@hasna/skills 0.8.2 → 0.8.4

package/dist/server/execution-grant-store.d.ts

@@ -0,0 +1,29 @@
+import type { Database } from "bun:sqlite";
+import type { ApiPrincipal } from "./types.js";
+import type { ExecutionGrant, ExecutionGrantPolicy } from "../lib/execution-grants.js";
+export interface ExecutionGrantStore {
+    get(principal: ApiPrincipal, profileId: string, revision?: string): Promise<ExecutionGrantPolicy | null>;
+    /** Atomically change the current revision and append immutable history. Null is a CAS conflict. */
+    save(principal: ApiPrincipal, profileId: string, grants: ExecutionGrant[], expected: string | null): Promise<ExecutionGrantPolicy | null>;
+}
+type Row = Record<string, unknown>;
+export declare class MemoryExecutionGrantStore implements ExecutionGrantStore {
+    private current;
+    private history;
+    get(p: ApiPrincipal, id: string, revision?: string): Promise<ExecutionGrantPolicy | null>;
+    save(p: ApiPrincipal, id: string, grants: ExecutionGrant[], expected: string | null): Promise<ExecutionGrantPolicy | null>;
+}
+export declare class SqliteExecutionGrantStore implements ExecutionGrantStore {
+    private db;
+    constructor(db: Database);
+    get(p: ApiPrincipal, id: string, revision?: string): Promise<ExecutionGrantPolicy | null>;
+    save(p: ApiPrincipal, id: string, grants: ExecutionGrant[], expected: string | null): Promise<ExecutionGrantPolicy | null>;
+}
+type Sql = (strings: TemplateStringsArray, ...values: unknown[]) => Promise<Row[]>;
+export declare class PostgresExecutionGrantStore implements ExecutionGrantStore {
+    private sql;
+    constructor(sql: Sql);
+    get(p: ApiPrincipal, id: string, revision?: string): Promise<ExecutionGrantPolicy | null>;
+    save(p: ApiPrincipal, id: string, grants: ExecutionGrant[], expected: string | null): Promise<ExecutionGrantPolicy | null>;
+}
+export {};

package/dist/server/execution-grants-api.d.ts

@@ -0,0 +1,4 @@
+import type { ApiPrincipal, SkillsProductStore } from "./types.js";
+import type { SkillsServerConfig } from "./config.js";
+import type { ArtifactStorage } from "./artifact-storage.js";
+export declare function handleExecutionGrantApi(store: SkillsProductStore, principal: ApiPrincipal, request: Request, parts: string[], config: SkillsServerConfig, artifacts: ArtifactStorage): Promise<Response | null>;

package/dist/server/sqlite-store.d.ts

@@ -1,3 +1,4 @@
+import { SqliteExecutionGrantStore } from "./execution-grant-store.js";
 /**
  * SQLite implementation of SkillsProductStore.
  *
@@ -32,6 +33,7 @@ export interface SqliteStoreOptions {
 }
 export declare class SqliteSkillsStore implements SkillsProductStore {
     get selectionStore(): SqliteSkillSelectionStore;
+    get executionGrantStore(): SqliteExecutionGrantStore;
     readonly backend: StoreBackendInfo;
     private db;
     private closed;

package/dist/server/store.d.ts

@@ -1,3 +1,4 @@
+import { MemoryExecutionGrantStore, PostgresExecutionGrantStore } from "./execution-grant-store.js";
 import { MemorySkillSelectionStore, PostgresSkillSelectionStore } from "./selection-store.js";
 import type { ApiPrincipal, ClaimRunInput, CreateRunInput, PublishSkillInput, RunTransitionPatch, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillRecord, ServerSkillVersion, SkillsProductStore, StoreBackendInfo, UpdateSkillPatch } from "./types.js";
 import { type SqliteStoreOptions } from "./sqlite-store.js";
@@ -25,6 +26,7 @@ export interface StoreOptions {
 export declare function createStore(options?: StoreOptions): Promise<SkillsProductStore>;
 export declare class MemorySkillsStore implements SkillsProductStore {
     readonly selectionStore: MemorySkillSelectionStore;
+    readonly executionGrantStore: MemoryExecutionGrantStore;
     readonly backend: StoreBackendInfo;
     private apiKeys;
     private runs;
@@ -90,6 +92,7 @@ export declare class MemorySkillsStore implements SkillsProductStore {
 }
 export declare class PostgresSkillsStore implements SkillsProductStore {
     get selectionStore(): PostgresSkillSelectionStore;
+    get executionGrantStore(): PostgresExecutionGrantStore;
     readonly backend: StoreBackendInfo;
     private sql;
     constructor(databaseUrl: string);

package/dist/server/types.d.ts

@@ -1,4 +1,5 @@
 import type { OwnedBytes } from "../lib/skill-bundle.js";
+import type { ExecutionGrantStore } from "./execution-grant-store.js";
 import type { SkillSelectionStore } from "./selection-store.js";
 export declare const SERVER_RUN_STATUSES: readonly ["queued", "waiting_for_approval", "running", "succeeded", "failed", "cancel_requested", "cancelled", "retrying", "expired", "refunded"];
 export type ServerRunStatus = (typeof SERVER_RUN_STATUSES)[number];
@@ -300,6 +301,7 @@ export interface SkillsProductStore {
     readonly backend?: StoreBackendInfo;
     /** Optional for third-party stores; profile APIs fail closed when absent. */
     readonly selectionStore?: SkillSelectionStore;
+    readonly executionGrantStore?: ExecutionGrantStore;
     /** Release connections and file handles. Optional; not every backend holds any. */
     close?(): Promise<void>;
     /**

package/migrations/postgres/0009_execution_grants.sql

@@ -0,0 +1,15 @@
+-- Explicit org predicates fence API reads/writes; there is no context-less worker writer.
+CREATE TABLE IF NOT EXISTS skills_execution_grants (
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  profile_id text NOT NULL,
+  revision text NOT NULL,
+  document_json jsonb NOT NULL,
+  PRIMARY KEY (org_id, profile_id)
+);
+CREATE TABLE IF NOT EXISTS skills_execution_grant_revisions (
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  profile_id text NOT NULL,
+  revision text NOT NULL,
+  document_json jsonb NOT NULL,
+  PRIMARY KEY (org_id, profile_id, revision)
+);

package/migrations/sqlite/0009_execution_grants.sql

@@ -0,0 +1,15 @@
+-- Current policy and immutable history are changed in one transaction.
+CREATE TABLE IF NOT EXISTS skills_execution_grants (
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  profile_id text NOT NULL,
+  revision text NOT NULL,
+  document_json text NOT NULL,
+  PRIMARY KEY (org_id, profile_id)
+);
+CREATE TABLE IF NOT EXISTS skills_execution_grant_revisions (
+  org_id text NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+  profile_id text NOT NULL,
+  revision text NOT NULL,
+  document_json text NOT NULL,
+  PRIMARY KEY (org_id, profile_id, revision)
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {