@hasna/skills 0.1.63 → 0.1.64

package/dist/sdk/index.js

@@ -22936,11 +22936,12 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
 
-// ../../node_modules/.bun/@hasna+events@0.1.7/node_modules/@hasna/events/dist/index.js
+// ../events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
-import { existsSync as existsSync14 } from "fs";
+import { Buffer as Buffer2 } from "buffer";
+import { existsSync as existsSync13 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { randomUUID as randomUUID5 } from "crypto";
 import { spawn } from "child_process";
@@ -22953,29 +22954,83 @@ function getPathValue(input, path) {
     return;
   }, input);
 }
-function wildcardToRegExp(pattern) {
-  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
+function getFieldValues(input, path) {
+  const values = [];
+  const push = (value) => {
+    if (!values.some((item) => Object.is(item, value)))
+      values.push(value);
+  };
+  if (path.includes(".") && path in input)
+    push(input[path]);
+  const nestedValue = getPathValue(input, path);
+  if (nestedValue !== undefined || !path.includes("."))
+    push(nestedValue);
+  return values;
+}
+function wildcardToRegExp(pattern, options = {}) {
+  let body = "";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        body += ".*";
+        index += 1;
+      } else {
+        body += options.segmentSafe ? "[^/]*" : ".*";
+      }
+    } else {
+      body += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
 }
-function matchString(value, matcher) {
+function matchString(value, matcher, options = {}) {
   if (matcher === undefined)
     return true;
   if (value === undefined)
     return false;
   const matchers = Array.isArray(matcher) ? matcher : [matcher];
-  return matchers.some((item) => wildcardToRegExp(item).test(value));
+  return matchers.some((item) => wildcardToRegExp(item, options).test(value));
 }
 function matchRecord(input, matcher) {
   if (!matcher)
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
-    const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected);
-    }
-    return actual === expected;
+    const actualValues = getFieldValues(input, path);
+    return matchField(actualValues, expected, path);
   });
 }
+function matchField(actualValues, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !actualValues.some((actual) => matchPositiveField(actual, expected.not, path));
+  }
+  return actualValues.some((actual) => matchPositiveField(actual, expected, path));
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -22987,19 +23042,21 @@ function channelMatchesEvent(channel, event) {
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join16(homedir5(), ".hasna", "events");
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join15(homedir5(), ".hasna", "events");
 }
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
-    this.channelsPath = join16(dataDir, "channels.json");
-    this.eventsPath = join16(dataDir, "events.json");
-    this.deliveriesPath = join16(dataDir, "deliveries.json");
+    this.runtime = localJsonRuntime(dataDir);
+    this.channelsPath = join15(dataDir, "channels.json");
+    this.eventsPath = join15(dataDir, "events.json");
+    this.deliveriesPath = join15(dataDir, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -23044,13 +23101,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -23071,7 +23173,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync14(path)) {
+    if (!existsSync13(path)) {
       await writeFile2(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -23101,6 +23203,83 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -23114,21 +23293,27 @@ function now() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp = event.time;
+  const timestamp = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp, body);
   }
   return { body, headers };
 }
@@ -23136,7 +23321,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -23168,6 +23367,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -23256,6 +23464,76 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now()
   };
 }
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID22(),
@@ -23276,10 +23554,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp = new Date().toISOString();
@@ -23297,18 +23583,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -23325,7 +23633,7 @@ class EventsClient {
     }
     return deliveries;
   }
-  async testChannel(id, input = {}) {
+  async matchChannel(id, input = {}) {
     const channel = await this.store.getChannel(id);
     if (!channel)
       throw new Error(`Channel not found: ${id}`);
@@ -23342,28 +23650,71 @@ class EventsClient {
       time: input.time,
       id: input.id
     });
+    const matched = channelMatchesEvent(channel, event);
+    return {
+      channelId: channel.id,
+      matched,
+      event,
+      filters: channel.filters,
+      reason: matched ? undefined : channel.enabled ? "event did not match channel filters" : "channel is disabled"
+    };
+  }
+  async testChannel(id, input = {}, options = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const match = await this.matchChannel(id, input);
+    const event = match.event;
+    if (options.honorFilters && !match.matched) {
+      const timestamp = new Date().toISOString();
+      const result2 = createDeliveryResult(event, channel, [{
+        attempt: 1,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: match.reason
+      }]);
+      result2.metadata = { reason: "filter_mismatch" };
+      await this.store.appendDelivery(result2);
+      return result2;
+    }
     const eventForChannel = await this.applyRedaction(event, channel);
     const result = await this.deliverWithRetry(eventForChannel, channel);
     await this.store.appendDelivery(result);
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -23390,43 +23741,19 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -23440,9 +23767,22 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  EventValidationError = class EventValidationError extends Error {
+    eventType;
+    issues;
+    constructor(eventType, issues) {
+      const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+      super(`Event validation failed for type "${eventType}": ${detail}`);
+      this.name = "EventValidationError";
+      this.eventType = eventType;
+      this.issues = issues;
+    }
+  };
+  defaultEventTypeCatalog = new EventTypeCatalog;
+  APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
 });
 
 // src/sdk/event-sink.ts
@@ -23526,6 +23866,7 @@ var ANY_SEGMENT_EXCLUDES = new Set([
   ".docker"
 ]);
 var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
 var CREDENTIAL_FILENAMES = new Set([
   ".npmrc",
   ".pypirc",
@@ -33591,9 +33932,10 @@ function resolveServerConfig(env = process.env) {
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
     inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
     requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
     skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
     publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
     nodeEnv,
     allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
@@ -33671,6 +34013,11 @@ function normalizeConfigValue(key, value) {
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var INSTALLED_SKILLS_DIRNAME = "installed";
+var SKILLS_CACHE_DIRNAME = "skills";
+var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
+function isOwnerLayoutMigrated(appDir) {
+  return existsSync(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+}
 function getDataDir() {
   const override = process.env[DATA_DIR_ENV];
   if (override) {
@@ -33849,7 +34196,7 @@ function looksLikeSqlitePath(value) {
 }
 
 // src/server/handlers.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/server/store.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -33870,6 +34217,19 @@ class StaleLeaseGenerationError extends Error {
   }
 }
 
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
 // src/server/rows.ts
 import { randomUUID } from "crypto";
 function nowIso() {
@@ -33950,7 +34310,20 @@ function rowToSkill(row) {
     ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
     ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
     createdAt: dateString(row.created_at),
-    updatedAt: dateString(row.updated_at)
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
   };
 }
 function rowToSkillBundle(row) {
@@ -34002,6 +34375,29 @@ function dateString(value) {
   return String(value);
 }
 
+// src/lib/revision.ts
+import { createHash as createHash5 } from "crypto";
+var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash5("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
+}
+
 // src/server/sqlite-store.ts
 import { Database } from "bun:sqlite";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -34049,6 +34445,7 @@ function defaultStartDirs() {
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 var LAST_USED_RESOLUTION_MS = 60000;
 
 class SqliteSkillsStore {
@@ -34068,12 +34465,24 @@ class SqliteSkillsStore {
     if (options.migrate !== false) {
       applySqliteMigrations(this.db, options.migrationsDir);
     }
+    this.backfillLegacyRevisions();
     this.backend = {
       kind: "sqlite",
       durable: !inMemory,
       label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
     };
   }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
   get database() {
     return this.db;
   }
@@ -34297,8 +34706,29 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -34319,8 +34749,8 @@ class SqliteSkillsStore {
         ]);
       }
       const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
          ON CONFLICT (org_id, slug) DO UPDATE SET
            display_name = excluded.display_name,
            description = excluded.description,
@@ -34338,7 +34768,16 @@ class SqliteSkillsStore {
            bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
            bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
            published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
+         WHERE skills_registry.tombstoned_at IS NOT NULL
+            OR skills_registry.revision_id = ?
          RETURNING *`, [
         orgId,
         input.slug,
@@ -34349,62 +34788,165 @@ class SqliteSkillsStore {
         input.source,
         input.kind,
         input.version ?? null,
-        input.skillMd ?? null,
+        carriedSkillMd,
         input.bundle?.sha256 ?? null,
         input.bundle?.byteSize ?? null,
         input.principal.userId,
+        revisionId,
         now,
-        now
+        now,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
       return rowToSkill(row);
     })();
   }
   async listSkills(principal) {
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const row = this.get(`UPDATE skills_registry
-       SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?, updated_at = ?
-       WHERE org_id = ? AND slug = ?
-       RETURNING *`, [
-      next.displayName,
-      next.description,
-      next.category,
-      JSON.stringify(next.tags),
-      next.kind,
-      next.version ?? null,
-      next.skillMd ?? null,
-      nowIso(),
-      principal.orgId,
-      slug
-    ]);
-    return row ? rowToSkill(row) : null;
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next.displayName,
+        next.description,
+        next.category,
+        JSON.stringify(next.tags),
+        next.kind,
+        next.version ?? null,
+        next.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return this.db.transaction(() => {
-      const existing = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       if (!existing)
-        return false;
-      this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (typeof existing.bundle_sha256 === "string")
-        this.collectOrphanBundle(principal.orgId, existing.bundle_sha256);
-      return true;
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
     })();
   }
   async getSkillBundle(principal, sha256) {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)
@@ -34491,6 +35033,21 @@ function parseScopes(value) {
 }
 
 // src/server/store.ts
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
 function resolvePoolMax(env = process.env) {
   const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
@@ -34528,6 +35085,7 @@ class MemorySkillsStore {
   idempotency = new Map;
   skills = new Map;
   bundles = new Map;
+  pins = new Map;
   constructor(apiKeys = []) {
     for (const key of apiKeys)
       this.addApiKey(key.token, key.principal);
@@ -34629,6 +35187,9 @@ class MemorySkillsStore {
     const key = skillKey(input.principal.orgId, input.slug);
     const now = nowIso();
     const previous = this.skills.get(key);
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
     if (input.bundle) {
       const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
       this.bundles.set(bundleMapKey, {
@@ -34638,6 +35199,8 @@ class MemorySkillsStore {
         createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
       });
     }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
     const record = {
       orgId: input.principal.orgId,
       slug: input.slug,
@@ -34648,11 +35211,13 @@ class MemorySkillsStore {
       source: input.source,
       kind: input.kind,
       ...input.version ? { version: input.version } : {},
-      ...input.skillMd ? { skillMd: input.skillMd } : {},
-      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
       publishedByUserId: input.principal.userId,
       createdAt: previous?.createdAt ?? now,
-      updatedAt: now
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1
     };
     this.skills.set(key, record);
     if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
@@ -34661,33 +35226,107 @@ class MemorySkillsStore {
     return record;
   }
   async listSkills(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async getSkill(principal, slug) {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
       return null;
-    const next = { ...current, ...patch, updatedAt: nowIso() };
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
     this.skills.set(skillKey(principal.orgId, slug), next);
     return next;
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     const current = await this.getSkill(principal, slug);
     if (!current)
-      return false;
-    this.skills.delete(skillKey(principal.orgId, slug));
-    if (current.bundleSha256)
-      this.collectOrphanBundle(principal.orgId, current.bundleSha256);
-    return true;
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next);
+      return next;
+    }
+    return current;
+  }
+  async purgeExpiredTombstones(principal) {
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
   }
   async getSkillBundle(principal, sha256) {
     const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
     return bundle && bundle.orgId === principal.orgId ? bundle : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
+  }
+  async unpinSkill(principal, slug) {
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+  }
+  async listPins(principal) {
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId)
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256);
     if (!referenced)
@@ -34705,6 +35344,9 @@ class MemorySkillsStore {
 function skillKey(orgId, slug) {
   return `${orgId.length}:${orgId}:${slug}`;
 }
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
 
 class PostgresSkillsStore {
   backend = { kind: "postgres", durable: true, label: "postgres" };
@@ -34724,6 +35366,14 @@ class PostgresSkillsStore {
     } catch (error) {
       throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
     }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
   }
   async close() {
     await this.sql.close?.();
@@ -34958,8 +35608,33 @@ class PostgresSkillsStore {
   async publishSkill(input) {
     const orgId = input.principal.orgId;
     return await this.sql.begin(async (tx) => {
-      const previousRows = await tx`SELECT bundle_sha256 FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
-      const previousSha = typeof previousRows[0]?.bundle_sha256 === "string" ? String(previousRows[0].bundle_sha256) : null;
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         await tx`
           INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
@@ -34974,10 +35649,10 @@ class PostgresSkillsStore {
       }
       const rows = await tx`
         INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                     bundle_sha256, bundle_byte_size, published_by_user_id, updated_at)
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
         VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
-                ${input.source}, ${input.kind}, ${input.version ?? null}, ${input.skillMd ?? null},
-                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, now())
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
         ON CONFLICT (org_id, slug) DO UPDATE SET
           display_name = EXCLUDED.display_name,
           description = EXCLUDED.description,
@@ -34992,9 +35667,23 @@ class PostgresSkillsStore {
           bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
           bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
           published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
+        WHERE skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
         RETURNING *
       `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
         await tx`
           DELETE FROM skills_bundles
@@ -35002,55 +35691,182 @@ class PostgresSkillsStore {
             AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
         `;
       }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
       return rowToSkill(rows[0]);
     });
   }
   async listSkills(principal) {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} ORDER BY slug ASC`;
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
     return rows.map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const rows = await this.sql`
-      UPDATE skills_registry
-      SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-          tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-          skill_md = ${next.skillMd ?? null}, updated_at = now()
-      WHERE org_id = ${principal.orgId} AND slug = ${slug}
-      RETURNING *
-    `;
-    return rows[0] ? rowToSkill(rows[0]) : null;
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
+            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
+            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
       const rows = await tx`
-        DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug}
-        RETURNING bundle_sha256
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
       `;
-      if (!rows[0])
-        return false;
-      const sha = rows[0].bundle_sha256;
-      if (typeof sha === "string") {
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
+  }
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
         await tx`
-          DELETE FROM skills_bundles
-          WHERE org_id = ${principal.orgId} AND sha256 = ${sha}
-            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${sha})
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
         `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
       }
-      return true;
+      return purged;
     });
   }
   async getSkillBundle(principal, sha256) {
     const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
     return rows[0] ? rowToSkillBundle(rows[0]) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
+  }
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
+  }
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
   async collectOrphanBundle(orgId, sha256) {
     await this.sql`
       DELETE FROM skills_bundles
@@ -35059,6 +35875,7 @@ class PostgresSkillsStore {
     `;
   }
 }
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
 function isUniqueViolation(error) {
   const code = error?.code;
   if (code === "23505" || code === 23505)
@@ -35120,7 +35937,7 @@ ${summary}
       textArtifact(run, "show-notes.md", `# Show Notes
 
 - ${summary}
-- Generated by the open-skills deterministic worker.
+- Generated by the skills deterministic worker.
 `),
       textArtifact(run, "clips.csv", `start,end,title,summary
 00:00,00:30,"Opening","${csv(summary)}"
@@ -35154,7 +35971,7 @@ function textArtifact(run, relativePath, bodyText, contentType = relativePath.en
       relativePath,
       contentType,
       byteSize: bytes.byteLength,
-      sha256: createHash5("sha256").update(bytes).digest("hex"),
+      sha256: createHash6("sha256").update(bytes).digest("hex"),
       visibility: "private"
     },
     body: { relativePath, bodyText, contentType }
@@ -35216,7 +36033,7 @@ function csv(value) {
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -35266,7 +36083,7 @@ function mergeSkillRegistryLists(...groups) {
 }
 
 // src/server/registry.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
 import { resolve, sep as sep2 } from "path";
 
 // src/lib/registry.ts
@@ -35444,7 +36261,7 @@ var DEVELOPMENT_TOOLS_SKILLS = [
   {
     name: "monitor",
     displayName: "Monitor",
-    description: "Operate the open-monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
     category: "Development Tools",
     tags: ["monitoring", "mcp", "processes", "operations"]
   },
@@ -35490,6 +36307,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     description: "Validate configuration files for syntax and schema compliance",
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
+  },
+  {
+    name: "session-inject-monitor",
+    displayName: "Session Inject Monitor",
+    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
+    category: "Development Tools",
+    tags: ["monitor", "session", "injection", "automation", "wake"],
+    kind: "instruction"
   }
 ];
 
@@ -35877,7 +36702,7 @@ var DESIGN_BRANDING_SKILLS = [
     displayName: "Site Analyze",
     description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
     category: "Design & Branding",
-    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "open-styles"]
+    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
   }
 ];
 
@@ -36361,7 +37186,7 @@ function validateRegistryConsistency(registry, skillsDir) {
 }
 
 // src/lib/skill-hash.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { existsSync as existsSync4, readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
 import { join as join7, sep } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
@@ -36469,7 +37294,7 @@ function collectFile(files, absolute, rel) {
   files.push({ rel: rel.split(sep).join("/"), content: buffer });
 }
 function computeContentHash(skillPath) {
-  const hash = createHash6(CONTENT_HASH_ALGORITHM);
+  const hash = createHash7(CONTENT_HASH_ALGORITHM);
   for (const file of collectBundleFiles(skillPath)) {
     hash.update(new TextEncoder().encode(file.rel));
     hash.update(new TextEncoder().encode(`\x00${file.content.length}\x00`));
@@ -37243,6 +38068,9 @@ function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
   const appDir = options.homeDir ? join9(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache3 = join9(appDir, SKILLS_CACHE_DIRNAME);
+  if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
+    return cache3;
   const installed = join9(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
@@ -37463,10 +38291,7 @@ function writeCorpusSkill(input, options = {}) {
   const skillPath = join9(root3, name);
   const created = !existsSync6(skillPath);
   mkdirSync4(skillPath, { recursive: true });
-  const skillMd = input.skillMd.endsWith(`
-`) ? input.skillMd : `${input.skillMd}
-`;
-  writeFileSync3(join9(skillPath, "SKILL.md"), skillMd);
+  writeFileSync3(join9(skillPath, "SKILL.md"), input.skillMd);
   const frontmatter = parseSkillFrontmatter(input.skillMd) ?? undefined;
   const kind = input.meta?.kind ?? parseSkillKind(frontmatter?.kind) ?? "instruction";
   const manifest = {
@@ -37954,49 +38779,32 @@ function getAllTags() {
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { join as join14 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10, rmSync as rmSync4 } from "fs";
-import { dirname as dirname8, join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
+import { dirname as dirname8, join as join13 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync3,
-  existsSync as existsSync9,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
   mkdtempSync,
   readFileSync as readFileSync8,
-  readdirSync as readdirSync8,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
-  statSync as statSync7,
-  writeFileSync as writeFileSync5
+  readdirSync as readdirSync7,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync as statSync6,
+  writeFileSync as writeFileSync4
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname7, join as join12 } from "path";
-
+import { basename as basename3, dirname as dirname7, join as join11 } from "path";
 // src/lib/home-migration.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync7, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
-var SKILLS_CACHE_DIRNAME = "skills";
-var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
-function layoutMigrationRecordPath(appDir) {
-  return join11(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD);
-}
-function isOwnerLayoutMigrated(appDir) {
-  return existsSync8(layoutMigrationRecordPath(appDir));
-}
 function resolveCorpusRoot(options = {}) {
-  if (options.rootDir)
-    return options.rootDir;
-  const appDir = options.homeDir ? join11(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache3 = join11(appDir, SKILLS_CACHE_DIRNAME);
-  if (isOwnerLayoutMigrated(appDir) && existsSync8(cache3))
-    return cache3;
   return getPortableSkillsRoot(options);
 }
 
@@ -38019,9 +38827,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir = homedir3()) {
   switch (agent) {
     case "opencode":
-      return join12(homeDir, ".config", "opencode", "skills");
+      return join11(homeDir, ".config", "opencode", "skills");
     default:
-      return join12(homeDir, `.${agent}`, "skills");
+      return join11(homeDir, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -38042,6 +38850,10 @@ ${lines.join(`
 ---
 ${body}`;
 }
+var POINTER_MARKER_PHRASE = "This is an executable skill from the @hasna/skills catalog";
+function isPointerSkillMd(markdown) {
+  return markdown.includes(POINTER_MARKER_PHRASE) && /^kind:\s*executable\b/m.test(markdown);
+}
 function pointerSkillMd(name, description) {
   const display = name.replace(/[-_]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
   return [
@@ -38067,7 +38879,7 @@ function resolveSyncCorpus(options = {}) {
   if (explicit) {
     const roots = packageSourceRoots(explicit);
     if (roots.length === 0) {
-      throw new Error(`SKILLS_SOURCE '${explicit}' contains no skills: expected a corpus directory or a package root with skills/ and/or agent-skills/`);
+      throw new Error(`SKILLS_SOURCE '${explicit}' contains no skills: expected a corpus directory or a package root with skills/`);
     }
     return { roots, source: "source" };
   }
@@ -38075,9 +38887,9 @@ function resolveSyncCorpus(options = {}) {
 }
 function packageSourceRoots(source) {
   const roots = [];
-  for (const sub of ["skills", "agent-skills"]) {
-    const candidate = join12(source, sub);
-    if (existsSync9(candidate) && isDirectory(candidate))
+  for (const sub of ["skills"]) {
+    const candidate = join11(source, sub);
+    if (existsSync8(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
   if (roots.length > 0)
@@ -38087,20 +38899,20 @@ function packageSourceRoots(source) {
 function containsSkillDirectories(path) {
   let entries;
   try {
-    entries = readdirSync8(path);
+    entries = readdirSync7(path);
   } catch {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join12(path, entry);
+    const candidate = join11(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync9(join12(candidate, "SKILL.md")) || existsSync9(join12(candidate, "skill.json")) || existsSync9(join12(candidate, "package.json"));
+    return existsSync8(join11(candidate, "SKILL.md")) || existsSync8(join11(candidate, "skill.json")) || existsSync8(join11(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
   try {
-    return statSync7(path).isDirectory();
+    return statSync6(path).isDirectory();
   } catch {
     return false;
   }
@@ -38134,7 +38946,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join12(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
+          path: join11(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -38164,7 +38976,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir = params.homeDir ?? homedir3();
-  const dir = join12(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
+  const dir = join11(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -38181,11 +38993,11 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join12(dir, "SKILL.md");
-  const markerPath = join12(dir, SYNC_MARKER_FILE);
-  const dirExists = existsSync9(dir);
-  const managed = existsSync9(markerPath);
-  const hasSkillMd = existsSync9(skillMdPath);
+  const skillMdPath = join11(dir, "SKILL.md");
+  const markerPath = join11(dir, SYNC_MARKER_FILE);
+  const dirExists = existsSync8(dir);
+  const managed = existsSync8(markerPath);
+  const hasSkillMd = existsSync8(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
       action: "skip",
@@ -38200,35 +39012,50 @@ function writeManagedSkillDir(dir, skillMd, options) {
       reason: "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
+  if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
+    let existingIsStub = false;
+    try {
+      existingIsStub = isPointerSkillMd(readFileSync8(skillMdPath, "utf-8"));
+    } catch {
+      existingIsStub = false;
+    }
+    if (!existingIsStub) {
+      return {
+        action: "skip",
+        path: skillMdPath,
+        reason: "refusing to replace a content-bearing managed home with an executable pointer stub (the corpus entry lacks kind: instruction); pass --force to overwrite"
+      };
+    }
+  }
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
   const parentDir = dirname7(dir);
-  mkdirSync6(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync(join12(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join12(transactionDir, "candidate");
-  const backupDir = join12(transactionDir, "backup");
-  const candidateSkillMdPath = join12(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join12(candidateDir, SYNC_MARKER_FILE);
+  mkdirSync5(parentDir, { recursive: true });
+  const transactionDir = mkdtempSync(join11(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join11(transactionDir, "candidate");
+  const backupDir = join11(transactionDir, "backup");
+  const candidateSkillMdPath = join11(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join11(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
     source: options.source ?? "corpus",
     syncedAt: new Date().toISOString()
   };
-  const renameDirectory = options.renameDirectory ?? renameSync3;
+  const renameDirectory = options.renameDirectory ?? renameSync2;
   let originalMoved = false;
   let preserveTransaction = false;
   try {
     if (options.resourceDir) {
       cpSync3(options.resourceDir, candidateDir, { recursive: true, force: true });
     } else {
-      mkdirSync6(candidateDir, { recursive: true });
+      mkdirSync5(candidateDir, { recursive: true });
     }
-    writeFileSync5(candidateSkillMdPath, skillMd.endsWith(`
+    writeFileSync4(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
 `);
-    writeFileSync5(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
+    writeFileSync4(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
 `);
     if (dirExists) {
       originalMoved = true;
@@ -38236,10 +39063,10 @@ function writeManagedSkillDir(dir, skillMd, options) {
     }
     renameDirectory(candidateDir, dir);
   } catch (error) {
-    if (originalMoved && existsSync9(backupDir)) {
+    if (originalMoved && existsSync8(backupDir)) {
       try {
-        if (existsSync9(dir))
-          rmSync3(dir, { recursive: true, force: true });
+        if (existsSync8(dir))
+          rmSync2(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
       } catch (rollbackError) {
@@ -38251,23 +39078,23 @@ function writeManagedSkillDir(dir, skillMd, options) {
   } finally {
     if (!preserveTransaction) {
       try {
-        rmSync3(transactionDir, { recursive: true, force: true });
+        rmSync2(transactionDir, { recursive: true, force: true });
       } catch {}
     }
   }
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir = homedir3()) {
-  const dir = join12(agentGlobalSkillsDir(agent, homeDir), skill);
-  if (!existsSync9(join12(dir, SYNC_MARKER_FILE)))
+  const dir = join11(agentGlobalSkillsDir(agent, homeDir), skill);
+  if (!existsSync8(join11(dir, SYNC_MARKER_FILE)))
     return false;
-  rmSync3(dir, { recursive: true, force: true });
+  rmSync2(dir, { recursive: true, force: true });
   return true;
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join12(skillPath, "SKILL.md");
-    if (existsSync9(skillMdPath))
+    const skillMdPath = join11(skillPath, "SKILL.md");
+    if (existsSync8(skillMdPath))
       return readFileSync8(skillMdPath, "utf-8");
   }
   return pointerSkillMd(name, description);
@@ -38298,8 +39125,8 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -38314,14 +39141,14 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join13(targetDir, SKILLS_PROJECT_DIR);
+  return join12(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join13(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join12(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
-  if (!existsSync10(path))
+  if (!existsSync9(path))
     return null;
   try {
     return normalizeProjectConfig(JSON.parse(readFileSync9(path, "utf-8")));
@@ -38345,9 +39172,9 @@ function ensureProjectConfig(targetDir = process.cwd()) {
 }
 function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
-  writeFileSync6(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
+  writeFileSync5(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
 }
 function pinProjectSkill(name, details = {}, targetDir = process.cwd()) {
@@ -38442,12 +39269,12 @@ var __dirname2 = dirname8(fileURLToPath2(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i3 = 0;i3 < 5; i3++) {
-    const candidate = join14(dir, "skills");
-    if (existsSync11(candidate) && !dir.includes(".skills"))
+    const candidate = join13(dir, "skills");
+    if (existsSync10(candidate) && !dir.includes(".skills"))
       return candidate;
     dir = dirname8(dir);
   }
-  return join14(__dirname2, "..", "skills");
+  return join13(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -38455,25 +39282,25 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join14(getDataDir(), "custom", skillName);
-  if (existsSync11(legacyCustomPath))
+  const legacyCustomPath = join13(getDataDir(), "custom", skillName);
+  if (existsSync10(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join14(SKILLS_DIR, skillName);
+  return join13(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
 }
 function skillExists(name) {
-  return existsSync11(getSkillPath(name));
+  return existsSync10(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const canonicalName = getCanonicalSkillName(name);
   const skillName = normalizeSkillName(canonicalName);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync10(getSkillPath(name))) {
     const knownOfficial = Boolean(getSkill(name));
     return {
       skill: canonicalName,
@@ -38500,7 +39327,7 @@ function installSkill(name, options = {}) {
 }
 function installSkillSource(name, _options = {}) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync10(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found`, mode: "source" };
   }
   return {
@@ -38521,11 +39348,11 @@ function installSkillManifest(manifest, _options = {}) {
 }
 function createLocalSkillManifest(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync11(sourcePath))
+  if (!existsSync10(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join14(sourcePath, "SKILL.md");
-  if (existsSync11(skillMdPath)) {
+  const skillMdPath = join13(sourcePath, "SKILL.md");
+  if (existsSync10(skillMdPath)) {
     skillMd = readFileSync10(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMd = generateSkillMd(name) ?? "";
@@ -38598,20 +39425,20 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join14(base, ".pi", "skills") : join14(homedir4(), ".pi", "agent", "skills");
+      return scope === "project" ? join13(base, ".pi", "skills") : join13(homedir4(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join14(base, ".opencode", "skills") : join14(homedir4(), ".config", "opencode", "skills");
+      return scope === "project" ? join13(base, ".opencode", "skills") : join13(homedir4(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join14(base, `.${agent}`, "skills") : join14(homedir4(), `.${agent}`, "skills");
+      return scope === "project" ? join13(base, `.${agent}`, "skills") : join13(homedir4(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join14(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join13(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync10(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found` };
   }
   const scope = options.scope ?? "global";
@@ -38635,15 +39462,15 @@ function removeSkillForAgent(name, options) {
   const canonicalName = getCanonicalSkillName(name);
   const scope = options.scope ?? "global";
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
-  if (!existsSync11(join14(dir, SYNC_MARKER_FILE)))
+  if (!existsSync10(join13(dir, SYNC_MARKER_FILE)))
     return false;
-  rmSync4(dir, { recursive: true, force: true });
+  rmSync3(dir, { recursive: true, force: true });
   return true;
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join14(sourcePath, "SKILL.md");
-  if (existsSync11(skillMdPath))
+  const skillMdPath = join13(sourcePath, "SKILL.md");
+  if (existsSync10(skillMdPath))
     return readFileSync10(skillMdPath, "utf-8");
   if (generateSkillMd)
     return generateSkillMd(name);
@@ -38662,7 +39489,7 @@ function warnMissingDependencies(name, targetDir) {
 }
 function generateMinimalSkillMd(name) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync11(sourcePath))
+  if (!existsSync10(sourcePath))
     return null;
   const canonicalName = getCanonicalSkillName(name);
   const meta = getSkill(canonicalName);
@@ -38677,7 +39504,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join14(sourcePath, "README.md")) || readFileIfExists(join14(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join13(sourcePath, "README.md")) || readFileIfExists(join13(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -38696,8 +39523,8 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join14(getSkillPath(name), "package.json");
-  if (!existsSync11(pkgPath))
+  const pkgPath = join13(getSkillPath(name), "package.json");
+  if (!existsSync10(pkgPath))
     return "unknown";
   try {
     const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
@@ -38707,7 +39534,7 @@ function readBundledSkillVersion(name) {
   }
 }
 function readFileIfExists(path) {
-  return existsSync11(path) ? readFileSync10(path, "utf-8") : null;
+  return existsSync10(path) ? readFileSync10(path, "utf-8") : null;
 }
 function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
@@ -38717,8 +39544,8 @@ function loadProjectConfigCompat(targetDir) {
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join15(skillPath, "SKILL.md");
-  if (!existsSync12(skillMdPath))
+  const skillMdPath = join14(skillPath, "SKILL.md");
+  if (!existsSync11(skillMdPath))
     return false;
   try {
     return parseSkillFrontmatter(readFileSync11(skillMdPath, "utf-8"))?.kind === "instruction";
@@ -38744,12 +39571,12 @@ var HOSTED_PROVIDER_ENV_PREFIXES = [
 ];
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync11(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join15(skillPath, "SKILL.md")),
-    readme: readIfExists(join15(skillPath, "README.md")),
-    claudeMd: readIfExists(join15(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join14(skillPath, "SKILL.md")),
+    readme: readIfExists(join14(skillPath, "README.md")),
+    claudeMd: readIfExists(join14(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -38760,11 +39587,11 @@ function getSkillBestDoc(name) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync11(skillPath))
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join15(skillPath, file));
+    const content = readIfExists(join14(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -38803,8 +39630,8 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join15(skillPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join14(skillPath, "package.json");
+  if (existsSync11(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
@@ -38824,7 +39651,7 @@ async function runSkill(name, args, options = {}) {
   const meta = getSkill(name);
   const canonicalName = meta?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync12(skillPath)) {
+  if (!existsSync11(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   if (isInstructionSkillDir(skillPath, meta)) {
@@ -38833,8 +39660,8 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join15(skillPath, "package.json");
-  if (!existsSync12(pkgPath)) {
+  const pkgPath = join14(skillPath, "package.json");
+  if (!existsSync11(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
@@ -38853,12 +39680,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join15(skillPath, entryPoint);
-  if (!existsSync12(entryPath)) {
+  const entryPath = join14(skillPath, entryPoint);
+  if (!existsSync11(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join15(skillPath, "node_modules");
-  if (!existsSync12(nodeModules)) {
+  const nodeModules = join14(skillPath, "node_modules");
+  if (!existsSync11(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
       stdout: "pipe",
@@ -38930,7 +39757,7 @@ function generateSkillMd(name) {
   if (!meta)
     return null;
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync11(skillPath))
     return null;
   const frontmatter = [
     "---",
@@ -38939,11 +39766,11 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join15(skillPath, "README.md"));
-  const claudeMd = readIfExists(join15(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join14(skillPath, "README.md"));
+  const claudeMd = readIfExists(join14(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join15(skillPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join14(skillPath, "package.json");
+  if (existsSync11(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       if (pkg.bin) {
@@ -39020,7 +39847,7 @@ function extractEnvVars(text) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync12(path)) {
+    if (existsSync11(path)) {
       return readFileSync11(path, "utf-8");
     }
   } catch {}
@@ -39062,7 +39889,7 @@ function getServerSkillMd(slug) {
   const path = resolve(skillsDir, name, "SKILL.md");
   if (!isInsideDir(skillsDir, path))
     return null;
-  return existsSync13(path) ? readFileSync12(path, "utf8") : null;
+  return existsSync12(path) ? readFileSync12(path, "utf8") : null;
 }
 
 // src/server/skills-api.ts
@@ -39072,6 +39899,17 @@ var MAX_SLUG_LENGTH = 128;
 var MAX_SKILL_MD_BYTES = 512000;
 var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
 var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
+function pinPayload(pin) {
+  return { slug: pin.slug, pinnedAt: pin.pinnedAt, metadata: pin.metadata };
+}
+function pinMetadataField(body) {
+  if (body.metadata === undefined)
+    return {};
+  if (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata)) {
+    throw new SkillRequestError(400, "INVALID_METADATA", "`metadata` must be a JSON object");
+  }
+  return body.metadata;
+}
 
 class SkillRequestError extends Error {
   status;
@@ -39100,33 +39938,130 @@ function publishedPayload(record) {
     ...publishedSkillMeta(record),
     slug: record.slug,
     publishedSource: record.source,
+    ...record.skillMd ? { skillMd: record.skillMd } : {},
     ...record.bundleSha256 ? { bundleSha256: record.bundleSha256, bundleByteSize: record.bundleByteSize } : {},
     publishedAt: record.createdAt,
-    updatedAt: record.updatedAt
+    updatedAt: record.updatedAt,
+    revisionId: record.revisionId,
+    revisionNumber: record.revisionNumber
+  };
+}
+function revisionEtag(revisionId) {
+  return `"${revisionId}"`;
+}
+function parseIfMatch(value) {
+  if (value === null || value.trim() === "")
+    return;
+  const trimmed = value.trim();
+  if (trimmed === "*") {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must name the exact revision id (the ETag of the current revision); '*' is not accepted");
+  }
+  const unquoted = trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+  if (!REVISION_ID_PATTERN.test(unquoted)) {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must carry a revision id: a 64-character lowercase hex sha-256, quoted as the server's ETag");
+  }
+  return unquoted;
+}
+async function tombstoneStatus(store, artifactStorage, principal, record) {
+  if (!record.tombstonedAt)
+    return "live";
+  if (record.tombstonePurgeAfter && record.tombstonePurgeAfter <= new Date().toISOString()) {
+    const purged = await store.purgeExpiredTombstones(principal);
+    for (const removed of purged) {
+      if (removed.bundleSha256)
+        await discardCollectedObject(store, artifactStorage, principal, removed.bundleSha256);
+    }
+    return "purged";
+  }
+  return {
+    slug: record.slug,
+    deleted: true,
+    code: "TOMBSTONED",
+    tombstonedAt: record.tombstonedAt,
+    tombstonePurgeAfter: record.tombstonePurgeAfter,
+    revisionId: record.revisionId
   };
 }
 async function listMergedSkills(store, principal) {
   const published = await store.listSkills(principal);
+  return mergedSkillPayloads(published, listServerSkills());
+}
+function mergedSkillPayloads(published, bundled) {
   const publishedBySlug = new Map(published.map((record) => [record.slug, record]));
-  const merged = mergeSkillRegistryLists(listServerSkills(), published.map(publishedSkillMeta));
+  const merged = mergeSkillRegistryLists(bundled, published.map(publishedSkillMeta));
   return merged.map((skill) => {
     const record = publishedBySlug.get(skill.name);
     return record ? publishedPayload(record) : skill;
   });
 }
-async function getMergedSkill(store, principal, slug) {
+async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
   const record = await store.getSkill(principal, slug);
-  if (record)
-    return publishedPayload(record);
+  if (!record)
+    return { kind: "absent" };
+  const status = await tombstoneStatus(store, artifactStorage, principal, record);
+  if (status === "purged")
+    return { kind: "absent" };
+  if (status !== "live")
+    return { kind: "tombstone", payload: status };
+  return { kind: "published", record };
+}
+async function listOrgTags(store, principal) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const tags = new Set;
+  for (const tag of await store.listTags(principal)) {
+    if (tag.trim())
+      tags.add(tag);
+  }
+  for (const skill of listServerSkills()) {
+    if (publishedSlugs.includes(skill.name))
+      continue;
+    for (const tag of skill.tags) {
+      if (tag.trim())
+        tags.add(tag);
+    }
+  }
+  return [...tags].sort();
+}
+async function listMergedSkillsByTag(store, principal, tag) {
+  const published = await store.listSkillsByTag(principal, tag);
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundled = listServerSkills().filter((skill) => skill.tags.includes(tag) && !publishedSlugs.includes(skill.name));
+  return mergedSkillPayloads(published, bundled);
+}
+function skillSummary(skill) {
+  return {
+    slug: String(skill.slug ?? skill.name),
+    ...typeof skill.name === "string" ? { name: skill.name } : {},
+    ...typeof skill.version === "string" ? { version: skill.version } : {},
+    ...typeof skill.updatedAt === "string" ? { updatedAt: skill.updatedAt } : {}
+  };
+}
+async function listPinsByTag(store, principal, tag) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundledTaggedSlugs = new Set;
+  for (const skill of listServerSkills()) {
+    if (skill.tags.includes(tag) && !publishedSlugs.includes(skill.name))
+      bundledTaggedSlugs.add(skill.name);
+  }
+  const publishedPins = await store.listPinsByTag(principal, tag);
+  const bundledPins = bundledTaggedSlugs.size ? (await store.listPins(principal)).filter((pin) => bundledTaggedSlugs.has(pin.slug)) : [];
+  return [...publishedPins, ...bundledPins].sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map(pinPayload);
+}
+async function getMergedSkill(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
+    return resolved.payload;
+  if (resolved.kind === "published")
+    return publishedPayload(resolved.record);
   const bundled = getServerSkill(slug);
   return bundled ? bundled : null;
 }
-async function getMergedSkillMd(store, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (record?.skillMd)
-    return record.skillMd;
-  if (record)
+async function getMergedSkillMd(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
     return null;
+  if (resolved.kind === "published")
+    return resolved.record.skillMd ?? null;
   return getServerSkillMd(slug);
 }
 async function parsePublishRequest(request, config) {
@@ -39168,7 +40103,7 @@ async function parsePublishRequest(request, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha256 = createHash7("sha256").update(bundleBytes).digest("hex");
+    const sha256 = createHash8("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -39196,9 +40131,13 @@ async function parsePublishRequest(request, config) {
   }
   return { input: buildPublishInput(parseManifestJson(text)) };
 }
-async function storePublishedSkill(store, artifactStorage, principal, parsed) {
+async function storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId) {
   const superseded = (await store.getSkill(principal, parsed.input.slug))?.bundleSha256;
-  let input = { ...parsed.input, principal };
+  let input = {
+    ...parsed.input,
+    principal,
+    ...expectedRevisionId ? { expectedRevisionId } : {}
+  };
   if (parsed.bundleBytes && input.bundle) {
     const placement = await artifactStorage.putBundle(principal.orgId, input.bundle.sha256, parsed.bundleBytes, input.bundle.contentType);
     input = { ...input, bundle: { ...input.bundle, ...placement } };
@@ -39209,15 +40148,8 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed) {
   }
   return record;
 }
-async function deletePublishedSkill(store, artifactStorage, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (!record)
-    return false;
-  const deleted = await store.deleteSkill(principal, slug);
-  if (deleted && record.bundleSha256) {
-    await discardCollectedObject(store, artifactStorage, principal, record.bundleSha256);
-  }
-  return deleted;
+async function deletePublishedSkill(store, artifactStorage, principal, slug, tombstoneWindowMs) {
+  return store.deleteSkill(principal, slug, tombstoneWindowMs);
 }
 async function discardCollectedObject(store, artifactStorage, principal, sha256) {
   if (await store.getSkillBundle(principal, sha256))
@@ -39237,7 +40169,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash7("sha256").update(bytes).digest("hex");
+  const actual = createHash8("sha256").update(bytes).digest("hex");
   if (actual !== record.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record.bundleSha256}`);
   }
@@ -39353,10 +40285,10 @@ async function createSkillsFetchHandler(options = {}) {
     const segments = pathSegments(url.pathname);
     try {
       if (request.method === "GET" && url.pathname === "/health") {
-        return json({ ok: true, service: "open-skills", time: new Date().toISOString() });
+        return json({ ok: true, service: "skills", time: new Date().toISOString() });
       }
       if (request.method === "GET" && url.pathname === "/ready") {
-        return json({ ok: true, service: "open-skills" });
+        return json({ ok: true, service: "skills" });
       }
       if (url.pathname.startsWith("/api/")) {
         const principal = await authenticateRequest(store, request);
@@ -39374,6 +40306,14 @@ async function createSkillsFetchHandler(options = {}) {
       if (error instanceof SkillRequestError) {
         return json({ error: error.message, code: error.code }, { status: error.status });
       }
+      if (error instanceof SkillRevisionConflictError) {
+        return json({
+          error: error.message,
+          code: "REVISION_CONFLICT",
+          slug: error.slug,
+          ...error.currentRevisionId ? { currentRevisionId: error.currentRevisionId } : {}
+        }, { status: 409 });
+      }
       return json({ error: "internal server error", detail: error.message }, { status: 500 });
     }
   };
@@ -39393,24 +40333,43 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
     return json({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
   if (resource === "skills") {
-    if (request.method === "GET" && !id)
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listMergedSkillsByTag(store, principal, tag));
       return json(await listMergedSkills(store, principal));
+    }
     if (request.method === "POST" && !id) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const parsed = await parsePublishRequest(request, config);
-      const record = await storePublishedSkill(store, artifactStorage, principal, parsed);
-      return json(publishedPayload(record), { status: 201 });
+      const record = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
+      return json(publishedPayload(record), { status: 201, headers: { ETag: revisionEtag(record.revisionId) } });
     }
     if (request.method === "GET" && id && subresource === "skill.md") {
-      const docs = await getMergedSkillMd(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      const docs = await getMergedSkillMd(store, artifactStorage, principal, id);
       return docs ? new Response(docs, { headers: { "Content-Type": "text/markdown; charset=utf-8", "Cache-Control": "no-store" } }) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "GET" && id && subresource === "bundle") {
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "absent") {
+        return json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      }
       const { record, bytes } = await readPublishedBundle(store, artifactStorage, principal, id);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
         "Content-Disposition": `attachment; filename="${record.slug}.tar.gz"`,
         "X-Skill-Bundle-Sha256": record.bundleSha256 ?? "",
+        "X-Skill-Revision-Id": record.revisionId,
+        "X-Skill-Revision-Number": String(record.revisionNumber),
+        ETag: revisionEtag(record.revisionId),
         "Cache-Control": "no-store"
       };
       if (config.bundleSigningKey) {
@@ -39419,17 +40378,56 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
       return new Response(bytes, { headers });
     }
     if (request.method === "GET" && id && !subresource) {
-      const skill = await getMergedSkill(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "published") {
+        return json(publishedPayload(resolved.record), { headers: { ETag: revisionEtag(resolved.record.revisionId) } });
+      }
+      const skill = await getMergedSkill(store, artifactStorage, principal, id);
       return skill ? json(skill) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if ((request.method === "PUT" || request.method === "PATCH") && id && !subresource) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const body = await readJson(request, config.requestBodyLimitBytes);
-      const updated = await store.updateSkill(principal, id, skillPatch(body));
-      return updated ? json(publishedPayload(updated)) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const updated = await store.updateSkill(principal, id, skillPatch(body), expectedRevisionId);
+      return updated ? json(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "DELETE" && id && !subresource) {
-      const removed = await deletePublishedSkill(store, artifactStorage, principal, id);
-      return removed ? json({ deleted: true, slug: id }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const removed = await deletePublishedSkill(store, artifactStorage, principal, id, config.tombstoneWindowMs);
+      return removed ? json({
+        deleted: true,
+        slug: id,
+        ...removed.tombstonedAt ? { tombstonedAt: removed.tombstonedAt, tombstonePurgeAfter: removed.tombstonePurgeAfter } : {}
+      }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "pins") {
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listPinsByTag(store, principal, tag));
+      return json((await store.listPins(principal)).map(pinPayload));
+    }
+    if (request.method === "PUT" && id && !subresource) {
+      assertPublishableSlug(id);
+      const body = await readJson(request, config.requestBodyLimitBytes);
+      const pin = await store.pinSkill(principal, id, pinMetadataField(body));
+      return json(pinPayload(pin));
+    }
+    if (request.method === "DELETE" && id && !subresource) {
+      assertPublishableSlug(id);
+      const removed = await store.unpinSkill(principal, id);
+      return removed ? json({ deleted: true, slug: id }) : json({ error: "pin not found", code: "PIN_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "tags") {
+    if (request.method === "GET" && !id) {
+      return json(await listOrgTags(store, principal));
+    }
+    if (request.method === "GET" && id && subresource === "skills") {
+      return json((await listMergedSkillsByTag(store, principal, id)).map(skillSummary));
     }
   }
   if (resource === "runs") {
@@ -44144,7 +45142,7 @@ CREATE TABLE IF NOT EXISTS execution_receipts (
 );
 `;
 // src/sdk/execution/admission.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 
 // src/sdk/execution/image-profile.ts
 class ImageProfileResolutionError extends Error {
@@ -44269,7 +45267,7 @@ function createSubmitRunService(options) {
   };
 }
 function digestInput(input) {
-  return createHash9("sha256").update(canonicalJson(input)).digest("hex");
+  return createHash10("sha256").update(canonicalJson(input)).digest("hex");
 }
 // src/sdk/execution/state-machine.ts
 var LEGAL_TRANSITIONS = {
@@ -44431,13 +45429,13 @@ function createReceiptService(store) {
   };
 }
 // src/sdk/execution/dispatchers/ecs.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1106.0/node_modules/@aws-sdk/client-ecs/dist-es/ECSClient.js
 var import_client33 = __toESM(require_client2(), 1);
 var import_core2 = __toESM(require_dist_cjs2(), 1);
 var import_client34 = __toESM(require_client(), 1);
-var import_config38 = __toESM(require_config(), 1);
+var import_config39 = __toESM(require_config(), 1);
 var import_endpoints8 = __toESM(require_endpoints(), 1);
 var import_protocols10 = __toESM(require_protocols(), 1);
 var import_retry6 = __toESM(require_retry(), 1);
@@ -44576,7 +45574,7 @@ var package_default2 = {
 var import_client29 = __toESM(require_client2(), 1);
 var import_httpAuthSchemes6 = __toESM(require_httpAuthSchemes(), 1);
 var import_client30 = __toESM(require_client(), 1);
-var import_config37 = __toESM(require_config(), 1);
+var import_config38 = __toESM(require_config(), 1);
 var import_retry5 = __toESM(require_retry(), 1);
 var import_serde6 = __toESM(require_serde(), 1);
 var import_node_http_handler3 = __toESM(require_dist_cjs6(), 1);
@@ -47517,7 +48515,7 @@ var getRuntimeConfig4 = (config) => {
 // ../../node_modules/.bun/@aws-sdk+client-ecs@3.1106.0/node_modules/@aws-sdk/client-ecs/dist-es/runtimeConfig.js
 var getRuntimeConfig5 = (config) => {
   import_client30.emitWarningIfUnsupportedVersion(process.version);
-  const defaultsMode = import_config37.resolveDefaultsModeConfig(config);
+  const defaultsMode = import_config38.resolveDefaultsModeConfig(config);
   const defaultConfigProvider = () => defaultsMode().then(import_client30.loadConfigsForDefaultMode);
   const clientSharedValues = getRuntimeConfig4(config);
   import_client29.emitWarningIfUnsupportedVersion(process.version);
@@ -47530,21 +48528,21 @@ var getRuntimeConfig5 = (config) => {
     ...config,
     runtime: "node",
     defaultsMode,
-    authSchemePreference: config?.authSchemePreference ?? import_config37.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+    authSchemePreference: config?.authSchemePreference ?? import_config38.loadConfig(import_httpAuthSchemes6.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde6.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
     defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client29.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
-    maxAttempts: config?.maxAttempts ?? import_config37.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
-    region: config?.region ?? import_config37.loadConfig(import_config37.NODE_REGION_CONFIG_OPTIONS, { ...import_config37.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+    maxAttempts: config?.maxAttempts ?? import_config38.loadConfig(import_retry5.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+    region: config?.region ?? import_config38.loadConfig(import_config38.NODE_REGION_CONFIG_OPTIONS, { ...import_config38.NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
     requestHandler: import_node_http_handler3.NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
-    retryMode: config?.retryMode ?? import_config37.loadConfig({
+    retryMode: config?.retryMode ?? import_config38.loadConfig({
       ...import_retry5.NODE_RETRY_MODE_CONFIG_OPTIONS,
       default: async () => (await defaultConfigProvider()).retryMode || import_retry5.DEFAULT_RETRY_MODE
     }, config),
     streamCollector: config?.streamCollector ?? import_node_http_handler3.streamCollector,
-    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    useFipsEndpoint: config?.useFipsEndpoint ?? import_config37.loadConfig(import_config37.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
-    userAgentAppId: config?.userAgentAppId ?? import_config37.loadConfig(import_client29.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    useDualstackEndpoint: config?.useDualstackEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    useFipsEndpoint: config?.useFipsEndpoint ?? import_config38.loadConfig(import_config38.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+    userAgentAppId: config?.userAgentAppId ?? import_config38.loadConfig(import_client29.NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
   };
 };
 
@@ -47609,7 +48607,7 @@ class ECSClient extends import_client34.Client {
     const _config_1 = resolveClientEndpointParameters3(_config_0);
     const _config_2 = import_client33.resolveUserAgentConfig(_config_1);
     const _config_3 = import_retry6.resolveRetryConfig(_config_2);
-    const _config_4 = import_config38.resolveRegionConfig(_config_3);
+    const _config_4 = import_config39.resolveRegionConfig(_config_3);
     const _config_5 = import_client33.resolveHostHeaderConfig(_config_4);
     const _config_6 = import_endpoints8.resolveEndpointConfig(_config_5);
     const _config_7 = resolveHttpAuthSchemeConfig3(_config_6);
@@ -47662,13 +48660,13 @@ class StopTaskCommand extends command3(_ep03, _mw03, "StopTask", StopTask$) {
 var CLIENT_TOKEN_BYTES = 16;
 var TERMINAL_TASK_STATUSES = new Set(["STOPPED"]);
 function clientTokenFor(runId2, attemptId) {
-  return createHash10("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+  return createHash11("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
 function startedByFor(runId2, attemptNumber) {
   return `skills-exec/${runId2}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
-  return createHash10("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
+  return createHash11("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
 }
 
 class EcsDispatcher {
@@ -48043,7 +49041,7 @@ function runPointersOf(run) {
 // src/sdk/governance-store.ts
 import { Database as Database3 } from "bun:sqlite";
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdirSync as mkdirSync8 } from "fs";
+import { mkdirSync as mkdirSync7 } from "fs";
 import { dirname as dirname9 } from "path";
 function receiptId() {
   return `rcpt_${Date.now().toString(36)}_${randomUUID4().replace(/-/g, "").slice(0, 10)}`;
@@ -48133,7 +49131,7 @@ class SqliteGovernanceStore {
   closed = false;
   constructor(path = SQLITE_MEMORY_PATH, options = {}) {
     if (path !== SQLITE_MEMORY_PATH)
-      mkdirSync8(dirname9(path), { recursive: true });
+      mkdirSync7(dirname9(path), { recursive: true });
     this.db = new Database3(path, { create: true, readwrite: true });
     this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA foreign_keys = ON");