@hasna/skills 0.8.11 → 0.9.1

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.11",
+  version: "0.9.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -34897,6 +34897,9 @@ class MemorySkillSelectionStore {
   async getProfile(p2, id) {
     return structuredClone(this.profiles.get(this.key(p2.orgId, id)) ?? null);
   }
+  async profilesReferencingSkill(p2, slug) {
+    return [...this.profiles.values()].filter((profile2) => profile2.workspaceId === p2.orgId && profile2.selections.some((selection) => selection.slug === slug)).map((profile2) => profile2.id).sort();
+  }
   async saveProfile(p2, id, selected, expected) {
     const key = this.key(p2.orgId, id), previous = this.profiles.get(key);
     if ((previous?.revision ?? null) !== expected)
@@ -34934,14 +34937,25 @@ class SqliteSkillSelectionStore {
   constructor(db) {
     this.db = db;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(p2.orgId);
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id) {
     const row = this.db.query("SELECT * FROM skills_profiles WHERE org_id=? AND profile_id=?").get(p2.orgId, id);
     return row ? profile(row) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID2(), timestamp = new Date().toISOString();
-    const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id, expected);
-    return row ? profile(row) : null;
+    return this.db.transaction(() => {
+      for (const selection of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const skill = this.db.query("SELECT lifecycle FROM skills_registry WHERE org_id=? AND slug=?").get(p2.orgId, selection.slug);
+        if (skill?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id, expected);
+      return row ? profile(row) : null;
+    }).immediate();
   }
   async getStationState(p2, id) {
     const row = this.db.query("SELECT * FROM skills_station_state WHERE org_id=? AND actor_id=? AND station_id=?").get(p2.orgId, p2.userId, id);
@@ -34960,14 +34974,25 @@ class PostgresSkillSelectionStore {
   constructor(sql) {
     this.sql = sql;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = await this.sql`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${p2.orgId}`;
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id) {
     const rows = await this.sql`SELECT * FROM skills_profiles WHERE org_id=${p2.orgId} AND profile_id=${id}`;
     return rows[0] ? profile(rows[0]) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID2(), timestamp = new Date().toISOString();
-    const rows = expected === null ? await this.sql`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await this.sql`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
-    return rows[0] ? profile(rows[0]) : null;
+    return this.sql.begin(async (tx) => {
+      for (const selection of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const rows2 = await tx`SELECT lifecycle FROM skills_registry WHERE org_id=${p2.orgId} AND slug=${selection.slug} FOR UPDATE`;
+        if (rows2[0]?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const rows = expected === null ? await tx`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await tx`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
+      return rows[0] ? profile(rows[0]) : null;
+    });
   }
   async getStationState(p2, id) {
     const rows = await this.sql`SELECT * FROM skills_station_state WHERE org_id=${p2.orgId} AND actor_id=${p2.userId} AND station_id=${id}`;
@@ -35161,7 +35186,11 @@ function rowToSkill(row) {
     revisionId: String(row.revision_id ?? ""),
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
-    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    lifecycle: row.lifecycle === "archived" ? "archived" : "active",
+    ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
+    ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
+    ...row.replacement_slug ? { replacementSlug: String(row.replacement_slug) } : {}
   };
 }
 function rowToPin(row) {
@@ -35280,11 +35309,22 @@ class SkillVersionExistsError extends Error {
   }
 }
 
+class SkillLifecycleConflictError extends Error {
+  slug;
+  profiles;
+  constructor(slug, profiles) {
+    super(`cannot archive '${slug}' while active profiles reference it: ${profiles.join(", ")}`);
+    this.slug = slug;
+    this.profiles = profiles;
+    this.name = "SkillLifecycleConflictError";
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash5 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -35296,7 +35336,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical = JSON.stringify(canonicalContent);
   return createHash5("sha256").update(canonical).digest("hex");
 }
 function revisionIdOfRecord(record) {
@@ -35399,6 +35445,28 @@ class SqliteSkillsStore {
       scopes: parseScopes(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    const row = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+    if (!row)
+      return { kind: "not_found" };
+    const current = parseScopes(row.scopes_json);
+    if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+      return { kind: "stale", scopes: current };
+    }
+    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const tx = this.db.transaction(() => {
+      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), keyId, actor.orgId, JSON.stringify(expectedScopes)]);
+      if (changed.changes !== 1)
+        return false;
+      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json) VALUES (?, ?, ?, ?, ?, ?, ?)", [actor.orgId, actor.userId, actor.apiKeyId, "api_key_scopes_added", "api_key", keyId, JSON.stringify({ added: addScopes, scopes })]);
+      return true;
+    });
+    if (!tx()) {
+      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
+    }
+    return { kind: "updated", scopes };
+  }
   async createRun(input) {
     if (input.idempotencyKey) {
       const existing = this.get("SELECT * FROM skills_runs WHERE org_id = ? AND idempotency_key = ? LIMIT 1", [input.principal.orgId, input.idempotencyKey]);
@@ -35720,6 +35788,39 @@ class SqliteSkillsStore {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.db.transaction(() => {
+      const rowCurrent = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+      const current = rowCurrent ? rowToSkill(rowCurrent) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(principal.orgId);
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = { ...current, lifecycle: patch.lifecycle, updatedAt: nowIso(), ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {} };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
+      if (!row)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
+      return rowToSkill(row);
+    }).immediate();
+  }
+  getSkillSync(principal, slug) {
+    const row = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+    return row ? rowToSkill(row) : null;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -35832,13 +35933,13 @@ class SqliteSkillsStore {
   }
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
-    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+    return this.all("SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id=t.org_id AND s.slug=t.slug WHERE t.org_id = ? AND s.lifecycle='active' ORDER BY t.tag ASC", [principal.orgId]).map((row) => String(row.tag));
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     return this.all(`SELECT s.* FROM skills_registry s
        JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
   }
   async listPinsByTag(principal, tag) {
@@ -35846,7 +35947,7 @@ class SqliteSkillsStore {
     return this.all(`SELECT p.* FROM skills_pins p
        JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
        JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
-       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
   }
   async listPublishedSlugs(principal) {
@@ -36795,6 +36896,15 @@ class SkillRequestError extends Error {
     this.code = code;
   }
 }
+function skillLifecyclePatch(body) {
+  if (body.lifecycle !== "active" && body.lifecycle !== "archived")
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "lifecycle must be active or archived");
+  if (body.reason !== undefined && (typeof body.reason !== "string" || body.reason.length > 512))
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "reason must be at most 512 characters");
+  if (body.replacementSlug !== undefined && (typeof body.replacementSlug !== "string" || !SLUG_PATTERN.test(body.replacementSlug)))
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "replacementSlug must be a valid skill slug");
+  return { lifecycle: body.lifecycle, ...body.reason ? { reason: body.reason } : {}, ...body.replacementSlug ? { replacementSlug: body.replacementSlug } : {} };
+}
 function publishedSkillMeta(record) {
   return {
     name: record.slug,
@@ -36819,7 +36929,11 @@ function publishedPayload(record, opts = {}) {
     publishedAt: record.createdAt,
     updatedAt: record.updatedAt,
     revisionId: record.revisionId,
-    revisionNumber: record.revisionNumber
+    revisionNumber: record.revisionNumber,
+    lifecycle: record.lifecycle,
+    ...record.archivedAt ? { archivedAt: record.archivedAt } : {},
+    ...record.archiveReason ? { archiveReason: record.archiveReason } : {},
+    ...record.replacementSlug ? { replacementSlug: record.replacementSlug } : {}
   };
 }
 function revisionEtag(revisionId) {
@@ -36859,7 +36973,7 @@ async function tombstoneStatus(store, artifactStorage, principal, record) {
   };
 }
 async function listMergedSkills(store, principal) {
-  return (await store.listSkills(principal)).sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record) => publishedPayload(record));
+  return (await store.listSkills(principal)).filter((record) => record.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record) => publishedPayload(record));
 }
 async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
   const record = await store.getSkill(principal, slug);
@@ -36876,7 +36990,7 @@ async function listOrgTags(store, principal) {
   return [...new Set((await store.listTags(principal)).filter((tag) => tag.trim()))].sort();
 }
 async function listMergedSkillsByTag(store, principal, tag) {
-  return (await store.listSkillsByTag(principal, tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record) => publishedPayload(record));
+  return (await store.listSkillsByTag(principal, tag)).filter((record) => record.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record) => publishedPayload(record));
 }
 function skillSummary(skill) {
   return {
@@ -37438,6 +37552,8 @@ async function validatePublished(store, principal, selections2) {
     const current = await store.getSkill(principal, selection2.slug);
     if (!current || current.tombstonedAt)
       throw new SkillRequestError(current?.tombstonedAt ? 410 : 404, "SELECTION_UNAVAILABLE", `Selected skill '${selection2.slug}' is unavailable`);
+    if (current.lifecycle === "archived")
+      throw new SkillRequestError(409, "SELECTION_ARCHIVED", `Selected skill '${selection2.slug}' is archived`);
     const version2 = await store.getSkillVersion(principal, selection2.slug, selection2.version);
     if (!version2 || `sha256:${version2.bundleSha256}` !== selection2.bundleDigest)
       throw new SkillRequestError(409, "SELECTION_VERSION_MISMATCH", `Selected version of '${selection2.slug}' does not match its published digest`);
@@ -38165,6 +38281,7 @@ function createSubmitRunService(options) {
       const policy = { ...DEFAULT_RUN_POLICY, ...input.policy };
       input = {
         ...input,
+        ...input.executionContract ? { executionContract: { ...input.executionContract } } : {},
         systemDeps: [...input.systemDeps ?? []],
         policy: { ...policy, egressAllowlist: [...policy.egressAllowlist] },
         limits: { ...DEFAULT_RUN_LIMITS, ...input.limits }
@@ -38173,7 +38290,7 @@ function createSubmitRunService(options) {
       const byKey = await store.getRunByKey(input.tenantId, input.idempotencyKey);
       if (byKey)
         return { run: ownedAdmission(byKey.admission), created: false };
-      const byDigests = await store.getRunByDigests({
+      const byDigests = input.executionContract ? null : await store.getRunByDigests({
         tenantId: input.tenantId,
         skillId: input.skillId,
         skillVersion: input.skillVersion,
@@ -38195,6 +38312,7 @@ function createSubmitRunService(options) {
         bundleDigest: input.bundleDigest,
         runtimeImageDigest: image.runtimeImageDigest,
         dependencyLayerTag: image.dependencyLayerTag,
+        ...input.executionContract ? { executionContract: { ...input.executionContract } } : {},
         inputDigest,
         runtime: image.runtime,
         policy: { ...DEFAULT_RUN_POLICY, ...input.policy },
@@ -38210,6 +38328,7 @@ function createSubmitRunService(options) {
 function ownedAdmission(admission) {
   return {
     ...admission,
+    ...admission.executionContract ? { executionContract: { ...admission.executionContract } } : {},
     policy: { ...admission.policy, egressAllowlist: [...admission.policy.egressAllowlist] },
     limits: { ...admission.limits }
   };
@@ -38350,6 +38469,7 @@ function createReceiptService(store) {
         runtimeImageDigest: input.admission.runtimeImageDigest,
         bundleDigest: input.admission.bundleDigest,
         dependencyLayerTag: input.admission.dependencyLayerTag,
+        ...input.admission.executionContract ? { executionContract: { ...input.admission.executionContract } } : {},
         policy: input.admission.policy,
         limits: input.admission.limits,
         exitCode: null,
@@ -41823,7 +41943,7 @@ class EcsDispatcher {
   }
   cancellationReceipt(receipt, admission, attempt) {
     try {
-      return !!receipt && receipt.runId === admission.runId && receipt.attemptId === attempt.attemptId && !!attempt.clientToken && receipt.clientToken === attempt.clientToken && !!attempt.requestDigest && receipt.requestDigest === attempt.requestDigest && !!attempt.startedBy && receipt.startedBy === attempt.startedBy && receipt.bundleDigest === admission.bundleDigest && receipt.runtimeImageDigest === admission.runtimeImageDigest && receipt.dependencyLayerTag === admission.dependencyLayerTag && canonicalJson(receipt.policy) === canonicalJson(admission.policy) && canonicalJson(receipt.limits) === canonicalJson(admission.limits) && (receipt.taskId === null || receipt.taskId === attempt.taskId) && (receipt.status === null && receipt.completedAt === null || receipt.status === "cancelled" && typeof receipt.completedAt === "string" && Number.isFinite(Date.parse(receipt.completedAt)));
+      return !!receipt && receipt.runId === admission.runId && receipt.attemptId === attempt.attemptId && !!attempt.clientToken && receipt.clientToken === attempt.clientToken && !!attempt.requestDigest && receipt.requestDigest === attempt.requestDigest && !!attempt.startedBy && receipt.startedBy === attempt.startedBy && receipt.bundleDigest === admission.bundleDigest && receipt.runtimeImageDigest === admission.runtimeImageDigest && receipt.dependencyLayerTag === admission.dependencyLayerTag && canonicalJson(receipt.executionContract ?? null) === canonicalJson(admission.executionContract ?? null) && canonicalJson(receipt.policy) === canonicalJson(admission.policy) && canonicalJson(receipt.limits) === canonicalJson(admission.limits) && (receipt.taskId === null || receipt.taskId === attempt.taskId) && (receipt.status === null && receipt.completedAt === null || receipt.status === "cancelled" && typeof receipt.completedAt === "string" && Number.isFinite(Date.parse(receipt.completedAt)));
     } catch {
       return false;
     }
@@ -41920,7 +42040,174 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash10, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash11, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/server/runtime-pure-contract.ts
+import { createHash as createHash10 } from "crypto";
+var PURE_DESCRIPTOR = Object.freeze({
+  id: "regex-test.v1",
+  runtime: "bun",
+  adapter: "skills-input-json.v1",
+  input: Object.freeze({ patternBytes: 512, textBytes: 4096, totalBytes: 8192, flags: "dgimsuvy" }),
+  output: "regex-matches.v1",
+  secrets: "none",
+  egress: "deny",
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  stdoutBytes: 16384,
+  stderrBytes: 8192,
+  artifactsBytes: 0
+});
+var PURE_DESCRIPTOR_DIGEST = digestInput(PURE_DESCRIPTOR);
+var PURE_LIMITS = Object.freeze({
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  maxArtifactsBytes: 0,
+  maxConcurrency: 1
+});
+var hash = (bytes) => createHash10("sha256").update(bytes).digest("hex");
+var object2 = (v2) => {
+  if (!v2 || typeof v2 !== "object" || Array.isArray(v2))
+    throw Error("Pure contract requires an object");
+  return v2;
+};
+function keys2(v2, allowed) {
+  if (Object.keys(v2).some((k4) => !allowed.includes(k4)))
+    throw Error("Unsupported pure contract field");
+}
+function uniqueJson(text) {
+  const result = JSON.parse(text);
+  let i4 = 0;
+  const ws = () => {
+    while (/\s/.test(text[i4] ?? "") && i4 < text.length)
+      i4++;
+  };
+  const string = () => {
+    const start = i4++;
+    while (i4 < text.length) {
+      const c4 = text[i4++];
+      if (c4 === "\\")
+        i4++;
+      else if (c4 === '"')
+        break;
+    }
+    return JSON.parse(text.slice(start, i4));
+  };
+  const value = (depth) => {
+    if (depth > 32)
+      throw Error("JSON nesting limit exceeded");
+    ws();
+    if (text[i4] === '"') {
+      string();
+      return;
+    }
+    if (text[i4] === "{") {
+      i4++;
+      ws();
+      const seen = new Set;
+      if (text[i4] === "}") {
+        i4++;
+        return;
+      }
+      for (;; ) {
+        ws();
+        const key = string();
+        if (seen.has(key))
+          throw Error("Duplicate JSON key");
+        seen.add(key);
+        ws();
+        i4++;
+        value(depth + 1);
+        ws();
+        if (text[i4++] === "}")
+          return;
+      }
+    }
+    if (text[i4] === "[") {
+      i4++;
+      ws();
+      if (text[i4] === "]") {
+        i4++;
+        return;
+      }
+      for (;; ) {
+        value(depth + 1);
+        ws();
+        if (text[i4++] === "]")
+          return;
+      }
+    }
+    while (i4 < text.length && !/[\s,\]}]/.test(text[i4]))
+      i4++;
+  };
+  value(0);
+  return result;
+}
+function pureInput(value) {
+  const v2 = object2(value);
+  keys2(v2, ["pattern", "text", "flags"]);
+  if (typeof v2.pattern !== "string" || Buffer.byteLength(v2.pattern) > 512 || typeof v2.text !== "string" || Buffer.byteLength(v2.text) > 4096 || typeof v2.flags !== "string" || !/^[dgimsuvy]*$/.test(v2.flags) || new Set(v2.flags).size !== v2.flags.length || v2.flags.includes("u") && v2.flags.includes("v") || Buffer.byteLength(JSON.stringify(v2)) > 8192)
+    throw Error("Invalid pure regex input");
+  return { pattern: v2.pattern, text: v2.text, flags: v2.flags };
+}
+function assertPureContract(value) {
+  const v2 = object2(value);
+  keys2(v2, ["id", "descriptorDigest", "entrypoint", "entrypointDigest"]);
+  if (v2.id !== PURE_DESCRIPTOR.id || v2.descriptorDigest !== PURE_DESCRIPTOR_DIGEST || typeof v2.entrypoint !== "string" || !/^src\/[a-zA-Z0-9_/-]+\.[cm]?[jt]s$/.test(v2.entrypoint) || v2.entrypoint.includes("//") || typeof v2.entrypointDigest !== "string" || !/^[a-f0-9]{64}$/.test(v2.entrypointDigest))
+    throw Error("Unsupported pure execution contract");
+}
+function assertPureAdmission(a4) {
+  assertPureContract(a4.executionContract);
+  if (a4.runtime !== "bun" || a4.dependencyLayerTag !== null || a4.policy.egress !== "deny" || a4.policy.egressAllowlist.length !== 0 || a4.policy.networkByteCap !== 0 || Object.entries(PURE_LIMITS).some(([k4, v2]) => a4.limits[k4] !== v2))
+    throw Error("Pure admission isolation policy mismatch");
+  return a4.executionContract;
+}
+async function inspectPureBundle(bytes, contract) {
+  assertPureContract(contract);
+  const { entries } = await inspectSkillBundle(bytes, { limits: {
+    compressedBytes: 1e6,
+    decompressedBytes: 4000000,
+    fileBytes: 1e6,
+    entries: 100,
+    timeoutMs: 5000
+  } });
+  const entry = entries.find((e4) => e4.path === contract.entrypoint);
+  if (!entry || hash(entry.bytes) !== contract.entrypointDigest)
+    throw Error("Pure entrypoint integrity failed");
+  if (entries.some((e4) => e4.path.split("/").includes("node_modules")))
+    throw Error("Pure bundle cannot supply dependencies");
+  const read = (name) => {
+    const entry2 = entries.find((e4) => e4.path === name);
+    if (!entry2)
+      throw Error("Pure bundle manifest missing");
+    return object2(uniqueJson(Buffer.from(entry2.bytes).toString("utf8")));
+  };
+  const manifest = read("skill.json"), runtime = object2(manifest.runtime), pkg = read("package.json");
+  if (manifest.kind !== "executable" || runtime.runtime !== "bun" || runtime.entrypoint !== contract.entrypoint || !Array.isArray(runtime.env) || runtime.env.length !== 0 || runtime.system_deps !== undefined && (!Array.isArray(runtime.system_deps) || runtime.system_deps.length !== 0) || runtime.needs_network === true || manifest.needs_network === true)
+    throw Error("Pure bundle requires a credential-free self-contained Bun entrypoint");
+  for (const key of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies", "scripts"])
+    if (pkg[key] !== undefined && Object.keys(object2(pkg[key])).length)
+      throw Error("Pure bundle cannot install dependencies or lifecycle scripts");
+  return entries;
+}
+function validatePureOutput(stdout, input) {
+  if (Buffer.byteLength(stdout) > PURE_DESCRIPTOR.stdoutBytes)
+    throw Error("Pure output limit exceeded");
+  const v2 = object2(uniqueJson(stdout));
+  keys2(v2, ["pattern", "flags", "matches"]);
+  if (v2.pattern !== input.pattern || v2.flags !== input.flags || !Array.isArray(v2.matches))
+    throw Error("Pure output does not match admitted input");
+  for (const value of v2.matches) {
+    const m2 = object2(value);
+    keys2(m2, ["match", "groups", "namedGroups", "index"]);
+    if (typeof m2.match !== "string" || !Number.isInteger(m2.index) || m2.index < 0 || m2.index > input.text.length || input.text.slice(m2.index, m2.index + m2.match.length) !== m2.match || !Array.isArray(m2.groups) || m2.groups.some((x2) => x2 !== null && typeof x2 !== "string") || m2.namedGroups !== null && Object.values(object2(m2.namedGroups)).some((x2) => typeof x2 !== "string"))
+      throw Error("Invalid pure match output");
+  }
+}
+
+// src/server/runtime-policy.ts
 var RUNTIME_MAX_INPUT_BYTES = 1e5;
 var RUNTIME_MAX_BUNDLE_BYTES = 1e6;
 var RUNTIME_MAX_ARTIFACT_BYTES = 2000000;
@@ -41955,8 +42242,25 @@ function readRuntimeConfig(env = process.env) {
   for (const key of ["subnets", "securityGroups"])
     if (!Array.isArray(c4[key]) || !c4[key].length || c4[key].some((v2) => typeof v2 !== "string" || !v2))
       throw Error(`Runtime configuration missing ${key}`);
-  if (!Array.isArray(c4.reviewedBundles) || !c4.reviewedBundles.length || c4.reviewedBundles.some((b4) => b4.slug !== "pdf-generate" || typeof b4.version !== "string" || !/^\d+\.\d+\.\d+$/.test(b4.version) || !/^[a-f0-9]{64}$/.test(b4.sha256)))
-    throw Error("Runtime requires exact reviewed pdf-generate versions and bundle digests");
+  if (!Array.isArray(c4.reviewedBundles) || !c4.reviewedBundles.length)
+    throw Error("Runtime requires exact reviewed versions and bundle digests");
+  const seen = new Set;
+  for (const b4 of c4.reviewedBundles) {
+    if (!b4 || typeof b4.slug !== "string" || !/^[a-z0-9-]+$/.test(b4.slug) || typeof b4.version !== "string" || !/^\d+\.\d+\.\d+$/.test(b4.version) || !/^[a-f0-9]{64}$/.test(b4.sha256))
+      throw Error("Runtime requires exact reviewed versions and bundle digests");
+    if (b4.executionContract) {
+      if (b4.slug === "pdf-generate")
+        throw Error("pdf-generate is reserved for the legacy PDF contract");
+      assertPureContract(b4.executionContract);
+      if (typeof b4.tenantId !== "string" || !b4.tenantId.trim() || b4.imageDigest !== c4.imageDigest)
+        throw Error("Pure runtime review must bind tenant and configured image");
+    } else if (b4.slug !== "pdf-generate")
+      throw Error("Missing reviewed execution contract");
+    const key = JSON.stringify([b4.executionContract ? b4.tenantId : null, b4.slug, b4.version, b4.sha256]);
+    if (seen.has(key))
+      throw Error("Ambiguous runtime review");
+    seen.add(key);
+  }
   return c4;
 }
 function runtimeInput(value) {
@@ -41992,7 +42296,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash10("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash11("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -42068,7 +42372,7 @@ async function body3(request, max) {
     }
     chunks.push(v2.value);
   }
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  return uniqueJson(Buffer.concat(chunks).toString("utf8"));
 }
 var scope = (p2, action) => p2.scopes.includes("*") || p2.scopes.includes("runs:*") || p2.scopes.includes(action) || action === "runs:read" && p2.scopes.includes("skills:read");
 function publicJob(job) {
@@ -42082,6 +42386,7 @@ function publicJob(job) {
     bundleDigest: a4.bundleDigest,
     inputDigest: a4.inputDigest,
     runtimeImageDigest: a4.runtimeImageDigest,
+    executionContract: a4.executionContract ?? { id: "pdf.v1" },
     status: job.execution.status,
     createdAt: a4.createdAt,
     updatedAt: job.execution.updatedAt,
@@ -42092,6 +42397,33 @@ function publicJob(job) {
     artifacts: (job.result?.artifacts ?? []).map(({ base64, ...meta }) => meta)
   };
 }
+function findReview(service, tenant, slug, version2, sha256) {
+  return service.config.reviewedBundles.find((b4) => b4.slug === slug && b4.version === version2 && b4.sha256 === sha256 && (!b4.executionContract || b4.tenantId === tenant && b4.imageDigest === service.config.imageDigest));
+}
+function sameContract(admission, contract, image) {
+  return digestInput(admission.executionContract ?? null) === digestInput(contract ?? null) && (!contract || admission.runtimeImageDigest === image);
+}
+
+class RuntimeBundleError extends Error {
+  code;
+  status;
+  constructor(code, status) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+}
+async function reviewedBytes(service, principal, digest2) {
+  const bundle = await service.productStore.getSkillBundle(principal, digest2);
+  if (!bundle)
+    throw new RuntimeBundleError("BUNDLE_UNAVAILABLE", 503);
+  if (bundle.byteSize > RUNTIME_MAX_BUNDLE_BYTES)
+    throw new RuntimeBundleError("BUNDLE_LIMIT", 413);
+  const bytes = await service.artifacts.readBundle(bundle);
+  if (!bytes || bytes.length > RUNTIME_MAX_BUNDLE_BYTES || hashBytes(bytes) !== digest2)
+    throw new RuntimeBundleError("BUNDLE_INTEGRITY_FAILED", 503);
+  return bytes;
+}
 async function handleRuntimeApiRequest(request, principal, service) {
   const segments = path(request);
   if (segments[0] !== "api" || segments[1] !== "v1" || segments[2] !== "executions")
@@ -42104,9 +42436,50 @@ async function handleRuntimeApiRequest(request, principal, service) {
   if (!id || segments.length > 6 || !/^[a-z0-9_-]+$/.test(id))
     return refusal("INVALID_EXECUTION_PATH", 400);
   try {
+    if (request.method === "GET" && sub === "eligibility" && segments.length === 5) {
+      const query = new URL(request.url).searchParams;
+      const versionName = query.get("version");
+      if (!versionName || !/^\d+\.\d+\.\d+$/.test(versionName))
+        return refusal("REVIEWED_VERSION_REQUIRED", 400);
+      const skill = await service.productStore.getSkill(principal, id);
+      if (skill?.lifecycle === "archived")
+        return refusal("SKILL_ARCHIVED", 410);
+      const version2 = skill && !skill.tombstonedAt && await service.productStore.getSkillVersion(principal, id, versionName);
+      if (!version2)
+        return refusal("SKILL_VERSION_NOT_FOUND", 404);
+      const pinned = query.get("bundleDigest");
+      if (pinned && pinned.replace(/^sha256:/, "") !== version2.bundleSha256)
+        return refusal("SELECTION_DIGEST_MISMATCH", 409);
+      const review = findReview(service, principal.orgId, id, versionName, version2.bundleSha256);
+      if (!review)
+        return json3({
+          contractVersion: 1,
+          eligible: false,
+          reason: "BUNDLE_NOT_REVIEWED_FOR_CLOUD",
+          skill: id,
+          version: versionName,
+          bundleDigest: version2.bundleSha256
+        });
+      if (review.executionContract) {
+        const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+        await inspectPureBundle(bytes, review.executionContract);
+      }
+      return json3({
+        contractVersion: 1,
+        eligible: true,
+        skill: id,
+        version: versionName,
+        bundleDigest: version2.bundleSha256,
+        runtimeImageDigest: service.config.imageDigest,
+        executionContract: review.executionContract ?? { id: "pdf.v1" },
+        secrets: "none",
+        egress: "deny",
+        ...review.executionContract ? { descriptor: PURE_DESCRIPTOR, limits: PURE_LIMITS } : {}
+      });
+    }
     if (request.method === "POST" && !sub) {
       const raw = await body3(request, 150000);
-      if (id !== "pdf-generate" || typeof raw.version !== "string" || !/^\d+\.\d+\.\d+$/.test(raw.version))
+      if (typeof raw.version !== "string" || !/^\d+\.\d+\.\d+$/.test(raw.version))
         return refusal("REVIEWED_VERSION_REQUIRED", 400);
       if (Object.keys(raw).some((k4) => ![
         "version",
@@ -42118,31 +42491,32 @@ async function handleRuntimeApiRequest(request, principal, service) {
         return refusal("UNSUPPORTED_EXECUTION_FIELD", 400);
       if (raw.workspaceId !== undefined && raw.workspaceId !== principal.orgId)
         return refusal("SELECTION_WORKSPACE_MISMATCH", 409);
-      const input = runtimeInput(raw.input);
       const key = request.headers.get("idempotency-key") ?? raw.idempotencyKey;
       if (typeof key !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(key))
         return refusal("IDEMPOTENCY_KEY_REQUIRED", 400);
       const skill = await service.productStore.getSkill(principal, id);
       if (!skill || skill.tombstonedAt)
         return refusal("SKILL_NOT_FOUND", 404);
+      if (skill.lifecycle === "archived")
+        return refusal("SKILL_ARCHIVED", 410);
       const version2 = await service.productStore.getSkillVersion(principal, id, raw.version);
       if (!version2)
         return refusal("SKILL_VERSION_NOT_FOUND", 404);
       if (raw.bundleDigest !== undefined && (typeof raw.bundleDigest !== "string" || raw.bundleDigest.replace(/^sha256:/, "") !== version2.bundleSha256))
         return refusal("SELECTION_DIGEST_MISMATCH", 409);
-      if (!service.config.reviewedBundles.some((b4) => b4.slug === id && b4.version === raw.version && b4.sha256 === version2.bundleSha256))
+      const review = findReview(service, principal.orgId, id, raw.version, version2.bundleSha256);
+      if (!review)
         return refusal("BUNDLE_NOT_REVIEWED_FOR_CLOUD", 403);
+      const contract = review.executionContract;
+      if (contract && (raw.workspaceId !== principal.orgId || typeof raw.bundleDigest !== "string"))
+        return refusal("PURE_SELECTION_REQUIRED", 400);
+      const input = contract ? pureInput(raw.input) : runtimeInput(raw.input);
       const existing = await service.store.getRunByKey(principal.orgId, key);
-      if (existing && (existing.admission.skillId !== id || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version2.bundleSha256 || existing.admission.inputDigest !== digestInput(input)))
+      if (existing && (existing.admission.skillId !== id || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version2.bundleSha256 || existing.admission.inputDigest !== digestInput(input) || !sameContract(existing.admission, contract, service.config.imageDigest)))
         return refusal("IDEMPOTENCY_CONFLICT", 409);
-      const bundle = await service.productStore.getSkillBundle(principal, version2.bundleSha256);
-      if (!bundle)
-        return refusal("BUNDLE_UNAVAILABLE", 503);
-      if (bundle.byteSize > RUNTIME_MAX_BUNDLE_BYTES)
-        return refusal("BUNDLE_LIMIT", 413);
-      const bytes = await service.artifacts.readBundle(bundle);
-      if (!bytes || hashBytes(bytes) !== version2.bundleSha256)
-        return refusal("BUNDLE_INTEGRITY_FAILED", 503);
+      const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+      if (contract)
+        await inspectPureBundle(bytes, contract);
       const admission = createSubmitRunService({
         store: service.store,
         imageProfiles: createImageProfileRegistry({
@@ -42164,12 +42538,13 @@ async function handleRuntimeApiRequest(request, principal, service) {
         input,
         idempotencyKey: key,
         runtime: "bun",
-        limits: {
+        ...contract ? { executionContract: contract } : {},
+        limits: contract ? PURE_LIMITS : {
           maxDurationMs: RUNTIME_TIMEOUT_MS,
           maxArtifactsBytes: RUNTIME_MAX_ARTIFACT_BYTES
         }
       });
-      if (run.tenantId !== principal.orgId || run.skillId !== id || run.skillVersion !== raw.version || run.bundleDigest !== version2.bundleSha256 || run.inputDigest !== digestInput(input))
+      if (run.tenantId !== principal.orgId || run.skillId !== id || run.skillVersion !== raw.version || run.bundleDigest !== version2.bundleSha256 || run.inputDigest !== digestInput(input) || !sameContract(run, contract, service.config.imageDigest))
         return refusal("IDEMPOTENCY_CONFLICT", 409);
       await service.store.mutate(run.runId, (j4) => {
         if (!j4.input) {
@@ -42261,6 +42636,8 @@ async function handleRuntimeApiRequest(request, principal, service) {
     }
     return refusal("EXECUTION_ROUTE_NOT_FOUND", 404);
   } catch (error) {
+    if (error instanceof RuntimeBundleError)
+      return refusal(error.code, error.status);
     if (error.message === "Runtime concurrency limit reached")
       return refusal("RUNTIME_CONCURRENCY_LIMIT", 429);
     return refusal("EXECUTION_REQUEST_FAILED", 400, error.message.startsWith("PDF ") ? error.message : "Execution request could not be completed");
@@ -42291,7 +42668,7 @@ async function handleRuntimeWorkerRequest(request, service) {
   }
   if (request.method === "POST" && s2[4] === "complete") {
     try {
-      const result = validatedResult(await body3(request, 3000000));
+      const result = validatedResult(await body3(request, 3000000), job);
       await service.store.mutate(s2[3], (j4) => {
         if (j4.execution.status === "cancelled")
           throw Error("Execution cancelled");
@@ -42328,12 +42705,28 @@ async function handleRuntimeWorkerRequest(request, service) {
   }
   return refusal("METHOD_NOT_ALLOWED", 405);
 }
-function validatedResult(value) {
+function validatedResult(value, job) {
   if (!value || typeof value !== "object")
     throw Error("Invalid result");
   const v2 = value;
   if (!Number.isInteger(v2.exitCode) || v2.exitCode < 0 || v2.exitCode > 255 || typeof v2.stdout !== "string" || typeof v2.stderr !== "string" || Buffer.byteLength(v2.stdout) > RUNTIME_MAX_LOG_BYTES || Buffer.byteLength(v2.stderr) > RUNTIME_MAX_LOG_BYTES || !Array.isArray(v2.artifacts) || v2.artifacts.length > 2)
     throw Error("Invalid result");
+  if (job.execution.admission.executionContract) {
+    assertPureAdmission(job.execution.admission);
+    if (v2.artifacts.length || Buffer.byteLength(v2.stdout) > PURE_DESCRIPTOR.stdoutBytes || Buffer.byteLength(v2.stderr) > PURE_DESCRIPTOR.stderrBytes)
+      throw Error("Invalid pure result limits");
+    if (v2.exitCode === 0)
+      validatePureOutput(v2.stdout, pureInput(job.input));
+    return {
+      exitCode: v2.exitCode,
+      stdout: v2.stdout,
+      stderr: v2.stderr,
+      artifacts: [],
+      ...typeof v2.error === "string" ? { error: v2.error.slice(0, 500) } : {}
+    };
+  }
+  if (job.execution.admission.skillId !== "pdf-generate")
+    throw Error("Missing execution contract");
   let total = 0;
   const seen = new Set;
   for (const a4 of v2.artifacts) {
@@ -42510,8 +42903,22 @@ class MemorySkillsStore {
   async ensureBootstrapApiKey(token, principal) {
     this.addApiKey(token, principal);
   }
-  async authenticateApiKeyHash(hash) {
-    return this.apiKeys.get(hash) ?? null;
+  async authenticateApiKeyHash(hash2) {
+    return this.apiKeys.get(hash2) ?? null;
+  }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    for (const [hash2, target] of this.apiKeys) {
+      if (target.apiKeyId !== keyId || target.orgId !== actor.orgId)
+        continue;
+      if (target.scopes.length !== expectedScopes.length || target.scopes.some((scope2, index) => scope2 !== expectedScopes[index])) {
+        return { kind: "stale", scopes: [...target.scopes] };
+      }
+      const scopes = [...target.scopes, ...addScopes.filter((scope2) => !target.scopes.includes(scope2))];
+      const updated = { ...target, scopes };
+      this.apiKeys.set(hash2, updated);
+      return { kind: "updated", scopes };
+    }
+    return { kind: "not_found" };
   }
   async createRun(input) {
     const idemKey = input.idempotencyKey?.trim();
@@ -42642,7 +43049,11 @@ class MemorySkillsStore {
       createdAt: previous?.createdAt ?? now,
       updatedAt: now,
       revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
-      revisionNumber: (previous?.revisionNumber ?? 0) + 1
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      lifecycle: previous?.lifecycle ?? "active",
+      ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
+      ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
+      ...previous?.replacementSlug ? { replacementSlug: previous.replacementSlug } : {}
     };
     this.skills.set(key, record);
     if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
@@ -42678,6 +43089,33 @@ class MemorySkillsStore {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId)
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+      const profiles = await this.selectionStore.profilesReferencingSkill(principal, slug);
+      if (profiles.length)
+        throw new SkillLifecycleConflictError(slug, profiles);
+    }
+    const next2 = {
+      ...current,
+      lifecycle: patch.lifecycle,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+      revisionNumber: current.revisionNumber + 1,
+      ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+    };
+    if (patch.lifecycle === "active") {
+      delete next2.archivedAt;
+      delete next2.archiveReason;
+      delete next2.replacementSlug;
+    }
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -42748,7 +43186,7 @@ class MemorySkillsStore {
     await this.purgeExpiredTombstones(principal);
     const tags = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId !== principal.orgId)
+      if (skill.orgId !== principal.orgId || skill.lifecycle !== "active")
         continue;
       for (const tag of skill.tags) {
         if (tag.trim())
@@ -42759,13 +43197,13 @@ class MemorySkillsStore {
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
   }
   async listPinsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     const taggedSlugs = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag))
         taggedSlugs.add(skill.slug);
     }
     return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
@@ -42856,7 +43294,7 @@ class PostgresSkillsStore {
       ON CONFLICT (key_hash) DO NOTHING
     `;
   }
-  async authenticateApiKeyHash(hash) {
+  async authenticateApiKeyHash(hash2) {
     const rows = await this.sql`
       SELECT k.id AS api_key_id, k.scopes_json, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
              u.id AS user_id, u.email, m.role
@@ -42864,7 +43302,7 @@ class PostgresSkillsStore {
       JOIN organizations o ON o.id = k.org_id
       JOIN users u ON u.id = k.user_id
       LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
-      WHERE k.key_hash = ${hash} AND k.revoked_at IS NULL
+      WHERE k.key_hash = ${hash2} AND k.revoked_at IS NULL
       LIMIT 1
     `;
     const row = rows[0];
@@ -42882,6 +43320,38 @@ class PostgresSkillsStore {
       scopes: parseJsonArray(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+        SELECT scopes_json FROM api_keys
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+        LIMIT 1
+      `;
+      const row = rows[0];
+      if (!row)
+        return { kind: "not_found" };
+      const current = parseJsonArray(row.scopes_json);
+      if (current.length !== expectedScopes.length || current.some((scope2, index) => scope2 !== expectedScopes[index])) {
+        return { kind: "stale", scopes: current };
+      }
+      const scopes = [...current, ...addScopes.filter((scope2) => !current.includes(scope2))];
+      const updated = await tx`
+        UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+          AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        RETURNING scopes_json
+      `;
+      if (!updated[0]) {
+        const latest = await tx`SELECT scopes_json FROM api_keys WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL LIMIT 1`;
+        return { kind: "stale", scopes: latest[0] ? parseJsonArray(latest[0].scopes_json) : current };
+      }
+      await tx`
+        INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes })}::jsonb)
+      `;
+      return { kind: "updated", scopes };
+    });
+  }
   async withContext(orgId, worker, fn) {
     return this.sql.begin(async (tx) => {
       await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
@@ -43202,6 +43672,42 @@ class PostgresSkillsStore {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.sql.begin(async (tx) => {
+      const currentRows = await tx`SELECT * FROM skills_registry WHERE org_id=${principal.orgId} AND slug=${slug} LIMIT 1 FOR UPDATE`;
+      const current = currentRows[0] ? rowToSkill(currentRows[0]) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = await tx`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${principal.orgId}`;
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection2) => selection2?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = {
+        ...current,
+        lifecycle: patch.lifecycle,
+        updatedAt: nowIso(),
+        revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+        revisionNumber: current.revisionNumber + 1,
+        ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+      };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const rows = await tx`UPDATE skills_registry SET lifecycle=${next2.lifecycle}, archived_at=${next2.archivedAt ?? null}, archive_reason=${next2.archiveReason ?? null}, replacement_slug=${next2.replacementSlug ?? null}, revision_id=${next2.revisionId}, revision_number=revision_number+1, updated_at=${next2.updatedAt} WHERE org_id=${principal.orgId} AND slug=${slug} AND tombstoned_at IS NULL AND revision_id=${current.revisionId} RETURNING *`;
+      if (!rows[0])
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, (await this.getSkill(principal, slug))?.revisionId ?? null);
+      return rowToSkill(rows[0]);
+    });
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -43337,7 +43843,7 @@ class PostgresSkillsStore {
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
     const rows = await this.sql`
-      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+      SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id = t.org_id AND s.slug = t.slug WHERE t.org_id = ${principal.orgId} AND s.lifecycle = 'active' ORDER BY t.tag ASC
     `;
     return rows.map((row) => String(row.tag));
   }
@@ -43346,7 +43852,7 @@ class PostgresSkillsStore {
     const rows = await this.sql`
       SELECT s.* FROM skills_registry s
       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY s.slug ASC
     `;
     return rows.map(rowToSkill);
@@ -43358,7 +43864,7 @@ class PostgresSkillsStore {
       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
       WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
-        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY p.slug ASC
     `;
     return rows.map(rowToPin);
@@ -43455,7 +43961,7 @@ async function createSkillsFetchHandler(options = {}) {
         if (request.method === "GET" && url.pathname === "/api/v1/capabilities") {
           const response = await handleProfileApi(store, principal, request, ["capabilities"], config);
           const payload = await response.json();
-          return json4({ ...payload, cloudExecution: Boolean(runtime), capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
+          return json4({ ...payload, cloudExecution: Boolean(runtime), cloudExecutionContracts: runtime ? ["pdf.v1", "regex-test.v1"] : [], capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
         }
         if (request.method === "GET" && url.pathname === "/api/auth/whoami") {
           return json4(identityPayload(principal));
@@ -43479,6 +43985,9 @@ async function createSkillsFetchHandler(options = {}) {
           attemptedBundleSha256: error.attemptedSha256
         }, { status: 409 });
       }
+      if (error instanceof SkillLifecycleConflictError) {
+        return json4({ error: error.message, code: "SKILL_ARCHIVE_PROFILE_CONFLICT", profiles: error.profiles }, { status: 409 });
+      }
       if (error instanceof SkillRevisionConflictError) {
         return json4({
           error: error.message,
@@ -43517,6 +44026,32 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
   if (parts.some(segmentEscapesPath)) {
     return json4({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
+  if (parts.length === 4 && resource === "admin" && id === "keys" && subresource && childId === "scopes" && request.method === "PATCH") {
+    const adminScope = principal.scopes.includes("*") || principal.scopes.includes("skills:keys.admin");
+    if (!adminScope || !["owner", "admin"].includes(principal.role)) {
+      return json4({ error: "Key scope administration requires an owner/admin key with skills:keys.admin", code: "KEY_ADMIN_REQUIRED" }, { status: 403 });
+    }
+    if (!/^[A-Za-z0-9_-]+$/.test(subresource)) {
+      return json4({ error: "Key id must be url-safe (letters, digits, '_' or '-')", code: "INVALID_KEY_ID" }, { status: 400 });
+    }
+    const body4 = await readJson(request, config.requestBodyLimitBytes);
+    const expected = body4.expected_scopes;
+    const additions = body4.add_scopes;
+    if (!Array.isArray(expected) || !expected.every((scope2) => typeof scope2 === "string") || !Array.isArray(additions) || !additions.every((scope2) => typeof scope2 === "string")) {
+      return json4({ error: "expected_scopes and add_scopes must be arrays of scope strings", code: "INVALID_KEY_SCOPE_UPDATE" }, { status: 400 });
+    }
+    if (additions.length !== 1 || additions[0] !== "skills:publish") {
+      return json4({ error: "Only adding skills:publish to an existing Skills key is supported", code: "INVALID_KEY_SCOPE_UPDATE" }, { status: 400 });
+    }
+    const update = await store.updateApiKeyScopes?.(principal, subresource, expected, additions);
+    if (!update)
+      return json4({ error: "Key scope administration is unavailable", code: "KEY_SCOPE_UPDATE_UNAVAILABLE" }, { status: 501 });
+    if (update.kind === "not_found")
+      return json4({ error: "API key not found", code: "API_KEY_NOT_FOUND" }, { status: 404 });
+    if (update.kind === "stale")
+      return json4({ error: "API key scopes changed; re-read and retry with expected_scopes", code: "API_KEY_SCOPE_CONFLICT", keyId: subresource, scopes: update.scopes }, { status: 409 });
+    return json4({ keyId: subresource, orgId: principal.orgId, scopes: update.scopes, updated: true });
+  }
   if (!permitsSkillsRoute(principal, request.method, resource ?? "")) {
     return json4({ error: "The API key does not allow this operation", code: "INSUFFICIENT_SCOPE" }, { status: 403 });
   }
@@ -43550,6 +44085,13 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
     if (request.method === "GET" && id && subresource === "versions" && !childId) {
       return json4(await listSkillVersionsPayload(store, principal, id));
     }
+    if (request.method === "PATCH" && id && subresource === "lifecycle" && !childId) {
+      if (!["owner", "admin"].includes(principal.role))
+        return json4({ error: "Only organization owners or admins may change skill lifecycle", code: "LIFECYCLE_ROLE_REQUIRED" }, { status: 403 });
+      const expectedRevisionId = parseIfMatch(request.headers.get("if-match"));
+      const updated = await store.setSkillLifecycle(principal, id, skillLifecyclePatch(await readJson(request, config.requestBodyLimitBytes)), expectedRevisionId);
+      return updated ? json4(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json4({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+    }
     if (request.method === "GET" && id && subresource === "versions" && childId && !parts[4]) {
       const version2 = await readSkillVersion(store, principal, id, childId);
       const current = (await store.getSkill(principal, id))?.bundleSha256;
@@ -43708,8 +44250,11 @@ async function handleApiV1(store, governanceStore, principal, request, parts, co
   return json4({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
 }
 function identityPayload(principal) {
+  const safeKeyId = /^[A-Za-z0-9_-]{1,256}$/.test(principal.apiKeyId) ? principal.apiKeyId : undefined;
+  const safeScopes = principal.scopes.length <= 32 && principal.scopes.every((scope2) => scope2.length <= 128 && /^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope2)) ? [...new Set(principal.scopes)] : undefined;
   return {
     user: { id: principal.userId, email: principal.email, role: principal.role },
+    ...safeKeyId && safeScopes ? { apiKey: { id: safeKeyId, scopes: safeScopes } } : {},
     organization: { id: principal.orgId, slug: principal.orgSlug, name: principal.orgName }
   };
 }