@hasna/skills 0.8.12 → 0.9.2

package/dist/index.js

@@ -8323,6 +8323,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -8335,7 +8336,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -8854,6 +8855,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -11441,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.12",
+  version: "0.9.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -15731,6 +15738,35 @@ function treeHash(root2) {
   visit2(root2);
   return hash2.digest("hex");
 }
+function selectNativeMigrationTargets(inventory, manifest) {
+  if (manifest.schema !== "hasna.skills-native-migration-targets.v1" || !/^[0-9a-f]{64}$/.test(manifest.digest) || !Array.isArray(manifest.targets) || manifest.targets.length === 0)
+    throw new Error("Invalid native migration target manifest");
+  const identities = new Set;
+  const selected = [];
+  for (const target of manifest.targets) {
+    const projectRoot = resolve15(target.projectRoot), normalized = relative5(projectRoot, resolve15(projectRoot, target.path));
+    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync11(projectRoot) || !lstatSync18(projectRoot).isDirectory())
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    assertSafePath(projectRoot);
+    if (isAbsolute15(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep6}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
+      throw new Error(`Invalid native migration target: ${target.path}`);
+    const identity3 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    if (identities.has(identity3))
+      throw new Error(`Duplicate native migration target: ${target.path}`);
+    identities.add(identity3);
+    const expected = resolve15(target.projectRoot, target.path);
+    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve15(entry2.path) === expected);
+    if (matches.length !== 1)
+      throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
+    const entry = matches[0];
+    if (entry.bridge || entry.system || entry.vendor)
+      throw new Error(`Native migration target is protected or vendor-owned: ${entry.path}`);
+    if (entry.hash !== target.treeSha256 || treeHash(entry.path) !== target.treeSha256)
+      throw new Error(`Native migration target changed after review: ${entry.path}`);
+    selected.push(entry);
+  }
+  return selected;
+}
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
@@ -16219,12 +16255,13 @@ function archiveNativeSkills(inventory, options) {
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
-  const selected = inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
+  const selected = options.targetManifest ? selectNativeMigrationTargets(inventory, options.targetManifest) : inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
   for (const entry of selected)
     if (treeHash(entry.path) !== entry.hash)
       throw new Error(`Native skill changed after planning: ${entry.path}`);
+  const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
-    return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
+    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const operationId = randomUUID3(), archiveRoot = join25(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join25(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join25(entry.path, "SKILL.md") : entry.path,
@@ -16233,7 +16270,7 @@ function archiveNativeSkills(inventory, options) {
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
-  const journal = { version: 2, operationId, status: "planned", entries, ...aliases.length ? { rootAliases: aliases } : {} };
+  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
@@ -16327,7 +16364,7 @@ function archiveNativeSkills(inventory, options) {
     } catch {}
     throw new Error(`Native archive failed; inspect the recovery journal at ${receiptPath} before retrying.`, { cause: error });
   }
-  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
 }
 function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir2))
@@ -35954,6 +35991,8 @@ var remoteSkillSchema = exports_external.object({
   tags: exports_external.array(exports_external.string()).optional(),
   dependencies: exports_external.array(exports_external.string()).optional(),
   version: exports_external.string().optional(),
+  revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+  lifecycle: exports_external.enum(["active", "archived"]).optional(),
   availability: remoteAvailabilitySchema.optional()
 }).passthrough().refine((skill) => skill.name || skill.slug, {
   message: "Remote skill requires name or slug"
@@ -36016,6 +36055,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -37732,6 +37773,18 @@ class RemoteRequestError extends Error {
     this.name = "RemoteRequestError";
   }
 }
+var KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+
+class RemoteSkillLifecycleError extends RemoteRequestError {
+  code;
+  constructor(path, status, code) {
+    super(path, status);
+    this.name = "RemoteSkillLifecycleError";
+    const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+    this.code = safeCode;
+    this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+  }
+}
 
 class RemoteCreditCheckoutError extends RemoteRequestError {
   code;
@@ -37912,6 +37965,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -38429,6 +38515,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -38581,9 +38680,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject) => {
@@ -38598,7 +38701,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size += next.value.byteLength;
       if (size > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size);
@@ -38609,11 +38712,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -38847,7 +38950,7 @@ function recordScheduleRun(id, status, targetDir) {
 import { createHash as createHash17 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical4 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -38859,7 +38962,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
   return createHash17("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record7) {

package/dist/lib/agent-integration.d.ts

@@ -22,6 +22,17 @@ export interface NativeSkillEntry {
     bridgeHome?: string;
     rootAlias?: AgentRootAlias;
 }
+export interface NativeMigrationTarget {
+    agent: string;
+    projectRoot: string;
+    path: string;
+    treeSha256: string;
+}
+export interface NativeMigrationTargetManifest {
+    schema: "hasna.skills-native-migration-targets.v1";
+    targets: NativeMigrationTarget[];
+    digest: string;
+}
 export interface AgentConfigChange {
     path: string;
     before: string | null;
@@ -40,6 +51,15 @@ export interface AgentIntegrationPlan {
     discoveryAfter?: AgentDiscoveryBinding[];
     rootAliases?: AgentRootAlias[];
 }
+/** Parse the reviewed exact-target binding used by native migration. Paths are
+ * deliberately project-relative so a manifest cannot silently select another
+ * checkout when a project root changes. */
+export declare function parseNativeMigrationTargetManifest(input: string | Buffer): NativeMigrationTargetManifest;
+/** Read a manifest without following links or opening special files, with a
+ * finite bound so a CLI cannot block on an untrusted path. */
+export declare function readNativeMigrationTargetManifest(path: string): NativeMigrationTargetManifest;
+/** Validate every reviewed target before any archive directory or journal is created. */
+export declare function selectNativeMigrationTargets(inventory: NativeSkillEntry[], manifest: NativeMigrationTargetManifest): NativeSkillEntry[];
 export declare function inventoryNativeSkills(home?: string, options?: {
     includeVendor?: boolean;
     guardHermes?: boolean;
@@ -75,6 +95,7 @@ export declare function archiveNativeSkills(inventory: NativeSkillEntry[], optio
     includeUnmanaged?: boolean;
     includeVendor?: boolean;
     allowRootAliases?: boolean;
+    targetManifest?: NativeMigrationTargetManifest;
 }): {
     entries: Array<{
         source: string;
@@ -84,6 +105,11 @@ export declare function archiveNativeSkills(inventory: NativeSkillEntry[], optio
     }>;
     receiptPath?: string;
     rootAliases?: AgentRootAlias[];
+    targetManifest?: {
+        schema: string;
+        digest: string;
+        targetCount: number;
+    };
 };
 /** Run before any prompt context load. Missing ownership or reappearing native
  * discovery files require repair; verified cache availability is not an override. */

package/dist/lib/cloud-executions.d.ts

@@ -1,3 +1,18 @@
+import type { PureExecutionContract } from "../sdk/execution/types.js";
+export interface CloudEligibility {
+    contractVersion: 1;
+    eligible: boolean;
+    skill: string;
+    version: string;
+    bundleDigest: string;
+    reason?: string;
+    runtimeImageDigest?: string;
+    executionContract?: PureExecutionContract | {
+        id: "pdf.v1";
+    };
+    secrets?: "none";
+    egress?: "deny";
+}
 export interface CloudExecution {
     contractVersion: 1;
     id: string;
@@ -7,6 +22,9 @@ export interface CloudExecution {
     bundleDigest: string;
     inputDigest: string;
     runtimeImageDigest: string;
+    executionContract?: PureExecutionContract | {
+        id: "pdf.v1";
+    };
     status: "admitted" | "leased" | "running" | "succeeded" | "failed" | "cancelled";
     exitCode?: number;
     artifacts: {
@@ -22,6 +40,8 @@ export declare class CloudExecutionClient {
     constructor(apiOrigin: string, apiKey: string);
     static configured(): Promise<CloudExecutionClient>;
     private request;
+    /** Metadata only: never creates, starts or reconciles a task. */
+    eligibility(slug: string, version: string, bundleDigest?: string): Promise<CloudEligibility>;
     submit(slug: string, version: string, input: unknown, key: string, selection?: {
         bundleDigest: string;
         workspaceId?: string;

package/dist/lib/registry-types.d.ts

@@ -12,6 +12,9 @@ export interface SkillMeta {
     tags: string[];
     dependencies?: string[];
     version?: string;
+    /** Server registry revision and lifecycle, when supplied by a remote read. */
+    revisionId?: string | null;
+    lifecycle?: "active" | "archived";
     /**
      * Artifact class of the skill. "executable" skills carry a runnable
      * package.json/bin/src; "instruction" skills are SKILL.md-primary prose for

package/dist/lib/remote-client.d.ts

@@ -30,6 +30,10 @@ export declare class RemoteRequestError extends Error {
     readonly status: number;
     constructor(path: string, status: number, _statusText?: string);
 }
+export declare class RemoteSkillLifecycleError extends RemoteRequestError {
+    readonly code?: string;
+    constructor(path: string, status: number, code?: string);
+}
 /** Bounded checkout outcome; the key is caller-owned, never copied from a server error. */
 export declare class RemoteCreditCheckoutError extends RemoteRequestError {
     readonly code: RemoteCreditCheckoutErrorCode;
@@ -144,6 +148,8 @@ export declare class RemoteSkillsClient {
         };
         recurringConsents?: RecurringCapability;
     }>;
+    /** Add the single supported publication scope to an existing key, metadata only. */
+    addSkillPublishScope(keyId: string, expectedScopes: string[], expectedOrgId: string): Promise<Record<string, unknown>>;
     /** Quote first and fail closed when the caller has not approved the required credits. */
     submitQuotedRun(slug: string, input?: Record<string, unknown>, args?: string[], approval?: RemoteRunApproval): Promise<RemoteSkillRunContract>;
     getIdentity(): Promise<Record<string, unknown>>;
@@ -252,6 +258,11 @@ export declare class RemoteSkillsClient {
      */
     publishSkill(manifest: Record<string, unknown>, bundle?: Uint8Array, ifMatch?: string): Promise<Response>;
     deleteSkill(slug: string): Promise<Response>;
+    setSkillLifecycle(slug: string, lifecycle: "active" | "archived", options: {
+        reason?: string;
+        replacementSlug?: string;
+        expectedRevisionId: string;
+    }): Promise<any>;
     downloadSkillBundle(slug: string): Promise<Response>;
     /**
      * Bundle fetch for the verified-pull path. Returns the raw Response so the caller can

package/dist/lib/revision.d.ts

@@ -12,6 +12,9 @@ export interface RevisionContent {
     skillMd?: string;
     bundleSha256?: string;
     bundleByteSize?: number;
+    lifecycle?: "active" | "archived";
+    archiveReason?: string;
+    replacementSlug?: string;
 }
 export declare function revisionIdOf(content: RevisionContent): string;
 export declare function revisionIdOfRecord(record: RevisionContent): string;

package/dist/sdk/execution/admission.d.ts

@@ -10,7 +10,7 @@
  */
 import type { ImageProfileRegistry } from "./image-profile.js";
 import type { RunExecutionStore } from "./storage.js";
-import { type FrozenAdmission, type RunLimits, type RunPolicy, type RuntimeName } from "./types.js";
+import { type FrozenAdmission, type RunLimits, type RunPolicy, type RuntimeName, type PureExecutionContract } from "./types.js";
 export interface SubmitRunInput {
     tenantId: string;
     skillId: string;
@@ -24,6 +24,7 @@ export interface SubmitRunInput {
     systemDeps?: string[];
     policy?: Partial<RunPolicy>;
     limits?: Partial<RunLimits>;
+    executionContract?: PureExecutionContract;
 }
 export interface SubmitRunResult {
     run: FrozenAdmission;

package/dist/sdk/execution/types.d.ts

@@ -33,6 +33,13 @@ export interface RunLimits {
     maxArtifactsBytes: number;
     maxConcurrency: number;
 }
+/** Trusted, versioned adapter identity. Absent only for legacy PDF admissions. */
+export interface PureExecutionContract {
+    id: "regex-test.v1";
+    descriptorDigest: string;
+    entrypoint: string;
+    entrypointDigest: string;
+}
 /** Everything frozen at admission under one stable run_id. */
 export interface FrozenAdmission {
     contractVersion: number;
@@ -46,6 +53,7 @@ export interface FrozenAdmission {
     runtimeImageDigest: string;
     /** Prebuilt dependency layer tag, when the manifest's system_deps are allowlisted. */
     dependencyLayerTag: string | null;
+    executionContract?: PureExecutionContract;
     /** sha256 of the canonical serialization of the run input. */
     inputDigest: string;
     runtime: RuntimeName;
@@ -109,6 +117,7 @@ export interface AttemptReceipt {
     runtimeImageDigest: string;
     bundleDigest: string;
     dependencyLayerTag: string | null;
+    executionContract?: PureExecutionContract;
     policy: RunPolicy;
     limits: RunLimits;
     exitCode: number | null;

package/dist/sdk/index.d.ts

@@ -15,6 +15,7 @@
  * — the shared @hasna/contracts ladder — instead of reading an environment
  * variable of its own. See lib/fleet-credentials.ts.
  */
+export { CloudExecutionClient, type CloudExecution, type CloudEligibility } from "../lib/cloud-executions.js";
 export { readExecutionGrantPolicy, saveExecutionGrantPolicy, resolveExecutionGrant } from "../lib/execution-grant-client.js";
 export type { ExecutionGrant, ExecutionGrantPolicy, ExecutionGrantRequest, ResolvedExecutionGrant } from "../lib/execution-grants.js";
 export { HttpProfileClient, createProfileClient, type ProfileClient, type AuthenticatedProfilePrincipal, type AuthenticatedProfileRole } from "../lib/profile-client.js";