@hasna/skills 0.1.64 → 0.1.66

package/bin/server.js

@@ -22936,6 +22936,119 @@ __export(exports_dist_es8, {
 var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
+// package.json
+var package_default = {
+  name: "@hasna/skills",
+  version: "0.1.66",
+  description: "Skills library for AI coding agents",
+  type: "module",
+  bin: {
+    skills: "bin/index.js",
+    "skills-mcp": "bin/mcp.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-migrate": "bin/migrate.js"
+  },
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./storage": {
+      import: "./dist/storage.js",
+      types: "./dist/storage.d.ts"
+    },
+    "./sdk": {
+      import: "./dist/sdk/index.js",
+      types: "./dist/sdk/index.d.ts"
+    }
+  },
+  files: [
+    "dist/",
+    "!dist/**/*.test.d.ts",
+    "!dist/test-preload.d.ts",
+    "!dist/platform",
+    "bin/",
+    "migrations/",
+    "docs/skill-standard.md",
+    "schemas/",
+    "LICENSE",
+    "README.md"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  scripts: {
+    clean: "rm -rf bin/ dist/",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    test: "bun test --timeout 30000",
+    dev: "bun run ./src/cli/index.tsx",
+    "dev:watch": "bun --watch run ./src/cli/index.tsx",
+    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    migrate: "bun run ./src/server/migrate.ts",
+    typecheck: "tsc --noEmit",
+    "verify:release": "bun run scripts/release-guard.ts",
+    prepack: "bun run build && bun run verify:release",
+    prepublishOnly: "bun run typecheck && bun run test",
+    postinstall: "mkdir -p $HOME/.hasna/skills/custom 2>/dev/null || true"
+  },
+  keywords: [
+    "skills",
+    "ai",
+    "agent",
+    "cli",
+    "typescript",
+    "bun",
+    "claude",
+    "codex",
+    "gemini",
+    "mcp",
+    "model-context-protocol",
+    "open-source",
+    "skills-library",
+    "automation"
+  ],
+  author: "Hasna",
+  license: "Apache-2.0",
+  devDependencies: {
+    "@types/bun": "latest",
+    "@types/node": "25.2.3",
+    "@types/react": "^18.2.0",
+    "bun-types": "1.3.14",
+    "react-devtools-core": "^7.0.1",
+    typescript: "^5"
+  },
+  dependencies: {
+    "@aws-sdk/client-ecs": "^3.1079.0",
+    "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/events": "0.1.16",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    chalk: "^5.3.0",
+    commander: "^12.1.0",
+    ink: "^5.0.1",
+    "ink-select-input": "^6.0.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    react: "^18.2.0",
+    zod: "^4.3.6"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/hasna/apps.git"
+  },
+  homepage: "https://github.com/hasna/skills",
+  bugs: {
+    url: "https://github.com/hasna/skills/issues"
+  }
+};
 
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -31995,7 +32108,7 @@ var WriteGetObjectResponse$ = [
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1106.0/node_modules/@aws-sdk/client-s3/package.json
-var package_default = {
+var package_default2 = {
   name: "@aws-sdk/client-s3",
   version: "3.1106.0",
   description: "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
@@ -32545,7 +32658,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config28.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config28.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config28.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -32857,36 +32970,144 @@ function concat(chunks) {
   return merged;
 }
 
-// src/server/auth.ts
-import { createHash as createHash3 } from "crypto";
-function hashApiKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
-}
-function bearerToken(request) {
-  const header = request.headers.get("authorization") || "";
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  const token = match?.[1]?.trim();
-  return token || null;
+// src/sdk/governance.ts
+var DEFAULT_OUTPUT_GOVERNANCE = {
+  defaultVisibility: "private",
+  redactPatterns: [
+    /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+    /\bsk_[A-Za-z0-9_-]{8,}\b/g,
+    /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+    /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+    /\bAKIA[A-Z0-9]{12,}\b/g,
+    /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+    /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
+    /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
+  ],
+  perOutputBytes: 10 * 1024 * 1024,
+  perRunTotalBytes: 100 * 1024 * 1024,
+  artifactTtlSeconds: 30 * 24 * 60 * 60
+};
+var DEFAULT_RUN_QUOTA = {
+  cpu: 1,
+  memoryMB: 2048,
+  durationSeconds: 3600,
+  networkMB: 100,
+  artifactBytes: 100 * 1024 * 1024
+};
+var GOVERNANCE_ERROR_CODES = {
+  ARTIFACT_LIMIT_EXCEEDED: "ARTIFACT_LIMIT_EXCEEDED",
+  RUN_ARTIFACT_TOTAL_EXCEEDED: "RUN_ARTIFACT_TOTAL_EXCEEDED",
+  RUN_BUDGET_EXHAUSTED: "RUN_BUDGET_EXHAUSTED",
+  STALE_LEASE_GENERATION: "STALE_LEASE_GENERATION",
+  FENCING_UNSUPPORTED: "FENCING_UNSUPPORTED",
+  EVENT_PAYLOAD_REJECTED: "EVENT_PAYLOAD_REJECTED",
+  SKILL_UNAVAILABLE_OFFLINE: "SKILL_UNAVAILABLE_OFFLINE",
+  REMOTE_REQUIRED: "REMOTE_REQUIRED"
+};
+
+class GovernanceError extends Error {
+  code;
+  gate;
+  ceiling;
+  constructor(code, message, options = {}) {
+    super(message);
+    this.name = "GovernanceError";
+    this.code = code;
+    this.gate = options.gate ?? code;
+    this.ceiling = options.ceiling;
+  }
 }
-async function authenticateRequest(store, request) {
-  const token = bearerToken(request);
-  if (!token)
-    return null;
-  return store.authenticateApiKeyHash(hashApiKey(token));
+function runPointersOf(run) {
+  return {
+    runId: run.id,
+    attemptId: run.id,
+    leaseGeneration: run.leaseGeneration,
+    correlationId: run.correlationId
+  };
 }
-function publicPrincipal(partial = {}) {
+
+// src/sdk/cancel.ts
+function createCancelService(options) {
+  const store = options.store;
+  const governanceStore = options.governanceStore;
+  const storage = options.storage ?? new ArtifactStorage;
   return {
-    apiKeyId: partial.apiKeyId || "key_dev",
-    orgId: partial.orgId || "org_dev",
-    orgSlug: partial.orgSlug || "dev",
-    orgName: partial.orgName || "Development",
-    userId: partial.userId || "user_dev",
-    email: partial.email || "dev@example.com",
-    role: partial.role || "owner",
-    scopes: partial.scopes || ["skills:read", "runs:write"]
+    async cancel(principal, runId, requestedBy) {
+      if (!store.transitionRun) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.FENCING_UNSUPPORTED, `cannot cancel run ${runId}: the store has no transitionRun generation fencing`, { gate: "transitionRun" });
+      }
+      const run = await store.getRun(principal, runId);
+      if (!run)
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} not found`, { gate: "run" });
+      const terminalStatuses = new Set(["succeeded", "failed", "cancelled", "expired", "refunded"]);
+      if (terminalStatuses.has(run.status)) {
+        const receipt2 = await governanceStore.appendReceipt({
+          kind: "cancel",
+          orgId: run.orgId,
+          runId: run.id,
+          requestedBy,
+          metadata: { outcome: "already-terminal", status: run.status, ...runPointersOf(run) }
+        });
+        return { run, fencedGeneration: run.leaseGeneration, quarantined: [], receipt: receipt2, alreadyTerminal: true };
+      }
+      const fencedGeneration = run.leaseGeneration + 1;
+      const cancelling = await store.transitionRun(runId, { status: "cancel_requested", leaseGeneration: fencedGeneration }, run.leaseGeneration);
+      if (!cancelling) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} changed while cancelling`, { gate: "transition" });
+      }
+      const artifacts = await store.listArtifacts(principal, runId);
+      const quarantined = [];
+      for (const artifact of artifacts) {
+        const quarantineKey = await storage.moveToQuarantine?.(artifact);
+        if (quarantineKey) {
+          await governanceStore.updateArtifactStorageKey(artifact.id, artifact.orgId, quarantineKey);
+        }
+        await governanceStore.appendReceipt({
+          kind: "quarantine",
+          orgId: artifact.orgId,
+          runId: run.id,
+          artifactId: artifact.id,
+          requestedBy,
+          metadata: { relativePath: artifact.relativePath, byteSize: artifact.byteSize, quarantineKey: quarantineKey ?? null }
+        });
+        quarantined.push({ ...artifact, ...quarantineKey ? { storageKey: quarantineKey } : {} });
+      }
+      const cancelled = await store.transitionRun(runId, { status: "cancelled", completedAt: new Date().toISOString() }, fencedGeneration);
+      if (!cancelled) {
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} moved on while finalising cancellation`, { gate: "transition" });
+      }
+      const receipt = await governanceStore.appendReceipt({
+        kind: "cancel",
+        orgId: run.orgId,
+        runId: run.id,
+        requestedBy,
+        metadata: {
+          fencedGeneration,
+          artifactCount: quarantined.length,
+          pointers: runPointersOf(cancelled)
+        }
+      });
+      return { run: cancelled, fencedGeneration, quarantined, receipt, alreadyTerminal: false };
+    }
   };
 }
 
+// src/sdk/governance-store.ts
+import { Database as Database2 } from "bun:sqlite";
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdirSync as mkdirSync3 } from "fs";
+import { dirname as dirname5 } from "path";
+
+// src/server/database-url.ts
+import { isAbsolute, join as join3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { homedir as homedir2 } from "os";
+
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
 var RETIRED_CONFIG_KEYS = {
@@ -32933,54 +33154,7 @@ function assertNoRetiredConfigKeys(config, source) {
   }
 }
 
-// src/server/config.ts
-var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
-var SKILLS_ENV_NAMESPACE = "SKILLS";
-function resolveServerConfig(env = process.env) {
-  assertNoRetiredModeEnvVars(env, {
-    app: SKILLS_ENV_NAMESPACE,
-    replacement: DATABASE_URL_ENV
-  });
-  const nodeEnv = env.NODE_ENV || "development";
-  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
-  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
-  return {
-    host,
-    port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
-    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
-    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
-    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
-    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
-    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
-    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
-    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
-    nodeEnv,
-    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
-  };
-}
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function normalizePrefix(value) {
-  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
-}
-
-// src/server/database-url.ts
-import { isAbsolute, join as join3 } from "path";
-import { fileURLToPath } from "url";
-
 // src/lib/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
 var ENUM_KEYS = {
   defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
   defaultScope: ["global", "project"],
@@ -33160,39 +33334,78 @@ function looksLikeSqlitePath(value) {
   return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
 }
 
-// src/server/handlers.ts
-import { createHash as createHash5 } from "crypto";
+// src/server/sqlite-store.ts
+import { Database } from "bun:sqlite";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 
-// src/server/store.ts
-import { randomUUID as randomUUID3 } from "crypto";
+// src/server/auth.ts
+import { createHash as createHash3 } from "crypto";
+function hashApiKey(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+function bearerToken(request) {
+  const header = request.headers.get("authorization") || "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  const token = match?.[1]?.trim();
+  return token || null;
+}
+async function authenticateRequest(store, request) {
+  const token = bearerToken(request);
+  if (!token)
+    return null;
+  return store.authenticateApiKeyHash(hashApiKey(token));
+}
+function publicPrincipal(partial = {}) {
+  return {
+    apiKeyId: partial.apiKeyId || "key_dev",
+    orgId: partial.orgId || "org_dev",
+    orgSlug: partial.orgSlug || "dev",
+    orgName: partial.orgName || "Development",
+    userId: partial.userId || "user_dev",
+    email: partial.email || "dev@example.com",
+    role: partial.role || "owner",
+    scopes: partial.scopes || ["skills:read", "runs:write"]
+  };
+}
 
-// src/server/types.ts
-class StaleLeaseGenerationError extends Error {
-  runId;
-  expectedGeneration;
-  currentGeneration;
-  status;
-  constructor(runId, expectedGeneration, currentGeneration, status) {
-    super(`late transition rejected for run ${runId}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
-    this.name = "StaleLeaseGenerationError";
-    this.runId = runId;
-    this.expectedGeneration = expectedGeneration;
-    this.currentGeneration = currentGeneration;
-    this.status = status;
+// src/server/migrations-dir.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var MIGRATION_DIALECTS = ["postgres", "sqlite"];
+var MAX_WALK_UP = 6;
+function findMigrationsRoot(startDirs = defaultStartDirs()) {
+  for (const start of startDirs) {
+    let dir = start;
+    for (let level = 0;level < MAX_WALK_UP; level += 1) {
+      const candidate = join4(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
+        return candidate;
+      const parent = dirname3(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
   }
+  return null;
 }
-
-class SkillRevisionConflictError extends Error {
-  slug;
-  expectedRevisionId;
-  currentRevisionId;
-  constructor(slug, expectedRevisionId, currentRevisionId) {
-    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
-    this.name = "SkillRevisionConflictError";
-    this.slug = slug;
-    this.expectedRevisionId = expectedRevisionId;
-    this.currentRevisionId = currentRevisionId;
+function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
+  if (!root3) {
+    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
+  const dir = join4(root3, dialect);
+  if (!existsSync2(dir)) {
+    throw new Error(`migrations directory not found: ${dir}`);
+  }
+  return dir;
+}
+function defaultStartDirs() {
+  const dirs = [import.meta.dir];
+  const cwd = process.cwd();
+  if (cwd && cwd !== import.meta.dir)
+    dirs.push(cwd);
+  return dirs;
 }
 
 // src/server/rows.ts
@@ -33340,6 +33553,35 @@ function dateString(value) {
   return String(value);
 }
 
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId2, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId2;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
+  }
+}
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
@@ -33363,50 +33605,6 @@ function revisionIdOfRecord(record) {
   return revisionIdOf(record);
 }
 
-// src/server/sqlite-store.ts
-import { Database } from "bun:sqlite";
-import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-
-// src/server/migrations-dir.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-var MIGRATION_DIALECTS = ["postgres", "sqlite"];
-var MAX_WALK_UP = 6;
-function findMigrationsRoot(startDirs = defaultStartDirs()) {
-  for (const start of startDirs) {
-    let dir = start;
-    for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join4(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
-        return candidate;
-      const parent = dirname3(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
-  }
-  return null;
-}
-function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
-  if (!root3) {
-    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
-  }
-  const dir = join4(root3, dialect);
-  if (!existsSync2(dir)) {
-    throw new Error(`migrations directory not found: ${dir}`);
-  }
-  return dir;
-}
-function defaultStartDirs() {
-  const dirs = [import.meta.dir];
-  const cwd = process.cwd();
-  if (cwd && cwd !== import.meta.dir)
-    dirs.push(cwd);
-  return dirs;
-}
-
 // src/server/sqlite-store.ts
 var CLAIM_ATTEMPTS = 8;
 var CLAIMABLE_STATUSES = ["queued", "retrying"];
@@ -33997,7 +34195,301 @@ function parseScopes(value) {
   }
 }
 
+// src/sdk/governance-store.ts
+function receiptId() {
+  return `rcpt_${Date.now().toString(36)}_${randomUUID3().replace(/-/g, "").slice(0, 10)}`;
+}
+function reservationId() {
+  return `res_${Date.now().toString(36)}_${randomUUID3().replace(/-/g, "").slice(0, 10)}`;
+}
+var EXPIRED_ARTIFACT_SQL = `
+  SELECT a.* FROM skills_artifacts a
+  JOIN skills_runs r ON r.id = a.run_id
+  WHERE a.expires_at IS NOT NULL AND a.expires_at <= ?
+  ORDER BY a.expires_at ASC
+`;
+var ACTIVE_RUN_SQL = `
+  SELECT COUNT(*) AS n FROM skills_runs
+  WHERE org_id = ? AND status IN ('queued','running','cancel_requested')
+`;
+class SqliteGovernanceStore {
+  backend = "sqlite";
+  db;
+  closed = false;
+  constructor(path = SQLITE_MEMORY_PATH, options = {}) {
+    if (path !== SQLITE_MEMORY_PATH)
+      mkdirSync3(dirname5(path), { recursive: true });
+    this.db = new Database2(path, { create: true, readwrite: true });
+    this.db.exec("PRAGMA busy_timeout = 5000");
+    this.db.exec("PRAGMA foreign_keys = ON");
+    if (options.migrate !== false)
+      applySqliteMigrations(this.db);
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.db.close(false);
+  }
+  get database() {
+    return this.db;
+  }
+  async appendReceipt(receipt) {
+    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    this.db.run(`INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [next.id, next.kind, next.orgId, next.runId, next.artifactId ?? null, next.requestedBy, JSON.stringify(next.metadata), next.createdAt]);
+    return next;
+  }
+  async listReceipts(orgId, runId2) {
+    const rows = this.db.query("SELECT * FROM skills_lifecycle_receipts WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+    return rows.map((row) => ({
+      id: String(row.id),
+      kind: String(row.kind),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      ...typeof row.artifact_id === "string" ? { artifactId: row.artifact_id } : {},
+      requestedBy: String(row.requested_by),
+      metadata: parseJsonObject(row.metadata_json),
+      createdAt: String(row.created_at)
+    }));
+  }
+  async createReservation(input) {
+    const reservation = { ...input, id: reservationId(), status: "reserved", createdAt: nowIso() };
+    this.db.run(`INSERT INTO skills_credit_reservations (id, org_id, run_id, estimated_cents, status, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, [reservation.id, reservation.orgId, reservation.runId, reservation.estimatedCents, reservation.status, reservation.createdAt]);
+    return reservation;
+  }
+  async reservationsForRun(orgId, runId2) {
+    const rows = this.db.query("SELECT * FROM skills_credit_reservations WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+    return rows.map((row) => this.reservationFrom(row));
+  }
+  async reconcileReservation(reservationId2, actualCents, status) {
+    const row = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
+    if (!row || String(row.status) !== "reserved")
+      return row ? this.reservationFrom(row) : null;
+    const reconciledAt = nowIso();
+    this.db.run("UPDATE skills_credit_reservations SET actual_cents = ?, status = ?, reconciled_at = ? WHERE id = ?", [actualCents, status, reconciledAt, reservationId2]);
+    const updated = this.db.query("SELECT * FROM skills_credit_reservations WHERE id = ? LIMIT 1").get(reservationId2);
+    return this.reservationFrom(updated);
+  }
+  async monthlySpendCents(orgId, monthPrefix) {
+    const from = `${monthPrefix}-01T00:00:00.000Z`;
+    const nextMonth = nextMonthPrefix(monthPrefix);
+    const spent = this.db.query("SELECT COALESCE(SUM(cost_cents), 0) AS spent FROM skills_runs WHERE org_id = ? AND created_at >= ? AND created_at < ?").get(orgId, from, `${nextMonth}-01T00:00:00.000Z`);
+    const pending = this.db.query("SELECT COALESCE(SUM(estimated_cents), 0) AS pending FROM skills_credit_reservations WHERE org_id = ? AND status = 'reserved'").get(orgId);
+    return Number(spent.spent ?? 0) + Number(pending.pending ?? 0);
+  }
+  async activeRunCount(orgId) {
+    const row = this.db.query(ACTIVE_RUN_SQL).get(orgId);
+    return Number(row.n ?? 0);
+  }
+  async listExpiredArtifacts(at2) {
+    const rows = this.db.query(EXPIRED_ARTIFACT_SQL).all(at2);
+    return rows.map(rowToArtifact);
+  }
+  async deleteArtifactRow(artifactId2, orgId) {
+    const result = this.db.run("DELETE FROM skills_artifacts WHERE id = ? AND org_id = ?", [artifactId2, orgId]);
+    return result.changes === 1;
+  }
+  async updateArtifactStorageKey(artifactId2, orgId, storageKey) {
+    const result = this.db.run("UPDATE skills_artifacts SET storage_key = ? WHERE id = ? AND org_id = ?", [storageKey, artifactId2, orgId]);
+    return result.changes === 1;
+  }
+  reservationFrom(row) {
+    return {
+      id: String(row.id),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      estimatedCents: Number(row.estimated_cents ?? 0),
+      ...row.actual_cents !== null && row.actual_cents !== undefined ? { actualCents: Number(row.actual_cents) } : {},
+      status: String(row.status),
+      createdAt: String(row.created_at),
+      ...typeof row.reconciled_at === "string" ? { reconciledAt: row.reconciled_at } : {}
+    };
+  }
+}
+
+class PostgresGovernanceStore {
+  backend = "postgres";
+  sql;
+  constructor(databaseUrl) {
+    const bunWithSql = Bun;
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: 2 });
+  }
+  async close() {
+    await this.sql.close?.();
+  }
+  async withContext(orgId, worker, fn) {
+    return this.sql.begin(async (tx) => {
+      await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
+      await tx`SELECT set_config('app.skills_claim_context', ${worker ? "worker" : ""}, true)`;
+      return await fn(tx);
+    });
+  }
+  async appendReceipt(receipt) {
+    const next = { ...receipt, id: receiptId(), createdAt: nowIso() };
+    await this.sql`
+      INSERT INTO skills_lifecycle_receipts (id, kind, org_id, run_id, artifact_id, requested_by, metadata_json)
+      VALUES (${next.id}, ${next.kind}, ${next.orgId}, ${next.runId}, ${next.artifactId ?? null}, ${next.requestedBy}, ${JSON.stringify(next.metadata)}::jsonb)
+    `;
+    return next;
+  }
+  async listReceipts(orgId, runId2) {
+    const rows = await this.sql`
+      SELECT * FROM skills_lifecycle_receipts WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+    `;
+    return rows.map((row) => ({
+      id: String(row.id),
+      kind: String(row.kind),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      ...typeof row.artifact_id === "string" ? { artifactId: row.artifact_id } : {},
+      requestedBy: String(row.requested_by),
+      metadata: parseJsonObject(row.metadata_json),
+      createdAt: String(row.created_at)
+    }));
+  }
+  async createReservation(input) {
+    const reservation = { ...input, id: reservationId(), status: "reserved", createdAt: nowIso() };
+    await this.sql`
+      INSERT INTO skills_credit_reservations (id, org_id, run_id, estimated_cents, status)
+      VALUES (${reservation.id}, ${reservation.orgId}, ${reservation.runId}, ${reservation.estimatedCents}, ${reservation.status})
+    `;
+    return reservation;
+  }
+  async reservationsForRun(orgId, runId2) {
+    const rows = await this.sql`
+      SELECT * FROM skills_credit_reservations WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+    `;
+    return rows.map((row) => this.reservationFrom(row));
+  }
+  async reconcileReservation(reservationId2, actualCents, status) {
+    const rows = await this.sql`
+      UPDATE skills_credit_reservations
+      SET actual_cents = ${actualCents}, status = ${status}, reconciled_at = now()
+      WHERE id = ${reservationId2} AND status = ${"reserved"}
+      RETURNING *
+    `;
+    if (!rows[0]) {
+      const existing = await this.sql`SELECT * FROM skills_credit_reservations WHERE id = ${reservationId2} LIMIT 1`;
+      return existing[0] ? this.reservationFrom(existing[0]) : null;
+    }
+    return this.reservationFrom(rows[0]);
+  }
+  async monthlySpendCents(orgId, monthPrefix) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        SELECT
+          (SELECT COALESCE(SUM(cost_cents), 0) FROM skills_runs
+           WHERE org_id = ${orgId} AND created_at >= ${`${monthPrefix}-01T00:00:00.000Z`} AND created_at < ${`${nextMonthPrefix(monthPrefix)}-01T00:00:00.000Z`}) AS spent,
+          (SELECT COALESCE(SUM(estimated_cents), 0) FROM skills_credit_reservations
+           WHERE org_id = ${orgId} AND status = ${"reserved"}) AS pending
+      `;
+      return Number(rows[0]?.spent ?? 0) + Number(rows[0]?.pending ?? 0);
+    });
+  }
+  async activeRunCount(orgId) {
+    return this.withContext(orgId, false, async (tx) => {
+      const rows = await tx`SELECT COUNT(*) AS n FROM skills_runs WHERE org_id = ${orgId} AND status IN (${"queued"}, ${"running"}, ${"cancel_requested"})`;
+      return Number(rows[0]?.n ?? 0);
+    });
+  }
+  async listExpiredArtifacts(at2) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id
+        WHERE a.expires_at IS NOT NULL AND a.expires_at <= ${at2}
+        ORDER BY a.expires_at ASC
+      `;
+      return rows.map(rowToArtifact);
+    });
+  }
+  async deleteArtifactRow(artifactId2, orgId) {
+    return this.withContext(orgId, true, async (tx) => {
+      const rows = await tx`DELETE FROM skills_artifacts WHERE id = ${artifactId2} AND org_id = ${orgId} RETURNING id`;
+      return rows.length > 0;
+    });
+  }
+  async updateArtifactStorageKey(artifactId2, orgId, storageKey) {
+    return this.withContext(orgId, true, async (tx) => {
+      const rows = await tx`
+        UPDATE skills_artifacts SET storage_key = ${storageKey} WHERE id = ${artifactId2} AND org_id = ${orgId} RETURNING id
+      `;
+      return rows.length > 0;
+    });
+  }
+  reservationFrom(row) {
+    return {
+      id: String(row.id),
+      orgId: String(row.org_id),
+      runId: String(row.run_id),
+      estimatedCents: Number(row.estimated_cents ?? 0),
+      ...row.actual_cents !== null && row.actual_cents !== undefined ? { actualCents: Number(row.actual_cents) } : {},
+      status: String(row.status),
+      createdAt: String(row.created_at),
+      ...typeof row.reconciled_at === "string" ? { reconciledAt: row.reconciled_at } : {}
+    };
+  }
+}
+async function createGovernanceStore(databaseUrl) {
+  const target = resolveDatabaseTarget(databaseUrl);
+  if (target.kind === "postgres")
+    return new PostgresGovernanceStore(target.url);
+  if (target.kind === "memory")
+    return new SqliteGovernanceStore(SQLITE_MEMORY_PATH);
+  return new SqliteGovernanceStore(target.path);
+}
+function nextMonthPrefix(monthPrefix) {
+  const [year, month] = monthPrefix.split("-").map(Number);
+  return month === 12 ? `${year + 1}-01` : `${year}-${String(month + 1).padStart(2, "0")}`;
+}
+
+// src/server/config.ts
+var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
+var SKILLS_ENV_NAMESPACE = "SKILLS";
+function resolveServerConfig(env = process.env) {
+  assertNoRetiredModeEnvVars(env, {
+    app: SKILLS_ENV_NAMESPACE,
+    replacement: DATABASE_URL_ENV
+  });
+  const nodeEnv = env.NODE_ENV || "development";
+  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
+  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
+  return {
+    host,
+    port,
+    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
+    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
+    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
+    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
+    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    nodeEnv,
+    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
+  };
+}
+function localOrigin(host, port) {
+  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizePrefix(value) {
+  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
+}
+
+// src/server/handlers.ts
+import { createHash as createHash5 } from "crypto";
+
 // src/server/store.ts
+import { randomUUID as randomUUID4 } from "crypto";
 function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
   return {
     slug: input.slug,
@@ -34085,7 +34577,7 @@ class MemorySkillsStore {
       input: input.input,
       args: input.args,
       ...idemKey ? { idempotencyKey: idemKey } : {},
-      correlationId: randomUUID3(),
+      correlationId: randomUUID4(),
       costCents: 0,
       leaseGeneration: 0,
       createdAt: now
@@ -34400,20 +34892,20 @@ class PostgresSkillsStore {
     });
   }
   async createRun(input) {
-    if (input.idempotencyKey) {
-      const existing = await this.sql`
-        SELECT * FROM skills_runs
-        WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
-        LIMIT 1
-      `;
-      if (existing[0])
-        return rowToRun(existing[0]);
-    }
-    const id = runId();
     return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
-        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID4()})
         RETURNING *
       `;
       return rowToRun(rows[0]);
@@ -34952,7 +35444,9 @@ async function completeRun(store, run, preview) {
   return next ?? run;
 }
 async function failRun(store, run, code, message) {
-  await store.appendLog(run.id, run.orgId, "error", message);
+  try {
+    await store.appendLog(run.id, run.orgId, "error", message);
+  } catch {}
   const next = await fencedTransition(store, run, {
     status: "failed",
     errorCode: code,
@@ -34966,7 +35460,9 @@ async function fencedTransition(store, run, patch) {
     return store.updateRun(run.id, patch);
   const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
   if (!next) {
-    await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    try {
+      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    } catch {}
   }
   return next;
 }
@@ -35048,25 +35544,26 @@ function mergeSkillRegistryLists(...groups) {
 }
 
 // src/server/registry.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
 import { resolve, sep } from "path";
 
 // src/lib/registry.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync5 } from "fs";
+import { join as join9 } from "path";
 
 // src/lib/portable-skills.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync5,
+  mkdtempSync,
+  readdirSync as readdirSync4,
   renameSync,
   rmSync,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute2, join as join7, normalize } from "path";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join8, normalize } from "path";
 
 // src/lib/registry-data/development-tools.ts
 var DEVELOPMENT_TOOLS_SKILLS = [
@@ -35778,8 +36275,29 @@ var SKILLS = [
 ];
 
 // src/lib/hosted-skill-set.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { join as join6 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
+function normalizeMarker(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isHostedMetadataPackage(pkg) {
+  const skills = pkg?.skills;
+  if (!skills || typeof skills !== "object")
+    return false;
+  return HOSTED_RUNTIMES.has(normalizeMarker(skills.runtime)) || HOSTED_SOURCES.has(normalizeMarker(skills.source));
+}
+function isHostedMetadataSkillDir(skillDir) {
+  const pkgPath = join6(skillDir, "package.json");
+  if (!existsSync3(pkgPath))
+    return false;
+  try {
+    return isHostedMetadataPackage(JSON.parse(readFileSync4(pkgPath, "utf8")));
+  } catch {
+    return false;
+  }
+}
 var HOSTED_METADATA_SET_EMPTY_ERROR = [
   "The hosted metadata skill set is empty, but the packaging guards that depend on it",
   "only mean anything while it is non-empty: an empty set makes every one of them pass",
@@ -35901,14 +36419,14 @@ var PORTABLE_SKILL_DEFAULT_VERSION = "0.1.0";
 // src/lib/portable-skills-files.ts
 import {
   cpSync,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync5,
   realpathSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { basename, dirname as dirname5, join as join6, relative } from "path";
+import { basename, dirname as dirname6, join as join7, relative } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -35936,12 +36454,12 @@ function normalizePortableSkillName(name) {
   return normalized;
 }
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
-  const skillJsonPath = join6(skillPath, "skill.json");
-  const skillMdPath = join6(skillPath, "SKILL.md");
-  const pkgPath = join6(skillPath, "package.json");
-  const jsonManifest = existsSync3(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
-  const frontmatter = existsSync3(skillMdPath) ? parseSkillFrontmatter(readFileSync4(skillMdPath, "utf-8")) ?? undefined : undefined;
-  const pkg = existsSync3(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  const skillJsonPath = join7(skillPath, "skill.json");
+  const skillMdPath = join7(skillPath, "SKILL.md");
+  const pkgPath = join7(skillPath, "package.json");
+  const jsonManifest = existsSync4(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync4(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync4(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version2 = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
@@ -36068,7 +36586,7 @@ function inferPackageCommands(pkg, fallbackName) {
   return;
 }
 function readJsonObject(path) {
-  const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (!isRecord(parsed))
     throw new Error(`${basename(path)} must contain a JSON object`);
   return parsed;
@@ -36097,36 +36615,36 @@ var LEGACY_CUSTOM_DIRNAME = "custom";
 function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache3 = join7(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join8(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache3 = join8(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
     return cache3;
-  const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join8(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
 }
 function looksLikeSkillDirectory(path) {
   if (!safeIsDirectory(path))
     return false;
-  return existsSync4(join7(path, "SKILL.md")) || existsSync4(join7(path, "skill.json")) || existsSync4(join7(path, "package.json"));
+  return existsSync5(join8(path, "SKILL.md")) || existsSync5(join8(path, "skill.json")) || existsSync5(join8(path, "package.json"));
 }
 function migrateLegacySkillLayout(appDir, installed) {
   if (!safeIsDirectory(appDir))
     return;
   const candidates = [];
   try {
-    for (const entry of readdirSync3(appDir)) {
+    for (const entry of readdirSync4(appDir)) {
       if (entry.startsWith(".") || entry === INSTALLED_SKILLS_DIRNAME)
         continue;
-      const path = join7(appDir, entry);
+      const path = join8(appDir, entry);
       if (entry === LEGACY_CUSTOM_DIRNAME) {
         if (!safeIsDirectory(path))
           continue;
         try {
-          for (const nested of readdirSync3(path)) {
+          for (const nested of readdirSync4(path)) {
             if (nested.startsWith("."))
               continue;
-            const nestedPath = join7(path, nested);
+            const nestedPath = join8(path, nested);
             if (looksLikeSkillDirectory(nestedPath))
               candidates.push({ from: nestedPath, name: nested });
           }
@@ -36140,10 +36658,10 @@ function migrateLegacySkillLayout(appDir, installed) {
     return;
   }
   for (const { from, name } of candidates) {
-    const target = join7(installed, name);
-    if (existsSync4(target))
+    const target = join8(installed, name);
+    if (existsSync5(target))
       continue;
-    const staging = join7(installed, `.migrating-${name}-${process.pid}`);
+    const staging = join8(installed, `.migrating-${name}-${process.pid}`);
     try {
       rmSync(staging, { recursive: true, force: true });
       cpSync2(from, staging, { recursive: true, errorOnExist: false });
@@ -36156,7 +36674,7 @@ function migrateLegacySkillLayout(appDir, installed) {
   }
 }
 function getPortableSkillPath(name, options = {}) {
-  return join7(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join8(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -36166,7 +36684,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync4(path) || !statSync3(path).isDirectory())
+  if (!existsSync5(path) || !statSync4(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -36179,10 +36697,10 @@ function listPortableSkills(options = {}) {
   if (!safeIsDirectory(root3))
     return [];
   const skills = [];
-  for (const entry of readdirSync3(root3).sort()) {
+  for (const entry of readdirSync4(root3).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join7(root3, entry);
+    const path = join8(root3, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -36204,7 +36722,8 @@ function listPortableSkillMetas(options = {}) {
       tags: manifest.tags || ["custom"],
       version: skill.version,
       ...manifest.kind ? { kind: manifest.kind } : {},
-      source: "custom"
+      source: "custom",
+      ...isHostedMetadataSkillDir(skill.path) ? { serverOwned: true } : {}
     };
   });
 }
@@ -36224,7 +36743,7 @@ function summarizePortableSkill(skillPath, fallbackName) {
 }
 function safeIsDirectory(path) {
   try {
-    return statSync3(path).isDirectory();
+    return statSync4(path).isDirectory();
   } catch {
     return false;
   }
@@ -36274,20 +36793,20 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync5(dir))
+  if (!existsSync6(dir))
     return [];
   const result = [];
   try {
-    const entries = readdirSync4(dir, { withFileTypes: true });
+    const entries = readdirSync5(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join8(dir, entry.name, "SKILL.md");
-      if (!existsSync5(skillMdPath))
+      const skillMdPath = join9(dir, entry.name, "SKILL.md");
+      if (!existsSync6(skillMdPath))
         continue;
       let content;
       try {
-        content = readFileSync5(skillMdPath, "utf-8");
+        content = readFileSync6(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -36302,6 +36821,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
+        ...isHostedMetadataSkillDir(join9(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -36310,20 +36830,20 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config = loadConfig4();
-  if (!config.extensionsDir || !existsSync5(config.extensionsDir))
+  if (!config.extensionsDir || !existsSync6(config.extensionsDir))
     return null;
   try {
-    const entries = readdirSync4(config.extensionsDir, { withFileTypes: true });
+    const entries = readdirSync5(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join8(config.extensionsDir, entry.name);
-      const skillMdPath = join8(skillDir, "SKILL.md");
-      if (!existsSync5(skillMdPath))
+      const skillDir = join9(config.extensionsDir, entry.name);
+      const skillMdPath = join9(skillDir, "SKILL.md");
+      if (!existsSync6(skillMdPath))
         continue;
       let content;
       try {
-        content = readFileSync5(skillMdPath, "utf-8");
+        content = readFileSync6(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -36356,7 +36876,7 @@ function loadRegistry(cwd) {
   const official = SKILLS.map((s2) => ({ ...s2, source: "official" }));
   const extensions = config.extensionsDir ? discoverSkillsInDir(config.extensionsDir, "extension") : [];
   const portableCustom = listPortableSkillMetas();
-  const legacyCustom = discoverSkillsInDir(join8(dataDir, "custom"));
+  const legacyCustom = discoverSkillsInDir(join9(dataDir, "custom"));
   const globalCustom = mergeCustomSkills([...legacyCustom, ...portableCustom]);
   registryCache = mergeSkillRegistryLists(official, extensions, globalCustom);
   registryCacheTime = now;
@@ -36376,12 +36896,12 @@ function mergeCustomSkills(skills) {
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync as rmSync2 } from "fs";
-import { dirname as dirname7, join as join9 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync2 } from "fs";
+import { dirname as dirname8, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 // src/lib/utils.ts
 function normalizeSkillName(name) {
@@ -36389,16 +36909,16 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname7(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname8(fileURLToPath2(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i3 = 0;i3 < 5; i3++) {
-    const candidate = join9(dir, "skills");
-    if (existsSync6(candidate) && !dir.includes(".skills"))
+    const candidate = join10(dir, "skills");
+    if (existsSync7(candidate) && !dir.includes(".skills"))
       return candidate;
-    dir = dirname7(dir);
+    dir = dirname8(dir);
   }
-  return join9(__dirname2, "..", "skills");
+  return join10(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -36406,13 +36926,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join9(getDataDir(), "custom", skillName);
-  if (existsSync6(legacyCustomPath))
+  const legacyCustomPath = join10(getDataDir(), "custom", skillName);
+  if (existsSync7(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join9(SKILLS_DIR, skillName);
+  return join10(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -36421,18 +36941,18 @@ function getCanonicalSkillName(name) {
 // src/lib/skillinfo.ts
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync7(skillPath))
+  if (!existsSync8(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join10(skillPath, "SKILL.md")),
-    readme: readIfExists(join10(skillPath, "README.md")),
-    claudeMd: readIfExists(join10(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join11(skillPath, "SKILL.md")),
+    readme: readIfExists(join11(skillPath, "README.md")),
+    claudeMd: readIfExists(join11(skillPath, "CLAUDE.md"))
   };
 }
 function readIfExists(path) {
   try {
-    if (existsSync7(path)) {
-      return readFileSync7(path, "utf-8");
+    if (existsSync8(path)) {
+      return readFileSync8(path, "utf-8");
     }
   } catch {}
   return null;
@@ -36473,7 +36993,7 @@ function getServerSkillMd(slug) {
   const path = resolve(skillsDir, name, "SKILL.md");
   if (!isInsideDir(skillsDir, path))
     return null;
-  return existsSync8(path) ? readFileSync8(path, "utf8") : null;
+  return existsSync9(path) ? readFileSync9(path, "utf8") : null;
 }
 
 // src/server/skills-api.ts
@@ -36726,7 +37246,15 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed, ex
     const placement = await artifactStorage.putBundle(principal.orgId, input.bundle.sha256, parsed.bundleBytes, input.bundle.contentType);
     input = { ...input, bundle: { ...input.bundle, ...placement } };
   }
-  const record = await store.publishSkill(input);
+  let record;
+  try {
+    record = await store.publishSkill(input);
+  } catch (error) {
+    if (input.bundle?.sha256) {
+      await discardCollectedObject(store, artifactStorage, principal, input.bundle.sha256);
+    }
+    throw error;
+  }
   if (superseded && superseded !== record.bundleSha256) {
     await discardCollectedObject(store, artifactStorage, principal, superseded);
   }
@@ -36798,7 +37326,7 @@ function buildPublishInput(manifest) {
   if (skillMd && byteLength(skillMd) > MAX_SKILL_MD_BYTES) {
     throw new SkillRequestError(413, "SKILL_MD_TOO_LARGE", `skillMd exceeds ${MAX_SKILL_MD_BYTES} bytes`);
   }
-  const kindValue = optionalString(manifest.kind) ?? "executable";
+  const kindValue = optionalString(manifest.kind) ?? "instruction";
   if (kindValue !== "executable" && kindValue !== "instruction") {
     throw new SkillRequestError(400, "INVALID_KIND", "`kind` must be 'executable' or 'instruction'");
   }
@@ -36860,6 +37388,7 @@ async function createSkillsFetchHandler(options = {}) {
     bootstrapApiKey: config.bootstrapApiKey
   });
   assertDurableStore(store, config);
+  const governanceStore = options.governanceStore ?? await createGovernanceStore(config.databaseUrl);
   const artifactStorage = new ArtifactStorage({
     bucket: config.artifactBucket,
     prefix: config.artifactPrefix
@@ -36882,7 +37411,7 @@ async function createSkillsFetchHandler(options = {}) {
           return json(identityPayload(principal));
         }
         if (segments[0] === "api" && segments[1] === "v1") {
-          return await handleApiV1(store, principal, request, segments.slice(2), config, artifactStorage);
+          return await handleApiV1(store, governanceStore, principal, request, segments.slice(2), config, artifactStorage);
         }
       }
       return json({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
@@ -36911,7 +37440,7 @@ function skillsServeLimits(config) {
   return { maxRequestBodySize: Math.max(config.skillBundleLimitBytes, config.requestBodyLimitBytes) + BODY_LIMIT_HEADROOM_BYTES };
 }
 var BODY_LIMIT_HEADROOM_BYTES = 1e6;
-async function handleApiV1(store, principal, request, parts, config, artifactStorage) {
+async function handleApiV1(store, governanceStore, principal, request, parts, config, artifactStorage) {
   const [resource, id, subresource, childId] = parts;
   if (parts.some(segmentEscapesPath)) {
     return json({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
@@ -37070,8 +37599,18 @@ async function handleApiV1(store, principal, request, parts, config, artifactSto
       const run = await store.getRun(principal, id);
       if (!run)
         return json({ error: "run not found", code: "RUN_NOT_FOUND" }, { status: 404 });
-      const next = await store.updateRun(id, { status: "cancel_requested" });
-      return json(runPayload(next ?? run));
+      try {
+        const outcome = await createCancelService({ store, governanceStore, storage: artifactStorage }).cancel(principal, id, principal.email);
+        return json(runPayload(outcome.run));
+      } catch (error) {
+        if (error instanceof GovernanceError && error.code === GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION) {
+          return json({ error: error.message, code: error.code }, { status: 409 });
+        }
+        if (error instanceof StaleLeaseGenerationError) {
+          return json({ error: error.message, code: GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION }, { status: 409 });
+        }
+        throw error;
+      }
     }
   }
   return json({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
@@ -37161,6 +37700,24 @@ function clampInt(value, fallback, max) {
 }
 
 // src/server/index.ts
+var EARLY_ARGV = process.argv.slice(2);
+if (EARLY_ARGV.includes("--version") || EARLY_ARGV.includes("-V")) {
+  console.log(package_default.version);
+  process.exit(0);
+}
+if (EARLY_ARGV.includes("--help") || EARLY_ARGV.includes("-h")) {
+  console.log(`Usage: skills-server [options]
+
+Runs the @hasna/skills HTTP API.
+
+Options:
+  -V, --version  output the version number
+  -h, --help     display help for command
+
+Environment:
+  SKILLS_PORT  Listen port (default: 8787)`);
+  process.exit(0);
+}
 var config = resolveServerConfig();
 var server = await startSkillsServer({ config });
 console.log(`skills API listening on http://${config.host}:${server.port}`);