@hasna/skills 0.8.12 → 0.9.1

package/dist/index.js

@@ -8323,6 +8323,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -8335,7 +8336,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -8854,6 +8855,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -11441,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.12",
+  version: "0.9.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -35954,6 +35961,8 @@ var remoteSkillSchema = exports_external.object({
   tags: exports_external.array(exports_external.string()).optional(),
   dependencies: exports_external.array(exports_external.string()).optional(),
   version: exports_external.string().optional(),
+  revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+  lifecycle: exports_external.enum(["active", "archived"]).optional(),
   availability: remoteAvailabilitySchema.optional()
 }).passthrough().refine((skill) => skill.name || skill.slug, {
   message: "Remote skill requires name or slug"
@@ -36016,6 +36025,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -37732,6 +37743,18 @@ class RemoteRequestError extends Error {
     this.name = "RemoteRequestError";
   }
 }
+var KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+
+class RemoteSkillLifecycleError extends RemoteRequestError {
+  code;
+  constructor(path, status, code) {
+    super(path, status);
+    this.name = "RemoteSkillLifecycleError";
+    const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+    this.code = safeCode;
+    this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+  }
+}
 
 class RemoteCreditCheckoutError extends RemoteRequestError {
   code;
@@ -37912,6 +37935,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -38429,6 +38485,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -38581,9 +38650,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject) => {
@@ -38598,7 +38671,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size += next.value.byteLength;
       if (size > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size);
@@ -38609,11 +38682,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -38847,7 +38920,7 @@ function recordScheduleRun(id, status, targetDir) {
 import { createHash as createHash17 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical4 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -38859,7 +38932,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
   return createHash17("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record7) {

package/dist/lib/cloud-executions.d.ts

@@ -1,3 +1,18 @@
+import type { PureExecutionContract } from "../sdk/execution/types.js";
+export interface CloudEligibility {
+    contractVersion: 1;
+    eligible: boolean;
+    skill: string;
+    version: string;
+    bundleDigest: string;
+    reason?: string;
+    runtimeImageDigest?: string;
+    executionContract?: PureExecutionContract | {
+        id: "pdf.v1";
+    };
+    secrets?: "none";
+    egress?: "deny";
+}
 export interface CloudExecution {
     contractVersion: 1;
     id: string;
@@ -7,6 +22,9 @@ export interface CloudExecution {
     bundleDigest: string;
     inputDigest: string;
     runtimeImageDigest: string;
+    executionContract?: PureExecutionContract | {
+        id: "pdf.v1";
+    };
     status: "admitted" | "leased" | "running" | "succeeded" | "failed" | "cancelled";
     exitCode?: number;
     artifacts: {
@@ -22,6 +40,8 @@ export declare class CloudExecutionClient {
     constructor(apiOrigin: string, apiKey: string);
     static configured(): Promise<CloudExecutionClient>;
     private request;
+    /** Metadata only: never creates, starts or reconciles a task. */
+    eligibility(slug: string, version: string, bundleDigest?: string): Promise<CloudEligibility>;
     submit(slug: string, version: string, input: unknown, key: string, selection?: {
         bundleDigest: string;
         workspaceId?: string;

package/dist/lib/registry-types.d.ts

@@ -12,6 +12,9 @@ export interface SkillMeta {
     tags: string[];
     dependencies?: string[];
     version?: string;
+    /** Server registry revision and lifecycle, when supplied by a remote read. */
+    revisionId?: string | null;
+    lifecycle?: "active" | "archived";
     /**
      * Artifact class of the skill. "executable" skills carry a runnable
      * package.json/bin/src; "instruction" skills are SKILL.md-primary prose for

package/dist/lib/remote-client.d.ts

@@ -30,6 +30,10 @@ export declare class RemoteRequestError extends Error {
     readonly status: number;
     constructor(path: string, status: number, _statusText?: string);
 }
+export declare class RemoteSkillLifecycleError extends RemoteRequestError {
+    readonly code?: string;
+    constructor(path: string, status: number, code?: string);
+}
 /** Bounded checkout outcome; the key is caller-owned, never copied from a server error. */
 export declare class RemoteCreditCheckoutError extends RemoteRequestError {
     readonly code: RemoteCreditCheckoutErrorCode;
@@ -144,6 +148,8 @@ export declare class RemoteSkillsClient {
         };
         recurringConsents?: RecurringCapability;
     }>;
+    /** Add the single supported publication scope to an existing key, metadata only. */
+    addSkillPublishScope(keyId: string, expectedScopes: string[], expectedOrgId: string): Promise<Record<string, unknown>>;
     /** Quote first and fail closed when the caller has not approved the required credits. */
     submitQuotedRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
     getIdentity(): Promise<Record<string, unknown>>;
@@ -252,6 +258,11 @@ export declare class RemoteSkillsClient {
      */
     publishSkill(manifest: Record<string, unknown>, bundle?: Uint8Array, ifMatch?: string): Promise<Response>;
     deleteSkill(slug: string): Promise<Response>;
+    setSkillLifecycle(slug: string, lifecycle: "active" | "archived", options: {
+        reason?: string;
+        replacementSlug?: string;
+        expectedRevisionId: string;
+    }): Promise<any>;
     downloadSkillBundle(slug: string): Promise<Response>;
     /**
      * Bundle fetch for the verified-pull path. Returns the raw Response so the caller can

package/dist/lib/revision.d.ts

@@ -12,6 +12,9 @@ export interface RevisionContent {
     skillMd?: string;
     bundleSha256?: string;
     bundleByteSize?: number;
+    lifecycle?: "active" | "archived";
+    archiveReason?: string;
+    replacementSlug?: string;
 }
 export declare function revisionIdOf(content: RevisionContent): string;
 export declare function revisionIdOfRecord(record: RevisionContent): string;

package/dist/sdk/execution/admission.d.ts

@@ -10,7 +10,7 @@
  */
 import type { ImageProfileRegistry } from "./image-profile.js";
 import type { RunExecutionStore } from "./storage.js";
-import { type FrozenAdmission, type RunLimits, type RunPolicy, type RuntimeName } from "./types.js";
+import { type FrozenAdmission, type RunLimits, type RunPolicy, type RuntimeName, type PureExecutionContract } from "./types.js";
 export interface SubmitRunInput {
     tenantId: string;
     skillId: string;
@@ -24,6 +24,7 @@ export interface SubmitRunInput {
     systemDeps?: string[];
     policy?: Partial<RunPolicy>;
     limits?: Partial<RunLimits>;
+    executionContract?: PureExecutionContract;
 }
 export interface SubmitRunResult {
     run: FrozenAdmission;

package/dist/sdk/execution/types.d.ts

@@ -33,6 +33,13 @@ export interface RunLimits {
     maxArtifactsBytes: number;
     maxConcurrency: number;
 }
+/** Trusted, versioned adapter identity. Absent only for legacy PDF admissions. */
+export interface PureExecutionContract {
+    id: "regex-test.v1";
+    descriptorDigest: string;
+    entrypoint: string;
+    entrypointDigest: string;
+}
 /** Everything frozen at admission under one stable run_id. */
 export interface FrozenAdmission {
     contractVersion: number;
@@ -46,6 +53,7 @@ export interface FrozenAdmission {
     runtimeImageDigest: string;
     /** Prebuilt dependency layer tag, when the manifest's system_deps are allowlisted. */
     dependencyLayerTag: string | null;
+    executionContract?: PureExecutionContract;
     /** sha256 of the canonical serialization of the run input. */
     inputDigest: string;
     runtime: RuntimeName;
@@ -109,6 +117,7 @@ export interface AttemptReceipt {
     runtimeImageDigest: string;
     bundleDigest: string;
     dependencyLayerTag: string | null;
+    executionContract?: PureExecutionContract;
     policy: RunPolicy;
     limits: RunLimits;
     exitCode: number | null;

package/dist/sdk/index.d.ts

@@ -15,6 +15,7 @@
  * — the shared @hasna/contracts ladder — instead of reading an environment
  * variable of its own. See lib/fleet-credentials.ts.
  */
+export { CloudExecutionClient, type CloudExecution, type CloudEligibility } from "../lib/cloud-executions.js";
 export { readExecutionGrantPolicy, saveExecutionGrantPolicy, resolveExecutionGrant } from "../lib/execution-grant-client.js";
 export type { ExecutionGrant, ExecutionGrantPolicy, ExecutionGrantRequest, ResolvedExecutionGrant } from "../lib/execution-grants.js";
 export { HttpProfileClient, createProfileClient, type ProfileClient, type AuthenticatedProfilePrincipal, type AuthenticatedProfileRole } from "../lib/profile-client.js";