@hasna/skills 0.10.11 → 0.10.14

package/bin/maintenance.js

@@ -1890,6 +1890,7 @@ var {
 // src/server/maintenance-entry.ts
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "fs";
 import { createHash as createHash3 } from "crypto";
+var {SQL: SQL2 } = globalThis.Bun;
 
 // src/server/execution-grant-store.ts
 import { randomUUID } from "crypto";
@@ -1925,27 +1926,6 @@ class MemoryExecutionGrantStore {
     return structuredClone(value);
   }
 }
-
-class SqliteExecutionGrantStore {
-  db;
-  constructor(db) {
-    this.db = db;
-  }
-  async get(p, id, revision) {
-    return document(revision ? this.db.query("SELECT document_json FROM skills_execution_grant_revisions WHERE org_id=? AND profile_id=? AND revision=?").get(p.orgId, id, revision) : this.db.query("SELECT document_json FROM skills_execution_grants WHERE org_id=? AND profile_id=?").get(p.orgId, id));
-  }
-  async save(p, id, grants, expected) {
-    return this.db.transaction(() => {
-      const value = next(p, id, grants, expected), json = JSON.stringify(value);
-      const row = expected === null ? this.db.query("INSERT INTO skills_execution_grants(org_id,profile_id,revision,document_json) VALUES(?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING document_json").get(p.orgId, id, value.revision, json) : this.db.query("UPDATE skills_execution_grants SET revision=?,document_json=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING document_json").get(value.revision, json, p.orgId, id, expected);
-      if (!row)
-        return null;
-      this.db.query("INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) VALUES(?,?,?,?)").run(p.orgId, id, value.revision, json);
-      return document(row);
-    })();
-  }
-}
-
 class PostgresExecutionGrantStore {
   sql;
   constructor(sql) {
@@ -1963,7 +1943,7 @@ class PostgresExecutionGrantStore {
 }
 
 // src/server/store.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // src/server/selection-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -2037,44 +2017,6 @@ class MemorySkillSelectionStore {
     return structuredClone(next2);
   }
 }
-
-class SqliteSkillSelectionStore {
-  db;
-  constructor(db) {
-    this.db = db;
-  }
-  async profilesReferencingSkill(p, slug) {
-    const rows = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(p.orgId);
-    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
-  }
-  async getProfile(p, id) {
-    const row = this.db.query("SELECT * FROM skills_profiles WHERE org_id=? AND profile_id=?").get(p.orgId, id);
-    return row ? profile(row) : null;
-  }
-  async saveProfile(p, id, selected, expected) {
-    return this.db.transaction(() => {
-      for (const selection of [...selected].sort((a, b) => a.slug.localeCompare(b.slug))) {
-        const skill = this.db.query("SELECT lifecycle FROM skills_registry WHERE org_id=? AND slug=?").get(p.orgId, selection.slug);
-        if (skill?.lifecycle === "archived")
-          return null;
-      }
-      const revision = randomUUID2(), timestamp = new Date().toISOString();
-      const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p.orgId, id, expected);
-      return row ? profile(row) : null;
-    }).immediate();
-  }
-  async getStationState(p, id) {
-    const row = this.db.query("SELECT * FROM skills_station_state WHERE org_id=? AND actor_id=? AND station_id=?").get(p.orgId, p.userId, id);
-    return row ? state(row) : null;
-  }
-  async saveStationState(p, id, input) {
-    const row = this.db.query(`INSERT INTO skills_station_state(org_id,actor_id,station_id,profile_id,profile_revision,selections_json,applied_at)
-      SELECT ?,?,?,?,?,?,? WHERE EXISTS(SELECT 1 FROM skills_profiles WHERE org_id=? AND profile_id=? AND revision=?)
-      ON CONFLICT(org_id,actor_id,station_id) DO UPDATE SET profile_id=excluded.profile_id,profile_revision=excluded.profile_revision,selections_json=excluded.selections_json,applied_at=excluded.applied_at RETURNING *`).get(p.orgId, p.userId, id, input.profileId, input.profileRevision, JSON.stringify(input.selections), new Date().toISOString(), p.orgId, input.profileId, input.profileRevision);
-    return row ? state(row) : null;
-  }
-}
-
 class PostgresSkillSelectionStore {
   sql;
   constructor(sql) {
@@ -2193,159 +2135,15 @@ function publicPrincipal(partial = {}) {
   };
 }
 
-// src/server/database-url.ts
-import { isAbsolute, join as join2 } from "path";
-import { fileURLToPath } from "url";
-
-// src/lib/config.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync } from "fs";
-
 // src/lib/retired-settings.ts
 var RETIRED_CONFIG_KEY_REASONS = {
   mode: "Deployment modes were removed: a Skills client either resolves a credential " + "or it does not, and that is the whole of it.",
   apiUrl: "The service address is no longer kept in this app's config file: it is read from " + "HASNA_SKILLS_API_URL, then the macOS Keychain item hasna.credentials.skills.api-url, " + "then ~/.hasna/skills/config/credentials, then the fleet gateway."
 };
-
-// src/lib/app-home.ts
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join, resolve } from "path";
-import { homedir as pathsResolverHomedir } from "os";
-import { join as pathsResolverJoin } from "path";
-var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
-var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function pathsResolverAssertApp(app) {
-  if (typeof app !== "string" || app.length === 0) {
-    throw new TypeError("paths: app must be a non-empty string");
-  }
-  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
-    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
-  }
-}
-function pathsResolverDataBaseDir(options) {
-  const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_DATA_ENV];
-  if (typeof override === "string" && override.length > 0)
-    return override;
-  const home = options.home ?? pathsResolverHomedir();
-  const platform = options.platform ?? process.platform;
-  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
-}
-function dataDir(options) {
-  pathsResolverAssertApp(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
-  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
-}
-var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
-var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
-var SKILLS_HOME_ENV = "SKILLS_HOME";
-var DEFAULT_SQLITE_FILENAME = "server.db";
-var GLOBAL_CONFIG_FILENAME = "config.json";
-function effectiveHome() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
-}
-function legacyDataRoot() {
-  return join(effectiveHome(), ".hasna", "skills");
-}
-function resolverDataRoot(home = effectiveHome(), env) {
-  return dataDir({ app: "skills", home, env });
-}
-function adoptResolverDataRoot(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
-  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
-    return true;
-  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
-}
-function exactDataRoot() {
-  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
-    const dir = process.env[key]?.trim();
-    if (dir)
-      return resolve(dir);
-  }
-  return;
-}
-function getDataRoot() {
-  const exact = exactDataRoot();
-  if (exact)
-    return exact;
-  const resolved = resolverDataRoot();
-  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
-}
-// src/lib/config.ts
-function getDataDir() {
-  const root = getDataRoot();
-  try {
-    mkdirSync(root, { recursive: true });
-  } catch {}
-  return root;
-}
-
 // src/server/database-url.ts
-var DEFAULT_SQLITE_FILENAME2 = "server.db";
-var SQLITE_MEMORY_PATH = ":memory:";
 var POSTGRES_SCHEMES = new Set(["postgres", "postgresql"]);
 var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
 var MEMORY_SCHEMES = new Set(["memory"]);
-var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
-function defaultSqlitePath() {
-  return join2(getDataDir(), DEFAULT_SQLITE_FILENAME2);
-}
-function resolveDatabaseTarget(raw) {
-  const value = raw?.trim();
-  if (!value) {
-    const path = defaultSqlitePath();
-    return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
-  }
-  if (value === SQLITE_MEMORY_PATH) {
-    return { kind: "sqlite", path: SQLITE_MEMORY_PATH, durable: false, label: "sqlite (in-memory)" };
-  }
-  const schemeMatch = value.match(/^([a-z][a-z0-9+.-]+):/i);
-  const scheme = schemeMatch?.[1]?.toLowerCase();
-  if (scheme && POSTGRES_SCHEMES.has(scheme)) {
-    return { kind: "postgres", url: value, durable: true, label: "postgres" };
-  }
-  if (scheme && MEMORY_SCHEMES.has(scheme)) {
-    return { kind: "memory", durable: false, label: "memory (non-durable)" };
-  }
-  if (scheme && SQLITE_SCHEMES.has(scheme)) {
-    const path = sqlitePathFromUrl(value, scheme);
-    return path === SQLITE_MEMORY_PATH ? { kind: "sqlite", path, durable: false, label: "sqlite (in-memory)" } : { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
-  }
-  if (scheme) {
-    throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
-  }
-  if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute(value) ? value : join2(process.cwd(), value);
-    return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
-  }
-  throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
-}
-function sqlitePathFromUrl(value, scheme) {
-  const rest = value.slice(scheme.length + 1).replace(/[?#].*$/, "");
-  if (rest.startsWith(SQLITE_MEMORY_PATH))
-    return SQLITE_MEMORY_PATH;
-  if (rest === "" || rest === "//") {
-    throw new Error(`"${value}" names no database file. Give a path (${scheme}:///var/lib/skills/server.db), ` + `or ":memory:" if a non-durable database is genuinely what you want. ` + "An empty path here usually means an unset variable in a templated URL.");
-  }
-  if (rest.startsWith("//")) {
-    if (!rest.startsWith("///")) {
-      const authority = rest.slice(2).split("/")[0];
-      throw new Error(`"${value}" has a host ("${authority}") where a path was expected. Remote SQLite files are not a thing; ` + `for an absolute path use ${scheme}:///${rest.slice(2)}, and for a relative one use ${scheme}:${rest.slice(2)}.`);
-    }
-    if (scheme === "file") {
-      try {
-        return fileURLToPath(new URL(value));
-      } catch {}
-    }
-    return rest.slice(2).replace(/^\/\/+/, "/");
-  }
-  return isAbsolute(rest) ? rest : join2(process.cwd(), rest);
-}
-function looksLikeSqlitePath(value) {
-  if (value.includes("/"))
-    return true;
-  return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
-}
 
 // src/server/rows.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -2856,803 +2654,6 @@ function revisionIdOfRecord(record) {
   return revisionIdOf(record);
 }
 
-// src/server/sqlite-store.ts
-import { Database } from "bun:sqlite";
-import { randomUUID as randomUUID4 } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
-
-// src/server/migrations-dir.ts
-import { existsSync as existsSync3 } from "fs";
-import { dirname, join as join3 } from "path";
-var MIGRATION_DIALECTS = ["postgres", "sqlite"];
-var MAX_WALK_UP = 6;
-function findMigrationsRoot(startDirs = defaultStartDirs()) {
-  for (const start of startDirs) {
-    let dir = start;
-    for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate = join3(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync3(join3(candidate, dialect))))
-        return candidate;
-      const parent = dirname(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
-  }
-  return null;
-}
-function resolveMigrationsDir(dialect, root = findMigrationsRoot()) {
-  if (!root) {
-    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
-  }
-  const dir = join3(root, dialect);
-  if (!existsSync3(dir)) {
-    throw new Error(`migrations directory not found: ${dir}`);
-  }
-  return dir;
-}
-function defaultStartDirs() {
-  const dirs = [import.meta.dir];
-  const cwd = process.cwd();
-  if (cwd && cwd !== import.meta.dir)
-    dirs.push(cwd);
-  return dirs;
-}
-
-// src/server/sqlite-store.ts
-var CLAIM_ATTEMPTS = 8;
-var CLAIMABLE_STATUSES = ["queued", "retrying"];
-var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
-var LAST_USED_RESOLUTION_MS = 60000;
-
-class SqliteSkillsStore {
-  get selectionStore() {
-    return new SqliteSkillSelectionStore(this.db);
-  }
-  get executionGrantStore() {
-    return new SqliteExecutionGrantStore(this.db);
-  }
-  backend;
-  db;
-  closed = false;
-  constructor(path = SQLITE_MEMORY_PATH, options = {}) {
-    const inMemory = path === SQLITE_MEMORY_PATH;
-    if (!inMemory)
-      mkdirSync2(dirname2(path), { recursive: true });
-    this.db = openDatabase(path);
-    this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
-    if (!inMemory)
-      enableWalMode(this.db);
-    this.db.exec("PRAGMA foreign_keys = ON");
-    this.db.exec("PRAGMA synchronous = NORMAL");
-    if (options.migrate !== false) {
-      applySqliteMigrations(this.db, options.migrationsDir);
-    }
-    this.backfillLegacyRevisions();
-    this.backend = {
-      kind: "sqlite",
-      durable: !inMemory,
-      label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
-    };
-  }
-  backfillLegacyRevisions() {
-    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
-    for (const row of rows) {
-      const record = rowToSkill(row);
-      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
-        revisionIdOfRecord(record),
-        record.orgId,
-        record.slug
-      ]);
-    }
-  }
-  get database() {
-    return this.db;
-  }
-  async close() {
-    if (this.closed)
-      return;
-    this.closed = true;
-    this.db.close(false);
-  }
-  async ensureBootstrapApiKey(token, principal) {
-    const resolved = publicPrincipal(principal);
-    this.db.transaction(() => {
-      this.db.run(`INSERT INTO organizations (id, slug, name) VALUES (?, ?, ?)
-         ON CONFLICT (id) DO UPDATE SET slug = excluded.slug, name = excluded.name`, [resolved.orgId, resolved.orgSlug, resolved.orgName]);
-      this.db.run(`INSERT INTO users (id, email, name) VALUES (?, ?, ?)
-         ON CONFLICT (id) DO UPDATE SET email = excluded.email`, [resolved.userId, resolved.email, resolved.email]);
-      this.db.run(`INSERT INTO organization_members (org_id, user_id, role) VALUES (?, ?, ?)
-         ON CONFLICT (org_id, user_id) DO UPDATE SET role = excluded.role`, [resolved.orgId, resolved.userId, resolved.role]);
-      this.db.run(`INSERT INTO api_keys (id, org_id, user_id, name, key_hash, scopes_json)
-         VALUES (?, ?, ?, ?, ?, ?)
-         ON CONFLICT (key_hash) DO NOTHING`, [resolved.apiKeyId, resolved.orgId, resolved.userId, "bootstrap", hashApiKey(token), JSON.stringify(resolved.scopes)]);
-    })();
-  }
-  async authenticateApiKeyHash(hash) {
-    const row = this.get(`SELECT k.id AS api_key_id, k.scopes_json, k.last_used_at, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
-              u.id AS user_id, u.email, m.role
-       FROM api_keys k
-       JOIN organizations o ON o.id = k.org_id
-       JOIN users u ON u.id = k.user_id
-       LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
-       WHERE k.key_hash = ? AND k.revoked_at IS NULL
-       LIMIT 1`, [hash]);
-    if (!row)
-      return null;
-    const lastUsed = typeof row.last_used_at === "string" ? Date.parse(row.last_used_at) : Number.NaN;
-    if (!Number.isFinite(lastUsed) || Date.now() - lastUsed >= LAST_USED_RESOLUTION_MS) {
-      this.db.run("UPDATE api_keys SET last_used_at = ? WHERE id = ?", [nowIso(), String(row.api_key_id)]);
-    }
-    return {
-      apiKeyId: String(row.api_key_id),
-      orgId: String(row.org_id),
-      orgSlug: String(row.org_slug),
-      orgName: String(row.org_name),
-      userId: String(row.user_id),
-      email: String(row.email),
-      role: typeof row.role === "string" ? row.role : "member",
-      scopes: parseScopes(row.scopes_json)
-    };
-  }
-  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
-    const row = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
-    if (!row)
-      return { kind: "not_found" };
-    const current = parseScopes(row.scopes_json);
-    if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
-      return { kind: "stale", scopes: current };
-    }
-    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
-    const tx = this.db.transaction(() => {
-      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), keyId, actor.orgId, JSON.stringify(expectedScopes)]);
-      if (changed.changes !== 1)
-        return false;
-      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json) VALUES (?, ?, ?, ?, ?, ?, ?)", [actor.orgId, actor.userId, actor.apiKeyId, "api_key_scopes_added", "api_key", keyId, JSON.stringify({ added: addScopes, scopes })]);
-      return true;
-    });
-    if (!tx()) {
-      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
-      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
-    }
-    return { kind: "updated", scopes };
-  }
-  async enrollPublishScopeByOperator(input) {
-    if (!validOperatorScopeEnrollmentInput(input))
-      return { kind: "invalid" };
-    if (input.expectedScopes.includes("skills:publish"))
-      return { kind: "stale", scopes: input.expectedScopes };
-    const operation = this.get("SELECT org_id, target_id FROM skills_audit_events WHERE action = ? AND operator_operation_id = ? LIMIT 1", ["api_key_scopes_added", input.operationId]);
-    if (operation && (String(operation.org_id) !== input.orgId || String(operation.target_id) !== input.keyId))
-      return { kind: "target_mismatch" };
-    const row = this.get("SELECT id, org_id, name, scopes_json FROM api_keys WHERE id = ? AND revoked_at IS NULL LIMIT 1", [input.keyId]);
-    if (!row)
-      return { kind: "not_found" };
-    if (String(row.org_id) !== input.orgId)
-      return { kind: "target_mismatch" };
-    const current = parseScopes(row.scopes_json);
-    const prior = this.get("SELECT metadata_json FROM skills_audit_events WHERE action = ? AND target_type = ? AND target_id = ? AND json_extract(metadata_json, '$.operator_operation_id') = ? LIMIT 1", ["api_key_scopes_added", "api_key", input.keyId, input.operationId]);
-    if (prior) {
-      try {
-        if (JSON.parse(String(prior.metadata_json)).target_manifest_digest !== input.manifestDigest)
-          return { kind: "target_mismatch" };
-      } catch {
-        return { kind: "target_mismatch" };
-      }
-      return current.includes("skills:publish") ? { kind: "already_applied", scopes: current } : { kind: "stale", scopes: current };
-    }
-    if (current.length !== input.expectedScopes.length || current.some((scope, index) => scope !== input.expectedScopes[index]))
-      return { kind: "stale", scopes: current };
-    const scopes = [...current, "skills:publish"];
-    const tx = this.db.transaction(() => {
-      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), input.keyId, input.orgId, JSON.stringify(input.expectedScopes)]);
-      if (changed.changes !== 1)
-        return false;
-      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, operator_operation_id, metadata_json) VALUES (?, NULL, NULL, ?, ?, ?, ?, ?)", [input.orgId, "api_key_scopes_added", "api_key", input.keyId, input.operationId, JSON.stringify({ added: ["skills:publish"], scopes, operator_operation_id: input.operationId, operator_job_id: input.operatorJobId, operator_task_arn: input.operatorTaskArn, target_manifest_digest: input.manifestDigest, station_id: input.stationId })]);
-      return true;
-    });
-    if (!tx()) {
-      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [input.keyId, input.orgId]);
-      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
-    }
-    return { kind: "updated", scopes };
-  }
-  async inspectOperatorScopeTarget(keyId, orgId) {
-    const row = this.get("SELECT org_id, scopes_json FROM api_keys WHERE id = ? AND revoked_at IS NULL LIMIT 1", [keyId]);
-    if (!row)
-      return { kind: "not_found" };
-    if (String(row.org_id) !== orgId)
-      return { kind: "target_mismatch" };
-    return { kind: "found", scopes: parseScopes(row.scopes_json) };
-  }
-  async createRun(input) {
-    if (input.idempotencyKey) {
-      const existing = this.get("SELECT * FROM skills_runs WHERE org_id = ? AND idempotency_key = ? LIMIT 1", [input.principal.orgId, input.idempotencyKey]);
-      if (existing)
-        return rowToRun(existing);
-    }
-    const row = this.get(`INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`, [
-      runId(),
-      input.principal.orgId,
-      input.principal.userId,
-      input.slug,
-      input.slug,
-      "queued",
-      JSON.stringify(input.input),
-      JSON.stringify(input.args),
-      input.idempotencyKey ?? null,
-      randomUUID4(),
-      nowIso()
-    ]);
-    return rowToRun(row);
-  }
-  async listRuns(principal, limit) {
-    return this.all("SELECT * FROM skills_runs WHERE org_id = ? ORDER BY created_at DESC, rowid DESC LIMIT ?", [principal.orgId, normalizeLimit(limit)]).map(rowToRun);
-  }
-  async getRun(principal, id) {
-    const row = this.get("SELECT * FROM skills_runs WHERE id = ? AND org_id = ? LIMIT 1", [id, principal.orgId]);
-    return row ? rowToRun(row) : null;
-  }
-  async claimNextRun(input) {
-    const lost = new Set;
-    for (let attempt = 0;attempt < CLAIM_ATTEMPTS; attempt += 1) {
-      const claimed = this.claimOnce(input.workerId, lost);
-      if (claimed === "empty")
-        return null;
-      if (claimed)
-        return claimed;
-    }
-    return null;
-  }
-  claimOnce(workerId, lost) {
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      const excluded = [...lost];
-      const candidate = this.get(`SELECT id FROM skills_runs
-         WHERE status IN (${CLAIMABLE_STATUSES.map(() => "?").join(", ")})
-           ${excluded.length ? `AND id NOT IN (${excluded.map(() => "?").join(", ")})` : ""}
-         ORDER BY created_at ASC, rowid ASC
-         LIMIT 1`, [...CLAIMABLE_STATUSES, ...excluded]);
-      if (!candidate) {
-        this.db.exec("COMMIT");
-        return "empty";
-      }
-      const id = String(candidate.id);
-      const now = nowIso();
-      const result = this.db.run(`UPDATE skills_runs
-         SET status = 'running', started_at = COALESCE(started_at, ?), locked_by = ?, locked_at = ?,
-             lease_generation = lease_generation + 1
-         WHERE id = ? AND status IN (${CLAIMABLE_STATUSES.map(() => "?").join(", ")})`, [now, workerId, now, id, ...CLAIMABLE_STATUSES]);
-      if (result.changes !== 1) {
-        this.db.exec("ROLLBACK");
-        lost.add(id);
-        return null;
-      }
-      const row = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
-      if (!row) {
-        this.db.exec("ROLLBACK");
-        throw new Error(`claimed run ${id} vanished within its own transaction; refusing to report a lost claim as an empty queue`);
-      }
-      this.db.exec("COMMIT");
-      return rowToRun(row);
-    } catch (error) {
-      this.rollbackQuietly();
-      throw error;
-    }
-  }
-  async updateRun(id, patch) {
-    const current = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
-    if (!current)
-      return null;
-    const run = { ...rowToRun(current), ...patch };
-    const row = this.get(`UPDATE skills_runs
-       SET status = ?, output_type = ?, output_preview = ?, error_code = ?, error_message = ?, started_at = ?, completed_at = ?
-       WHERE id = ?
-       RETURNING *`, [
-      run.status,
-      run.outputType ?? null,
-      run.outputPreview ?? null,
-      run.errorCode ?? null,
-      run.errorMessage ?? null,
-      run.startedAt ?? null,
-      run.completedAt ?? null,
-      id
-    ]);
-    return row ? rowToRun(row) : null;
-  }
-  async transitionRun(id, patch, expectedGeneration) {
-    const current = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
-    if (!current)
-      return null;
-    const stored = rowToRun(current);
-    if (stored.leaseGeneration !== expectedGeneration) {
-      throw new StaleLeaseGenerationError(id, expectedGeneration, stored.leaseGeneration, stored.status);
-    }
-    const run = { ...stored, ...patch };
-    const row = this.get(`UPDATE skills_runs
-       SET status = ?, output_type = ?, output_preview = ?, error_code = ?, error_message = ?, started_at = ?, completed_at = ?,
-           lease_generation = ?
-       WHERE id = ? AND lease_generation = ?
-       RETURNING *`, [
-      run.status,
-      run.outputType ?? null,
-      run.outputPreview ?? null,
-      run.errorCode ?? null,
-      run.errorMessage ?? null,
-      run.startedAt ?? null,
-      run.completedAt ?? null,
-      run.leaseGeneration,
-      id,
-      expectedGeneration
-    ]);
-    return row ? rowToRun(row) : null;
-  }
-  async appendLog(id, orgId, level, message) {
-    const row = this.get(`INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message, created_at)
-       VALUES (?, ?, (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ?), ?, ?, ?)
-       RETURNING *`, [id, orgId, id, level, message, nowIso()]);
-    return rowToLog(row);
-  }
-  async listLogs(principal, id) {
-    return this.all(`SELECT l.* FROM skills_run_logs l
-       JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ?
-       WHERE l.run_id = ?
-       ORDER BY l.sequence ASC`, [principal.orgId, id]).map(rowToLog);
-  }
-  async addArtifact(artifact) {
-    const row = this.get(`INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`, [
-      artifact.id,
-      artifact.runId,
-      artifact.orgId,
-      artifact.fileName,
-      artifact.relativePath,
-      artifact.contentType,
-      artifact.byteSize,
-      artifact.sha256,
-      artifact.storageKind,
-      artifact.storageKey ?? null,
-      artifact.bodyText ?? null,
-      artifact.visibility,
-      artifact.expiresAt ?? null,
-      nowIso()
-    ]);
-    return rowToArtifact(row);
-  }
-  async listArtifacts(principal, id) {
-    return this.all(`SELECT a.* FROM skills_artifacts a
-       JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ?
-       WHERE a.run_id = ?
-       ORDER BY a.created_at ASC, a.rowid ASC`, [principal.orgId, id]).map(rowToArtifact);
-  }
-  async getArtifact(principal, id, artifact) {
-    const row = this.get(`SELECT a.* FROM skills_artifacts a
-       JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ?
-       WHERE a.run_id = ? AND a.id = ?
-       LIMIT 1`, [principal.orgId, id, artifact]);
-    return row ? rowToArtifact(row) : null;
-  }
-  async publishSkill(input) {
-    const orgId = input.principal.orgId;
-    const now = nowIso();
-    return this.db.transaction(() => {
-      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
-      const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
-      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
-      const tombstoned = previous?.tombstoned_at != null;
-      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
-      }
-      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
-      }
-      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
-      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
-      }
-      const carriedSha = input.bundle?.sha256 ?? previousSha;
-      if (input.version && carriedSha) {
-        const existingVersion = this.get("SELECT bundle_sha256 FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [orgId, input.slug, input.version]);
-        const existingSha = typeof existingVersion?.bundle_sha256 === "string" ? existingVersion.bundle_sha256 : null;
-        if (existingSha && existingSha !== carriedSha) {
-          throw new SkillVersionExistsError(input.slug, input.version, existingSha, carriedSha);
-        }
-      }
-      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
-      const revisionId = revisionIdOfRecord({
-        slug: input.slug,
-        displayName: input.displayName,
-        description: input.description,
-        category: input.category,
-        tags: input.tags,
-        source: input.source,
-        kind: input.kind,
-        ...input.version ? { version: input.version } : {},
-        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
-        ...carriedSha ? { bundleSha256: carriedSha } : {},
-        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
-      });
-      if (input.bundle) {
-        this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-           ON CONFLICT (org_id, sha256) DO UPDATE SET
-             byte_size = excluded.byte_size,
-             content_type = excluded.content_type,
-             storage_kind = excluded.storage_kind,
-             storage_key = excluded.storage_key,
-             body_blob = excluded.body_blob`, [
-          orgId,
-          input.bundle.sha256,
-          input.bundle.byteSize,
-          input.bundle.contentType,
-          input.bundle.storageKind,
-          input.bundle.storageKey ?? null,
-          input.bundle.bytes ?? null,
-          now
-        ]);
-      }
-      const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
-                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
-         ON CONFLICT (org_id, slug) DO UPDATE SET
-           display_name = excluded.display_name,
-           description = excluded.description,
-           category = excluded.category,
-           tags_json = excluded.tags_json,
-           source = excluded.source,
-           kind = excluded.kind,
-           version = excluded.version,
-           skill_md = excluded.skill_md,
-           -- COALESCE, not a straight assignment. A publish that carries no bundle is a
-           -- metadata update, not an instruction to discard the stored one: the plain
-           -- assignment nulled bundle_sha256 and then handed the old digest to orphan
-           -- collection, so re-publishing metadata over an existing skill deleted its
-           -- tarball and left every client with a 404.
-           bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
-           bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
-           published_by_user_id = excluded.published_by_user_id,
-           revision_id = excluded.revision_id,
-           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
-           -- counter is the truth (it may have advanced since the pre-read, which is
-           -- exactly what the WHERE guard below detects).
-           revision_number = skills_registry.revision_number + 1,
-           tombstoned_at = NULL,
-           tombstone_purge_after = NULL,
-           updated_at = excluded.updated_at
-         WHERE (skills_registry.tombstoned_at IS NOT NULL OR skills_registry.revision_id = ?)
-           AND (? = 0 OR (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
-             AND skills_registry.revision_id = ?))
-         RETURNING *`, [
-        orgId,
-        input.slug,
-        input.displayName,
-        input.description,
-        input.category,
-        JSON.stringify(input.tags),
-        input.source,
-        input.kind,
-        input.version ?? null,
-        carriedSkillMd,
-        input.bundle?.sha256 ?? null,
-        input.bundle?.byteSize ?? null,
-        input.principal.userId,
-        revisionId,
-        now,
-        now,
-        input.expectedRevisionId ?? NO_REVISION_SENTINEL,
-        input.seedBundledOnly ? 1 : 0,
-        input.expectedRevisionId ?? NO_REVISION_SENTINEL
-      ]);
-      if (!row) {
-        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
-        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
-        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
-      }
-      if (input.version && carriedSha) {
-        this.db.run(`INSERT OR IGNORE INTO skills_versions (org_id, slug, version, bundle_sha256, bundle_byte_size, storage_kind, storage_key, manifest_json, published_by_user_id, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-          orgId,
-          input.slug,
-          input.version,
-          carriedSha,
-          carriedSize ?? 0,
-          input.versionStorage?.storageKind ?? "db",
-          input.versionStorage?.storageKey ?? null,
-          JSON.stringify(input.versionManifest ?? {}),
-          input.principal.userId ?? null,
-          now
-        ]);
-      }
-      if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
-        this.collectOrphanBundle(orgId, previousSha);
-      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
-      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
-      for (const tag of input.tags) {
-        if (!tag.trim())
-          continue;
-        insertTag.run(orgId, input.slug, tag);
-      }
-      return rowToSkill(row);
-    })();
-  }
-  async listSkills(principal) {
-    await this.purgeExpiredTombstones(principal);
-    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
-  }
-  async getSkill(principal, slug) {
-    const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
-    return row ? rowToSkill(row) : null;
-  }
-  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
-    return this.db.transaction(() => {
-      const rowCurrent = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
-      const current = rowCurrent ? rowToSkill(rowCurrent) : null;
-      if (!current || current.tombstonedAt)
-        return null;
-      if (expectedRevisionId !== current.revisionId)
-        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
-      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
-        const profiles = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(principal.orgId);
-        const referencing = profiles.filter((profile2) => {
-          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
-          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
-        }).map((profile2) => String(profile2.profile_id)).sort();
-        if (referencing.length)
-          throw new SkillLifecycleConflictError(slug, referencing);
-      }
-      const next2 = { ...current, lifecycle: patch.lifecycle, updatedAt: nowIso(), ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {} };
-      if (patch.lifecycle === "active") {
-        delete next2.archivedAt;
-        delete next2.archiveReason;
-        delete next2.replacementSlug;
-      }
-      const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
-      if (!row)
-        throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
-      return rowToSkill(row);
-    }).immediate();
-  }
-  getSkillSync(principal, slug) {
-    const row = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
-    return row ? rowToSkill(row) : null;
-  }
-  async updateSkill(principal, slug, patch, expectedRevisionId) {
-    const current = await this.getSkill(principal, slug);
-    if (!current || current.tombstonedAt)
-      return null;
-    if (expectedRevisionId !== current.revisionId) {
-      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
-    }
-    const next2 = { ...current, ...patch };
-    return this.db.transaction(() => {
-      const revisionId = revisionIdOfRecord(next2);
-      const row = this.get(`UPDATE skills_registry
-         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
-             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
-         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
-         RETURNING *`, [
-        next2.displayName,
-        next2.description,
-        next2.category,
-        JSON.stringify(next2.tags),
-        next2.kind,
-        next2.version ?? null,
-        next2.skillMd ?? null,
-        revisionId,
-        nowIso(),
-        principal.orgId,
-        slug,
-        current.revisionId
-      ]);
-      if (!row) {
-        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
-          principal.orgId,
-          slug
-        ]);
-        if (nowRow && nowRow.tombstoned_at == null) {
-          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
-          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
-        }
-        return null;
-      }
-      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
-      for (const tag of next2.tags) {
-        if (!tag.trim())
-          continue;
-        insertTag.run(principal.orgId, slug, tag);
-      }
-      return rowToSkill(row);
-    })();
-  }
-  async deleteSkill(principal, slug, tombstoneWindowMs) {
-    return this.db.transaction(() => {
-      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
-      if (!existing)
-        return null;
-      if (existing.tombstoned_at != null) {
-        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
-        return rowToSkill(row2);
-      }
-      const tombstonedAt = nowIso();
-      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
-      const row = this.get(`UPDATE skills_registry
-         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
-         WHERE org_id = ? AND slug = ?
-         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
-      return rowToSkill(row);
-    })();
-  }
-  async purgeExpiredTombstones(principal) {
-    return this.db.transaction(() => {
-      const now = nowIso();
-      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
-      const purged = [];
-      for (const row of expired) {
-        const record = rowToSkill(row);
-        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
-        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
-        if (record.bundleSha256)
-          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
-        purged.push(record);
-      }
-      return purged;
-    })();
-  }
-  async getSkillBundle(principal, sha256) {
-    const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
-    return row ? rowToSkillBundle(row) : null;
-  }
-  async listSkillVersions(principal, slug) {
-    return this.all("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? ORDER BY created_at DESC, version DESC", [principal.orgId, slug]).map(rowToSkillVersion);
-  }
-  async getSkillVersion(principal, slug, version) {
-    const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version]);
-    return row ? rowToSkillVersion(row) : null;
-  }
-  async getPublishedSelectionStates(principal, selections2) {
-    if (selections2.length > MAX_PROFILE_SELECTIONS)
-      throw new RangeError("Published selection lookup exceeds the profile selection limit");
-    if (!selections2.length)
-      return [];
-    const requested = JSON.stringify(selections2.map(({ slug, version }) => ({ slug, version })));
-    return this.all(`SELECT json_extract(q.value, '$.slug') AS slug, json_extract(q.value, '$.version') AS version,
-         r.slug IS NOT NULL AS skill_exists, r.lifecycle, r.tombstoned_at,
-         v.bundle_sha256, b.sha256 IS NOT NULL AS bundle_available
-       FROM json_each(?) q
-       LEFT JOIN skills_registry r ON r.org_id = ? AND r.slug = json_extract(q.value, '$.slug')
-       LEFT JOIN skills_versions v ON v.org_id = ?
-         AND v.slug = json_extract(q.value, '$.slug') AND v.version = json_extract(q.value, '$.version')
-       LEFT JOIN skills_bundles b ON b.org_id = ? AND b.sha256 = v.bundle_sha256
-       ORDER BY CAST(q.key AS INTEGER)`, [requested, principal.orgId, principal.orgId, principal.orgId]).map(rowToPublishedSelectionState);
-  }
-  async pinSkill(principal, slug, metadata = {}) {
-    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
-         pinned_at = excluded.pinned_at,
-         metadata_json = excluded.metadata_json
-       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
-    return rowToPin(row);
-  }
-  async unpinSkill(principal, slug) {
-    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
-    return result.changes > 0;
-  }
-  async listPins(principal) {
-    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
-  }
-  async listTags(principal) {
-    await this.purgeExpiredTombstones(principal);
-    return this.all("SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id=t.org_id AND s.slug=t.slug WHERE t.org_id = ? AND s.lifecycle='active' ORDER BY t.tag ASC", [principal.orgId]).map((row) => String(row.tag));
-  }
-  async listSkillsByTag(principal, tag) {
-    await this.purgeExpiredTombstones(principal);
-    return this.all(`SELECT s.* FROM skills_registry s
-       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
-       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
-  }
-  async listPinsByTag(principal, tag) {
-    await this.purgeExpiredTombstones(principal);
-    return this.all(`SELECT p.* FROM skills_pins p
-       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
-       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
-       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
-       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
-  }
-  async listPublishedSlugs(principal) {
-    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
-  }
-  collectOrphanBundle(orgId, sha256) {
-    const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]) ?? this.get("SELECT 1 AS present FROM skills_versions WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
-    if (referenced)
-      return;
-    this.db.run("DELETE FROM skills_bundles WHERE org_id = ? AND sha256 = ?", [orgId, sha256]);
-  }
-  get(sql, params) {
-    return this.db.query(sql).get(...params) ?? null;
-  }
-  all(sql, params) {
-    return this.db.query(sql).all(...params);
-  }
-  rollbackQuietly() {
-    try {
-      this.db.exec("ROLLBACK");
-    } catch {}
-  }
-}
-function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite")) {
-  db.exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
-       version text PRIMARY KEY,
-       applied_at text NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-     )`);
-  const files = readdirSync(migrationsDir).filter((name) => name.endsWith(".sql")).sort();
-  if (files.length === 0) {
-    throw new Error(`no .sql migrations found in ${migrationsDir}`);
-  }
-  const appliedNow = [];
-  for (const file of files) {
-    const version = file.replace(/\.sql$/, "");
-    const text = readFileSync2(join4(migrationsDir, file), "utf8");
-    const apply = db.transaction(() => {
-      const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version);
-      if (already)
-        return false;
-      db.exec(text);
-      db.run("INSERT INTO schema_migrations (version) VALUES (?)", [version]);
-      return true;
-    });
-    if (apply.immediate())
-      appliedNow.push(version);
-  }
-  return appliedNow;
-}
-function enableWalMode(db, attempts = 50, pauseMs = 10) {
-  for (let attempt = 0;attempt < attempts; attempt += 1) {
-    if (journalMode(db) === "wal")
-      return true;
-    try {
-      if (String(db.query("PRAGMA journal_mode = WAL").get()?.journal_mode).toLowerCase() === "wal") {
-        return true;
-      }
-    } catch {}
-    Bun.sleepSync(pauseMs);
-  }
-  return false;
-}
-function journalMode(db) {
-  try {
-    return String(db.query("PRAGMA journal_mode").get()?.journal_mode ?? "").toLowerCase();
-  } catch {
-    return "";
-  }
-}
-function openDatabase(path) {
-  try {
-    return new Database(path, { create: true, readwrite: true });
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(`cannot open the skills database at ${path}: ${reason}. ` + "Check that the directory exists and is writable. Set HASNA_SKILLS_DATABASE_URL to choose a " + "different path or a postgres:// URL, or HASNA_SKILLS_DIR to relocate the whole data directory.", { cause: error });
-  }
-}
-function parseScopes(value) {
-  if (Array.isArray(value))
-    return value.map(String);
-  if (typeof value !== "string")
-    return [];
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed) ? parsed.map(String) : [];
-  } catch {
-    return [];
-  }
-}
-
 // src/server/store.ts
 function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
   return {
@@ -3674,26 +2675,26 @@ function resolvePoolMax(env = process.env) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
 }
 var LOG_SEQUENCE_ATTEMPTS = 12;
-async function createStore(options = {}) {
-  const target = resolveDatabaseTarget(options.databaseUrl);
-  const store = instantiateStore(target, options.sqlite);
-  await store.verifyConnectivity?.();
-  if (options.bootstrapApiKey && store.ensureBootstrapApiKey) {
-    await store.ensureBootstrapApiKey(options.bootstrapApiKey);
-  }
-  return store;
-}
-function instantiateStore(target, sqliteOptions) {
-  switch (target.kind) {
-    case "postgres":
-      return new PostgresSkillsStore(target.url);
-    case "sqlite":
-      return new SqliteSkillsStore(target.path, sqliteOptions);
-    case "memory":
-      return new MemorySkillsStore;
+function openOperatorScopeMaintenance(databaseUrl) {
+  try {
+    const url = new URL(databaseUrl);
+    if (!["postgres:", "postgresql:"].includes(url.protocol) || !url.hostname)
+      throw new Error;
+  } catch {
+    throw new Error("maintenance requires an explicit Postgres database");
   }
+  const store = new PostgresSkillsStore(databaseUrl, {
+    max: 1,
+    connectionTimeout: 5,
+    idleTimeout: 5,
+    connection: { statement_timeout: "5s", lock_timeout: "1s" }
+  });
+  return {
+    inspectOperatorScopeTarget: (keyId, orgId) => store.inspectOperatorScopeTarget(keyId, orgId),
+    enrollPublishScopeByOperator: (input) => store.enrollPublishScopeByOperator(input),
+    close: () => store.close()
+  };
 }
-
 class MemorySkillsStore {
   selectionStore = new MemorySkillSelectionStore;
   executionGrantStore = new MemoryExecutionGrantStore;
@@ -3791,7 +2792,7 @@ class MemorySkillsStore {
       input: input.input,
       args: input.args,
       ...idemKey ? { idempotencyKey: idemKey } : {},
-      correlationId: randomUUID5(),
+      correlationId: randomUUID4(),
       costCents: 0,
       leaseGeneration: 0,
       createdAt: now
@@ -4115,9 +3116,9 @@ class PostgresSkillsStore {
   }
   backend = { kind: "postgres", durable: true, label: "postgres" };
   sql;
-  constructor(databaseUrl) {
+  constructor(databaseUrl, connectionOptions = {}) {
     const bunWithSql = Bun;
-    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax(), ...connectionOptions });
   }
   async verifyConnectivity() {
     try {
@@ -4212,7 +3213,7 @@ class PostgresSkillsStore {
       }
       await tx`
         INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
-        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::text::jsonb)
       `;
       return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
     });
@@ -4220,10 +3221,12 @@ class PostgresSkillsStore {
   async casUpdateApiKeyScopes(tx, keyId, orgId, expectedScopes, addScopes) {
     const current = expectedScopes;
     const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const expectedScopesJson = JSON.stringify(expectedScopes);
     return tx`
-      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::text::jsonb
       WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
-        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        AND (scopes_json = ${expectedScopesJson}::text::jsonb
+          OR scopes_json = to_jsonb(${expectedScopesJson}::text))
       RETURNING scopes_json
     `;
   }
@@ -4283,7 +3286,7 @@ class PostgresSkillsStore {
         operator_task_arn: input.operatorTaskArn,
         target_manifest_digest: input.manifestDigest,
         station_id: input.stationId
-      })}::jsonb)
+      })}::text::jsonb)
       `;
       return { kind: "updated", scopes };
     });
@@ -4318,7 +3321,7 @@ class PostgresSkillsStore {
       const id = runId();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
-        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID5()})
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID4()})
         RETURNING *
       `;
       return rowToRun(rows[0]);
@@ -4567,10 +3570,10 @@ class PostgresSkillsStore {
           tombstone_purge_after = NULL,
           updated_at = EXCLUDED.updated_at
         WHERE (skills_registry.tombstoned_at IS NOT NULL
-           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2})
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL})
           AND (NOT ${Boolean(input.seedBundledOnly)} OR
             (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
-             AND skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}))
+             AND skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL}))
         RETURNING *
       `;
       if (!rows[0]) {
@@ -4848,7 +3851,7 @@ class PostgresSkillsStore {
     `;
   }
 }
-var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
 function isUniqueViolation(error) {
   const code = error?.code;
   if (code === "23505" || code === 23505)
@@ -4862,7 +3865,116 @@ function connectionFailureSummary(error) {
 `)[0].slice(0, 200);
 }
 
+// src/server/enrollment-inspection.ts
+var {SQL } = globalThis.Bun;
+class EnrollmentInspectionError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "EnrollmentInspectionError";
+  }
+}
+var refuse = (code) => {
+  throw new EnrollmentInspectionError(code);
+};
+var boundedId = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && !/[\u0000-\u001f\u007f]/.test(value);
+async function inspectEnrollment(databaseUrl, input) {
+  if (!input || !boundedId(input.keyId) || !boundedId(input.orgId) || !boundedId(input.enrollmentOperationId) || typeof input.enrollmentManifestDigest !== "string" || !/^[a-f0-9]{64}$/.test(input.enrollmentManifestDigest)) {
+    refuse("INVALID_INSPECTION_INPUT");
+  }
+  try {
+    const url = new URL(databaseUrl);
+    if (!["postgres:", "postgresql:"].includes(url.protocol) || !url.hostname)
+      refuse("POSTGRES_REQUIRED");
+  } catch {
+    refuse("POSTGRES_REQUIRED");
+  }
+  let sql;
+  try {
+    sql = new SQL(databaseUrl, { max: 1, connectionTimeout: 5, idleTimeout: 5 });
+    return await sql.begin("ISOLATION LEVEL REPEATABLE READ READ ONLY", async (tx) => {
+      await tx.unsafe("SET LOCAL statement_timeout = '5s'");
+      await tx.unsafe("SET LOCAL lock_timeout = '1s'");
+      const mode = await tx`SELECT current_setting('transaction_read_only') AS read_only,
+        current_setting('transaction_isolation') AS isolation`;
+      if (mode.length !== 1 || mode[0].read_only !== "on" || mode[0].isolation !== "repeatable read")
+        refuse("INSPECTION_FAILED");
+      const targets = await tx`SELECT org_id = ${input.orgId} AS org_matches,
+        revoked_at IS NOT NULL AS revoked,
+        CASE WHEN org_id = ${input.orgId} AND revoked_at IS NULL
+          AND octet_length(scopes_json::text) <= 8192 THEN scopes_json::text ELSE NULL END AS scopes_json
+        FROM api_keys WHERE id = ${input.keyId} LIMIT 2`;
+      let target;
+      if (targets.length > 1)
+        target = { state: "ambiguous" };
+      else if (!targets.length)
+        target = { state: "absent" };
+      else {
+        const row = targets[0];
+        if (typeof row.org_matches !== "boolean" || typeof row.revoked !== "boolean")
+          refuse("INVALID_INSPECTION_RESULT");
+        if (!row.org_matches)
+          target = { state: "mismatched" };
+        else if (row.revoked)
+          target = { state: "revoked" };
+        else {
+          let scopes;
+          try {
+            scopes = typeof row.scopes_json === "string" ? JSON.parse(row.scopes_json) : null;
+          } catch {
+            refuse("INVALID_INSPECTION_RESULT");
+          }
+          if (!validOperatorScopeList(scopes))
+            return refuse("INVALID_INSPECTION_RESULT");
+          target = { state: "found", scopes: [...scopes] };
+        }
+      }
+      const audits = await tx`SELECT org_id = ${input.orgId} AS org_matches,
+        target_type = 'api_key' AND target_id = ${input.keyId} AS target_matches,
+        jsonb_typeof(metadata_json) = 'object'
+          AND jsonb_typeof(metadata_json->'target_manifest_digest') = 'string'
+          AND (metadata_json->>'target_manifest_digest') ~ '^[a-f0-9]{64}$' AS digest_valid,
+        metadata_json->>'target_manifest_digest' = ${input.enrollmentManifestDigest} AS digest_matches
+        FROM skills_audit_events WHERE action = 'api_key_scopes_added'
+          AND operator_operation_id = ${input.enrollmentOperationId} LIMIT 2`;
+      let audit;
+      if (audits.length > 1)
+        audit = { state: "ambiguous" };
+      else if (!audits.length)
+        audit = { state: "absent" };
+      else {
+        const row = audits[0];
+        if (row.digest_valid !== true || [row.org_matches, row.target_matches, row.digest_matches].some((value) => typeof value !== "boolean")) {
+          refuse("INVALID_INSPECTION_RESULT");
+        }
+        audit = { state: row.org_matches && row.target_matches && row.digest_matches ? "matching" : "mismatched" };
+      }
+      return { status: "inspected", target, audit };
+    });
+  } catch (error) {
+    if (error instanceof EnrollmentInspectionError)
+      throw error;
+    const state2 = error instanceof SQL.PostgresError ? error.errno : undefined;
+    const code = state2 === "42P01" || state2 === "42703" ? "INSPECTION_SCHEMA_UNAVAILABLE" : state2 === "42501" ? "INSPECTION_ACCESS_DENIED" : state2 === "25006" ? "INSPECTION_WRITE_REFUSED" : state2 === "57014" || state2 === "55P03" ? "INSPECTION_TIMEOUT" : ["08000", "08001", "08003", "08004", "08006", "08007", "08P01", "28000", "28P01", "57P03"].includes(state2 ?? "") ? "INSPECTION_CONNECTION_FAILED" : "INSPECTION_FAILED";
+    throw new EnrollmentInspectionError(code);
+  } finally {
+    try {
+      await sql?.close({ timeout: 1 });
+    } catch {
+      throw new EnrollmentInspectionError("INSPECTION_FAILED");
+    }
+  }
+}
+
 // src/server/maintenance-entry.ts
+class InspectionInputError extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+}
 var MAX_MANIFEST_BYTES = 32 * 1024;
 function sha256(value) {
   return createHash3("sha256").update(value).digest("hex");
@@ -4896,6 +4008,17 @@ function readBoundedJson(path) {
     closeSync(fd);
   }
 }
+function verifyOperatorReceipt(manifestInput, receipt) {
+  if (typeof receipt.operatorJobId !== "string" || !receipt.operatorJobId.trim() || typeof receipt.operatorTaskArn !== "string" || !receipt.operatorTaskArn.trim())
+    throw new Error("verified operator receipt is incomplete");
+  if (typeof receipt.manifestBytesSha256 !== "string" || !/^[a-f0-9]{64}$/.test(receipt.manifestBytesSha256))
+    throw new Error("verified operator receipt digest is invalid");
+  if (manifestInput.bytesSha256 !== receipt.manifestBytesSha256)
+    throw new Error("manifest bytes are not the bytes verified by the operator wrapper");
+  if (typeof receipt.taskDefinitionArn !== "string" || !receipt.taskDefinitionArn.trim() || typeof receipt.verifiedAt !== "string" || !Number.isFinite(Date.parse(receipt.verifiedAt)))
+    throw new Error("verified operator receipt provenance is invalid");
+  return { operatorJobId: receipt.operatorJobId, operatorTaskArn: receipt.operatorTaskArn };
+}
 function readManifest(path, receiptPath) {
   const manifestInput = readBoundedJson(path);
   const receiptInput = readBoundedJson(receiptPath);
@@ -4921,18 +4044,71 @@ function readManifest(path, receiptPath) {
     throw new Error("maintenance manifest digest must be SHA-256");
   if (sha256(canonical(parsed)) !== parsed.manifestDigest)
     throw new Error("maintenance manifest digest does not match its bytes");
-  if (typeof receipt.operatorJobId !== "string" || !receipt.operatorJobId.trim() || typeof receipt.operatorTaskArn !== "string" || !receipt.operatorTaskArn.trim())
-    throw new Error("verified operator receipt is incomplete");
-  if (typeof receipt.manifestBytesSha256 !== "string" || !/^[a-f0-9]{64}$/.test(receipt.manifestBytesSha256))
-    throw new Error("verified operator receipt digest is invalid");
-  if (manifestInput.bytesSha256 !== receipt.manifestBytesSha256)
-    throw new Error("manifest bytes are not the bytes verified by the operator wrapper");
-  if (typeof receipt.taskDefinitionArn !== "string" || !receipt.taskDefinitionArn.trim() || typeof receipt.verifiedAt !== "string" || !Number.isFinite(Date.parse(receipt.verifiedAt)))
-    throw new Error("verified operator receipt provenance is invalid");
-  return { ...parsed, operatorJobId: receipt.operatorJobId, operatorTaskArn: receipt.operatorTaskArn };
+  return { ...parsed, ...verifyOperatorReceipt(manifestInput, receipt) };
+}
+function readInspectionManifest(path, receiptPath) {
+  let input;
+  let parsed;
+  try {
+    input = readBoundedJson(path);
+    const value = input.value;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error;
+    const fields = ["app", "operation", "manifestVersion", "operationId", "stationId", "keyId", "orgId", "enrollmentOperationId", "enrollmentManifestDigest", "expiresAt", "manifestDigest"];
+    if (Object.keys(value).length !== fields.length || fields.some((field) => !Object.hasOwn(value, field)))
+      throw new Error;
+    if (value.app !== "skills" || value.operation !== "inspect-enrollment" || value.manifestVersion !== 1)
+      throw new Error;
+    for (const field of ["operationId", "stationId", "keyId", "orgId", "enrollmentOperationId"]) {
+      const item = value[field];
+      if (typeof item !== "string" || item.trim().length === 0 || item.length > 256 || /[\u0000-\u001f\u007f]/.test(item))
+        throw new Error;
+    }
+    if (value.operationId === value.enrollmentOperationId)
+      throw new Error;
+    for (const field of ["manifestDigest", "enrollmentManifestDigest"]) {
+      if (typeof value[field] !== "string" || !/^[a-f0-9]{64}$/.test(value[field]))
+        throw new Error;
+    }
+    if (typeof value.expiresAt !== "string" || value.expiresAt.length > 64 || !Number.isFinite(Date.parse(value.expiresAt)) || Date.parse(value.expiresAt) <= Date.now())
+      throw new Error;
+    if (sha256(canonical(value)) !== value.manifestDigest)
+      throw new Error;
+    parsed = value;
+  } catch {
+    throw new InspectionInputError("INVALID_INSPECTION_MANIFEST");
+  }
+  try {
+    verifyOperatorReceipt(input, readBoundedJson(receiptPath).value);
+  } catch {
+    throw new InspectionInputError("INVALID_OPERATOR_RECEIPT");
+  }
+  return parsed;
 }
 function registerMaintenance(parent) {
   const maintenance = parent.command("maintenance").description("Run protected, metadata-only Skills maintenance operations");
+  maintenance.command("inspect-enrollment").description("Inspect one enrollment with a database-enforced read-only snapshot").requiredOption("--manifest <path>", "Fresh inspection authorization supplied by the protected task wrapper").requiredOption("--operator-receipt <path>", "Verified actor receipt written by the protected task wrapper").option("--json", "Output a safe JSON receipt", false).action(async (options) => {
+    try {
+      const manifest = readInspectionManifest(options.manifest, options.operatorReceipt);
+      const result = await inspectEnrollment(process.env.HASNA_SKILLS_DATABASE_URL ?? "", manifest);
+      console.log(JSON.stringify({
+        ...result,
+        operationId: manifest.operationId,
+        enrollmentOperationId: manifest.enrollmentOperationId,
+        enrollmentManifestDigest: manifest.enrollmentManifestDigest,
+        keyId: manifest.keyId,
+        orgId: manifest.orgId,
+        stationId: manifest.stationId
+      }));
+    } catch (error) {
+      const code = error instanceof InspectionInputError || error instanceof EnrollmentInspectionError ? error.code : "INSPECTION_FAILED";
+      if (options.json || !process.stdout.isTTY)
+        console.log(JSON.stringify({ status: "failed", code }));
+      else
+        console.error(code);
+      process.exitCode = 1;
+    }
+  });
   maintenance.command("enroll-publish").requiredOption("--manifest <path>", "Bounded target manifest supplied by the protected task wrapper").requiredOption("--operator-receipt <path>", "Verified actor receipt written by the protected task wrapper").option("--apply", "Commit the bounded scope update; defaults to dry-run", false).option("--json", "Output a safe JSON receipt", false).action(async (options) => {
     let manifest;
     let store;
@@ -4943,8 +4119,8 @@ function registerMaintenance(parent) {
       const databaseUrl = process.env.HASNA_SKILLS_DATABASE_URL;
       if (!databaseUrl)
         throw new Error("maintenance requires HASNA_SKILLS_DATABASE_URL");
-      store = await createStore({ databaseUrl });
-      const snapshot = await store.inspectOperatorScopeTarget?.(manifest.keyId, manifest.orgId);
+      store = openOperatorScopeMaintenance(databaseUrl);
+      const snapshot = await store.inspectOperatorScopeTarget(manifest.keyId, manifest.orgId);
       if (!snapshot)
         throw new Error("configured store does not support operator maintenance");
       if (snapshot.kind !== "found")
@@ -4956,7 +4132,7 @@ function registerMaintenance(parent) {
         console.log(JSON.stringify(base));
         return;
       }
-      const result = await store.enrollPublishScopeByOperator?.(manifest);
+      const result = await store.enrollPublishScopeByOperator(manifest);
       if (!result)
         throw new Error("configured store does not support operator maintenance");
       if ("scopes" in result && !validOperatorScopeList(result.scopes))
@@ -4967,14 +4143,20 @@ function registerMaintenance(parent) {
       process.exitCode = 1;
     } catch (error) {
       const message = error instanceof Error ? error.message : "";
-      const code = message.includes("expired") || message.includes("expiry") ? "INVALID_EXPIRY" : message.includes("receipt") || message.includes("operator") ? "INVALID_OPERATOR_RECEIPT" : message.includes("manifest") || message.includes("input") ? "INVALID_MANIFEST" : message.includes("database") || message.includes("store") ? "STORE_UNAVAILABLE" : "MAINTENANCE_FAILED";
+      const state2 = error instanceof SQL2.PostgresError ? error.errno : undefined;
+      const code = state2 === "42P01" || state2 === "42703" ? "MAINTENANCE_SCHEMA_UNAVAILABLE" : state2 === "42501" ? "MAINTENANCE_ACCESS_DENIED" : state2 === "25006" ? "MAINTENANCE_WRITE_REFUSED" : state2 === "57014" || state2 === "55P03" ? "MAINTENANCE_TIMEOUT" : ["08000", "08001", "08003", "08004", "08006", "08007", "08P01", "28000", "28P01", "57P03"].includes(state2 ?? "") ? "MAINTENANCE_CONNECTION_FAILED" : message.includes("expired") || message.includes("expiry") ? "INVALID_EXPIRY" : message.includes("receipt") || message.includes("operator") ? "INVALID_OPERATOR_RECEIPT" : message.includes("manifest") || message.includes("input") ? "INVALID_MANIFEST" : message.includes("database") || message.includes("store") ? "STORE_UNAVAILABLE" : "MAINTENANCE_FAILED";
       if (options.json || !process.stdout.isTTY)
         console.log(JSON.stringify({ status: "failed", code }));
       else
         console.error(code);
       process.exitCode = 1;
     } finally {
-      await store?.close?.();
+      try {
+        await store?.close();
+      } catch {
+        console.log(JSON.stringify({ status: "failed", code: "MAINTENANCE_CLOSE_FAILED" }));
+        process.exitCode = 1;
+      }
     }
   });
 }