@hasna/skills 0.1.71 → 0.2.0

package/bin/worker.js

@@ -22940,6 +22940,127 @@ var init_dist_es9 = __esm(() => {
 
 // src/server/worker.ts
 import { randomUUID as randomUUID4 } from "crypto";
+// package.json
+var package_default = {
+  name: "@hasna/skills",
+  version: "0.2.0",
+  description: "Skills library for AI coding agents",
+  type: "module",
+  bin: {
+    skills: "bin/index.js",
+    "skills-mcp": "bin/mcp.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-migrate": "bin/migrate.js"
+  },
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./storage": {
+      import: "./dist/storage.js",
+      types: "./dist/storage.d.ts"
+    },
+    "./sdk": {
+      import: "./dist/sdk/index.js",
+      types: "./dist/sdk/index.d.ts"
+    },
+    "./admin-contract": {
+      import: "./dist/admin-contract.js",
+      types: "./dist/admin-contract.d.ts"
+    }
+  },
+  files: [
+    "dist/",
+    "!dist/**/*.test.d.ts",
+    "!dist/test-preload.d.ts",
+    "!dist/platform",
+    "bin/",
+    "migrations/",
+    "docs/skill-standard.md",
+    "schemas/",
+    "LICENSE",
+    "README.md"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  scripts: {
+    clean: "rm -rf bin/ dist/",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    test: "bun test --timeout 30000",
+    dev: "bun run ./src/cli/index.tsx",
+    "dev:watch": "bun --watch run ./src/cli/index.tsx",
+    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "docker:check": "bash scripts/docker-build-check.sh",
+    migrate: "bun run ./src/server/migrate.ts",
+    typecheck: "tsc --noEmit",
+    "verify:release": "bun run scripts/release-guard.ts",
+    prepare: "bun run build:js",
+    prepack: "bun run build && bun run verify:release",
+    prepublishOnly: "bun run typecheck && bun run test",
+    postinstall: "mkdir -p $HOME/.hasna/skills/custom 2>/dev/null || true"
+  },
+  keywords: [
+    "skills",
+    "ai",
+    "agent",
+    "cli",
+    "typescript",
+    "bun",
+    "claude",
+    "codex",
+    "gemini",
+    "mcp",
+    "model-context-protocol",
+    "open-source",
+    "skills-library",
+    "automation"
+  ],
+  author: "Hasna",
+  license: "Apache-2.0",
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/node": "25.2.3",
+    "@types/react": "^18.2.0",
+    "bun-types": "1.3.14",
+    "react-devtools-core": "^7.0.1",
+    typescript: "^5",
+    yaml: "^2.9.0"
+  },
+  dependencies: {
+    "@aws-sdk/client-ecs": "^3.1079.0",
+    "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/events": "0.1.16",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    chalk: "^5.3.0",
+    commander: "^12.1.0",
+    ink: "^5.0.1",
+    "ink-select-input": "^6.0.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    react: "^18.2.0",
+    zod: "^4.3.6"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/hasna/apps.git"
+  },
+  homepage: "https://github.com/hasna/skills",
+  bugs: {
+    url: "https://github.com/hasna/skills/issues"
+  }
+};
 
 // src/lib/skill-bundle.ts
 var ANY_SEGMENT_EXCLUDES = new Set([
@@ -31987,7 +32108,7 @@ var WriteGetObjectResponse$ = [
 class CreateSessionCommand extends command(_ep4, _mw0, "CreateSession", CreateSession$) {
 }
 // ../../node_modules/.bun/@aws-sdk+client-s3@3.1112.0/node_modules/@aws-sdk/client-s3/package.json
-var package_default = {
+var package_default2 = {
   name: "@aws-sdk/client-s3",
   version: "3.1112.0",
   description: "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
@@ -32537,7 +32658,7 @@ var getRuntimeConfig3 = (config) => {
     authSchemePreference: config?.authSchemePreference ?? import_config28.loadConfig(import_httpAuthSchemes3.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
     bodyLengthChecker: config?.bodyLengthChecker ?? import_serde4.calculateBodyLength,
     credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
-    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default.version }),
+    defaultUserAgentProvider: config?.defaultUserAgentProvider ?? import_client19.createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: package_default2.version }),
     disableS3ExpressSessionAuth: config?.disableS3ExpressSessionAuth ?? import_config28.loadConfig($NODE_DISABLE_S3_EXPRESS_SESSION_AUTH_OPTIONS, loaderConfig),
     eventStreamSerdeProvider: config?.eventStreamSerdeProvider ?? import_event_streams.eventStreamSerdeProvider,
     maxAttempts: config?.maxAttempts ?? import_config28.loadConfig(import_retry3.NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
@@ -32677,7 +32798,7 @@ class ArtifactStorage {
   constructor(options = {}) {
     this.bucket = options.bucket;
     this.prefix = (options.prefix || "skills/artifacts").replace(/^\/+|\/+$/g, "");
-    this.s3 = this.bucket ? new S3Client({ region: options.region || process.env.AWS_REGION || "us-east-1" }) : undefined;
+    this.s3 = this.bucket ? options.client ?? new S3Client({ region: options.region || process.env.AWS_REGION || "us-east-1" }) : undefined;
   }
   get usesS3() {
     return Boolean(this.bucket);
@@ -32775,6 +32896,27 @@ class ArtifactStorage {
   keyFor(run, relativePath) {
     return this.objectKeyFor(run.orgId, run.id, relativePath);
   }
+  async putVersionObjects(orgId, slug, version2, bytes, manifest, contentType = "application/gzip") {
+    if (!this.bucket || !this.s3)
+      return { storageKind: "db" };
+    const key = this.versionKeyFor(orgId, slug, version2, "bundle.tar.gz");
+    await this.s3.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: bytes, ContentType: contentType }));
+    await this.s3.send(new PutObjectCommand({
+      Bucket: this.bucket,
+      Key: this.versionKeyFor(orgId, slug, version2, "manifest.json"),
+      Body: new TextEncoder().encode(JSON.stringify(manifest, null, 2)),
+      ContentType: "application/json"
+    }));
+    return { storageKind: "s3", storageKey: key };
+  }
+  versionPlacement(orgId, slug, version2) {
+    if (!this.bucket || !this.s3)
+      return { storageKind: "db" };
+    return { storageKind: "s3", storageKey: this.versionKeyFor(orgId, slug, version2, "bundle.tar.gz") };
+  }
+  versionKeyFor(orgId, slug, version2, file) {
+    return `${this.prefix}/skills/${encodeURIComponent(orgId)}/${encodeURIComponent(slug)}/${encodeURIComponent(version2)}/${file}`;
+  }
   bundleKeyFor(orgId, sha256) {
     return `${this.prefix}/bundles/${encodeURIComponent(orgId)}/${sha256}.tar.gz`;
   }
@@ -32876,13 +33018,12 @@ var DEFAULT_RUN_QUOTA = {
 };
 
 // src/server/database-url.ts
-import { isAbsolute, join as join3 } from "path";
+import { isAbsolute, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join3, dirname as dirname2 } from "path";
 
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
@@ -32919,59 +33060,160 @@ function assertNoRetiredModeEnvVars(env, options) {
   throw new RetiredSettingError(names[0], `${names.join(", ")} ${names.length === 1 ? "is" : "are"} no longer read. ` + "Deployment modes were removed: where a server keeps its data is decided by the " + `database it is given, not by a declared label. Set ${options.replacement} to a ` + "postgres:// URL to use PostgreSQL, or leave it unset for the on-box SQLite database. " + `Then unset ${names.join(" and ")}. ` + "Refused rather than ignored, because a discarded setting looks exactly like a " + "working one until something needs the data.");
 }
 
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
+var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
+var SKILLS_HOME_ENV = "SKILLS_HOME";
+var DEFAULT_SQLITE_FILENAME = "server.db";
+var GLOBAL_CONFIG_FILENAME = "config.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2() || "/tmp";
+}
+function legacyDataRoot() {
+  return join2(effectiveHome(), ".hasna", "skills");
+}
+function resolverDataRoot(home = effectiveHome(), env) {
+  return dataDir({ app: "skills", home, env });
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join2(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join2(resolved, GLOBAL_CONFIG_FILENAME));
+}
+function exactDataRoot() {
+  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
+    const dir = process.env[key]?.trim();
+    if (dir)
+      return resolve(dir);
+  }
+  return;
+}
+function hasExactOverride(env = process.env) {
+  return Boolean(env[DATA_DIR_ENV]?.trim()) || Boolean(env[HASNA_SKILLS_HOME_ENV]?.trim()) || Boolean(env[SKILLS_HOME_ENV]?.trim());
+}
+function hasOperatorOverride(env = process.env) {
+  return hasExactOverride(env) || Boolean(env.HASNA_DATA_HOME?.trim());
+}
+function getDataRoot() {
+  const exact = exactDataRoot();
+  if (exact)
+    return exact;
+  const resolved = resolverDataRoot();
+  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
+}
 // src/lib/config.ts
 function mergeDirectoryContents(sourceDir, targetDir) {
-  if (!existsSync(sourceDir))
+  if (!existsSync2(sourceDir))
     return;
   mkdirSync(targetDir, { recursive: true });
   for (const entry of readdirSync(sourceDir)) {
-    const sourcePath = join2(sourceDir, entry);
-    const targetPath = join2(targetDir, entry);
+    const sourcePath = join3(sourceDir, entry);
+    const targetPath = join3(targetDir, entry);
     try {
       const sourceStat = statSync(sourcePath);
       if (sourceStat.isDirectory()) {
         mergeDirectoryContents(sourcePath, targetPath);
         continue;
       }
-      if (!existsSync(targetPath))
+      if (!existsSync2(targetPath))
         copyFileSync(sourcePath, targetPath);
     } catch {}
   }
 }
-var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 function getDataDir() {
-  const override = process.env[DATA_DIR_ENV];
-  if (override) {
-    try {
-      mkdirSync(override, { recursive: true });
-    } catch {}
-    return override;
-  }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
-  const newDir = join2(home, ".hasna", "skills");
-  const oldDir = join2(home, ".skills");
-  const oldConfigFile = join2(home, ".skillsrc");
-  mkdirSync(newDir, { recursive: true });
+  const root3 = getDataRoot();
+  try {
+    mkdirSync(root3, { recursive: true });
+  } catch {}
+  if (hasOperatorOverride())
+    return root3;
+  const home = effectiveHome();
+  const oldDir = join3(home, ".skills");
+  const oldConfigFile = join3(home, ".skillsrc");
   try {
-    mergeDirectoryContents(oldDir, newDir);
+    mergeDirectoryContents(oldDir, root3);
   } catch {}
-  if (existsSync(oldConfigFile) && !existsSync(join2(newDir, "config.json"))) {
+  if (existsSync2(oldConfigFile) && !existsSync2(join3(root3, "config.json"))) {
     try {
-      copyFileSync(oldConfigFile, join2(newDir, "config.json"));
+      copyFileSync(oldConfigFile, join3(root3, "config.json"));
     } catch {}
   }
-  return newDir;
+  return root3;
 }
 
 // src/server/database-url.ts
-var DEFAULT_SQLITE_FILENAME = "server.db";
+var DEFAULT_SQLITE_FILENAME2 = "server.db";
 var SQLITE_MEMORY_PATH = ":memory:";
 var POSTGRES_SCHEMES = new Set(["postgres", "postgresql"]);
 var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
 var MEMORY_SCHEMES = new Set(["memory"]);
 var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
 function defaultSqlitePath() {
-  return join3(getDataDir(), DEFAULT_SQLITE_FILENAME);
+  return join4(getDataDir(), DEFAULT_SQLITE_FILENAME2);
 }
 function resolveDatabaseTarget(raw) {
   const value = raw?.trim();
@@ -32998,7 +33240,7 @@ function resolveDatabaseTarget(raw) {
     throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
   }
   if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute(value) ? value : join3(process.cwd(), value);
+    const path = isAbsolute(value) ? value : join4(process.cwd(), value);
     return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
   }
   throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
@@ -33022,7 +33264,7 @@ function sqlitePathFromUrl(value, scheme) {
     }
     return rest.slice(2).replace(/^\/\/+/, "/");
   }
-  return isAbsolute(rest) ? rest : join3(process.cwd(), rest);
+  return isAbsolute(rest) ? rest : join4(process.cwd(), rest);
 }
 function looksLikeSqlitePath(value) {
   if (value.includes("/"))
@@ -33034,7 +33276,7 @@ function looksLikeSqlitePath(value) {
 import { Database } from "bun:sqlite";
 import { randomUUID as randomUUID2 } from "crypto";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 
 // src/server/auth.ts
 import { createHash as createHash3 } from "crypto";
@@ -33055,16 +33297,16 @@ function publicPrincipal(partial = {}) {
 }
 
 // src/server/migrations-dir.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
 var MIGRATION_DIALECTS = ["postgres", "sqlite"];
 var MAX_WALK_UP = 6;
 function findMigrationsRoot(startDirs = defaultStartDirs()) {
   for (const start of startDirs) {
     let dir = start;
     for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join4(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync2(join4(candidate, dialect))))
+      const candidate = join5(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync3(join5(candidate, dialect))))
         return candidate;
       const parent = dirname3(dir);
       if (parent === dir)
@@ -33078,8 +33320,8 @@ function resolveMigrationsDir(dialect, root3 = findMigrationsRoot()) {
   if (!root3) {
     throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
-  const dir = join4(root3, dialect);
-  if (!existsSync2(dir)) {
+  const dir = join5(root3, dialect);
+  if (!existsSync3(dir)) {
     throw new Error(`migrations directory not found: ${dir}`);
   }
   return dir;
@@ -33236,6 +33478,20 @@ function dateString(value) {
     return value.toISOString();
   return String(value);
 }
+function rowToSkillVersion(row) {
+  return {
+    orgId: String(row.org_id),
+    slug: String(row.slug),
+    version: String(row.version),
+    bundleSha256: String(row.bundle_sha256),
+    bundleByteSize: Number(row.bundle_byte_size),
+    storageKind: String(row.storage_kind ?? "db"),
+    ...typeof row.storage_key === "string" ? { storageKey: row.storage_key } : {},
+    manifest: parseJsonObject(row.manifest_json),
+    ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
+    createdAt: dateString(row.created_at)
+  };
+}
 
 // src/server/types.ts
 class StaleLeaseGenerationError extends Error {
@@ -33266,6 +33522,21 @@ class SkillRevisionConflictError extends Error {
   }
 }
 
+class SkillVersionExistsError extends Error {
+  slug;
+  version;
+  existingSha256;
+  attemptedSha256;
+  constructor(slug, version2, existingSha256, attemptedSha256) {
+    super(`version conflict for '${slug}@${version2}': already published with bundle ${existingSha256}, ` + `refusing to overwrite it with ${attemptedSha256}. Publish a new version instead.`);
+    this.slug = slug;
+    this.version = version2;
+    this.existingSha256 = existingSha256;
+    this.attemptedSha256 = attemptedSha256;
+    this.name = "SkillVersionExistsError";
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
 function revisionIdOf(content) {
@@ -33561,6 +33832,13 @@ class SqliteSkillsStore {
         throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
       }
       const carriedSha = input.bundle?.sha256 ?? previousSha;
+      if (input.version && carriedSha) {
+        const existingVersion = this.get("SELECT bundle_sha256 FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [orgId, input.slug, input.version]);
+        const existingSha = typeof existingVersion?.bundle_sha256 === "string" ? existingVersion.bundle_sha256 : null;
+        if (existingSha && existingSha !== carriedSha) {
+          throw new SkillVersionExistsError(input.slug, input.version, existingSha, carriedSha);
+        }
+      }
       const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
       const revisionId = revisionIdOfRecord({
         slug: input.slug,
@@ -33648,6 +33926,21 @@ class SqliteSkillsStore {
         const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
         throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
       }
+      if (input.version && carriedSha) {
+        this.db.run(`INSERT OR IGNORE INTO skills_versions (org_id, slug, version, bundle_sha256, bundle_byte_size, storage_kind, storage_key, manifest_json, published_by_user_id, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+          orgId,
+          input.slug,
+          input.version,
+          carriedSha,
+          carriedSize ?? 0,
+          input.versionStorage?.storageKind ?? "db",
+          input.versionStorage?.storageKey ?? null,
+          JSON.stringify(input.versionManifest ?? {}),
+          input.principal.userId ?? null,
+          now
+        ]);
+      }
       if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
         this.collectOrphanBundle(orgId, previousSha);
       this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
@@ -33755,6 +34048,13 @@ class SqliteSkillsStore {
     const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
     return row ? rowToSkillBundle(row) : null;
   }
+  async listSkillVersions(principal, slug) {
+    return this.all("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? ORDER BY created_at DESC, version DESC", [principal.orgId, slug]).map(rowToSkillVersion);
+  }
+  async getSkillVersion(principal, slug, version2) {
+    const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version2]);
+    return row ? rowToSkillVersion(row) : null;
+  }
   async pinSkill(principal, slug, metadata = {}) {
     const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
        VALUES (?, ?, ?, ?, ?)
@@ -33794,7 +34094,7 @@ class SqliteSkillsStore {
     return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
   }
   collectOrphanBundle(orgId, sha256) {
-    const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
+    const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]) ?? this.get("SELECT 1 AS present FROM skills_versions WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
     if (referenced)
       return;
     this.db.run("DELETE FROM skills_bundles WHERE org_id = ? AND sha256 = ?", [orgId, sha256]);
@@ -33823,7 +34123,7 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
   const appliedNow = [];
   for (const file of files) {
     const version2 = file.replace(/\.sql$/, "");
-    const text = readFileSync3(join5(migrationsDir, file), "utf8");
+    const text = readFileSync3(join6(migrationsDir, file), "utf8");
     const apply = db.transaction(() => {
       const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version2);
       if (already)
@@ -33878,731 +34178,1096 @@ function parseScopes(value) {
   }
 }
 
-// src/server/config.ts
-var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
-var SKILLS_ENV_NAMESPACE = "SKILLS";
-function resolveServerConfig(env = process.env) {
-  assertNoRetiredModeEnvVars(env, {
-    app: SKILLS_ENV_NAMESPACE,
-    replacement: DATABASE_URL_ENV
-  });
-  const nodeEnv = env.NODE_ENV || "development";
-  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
-  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
-  return {
-    host,
-    port,
-    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
-    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
-    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
-    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
-    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
-    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
-    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
-    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
-    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
-    nodeEnv,
-    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
-  };
-}
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number.parseInt(value ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-function normalizePrefix(value) {
-  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
-}
-
-// src/server/handlers.ts
-import { createHash as createHash5 } from "crypto";
-
-// src/server/store.ts
-import { randomUUID as randomUUID3 } from "crypto";
-function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
-  return {
-    slug: input.slug,
-    displayName: input.displayName,
-    description: input.description,
-    category: input.category,
-    tags: input.tags,
-    source: input.source,
-    kind: input.kind,
-    ...input.version ? { version: input.version } : {},
-    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
-    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
-    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
-  };
-}
-function resolvePoolMax(env = process.env) {
-  const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
-}
-var LOG_SEQUENCE_ATTEMPTS = 12;
-function createArtifactId() {
-  return artifactId();
-}
-async function createStore(options = {}) {
-  const target = resolveDatabaseTarget(options.databaseUrl);
-  const store = instantiateStore(target, options.sqlite);
-  await store.verifyConnectivity?.();
-  if (options.bootstrapApiKey && store.ensureBootstrapApiKey) {
-    await store.ensureBootstrapApiKey(options.bootstrapApiKey);
-  }
-  return store;
-}
-function instantiateStore(target, sqliteOptions) {
-  switch (target.kind) {
-    case "postgres":
-      return new PostgresSkillsStore(target.url);
-    case "sqlite":
-      return new SqliteSkillsStore(target.path, sqliteOptions);
-    case "memory":
-      return new MemorySkillsStore;
-  }
-}
+// src/lib/installer.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync } from "fs";
+import { dirname as dirname5, join as join7 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
-class MemorySkillsStore {
-  backend = { kind: "memory", durable: false, label: "memory (non-durable)" };
-  apiKeys = new Map;
-  runs = new Map;
-  logs = new Map;
-  artifacts = new Map;
-  idempotency = new Map;
-  skills = new Map;
-  bundles = new Map;
-  pins = new Map;
-  constructor(apiKeys = []) {
-    for (const key of apiKeys)
-      this.addApiKey(key.token, key.principal);
-  }
-  addApiKey(token, principal) {
-    const resolved = publicPrincipal(principal);
-    this.apiKeys.set(hashApiKey(token), resolved);
-    return resolved;
-  }
-  async ensureBootstrapApiKey(token, principal) {
-    this.addApiKey(token, principal);
-  }
-  async authenticateApiKeyHash(hash) {
-    return this.apiKeys.get(hash) ?? null;
-  }
-  async createRun(input) {
-    const idemKey = input.idempotencyKey?.trim();
-    const idemMapKey = idemKey ? `${input.principal.orgId}:${idemKey}` : undefined;
-    if (idemMapKey) {
-      const existing = this.idempotency.get(idemMapKey);
-      if (existing)
-        return this.runs.get(existing);
-    }
-    const now = nowIso();
-    const run = {
-      id: runId(),
-      orgId: input.principal.orgId,
-      userId: input.principal.userId,
-      skill: input.slug,
-      requestedSlug: input.slug,
-      status: "queued",
-      input: input.input,
-      args: input.args,
-      ...idemKey ? { idempotencyKey: idemKey } : {},
-      correlationId: randomUUID3(),
-      costCents: 0,
-      leaseGeneration: 0,
-      createdAt: now
-    };
-    this.runs.set(run.id, run);
-    this.logs.set(run.id, []);
-    this.artifacts.set(run.id, []);
-    if (idemMapKey)
-      this.idempotency.set(idemMapKey, run.id);
-    return run;
-  }
-  async listRuns(principal, limit) {
-    return Array.from(this.runs.values()).filter((run) => run.orgId === principal.orgId).sort((a3, b3) => b3.createdAt.localeCompare(a3.createdAt)).slice(0, normalizeLimit(limit));
-  }
-  async getRun(principal, runId2) {
-    const run = this.runs.get(runId2);
-    return run && run.orgId === principal.orgId ? run : null;
-  }
-  async claimNextRun(_input) {
-    const run = Array.from(this.runs.values()).filter((candidate) => candidate.status === "queued" || candidate.status === "retrying").sort((a3, b3) => a3.createdAt.localeCompare(b3.createdAt))[0];
-    if (!run)
-      return null;
-    return this.patchRun(run.id, { status: "running", startedAt: run.startedAt ?? nowIso(), leaseGeneration: run.leaseGeneration + 1 });
-  }
-  async updateRun(runId2, patch) {
-    return this.patchRun(runId2, patch);
-  }
-  async transitionRun(runId2, patch, expectedGeneration) {
-    const run = this.runs.get(runId2);
-    if (!run)
-      return null;
-    if (run.leaseGeneration !== expectedGeneration) {
-      throw new StaleLeaseGenerationError(runId2, expectedGeneration, run.leaseGeneration, run.status);
-    }
-    return this.patchRun(runId2, patch);
-  }
-  async appendLog(runId2, orgId, level, message) {
-    const entries = this.logs.get(runId2) ?? [];
-    const log = { runId: runId2, sequence: entries.length + 1, level, message, createdAt: nowIso() };
-    entries.push(log);
-    this.logs.set(runId2, entries);
-    return log;
-  }
-  async listLogs(principal, runId2) {
-    const run = await this.getRun(principal, runId2);
-    return run ? [...this.logs.get(runId2) ?? []] : [];
-  }
-  async addArtifact(artifact) {
-    const next = { ...artifact, createdAt: nowIso() };
-    const artifacts = this.artifacts.get(artifact.runId) ?? [];
-    artifacts.push(next);
-    this.artifacts.set(artifact.runId, artifacts);
-    return next;
-  }
-  async listArtifacts(principal, runId2) {
-    const run = await this.getRun(principal, runId2);
-    return run ? [...this.artifacts.get(runId2) ?? []] : [];
-  }
-  async getArtifact(principal, runId2, id) {
-    const artifacts = await this.listArtifacts(principal, runId2);
-    return artifacts.find((artifact) => artifact.id === id) ?? null;
-  }
-  async publishSkill(input) {
-    const key = skillKey(input.principal.orgId, input.slug);
-    const now = nowIso();
-    const previous = this.skills.get(key);
-    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
-      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
-    }
-    if (input.bundle) {
-      const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
-      this.bundles.set(bundleMapKey, {
-        ...this.bundles.get(bundleMapKey),
-        ...input.bundle,
-        orgId: input.principal.orgId,
-        createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
-      });
-    }
-    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
-    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
-    const record = {
-      orgId: input.principal.orgId,
-      slug: input.slug,
-      displayName: input.displayName,
-      description: input.description,
-      category: input.category,
-      tags: [...input.tags],
-      source: input.source,
-      kind: input.kind,
-      ...input.version ? { version: input.version } : {},
-      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
-      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
-      publishedByUserId: input.principal.userId,
-      createdAt: previous?.createdAt ?? now,
-      updatedAt: now,
-      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
-      revisionNumber: (previous?.revisionNumber ?? 0) + 1
-    };
-    this.skills.set(key, record);
-    if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
-      this.collectOrphanBundle(input.principal.orgId, previous.bundleSha256);
-    }
-    return record;
-  }
-  async listSkills(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
-  }
-  async getSkill(principal, slug) {
-    const skill = this.skills.get(skillKey(principal.orgId, slug));
-    return skill && skill.orgId === principal.orgId ? skill : null;
-  }
-  async updateSkill(principal, slug, patch, expectedRevisionId) {
-    const current = await this.getSkill(principal, slug);
-    if (!current || current.tombstonedAt)
-      return null;
-    if (expectedRevisionId !== current.revisionId) {
-      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
-    }
-    const latest = this.skills.get(skillKey(principal.orgId, slug));
-    if (!latest || latest.tombstonedAt)
-      return null;
-    if (latest.revisionId !== current.revisionId) {
-      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
-    }
-    const next = {
-      ...latest,
-      ...patch,
-      updatedAt: nowIso(),
-      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
-      revisionNumber: latest.revisionNumber + 1
-    };
-    this.skills.set(skillKey(principal.orgId, slug), next);
-    return next;
+// src/lib/registry-data/development-tools.ts
+var DEVELOPMENT_TOOLS_SKILLS = [
+  {
+    name: "repo-onboarding-report",
+    displayName: "Repo Onboarding Report",
+    description: "Generate repository onboarding packages with architecture maps, setup guides, risk registers, and first-week plans",
+    category: "Development Tools",
+    kind: "instruction",
+    tags: ["repository", "onboarding", "architecture", "developer-tools"]
+  },
+  {
+    name: "security-audit-report",
+    displayName: "Security Audit Report",
+    description: "Generate application security hardening reports covering auth, secrets, headers, webhooks, RLS, permissions, dependencies, and prioritized fixes",
+    category: "Development Tools",
+    kind: "instruction",
+    tags: ["security", "audit", "hardening", "rls", "webhooks"]
+  },
+  {
+    name: "performance-audit-report",
+    displayName: "Performance Audit Report",
+    description: "Generate performance audit reports with metrics, findings, budgets, remediation plans, and manifest artifacts",
+    category: "Development Tools",
+    kind: "instruction",
+    tags: ["performance", "audit", "latency", "budget", "web"]
+  },
+  {
+    name: "migration-plan-pack",
+    displayName: "Migration Plan Pack",
+    description: "Generate migration plans for frameworks, libraries, databases, infrastructure, and architecture upgrades with risk matrix, checklist, rollout, and test strategy artifacts",
+    category: "Development Tools",
+    kind: "instruction",
+    tags: ["migration", "upgrade", "planning", "frameworks", "databases"]
+  },
+  {
+    name: "test-suite-generator",
+    displayName: "Test Suite Generator",
+    description: "Generate runnable API, unit, and browser test suite packages with coverage notes",
+    category: "Development Tools",
+    kind: "instruction",
+    tags: ["testing", "qa", "api-tests", "browser-tests", "coverage"]
+  },
+  {
+    name: "api-test-suite",
+    displayName: "API Test Suite",
+    description: "Generate and run API test suites with comprehensive endpoint coverage",
+    category: "Development Tools",
+    tags: ["api", "testing", "automation", "qa"]
+  },
+  {
+    name: "api-docs-portal",
+    displayName: "API Docs Portal",
+    description: "Generate static API documentation portals from OpenAPI specs, route lists, and endpoint examples",
+    category: "Development Tools",
+    tags: ["api", "documentation", "openapi", "portal"]
+  },
+  {
+    name: "codefix",
+    displayName: "Code Fix",
+    description: "Code quality CLI for auto-linting, formatting, fixing, and style enforcement",
+    category: "Development Tools",
+    tags: ["code", "linting", "formatting", "quality"]
+  },
+  {
+    name: "commitpush",
+    displayName: "Commit Push",
+    description: "Create logical commits from repo changes and push directly to the main branch",
+    category: "Development Tools",
+    tags: ["git", "commit", "push", "automation"]
+  },
+  {
+    name: "commitpushpr",
+    displayName: "Commit Push PR",
+    description: "Create logical commits, push a feature branch, and open a GitHub pull request",
+    category: "Development Tools",
+    dependencies: ["commitpush"],
+    tags: ["git", "commit", "pull-request", "github", "automation"]
+  },
+  {
+    name: "database-explorer",
+    displayName: "Database Explorer",
+    description: "Explore and query databases with an interactive interface",
+    category: "Development Tools",
+    tags: ["database", "explorer", "sql", "query"]
+  },
+  {
+    name: "diff-viewer",
+    displayName: "Diff Viewer",
+    description: "View and analyze file differences with visual diff representation",
+    category: "Development Tools",
+    tags: ["diff", "comparison", "files", "code-review"]
+  },
+  {
+    name: "generate-api-client",
+    displayName: "Generate API Client",
+    description: "Generate API client libraries from OpenAPI specs and documentation",
+    category: "Development Tools",
+    tags: ["api", "client", "code-generation", "openapi"]
+  },
+  {
+    name: "generate-dockerfile",
+    displayName: "Generate Dockerfile",
+    description: "Generate optimized Dockerfiles for containerized applications",
+    category: "Development Tools",
+    tags: ["docker", "dockerfile", "containers", "devops"]
+  },
+  {
+    name: "generate-env",
+    displayName: "Generate Env",
+    description: "Generate environment variable files from templates and configurations",
+    category: "Development Tools",
+    tags: ["env", "environment", "configuration", "dotenv"]
+  },
+  {
+    name: "generate-sitemap",
+    displayName: "Generate Sitemap",
+    description: "Generate XML sitemaps for websites and web applications",
+    category: "Development Tools",
+    tags: ["sitemap", "seo", "xml", "web"]
+  },
+  {
+    name: "hook",
+    displayName: "Hook",
+    description: "Claude Code hook creation skill - generates standardized hook scaffolds",
+    category: "Development Tools",
+    tags: ["hooks", "scaffold", "claude-code", "automation"]
+  },
+  {
+    name: "http-server",
+    displayName: "HTTP Server",
+    description: "Spin up local HTTP servers for development and testing",
+    category: "Development Tools",
+    tags: ["http", "server", "development", "local"]
+  },
+  {
+    name: "lorem-generator",
+    displayName: "Lorem Generator",
+    description: "Generate placeholder text in various styles and lengths",
+    category: "Development Tools",
+    tags: ["lorem", "placeholder", "text", "mockup"]
+  },
+  {
+    name: "managemcp",
+    displayName: "Manage MCP",
+    description: "Manage MCP servers with install, configure, and lifecycle operations",
+    category: "Development Tools",
+    tags: ["mcp", "management", "servers", "configuration"]
+  },
+  {
+    name: "markdown-validator",
+    displayName: "Markdown Validator",
+    description: "Validate markdown files for syntax, links, and formatting issues",
+    category: "Development Tools",
+    tags: ["markdown", "validation", "linting", "formatting"]
+  },
+  {
+    name: "monitor",
+    displayName: "Monitor",
+    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+    category: "Development Tools",
+    tags: ["monitoring", "mcp", "processes", "operations"]
+  },
+  {
+    name: "regex-tester",
+    displayName: "Regex Tester",
+    description: "Test and validate regular expressions with sample inputs",
+    category: "Development Tools",
+    tags: ["regex", "testing", "validation", "patterns"]
+  },
+  {
+    name: "scancommitpr",
+    displayName: "Scan Commit PR",
+    description: "Scan repo changes, group into logical commits, push, and optionally create a PR",
+    category: "Development Tools",
+    dependencies: ["scancommitpush"],
+    tags: ["git", "commit", "push", "pull-request", "automation"]
+  },
+  {
+    name: "scancommitpush",
+    displayName: "Scan Commit Push",
+    description: "Scan repo changes, group into logical commits with conventional messages, and push to GitHub",
+    category: "Development Tools",
+    tags: ["git", "commit", "push", "automation"]
+  },
+  {
+    name: "security-audit",
+    displayName: "Security Audit",
+    description: "Perform security audits on codebases and infrastructure configurations",
+    category: "Development Tools",
+    tags: ["security", "audit", "vulnerabilities", "scanning"]
+  },
+  {
+    name: "tmux-session",
+    displayName: "Tmux Session",
+    description: "Create and manage grouped tmux sessions with workspace-aware naming and window layout guidance",
+    category: "Development Tools",
+    tags: ["tmux", "terminal", "sessions", "workspace"]
+  },
+  {
+    name: "validate-config",
+    displayName: "Validate Config",
+    description: "Validate configuration files for syntax and schema compliance",
+    category: "Development Tools",
+    tags: ["config", "validation", "schema", "linting"]
+  },
+  {
+    name: "oss-app-two-backend-storage",
+    displayName: "OSS App Two-Backend Storage",
+    description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
+    category: "Development Tools",
+    tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
+    kind: "instruction"
   }
-  async deleteSkill(principal, slug, tombstoneWindowMs) {
-    const current = await this.getSkill(principal, slug);
-    if (!current)
-      return null;
-    if (!current.tombstonedAt) {
-      const tombstoned = nowIso();
-      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
-      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
-      this.skills.set(skillKey(principal.orgId, slug), next);
-      return next;
-    }
-    return current;
+];
+
+// src/lib/registry-data/business-marketing.ts
+var BUSINESS_MARKETING_SKILLS = [
+  {
+    name: "customer-feedback-report",
+    displayName: "Customer Feedback Report",
+    description: "Generate customer feedback reports with clusters, sentiment, root causes, roadmap recommendations, evidence, and PDF/Markdown artifacts",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["feedback", "customer", "sentiment", "roadmap", "report"]
+  },
+  {
+    name: "pitch-deck",
+    displayName: "Pitch Deck",
+    description: "Generate investor and sales deck packages with slides, speaker notes, design direction, PDF, and PPTX artifacts",
+    category: "Business & Marketing",
+    kind: "instruction",
+    dependencies: ["market-research-report"],
+    tags: ["deck", "presentation", "investor", "sales", "pptx"]
+  },
+  {
+    name: "proposal-pack",
+    displayName: "Proposal Pack",
+    description: "Generate client proposal packages with proposal, statement of work, pricing, timeline, assumptions, cover email, and PDF/Markdown artifacts",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["proposal", "sow", "sales", "pricing", "timeline"]
+  },
+  {
+    name: "seo-content-pack",
+    displayName: "SEO Content Pack",
+    description: "Generate SEO content packages with topic clusters, articles, metadata, internal links, FAQs, and publishing cadence",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["seo", "content", "articles", "metadata"]
+  },
+  {
+    name: "landing-page-pack",
+    displayName: "Landing Page Pack",
+    description: "Generate landing page packages with conversion copy, wireframes, CTA maps, experiments, preview HTML, and implementation notes",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["landing-page", "sales", "copywriting", "conversion"]
+  },
+  {
+    name: "ad-creative-pack",
+    displayName: "Ad Creative Pack",
+    description: "Generate paid ad packages with platform copy, creative concepts, image prompts, audience angles, and test matrices",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["ads", "creative", "marketing", "copywriting"]
+  },
+  {
+    name: "email-sequence",
+    displayName: "Email Sequence",
+    description: "Generate email campaign packages with subject lines, preview text, body copy, segmentation notes, CTA variants, HTML emails, and send plans",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["email", "marketing", "campaign", "copywriting"]
+  },
+  {
+    name: "social-content-calendar",
+    displayName: "Social Content Calendar",
+    description: "Generate social content calendars with daily posts, channel strategy, asset briefs, hooks, publishing schedules, and repurposing maps",
+    category: "Business & Marketing",
+    kind: "instruction",
+    tags: ["social", "content", "calendar", "marketing"]
+  },
+  {
+    name: "one-page-website",
+    displayName: "One Page Website",
+    description: "Generate static one-page website bundles with HTML, CSS, JavaScript, copy, section maps, deploy notes, and manifest",
+    category: "Business & Marketing",
+    tags: ["website", "landing-page", "static-site", "html"]
   }
-  async purgeExpiredTombstones(principal) {
-    const now = nowIso();
-    const purged = [];
-    for (const [key, skill] of this.skills) {
-      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
-        continue;
-      if (skill.tombstonePurgeAfter > now)
-        continue;
-      this.skills.delete(key);
-      if (skill.bundleSha256)
-        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
-      purged.push(skill);
-    }
-    return purged;
+];
+
+// src/lib/registry-data/productivity-organization.ts
+var PRODUCTIVITY_ORGANIZATION_SKILLS = [
+  {
+    name: "meeting-pack",
+    displayName: "Meeting Pack",
+    description: "Generate meeting artifact packages with summaries, decisions, action items, follow-up email, timeline, project export, and manifest",
+    category: "Productivity & Organization",
+    kind: "instruction",
+    tags: ["meeting", "summary", "action-items", "decisions"]
+  },
+  {
+    name: "file-organizer",
+    displayName: "File Organizer",
+    description: "Organize files into structured directories based on type, date, or content",
+    category: "Productivity & Organization",
+    tags: ["files", "organization", "sorting", "cleanup"]
+  },
+  {
+    name: "folder-tree",
+    displayName: "Folder Tree",
+    description: "Generate and display folder tree structures for documentation",
+    category: "Productivity & Organization",
+    tags: ["folder", "tree", "structure", "visualization"]
+  },
+  {
+    name: "form-filler",
+    displayName: "Form Filler",
+    description: "Automatically fill out web forms and document templates",
+    category: "Productivity & Organization",
+    tags: ["forms", "automation", "filling", "data-entry"]
+  },
+  {
+    name: "merge-pdfs",
+    displayName: "Merge PDFs",
+    description: "Merge multiple PDF files into a single document",
+    category: "Productivity & Organization",
+    tags: ["pdf", "merge", "documents", "combining"]
+  },
+  {
+    name: "split-pdf",
+    displayName: "Split PDF",
+    description: "Split PDF documents into separate pages or sections",
+    category: "Productivity & Organization",
+    tags: ["pdf", "split", "documents", "pages"]
   }
-  async getSkillBundle(principal, sha256) {
-    const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
-    return bundle && bundle.orgId === principal.orgId ? bundle : null;
+];
+
+// src/lib/registry-data/project-management.ts
+var PROJECT_MANAGEMENT_SKILLS = [
+  {
+    name: "businessactivity",
+    displayName: "Business Activity",
+    description: "Business activity, workflow, and ownership management service",
+    category: "Project Management",
+    tags: ["business", "workflow", "activities", "management"]
+  },
+  {
+    name: "implementation",
+    displayName: "Implementation",
+    description: "Create .implementation scaffold for project development tracking",
+    category: "Project Management",
+    tags: ["implementation", "tracking", "scaffold", "project"]
+  },
+  {
+    name: "implementation-plan",
+    displayName: "Implementation Plan",
+    description: "Generate detailed implementation plans with phases and milestones",
+    category: "Project Management",
+    tags: ["implementation", "planning", "milestones", "phases"]
+  },
+  {
+    name: "implementation-todo",
+    displayName: "Implementation Todo",
+    description: "Manage implementation task lists and todo items",
+    category: "Project Management",
+    tags: ["implementation", "todo", "tasks", "tracking"]
+  },
+  {
+    name: "todos-plan",
+    displayName: "Todos Plan",
+    description: "Author, sync, route, and verify Todos plans using Todos CLI plan IDs as source of truth",
+    category: "Project Management",
+    tags: ["todos", "plans", "tasks", "verification", "workflow"]
   }
-  async pinSkill(principal, slug, metadata = {}) {
-    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
-    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
-    return pin;
+];
+
+// src/lib/registry-data/content-generation.ts
+var CONTENT_GENERATION_SKILLS = [
+  {
+    name: "pdf-generate",
+    displayName: "PDF Generate",
+    description: "Generate PDF documents with rich formatting and layouts",
+    category: "Content Generation",
+    tags: ["pdf", "document", "generation", "formatting"]
+  },
+  {
+    name: "slide-deck-generator",
+    displayName: "Slide Deck Generator",
+    description: "Generate slide decks from briefs, docs, or outlines with PDF, PPTX, speaker notes, and structured slide metadata",
+    category: "Content Generation",
+    tags: ["presentation", "slides", "deck", "documents"]
+  },
+  {
+    name: "generate-qrcode",
+    displayName: "Generate QR Code",
+    description: "Generate QR codes with custom styling and embedded data",
+    category: "Content Generation",
+    tags: ["qrcode", "generation", "encoding", "visual"]
+  },
+  {
+    name: "generate-resume",
+    displayName: "Generate Resume",
+    description: "Generate professional resumes with formatting and content optimization",
+    category: "Content Generation",
+    tags: ["resume", "cv", "career", "generation"]
   }
-  async unpinSkill(principal, slug) {
-    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+];
+
+// src/lib/registry-data/finance-compliance.ts
+var FINANCE_COMPLIANCE_SKILLS = [
+  {
+    name: "contract-review-report",
+    displayName: "Contract Review Report",
+    description: "Generate contract review reports with risk register, clause summary, redline suggestions, negotiation email, and manifest artifacts",
+    category: "Finance & Compliance",
+    kind: "instruction",
+    tags: ["contract", "legal", "review", "risk"]
+  },
+  {
+    name: "invoice",
+    displayName: "Invoice",
+    description: "Generate professional invoices with company management and PDF export",
+    category: "Finance & Compliance",
+    tags: ["invoice", "billing", "pdf", "finance"]
+  },
+  {
+    name: "invoice-reconciliation",
+    displayName: "Invoice Reconciliation",
+    description: "Generate invoice reconciliation reports with matched payments, discrepancies, anomaly notes, summaries, and manifest artifacts",
+    category: "Finance & Compliance",
+    tags: ["invoice", "payments", "reconciliation", "finance"]
   }
-  async listPins(principal) {
-    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+];
+
+// src/lib/registry-data/data-analysis.ts
+var DATA_ANALYSIS_SKILLS = [
+  {
+    name: "analyze-data",
+    displayName: "Analyze Data",
+    description: "Data science insights for CSV and JSON datasets with statistical analysis",
+    category: "Data & Analysis",
+    tags: ["data", "analysis", "csv", "json", "statistics"]
+  },
+  {
+    name: "dashboard-builder",
+    displayName: "Dashboard Builder",
+    description: "Build data dashboards with charts, metrics, and visualizations",
+    category: "Data & Analysis",
+    tags: ["dashboard", "visualization", "charts", "metrics"]
+  },
+  {
+    name: "data-anonymizer",
+    displayName: "Data Anonymizer",
+    description: "Anonymize sensitive data in datasets for privacy compliance",
+    category: "Data & Analysis",
+    tags: ["anonymization", "privacy", "data", "compliance"]
+  },
+  {
+    name: "generate-chart",
+    displayName: "Generate Chart",
+    description: "Generate data charts and visualizations from datasets",
+    category: "Data & Analysis",
+    tags: ["charts", "visualization", "data", "graphs"]
+  },
+  {
+    name: "read-csv",
+    displayName: "Read CSV",
+    description: "Parse CSV files into structured JSON with delimiter and encoding detection",
+    category: "Data & Analysis",
+    tags: ["csv", "parsing", "tabular", "data"]
+  },
+  {
+    name: "read-excel",
+    displayName: "Read Excel",
+    description: "Parse XLS and XLSX workbooks into structured JSON with sheet and formatted cell metadata",
+    category: "Data & Analysis",
+    tags: ["excel", "spreadsheet", "xlsx", "data"]
+  },
+  {
+    name: "pdf-to-markdown",
+    displayName: "PDF to Markdown",
+    description: "Convert PDFs into clean markdown with remote extraction and structure cleanup",
+    category: "Data & Analysis",
+    tags: ["pdf", "markdown", "conversion"]
+  },
+  {
+    name: "pdf-to-dataset",
+    displayName: "PDF to Dataset",
+    description: "Extract PDF tables, forms, invoices, and semi-structured content into CSV and JSON datasets",
+    category: "Data & Analysis",
+    tags: ["pdf", "dataset", "csv", "json", "extraction"]
+  },
+  {
+    name: "doc-read",
+    displayName: "Doc Read",
+    description: "Read and extract text from DOCX files with section parsing and metadata extraction",
+    category: "Data & Analysis",
+    tags: ["docx", "reader", "extraction", "word"]
   }
-  async listTags(principal) {
-    await this.purgeExpiredTombstones(principal);
-    const tags = new Set;
-    for (const skill of this.skills.values()) {
-      if (skill.orgId !== principal.orgId)
-        continue;
-      for (const tag of skill.tags) {
-        if (tag.trim())
-          tags.add(tag);
-      }
-    }
-    return [...tags].sort();
+];
+
+// src/lib/registry-data/media-processing.ts
+var MEDIA_PROCESSING_SKILLS = [
+  {
+    name: "video-highlight-pack",
+    displayName: "Video Highlight Pack",
+    description: "Generate video highlight packages with clip plans, captions, thumbnail briefs, chapter markers, social posts, and edit decisions",
+    category: "Media Processing",
+    kind: "instruction",
+    tags: ["video", "highlights", "clips", "captions"]
+  },
+  {
+    name: "compress-video",
+    displayName: "Compress Video",
+    description: "Compress video files while preserving visual quality using ffmpeg",
+    category: "Media Processing",
+    tags: ["video", "compression", "ffmpeg", "optimization"]
+  },
+  {
+    name: "audio-extract",
+    displayName: "Audio Extract",
+    description: "Extract audio tracks from video files with multiple format support",
+    category: "Media Processing",
+    tags: ["audio", "extraction", "video", "conversion"]
+  },
+  {
+    name: "extract-frames",
+    displayName: "Extract Frames",
+    description: "Extract frames from video files at specified intervals or timestamps",
+    category: "Media Processing",
+    tags: ["frames", "video", "extraction", "images"]
+  },
+  {
+    name: "gif-maker",
+    displayName: "GIF Maker",
+    description: "Create animated GIFs from images, videos, or screen recordings",
+    category: "Media Processing",
+    tags: ["gif", "animation", "images", "video"]
+  },
+  {
+    name: "video-downloader",
+    displayName: "Video Downloader",
+    description: "Download videos from various online platforms and services",
+    category: "Media Processing",
+    tags: ["video", "download", "platforms", "media"]
+  },
+  {
+    name: "watermark",
+    displayName: "Watermark",
+    description: "Add watermarks to images and documents for copyright protection",
+    category: "Media Processing",
+    tags: ["watermark", "protection", "copyright", "images"]
   }
-  async listSkillsByTag(principal, tag) {
-    await this.purgeExpiredTombstones(principal);
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+];
+
+// src/lib/registry-data/design-branding.ts
+var DESIGN_BRANDING_SKILLS = [
+  {
+    name: "brand-kit",
+    displayName: "Brand Kit",
+    description: "Generate brand kits with logo usage, palette, typography, brand voice, sample applications, Markdown guide, PDF guide, and SVG assets",
+    category: "Design & Branding",
+    kind: "instruction",
+    tags: ["brand", "design", "palette", "typography"]
+  },
+  {
+    name: "brand-assets",
+    displayName: "Brand Assets",
+    description: "Fetch official brand assets from a website or brand name with logos, PNG sizes, palette, typography, source metadata, and manifests",
+    category: "Design & Branding",
+    tags: ["brand", "logo", "assets", "palette", "typography"]
+  },
+  {
+    name: "logo-design",
+    displayName: "Logo Design",
+    description: "Generate multi-variant logo packages with transparent PNGs, vector-style SVGs, usage notes, and manifests",
+    category: "Design & Branding",
+    tags: ["logo", "design", "branding", "identity"]
+  },
+  {
+    name: "generate-favicon",
+    displayName: "Generate Favicon",
+    description: "Generate favicons in multiple sizes and formats for websites",
+    category: "Design & Branding",
+    tags: ["favicon", "icon", "design", "web"]
+  },
+  {
+    name: "product-mockup",
+    displayName: "Product Mockup",
+    description: "Generate product mockup packages with visual variants, prompts, usage notes, and asset metadata",
+    category: "Design & Branding",
+    tags: ["product", "mockup", "visualization", "marketing"]
+  },
+  {
+    name: "siteanalyze",
+    displayName: "Site Analyze",
+    description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
+    category: "Design & Branding",
+    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
   }
-  async listPinsByTag(principal, tag) {
-    await this.purgeExpiredTombstones(principal);
-    const taggedSlugs = new Set;
-    for (const skill of this.skills.values()) {
-      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
-        taggedSlugs.add(skill.slug);
-    }
-    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+];
+
+// src/lib/registry-data/web-browser.ts
+var WEB_BROWSER_SKILLS = [
+  {
+    name: "domainpurchase",
+    displayName: "Domain Purchase",
+    description: "Purchase and manage domains via registrar connectors",
+    category: "Web & Browser",
+    tags: ["domain", "purchase", "registrar", "management"]
   }
-  async listPublishedSlugs(principal) {
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+];
+
+// src/lib/registry-data/research-writing.ts
+var RESEARCH_WRITING_SKILLS = [
+  {
+    name: "blog-article",
+    displayName: "Blog Article",
+    description: "Create SEO-optimized blog article artifact packages",
+    category: "Research & Writing",
+    kind: "instruction",
+    tags: ["blog", "article", "writing", "seo"]
+  },
+  {
+    name: "market-research-report",
+    displayName: "Market Research Report",
+    description: "Generate market research packages with competitor tables, positioning, pricing notes, source notes, and PDF/Markdown artifacts",
+    category: "Research & Writing",
+    kind: "instruction",
+    tags: ["market-research", "competitors", "positioning", "pricing", "report"]
   }
-  collectOrphanBundle(orgId, sha256) {
-    const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256);
-    if (!referenced)
-      this.bundles.delete(skillKey(orgId, sha256));
+];
+
+// src/lib/registry-data/science-academic.ts
+var SCIENCE_ACADEMIC_SKILLS = [
+  {
+    name: "bio-sequence-tool",
+    displayName: "Bio Sequence Tool",
+    description: "Analyze and manipulate biological sequences including DNA, RNA, and protein data",
+    category: "Science & Academic",
+    tags: ["biology", "dna", "sequence", "bioinformatics"]
+  },
+  {
+    name: "experiment-power-calculator",
+    displayName: "Experiment Power Calculator",
+    description: "Calculate statistical power and sample size for experiments",
+    category: "Science & Academic",
+    tags: ["experiment", "statistics", "power-analysis", "sample-size"]
+  },
+  {
+    name: "latex-table-generator",
+    displayName: "LaTeX Table Generator",
+    description: "Generate formatted LaTeX tables from data for academic papers",
+    category: "Science & Academic",
+    tags: ["latex", "tables", "academic", "formatting"]
+  },
+  {
+    name: "scientific-figure-check",
+    displayName: "Scientific Figure Check",
+    description: "Validate scientific figures for accuracy, formatting, and publication standards",
+    category: "Science & Academic",
+    tags: ["scientific", "figures", "validation", "publishing"]
+  },
+  {
+    name: "statistical-test-selector",
+    displayName: "Statistical Test Selector",
+    description: "Recommend appropriate statistical tests based on data and research questions",
+    category: "Science & Academic",
+    tags: ["statistics", "test-selection", "research", "analysis"]
   }
-  patchRun(runId2, patch) {
-    const run = this.runs.get(runId2);
-    if (!run)
-      return null;
-    const next = { ...run, ...patch };
-    this.runs.set(runId2, next);
-    return next;
+];
+
+// src/lib/registry-data/education-learning.ts
+var EDUCATION_LEARNING_SKILLS = [];
+
+// src/lib/registry-data/communication.ts
+var COMMUNICATION_SKILLS = [];
+
+// src/lib/registry-data/health-wellness.ts
+var HEALTH_WELLNESS_SKILLS = [];
+
+// src/lib/registry-data/travel-lifestyle.ts
+var TRAVEL_LIFESTYLE_SKILLS = [];
+
+// src/lib/registry-data/event-management.ts
+var EVENT_MANAGEMENT_SKILLS = [];
+
+// src/lib/registry-data/index.ts
+var SKILLS = [
+  ...DEVELOPMENT_TOOLS_SKILLS,
+  ...BUSINESS_MARKETING_SKILLS,
+  ...PRODUCTIVITY_ORGANIZATION_SKILLS,
+  ...PROJECT_MANAGEMENT_SKILLS,
+  ...CONTENT_GENERATION_SKILLS,
+  ...FINANCE_COMPLIANCE_SKILLS,
+  ...DATA_ANALYSIS_SKILLS,
+  ...MEDIA_PROCESSING_SKILLS,
+  ...DESIGN_BRANDING_SKILLS,
+  ...WEB_BROWSER_SKILLS,
+  ...RESEARCH_WRITING_SKILLS,
+  ...SCIENCE_ACADEMIC_SKILLS,
+  ...EDUCATION_LEARNING_SKILLS,
+  ...COMMUNICATION_SKILLS,
+  ...HEALTH_WELLNESS_SKILLS,
+  ...TRAVEL_LIFESTYLE_SKILLS,
+  ...EVENT_MANAGEMENT_SKILLS
+];
+
+// src/lib/hosted-skill-set.ts
+var HOSTED_RUNTIMES = new Set(["hosted"]);
+var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
+var HOSTED_METADATA_SET_EMPTY_ERROR = [
+  "The hosted metadata skill set is empty, but the packaging guards that depend on it",
+  "only mean anything while it is non-empty: an empty set makes every one of them pass",
+  "vacuously and silently removes the protection that keeps hosted implementation source",
+  "out of the published package.",
+  "",
+  "If emptying the set is intentional (every hosted skill was deleted or converted to a",
+  "runnable in-repo skill), retire the derived guards in the SAME change \u2014 do not let them",
+  "stay green and empty."
+].join(`
+`);
+var SLUG = "[^,{}/]+";
+var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/src$`);
+var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
+
+// src/lib/skill-validation.ts
+var RESERVED_SKILL_ENTRIES = new Set([
+  ".env",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  "id_rsa",
+  "id_ed25519"
+]);
+var KNOWN_TOP_LEVEL_ENTRIES = new Set([
+  ".claude",
+  ".env.example",
+  ".gitignore",
+  ".skills",
+  "CLAUDE.md",
+  "AGENTS.md",
+  "LICENSE",
+  "PROJECT_OVERVIEW.md",
+  "QUICKSTART.md",
+  "README.md",
+  "SKILL.md",
+  "api-docs-list.json",
+  "auth.ts",
+  "bun.lock",
+  "bunfig.toml",
+  "data",
+  "dist",
+  "examples",
+  "exports",
+  "http-client.ts",
+  "index.ts",
+  "install.sh",
+  "installer.ts",
+  "logs",
+  "node_modules",
+  "package.json",
+  "scripts",
+  "skill-install.ts",
+  "skill.json",
+  "src",
+  "tests",
+  "references",
+  "assets",
+  "tsconfig.json",
+  "vision.ts"
+]);
+var VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
+
+// src/lib/skill-hash.ts
+var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+
+// src/lib/portable-skills-files.ts
+var ANY_SEGMENT_COPY_EXCLUDES = new Set([
+  ".git",
+  ".DS_Store",
+  ".system",
+  "node_modules"
+]);
+var FIRST_SEGMENT_COPY_EXCLUDES = new Set([
+  "dist",
+  "build",
+  ".turbo"
+]);
+// src/lib/portable-skills.ts
+var OFFICIAL_SKILL_NAMES = new Set(SKILLS.map((skill) => skill.name));
+// src/lib/installer.ts
+var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
+function findSkillsDir() {
+  let dir = __dirname2;
+  for (let i3 = 0;i3 < 5; i3++) {
+    const candidate = join7(dir, "skills");
+    if (existsSync4(candidate) && !dir.includes(".skills"))
+      return candidate;
+    dir = dirname5(dir);
   }
+  return join7(__dirname2, "..", "skills");
 }
-function skillKey(orgId, slug) {
-  return `${orgId.length}:${orgId}:${slug}`;
+var SKILLS_DIR = findSkillsDir();
+
+// src/server/skills-api.ts
+var MAX_SKILL_MD_BYTES = 512000;
+var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
+var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
+var MAX_VERSION_MANIFEST_BYTES = 512 * 1024;
+
+// src/server/config.ts
+var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
+var SKILLS_ENV_NAMESPACE = "SKILLS";
+function resolveServerConfig(env = process.env) {
+  assertNoRetiredModeEnvVars(env, {
+    app: SKILLS_ENV_NAMESPACE,
+    replacement: DATABASE_URL_ENV
+  });
+  const nodeEnv = env.NODE_ENV || "development";
+  const host = env.HOST || env.SKILLS_HOST || "0.0.0.0";
+  const port = parsePositiveInt(env.PORT || env.SKILLS_PORT, 8787);
+  return {
+    host,
+    port,
+    databaseUrl: env[DATABASE_URL_ENV] || env.DATABASE_URL || undefined,
+    bootstrapApiKey: env.HASNA_SKILLS_BOOTSTRAP_API_KEY || undefined,
+    seedBundledCorpus: (env.HASNA_SKILLS_SEED_BUNDLED_CORPUS ?? "1") !== "0",
+    artifactBucket: env.HASNA_SKILLS_S3_BUCKET || env.SKILLS_S3_BUCKET || undefined,
+    artifactPrefix: normalizePrefix(env.HASNA_SKILLS_S3_PREFIX || env.SKILLS_S3_PREFIX || "skills/artifacts"),
+    inlineWorker: env.HASNA_SKILLS_INLINE_WORKER === "1",
+    bundleSigningKey: env.HASNA_SKILLS_API_SIGNING_KEY || env.HASNA_SKILLS_SIGNING_KEY || undefined,
+    requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
+    skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
+    tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    nodeEnv,
+    allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
+  };
 }
-function pinKey(orgId, principal, slug) {
-  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+function localOrigin(host, port) {
+  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizePrefix(value) {
+  return value.replace(/^\/+|\/+$/g, "") || "skills/artifacts";
 }
 
-class PostgresSkillsStore {
-  backend = { kind: "postgres", durable: true, label: "postgres" };
-  sql;
-  constructor(databaseUrl) {
-    const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
-  }
-  async verifyConnectivity() {
-    try {
-      await this.sql`SELECT 1`;
-    } catch (error) {
-      throw new Error("cannot reach the configured Postgres database. The server will not start with an unreachable " + "database rather than fall back to another backend and silently split your data across two stores. " + `Check HASNA_SKILLS_DATABASE_URL and that the instance is accepting connections. Driver reported: ${connectionFailureSummary(error)}`);
-    }
-    try {
-      await this.sql`SELECT 1 FROM api_keys LIMIT 0`;
-    } catch (error) {
-      throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
-    }
-    await this.backfillLegacyRevisions();
+// src/server/handlers.ts
+import { createHash as createHash5 } from "crypto";
+
+// src/server/store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
+function resolvePoolMax(env = process.env) {
+  const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
+}
+var LOG_SEQUENCE_ATTEMPTS = 12;
+function createArtifactId() {
+  return artifactId();
+}
+async function createStore(options = {}) {
+  const target = resolveDatabaseTarget(options.databaseUrl);
+  const store = instantiateStore(target, options.sqlite);
+  await store.verifyConnectivity?.();
+  if (options.bootstrapApiKey && store.ensureBootstrapApiKey) {
+    await store.ensureBootstrapApiKey(options.bootstrapApiKey);
   }
-  async backfillLegacyRevisions() {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
-    for (const row of rows) {
-      const record = rowToSkill(row);
-      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
-    }
+  return store;
+}
+function instantiateStore(target, sqliteOptions) {
+  switch (target.kind) {
+    case "postgres":
+      return new PostgresSkillsStore(target.url);
+    case "sqlite":
+      return new SqliteSkillsStore(target.path, sqliteOptions);
+    case "memory":
+      return new MemorySkillsStore;
   }
-  async close() {
-    await this.sql.close?.();
+}
+
+class MemorySkillsStore {
+  backend = { kind: "memory", durable: false, label: "memory (non-durable)" };
+  apiKeys = new Map;
+  runs = new Map;
+  logs = new Map;
+  artifacts = new Map;
+  idempotency = new Map;
+  skills = new Map;
+  bundles = new Map;
+  versions = new Map;
+  pins = new Map;
+  constructor(apiKeys = []) {
+    for (const key of apiKeys)
+      this.addApiKey(key.token, key.principal);
   }
-  async ensureBootstrapApiKey(token, principal) {
+  addApiKey(token, principal) {
     const resolved = publicPrincipal(principal);
-    await this.sql`
-      INSERT INTO organizations (id, slug, name)
-      VALUES (${resolved.orgId}, ${resolved.orgSlug}, ${resolved.orgName})
-      ON CONFLICT (id) DO UPDATE SET slug = EXCLUDED.slug, name = EXCLUDED.name
-    `;
-    await this.sql`
-      INSERT INTO users (id, email, name)
-      VALUES (${resolved.userId}, ${resolved.email}, ${resolved.email})
-      ON CONFLICT (id) DO UPDATE SET email = EXCLUDED.email
-    `;
-    await this.sql`
-      INSERT INTO organization_members (org_id, user_id, role)
-      VALUES (${resolved.orgId}, ${resolved.userId}, ${resolved.role})
-      ON CONFLICT (org_id, user_id) DO UPDATE SET role = EXCLUDED.role
-    `;
-    await this.sql`
-      INSERT INTO api_keys (id, org_id, user_id, name, key_hash, scopes_json)
-      VALUES (${resolved.apiKeyId}, ${resolved.orgId}, ${resolved.userId}, ${"bootstrap"}, ${hashApiKey(token)}, ${JSON.stringify(resolved.scopes)}::jsonb)
-      ON CONFLICT (key_hash) DO NOTHING
-    `;
+    this.apiKeys.set(hashApiKey(token), resolved);
+    return resolved;
   }
-  async authenticateApiKeyHash(hash) {
-    const rows = await this.sql`
-      SELECT k.id AS api_key_id, k.scopes_json, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
-             u.id AS user_id, u.email, m.role
-      FROM api_keys k
-      JOIN organizations o ON o.id = k.org_id
-      JOIN users u ON u.id = k.user_id
-      LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
-      WHERE k.key_hash = ${hash} AND k.revoked_at IS NULL
-      LIMIT 1
-    `;
-    const row = rows[0];
-    if (!row)
-      return null;
-    await this.sql`UPDATE api_keys SET last_used_at = now() WHERE id = ${String(row.api_key_id)}`;
-    return {
-      apiKeyId: String(row.api_key_id),
-      orgId: String(row.org_id),
-      orgSlug: String(row.org_slug),
-      orgName: String(row.org_name),
-      userId: String(row.user_id),
-      email: String(row.email),
-      role: typeof row.role === "string" ? row.role : "member",
-      scopes: parseJsonArray(row.scopes_json)
-    };
+  async ensureBootstrapApiKey(token, principal) {
+    this.addApiKey(token, principal);
   }
-  async withContext(orgId, worker, fn) {
-    return this.sql.begin(async (tx) => {
-      await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
-      await tx`SELECT set_config('app.skills_claim_context', ${worker ? "worker" : ""}, true)`;
-      return await fn(tx);
-    });
+  async authenticateApiKeyHash(hash) {
+    return this.apiKeys.get(hash) ?? null;
   }
   async createRun(input) {
-    return this.withContext(input.principal.orgId, false, async (tx) => {
-      if (input.idempotencyKey) {
-        const existing = await tx`
-          SELECT * FROM skills_runs
-          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
-          LIMIT 1
-        `;
-        if (existing[0])
-          return rowToRun(existing[0]);
-      }
-      const id = runId();
-      const rows = await tx`
-        INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
-        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
-        RETURNING *
-      `;
-      return rowToRun(rows[0]);
-    });
+    const idemKey = input.idempotencyKey?.trim();
+    const idemMapKey = idemKey ? `${input.principal.orgId}:${idemKey}` : undefined;
+    if (idemMapKey) {
+      const existing = this.idempotency.get(idemMapKey);
+      if (existing)
+        return this.runs.get(existing);
+    }
+    const now = nowIso();
+    const run = {
+      id: runId(),
+      orgId: input.principal.orgId,
+      userId: input.principal.userId,
+      skill: input.slug,
+      requestedSlug: input.slug,
+      status: "queued",
+      input: input.input,
+      args: input.args,
+      ...idemKey ? { idempotencyKey: idemKey } : {},
+      correlationId: randomUUID3(),
+      costCents: 0,
+      leaseGeneration: 0,
+      createdAt: now
+    };
+    this.runs.set(run.id, run);
+    this.logs.set(run.id, []);
+    this.artifacts.set(run.id, []);
+    if (idemMapKey)
+      this.idempotency.set(idemMapKey, run.id);
+    return run;
   }
   async listRuns(principal, limit) {
-    return this.withContext(principal.orgId, false, async (tx) => {
-      const rows = await tx`
-        SELECT * FROM skills_runs WHERE org_id = ${principal.orgId}
-        ORDER BY created_at DESC LIMIT ${normalizeLimit(limit)}
-      `;
-      return rows.map(rowToRun);
-    });
+    return Array.from(this.runs.values()).filter((run) => run.orgId === principal.orgId).sort((a3, b3) => b3.createdAt.localeCompare(a3.createdAt)).slice(0, normalizeLimit(limit));
   }
   async getRun(principal, runId2) {
-    return this.withContext(principal.orgId, false, async (tx) => {
-      const rows = await tx`
-        SELECT * FROM skills_runs WHERE id = ${runId2} AND org_id = ${principal.orgId} LIMIT 1
-      `;
-      return rows[0] ? rowToRun(rows[0]) : null;
-    });
+    const run = this.runs.get(runId2);
+    return run && run.orgId === principal.orgId ? run : null;
   }
-  async claimNextRun(input) {
-    return this.withContext(null, true, async (tx) => {
-      const rows = await tx`
-        UPDATE skills_runs
-        SET status = ${"running"}, started_at = COALESCE(started_at, now()), locked_by = ${input.workerId}, locked_at = now(),
-            lease_generation = lease_generation + 1
-        WHERE id = (
-          SELECT id FROM skills_runs
-          WHERE status IN (${"queued"}, ${"retrying"})
-          ORDER BY created_at ASC
-          FOR UPDATE SKIP LOCKED
-          LIMIT 1
-        )
-        RETURNING *
-      `;
-      return rows[0] ? rowToRun(rows[0]) : null;
-    });
+  async claimNextRun(_input) {
+    const run = Array.from(this.runs.values()).filter((candidate) => candidate.status === "queued" || candidate.status === "retrying").sort((a3, b3) => a3.createdAt.localeCompare(b3.createdAt))[0];
+    if (!run)
+      return null;
+    return this.patchRun(run.id, { status: "running", startedAt: run.startedAt ?? nowIso(), leaseGeneration: run.leaseGeneration + 1 });
   }
   async updateRun(runId2, patch) {
-    return this.withContext(null, true, async (tx) => {
-      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
-      if (!current[0])
-        return null;
-      const run = { ...rowToRun(current[0]), ...patch };
-      const rows = await tx`
-        UPDATE skills_runs
-        SET status = ${run.status},
-            output_type = ${run.outputType ?? null},
-            output_preview = ${run.outputPreview ?? null},
-            error_code = ${run.errorCode ?? null},
-            error_message = ${run.errorMessage ?? null},
-            started_at = ${run.startedAt ?? null},
-            completed_at = ${run.completedAt ?? null}
-        WHERE id = ${runId2}
-        RETURNING *
-      `;
-      return rows[0] ? rowToRun(rows[0]) : null;
-    });
+    return this.patchRun(runId2, patch);
   }
   async transitionRun(runId2, patch, expectedGeneration) {
-    return this.withContext(null, true, async (tx) => {
-      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
-      if (!current[0])
-        return null;
-      const stored = rowToRun(current[0]);
-      if (stored.leaseGeneration !== expectedGeneration) {
-        throw new StaleLeaseGenerationError(runId2, expectedGeneration, stored.leaseGeneration, stored.status);
-      }
-      const run = { ...stored, ...patch };
-      const rows = await tx`
-        UPDATE skills_runs
-        SET status = ${run.status},
-            output_type = ${run.outputType ?? null},
-            output_preview = ${run.outputPreview ?? null},
-            error_code = ${run.errorCode ?? null},
-            error_message = ${run.errorMessage ?? null},
-            started_at = ${run.startedAt ?? null},
-            completed_at = ${run.completedAt ?? null},
-            lease_generation = ${run.leaseGeneration}
-        WHERE id = ${runId2} AND lease_generation = ${expectedGeneration}
-        RETURNING *
-      `;
-      return rows[0] ? rowToRun(rows[0]) : null;
-    });
+    const run = this.runs.get(runId2);
+    if (!run)
+      return null;
+    if (run.leaseGeneration !== expectedGeneration) {
+      throw new StaleLeaseGenerationError(runId2, expectedGeneration, run.leaseGeneration, run.status);
+    }
+    return this.patchRun(runId2, patch);
   }
   async appendLog(runId2, orgId, level, message) {
-    let lastError;
-    for (let attempt = 0;attempt < LOG_SEQUENCE_ATTEMPTS; attempt += 1) {
-      try {
-        const rows = await this.withContext(orgId, true, async (tx) => {
-          return await tx`
-            INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message)
-            VALUES (
-              ${runId2},
-              ${orgId},
-              (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ${runId2}),
-              ${level},
-              ${message}
-            )
-            RETURNING *
-          `;
-        });
-        return rowToLog(rows[0]);
-      } catch (error) {
-        if (!isUniqueViolation(error))
-          throw error;
-        lastError = error;
-      }
-    }
-    throw lastError;
+    const entries = this.logs.get(runId2) ?? [];
+    const log = { runId: runId2, sequence: entries.length + 1, level, message, createdAt: nowIso() };
+    entries.push(log);
+    this.logs.set(runId2, entries);
+    return log;
   }
   async listLogs(principal, runId2) {
-    return this.withContext(principal.orgId, false, async (tx) => {
-      const rows = await tx`
-        SELECT l.* FROM skills_run_logs l
-        JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ${principal.orgId}
-        WHERE l.run_id = ${runId2}
-        ORDER BY l.sequence ASC
-      `;
-      return rows.map(rowToLog);
-    });
+    const run = await this.getRun(principal, runId2);
+    return run ? [...this.logs.get(runId2) ?? []] : [];
   }
   async addArtifact(artifact) {
-    return this.withContext(artifact.orgId, true, async (tx) => {
-      const rows = await tx`
-        INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at)
-        VALUES (${artifact.id}, ${artifact.runId}, ${artifact.orgId}, ${artifact.fileName}, ${artifact.relativePath}, ${artifact.contentType}, ${artifact.byteSize}, ${artifact.sha256}, ${artifact.storageKind}, ${artifact.storageKey ?? null}, ${artifact.bodyText ?? null}, ${artifact.visibility}, ${artifact.expiresAt ?? null})
-        RETURNING *
-      `;
-      return rowToArtifact(rows[0]);
-    });
+    const next = { ...artifact, createdAt: nowIso() };
+    const artifacts = this.artifacts.get(artifact.runId) ?? [];
+    artifacts.push(next);
+    this.artifacts.set(artifact.runId, artifacts);
+    return next;
   }
   async listArtifacts(principal, runId2) {
-    return this.withContext(principal.orgId, false, async (tx) => {
-      const rows = await tx`
-        SELECT a.* FROM skills_artifacts a
-        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
-        WHERE a.run_id = ${runId2}
-        ORDER BY a.created_at ASC
-      `;
-      return rows.map(rowToArtifact);
-    });
+    const run = await this.getRun(principal, runId2);
+    return run ? [...this.artifacts.get(runId2) ?? []] : [];
   }
-  async getArtifact(principal, runId2, artifactId2) {
-    return this.withContext(principal.orgId, false, async (tx) => {
-      const rows = await tx`
-        SELECT a.* FROM skills_artifacts a
-        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
-        WHERE a.run_id = ${runId2} AND a.id = ${artifactId2}
-        LIMIT 1
-      `;
-      return rows[0] ? rowToArtifact(rows[0]) : null;
-    });
+  async getArtifact(principal, runId2, id) {
+    const artifacts = await this.listArtifacts(principal, runId2);
+    return artifacts.find((artifact) => artifact.id === id) ?? null;
   }
   async publishSkill(input) {
-    const orgId = input.principal.orgId;
-    return await this.sql.begin(async (tx) => {
-      const previousRows = await tx`
-        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
-        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
-      `;
-      const previous = previousRows[0];
-      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
-      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
-      const tombstoned = previous?.tombstoned_at != null;
-      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
-      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+    const key = skillKey(input.principal.orgId, input.slug);
+    const now = nowIso();
+    const previous = this.skills.get(key);
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
+    const versionSha = input.bundle?.sha256 ?? previous?.bundleSha256;
+    if (input.version && versionSha) {
+      const existing = this.versions.get(versionKey(input.principal.orgId, input.slug, input.version));
+      if (existing && existing.bundleSha256 !== versionSha) {
+        throw new SkillVersionExistsError(input.slug, input.version, existing.bundleSha256, versionSha);
       }
-      const carriedSha = input.bundle?.sha256 ?? previousSha;
-      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
-      const revisionId = revisionIdOfRecord({
+    }
+    if (input.bundle) {
+      const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
+      this.bundles.set(bundleMapKey, {
+        ...this.bundles.get(bundleMapKey),
+        ...input.bundle,
+        orgId: input.principal.orgId,
+        createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
+      });
+    }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
+    const record = {
+      orgId: input.principal.orgId,
+      slug: input.slug,
+      displayName: input.displayName,
+      description: input.description,
+      category: input.category,
+      tags: [...input.tags],
+      source: input.source,
+      kind: input.kind,
+      ...input.version ? { version: input.version } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
+      publishedByUserId: input.principal.userId,
+      createdAt: previous?.createdAt ?? now,
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1
+    };
+    this.skills.set(key, record);
+    if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
+      this.versions.set(versionKey(input.principal.orgId, input.slug, input.version), {
+        orgId: input.principal.orgId,
         slug: input.slug,
-        displayName: input.displayName,
-        description: input.description,
-        category: input.category,
-        tags: input.tags,
-        source: input.source,
-        kind: input.kind,
-        ...input.version ? { version: input.version } : {},
-        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
-        ...carriedSha ? { bundleSha256: carriedSha } : {},
-        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+        version: input.version,
+        bundleSha256: versionSha,
+        bundleByteSize: input.bundle?.byteSize ?? previous?.bundleByteSize ?? 0,
+        storageKind: input.versionStorage?.storageKind ?? "db",
+        ...input.versionStorage?.storageKey ? { storageKey: input.versionStorage.storageKey } : {},
+        manifest: { ...input.versionManifest ?? {} },
+        ...input.principal.userId ? { publishedByUserId: input.principal.userId } : {},
+        createdAt: now
       });
-      if (input.bundle) {
-        await tx`
-          INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
-          VALUES (${orgId}, ${input.bundle.sha256}, ${input.bundle.byteSize}, ${input.bundle.contentType}, ${input.bundle.storageKind}, ${input.bundle.storageKey ?? null}, ${input.bundle.bytes ?? null})
-          ON CONFLICT (org_id, sha256) DO UPDATE SET
-            byte_size = EXCLUDED.byte_size,
-            content_type = EXCLUDED.content_type,
-            storage_kind = EXCLUDED.storage_kind,
-            storage_key = EXCLUDED.storage_key,
-            body_blob = EXCLUDED.body_blob
-        `;
-      }
-      const rows = await tx`
-        INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
-        VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
-                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
-                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
-        ON CONFLICT (org_id, slug) DO UPDATE SET
-          display_name = EXCLUDED.display_name,
-          description = EXCLUDED.description,
-          category = EXCLUDED.category,
-          tags_json = EXCLUDED.tags_json,
-          source = EXCLUDED.source,
-          kind = EXCLUDED.kind,
-          version = EXCLUDED.version,
-          skill_md = EXCLUDED.skill_md,
-          -- COALESCE: see the SQLite twin. A bundle-less publish is a metadata update,
-          -- not an instruction to discard the stored tarball.
-          bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
-          bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
-          published_by_user_id = EXCLUDED.published_by_user_id,
-          revision_id = EXCLUDED.revision_id,
-          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
-          -- the update path the ACTUAL row's counter is the truth (it may have advanced
-          -- since the pre-read, which is exactly what the WHERE guard below detects).
-          revision_number = skills_registry.revision_number + 1,
-          tombstoned_at = NULL,
-          tombstone_purge_after = NULL,
-          updated_at = EXCLUDED.updated_at
-        WHERE skills_registry.tombstoned_at IS NOT NULL
-           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
-        RETURNING *
-      `;
-      if (!rows[0]) {
-        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
-        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
-      }
-      if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
-        await tx`
-          DELETE FROM skills_bundles
-          WHERE org_id = ${orgId} AND sha256 = ${previousSha}
-            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
-        `;
-      }
-      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
-      for (const tag of input.tags) {
-        if (!tag.trim())
-          continue;
-        await tx`
-          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
-          ON CONFLICT DO NOTHING
-        `;
-      }
-      return rowToSkill(rows[0]);
-    });
+    }
+    if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
+      this.collectOrphanBundle(input.principal.orgId, previous.bundleSha256);
+    }
+    return record;
+  }
+  async listSkillVersions(principal, slug) {
+    return Array.from(this.versions.values()).filter((v2) => v2.orgId === principal.orgId && v2.slug === slug).sort((a3, b3) => b3.createdAt.localeCompare(a3.createdAt) || b3.version.localeCompare(a3.version));
+  }
+  async getSkillVersion(principal, slug, version2) {
+    const found = this.versions.get(versionKey(principal.orgId, slug, version2));
+    return found && found.orgId === principal.orgId ? found : null;
   }
   async listSkills(principal) {
-    await this.purgeExpiredTombstones(principal);
-    const rows = await this.sql`
-      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
-    `;
-    return rows.map(rowToSkill);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async getSkill(principal, slug) {
-    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
-    return rows[0] ? rowToSkill(rows[0]) : null;
+    const skill = this.skills.get(skillKey(principal.orgId, slug));
+    return skill && skill.orgId === principal.orgId ? skill : null;
   }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
@@ -34611,1142 +35276,838 @@ class PostgresSkillsStore {
     if (expectedRevisionId !== current.revisionId) {
       throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
     }
-    const next = { ...current, ...patch };
-    return await this.sql.begin(async (tx) => {
-      const revisionId = revisionIdOfRecord(next);
-      const updated = await tx`
-        UPDATE skills_registry
-        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
-            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
-            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
-        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
-        RETURNING *
-      `;
-      if (!updated[0]) {
-        const nowRows = await tx`
-          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
-        `;
-        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
-          const currentId = String(nowRows[0].revision_id);
-          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
-        }
-        return null;
-      }
-      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
-      for (const tag of next.tags) {
-        if (!tag.trim())
-          continue;
-        await tx`
-          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
-          ON CONFLICT DO NOTHING
-        `;
-      }
-      return rowToSkill(updated[0]);
-    });
-  }
-  async deleteSkill(principal, slug, tombstoneWindowMs) {
-    return await this.sql.begin(async (tx) => {
-      const existingRows = await tx`
-        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
-      `;
-      if (!existingRows[0])
-        return null;
-      if (existingRows[0].tombstoned_at != null) {
-        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
-        return rowToSkill(rows2[0]);
-      }
-      const rows = await tx`
-        UPDATE skills_registry
-        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
-        WHERE org_id = ${principal.orgId} AND slug = ${slug}
-        RETURNING *
-      `;
-      return rows[0] ? rowToSkill(rows[0]) : null;
-    });
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
+      return null;
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
+    this.skills.set(skillKey(principal.orgId, slug), next);
+    return next;
+  }
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
+    const current = await this.getSkill(principal, slug);
+    if (!current)
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next);
+      return next;
+    }
+    return current;
   }
   async purgeExpiredTombstones(principal) {
-    return await this.sql.begin(async (tx) => {
-      const expiredRows = await tx`
-        SELECT * FROM skills_registry
-        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
-      `;
-      if (!expiredRows.length)
-        return [];
-      const purged = [];
-      for (const row of expiredRows) {
-        const record = rowToSkill(row);
-        await tx`
-          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
-        `;
-        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
-        await tx`
-          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
-        `;
-        if (record.bundleSha256) {
-          await tx`
-            DELETE FROM skills_bundles
-            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
-              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
-          `;
-        }
-        purged.push(record);
-      }
-      return purged;
-    });
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
   }
   async getSkillBundle(principal, sha256) {
-    const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
-    return rows[0] ? rowToSkillBundle(rows[0]) : null;
+    const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
+    return bundle && bundle.orgId === principal.orgId ? bundle : null;
   }
   async pinSkill(principal, slug, metadata = {}) {
-    const rows = await this.sql`
-      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
-      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
-      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
-        pinned_at = now(),
-        metadata_json = EXCLUDED.metadata_json
-      RETURNING *
-    `;
-    return rowToPin(rows[0]);
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
   }
   async unpinSkill(principal, slug) {
-    const rows = await this.sql`
-      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
-      RETURNING 1 AS present
-    `;
-    return rows.length > 0;
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
   }
   async listPins(principal) {
-    const rows = await this.sql`
-      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
-    `;
-    return rows.map(rowToPin);
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
-    const rows = await this.sql`
-      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
-    `;
-    return rows.map((row) => String(row.tag));
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId)
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
+  collectOrphanBundle(orgId, sha256) {
+    const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256) || Array.from(this.versions.values()).some((v2) => v2.orgId === orgId && v2.bundleSha256 === sha256);
+    if (!referenced)
+      this.bundles.delete(skillKey(orgId, sha256));
+  }
+  patchRun(runId2, patch) {
+    const run = this.runs.get(runId2);
+    if (!run)
+      return null;
+    const next = { ...run, ...patch };
+    this.runs.set(runId2, next);
+    return next;
+  }
+}
+function skillKey(orgId, slug) {
+  return `${orgId.length}:${orgId}:${slug}`;
+}
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
+function versionKey(orgId, slug, version2) {
+  return `${orgId.length}:${orgId}:${slug.length}:${slug}:${version2}`;
+}
+
+class PostgresSkillsStore {
+  backend = { kind: "postgres", durable: true, label: "postgres" };
+  sql;
+  constructor(databaseUrl) {
+    const bunWithSql = Bun;
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+  }
+  async verifyConnectivity() {
+    try {
+      await this.sql`SELECT 1`;
+    } catch (error) {
+      throw new Error("cannot reach the configured Postgres database. The server will not start with an unreachable " + "database rather than fall back to another backend and silently split your data across two stores. " + `Check HASNA_SKILLS_DATABASE_URL and that the instance is accepting connections. Driver reported: ${connectionFailureSummary(error)}`);
+    }
+    try {
+      await this.sql`SELECT 1 FROM api_keys LIMIT 0`;
+    } catch (error) {
+      throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
+    }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
+  }
+  async close() {
+    await this.sql.close?.();
+  }
+  async ensureBootstrapApiKey(token, principal) {
+    const resolved = publicPrincipal(principal);
+    await this.sql`
+      INSERT INTO organizations (id, slug, name)
+      VALUES (${resolved.orgId}, ${resolved.orgSlug}, ${resolved.orgName})
+      ON CONFLICT (id) DO UPDATE SET slug = EXCLUDED.slug, name = EXCLUDED.name
+    `;
+    await this.sql`
+      INSERT INTO users (id, email, name)
+      VALUES (${resolved.userId}, ${resolved.email}, ${resolved.email})
+      ON CONFLICT (id) DO UPDATE SET email = EXCLUDED.email
+    `;
+    await this.sql`
+      INSERT INTO organization_members (org_id, user_id, role)
+      VALUES (${resolved.orgId}, ${resolved.userId}, ${resolved.role})
+      ON CONFLICT (org_id, user_id) DO UPDATE SET role = EXCLUDED.role
+    `;
+    await this.sql`
+      INSERT INTO api_keys (id, org_id, user_id, name, key_hash, scopes_json)
+      VALUES (${resolved.apiKeyId}, ${resolved.orgId}, ${resolved.userId}, ${"bootstrap"}, ${hashApiKey(token)}, ${JSON.stringify(resolved.scopes)}::jsonb)
+      ON CONFLICT (key_hash) DO NOTHING
+    `;
+  }
+  async authenticateApiKeyHash(hash) {
     const rows = await this.sql`
-      SELECT s.* FROM skills_registry s
-      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
-      ORDER BY s.slug ASC
+      SELECT k.id AS api_key_id, k.scopes_json, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
+             u.id AS user_id, u.email, m.role
+      FROM api_keys k
+      JOIN organizations o ON o.id = k.org_id
+      JOIN users u ON u.id = k.user_id
+      LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
+      WHERE k.key_hash = ${hash} AND k.revoked_at IS NULL
+      LIMIT 1
     `;
-    return rows.map(rowToSkill);
+    const row = rows[0];
+    if (!row)
+      return null;
+    await this.sql`UPDATE api_keys SET last_used_at = now() WHERE id = ${String(row.api_key_id)}`;
+    return {
+      apiKeyId: String(row.api_key_id),
+      orgId: String(row.org_id),
+      orgSlug: String(row.org_slug),
+      orgName: String(row.org_name),
+      userId: String(row.user_id),
+      email: String(row.email),
+      role: typeof row.role === "string" ? row.role : "member",
+      scopes: parseJsonArray(row.scopes_json)
+    };
+  }
+  async withContext(orgId, worker, fn) {
+    return this.sql.begin(async (tx) => {
+      await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
+      await tx`SELECT set_config('app.skills_claim_context', ${worker ? "worker" : ""}, true)`;
+      return await fn(tx);
+    });
+  }
+  async createRun(input) {
+    return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
+      const rows = await tx`
+        INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID3()})
+        RETURNING *
+      `;
+      return rowToRun(rows[0]);
+    });
+  }
+  async listRuns(principal, limit) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT * FROM skills_runs WHERE org_id = ${principal.orgId}
+        ORDER BY created_at DESC LIMIT ${normalizeLimit(limit)}
+      `;
+      return rows.map(rowToRun);
+    });
   }
-  async listPinsByTag(principal, tag) {
-    await this.purgeExpiredTombstones(principal);
-    const rows = await this.sql`
-      SELECT p.* FROM skills_pins p
-      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
-      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
-      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
-        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
-      ORDER BY p.slug ASC
-    `;
-    return rows.map(rowToPin);
+  async getRun(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT * FROM skills_runs WHERE id = ${runId2} AND org_id = ${principal.orgId} LIMIT 1
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
   }
-  async listPublishedSlugs(principal) {
-    const rows = await this.sql`
-      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
-    `;
-    return rows.map((row) => String(row.slug));
+  async claimNextRun(input) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${"running"}, started_at = COALESCE(started_at, now()), locked_by = ${input.workerId}, locked_at = now(),
+            lease_generation = lease_generation + 1
+        WHERE id = (
+          SELECT id FROM skills_runs
+          WHERE status IN (${"queued"}, ${"retrying"})
+          ORDER BY created_at ASC
+          FOR UPDATE SKIP LOCKED
+          LIMIT 1
+        )
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
   }
-  async collectOrphanBundle(orgId, sha256) {
-    await this.sql`
-      DELETE FROM skills_bundles
-      WHERE org_id = ${orgId} AND sha256 = ${sha256}
-        AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${sha256})
-    `;
+  async updateRun(runId2, patch) {
+    return this.withContext(null, true, async (tx) => {
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      if (!current[0])
+        return null;
+      const run = { ...rowToRun(current[0]), ...patch };
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${run.status},
+            output_type = ${run.outputType ?? null},
+            output_preview = ${run.outputPreview ?? null},
+            error_code = ${run.errorCode ?? null},
+            error_message = ${run.errorMessage ?? null},
+            started_at = ${run.startedAt ?? null},
+            completed_at = ${run.completedAt ?? null}
+        WHERE id = ${runId2}
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
   }
-}
-var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
-function isUniqueViolation(error) {
-  const code = error?.code;
-  if (code === "23505" || code === 23505)
-    return true;
-  const message = error instanceof Error ? error.message : String(error);
-  return /duplicate key value violates unique constraint/i.test(message);
-}
-function connectionFailureSummary(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return message.replace(/[a-z][a-z0-9+.-]*:\/\/\S*/gi, "<redacted-url>").split(`
-`)[0].slice(0, 200);
-}
-
-// src/server/redaction.ts
-var SECRET_PATTERNS = [
-  /\bsk-[A-Za-z0-9_-]{8,}\b/g,
-  /\bsk_[A-Za-z0-9_-]{8,}\b/g,
-  /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
-  /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
-  /\bnpm_[A-Za-z0-9_]{8,}\b/g,
-  /\bAKIA[A-Z0-9]{12,}\b/g,
-  /\bAIza[A-Za-z0-9_-]{10,}\b/g,
-  /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
-  /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
-];
-function redactForClient(value) {
-  const text = typeof value === "string" ? value : JSON.stringify(value);
-  return SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, "credential"), text).replace(/\s+$/g, "").slice(0, 20000);
-}
-
-// src/server/handlers.ts
-var DETERMINISTIC_TEXT_HANDLERS = new Set([
-  "audio-transcript-pack",
-  "transcript",
-  "video-highlight-pack"
-]);
-async function executeRun(store, run, storage = new ArtifactStorage) {
-  try {
-    await store.appendLog(run.id, run.orgId, "info", redactForClient(`starting run ${run.skill}`));
-    if (!DETERMINISTIC_TEXT_HANDLERS.has(run.skill)) {
-      await store.appendLog(run.id, run.orgId, "warn", `${run.skill} has no provider-free handler yet`);
-      return await failRun(store, run, "HANDLER_UNAVAILABLE", "This deployment has no safe provider-free handler for that skill yet.");
-    }
-    const text = extractText(run);
-    if (!text.trim()) {
-      return await failRun(store, run, "INVALID_INPUT", "Provide transcript text with input.transcript, input.text, --text, --source, or positional text.");
-    }
-    const title = extractOption(run.args, "--title") || stringInput(run.input, "title") || "Skills run";
-    const summary = summarize(text);
-    const artifacts = [
-      textArtifact(run, "transcript.md", `# ${title}
-
-${text.trim()}
-`),
-      textArtifact(run, "summary.md", `# Summary
-
-${summary}
-`),
-      textArtifact(run, "show-notes.md", `# Show Notes
-
-- ${summary}
-- Generated by the skills deterministic worker.
-`),
-      textArtifact(run, "clips.csv", `start,end,title,summary
-00:00,00:30,"Opening","${csv(summary)}"
-`),
-      textArtifact(run, "manifest.json", JSON.stringify({
-        runId: run.id,
-        skill: run.skill,
-        requestedSlug: run.requestedSlug,
-        generatedAt: new Date().toISOString(),
-        artifacts: ["transcript.md", "summary.md", "show-notes.md", "clips.csv"]
-      }, null, 2) + `
-`, "application/json")
-    ];
-    for (const artifact of artifacts) {
-      await store.addArtifact(await storage.materialize(run, artifact.meta, artifact.body));
+  async transitionRun(runId2, patch, expectedGeneration) {
+    return this.withContext(null, true, async (tx) => {
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      if (!current[0])
+        return null;
+      const stored = rowToRun(current[0]);
+      if (stored.leaseGeneration !== expectedGeneration) {
+        throw new StaleLeaseGenerationError(runId2, expectedGeneration, stored.leaseGeneration, stored.status);
+      }
+      const run = { ...stored, ...patch };
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${run.status},
+            output_type = ${run.outputType ?? null},
+            output_preview = ${run.outputPreview ?? null},
+            error_code = ${run.errorCode ?? null},
+            error_message = ${run.errorMessage ?? null},
+            started_at = ${run.startedAt ?? null},
+            completed_at = ${run.completedAt ?? null},
+            lease_generation = ${run.leaseGeneration}
+        WHERE id = ${runId2} AND lease_generation = ${expectedGeneration}
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
+  }
+  async appendLog(runId2, orgId, level, message) {
+    let lastError;
+    for (let attempt = 0;attempt < LOG_SEQUENCE_ATTEMPTS; attempt += 1) {
+      try {
+        const rows = await this.withContext(orgId, true, async (tx) => {
+          return await tx`
+            INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message)
+            VALUES (
+              ${runId2},
+              ${orgId},
+              (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ${runId2}),
+              ${level},
+              ${message}
+            )
+            RETURNING *
+          `;
+        });
+        return rowToLog(rows[0]);
+      } catch (error) {
+        if (!isUniqueViolation(error))
+          throw error;
+        lastError = error;
+      }
     }
-    await store.appendLog(run.id, run.orgId, "info", `generated ${artifacts.length} artifacts`);
-    return await completeRun(store, run, summary);
-  } catch (error) {
-    return await failRun(store, run, "WORKER_ERROR", redactForClient(error.message));
+    throw lastError;
   }
-}
-function textArtifact(run, relativePath, bodyText, contentType = relativePath.endsWith(".json") ? "application/json" : "text/markdown; charset=utf-8") {
-  const bytes = new TextEncoder().encode(bodyText);
-  return {
-    meta: {
-      id: createArtifactId(),
-      runId: run.id,
-      orgId: run.orgId,
-      fileName: relativePath.split("/").pop() || relativePath,
-      relativePath,
-      contentType,
-      byteSize: bytes.byteLength,
-      sha256: createHash5("sha256").update(bytes).digest("hex"),
-      visibility: "private"
-    },
-    body: { relativePath, bodyText, contentType }
-  };
-}
-async function completeRun(store, run, preview) {
-  const next = await fencedTransition(store, run, {
-    status: "succeeded",
-    outputType: "artifact_bundle",
-    outputPreview: preview,
-    completedAt: new Date().toISOString()
-  });
-  return next ?? run;
-}
-async function failRun(store, run, code, message) {
-  try {
-    await store.appendLog(run.id, run.orgId, "error", message);
-  } catch {}
-  const next = await fencedTransition(store, run, {
-    status: "failed",
-    errorCode: code,
-    errorMessage: message,
-    completedAt: new Date().toISOString()
-  });
-  return next ?? run;
-}
-async function fencedTransition(store, run, patch) {
-  if (!store.transitionRun)
-    return store.updateRun(run.id, patch);
-  const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
-  if (!next) {
-    try {
-      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
-    } catch {}
+  async listLogs(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT l.* FROM skills_run_logs l
+        JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ${principal.orgId}
+        WHERE l.run_id = ${runId2}
+        ORDER BY l.sequence ASC
+      `;
+      return rows.map(rowToLog);
+    });
   }
-  return next;
-}
-function extractText(run) {
-  return stringInput(run.input, "transcript") || stringInput(run.input, "text") || extractOption(run.args, "--text") || extractOption(run.args, "--source") || run.args.filter((arg) => !arg.startsWith("--")).join(" ");
-}
-function stringInput(input, key) {
-  const value = input[key];
-  return typeof value === "string" && value.trim() ? value : undefined;
-}
-function extractOption(args, flag) {
-  for (let i3 = 0;i3 < args.length; i3++) {
-    const arg = args[i3];
-    if (arg === flag && args[i3 + 1])
-      return args[i3 + 1];
-    if (arg.startsWith(`${flag}=`))
-      return arg.slice(flag.length + 1);
+  async addArtifact(artifact) {
+    return this.withContext(artifact.orgId, true, async (tx) => {
+      const rows = await tx`
+        INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at)
+        VALUES (${artifact.id}, ${artifact.runId}, ${artifact.orgId}, ${artifact.fileName}, ${artifact.relativePath}, ${artifact.contentType}, ${artifact.byteSize}, ${artifact.sha256}, ${artifact.storageKind}, ${artifact.storageKey ?? null}, ${artifact.bodyText ?? null}, ${artifact.visibility}, ${artifact.expiresAt ?? null})
+        RETURNING *
+      `;
+      return rowToArtifact(rows[0]);
+    });
   }
-  return;
-}
-function summarize(text) {
-  const normalized = redactForClient(text).replace(/\s+/g, " ").trim();
-  if (normalized.length <= 220)
-    return normalized;
-  return `${normalized.slice(0, 217)}...`;
-}
-function csv(value) {
-  return value.replace(/"/g, '""');
-}
-
-// src/lib/registry-data/development-tools.ts
-var DEVELOPMENT_TOOLS_SKILLS = [
-  {
-    name: "repo-onboarding-report",
-    displayName: "Repo Onboarding Report",
-    description: "Generate repository onboarding packages with architecture maps, setup guides, risk registers, and first-week plans",
-    category: "Development Tools",
-    kind: "instruction",
-    tags: ["repository", "onboarding", "architecture", "developer-tools"]
-  },
-  {
-    name: "security-audit-report",
-    displayName: "Security Audit Report",
-    description: "Generate application security hardening reports covering auth, secrets, headers, webhooks, RLS, permissions, dependencies, and prioritized fixes",
-    category: "Development Tools",
-    kind: "instruction",
-    tags: ["security", "audit", "hardening", "rls", "webhooks"]
-  },
-  {
-    name: "performance-audit-report",
-    displayName: "Performance Audit Report",
-    description: "Generate performance audit reports with metrics, findings, budgets, remediation plans, and manifest artifacts",
-    category: "Development Tools",
-    kind: "instruction",
-    tags: ["performance", "audit", "latency", "budget", "web"]
-  },
-  {
-    name: "migration-plan-pack",
-    displayName: "Migration Plan Pack",
-    description: "Generate migration plans for frameworks, libraries, databases, infrastructure, and architecture upgrades with risk matrix, checklist, rollout, and test strategy artifacts",
-    category: "Development Tools",
-    kind: "instruction",
-    tags: ["migration", "upgrade", "planning", "frameworks", "databases"]
-  },
-  {
-    name: "test-suite-generator",
-    displayName: "Test Suite Generator",
-    description: "Generate runnable API, unit, and browser test suite packages with coverage notes",
-    category: "Development Tools",
-    kind: "instruction",
-    tags: ["testing", "qa", "api-tests", "browser-tests", "coverage"]
-  },
-  {
-    name: "api-test-suite",
-    displayName: "API Test Suite",
-    description: "Generate and run API test suites with comprehensive endpoint coverage",
-    category: "Development Tools",
-    tags: ["api", "testing", "automation", "qa"]
-  },
-  {
-    name: "api-docs-portal",
-    displayName: "API Docs Portal",
-    description: "Generate static API documentation portals from OpenAPI specs, route lists, and endpoint examples",
-    category: "Development Tools",
-    tags: ["api", "documentation", "openapi", "portal"]
-  },
-  {
-    name: "codefix",
-    displayName: "Code Fix",
-    description: "Code quality CLI for auto-linting, formatting, fixing, and style enforcement",
-    category: "Development Tools",
-    tags: ["code", "linting", "formatting", "quality"]
-  },
-  {
-    name: "commitpush",
-    displayName: "Commit Push",
-    description: "Create logical commits from repo changes and push directly to the main branch",
-    category: "Development Tools",
-    tags: ["git", "commit", "push", "automation"]
-  },
-  {
-    name: "commitpushpr",
-    displayName: "Commit Push PR",
-    description: "Create logical commits, push a feature branch, and open a GitHub pull request",
-    category: "Development Tools",
-    dependencies: ["commitpush"],
-    tags: ["git", "commit", "pull-request", "github", "automation"]
-  },
-  {
-    name: "database-explorer",
-    displayName: "Database Explorer",
-    description: "Explore and query databases with an interactive interface",
-    category: "Development Tools",
-    tags: ["database", "explorer", "sql", "query"]
-  },
-  {
-    name: "diff-viewer",
-    displayName: "Diff Viewer",
-    description: "View and analyze file differences with visual diff representation",
-    category: "Development Tools",
-    tags: ["diff", "comparison", "files", "code-review"]
-  },
-  {
-    name: "generate-api-client",
-    displayName: "Generate API Client",
-    description: "Generate API client libraries from OpenAPI specs and documentation",
-    category: "Development Tools",
-    tags: ["api", "client", "code-generation", "openapi"]
-  },
-  {
-    name: "generate-dockerfile",
-    displayName: "Generate Dockerfile",
-    description: "Generate optimized Dockerfiles for containerized applications",
-    category: "Development Tools",
-    tags: ["docker", "dockerfile", "containers", "devops"]
-  },
-  {
-    name: "generate-env",
-    displayName: "Generate Env",
-    description: "Generate environment variable files from templates and configurations",
-    category: "Development Tools",
-    tags: ["env", "environment", "configuration", "dotenv"]
-  },
-  {
-    name: "generate-sitemap",
-    displayName: "Generate Sitemap",
-    description: "Generate XML sitemaps for websites and web applications",
-    category: "Development Tools",
-    tags: ["sitemap", "seo", "xml", "web"]
-  },
-  {
-    name: "hook",
-    displayName: "Hook",
-    description: "Claude Code hook creation skill - generates standardized hook scaffolds",
-    category: "Development Tools",
-    tags: ["hooks", "scaffold", "claude-code", "automation"]
-  },
-  {
-    name: "http-server",
-    displayName: "HTTP Server",
-    description: "Spin up local HTTP servers for development and testing",
-    category: "Development Tools",
-    tags: ["http", "server", "development", "local"]
-  },
-  {
-    name: "lorem-generator",
-    displayName: "Lorem Generator",
-    description: "Generate placeholder text in various styles and lengths",
-    category: "Development Tools",
-    tags: ["lorem", "placeholder", "text", "mockup"]
-  },
-  {
-    name: "managemcp",
-    displayName: "Manage MCP",
-    description: "Manage MCP servers with install, configure, and lifecycle operations",
-    category: "Development Tools",
-    tags: ["mcp", "management", "servers", "configuration"]
-  },
-  {
-    name: "markdown-validator",
-    displayName: "Markdown Validator",
-    description: "Validate markdown files for syntax, links, and formatting issues",
-    category: "Development Tools",
-    tags: ["markdown", "validation", "linting", "formatting"]
-  },
-  {
-    name: "monitor",
-    displayName: "Monitor",
-    description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
-    category: "Development Tools",
-    tags: ["monitoring", "mcp", "processes", "operations"]
-  },
-  {
-    name: "regex-tester",
-    displayName: "Regex Tester",
-    description: "Test and validate regular expressions with sample inputs",
-    category: "Development Tools",
-    tags: ["regex", "testing", "validation", "patterns"]
-  },
-  {
-    name: "scancommitpr",
-    displayName: "Scan Commit PR",
-    description: "Scan repo changes, group into logical commits, push, and optionally create a PR",
-    category: "Development Tools",
-    dependencies: ["scancommitpush"],
-    tags: ["git", "commit", "push", "pull-request", "automation"]
-  },
-  {
-    name: "scancommitpush",
-    displayName: "Scan Commit Push",
-    description: "Scan repo changes, group into logical commits with conventional messages, and push to GitHub",
-    category: "Development Tools",
-    tags: ["git", "commit", "push", "automation"]
-  },
-  {
-    name: "security-audit",
-    displayName: "Security Audit",
-    description: "Perform security audits on codebases and infrastructure configurations",
-    category: "Development Tools",
-    tags: ["security", "audit", "vulnerabilities", "scanning"]
-  },
-  {
-    name: "tmux-session",
-    displayName: "Tmux Session",
-    description: "Create and manage grouped tmux sessions with workspace-aware naming and window layout guidance",
-    category: "Development Tools",
-    tags: ["tmux", "terminal", "sessions", "workspace"]
-  },
-  {
-    name: "validate-config",
-    displayName: "Validate Config",
-    description: "Validate configuration files for syntax and schema compliance",
-    category: "Development Tools",
-    tags: ["config", "validation", "schema", "linting"]
-  },
-  {
-    name: "oss-app-two-backend-storage",
-    displayName: "OSS App Two-Backend Storage",
-    description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
-    category: "Development Tools",
-    tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
-    kind: "instruction"
-  },
-  {
-    name: "session-inject-monitor",
-    displayName: "Session Inject Monitor",
-    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
-    category: "Development Tools",
-    tags: ["monitor", "session", "injection", "automation", "wake"],
-    kind: "instruction"
+  async listArtifacts(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
+        WHERE a.run_id = ${runId2}
+        ORDER BY a.created_at ASC
+      `;
+      return rows.map(rowToArtifact);
+    });
   }
-];
-
-// src/lib/registry-data/business-marketing.ts
-var BUSINESS_MARKETING_SKILLS = [
-  {
-    name: "customer-feedback-report",
-    displayName: "Customer Feedback Report",
-    description: "Generate customer feedback reports with clusters, sentiment, root causes, roadmap recommendations, evidence, and PDF/Markdown artifacts",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["feedback", "customer", "sentiment", "roadmap", "report"]
-  },
-  {
-    name: "pitch-deck",
-    displayName: "Pitch Deck",
-    description: "Generate investor and sales deck packages with slides, speaker notes, design direction, PDF, and PPTX artifacts",
-    category: "Business & Marketing",
-    kind: "instruction",
-    dependencies: ["market-research-report"],
-    tags: ["deck", "presentation", "investor", "sales", "pptx"]
-  },
-  {
-    name: "proposal-pack",
-    displayName: "Proposal Pack",
-    description: "Generate client proposal packages with proposal, statement of work, pricing, timeline, assumptions, cover email, and PDF/Markdown artifacts",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["proposal", "sow", "sales", "pricing", "timeline"]
-  },
-  {
-    name: "seo-content-pack",
-    displayName: "SEO Content Pack",
-    description: "Generate SEO content packages with topic clusters, articles, metadata, internal links, FAQs, and publishing cadence",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["seo", "content", "articles", "metadata"]
-  },
-  {
-    name: "landing-page-pack",
-    displayName: "Landing Page Pack",
-    description: "Generate landing page packages with conversion copy, wireframes, CTA maps, experiments, preview HTML, and implementation notes",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["landing-page", "sales", "copywriting", "conversion"]
-  },
-  {
-    name: "ad-creative-pack",
-    displayName: "Ad Creative Pack",
-    description: "Generate paid ad packages with platform copy, creative concepts, image prompts, audience angles, and test matrices",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["ads", "creative", "marketing", "copywriting"]
-  },
-  {
-    name: "email-sequence",
-    displayName: "Email Sequence",
-    description: "Generate email campaign packages with subject lines, preview text, body copy, segmentation notes, CTA variants, HTML emails, and send plans",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["email", "marketing", "campaign", "copywriting"]
-  },
-  {
-    name: "social-content-calendar",
-    displayName: "Social Content Calendar",
-    description: "Generate social content calendars with daily posts, channel strategy, asset briefs, hooks, publishing schedules, and repurposing maps",
-    category: "Business & Marketing",
-    kind: "instruction",
-    tags: ["social", "content", "calendar", "marketing"]
-  },
-  {
-    name: "one-page-website",
-    displayName: "One Page Website",
-    description: "Generate static one-page website bundles with HTML, CSS, JavaScript, copy, section maps, deploy notes, and manifest",
-    category: "Business & Marketing",
-    tags: ["website", "landing-page", "static-site", "html"]
+  async getArtifact(principal, runId2, artifactId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
+        WHERE a.run_id = ${runId2} AND a.id = ${artifactId2}
+        LIMIT 1
+      `;
+      return rows[0] ? rowToArtifact(rows[0]) : null;
+    });
+  }
+  async publishSkill(input) {
+    const orgId = input.principal.orgId;
+    return await this.sql.begin(async (tx) => {
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      if (input.version && carriedSha) {
+        const existingVersion = await tx`
+          SELECT bundle_sha256 FROM skills_versions WHERE org_id = ${orgId} AND slug = ${input.slug} AND version = ${input.version} LIMIT 1
+        `;
+        const existingSha = existingVersion[0] && typeof existingVersion[0].bundle_sha256 === "string" ? String(existingVersion[0].bundle_sha256) : null;
+        if (existingSha && existingSha !== carriedSha) {
+          throw new SkillVersionExistsError(input.slug, input.version, existingSha, carriedSha);
+        }
+      }
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
+      if (input.bundle) {
+        await tx`
+          INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
+          VALUES (${orgId}, ${input.bundle.sha256}, ${input.bundle.byteSize}, ${input.bundle.contentType}, ${input.bundle.storageKind}, ${input.bundle.storageKey ?? null}, ${input.bundle.bytes ?? null})
+          ON CONFLICT (org_id, sha256) DO UPDATE SET
+            byte_size = EXCLUDED.byte_size,
+            content_type = EXCLUDED.content_type,
+            storage_kind = EXCLUDED.storage_kind,
+            storage_key = EXCLUDED.storage_key,
+            body_blob = EXCLUDED.body_blob
+        `;
+      }
+      const rows = await tx`
+        INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
+        VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
+        ON CONFLICT (org_id, slug) DO UPDATE SET
+          display_name = EXCLUDED.display_name,
+          description = EXCLUDED.description,
+          category = EXCLUDED.category,
+          tags_json = EXCLUDED.tags_json,
+          source = EXCLUDED.source,
+          kind = EXCLUDED.kind,
+          version = EXCLUDED.version,
+          skill_md = EXCLUDED.skill_md,
+          -- COALESCE: see the SQLite twin. A bundle-less publish is a metadata update,
+          -- not an instruction to discard the stored tarball.
+          bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
+          bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
+          published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
+          updated_at = EXCLUDED.updated_at
+        WHERE skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}
+        RETURNING *
+      `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
+      if (input.version && carriedSha) {
+        await tx`
+          INSERT INTO skills_versions (org_id, slug, version, bundle_sha256, bundle_byte_size, storage_kind, storage_key, manifest_json, published_by_user_id)
+          VALUES (${orgId}, ${input.slug}, ${input.version}, ${carriedSha}, ${carriedSize ?? 0}, ${input.versionStorage?.storageKind ?? "db"},
+                  ${input.versionStorage?.storageKey ?? null}, ${JSON.stringify(input.versionManifest ?? {})}::jsonb, ${input.principal.userId})
+          ON CONFLICT (org_id, slug, version) DO NOTHING
+        `;
+      }
+      if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
+        await tx`
+          DELETE FROM skills_bundles
+          WHERE org_id = ${orgId} AND sha256 = ${previousSha}
+            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
+            AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
+        `;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(rows[0]);
+    });
+  }
+  async listSkills(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async getSkill(principal, slug) {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+    return rows[0] ? rowToSkill(rows[0]) : null;
+  }
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const next = { ...current, ...patch };
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next.displayName}, description = ${next.description}, category = ${next.category},
+            tags_json = ${JSON.stringify(next.tags)}::jsonb, kind = ${next.kind}, version = ${next.version ?? null},
+            skill_md = ${next.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
+  }
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
+    return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
+      const rows = await tx`
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
+      `;
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
   }
-];
-
-// src/lib/registry-data/productivity-organization.ts
-var PRODUCTIVITY_ORGANIZATION_SKILLS = [
-  {
-    name: "meeting-pack",
-    displayName: "Meeting Pack",
-    description: "Generate meeting artifact packages with summaries, decisions, action items, follow-up email, timeline, project export, and manifest",
-    category: "Productivity & Organization",
-    kind: "instruction",
-    tags: ["meeting", "summary", "action-items", "decisions"]
-  },
-  {
-    name: "file-organizer",
-    displayName: "File Organizer",
-    description: "Organize files into structured directories based on type, date, or content",
-    category: "Productivity & Organization",
-    tags: ["files", "organization", "sorting", "cleanup"]
-  },
-  {
-    name: "folder-tree",
-    displayName: "Folder Tree",
-    description: "Generate and display folder tree structures for documentation",
-    category: "Productivity & Organization",
-    tags: ["folder", "tree", "structure", "visualization"]
-  },
-  {
-    name: "form-filler",
-    displayName: "Form Filler",
-    description: "Automatically fill out web forms and document templates",
-    category: "Productivity & Organization",
-    tags: ["forms", "automation", "filling", "data-entry"]
-  },
-  {
-    name: "merge-pdfs",
-    displayName: "Merge PDFs",
-    description: "Merge multiple PDF files into a single document",
-    category: "Productivity & Organization",
-    tags: ["pdf", "merge", "documents", "combining"]
-  },
-  {
-    name: "split-pdf",
-    displayName: "Split PDF",
-    description: "Split PDF documents into separate pages or sections",
-    category: "Productivity & Organization",
-    tags: ["pdf", "split", "documents", "pages"]
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+              AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
+      }
+      return purged;
+    });
   }
-];
-
-// src/lib/registry-data/project-management.ts
-var PROJECT_MANAGEMENT_SKILLS = [
-  {
-    name: "businessactivity",
-    displayName: "Business Activity",
-    description: "Business activity, workflow, and ownership management service",
-    category: "Project Management",
-    tags: ["business", "workflow", "activities", "management"]
-  },
-  {
-    name: "implementation",
-    displayName: "Implementation",
-    description: "Create .implementation scaffold for project development tracking",
-    category: "Project Management",
-    tags: ["implementation", "tracking", "scaffold", "project"]
-  },
-  {
-    name: "implementation-plan",
-    displayName: "Implementation Plan",
-    description: "Generate detailed implementation plans with phases and milestones",
-    category: "Project Management",
-    tags: ["implementation", "planning", "milestones", "phases"]
-  },
-  {
-    name: "implementation-todo",
-    displayName: "Implementation Todo",
-    description: "Manage implementation task lists and todo items",
-    category: "Project Management",
-    tags: ["implementation", "todo", "tasks", "tracking"]
-  },
-  {
-    name: "todos-plan",
-    displayName: "Todos Plan",
-    description: "Author, sync, route, and verify Todos plans using Todos CLI plan IDs as source of truth",
-    category: "Project Management",
-    tags: ["todos", "plans", "tasks", "verification", "workflow"]
+  async getSkillBundle(principal, sha256) {
+    const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
+    return rows[0] ? rowToSkillBundle(rows[0]) : null;
   }
-];
-
-// src/lib/registry-data/content-generation.ts
-var CONTENT_GENERATION_SKILLS = [
-  {
-    name: "pdf-generate",
-    displayName: "PDF Generate",
-    description: "Generate PDF documents with rich formatting and layouts",
-    category: "Content Generation",
-    tags: ["pdf", "document", "generation", "formatting"]
-  },
-  {
-    name: "slide-deck-generator",
-    displayName: "Slide Deck Generator",
-    description: "Generate slide decks from briefs, docs, or outlines with PDF, PPTX, speaker notes, and structured slide metadata",
-    category: "Content Generation",
-    tags: ["presentation", "slides", "deck", "documents"]
-  },
-  {
-    name: "generate-qrcode",
-    displayName: "Generate QR Code",
-    description: "Generate QR codes with custom styling and embedded data",
-    category: "Content Generation",
-    tags: ["qrcode", "generation", "encoding", "visual"]
-  },
-  {
-    name: "generate-resume",
-    displayName: "Generate Resume",
-    description: "Generate professional resumes with formatting and content optimization",
-    category: "Content Generation",
-    tags: ["resume", "cv", "career", "generation"]
+  async listSkillVersions(principal, slug) {
+    const rows = await this.sql`
+      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug}
+      ORDER BY created_at DESC, version DESC
+    `;
+    return rows.map((row) => rowToSkillVersion(row));
   }
-];
-
-// src/lib/registry-data/finance-compliance.ts
-var FINANCE_COMPLIANCE_SKILLS = [
-  {
-    name: "contract-review-report",
-    displayName: "Contract Review Report",
-    description: "Generate contract review reports with risk register, clause summary, redline suggestions, negotiation email, and manifest artifacts",
-    category: "Finance & Compliance",
-    kind: "instruction",
-    tags: ["contract", "legal", "review", "risk"]
-  },
-  {
-    name: "invoice",
-    displayName: "Invoice",
-    description: "Generate professional invoices with company management and PDF export",
-    category: "Finance & Compliance",
-    tags: ["invoice", "billing", "pdf", "finance"]
-  },
-  {
-    name: "invoice-reconciliation",
-    displayName: "Invoice Reconciliation",
-    description: "Generate invoice reconciliation reports with matched payments, discrepancies, anomaly notes, summaries, and manifest artifacts",
-    category: "Finance & Compliance",
-    tags: ["invoice", "payments", "reconciliation", "finance"]
+  async getSkillVersion(principal, slug, version2) {
+    const rows = await this.sql`
+      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug} AND version = ${version2} LIMIT 1
+    `;
+    return rows[0] ? rowToSkillVersion(rows[0]) : null;
   }
-];
-
-// src/lib/registry-data/data-analysis.ts
-var DATA_ANALYSIS_SKILLS = [
-  {
-    name: "analyze-data",
-    displayName: "Analyze Data",
-    description: "Data science insights for CSV and JSON datasets with statistical analysis",
-    category: "Data & Analysis",
-    tags: ["data", "analysis", "csv", "json", "statistics"]
-  },
-  {
-    name: "dashboard-builder",
-    displayName: "Dashboard Builder",
-    description: "Build data dashboards with charts, metrics, and visualizations",
-    category: "Data & Analysis",
-    tags: ["dashboard", "visualization", "charts", "metrics"]
-  },
-  {
-    name: "data-anonymizer",
-    displayName: "Data Anonymizer",
-    description: "Anonymize sensitive data in datasets for privacy compliance",
-    category: "Data & Analysis",
-    tags: ["anonymization", "privacy", "data", "compliance"]
-  },
-  {
-    name: "generate-chart",
-    displayName: "Generate Chart",
-    description: "Generate data charts and visualizations from datasets",
-    category: "Data & Analysis",
-    tags: ["charts", "visualization", "data", "graphs"]
-  },
-  {
-    name: "read-csv",
-    displayName: "Read CSV",
-    description: "Parse CSV files into structured JSON with delimiter and encoding detection",
-    category: "Data & Analysis",
-    tags: ["csv", "parsing", "tabular", "data"]
-  },
-  {
-    name: "read-excel",
-    displayName: "Read Excel",
-    description: "Parse XLS and XLSX workbooks into structured JSON with sheet and formatted cell metadata",
-    category: "Data & Analysis",
-    tags: ["excel", "spreadsheet", "xlsx", "data"]
-  },
-  {
-    name: "pdf-to-markdown",
-    displayName: "PDF to Markdown",
-    description: "Convert PDFs into clean markdown with remote extraction and structure cleanup",
-    category: "Data & Analysis",
-    tags: ["pdf", "markdown", "conversion"]
-  },
-  {
-    name: "pdf-to-dataset",
-    displayName: "PDF to Dataset",
-    description: "Extract PDF tables, forms, invoices, and semi-structured content into CSV and JSON datasets",
-    category: "Data & Analysis",
-    tags: ["pdf", "dataset", "csv", "json", "extraction"]
-  },
-  {
-    name: "doc-read",
-    displayName: "Doc Read",
-    description: "Read and extract text from DOCX files with section parsing and metadata extraction",
-    category: "Data & Analysis",
-    tags: ["docx", "reader", "extraction", "word"]
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
   }
-];
-
-// src/lib/registry-data/media-processing.ts
-var MEDIA_PROCESSING_SKILLS = [
-  {
-    name: "video-highlight-pack",
-    displayName: "Video Highlight Pack",
-    description: "Generate video highlight packages with clip plans, captions, thumbnail briefs, chapter markers, social posts, and edit decisions",
-    category: "Media Processing",
-    kind: "instruction",
-    tags: ["video", "highlights", "clips", "captions"]
-  },
-  {
-    name: "compress-video",
-    displayName: "Compress Video",
-    description: "Compress video files while preserving visual quality using ffmpeg",
-    category: "Media Processing",
-    tags: ["video", "compression", "ffmpeg", "optimization"]
-  },
-  {
-    name: "audio-extract",
-    displayName: "Audio Extract",
-    description: "Extract audio tracks from video files with multiple format support",
-    category: "Media Processing",
-    tags: ["audio", "extraction", "video", "conversion"]
-  },
-  {
-    name: "extract-frames",
-    displayName: "Extract Frames",
-    description: "Extract frames from video files at specified intervals or timestamps",
-    category: "Media Processing",
-    tags: ["frames", "video", "extraction", "images"]
-  },
-  {
-    name: "gif-maker",
-    displayName: "GIF Maker",
-    description: "Create animated GIFs from images, videos, or screen recordings",
-    category: "Media Processing",
-    tags: ["gif", "animation", "images", "video"]
-  },
-  {
-    name: "video-downloader",
-    displayName: "Video Downloader",
-    description: "Download videos from various online platforms and services",
-    category: "Media Processing",
-    tags: ["video", "download", "platforms", "media"]
-  },
-  {
-    name: "watermark",
-    displayName: "Watermark",
-    description: "Add watermarks to images and documents for copyright protection",
-    category: "Media Processing",
-    tags: ["watermark", "protection", "copyright", "images"]
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
   }
-];
-
-// src/lib/registry-data/design-branding.ts
-var DESIGN_BRANDING_SKILLS = [
-  {
-    name: "brand-kit",
-    displayName: "Brand Kit",
-    description: "Generate brand kits with logo usage, palette, typography, brand voice, sample applications, Markdown guide, PDF guide, and SVG assets",
-    category: "Design & Branding",
-    kind: "instruction",
-    tags: ["brand", "design", "palette", "typography"]
-  },
-  {
-    name: "brand-assets",
-    displayName: "Brand Assets",
-    description: "Fetch official brand assets from a website or brand name with logos, PNG sizes, palette, typography, source metadata, and manifests",
-    category: "Design & Branding",
-    tags: ["brand", "logo", "assets", "palette", "typography"]
-  },
-  {
-    name: "logo-design",
-    displayName: "Logo Design",
-    description: "Generate multi-variant logo packages with transparent PNGs, vector-style SVGs, usage notes, and manifests",
-    category: "Design & Branding",
-    tags: ["logo", "design", "branding", "identity"]
-  },
-  {
-    name: "generate-favicon",
-    displayName: "Generate Favicon",
-    description: "Generate favicons in multiple sizes and formats for websites",
-    category: "Design & Branding",
-    tags: ["favicon", "icon", "design", "web"]
-  },
-  {
-    name: "product-mockup",
-    displayName: "Product Mockup",
-    description: "Generate product mockup packages with visual variants, prompts, usage notes, and asset metadata",
-    category: "Design & Branding",
-    tags: ["product", "mockup", "visualization", "marketing"]
-  },
-  {
-    name: "siteanalyze",
-    displayName: "Site Analyze",
-    description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
-    category: "Design & Branding",
-    tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
   }
-];
-
-// src/lib/registry-data/web-browser.ts
-var WEB_BROWSER_SKILLS = [
-  {
-    name: "domainpurchase",
-    displayName: "Domain Purchase",
-    description: "Purchase and manage domains via registrar connectors",
-    category: "Web & Browser",
-    tags: ["domain", "purchase", "registrar", "management"]
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
   }
-];
-
-// src/lib/registry-data/research-writing.ts
-var RESEARCH_WRITING_SKILLS = [
-  {
-    name: "blog-article",
-    displayName: "Blog Article",
-    description: "Create SEO-optimized blog article artifact packages",
-    category: "Research & Writing",
-    kind: "instruction",
-    tags: ["blog", "article", "writing", "seo"]
-  },
-  {
-    name: "market-research-report",
-    displayName: "Market Research Report",
-    description: "Generate market research packages with competitor tables, positioning, pricing notes, source notes, and PDF/Markdown artifacts",
-    category: "Research & Writing",
-    kind: "instruction",
-    tags: ["market-research", "competitors", "positioning", "pricing", "report"]
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
   }
-];
-
-// src/lib/registry-data/science-academic.ts
-var SCIENCE_ACADEMIC_SKILLS = [
-  {
-    name: "bio-sequence-tool",
-    displayName: "Bio Sequence Tool",
-    description: "Analyze and manipulate biological sequences including DNA, RNA, and protein data",
-    category: "Science & Academic",
-    tags: ["biology", "dna", "sequence", "bioinformatics"]
-  },
-  {
-    name: "experiment-power-calculator",
-    displayName: "Experiment Power Calculator",
-    description: "Calculate statistical power and sample size for experiments",
-    category: "Science & Academic",
-    tags: ["experiment", "statistics", "power-analysis", "sample-size"]
-  },
-  {
-    name: "latex-table-generator",
-    displayName: "LaTeX Table Generator",
-    description: "Generate formatted LaTeX tables from data for academic papers",
-    category: "Science & Academic",
-    tags: ["latex", "tables", "academic", "formatting"]
-  },
-  {
-    name: "scientific-figure-check",
-    displayName: "Scientific Figure Check",
-    description: "Validate scientific figures for accuracy, formatting, and publication standards",
-    category: "Science & Academic",
-    tags: ["scientific", "figures", "validation", "publishing"]
-  },
-  {
-    name: "statistical-test-selector",
-    displayName: "Statistical Test Selector",
-    description: "Recommend appropriate statistical tests based on data and research questions",
-    category: "Science & Academic",
-    tags: ["statistics", "test-selection", "research", "analysis"]
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
   }
-];
-
-// src/lib/registry-data/education-learning.ts
-var EDUCATION_LEARNING_SKILLS = [];
-
-// src/lib/registry-data/communication.ts
-var COMMUNICATION_SKILLS = [];
-
-// src/lib/registry-data/health-wellness.ts
-var HEALTH_WELLNESS_SKILLS = [];
-
-// src/lib/registry-data/travel-lifestyle.ts
-var TRAVEL_LIFESTYLE_SKILLS = [];
-
-// src/lib/registry-data/event-management.ts
-var EVENT_MANAGEMENT_SKILLS = [];
-
-// src/lib/registry-data/index.ts
-var SKILLS = [
-  ...DEVELOPMENT_TOOLS_SKILLS,
-  ...BUSINESS_MARKETING_SKILLS,
-  ...PRODUCTIVITY_ORGANIZATION_SKILLS,
-  ...PROJECT_MANAGEMENT_SKILLS,
-  ...CONTENT_GENERATION_SKILLS,
-  ...FINANCE_COMPLIANCE_SKILLS,
-  ...DATA_ANALYSIS_SKILLS,
-  ...MEDIA_PROCESSING_SKILLS,
-  ...DESIGN_BRANDING_SKILLS,
-  ...WEB_BROWSER_SKILLS,
-  ...RESEARCH_WRITING_SKILLS,
-  ...SCIENCE_ACADEMIC_SKILLS,
-  ...EDUCATION_LEARNING_SKILLS,
-  ...COMMUNICATION_SKILLS,
-  ...HEALTH_WELLNESS_SKILLS,
-  ...TRAVEL_LIFESTYLE_SKILLS,
-  ...EVENT_MANAGEMENT_SKILLS
-];
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
+  async collectOrphanBundle(orgId, sha256) {
+    await this.sql`
+      DELETE FROM skills_bundles
+      WHERE org_id = ${orgId} AND sha256 = ${sha256}
+        AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${sha256})
+        AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${orgId} AND bundle_sha256 = ${sha256})
+    `;
+  }
+}
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
+function isUniqueViolation(error) {
+  const code = error?.code;
+  if (code === "23505" || code === 23505)
+    return true;
+  const message = error instanceof Error ? error.message : String(error);
+  return /duplicate key value violates unique constraint/i.test(message);
+}
+function connectionFailureSummary(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/[a-z][a-z0-9+.-]*:\/\/\S*/gi, "<redacted-url>").split(`
+`)[0].slice(0, 200);
+}
 
-// src/lib/hosted-skill-set.ts
-var HOSTED_RUNTIMES = new Set(["hosted"]);
-var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
-var HOSTED_METADATA_SET_EMPTY_ERROR = [
-  "The hosted metadata skill set is empty, but the packaging guards that depend on it",
-  "only mean anything while it is non-empty: an empty set makes every one of them pass",
-  "vacuously and silently removes the protection that keeps hosted implementation source",
-  "out of the published package.",
-  "",
-  "If emptying the set is intentional (every hosted skill was deleted or converted to a",
-  "runnable in-repo skill), retire the derived guards in the SAME change \u2014 do not let them",
-  "stay green and empty."
-].join(`
-`);
-var SLUG = "[^,{}/]+";
-var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/src$`);
-var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
+// src/server/redaction.ts
+var SECRET_PATTERNS = [
+  /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bsk_[A-Za-z0-9_-]{8,}\b/g,
+  /\bgh[opsur]_[A-Za-z0-9_]{8,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{8,}\b/g,
+  /\bnpm_[A-Za-z0-9_]{8,}\b/g,
+  /\bAKIA[A-Z0-9]{12,}\b/g,
+  /\bAIza[A-Za-z0-9_-]{10,}\b/g,
+  /\b[A-Z0-9_]*(?:API_KEY|SECRET|TOKEN|PASSWORD|DATABASE_URL)[A-Z0-9_]*\s*[:=]\s*[^ \n\r\t]+/gi,
+  /\bhttps?:\/\/[^ \n\r\t]+X-Amz-Signature=[^ \n\r\t]+/gi
+];
+function redactForClient(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, "credential"), text).replace(/\s+$/g, "").slice(0, 20000);
+}
 
-// src/lib/skill-validation.ts
-var RESERVED_SKILL_ENTRIES = new Set([
-  ".env",
-  ".npmrc",
-  ".pypirc",
-  ".netrc",
-  "id_rsa",
-  "id_ed25519"
-]);
-var KNOWN_TOP_LEVEL_ENTRIES = new Set([
-  ".claude",
-  ".env.example",
-  ".gitignore",
-  ".skills",
-  "CLAUDE.md",
-  "AGENTS.md",
-  "LICENSE",
-  "PROJECT_OVERVIEW.md",
-  "QUICKSTART.md",
-  "README.md",
-  "SKILL.md",
-  "api-docs-list.json",
-  "auth.ts",
-  "bun.lock",
-  "bunfig.toml",
-  "data",
-  "dist",
-  "examples",
-  "exports",
-  "http-client.ts",
-  "index.ts",
-  "install.sh",
-  "installer.ts",
-  "logs",
-  "node_modules",
-  "package.json",
-  "scripts",
-  "skill-install.ts",
-  "skill.json",
-  "src",
-  "tests",
-  "references",
-  "assets",
-  "tsconfig.json",
-  "vision.ts"
+// src/server/handlers.ts
+var DETERMINISTIC_TEXT_HANDLERS = new Set([
+  "audio-transcript-pack",
+  "transcript",
+  "video-highlight-pack"
 ]);
-var VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private", "private-hosted", "upstream", "extension"]);
+async function executeRun(store, run, storage = new ArtifactStorage) {
+  try {
+    await store.appendLog(run.id, run.orgId, "info", redactForClient(`starting run ${run.skill}`));
+    if (!DETERMINISTIC_TEXT_HANDLERS.has(run.skill)) {
+      await store.appendLog(run.id, run.orgId, "warn", `${run.skill} has no provider-free handler yet`);
+      return await failRun(store, run, "HANDLER_UNAVAILABLE", "This deployment has no safe provider-free handler for that skill yet.");
+    }
+    const text = extractText(run);
+    if (!text.trim()) {
+      return await failRun(store, run, "INVALID_INPUT", "Provide transcript text with input.transcript, input.text, --text, --source, or positional text.");
+    }
+    const title = extractOption(run.args, "--title") || stringInput(run.input, "title") || "Skills run";
+    const summary = summarize(text);
+    const artifacts = [
+      textArtifact(run, "transcript.md", `# ${title}
 
-// src/lib/skill-hash.ts
-var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+${text.trim()}
+`),
+      textArtifact(run, "summary.md", `# Summary
 
-// src/lib/portable-skills-files.ts
-var ANY_SEGMENT_COPY_EXCLUDES = new Set([
-  ".git",
-  ".DS_Store",
-  ".system",
-  "node_modules"
-]);
-var FIRST_SEGMENT_COPY_EXCLUDES = new Set([
-  "dist",
-  "build",
-  ".turbo"
-]);
-// src/lib/portable-skills.ts
-var OFFICIAL_SKILL_NAMES = new Set(SKILLS.map((skill) => skill.name));
-// src/lib/installer.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, rmSync } from "fs";
-import { dirname as dirname5, join as join6 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
-function findSkillsDir() {
-  let dir = __dirname2;
-  for (let i3 = 0;i3 < 5; i3++) {
-    const candidate = join6(dir, "skills");
-    if (existsSync3(candidate) && !dir.includes(".skills"))
-      return candidate;
-    dir = dirname5(dir);
+${summary}
+`),
+      textArtifact(run, "show-notes.md", `# Show Notes
+
+- ${summary}
+- Generated by the skills deterministic worker.
+`),
+      textArtifact(run, "clips.csv", `start,end,title,summary
+00:00,00:30,"Opening","${csv(summary)}"
+`),
+      textArtifact(run, "manifest.json", JSON.stringify({
+        runId: run.id,
+        skill: run.skill,
+        requestedSlug: run.requestedSlug,
+        generatedAt: new Date().toISOString(),
+        artifacts: ["transcript.md", "summary.md", "show-notes.md", "clips.csv"]
+      }, null, 2) + `
+`, "application/json")
+    ];
+    for (const artifact of artifacts) {
+      await store.addArtifact(await storage.materialize(run, artifact.meta, artifact.body));
+    }
+    await store.appendLog(run.id, run.orgId, "info", `generated ${artifacts.length} artifacts`);
+    return await completeRun(store, run, summary);
+  } catch (error) {
+    return await failRun(store, run, "WORKER_ERROR", redactForClient(error.message));
   }
-  return join6(__dirname2, "..", "skills");
 }
-var SKILLS_DIR = findSkillsDir();
-
-// src/server/skills-api.ts
-var MAX_SKILL_MD_BYTES = 512000;
-var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
-var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
+function textArtifact(run, relativePath, bodyText, contentType = relativePath.endsWith(".json") ? "application/json" : "text/markdown; charset=utf-8") {
+  const bytes = new TextEncoder().encode(bodyText);
+  return {
+    meta: {
+      id: createArtifactId(),
+      runId: run.id,
+      orgId: run.orgId,
+      fileName: relativePath.split("/").pop() || relativePath,
+      relativePath,
+      contentType,
+      byteSize: bytes.byteLength,
+      sha256: createHash5("sha256").update(bytes).digest("hex"),
+      visibility: "private"
+    },
+    body: { relativePath, bodyText, contentType }
+  };
+}
+async function completeRun(store, run, preview) {
+  const next = await fencedTransition(store, run, {
+    status: "succeeded",
+    outputType: "artifact_bundle",
+    outputPreview: preview,
+    completedAt: new Date().toISOString()
+  });
+  return next ?? run;
+}
+async function failRun(store, run, code, message) {
+  try {
+    await store.appendLog(run.id, run.orgId, "error", message);
+  } catch {}
+  const next = await fencedTransition(store, run, {
+    status: "failed",
+    errorCode: code,
+    errorMessage: message,
+    completedAt: new Date().toISOString()
+  });
+  return next ?? run;
+}
+async function fencedTransition(store, run, patch) {
+  if (!store.transitionRun)
+    return store.updateRun(run.id, patch);
+  const next = await store.transitionRun(run.id, patch, run.leaseGeneration);
+  if (!next) {
+    try {
+      await store.appendLog(run.id, run.orgId, "warn", `late write rejected: run no longer owned at lease_generation ${run.leaseGeneration}`);
+    } catch {}
+  }
+  return next;
+}
+function extractText(run) {
+  return stringInput(run.input, "transcript") || stringInput(run.input, "text") || extractOption(run.args, "--text") || extractOption(run.args, "--source") || run.args.filter((arg) => !arg.startsWith("--")).join(" ");
+}
+function stringInput(input, key) {
+  const value = input[key];
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+function extractOption(args, flag) {
+  for (let i3 = 0;i3 < args.length; i3++) {
+    const arg = args[i3];
+    if (arg === flag && args[i3 + 1])
+      return args[i3 + 1];
+    if (arg.startsWith(`${flag}=`))
+      return arg.slice(flag.length + 1);
+  }
+  return;
+}
+function summarize(text) {
+  const normalized = redactForClient(text).replace(/\s+/g, " ").trim();
+  if (normalized.length <= 220)
+    return normalized;
+  return `${normalized.slice(0, 217)}...`;
+}
+function csv(value) {
+  return value.replace(/"/g, '""');
+}
 
 // src/server/app.ts
 function assertDurableStore(store, config) {
@@ -35774,6 +36135,26 @@ async function runWorkerOnce(store, workerId = `worker_${randomUUID4().slice(0,
   return true;
 }
 if (import.meta.main) {
+  const EARLY_ARGV = process.argv.slice(2);
+  if (EARLY_ARGV.includes("--version") || EARLY_ARGV.includes("-V")) {
+    console.log(package_default.version);
+    process.exit(0);
+  }
+  if (EARLY_ARGV.includes("--help") || EARLY_ARGV.includes("-h")) {
+    console.log(`Usage: skills-worker [options]
+
+Drains @hasna/skills runs from the store.
+
+Options:
+  -V, --version  output the version number
+  -h, --help     display help for command
+      --once     process exactly one run, then exit
+
+Environment:
+  HASNA_SKILLS_WORKER_ID       Worker identity (default: worker_<random>)
+  HASNA_SKILLS_WORKER_IDLE_MS  Idle pause between polls (default: 1000)`);
+    process.exit(0);
+  }
   const config = resolveServerConfig();
   const store = await createStore({ databaseUrl: config.databaseUrl, bootstrapApiKey: config.bootstrapApiKey });
   assertDurableStore(store, config);
@@ -35794,13 +36175,13 @@ if (import.meta.main) {
       console.error(`worker ${workerId}: claim/execute failed (${consecutiveErrors} in a row):`, error.message);
       if (once)
         process.exit(1);
-      await new Promise((resolve) => setTimeout(resolve, Math.min(pause * consecutiveErrors, 30000)));
+      await new Promise((resolve2) => setTimeout(resolve2, Math.min(pause * consecutiveErrors, 30000)));
       continue;
     }
     if (once)
       process.exit(processed ? 0 : 2);
     if (!processed)
-      await new Promise((resolve) => setTimeout(resolve, pause));
+      await new Promise((resolve2) => setTimeout(resolve2, pause));
   } while (true);
 }
 export {