@hasna/skills 0.8.12 → 0.9.2

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.12",
+  version: "0.9.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -34682,6 +34682,9 @@ class MemorySkillSelectionStore {
   async getProfile(p2, id) {
     return structuredClone(this.profiles.get(this.key(p2.orgId, id)) ?? null);
   }
+  async profilesReferencingSkill(p2, slug) {
+    return [...this.profiles.values()].filter((profile2) => profile2.workspaceId === p2.orgId && profile2.selections.some((selection) => selection.slug === slug)).map((profile2) => profile2.id).sort();
+  }
   async saveProfile(p2, id, selected, expected) {
     const key = this.key(p2.orgId, id), previous = this.profiles.get(key);
     if ((previous?.revision ?? null) !== expected)
@@ -34719,14 +34722,25 @@ class SqliteSkillSelectionStore {
   constructor(db) {
     this.db = db;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(p2.orgId);
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id) {
     const row = this.db.query("SELECT * FROM skills_profiles WHERE org_id=? AND profile_id=?").get(p2.orgId, id);
     return row ? profile(row) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID2(), timestamp = new Date().toISOString();
-    const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id, expected);
-    return row ? profile(row) : null;
+    return this.db.transaction(() => {
+      for (const selection of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const skill = this.db.query("SELECT lifecycle FROM skills_registry WHERE org_id=? AND slug=?").get(p2.orgId, selection.slug);
+        if (skill?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id, expected);
+      return row ? profile(row) : null;
+    }).immediate();
   }
   async getStationState(p2, id) {
     const row = this.db.query("SELECT * FROM skills_station_state WHERE org_id=? AND actor_id=? AND station_id=?").get(p2.orgId, p2.userId, id);
@@ -34745,14 +34759,25 @@ class PostgresSkillSelectionStore {
   constructor(sql) {
     this.sql = sql;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = await this.sql`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${p2.orgId}`;
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id) {
     const rows = await this.sql`SELECT * FROM skills_profiles WHERE org_id=${p2.orgId} AND profile_id=${id}`;
     return rows[0] ? profile(rows[0]) : null;
   }
   async saveProfile(p2, id, selected, expected) {
-    const revision = randomUUID2(), timestamp = new Date().toISOString();
-    const rows = expected === null ? await this.sql`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await this.sql`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
-    return rows[0] ? profile(rows[0]) : null;
+    return this.sql.begin(async (tx) => {
+      for (const selection of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const rows2 = await tx`SELECT lifecycle FROM skills_registry WHERE org_id=${p2.orgId} AND slug=${selection.slug} FOR UPDATE`;
+        if (rows2[0]?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const rows = expected === null ? await tx`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await tx`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
+      return rows[0] ? profile(rows[0]) : null;
+    });
   }
   async getStationState(p2, id) {
     const rows = await this.sql`SELECT * FROM skills_station_state WHERE org_id=${p2.orgId} AND actor_id=${p2.userId} AND station_id=${id}`;
@@ -34909,7 +34934,11 @@ function rowToSkill(row) {
     revisionId: String(row.revision_id ?? ""),
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
-    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    lifecycle: row.lifecycle === "archived" ? "archived" : "active",
+    ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
+    ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
+    ...row.replacement_slug ? { replacementSlug: String(row.replacement_slug) } : {}
   };
 }
 function rowToPin(row) {
@@ -35028,10 +35057,21 @@ class SkillVersionExistsError extends Error {
   }
 }
 
+class SkillLifecycleConflictError extends Error {
+  slug;
+  profiles;
+  constructor(slug, profiles) {
+    super(`cannot archive '${slug}' while active profiles reference it: ${profiles.join(", ")}`);
+    this.slug = slug;
+    this.profiles = profiles;
+    this.name = "SkillLifecycleConflictError";
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
 function revisionIdOf(content) {
-  const canonical = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -35043,7 +35083,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical = JSON.stringify(canonicalContent);
   return createHash4("sha256").update(canonical).digest("hex");
 }
 function revisionIdOfRecord(record) {
@@ -35146,6 +35192,28 @@ class SqliteSkillsStore {
       scopes: parseScopes(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    const row = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+    if (!row)
+      return { kind: "not_found" };
+    const current = parseScopes(row.scopes_json);
+    if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+      return { kind: "stale", scopes: current };
+    }
+    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const tx = this.db.transaction(() => {
+      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), keyId, actor.orgId, JSON.stringify(expectedScopes)]);
+      if (changed.changes !== 1)
+        return false;
+      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json) VALUES (?, ?, ?, ?, ?, ?, ?)", [actor.orgId, actor.userId, actor.apiKeyId, "api_key_scopes_added", "api_key", keyId, JSON.stringify({ added: addScopes, scopes })]);
+      return true;
+    });
+    if (!tx()) {
+      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
+    }
+    return { kind: "updated", scopes };
+  }
   async createRun(input) {
     if (input.idempotencyKey) {
       const existing = this.get("SELECT * FROM skills_runs WHERE org_id = ? AND idempotency_key = ? LIMIT 1", [input.principal.orgId, input.idempotencyKey]);
@@ -35467,6 +35535,39 @@ class SqliteSkillsStore {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.db.transaction(() => {
+      const rowCurrent = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+      const current = rowCurrent ? rowToSkill(rowCurrent) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(principal.orgId);
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = { ...current, lifecycle: patch.lifecycle, updatedAt: nowIso(), ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {} };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
+      if (!row)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
+      return rowToSkill(row);
+    }).immediate();
+  }
+  getSkillSync(principal, slug) {
+    const row = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+    return row ? rowToSkill(row) : null;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -35579,13 +35680,13 @@ class SqliteSkillsStore {
   }
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
-    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+    return this.all("SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id=t.org_id AND s.slug=t.slug WHERE t.org_id = ? AND s.lifecycle='active' ORDER BY t.tag ASC", [principal.orgId]).map((row) => String(row.tag));
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     return this.all(`SELECT s.* FROM skills_registry s
        JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
   }
   async listPinsByTag(principal, tag) {
@@ -35593,7 +35694,7 @@ class SqliteSkillsStore {
     return this.all(`SELECT p.* FROM skills_pins p
        JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
        JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
-       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
   }
   async listPublishedSlugs(principal) {
@@ -35962,6 +36063,27 @@ var MAX_MANIFEST_BYTES = MAX_SKILL_MD_BYTES + 64000;
 var ALLOWED_PUBLISH_PARTS = new Set(["manifest", "bundle"]);
 var MAX_VERSION_MANIFEST_BYTES = 512 * 1024;
 
+// src/sdk/execution/types.ts
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value))
+    return value.map(sortKeys);
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    const sorted = Object.create(null);
+    for (const key of Object.keys(record).sort()) {
+      sorted[key] = sortKeys(record[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+
+// src/sdk/execution/admission.ts
+import { createHash as createHash5 } from "crypto";
+
 // src/sdk/execution/storage.ts
 class MemoryRunExecutionStore {
   durable = false;
@@ -36142,10 +36264,38 @@ var DEFAULT_RUN_LIMITS = {
   maxArtifactsBytes: 10 * 1024 * 1024,
   maxConcurrency: 1
 };
+function digestInput(input) {
+  return createHash5("sha256").update(canonicalJson(input)).digest("hex");
+}
 
 // src/sdk/execution/dispatchers/ecs.ts
 var LIVE_TASK_STATUSES = new Set(["PROVISIONING", "PENDING", "ACTIVATING", "RUNNING", "DEACTIVATING", "STOPPING", "DEPROVISIONING"]);
 
+// src/server/runtime-pure-contract.ts
+var PURE_DESCRIPTOR = Object.freeze({
+  id: "regex-test.v1",
+  runtime: "bun",
+  adapter: "skills-input-json.v1",
+  input: Object.freeze({ patternBytes: 512, textBytes: 4096, totalBytes: 8192, flags: "dgimsuvy" }),
+  output: "regex-matches.v1",
+  secrets: "none",
+  egress: "deny",
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  stdoutBytes: 16384,
+  stderrBytes: 8192,
+  artifactsBytes: 0
+});
+var PURE_DESCRIPTOR_DIGEST = digestInput(PURE_DESCRIPTOR);
+var PURE_LIMITS = Object.freeze({
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  maxArtifactsBytes: 0,
+  maxConcurrency: 1
+});
+
 // src/server/config.ts
 var DATABASE_URL_ENV = "HASNA_SKILLS_DATABASE_URL";
 var SKILLS_ENV_NAMESPACE = "SKILLS";
@@ -36292,6 +36442,20 @@ class MemorySkillsStore {
   async authenticateApiKeyHash(hash) {
     return this.apiKeys.get(hash) ?? null;
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    for (const [hash, target] of this.apiKeys) {
+      if (target.apiKeyId !== keyId || target.orgId !== actor.orgId)
+        continue;
+      if (target.scopes.length !== expectedScopes.length || target.scopes.some((scope, index) => scope !== expectedScopes[index])) {
+        return { kind: "stale", scopes: [...target.scopes] };
+      }
+      const scopes = [...target.scopes, ...addScopes.filter((scope) => !target.scopes.includes(scope))];
+      const updated = { ...target, scopes };
+      this.apiKeys.set(hash, updated);
+      return { kind: "updated", scopes };
+    }
+    return { kind: "not_found" };
+  }
   async createRun(input) {
     const idemKey = input.idempotencyKey?.trim();
     const idemMapKey = idemKey ? `${input.principal.orgId}:${idemKey}` : undefined;
@@ -36421,7 +36585,11 @@ class MemorySkillsStore {
       createdAt: previous?.createdAt ?? now,
       updatedAt: now,
       revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
-      revisionNumber: (previous?.revisionNumber ?? 0) + 1
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      lifecycle: previous?.lifecycle ?? "active",
+      ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
+      ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
+      ...previous?.replacementSlug ? { replacementSlug: previous.replacementSlug } : {}
     };
     this.skills.set(key, record);
     if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
@@ -36457,6 +36625,33 @@ class MemorySkillsStore {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId)
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+      const profiles = await this.selectionStore.profilesReferencingSkill(principal, slug);
+      if (profiles.length)
+        throw new SkillLifecycleConflictError(slug, profiles);
+    }
+    const next2 = {
+      ...current,
+      lifecycle: patch.lifecycle,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+      revisionNumber: current.revisionNumber + 1,
+      ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+    };
+    if (patch.lifecycle === "active") {
+      delete next2.archivedAt;
+      delete next2.archiveReason;
+      delete next2.replacementSlug;
+    }
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -36527,7 +36722,7 @@ class MemorySkillsStore {
     await this.purgeExpiredTombstones(principal);
     const tags = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId !== principal.orgId)
+      if (skill.orgId !== principal.orgId || skill.lifecycle !== "active")
         continue;
       for (const tag of skill.tags) {
         if (tag.trim())
@@ -36538,13 +36733,13 @@ class MemorySkillsStore {
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
   }
   async listPinsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     const taggedSlugs = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag))
         taggedSlugs.add(skill.slug);
     }
     return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a3, b3) => a3.slug.localeCompare(b3.slug));
@@ -36661,6 +36856,38 @@ class PostgresSkillsStore {
       scopes: parseJsonArray(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+        SELECT scopes_json FROM api_keys
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+        LIMIT 1
+      `;
+      const row = rows[0];
+      if (!row)
+        return { kind: "not_found" };
+      const current = parseJsonArray(row.scopes_json);
+      if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+        return { kind: "stale", scopes: current };
+      }
+      const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+      const updated = await tx`
+        UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+          AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        RETURNING scopes_json
+      `;
+      if (!updated[0]) {
+        const latest = await tx`SELECT scopes_json FROM api_keys WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL LIMIT 1`;
+        return { kind: "stale", scopes: latest[0] ? parseJsonArray(latest[0].scopes_json) : current };
+      }
+      await tx`
+        INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes })}::jsonb)
+      `;
+      return { kind: "updated", scopes };
+    });
+  }
   async withContext(orgId, worker, fn) {
     return this.sql.begin(async (tx) => {
       await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
@@ -36981,6 +37208,42 @@ class PostgresSkillsStore {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.sql.begin(async (tx) => {
+      const currentRows = await tx`SELECT * FROM skills_registry WHERE org_id=${principal.orgId} AND slug=${slug} LIMIT 1 FOR UPDATE`;
+      const current = currentRows[0] ? rowToSkill(currentRows[0]) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = await tx`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${principal.orgId}`;
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = {
+        ...current,
+        lifecycle: patch.lifecycle,
+        updatedAt: nowIso(),
+        revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+        revisionNumber: current.revisionNumber + 1,
+        ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+      };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const rows = await tx`UPDATE skills_registry SET lifecycle=${next2.lifecycle}, archived_at=${next2.archivedAt ?? null}, archive_reason=${next2.archiveReason ?? null}, replacement_slug=${next2.replacementSlug ?? null}, revision_id=${next2.revisionId}, revision_number=revision_number+1, updated_at=${next2.updatedAt} WHERE org_id=${principal.orgId} AND slug=${slug} AND tombstoned_at IS NULL AND revision_id=${current.revisionId} RETURNING *`;
+      if (!rows[0])
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, (await this.getSkill(principal, slug))?.revisionId ?? null);
+      return rowToSkill(rows[0]);
+    });
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -37116,7 +37379,7 @@ class PostgresSkillsStore {
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
     const rows = await this.sql`
-      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+      SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id = t.org_id AND s.slug = t.slug WHERE t.org_id = ${principal.orgId} AND s.lifecycle = 'active' ORDER BY t.tag ASC
     `;
     return rows.map((row) => String(row.tag));
   }
@@ -37125,7 +37388,7 @@ class PostgresSkillsStore {
     const rows = await this.sql`
       SELECT s.* FROM skills_registry s
       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY s.slug ASC
     `;
     return rows.map(rowToSkill);
@@ -37137,7 +37400,7 @@ class PostgresSkillsStore {
       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
       WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
-        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY p.slug ASC
     `;
     return rows.map(rowToPin);

package/dist/cli/commands/registry.d.ts

@@ -13,3 +13,4 @@ export declare function registerPull(parent: Command): void;
  * instance, newest first, with the one the instance currently serves marked (hasna/apps#1630).
  */
 export declare function registerVersions(parent: Command): void;
+export declare function registerLifecycle(parent: Command): void;