skillscript-runtime 0.18.9 → 0.19.1

package/docs/configuration.md

@@ -57,6 +57,8 @@ The CLI auto-loads `$SKILLSCRIPT_HOME/.env` at startup and populates `process.en
 | `SKILLSCRIPT_POLL_INTERVAL_SECONDS=30` | Scheduler tick / poll interval (seconds) | env > config > default `30` |
 | `SKILLSCRIPT_ABSOLUTE_TIMEOUT_MS=300000` | Runtime fallback timeout (ms) when no per-op / skill / connector default applies | env > config > default `300000` (5 min) |
 | `SKILLSCRIPT_MAX_RECURSION_DEPTH=10` | Composition recursion depth ceiling for `$ execute_skill` chains | env > config > default `10` |
+| `SKILLSCRIPT_EVENT_INGRESS_ENABLED=true` | Mount `POST /event` for v0.19.0 event-triggered skills. Default `false` — route returns 404 when not enabled. Shares `SKILLSCRIPT_PORT` with dashboard/RPC (one HTTP server). | env > default `false` |
+| `SKILLSCRIPT_EVENT_INGRESS_AUTH_TOKEN=<token>` | Bearer-token auth for `POST /event`. When set, every event POST requires `Authorization: Bearer <token>`; 401 otherwise. Default unset = open-internally (still gated by bind address). | env > default unset |
 | `OLLAMA_BASE_URL=http://...` | Ollama endpoint for LocalModel (default `http://localhost:11434`) | env > built-in default |
 
 `SKILLSCRIPT_HOME` is the chicken-and-egg case — the path to `.env` requires it, so `.env` can't set it. Use shell, Docker `-e`, or systemd `Environment=` instead.

package/examples/skillscripts/hello-world.skill.provenance.json

@@ -2,7 +2,7 @@
   "provenance_version": "1.0",
   "language_version": "1.0",
   "compiler_version": "0.1.0-dev",
-  "compiled_at": "2026-06-07T11:45:30.911Z",
+  "compiled_at": "2026-06-07T23:02:51.300Z",
   "source_skill": {
     "name": "hello-world"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillscript-runtime",
-  "version": "0.18.9",
+  "version": "0.19.1",
   "description": "Runtime, compiler, lint, CLI, and dashboard for Skillscript — a small declarative language for authoring agent workflows.",
   "license": "MIT",
   "author": "Scott Shwarts <scotts@pobox.com>",

package/scaffold/.env.example

@@ -64,10 +64,31 @@
 # reach the listener.
 # SKILLSCRIPT_HOST=0.0.0.0
 
-# Dashboard / serve HTTP port. Default 7878.
+# Dashboard / serve HTTP port. Default 7878. Used for the SPA, JSON-RPC
+# at /rpc, AND the v0.19.0 event-trigger ingress at /event (they share
+# one HTTP server — no separate event port).
 # SKILLSCRIPT_PORT=8080
 
 
+# ─── Event-trigger HTTP ingress (v0.19.0) ──────────────────────────────
+
+# Enable POST /event for external HTTP-triggered skills. Default false —
+# the route returns 404 when not enabled. Once enabled, external services
+# POST {event_name, params} and the runtime fires the registered skill
+# asynchronously, returning 200 + {run_id, durability: "in-process"}.
+# The route mounts on SKILLSCRIPT_PORT (above); no separate port.
+# Localhost-only by default — set SKILLSCRIPT_HOST=0.0.0.0 to expose
+# beyond loopback. "Enforce the DMZ assumption by the bind, not by hope."
+# SKILLSCRIPT_EVENT_INGRESS_ENABLED=true
+
+# Optional bearer-token auth for POST /event. When set, every event
+# POST must carry `Authorization: Bearer <token>` matching this value;
+# 401 otherwise. Default unset = open-internally (still gated by the
+# bind address). Cheap to wire early — turning it on later is just an
+# env edit + restart, no refactor.
+# SKILLSCRIPT_EVENT_INGRESS_AUTH_TOKEN=your-secret-token-here
+
+
 # ─── Runtime tuning ────────────────────────────────────────────────────
 
 # Scheduler tick / poll interval in seconds. Default 30. Lower (e.g. 5)