@hasna/skills 0.8.12 → 0.9.2

package/dist/sdk/index.js

@@ -32370,9 +32370,196 @@ var cachedClient;
 var init_event_sink = __esm(() => {
   init_dist();
 });
+// package.json
+var package_default = {
+  name: "@hasna/skills",
+  version: "0.9.2",
+  description: "Skills library for AI coding agents",
+  type: "module",
+  bin: {
+    skills: "bin/index.js",
+    "skills-mcp": "bin/mcp.js",
+    "skills-serve": "bin/server.js",
+    "skills-server": "bin/server.js",
+    "skills-worker": "bin/worker.js",
+    "skills-migrate": "bin/migrate.js"
+  },
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./storage": {
+      import: "./dist/storage.js",
+      types: "./dist/storage.d.ts"
+    },
+    "./sdk": {
+      import: "./dist/sdk/index.js",
+      types: "./dist/sdk/index.d.ts"
+    },
+    "./admin-contract": {
+      import: "./dist/admin-contract.js",
+      types: "./dist/admin-contract.d.ts"
+    }
+  },
+  files: [
+    "dist/",
+    "!dist/**/*.test.d.ts",
+    "!dist/**/*.fixture.d.ts",
+    "!dist/test-preload.d.ts",
+    "!dist/platform",
+    "bin/",
+    "migrations/",
+    "docs/skill-standard.md",
+    "docs/plugin-admission.md",
+    "schemas/",
+    "LICENSE",
+    "README.md",
+    "!dist/**/*test-utils.d.ts",
+    "!dist/**/*fixtures.d.ts"
+  ],
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  scripts: {
+    clean: "rm -rf bin/ dist/",
+    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
+    test: "bun test --timeout 30000",
+    dev: "bun run ./src/cli/index.tsx",
+    "dev:watch": "bun --watch run ./src/cli/index.tsx",
+    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
+    "dev:server": "bun --watch run ./src/server/index.ts",
+    "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "docker:check": "bash scripts/docker-build-check.sh",
+    migrate: "bun run ./src/server/migrate.ts",
+    typecheck: "tsc --noEmit",
+    "verify:release": "bun run scripts/release-guard.ts",
+    "verify:consumer-types": "bun run scripts/consumer-types.ts",
+    prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
+    prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
+    "verify:producer": "bun run scripts/release-dependencies.ts",
+    "verify:generated": "HASNA_SKILLS_RELEASE_ARTIFACT_TEST=1 bun test src/lib/release-artifacts.test.ts",
+    "verify:consumer-credentials": "bun run scripts/consumer-credentials.ts"
+  },
+  keywords: [
+    "skills",
+    "ai",
+    "agent",
+    "cli",
+    "typescript",
+    "bun",
+    "claude",
+    "codex",
+    "gemini",
+    "mcp",
+    "model-context-protocol",
+    "open-source",
+    "skills-library",
+    "automation"
+  ],
+  author: "Hasna",
+  license: "Apache-2.0",
+  devDependencies: {
+    "@hasna/contracts": "1.1.0",
+    "@types/bun": "1.3.14",
+    "@types/node": "25.2.3",
+    "@types/react": "^18.2.0",
+    "bun-types": "1.3.14",
+    "react-devtools-core": "^7.0.1",
+    typescript: "^5",
+    yaml: "^2.9.0"
+  },
+  dependencies: {
+    "@aws-sdk/client-ecs": "^3.1079.0",
+    "@aws-sdk/client-s3": "^3.1079.0",
+    "@hasna/events": "0.1.18",
+    "@hasna/secrets": "0.4.2",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    chalk: "^5.3.0",
+    commander: "^12.1.0",
+    ink: "^5.0.1",
+    "ink-select-input": "^6.0.0",
+    "ink-spinner": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    react: "^18.2.0",
+    zod: "^4.3.6"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/skills"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/skills",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  }
+};
 
-// src/lib/execution-grant-client.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+// src/lib/remote-files.ts
+import { createHash } from "crypto";
+var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
+function describeRemoteFiles(files) {
+  if (files.length > 10)
+    throw new Error("At most 10 input files are supported");
+  const names = new Set;
+  let total = 0;
+  return files.map((file) => {
+    if (typeof file.name !== "string" || file.name.length === 0 || file.name.length > 255 || /[/\\\x00-\x1f\x7f]/.test(file.name) || /[\ud800-\udfff]/u.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
+      throw new Error("Input file names must be unique safe basenames");
+    names.add(file.name);
+    total += file.bytes.byteLength;
+    if (file.bytes.byteLength > 20 * 1024 * 1024 || total > 50 * 1024 * 1024)
+      throw new Error("Input files exceed the supported size limit");
+    return { name: file.name, sizeBytes: file.bytes.byteLength, sha256: sha256(file.bytes), contentType: file.contentType ?? "application/octet-stream" };
+  });
+}
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+async function readBoundedResponse(response, maximum) {
+  if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
+    throw new Error("Invalid artifact size limit");
+  const length = response.headers.get("content-length");
+  if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
+    await response.body?.cancel();
+    throw new Error("Artifact exceeds its declared size limit");
+  }
+  const reader = response.body?.getReader();
+  if (!reader)
+    return new Uint8Array;
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > maximum)
+        throw new Error("Artifact exceeds its declared size limit");
+      chunks.push(next.value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
 
 // node_modules/@hasna/contracts/dist/client/transport.js
 import { isIP } from "net";
@@ -33591,64 +33778,152 @@ class MissingSkillsFleetError extends Error {
   }
 }
 
-// src/lib/remote-files.ts
-import { createHash } from "crypto";
-var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
-function describeRemoteFiles(files) {
-  if (files.length > 10)
-    throw new Error("At most 10 input files are supported");
-  const names = new Set;
-  let total = 0;
-  return files.map((file) => {
-    if (typeof file.name !== "string" || file.name.length === 0 || file.name.length > 255 || /[/\\\x00-\x1f\x7f]/.test(file.name) || /[\ud800-\udfff]/u.test(file.name) || file.name === "." || file.name === ".." || names.has(file.name))
-      throw new Error("Input file names must be unique safe basenames");
-    names.add(file.name);
-    total += file.bytes.byteLength;
-    if (file.bytes.byteLength > 20 * 1024 * 1024 || total > 50 * 1024 * 1024)
-      throw new Error("Input files exceed the supported size limit");
-    return { name: file.name, sizeBytes: file.bytes.byteLength, sha256: sha256(file.bytes), contentType: file.contentType ?? "application/octet-stream" };
-  });
-}
-function sha256(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-async function readBoundedResponse(response, maximum) {
-  if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
-    throw new Error("Invalid artifact size limit");
-  const length = response.headers.get("content-length");
-  if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-    await response.body?.cancel();
-    throw new Error("Artifact exceeds its declared size limit");
+// src/lib/cloud-executions.ts
+class CloudExecutionClient {
+  apiOrigin;
+  apiKey;
+  constructor(apiOrigin, apiKey) {
+    this.apiOrigin = apiOrigin;
+    this.apiKey = apiKey;
   }
-  const reader = response.body?.getReader();
-  if (!reader)
-    return new Uint8Array;
-  const chunks = [];
-  let size = 0;
-  try {
-    while (true) {
-      const next = await reader.read();
-      if (next.done)
+  static async configured() {
+    const c = await resolveSkillsConnection();
+    if (!c)
+      throw Error("Cloud execution requires a configured Skills API credential");
+    return new CloudExecutionClient(c.apiOrigin, c.apiKey);
+  }
+  async request(route, method = "GET", value) {
+    const response = await fetch(skillsApiRequestUrl(this.apiOrigin, "/api/v1/executions/" + route), {
+      method,
+      headers: {
+        authorization: `Bearer ${this.apiKey}`,
+        "User-Agent": `hasna-skills/${package_default.version}`,
+        ...value === undefined ? {} : { "content-type": "application/json" }
+      },
+      ...value === undefined ? {} : { body: JSON.stringify(value) },
+      redirect: "error",
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      response.body?.cancel();
+      throw Error(`Skills cloud execution refused: HTTP ${response.status}`);
+    }
+    return response;
+  }
+  async eligibility(slug, version, bundleDigest) {
+    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version) || bundleDigest !== undefined && !/^(sha256:)?[a-f0-9]{64}$/.test(bundleDigest))
+      throw Error("Cloud eligibility requires an exact skill version and valid digest");
+    const query = new URLSearchParams({ version, ...bundleDigest ? { bundleDigest } : {} });
+    const v = await jsonBody(await this.request(`${slug}/eligibility?${query}`));
+    if (!v || v.contractVersion !== 1 || typeof v.eligible !== "boolean" || v.skill !== slug || v.version !== version || !/^[a-f0-9]{64}$/.test(v.bundleDigest) || bundleDigest && bundleDigest.replace(/^sha256:/, "") !== v.bundleDigest || v.eligible && (!v.executionContract || !["pdf.v1", "regex-test.v1"].includes(v.executionContract.id)))
+      throw Error("Invalid cloud eligibility receipt");
+    return v;
+  }
+  async submit(slug, version, input, key, selection) {
+    if (!/^[a-z0-9-]+$/.test(slug) || !/^\d+\.\d+\.\d+$/.test(version))
+      throw Error("Cloud execution requires skill@exact-version");
+    if (!/^[A-Za-z0-9._:-]{1,128}$/.test(key))
+      throw Error("Invalid idempotency key");
+    if (selection?.authority && selection.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
+      throw Error("Selected skill belongs to another Skills authority");
+    const execution = parseExecution(await jsonBody(await this.request(slug, "POST", {
+      version,
+      input,
+      idempotencyKey: key,
+      ...selection ? {
+        bundleDigest: selection.bundleDigest,
+        workspaceId: selection.workspaceId
+      } : {}
+    })));
+    if (execution.skill !== slug || execution.version !== version || selection && execution.bundleDigest.replace(/^sha256:/, "") !== selection.bundleDigest.replace(/^sha256:/, ""))
+      throw Error("Cloud execution receipt does not match the selected exact skill");
+    return execution;
+  }
+  async get(id) {
+    return parseExecution(await jsonBody(await this.request(runId(id))));
+  }
+  async logs(id) {
+    return jsonBody(await this.request(runId(id) + "/logs"));
+  }
+  async artifacts(id) {
+    return (await this.get(id)).artifacts;
+  }
+  async download(id, name) {
+    if (!["document.pdf", "document.html"].includes(name))
+      throw Error("Invalid cloud artifact name");
+    const response = await this.request(runId(id) + "/artifacts/" + encodeURIComponent(name));
+    if (!response.body)
+      throw Error("Cloud artifact body is missing");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;; ) {
+      const r2 = await reader.read();
+      if (r2.done)
         break;
-      size += next.value.byteLength;
-      if (size > maximum)
-        throw new Error("Artifact exceeds its declared size limit");
-      chunks.push(next.value);
+      size += r2.value.length;
+      if (size > 2000000) {
+        await reader.cancel();
+        throw Error("Cloud artifact exceeds limit");
+      }
+      chunks.push(r2.value);
     }
-  } catch (error) {
-    await reader.cancel().catch(() => {});
-    throw error;
-  } finally {
-    reader.releaseLock();
+    return Buffer.concat(chunks);
   }
-  const bytes = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
+  async cancel(id) {
+    return parseExecution(await jsonBody(await this.request(runId(id) + "/cancel", "POST", {})));
+  }
+  async wait(id, options = {}) {
+    const timeout = options.timeoutMs ?? 300000, interval = options.intervalMs ?? 1000;
+    if (!Number.isFinite(timeout) || timeout < 1 || timeout > 1200000 || !Number.isFinite(interval) || interval < 100 || interval > 60000)
+      throw Error("Invalid cloud polling bounds");
+    const until = Date.now() + timeout;
+    for (;; ) {
+      const run = await this.get(id);
+      if (["succeeded", "failed", "cancelled"].includes(run.status))
+        return run;
+      if (Date.now() >= until)
+        throw Error("Cloud execution is still running; poll the returned execution id");
+      await Bun.sleep(interval);
+    }
+  }
+}
+function runId(id) {
+  if (!/^run_[a-z0-9_]+$/.test(id))
+    throw Error("Invalid cloud execution id");
+  return id;
+}
+function parseExecution(value) {
+  const v = value;
+  if (!v || v.contractVersion !== 1 || v.target !== "cloud" || ![
+    "admitted",
+    "leased",
+    "running",
+    "succeeded",
+    "failed",
+    "cancelled"
+  ].includes(v.status) || typeof v.skill !== "string" || typeof v.version !== "string" || !Array.isArray(v.artifacts))
+    throw Error("Unsupported cloud execution response");
+  runId(v.id);
+  for (const field of [
+    "bundleDigest",
+    "inputDigest",
+    "runtimeImageDigest"
+  ])
+    if (typeof v[field] !== "string" || !/^(sha256:)?[a-f0-9]{64}$/.test(v[field]))
+      throw Error("Invalid cloud execution integrity receipt");
+  return v;
+}
+async function jsonBody(response) {
+  const bytes = await readBoundedResponse(response, 1e5);
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw Error("Invalid cloud execution JSON response");
   }
-  return bytes;
 }
+// src/lib/execution-grant-client.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 
 // src/lib/selection-cache.ts
 import { createHash as createHash3, randomUUID } from "crypto";
@@ -36701,138 +36976,6 @@ async function resolveExecutionGrant(input) {
   }
   return value;
 }
-// package.json
-var package_default = {
-  name: "@hasna/skills",
-  version: "0.8.12",
-  description: "Skills library for AI coding agents",
-  type: "module",
-  bin: {
-    skills: "bin/index.js",
-    "skills-mcp": "bin/mcp.js",
-    "skills-serve": "bin/server.js",
-    "skills-server": "bin/server.js",
-    "skills-worker": "bin/worker.js",
-    "skills-migrate": "bin/migrate.js"
-  },
-  exports: {
-    ".": {
-      import: "./dist/index.js",
-      types: "./dist/index.d.ts"
-    },
-    "./storage": {
-      import: "./dist/storage.js",
-      types: "./dist/storage.d.ts"
-    },
-    "./sdk": {
-      import: "./dist/sdk/index.js",
-      types: "./dist/sdk/index.d.ts"
-    },
-    "./admin-contract": {
-      import: "./dist/admin-contract.js",
-      types: "./dist/admin-contract.d.ts"
-    }
-  },
-  files: [
-    "dist/",
-    "!dist/**/*.test.d.ts",
-    "!dist/**/*.fixture.d.ts",
-    "!dist/test-preload.d.ts",
-    "!dist/platform",
-    "bin/",
-    "migrations/",
-    "docs/skill-standard.md",
-    "docs/plugin-admission.md",
-    "schemas/",
-    "LICENSE",
-    "README.md",
-    "!dist/**/*test-utils.d.ts",
-    "!dist/**/*fixtures.d.ts"
-  ],
-  main: "./dist/index.js",
-  types: "./dist/index.d.ts",
-  scripts: {
-    clean: "rm -rf bin/ dist/",
-    build: "bun run clean && bun build ./src/cli/index.tsx --outdir ./bin --target bun && bun build ./src/mcp/index.ts --outfile ./bin/mcp.js --target bun && bun build ./src/server/index.ts --outfile ./bin/server.js --target bun && bun build ./src/server/worker.ts --outfile ./bin/worker.js --target bun && bun build ./src/server/migrate.ts --outfile ./bin/migrate.js --target bun && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    "build:js": "rm -rf dist && bun build ./src/index.ts ./src/storage.ts ./src/sdk/index.ts ./src/admin-contract.ts --outdir ./dist --target bun && tsc --emitDeclarationOnly --declaration --outDir dist",
-    test: "bun test --timeout 30000",
-    dev: "bun run ./src/cli/index.tsx",
-    "dev:watch": "bun --watch run ./src/cli/index.tsx",
-    "dev:mcp": "bun --watch run ./src/mcp/index.ts",
-    "dev:server": "bun --watch run ./src/server/index.ts",
-    "dev:worker": "bun --watch run ./src/server/worker.ts",
-    "docker:check": "bash scripts/docker-build-check.sh",
-    migrate: "bun run ./src/server/migrate.ts",
-    typecheck: "tsc --noEmit",
-    "verify:release": "bun run scripts/release-guard.ts",
-    "verify:consumer-types": "bun run scripts/consumer-types.ts",
-    prepack: "bun run verify:generated && bun run verify:release && bun run verify:consumer-types",
-    prepublishOnly: "bun run verify:producer && bun run typecheck && bun run test",
-    "verify:producer": "bun run scripts/release-dependencies.ts",
-    "verify:generated": "HASNA_SKILLS_RELEASE_ARTIFACT_TEST=1 bun test src/lib/release-artifacts.test.ts",
-    "verify:consumer-credentials": "bun run scripts/consumer-credentials.ts"
-  },
-  keywords: [
-    "skills",
-    "ai",
-    "agent",
-    "cli",
-    "typescript",
-    "bun",
-    "claude",
-    "codex",
-    "gemini",
-    "mcp",
-    "model-context-protocol",
-    "open-source",
-    "skills-library",
-    "automation"
-  ],
-  author: "Hasna",
-  license: "Apache-2.0",
-  devDependencies: {
-    "@hasna/contracts": "1.1.0",
-    "@types/bun": "1.3.14",
-    "@types/node": "25.2.3",
-    "@types/react": "^18.2.0",
-    "bun-types": "1.3.14",
-    "react-devtools-core": "^7.0.1",
-    typescript: "^5",
-    yaml: "^2.9.0"
-  },
-  dependencies: {
-    "@aws-sdk/client-ecs": "^3.1079.0",
-    "@aws-sdk/client-s3": "^3.1079.0",
-    "@hasna/events": "0.1.18",
-    "@hasna/secrets": "0.4.2",
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    chalk: "^5.3.0",
-    commander: "^12.1.0",
-    ink: "^5.0.1",
-    "ink-select-input": "^6.0.0",
-    "ink-spinner": "^5.0.0",
-    "ink-text-input": "^6.0.0",
-    react: "^18.2.0",
-    zod: "^4.3.6"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/hasna/apps.git",
-    directory: "apps/skills"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/skills",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  }
-};
-
 // src/lib/profile-client.ts
 function object(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -40518,6 +40661,35 @@ function treeHash(root2) {
   visit2(root2);
   return hash2.digest("hex");
 }
+function selectNativeMigrationTargets(inventory, manifest) {
+  if (manifest.schema !== "hasna.skills-native-migration-targets.v1" || !/^[0-9a-f]{64}$/.test(manifest.digest) || !Array.isArray(manifest.targets) || manifest.targets.length === 0)
+    throw new Error("Invalid native migration target manifest");
+  const identities = new Set;
+  const selected = [];
+  for (const target of manifest.targets) {
+    const projectRoot = resolve14(target.projectRoot), normalized = relative3(projectRoot, resolve14(projectRoot, target.path));
+    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync6(projectRoot) || !lstatSync17(projectRoot).isDirectory())
+      throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
+    assertSafePath(projectRoot);
+    if (isAbsolute15(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep4}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
+      throw new Error(`Invalid native migration target: ${target.path}`);
+    const identity3 = `${target.agent}\x00${projectRoot}\x00${normalized}`;
+    if (identities.has(identity3))
+      throw new Error(`Duplicate native migration target: ${target.path}`);
+    identities.add(identity3);
+    const expected = resolve14(target.projectRoot, target.path);
+    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve14(entry2.path) === expected);
+    if (matches.length !== 1)
+      throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
+    const entry = matches[0];
+    if (entry.bridge || entry.system || entry.vendor)
+      throw new Error(`Native migration target is protected or vendor-owned: ${entry.path}`);
+    if (entry.hash !== target.treeSha256 || treeHash(entry.path) !== target.treeSha256)
+      throw new Error(`Native migration target changed after review: ${entry.path}`);
+    selected.push(entry);
+  }
+  return selected;
+}
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
@@ -41006,12 +41178,13 @@ function archiveNativeSkills(inventory, options) {
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
-  const selected = inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
+  const selected = options.targetManifest ? selectNativeMigrationTargets(inventory, options.targetManifest) : inventory.filter((entry) => !entry.bridge && !entry.system && (entry.vendor ? options.includeVendor : entry.managed || options.includeUnmanaged));
   for (const entry of selected)
     if (treeHash(entry.path) !== entry.hash)
       throw new Error(`Native skill changed after planning: ${entry.path}`);
+  const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
-    return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
+    return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const operationId = randomUUID3(), archiveRoot = join21(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join21(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join21(entry.path, "SKILL.md") : entry.path,
@@ -41020,7 +41193,7 @@ function archiveNativeSkills(inventory, options) {
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
-  const journal = { version: 2, operationId, status: "planned", entries, ...aliases.length ? { rootAliases: aliases } : {} };
+  const journal = { version: 2, operationId, status: "planned", entries, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
@@ -41114,7 +41287,7 @@ function archiveNativeSkills(inventory, options) {
     } catch {}
     throw new Error(`Native archive failed; inspect the recovery journal at ${receiptPath} before retrying.`, { cause: error });
   }
-  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...aliases.length ? { rootAliases: aliases } : {} };
+  return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
 }
 function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir2))
@@ -41726,6 +41899,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -41738,7 +41912,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -42257,6 +42431,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync15(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -54107,12 +54287,12 @@ class ArtifactStorage {
   get usesS3() {
     return Boolean(this.bucket);
   }
-  objectKeyFor(tenantId, runId, relativePath) {
+  objectKeyFor(tenantId, runId2, relativePath) {
     const safeRelativePath = relativePath.replace(/^\/+/, "").replace(/\.\.(?:\/|$)/g, "");
-    return `${this.runPrefix}/${tenantId}/${runId}/${safeRelativePath}`;
+    return `${this.runPrefix}/${tenantId}/${runId2}/${safeRelativePath}`;
   }
-  quarantineKeyFor(tenantId, runId, artifactId) {
-    return `${this.runPrefix}/quarantine/${tenantId}/${runId}/${artifactId}`;
+  quarantineKeyFor(tenantId, runId2, artifactId) {
+    return `${this.runPrefix}/quarantine/${tenantId}/${runId2}/${artifactId}`;
   }
   async materialize(run, artifact, body) {
     if (!this.bucket) {
@@ -54363,13 +54543,13 @@ function createCancelService(options) {
   const governanceStore = options.governanceStore;
   const storage = options.storage ?? new ArtifactStorage;
   return {
-    async cancel(principal, runId, requestedBy) {
+    async cancel(principal, runId2, requestedBy) {
       if (!store.transitionRun) {
-        throw new GovernanceError(GOVERNANCE_ERROR_CODES.FENCING_UNSUPPORTED, `cannot cancel run ${runId}: the store has no transitionRun generation fencing`, { gate: "transitionRun" });
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.FENCING_UNSUPPORTED, `cannot cancel run ${runId2}: the store has no transitionRun generation fencing`, { gate: "transitionRun" });
       }
-      const run = await store.getRun(principal, runId);
+      const run = await store.getRun(principal, runId2);
       if (!run)
-        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} not found`, { gate: "run" });
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId2} not found`, { gate: "run" });
       const terminalStatuses = new Set(["succeeded", "failed", "cancelled", "expired", "refunded"]);
       if (terminalStatuses.has(run.status)) {
         const receipt2 = await governanceStore.appendReceipt({
@@ -54382,11 +54562,11 @@ function createCancelService(options) {
         return { run, fencedGeneration: run.leaseGeneration, quarantined: [], receipt: receipt2, alreadyTerminal: true };
       }
       const fencedGeneration = run.leaseGeneration + 1;
-      const cancelling = await store.transitionRun(runId, { status: "cancel_requested", leaseGeneration: fencedGeneration }, run.leaseGeneration);
+      const cancelling = await store.transitionRun(runId2, { status: "cancel_requested", leaseGeneration: fencedGeneration }, run.leaseGeneration);
       if (!cancelling) {
-        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} changed while cancelling`, { gate: "transition" });
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId2} changed while cancelling`, { gate: "transition" });
       }
-      const artifacts = await store.listArtifacts(principal, runId);
+      const artifacts = await store.listArtifacts(principal, runId2);
       const quarantined = [];
       for (const artifact of artifacts) {
         const quarantineKey = await storage.moveToQuarantine?.(artifact);
@@ -54403,9 +54583,9 @@ function createCancelService(options) {
         });
         quarantined.push({ ...artifact, ...quarantineKey ? { storageKey: quarantineKey } : {} });
       }
-      const cancelled = await store.transitionRun(runId, { status: "cancelled", completedAt: new Date().toISOString() }, fencedGeneration);
+      const cancelled = await store.transitionRun(runId2, { status: "cancelled", completedAt: new Date().toISOString() }, fencedGeneration);
       if (!cancelled) {
-        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId} moved on while finalising cancellation`, { gate: "transition" });
+        throw new GovernanceError(GOVERNANCE_ERROR_CODES.STALE_LEASE_GENERATION, `run ${runId2} moved on while finalising cancellation`, { gate: "transition" });
       }
       const receipt = await governanceStore.appendReceipt({
         kind: "cancel",
@@ -54623,6 +54803,9 @@ class MemorySkillSelectionStore {
   async getProfile(p2, id2) {
     return structuredClone(this.profiles.get(this.key(p2.orgId, id2)) ?? null);
   }
+  async profilesReferencingSkill(p2, slug) {
+    return [...this.profiles.values()].filter((profile2) => profile2.workspaceId === p2.orgId && profile2.selections.some((selection2) => selection2.slug === slug)).map((profile2) => profile2.id).sort();
+  }
   async saveProfile(p2, id2, selected, expected) {
     const key = this.key(p2.orgId, id2), previous = this.profiles.get(key);
     if ((previous?.revision ?? null) !== expected)
@@ -54660,14 +54843,25 @@ class SqliteSkillSelectionStore {
   constructor(db) {
     this.db = db;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(p2.orgId);
+    return rows.filter((row) => selections(row.selections_json).some((selection2) => selection2.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id2) {
     const row = this.db.query("SELECT * FROM skills_profiles WHERE org_id=? AND profile_id=?").get(p2.orgId, id2);
     return row ? profile(row) : null;
   }
   async saveProfile(p2, id2, selected, expected) {
-    const revision = randomUUID5(), timestamp = new Date().toISOString();
-    const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id2, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id2, expected);
-    return row ? profile(row) : null;
+    return this.db.transaction(() => {
+      for (const selection2 of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const skill = this.db.query("SELECT lifecycle FROM skills_registry WHERE org_id=? AND slug=?").get(p2.orgId, selection2.slug);
+        if (skill?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID5(), timestamp = new Date().toISOString();
+      const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p2.orgId, id2, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p2.orgId, id2, expected);
+      return row ? profile(row) : null;
+    }).immediate();
   }
   async getStationState(p2, id2) {
     const row = this.db.query("SELECT * FROM skills_station_state WHERE org_id=? AND actor_id=? AND station_id=?").get(p2.orgId, p2.userId, id2);
@@ -54686,14 +54880,25 @@ class PostgresSkillSelectionStore {
   constructor(sql) {
     this.sql = sql;
   }
+  async profilesReferencingSkill(p2, slug) {
+    const rows = await this.sql`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${p2.orgId}`;
+    return rows.filter((row) => selections(row.selections_json).some((selection2) => selection2.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
   async getProfile(p2, id2) {
     const rows = await this.sql`SELECT * FROM skills_profiles WHERE org_id=${p2.orgId} AND profile_id=${id2}`;
     return rows[0] ? profile(rows[0]) : null;
   }
   async saveProfile(p2, id2, selected, expected) {
-    const revision = randomUUID5(), timestamp = new Date().toISOString();
-    const rows = expected === null ? await this.sql`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id2},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await this.sql`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id2} AND revision=${expected} RETURNING *`;
-    return rows[0] ? profile(rows[0]) : null;
+    return this.sql.begin(async (tx) => {
+      for (const selection2 of [...selected].sort((a3, b3) => a3.slug.localeCompare(b3.slug))) {
+        const rows2 = await tx`SELECT lifecycle FROM skills_registry WHERE org_id=${p2.orgId} AND slug=${selection2.slug} FOR UPDATE`;
+        if (rows2[0]?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID5(), timestamp = new Date().toISOString();
+      const rows = expected === null ? await tx`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p2.orgId},${id2},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await tx`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p2.orgId} AND profile_id=${id2} AND revision=${expected} RETURNING *`;
+      return rows[0] ? profile(rows[0]) : null;
+    });
   }
   async getStationState(p2, id2) {
     const rows = await this.sql`SELECT * FROM skills_station_state WHERE org_id=${p2.orgId} AND actor_id=${p2.userId} AND station_id=${id2}`;
@@ -54814,7 +55019,7 @@ function nowIso() {
 function normalizeLimit(limit) {
   return Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : 0;
 }
-function runId() {
+function runId2() {
   return `run_${Date.now().toString(36)}_${randomUUID6().slice(0, 8)}`;
 }
 function rowToRun(row) {
@@ -54887,7 +55092,11 @@ function rowToSkill(row) {
     revisionId: String(row.revision_id ?? ""),
     revisionNumber: Number(row.revision_number ?? 0),
     ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
-    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {}
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    lifecycle: row.lifecycle === "archived" ? "archived" : "active",
+    ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
+    ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
+    ...row.replacement_slug ? { replacementSlug: String(row.replacement_slug) } : {}
   };
 }
 function rowToPin(row) {
@@ -54968,10 +55177,10 @@ class StaleLeaseGenerationError extends Error {
   expectedGeneration;
   currentGeneration;
   status;
-  constructor(runId2, expectedGeneration, currentGeneration, status) {
-    super(`late transition rejected for run ${runId2}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+  constructor(runId3, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId3}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
     this.name = "StaleLeaseGenerationError";
-    this.runId = runId2;
+    this.runId = runId3;
     this.expectedGeneration = expectedGeneration;
     this.currentGeneration = currentGeneration;
     this.status = status;
@@ -55006,11 +55215,22 @@ class SkillVersionExistsError extends Error {
   }
 }
 
+class SkillLifecycleConflictError extends Error {
+  slug;
+  profiles;
+  constructor(slug, profiles) {
+    super(`cannot archive '${slug}' while active profiles reference it: ${profiles.join(", ")}`);
+    this.slug = slug;
+    this.profiles = profiles;
+    this.name = "SkillLifecycleConflictError";
+  }
+}
+
 // src/lib/revision.ts
 import { createHash as createHash20 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical4 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -55022,7 +55242,13 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
   return createHash20("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record3) {
@@ -55125,6 +55351,28 @@ class SqliteSkillsStore {
       scopes: parseScopes(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    const row = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+    if (!row)
+      return { kind: "not_found" };
+    const current = parseScopes(row.scopes_json);
+    if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+      return { kind: "stale", scopes: current };
+    }
+    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const tx = this.db.transaction(() => {
+      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), keyId, actor.orgId, JSON.stringify(expectedScopes)]);
+      if (changed.changes !== 1)
+        return false;
+      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json) VALUES (?, ?, ?, ?, ?, ?, ?)", [actor.orgId, actor.userId, actor.apiKeyId, "api_key_scopes_added", "api_key", keyId, JSON.stringify({ added: addScopes, scopes })]);
+      return true;
+    });
+    if (!tx()) {
+      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
+    }
+    return { kind: "updated", scopes };
+  }
   async createRun(input) {
     if (input.idempotencyKey) {
       const existing = this.get("SELECT * FROM skills_runs WHERE org_id = ? AND idempotency_key = ? LIMIT 1", [input.principal.orgId, input.idempotencyKey]);
@@ -55134,7 +55382,7 @@ class SqliteSkillsStore {
     const row = this.get(`INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id, created_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        RETURNING *`, [
-      runId(),
+      runId2(),
       input.principal.orgId,
       input.principal.userId,
       input.slug,
@@ -55446,6 +55694,39 @@ class SqliteSkillsStore {
     const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
     return row ? rowToSkill(row) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.db.transaction(() => {
+      const rowCurrent = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+      const current = rowCurrent ? rowToSkill(rowCurrent) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(principal.orgId);
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection2) => selection2?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = { ...current, lifecycle: patch.lifecycle, updatedAt: nowIso(), ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {} };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
+      if (!row)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
+      return rowToSkill(row);
+    }).immediate();
+  }
+  getSkillSync(principal, slug) {
+    const row = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+    return row ? rowToSkill(row) : null;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -55558,13 +55839,13 @@ class SqliteSkillsStore {
   }
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
-    return this.all("SELECT DISTINCT tag FROM skills_tags WHERE org_id = ? ORDER BY tag ASC", [principal.orgId]).map((row) => String(row.tag));
+    return this.all("SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id=t.org_id AND s.slug=t.slug WHERE t.org_id = ? AND s.lifecycle='active' ORDER BY t.tag ASC", [principal.orgId]).map((row) => String(row.tag));
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     return this.all(`SELECT s.* FROM skills_registry s
        JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
   }
   async listPinsByTag(principal, tag) {
@@ -55572,7 +55853,7 @@ class SqliteSkillsStore {
     return this.all(`SELECT p.* FROM skills_pins p
        JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
        JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
-       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
        ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
   }
   async listPublishedSlugs(principal) {
@@ -55694,8 +55975,8 @@ class MemoryGovernanceStore {
     this.receipts.push(next2);
     return next2;
   }
-  async listReceipts(orgId, runId2) {
-    return this.receipts.filter((receipt) => receipt.orgId === orgId && receipt.runId === runId2);
+  async listReceipts(orgId, runId3) {
+    return this.receipts.filter((receipt) => receipt.orgId === orgId && receipt.runId === runId3);
   }
   async createReservation(input) {
     const estimatedCents = input.estimatedCents;
@@ -55704,8 +55985,8 @@ class MemoryGovernanceStore {
     this.reservations.push(reservation);
     return reservation;
   }
-  async reservationsForRun(orgId, runId2) {
-    return this.reservations.filter((reservation) => reservation.orgId === orgId && reservation.runId === runId2);
+  async reservationsForRun(orgId, runId3) {
+    return this.reservations.filter((reservation) => reservation.orgId === orgId && reservation.runId === runId3);
   }
   async reconcileReservation(reservationId2, actualCents, status) {
     assertReservationCents(actualCents, "actualCents");
@@ -55777,8 +56058,8 @@ class SqliteGovernanceStore {
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [next2.id, next2.kind, next2.orgId, next2.runId, next2.artifactId ?? null, next2.requestedBy, JSON.stringify(next2.metadata), next2.createdAt]);
     return next2;
   }
-  async listReceipts(orgId, runId2) {
-    const rows = this.db.query("SELECT * FROM skills_lifecycle_receipts WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+  async listReceipts(orgId, runId3) {
+    const rows = this.db.query("SELECT * FROM skills_lifecycle_receipts WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId3);
     return rows.map((row) => ({
       id: String(row.id),
       kind: String(row.kind),
@@ -55798,8 +56079,8 @@ class SqliteGovernanceStore {
        VALUES (?, ?, ?, ?, ?, ?)`, [reservation.id, reservation.orgId, reservation.runId, reservation.estimatedCents, reservation.status, reservation.createdAt]);
     return reservation;
   }
-  async reservationsForRun(orgId, runId2) {
-    const rows = this.db.query("SELECT * FROM skills_credit_reservations WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId2);
+  async reservationsForRun(orgId, runId3) {
+    const rows = this.db.query("SELECT * FROM skills_credit_reservations WHERE org_id = ? AND run_id = ? ORDER BY created_at ASC, rowid ASC").all(orgId, runId3);
     return rows.map((row) => this.reservationFrom(row));
   }
   async reconcileReservation(reservationId2, actualCents, status) {
@@ -55873,9 +56154,9 @@ class PostgresGovernanceStore {
     `;
     return next2;
   }
-  async listReceipts(orgId, runId2) {
+  async listReceipts(orgId, runId3) {
     const rows = await this.sql`
-      SELECT * FROM skills_lifecycle_receipts WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+      SELECT * FROM skills_lifecycle_receipts WHERE org_id = ${orgId} AND run_id = ${runId3} ORDER BY created_at ASC
     `;
     return rows.map((row) => ({
       id: String(row.id),
@@ -55898,9 +56179,9 @@ class PostgresGovernanceStore {
     `;
     return reservation;
   }
-  async reservationsForRun(orgId, runId2) {
+  async reservationsForRun(orgId, runId3) {
     const rows = await this.sql`
-      SELECT * FROM skills_credit_reservations WHERE org_id = ${orgId} AND run_id = ${runId2} ORDER BY created_at ASC
+      SELECT * FROM skills_credit_reservations WHERE org_id = ${orgId} AND run_id = ${runId3} ORDER BY created_at ASC
     `;
     return rows.map((row) => this.reservationFrom(row));
   }
@@ -56016,6 +56297,15 @@ class SkillRequestError extends Error {
     this.code = code;
   }
 }
+function skillLifecyclePatch(body) {
+  if (body.lifecycle !== "active" && body.lifecycle !== "archived")
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "lifecycle must be active or archived");
+  if (body.reason !== undefined && (typeof body.reason !== "string" || body.reason.length > 512))
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "reason must be at most 512 characters");
+  if (body.replacementSlug !== undefined && (typeof body.replacementSlug !== "string" || !SLUG_PATTERN.test(body.replacementSlug)))
+    throw new SkillRequestError(400, "INVALID_LIFECYCLE", "replacementSlug must be a valid skill slug");
+  return { lifecycle: body.lifecycle, ...body.reason ? { reason: body.reason } : {}, ...body.replacementSlug ? { replacementSlug: body.replacementSlug } : {} };
+}
 function publishedSkillMeta(record3) {
   return {
     name: record3.slug,
@@ -56040,7 +56330,11 @@ function publishedPayload(record3, opts = {}) {
     publishedAt: record3.createdAt,
     updatedAt: record3.updatedAt,
     revisionId: record3.revisionId,
-    revisionNumber: record3.revisionNumber
+    revisionNumber: record3.revisionNumber,
+    lifecycle: record3.lifecycle,
+    ...record3.archivedAt ? { archivedAt: record3.archivedAt } : {},
+    ...record3.archiveReason ? { archiveReason: record3.archiveReason } : {},
+    ...record3.replacementSlug ? { replacementSlug: record3.replacementSlug } : {}
   };
 }
 function revisionEtag(revisionId) {
@@ -56080,7 +56374,7 @@ async function tombstoneStatus(store, artifactStorage, principal, record3) {
   };
 }
 async function listMergedSkills(store, principal) {
-  return (await store.listSkills(principal)).sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
+  return (await store.listSkills(principal)).filter((record3) => record3.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
 }
 async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
   const record3 = await store.getSkill(principal, slug);
@@ -56097,7 +56391,7 @@ async function listOrgTags(store, principal) {
   return [...new Set((await store.listTags(principal)).filter((tag) => tag.trim()))].sort();
 }
 async function listMergedSkillsByTag(store, principal, tag) {
-  return (await store.listSkillsByTag(principal, tag)).sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
+  return (await store.listSkillsByTag(principal, tag)).filter((record3) => record3.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
 }
 function skillSummary(skill) {
   return {
@@ -56659,6 +56953,8 @@ async function validatePublished(store, principal, selections2) {
     const current = await store.getSkill(principal, selection2.slug);
     if (!current || current.tombstonedAt)
       throw new SkillRequestError(current?.tombstonedAt ? 410 : 404, "SELECTION_UNAVAILABLE", `Selected skill '${selection2.slug}' is unavailable`);
+    if (current.lifecycle === "archived")
+      throw new SkillRequestError(409, "SELECTION_ARCHIVED", `Selected skill '${selection2.slug}' is archived`);
     const version2 = await store.getSkillVersion(principal, selection2.slug, selection2.version);
     if (!version2 || `sha256:${version2.bundleSha256}` !== selection2.bundleDigest)
       throw new SkillRequestError(409, "SELECTION_VERSION_MISMATCH", `Selected version of '${selection2.slug}' does not match its published digest`);
@@ -56895,8 +57191,8 @@ class RuntimeExecutionStore {
     this.sqlite?.close();
     await this.postgres?.close();
   }
-  async job(runId2) {
-    const row = this.sqlite ? this.sqlite.query("SELECT payload FROM skills_runtime_jobs WHERE run_id=?").get(runId2) : (await this.postgres`SELECT payload FROM skills_runtime_jobs WHERE run_id=${runId2}`)[0];
+  async job(runId3) {
+    const row = this.sqlite ? this.sqlite.query("SELECT payload FROM skills_runtime_jobs WHERE run_id=?").get(runId3) : (await this.postgres`SELECT payload FROM skills_runtime_jobs WHERE run_id=${runId3}`)[0];
     return row ? JSON.parse(String(row.payload)) : null;
   }
   async mutate(id2, fn) {
@@ -57229,19 +57525,19 @@ class MemoryRunExecutionStore {
     }), admission.runId);
     return row;
   }
-  async getRun(runId2) {
-    return this.runs.get(runId2) ?? null;
+  async getRun(runId3) {
+    return this.runs.get(runId3) ?? null;
   }
   async getRunByKey(tenantId, idempotencyKey) {
-    const runId2 = this.byKey.get(tenantId + "\x00" + idempotencyKey);
-    return runId2 ? this.runs.get(runId2) ?? null : null;
+    const runId3 = this.byKey.get(tenantId + "\x00" + idempotencyKey);
+    return runId3 ? this.runs.get(runId3) ?? null : null;
   }
   async getRunByDigests(input) {
-    const runId2 = this.byDigests.get(digestKey(input));
-    return runId2 ? this.runs.get(runId2) ?? null : null;
+    const runId3 = this.byDigests.get(digestKey(input));
+    return runId3 ? this.runs.get(runId3) ?? null : null;
   }
-  async listAttempts(runId2) {
-    return Array.from(this.attempts.values()).filter((attempt) => attempt.runId === runId2).sort((a3, b3) => a3.attemptNumber - b3.attemptNumber);
+  async listAttempts(runId3) {
+    return Array.from(this.attempts.values()).filter((attempt) => attempt.runId === runId3).sort((a3, b3) => a3.attemptNumber - b3.attemptNumber);
   }
   async createAttempt(input) {
     const attemptId = `${input.runId}/attempt/${input.attemptNumber}`;
@@ -57321,7 +57617,7 @@ class MemoryRunExecutionStore {
   async recordTransition(transition) {
     this.transitions.push(transition);
   }
-  async markAttemptTerminal(runId2, attemptId) {
+  async markAttemptTerminal(runId3, attemptId) {
     const attempt = this.attempts.get(attemptId);
     if (!attempt)
       return null;
@@ -57333,15 +57629,15 @@ class MemoryRunExecutionStore {
     this.receipts.set(receipt.runId + "\x00" + receipt.attemptId, receipt);
     return receipt;
   }
-  async getReceipt(runId2, attemptId) {
-    return this.receipts.get(runId2 + "\x00" + attemptId) ?? null;
+  async getReceipt(runId3, attemptId) {
+    return this.receipts.get(runId3 + "\x00" + attemptId) ?? null;
   }
-  async finalizeRun(runId2, status, receiptId2) {
-    const run = this.runs.get(runId2);
+  async finalizeRun(runId3, status, receiptId2) {
+    const run = this.runs.get(runId3);
     if (!run)
       return null;
     for (const [attemptId, attempt] of this.attempts) {
-      if (attempt.runId === runId2 && attempt.status !== "terminal") {
+      if (attempt.runId === runId3 && attempt.status !== "terminal") {
         this.attempts.set(attemptId, { ...attempt, status: "terminal" });
       }
     }
@@ -57351,15 +57647,15 @@ class MemoryRunExecutionStore {
       terminalReceiptId: receiptId2,
       updatedAt: new Date().toISOString()
     };
-    this.runs.set(runId2, next2);
+    this.runs.set(runId3, next2);
     return next2;
   }
-  async setRunStatus(runId2, status) {
-    const run = this.runs.get(runId2);
+  async setRunStatus(runId3, status) {
+    const run = this.runs.get(runId3);
     if (!run)
       return null;
     const next2 = { ...run, status, updatedAt: new Date().toISOString() };
-    this.runs.set(runId2, next2);
+    this.runs.set(runId3, next2);
     return next2;
   }
 }
@@ -57377,21 +57673,28 @@ class SqliteRunExecutionStore {
     this.db = new Database4(path);
     this.db.run("PRAGMA journal_mode = WAL");
     this.db.run("PRAGMA foreign_keys = ON");
-    this.db.run(SCHEMA_SQL);
+    this.db.transaction(() => {
+      this.db.run(SCHEMA_SQL);
+      for (const table of ["execution_runs", "execution_receipts"]) {
+        const columns = this.db.query(`PRAGMA table_info(${table})`).all();
+        if (!columns.some((column) => column.name === "execution_contract_json"))
+          this.db.run(`ALTER TABLE ${table} ADD COLUMN execution_contract_json TEXT`);
+      }
+    }).immediate();
   }
   async admit(admission) {
     this.db.query(`INSERT OR IGNORE INTO execution_runs (
            run_id, contract_version, tenant_id, skill_id, skill_version, bundle_digest,
            runtime_image_digest, dependency_layer_tag, input_digest, runtime,
-           policy_json, limits_json, idempotency_key, status, created_at, updated_at
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(admission.runId, admission.contractVersion, admission.tenantId, admission.skillId, admission.skillVersion, admission.bundleDigest, admission.runtimeImageDigest, admission.dependencyLayerTag, admission.inputDigest, admission.runtime, JSON.stringify(admission.policy), JSON.stringify(admission.limits), admission.idempotencyKey, "admitted", admission.createdAt, admission.createdAt);
+           policy_json, limits_json, idempotency_key, status, created_at, updated_at, execution_contract_json
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(admission.runId, admission.contractVersion, admission.tenantId, admission.skillId, admission.skillVersion, admission.bundleDigest, admission.runtimeImageDigest, admission.dependencyLayerTag, admission.inputDigest, admission.runtime, JSON.stringify(admission.policy), JSON.stringify(admission.limits), admission.idempotencyKey, "admitted", admission.createdAt, admission.createdAt, admission.executionContract ? JSON.stringify(admission.executionContract) : null);
     const row = this.readRun(admission.runId);
     if (!row)
       throw new Error(`admission did not persist run ${admission.runId}`);
     return row;
   }
-  async getRun(runId2) {
-    return this.readRun(runId2);
+  async getRun(runId3) {
+    return this.readRun(runId3);
   }
   async getRunByKey(tenantId, idempotencyKey) {
     const row = this.db.query(`SELECT * FROM execution_runs WHERE tenant_id = ? AND idempotency_key = ? LIMIT 1`).get(tenantId, idempotencyKey);
@@ -57403,8 +57706,8 @@ class SqliteRunExecutionStore {
          LIMIT 1`).get(input.tenantId, input.skillId, input.skillVersion, input.bundleDigest, input.inputDigest);
     return row ? rowToRun2(row) : null;
   }
-  async listAttempts(runId2) {
-    const rows = this.db.query(`SELECT * FROM execution_attempts WHERE run_id = ? ORDER BY attempt_number ASC`).all(runId2);
+  async listAttempts(runId3) {
+    const rows = this.db.query(`SELECT * FROM execution_attempts WHERE run_id = ? ORDER BY attempt_number ASC`).all(runId3);
     return rows.map(rowToAttempt);
   }
   async createAttempt(input) {
@@ -57474,8 +57777,8 @@ class SqliteRunExecutionStore {
     this.db.query(`INSERT INTO execution_transitions (run_id, attempt_id, from_status, to_status, at)
          VALUES (?, ?, ?, ?, ?)`).run(transition.runId, transition.attemptId, transition.from, transition.to, transition.at);
   }
-  async markAttemptTerminal(runId2, attemptId) {
-    this.db.query(`UPDATE execution_attempts SET status = 'terminal' WHERE attempt_id = ? AND run_id = ? AND status != 'terminal'`).run(attemptId, runId2);
+  async markAttemptTerminal(runId3, attemptId) {
+    this.db.query(`UPDATE execution_attempts SET status = 'terminal' WHERE attempt_id = ? AND run_id = ? AND status != 'terminal'`).run(attemptId, runId3);
     return this.readAttempt(attemptId);
   }
   async writeReceipt(receipt) {
@@ -57483,28 +57786,28 @@ class SqliteRunExecutionStore {
            run_id, attempt_id, lease_generation, client_token, request_digest, started_by,
            task_id, launched_at, completed_at, runtime_image_digest, bundle_digest,
            dependency_layer_tag, policy_json, limits_json, exit_code, status,
-           artifact_pointers_json, log_pointers_json, cost_cents
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(receipt.runId, receipt.attemptId, receipt.leaseGeneration, receipt.clientToken, receipt.requestDigest, receipt.startedBy, receipt.taskId, receipt.launchedAt, receipt.completedAt, receipt.runtimeImageDigest, receipt.bundleDigest, receipt.dependencyLayerTag, JSON.stringify(receipt.policy), JSON.stringify(receipt.limits), receipt.exitCode, receipt.status, JSON.stringify(receipt.artifactPointers), JSON.stringify(receipt.logPointers), receipt.costCents);
+           artifact_pointers_json, log_pointers_json, cost_cents, execution_contract_json
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(receipt.runId, receipt.attemptId, receipt.leaseGeneration, receipt.clientToken, receipt.requestDigest, receipt.startedBy, receipt.taskId, receipt.launchedAt, receipt.completedAt, receipt.runtimeImageDigest, receipt.bundleDigest, receipt.dependencyLayerTag, JSON.stringify(receipt.policy), JSON.stringify(receipt.limits), receipt.exitCode, receipt.status, JSON.stringify(receipt.artifactPointers), JSON.stringify(receipt.logPointers), receipt.costCents, receipt.executionContract ? JSON.stringify(receipt.executionContract) : null);
     return receipt;
   }
-  async getReceipt(runId2, attemptId) {
-    const row = this.db.query(`SELECT * FROM execution_receipts WHERE run_id = ? AND attempt_id = ?`).get(runId2, attemptId);
+  async getReceipt(runId3, attemptId) {
+    const row = this.db.query(`SELECT * FROM execution_receipts WHERE run_id = ? AND attempt_id = ?`).get(runId3, attemptId);
     return row ? rowToReceipt(row) : null;
   }
-  async finalizeRun(runId2, status, receiptId2) {
-    this.db.query(`UPDATE execution_runs SET status = ?, terminal_receipt_id = ?, updated_at = ? WHERE run_id = ?`).run(status, receiptId2, new Date().toISOString(), runId2);
-    this.db.query(`UPDATE execution_attempts SET status = 'terminal' WHERE run_id = ? AND status != 'terminal'`).run(runId2);
-    return this.readRun(runId2);
+  async finalizeRun(runId3, status, receiptId2) {
+    this.db.query(`UPDATE execution_runs SET status = ?, terminal_receipt_id = ?, updated_at = ? WHERE run_id = ?`).run(status, receiptId2, new Date().toISOString(), runId3);
+    this.db.query(`UPDATE execution_attempts SET status = 'terminal' WHERE run_id = ? AND status != 'terminal'`).run(runId3);
+    return this.readRun(runId3);
   }
-  async setRunStatus(runId2, status) {
-    this.db.query(`UPDATE execution_runs SET status = ?, updated_at = ? WHERE run_id = ?`).run(status, new Date().toISOString(), runId2);
-    return this.readRun(runId2);
+  async setRunStatus(runId3, status) {
+    this.db.query(`UPDATE execution_runs SET status = ?, updated_at = ? WHERE run_id = ?`).run(status, new Date().toISOString(), runId3);
+    return this.readRun(runId3);
   }
   async close() {
     this.db.close();
   }
-  readRun(runId2) {
-    const row = this.db.query(`SELECT * FROM execution_runs WHERE run_id = ?`).get(runId2);
+  readRun(runId3) {
+    const row = this.db.query(`SELECT * FROM execution_runs WHERE run_id = ?`).get(runId3);
     return row ? rowToRun2(row) : null;
   }
   readAttempt(attemptId) {
@@ -57523,6 +57826,7 @@ function rowToRun2(row) {
       bundleDigest: row.bundle_digest,
       runtimeImageDigest: row.runtime_image_digest,
       dependencyLayerTag: row.dependency_layer_tag,
+      ...row.execution_contract_json ? { executionContract: JSON.parse(row.execution_contract_json) } : {},
       inputDigest: row.input_digest,
       runtime: row.runtime,
       policy: JSON.parse(row.policy_json),
@@ -57566,6 +57870,7 @@ function rowToReceipt(row) {
     runtimeImageDigest: row.runtime_image_digest,
     bundleDigest: row.bundle_digest,
     dependencyLayerTag: row.dependency_layer_tag,
+    ...row.execution_contract_json ? { executionContract: JSON.parse(row.execution_contract_json) } : {},
     policy: JSON.parse(row.policy_json),
     limits: JSON.parse(row.limits_json),
     exitCode: row.exit_code,
@@ -57585,6 +57890,7 @@ CREATE TABLE IF NOT EXISTS execution_runs (
   bundle_digest TEXT NOT NULL,
   runtime_image_digest TEXT NOT NULL,
   dependency_layer_tag TEXT,
+  execution_contract_json TEXT,
   input_digest TEXT NOT NULL,
   runtime TEXT NOT NULL,
   policy_json TEXT NOT NULL,
@@ -57638,6 +57944,7 @@ CREATE TABLE IF NOT EXISTS execution_receipts (
   runtime_image_digest TEXT NOT NULL,
   bundle_digest TEXT NOT NULL,
   dependency_layer_tag TEXT,
+  execution_contract_json TEXT,
   policy_json TEXT NOT NULL,
   limits_json TEXT NOT NULL,
   exit_code INTEGER,
@@ -57672,6 +57979,7 @@ function createSubmitRunService(options) {
       const policy = { ...DEFAULT_RUN_POLICY, ...input.policy };
       input = {
         ...input,
+        ...input.executionContract ? { executionContract: { ...input.executionContract } } : {},
         systemDeps: [...input.systemDeps ?? []],
         policy: { ...policy, egressAllowlist: [...policy.egressAllowlist] },
         limits: { ...DEFAULT_RUN_LIMITS, ...input.limits }
@@ -57680,7 +57988,7 @@ function createSubmitRunService(options) {
       const byKey = await store.getRunByKey(input.tenantId, input.idempotencyKey);
       if (byKey)
         return { run: ownedAdmission(byKey.admission), created: false };
-      const byDigests = await store.getRunByDigests({
+      const byDigests = input.executionContract ? null : await store.getRunByDigests({
         tenantId: input.tenantId,
         skillId: input.skillId,
         skillVersion: input.skillVersion,
@@ -57702,6 +58010,7 @@ function createSubmitRunService(options) {
         bundleDigest: input.bundleDigest,
         runtimeImageDigest: image.runtimeImageDigest,
         dependencyLayerTag: image.dependencyLayerTag,
+        ...input.executionContract ? { executionContract: { ...input.executionContract } } : {},
         inputDigest,
         runtime: image.runtime,
         policy: { ...DEFAULT_RUN_POLICY, ...input.policy },
@@ -57717,6 +58026,7 @@ function createSubmitRunService(options) {
 function ownedAdmission(admission) {
   return {
     ...admission,
+    ...admission.executionContract ? { executionContract: { ...admission.executionContract } } : {},
     policy: { ...admission.policy, egressAllowlist: [...admission.policy.egressAllowlist] },
     limits: { ...admission.limits }
   };
@@ -57738,12 +58048,12 @@ var LEGAL_TRANSITIONS = {
   cancelled: []
 };
 function createRunStateMachine(store) {
-  async function transition(runId2, from, to, attemptId = null) {
-    const run = await store.getRun(runId2);
+  async function transition(runId3, from, to, attemptId = null) {
+    const run = await store.getRun(runId3);
     if (!run)
       return { ok: false, reason: "NO_SUCH_RUN" };
     if (attemptId) {
-      const attempt = await findAttempt(store, runId2, attemptId);
+      const attempt = await findAttempt(store, runId3, attemptId);
       if (!attempt)
         return { ok: false, reason: "NO_SUCH_ATTEMPT" };
     }
@@ -57755,11 +58065,11 @@ function createRunStateMachine(store) {
     if (!LEGAL_TRANSITIONS[from].includes(to)) {
       return { ok: false, reason: "INVALID_TRANSITION" };
     }
-    const next2 = await store.setRunStatus(runId2, to);
+    const next2 = await store.setRunStatus(runId3, to);
     if (!next2)
       return { ok: false, reason: "NO_SUCH_RUN" };
     const record3 = {
-      runId: runId2,
+      runId: runId3,
       attemptId,
       from,
       to,
@@ -57796,8 +58106,8 @@ function createRunStateMachine(store) {
       });
       return claimed;
     },
-    async start(runId2, attemptId) {
-      return transition(runId2, "leased", "running", attemptId);
+    async start(runId3, attemptId) {
+      return transition(runId3, "leased", "running", attemptId);
     },
     async terminate(input) {
       const run = await store.getRun(input.runId);
@@ -57817,26 +58127,26 @@ function createRunStateMachine(store) {
       await store.markAttemptTerminal(input.runId, input.attemptId);
       return { ok: true };
     },
-    async cancel(runId2) {
-      const run = await store.getRun(runId2);
+    async cancel(runId3) {
+      const run = await store.getRun(runId3);
       if (!run)
         return { ok: false, reason: "NO_SUCH_RUN" };
       if (isTerminalStatus(run.status))
         return { ok: false, reason: "RUN_TERMINAL" };
-      const result = await transition(runId2, run.status, "cancelled", run.currentAttemptId);
+      const result = await transition(runId3, run.status, "cancelled", run.currentAttemptId);
       if (!result.ok)
         return result;
       return { ok: true };
     },
     transition,
-    async getStatus(runId2) {
-      const run = await store.getRun(runId2);
+    async getStatus(runId3) {
+      const run = await store.getRun(runId3);
       return run ? run.status : null;
     }
   };
 }
-async function findAttempt(store, runId2, attemptId) {
-  const attempts = await store.listAttempts(runId2);
+async function findAttempt(store, runId3, attemptId) {
+  const attempts = await store.listAttempts(runId3);
   return attempts.find((attempt) => attempt.attemptId === attemptId) ?? null;
 }
 
@@ -57857,6 +58167,7 @@ function createReceiptService(store) {
         runtimeImageDigest: input.admission.runtimeImageDigest,
         bundleDigest: input.admission.bundleDigest,
         dependencyLayerTag: input.admission.dependencyLayerTag,
+        ...input.admission.executionContract ? { executionContract: { ...input.admission.executionContract } } : {},
         policy: input.admission.policy,
         limits: input.admission.limits,
         exitCode: null,
@@ -57885,7 +58196,7 @@ function createReceiptService(store) {
       await store.finalizeRun(input.runId, input.status, input.attemptId);
       return { receipt: written, runId: input.runId, status: input.status };
     },
-    get: (runId2, attemptId) => store.getReceipt(runId2, attemptId)
+    get: (runId3, attemptId) => store.getReceipt(runId3, attemptId)
   };
 }
 
@@ -61124,11 +61435,11 @@ function observedTask(states, taskArn) {
   const state2 = states[0];
   return state2.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state2.lastStatus) ? state2 : undefined;
 }
-function clientTokenFor(runId2, attemptId) {
-  return createHash24("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+function clientTokenFor(runId3, attemptId) {
+  return createHash24("sha256").update(`${runId3}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
-function startedByFor(runId2, attemptNumber) {
-  return `skills-exec/${runId2}/a${attemptNumber}`;
+function startedByFor(runId3, attemptNumber) {
+  return `skills-exec/${runId3}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
   return createHash24("sha256").update(canonicalJson2({ admission, attemptId })).digest("hex");
@@ -61173,29 +61484,29 @@ class EcsDispatcher {
         return { accepted: false, detail: `run already ${outcome.status}` };
     }
   }
-  async cancel(runId2) {
-    const run = await this.store.getRun(runId2);
+  async cancel(runId3) {
+    const run = await this.store.getRun(runId3);
     if (!run)
       return { accepted: false, detail: "no such run" };
     if (run.status === "succeeded" || run.status === "failed") {
       return { accepted: false, detail: `run already ${run.status}` };
     }
-    const attempts = await this.store.listAttempts(runId2);
+    const attempts = await this.store.listAttempts(runId3);
     const current = attempts[attempts.length - 1];
     if (!current) {
       if (run.status === "cancelled")
         return { accepted: true, detail: "already cancelled (no attempt launched)" };
-      const cancelled = await this.stateMachine.cancel(runId2);
+      const cancelled = await this.stateMachine.cancel(runId3);
       return cancelled.ok ? { accepted: true, detail: "cancelled (no attempt launched)" } : { accepted: false, detail: cancelled.reason };
     }
-    if (!this.cancellationReceipt(await this.receipts.get(runId2, current.attemptId), run.admission, current)) {
+    if (!this.cancellationReceipt(await this.receipts.get(runId3, current.attemptId), run.admission, current)) {
       return { accepted: false, detail: "matching cancellation receipt is unavailable or contradictory" };
     }
     const observation = await this.reconcile(run.admission, current);
     if (observation.kind !== "already-launched" && observation.kind !== "previous-terminal") {
       return { accepted: false, detail: "task state unknown; cancellation is not yet confirmed" };
     }
-    const taskArn = observation.kind === "already-launched" ? observation.taskId : (await this.store.listAttempts(runId2)).find((row) => row.attemptId === current.attemptId)?.taskId ?? null;
+    const taskArn = observation.kind === "already-launched" ? observation.taskId : (await this.store.listAttempts(runId3)).find((row) => row.attemptId === current.attemptId)?.taskId ?? null;
     if (!taskArn)
       return { accepted: false, detail: "stopped task identity is not confirmed" };
     if (observation.kind === "already-launched") {
@@ -61208,7 +61519,7 @@ class EcsDispatcher {
       }
     }
     if (run.status !== "cancelled") {
-      const cancelled = await this.stateMachine.cancel(runId2);
+      const cancelled = await this.stateMachine.cancel(runId3);
       if (!cancelled.ok)
         return { accepted: false, detail: cancelled.reason };
     }
@@ -61219,22 +61530,22 @@ class EcsDispatcher {
     }
     return { accepted: true, target: taskArn, detail: "cancelled after confirmed task stop and receipt" };
   }
-  async launchAttempt(runId2) {
-    const run = await this.store.getRun(runId2);
+  async launchAttempt(runId3) {
+    const run = await this.store.getRun(runId3);
     if (!run)
       return { kind: "no-admission" };
     if (run.status === "succeeded" || run.status === "failed" || run.status === "cancelled") {
       return { kind: "run-terminal", status: run.status };
     }
-    const attempts = await this.store.listAttempts(runId2);
+    const attempts = await this.store.listAttempts(runId3);
     const previous = attempts[attempts.length - 1];
     if (previous) {
       return this.reconcile(run.admission, previous);
     }
     const attemptNumber = 1;
-    const attempt = await this.store.createAttempt({ runId: runId2, attemptNumber });
+    const attempt = await this.store.createAttempt({ runId: runId3, attemptNumber });
     const claimed = await this.stateMachine.claim({
-      runId: runId2,
+      runId: runId3,
       attemptId: attempt.attemptId,
       workerId: this.workerId,
       expectedLeaseGeneration: 0
@@ -61242,11 +61553,11 @@ class EcsDispatcher {
     if (!claimed.ok) {
       return { kind: "claim-refused", attemptId: attempt.attemptId, reason: claimed.reason };
     }
-    const clientToken = clientTokenFor(runId2, attempt.attemptId);
-    const startedBy = startedByFor(runId2, attemptNumber);
+    const clientToken = clientTokenFor(runId3, attempt.attemptId);
+    const startedBy = startedByFor(runId3, attemptNumber);
     const requestDigest = requestDigestFor(run.admission, attempt.attemptId);
     const intent = await this.store.recordLaunchIntent({
-      runId: runId2,
+      runId: runId3,
       attemptId: attempt.attemptId,
       clientToken,
       requestDigest,
@@ -61264,11 +61575,11 @@ class EcsDispatcher {
     try {
       result = await this.client.runTask(this.runTaskInput(run.admission, intent.attempt, clientToken, startedBy, requestDigest));
     } catch {
-      await this.store.recordLaunchState({ runId: runId2, attemptId: attempt.attemptId, launchState: "ambiguous" });
+      await this.store.recordLaunchState({ runId: runId3, attemptId: attempt.attemptId, launchState: "ambiguous" });
       const reconciled = await this.reconcile(run.admission, intent.attempt);
       return reconciled;
     }
-    await this.store.recordLaunchState({ runId: runId2, attemptId: attempt.attemptId, launchState: "launched", taskId: result.taskArn });
+    await this.store.recordLaunchState({ runId: runId3, attemptId: attempt.attemptId, launchState: "launched", taskId: result.taskArn });
     return { kind: "launched", attemptId: attempt.attemptId, taskId: result.taskArn };
   }
   async reconcile(admission, attempt) {
@@ -61330,7 +61641,7 @@ class EcsDispatcher {
   }
   cancellationReceipt(receipt, admission, attempt) {
     try {
-      return !!receipt && receipt.runId === admission.runId && receipt.attemptId === attempt.attemptId && !!attempt.clientToken && receipt.clientToken === attempt.clientToken && !!attempt.requestDigest && receipt.requestDigest === attempt.requestDigest && !!attempt.startedBy && receipt.startedBy === attempt.startedBy && receipt.bundleDigest === admission.bundleDigest && receipt.runtimeImageDigest === admission.runtimeImageDigest && receipt.dependencyLayerTag === admission.dependencyLayerTag && canonicalJson2(receipt.policy) === canonicalJson2(admission.policy) && canonicalJson2(receipt.limits) === canonicalJson2(admission.limits) && (receipt.taskId === null || receipt.taskId === attempt.taskId) && (receipt.status === null && receipt.completedAt === null || receipt.status === "cancelled" && typeof receipt.completedAt === "string" && Number.isFinite(Date.parse(receipt.completedAt)));
+      return !!receipt && receipt.runId === admission.runId && receipt.attemptId === attempt.attemptId && !!attempt.clientToken && receipt.clientToken === attempt.clientToken && !!attempt.requestDigest && receipt.requestDigest === attempt.requestDigest && !!attempt.startedBy && receipt.startedBy === attempt.startedBy && receipt.bundleDigest === admission.bundleDigest && receipt.runtimeImageDigest === admission.runtimeImageDigest && receipt.dependencyLayerTag === admission.dependencyLayerTag && canonicalJson2(receipt.executionContract ?? null) === canonicalJson2(admission.executionContract ?? null) && canonicalJson2(receipt.policy) === canonicalJson2(admission.policy) && canonicalJson2(receipt.limits) === canonicalJson2(admission.limits) && (receipt.taskId === null || receipt.taskId === attempt.taskId) && (receipt.status === null && receipt.completedAt === null || receipt.status === "cancelled" && typeof receipt.completedAt === "string" && Number.isFinite(Date.parse(receipt.completedAt)));
     } catch {
       return false;
     }
@@ -61427,7 +61738,174 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash25, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash26, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/server/runtime-pure-contract.ts
+import { createHash as createHash25 } from "crypto";
+var PURE_DESCRIPTOR = Object.freeze({
+  id: "regex-test.v1",
+  runtime: "bun",
+  adapter: "skills-input-json.v1",
+  input: Object.freeze({ patternBytes: 512, textBytes: 4096, totalBytes: 8192, flags: "dgimsuvy" }),
+  output: "regex-matches.v1",
+  secrets: "none",
+  egress: "deny",
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  stdoutBytes: 16384,
+  stderrBytes: 8192,
+  artifactsBytes: 0
+});
+var PURE_DESCRIPTOR_DIGEST = digestInput(PURE_DESCRIPTOR);
+var PURE_LIMITS = Object.freeze({
+  maxDurationMs: 5000,
+  maxMemoryMb: 512,
+  maxCpuUnits: 256,
+  maxArtifactsBytes: 0,
+  maxConcurrency: 1
+});
+var hash2 = (bytes) => createHash25("sha256").update(bytes).digest("hex");
+var object5 = (v2) => {
+  if (!v2 || typeof v2 !== "object" || Array.isArray(v2))
+    throw Error("Pure contract requires an object");
+  return v2;
+};
+function keys2(v2, allowed) {
+  if (Object.keys(v2).some((k4) => !allowed.includes(k4)))
+    throw Error("Unsupported pure contract field");
+}
+function uniqueJson(text2) {
+  const result = JSON.parse(text2);
+  let i4 = 0;
+  const ws = () => {
+    while (/\s/.test(text2[i4] ?? "") && i4 < text2.length)
+      i4++;
+  };
+  const string = () => {
+    const start = i4++;
+    while (i4 < text2.length) {
+      const c4 = text2[i4++];
+      if (c4 === "\\")
+        i4++;
+      else if (c4 === '"')
+        break;
+    }
+    return JSON.parse(text2.slice(start, i4));
+  };
+  const value = (depth) => {
+    if (depth > 32)
+      throw Error("JSON nesting limit exceeded");
+    ws();
+    if (text2[i4] === '"') {
+      string();
+      return;
+    }
+    if (text2[i4] === "{") {
+      i4++;
+      ws();
+      const seen = new Set;
+      if (text2[i4] === "}") {
+        i4++;
+        return;
+      }
+      for (;; ) {
+        ws();
+        const key = string();
+        if (seen.has(key))
+          throw Error("Duplicate JSON key");
+        seen.add(key);
+        ws();
+        i4++;
+        value(depth + 1);
+        ws();
+        if (text2[i4++] === "}")
+          return;
+      }
+    }
+    if (text2[i4] === "[") {
+      i4++;
+      ws();
+      if (text2[i4] === "]") {
+        i4++;
+        return;
+      }
+      for (;; ) {
+        value(depth + 1);
+        ws();
+        if (text2[i4++] === "]")
+          return;
+      }
+    }
+    while (i4 < text2.length && !/[\s,\]}]/.test(text2[i4]))
+      i4++;
+  };
+  value(0);
+  return result;
+}
+function pureInput(value) {
+  const v2 = object5(value);
+  keys2(v2, ["pattern", "text", "flags"]);
+  if (typeof v2.pattern !== "string" || Buffer.byteLength(v2.pattern) > 512 || typeof v2.text !== "string" || Buffer.byteLength(v2.text) > 4096 || typeof v2.flags !== "string" || !/^[dgimsuvy]*$/.test(v2.flags) || new Set(v2.flags).size !== v2.flags.length || v2.flags.includes("u") && v2.flags.includes("v") || Buffer.byteLength(JSON.stringify(v2)) > 8192)
+    throw Error("Invalid pure regex input");
+  return { pattern: v2.pattern, text: v2.text, flags: v2.flags };
+}
+function assertPureContract(value) {
+  const v2 = object5(value);
+  keys2(v2, ["id", "descriptorDigest", "entrypoint", "entrypointDigest"]);
+  if (v2.id !== PURE_DESCRIPTOR.id || v2.descriptorDigest !== PURE_DESCRIPTOR_DIGEST || typeof v2.entrypoint !== "string" || !/^src\/[a-zA-Z0-9_/-]+\.[cm]?[jt]s$/.test(v2.entrypoint) || v2.entrypoint.includes("//") || typeof v2.entrypointDigest !== "string" || !/^[a-f0-9]{64}$/.test(v2.entrypointDigest))
+    throw Error("Unsupported pure execution contract");
+}
+function assertPureAdmission(a4) {
+  assertPureContract(a4.executionContract);
+  if (a4.runtime !== "bun" || a4.dependencyLayerTag !== null || a4.policy.egress !== "deny" || a4.policy.egressAllowlist.length !== 0 || a4.policy.networkByteCap !== 0 || Object.entries(PURE_LIMITS).some(([k4, v2]) => a4.limits[k4] !== v2))
+    throw Error("Pure admission isolation policy mismatch");
+  return a4.executionContract;
+}
+async function inspectPureBundle(bytes, contract) {
+  assertPureContract(contract);
+  const { entries } = await inspectSkillBundle(bytes, { limits: {
+    compressedBytes: 1e6,
+    decompressedBytes: 4000000,
+    fileBytes: 1e6,
+    entries: 100,
+    timeoutMs: 5000
+  } });
+  const entry = entries.find((e5) => e5.path === contract.entrypoint);
+  if (!entry || hash2(entry.bytes) !== contract.entrypointDigest)
+    throw Error("Pure entrypoint integrity failed");
+  if (entries.some((e5) => e5.path.split("/").includes("node_modules")))
+    throw Error("Pure bundle cannot supply dependencies");
+  const read2 = (name) => {
+    const entry2 = entries.find((e5) => e5.path === name);
+    if (!entry2)
+      throw Error("Pure bundle manifest missing");
+    return object5(uniqueJson(Buffer.from(entry2.bytes).toString("utf8")));
+  };
+  const manifest = read2("skill.json"), runtime = object5(manifest.runtime), pkg = read2("package.json");
+  if (manifest.kind !== "executable" || runtime.runtime !== "bun" || runtime.entrypoint !== contract.entrypoint || !Array.isArray(runtime.env) || runtime.env.length !== 0 || runtime.system_deps !== undefined && (!Array.isArray(runtime.system_deps) || runtime.system_deps.length !== 0) || runtime.needs_network === true || manifest.needs_network === true)
+    throw Error("Pure bundle requires a credential-free self-contained Bun entrypoint");
+  for (const key of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies", "scripts"])
+    if (pkg[key] !== undefined && Object.keys(object5(pkg[key])).length)
+      throw Error("Pure bundle cannot install dependencies or lifecycle scripts");
+  return entries;
+}
+function validatePureOutput(stdout, input) {
+  if (Buffer.byteLength(stdout) > PURE_DESCRIPTOR.stdoutBytes)
+    throw Error("Pure output limit exceeded");
+  const v2 = object5(uniqueJson(stdout));
+  keys2(v2, ["pattern", "flags", "matches"]);
+  if (v2.pattern !== input.pattern || v2.flags !== input.flags || !Array.isArray(v2.matches))
+    throw Error("Pure output does not match admitted input");
+  for (const value of v2.matches) {
+    const m2 = object5(value);
+    keys2(m2, ["match", "groups", "namedGroups", "index"]);
+    if (typeof m2.match !== "string" || !Number.isInteger(m2.index) || m2.index < 0 || m2.index > input.text.length || input.text.slice(m2.index, m2.index + m2.match.length) !== m2.match || !Array.isArray(m2.groups) || m2.groups.some((x2) => x2 !== null && typeof x2 !== "string") || m2.namedGroups !== null && Object.values(object5(m2.namedGroups)).some((x2) => typeof x2 !== "string"))
+      throw Error("Invalid pure match output");
+  }
+}
+
+// src/server/runtime-policy.ts
 var RUNTIME_MAX_INPUT_BYTES = 1e5;
 var RUNTIME_MAX_BUNDLE_BYTES = 1e6;
 var RUNTIME_MAX_ARTIFACT_BYTES = 2000000;
@@ -61462,8 +61940,25 @@ function readRuntimeConfig(env = process.env) {
   for (const key of ["subnets", "securityGroups"])
     if (!Array.isArray(c4[key]) || !c4[key].length || c4[key].some((v2) => typeof v2 !== "string" || !v2))
       throw Error(`Runtime configuration missing ${key}`);
-  if (!Array.isArray(c4.reviewedBundles) || !c4.reviewedBundles.length || c4.reviewedBundles.some((b4) => b4.slug !== "pdf-generate" || typeof b4.version !== "string" || !/^\d+\.\d+\.\d+$/.test(b4.version) || !/^[a-f0-9]{64}$/.test(b4.sha256)))
-    throw Error("Runtime requires exact reviewed pdf-generate versions and bundle digests");
+  if (!Array.isArray(c4.reviewedBundles) || !c4.reviewedBundles.length)
+    throw Error("Runtime requires exact reviewed versions and bundle digests");
+  const seen = new Set;
+  for (const b4 of c4.reviewedBundles) {
+    if (!b4 || typeof b4.slug !== "string" || !/^[a-z0-9-]+$/.test(b4.slug) || typeof b4.version !== "string" || !/^\d+\.\d+\.\d+$/.test(b4.version) || !/^[a-f0-9]{64}$/.test(b4.sha256))
+      throw Error("Runtime requires exact reviewed versions and bundle digests");
+    if (b4.executionContract) {
+      if (b4.slug === "pdf-generate")
+        throw Error("pdf-generate is reserved for the legacy PDF contract");
+      assertPureContract(b4.executionContract);
+      if (typeof b4.tenantId !== "string" || !b4.tenantId.trim() || b4.imageDigest !== c4.imageDigest)
+        throw Error("Pure runtime review must bind tenant and configured image");
+    } else if (b4.slug !== "pdf-generate")
+      throw Error("Missing reviewed execution contract");
+    const key = JSON.stringify([b4.executionContract ? b4.tenantId : null, b4.slug, b4.version, b4.sha256]);
+    if (seen.has(key))
+      throw Error("Ambiguous runtime review");
+    seen.add(key);
+  }
   return c4;
 }
 function runtimeInput(value) {
@@ -61499,7 +61994,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash25("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash26("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -61575,7 +62070,7 @@ async function body3(request2, max) {
     }
     chunks.push(v2.value);
   }
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  return uniqueJson(Buffer.concat(chunks).toString("utf8"));
 }
 var scope = (p2, action) => p2.scopes.includes("*") || p2.scopes.includes("runs:*") || p2.scopes.includes(action) || action === "runs:read" && p2.scopes.includes("skills:read");
 function publicJob(job) {
@@ -61589,6 +62084,7 @@ function publicJob(job) {
     bundleDigest: a4.bundleDigest,
     inputDigest: a4.inputDigest,
     runtimeImageDigest: a4.runtimeImageDigest,
+    executionContract: a4.executionContract ?? { id: "pdf.v1" },
     status: job.execution.status,
     createdAt: a4.createdAt,
     updatedAt: job.execution.updatedAt,
@@ -61599,6 +62095,33 @@ function publicJob(job) {
     artifacts: (job.result?.artifacts ?? []).map(({ base64, ...meta }) => meta)
   };
 }
+function findReview(service, tenant, slug, version2, sha2562) {
+  return service.config.reviewedBundles.find((b4) => b4.slug === slug && b4.version === version2 && b4.sha256 === sha2562 && (!b4.executionContract || b4.tenantId === tenant && b4.imageDigest === service.config.imageDigest));
+}
+function sameContract(admission, contract, image) {
+  return digestInput(admission.executionContract ?? null) === digestInput(contract ?? null) && (!contract || admission.runtimeImageDigest === image);
+}
+
+class RuntimeBundleError extends Error {
+  code;
+  status;
+  constructor(code, status) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+}
+async function reviewedBytes(service, principal, digest4) {
+  const bundle2 = await service.productStore.getSkillBundle(principal, digest4);
+  if (!bundle2)
+    throw new RuntimeBundleError("BUNDLE_UNAVAILABLE", 503);
+  if (bundle2.byteSize > RUNTIME_MAX_BUNDLE_BYTES)
+    throw new RuntimeBundleError("BUNDLE_LIMIT", 413);
+  const bytes = await service.artifacts.readBundle(bundle2);
+  if (!bytes || bytes.length > RUNTIME_MAX_BUNDLE_BYTES || hashBytes(bytes) !== digest4)
+    throw new RuntimeBundleError("BUNDLE_INTEGRITY_FAILED", 503);
+  return bytes;
+}
 async function handleRuntimeApiRequest(request2, principal, service) {
   const segments = path(request2);
   if (segments[0] !== "api" || segments[1] !== "v1" || segments[2] !== "executions")
@@ -61611,9 +62134,50 @@ async function handleRuntimeApiRequest(request2, principal, service) {
   if (!id2 || segments.length > 6 || !/^[a-z0-9_-]+$/.test(id2))
     return refusal2("INVALID_EXECUTION_PATH", 400);
   try {
+    if (request2.method === "GET" && sub === "eligibility" && segments.length === 5) {
+      const query = new URL(request2.url).searchParams;
+      const versionName = query.get("version");
+      if (!versionName || !/^\d+\.\d+\.\d+$/.test(versionName))
+        return refusal2("REVIEWED_VERSION_REQUIRED", 400);
+      const skill = await service.productStore.getSkill(principal, id2);
+      if (skill?.lifecycle === "archived")
+        return refusal2("SKILL_ARCHIVED", 410);
+      const version2 = skill && !skill.tombstonedAt && await service.productStore.getSkillVersion(principal, id2, versionName);
+      if (!version2)
+        return refusal2("SKILL_VERSION_NOT_FOUND", 404);
+      const pinned = query.get("bundleDigest");
+      if (pinned && pinned.replace(/^sha256:/, "") !== version2.bundleSha256)
+        return refusal2("SELECTION_DIGEST_MISMATCH", 409);
+      const review = findReview(service, principal.orgId, id2, versionName, version2.bundleSha256);
+      if (!review)
+        return json3({
+          contractVersion: 1,
+          eligible: false,
+          reason: "BUNDLE_NOT_REVIEWED_FOR_CLOUD",
+          skill: id2,
+          version: versionName,
+          bundleDigest: version2.bundleSha256
+        });
+      if (review.executionContract) {
+        const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+        await inspectPureBundle(bytes, review.executionContract);
+      }
+      return json3({
+        contractVersion: 1,
+        eligible: true,
+        skill: id2,
+        version: versionName,
+        bundleDigest: version2.bundleSha256,
+        runtimeImageDigest: service.config.imageDigest,
+        executionContract: review.executionContract ?? { id: "pdf.v1" },
+        secrets: "none",
+        egress: "deny",
+        ...review.executionContract ? { descriptor: PURE_DESCRIPTOR, limits: PURE_LIMITS } : {}
+      });
+    }
     if (request2.method === "POST" && !sub) {
       const raw = await body3(request2, 150000);
-      if (id2 !== "pdf-generate" || typeof raw.version !== "string" || !/^\d+\.\d+\.\d+$/.test(raw.version))
+      if (typeof raw.version !== "string" || !/^\d+\.\d+\.\d+$/.test(raw.version))
         return refusal2("REVIEWED_VERSION_REQUIRED", 400);
       if (Object.keys(raw).some((k4) => ![
         "version",
@@ -61625,31 +62189,32 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         return refusal2("UNSUPPORTED_EXECUTION_FIELD", 400);
       if (raw.workspaceId !== undefined && raw.workspaceId !== principal.orgId)
         return refusal2("SELECTION_WORKSPACE_MISMATCH", 409);
-      const input = runtimeInput(raw.input);
       const key = request2.headers.get("idempotency-key") ?? raw.idempotencyKey;
       if (typeof key !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(key))
         return refusal2("IDEMPOTENCY_KEY_REQUIRED", 400);
       const skill = await service.productStore.getSkill(principal, id2);
       if (!skill || skill.tombstonedAt)
         return refusal2("SKILL_NOT_FOUND", 404);
+      if (skill.lifecycle === "archived")
+        return refusal2("SKILL_ARCHIVED", 410);
       const version2 = await service.productStore.getSkillVersion(principal, id2, raw.version);
       if (!version2)
         return refusal2("SKILL_VERSION_NOT_FOUND", 404);
       if (raw.bundleDigest !== undefined && (typeof raw.bundleDigest !== "string" || raw.bundleDigest.replace(/^sha256:/, "") !== version2.bundleSha256))
         return refusal2("SELECTION_DIGEST_MISMATCH", 409);
-      if (!service.config.reviewedBundles.some((b4) => b4.slug === id2 && b4.version === raw.version && b4.sha256 === version2.bundleSha256))
+      const review = findReview(service, principal.orgId, id2, raw.version, version2.bundleSha256);
+      if (!review)
         return refusal2("BUNDLE_NOT_REVIEWED_FOR_CLOUD", 403);
+      const contract = review.executionContract;
+      if (contract && (raw.workspaceId !== principal.orgId || typeof raw.bundleDigest !== "string"))
+        return refusal2("PURE_SELECTION_REQUIRED", 400);
+      const input = contract ? pureInput(raw.input) : runtimeInput(raw.input);
       const existing = await service.store.getRunByKey(principal.orgId, key);
-      if (existing && (existing.admission.skillId !== id2 || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version2.bundleSha256 || existing.admission.inputDigest !== digestInput(input)))
+      if (existing && (existing.admission.skillId !== id2 || existing.admission.skillVersion !== raw.version || existing.admission.bundleDigest !== version2.bundleSha256 || existing.admission.inputDigest !== digestInput(input) || !sameContract(existing.admission, contract, service.config.imageDigest)))
         return refusal2("IDEMPOTENCY_CONFLICT", 409);
-      const bundle2 = await service.productStore.getSkillBundle(principal, version2.bundleSha256);
-      if (!bundle2)
-        return refusal2("BUNDLE_UNAVAILABLE", 503);
-      if (bundle2.byteSize > RUNTIME_MAX_BUNDLE_BYTES)
-        return refusal2("BUNDLE_LIMIT", 413);
-      const bytes = await service.artifacts.readBundle(bundle2);
-      if (!bytes || hashBytes(bytes) !== version2.bundleSha256)
-        return refusal2("BUNDLE_INTEGRITY_FAILED", 503);
+      const bytes = await reviewedBytes(service, principal, version2.bundleSha256);
+      if (contract)
+        await inspectPureBundle(bytes, contract);
       const admission = createSubmitRunService({
         store: service.store,
         imageProfiles: createImageProfileRegistry({
@@ -61671,12 +62236,13 @@ async function handleRuntimeApiRequest(request2, principal, service) {
         input,
         idempotencyKey: key,
         runtime: "bun",
-        limits: {
+        ...contract ? { executionContract: contract } : {},
+        limits: contract ? PURE_LIMITS : {
           maxDurationMs: RUNTIME_TIMEOUT_MS,
           maxArtifactsBytes: RUNTIME_MAX_ARTIFACT_BYTES
         }
       });
-      if (run.tenantId !== principal.orgId || run.skillId !== id2 || run.skillVersion !== raw.version || run.bundleDigest !== version2.bundleSha256 || run.inputDigest !== digestInput(input))
+      if (run.tenantId !== principal.orgId || run.skillId !== id2 || run.skillVersion !== raw.version || run.bundleDigest !== version2.bundleSha256 || run.inputDigest !== digestInput(input) || !sameContract(run, contract, service.config.imageDigest))
         return refusal2("IDEMPOTENCY_CONFLICT", 409);
       await service.store.mutate(run.runId, (j4) => {
         if (!j4.input) {
@@ -61768,6 +62334,8 @@ async function handleRuntimeApiRequest(request2, principal, service) {
     }
     return refusal2("EXECUTION_ROUTE_NOT_FOUND", 404);
   } catch (error) {
+    if (error instanceof RuntimeBundleError)
+      return refusal2(error.code, error.status);
     if (error.message === "Runtime concurrency limit reached")
       return refusal2("RUNTIME_CONCURRENCY_LIMIT", 429);
     return refusal2("EXECUTION_REQUEST_FAILED", 400, error.message.startsWith("PDF ") ? error.message : "Execution request could not be completed");
@@ -61798,7 +62366,7 @@ async function handleRuntimeWorkerRequest(request2, service) {
   }
   if (request2.method === "POST" && s2[4] === "complete") {
     try {
-      const result = validatedResult(await body3(request2, 3000000));
+      const result = validatedResult(await body3(request2, 3000000), job);
       await service.store.mutate(s2[3], (j4) => {
         if (j4.execution.status === "cancelled")
           throw Error("Execution cancelled");
@@ -61835,12 +62403,28 @@ async function handleRuntimeWorkerRequest(request2, service) {
   }
   return refusal2("METHOD_NOT_ALLOWED", 405);
 }
-function validatedResult(value) {
+function validatedResult(value, job) {
   if (!value || typeof value !== "object")
     throw Error("Invalid result");
   const v2 = value;
   if (!Number.isInteger(v2.exitCode) || v2.exitCode < 0 || v2.exitCode > 255 || typeof v2.stdout !== "string" || typeof v2.stderr !== "string" || Buffer.byteLength(v2.stdout) > RUNTIME_MAX_LOG_BYTES || Buffer.byteLength(v2.stderr) > RUNTIME_MAX_LOG_BYTES || !Array.isArray(v2.artifacts) || v2.artifacts.length > 2)
     throw Error("Invalid result");
+  if (job.execution.admission.executionContract) {
+    assertPureAdmission(job.execution.admission);
+    if (v2.artifacts.length || Buffer.byteLength(v2.stdout) > PURE_DESCRIPTOR.stdoutBytes || Buffer.byteLength(v2.stderr) > PURE_DESCRIPTOR.stderrBytes)
+      throw Error("Invalid pure result limits");
+    if (v2.exitCode === 0)
+      validatePureOutput(v2.stdout, pureInput(job.input));
+    return {
+      exitCode: v2.exitCode,
+      stdout: v2.stdout,
+      stderr: v2.stderr,
+      artifacts: [],
+      ...typeof v2.error === "string" ? { error: v2.error.slice(0, 500) } : {}
+    };
+  }
+  if (job.execution.admission.skillId !== "pdf-generate")
+    throw Error("Missing execution contract");
   let total = 0;
   const seen = new Set;
   for (const a4 of v2.artifacts) {
@@ -62048,8 +62632,22 @@ class MemorySkillsStore {
   async ensureBootstrapApiKey(token, principal) {
     this.addApiKey(token, principal);
   }
-  async authenticateApiKeyHash(hash2) {
-    return this.apiKeys.get(hash2) ?? null;
+  async authenticateApiKeyHash(hash3) {
+    return this.apiKeys.get(hash3) ?? null;
+  }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    for (const [hash3, target] of this.apiKeys) {
+      if (target.apiKeyId !== keyId || target.orgId !== actor.orgId)
+        continue;
+      if (target.scopes.length !== expectedScopes.length || target.scopes.some((scope2, index) => scope2 !== expectedScopes[index])) {
+        return { kind: "stale", scopes: [...target.scopes] };
+      }
+      const scopes = [...target.scopes, ...addScopes.filter((scope2) => !target.scopes.includes(scope2))];
+      const updated = { ...target, scopes };
+      this.apiKeys.set(hash3, updated);
+      return { kind: "updated", scopes };
+    }
+    return { kind: "not_found" };
   }
   async createRun(input) {
     const idemKey = input.idempotencyKey?.trim();
@@ -62061,7 +62659,7 @@ class MemorySkillsStore {
     }
     const now = nowIso();
     const run = {
-      id: runId(),
+      id: runId2(),
       orgId: input.principal.orgId,
       userId: input.principal.userId,
       skill: input.slug,
@@ -62085,8 +62683,8 @@ class MemorySkillsStore {
   async listRuns(principal, limit) {
     return Array.from(this.runs.values()).filter((run) => run.orgId === principal.orgId).sort((a4, b4) => b4.createdAt.localeCompare(a4.createdAt)).slice(0, normalizeLimit(limit));
   }
-  async getRun(principal, runId2) {
-    const run = this.runs.get(runId2);
+  async getRun(principal, runId3) {
+    const run = this.runs.get(runId3);
     return run && run.orgId === principal.orgId ? run : null;
   }
   async claimNextRun(_input) {
@@ -62095,28 +62693,28 @@ class MemorySkillsStore {
       return null;
     return this.patchRun(run.id, { status: "running", startedAt: run.startedAt ?? nowIso(), leaseGeneration: run.leaseGeneration + 1 });
   }
-  async updateRun(runId2, patch) {
-    return this.patchRun(runId2, patch);
+  async updateRun(runId3, patch) {
+    return this.patchRun(runId3, patch);
   }
-  async transitionRun(runId2, patch, expectedGeneration) {
-    const run = this.runs.get(runId2);
+  async transitionRun(runId3, patch, expectedGeneration) {
+    const run = this.runs.get(runId3);
     if (!run)
       return null;
     if (run.leaseGeneration !== expectedGeneration) {
-      throw new StaleLeaseGenerationError(runId2, expectedGeneration, run.leaseGeneration, run.status);
+      throw new StaleLeaseGenerationError(runId3, expectedGeneration, run.leaseGeneration, run.status);
     }
-    return this.patchRun(runId2, patch);
+    return this.patchRun(runId3, patch);
   }
-  async appendLog(runId2, orgId, level, message) {
-    const entries = this.logs.get(runId2) ?? [];
-    const log = { runId: runId2, sequence: entries.length + 1, level, message, createdAt: nowIso() };
+  async appendLog(runId3, orgId, level, message) {
+    const entries = this.logs.get(runId3) ?? [];
+    const log = { runId: runId3, sequence: entries.length + 1, level, message, createdAt: nowIso() };
     entries.push(log);
-    this.logs.set(runId2, entries);
+    this.logs.set(runId3, entries);
     return log;
   }
-  async listLogs(principal, runId2) {
-    const run = await this.getRun(principal, runId2);
-    return run ? [...this.logs.get(runId2) ?? []] : [];
+  async listLogs(principal, runId3) {
+    const run = await this.getRun(principal, runId3);
+    return run ? [...this.logs.get(runId3) ?? []] : [];
   }
   async addArtifact(artifact) {
     const next2 = { ...artifact, createdAt: nowIso() };
@@ -62125,12 +62723,12 @@ class MemorySkillsStore {
     this.artifacts.set(artifact.runId, artifacts);
     return next2;
   }
-  async listArtifacts(principal, runId2) {
-    const run = await this.getRun(principal, runId2);
-    return run ? [...this.artifacts.get(runId2) ?? []] : [];
+  async listArtifacts(principal, runId3) {
+    const run = await this.getRun(principal, runId3);
+    return run ? [...this.artifacts.get(runId3) ?? []] : [];
   }
-  async getArtifact(principal, runId2, id2) {
-    const artifacts = await this.listArtifacts(principal, runId2);
+  async getArtifact(principal, runId3, id2) {
+    const artifacts = await this.listArtifacts(principal, runId3);
     return artifacts.find((artifact) => artifact.id === id2) ?? null;
   }
   async publishSkill(input) {
@@ -62180,7 +62778,11 @@ class MemorySkillsStore {
       createdAt: previous?.createdAt ?? now,
       updatedAt: now,
       revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
-      revisionNumber: (previous?.revisionNumber ?? 0) + 1
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      lifecycle: previous?.lifecycle ?? "active",
+      ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
+      ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
+      ...previous?.replacementSlug ? { replacementSlug: previous.replacementSlug } : {}
     };
     this.skills.set(key, record3);
     if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
@@ -62216,6 +62818,33 @@ class MemorySkillsStore {
     const skill = this.skills.get(skillKey(principal.orgId, slug));
     return skill && skill.orgId === principal.orgId ? skill : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId)
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+      const profiles = await this.selectionStore.profilesReferencingSkill(principal, slug);
+      if (profiles.length)
+        throw new SkillLifecycleConflictError(slug, profiles);
+    }
+    const next2 = {
+      ...current,
+      lifecycle: patch.lifecycle,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+      revisionNumber: current.revisionNumber + 1,
+      ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+    };
+    if (patch.lifecycle === "active") {
+      delete next2.archivedAt;
+      delete next2.archiveReason;
+      delete next2.replacementSlug;
+    }
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -62286,7 +62915,7 @@ class MemorySkillsStore {
     await this.purgeExpiredTombstones(principal);
     const tags = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId !== principal.orgId)
+      if (skill.orgId !== principal.orgId || skill.lifecycle !== "active")
         continue;
       for (const tag of skill.tags) {
         if (tag.trim())
@@ -62297,13 +62926,13 @@ class MemorySkillsStore {
   }
   async listSkillsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
-    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
   }
   async listPinsByTag(principal, tag) {
     await this.purgeExpiredTombstones(principal);
     const taggedSlugs = new Set;
     for (const skill of this.skills.values()) {
-      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.tags.includes(tag))
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag))
         taggedSlugs.add(skill.slug);
     }
     return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a4, b4) => a4.slug.localeCompare(b4.slug));
@@ -62316,12 +62945,12 @@ class MemorySkillsStore {
     if (!referenced)
       this.bundles.delete(skillKey(orgId, sha2562));
   }
-  patchRun(runId2, patch) {
-    const run = this.runs.get(runId2);
+  patchRun(runId3, patch) {
+    const run = this.runs.get(runId3);
     if (!run)
       return null;
     const next2 = { ...run, ...patch };
-    this.runs.set(runId2, next2);
+    this.runs.set(runId3, next2);
     return next2;
   }
 }
@@ -62394,7 +63023,7 @@ class PostgresSkillsStore {
       ON CONFLICT (key_hash) DO NOTHING
     `;
   }
-  async authenticateApiKeyHash(hash2) {
+  async authenticateApiKeyHash(hash3) {
     const rows = await this.sql`
       SELECT k.id AS api_key_id, k.scopes_json, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
              u.id AS user_id, u.email, m.role
@@ -62402,7 +63031,7 @@ class PostgresSkillsStore {
       JOIN organizations o ON o.id = k.org_id
       JOIN users u ON u.id = k.user_id
       LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
-      WHERE k.key_hash = ${hash2} AND k.revoked_at IS NULL
+      WHERE k.key_hash = ${hash3} AND k.revoked_at IS NULL
       LIMIT 1
     `;
     const row = rows[0];
@@ -62420,6 +63049,38 @@ class PostgresSkillsStore {
       scopes: parseJsonArray(row.scopes_json)
     };
   }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+        SELECT scopes_json FROM api_keys
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+        LIMIT 1
+      `;
+      const row = rows[0];
+      if (!row)
+        return { kind: "not_found" };
+      const current = parseJsonArray(row.scopes_json);
+      if (current.length !== expectedScopes.length || current.some((scope2, index) => scope2 !== expectedScopes[index])) {
+        return { kind: "stale", scopes: current };
+      }
+      const scopes = [...current, ...addScopes.filter((scope2) => !current.includes(scope2))];
+      const updated = await tx`
+        UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+          AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+        RETURNING scopes_json
+      `;
+      if (!updated[0]) {
+        const latest = await tx`SELECT scopes_json FROM api_keys WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL LIMIT 1`;
+        return { kind: "stale", scopes: latest[0] ? parseJsonArray(latest[0].scopes_json) : current };
+      }
+      await tx`
+        INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes })}::jsonb)
+      `;
+      return { kind: "updated", scopes };
+    });
+  }
   async withContext(orgId, worker, fn) {
     return this.sql.begin(async (tx) => {
       await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
@@ -62438,7 +63099,7 @@ class PostgresSkillsStore {
         if (existing[0])
           return rowToRun(existing[0]);
       }
-      const id2 = runId();
+      const id2 = runId2();
       const rows = await tx`
         INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
         VALUES (${id2}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID9()})
@@ -62456,10 +63117,10 @@ class PostgresSkillsStore {
       return rows.map(rowToRun);
     });
   }
-  async getRun(principal, runId2) {
+  async getRun(principal, runId3) {
     return this.withContext(principal.orgId, false, async (tx) => {
       const rows = await tx`
-        SELECT * FROM skills_runs WHERE id = ${runId2} AND org_id = ${principal.orgId} LIMIT 1
+        SELECT * FROM skills_runs WHERE id = ${runId3} AND org_id = ${principal.orgId} LIMIT 1
       `;
       return rows[0] ? rowToRun(rows[0]) : null;
     });
@@ -62482,9 +63143,9 @@ class PostgresSkillsStore {
       return rows[0] ? rowToRun(rows[0]) : null;
     });
   }
-  async updateRun(runId2, patch) {
+  async updateRun(runId3, patch) {
     return this.withContext(null, true, async (tx) => {
-      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId3} LIMIT 1`;
       if (!current[0])
         return null;
       const run = { ...rowToRun(current[0]), ...patch };
@@ -62497,20 +63158,20 @@ class PostgresSkillsStore {
             error_message = ${run.errorMessage ?? null},
             started_at = ${run.startedAt ?? null},
             completed_at = ${run.completedAt ?? null}
-        WHERE id = ${runId2}
+        WHERE id = ${runId3}
         RETURNING *
       `;
       return rows[0] ? rowToRun(rows[0]) : null;
     });
   }
-  async transitionRun(runId2, patch, expectedGeneration) {
+  async transitionRun(runId3, patch, expectedGeneration) {
     return this.withContext(null, true, async (tx) => {
-      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId3} LIMIT 1`;
       if (!current[0])
         return null;
       const stored = rowToRun(current[0]);
       if (stored.leaseGeneration !== expectedGeneration) {
-        throw new StaleLeaseGenerationError(runId2, expectedGeneration, stored.leaseGeneration, stored.status);
+        throw new StaleLeaseGenerationError(runId3, expectedGeneration, stored.leaseGeneration, stored.status);
       }
       const run = { ...stored, ...patch };
       const rows = await tx`
@@ -62523,13 +63184,13 @@ class PostgresSkillsStore {
             started_at = ${run.startedAt ?? null},
             completed_at = ${run.completedAt ?? null},
             lease_generation = ${run.leaseGeneration}
-        WHERE id = ${runId2} AND lease_generation = ${expectedGeneration}
+        WHERE id = ${runId3} AND lease_generation = ${expectedGeneration}
         RETURNING *
       `;
       return rows[0] ? rowToRun(rows[0]) : null;
     });
   }
-  async appendLog(runId2, orgId, level, message) {
+  async appendLog(runId3, orgId, level, message) {
     let lastError;
     for (let attempt = 0;attempt < LOG_SEQUENCE_ATTEMPTS; attempt += 1) {
       try {
@@ -62537,9 +63198,9 @@ class PostgresSkillsStore {
           return await tx`
             INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message)
             VALUES (
-              ${runId2},
+              ${runId3},
               ${orgId},
-              (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ${runId2}),
+              (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ${runId3}),
               ${level},
               ${message}
             )
@@ -62555,12 +63216,12 @@ class PostgresSkillsStore {
     }
     throw lastError;
   }
-  async listLogs(principal, runId2) {
+  async listLogs(principal, runId3) {
     return this.withContext(principal.orgId, false, async (tx) => {
       const rows = await tx`
         SELECT l.* FROM skills_run_logs l
         JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ${principal.orgId}
-        WHERE l.run_id = ${runId2}
+        WHERE l.run_id = ${runId3}
         ORDER BY l.sequence ASC
       `;
       return rows.map(rowToLog);
@@ -62576,23 +63237,23 @@ class PostgresSkillsStore {
       return rowToArtifact(rows[0]);
     });
   }
-  async listArtifacts(principal, runId2) {
+  async listArtifacts(principal, runId3) {
     return this.withContext(principal.orgId, false, async (tx) => {
       const rows = await tx`
         SELECT a.* FROM skills_artifacts a
         JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
-        WHERE a.run_id = ${runId2}
+        WHERE a.run_id = ${runId3}
         ORDER BY a.created_at ASC
       `;
       return rows.map(rowToArtifact);
     });
   }
-  async getArtifact(principal, runId2, artifactId2) {
+  async getArtifact(principal, runId3, artifactId2) {
     return this.withContext(principal.orgId, false, async (tx) => {
       const rows = await tx`
         SELECT a.* FROM skills_artifacts a
         JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
-        WHERE a.run_id = ${runId2} AND a.id = ${artifactId2}
+        WHERE a.run_id = ${runId3} AND a.id = ${artifactId2}
         LIMIT 1
       `;
       return rows[0] ? rowToArtifact(rows[0]) : null;
@@ -62740,6 +63401,42 @@ class PostgresSkillsStore {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
     return rows[0] ? rowToSkill(rows[0]) : null;
   }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.sql.begin(async (tx) => {
+      const currentRows = await tx`SELECT * FROM skills_registry WHERE org_id=${principal.orgId} AND slug=${slug} LIMIT 1 FOR UPDATE`;
+      const current = currentRows[0] ? rowToSkill(currentRows[0]) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = await tx`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${principal.orgId}`;
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection2) => selection2?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = {
+        ...current,
+        lifecycle: patch.lifecycle,
+        updatedAt: nowIso(),
+        revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+        revisionNumber: current.revisionNumber + 1,
+        ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+      };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const rows = await tx`UPDATE skills_registry SET lifecycle=${next2.lifecycle}, archived_at=${next2.archivedAt ?? null}, archive_reason=${next2.archiveReason ?? null}, replacement_slug=${next2.replacementSlug ?? null}, revision_id=${next2.revisionId}, revision_number=revision_number+1, updated_at=${next2.updatedAt} WHERE org_id=${principal.orgId} AND slug=${slug} AND tombstoned_at IS NULL AND revision_id=${current.revisionId} RETURNING *`;
+      if (!rows[0])
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, (await this.getSkill(principal, slug))?.revisionId ?? null);
+      return rowToSkill(rows[0]);
+    });
+  }
   async updateSkill(principal, slug, patch, expectedRevisionId) {
     const current = await this.getSkill(principal, slug);
     if (!current || current.tombstonedAt)
@@ -62875,7 +63572,7 @@ class PostgresSkillsStore {
   async listTags(principal) {
     await this.purgeExpiredTombstones(principal);
     const rows = await this.sql`
-      SELECT DISTINCT tag FROM skills_tags WHERE org_id = ${principal.orgId} ORDER BY tag ASC
+      SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id = t.org_id AND s.slug = t.slug WHERE t.org_id = ${principal.orgId} AND s.lifecycle = 'active' ORDER BY t.tag ASC
     `;
     return rows.map((row) => String(row.tag));
   }
@@ -62884,7 +63581,7 @@ class PostgresSkillsStore {
     const rows = await this.sql`
       SELECT s.* FROM skills_registry s
       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
-      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY s.slug ASC
     `;
     return rows.map(rowToSkill);
@@ -62896,7 +63593,7 @@ class PostgresSkillsStore {
       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
       WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
-        AND t.tag = ${tag} AND s.tombstoned_at IS NULL
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
       ORDER BY p.slug ASC
     `;
     return rows.map(rowToPin);
@@ -62993,7 +63690,7 @@ async function createSkillsFetchHandler(options = {}) {
         if (request2.method === "GET" && url.pathname === "/api/v1/capabilities") {
           const response = await handleProfileApi(store, principal, request2, ["capabilities"], config);
           const payload = await response.json();
-          return json4({ ...payload, cloudExecution: Boolean(runtime), capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
+          return json4({ ...payload, cloudExecution: Boolean(runtime), cloudExecutionContracts: runtime ? ["pdf.v1", "regex-test.v1"] : [], capabilities: [...payload.capabilities, ...runtime ? ["skills.cloud-execution"] : []] });
         }
         if (request2.method === "GET" && url.pathname === "/api/auth/whoami") {
           return json4(identityPayload(principal));
@@ -63017,6 +63714,9 @@ async function createSkillsFetchHandler(options = {}) {
           attemptedBundleSha256: error.attemptedSha256
         }, { status: 409 });
       }
+      if (error instanceof SkillLifecycleConflictError) {
+        return json4({ error: error.message, code: "SKILL_ARCHIVE_PROFILE_CONFLICT", profiles: error.profiles }, { status: 409 });
+      }
       if (error instanceof SkillRevisionConflictError) {
         return json4({
           error: error.message,
@@ -63055,6 +63755,32 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
   if (parts.some(segmentEscapesPath)) {
     return json4({ error: "invalid path segment", code: "INVALID_PATH" }, { status: 400 });
   }
+  if (parts.length === 4 && resource === "admin" && id2 === "keys" && subresource && childId === "scopes" && request2.method === "PATCH") {
+    const adminScope = principal.scopes.includes("*") || principal.scopes.includes("skills:keys.admin");
+    if (!adminScope || !["owner", "admin"].includes(principal.role)) {
+      return json4({ error: "Key scope administration requires an owner/admin key with skills:keys.admin", code: "KEY_ADMIN_REQUIRED" }, { status: 403 });
+    }
+    if (!/^[A-Za-z0-9_-]+$/.test(subresource)) {
+      return json4({ error: "Key id must be url-safe (letters, digits, '_' or '-')", code: "INVALID_KEY_ID" }, { status: 400 });
+    }
+    const body4 = await readJson(request2, config.requestBodyLimitBytes);
+    const expected = body4.expected_scopes;
+    const additions = body4.add_scopes;
+    if (!Array.isArray(expected) || !expected.every((scope2) => typeof scope2 === "string") || !Array.isArray(additions) || !additions.every((scope2) => typeof scope2 === "string")) {
+      return json4({ error: "expected_scopes and add_scopes must be arrays of scope strings", code: "INVALID_KEY_SCOPE_UPDATE" }, { status: 400 });
+    }
+    if (additions.length !== 1 || additions[0] !== "skills:publish") {
+      return json4({ error: "Only adding skills:publish to an existing Skills key is supported", code: "INVALID_KEY_SCOPE_UPDATE" }, { status: 400 });
+    }
+    const update = await store.updateApiKeyScopes?.(principal, subresource, expected, additions);
+    if (!update)
+      return json4({ error: "Key scope administration is unavailable", code: "KEY_SCOPE_UPDATE_UNAVAILABLE" }, { status: 501 });
+    if (update.kind === "not_found")
+      return json4({ error: "API key not found", code: "API_KEY_NOT_FOUND" }, { status: 404 });
+    if (update.kind === "stale")
+      return json4({ error: "API key scopes changed; re-read and retry with expected_scopes", code: "API_KEY_SCOPE_CONFLICT", keyId: subresource, scopes: update.scopes }, { status: 409 });
+    return json4({ keyId: subresource, orgId: principal.orgId, scopes: update.scopes, updated: true });
+  }
   if (!permitsSkillsRoute(principal, request2.method, resource ?? "")) {
     return json4({ error: "The API key does not allow this operation", code: "INSUFFICIENT_SCOPE" }, { status: 403 });
   }
@@ -63088,6 +63814,13 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
     if (request2.method === "GET" && id2 && subresource === "versions" && !childId) {
       return json4(await listSkillVersionsPayload(store, principal, id2));
     }
+    if (request2.method === "PATCH" && id2 && subresource === "lifecycle" && !childId) {
+      if (!["owner", "admin"].includes(principal.role))
+        return json4({ error: "Only organization owners or admins may change skill lifecycle", code: "LIFECYCLE_ROLE_REQUIRED" }, { status: 403 });
+      const expectedRevisionId = parseIfMatch(request2.headers.get("if-match"));
+      const updated = await store.setSkillLifecycle(principal, id2, skillLifecyclePatch(await readJson(request2, config.requestBodyLimitBytes)), expectedRevisionId);
+      return updated ? json4(publishedPayload(updated), { headers: { ETag: revisionEtag(updated.revisionId) } }) : json4({ error: "published skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
+    }
     if (request2.method === "GET" && id2 && subresource === "versions" && childId && !parts[4]) {
       const version2 = await readSkillVersion(store, principal, id2, childId);
       const current = (await store.getSkill(principal, id2))?.bundleSha256;
@@ -63246,8 +63979,11 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
   return json4({ error: "not found", code: "NOT_FOUND" }, { status: 404 });
 }
 function identityPayload(principal) {
+  const safeKeyId = /^[A-Za-z0-9_-]{1,256}$/.test(principal.apiKeyId) ? principal.apiKeyId : undefined;
+  const safeScopes = principal.scopes.length <= 32 && principal.scopes.every((scope2) => scope2.length <= 128 && /^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope2)) ? [...new Set(principal.scopes)] : undefined;
   return {
     user: { id: principal.userId, email: principal.email, role: principal.role },
+    ...safeKeyId && safeScopes ? { apiKey: { id: safeKeyId, scopes: safeScopes } } : {},
     organization: { id: principal.orgId, slug: principal.orgSlug, name: principal.orgName }
   };
 }
@@ -63503,14 +64239,14 @@ var util;
       return obj[e5];
     });
   };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object5) => {
-    const keys2 = [];
-    for (const key in object5) {
-      if (Object.prototype.hasOwnProperty.call(object5, key)) {
-        keys2.push(key);
+  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object6) => {
+    const keys3 = [];
+    for (const key in object6) {
+      if (Object.prototype.hasOwnProperty.call(object6, key)) {
+        keys3.push(key);
       }
     }
-    return keys2;
+    return keys3;
   };
   util2.find = (arr, checker) => {
     for (const item of arr) {
@@ -65760,8 +66496,8 @@ class ZodObject extends ZodType {
     if (this._cached !== null)
       return this._cached;
     const shape = this._def.shape();
-    const keys2 = util.objectKeys(shape);
-    this._cached = { shape, keys: keys2 };
+    const keys3 = util.objectKeys(shape);
+    this._cached = { shape, keys: keys3 };
     return this._cached;
   }
   _parse(input) {
@@ -67435,8 +68171,8 @@ function createRunService({ store, governance }) {
       return run;
     },
     leaseNext: (workerId) => store.claimNextRun({ workerId }),
-    transition: (runId2, patch) => store.updateRun(runId2, patch),
-    get: (principal, runId2) => store.getRun(principal, runId2)
+    transition: (runId3, patch) => store.updateRun(runId3, patch),
+    get: (principal, runId3) => store.getRun(principal, runId3)
   };
 }
 async function settleRun(store, options, run, actualCents) {
@@ -67481,7 +68217,7 @@ var localRunExecutor = {
 // src/sdk/storage.ts
 var artifactStorageSeam = ArtifactStorage;
 // src/sdk/outputs.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 class DatabaseOnlyObjectStore {
   usesS3 = false;
   async materialize(run, artifact, body4) {
@@ -67491,8 +68227,8 @@ class DatabaseOnlyObjectStore {
     return null;
   }
   async deleteBundle() {}
-  quarantineKeyFor(tenantId, runId2, artifactId2) {
-    return `${tenantId}/${runId2}/quarantine/${artifactId2}`;
+  quarantineKeyFor(tenantId, runId3, artifactId2) {
+    return `${tenantId}/${runId3}/quarantine/${artifactId2}`;
   }
 }
 function redactRunOutput(value, patterns = DEFAULT_OUTPUT_GOVERNANCE.redactPatterns) {
@@ -67528,7 +68264,7 @@ function createGovernedArtifactWriter(options) {
       const stamped = {
         ...meta,
         byteSize: outputBytes,
-        sha256: createHash26("sha256").update(persistedBytes).digest("hex"),
+        sha256: createHash27("sha256").update(persistedBytes).digest("hex"),
         visibility: options.visibility ?? config.defaultVisibility,
         ...config.artifactTtlSeconds !== undefined ? { expiresAt: expiresAtFor(createdAt, config.artifactTtlSeconds) } : {}
       };
@@ -67674,13 +68410,13 @@ function createSpendService(options) {
         exhaust("monthly", `org spend for ${monthPrefix} is ${monthly} cents and this run estimates ${estimated}; monthly ceiling is ${ceilings.monthlyTotalCents} cents`);
       }
     },
-    async reserve(tenantId, runId2, estimatedCents) {
+    async reserve(tenantId, runId3, estimatedCents) {
       assertReservationCents(estimatedCents, "estimatedCents");
-      return store.createReservation({ orgId: tenantId, runId: runId2, estimatedCents });
+      return store.createReservation({ orgId: tenantId, runId: runId3, estimatedCents });
     },
-    async reconcile(tenantId, runId2, actualCents) {
+    async reconcile(tenantId, runId3, actualCents) {
       assertReservationCents(actualCents, "actualCents");
-      const reservations = await store.reservationsForRun(tenantId, runId2);
+      const reservations = await store.reservationsForRun(tenantId, runId3);
       const open = reservations.find((reservation) => reservation.status === "reserved");
       if (!open)
         return null;
@@ -67773,7 +68509,7 @@ __export(exports_external2, {
   overwrite: () => _overwrite,
   output: () => output,
   optional: () => optional,
-  object: () => object5,
+  object: () => object6,
   number: () => number2,
   nullish: () => nullish2,
   nullable: () => nullable,
@@ -67824,7 +68560,7 @@ __export(exports_external2, {
   httpUrl: () => httpUrl,
   hostname: () => hostname2,
   hex: () => hex2,
-  hash: () => hash2,
+  hash: () => hash3,
   guid: () => guid2,
   gte: () => _gte,
   gt: () => _gt,
@@ -68403,9 +69139,9 @@ function floatSafeRemainder2(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object5, key, getter) {
+function defineLazy(object6, key, getter) {
   let value = undefined;
-  Object.defineProperty(object5, key, {
+  Object.defineProperty(object6, key, {
     get() {
       if (value === EVALUATING) {
         return;
@@ -68417,7 +69153,7 @@ function defineLazy(object5, key, getter) {
       return value;
     },
     set(v2) {
-      Object.defineProperty(object5, key, {
+      Object.defineProperty(object6, key, {
         value: v2
       });
     },
@@ -68452,12 +69188,12 @@ function getElementAtPath(obj, path2) {
   return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
-  const keys2 = Object.keys(promisesObj);
-  const promises = keys2.map((key) => promisesObj[key]);
+  const keys3 = Object.keys(promisesObj);
+  const promises = keys3.map((key) => promisesObj[key]);
   return Promise.all(promises).then((results) => {
     const resolvedObj = {};
-    for (let i4 = 0;i4 < keys2.length; i4++) {
-      resolvedObj[keys2[i4]] = results[i4];
+    for (let i4 = 0;i4 < keys3.length; i4++) {
+      resolvedObj[keys3[i4]] = results[i4];
     }
     return resolvedObj;
   });
@@ -71087,10 +71823,10 @@ function handlePropertyResult(result, final, key, input, optin, optout) {
 }
 var NO_SYMBOL_KEYS = [];
 function normalizeDef(def) {
-  const keys2 = Object.keys(def.shape);
+  const keys3 = Object.keys(def.shape);
   const ownSymbols = Object.getOwnPropertySymbols(def.shape);
   const symbolKeys = ownSymbols.length ? ownSymbols : NO_SYMBOL_KEYS;
-  const allKeys = symbolKeys.length ? [...keys2, ...symbolKeys] : keys2;
+  const allKeys = symbolKeys.length ? [...keys3, ...symbolKeys] : keys3;
   for (const k4 of allKeys) {
     if (!def.shape?.[k4]?._zod?.traits?.has("$ZodType")) {
       throw new Error(`Invalid element at key "${String(k4)}": expected a Zod schema`);
@@ -71101,8 +71837,8 @@ function normalizeDef(def) {
     ...def,
     allKeys,
     symbolKeys,
-    keySet: new Set(keys2),
-    numKeys: keys2.length,
+    keySet: new Set(keys3),
+    numKeys: keys3.length,
     optionalKeys: new Set(okeys)
   };
 }
@@ -71619,19 +72355,19 @@ function handleIntersectionResults(result, left, right) {
   let unrecIssue;
   const keyIssues = new Map;
   const collect = (iss, side) => {
-    let keys2;
+    let keys3;
     if (iss.code === "unrecognized_keys" && !iss.path?.length) {
       unrecIssue ?? (unrecIssue = iss);
-      keys2 = iss.keys;
+      keys3 = iss.keys;
     } else if (iss.code === "invalid_key" && iss.origin === "record" && iss.path?.length === 1) {
       const k4 = String(iss.path[0]);
       if (!keyIssues.has(k4))
         keyIssues.set(k4, iss);
-      keys2 = [k4];
+      keys3 = [k4];
     } else {
       return false;
     }
-    for (const k4 of keys2) {
+    for (const k4 of keys3) {
       if (!unrecKeys.has(k4))
         unrecKeys.set(k4, {});
       unrecKeys.get(k4)[side] = true;
@@ -80835,13 +81571,13 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (typeof ${accessor} !== "object" || ${accessor} === null || Array.isArray(${accessor})) return INVALID;`);
   const shape = def.shape;
-  const keys2 = Object.keys(shape);
+  const keys3 = Object.keys(shape);
   const symbolKeys = Object.getOwnPropertySymbols(shape);
-  const allKeys = symbolKeys.length ? [...keys2, ...symbolKeys] : keys2;
+  const allKeys = symbolKeys.length ? [...keys3, ...symbolKeys] : keys3;
   const keyExpr = (k4) => typeof k4 === "symbol" ? addConstant(ctx, k4) : esc(k4);
   const propKey = (k4) => typeof k4 === "symbol" ? `[${keyExpr(k4)}]` : esc(k4);
   const propShape = shape;
-  if (keys2.includes("__proto__")) {
+  if (keys3.includes("__proto__")) {
     throw new ZodCompileUnsupportedError('object shape key "__proto__"');
   }
   const propOutputs = new Map;
@@ -80883,7 +81619,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
   if (catchall) {
     const catchallType = catchall._zod.def.type;
     if (catchallType === "never") {
-      const condition = keys2.map((k4) => `k !== ${esc(k4)}`).join(" && ") || "true";
+      const condition = keys3.map((k4) => `k !== ${esc(k4)}`).join(" && ") || "true";
       doc.write(`for (const k in ${accessor}) {`);
       doc.indented((d4) => {
         d4.write(`if (${condition}) return INVALID;`);
@@ -80899,7 +81635,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const hasConditionalKeys = allKeys.some((k4) => mayOutputUndefined(propShape[k4]) || dropsWhenAbsent(propShape[k4]));
   if (!buildsValue) {
     if (unknownKeysMode === "schema") {
-      const knownSet = keys2.length > 0 ? addConstant(ctx, new Set(keys2)) : null;
+      const knownSet = keys3.length > 0 ? addConstant(ctx, new Set(keys3)) : null;
       doc.write(`for (const k in ${accessor}) {`);
       doc.indented((d4) => {
         d4.write(`if (k === "__proto__") continue;`);
@@ -80931,7 +81667,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
     }
   }
   if (unknownKeysMode !== "none") {
-    const knownSet = keys2.length > 0 ? addConstant(ctx, new Set(keys2)) : null;
+    const knownSet = keys3.length > 0 ? addConstant(ctx, new Set(keys3)) : null;
     doc.write(`for (const k in ${accessor}) {`);
     doc.indented((d4) => {
       d4.write(`if (k === "__proto__") continue;`);
@@ -82794,8 +83530,8 @@ function compactTypeUnion(schema) {
     if (!option || typeof option !== "object")
       return;
     compactTypeUnion(option);
-    const keys2 = Object.keys(option);
-    if (keys2.length !== 1 || keys2[0] !== "type")
+    const keys3 = Object.keys(option);
+    if (keys3.length !== 1 || keys3[0] !== "type")
       return;
     const type = option.type;
     for (const member of Array.isArray(type) ? type : [type]) {
@@ -82829,8 +83565,8 @@ function foldObjects(members2) {
   }
   const properties = {};
   const required2 = new Set;
-  for (const object5 of objects) {
-    for (const key in object5.properties) {
+  for (const object6 of objects) {
+    for (const key in object6.properties) {
       if (Object.prototype.hasOwnProperty.call(properties, key))
         continue;
       const parts = [];
@@ -82844,18 +83580,18 @@ function foldObjects(members2) {
       const merged = parts.length === 1 ? parts[0] : foldObjects(parts) ?? { allOf: parts };
       assignProp(properties, key, merged);
     }
-    for (const key of object5.required ?? [])
+    for (const key of object6.required ?? [])
       required2.add(key);
   }
   const folded = { type: "object", properties };
   if (required2.size)
     folded.required = [...required2];
-  if (objects.every((object5) => object5.additionalProperties === false)) {
+  if (objects.every((object6) => object6.additionalProperties === false)) {
     folded.additionalProperties = false;
   } else {
     const constraints = [];
-    for (const object5 of objects) {
-      const constraint = undeclaredConstraint(object5);
+    for (const object6 of objects) {
+      const constraint = undeclaredConstraint(object6);
       if (constraint && !constraints.some((seen) => JSON.stringify(seen) === JSON.stringify(constraint)))
         constraints.push(constraint);
     }
@@ -83867,7 +84603,7 @@ __export(exports_schemas2, {
   pipe: () => pipe,
   partialRecord: () => partialRecord,
   optional: () => optional,
-  object: () => object5,
+  object: () => object6,
   number: () => number2,
   nullish: () => nullish2,
   nullable: () => nullable,
@@ -83899,7 +84635,7 @@ __export(exports_schemas2, {
   httpUrl: () => httpUrl,
   hostname: () => hostname2,
   hex: () => hex2,
-  hash: () => hash2,
+  hash: () => hash3,
   guid: () => guid2,
   function: () => _function,
   float64: () => float64,
@@ -84613,7 +85349,7 @@ function hostname2(_params) {
 function hex2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hex", exports_regexes.hex, _params);
 }
-function hash2(alg, params) {
+function hash3(alg, params) {
   const enc = params?.enc ?? "hex";
   const format = `${alg}_${enc}`;
   const regex = exports_regexes[format];
@@ -84913,7 +85649,7 @@ var ZodObject2 = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
     return exports_util.required(ZodNonOptional, this, args[0]);
   }
 });
-function object5(shape, params) {
+function object6(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -85106,11 +85842,11 @@ var ZodEnum2 = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json5, params) => enumProcessor(inst, ctx, json5, params);
   inst.enum = def.entries;
   inst.options = Object.values(def.entries);
-  const keys2 = new Set(Object.keys(def.entries));
+  const keys3 = new Set(Object.keys(def.entries));
   inst.extract = (values, params) => {
     const newEntries = {};
     for (const value of values) {
-      if (keys2.has(value)) {
+      if (keys3.has(value)) {
         newEntries[value] = def.entries[value];
       } else
         throw new Error(`Key ${value} not found in enum`);
@@ -85125,7 +85861,7 @@ var ZodEnum2 = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
   inst.exclude = (values, params) => {
     const newEntries = { ...def.entries };
     for (const value of values) {
-      if (keys2.has(value)) {
+      if (keys3.has(value)) {
         delete newEntries[value];
       } else
         throw new Error(`Key ${value} not found in enum`);
@@ -86112,10 +86848,10 @@ function visit2(schema, fnOrHandlers) {
     switch (kind) {
       case "object": {
         const oldShape = def.shape;
-        const keys2 = Object.keys(oldShape);
+        const keys3 = Object.keys(oldShape);
         let changed = false;
         const newShape = {};
-        for (const k4 of keys2) {
+        for (const k4 of keys3) {
           const mapped = run(oldShape[k4]);
           if (mapped !== oldShape[k4])
             changed = true;
@@ -86295,7 +87031,7 @@ function date4(params) {
   return _coercedDate(ZodDate2, params);
 }
 // src/lib/canonical-json.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 function canonicalJson3(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -86339,7 +87075,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash27("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
+  return createHash28("sha256").update(canonicalJson3(value, maximumBytes)).digest("hex");
 }
 
 // src/lib/remote-recurring-contract.ts
@@ -86597,9 +87333,9 @@ function requireResult(value) {
   if (!value)
     throw new RemoteRecurringReadError;
 }
-function termsIntegrity(terms, hash3, identity3, own2) {
+function termsIntegrity(terms, hash4, identity3, own2) {
   requireResult(terms.organizationId === identity3.organization.id && (!own2 || terms.approvedByUserId === identity3.user.id && terms.approvedMembershipId === identity3.user.membershipId));
-  requireResult(canonicalJsonSha256(terms) === hash3);
+  requireResult(canonicalJsonSha256(terms) === hash4);
   requireResult(canonicalJsonSha256({ skill: terms.skill, input: terms.input, args: terms.args, runtime: terms.runtime }) === terms.payloadSha256);
   requireResult(Date.parse(terms.expiresAt) > Date.parse(terms.startsAt));
 }
@@ -86734,7 +87470,7 @@ var inputFailure = () => {
 function invitationInput(action, input2) {
   if (!record4(input2))
     return inputFailure();
-  const keys2 = {
+  const keys3 = {
     list: ["after"],
     get: ["invitationId"],
     issue: ["email", "role", "idempotencyKey", "confirm"],
@@ -86742,7 +87478,7 @@ function invitationInput(action, input2) {
     revoke: ["invitationId", "expectedGeneration", "confirm"],
     accept: ["invitationId", "token", "confirm"]
   };
-  if (Object.keys(input2).some((key) => !keys2[action].includes(key)) || action !== "list" && keys2[action].some((key) => !Object.hasOwn(input2, key)))
+  if (Object.keys(input2).some((key) => !keys3[action].includes(key)) || action !== "list" && keys3[action].some((key) => !Object.hasOwn(input2, key)))
     return inputFailure();
   const value = { ...input2 };
   if (action === "list") {
@@ -87119,15 +87855,15 @@ function runQuoteReceipt(value) {
   return value;
 }
 function parseRemoteRunQuote(value) {
-  const quote2 = object6(value);
+  const quote2 = object7(value);
   runQuoteReceipt(quote2.quoteReceipt);
-  const pricing = object6(quote2.pricing);
+  const pricing = object7(quote2.pricing);
   if (typeof quote2.skill !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(quote2.skill))
     throw new Error("Invalid quoted skill");
   const costCents = creditCount(pricing.costCredits ?? pricing.costCents);
   if (pricing.costCredits !== undefined && pricing.costCents !== undefined && pricing.costCents !== costCents)
     throw new Error("Inconsistent quoted credit count");
-  if (quote2.availability && object6(quote2.availability).status !== "available")
+  if (quote2.availability && object7(quote2.availability).status !== "available")
     throw new Error("This skill is unavailable for remote execution");
   return { ...quote2, skill: quote2.skill, pricing: { ...pricing, costCredits: costCents, costCents, formattedCost: `${costCents} credits` } };
 }
@@ -87136,7 +87872,7 @@ function parseRemoteCreditPacks(value) {
     throw new Error("Invalid credit pack response");
   const ids = new Set;
   return value.map((value2) => {
-    const row = object6(value2);
+    const row = object7(value2);
     const counts = [row.credits, row.creditsCents, row.amountCents].filter((value3) => value3 !== undefined).map(creditCount);
     if (!counts.length || counts[0] === 0 || counts.some((count) => count !== counts[0]))
       throw new Error("Inconsistent credit pack counts");
@@ -87151,7 +87887,7 @@ function parseRemoteCreditPacks(value) {
   });
 }
 function parseRemoteBillingStatus(value) {
-  const row = object6(value);
+  const row = object7(value);
   const counts = [row.creditBalance, row.balanceCents].filter((value2) => value2 !== undefined).map(creditCount);
   if (!counts.length || counts.some((count) => count !== counts[0]))
     throw new Error("Inconsistent credit balance");
@@ -87163,7 +87899,7 @@ function parseRemoteBillingStatus(value) {
   };
 }
 function parseRemoteCheckout(value) {
-  const row = object6(value);
+  const row = object7(value);
   if (typeof row.url !== "string")
     throw new Error("Invalid checkout URL");
   const url2 = new URL(row.url);
@@ -87171,7 +87907,7 @@ function parseRemoteCheckout(value) {
     throw new Error("Invalid checkout URL");
   return { url: row.url };
 }
-function object6(value) {
+function object7(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid Skills server response");
   return value;
@@ -87375,6 +88111,18 @@ class RemoteRequestError extends Error {
     this.name = "RemoteRequestError";
   }
 }
+var KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+
+class RemoteSkillLifecycleError extends RemoteRequestError {
+  code;
+  constructor(path2, status, code) {
+    super(path2, status);
+    this.name = "RemoteSkillLifecycleError";
+    const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+    this.code = safeCode;
+    this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+  }
+}
 
 class RemoteCreditCheckoutError extends RemoteRequestError {
   code;
@@ -87555,6 +88303,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope2) => typeof scope2 !== "string" || scope2.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope2)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path2 = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path2, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path2, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body4 = value;
+    const returnedId = body4.keyId;
+    const orgId = body4.orgId;
+    const scopes = body4.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope2) => typeof scope2 !== "string") || body4.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope2, index) => returnedScopes[index] !== scope2)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -87928,14 +88709,14 @@ class RemoteSkillsClient {
   async createBillingPortal() {
     return this.checkoutResponse("/api/v1/billing/portal");
   }
-  async cancelRun(runId2) {
-    return this.controlRun(runId2, "cancel");
+  async cancelRun(runId3) {
+    return this.controlRun(runId3, "cancel");
   }
-  async resumeRun(runId2) {
-    return this.controlRun(runId2, "resume");
+  async resumeRun(runId3) {
+    return this.controlRun(runId3, "resume");
   }
-  async controlRun(runId2, action) {
-    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId2)}/${action}`, { method: "POST", body: "{}" });
+  async controlRun(runId3, action) {
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId3)}/${action}`, { method: "POST", body: "{}" });
     return normalizeRemoteSkillRunContract(await response.json());
   }
   async checkoutResponse(path2) {
@@ -87947,8 +88728,8 @@ class RemoteSkillsClient {
       throw new Error("Invalid Skills server list response");
     return rows;
   }
-  async getRun(runId2) {
-    const path2 = `/api/v1/runs/${encodeURIComponent(runId2)}`;
+  async getRun(runId3) {
+    const path2 = `/api/v1/runs/${encodeURIComponent(runId3)}`;
     const res = await this.request(path2);
     if (res.status === 404)
       return null;
@@ -87956,30 +88737,30 @@ class RemoteSkillsClient {
       throw new RemoteRequestError(path2, res.status, res.statusText);
     return normalizeRemoteSkillRunContract(await res.json());
   }
-  async getRunLogs(runId2) {
-    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId2)}/logs`);
+  async getRunLogs(runId3) {
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId3)}/logs`);
   }
   async listRuns(limit = 20) {
     if (!Number.isInteger(limit) || limit < 1 || limit > 100)
       throw new Error("Run limit must be an integer from 1 to 100");
     return this.arrayResponse(`/api/v1/runs?limit=${limit}`);
   }
-  async getRunArtifacts(runId2) {
-    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId2)}/artifacts`);
+  async getRunArtifacts(runId3) {
+    return this.arrayResponse(`/api/v1/runs/${encodeURIComponent(runId3)}/artifacts`);
   }
-  async downloadRunArtifact(runId2, artifactId2) {
-    return this.request(`/api/v1/runs/${encodeURIComponent(runId2)}/artifacts/${encodeURIComponent(artifactId2)}/download`, {
+  async downloadRunArtifact(runId3, artifactId2) {
+    return this.request(`/api/v1/runs/${encodeURIComponent(runId3)}/artifacts/${encodeURIComponent(artifactId2)}/download`, {
       method: "GET"
     });
   }
-  async getVerifiedRunArtifact(runId2, artifactId2, maximumBytes = MAX_REMOTE_FILE_BYTES) {
-    const artifacts = await this.getRunArtifacts(runId2);
+  async getVerifiedRunArtifact(runId3, artifactId2, maximumBytes = MAX_REMOTE_FILE_BYTES) {
+    const artifacts = await this.getRunArtifacts(runId3);
     const artifact = artifacts.find((row) => row.id === artifactId2);
     if (!artifact)
       throw new Error("Run artifact not found");
     if (!Number.isSafeInteger(artifact.byteSize) || artifact.byteSize < 0 || artifact.byteSize > maximumBytes || typeof artifact.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(artifact.sha256))
       throw new Error("The server does not provide valid artifact integrity metadata");
-    const response = await this.downloadRunArtifact(runId2, artifactId2);
+    const response = await this.downloadRunArtifact(runId3, artifactId2);
     if (!response.ok)
       throw new RemoteRequestError("artifact download", response.status, response.statusText);
     const bytes = await readBoundedResponse(response, artifact.byteSize);
@@ -88027,9 +88808,9 @@ class RemoteSkillsClient {
     }
     return run;
   }
-  async uploadRunFiles(runId2, files) {
+  async uploadRunFiles(runId3, files) {
     const descriptors = describeRemoteFiles(files);
-    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId2)}/uploads`, { method: "POST", body: JSON.stringify({ files: descriptors }) });
+    const response = await this.requestNewRoute(`/api/v1/runs/${encodeURIComponent(runId3)}/uploads`, { method: "POST", body: JSON.stringify({ files: descriptors }) });
     const payload = await response.json();
     if (!Array.isArray(payload.files) || payload.files.length !== files.length || new Set(payload.files.map((file2) => file2.name)).size !== files.length)
       throw new Error("Invalid input upload response");
@@ -88072,6 +88853,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path2 = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path2, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path2, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -88224,9 +89018,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject) => {
@@ -88241,7 +89039,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size += next2.value.byteLength;
       if (size > maximum)
-        return false;
+        return;
       chunks.push(next2.value);
     }
     const bytes = new Uint8Array(size);
@@ -88252,11 +89050,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -88327,8 +89125,8 @@ function invitationEmailIds(invitationId, challengeId) {
   return { invitationId, challengeId };
 }
 function invitationEmailInput(action, input2) {
-  const keys2 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record8(input2) || Object.keys(input2).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input2, key)))
+  const keys3 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
+  if (!record8(input2) || Object.keys(input2).length !== keys3.length || keys3.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -88378,7 +89176,7 @@ async function requestInvitationEmail(origin, action, input2) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -88421,17 +89219,17 @@ var invalid7 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
 };
 var publicationUuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
-var hash3 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
+var hash4 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
 var record9 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
-var exact = (v2, keys2) => record9(v2) && Object.keys(v2).sort().join(",") === keys2.sort().join(",");
+var exact = (v2, keys3) => record9(v2) && Object.keys(v2).sort().join(",") === keys3.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
-var publicationSha256 = (bytes) => createHash28("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash29("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
-  if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
+  if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash4(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -88439,7 +89237,7 @@ function checkedPublicationDeclaration(value) {
   return Object.freeze({ ...value });
 }
 function checkedPublicationView(value, skillId, intentId, declaration) {
-  if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date5(value.expiresAt) || !date5(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
+  if (!exact(value, ["id", "skillId", "version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize", "state", "expiresAt", "createdAt", "versionId"]) || !publicationUuid(value.id) || value.skillId !== skillId || intentId !== undefined && value.id !== intentId || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || !hash4(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES || typeof value.state !== "string" || !["awaiting_upload", "queued", "verifying", "needs_attention", "committed", "rejected", "cancelled", "expired"].includes(value.state) || !date5(value.expiresAt) || !date5(value.createdAt) || !(value.versionId === null || publicationUuid(value.versionId)) || value.state === "committed" && value.versionId === null)
     return invalid7();
   if (declaration && ["version", "expectedCurrentVersionId", "archiveSha256", "archiveByteSize"].some((k4) => value[k4] !== declaration[k4]))
     return invalid7();
@@ -89165,8 +89963,8 @@ function record10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function exact2(value, names) {
-  const keys2 = Object.keys(value).sort(), expected = [...names].sort();
-  return keys2.length === expected.length && keys2.every((key, index) => key === expected[index]);
+  const keys3 = Object.keys(value).sort(), expected = [...names].sort();
+  return keys3.length === expected.length && keys3.every((key, index) => key === expected[index]);
 }
 function snapshot(value, maximum) {
   let nodes4 = 0, bytes = 0;
@@ -89203,13 +90001,13 @@ function snapshot(value, maximum) {
     const array3 = Array.isArray(input2), proto = Object.getPrototypeOf(input2);
     if (array3 ? proto !== Array.prototype : proto !== Object.prototype && proto !== null)
       throw Error();
-    const keys2 = Reflect.ownKeys(input2);
-    if (keys2.length > SKILL_OPERATION_LIMITS.nodes + 1 || keys2.some((key) => typeof key !== "string"))
+    const keys3 = Reflect.ownKeys(input2);
+    if (keys3.length > SKILL_OPERATION_LIMITS.nodes + 1 || keys3.some((key) => typeof key !== "string"))
       throw Error();
     ancestors2.add(input2);
     try {
       if (array3) {
-        if (input2.length > SKILL_OPERATION_LIMITS.nodes || keys2.length !== input2.length + 1)
+        if (input2.length > SKILL_OPERATION_LIMITS.nodes || keys3.length !== input2.length + 1)
           throw Error();
         const result2 = [];
         append("[");
@@ -89226,7 +90024,7 @@ function snapshot(value, maximum) {
       }
       const result = Object.create(null);
       append("{");
-      for (const [i4, key] of keys2.sort().entries()) {
+      for (const [i4, key] of keys3.sort().entries()) {
         const descriptor = Object.getOwnPropertyDescriptor(input2, key);
         if (!("value" in descriptor) || !descriptor.enumerable || /[\ud800-\udfff]/u.test(key) || key.length > maximum - bytes)
           throw Error();
@@ -89513,6 +90311,7 @@ export {
   DEFAULT_OUTPUT_GOVERNANCE,
   DEFAULT_IMAGE_PROFILES,
   ContentHashInputError,
+  CloudExecutionClient,
   CONTENT_HASH_LIMITS,
   CLIENT_TOKEN_BYTES,
   ArtifactStorage