@supplyaipro/package-signing 1.1.0

package/README.md

@@ -0,0 +1,8 @@
+# @supplyaipro/package-signing
+
+Catalogue id: `@supply/package-signing`
+
+```bash
+npm install -g @supplyaipro/installer
+supply lease @supplyaipro/package-signing --consumer weft --intent intent_local --action invoke --ttl 120m --uses 3
+```

package/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: Package Signing
+id: @supply/package-signing
+---
+
+# Package Signing
+
+Sign releases and preserve provenance from publisher source to installation.
+
+Run this capability as one job. Do not split it into catalogue micro-skills.

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@supplyaipro/package-signing",
+  "version": "1.1.0",
+  "description": "Package Signing. Catalogue id @supply/package-signing.",
+  "license": "UNLICENSED",
+  "homepage": "https://supplyai.pro",
+  "publishConfig": {
+    "access": "public"
+  },
+  "supply": {
+    "catalogueId": "@supply/package-signing"
+  }
+}

package/policies/permissions.yaml

@@ -0,0 +1,4 @@
+filesystem: project
+network: declared-domains
+shell: as-declared
+secrets: never-in-kit

package/record.json

@@ -0,0 +1,13 @@
+{
+  "id": "@supply/package-signing",
+  "publisher": "supply",
+  "kit": "package-signing",
+  "version": "1.1.0",
+  "digest": "abd7ba6d278635f3c59a4d223a0c0708eb4b235bf889fadaedfd9d571f027eb5",
+  "yanked": false,
+  "files": [
+    "supply.yaml",
+    "SKILL.md",
+    "policies/permissions.yaml"
+  ]
+}

package/supply.yaml

@@ -0,0 +1,16 @@
+schema: http://127.0.0.1:3000/schema/v1
+id: @supply/package-signing
+name: Package Signing
+version: 1.1.0
+publisher: SUPPLY
+license: Standard
+destinations:
+  - codex
+  - mcp
+  - cursor
+
+permissions:
+  filesystem: project
+  network: declared-domains
+  shell: as-declared
+  secrets: never-in-kit