@hasna/skills 0.8.1 → 0.8.2

package/dist/lib/execution-secrets.d.ts

@@ -0,0 +1,40 @@
+import type { ResolvedSkillSelection } from "../types/skill-selection.js";
+export interface SelectedSecretBindings {
+    schema: "hasna.skills-secret-bindings.v1";
+    selection: Pick<ResolvedSkillSelection, "authority" | "workspaceId" | "profileRevision" | "slug" | "version" | "bundleDigest"> & {
+        profileId: string;
+    };
+    consumer: {
+        stationId: string;
+        workspaceDirectory: string;
+    };
+    /** Exact canonical /v1 authority of the independently configured Secrets client. */
+    secretsAuthority: string;
+    /** Declared environment name -> vault key. Values are resolved freshly for each run. */
+    bindings: Record<string, string>;
+}
+export interface SelectedSecretsClient {
+    readonly baseUrl: string;
+    getSecret(query: {
+        key: string;
+    }, init?: RequestInit): Promise<{
+        key: string;
+        value: string;
+        expires_at?: string | null;
+    }>;
+}
+export interface SelectedSecretScope {
+    selection: ResolvedSkillSelection;
+    profileId: string;
+    cwd: string;
+}
+export declare function selectedSecretBindingsTemplate(scope: SelectedSecretScope, names: string[], createClient?: () => SelectedSecretsClient): SelectedSecretBindings;
+/** Runtime controls must not be supplied as credentials, even by a reviewed binding. */
+export declare function declaredSecretNames(value: unknown): string[];
+/** Reading is bounded and rejects symlinks/devices. Parsing errors never echo file contents. */
+export declare function readSelectedSecretBindings(path: string): SelectedSecretBindings;
+/** Validate every grant before constructing a client or reading any secret. */
+export declare function validateSelectedSecretBindings(value: unknown, scope: SelectedSecretScope, names: string[]): SelectedSecretBindings;
+export declare function resolveSelectedSecrets(bindings: SelectedSecretBindings, createClient?: () => SelectedSecretsClient): Promise<Record<string, string>>;
+/** Limit accidental disclosure in child output. This is not a sandbox for hostile code. */
+export declare function redactExecutionSecrets(text: string, env: Record<string, string>): string;

package/dist/lib/selected-run.d.ts

@@ -1,8 +1,10 @@
 import type { ResolvedSkillSelection } from "../types/skill-selection.js";
 import type { SkillBundleEntry } from "./skill-bundle.js";
 import { type SelectionResolverOptions } from "./selection-resolver.js";
+import { type SelectedSecretBindings, type SelectedSecretsClient } from "./execution-secrets.js";
 export interface ResolvedSelectedRun {
     selection: ResolvedSkillSelection;
+    profileId: string;
     kind: "instruction" | "executable";
     entries: SkillBundleEntry[];
     manifest: Record<string, any>;
@@ -17,12 +19,29 @@ export interface SelectedLocalRunOptions {
     timeoutMs?: number;
     /** Only explicitly supplied environment values are available to declared secret references. */
     env?: Record<string, string>;
+    /** Explicit value-free vault grants; mutually exclusive with env. */
+    secretBindings?: SelectedSecretBindings;
+    /** SDK injection seam. The default uses the independently configured Secrets SDK. */
+    createSecretsClient?: () => SelectedSecretsClient;
 }
+export declare function prepareSelectedSecretBindings(selected: ResolvedSelectedRun, cwd?: string): Promise<SelectedSecretBindings>;
 export declare function executeSelectedLocal(selected: ResolvedSelectedRun, options?: SelectedLocalRunOptions): Promise<{
     exitCode: number;
     stdout: string;
     stderr: string;
     error?: string;
+    secretBinding?: {
+        schema: "hasna.skills-secret-bindings.v1";
+        selection: Pick<ResolvedSkillSelection, "slug" | "version" | "bundleDigest" | "workspaceId" | "authority" | "profileRevision"> & {
+            profileId: string;
+        };
+        consumer: {
+            stationId: string;
+            workspaceDirectory: string;
+        };
+        secretsAuthority: string;
+        bindings: Record<string, string>;
+    } | undefined;
     selection: ResolvedSkillSelection;
     target: "local";
     runtime: any;

package/dist/sdk/index.d.ts

@@ -16,6 +16,8 @@
  * variable of its own. See lib/fleet-credentials.ts.
  */
 export { HttpProfileClient, createProfileClient, type ProfileClient } from "../lib/profile-client.js";
+export { resolveSelectedRun, executeSelectedLocal, prepareSelectedSecretBindings, type ResolvedSelectedRun, type SelectedLocalRunOptions } from "../lib/selected-run.js";
+export { readSelectedSecretBindings, type SelectedSecretBindings, type SelectedSecretsClient } from "../lib/execution-secrets.js";
 export type { SkillSelection, SkillProfile, ResolvedSkillSelection, ResolvedSkillProfile, StationSkillStateInput, StationSkillState } from "../types/skill-selection.js";
 export { MissingSkillsFleetError, SkillsFleetCredentialError, SKILLS_API_KEY_ENV, SKILLS_API_URL_ENV, SKILLS_APP, SKILLS_LOCAL_OPT_IN_ENV_KEYS, configuredSkillsApiUrl, isSkillsLocalOptIn, noticeLocalSkillsMode, normalizeSkillsApiOrigin, requireSkillsApiOrigin, requireSkillsFleet, resolveSkillsApiOrigin, resolveSkillsFleet, selectsSkillsLocalMode, skillsCredentialFilePath, skillsCredentialFiles, skillsCredentialOrReason, type HostedSkillsFleet, type LocalSkillsFleet, type SkillsFleet, type SkillsFleetErrorCode, type SkillsFleetOptions, } from "../lib/fleet-credentials.js";
 export * from "./server.js";