@hasna/skills 0.8.12 → 0.9.1

package/README.md

@@ -592,13 +592,20 @@ before submitting again. The selected profile must include this exact version,
 and the consumer needs `runs:write` as well as `skills:read`.
 
 Cloud execution is enabled only when the deployment configures a reviewed image
-and exact bundle allowlist. The first supported lane is `pdf-generate`; arbitrary
-uploaded code is not admitted. Runs capture version, bundle digest, input digest,
+and exact bundle allowlist; arbitrary
+uploaded code is not admitted. The PDF lane accepts reviewed `pdf-generate` versions.
+The optional `regex-test.v1` pure contract accepts only a tenant-specific, reviewed
+self-contained Bun bundle, with no secrets, dependencies or network. Uploading or
+selecting a bundle never admits it to cloud execution. Check an exact version with
+`skills executions eligibility <skill> --skill-version <version> --json`; this
+reads metadata without creating a run. Runs capture version, bundle digest, input digest,
 runtime image digest, limits and policy. The cloud worker runs in a separate
 Fargate task; the skill process has no API/provider credentials, no network, a
 read-only root and bounded temporary storage, execution time and output.
 `GET /skills/v1/capabilities` reports whether this deployment has cloud execution
-configured. Authorization and runtime availability are checked separately.
+configured and lists supported `cloudExecutionContracts`. Each exact bundle needs
+its own review and admission; the flag does not promise arbitrary executable
+support. Authorization and runtime availability are checked separately.
 
 On a managed station, local execution also resolves the selected immutable
 bundle. Self-contained local executables run with explicit environment references
@@ -1433,7 +1440,7 @@ src/
 |---|---|---|
 | Catalog skills | 0 | `SKILLS.length` (`src/lib/registry-data/`) |
 | Categories | 17 | `CATEGORIES` (`src/lib/registry-types.ts`) |
-| MCP tools | 81 | `tools/list` against a live `buildServer()` |
+| MCP tools | 82 | `tools/list` against a live `buildServer()` |
 
 Every number in this table is re-derived from the source tree on each test run by
 `src/lib/readme-derived-counts.test.ts`, so a drifted figure fails a test rather

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.12",
+    version: "0.9.1",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39186,6 +39186,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -39198,7 +39199,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -39717,6 +39718,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync6(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -76206,6 +76213,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -76323,6 +76332,8 @@ var init_remote_registry = __esm(() => {
     tags: exports_external.array(exports_external.string()).optional(),
     dependencies: exports_external.array(exports_external.string()).optional(),
     version: exports_external.string().optional(),
+    revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+    lifecycle: exports_external.enum(["active", "archived"]).optional(),
     availability: remoteAvailabilitySchema.optional()
   }).passthrough().refine((skill) => skill.name || skill.slug, {
     message: "Remote skill requires name or slug"
@@ -77711,6 +77722,7 @@ __export(exports_remote_client, {
   RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteSkillLifecycleError: () => RemoteSkillLifecycleError,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
   RemoteRequestError: () => RemoteRequestError,
   RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
@@ -77842,6 +77854,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -78359,6 +78404,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -78510,9 +78568,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject2) => {
@@ -78527,7 +78589,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size2 += next.value.byteLength;
       if (size2 > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size2);
@@ -78538,11 +78600,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -78571,7 +78633,7 @@ async function createRemoteSkillsClient(env3 = process.env) {
 function createRemoteSkillsClientReadOnly(env3 = process.env) {
   return createRemoteSkillsClient(env3);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, KNOWN_SKILL_LIFECYCLE_CODES, RemoteSkillLifecycleError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
   init_remote_recurring();
   init_remote_invitations();
@@ -78608,6 +78670,17 @@ var init_remote_client = __esm(() => {
       this.name = "RemoteRequestError";
     }
   };
+  KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+  RemoteSkillLifecycleError = class RemoteSkillLifecycleError extends RemoteRequestError {
+    code;
+    constructor(path, status, code) {
+      super(path, status);
+      this.name = "RemoteSkillLifecycleError";
+      const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+      this.code = safeCode;
+      this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+    }
+  };
   RemoteCreditCheckoutError = class RemoteCreditCheckoutError extends RemoteRequestError {
     code;
     requestIdempotencyKey;
@@ -78663,7 +78736,7 @@ var init_remote_client = __esm(() => {
 // src/lib/revision.ts
 import { createHash as createHash16 } from "crypto";
 function revisionIdOf(content) {
-  const canonical4 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -78675,7 +78748,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
   return createHash16("sha256").update(canonical4).digest("hex");
 }
 var REVISION_ID_PATTERN;
@@ -82131,6 +82210,15 @@ class CloudExecutionClient {
     }
     return response;
   }
+  async eligibility(slug2, version2, bundleDigest) {
+    if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
+      throw Error("Cloud eligibility requires an exact skill version and valid digest");
+    const query = new URLSearchParams({ version: version2, ...bundleDigest ? { bundleDigest } : {} });
+    const v = await jsonBody(await this.request(`${slug2}/eligibility?${query}`));
+    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug2 || v.version !== version2 || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
+      throw Error("Invalid cloud eligibility receipt");
+    return v;
+  }
   async submit(slug2, version2, input2, key, selection) {
     if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2))
       throw Error("Cloud execution requires skill@exact-version");
@@ -103202,6 +103290,18 @@ var init_run_routing = __esm(() => {
 import { existsSync as existsSync28, readdirSync as readdirSync17, statSync as statSync16 } from "fs";
 import { join as join46 } from "path";
 function registerOperationTools(server) {
+  server.registerTool("cloud_skill_eligibility", {
+    title: "Cloud Skill Eligibility",
+    description: "Inspect the authenticated workspace's exact reviewed cloud contract. Does not execute or admit a skill.",
+    inputSchema: { name: exports_external.string(), version: exports_external.string(), bundleDigest: exports_external.string().optional() }
+  }, async ({ name, version: version2, bundleDigest }) => {
+    try {
+      const { CloudExecutionClient: CloudExecutionClient2 } = await Promise.resolve().then(() => (init_cloud_executions(), exports_cloud_executions));
+      return mcpJson(await (await CloudExecutionClient2.configured()).eligibility(name, version2, bundleDigest));
+    } catch (error61) {
+      return mcpError("CLOUD_ELIGIBILITY_FAILED", error61.message);
+    }
+  });
   server.registerTool("scaffold_skill", {
     title: "Scaffold Skill",
     description: "Create a portable skill folder under ~/.hasna/skills/installed/<name> with SKILL.md, skill.json, AGENTS.md, package.json, and src/index.ts.",
@@ -105518,6 +105618,15 @@ function registerRuntime(parent) {
     await handleRun(name, args2, options, separatorBeforeSkill);
   });
   const executions = parent.command("executions").description("Inspect isolated cloud executions");
+  executions.command("eligibility").argument("<skill>").requiredOption("--skill-version <version>", "Exact published version").option("--bundle-digest <digest>", "Expected published bundle SHA256").option("--json", "Output as JSON", false).description("Inspect reviewed cloud eligibility without executing a skill").action(async (slug2, options) => {
+    try {
+      const client2 = await CloudExecutionClient.configured();
+      await writeCliOutput(JSON.stringify(await client2.eligibility(slug2, options.skillVersion, options.bundleDigest), null, 2));
+    } catch (error61) {
+      console.error(JSON.stringify({ error: error61.message }));
+      process.exitCode = 1;
+    }
+  });
   for (const operation of ["show", "logs", "artifacts", "cancel"]) {
     executions.command(operation).argument("<execution-id>").option("--json", "Output as JSON", false).action(async (id2) => {
       try {
@@ -109219,6 +109328,7 @@ function validateRawCandidate(candidate2) {
   const issues = validatePortableManifestContract(candidate2, { strict: true });
   if (issues.length)
     throw new Error(`Invalid skill.json: ${issues.map((issue2) => issue2.code).join(", ")}`);
+  validateRuntimeEntrypointCompatibility(candidate2);
   for (const field2 of ["inputs", "commands"]) {
     const items = candidate2[field2];
     if (items === undefined)
@@ -109244,6 +109354,18 @@ function validateRawCandidate(candidate2) {
     }
   }
 }
+function validateRuntimeEntrypointCompatibility(candidate2) {
+  if (candidate2.kind !== "executable" || !isRecord6(candidate2.runtime))
+    return;
+  const runtime = candidate2.runtime.runtime;
+  const entrypoint = candidate2.runtime.entrypoint;
+  if (typeof runtime !== "string" || typeof entrypoint !== "string")
+    return;
+  const extension = entrypoint.toLowerCase().split(".").pop();
+  if (extension === "py" && runtime !== "python3") {
+    throw new Error("Invalid skill.json: runtime.entrypoint with .py extension requires runtime python3.");
+  }
+}
 function compareVersions(left, right) {
   const parts = (value) => value.split("+")[0].split(/-(.*)/s).slice(0, 2);
   const [a, ap] = parts(left), [b, bp] = parts(right);
@@ -109779,7 +109901,8 @@ var exports_registry2 = {};
 __export(exports_registry2, {
   registerVersions: () => registerVersions,
   registerRegistry: () => registerRegistry,
-  registerPull: () => registerPull
+  registerPull: () => registerPull,
+  registerLifecycle: () => registerLifecycle
 });
 function registerRegistry(parent) {
   const registry2 = parent.command("registry").description("Generate registry artifacts for hosted skills services");
@@ -109935,6 +110058,25 @@ Versions of ${name}
     }
   });
 }
+function registerLifecycle(parent) {
+  parent.command("lifecycle").argument("<name>", "Skill name on the configured instance").requiredOption("--state <state>", "Lifecycle state: active or archived").requiredOption("--revision <revision>", "Exact revision id from skills info/get").option("--reason <reason>", "Bounded archive reason").option("--replacement <slug>", "Optional successor slug").option("--json", "Output as JSON", false).description("Change a hosted skill's active/archive lifecycle with an exact revision guard").action(async (name, options) => {
+    if (options.state !== "active" && options.state !== "archived")
+      throw new Error("--state must be active or archived");
+    const client2 = await createRemoteSkillsClient();
+    if (!client2)
+      throw new Error("No API key configured, so there is no instance to update.");
+    try {
+      const result2 = await client2.setSkillLifecycle(name.trim(), options.state, { expectedRevisionId: options.revision, ...options.reason ? { reason: options.reason } : {}, ...options.replacement ? { replacementSlug: options.replacement } : {} });
+      console.log(options.json ? JSON.stringify(result2, null, 2) : `Updated ${name} to ${options.state}.`);
+    } catch (error61) {
+      if (options.json)
+        console.log(JSON.stringify({ error: error61.message }, null, 2));
+      else
+        console.error(source_default.red(error61.message));
+      process.exitCode = 1;
+    }
+  });
+}
 var init_registry2 = __esm(() => {
   init_source();
   init_registry_sync();
@@ -110482,6 +110624,11 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
   const userId = stringField2(user?.id) ?? cached2?.userId;
   const orgId = stringField2(organization2?.id) ?? cached2?.orgId;
   const role3 = stringField2(user?.role);
+  const apiKey = recordField(root2.apiKey) ?? recordField(data?.apiKey);
+  const apiKeyId = stringField2(apiKey?.id);
+  const apiKeyScopes = apiKey?.scopes;
+  const safeApiKeyId = apiKeyId && /^[A-Za-z0-9_-]{1,256}$/.test(apiKeyId) ? apiKeyId : undefined;
+  const safeApiKeyScopes = Array.isArray(apiKeyScopes) && apiKeyScopes.length <= 32 && apiKeyScopes.every((scope) => typeof scope === "string" && scope.length <= 128 && /^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) ? [...new Set(apiKeyScopes)] : undefined;
   return {
     status: "authenticated",
     authSource,
@@ -110491,7 +110638,8 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
     ...orgName ? { organizationName: orgName } : {},
     ...userId ? { userId } : {},
     ...orgId ? { orgId } : {},
-    ...role3 ? { role: role3 } : {}
+    ...role3 ? { role: role3 } : {},
+    ...safeApiKeyId && safeApiKeyScopes ? { apiKeyId: safeApiKeyId, scopes: safeApiKeyScopes } : {}
   };
 }
 function printWhoami(payload) {
@@ -110501,6 +110649,8 @@ function printWhoami(payload) {
     console.log(source_default.bold("Org:    ") + payload.organization);
   if (payload.role)
     console.log(source_default.bold("Role:   ") + payload.role);
+  if (payload.apiKeyId)
+    console.log(source_default.bold("Key:    ") + payload.apiKeyId);
   if (payload.organizationName)
     console.log(source_default.bold("Name:   ") + payload.organizationName);
   if (payload.authSource)
@@ -110822,6 +110972,25 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to revoke API key", options.json);
     }
   });
+  keys3.command("add-publish-scope").argument("<key-id>").requiredOption("--expected-scopes <csv>", "Current comma-separated scopes; stale values are refused").option("--json", "Output as JSON", false).description("Add skills:publish to one existing key without minting or rotating it").action(async (id3, options) => {
+    try {
+      const connection = await resolveSkillsConnection();
+      if (!connection)
+        throw new Error("A hosted Skills credential is required for key scope administration");
+      const identity4 = await apiRequest("/api/auth/whoami", { headers: { Authorization: `Bearer ${connection.apiKey}` } }, connection.apiOrigin);
+      const identityOrg = recordField(identity4.organization);
+      const orgId = stringField2(identityOrg?.id);
+      if (!orgId)
+        throw new Error("The Skills authority did not return a tenant identity; refusing key scope administration");
+      const result2 = await new RemoteSkillsClient(connection.apiKey, connection.apiOrigin).addSkillPublishScope(id3, options.expectedScopes.split(",").map((scope) => scope.trim()).filter(Boolean), orgId);
+      if (options.json || !isTTY)
+        console.log(JSON.stringify(result2, null, 2));
+      else
+        console.log(source_default.green(`Added skills:publish to ${id3}; scopes read back from the server.`));
+    } catch (error61) {
+      writeCommandError(error61, "Failed to add Skills publication scope", options.json);
+    }
+  });
   auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--membership-id <id>", "Enroll an exact workspace membership into an explicit HASNA_PROFILE").option("--code-stdin", "Read a fresh six-digit code for workspace enrollment from stdin").option("--api-key <key>", "Verify and store an API key").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
     if (options.membershipId !== undefined) {
       if (options.apiKey || options.device || options.code || options.poll) {
@@ -119885,10 +120054,11 @@ var { registerPortableSkillCommands: registerPortableSkillCommands2 } = await Pr
 registerPortableSkillCommands2(program2);
 var { registerSchedule: registerSchedule2 } = await Promise.resolve().then(() => (init_schedule(), exports_schedule));
 registerSchedule2(program2);
-var { registerRegistry: registerRegistry2, registerPull: registerPull2, registerVersions: registerVersions2 } = await Promise.resolve().then(() => (init_registry2(), exports_registry2));
+var { registerRegistry: registerRegistry2, registerPull: registerPull2, registerVersions: registerVersions2, registerLifecycle: registerLifecycle2 } = await Promise.resolve().then(() => (init_registry2(), exports_registry2));
 registerRegistry2(program2);
 registerPull2(program2);
 registerVersions2(program2);
+registerLifecycle2(program2);
 var { registerPublish: registerPublish2 } = await Promise.resolve().then(() => (init_publish(), exports_publish));
 registerPublish2(program2);
 var { registerPrivatePublications: registerPrivatePublications2 } = await Promise.resolve().then(() => (init_private_publications(), exports_private_publications));