (src/server/handlers.ts) — same logs, same artifacts, same terminal transitions.
+ * Embedders may supply their own implementation of the interface. The legacy
+ * implementation only drains old records to a fenced refusal; versioned bundle
+ * execution uses the managed runtime and never resolves an embedded skill name.
  */
 import { ArtifactStorage } from "../server/artifact-storage.js";
 import { executeRun } from "../server/handlers.js";
@@ -12,6 +12,6 @@ import type { ServerRunRecord, SkillsProductStore } from "../server/types.js";
 export interface RunExecutor {
     execute(store: SkillsProductStore, run: ServerRunRecord, storage?: ArtifactStorage): Promise<ServerRunRecord>;
 }
-/** Current implementation: the shipped deterministic handler, unchanged. */
+/** @deprecated Drains legacy records with LEGACY_EXECUTION_RETIRED; executes no skill. */
 export declare const localRunExecutor: RunExecutor;
 export { executeRun };