@hasna/skills 0.1.63 → 0.1.66

package/bin/server.js

@@ -22936,6 +22936,119 @@ __export(exports_dist_es8, {
 var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
+// package.json
+var package_default = {
+  name: "@hasna/skills",
+  version: "0.1.66",
+  description: "Skills library for AI coding agents",
+  type: "module",
+  bin: {
+    skills: "bin/index.js",
+    "skills-mcp": "bin/mcp.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-migrate": "bin/migrate.js"
+  },
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./storage": {
+      import: "./dist/storage.js",
+      types: "./dist/storage.d.ts"
+    },
+    "./sdk": {
+      import: "./dist/sdk/index.js",
+      types: "./dist/sdk/index.d.ts"
+    }
+  },
+  files: [
+    "dist/",
+    "!dist/**/*.test.d.ts",
+    "!dist/test-preload.d.ts",
+    "!dist/platform",
+    "bin/",
+    "migrations/",
+    "docs/skill-standard.md",
+    "schemas/",
+    "LICENSE",
+    "README.md"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  scripts: {
+    clean: "rm -rf bin/ dist/",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    test: "bun test --timeout 30000",
+    dev: "bun run ./src/cli/index.tsx",
+    "dev:watch": "bun --watch run ./src/cli/index.tsx",
+    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    migrate: "bun run ./src/server/migrate.ts",
+    typecheck: "tsc --noEmit",
+    "verify:release": "bun run scripts/release-guard.ts",
+    prepack: "bun run build && bun run verify:release",
+    prepublishOnly: "bun run typecheck && bun run test",
+    postinstall: "mkdir -p $HOME/.hasna/skills/custom 2>/dev/null || true"
+  },
+  keywords: [
+    "skills",
+    "ai",
+    "agent",
+    "cli",
+    "typescript",
+    "bun",
+    "claude",
+    "codex",
+    "gemini",
+    "mcp",
+    "model-context-protocol",
+    "open-source",
+    "skills-library",
+    "automation"
+  ],
+  author: "Hasna",
+  license: "Apache-2.0",
+  devDependencies: {
+    "@types/bun": "latest",
+    "@types/node": "25.2.3",
+    "@types/react": "^18.2.0",
+    "bun-types": "1.3.14",
+    "react-devtools-core": "^7.0.1",
+    typescript: "^5"
+  },
+  dependencies: {
+    "@aws-sdk/client-ecs": "^3.1079.0",
+    "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/events": "0.1.16",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    chalk: "^5.3.0",
+    commander: "^12.1.0",
+    ink: "^5.0.1",
+    "ink-select-input": "^6.0.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    react: "^18.2.0",
+    zod: "^4.3.6"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/hasna/apps.git"
+  },
+  homepage: "https://github.com/hasna/skills",
+  bugs: {
+    url: "https://github.com/hasna/skills/issues"
+  }
+};
 
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -22955,6 +23068,7 @@ var ANY_SEGMENT_EXCLUDES = new Set([
   ".docker"
 ]);
 var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
 var CREDENTIAL_FILENAMES = new Set([
   ".npmrc",
   ".pypirc",
@@ -31994,7 +32108,7 @@ var WriteGetObjectResponse$ = [
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1106.0/node_modules/@aws-sdk/client-s3/package.json
-var package_default = {
+var package_default2 = {
   name: "@aws-sdk/client-s3",
   version: "3.1106.0",
   description: "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
@@ -32544,7 +32658,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config28.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config28.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config28.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -32856,36 +32970,144 @@ function concat(chunks) {
   return merged;
 }
 
-// src/server/auth.ts
-import { createHash as createHash3 } from "crypto";
-function hashApiKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
-}
-function bearerToken(request) {
-  const header = request.headers.get("authorization") || "";
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  const token = match?.[1]?.trim();
-  return token || null;
+// src/sdk/governance.ts
+var DEFAULT_OUTPUT_GOVERNANCE = {
+  defaultVisibility: "private",
+  redactPatterns: [
+    /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+    /\bsk_[A-Za-z0-9_-]{8,}\b/g,
+    /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+    /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+    /\bAKIA[A-Z0-9]{12,}\b/g,
+    /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+    /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
+    /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
+  ],
+  perOutputBytes: 10 * 1024 * 1024,
+  perRunTotalBytes: 100 * 1024 * 1024,
+  artifactTtlSeconds: 30 * 24 * 60 * 60
+};
+var DEFAULT_RUN_QUOTA = {
+  cpu: 1,
+  memoryMB: 2048,
+  durationSeconds: 3600,
+  networkMB: 100,
+  artifactBytes: 100 * 1024 * 1024
+};
+var GOVERNANCE_ERROR_CODES = {
+  ARTIFACT_LIMIT_EXCEEDED: "ARTIFACT_LIMIT_EXCEEDED",
+  RUN_ARTIFACT_TOTAL_EXCEEDED: "RUN_ARTIFACT_TOTAL_EXCEEDED",
+  RUN_BUDGET_EXHAUSTED: "RUN_BUDGET_EXHAUSTED",
+  STALE_LEASE_GENERATION: "STALE_LEASE_GENERATION",
+  FENCING_UNSUPPORTED: "FENCING_UNSUPPORTED",
+  EVENT_PAYLOAD_REJECTED: "EVENT_PAYLOAD_REJECTED",
+  SKILL_UNAVAILABLE_OFFLINE: "SKILL_UNAVAILABLE_OFFLINE",
+  REMOTE_REQUIRED: "REMOTE_REQUIRED"
+};
+
+class GovernanceError extends Error {
+  code;
+  gate;
+  ceiling;
+  constructor(code, message, options = {}) {
+    super(message);
+    this.name = "GovernanceError";
+    this.code = code;
+    this.gate = options.gate ?? code;
+    this.ceiling = options.ceiling;
+  }
 }
-async function authenticateRequest(store, request) {
-  const token = bearerToken(request);
-  if (!token)
-    return null;
-  return store.authenticateApiKeyHash(hashApiKey(token));
+function runPointersOf(run) {
+  return {
+    runId: run.id,
+    attemptId: run.id,
+    leaseGeneration: run.leaseGeneration,
+    correlationId: run.correlationId
+  };
 }
-function publicPrincipal(partial = {}) {
+
+// src/sdk/cancel.ts
+function createCancelService(options) {
+  const store = options.store;
+  const governanceStore = options.governanceStore;
+  const storage = options.storage ?? new ArtifactStorage;
   return {
-    apiKeyId: partial.apiKeyId || "key_dev",
-    orgId: partial.orgId || "org_dev",
-    orgSlug: partial.orgSlug || "dev",
-    orgName: partial.orgName || "Development",
-    userId: partial.userId || "user_dev",
-    email: partial.email || "dev@example.com",
-    role: partial.role || "owner",
-    scopes: partial.scopes || ["skills:read", "runs:write"]
+    async cancel(principal, runId, requestedBy) {
+      if (!store.transitionRun) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.FENCING_UNSUPPORTED, `cannot cancel run ${runId}: the store has no transitionRun generation fencing`, { gate: "transitionRun" });
+      }
+      const run = await store.getRun(principal, runId);
+      if (!run)
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} not found`, { gate: "run" });
+      const terminalStatuses = new Set(["succeeded", "failed", "cancelled", "expired", "refunded"]);
+      if (terminalStatuses.has(run.status)) {
+        const receipt2 = await governanceStore.appendReceipt({
+          kind: "cancel",
+          orgId: run.orgId,
+          runId: run.id,
+          requestedBy,
+          metadata: { outcome: "already-terminal", status: run.status, ...runPointersOf(run) }
+        });
+        return { run, fencedGeneration: run.leaseGeneration, quarantined: [], receipt: receipt2, alreadyTerminal: true };
+      }
+      const fencedGeneration = run.leaseGeneration + 1;
+      const cancelling = await store.transitionRun(runId, { status: "cancel_requested", leaseGeneration: fencedGeneration }, run.leaseGeneration);
+      if (!cancelling) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} changed while cancelling`, { gate: "transition" });
+      }
+      const artifacts = await store.listArtifacts(principal, runId);
+      const quarantined = [];
+      for (const artifact of artifacts) {
+        const quarantineKey = await storage.moveToQuarantine?.(artifact);
+        if (quarantineKey) {
+          await governanceStore.updateArtifactStorageKey(artifact.id, artifact.orgId, quarantineKey);
+        }
+        await governanceStore.appendReceipt({
+          kind: "quarantine",
+          orgId: artifact.orgId,
+          runId: run.id,
+          artifactId: artifact.id,
+          requestedBy,
+          metadata: { relativePath: artifact.relativePath, byteSize: artifact.byteSize, quarantineKey: quarantineKey ?? null }
+        });
+        quarantined.push({ ...artifact, ...quarantineKey ? { storageKey: quarantineKey } : {} });
+      }
+      const cancelled = await store.transitionRun(runId, { status: "cancelled", completedAt: new Date().toISOString() }, fencedGeneration);
+      if (!cancelled) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} moved on while finalising cancellation`, { gate: "transition" });
+      }
+      const receipt = await governanceStore.appendReceipt({
+        kind: "cancel",
+        orgId: run.orgId,
+        runId: run.id,
+        requestedBy,
+        metadata: {
+          fencedGeneration,
+          artifactCount: quarantined.length,
+          pointers: runPointersOf(cancelled)
+        }
+      });
+      return { run: cancelled, fencedGeneration, quarantined, receipt, alreadyTerminal: false };
+    }
   };
 }
 
+// src/sdk/governance-store.ts
+import { Database as Database2 } from "bun:sqlite";
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdirSync as mkdirSync3 } from "fs";
+import { dirname as dirname5 } from "path";
+
+// src/server/database-url.ts
+import { isAbsolute, join as join3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { homedir as homedir2 } from "os";
+
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
 var RETIRED_CONFIG_KEYS = {
@@ -32932,53 +33154,7 @@ function assertNoRetiredConfigKeys(config, source) {
   }
 }
 
-// src/server/config.ts
-var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
-var SKILLS_ENV_NAMESPACE = "SKILLS";
-function resolveServerConfig(env = process.env) {
-  assertNoRetiredModeEnvVars(env, {
-    app: SKILLS_ENV_NAMESPACE,
-    replacement: DATABASE_URL_ENV
-  });
-  const nodeEnv = env.NODE_ENV || "development";
-  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
-  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
-  return {
-    host,
-    port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
-    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
-    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
-    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
-    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_SIGNING_KEY || undefined,
-    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
-    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
-    nodeEnv,
-    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
-  };
-}
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function normalizePrefix(value) {
-  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
-}
-
-// src/server/database-url.ts
-import { isAbsolute, join as join3 } from "path";
-import { fileURLToPath } from "url";
-
 // src/lib/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
 var ENUM_KEYS = {
   defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
   defaultScope: ["global", "project"],
@@ -33031,6 +33207,11 @@ function normalizeConfigValue(key, value) {
 }
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var INSTALLED_SKILLS_DIRNAME = "installed";
+var SKILLS_CACHE_DIRNAME = "skills";
+var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
+function isOwnerLayoutMigrated(appDir) {
+  return existsSync(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+}
 function getDataDir() {
   const override = process.env[DATA_DIR_ENV];
   if (override) {
@@ -33153,26 +33334,78 @@ function looksLikeSqlitePath(value) {
   return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
 }
 
-// src/server/handlers.ts
-import { createHash as createHash4 } from "crypto";
+// src/server/sqlite-store.ts
+import { Database } from "bun:sqlite";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 
-// src/server/store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+// src/server/auth.ts
+import { createHash as createHash3 } from "crypto";
+function hashApiKey(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+function bearerToken(request) {
+  const header = request.headers.get("authorization") || "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  const token = match?.[1]?.trim();
+  return token || null;
+}
+async function authenticateRequest(store, request) {
+  const token = bearerToken(request);
+  if (!token)
+    return null;
+  return store.authenticateApiKeyHash(hashApiKey(token));
+}
+function publicPrincipal(partial = {}) {
+  return {
+    apiKeyId: partial.apiKeyId || "key_dev",
+    orgId: partial.orgId || "org_dev",
+    orgSlug: partial.orgSlug || "dev",
+    orgName: partial.orgName || "Development",
+    userId: partial.userId || "user_dev",
+    email: partial.email || "dev@example.com",
+    role: partial.role || "owner",
+    scopes: partial.scopes || ["skills:read", "runs:write"]
+  };
+}
 
-// src/server/types.ts
-class StaleLeaseGenerationError extends Error {
-  runId;
-  expectedGeneration;
-  currentGeneration;
-  status;
-  constructor(runId, expectedGeneration, currentGeneration, status) {
-    super(`late transition rejected for run ${runId}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
-    this.name = "StaleLeaseGenerationError";
-    this.runId = runId;
-    this.expectedGeneration = expectedGeneration;
-    this.currentGeneration = currentGeneration;
-    this.status = status;
+// src/server/migrations-dir.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var MIGRATION_DIALECTS = ["postgres", "sqlite"];
+var MAX_WALK_UP = 6;
+function findMigrationsRoot(startDirs = defaultStartDirs()) {
+  for (const start of startDirs) {
+    let dir = start;
+    for (let level = 0;level < MAX_WALK_UP; level += 1) {
+      const candidate = join4(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
+        return candidate;
+      const parent = dirname3(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
+  if (!root3) {
+    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
+  }
+  const dir = join4(root3, dialect);
+  if (!existsSync2(dir)) {
+    throw new Error(`migrations directory not found: ${dir}`);
   }
+  return dir;
+}
+function defaultStartDirs() {
+  const dirs = [import.meta.dir];
+  const cwd = process.cwd();
+  if (cwd && cwd !== import.meta.dir)
+    dirs.push(cwd);
+  return dirs;
 }
 
 // src/server/rows.ts
@@ -33255,7 +33488,20 @@ function rowToSkill(row) {
     ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
     ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
     createdAt: dateString(row.created_at),
-    updatedAt: dateString(row.updated_at)
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
   };
 }
 function rowToSkillBundle(row) {
@@ -33307,53 +33553,62 @@ function dateString(value) {
   return String(value);
 }
 
-// src/server/sqlite-store.ts
-import { Database } from "bun:sqlite";
-import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/server/migrations-dir.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-var MIGRATION_DIALECTS = ["postgres", "sqlite"];
-var MAX_WALK_UP = 6;
-function findMigrationsRoot(startDirs = defaultStartDirs()) {
-  for (const start of startDirs) {
-    let dir = start;
-    for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join4(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
-        return candidate;
-      const parent = dirname3(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId2, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId2;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
   }
-  return null;
 }
-function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
-  if (!root3) {
-    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
   }
-  const dir = join4(root3, dialect);
-  if (!existsSync2(dir)) {
-    throw new Error(`migrations directory not found: ${dir}`);
-  }
-  return dir;
 }
-function defaultStartDirs() {
-  const dirs = [import.meta.dir];
-  const cwd = process.cwd();
-  if (cwd && cwd !== import.meta.dir)
-    dirs.push(cwd);
-  return dirs;
+
+// src/lib/revision.ts
+import { createHash as createHash4 } from "crypto";
+var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash4("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
 }
 
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 var LAST_USED_RESOLUTION_MS = 60000;
 
 class SqliteSkillsStore {
@@ -33373,12 +33628,24 @@ class SqliteSkillsStore {
     if (options.migrate !== false) {
       applySqliteMigrations(this.db, options.migrationsDir);
     }
+    this.backfillLegacyRevisions();
     this.backend = {
       kind: "sqlite",
       durable: !inMemory,
       label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
     };
   }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
   get database() {
     return this.db;
   }
@@ -33602,8 +33869,29 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -33624,8 +33912,8 @@ class SqliteSkillsStore {
         ]);
       }
       const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
          ON CONFLICT (org_id, slug) DO UPDATE SET
            display_name = excluded.display_name,
            description = excluded.description,
@@ -33643,7 +33931,16 @@ class SqliteSkillsStore {
            bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
            bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
            published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
+         WHERE skills_registry.tombstoned_at IS NOT NULL
+            OR skills_registry.revision_id = ?
          RETURNING *`, [
         orgId,
         input.slug,
@@ -33654,62 +33951,165 @@ class SqliteSkillsStore {
         input.source,
         input.kind,
         input.version ?? null,
-        input.skillMd ?? null,
+        carriedSkillMd,
         input.bundle?.sha256 ?? null,
         input.bundle?.byteSize ?? null,
         input.principal.userId,
+        revisionId,
+        now,
         now,
-        now
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
       return rowToSkill(row);
     })();
   }
   async listSkills(principal) {
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const row = this.get(`UPDATE skills_registry
-       SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?, updated_at = ?
-       WHERE org_id = ? AND slug = ?
-       RETURNING *`, [
-      next.displayName,
-      next.description,
-      next.category,
-      JSON.stringify(next.tags),
-      next.kind,
-      next.version ?? null,
-      next.skillMd ?? null,
-      nowIso(),
-      principal.orgId,
-      slug
-    ]);
-    return row ? rowToSkill(row) : null;
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next.displayName,
+        next.description,
+        next.category,
+        JSON.stringify(next.tags),
+        next.kind,
+        next.version ?? null,
+        next.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return this.db.transaction(() => {
-      const existing = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       if (!existing)
-        return false;
-      this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (typeof existing.bundle_sha256 === "string")
-        this.collectOrphanBundle(principal.orgId, existing.bundle_sha256);
-      return true;
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
     })();
   }
   async getSkillBundle(principal, sha256) {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)
@@ -33795,7 +34195,316 @@ function parseScopes(value) {
   }
 }
 
+// src/sdk/governance-store.ts
+function receiptId() {
+  return `rcpt_${Date.now().toString(36)}_${randomUUID3().replace(/-/g, "").slice(0, 10)}`;
+}
+function reservationId() {
+  return `res_${Date.now().toString(36)}_${randomUUID3().replace(/-/g, "").slice(0, 10)}`;
+}
+var EXPIRED_ARTIFACT_SQL = `
+  SELECT a.* FROM skills_artifacts a
+  JOIN skills_runs r ON r.id = a.run_id
+  WHERE a.expires_at IS NOT NULL AND a.expires_at <= ?
+  ORDER BY a.expires_at ASC
+`;
+var ACTIVE_RUN_SQL = `
+  SELECT COUNT(*) AS n FROM skills_runs
+  WHERE org_id = ? AND status IN ('queued','running','cancel_requested')
+`;
+class SqliteGovernanceStore {
+  backend = "sqlite";
+  db;
+  closed = false;
+  constructor(path = SQLITE_MEMORY_PATH, options = {}) {
+    if (path !== SQLITE_MEMORY_PATH)
+      mkdirSync3(dirname5(path), { recursive: true });
+    this.db = new Database2(path, { create: true, readwrite: true });
+    this.db.exec("PRAGMA busy_timeout = 5000");
+    this.db.exec("PRAGMA foreign_keys = ON");
+    if (options.migrate !== false)
+      applySqliteMigrations(this.db);
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.db.close(false);
+  }
+  get database() {
+    return this.db;
+  }
+  async appendReceipt(receipt) {
+    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    this.db.run(`INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [next.id, next.kind, next.orgId, next.runId, next.artifactId ?? null, next.requestedBy, JSON.stringify(next.metadata), next.createdAt]);
+    return next;
+  }
+  async listReceipts(orgId, runId2) {
+    const rows = this.db.query("SELECT * FROM skills_lifecycle_receipts WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+    return rows.map((row) => ({
+      id: String(row.id),
+      kind: String(row.kind),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      ...typeof row.artifact_id === "string" ? { artifactId: row.artifact_id } : {},
+      requestedBy: String(row.requested_by),
+      metadata: parseJsonObject(row.metadata_json),
+      createdAt: String(row.created_at)
+    }));
+  }
+  async createReservation(input) {
+    const reservation = { ...input, id: reservationId(), status: "reserved", createdAt: nowIso() };
+    this.db.run(`INSERT INTO skills_credit_reservations (id, org_id, run_id, estimated_cents, status, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, [reservation.id, reservation.orgId, reservation.runId, reservation.estimatedCents, reservation.status, reservation.createdAt]);
+    return reservation;
+  }
+  async reservationsForRun(orgId, runId2) {
+    const rows = this.db.query("SELECT * FROM skills_credit_reservations WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+    return rows.map((row) => this.reservationFrom(row));
+  }
+  async reconcileReservation(reservationId2, actualCents, status) {
+    const row = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
+    if (!row || String(row.status) !== "reserved")
+      return row ? this.reservationFrom(row) : null;
+    const reconciledAt = nowIso();
+    this.db.run("UPDATE skills_credit_reservations SET actual_cents = ?, status = ?, reconciled_at = ? WHERE id = ?", [actualCents, status, reconciledAt, reservationId2]);
+    const updated = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
+    return this.reservationFrom(updated);
+  }
+  async monthlySpendCents(orgId, monthPrefix) {
+    const from = `${monthPrefix}-01T00:00:00.000Z`;
+    const nextMonth = nextMonthPrefix(monthPrefix);
+    const spent = this.db.query("SELECT COALESCE(SUM(cost_cents), 0) AS spent FROM skills_runs WHERE org_id = ? AND created_at >= ? AND created_at < ?").get(orgId, from, `${nextMonth}-01T00:00:00.000Z`);
+    const pending = this.db.query("SELECT COALESCE(SUM(estimated_cents), 0) AS pending FROM skills_credit_reservations WHERE org_id = ? AND status = 'reserved'").get(orgId);
+    return Number(spent.spent ?? 0) + Number(pending.pending ?? 0);
+  }
+  async activeRunCount(orgId) {
+    const row = this.db.query(ACTIVE_RUN_SQL).get(orgId);
+    return Number(row.n ?? 0);
+  }
+  async listExpiredArtifacts(at2) {
+    const rows = this.db.query(EXPIRED_ARTIFACT_SQL).all(at2);
+    return rows.map(rowToArtifact);
+  }
+  async deleteArtifactRow(artifactId2, orgId) {
+    const result = this.db.run("DELETE FROM skills_artifacts WHERE id = ? AND org_id = ?", [artifactId2, orgId]);
+    return result.changes === 1;
+  }
+  async updateArtifactStorageKey(artifactId2, orgId, storageKey) {
+    const result = this.db.run("UPDATE skills_artifacts SET storage_key = ? WHERE id = ? AND org_id = ?", [storageKey, artifactId2, orgId]);
+    return result.changes === 1;
+  }
+  reservationFrom(row) {
+    return {
+      id: String(row.id),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      estimatedCents: Number(row.estimated_cents ?? 0),
+      ...row.actual_cents !== null && row.actual_cents !== undefined ? { actualCents: Number(row.actual_cents) } : {},
+      status: String(row.status),
+      createdAt: String(row.created_at),
+      ...typeof row.reconciled_at === "string" ? { reconciledAt: row.reconciled_at } : {}
+    };
+  }
+}
+
+class PostgresGovernanceStore {
+  backend = "postgres";
+  sql;
+  constructor(databaseUrl) {
+    const bunWithSql = Bun;
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: 2 });
+  }
+  async close() {
+    await this.sql.close?.();
+  }
+  async withContext(orgId, worker, fn) {
+    return this.sql.begin(async (tx) => {
+      await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
+      await tx`SELECT set_config('app.skills_claim_context', ${worker ? "worker" : ""}, true)`;
+      return await fn(tx);
+    });
+  }
+  async appendReceipt(receipt) {
+    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    await this.sql`
+      INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json)
+      VALUES (${next.id}, ${next.kind}, ${next.orgId}, ${next.runId}, ${next.artifactId ?? null}, ${next.requestedBy}, ${JSON.stringify(next.metadata)}::jsonb)
+    `;
+    return next;
+  }
+  async listReceipts(orgId, runId2) {
+    const rows = await this.sql`
+      SELECT * FROM skills_lifecycle_receipts WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+    `;
+    return rows.map((row) => ({
+      id: String(row.id),
+      kind: String(row.kind),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      ...typeof row.artifact_id === "string" ? { artifactId: row.artifact_id } : {},
+      requestedBy: String(row.requested_by),
+      metadata: parseJsonObject(row.metadata_json),
+      createdAt: String(row.created_at)
+    }));
+  }
+  async createReservation(input) {
+    const reservation = { ...input, id: reservationId(), status: "reserved", createdAt: nowIso() };
+    await this.sql`
+      INSERT INTO skills_credit_reservations (id, org_id, run_id, estimated_cents, status)
+      VALUES (${reservation.id}, ${reservation.orgId}, ${reservation.runId}, ${reservation.estimatedCents}, ${reservation.status})
+    `;
+    return reservation;
+  }
+  async reservationsForRun(orgId, runId2) {
+    const rows = await this.sql`
+      SELECT * FROM skills_credit_reservations WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+    `;
+    return rows.map((row) => this.reservationFrom(row));
+  }
+  async reconcileReservation(reservationId2, actualCents, status) {
+    const rows = await this.sql`
+      UPDATE skills_credit_reservations
+      SET actual_cents = ${actualCents}, status = ${status}, reconciled_at = now()
+      WHERE id = ${reservationId2} AND status = ${"reserved"}
+      RETURNING *
+    `;
+    if (!rows[0]) {
+      const existing = await this.sql`SELECT * FROM skills_credit_reservations WHERE id = ${reservationId2} LIMIT 1`;
+      return existing[0] ? this.reservationFrom(existing[0]) : null;
+    }
+    return this.reservationFrom(rows[0]);
+  }
+  async monthlySpendCents(orgId, monthPrefix) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        SELECT
+          (SELECT COALESCE(SUM(cost_cents), 0) FROM skills_runs
+           WHERE org_id = ${orgId} AND created_at >= ${`${monthPrefix}-01T00:00:00.000Z`} AND created_at < ${`${nextMonthPrefix(monthPrefix)}-01T00:00:00.000Z`}) AS spent,
+          (SELECT COALESCE(SUM(estimated_cents), 0) FROM skills_credit_reservations
+           WHERE org_id = ${orgId} AND status = ${"reserved"}) AS pending
+      `;
+      return Number(rows[0]?.spent ?? 0) + Number(rows[0]?.pending ?? 0);
+    });
+  }
+  async activeRunCount(orgId) {
+    return this.withContext(orgId, false, async (tx) => {
+      const rows = await tx`SELECT COUNT(*) AS n FROM skills_runs WHERE org_id = ${orgId} AND status IN (${"queued"}, ${"running"}, ${"cancel_requested"})`;
+      return Number(rows[0]?.n ?? 0);
+    });
+  }
+  async listExpiredArtifacts(at2) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id
+        WHERE a.expires_at IS NOT NULL AND a.expires_at <= ${at2}
+        ORDER BY a.expires_at ASC
+      `;
+      return rows.map(rowToArtifact);
+    });
+  }
+  async deleteArtifactRow(artifactId2, orgId) {
+    return this.withContext(orgId, true, async (tx) => {
+      const rows = await tx`DELETE FROM skills_artifacts WHERE id = ${artifactId2} AND org_id = ${orgId} RETURNING id`;
+      return rows.length > 0;
+    });
+  }
+  async updateArtifactStorageKey(artifactId2, orgId, storageKey) {
+    return this.withContext(orgId, true, async (tx) => {
+      const rows = await tx`
+        UPDATE skills_artifacts SET storage_key = ${storageKey} WHERE id = ${artifactId2} AND org_id = ${orgId} RETURNING id
+      `;
+      return rows.length > 0;
+    });
+  }
+  reservationFrom(row) {
+    return {
+      id: String(row.id),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      estimatedCents: Number(row.estimated_cents ?? 0),
+      ...row.actual_cents !== null && row.actual_cents !== undefined ? { actualCents: Number(row.actual_cents) } : {},
+      status: String(row.status),
+      createdAt: String(row.created_at),
+      ...typeof row.reconciled_at === "string" ? { reconciledAt: row.reconciled_at } : {}
+    };
+  }
+}
+async function createGovernanceStore(databaseUrl) {
+  const target = resolveDatabaseTarget(databaseUrl);
+  if (target.kind === "postgres")
+    return new PostgresGovernanceStore(target.url);
+  if (target.kind === "memory")
+    return new SqliteGovernanceStore(SQLITE_MEMORY_PATH);
+  return new SqliteGovernanceStore(target.path);
+}
+function nextMonthPrefix(monthPrefix) {
+  const [year, month] = monthPrefix.split("-").map(Number);
+  return month === 12 ? `${year + 1}-01` : `${year}-${String(month + 1).padStart(2, "0")}`;
+}
+
+// src/server/config.ts
+var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
+var SKILLS_ENV_NAMESPACE = "SKILLS";
+function resolveServerConfig(env = process.env) {
+  assertNoRetiredModeEnvVars(env, {
+    app: SKILLS_ENV_NAMESPACE,
+    replacement: DATABASE_URL_ENV
+  });
+  const nodeEnv = env.NODE_ENV || "development";
+  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
+  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
+  return {
+    host,
+    port,
+    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
+    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
+    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
+    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
+    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    nodeEnv,
+    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
+  };
+}
+function localOrigin(host, port) {
+  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizePrefix(value) {
+  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
+}
+
+// src/server/handlers.ts
+import { createHash as createHash5 } from "crypto";
+
 // src/server/store.ts
+import { randomUUID as randomUUID4 } from "crypto";
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
 function resolvePoolMax(env = process.env) {
   const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
@@ -33833,6 +34542,7 @@ class MemorySkillsStore {
   idempotency = new Map;
   skills = new Map;
   bundles = new Map;
+  pins = new Map;
   constructor(apiKeys = []) {
     for (const key of apiKeys)
       this.addApiKey(key.token, key.principal);
@@ -33867,7 +34577,7 @@ class MemorySkillsStore {
       input: input.input,
       args: input.args,
       ...idemKey ? { idempotencyKey: idemKey } : {},
-      correlationId: randomUUID3(),
+      correlationId: randomUUID4(),
       costCents: 0,
       leaseGeneration: 0,
       createdAt: now
@@ -33934,6 +34644,9 @@ class MemorySkillsStore {
     const key = skillKey(input.principal.orgId, input.slug);
     const now = nowIso();
     const previous = this.skills.get(key);
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
     if (input.bundle) {
       const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
       this.bundles.set(bundleMapKey, {
@@ -33943,6 +34656,8 @@ class MemorySkillsStore {
         createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
       });
     }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
     const record = {
       orgId: input.principal.orgId,
       slug: input.slug,
@@ -33953,11 +34668,13 @@ class MemorySkillsStore {
       source: input.source,
       kind: input.kind,
       ...input.version ? { version: input.version } : {},
-      ...input.skillMd ? { skillMd: input.skillMd } : {},
-      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
       publishedByUserId: input.principal.userId,
       createdAt: previous?.createdAt ?? now,
-      updatedAt: now
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1
     };
     this.skills.set(key, record);
     if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
@@ -33966,33 +34683,107 @@ class MemorySkillsStore {
     return record;
   }
   async listSkills(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async getSkill(principal, slug) {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
-    const next = { ...current, ...patch, updatedAt: nowIso() };
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
+      return null;
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
     this.skills.set(skillKey(principal.orgId, slug), next);
     return next;
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     const current = await this.getSkill(principal, slug);
     if (!current)
-      return false;
-    this.skills.delete(skillKey(principal.orgId, slug));
-    if (current.bundleSha256)
-      this.collectOrphanBundle(principal.orgId, current.bundleSha256);
-    return true;
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next);
+      return next;
+    }
+    return current;
+  }
+  async purgeExpiredTombstones(principal) {
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
   }
   async getSkillBundle(principal, sha256) {
     const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
     return bundle && bundle.orgId === principal.orgId ? bundle : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
+  }
+  async unpinSkill(principal, slug) {
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+  }
+  async listPins(principal) {
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId)
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256);
     if (!referenced)
@@ -34010,6 +34801,9 @@ class MemorySkillsStore {
 function skillKey(orgId, slug) {
   return `${orgId.length}:${orgId}:${slug}`;
 }
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
 
 class PostgresSkillsStore {
   backend = { kind: "postgres", durable: true, label: "postgres" };
@@ -34029,6 +34823,14 @@ class PostgresSkillsStore {
     } catch (error) {
       throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
     }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
   }
   async close() {
     await this.sql.close?.();
@@ -34090,20 +34892,20 @@ class PostgresSkillsStore {
     });
   }
   async createRun(input) {
-    if (input.idempotencyKey) {
-      const existing = await this.sql`
-        SELECT * FROM skills_runs
-        WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
-        LIMIT 1
-      `;
-      if (existing[0])
-        return rowToRun(existing[0]);
-    }
-    const id = runId();
     return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
-        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID4()})
         RETURNING *
       `;
       return rowToRun(rows[0]);
@@ -34263,8 +35065,33 @@ class PostgresSkillsStore {
   async publishSkill(input) {
     const orgId = input.principal.orgId;
     return await this.sql.begin(async (tx) => {
-      const previousRows = await tx`SELECT bundle_sha256 FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
-      const previousSha = typeof previousRows[0]?.bundle_sha256 === "string" ? String(previousRows[0].bundle_sha256) : null;
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         await tx`
           INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
@@ -34279,10 +35106,10 @@ class PostgresSkillsStore {
       }
       const rows = await tx`
         INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                     bundle_sha256, bundle_byte_size, published_by_user_id, updated_at)
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
         VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
-                ${input.source}, ${input.kind}, ${input.version ?? null}, ${input.skillMd ?? null},
-                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, now())
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
         ON CONFLICT (org_id, slug) DO UPDATE SET
           display_name = EXCLUDED.display_name,
           description = EXCLUDED.description,
@@ -34297,9 +35124,23 @@ class PostgresSkillsStore {
           bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
           bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
           published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
+        WHERE skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
         RETURNING *
       `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
         await tx`
           DELETE FROM skills_bundles
@@ -34307,55 +35148,182 @@ class PostgresSkillsStore {
             AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
         `;
       }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
       return rowToSkill(rows[0]);
     });
   }
   async listSkills(principal) {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} ORDER BY slug ASC`;
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
     return rows.map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const rows = await this.sql`
-      UPDATE skills_registry
-      SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-          tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-          skill_md = ${next.skillMd ?? null}, updated_at = now()
-      WHERE org_id = ${principal.orgId} AND slug = ${slug}
-      RETURNING *
-    `;
-    return rows[0] ? rowToSkill(rows[0]) : null;
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
+            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
+            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
       const rows = await tx`
-        DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug}
-        RETURNING bundle_sha256
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
       `;
-      if (!rows[0])
-        return false;
-      const sha = rows[0].bundle_sha256;
-      if (typeof sha === "string") {
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
+  }
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
         await tx`
-          DELETE FROM skills_bundles
-          WHERE org_id = ${principal.orgId} AND sha256 = ${sha}
-            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${sha})
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
         `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
       }
-      return true;
+      return purged;
     });
   }
   async getSkillBundle(principal, sha256) {
     const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
     return rows[0] ? rowToSkillBundle(rows[0]) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
+  }
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
+  }
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
   async collectOrphanBundle(orgId, sha256) {
     await this.sql`
       DELETE FROM skills_bundles
@@ -34364,6 +35332,7 @@ class PostgresSkillsStore {
     `;
   }
 }
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
 function isUniqueViolation(error) {
   const code = error?.code;
   if (code === "23505" || code === 23505)
@@ -34425,7 +35394,7 @@ ${summary}
       textArtifact(run, "show-notes.md", `# Show Notes
 
 - ${summary}
-- Generated by the open-skills deterministic worker.
+- Generated by the skills deterministic worker.
 `),
       textArtifact(run, "clips.csv", `start,end,title,summary
 00:00,00:30,"Opening","${csv(summary)}"
@@ -34459,7 +35428,7 @@ function textArtifact(run, relativePath, bodyText, contentType = relativePath.en
       relativePath,
       contentType,
       byteSize: bytes.byteLength,
-      sha256: createHash4("sha256").update(bytes).digest("hex"),
+      sha256: createHash5("sha256").update(bytes).digest("hex"),
       visibility: "private"
     },
     body: { relativePath, bodyText, contentType }
@@ -34475,7 +35444,9 @@ async function completeRun(store, run, preview) {
   return next ?? run;
 }
 async function failRun(store, run, code, message) {
-  await store.appendLog(run.id, run.orgId, "error", message);
+  try {
+    await store.appendLog(run.id, run.orgId, "error", message);
+  } catch {}
   const next = await fencedTransition(store, run, {
     status: "failed",
     errorCode: code,
@@ -34489,7 +35460,9 @@ async function fencedTransition(store, run, patch) {
     return store.updateRun(run.id, patch);
   const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
   if (!next) {
-    await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    try {
+      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    } catch {}
   }
   return next;
 }
@@ -34521,7 +35494,7 @@ function csv(value) {
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -34571,25 +35544,26 @@ function mergeSkillRegistryLists(...groups) {
 }
 
 // src/server/registry.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
 import { resolve, sep } from "path";
 
 // src/lib/registry.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync5 } from "fs";
+import { join as join9 } from "path";
 
 // src/lib/portable-skills.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync5,
+  mkdtempSync,
+  readdirSync as readdirSync4,
   renameSync,
   rmSync,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join7, normalize } from "path";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join8, normalize } from "path";
 
 // src/lib/registry-data/development-tools.ts
 var DEVELOPMENT_TOOLS_SKILLS = [
@@ -34749,7 +35723,7 @@ var DEVELOPMENT_TOOLS_SKILLS = [
   {
     name: "monitor",
     displayName: "Monitor",
-    description: "Operate the open-monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
     category: "Development Tools",
     tags: ["monitoring", "mcp", "processes", "operations"]
   },
@@ -34795,6 +35769,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     description: "Validate configuration files for syntax and schema compliance",
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
+  },
+  {
+    name: "session-inject-monitor",
+    displayName: "Session Inject Monitor",
+    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
+    category: "Development Tools",
+    tags: ["monitor", "session", "injection", "automation", "wake"],
+    kind: "instruction"
   }
 ];
 
@@ -35182,7 +36164,7 @@ var DESIGN_BRANDING_SKILLS = [
     displayName: "Site Analyze",
     description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
     category: "Design & Branding",
-    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "open-styles"]
+    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
   }
 ];
 
@@ -35293,8 +36275,29 @@ var SKILLS = [
 ];
 
 // src/lib/hosted-skill-set.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { join as join6 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
+function normalizeMarker(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isHostedMetadataPackage(pkg) {
+  const skills = pkg?.skills;
+  if (!skills || typeof skills !== "object")
+    return false;
+  return HOSTED_RUNTIMES.has(normalizeMarker(skills.runtime)) || HOSTED_SOURCES.has(normalizeMarker(skills.source));
+}
+function isHostedMetadataSkillDir(skillDir) {
+  const pkgPath = join6(skillDir, "package.json");
+  if (!existsSync3(pkgPath))
+    return false;
+  try {
+    return isHostedMetadataPackage(JSON.parse(readFileSync4(pkgPath, "utf8")));
+  } catch {
+    return false;
+  }
+}
 var HOSTED_METADATA_SET_EMPTY_ERROR = [
   "The hosted metadata skill set is empty, but the packaging guards that depend on it",
   "only mean anything while it is non-empty: an empty set makes every one of them pass",
@@ -35416,14 +36419,14 @@ var PORTABLE_SKILL_DEFAULT_VERSION = "0.1.0";
 // src/lib/portable-skills-files.ts
 import {
   cpSync,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync5,
   realpathSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { basename, dirname as dirname5, join as join6, relative } from "path";
+import { basename, dirname as dirname6, join as join7, relative } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -35451,12 +36454,12 @@ function normalizePortableSkillName(name) {
   return normalized;
 }
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
-  const skillJsonPath = join6(skillPath, "skill.json");
-  const skillMdPath = join6(skillPath, "SKILL.md");
-  const pkgPath = join6(skillPath, "package.json");
-  const jsonManifest = existsSync3(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
-  const frontmatter = existsSync3(skillMdPath) ? parseSkillFrontmatter(readFileSync4(skillMdPath, "utf-8")) ?? undefined : undefined;
-  const pkg = existsSync3(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  const skillJsonPath = join7(skillPath, "skill.json");
+  const skillMdPath = join7(skillPath, "SKILL.md");
+  const pkgPath = join7(skillPath, "package.json");
+  const jsonManifest = existsSync4(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync4(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync4(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version2 = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
@@ -35583,7 +36586,7 @@ function inferPackageCommands(pkg, fallbackName) {
   return;
 }
 function readJsonObject(path) {
-  const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (!isRecord(parsed))
     throw new Error(`${basename(path)} must contain a JSON object`);
   return parsed;
@@ -35612,33 +36615,36 @@ var LEGACY_CUSTOM_DIRNAME = "custom";
 function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
-  const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
+  const appDir = options.homeDir ? join8(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache3 = join8(appDir, SKILLS_CACHE_DIRNAME);
+  if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
+    return cache3;
+  const installed = join8(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
 }
 function looksLikeSkillDirectory(path) {
   if (!safeIsDirectory(path))
     return false;
-  return existsSync4(join7(path, "SKILL.md")) || existsSync4(join7(path, "skill.json")) || existsSync4(join7(path, "package.json"));
+  return existsSync5(join8(path, "SKILL.md")) || existsSync5(join8(path, "skill.json")) || existsSync5(join8(path, "package.json"));
 }
 function migrateLegacySkillLayout(appDir, installed) {
   if (!safeIsDirectory(appDir))
     return;
   const candidates = [];
   try {
-    for (const entry of readdirSync3(appDir)) {
+    for (const entry of readdirSync4(appDir)) {
       if (entry.startsWith(".") || entry === INSTALLED_SKILLS_DIRNAME)
         continue;
-      const path = join7(appDir, entry);
+      const path = join8(appDir, entry);
       if (entry === LEGACY_CUSTOM_DIRNAME) {
         if (!safeIsDirectory(path))
           continue;
         try {
-          for (const nested of readdirSync3(path)) {
+          for (const nested of readdirSync4(path)) {
             if (nested.startsWith("."))
               continue;
-            const nestedPath = join7(path, nested);
+            const nestedPath = join8(path, nested);
             if (looksLikeSkillDirectory(nestedPath))
               candidates.push({ from: nestedPath, name: nested });
           }
@@ -35652,10 +36658,10 @@ function migrateLegacySkillLayout(appDir, installed) {
     return;
   }
   for (const { from, name } of candidates) {
-    const target = join7(installed, name);
-    if (existsSync4(target))
+    const target = join8(installed, name);
+    if (existsSync5(target))
       continue;
-    const staging = join7(installed, `.migrating-${name}-${process.pid}`);
+    const staging = join8(installed, `.migrating-${name}-${process.pid}`);
     try {
       rmSync(staging, { recursive: true, force: true });
       cpSync2(from, staging, { recursive: true, errorOnExist: false });
@@ -35668,7 +36674,7 @@ function migrateLegacySkillLayout(appDir, installed) {
   }
 }
 function getPortableSkillPath(name, options = {}) {
-  return join7(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join8(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -35678,7 +36684,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync4(path) || !statSync3(path).isDirectory())
+  if (!existsSync5(path) || !statSync4(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -35691,10 +36697,10 @@ function listPortableSkills(options = {}) {
   if (!safeIsDirectory(root3))
     return [];
   const skills = [];
-  for (const entry of readdirSync3(root3).sort()) {
+  for (const entry of readdirSync4(root3).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join7(root3, entry);
+    const path = join8(root3, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -35716,7 +36722,8 @@ function listPortableSkillMetas(options = {}) {
       tags: manifest.tags || ["custom"],
       version: skill.version,
       ...manifest.kind ? { kind: manifest.kind } : {},
-      source: "custom"
+      source: "custom",
+      ...isHostedMetadataSkillDir(skill.path) ? { serverOwned: true } : {}
     };
   });
 }
@@ -35736,7 +36743,7 @@ function summarizePortableSkill(skillPath, fallbackName) {
 }
 function safeIsDirectory(path) {
   try {
-    return statSync3(path).isDirectory();
+    return statSync4(path).isDirectory();
   } catch {
     return false;
   }
@@ -35786,20 +36793,20 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync5(dir))
+  if (!existsSync6(dir))
     return [];
   const result = [];
   try {
-    const entries = readdirSync4(dir, { withFileTypes: true });
+    const entries = readdirSync5(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join8(dir, entry.name, "SKILL.md");
-      if (!existsSync5(skillMdPath))
+      const skillMdPath = join9(dir, entry.name, "SKILL.md");
+      if (!existsSync6(skillMdPath))
         continue;
       let content;
       try {
-        content = readFileSync5(skillMdPath, "utf-8");
+        content = readFileSync6(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -35814,6 +36821,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
+        ...isHostedMetadataSkillDir(join9(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -35822,20 +36830,20 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config = loadConfig4();
-  if (!config.extensionsDir || !existsSync5(config.extensionsDir))
+  if (!config.extensionsDir || !existsSync6(config.extensionsDir))
     return null;
   try {
-    const entries = readdirSync4(config.extensionsDir, { withFileTypes: true });
+    const entries = readdirSync5(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join8(config.extensionsDir, entry.name);
-      const skillMdPath = join8(skillDir, "SKILL.md");
-      if (!existsSync5(skillMdPath))
+      const skillDir = join9(config.extensionsDir, entry.name);
+      const skillMdPath = join9(skillDir, "SKILL.md");
+      if (!existsSync6(skillMdPath))
         continue;
       let content;
       try {
-        content = readFileSync5(skillMdPath, "utf-8");
+        content = readFileSync6(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -35868,7 +36876,7 @@ function loadRegistry(cwd) {
   const official = SKILLS.map((s2) => ({ ...s2, source: "official" }));
   const extensions = config.extensionsDir ? discoverSkillsInDir(config.extensionsDir, "extension") : [];
   const portableCustom = listPortableSkillMetas();
-  const legacyCustom = discoverSkillsInDir(join8(dataDir, "custom"));
+  const legacyCustom = discoverSkillsInDir(join9(dataDir, "custom"));
   const globalCustom = mergeCustomSkills([...legacyCustom, ...portableCustom]);
   registryCache = mergeSkillRegistryLists(official, extensions, globalCustom);
   registryCacheTime = now;
@@ -35888,30 +36896,29 @@ function mergeCustomSkills(skills) {
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync as rmSync2 } from "fs";
-import { dirname as dirname7, join as join9 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync2 } from "fs";
+import { dirname as dirname8, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-
 // src/lib/utils.ts
 function normalizeSkillName(name) {
   return name;
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname7(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname8(fileURLToPath2(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i3 = 0;i3 < 5; i3++) {
-    const candidate = join9(dir, "skills");
-    if (existsSync6(candidate) && !dir.includes(".skills"))
+    const candidate = join10(dir, "skills");
+    if (existsSync7(candidate) && !dir.includes(".skills"))
       return candidate;
-    dir = dirname7(dir);
+    dir = dirname8(dir);
   }
-  return join9(__dirname2, "..", "skills");
+  return join10(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -35919,13 +36926,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join9(getDataDir(), "custom", skillName);
-  if (existsSync6(legacyCustomPath))
+  const legacyCustomPath = join10(getDataDir(), "custom", skillName);
+  if (existsSync7(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join9(SKILLS_DIR, skillName);
+  return join10(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -35934,18 +36941,18 @@ function getCanonicalSkillName(name) {
 // src/lib/skillinfo.ts
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync7(skillPath))
+  if (!existsSync8(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join10(skillPath, "SKILL.md")),
-    readme: readIfExists(join10(skillPath, "README.md")),
-    claudeMd: readIfExists(join10(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join11(skillPath, "SKILL.md")),
+    readme: readIfExists(join11(skillPath, "README.md")),
+    claudeMd: readIfExists(join11(skillPath, "CLAUDE.md"))
   };
 }
 function readIfExists(path) {
   try {
-    if (existsSync7(path)) {
-      return readFileSync7(path, "utf-8");
+    if (existsSync8(path)) {
+      return readFileSync8(path, "utf-8");
     }
   } catch {}
   return null;
@@ -35986,7 +36993,7 @@ function getServerSkillMd(slug) {
   const path = resolve(skillsDir, name, "SKILL.md");
   if (!isInsideDir(skillsDir, path))
     return null;
-  return existsSync8(path) ? readFileSync8(path, "utf8") : null;
+  return existsSync9(path) ? readFileSync9(path, "utf8") : null;
 }
 
 // src/server/skills-api.ts
@@ -35996,6 +37003,17 @@ var MAX_SLUG_LENGTH = 128;
 var MAX_SKILL_MD_BYTES = 512000;
 var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
 var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
+function pinPayload(pin) {
+  return { slug: pin.slug, pinnedAt: pin.pinnedAt, metadata: pin.metadata };
+}
+function pinMetadataField(body) {
+  if (body.metadata === undefined)
+    return {};
+  if (!body.metadata || typeof body.metadata !== "object" || Array.isArray(body.metadata)) {
+    throw new SkillRequestError(400, "INVALID_METADATA", "`metadata` must be a JSON object");
+  }
+  return body.metadata;
+}
 
 class SkillRequestError extends Error {
   status;
@@ -36024,33 +37042,130 @@ function publishedPayload(record) {
     ...publishedSkillMeta(record),
     slug: record.slug,
     publishedSource: record.source,
+    ...record.skillMd ? { skillMd: record.skillMd } : {},
     ...record.bundleSha256 ? { bundleSha256: record.bundleSha256, bundleByteSize: record.bundleByteSize } : {},
     publishedAt: record.createdAt,
-    updatedAt: record.updatedAt
+    updatedAt: record.updatedAt,
+    revisionId: record.revisionId,
+    revisionNumber: record.revisionNumber
+  };
+}
+function revisionEtag(revisionId) {
+  return `"${revisionId}"`;
+}
+function parseIfMatch(value) {
+  if (value === null || value.trim() === "")
+    return;
+  const trimmed = value.trim();
+  if (trimmed === "*") {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must name the exact revision id (the ETag of the current revision); '*' is not accepted");
+  }
+  const unquoted = trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+  if (!REVISION_ID_PATTERN.test(unquoted)) {
+    throw new SkillRequestError(400, "INVALID_IF_MATCH", "If-Match must carry a revision id: a 64-character lowercase hex sha-256, quoted as the server's ETag");
+  }
+  return unquoted;
+}
+async function tombstoneStatus(store, artifactStorage, principal, record) {
+  if (!record.tombstonedAt)
+    return "live";
+  if (record.tombstonePurgeAfter && record.tombstonePurgeAfter <= new Date().toISOString()) {
+    const purged = await store.purgeExpiredTombstones(principal);
+    for (const removed of purged) {
+      if (removed.bundleSha256)
+        await discardCollectedObject(store, artifactStorage, principal, removed.bundleSha256);
+    }
+    return "purged";
+  }
+  return {
+    slug: record.slug,
+    deleted: true,
+    code: "TOMBSTONED",
+    tombstonedAt: record.tombstonedAt,
+    tombstonePurgeAfter: record.tombstonePurgeAfter,
+    revisionId: record.revisionId
   };
 }
 async function listMergedSkills(store, principal) {
   const published = await store.listSkills(principal);
+  return mergedSkillPayloads(published, listServerSkills());
+}
+function mergedSkillPayloads(published, bundled) {
   const publishedBySlug = new Map(published.map((record) => [record.slug, record]));
-  const merged = mergeSkillRegistryLists(listServerSkills(), published.map(publishedSkillMeta));
+  const merged = mergeSkillRegistryLists(bundled, published.map(publishedSkillMeta));
   return merged.map((skill) => {
     const record = publishedBySlug.get(skill.name);
     return record ? publishedPayload(record) : skill;
   });
 }
-async function getMergedSkill(store, principal, slug) {
+async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
   const record = await store.getSkill(principal, slug);
-  if (record)
-    return publishedPayload(record);
+  if (!record)
+    return { kind: "absent" };
+  const status = await tombstoneStatus(store, artifactStorage, principal, record);
+  if (status === "purged")
+    return { kind: "absent" };
+  if (status !== "live")
+    return { kind: "tombstone", payload: status };
+  return { kind: "published", record };
+}
+async function listOrgTags(store, principal) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const tags = new Set;
+  for (const tag of await store.listTags(principal)) {
+    if (tag.trim())
+      tags.add(tag);
+  }
+  for (const skill of listServerSkills()) {
+    if (publishedSlugs.includes(skill.name))
+      continue;
+    for (const tag of skill.tags) {
+      if (tag.trim())
+        tags.add(tag);
+    }
+  }
+  return [...tags].sort();
+}
+async function listMergedSkillsByTag(store, principal, tag) {
+  const published = await store.listSkillsByTag(principal, tag);
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundled = listServerSkills().filter((skill) => skill.tags.includes(tag) && !publishedSlugs.includes(skill.name));
+  return mergedSkillPayloads(published, bundled);
+}
+function skillSummary(skill) {
+  return {
+    slug: String(skill.slug ?? skill.name),
+    ...typeof skill.name === "string" ? { name: skill.name } : {},
+    ...typeof skill.version === "string" ? { version: skill.version } : {},
+    ...typeof skill.updatedAt === "string" ? { updatedAt: skill.updatedAt } : {}
+  };
+}
+async function listPinsByTag(store, principal, tag) {
+  const publishedSlugs = await store.listPublishedSlugs(principal);
+  const bundledTaggedSlugs = new Set;
+  for (const skill of listServerSkills()) {
+    if (skill.tags.includes(tag) && !publishedSlugs.includes(skill.name))
+      bundledTaggedSlugs.add(skill.name);
+  }
+  const publishedPins = await store.listPinsByTag(principal, tag);
+  const bundledPins = bundledTaggedSlugs.size ? (await store.listPins(principal)).filter((pin) => bundledTaggedSlugs.has(pin.slug)) : [];
+  return [...publishedPins, ...bundledPins].sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map(pinPayload);
+}
+async function getMergedSkill(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
+    return resolved.payload;
+  if (resolved.kind === "published")
+    return publishedPayload(resolved.record);
   const bundled = getServerSkill(slug);
   return bundled ? bundled : null;
 }
-async function getMergedSkillMd(store, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (record?.skillMd)
-    return record.skillMd;
-  if (record)
+async function getMergedSkillMd(store, artifactStorage, principal, slug) {
+  const resolved = await resolvePublishedSkill(store, artifactStorage, principal, slug);
+  if (resolved.kind === "tombstone")
     return null;
+  if (resolved.kind === "published")
+    return resolved.record.skillMd ?? null;
   return getServerSkillMd(slug);
 }
 async function parsePublishRequest(request, config) {
@@ -36092,7 +37207,7 @@ async function parsePublishRequest(request, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha256 = createHash5("sha256").update(bundleBytes).digest("hex");
+    const sha256 = createHash6("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -36120,28 +37235,33 @@ async function parsePublishRequest(request, config) {
   }
   return { input: buildPublishInput(parseManifestJson(text)) };
 }
-async function storePublishedSkill(store, artifactStorage, principal, parsed) {
+async function storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId) {
   const superseded = (await store.getSkill(principal, parsed.input.slug))?.bundleSha256;
-  let input = { ...parsed.input, principal };
+  let input = {
+    ...parsed.input,
+    principal,
+    ...expectedRevisionId ? { expectedRevisionId } : {}
+  };
   if (parsed.bundleBytes && input.bundle) {
     const placement = await artifactStorage.putBundle(principal.orgId, input.bundle.sha256, parsed.bundleBytes, input.bundle.contentType);
     input = { ...input, bundle: { ...input.bundle, ...placement } };
   }
-  const record = await store.publishSkill(input);
+  let record;
+  try {
+    record = await store.publishSkill(input);
+  } catch (error) {
+    if (input.bundle?.sha256) {
+      await discardCollectedObject(store, artifactStorage, principal, input.bundle.sha256);
+    }
+    throw error;
+  }
   if (superseded && superseded !== record.bundleSha256) {
     await discardCollectedObject(store, artifactStorage, principal, superseded);
   }
   return record;
 }
-async function deletePublishedSkill(store, artifactStorage, principal, slug) {
-  const record = await store.getSkill(principal, slug);
-  if (!record)
-    return false;
-  const deleted = await store.deleteSkill(principal, slug);
-  if (deleted && record.bundleSha256) {
-    await discardCollectedObject(store, artifactStorage, principal, record.bundleSha256);
-  }
-  return deleted;
+async function deletePublishedSkill(store, artifactStorage, principal, slug, tombstoneWindowMs) {
+  return store.deleteSkill(principal, slug, tombstoneWindowMs);
 }
 async function discardCollectedObject(store, artifactStorage, principal, sha256) {
   if (await store.getSkillBundle(principal, sha256))
@@ -36161,7 +37281,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash5("sha256").update(bytes).digest("hex");
+  const actual = createHash6("sha256").update(bytes).digest("hex");
   if (actual !== record.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record.bundleSha256}`);
   }
@@ -36206,7 +37326,7 @@ function buildPublishInput(manifest) {
   if (skillMd && byteLength(skillMd) > MAX_SKILL_MD_BYTES) {
     throw new SkillRequestError(413, "SKILL_MD_TOO_LARGE", `skillMd exceeds ${MAX_SKILL_MD_BYTES} bytes`);
   }
-  const kindValue = optionalString(manifest.kind) ?? "executable";
+  const kindValue = optionalString(manifest.kind) ?? "instruction";
   if (kindValue !== "executable" && kindValue !== "instruction") {
     throw new SkillRequestError(400, "INVALID_KIND", "`kind` must be 'executable' or 'instruction'");
   }
@@ -36268,6 +37388,7 @@ async function createSkillsFetchHandler(options = {}) {
     bootstrapApiKey: config.bootstrapApiKey
   });
   assertDurableStore(store, config);
+  const governanceStore = options.governanceStore ?? await createGovernanceStore(config.databaseUrl);
   const artifactStorage = new ArtifactStorage({
     bucket: config.artifactBucket,
     prefix: config.artifactPrefix
@@ -36277,10 +37398,10 @@ async function createSkillsFetchHandler(options = {}) {
     const segments = pathSegments(url.pathname);
     try {
       if (request.method === "GET" && url.pathname === "/health") {
-        return json({ ok: true, service: "open-skills", time: new Date().toISOString() });
+        return json({ ok: true, service: "skills", time: new Date().toISOString() });
       }
       if (request.method === "GET" && url.pathname === "/ready") {
-        return json({ ok: true, service: "open-skills" });
+        return json({ ok: true, service: "skills" });
       }
       if (url.pathname.startsWith("/api/")) {
         const principal = await authenticateRequest(store, request);
@@ -36290,7 +37411,7 @@ async function createSkillsFetchHandler(options = {}) {
           return json(identityPayload(principal));
         }
         if (segments[0] === "api" && segments[1] === "v1") {
-          return await handleApiV1(store, principal, request, segments.slice(2), config, artifactStorage);
+          return await handleApiV1(store, governanceStore, principal, request, segments.slice(2), config, artifactStorage);
         }
       }
       return json({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
@@ -36298,6 +37419,14 @@ async function createSkillsFetchHandler(options = {}) {
       if (error instanceof SkillRequestError) {
         return json({ error: error.message, code: error.code }, { status: error.status });
       }
+      if (error instanceof SkillRevisionConflictError) {
+        return json({
+          error: error.message,
+          code: "REVISION_CONFLICT",
+          slug: error.slug,
+          ...error.currentRevisionId ? { currentRevisionId: error.currentRevisionId } : {}
+        }, { status: 409 });
+      }
       return json({ error: "internal server error", detail: error.message }, { status: 500 });
     }
   };
@@ -36311,30 +37440,49 @@ function skillsServeLimits(config) {
   return { maxRequestBodySize: Math.max(config.skillBundleLimitBytes, config.requestBodyLimitBytes) + BODY_LIMIT_HEADROOM_BYTES };
 }
 var BODY_LIMIT_HEADROOM_BYTES = 1e6;
-async function handleApiV1(store, principal, request, parts, config, artifactStorage) {
+async function handleApiV1(store, governanceStore, principal, request, parts, config, artifactStorage) {
   const [resource, id, subresource, childId] = parts;
   if (parts.some(segmentEscapesPath)) {
     return json({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
   if (resource === "skills") {
-    if (request.method === "GET" && !id)
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listMergedSkillsByTag(store, principal, tag));
       return json(await listMergedSkills(store, principal));
+    }
     if (request.method === "POST" && !id) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const parsed = await parsePublishRequest(request, config);
-      const record = await storePublishedSkill(store, artifactStorage, principal, parsed);
-      return json(publishedPayload(record), { status: 201 });
+      const record = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
+      return json(publishedPayload(record), { status: 201, headers: { ETag: revisionEtag(record.revisionId) } });
     }
     if (request.method === "GET" && id && subresource === "skill.md") {
-      const docs = await getMergedSkillMd(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      const docs = await getMergedSkillMd(store, artifactStorage, principal, id);
       return docs ? new Response(docs, { headers: { "Content-Type": "text/markdown; charset=utf-8", "Cache-Control": "no-store" } }) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "GET" && id && subresource === "bundle") {
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "absent") {
+        return json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      }
       const { record, bytes } = await readPublishedBundle(store, artifactStorage, principal, id);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
         "Content-Disposition": `attachment; filename="${record.slug}.tar.gz"`,
         "X-Skill-Bundle-Sha256": record.bundleSha256 ?? "",
+        "X-Skill-Revision-Id": record.revisionId,
+        "X-Skill-Revision-Number": String(record.revisionNumber),
+        ETag: revisionEtag(record.revisionId),
         "Cache-Control": "no-store"
       };
       if (config.bundleSigningKey) {
@@ -36343,17 +37491,56 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
       return new Response(bytes, { headers });
     }
     if (request.method === "GET" && id && !subresource) {
-      const skill = await getMergedSkill(store, principal, id);
+      const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id);
+      if (resolved.kind === "tombstone") {
+        return json({ error: "skill was deleted", ...resolved.payload }, { status: 410 });
+      }
+      if (resolved.kind === "published") {
+        return json(publishedPayload(resolved.record), { headers: { ETag: revisionEtag(resolved.record.revisionId) } });
+      }
+      const skill = await getMergedSkill(store, artifactStorage, principal, id);
       return skill ? json(skill) : json({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if ((request.method === "PUT" || request.method === "PATCH") && id && !subresource) {
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
       const body = await readJson(request, config.requestBodyLimitBytes);
-      const updated = await store.updateSkill(principal, id, skillPatch(body));
-      return updated ? json(publishedPayload(updated)) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const updated = await store.updateSkill(principal, id, skillPatch(body), expectedRevisionId);
+      return updated ? json(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
     }
     if (request.method === "DELETE" && id && !subresource) {
-      const removed = await deletePublishedSkill(store, artifactStorage, principal, id);
-      return removed ? json({ deleted: true, slug: id }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+      const removed = await deletePublishedSkill(store, artifactStorage, principal, id, config.tombstoneWindowMs);
+      return removed ? json({
+        deleted: true,
+        slug: id,
+        ...removed.tombstonedAt ? { tombstonedAt: removed.tombstonedAt, tombstonePurgeAfter: removed.tombstonePurgeAfter } : {}
+      }) : json({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "pins") {
+    if (request.method === "GET" && !id) {
+      const tag = new URL(request.url).searchParams.get("tag");
+      if (tag !== null && tag !== "")
+        return json(await listPinsByTag(store, principal, tag));
+      return json((await store.listPins(principal)).map(pinPayload));
+    }
+    if (request.method === "PUT" && id && !subresource) {
+      assertPublishableSlug(id);
+      const body = await readJson(request, config.requestBodyLimitBytes);
+      const pin = await store.pinSkill(principal, id, pinMetadataField(body));
+      return json(pinPayload(pin));
+    }
+    if (request.method === "DELETE" && id && !subresource) {
+      assertPublishableSlug(id);
+      const removed = await store.unpinSkill(principal, id);
+      return removed ? json({ deleted: true, slug: id }) : json({ error: "pin not found", code: "PIN_NOT_FOUND" }, { status: 404 });
+    }
+  }
+  if (resource === "tags") {
+    if (request.method === "GET" && !id) {
+      return json(await listOrgTags(store, principal));
+    }
+    if (request.method === "GET" && id && subresource === "skills") {
+      return json((await listMergedSkillsByTag(store, principal, id)).map(skillSummary));
     }
   }
   if (resource === "runs") {
@@ -36412,8 +37599,18 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
       const run = await store.getRun(principal, id);
       if (!run)
         return json({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
-      const next = await store.updateRun(id, { status: "cancel_requested" });
-      return json(runPayload(next ?? run));
+      try {
+        const outcome = await createCancelService({ store, governanceStore, storage: artifactStorage }).cancel(principal, id, principal.email);
+        return json(runPayload(outcome.run));
+      } catch (error) {
+        if (error instanceof GovernanceError && error.code === GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION) {
+          return json({ error: error.message, code: error.code }, { status: 409 });
+        }
+        if (error instanceof StaleLeaseGenerationError) {
+          return json({ error: error.message, code: GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION }, { status: 409 });
+        }
+        throw error;
+      }
     }
   }
   return json({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
@@ -36503,7 +37700,25 @@ function clampInt(value, fallback, max) {
 }
 
 // src/server/index.ts
+var EARLY_ARGV = process.argv.slice(2);
+if (EARLY_ARGV.includes("--version") || EARLY_ARGV.includes("-V")) {
+  console.log(package_default.version);
+  process.exit(0);
+}
+if (EARLY_ARGV.includes("--help") || EARLY_ARGV.includes("-h")) {
+  console.log(`Usage: skills-server [options]
+
+Runs the @hasna/skills HTTP API.
+
+Options:
+  -V, --version  output the version number
+  -h, --help     display help for command
+
+Environment:
+  SKILLS_PORT  Listen port (default: 8787)`);
+  process.exit(0);
+}
 var config = resolveServerConfig();
 var server = await startSkillsServer({ config });
-console.log(`open-skills API listening on http://${config.host}:${server.port}`);
+console.log(`skills API listening on http://${config.host}:${server.port}`);
 console.log(`storage: ${resolveDatabaseTarget(config.databaseUrl).label}`);