@hasna/skills 0.8.11 → 0.9.1

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.11",
+    version: "0.9.1",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -37439,6 +37439,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version2 = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -37451,7 +37452,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -37970,6 +37971,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync8(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -38786,6 +38793,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -38889,6 +38898,8 @@ var init_remote_registry = __esm(() => {
     tags: exports_external.array(exports_external.string()).optional(),
     dependencies: exports_external.array(exports_external.string()).optional(),
     version: exports_external.string().optional(),
+    revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+    lifecycle: exports_external.enum(["active", "archived"]).optional(),
     availability: remoteAvailabilitySchema.optional()
   }).passthrough().refine((skill) => skill.name || skill.slug, {
     message: "Remote skill requires name or slug"
@@ -39944,7 +39955,9 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1")
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute4(source.path) && resolve4(source.path) === source.path && basename4(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute4(source.path) && resolve4(source.path) === source.path && basename4(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-plugin-registry") {
@@ -47592,6 +47605,63 @@ var init_claude_marketplace_registry = __esm(() => {
   CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
 });
 
+// src/lib/claude-settings-witness.ts
+var CLAUDE_SETTINGS_WITNESS_LIMITS, BOOLEAN_PREFERENCES, ENUM_PREFERENCES, BUILTIN_MODEL_SELECTIONS;
+var init_claude_settings_witness = __esm(() => {
+  CLAUDE_SETTINGS_WITNESS_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
+  BOOLEAN_PREFERENCES = new Set([
+    "autoScrollEnabled",
+    "axScreenReader",
+    "emojiCompletionEnabled",
+    "prefersReducedMotion",
+    "showTurnDuration",
+    "spinnerTipsEnabled",
+    "syntaxHighlightingDisabled",
+    "terminalProgressBarEnabled",
+    "terminalTitleFromRename",
+    "verbose",
+    "wheelScrollAccelerationEnabled"
+  ]);
+  ENUM_PREFERENCES = Object.freeze({
+    editorMode: ["normal", "vim"],
+    tui: ["default", "fullscreen"],
+    viewMode: ["default", "verbose", "focus"]
+  });
+  BUILTIN_MODEL_SELECTIONS = new Set([
+    "default",
+    "best",
+    "fable",
+    "fable[1m]",
+    "sonnet",
+    "sonnet[1m]",
+    "opus",
+    "opus[1m]",
+    "haiku",
+    "opusplan",
+    "claude-fable-5-1",
+    "claude-fable-5",
+    "claude-fable-5[1m]",
+    "claude-opus-5",
+    "claude-sonnet-5",
+    "claude-haiku-4-5-20251001",
+    "claude-opus-4-6",
+    "claude-sonnet-4-5",
+    "claude-sonnet-4-5-20250929",
+    "claude-opus-4-8",
+    "claude-opus-4-8[1m]",
+    "claude-opus-4-7",
+    "claude-sonnet-4-6",
+    "claude-opus-4-5-20251101",
+    "claude-opus-4-5",
+    "claude-haiku-4-5",
+    "claude-fable-5-1[1m]",
+    "claude-opus-5[1m]",
+    "claude-opus-4-7[1m]",
+    "claude-opus-4-6[1m]",
+    "claude-sonnet-4-6[1m]"
+  ]);
+});
+
 // src/lib/agent-discovery.ts
 var init_agent_discovery = __esm(() => {
   init_agent_policy_limits();
@@ -47602,6 +47672,7 @@ var init_agent_discovery = __esm(() => {
   init_plugin_discovery();
   init_plugin_admission();
   init_claude_marketplace_registry();
+  init_claude_settings_witness();
   init_agent_discovery_directories();
 });
 
@@ -49467,6 +49538,7 @@ __export(exports_remote_client, {
   RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteSkillLifecycleError: () => RemoteSkillLifecycleError,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
   RemoteRequestError: () => RemoteRequestError,
   RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
@@ -49598,6 +49670,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -50115,6 +50220,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -50266,9 +50384,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject) => {
@@ -50283,7 +50405,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size += next.value.byteLength;
       if (size > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size);
@@ -50294,11 +50416,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -50327,7 +50449,7 @@ async function createRemoteSkillsClient(env = process.env) {
 function createRemoteSkillsClientReadOnly(env = process.env) {
   return createRemoteSkillsClient(env);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, KNOWN_SKILL_LIFECYCLE_CODES, RemoteSkillLifecycleError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
   init_remote_recurring();
   init_remote_invitations();
@@ -50364,6 +50486,17 @@ var init_remote_client = __esm(() => {
       this.name = "RemoteRequestError";
     }
   };
+  KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+  RemoteSkillLifecycleError = class RemoteSkillLifecycleError extends RemoteRequestError {
+    code;
+    constructor(path, status, code) {
+      super(path, status);
+      this.name = "RemoteSkillLifecycleError";
+      const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+      this.code = safeCode;
+      this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+    }
+  };
   RemoteCreditCheckoutError = class RemoteCreditCheckoutError extends RemoteRequestError {
     code;
     requestIdempotencyKey;
@@ -53758,6 +53891,161 @@ var init_run_routing = __esm(() => {
   init_fleet_credentials();
 });
 
+// src/lib/cloud-executions.ts
+var exports_cloud_executions = {};
+__export(exports_cloud_executions, {
+  CloudExecutionClient: () => CloudExecutionClient
+});
+
+class CloudExecutionClient {
+  apiOrigin;
+  apiKey;
+  constructor(apiOrigin, apiKey) {
+    this.apiOrigin = apiOrigin;
+    this.apiKey = apiKey;
+  }
+  static async configured() {
+    const c = await resolveSkillsConnection();
+    if (!c)
+      throw Error("Cloud execution requires a configured Skills API credential");
+    return new CloudExecutionClient(c.apiOrigin, c.apiKey);
+  }
+  async request(route, method = "GET", value) {
+    const response = await fetch(skillsApiRequestUrl(this.apiOrigin, "/api/v1/executions/" + route), {
+      method,
+      headers: {
+        authorization: `Bearer ${this.apiKey}`,
+        "User-Agent": `hasna-skills/${package_default.version}`,
+        ...value === undefined ? {} : { "content-type": "application/json" }
+      },
+      ...value === undefined ? {} : { body: JSON.stringify(value) },
+      redirect: "error",
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      response.body?.cancel();
+      throw Error(`Skills cloud execution refused: HTTP ${response.status}`);
+    }
+    return response;
+  }
+  async eligibility(slug2, version2, bundleDigest) {
+    if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
+      throw Error("Cloud eligibility requires an exact skill version and valid digest");
+    const query = new URLSearchParams({ version: version2, ...bundleDigest ? { bundleDigest } : {} });
+    const v = await jsonBody(await this.request(`${slug2}/eligibility?${query}`));
+    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug2 || v.version !== version2 || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
+      throw Error("Invalid cloud eligibility receipt");
+    return v;
+  }
+  async submit(slug2, version2, input2, key, selection) {
+    if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2))
+      throw Error("Cloud execution requires skill@exact-version");
+    if (!/^[A-Za-z0-9._:-]{1,128}$/.test(key))
+      throw Error("Invalid idempotency key");
+    if (selection?.authority && selection.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
+      throw Error("Selected skill belongs to another Skills authority");
+    const execution = parseExecution(await jsonBody(await this.request(slug2, "POST", {
+      version: version2,
+      input: input2,
+      idempotencyKey: key,
+      ...selection ? {
+        bundleDigest: selection.bundleDigest,
+        workspaceId: selection.workspaceId
+      } : {}
+    })));
+    if (execution.skill !== slug2 || execution.version !== version2 || selection && execution.bundleDigest.replace(/^sha256:/, "") !== selection.bundleDigest.replace(/^sha256:/, ""))
+      throw Error("Cloud execution receipt does not match the selected exact skill");
+    return execution;
+  }
+  async get(id) {
+    return parseExecution(await jsonBody(await this.request(runId(id))));
+  }
+  async logs(id) {
+    return jsonBody(await this.request(runId(id) + "/logs"));
+  }
+  async artifacts(id) {
+    return (await this.get(id)).artifacts;
+  }
+  async download(id, name) {
+    if (!["document.pdf", "document.html"].includes(name))
+      throw Error("Invalid cloud artifact name");
+    const response = await this.request(runId(id) + "/artifacts/" + encodeURIComponent(name));
+    if (!response.body)
+      throw Error("Cloud artifact body is missing");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;; ) {
+      const r2 = await reader.read();
+      if (r2.done)
+        break;
+      size += r2.value.length;
+      if (size > 2000000) {
+        await reader.cancel();
+        throw Error("Cloud artifact exceeds limit");
+      }
+      chunks.push(r2.value);
+    }
+    return Buffer.concat(chunks);
+  }
+  async cancel(id) {
+    return parseExecution(await jsonBody(await this.request(runId(id) + "/cancel", "POST", {})));
+  }
+  async wait(id, options = {}) {
+    const timeout = options.timeoutMs ?? 300000, interval = options.intervalMs ?? 1000;
+    if (!Number.isFinite(timeout) || timeout < 1 || timeout > 1200000 || !Number.isFinite(interval) || interval < 100 || interval > 60000)
+      throw Error("Invalid cloud polling bounds");
+    const until = Date.now() + timeout;
+    for (;; ) {
+      const run = await this.get(id);
+      if (["succeeded", "failed", "cancelled"].includes(run.status))
+        return run;
+      if (Date.now() >= until)
+        throw Error("Cloud execution is still running; poll the returned execution id");
+      await Bun.sleep(interval);
+    }
+  }
+}
+function runId(id) {
+  if (!/^run_[a-z0-9_]+$/.test(id))
+    throw Error("Invalid cloud execution id");
+  return id;
+}
+function parseExecution(value) {
+  const v = value;
+  if (!v || v.contractVersion !== 1 || v.target !== "cloud" || ![
+    "admitted",
+    "leased",
+    "running",
+    "succeeded",
+    "failed",
+    "cancelled"
+  ].includes(v.status) || typeof v.skill !== "string" || typeof v.version !== "string" || !Array.isArray(v.artifacts))
+    throw Error("Unsupported cloud execution response");
+  runId(v.id);
+  for (const field of [
+    "bundleDigest",
+    "inputDigest",
+    "runtimeImageDigest"
+  ])
+    if (typeof v[field] !== "string" || !/^(sha256:)?[a-f0-9]{64}$/.test(v[field]))
+      throw Error("Invalid cloud execution integrity receipt");
+  return v;
+}
+async function jsonBody(response) {
+  const bytes = await readBoundedResponse(response, 1e5);
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw Error("Invalid cloud execution JSON response");
+  }
+}
+var init_cloud_executions = __esm(() => {
+  init_package();
+  init_remote_files();
+  init_fleet_credentials();
+});
+
 // node_modules/@hasna/secrets/dist/sdk.js
 import { isIP as isIP2 } from "net";
 import { spawnSync as spawnSync2 } from "child_process";
@@ -55493,152 +55781,6 @@ var init_selected_run = __esm(() => {
   init_execution_secrets();
 });
 
-// src/lib/cloud-executions.ts
-var exports_cloud_executions = {};
-__export(exports_cloud_executions, {
-  CloudExecutionClient: () => CloudExecutionClient
-});
-
-class CloudExecutionClient {
-  apiOrigin;
-  apiKey;
-  constructor(apiOrigin, apiKey) {
-    this.apiOrigin = apiOrigin;
-    this.apiKey = apiKey;
-  }
-  static async configured() {
-    const c = await resolveSkillsConnection();
-    if (!c)
-      throw Error("Cloud execution requires a configured Skills API credential");
-    return new CloudExecutionClient(c.apiOrigin, c.apiKey);
-  }
-  async request(route, method = "GET", value) {
-    const response = await fetch(skillsApiRequestUrl(this.apiOrigin, "/api/v1/executions/" + route), {
-      method,
-      headers: {
-        authorization: `Bearer ${this.apiKey}`,
-        "User-Agent": `hasna-skills/${package_default.version}`,
-        ...value === undefined ? {} : { "content-type": "application/json" }
-      },
-      ...value === undefined ? {} : { body: JSON.stringify(value) },
-      redirect: "error",
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      response.body?.cancel();
-      throw Error(`Skills cloud execution refused: HTTP ${response.status}`);
-    }
-    return response;
-  }
-  async submit(slug2, version2, input2, key, selection2) {
-    if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2))
-      throw Error("Cloud execution requires skill@exact-version");
-    if (!/^[A-Za-z0-9._:-]{1,128}$/.test(key))
-      throw Error("Invalid idempotency key");
-    if (selection2?.authority && selection2.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
-      throw Error("Selected skill belongs to another Skills authority");
-    const execution = parseExecution(await jsonBody(await this.request(slug2, "POST", {
-      version: version2,
-      input: input2,
-      idempotencyKey: key,
-      ...selection2 ? {
-        bundleDigest: selection2.bundleDigest,
-        workspaceId: selection2.workspaceId
-      } : {}
-    })));
-    if (execution.skill !== slug2 || execution.version !== version2 || selection2 && execution.bundleDigest.replace(/^sha256:/, "") !== selection2.bundleDigest.replace(/^sha256:/, ""))
-      throw Error("Cloud execution receipt does not match the selected exact skill");
-    return execution;
-  }
-  async get(id2) {
-    return parseExecution(await jsonBody(await this.request(runId(id2))));
-  }
-  async logs(id2) {
-    return jsonBody(await this.request(runId(id2) + "/logs"));
-  }
-  async artifacts(id2) {
-    return (await this.get(id2)).artifacts;
-  }
-  async download(id2, name) {
-    if (!["document.pdf", "document.html"].includes(name))
-      throw Error("Invalid cloud artifact name");
-    const response = await this.request(runId(id2) + "/artifacts/" + encodeURIComponent(name));
-    if (!response.body)
-      throw Error("Cloud artifact body is missing");
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    for (;; ) {
-      const r2 = await reader.read();
-      if (r2.done)
-        break;
-      size += r2.value.length;
-      if (size > 2000000) {
-        await reader.cancel();
-        throw Error("Cloud artifact exceeds limit");
-      }
-      chunks.push(r2.value);
-    }
-    return Buffer.concat(chunks);
-  }
-  async cancel(id2) {
-    return parseExecution(await jsonBody(await this.request(runId(id2) + "/cancel", "POST", {})));
-  }
-  async wait(id2, options = {}) {
-    const timeout = options.timeoutMs ?? 300000, interval = options.intervalMs ?? 1000;
-    if (!Number.isFinite(timeout) || timeout < 1 || timeout > 1200000 || !Number.isFinite(interval) || interval < 100 || interval > 60000)
-      throw Error("Invalid cloud polling bounds");
-    const until = Date.now() + timeout;
-    for (;; ) {
-      const run = await this.get(id2);
-      if (["succeeded", "failed", "cancelled"].includes(run.status))
-        return run;
-      if (Date.now() >= until)
-        throw Error("Cloud execution is still running; poll the returned execution id");
-      await Bun.sleep(interval);
-    }
-  }
-}
-function runId(id2) {
-  if (!/^run_[a-z0-9_]+$/.test(id2))
-    throw Error("Invalid cloud execution id");
-  return id2;
-}
-function parseExecution(value) {
-  const v = value;
-  if (!v || v.contractVersion !== 1 || v.target !== "cloud" || ![
-    "admitted",
-    "leased",
-    "running",
-    "succeeded",
-    "failed",
-    "cancelled"
-  ].includes(v.status) || typeof v.skill !== "string" || typeof v.version !== "string" || !Array.isArray(v.artifacts))
-    throw Error("Unsupported cloud execution response");
-  runId(v.id);
-  for (const field of [
-    "bundleDigest",
-    "inputDigest",
-    "runtimeImageDigest"
-  ])
-    if (typeof v[field] !== "string" || !/^(sha256:)?[a-f0-9]{64}$/.test(v[field]))
-      throw Error("Invalid cloud execution integrity receipt");
-  return v;
-}
-async function jsonBody(response) {
-  const bytes = await readBoundedResponse(response, 1e5);
-  try {
-    return JSON.parse(new TextDecoder().decode(bytes));
-  } catch {
-    throw Error("Invalid cloud execution JSON response");
-  }
-}
-var init_cloud_executions = __esm(() => {
-  init_package();
-  init_remote_files();
-  init_fleet_credentials();
-});
-
 // src/lib/blog-article.ts
 var exports_blog_article = {};
 __export(exports_blog_article, {
@@ -55773,6 +55915,18 @@ var init_blog_article = __esm(() => {
 import { existsSync as existsSync15, readdirSync as readdirSync9, statSync as statSync10 } from "fs";
 import { join as join24 } from "path";
 function registerOperationTools(server) {
+  server.registerTool("cloud_skill_eligibility", {
+    title: "Cloud Skill Eligibility",
+    description: "Inspect the authenticated workspace's exact reviewed cloud contract. Does not execute or admit a skill.",
+    inputSchema: { name: exports_external.string(), version: exports_external.string(), bundleDigest: exports_external.string().optional() }
+  }, async ({ name, version: version2, bundleDigest }) => {
+    try {
+      const { CloudExecutionClient: CloudExecutionClient2 } = await Promise.resolve().then(() => (init_cloud_executions(), exports_cloud_executions));
+      return mcpJson(await (await CloudExecutionClient2.configured()).eligibility(name, version2, bundleDigest));
+    } catch (error61) {
+      return mcpError("CLOUD_ELIGIBILITY_FAILED", error61.message);
+    }
+  });
   server.registerTool("scaffold_skill", {
     title: "Scaffold Skill",
     description: "Create a portable skill folder under ~/.hasna/skills/installed/<name> with SKILL.md, skill.json, AGENTS.md, package.json, and src/index.ts.",