@hasna/skills 0.1.63 → 0.1.64

package/bin/server.js

@@ -22955,6 +22955,7 @@ var ANY_SEGMENT_EXCLUDES = new Set([
   ".docker"
 ]);
 var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
 var CREDENTIAL_FILENAMES = new Set([
   ".npmrc",
   ".pypirc",
@@ -32951,9 +32952,10 @@ function resolveServerConfig(env = process.env) {
     artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
     artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
     inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
     requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
     skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
     publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
     nodeEnv,
     allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
@@ -33031,6 +33033,11 @@ function normalizeConfigValue(key, value) {
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var INSTALLED_SKILLS_DIRNAME = "installed";
+var SKILLS_CACHE_DIRNAME = "skills";
+var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
+function isOwnerLayoutMigrated(appDir) {
+  return existsSync(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+}
 function getDataDir() {
   const override = process.env[DATA_DIR_ENV];
   if (override) {
@@ -33154,7 +33161,7 @@ function looksLikeSqlitePath(value) {
 }
 
 // src/server/handlers.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/server/store.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -33175,6 +33182,19 @@ class StaleLeaseGenerationError extends Error {
   }
 }
 
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
 // src/server/rows.ts
 import { randomUUID } from "crypto";
 function nowIso() {
@@ -33255,7 +33275,20 @@ function rowToSkill(row) {
     ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
     ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
     createdAt: dateString(row.created_at),
-    updatedAt: dateString(row.updated_at)
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
   };
 }
 function rowToSkillBundle(row) {
@@ -33307,6 +33340,29 @@ function dateString(value) {
   return String(value);
 }
 
+// src/lib/revision.ts
+import { createHash as createHash4 } from "crypto";
+var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash4("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
+}
+
 // src/server/sqlite-store.ts
 import { Database } from "bun:sqlite";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -33354,6 +33410,7 @@ function defaultStartDirs() {
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 var LAST_USED_RESOLUTION_MS = 60000;
 
 class SqliteSkillsStore {
@@ -33373,12 +33430,24 @@ class SqliteSkillsStore {
     if (options.migrate !== false) {
       applySqliteMigrations(this.db, options.migrationsDir);
     }
+    this.backfillLegacyRevisions();
     this.backend = {
       kind: "sqlite",
       durable: !inMemory,
       label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
     };
   }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
   get database() {
     return this.db;
   }
@@ -33602,8 +33671,29 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -33624,8 +33714,8 @@ class SqliteSkillsStore {
         ]);
       }
       const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
          ON CONFLICT (org_id, slug) DO UPDATE SET
            display_name = excluded.display_name,
            description = excluded.description,
@@ -33643,7 +33733,16 @@ class SqliteSkillsStore {
            bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
            bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
            published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
+         WHERE skills_registry.tombstoned_at IS NOT NULL
+            OR skills_registry.revision_id = ?
          RETURNING *`, [
         orgId,
         input.slug,
@@ -33654,62 +33753,165 @@ class SqliteSkillsStore {
         input.source,
         input.kind,
         input.version ?? null,
-        input.skillMd ?? null,
+        carriedSkillMd,
         input.bundle?.sha256 ?? null,
         input.bundle?.byteSize ?? null,
         input.principal.userId,
+        revisionId,
         now,
-        now
+        now,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
       return rowToSkill(row);
     })();
   }
   async listSkills(principal) {
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const row = this.get(`UPDATE skills_registry
-       SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?, updated_at = ?
-       WHERE org_id = ? AND slug = ?
-       RETURNING *`, [
-      next.displayName,
-      next.description,
-      next.category,
-      JSON.stringify(next.tags),
-      next.kind,
-      next.version ?? null,
-      next.skillMd ?? null,
-      nowIso(),
-      principal.orgId,
-      slug
-    ]);
-    return row ? rowToSkill(row) : null;
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next.displayName,
+        next.description,
+        next.category,
+        JSON.stringify(next.tags),
+        next.kind,
+        next.version ?? null,
+        next.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return this.db.transaction(() => {
-      const existing = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       if (!existing)
-        return false;
-      this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (typeof existing.bundle_sha256 === "string")
-        this.collectOrphanBundle(principal.orgId, existing.bundle_sha256);
-      return true;
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
     })();
   }
   async getSkillBundle(principal, sha256) {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)
@@ -33796,6 +33998,21 @@ function parseScopes(value) {
 }
 
 // src/server/store.ts
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
 function resolvePoolMax(env = process.env) {
   const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
@@ -33833,6 +34050,7 @@ class MemorySkillsStore {
   idempotency = new Map;
   skills = new Map;
   bundles = new Map;
+  pins = new Map;
   constructor(apiKeys = []) {
     for (const key of apiKeys)
       this.addApiKey(key.token, key.principal);
@@ -33934,6 +34152,9 @@ class MemorySkillsStore {
     const key = skillKey(input.principal.orgId, input.slug);
     const now = nowIso();
     const previous = this.skills.get(key);
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
     if (input.bundle) {
       const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
       this.bundles.set(bundleMapKey, {
@@ -33943,6 +34164,8 @@ class MemorySkillsStore {
         createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
       });
     }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
     const record = {
       orgId: input.principal.orgId,
       slug: input.slug,
@@ -33953,11 +34176,13 @@ class MemorySkillsStore {
       source: input.source,
       kind: input.kind,
       ...input.version ? { version: input.version } : {},
-      ...input.skillMd ? { skillMd: input.skillMd } : {},
-      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
       publishedByUserId: input.principal.userId,
       createdAt: previous?.createdAt ?? now,
-      updatedAt: now
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1
     };
     this.skills.set(key, record);
     if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
@@ -33966,33 +34191,107 @@ class MemorySkillsStore {
     return record;
   }
   async listSkills(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async getSkill(principal, slug) {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
-    const next = { ...current, ...patch, updatedAt: nowIso() };
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
+      return null;
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
     this.skills.set(skillKey(principal.orgId, slug), next);
     return next;
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     const current = await this.getSkill(principal, slug);
     if (!current)
-      return false;
-    this.skills.delete(skillKey(principal.orgId, slug));
-    if (current.bundleSha256)
-      this.collectOrphanBundle(principal.orgId, current.bundleSha256);
-    return true;
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next);
+      return next;
+    }
+    return current;
+  }
+  async purgeExpiredTombstones(principal) {
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
   }
   async getSkillBundle(principal, sha256) {
     const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
     return bundle && bundle.orgId === principal.orgId ? bundle : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
+  }
+  async unpinSkill(principal, slug) {
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+  }
+  async listPins(principal) {
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId)
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256);
     if (!referenced)
@@ -34010,6 +34309,9 @@ class MemorySkillsStore {
 function skillKey(orgId, slug) {
   return `${orgId.length}:${orgId}:${slug}`;
 }
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
 
 class PostgresSkillsStore {
   backend = { kind: "postgres", durable: true, label: "postgres" };
@@ -34029,6 +34331,14 @@ class PostgresSkillsStore {
     } catch (error) {
       throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
     }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
   }
   async close() {
     await this.sql.close?.();
@@ -34263,8 +34573,33 @@ class PostgresSkillsStore {
   async publishSkill(input) {
     const orgId = input.principal.orgId;
     return await this.sql.begin(async (tx) => {
-      const previousRows = await tx`SELECT bundle_sha256 FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
-      const previousSha = typeof previousRows[0]?.bundle_sha256 === "string" ? String(previousRows[0].bundle_sha256) : null;
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         await tx`
           INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
@@ -34279,10 +34614,10 @@ class PostgresSkillsStore {
       }
       const rows = await tx`
         INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                     bundle_sha256, bundle_byte_size, published_by_user_id, updated_at)
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
         VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
-                ${input.source}, ${input.kind}, ${input.version ?? null}, ${input.skillMd ?? null},
-                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, now())
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
         ON CONFLICT (org_id, slug) DO UPDATE SET
           display_name = EXCLUDED.display_name,
           description = EXCLUDED.description,
@@ -34297,9 +34632,23 @@ class PostgresSkillsStore {
           bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
           bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
           published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
+        WHERE skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
         RETURNING *
       `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
         await tx`
           DELETE FROM skills_bundles
@@ -34307,55 +34656,182 @@ class PostgresSkillsStore {
             AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
         `;
       }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
       return rowToSkill(rows[0]);
     });
   }
   async listSkills(principal) {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} ORDER BY slug ASC`;
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
     return rows.map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const rows = await this.sql`
-      UPDATE skills_registry
-      SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-          tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-          skill_md = ${next.skillMd ?? null}, updated_at = now()
-      WHERE org_id = ${principal.orgId} AND slug = ${slug}
-      RETURNING *
-    `;
-    return rows[0] ? rowToSkill(rows[0]) : null;
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
+            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
+            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
       const rows = await tx`
-        DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug}
-        RETURNING bundle_sha256
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
       `;
-      if (!rows[0])
-        return false;
-      const sha = rows[0].bundle_sha256;
-      if (typeof sha === "string") {
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
+  }
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
         await tx`
-          DELETE FROM skills_bundles
-          WHERE org_id = ${principal.orgId} AND sha256 = ${sha}
-            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${sha})
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
         `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
       }
-      return true;
+      return purged;
     });
   }
   async getSkillBundle(principal, sha256) {
     const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
     return rows[0] ? rowToSkillBundle(rows[0]) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
+  }
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
+  }
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
   async collectOrphanBundle(orgId, sha256) {
     await this.sql`
       DELETE FROM skills_bundles
@@ -34364,6 +34840,7 @@ class PostgresSkillsStore {
     `;
   }
 }
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
 function isUniqueViolation(error) {
   const code = error?.code;
   if (code === "23505" || code === 23505)
@@ -34425,7 +34902,7 @@ ${summary}
       textArtifact(run, "show-notes.md", `# Show Notes
 
 - ${summary}
-- Generated by the open-skills deterministic worker.
+- Generated by the skills deterministic worker.
 `),
       textArtifact(run, "clips.csv", `start,end,title,summary
 00:00,00:30,"Opening","${csv(summary)}"
@@ -34459,7 +34936,7 @@ function textArtifact(run, relativePath, bodyText, contentType = relativePath.en
       relativePath,
       contentType,
       byteSize: bytes.byteLength,
-      sha256: createHash4("sha256").update(bytes).digest("hex"),
+      sha256: createHash5("sha256").update(bytes).digest("hex"),
       visibility: "private"
     },
     body: { relativePath, bodyText, contentType }
@@ -34521,7 +34998,7 @@ function csv(value) {
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -34749,7 +35226,7 @@ var DEVELOPMENT_TOOLS_SKILLS = [
   {
     name: "monitor",
     displayName: "Monitor",
-    description: "Operate the open-monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
     category: "Development Tools",
     tags: ["monitoring", "mcp", "processes", "operations"]
   },
@@ -34795,6 +35272,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     description: "Validate configuration files for syntax and schema compliance",
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
+  },
+  {
+    name: "session-inject-monitor",
+    displayName: "Session Inject Monitor",
+    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
+    category: "Development Tools",
+    tags: ["monitor", "session", "injection", "automation", "wake"],
+    kind: "instruction"
   }
 ];
 
@@ -35182,7 +35667,7 @@ var DESIGN_BRANDING_SKILLS = [
     displayName: "Site Analyze",
     description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
     category: "Design & Branding",
-    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "open-styles"]
+    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
   }
 ];
 
@@ -35613,6 +36098,9 @@ function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
   const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache3 = join7(appDir, SKILLS_CACHE_DIRNAME);
+  if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
+    return cache3;
   const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
@@ -35895,7 +36383,6 @@ import { join as join10 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync as rmSync2 } from "fs";
 import { dirname as dirname7, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/lib/utils.ts
 function normalizeSkillName(name) {
   return name;
@@ -35996,6 +36483,17 @@ var MAX_SLUG_LENGTH = 128;
 var MAX_SKILL_MD_BYTES = 512000;
 var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
 var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
+function pinPayload(pin) {
+  return { slug: pin.slug, pinnedAt: pin.pinnedAt, metadata: pin.metadata };
+}
+function pinMetadataField(body) {
+  if (body.metadata === undefined)
+    return {};
+  if (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata)) {
+    throw new SkillRequestError(400, "INVALID_METADATA", "`metadata` must be a JSON object");
+  }
+  return body.metadata;
+}
 
 class SkillRequestError extends Error {
   status;
@@ -36024,33 +36522,130 @@ function publishedPayload(record) {
     ...publishedSkillMeta(record),
     slug: record.slug,
     publishedSource: record.source,
+    ...record.skillMd ? { skillMd: record.skillMd } : {},
     ...record.bundleSha256 ? { bundleSha256: record.bundleSha256, bundleByteSize: record.bundleByteSize } : {},
     publishedAt: record.createdAt,
-    updatedAt: record.updatedAt
+    updatedAt: record.updatedAt,
+    revisionId: record.revisionId,
+    revisionNumber: record.revisionNumber
+  };
+}
+function revisionEtag(revisionId) {
+  return `"${revisionId}"`;
+}
+function parseIfMatch(value) {
+  if (value === null || value.trim() === "")
+    return;
+  const trimmed = value.trim();
+  if (trimmed === "*") {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must name the exact revision id (the ETag of the current revision); '*' is not accepted");
+  }
+  const unquoted = trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+  if (!REVISION_ID_PATTERN.test(unquoted)) {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must carry a revision id: a 64-character lowercase hex sha-256, quoted as the server's ETag");
+  }
+  return unquoted;
+}
+async function tombstoneStatus(store, artifactStorage, principal, record) {
+  if (!record.tombstonedAt)
+    return "live";
+  if (record.tombstonePurgeAfter && record.tombstonePurgeAfter <= new Date().toISOString()) {
+    const purged = await store.purgeExpiredTombstones(principal);
+    for (const removed of purged) {
+      if (removed.bundleSha256)
+        await discardCollectedObject(store, artifactStorage, principal, removed.bundleSha256);
+    }
+    return "purged";
+  }
+  return {
+    slug: record.slug,
+    deleted: true,
+    code: "TOMBSTONED",
+    tombstonedAt: record.tombstonedAt,
+    tombstonePurgeAfter: record.tombstonePurgeAfter,
+    revisionId: record.revisionId
   };
 }
 async function listMergedSkills(store, principal) {
   const published = await store.listSkills(principal);
+  return mergedSkillPayloads(published, listServerSkills());
+}
+function mergedSkillPayloads(published, bundled) {
   const publishedBySlug = new Map(published.map((record) => [record.slug, record]));
-  const merged = mergeSkillRegistryLists(listServerSkills(), published.map(publishedSkillMeta));
+  const merged = mergeSkillRegistryLists(bundled, published.map(publishedSkillMeta));
   return merged.map((skill) => {
     const record = publishedBySlug.get(skill.name);
     return record ? publishedPayload(record) : skill;
   });
 }
-async function getMergedSkill(store, principal, slug) {
+async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
   const record = await store.getSkill(principal, slug);
-  if (record)
-    return publishedPayload(record);
+  if (!record)
+    return { kind: "absent" };
+  const status = await tombstoneStatus(store, artifactStorage, principal, record);
+  if (status === "purged")
+    return { kind: "absent" };
+  if (status !== "live")
+    return { kind: "tombstone", payload: status };
+  return { kind: "published", record };
+}
+async function listOrgTags(store, principal) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const tags = new Set;
+  for (const tag of await store.listTags(principal)) {
+    if (tag.trim())
+      tags.add(tag);
+  }
+  for (const skill of listServerSkills()) {
+    if (publishedSlugs.includes(skill.name))
+      continue;
+    for (const tag of skill.tags) {
+      if (tag.trim())
+        tags.add(tag);
+    }
+  }
+  return [...tags].sort();
+}
+async function listMergedSkillsByTag(store, principal, tag) {
+  const published = await store.listSkillsByTag(principal, tag);
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundled = listServerSkills().filter((skill) => skill.tags.includes(tag) && !publishedSlugs.includes(skill.name));
+  return mergedSkillPayloads(published, bundled);
+}
+function skillSummary(skill) {
+  return {
+    slug: String(skill.slug ?? skill.name),
+    ...typeof skill.name === "string" ? { name: skill.name } : {},
+    ...typeof skill.version === "string" ? { version: skill.version } : {},
+    ...typeof skill.updatedAt === "string" ? { updatedAt: skill.updatedAt } : {}
+  };
+}
+async function listPinsByTag(store, principal, tag) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundledTaggedSlugs = new Set;
+  for (const skill of listServerSkills()) {
+    if (skill.tags.includes(tag) && !publishedSlugs.includes(skill.name))
+      bundledTaggedSlugs.add(skill.name);
+  }
+  const publishedPins = await store.listPinsByTag(principal, tag);
+  const bundledPins = bundledTaggedSlugs.size ? (await store.listPins(principal)).filter((pin) => bundledTaggedSlugs.has(pin.slug)) : [];
+  return [...publishedPins, ...bundledPins].sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map(pinPayload);
+}
+async function getMergedSkill(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
+    return resolved.payload;
+  if (resolved.kind === "published")
+    return publishedPayload(resolved.record);
   const bundled = getServerSkill(slug);
   return bundled ? bundled : null;
 }
-async function getMergedSkillMd(store, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (record?.skillMd)
-    return record.skillMd;
-  if (record)
+async function getMergedSkillMd(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
     return null;
+  if (resolved.kind === "published")
+    return resolved.record.skillMd ?? null;
   return getServerSkillMd(slug);
 }
 async function parsePublishRequest(request, config) {
@@ -36092,7 +36687,7 @@ async function parsePublishRequest(request, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha256 = createHash5("sha256").update(bundleBytes).digest("hex");
+    const sha256 = createHash6("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -36120,9 +36715,13 @@ async function parsePublishRequest(request, config) {
   }
   return { input: buildPublishInput(parseManifestJson(text)) };
 }
-async function storePublishedSkill(store, artifactStorage, principal, parsed) {
+async function storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId) {
   const superseded = (await store.getSkill(principal, parsed.input.slug))?.bundleSha256;
-  let input = { ...parsed.input, principal };
+  let input = {
+    ...parsed.input,
+    principal,
+    ...expectedRevisionId ? { expectedRevisionId } : {}
+  };
   if (parsed.bundleBytes && input.bundle) {
     const placement = await artifactStorage.putBundle(principal.orgId, input.bundle.sha256, parsed.bundleBytes, input.bundle.contentType);
     input = { ...input, bundle: { ...input.bundle, ...placement } };
@@ -36133,15 +36732,8 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed) {
   }
   return record;
 }
-async function deletePublishedSkill(store, artifactStorage, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (!record)
-    return false;
-  const deleted = await store.deleteSkill(principal, slug);
-  if (deleted && record.bundleSha256) {
-    await discardCollectedObject(store, artifactStorage, principal, record.bundleSha256);
-  }
-  return deleted;
+async function deletePublishedSkill(store, artifactStorage, principal, slug, tombstoneWindowMs) {
+  return store.deleteSkill(principal, slug, tombstoneWindowMs);
 }
 async function discardCollectedObject(store, artifactStorage, principal, sha256) {
   if (await store.getSkillBundle(principal, sha256))
@@ -36161,7 +36753,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash5("sha256").update(bytes).digest("hex");
+  const actual = createHash6("sha256").update(bytes).digest("hex");
   if (actual !== record.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record.bundleSha256}`);
   }
@@ -36277,10 +36869,10 @@ async function createSkillsFetchHandler(options = {}) {
     const segments = pathSegments(url.pathname);
     try {
       if (request.method === "GET" && url.pathname === "/health") {
-        return json({ ok: true, service: "open-skills", time: new Date().toISOString() });
+        return json({ ok: true, service: "skills", time: new Date().toISOString() });
       }
       if (request.method === "GET" && url.pathname === "/ready") {
-        return json({ ok: true, service: "open-skills" });
+        return json({ ok: true, service: "skills" });
       }
       if (url.pathname.startsWith("/api/")) {
         const principal = await authenticateRequest(store, request);
@@ -36298,6 +36890,14 @@ async function createSkillsFetchHandler(options = {}) {
       if (error instanceof SkillRequestError) {
         return json({ error: error.message, code: error.code }, { status: error.status });
       }
+      if (error instanceof SkillRevisionConflictError) {
+        return json({
+          error: error.message,
+          code: "REVISION_CONFLICT",
+          slug: error.slug,
+          ...error.currentRevisionId ? { currentRevisionId: error.currentRevisionId } : {}
+        }, { status: 409 });
+      }
       return json({ error: "internal server error", detail: error.message }, { status: 500 });
     }
   };
@@ -36317,24 +36917,43 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
     return json({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
   if (resource === "skills") {
-    if (request.method === "GET" && !id)
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listMergedSkillsByTag(store, principal, tag));
       return json(await listMergedSkills(store, principal));
+    }
     if (request.method === "POST" && !id) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const parsed = await parsePublishRequest(request, config);
-      const record = await storePublishedSkill(store, artifactStorage, principal, parsed);
-      return json(publishedPayload(record), { status: 201 });
+      const record = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
+      return json(publishedPayload(record), { status: 201, headers: { ETag: revisionEtag(record.revisionId) } });
     }
     if (request.method === "GET" && id && subresource === "skill.md") {
-      const docs = await getMergedSkillMd(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      const docs = await getMergedSkillMd(store, artifactStorage, principal, id);
       return docs ? new Response(docs, { headers: { "Content-Type": "text/markdown; charset=utf-8", "Cache-Control": "no-store" } }) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "GET" && id && subresource === "bundle") {
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "absent") {
+        return json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      }
       const { record, bytes } = await readPublishedBundle(store, artifactStorage, principal, id);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
         "Content-Disposition": `attachment; filename="${record.slug}.tar.gz"`,
         "X-Skill-Bundle-Sha256": record.bundleSha256 ?? "",
+        "X-Skill-Revision-Id": record.revisionId,
+        "X-Skill-Revision-Number": String(record.revisionNumber),
+        ETag: revisionEtag(record.revisionId),
         "Cache-Control": "no-store"
       };
       if (config.bundleSigningKey) {
@@ -36343,17 +36962,56 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
       return new Response(bytes, { headers });
     }
     if (request.method === "GET" && id && !subresource) {
-      const skill = await getMergedSkill(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "published") {
+        return json(publishedPayload(resolved.record), { headers: { ETag: revisionEtag(resolved.record.revisionId) } });
+      }
+      const skill = await getMergedSkill(store, artifactStorage, principal, id);
       return skill ? json(skill) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if ((request.method === "PUT" || request.method === "PATCH") && id && !subresource) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const body = await readJson(request, config.requestBodyLimitBytes);
-      const updated = await store.updateSkill(principal, id, skillPatch(body));
-      return updated ? json(publishedPayload(updated)) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const updated = await store.updateSkill(principal, id, skillPatch(body), expectedRevisionId);
+      return updated ? json(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "DELETE" && id && !subresource) {
-      const removed = await deletePublishedSkill(store, artifactStorage, principal, id);
-      return removed ? json({ deleted: true, slug: id }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const removed = await deletePublishedSkill(store, artifactStorage, principal, id, config.tombstoneWindowMs);
+      return removed ? json({
+        deleted: true,
+        slug: id,
+        ...removed.tombstonedAt ? { tombstonedAt: removed.tombstonedAt, tombstonePurgeAfter: removed.tombstonePurgeAfter } : {}
+      }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "pins") {
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listPinsByTag(store, principal, tag));
+      return json((await store.listPins(principal)).map(pinPayload));
+    }
+    if (request.method === "PUT" && id && !subresource) {
+      assertPublishableSlug(id);
+      const body = await readJson(request, config.requestBodyLimitBytes);
+      const pin = await store.pinSkill(principal, id, pinMetadataField(body));
+      return json(pinPayload(pin));
+    }
+    if (request.method === "DELETE" && id && !subresource) {
+      assertPublishableSlug(id);
+      const removed = await store.unpinSkill(principal, id);
+      return removed ? json({ deleted: true, slug: id }) : json({ error: "pin not found", code: "PIN_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "tags") {
+    if (request.method === "GET" && !id) {
+      return json(await listOrgTags(store, principal));
+    }
+    if (request.method === "GET" && id && subresource === "skills") {
+      return json((await listMergedSkillsByTag(store, principal, id)).map(skillSummary));
     }
   }
   if (resource === "runs") {
@@ -36505,5 +37163,5 @@ function clampInt(value, fallback, max) {
 // src/server/index.ts
 var config = resolveServerConfig();
 var server = await startSkillsServer({ config });
-console.log(`open-skills API listening on http://${config.host}:${server.port}`);
+console.log(`skills API listening on http://${config.host}:${server.port}`);
 console.log(`storage: ${resolveDatabaseTarget(config.databaseUrl).label}`);