@hasna/skills 0.8.12 → 0.9.2

package/README.md

@@ -271,6 +271,15 @@ Vendor file restoration uses an exclusive hard link to preserve concurrent files
 Do not retry an interrupted operation until its journal and both paths have been
 reconciled; a failed final journal write may leave the earlier durable intent.
 
+For a reviewed migration that must retire one exact native copy, pass
+`--target-manifest <file>`. The JSON manifest uses schema
+`hasna.skills-native-migration-targets.v1` and binds each target to an agent,
+an existing absolute `projectRoot`, a normalized project-relative `path`, and
+the complete directory `treeSha256`. Exact-target mode refuses broad selector
+flags, protected or vendor entries, missing or ambiguous paths, symlinks,
+digest drift, and writes a manifest digest into the recovery journal. Every
+inventory entry outside the manifest remains untouched.
+
 `skills hook agents --json` reports the supported adapters and coverage limits.
 Claude and Codex have lifecycle context hooks; Gemini uses `BeforeAgent`, and
 OpenCode uses its awaited message plugin. Cursor receives selected context at
@@ -592,13 +601,20 @@ before submitting again. The selected profile must include this exact version,
 and the consumer needs `runs:write` as well as `skills:read`.
 
 Cloud execution is enabled only when the deployment configures a reviewed image
-and exact bundle allowlist. The first supported lane is `pdf-generate`; arbitrary
-uploaded code is not admitted. Runs capture version, bundle digest, input digest,
+and exact bundle allowlist; arbitrary
+uploaded code is not admitted. The PDF lane accepts reviewed `pdf-generate` versions.
+The optional `regex-test.v1` pure contract accepts only a tenant-specific, reviewed
+self-contained Bun bundle, with no secrets, dependencies or network. Uploading or
+selecting a bundle never admits it to cloud execution. Check an exact version with
+`skills executions eligibility <skill> --skill-version <version> --json`; this
+reads metadata without creating a run. Runs capture version, bundle digest, input digest,
 runtime image digest, limits and policy. The cloud worker runs in a separate
 Fargate task; the skill process has no API/provider credentials, no network, a
 read-only root and bounded temporary storage, execution time and output.
 `GET /skills/v1/capabilities` reports whether this deployment has cloud execution
-configured. Authorization and runtime availability are checked separately.
+configured and lists supported `cloudExecutionContracts`. Each exact bundle needs
+its own review and admission; the flag does not promise arbitrary executable
+support. Authorization and runtime availability are checked separately.
 
 On a managed station, local execution also resolves the selected immutable
 bundle. Self-contained local executables run with explicit environment references
@@ -751,7 +767,7 @@ of app folders, and `XDG_CONFIG_HOME` is not consulted at all.
 | `skills sessions show <id> --json` | | Inspect one session's exact profile revision and receipt hash without loading payloads |
 | `skills sessions reconcile <id> --from-profile <id> --from-revision <rev> --receipt-sha256 <sha> --selection-profile <id> --profile-revision <rev>` | | Plan an explicit migration of one live session; `--apply --plan-digest <digest> --plan-issued-at <time> --plan-expires-at <time>` (within five minutes) preserves its old receipt and applies the reviewed replacement |
 | `skills hook agents --json` | | Report maintained adapters and explicit coverage limits |
-| `skills migrate native` | | Inventory native copies; `--apply` archives managed copies, with explicit `--include-unmanaged` and `--include-vendor` retirement options |
+| `skills migrate native` | | Inventory native copies; `--apply` archives managed copies, with explicit `--include-unmanaged`, `--include-vendor`, or reviewed `--target-manifest` selection |
 | `skills pull --all --selection-profile <id>` | | With CLI loading active, refresh the selected profile into the verified cache |
 | `skills sync --selection-profile <id> [--check] [--station <id>]` | | Sync or check the selected profile/cache; optionally record station state |
 | `skills station-state <id>` | | Read a station's sync receipt in the authenticated workspace |
@@ -1433,7 +1449,7 @@ src/
 |---|---|---|
 | Catalog skills | 0 | `SKILLS.length` (`src/lib/registry-data/`) |
 | Categories | 17 | `CATEGORIES` (`src/lib/registry-types.ts`) |
-| MCP tools | 81 | `tools/list` against a live `buildServer()` |
+| MCP tools | 82 | `tools/list` against a live `buildServer()` |
 
 Every number in this table is re-derived from the source tree on each test run by
 `src/lib/readme-derived-counts.test.ts`, so a drifted figure fails a test rather

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.12",
+    version: "0.9.2",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39186,6 +39186,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -39198,7 +39199,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -39717,6 +39718,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync6(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -55351,6 +55358,82 @@ function treeHash(root2) {
   visit2(root2);
   return hash2.digest("hex");
 }
+function parseNativeMigrationTargetManifest(input) {
+  const digest2 = sha(input);
+  let value;
+  try {
+    value = JSON.parse(input.toString());
+  } catch {
+    throw new Error("Invalid native migration target manifest JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid native migration target manifest");
+  const record2 = value;
+  if (record2.schema !== "hasna.skills-native-migration-targets.v1" || Object.keys(record2).some((key) => !["schema", "targets"].includes(key)))
+    throw new Error("Unsupported native migration target manifest schema");
+  if (!Array.isArray(record2.targets) || record2.targets.length === 0 || record2.targets.length > 1000)
+    throw new Error("Native migration target manifest must contain 1 to 1000 targets");
+  const targets = [];
+  const identities = new Set;
+  for (const target of record2.targets) {
+    if (!target || typeof target !== "object" || Array.isArray(target))
+      throw new Error("Invalid native migration target");
+    const item = target;
+    if (Object.keys(item).some((key) => !["agent", "projectRoot", "path", "treeSha256"].includes(key)) || typeof item.agent !== "string" || typeof item.projectRoot !== "string" || typeof item.path !== "string" || typeof item.treeSha256 !== "string")
+      throw new Error("Invalid native migration target fields");
+    if (!INTEGRATION_AGENTS.includes(item.agent))
+      throw new Error(`Unsupported native migration target agent: ${item.agent}`);
+    const projectRoot = resolve16(item.projectRoot);
+    if (!isAbsolute15(item.projectRoot) || projectRoot !== item.projectRoot || !existsSync15(projectRoot) || !lstatSync18(projectRoot).isDirectory())
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${item.projectRoot}`);
+    assertSafePath(projectRoot);
+    if (isAbsolute15(item.path) || item.path.includes("\\") || item.path.length === 0 || item.path.includes("\x00"))
+      throw new Error(`Native migration target path must be normalized and project-relative: ${item.path}`);
+    const resolved = resolve16(projectRoot, item.path), normalized = relative5(projectRoot, resolved);
+    if (!normalized || normalized === ".." || normalized.startsWith(`..${sep6}`) || isAbsolute15(normalized) || normalized !== item.path)
+      throw new Error(`Native migration target path escapes or is not normalized: ${item.path}`);
+    if (!/^[0-9a-f]{64}$/.test(item.treeSha256))
+      throw new Error(`Invalid native migration tree digest for ${item.path}`);
+    const identity4 = `${item.agent}\x00${projectRoot}\x00${normalized}`;
+    if (identities.has(identity4))
+      throw new Error(`Duplicate native migration target: ${item.path}`);
+    identities.add(identity4);
+    targets.push({ agent: item.agent, projectRoot, path: normalized, treeSha256: item.treeSha256 });
+  }
+  return { schema: "hasna.skills-native-migration-targets.v1", targets, digest: digest2 };
+}
+function readNativeMigrationTargetManifest(path) {
+  return parseNativeMigrationTargetManifest(readNativeBytes(path, 4 * 1024 * 1024));
+}
+function selectNativeMigrationTargets(inventory, manifest) {
+  if (manifest.schema !== "hasna.skills-native-migration-targets.v1" || !/^[0-9a-f]{64}$/.test(manifest.digest) || !Array.isArray(manifest.targets) || manifest.targets.length === 0)
+    throw new Error("Invalid native migration target manifest");
+  const identities = new Set;
+  const selected = [];
+  for (const target of manifest.targets) {
+    const projectRoot = resolve16(target.projectRoot), normalized = relative5(projectRoot, resolve16(projectRoot, target.path));
+    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync15(projectRoot) || !lstatSync18(projectRoot).isDirectory())
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    assertSafePath(projectRoot);
+    if (isAbsolute15(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep6}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
+      throw new Error(`Invalid native migration target: ${target.path}`);
+    const identity4 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    if (identities.has(identity4))
+      throw new Error(`Duplicate native migration target: ${target.path}`);
+    identities.add(identity4);
+    const expected = resolve16(target.projectRoot, target.path);
+    const matches2 = inventory.filter((entry2) => entry2.agent === target.agent && resolve16(entry2.path) === expected);
+    if (matches2.length !== 1)
+      throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
+    const entry = matches2[0];
+    if (entry.bridge || entry.system || entry.vendor)
+      throw new Error(`Native migration target is protected or vendor-owned: ${entry.path}`);
+    if (entry.hash !== target.treeSha256 || treeHash(entry.path) !== target.treeSha256)
+      throw new Error(`Native migration target changed after review: ${entry.path}`);
+    selected.push(entry);
+  }
+  return selected;
+}
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
@@ -55839,12 +55922,13 @@ function archiveNativeSkills(inventory, options) {
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
-  const selected = inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
+  const selected = options.targetManifest ? selectNativeMigrationTargets(inventory, options.targetManifest) : inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
   for (const entry of selected)
     if (treeHash(entry.path) !== entry.hash)
       throw new Error(`Native skill changed after planning: ${entry.path}`);
+  const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
-    return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
+    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const operationId = randomUUID6(), archiveRoot = join29(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join29(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join29(entry.path, "SKILL.md") : entry.path,
@@ -55853,7 +55937,7 @@ function archiveNativeSkills(inventory, options) {
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
-  const journal = { version: 2, operationId, status: "planned", entries, ...aliases.length ? { rootAliases: aliases } : {} };
+  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
@@ -55947,7 +56031,7 @@ function archiveNativeSkills(inventory, options) {
     } catch {}
     throw new Error(`Native archive failed; inspect the recovery journal at ${receiptPath} before retrying.`, { cause: error });
   }
-  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
 }
 function assertManagedAgentBridge(agent, options = {}) {
   const home = resolve16(options.home ?? homedir4()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
@@ -76206,6 +76290,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -76323,6 +76409,8 @@ var init_remote_registry = __esm(() => {
     tags: exports_external.array(exports_external.string()).optional(),
     dependencies: exports_external.array(exports_external.string()).optional(),
     version: exports_external.string().optional(),
+    revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+    lifecycle: exports_external.enum(["active", "archived"]).optional(),
     availability: remoteAvailabilitySchema.optional()
   }).passthrough().refine((skill) => skill.name || skill.slug, {
     message: "Remote skill requires name or slug"
@@ -77711,6 +77799,7 @@ __export(exports_remote_client, {
   RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteSkillLifecycleError: () => RemoteSkillLifecycleError,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
   RemoteRequestError: () => RemoteRequestError,
   RemoteQuoteUnavailableError: () => RemoteQuoteUnavailableError,
@@ -77842,6 +77931,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -78359,6 +78481,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -78510,9 +78645,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject2) => {
@@ -78527,7 +78666,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size2 += next.value.byteLength;
       if (size2 > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size2);
@@ -78538,11 +78677,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -78571,7 +78710,7 @@ async function createRemoteSkillsClient(env3 = process.env) {
 function createRemoteSkillsClientReadOnly(env3 = process.env) {
   return createRemoteSkillsClient(env3);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, KNOWN_SKILL_LIFECYCLE_CODES, RemoteSkillLifecycleError, RemoteCreditCheckoutError, RemoteQuoteUnavailableError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
   init_remote_recurring();
   init_remote_invitations();
@@ -78608,6 +78747,17 @@ var init_remote_client = __esm(() => {
       this.name = "RemoteRequestError";
     }
   };
+  KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+  RemoteSkillLifecycleError = class RemoteSkillLifecycleError extends RemoteRequestError {
+    code;
+    constructor(path, status, code) {
+      super(path, status);
+      this.name = "RemoteSkillLifecycleError";
+      const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+      this.code = safeCode;
+      this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+    }
+  };
   RemoteCreditCheckoutError = class RemoteCreditCheckoutError extends RemoteRequestError {
     code;
     requestIdempotencyKey;
@@ -78663,7 +78813,7 @@ var init_remote_client = __esm(() => {
 // src/lib/revision.ts
 import { createHash as createHash16 } from "crypto";
 function revisionIdOf(content) {
-  const canonical4 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -78675,7 +78825,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
   return createHash16("sha256").update(canonical4).digest("hex");
 }
 var REVISION_ID_PATTERN;
@@ -82131,6 +82287,15 @@ class CloudExecutionClient {
     }
     return response;
   }
+  async eligibility(slug2, version2, bundleDigest) {
+    if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
+      throw Error("Cloud eligibility requires an exact skill version and valid digest");
+    const query = new URLSearchParams({ version: version2, ...bundleDigest ? { bundleDigest } : {} });
+    const v = await jsonBody(await this.request(`${slug2}/eligibility?${query}`));
+    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug2 || v.version !== version2 || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
+      throw Error("Invalid cloud eligibility receipt");
+    return v;
+  }
   async submit(slug2, version2, input2, key, selection) {
     if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2))
       throw Error("Cloud execution requires skill@exact-version");
@@ -103202,6 +103367,18 @@ var init_run_routing = __esm(() => {
 import { existsSync as existsSync28, readdirSync as readdirSync17, statSync as statSync16 } from "fs";
 import { join as join46 } from "path";
 function registerOperationTools(server) {
+  server.registerTool("cloud_skill_eligibility", {
+    title: "Cloud Skill Eligibility",
+    description: "Inspect the authenticated workspace's exact reviewed cloud contract. Does not execute or admit a skill.",
+    inputSchema: { name: exports_external.string(), version: exports_external.string(), bundleDigest: exports_external.string().optional() }
+  }, async ({ name, version: version2, bundleDigest }) => {
+    try {
+      const { CloudExecutionClient: CloudExecutionClient2 } = await Promise.resolve().then(() => (init_cloud_executions(), exports_cloud_executions));
+      return mcpJson(await (await CloudExecutionClient2.configured()).eligibility(name, version2, bundleDigest));
+    } catch (error61) {
+      return mcpError("CLOUD_ELIGIBILITY_FAILED", error61.message);
+    }
+  });
   server.registerTool("scaffold_skill", {
     title: "Scaffold Skill",
     description: "Create a portable skill folder under ~/.hasna/skills/installed/<name> with SKILL.md, skill.json, AGENTS.md, package.json, and src/index.ts.",
@@ -105518,6 +105695,15 @@ function registerRuntime(parent) {
     await handleRun(name, args2, options, separatorBeforeSkill);
   });
   const executions = parent.command("executions").description("Inspect isolated cloud executions");
+  executions.command("eligibility").argument("<skill>").requiredOption("--skill-version <version>", "Exact published version").option("--bundle-digest <digest>", "Expected published bundle SHA256").option("--json", "Output as JSON", false).description("Inspect reviewed cloud eligibility without executing a skill").action(async (slug2, options) => {
+    try {
+      const client2 = await CloudExecutionClient.configured();
+      await writeCliOutput(JSON.stringify(await client2.eligibility(slug2, options.skillVersion, options.bundleDigest), null, 2));
+    } catch (error61) {
+      console.error(JSON.stringify({ error: error61.message }));
+      process.exitCode = 1;
+    }
+  });
   for (const operation of ["show", "logs", "artifacts", "cancel"]) {
     executions.command(operation).argument("<execution-id>").option("--json", "Output as JSON", false).action(async (id2) => {
       try {
@@ -108432,11 +108618,16 @@ function registerAgentIntegration(parent) {
     }
   });
   const migrate = parent.command("migrate").description("Preserve and retire native agent skill copies");
-  migrate.command("native").option("--project <directory>", "Also inventory a project and its ancestors (the current directory and its ancestors are always included)").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
+  migrate.command("native").option("--project <directory>", "Also inventory a project and its ancestors (the current directory and its ancestors are always included)").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--target-manifest <file>", "Reviewed exact native migration target manifest").option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
     try {
       const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
+      if (options.targetManifest && (options.includeUnmanaged || options.includeVendor))
+        throw new Error("--target-manifest cannot be combined with broad native migration selectors");
+      const targetManifest = options.targetManifest ? readNativeMigrationTargetManifest(options.targetManifest) : undefined;
       const inventory = inventoryNativeSkills(undefined, { projectDirs: [process.cwd(), ...options.project ? [options.project] : []], includeVendor: options.includeVendor, configured: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
-      const result2 = options.apply ? archiveNativeSkills(inventory, { includeUnmanaged: options.includeUnmanaged, includeVendor: options.includeVendor, allowRootAliases: options.allowRootAliases }) : { entries: [] };
+      if (targetManifest)
+        selectNativeMigrationTargets(inventory, targetManifest);
+      const result2 = options.apply ? archiveNativeSkills(inventory, { includeUnmanaged: options.includeUnmanaged, includeVendor: options.includeVendor, allowRootAliases: options.allowRootAliases, targetManifest }) : { entries: [], ...targetManifest ? { targetManifest: { schema: targetManifest.schema, digest: targetManifest.digest, targetCount: targetManifest.targets.length } } : {} };
       if (options.json)
         await writeCliOutput(JSON.stringify({ applied: options.apply, inventory, ...result2 }));
       else
@@ -109219,6 +109410,7 @@ function validateRawCandidate(candidate2) {
   const issues = validatePortableManifestContract(candidate2, { strict: true });
   if (issues.length)
     throw new Error(`Invalid skill.json: ${issues.map((issue2) => issue2.code).join(", ")}`);
+  validateRuntimeEntrypointCompatibility(candidate2);
   for (const field2 of ["inputs", "commands"]) {
     const items = candidate2[field2];
     if (items === undefined)
@@ -109244,6 +109436,18 @@ function validateRawCandidate(candidate2) {
     }
   }
 }
+function validateRuntimeEntrypointCompatibility(candidate2) {
+  if (candidate2.kind !== "executable" || !isRecord6(candidate2.runtime))
+    return;
+  const runtime = candidate2.runtime.runtime;
+  const entrypoint = candidate2.runtime.entrypoint;
+  if (typeof runtime !== "string" || typeof entrypoint !== "string")
+    return;
+  const extension = entrypoint.toLowerCase().split(".").pop();
+  if (extension === "py" && runtime !== "python3") {
+    throw new Error("Invalid skill.json: runtime.entrypoint with .py extension requires runtime python3.");
+  }
+}
 function compareVersions(left, right) {
   const parts = (value) => value.split("+")[0].split(/-(.*)/s).slice(0, 2);
   const [a, ap] = parts(left), [b, bp] = parts(right);
@@ -109779,7 +109983,8 @@ var exports_registry2 = {};
 __export(exports_registry2, {
   registerVersions: () => registerVersions,
   registerRegistry: () => registerRegistry,
-  registerPull: () => registerPull
+  registerPull: () => registerPull,
+  registerLifecycle: () => registerLifecycle
 });
 function registerRegistry(parent) {
   const registry2 = parent.command("registry").description("Generate registry artifacts for hosted skills services");
@@ -109935,6 +110140,25 @@ Versions of ${name}
     }
   });
 }
+function registerLifecycle(parent) {
+  parent.command("lifecycle").argument("<name>", "Skill name on the configured instance").requiredOption("--state <state>", "Lifecycle state: active or archived").requiredOption("--revision <revision>", "Exact revision id from skills info/get").option("--reason <reason>", "Bounded archive reason").option("--replacement <slug>", "Optional successor slug").option("--json", "Output as JSON", false).description("Change a hosted skill's active/archive lifecycle with an exact revision guard").action(async (name, options) => {
+    if (options.state !== "active" && options.state !== "archived")
+      throw new Error("--state must be active or archived");
+    const client2 = await createRemoteSkillsClient();
+    if (!client2)
+      throw new Error("No API key configured, so there is no instance to update.");
+    try {
+      const result2 = await client2.setSkillLifecycle(name.trim(), options.state, { expectedRevisionId: options.revision, ...options.reason ? { reason: options.reason } : {}, ...options.replacement ? { replacementSlug: options.replacement } : {} });
+      console.log(options.json ? JSON.stringify(result2, null, 2) : `Updated ${name} to ${options.state}.`);
+    } catch (error61) {
+      if (options.json)
+        console.log(JSON.stringify({ error: error61.message }, null, 2));
+      else
+        console.error(source_default.red(error61.message));
+      process.exitCode = 1;
+    }
+  });
+}
 var init_registry2 = __esm(() => {
   init_source();
   init_registry_sync();
@@ -110482,6 +110706,11 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
   const userId = stringField2(user?.id) ?? cached2?.userId;
   const orgId = stringField2(organization2?.id) ?? cached2?.orgId;
   const role3 = stringField2(user?.role);
+  const apiKey = recordField(root2.apiKey) ?? recordField(data?.apiKey);
+  const apiKeyId = stringField2(apiKey?.id);
+  const apiKeyScopes = apiKey?.scopes;
+  const safeApiKeyId = apiKeyId && /^[A-Za-z0-9_-]{1,256}$/.test(apiKeyId) ? apiKeyId : undefined;
+  const safeApiKeyScopes = Array.isArray(apiKeyScopes) && apiKeyScopes.length <= 32 && apiKeyScopes.every((scope) => typeof scope === "string" && scope.length <= 128 && /^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) ? [...new Set(apiKeyScopes)] : undefined;
   return {
     status: "authenticated",
     authSource,
@@ -110491,7 +110720,8 @@ function authIdentityPayload(authSource, live, cached2, offline = false) {
     ...orgName ? { organizationName: orgName } : {},
     ...userId ? { userId } : {},
     ...orgId ? { orgId } : {},
-    ...role3 ? { role: role3 } : {}
+    ...role3 ? { role: role3 } : {},
+    ...safeApiKeyId && safeApiKeyScopes ? { apiKeyId: safeApiKeyId, scopes: safeApiKeyScopes } : {}
   };
 }
 function printWhoami(payload) {
@@ -110501,6 +110731,8 @@ function printWhoami(payload) {
     console.log(source_default.bold("Org:    ") + payload.organization);
   if (payload.role)
     console.log(source_default.bold("Role:   ") + payload.role);
+  if (payload.apiKeyId)
+    console.log(source_default.bold("Key:    ") + payload.apiKeyId);
   if (payload.organizationName)
     console.log(source_default.bold("Name:   ") + payload.organizationName);
   if (payload.authSource)
@@ -110822,6 +111054,25 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to revoke API key", options.json);
     }
   });
+  keys3.command("add-publish-scope").argument("<key-id>").requiredOption("--expected-scopes <csv>", "Current comma-separated scopes; stale values are refused").option("--json", "Output as JSON", false).description("Add skills:publish to one existing key without minting or rotating it").action(async (id3, options) => {
+    try {
+      const connection = await resolveSkillsConnection();
+      if (!connection)
+        throw new Error("A hosted Skills credential is required for key scope administration");
+      const identity4 = await apiRequest("/api/auth/whoami", { headers: { Authorization: `Bearer ${connection.apiKey}` } }, connection.apiOrigin);
+      const identityOrg = recordField(identity4.organization);
+      const orgId = stringField2(identityOrg?.id);
+      if (!orgId)
+        throw new Error("The Skills authority did not return a tenant identity; refusing key scope administration");
+      const result2 = await new RemoteSkillsClient(connection.apiKey, connection.apiOrigin).addSkillPublishScope(id3, options.expectedScopes.split(",").map((scope) => scope.trim()).filter(Boolean), orgId);
+      if (options.json || !isTTY)
+        console.log(JSON.stringify(result2, null, 2));
+      else
+        console.log(source_default.green(`Added skills:publish to ${id3}; scopes read back from the server.`));
+    } catch (error61) {
+      writeCommandError(error61, "Failed to add Skills publication scope", options.json);
+    }
+  });
   auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--membership-id <id>", "Enroll an exact workspace membership into an explicit HASNA_PROFILE").option("--code-stdin", "Read a fresh six-digit code for workspace enrollment from stdin").option("--api-key <key>", "Verify and store an API key").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
     if (options.membershipId !== undefined) {
       if (options.apiKey || options.device || options.code || options.poll) {
@@ -119885,10 +120136,11 @@ var { registerPortableSkillCommands: registerPortableSkillCommands2 } = await Pr
 registerPortableSkillCommands2(program2);
 var { registerSchedule: registerSchedule2 } = await Promise.resolve().then(() => (init_schedule(), exports_schedule));
 registerSchedule2(program2);
-var { registerRegistry: registerRegistry2, registerPull: registerPull2, registerVersions: registerVersions2 } = await Promise.resolve().then(() => (init_registry2(), exports_registry2));
+var { registerRegistry: registerRegistry2, registerPull: registerPull2, registerVersions: registerVersions2, registerLifecycle: registerLifecycle2 } = await Promise.resolve().then(() => (init_registry2(), exports_registry2));
 registerRegistry2(program2);
 registerPull2(program2);
 registerVersions2(program2);
+registerLifecycle2(program2);
 var { registerPublish: registerPublish2 } = await Promise.resolve().then(() => (init_publish(), exports_publish));
 registerPublish2(program2);
 var { registerPrivatePublications: registerPrivatePublications2 } = await Promise.resolve().then(() => (init_private_publications(), exports_private_publications));