@hasna/skills 0.9.11 → 0.9.13

package/dist/server/rows.d.ts

@@ -1,4 +1,4 @@
-import type { ServerSkillVersion, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillRecord } from "./types.js";
+import type { ServerSkillVersion, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillRecord, PublishedSkillSelectionState } from "./types.js";
 export declare function nowIso(): string;
 /**
  * Coerce a caller-supplied row limit to a non-negative integer.
@@ -17,6 +17,7 @@ export declare function rowToRun(row: Record<string, unknown>): ServerRunRecord;
 export declare function rowToLog(row: Record<string, unknown>): ServerRunLog;
 export declare function rowToArtifact(row: Record<string, unknown>): ServerArtifact;
 export declare function rowToSkill(row: Record<string, unknown>): ServerSkillRecord;
+export declare function rowToPublishedSelectionState(row: Record<string, unknown>): PublishedSkillSelectionState;
 export declare function rowToPin(row: Record<string, unknown>): ServerPin;
 export declare function rowToSkillBundle(row: Record<string, unknown>): ServerSkillBundle;
 export declare function parseJsonObject(value: unknown): Record<string, unknown>;

package/dist/server/sqlite-store.d.ts

@@ -15,7 +15,7 @@ import { SqliteExecutionGrantStore } from "./execution-grant-store.js";
  */
 import { Database } from "bun:sqlite";
 import { SqliteSkillSelectionStore } from "./selection-store.js";
-import type { ApiPrincipal, ClaimRunInput, CreateRunInput, PublishSkillInput, RunTransitionPatch, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillVersion, ApiKeyScopeUpdateResult, OperatorScopeEnrollmentInput, OperatorScopeEnrollmentResult, OperatorScopeTargetSnapshot, ServerSkillRecord, SkillLifecyclePatch, SkillsProductStore, StoreBackendInfo, UpdateSkillPatch } from "./types.js";
+import type { ApiPrincipal, ClaimRunInput, CreateRunInput, PublishSkillInput, PublishedSkillSelection, PublishedSkillSelectionState, RunTransitionPatch, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillVersion, ApiKeyScopeUpdateResult, OperatorScopeEnrollmentInput, OperatorScopeEnrollmentResult, OperatorScopeTargetSnapshot, ServerSkillRecord, SkillLifecyclePatch, SkillsProductStore, StoreBackendInfo, UpdateSkillPatch } from "./types.js";
 export interface SqliteStoreOptions {
     /** Apply pending migrations on open. Default true - it is what makes zero-config work. */
     migrate?: boolean;
@@ -113,6 +113,7 @@ export declare class SqliteSkillsStore implements SkillsProductStore {
     getSkillBundle(principal: ApiPrincipal, sha256: string): Promise<ServerSkillBundle | null>;
     listSkillVersions(principal: ApiPrincipal, slug: string): Promise<ServerSkillVersion[]>;
     getSkillVersion(principal: ApiPrincipal, slug: string, version: string): Promise<ServerSkillVersion | null>;
+    getPublishedSelectionStates(principal: ApiPrincipal, selections: readonly PublishedSkillSelection[]): Promise<PublishedSkillSelectionState[]>;
     pinSkill(principal: ApiPrincipal, slug: string, metadata?: Record<string, unknown>): Promise<ServerPin>;
     unpinSkill(principal: ApiPrincipal, slug: string): Promise<boolean>;
     listPins(principal: ApiPrincipal): Promise<ServerPin[]>;

package/dist/server/store.d.ts

@@ -1,6 +1,6 @@
 import { MemoryExecutionGrantStore, PostgresExecutionGrantStore } from "./execution-grant-store.js";
 import { MemorySkillSelectionStore, PostgresSkillSelectionStore } from "./selection-store.js";
-import type { ApiPrincipal, ClaimRunInput, CreateRunInput, PublishSkillInput, RunTransitionPatch, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillRecord, ServerSkillVersion, ApiKeyScopeUpdateResult, OperatorScopeEnrollmentInput, OperatorScopeEnrollmentResult, OperatorScopeTargetSnapshot, SkillsProductStore, StoreBackendInfo, UpdateSkillPatch } from "./types.js";
+import type { ApiPrincipal, ClaimRunInput, CreateRunInput, PublishSkillInput, PublishedSkillSelection, PublishedSkillSelectionState, RunTransitionPatch, ServerArtifact, ServerPin, ServerRunLog, ServerRunRecord, ServerSkillBundle, ServerSkillRecord, ServerSkillVersion, ApiKeyScopeUpdateResult, OperatorScopeEnrollmentInput, OperatorScopeEnrollmentResult, OperatorScopeTargetSnapshot, SkillsProductStore, StoreBackendInfo, UpdateSkillPatch } from "./types.js";
 import { type SkillLifecyclePatch } from "./types.js";
 import { type SqliteStoreOptions } from "./sqlite-store.js";
 export declare function createArtifactId(): string;
@@ -79,6 +79,7 @@ export declare class MemorySkillsStore implements SkillsProductStore {
     publishSkill(input: PublishSkillInput): Promise<ServerSkillRecord>;
     listSkillVersions(principal: ApiPrincipal, slug: string): Promise<ServerSkillVersion[]>;
     getSkillVersion(principal: ApiPrincipal, slug: string, version: string): Promise<ServerSkillVersion | null>;
+    getPublishedSelectionStates(principal: ApiPrincipal, selections: readonly PublishedSkillSelection[]): Promise<PublishedSkillSelectionState[]>;
     listSkills(principal: ApiPrincipal): Promise<ServerSkillRecord[]>;
     getSkill(principal: ApiPrincipal, slug: string): Promise<ServerSkillRecord | null>;
     setSkillLifecycle(principal: ApiPrincipal, slug: string, patch: SkillLifecyclePatch, expectedRevisionId?: string): Promise<ServerSkillRecord | null>;
@@ -180,6 +181,7 @@ export declare class PostgresSkillsStore implements SkillsProductStore {
     getSkillBundle(principal: ApiPrincipal, sha256: string): Promise<ServerSkillBundle | null>;
     listSkillVersions(principal: ApiPrincipal, slug: string): Promise<ServerSkillVersion[]>;
     getSkillVersion(principal: ApiPrincipal, slug: string, version: string): Promise<ServerSkillVersion | null>;
+    getPublishedSelectionStates(principal: ApiPrincipal, selections: readonly PublishedSkillSelection[]): Promise<PublishedSkillSelectionState[]>;
     pinSkill(principal: ApiPrincipal, slug: string, metadata?: Record<string, unknown>): Promise<ServerPin>;
     unpinSkill(principal: ApiPrincipal, slug: string): Promise<boolean>;
     listPins(principal: ApiPrincipal): Promise<ServerPin[]>;

package/dist/server/types.d.ts

@@ -279,6 +279,17 @@ export interface ServerSkillVersion {
     publishedByUserId?: string;
     createdAt: string;
 }
+/** Exact version lookup, independent of the registry's mutable current version. */
+export interface PublishedSkillSelection {
+    slug: string;
+    version: string;
+}
+/** Metadata only: bundle availability means its tenant-owned storage row exists. */
+export interface PublishedSkillSelectionState extends PublishedSkillSelection {
+    current: Pick<ServerSkillRecord, "lifecycle" | "tombstonedAt"> | null;
+    versionBundleSha256: string | null;
+    bundleAvailable: boolean;
+}
 export interface PublishSkillInput {
     /** Internal boot-seed precondition: never revive or replace non-bundled records. */
     seedBundledOnly?: true;
@@ -441,6 +452,13 @@ export interface SkillsProductStore {
     /** Every published version of a slug, newest first (hasna/apps#1630). */
     listSkillVersions(principal: ApiPrincipal, slug: string): Promise<ServerSkillVersion[]>;
     getSkillVersion(principal: ApiPrincipal, slug: string, version: string): Promise<ServerSkillVersion | null>;
+    /**
+     * Read at most MAX_PROFILE_SELECTIONS exact selections in one database snapshot,
+     * scoped to the principal's org at every join. Returns one row per input in input
+     * order, including missing selections and duplicates. Never reads bundle bytes or
+     * substitutes the latest version; callers retain lifecycle/digest error policy.
+     */
+    getPublishedSelectionStates(principal: ApiPrincipal, selections: readonly PublishedSkillSelection[]): Promise<PublishedSkillSelectionState[]>;
     pinSkill(principal: ApiPrincipal, slug: string, metadata?: Record<string, unknown>): Promise<ServerPin>;
     /** False when this principal has no pin by that slug. */
     unpinSkill(principal: ApiPrincipal, slug: string): Promise<boolean>;

package/docs/plugin-admission.md

@@ -286,3 +286,39 @@ cache history is bounded to 128 entries and an aggregate 256 MiB per witness.
 Primary runtime references: [command sources](https://code.claude.com/docs/en/plugin-marketplaces#command-sources),
 [plugin components](https://code.claude.com/docs/en/plugins-reference), and
 [exact command acceptance](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21271).
+
+### Explicit v2 preference reviews
+
+`captureClaudeSettingsV2(path)` creates a `claude-settings-v2` witness. In
+addition to the v1 display/model selections, it tolerates the documented
+persisted effort values `low`, `medium`, `high`, and `xhigh`, both at the top
+level and in known built-in model entries whose only property is `effortLevel`.
+Custom model entries and entries with any other property remain fully bound.
+The boolean `skipDangerousModePermissionPrompt` is Claude's saved dialog
+acknowledgment; it does not select a permission mode. Permission settings,
+plugins, hooks, environment, ultracode and unknown configuration remain bound.
+Invalid recognized preference types are refused.
+
+`captureClaudeMarketplaceRegistryV2(path)` creates a
+`claude-marketplace-registry-v2` witness. It also recognizes a registry row with
+an optional boolean `autoUpdate`. That boolean remains bound; only a strictly
+validated `lastUpdated` timestamp may vary. A new source or installation path,
+a changed automatic-update policy, or an unknown field still requires review.
+
+Capture either witness through the CLI:
+
+```sh
+skills hook witness --kind claude-settings-v2 --path /canonical/home/.claude/settings.json --json
+skills hook witness --kind claude-marketplace-registry-v2 --path /canonical/home/.claude/plugins/known_marketplaces.json --json
+```
+
+Capture does not install or authorize a review. Compare the current complete
+configuration with its previous review, put the chosen witness in the reviewed
+discovery inputs, and preview `skills hook install --discovery-inputs <file>`
+before applying. Existing byte and v1 witnesses are never silently converted.
+Runtime support for the selected witness version must be installed before
+policy activation. A real hook installation is a configuration change, not a
+preference: its owning installer must coordinate a guarded settings/policy
+update, or it needs a fresh explicit review.
+
+The effort schema follows [Claude's model configuration documentation](https://code.claude.com/docs/en/model-config#adjust-effort-level).

package/docs/skill-standard.md

@@ -122,7 +122,7 @@ incomplete, invalid, or whose `content_hash` does not match the bundle.
 | `name` | string | Lowercase slug; matches the folder name |
 | `description` | string | What this skill does and when to use it |
 | `version` | string | Semver (e.g. `0.1.0`). Any content change requires a version bump |
-| `runtime` | object | The runtime contract below |
+| `runtime` | object | The runtime contract below; optional for explicit `kind: instruction` |
 | `provenance` | object | Source and integrity fields; `content_hash` is required |
 
 ### Optional fields (legacy-compatible)
@@ -139,6 +139,12 @@ incomplete, invalid, or whose `content_hash` does not match the bundle.
 
 ### The runtime contract
 
+An explicit `kind: instruction` manifest may omit `runtime`. Preparation keeps
+that omission and does not invent an executable entrypoint. If runtime metadata
+is supplied for an instruction, its fields still must satisfy this contract.
+Executable manifests and legacy manifests without an explicit kind retain the
+strict runtime requirement.
+
 | field | type | default | meaning |
 |---|---|---|---|
 | `runtime` | `"bun" \| "node" \| "python3"` | *(required)* | Execution runtime. `bun` is the Hasna default |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {