@hasna/skills 0.8.2 → 0.8.3

package/dist/cli/commands/grants.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerGrants(parent: Command): void;

package/dist/index.js

@@ -37660,7 +37660,7 @@ import { dirname as dirname14, relative as relative7 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.2",
+  version: "0.8.3",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/lib/execution-grant-client.d.ts

@@ -0,0 +1,5 @@
+import { type ExecutionGrant, type ExecutionGrantPolicy, type ExecutionGrantRequest, type ResolvedExecutionGrant } from "./execution-grants.js";
+export declare function readExecutionGrantPolicy(profileId: string, revision?: string): Promise<ExecutionGrantPolicy>;
+export declare function saveExecutionGrantPolicy(profileId: string, grants: ExecutionGrant[], revision?: string): Promise<ExecutionGrantPolicy>;
+/** No disk cache: every execution obtains a current decision from its configured Skills authority. */
+export declare function resolveExecutionGrant(input: ExecutionGrantRequest): Promise<ResolvedExecutionGrant>;

package/dist/lib/execution-grants.d.ts

@@ -0,0 +1,49 @@
+import type { SelectedSecretBindings } from "./execution-secrets.js";
+export declare const MAX_EXECUTION_GRANTS = 256;
+export declare const MAX_EXECUTION_GRANT_BYTES: number;
+export interface ExecutionGrant {
+    id: string;
+    target: "local";
+    selection: {
+        slug: string;
+        version: string;
+        bundleDigest: string;
+    };
+    actors: string[];
+    /** Canonical directory conditions, not cryptographic machine attestation. */
+    consumers: {
+        stationId: string;
+        workspaceDirectory: string;
+        includeDescendants?: boolean;
+    }[];
+    secretsAuthority: string;
+    bindings: Record<string, string>;
+    expiresAt?: string;
+}
+export interface ExecutionGrantPolicy {
+    schema: "hasna.skills-execution-grants.v1";
+    profileId: string;
+    workspaceId: string;
+    revision: string;
+    previousRevision: string | null;
+    updatedAt: string;
+    actorId: string;
+    grants: ExecutionGrant[];
+}
+export interface ExecutionGrantRequest {
+    selection: SelectedSecretBindings["selection"];
+    consumer: SelectedSecretBindings["consumer"];
+}
+export interface ResolvedExecutionGrant {
+    policyRevision: string;
+    grantId: string;
+    bindings: SelectedSecretBindings;
+}
+export declare function grantIdentifier(v: unknown): v is string;
+export declare function grantRecord(v: unknown): v is Record<string, unknown>;
+export declare function grantWorkspace(v: unknown): v is string;
+export declare function grantDirectoryContains(root: string, directory: string, descendants?: boolean): boolean;
+export declare function validateExecutionGrants(value: unknown): ExecutionGrant[];
+export declare function validateExecutionGrantPolicy(value: unknown): ExecutionGrantPolicy;
+export declare function validateExecutionGrantRequest(value: unknown): ExecutionGrantRequest;
+export declare function executionGrantMatches(g: ExecutionGrant, r: ExecutionGrantRequest, actorId: string, now?: number): boolean;

package/dist/lib/selected-manifest.d.ts

@@ -0,0 +1,6 @@
+import type { SkillBundleEntry } from "./skill-bundle.js";
+export declare function describeEntries(entries: SkillBundleEntry[]): {
+    kind: "executable" | "instruction";
+    manifest: Record<string, any>;
+    packageJson: Record<string, any>;
+};

package/dist/lib/selected-run.d.ts

@@ -1,3 +1,4 @@
+import { type ExecutionGrantRequest, type ResolvedExecutionGrant } from "./execution-grants.js";
 import type { ResolvedSkillSelection } from "../types/skill-selection.js";
 import type { SkillBundleEntry } from "./skill-bundle.js";
 import { type SelectionResolverOptions } from "./selection-resolver.js";
@@ -23,6 +24,10 @@ export interface SelectedLocalRunOptions {
     secretBindings?: SelectedSecretBindings;
     /** SDK injection seam. The default uses the independently configured Secrets SDK. */
     createSecretsClient?: () => SelectedSecretsClient;
+    /** Disable network authorization for explicit cached execution; declared secrets then need caller bindings. */
+    sharedExecutionGrants?: boolean;
+    /** SDK seam for current shared authorization; responses still undergo exact binding validation. */
+    resolveExecutionGrant?: (request: ExecutionGrantRequest) => Promise<ResolvedExecutionGrant>;
 }
 export declare function prepareSelectedSecretBindings(selected: ResolvedSelectedRun, cwd?: string): Promise<SelectedSecretBindings>;
 export declare function executeSelectedLocal(selected: ResolvedSelectedRun, options?: SelectedLocalRunOptions): Promise<{
@@ -42,6 +47,10 @@ export declare function executeSelectedLocal(selected: ResolvedSelectedRun, opti
         secretsAuthority: string;
         bindings: Record<string, string>;
     } | undefined;
+    executionGrant?: {
+        policyRevision: string;
+        grantId: string;
+    } | undefined;
     selection: ResolvedSkillSelection;
     target: "local";
     runtime: any;

package/dist/sdk/index.d.ts

@@ -15,6 +15,8 @@
  * — the shared @hasna/contracts ladder — instead of reading an environment
  * variable of its own. See lib/fleet-credentials.ts.
  */
+export { readExecutionGrantPolicy, saveExecutionGrantPolicy, resolveExecutionGrant } from "../lib/execution-grant-client.js";
+export type { ExecutionGrant, ExecutionGrantPolicy, ExecutionGrantRequest, ResolvedExecutionGrant } from "../lib/execution-grants.js";
 export { HttpProfileClient, createProfileClient, type ProfileClient } from "../lib/profile-client.js";
 export { resolveSelectedRun, executeSelectedLocal, prepareSelectedSecretBindings, type ResolvedSelectedRun, type SelectedLocalRunOptions } from "../lib/selected-run.js";
 export { readSelectedSecretBindings, type SelectedSecretBindings, type SelectedSecretsClient } from "../lib/execution-secrets.js";