@hasna/skills 0.1.63 → 0.1.66

package/bin/worker.js

@@ -22952,6 +22952,7 @@ var ANY_SEGMENT_EXCLUDES = new Set([
   ".docker"
 ]);
 var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
 var CREDENTIAL_FILENAMES = new Set([
   ".npmrc",
   ".pypirc",
@@ -32847,23 +32848,40 @@ function concat(chunks) {
   return merged;
 }
 
-// src/server/auth.ts
-import { createHash as createHash3 } from "crypto";
-function hashApiKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
-}
-function publicPrincipal(partial = {}) {
-  return {
-    apiKeyId: partial.apiKeyId || "key_dev",
-    orgId: partial.orgId || "org_dev",
-    orgSlug: partial.orgSlug || "dev",
-    orgName: partial.orgName || "Development",
-    userId: partial.userId || "user_dev",
-    email: partial.email || "dev@example.com",
-    role: partial.role || "owner",
-    scopes: partial.scopes || ["skills:read", "runs:write"]
-  };
-}
+// src/sdk/governance.ts
+var DEFAULT_OUTPUT_GOVERNANCE = {
+  defaultVisibility: "private",
+  redactPatterns: [
+    /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+    /\bsk_[A-Za-z0-9_-]{8,}\b/g,
+    /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+    /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+    /\bAKIA[A-Z0-9]{12,}\b/g,
+    /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+    /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
+    /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
+  ],
+  perOutputBytes: 10 * 1024 * 1024,
+  perRunTotalBytes: 100 * 1024 * 1024,
+  artifactTtlSeconds: 30 * 24 * 60 * 60
+};
+var DEFAULT_RUN_QUOTA = {
+  cpu: 1,
+  memoryMB: 2048,
+  durationSeconds: 3600,
+  networkMB: 100,
+  artifactBytes: 100 * 1024 * 1024
+};
+
+// src/server/database-url.ts
+import { isAbsolute, join as join3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { homedir as homedir2 } from "os";
 
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
@@ -32900,53 +32918,7 @@ function assertNoRetiredModeEnvVars(env, options) {
   throw new RetiredSettingError(names[0], `${names.join(", ")} ${names.length === 1 ? "is" : "are"} no longer read. ` + "Deployment modes were removed: where a server keeps its data is decided by the " + `database it is given, not by a declared label. Set ${options.replacement} to a ` + "postgres:// URL to use PostgreSQL, or leave it unset for the on-box SQLite database. " + `Then unset ${names.join(" and ")}. ` + "Refused rather than ignored, because a discarded setting looks exactly like a " + "working one until something needs the data.");
 }
 
-// src/server/config.ts
-var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
-var SKILLS_ENV_NAMESPACE = "SKILLS";
-function resolveServerConfig(env = process.env) {
-  assertNoRetiredModeEnvVars(env, {
-    app: SKILLS_ENV_NAMESPACE,
-    replacement: DATABASE_URL_ENV
-  });
-  const nodeEnv = env.NODE_ENV || "development";
-  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
-  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
-  return {
-    host,
-    port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
-    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
-    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
-    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
-    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_SIGNING_KEY || undefined,
-    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
-    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
-    nodeEnv,
-    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
-  };
-}
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function normalizePrefix(value) {
-  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
-}
-
-// src/server/database-url.ts
-import { isAbsolute, join as join3 } from "path";
-import { fileURLToPath } from "url";
-
 // src/lib/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
 function mergeDirectoryContents(sourceDir, targetDir) {
   if (!existsSync(sourceDir))
     return;
@@ -33057,26 +33029,66 @@ function looksLikeSqlitePath(value) {
   return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
 }
 
-// src/server/handlers.ts
-import { createHash as createHash4 } from "crypto";
+// src/server/sqlite-store.ts
+import { Database } from "bun:sqlite";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 
-// src/server/store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+// src/server/auth.ts
+import { createHash as createHash3 } from "crypto";
+function hashApiKey(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+function publicPrincipal(partial = {}) {
+  return {
+    apiKeyId: partial.apiKeyId || "key_dev",
+    orgId: partial.orgId || "org_dev",
+    orgSlug: partial.orgSlug || "dev",
+    orgName: partial.orgName || "Development",
+    userId: partial.userId || "user_dev",
+    email: partial.email || "dev@example.com",
+    role: partial.role || "owner",
+    scopes: partial.scopes || ["skills:read", "runs:write"]
+  };
+}
 
-// src/server/types.ts
-class StaleLeaseGenerationError extends Error {
-  runId;
-  expectedGeneration;
-  currentGeneration;
-  status;
-  constructor(runId, expectedGeneration, currentGeneration, status) {
-    super(`late transition rejected for run ${runId}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
-    this.name = "StaleLeaseGenerationError";
-    this.runId = runId;
-    this.expectedGeneration = expectedGeneration;
-    this.currentGeneration = currentGeneration;
-    this.status = status;
+// src/server/migrations-dir.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var MIGRATION_DIALECTS = ["postgres", "sqlite"];
+var MAX_WALK_UP = 6;
+function findMigrationsRoot(startDirs = defaultStartDirs()) {
+  for (const start of startDirs) {
+    let dir = start;
+    for (let level = 0;level < MAX_WALK_UP; level += 1) {
+      const candidate = join4(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
+        return candidate;
+      const parent = dirname3(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
+  if (!root3) {
+    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
+  }
+  const dir = join4(root3, dialect);
+  if (!existsSync2(dir)) {
+    throw new Error(`migrations directory not found: ${dir}`);
   }
+  return dir;
+}
+function defaultStartDirs() {
+  const dirs = [import.meta.dir];
+  const cwd = process.cwd();
+  if (cwd && cwd !== import.meta.dir)
+    dirs.push(cwd);
+  return dirs;
 }
 
 // src/server/rows.ts
@@ -33159,7 +33171,20 @@ function rowToSkill(row) {
     ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
     ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
     createdAt: dateString(row.created_at),
-    updatedAt: dateString(row.updated_at)
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
   };
 }
 function rowToSkillBundle(row) {
@@ -33211,53 +33236,61 @@ function dateString(value) {
   return String(value);
 }
 
-// src/server/sqlite-store.ts
-import { Database } from "bun:sqlite";
-import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/server/migrations-dir.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-var MIGRATION_DIALECTS = ["postgres", "sqlite"];
-var MAX_WALK_UP = 6;
-function findMigrationsRoot(startDirs = defaultStartDirs()) {
-  for (const start of startDirs) {
-    let dir = start;
-    for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join4(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
-        return candidate;
-      const parent = dirname3(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId2, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId2;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
   }
-  return null;
 }
-function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
-  if (!root3) {
-    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
-  }
-  const dir = join4(root3, dialect);
-  if (!existsSync2(dir)) {
-    throw new Error(`migrations directory not found: ${dir}`);
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
   }
-  return dir;
 }
-function defaultStartDirs() {
-  const dirs = [import.meta.dir];
-  const cwd = process.cwd();
-  if (cwd && cwd !== import.meta.dir)
-    dirs.push(cwd);
-  return dirs;
+
+// src/lib/revision.ts
+import { createHash as createHash4 } from "crypto";
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash4("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
 }
 
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 var LAST_USED_RESOLUTION_MS = 60000;
 
 class SqliteSkillsStore {
@@ -33277,12 +33310,24 @@ class SqliteSkillsStore {
     if (options.migrate !== false) {
       applySqliteMigrations(this.db, options.migrationsDir);
     }
+    this.backfillLegacyRevisions();
     this.backend = {
       kind: "sqlite",
       durable: !inMemory,
       label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
     };
   }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
   get database() {
     return this.db;
   }
@@ -33506,8 +33551,29 @@ class SqliteSkillsStore {
     const orgId = input.principal.orgId;
     const now = nowIso();
     return this.db.transaction(() => {
-      const previous = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
       const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -33528,8 +33594,8 @@ class SqliteSkillsStore {
         ]);
       }
       const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
          ON CONFLICT (org_id, slug) DO UPDATE SET
            display_name = excluded.display_name,
            description = excluded.description,
@@ -33547,7 +33613,16 @@ class SqliteSkillsStore {
            bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
            bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
            published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
            updated_at = excluded.updated_at
+         WHERE skills_registry.tombstoned_at IS NOT NULL
+            OR skills_registry.revision_id = ?
          RETURNING *`, [
         orgId,
         input.slug,
@@ -33558,62 +33633,165 @@ class SqliteSkillsStore {
         input.source,
         input.kind,
         input.version ?? null,
-        input.skillMd ?? null,
+        carriedSkillMd,
         input.bundle?.sha256 ?? null,
         input.bundle?.byteSize ?? null,
         input.principal.userId,
+        revisionId,
+        now,
         now,
-        now
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
       ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
       return rowToSkill(row);
     })();
   }
   async listSkills(principal) {
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const row = this.get(`UPDATE skills_registry
-       SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?, updated_at = ?
-       WHERE org_id = ? AND slug = ?
-       RETURNING *`, [
-      next.displayName,
-      next.description,
-      next.category,
-      JSON.stringify(next.tags),
-      next.kind,
-      next.version ?? null,
-      next.skillMd ?? null,
-      nowIso(),
-      principal.orgId,
-      slug
-    ]);
-    return row ? rowToSkill(row) : null;
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next.displayName,
+        next.description,
+        next.category,
+        JSON.stringify(next.tags),
+        next.kind,
+        next.version ?? null,
+        next.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return this.db.transaction(() => {
-      const existing = this.get("SELECT bundle_sha256 FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
       if (!existing)
-        return false;
-      this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (typeof existing.bundle_sha256 === "string")
-        this.collectOrphanBundle(principal.orgId, existing.bundle_sha256);
-      return true;
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
     })();
   }
   async getSkillBundle(principal, sha256) {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)
@@ -33699,7 +33877,66 @@ function parseScopes(value) {
   }
 }
 
+// src/server/config.ts
+var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
+var SKILLS_ENV_NAMESPACE = "SKILLS";
+function resolveServerConfig(env = process.env) {
+  assertNoRetiredModeEnvVars(env, {
+    app: SKILLS_ENV_NAMESPACE,
+    replacement: DATABASE_URL_ENV
+  });
+  const nodeEnv = env.NODE_ENV || "development";
+  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
+  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
+  return {
+    host,
+    port,
+    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
+    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
+    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
+    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
+    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    nodeEnv,
+    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
+  };
+}
+function localOrigin(host, port) {
+  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizePrefix(value) {
+  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
+}
+
+// src/server/handlers.ts
+import { createHash as createHash5 } from "crypto";
+
 // src/server/store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
 function resolvePoolMax(env = process.env) {
   const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
@@ -33737,6 +33974,7 @@ class MemorySkillsStore {
   idempotency = new Map;
   skills = new Map;
   bundles = new Map;
+  pins = new Map;
   constructor(apiKeys = []) {
     for (const key of apiKeys)
       this.addApiKey(key.token, key.principal);
@@ -33838,6 +34076,9 @@ class MemorySkillsStore {
     const key = skillKey(input.principal.orgId, input.slug);
     const now = nowIso();
     const previous = this.skills.get(key);
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
     if (input.bundle) {
       const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
       this.bundles.set(bundleMapKey, {
@@ -33847,6 +34088,8 @@ class MemorySkillsStore {
         createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
       });
     }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
     const record = {
       orgId: input.principal.orgId,
       slug: input.slug,
@@ -33857,11 +34100,13 @@ class MemorySkillsStore {
       source: input.source,
       kind: input.kind,
       ...input.version ? { version: input.version } : {},
-      ...input.skillMd ? { skillMd: input.skillMd } : {},
-      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
       publishedByUserId: input.principal.userId,
       createdAt: previous?.createdAt ?? now,
-      updatedAt: now
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1
     };
     this.skills.set(key, record);
     if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
@@ -33870,33 +34115,107 @@ class MemorySkillsStore {
     return record;
   }
   async listSkills(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async getSkill(principal, slug) {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
-    const next = { ...current, ...patch, updatedAt: nowIso() };
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
+      return null;
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
     this.skills.set(skillKey(principal.orgId, slug), next);
     return next;
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     const current = await this.getSkill(principal, slug);
     if (!current)
-      return false;
-    this.skills.delete(skillKey(principal.orgId, slug));
-    if (current.bundleSha256)
-      this.collectOrphanBundle(principal.orgId, current.bundleSha256);
-    return true;
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next);
+      return next;
+    }
+    return current;
+  }
+  async purgeExpiredTombstones(principal) {
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
   }
   async getSkillBundle(principal, sha256) {
     const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
     return bundle && bundle.orgId === principal.orgId ? bundle : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
+  }
+  async unpinSkill(principal, slug) {
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+  }
+  async listPins(principal) {
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId)
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
   collectOrphanBundle(orgId, sha256) {
     const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256);
     if (!referenced)
@@ -33914,6 +34233,9 @@ class MemorySkillsStore {
 function skillKey(orgId, slug) {
   return `${orgId.length}:${orgId}:${slug}`;
 }
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
 
 class PostgresSkillsStore {
   backend = { kind: "postgres", durable: true, label: "postgres" };
@@ -33933,6 +34255,14 @@ class PostgresSkillsStore {
     } catch (error) {
       throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
     }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
   }
   async close() {
     await this.sql.close?.();
@@ -33994,17 +34324,17 @@ class PostgresSkillsStore {
     });
   }
   async createRun(input) {
-    if (input.idempotencyKey) {
-      const existing = await this.sql`
-        SELECT * FROM skills_runs
-        WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
-        LIMIT 1
-      `;
-      if (existing[0])
-        return rowToRun(existing[0]);
-    }
-    const id = runId();
     return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
         VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
@@ -34167,8 +34497,33 @@ class PostgresSkillsStore {
   async publishSkill(input) {
     const orgId = input.principal.orgId;
     return await this.sql.begin(async (tx) => {
-      const previousRows = await tx`SELECT bundle_sha256 FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
-      const previousSha = typeof previousRows[0]?.bundle_sha256 === "string" ? String(previousRows[0].bundle_sha256) : null;
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
       if (input.bundle) {
         await tx`
           INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
@@ -34183,10 +34538,10 @@ class PostgresSkillsStore {
       }
       const rows = await tx`
         INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                     bundle_sha256, bundle_byte_size, published_by_user_id, updated_at)
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
         VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
-                ${input.source}, ${input.kind}, ${input.version ?? null}, ${input.skillMd ?? null},
-                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, now())
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
         ON CONFLICT (org_id, slug) DO UPDATE SET
           display_name = EXCLUDED.display_name,
           description = EXCLUDED.description,
@@ -34201,9 +34556,23 @@ class PostgresSkillsStore {
           bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
           bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
           published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
+        WHERE skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
         RETURNING *
       `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
         await tx`
           DELETE FROM skills_bundles
@@ -34211,55 +34580,182 @@ class PostgresSkillsStore {
             AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
         `;
       }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
       return rowToSkill(rows[0]);
     });
   }
   async listSkills(principal) {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} ORDER BY slug ASC`;
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
     return rows.map(rowToSkill);
   }
   async getSkill(principal, slug) {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
-  async updateSkill(principal, slug, patch) {
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
-    if (!current)
+    if (!current || current.tombstonedAt)
       return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
     const next = { ...current, ...patch };
-    const rows = await this.sql`
-      UPDATE skills_registry
-      SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-          tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-          skill_md = ${next.skillMd ?? null}, updated_at = now()
-      WHERE org_id = ${principal.orgId} AND slug = ${slug}
-      RETURNING *
-    `;
-    return rows[0] ? rowToSkill(rows[0]) : null;
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
+            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
+            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
   }
-  async deleteSkill(principal, slug) {
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
     return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
       const rows = await tx`
-        DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug}
-        RETURNING bundle_sha256
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
       `;
-      if (!rows[0])
-        return false;
-      const sha = rows[0].bundle_sha256;
-      if (typeof sha === "string") {
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
+  }
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
         await tx`
-          DELETE FROM skills_bundles
-          WHERE org_id = ${principal.orgId} AND sha256 = ${sha}
-            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${sha})
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
         `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
       }
-      return true;
+      return purged;
     });
   }
   async getSkillBundle(principal, sha256) {
     const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
     return rows[0] ? rowToSkillBundle(rows[0]) : null;
   }
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
+  }
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
+  }
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
   async collectOrphanBundle(orgId, sha256) {
     await this.sql`
       DELETE FROM skills_bundles
@@ -34268,6 +34764,7 @@ class PostgresSkillsStore {
     `;
   }
 }
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
 function isUniqueViolation(error) {
   const code = error?.code;
   if (code === "23505" || code === 23505)
@@ -34329,7 +34826,7 @@ ${summary}
       textArtifact(run, "show-notes.md", `# Show Notes
 
 - ${summary}
-- Generated by the open-skills deterministic worker.
+- Generated by the skills deterministic worker.
 `),
       textArtifact(run, "clips.csv", `start,end,title,summary
 00:00,00:30,"Opening","${csv(summary)}"
@@ -34363,7 +34860,7 @@ function textArtifact(run, relativePath, bodyText, contentType = relativePath.en
       relativePath,
       contentType,
       byteSize: bytes.byteLength,
-      sha256: createHash4("sha256").update(bytes).digest("hex"),
+      sha256: createHash5("sha256").update(bytes).digest("hex"),
       visibility: "private"
     },
     body: { relativePath, bodyText, contentType }
@@ -34379,7 +34876,9 @@ async function completeRun(store, run, preview) {
   return next ?? run;
 }
 async function failRun(store, run, code, message) {
-  await store.appendLog(run.id, run.orgId, "error", message);
+  try {
+    await store.appendLog(run.id, run.orgId, "error", message);
+  } catch {}
   const next = await fencedTransition(store, run, {
     status: "failed",
     errorCode: code,
@@ -34393,7 +34892,9 @@ async function fencedTransition(store, run, patch) {
     return store.updateRun(run.id, patch);
   const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
   if (!next) {
-    await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    try {
+      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    } catch {}
   }
   return next;
 }
@@ -34582,7 +35083,7 @@ var DEVELOPMENT_TOOLS_SKILLS = [
   {
     name: "monitor",
     displayName: "Monitor",
-    description: "Operate the open-monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
     category: "Development Tools",
     tags: ["monitoring", "mcp", "processes", "operations"]
   },
@@ -34628,6 +35129,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     description: "Validate configuration files for syntax and schema compliance",
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
+  },
+  {
+    name: "session-inject-monitor",
+    displayName: "Session Inject Monitor",
+    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
+    category: "Development Tools",
+    tags: ["monitor", "session", "injection", "automation", "wake"],
+    kind: "instruction"
   }
 ];
 
@@ -35015,7 +35524,7 @@ var DESIGN_BRANDING_SKILLS = [
     displayName: "Site Analyze",
     description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
     category: "Design & Branding",
-    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "open-styles"]
+    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
   }
 ];