@hasna/skills 0.9.2 → 0.9.4

package/bin/maintenance.js

@@ -0,0 +1,4913 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = import.meta.require;
+
+// node_modules/commander/lib/error.js
+var require_error = __commonJS((exports) => {
+  class CommanderError extends Error {
+    constructor(exitCode, code, message) {
+      super(message);
+      Error.captureStackTrace(this, this.constructor);
+      this.name = this.constructor.name;
+      this.code = code;
+      this.exitCode = exitCode;
+      this.nestedError = undefined;
+    }
+  }
+
+  class InvalidArgumentError extends CommanderError {
+    constructor(message) {
+      super(1, "commander.invalidArgument", message);
+      Error.captureStackTrace(this, this.constructor);
+      this.name = this.constructor.name;
+    }
+  }
+  exports.CommanderError = CommanderError;
+  exports.InvalidArgumentError = InvalidArgumentError;
+});
+
+// node_modules/commander/lib/argument.js
+var require_argument = __commonJS((exports) => {
+  var { InvalidArgumentError } = require_error();
+
+  class Argument {
+    constructor(name, description) {
+      this.description = description || "";
+      this.variadic = false;
+      this.parseArg = undefined;
+      this.defaultValue = undefined;
+      this.defaultValueDescription = undefined;
+      this.argChoices = undefined;
+      switch (name[0]) {
+        case "<":
+          this.required = true;
+          this._name = name.slice(1, -1);
+          break;
+        case "[":
+          this.required = false;
+          this._name = name.slice(1, -1);
+          break;
+        default:
+          this.required = true;
+          this._name = name;
+          break;
+      }
+      if (this._name.length > 3 && this._name.slice(-3) === "...") {
+        this.variadic = true;
+        this._name = this._name.slice(0, -3);
+      }
+    }
+    name() {
+      return this._name;
+    }
+    _concatValue(value, previous) {
+      if (previous === this.defaultValue || !Array.isArray(previous)) {
+        return [value];
+      }
+      return previous.concat(value);
+    }
+    default(value, description) {
+      this.defaultValue = value;
+      this.defaultValueDescription = description;
+      return this;
+    }
+    argParser(fn) {
+      this.parseArg = fn;
+      return this;
+    }
+    choices(values) {
+      this.argChoices = values.slice();
+      this.parseArg = (arg, previous) => {
+        if (!this.argChoices.includes(arg)) {
+          throw new InvalidArgumentError(`Allowed choices are ${this.argChoices.join(", ")}.`);
+        }
+        if (this.variadic) {
+          return this._concatValue(arg, previous);
+        }
+        return arg;
+      };
+      return this;
+    }
+    argRequired() {
+      this.required = true;
+      return this;
+    }
+    argOptional() {
+      this.required = false;
+      return this;
+    }
+  }
+  function humanReadableArgName(arg) {
+    const nameOutput = arg.name() + (arg.variadic === true ? "..." : "");
+    return arg.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
+  }
+  exports.Argument = Argument;
+  exports.humanReadableArgName = humanReadableArgName;
+});
+
+// node_modules/commander/lib/help.js
+var require_help = __commonJS((exports) => {
+  var { humanReadableArgName } = require_argument();
+
+  class Help {
+    constructor() {
+      this.helpWidth = undefined;
+      this.sortSubcommands = false;
+      this.sortOptions = false;
+      this.showGlobalOptions = false;
+    }
+    visibleCommands(cmd) {
+      const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
+      const helpCommand = cmd._getHelpCommand();
+      if (helpCommand && !helpCommand._hidden) {
+        visibleCommands.push(helpCommand);
+      }
+      if (this.sortSubcommands) {
+        visibleCommands.sort((a, b) => {
+          return a.name().localeCompare(b.name());
+        });
+      }
+      return visibleCommands;
+    }
+    compareOptions(a, b) {
+      const getSortKey = (option) => {
+        return option.short ? option.short.replace(/^-/, "") : option.long.replace(/^--/, "");
+      };
+      return getSortKey(a).localeCompare(getSortKey(b));
+    }
+    visibleOptions(cmd) {
+      const visibleOptions = cmd.options.filter((option) => !option.hidden);
+      const helpOption = cmd._getHelpOption();
+      if (helpOption && !helpOption.hidden) {
+        const removeShort = helpOption.short && cmd._findOption(helpOption.short);
+        const removeLong = helpOption.long && cmd._findOption(helpOption.long);
+        if (!removeShort && !removeLong) {
+          visibleOptions.push(helpOption);
+        } else if (helpOption.long && !removeLong) {
+          visibleOptions.push(cmd.createOption(helpOption.long, helpOption.description));
+        } else if (helpOption.short && !removeShort) {
+          visibleOptions.push(cmd.createOption(helpOption.short, helpOption.description));
+        }
+      }
+      if (this.sortOptions) {
+        visibleOptions.sort(this.compareOptions);
+      }
+      return visibleOptions;
+    }
+    visibleGlobalOptions(cmd) {
+      if (!this.showGlobalOptions)
+        return [];
+      const globalOptions = [];
+      for (let ancestorCmd = cmd.parent;ancestorCmd; ancestorCmd = ancestorCmd.parent) {
+        const visibleOptions = ancestorCmd.options.filter((option) => !option.hidden);
+        globalOptions.push(...visibleOptions);
+      }
+      if (this.sortOptions) {
+        globalOptions.sort(this.compareOptions);
+      }
+      return globalOptions;
+    }
+    visibleArguments(cmd) {
+      if (cmd._argsDescription) {
+        cmd.registeredArguments.forEach((argument) => {
+          argument.description = argument.description || cmd._argsDescription[argument.name()] || "";
+        });
+      }
+      if (cmd.registeredArguments.find((argument) => argument.description)) {
+        return cmd.registeredArguments;
+      }
+      return [];
+    }
+    subcommandTerm(cmd) {
+      const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
+      return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + (args ? " " + args : "");
+    }
+    optionTerm(option) {
+      return option.flags;
+    }
+    argumentTerm(argument) {
+      return argument.name();
+    }
+    longestSubcommandTermLength(cmd, helper) {
+      return helper.visibleCommands(cmd).reduce((max, command) => {
+        return Math.max(max, helper.subcommandTerm(command).length);
+      }, 0);
+    }
+    longestOptionTermLength(cmd, helper) {
+      return helper.visibleOptions(cmd).reduce((max, option) => {
+        return Math.max(max, helper.optionTerm(option).length);
+      }, 0);
+    }
+    longestGlobalOptionTermLength(cmd, helper) {
+      return helper.visibleGlobalOptions(cmd).reduce((max, option) => {
+        return Math.max(max, helper.optionTerm(option).length);
+      }, 0);
+    }
+    longestArgumentTermLength(cmd, helper) {
+      return helper.visibleArguments(cmd).reduce((max, argument) => {
+        return Math.max(max, helper.argumentTerm(argument).length);
+      }, 0);
+    }
+    commandUsage(cmd) {
+      let cmdName = cmd._name;
+      if (cmd._aliases[0]) {
+        cmdName = cmdName + "|" + cmd._aliases[0];
+      }
+      let ancestorCmdNames = "";
+      for (let ancestorCmd = cmd.parent;ancestorCmd; ancestorCmd = ancestorCmd.parent) {
+        ancestorCmdNames = ancestorCmd.name() + " " + ancestorCmdNames;
+      }
+      return ancestorCmdNames + cmdName + " " + cmd.usage();
+    }
+    commandDescription(cmd) {
+      return cmd.description();
+    }
+    subcommandDescription(cmd) {
+      return cmd.summary() || cmd.description();
+    }
+    optionDescription(option) {
+      const extraInfo = [];
+      if (option.argChoices) {
+        extraInfo.push(`choices: ${option.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`);
+      }
+      if (option.defaultValue !== undefined) {
+        const showDefault = option.required || option.optional || option.isBoolean() && typeof option.defaultValue === "boolean";
+        if (showDefault) {
+          extraInfo.push(`default: ${option.defaultValueDescription || JSON.stringify(option.defaultValue)}`);
+        }
+      }
+      if (option.presetArg !== undefined && option.optional) {
+        extraInfo.push(`preset: ${JSON.stringify(option.presetArg)}`);
+      }
+      if (option.envVar !== undefined) {
+        extraInfo.push(`env: ${option.envVar}`);
+      }
+      if (extraInfo.length > 0) {
+        return `${option.description} (${extraInfo.join(", ")})`;
+      }
+      return option.description;
+    }
+    argumentDescription(argument) {
+      const extraInfo = [];
+      if (argument.argChoices) {
+        extraInfo.push(`choices: ${argument.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`);
+      }
+      if (argument.defaultValue !== undefined) {
+        extraInfo.push(`default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}`);
+      }
+      if (extraInfo.length > 0) {
+        const extraDescripton = `(${extraInfo.join(", ")})`;
+        if (argument.description) {
+          return `${argument.description} ${extraDescripton}`;
+        }
+        return extraDescripton;
+      }
+      return argument.description;
+    }
+    formatHelp(cmd, helper) {
+      const termWidth = helper.padWidth(cmd, helper);
+      const helpWidth = helper.helpWidth || 80;
+      const itemIndentWidth = 2;
+      const itemSeparatorWidth = 2;
+      function formatItem(term, description) {
+        if (description) {
+          const fullText = `${term.padEnd(termWidth + itemSeparatorWidth)}${description}`;
+          return helper.wrap(fullText, helpWidth - itemIndentWidth, termWidth + itemSeparatorWidth);
+        }
+        return term;
+      }
+      function formatList(textArray) {
+        return textArray.join(`
+`).replace(/^/gm, " ".repeat(itemIndentWidth));
+      }
+      let output = [`Usage: ${helper.commandUsage(cmd)}`, ""];
+      const commandDescription = helper.commandDescription(cmd);
+      if (commandDescription.length > 0) {
+        output = output.concat([
+          helper.wrap(commandDescription, helpWidth, 0),
+          ""
+        ]);
+      }
+      const argumentList = helper.visibleArguments(cmd).map((argument) => {
+        return formatItem(helper.argumentTerm(argument), helper.argumentDescription(argument));
+      });
+      if (argumentList.length > 0) {
+        output = output.concat(["Arguments:", formatList(argumentList), ""]);
+      }
+      const optionList = helper.visibleOptions(cmd).map((option) => {
+        return formatItem(helper.optionTerm(option), helper.optionDescription(option));
+      });
+      if (optionList.length > 0) {
+        output = output.concat(["Options:", formatList(optionList), ""]);
+      }
+      if (this.showGlobalOptions) {
+        const globalOptionList = helper.visibleGlobalOptions(cmd).map((option) => {
+          return formatItem(helper.optionTerm(option), helper.optionDescription(option));
+        });
+        if (globalOptionList.length > 0) {
+          output = output.concat([
+            "Global Options:",
+            formatList(globalOptionList),
+            ""
+          ]);
+        }
+      }
+      const commandList = helper.visibleCommands(cmd).map((cmd2) => {
+        return formatItem(helper.subcommandTerm(cmd2), helper.subcommandDescription(cmd2));
+      });
+      if (commandList.length > 0) {
+        output = output.concat(["Commands:", formatList(commandList), ""]);
+      }
+      return output.join(`
+`);
+    }
+    padWidth(cmd, helper) {
+      return Math.max(helper.longestOptionTermLength(cmd, helper), helper.longestGlobalOptionTermLength(cmd, helper), helper.longestSubcommandTermLength(cmd, helper), helper.longestArgumentTermLength(cmd, helper));
+    }
+    wrap(str, width, indent, minColumnWidth = 40) {
+      const indents = " \\f\\t\\v\xA0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF";
+      const manualIndent = new RegExp(`[\\n][${indents}]+`);
+      if (str.match(manualIndent))
+        return str;
+      const columnWidth = width - indent;
+      if (columnWidth < minColumnWidth)
+        return str;
+      const leadingStr = str.slice(0, indent);
+      const columnText = str.slice(indent).replace(`\r
+`, `
+`);
+      const indentString = " ".repeat(indent);
+      const zeroWidthSpace = "\u200B";
+      const breaks = `\\s${zeroWidthSpace}`;
+      const regex = new RegExp(`
+|.{1,${columnWidth - 1}}([${breaks}]|$)|[^${breaks}]+?([${breaks}]|$)`, "g");
+      const lines = columnText.match(regex) || [];
+      return leadingStr + lines.map((line, i) => {
+        if (line === `
+`)
+          return "";
+        return (i > 0 ? indentString : "") + line.trimEnd();
+      }).join(`
+`);
+    }
+  }
+  exports.Help = Help;
+});
+
+// node_modules/commander/lib/option.js
+var require_option = __commonJS((exports) => {
+  var { InvalidArgumentError } = require_error();
+
+  class Option {
+    constructor(flags, description) {
+      this.flags = flags;
+      this.description = description || "";
+      this.required = flags.includes("<");
+      this.optional = flags.includes("[");
+      this.variadic = /\w\.\.\.[>\]]$/.test(flags);
+      this.mandatory = false;
+      const optionFlags = splitOptionFlags(flags);
+      this.short = optionFlags.shortFlag;
+      this.long = optionFlags.longFlag;
+      this.negate = false;
+      if (this.long) {
+        this.negate = this.long.startsWith("--no-");
+      }
+      this.defaultValue = undefined;
+      this.defaultValueDescription = undefined;
+      this.presetArg = undefined;
+      this.envVar = undefined;
+      this.parseArg = undefined;
+      this.hidden = false;
+      this.argChoices = undefined;
+      this.conflictsWith = [];
+      this.implied = undefined;
+    }
+    default(value, description) {
+      this.defaultValue = value;
+      this.defaultValueDescription = description;
+      return this;
+    }
+    preset(arg) {
+      this.presetArg = arg;
+      return this;
+    }
+    conflicts(names) {
+      this.conflictsWith = this.conflictsWith.concat(names);
+      return this;
+    }
+    implies(impliedOptionValues) {
+      let newImplied = impliedOptionValues;
+      if (typeof impliedOptionValues === "string") {
+        newImplied = { [impliedOptionValues]: true };
+      }
+      this.implied = Object.assign(this.implied || {}, newImplied);
+      return this;
+    }
+    env(name) {
+      this.envVar = name;
+      return this;
+    }
+    argParser(fn) {
+      this.parseArg = fn;
+      return this;
+    }
+    makeOptionMandatory(mandatory = true) {
+      this.mandatory = !!mandatory;
+      return this;
+    }
+    hideHelp(hide = true) {
+      this.hidden = !!hide;
+      return this;
+    }
+    _concatValue(value, previous) {
+      if (previous === this.defaultValue || !Array.isArray(previous)) {
+        return [value];
+      }
+      return previous.concat(value);
+    }
+    choices(values) {
+      this.argChoices = values.slice();
+      this.parseArg = (arg, previous) => {
+        if (!this.argChoices.includes(arg)) {
+          throw new InvalidArgumentError(`Allowed choices are ${this.argChoices.join(", ")}.`);
+        }
+        if (this.variadic) {
+          return this._concatValue(arg, previous);
+        }
+        return arg;
+      };
+      return this;
+    }
+    name() {
+      if (this.long) {
+        return this.long.replace(/^--/, "");
+      }
+      return this.short.replace(/^-/, "");
+    }
+    attributeName() {
+      return camelcase(this.name().replace(/^no-/, ""));
+    }
+    is(arg) {
+      return this.short === arg || this.long === arg;
+    }
+    isBoolean() {
+      return !this.required && !this.optional && !this.negate;
+    }
+  }
+
+  class DualOptions {
+    constructor(options) {
+      this.positiveOptions = new Map;
+      this.negativeOptions = new Map;
+      this.dualOptions = new Set;
+      options.forEach((option) => {
+        if (option.negate) {
+          this.negativeOptions.set(option.attributeName(), option);
+        } else {
+          this.positiveOptions.set(option.attributeName(), option);
+        }
+      });
+      this.negativeOptions.forEach((value, key) => {
+        if (this.positiveOptions.has(key)) {
+          this.dualOptions.add(key);
+        }
+      });
+    }
+    valueFromOption(value, option) {
+      const optionKey = option.attributeName();
+      if (!this.dualOptions.has(optionKey))
+        return true;
+      const preset = this.negativeOptions.get(optionKey).presetArg;
+      const negativeValue = preset !== undefined ? preset : false;
+      return option.negate === (negativeValue === value);
+    }
+  }
+  function camelcase(str) {
+    return str.split("-").reduce((str2, word) => {
+      return str2 + word[0].toUpperCase() + word.slice(1);
+    });
+  }
+  function splitOptionFlags(flags) {
+    let shortFlag;
+    let longFlag;
+    const flagParts = flags.split(/[ |,]+/);
+    if (flagParts.length > 1 && !/^[[<]/.test(flagParts[1]))
+      shortFlag = flagParts.shift();
+    longFlag = flagParts.shift();
+    if (!shortFlag && /^-[^-]$/.test(longFlag)) {
+      shortFlag = longFlag;
+      longFlag = undefined;
+    }
+    return { shortFlag, longFlag };
+  }
+  exports.Option = Option;
+  exports.DualOptions = DualOptions;
+});
+
+// node_modules/commander/lib/suggestSimilar.js
+var require_suggestSimilar = __commonJS((exports) => {
+  var maxDistance = 3;
+  function editDistance(a, b) {
+    if (Math.abs(a.length - b.length) > maxDistance)
+      return Math.max(a.length, b.length);
+    const d = [];
+    for (let i = 0;i <= a.length; i++) {
+      d[i] = [i];
+    }
+    for (let j = 0;j <= b.length; j++) {
+      d[0][j] = j;
+    }
+    for (let j = 1;j <= b.length; j++) {
+      for (let i = 1;i <= a.length; i++) {
+        let cost = 1;
+        if (a[i - 1] === b[j - 1]) {
+          cost = 0;
+        } else {
+          cost = 1;
+        }
+        d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+        if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+          d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+        }
+      }
+    }
+    return d[a.length][b.length];
+  }
+  function suggestSimilar(word, candidates) {
+    if (!candidates || candidates.length === 0)
+      return "";
+    candidates = Array.from(new Set(candidates));
+    const searchingOptions = word.startsWith("--");
+    if (searchingOptions) {
+      word = word.slice(2);
+      candidates = candidates.map((candidate) => candidate.slice(2));
+    }
+    let similar = [];
+    let bestDistance = maxDistance;
+    const minSimilarity = 0.4;
+    candidates.forEach((candidate) => {
+      if (candidate.length <= 1)
+        return;
+      const distance = editDistance(word, candidate);
+      const length = Math.max(word.length, candidate.length);
+      const similarity = (length - distance) / length;
+      if (similarity > minSimilarity) {
+        if (distance < bestDistance) {
+          bestDistance = distance;
+          similar = [candidate];
+        } else if (distance === bestDistance) {
+          similar.push(candidate);
+        }
+      }
+    });
+    similar.sort((a, b) => a.localeCompare(b));
+    if (searchingOptions) {
+      similar = similar.map((candidate) => `--${candidate}`);
+    }
+    if (similar.length > 1) {
+      return `
+(Did you mean one of ${similar.join(", ")}?)`;
+    }
+    if (similar.length === 1) {
+      return `
+(Did you mean ${similar[0]}?)`;
+    }
+    return "";
+  }
+  exports.suggestSimilar = suggestSimilar;
+});
+
+// node_modules/commander/lib/command.js
+var require_command = __commonJS((exports) => {
+  var EventEmitter = __require("events").EventEmitter;
+  var childProcess = __require("child_process");
+  var path = __require("path");
+  var fs = __require("fs");
+  var process2 = __require("process");
+  var { Argument, humanReadableArgName } = require_argument();
+  var { CommanderError } = require_error();
+  var { Help } = require_help();
+  var { Option, DualOptions } = require_option();
+  var { suggestSimilar } = require_suggestSimilar();
+
+  class Command extends EventEmitter {
+    constructor(name) {
+      super();
+      this.commands = [];
+      this.options = [];
+      this.parent = null;
+      this._allowUnknownOption = false;
+      this._allowExcessArguments = true;
+      this.registeredArguments = [];
+      this._args = this.registeredArguments;
+      this.args = [];
+      this.rawArgs = [];
+      this.processedArgs = [];
+      this._scriptPath = null;
+      this._name = name || "";
+      this._optionValues = {};
+      this._optionValueSources = {};
+      this._storeOptionsAsProperties = false;
+      this._actionHandler = null;
+      this._executableHandler = false;
+      this._executableFile = null;
+      this._executableDir = null;
+      this._defaultCommandName = null;
+      this._exitCallback = null;
+      this._aliases = [];
+      this._combineFlagAndOptionalValue = true;
+      this._description = "";
+      this._summary = "";
+      this._argsDescription = undefined;
+      this._enablePositionalOptions = false;
+      this._passThroughOptions = false;
+      this._lifeCycleHooks = {};
+      this._showHelpAfterError = false;
+      this._showSuggestionAfterError = true;
+      this._outputConfiguration = {
+        writeOut: (str) => process2.stdout.write(str),
+        writeErr: (str) => process2.stderr.write(str),
+        getOutHelpWidth: () => process2.stdout.isTTY ? process2.stdout.columns : undefined,
+        getErrHelpWidth: () => process2.stderr.isTTY ? process2.stderr.columns : undefined,
+        outputError: (str, write) => write(str)
+      };
+      this._hidden = false;
+      this._helpOption = undefined;
+      this._addImplicitHelpCommand = undefined;
+      this._helpCommand = undefined;
+      this._helpConfiguration = {};
+    }
+    copyInheritedSettings(sourceCommand) {
+      this._outputConfiguration = sourceCommand._outputConfiguration;
+      this._helpOption = sourceCommand._helpOption;
+      this._helpCommand = sourceCommand._helpCommand;
+      this._helpConfiguration = sourceCommand._helpConfiguration;
+      this._exitCallback = sourceCommand._exitCallback;
+      this._storeOptionsAsProperties = sourceCommand._storeOptionsAsProperties;
+      this._combineFlagAndOptionalValue = sourceCommand._combineFlagAndOptionalValue;
+      this._allowExcessArguments = sourceCommand._allowExcessArguments;
+      this._enablePositionalOptions = sourceCommand._enablePositionalOptions;
+      this._showHelpAfterError = sourceCommand._showHelpAfterError;
+      this._showSuggestionAfterError = sourceCommand._showSuggestionAfterError;
+      return this;
+    }
+    _getCommandAndAncestors() {
+      const result = [];
+      for (let command = this;command; command = command.parent) {
+        result.push(command);
+      }
+      return result;
+    }
+    command(nameAndArgs, actionOptsOrExecDesc, execOpts) {
+      let desc = actionOptsOrExecDesc;
+      let opts = execOpts;
+      if (typeof desc === "object" && desc !== null) {
+        opts = desc;
+        desc = null;
+      }
+      opts = opts || {};
+      const [, name, args] = nameAndArgs.match(/([^ ]+) *(.*)/);
+      const cmd = this.createCommand(name);
+      if (desc) {
+        cmd.description(desc);
+        cmd._executableHandler = true;
+      }
+      if (opts.isDefault)
+        this._defaultCommandName = cmd._name;
+      cmd._hidden = !!(opts.noHelp || opts.hidden);
+      cmd._executableFile = opts.executableFile || null;
+      if (args)
+        cmd.arguments(args);
+      this._registerCommand(cmd);
+      cmd.parent = this;
+      cmd.copyInheritedSettings(this);
+      if (desc)
+        return this;
+      return cmd;
+    }
+    createCommand(name) {
+      return new Command(name);
+    }
+    createHelp() {
+      return Object.assign(new Help, this.configureHelp());
+    }
+    configureHelp(configuration) {
+      if (configuration === undefined)
+        return this._helpConfiguration;
+      this._helpConfiguration = configuration;
+      return this;
+    }
+    configureOutput(configuration) {
+      if (configuration === undefined)
+        return this._outputConfiguration;
+      Object.assign(this._outputConfiguration, configuration);
+      return this;
+    }
+    showHelpAfterError(displayHelp = true) {
+      if (typeof displayHelp !== "string")
+        displayHelp = !!displayHelp;
+      this._showHelpAfterError = displayHelp;
+      return this;
+    }
+    showSuggestionAfterError(displaySuggestion = true) {
+      this._showSuggestionAfterError = !!displaySuggestion;
+      return this;
+    }
+    addCommand(cmd, opts) {
+      if (!cmd._name) {
+        throw new Error(`Command passed to .addCommand() must have a name
+- specify the name in Command constructor or using .name()`);
+      }
+      opts = opts || {};
+      if (opts.isDefault)
+        this._defaultCommandName = cmd._name;
+      if (opts.noHelp || opts.hidden)
+        cmd._hidden = true;
+      this._registerCommand(cmd);
+      cmd.parent = this;
+      cmd._checkForBrokenPassThrough();
+      return this;
+    }
+    createArgument(name, description) {
+      return new Argument(name, description);
+    }
+    argument(name, description, fn, defaultValue) {
+      const argument = this.createArgument(name, description);
+      if (typeof fn === "function") {
+        argument.default(defaultValue).argParser(fn);
+      } else {
+        argument.default(fn);
+      }
+      this.addArgument(argument);
+      return this;
+    }
+    arguments(names) {
+      names.trim().split(/ +/).forEach((detail) => {
+        this.argument(detail);
+      });
+      return this;
+    }
+    addArgument(argument) {
+      const previousArgument = this.registeredArguments.slice(-1)[0];
+      if (previousArgument && previousArgument.variadic) {
+        throw new Error(`only the last argument can be variadic '${previousArgument.name()}'`);
+      }
+      if (argument.required && argument.defaultValue !== undefined && argument.parseArg === undefined) {
+        throw new Error(`a default value for a required argument is never used: '${argument.name()}'`);
+      }
+      this.registeredArguments.push(argument);
+      return this;
+    }
+    helpCommand(enableOrNameAndArgs, description) {
+      if (typeof enableOrNameAndArgs === "boolean") {
+        this._addImplicitHelpCommand = enableOrNameAndArgs;
+        return this;
+      }
+      enableOrNameAndArgs = enableOrNameAndArgs ?? "help [command]";
+      const [, helpName, helpArgs] = enableOrNameAndArgs.match(/([^ ]+) *(.*)/);
+      const helpDescription = description ?? "display help for command";
+      const helpCommand = this.createCommand(helpName);
+      helpCommand.helpOption(false);
+      if (helpArgs)
+        helpCommand.arguments(helpArgs);
+      if (helpDescription)
+        helpCommand.description(helpDescription);
+      this._addImplicitHelpCommand = true;
+      this._helpCommand = helpCommand;
+      return this;
+    }
+    addHelpCommand(helpCommand, deprecatedDescription) {
+      if (typeof helpCommand !== "object") {
+        this.helpCommand(helpCommand, deprecatedDescription);
+        return this;
+      }
+      this._addImplicitHelpCommand = true;
+      this._helpCommand = helpCommand;
+      return this;
+    }
+    _getHelpCommand() {
+      const hasImplicitHelpCommand = this._addImplicitHelpCommand ?? (this.commands.length && !this._actionHandler && !this._findCommand("help"));
+      if (hasImplicitHelpCommand) {
+        if (this._helpCommand === undefined) {
+          this.helpCommand(undefined, undefined);
+        }
+        return this._helpCommand;
+      }
+      return null;
+    }
+    hook(event, listener) {
+      const allowedValues = ["preSubcommand", "preAction", "postAction"];
+      if (!allowedValues.includes(event)) {
+        throw new Error(`Unexpected value for event passed to hook : '${event}'.
+Expecting one of '${allowedValues.join("', '")}'`);
+      }
+      if (this._lifeCycleHooks[event]) {
+        this._lifeCycleHooks[event].push(listener);
+      } else {
+        this._lifeCycleHooks[event] = [listener];
+      }
+      return this;
+    }
+    exitOverride(fn) {
+      if (fn) {
+        this._exitCallback = fn;
+      } else {
+        this._exitCallback = (err) => {
+          if (err.code !== "commander.executeSubCommandAsync") {
+            throw err;
+          }
+        };
+      }
+      return this;
+    }
+    _exit(exitCode, code, message) {
+      if (this._exitCallback) {
+        this._exitCallback(new CommanderError(exitCode, code, message));
+      }
+      process2.exit(exitCode);
+    }
+    action(fn) {
+      const listener = (args) => {
+        const expectedArgsCount = this.registeredArguments.length;
+        const actionArgs = args.slice(0, expectedArgsCount);
+        if (this._storeOptionsAsProperties) {
+          actionArgs[expectedArgsCount] = this;
+        } else {
+          actionArgs[expectedArgsCount] = this.opts();
+        }
+        actionArgs.push(this);
+        return fn.apply(this, actionArgs);
+      };
+      this._actionHandler = listener;
+      return this;
+    }
+    createOption(flags, description) {
+      return new Option(flags, description);
+    }
+    _callParseArg(target, value, previous, invalidArgumentMessage) {
+      try {
+        return target.parseArg(value, previous);
+      } catch (err) {
+        if (err.code === "commander.invalidArgument") {
+          const message = `${invalidArgumentMessage} ${err.message}`;
+          this.error(message, { exitCode: err.exitCode, code: err.code });
+        }
+        throw err;
+      }
+    }
+    _registerOption(option) {
+      const matchingOption = option.short && this._findOption(option.short) || option.long && this._findOption(option.long);
+      if (matchingOption) {
+        const matchingFlag = option.long && this._findOption(option.long) ? option.long : option.short;
+        throw new Error(`Cannot add option '${option.flags}'${this._name && ` to command '${this._name}'`} due to conflicting flag '${matchingFlag}'
+-  already used by option '${matchingOption.flags}'`);
+      }
+      this.options.push(option);
+    }
+    _registerCommand(command) {
+      const knownBy = (cmd) => {
+        return [cmd.name()].concat(cmd.aliases());
+      };
+      const alreadyUsed = knownBy(command).find((name) => this._findCommand(name));
+      if (alreadyUsed) {
+        const existingCmd = knownBy(this._findCommand(alreadyUsed)).join("|");
+        const newCmd = knownBy(command).join("|");
+        throw new Error(`cannot add command '${newCmd}' as already have command '${existingCmd}'`);
+      }
+      this.commands.push(command);
+    }
+    addOption(option) {
+      this._registerOption(option);
+      const oname = option.name();
+      const name = option.attributeName();
+      if (option.negate) {
+        const positiveLongFlag = option.long.replace(/^--no-/, "--");
+        if (!this._findOption(positiveLongFlag)) {
+          this.setOptionValueWithSource(name, option.defaultValue === undefined ? true : option.defaultValue, "default");
+        }
+      } else if (option.defaultValue !== undefined) {
+        this.setOptionValueWithSource(name, option.defaultValue, "default");
+      }
+      const handleOptionValue = (val, invalidValueMessage, valueSource) => {
+        if (val == null && option.presetArg !== undefined) {
+          val = option.presetArg;
+        }
+        const oldValue = this.getOptionValue(name);
+        if (val !== null && option.parseArg) {
+          val = this._callParseArg(option, val, oldValue, invalidValueMessage);
+        } else if (val !== null && option.variadic) {
+          val = option._concatValue(val, oldValue);
+        }
+        if (val == null) {
+          if (option.negate) {
+            val = false;
+          } else if (option.isBoolean() || option.optional) {
+            val = true;
+          } else {
+            val = "";
+          }
+        }
+        this.setOptionValueWithSource(name, val, valueSource);
+      };
+      this.on("option:" + oname, (val) => {
+        const invalidValueMessage = `error: option '${option.flags}' argument '${val}' is invalid.`;
+        handleOptionValue(val, invalidValueMessage, "cli");
+      });
+      if (option.envVar) {
+        this.on("optionEnv:" + oname, (val) => {
+          const invalidValueMessage = `error: option '${option.flags}' value '${val}' from env '${option.envVar}' is invalid.`;
+          handleOptionValue(val, invalidValueMessage, "env");
+        });
+      }
+      return this;
+    }
+    _optionEx(config, flags, description, fn, defaultValue) {
+      if (typeof flags === "object" && flags instanceof Option) {
+        throw new Error("To add an Option object use addOption() instead of option() or requiredOption()");
+      }
+      const option = this.createOption(flags, description);
+      option.makeOptionMandatory(!!config.mandatory);
+      if (typeof fn === "function") {
+        option.default(defaultValue).argParser(fn);
+      } else if (fn instanceof RegExp) {
+        const regex = fn;
+        fn = (val, def) => {
+          const m = regex.exec(val);
+          return m ? m[0] : def;
+        };
+        option.default(defaultValue).argParser(fn);
+      } else {
+        option.default(fn);
+      }
+      return this.addOption(option);
+    }
+    option(flags, description, parseArg, defaultValue) {
+      return this._optionEx({}, flags, description, parseArg, defaultValue);
+    }
+    requiredOption(flags, description, parseArg, defaultValue) {
+      return this._optionEx({ mandatory: true }, flags, description, parseArg, defaultValue);
+    }
+    combineFlagAndOptionalValue(combine = true) {
+      this._combineFlagAndOptionalValue = !!combine;
+      return this;
+    }
+    allowUnknownOption(allowUnknown = true) {
+      this._allowUnknownOption = !!allowUnknown;
+      return this;
+    }
+    allowExcessArguments(allowExcess = true) {
+      this._allowExcessArguments = !!allowExcess;
+      return this;
+    }
+    enablePositionalOptions(positional = true) {
+      this._enablePositionalOptions = !!positional;
+      return this;
+    }
+    passThroughOptions(passThrough = true) {
+      this._passThroughOptions = !!passThrough;
+      this._checkForBrokenPassThrough();
+      return this;
+    }
+    _checkForBrokenPassThrough() {
+      if (this.parent && this._passThroughOptions && !this.parent._enablePositionalOptions) {
+        throw new Error(`passThroughOptions cannot be used for '${this._name}' without turning on enablePositionalOptions for parent command(s)`);
+      }
+    }
+    storeOptionsAsProperties(storeAsProperties = true) {
+      if (this.options.length) {
+        throw new Error("call .storeOptionsAsProperties() before adding options");
+      }
+      if (Object.keys(this._optionValues).length) {
+        throw new Error("call .storeOptionsAsProperties() before setting option values");
+      }
+      this._storeOptionsAsProperties = !!storeAsProperties;
+      return this;
+    }
+    getOptionValue(key) {
+      if (this._storeOptionsAsProperties) {
+        return this[key];
+      }
+      return this._optionValues[key];
+    }
+    setOptionValue(key, value) {
+      return this.setOptionValueWithSource(key, value, undefined);
+    }
+    setOptionValueWithSource(key, value, source) {
+      if (this._storeOptionsAsProperties) {
+        this[key] = value;
+      } else {
+        this._optionValues[key] = value;
+      }
+      this._optionValueSources[key] = source;
+      return this;
+    }
+    getOptionValueSource(key) {
+      return this._optionValueSources[key];
+    }
+    getOptionValueSourceWithGlobals(key) {
+      let source;
+      this._getCommandAndAncestors().forEach((cmd) => {
+        if (cmd.getOptionValueSource(key) !== undefined) {
+          source = cmd.getOptionValueSource(key);
+        }
+      });
+      return source;
+    }
+    _prepareUserArgs(argv, parseOptions) {
+      if (argv !== undefined && !Array.isArray(argv)) {
+        throw new Error("first parameter to parse must be array or undefined");
+      }
+      parseOptions = parseOptions || {};
+      if (argv === undefined && parseOptions.from === undefined) {
+        if (process2.versions?.electron) {
+          parseOptions.from = "electron";
+        }
+        const execArgv = process2.execArgv ?? [];
+        if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
+          parseOptions.from = "eval";
+        }
+      }
+      if (argv === undefined) {
+        argv = process2.argv;
+      }
+      this.rawArgs = argv.slice();
+      let userArgs;
+      switch (parseOptions.from) {
+        case undefined:
+        case "node":
+          this._scriptPath = argv[1];
+          userArgs = argv.slice(2);
+          break;
+        case "electron":
+          if (process2.defaultApp) {
+            this._scriptPath = argv[1];
+            userArgs = argv.slice(2);
+          } else {
+            userArgs = argv.slice(1);
+          }
+          break;
+        case "user":
+          userArgs = argv.slice(0);
+          break;
+        case "eval":
+          userArgs = argv.slice(1);
+          break;
+        default:
+          throw new Error(`unexpected parse option { from: '${parseOptions.from}' }`);
+      }
+      if (!this._name && this._scriptPath)
+        this.nameFromFilename(this._scriptPath);
+      this._name = this._name || "program";
+      return userArgs;
+    }
+    parse(argv, parseOptions) {
+      const userArgs = this._prepareUserArgs(argv, parseOptions);
+      this._parseCommand([], userArgs);
+      return this;
+    }
+    async parseAsync(argv, parseOptions) {
+      const userArgs = this._prepareUserArgs(argv, parseOptions);
+      await this._parseCommand([], userArgs);
+      return this;
+    }
+    _executeSubCommand(subcommand, args) {
+      args = args.slice();
+      let launchWithNode = false;
+      const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
+      function findFile(baseDir, baseName) {
+        const localBin = path.resolve(baseDir, baseName);
+        if (fs.existsSync(localBin))
+          return localBin;
+        if (sourceExt.includes(path.extname(baseName)))
+          return;
+        const foundExt = sourceExt.find((ext) => fs.existsSync(`${localBin}${ext}`));
+        if (foundExt)
+          return `${localBin}${foundExt}`;
+        return;
+      }
+      this._checkForMissingMandatoryOptions();
+      this._checkForConflictingOptions();
+      let executableFile = subcommand._executableFile || `${this._name}-${subcommand._name}`;
+      let executableDir = this._executableDir || "";
+      if (this._scriptPath) {
+        let resolvedScriptPath;
+        try {
+          resolvedScriptPath = fs.realpathSync(this._scriptPath);
+        } catch (err) {
+          resolvedScriptPath = this._scriptPath;
+        }
+        executableDir = path.resolve(path.dirname(resolvedScriptPath), executableDir);
+      }
+      if (executableDir) {
+        let localFile = findFile(executableDir, executableFile);
+        if (!localFile && !subcommand._executableFile && this._scriptPath) {
+          const legacyName = path.basename(this._scriptPath, path.extname(this._scriptPath));
+          if (legacyName !== this._name) {
+            localFile = findFile(executableDir, `${legacyName}-${subcommand._name}`);
+          }
+        }
+        executableFile = localFile || executableFile;
+      }
+      launchWithNode = sourceExt.includes(path.extname(executableFile));
+      let proc;
+      if (process2.platform !== "win32") {
+        if (launchWithNode) {
+          args.unshift(executableFile);
+          args = incrementNodeInspectorPort(process2.execArgv).concat(args);
+          proc = childProcess.spawn(process2.argv[0], args, { stdio: "inherit" });
+        } else {
+          proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
+        }
+      } else {
+        args.unshift(executableFile);
+        args = incrementNodeInspectorPort(process2.execArgv).concat(args);
+        proc = childProcess.spawn(process2.execPath, args, { stdio: "inherit" });
+      }
+      if (!proc.killed) {
+        const signals = ["SIGUSR1", "SIGUSR2", "SIGTERM", "SIGINT", "SIGHUP"];
+        signals.forEach((signal) => {
+          process2.on(signal, () => {
+            if (proc.killed === false && proc.exitCode === null) {
+              proc.kill(signal);
+            }
+          });
+        });
+      }
+      const exitCallback = this._exitCallback;
+      proc.on("close", (code) => {
+        code = code ?? 1;
+        if (!exitCallback) {
+          process2.exit(code);
+        } else {
+          exitCallback(new CommanderError(code, "commander.executeSubCommandAsync", "(close)"));
+        }
+      });
+      proc.on("error", (err) => {
+        if (err.code === "ENOENT") {
+          const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
+          const executableMissing = `'${executableFile}' does not exist
+ - if '${subcommand._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
+ - if the default executable name is not suitable, use the executableFile option to supply a custom name or path
+ - ${executableDirMessage}`;
+          throw new Error(executableMissing);
+        } else if (err.code === "EACCES") {
+          throw new Error(`'${executableFile}' not executable`);
+        }
+        if (!exitCallback) {
+          process2.exit(1);
+        } else {
+          const wrappedError = new CommanderError(1, "commander.executeSubCommandAsync", "(error)");
+          wrappedError.nestedError = err;
+          exitCallback(wrappedError);
+        }
+      });
+      this.runningCommand = proc;
+    }
+    _dispatchSubcommand(commandName, operands, unknown) {
+      const subCommand = this._findCommand(commandName);
+      if (!subCommand)
+        this.help({ error: true });
+      let promiseChain;
+      promiseChain = this._chainOrCallSubCommandHook(promiseChain, subCommand, "preSubcommand");
+      promiseChain = this._chainOrCall(promiseChain, () => {
+        if (subCommand._executableHandler) {
+          this._executeSubCommand(subCommand, operands.concat(unknown));
+        } else {
+          return subCommand._parseCommand(operands, unknown);
+        }
+      });
+      return promiseChain;
+    }
+    _dispatchHelpCommand(subcommandName) {
+      if (!subcommandName) {
+        this.help();
+      }
+      const subCommand = this._findCommand(subcommandName);
+      if (subCommand && !subCommand._executableHandler) {
+        subCommand.help();
+      }
+      return this._dispatchSubcommand(subcommandName, [], [this._getHelpOption()?.long ?? this._getHelpOption()?.short ?? "--help"]);
+    }
+    _checkNumberOfArguments() {
+      this.registeredArguments.forEach((arg, i) => {
+        if (arg.required && this.args[i] == null) {
+          this.missingArgument(arg.name());
+        }
+      });
+      if (this.registeredArguments.length > 0 && this.registeredArguments[this.registeredArguments.length - 1].variadic) {
+        return;
+      }
+      if (this.args.length > this.registeredArguments.length) {
+        this._excessArguments(this.args);
+      }
+    }
+    _processArguments() {
+      const myParseArg = (argument, value, previous) => {
+        let parsedValue = value;
+        if (value !== null && argument.parseArg) {
+          const invalidValueMessage = `error: command-argument value '${value}' is invalid for argument '${argument.name()}'.`;
+          parsedValue = this._callParseArg(argument, value, previous, invalidValueMessage);
+        }
+        return parsedValue;
+      };
+      this._checkNumberOfArguments();
+      const processedArgs = [];
+      this.registeredArguments.forEach((declaredArg, index) => {
+        let value = declaredArg.defaultValue;
+        if (declaredArg.variadic) {
+          if (index < this.args.length) {
+            value = this.args.slice(index);
+            if (declaredArg.parseArg) {
+              value = value.reduce((processed, v) => {
+                return myParseArg(declaredArg, v, processed);
+              }, declaredArg.defaultValue);
+            }
+          } else if (value === undefined) {
+            value = [];
+          }
+        } else if (index < this.args.length) {
+          value = this.args[index];
+          if (declaredArg.parseArg) {
+            value = myParseArg(declaredArg, value, declaredArg.defaultValue);
+          }
+        }
+        processedArgs[index] = value;
+      });
+      this.processedArgs = processedArgs;
+    }
+    _chainOrCall(promise, fn) {
+      if (promise && promise.then && typeof promise.then === "function") {
+        return promise.then(() => fn());
+      }
+      return fn();
+    }
+    _chainOrCallHooks(promise, event) {
+      let result = promise;
+      const hooks = [];
+      this._getCommandAndAncestors().reverse().filter((cmd) => cmd._lifeCycleHooks[event] !== undefined).forEach((hookedCommand) => {
+        hookedCommand._lifeCycleHooks[event].forEach((callback) => {
+          hooks.push({ hookedCommand, callback });
+        });
+      });
+      if (event === "postAction") {
+        hooks.reverse();
+      }
+      hooks.forEach((hookDetail) => {
+        result = this._chainOrCall(result, () => {
+          return hookDetail.callback(hookDetail.hookedCommand, this);
+        });
+      });
+      return result;
+    }
+    _chainOrCallSubCommandHook(promise, subCommand, event) {
+      let result = promise;
+      if (this._lifeCycleHooks[event] !== undefined) {
+        this._lifeCycleHooks[event].forEach((hook) => {
+          result = this._chainOrCall(result, () => {
+            return hook(this, subCommand);
+          });
+        });
+      }
+      return result;
+    }
+    _parseCommand(operands, unknown) {
+      const parsed = this.parseOptions(unknown);
+      this._parseOptionsEnv();
+      this._parseOptionsImplied();
+      operands = operands.concat(parsed.operands);
+      unknown = parsed.unknown;
+      this.args = operands.concat(unknown);
+      if (operands && this._findCommand(operands[0])) {
+        return this._dispatchSubcommand(operands[0], operands.slice(1), unknown);
+      }
+      if (this._getHelpCommand() && operands[0] === this._getHelpCommand().name()) {
+        return this._dispatchHelpCommand(operands[1]);
+      }
+      if (this._defaultCommandName) {
+        this._outputHelpIfRequested(unknown);
+        return this._dispatchSubcommand(this._defaultCommandName, operands, unknown);
+      }
+      if (this.commands.length && this.args.length === 0 && !this._actionHandler && !this._defaultCommandName) {
+        this.help({ error: true });
+      }
+      this._outputHelpIfRequested(parsed.unknown);
+      this._checkForMissingMandatoryOptions();
+      this._checkForConflictingOptions();
+      const checkForUnknownOptions = () => {
+        if (parsed.unknown.length > 0) {
+          this.unknownOption(parsed.unknown[0]);
+        }
+      };
+      const commandEvent = `command:${this.name()}`;
+      if (this._actionHandler) {
+        checkForUnknownOptions();
+        this._processArguments();
+        let promiseChain;
+        promiseChain = this._chainOrCallHooks(promiseChain, "preAction");
+        promiseChain = this._chainOrCall(promiseChain, () => this._actionHandler(this.processedArgs));
+        if (this.parent) {
+          promiseChain = this._chainOrCall(promiseChain, () => {
+            this.parent.emit(commandEvent, operands, unknown);
+          });
+        }
+        promiseChain = this._chainOrCallHooks(promiseChain, "postAction");
+        return promiseChain;
+      }
+      if (this.parent && this.parent.listenerCount(commandEvent)) {
+        checkForUnknownOptions();
+        this._processArguments();
+        this.parent.emit(commandEvent, operands, unknown);
+      } else if (operands.length) {
+        if (this._findCommand("*")) {
+          return this._dispatchSubcommand("*", operands, unknown);
+        }
+        if (this.listenerCount("command:*")) {
+          this.emit("command:*", operands, unknown);
+        } else if (this.commands.length) {
+          this.unknownCommand();
+        } else {
+          checkForUnknownOptions();
+          this._processArguments();
+        }
+      } else if (this.commands.length) {
+        checkForUnknownOptions();
+        this.help({ error: true });
+      } else {
+        checkForUnknownOptions();
+        this._processArguments();
+      }
+    }
+    _findCommand(name) {
+      if (!name)
+        return;
+      return this.commands.find((cmd) => cmd._name === name || cmd._aliases.includes(name));
+    }
+    _findOption(arg) {
+      return this.options.find((option) => option.is(arg));
+    }
+    _checkForMissingMandatoryOptions() {
+      this._getCommandAndAncestors().forEach((cmd) => {
+        cmd.options.forEach((anOption) => {
+          if (anOption.mandatory && cmd.getOptionValue(anOption.attributeName()) === undefined) {
+            cmd.missingMandatoryOptionValue(anOption);
+          }
+        });
+      });
+    }
+    _checkForConflictingLocalOptions() {
+      const definedNonDefaultOptions = this.options.filter((option) => {
+        const optionKey = option.attributeName();
+        if (this.getOptionValue(optionKey) === undefined) {
+          return false;
+        }
+        return this.getOptionValueSource(optionKey) !== "default";
+      });
+      const optionsWithConflicting = definedNonDefaultOptions.filter((option) => option.conflictsWith.length > 0);
+      optionsWithConflicting.forEach((option) => {
+        const conflictingAndDefined = definedNonDefaultOptions.find((defined) => option.conflictsWith.includes(defined.attributeName()));
+        if (conflictingAndDefined) {
+          this._conflictingOption(option, conflictingAndDefined);
+        }
+      });
+    }
+    _checkForConflictingOptions() {
+      this._getCommandAndAncestors().forEach((cmd) => {
+        cmd._checkForConflictingLocalOptions();
+      });
+    }
+    parseOptions(argv) {
+      const operands = [];
+      const unknown = [];
+      let dest = operands;
+      const args = argv.slice();
+      function maybeOption(arg) {
+        return arg.length > 1 && arg[0] === "-";
+      }
+      let activeVariadicOption = null;
+      while (args.length) {
+        const arg = args.shift();
+        if (arg === "--") {
+          if (dest === unknown)
+            dest.push(arg);
+          dest.push(...args);
+          break;
+        }
+        if (activeVariadicOption && !maybeOption(arg)) {
+          this.emit(`option:${activeVariadicOption.name()}`, arg);
+          continue;
+        }
+        activeVariadicOption = null;
+        if (maybeOption(arg)) {
+          const option = this._findOption(arg);
+          if (option) {
+            if (option.required) {
+              const value = args.shift();
+              if (value === undefined)
+                this.optionMissingArgument(option);
+              this.emit(`option:${option.name()}`, value);
+            } else if (option.optional) {
+              let value = null;
+              if (args.length > 0 && !maybeOption(args[0])) {
+                value = args.shift();
+              }
+              this.emit(`option:${option.name()}`, value);
+            } else {
+              this.emit(`option:${option.name()}`);
+            }
+            activeVariadicOption = option.variadic ? option : null;
+            continue;
+          }
+        }
+        if (arg.length > 2 && arg[0] === "-" && arg[1] !== "-") {
+          const option = this._findOption(`-${arg[1]}`);
+          if (option) {
+            if (option.required || option.optional && this._combineFlagAndOptionalValue) {
+              this.emit(`option:${option.name()}`, arg.slice(2));
+            } else {
+              this.emit(`option:${option.name()}`);
+              args.unshift(`-${arg.slice(2)}`);
+            }
+            continue;
+          }
+        }
+        if (/^--[^=]+=/.test(arg)) {
+          const index = arg.indexOf("=");
+          const option = this._findOption(arg.slice(0, index));
+          if (option && (option.required || option.optional)) {
+            this.emit(`option:${option.name()}`, arg.slice(index + 1));
+            continue;
+          }
+        }
+        if (maybeOption(arg)) {
+          dest = unknown;
+        }
+        if ((this._enablePositionalOptions || this._passThroughOptions) && operands.length === 0 && unknown.length === 0) {
+          if (this._findCommand(arg)) {
+            operands.push(arg);
+            if (args.length > 0)
+              unknown.push(...args);
+            break;
+          } else if (this._getHelpCommand() && arg === this._getHelpCommand().name()) {
+            operands.push(arg);
+            if (args.length > 0)
+              operands.push(...args);
+            break;
+          } else if (this._defaultCommandName) {
+            unknown.push(arg);
+            if (args.length > 0)
+              unknown.push(...args);
+            break;
+          }
+        }
+        if (this._passThroughOptions) {
+          dest.push(arg);
+          if (args.length > 0)
+            dest.push(...args);
+          break;
+        }
+        dest.push(arg);
+      }
+      return { operands, unknown };
+    }
+    opts() {
+      if (this._storeOptionsAsProperties) {
+        const result = {};
+        const len = this.options.length;
+        for (let i = 0;i < len; i++) {
+          const key = this.options[i].attributeName();
+          result[key] = key === this._versionOptionName ? this._version : this[key];
+        }
+        return result;
+      }
+      return this._optionValues;
+    }
+    optsWithGlobals() {
+      return this._getCommandAndAncestors().reduce((combinedOptions, cmd) => Object.assign(combinedOptions, cmd.opts()), {});
+    }
+    error(message, errorOptions) {
+      this._outputConfiguration.outputError(`${message}
+`, this._outputConfiguration.writeErr);
+      if (typeof this._showHelpAfterError === "string") {
+        this._outputConfiguration.writeErr(`${this._showHelpAfterError}
+`);
+      } else if (this._showHelpAfterError) {
+        this._outputConfiguration.writeErr(`
+`);
+        this.outputHelp({ error: true });
+      }
+      const config = errorOptions || {};
+      const exitCode = config.exitCode || 1;
+      const code = config.code || "commander.error";
+      this._exit(exitCode, code, message);
+    }
+    _parseOptionsEnv() {
+      this.options.forEach((option) => {
+        if (option.envVar && option.envVar in process2.env) {
+          const optionKey = option.attributeName();
+          if (this.getOptionValue(optionKey) === undefined || ["default", "config", "env"].includes(this.getOptionValueSource(optionKey))) {
+            if (option.required || option.optional) {
+              this.emit(`optionEnv:${option.name()}`, process2.env[option.envVar]);
+            } else {
+              this.emit(`optionEnv:${option.name()}`);
+            }
+          }
+        }
+      });
+    }
+    _parseOptionsImplied() {
+      const dualHelper = new DualOptions(this.options);
+      const hasCustomOptionValue = (optionKey) => {
+        return this.getOptionValue(optionKey) !== undefined && !["default", "implied"].includes(this.getOptionValueSource(optionKey));
+      };
+      this.options.filter((option) => option.implied !== undefined && hasCustomOptionValue(option.attributeName()) && dualHelper.valueFromOption(this.getOptionValue(option.attributeName()), option)).forEach((option) => {
+        Object.keys(option.implied).filter((impliedKey) => !hasCustomOptionValue(impliedKey)).forEach((impliedKey) => {
+          this.setOptionValueWithSource(impliedKey, option.implied[impliedKey], "implied");
+        });
+      });
+    }
+    missingArgument(name) {
+      const message = `error: missing required argument '${name}'`;
+      this.error(message, { code: "commander.missingArgument" });
+    }
+    optionMissingArgument(option) {
+      const message = `error: option '${option.flags}' argument missing`;
+      this.error(message, { code: "commander.optionMissingArgument" });
+    }
+    missingMandatoryOptionValue(option) {
+      const message = `error: required option '${option.flags}' not specified`;
+      this.error(message, { code: "commander.missingMandatoryOptionValue" });
+    }
+    _conflictingOption(option, conflictingOption) {
+      const findBestOptionFromValue = (option2) => {
+        const optionKey = option2.attributeName();
+        const optionValue = this.getOptionValue(optionKey);
+        const negativeOption = this.options.find((target) => target.negate && optionKey === target.attributeName());
+        const positiveOption = this.options.find((target) => !target.negate && optionKey === target.attributeName());
+        if (negativeOption && (negativeOption.presetArg === undefined && optionValue === false || negativeOption.presetArg !== undefined && optionValue === negativeOption.presetArg)) {
+          return negativeOption;
+        }
+        return positiveOption || option2;
+      };
+      const getErrorMessage = (option2) => {
+        const bestOption = findBestOptionFromValue(option2);
+        const optionKey = bestOption.attributeName();
+        const source = this.getOptionValueSource(optionKey);
+        if (source === "env") {
+          return `environment variable '${bestOption.envVar}'`;
+        }
+        return `option '${bestOption.flags}'`;
+      };
+      const message = `error: ${getErrorMessage(option)} cannot be used with ${getErrorMessage(conflictingOption)}`;
+      this.error(message, { code: "commander.conflictingOption" });
+    }
+    unknownOption(flag) {
+      if (this._allowUnknownOption)
+        return;
+      let suggestion = "";
+      if (flag.startsWith("--") && this._showSuggestionAfterError) {
+        let candidateFlags = [];
+        let command = this;
+        do {
+          const moreFlags = command.createHelp().visibleOptions(command).filter((option) => option.long).map((option) => option.long);
+          candidateFlags = candidateFlags.concat(moreFlags);
+          command = command.parent;
+        } while (command && !command._enablePositionalOptions);
+        suggestion = suggestSimilar(flag, candidateFlags);
+      }
+      const message = `error: unknown option '${flag}'${suggestion}`;
+      this.error(message, { code: "commander.unknownOption" });
+    }
+    _excessArguments(receivedArgs) {
+      if (this._allowExcessArguments)
+        return;
+      const expected = this.registeredArguments.length;
+      const s = expected === 1 ? "" : "s";
+      const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
+      const message = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${receivedArgs.length}.`;
+      this.error(message, { code: "commander.excessArguments" });
+    }
+    unknownCommand() {
+      const unknownName = this.args[0];
+      let suggestion = "";
+      if (this._showSuggestionAfterError) {
+        const candidateNames = [];
+        this.createHelp().visibleCommands(this).forEach((command) => {
+          candidateNames.push(command.name());
+          if (command.alias())
+            candidateNames.push(command.alias());
+        });
+        suggestion = suggestSimilar(unknownName, candidateNames);
+      }
+      const message = `error: unknown command '${unknownName}'${suggestion}`;
+      this.error(message, { code: "commander.unknownCommand" });
+    }
+    version(str, flags, description) {
+      if (str === undefined)
+        return this._version;
+      this._version = str;
+      flags = flags || "-V, --version";
+      description = description || "output the version number";
+      const versionOption = this.createOption(flags, description);
+      this._versionOptionName = versionOption.attributeName();
+      this._registerOption(versionOption);
+      this.on("option:" + versionOption.name(), () => {
+        this._outputConfiguration.writeOut(`${str}
+`);
+        this._exit(0, "commander.version", str);
+      });
+      return this;
+    }
+    description(str, argsDescription) {
+      if (str === undefined && argsDescription === undefined)
+        return this._description;
+      this._description = str;
+      if (argsDescription) {
+        this._argsDescription = argsDescription;
+      }
+      return this;
+    }
+    summary(str) {
+      if (str === undefined)
+        return this._summary;
+      this._summary = str;
+      return this;
+    }
+    alias(alias) {
+      if (alias === undefined)
+        return this._aliases[0];
+      let command = this;
+      if (this.commands.length !== 0 && this.commands[this.commands.length - 1]._executableHandler) {
+        command = this.commands[this.commands.length - 1];
+      }
+      if (alias === command._name)
+        throw new Error("Command alias can't be the same as its name");
+      const matchingCommand = this.parent?._findCommand(alias);
+      if (matchingCommand) {
+        const existingCmd = [matchingCommand.name()].concat(matchingCommand.aliases()).join("|");
+        throw new Error(`cannot add alias '${alias}' to command '${this.name()}' as already have command '${existingCmd}'`);
+      }
+      command._aliases.push(alias);
+      return this;
+    }
+    aliases(aliases) {
+      if (aliases === undefined)
+        return this._aliases;
+      aliases.forEach((alias) => this.alias(alias));
+      return this;
+    }
+    usage(str) {
+      if (str === undefined) {
+        if (this._usage)
+          return this._usage;
+        const args = this.registeredArguments.map((arg) => {
+          return humanReadableArgName(arg);
+        });
+        return [].concat(this.options.length || this._helpOption !== null ? "[options]" : [], this.commands.length ? "[command]" : [], this.registeredArguments.length ? args : []).join(" ");
+      }
+      this._usage = str;
+      return this;
+    }
+    name(str) {
+      if (str === undefined)
+        return this._name;
+      this._name = str;
+      return this;
+    }
+    nameFromFilename(filename) {
+      this._name = path.basename(filename, path.extname(filename));
+      return this;
+    }
+    executableDir(path2) {
+      if (path2 === undefined)
+        return this._executableDir;
+      this._executableDir = path2;
+      return this;
+    }
+    helpInformation(contextOptions) {
+      const helper = this.createHelp();
+      if (helper.helpWidth === undefined) {
+        helper.helpWidth = contextOptions && contextOptions.error ? this._outputConfiguration.getErrHelpWidth() : this._outputConfiguration.getOutHelpWidth();
+      }
+      return helper.formatHelp(this, helper);
+    }
+    _getHelpContext(contextOptions) {
+      contextOptions = contextOptions || {};
+      const context = { error: !!contextOptions.error };
+      let write;
+      if (context.error) {
+        write = (arg) => this._outputConfiguration.writeErr(arg);
+      } else {
+        write = (arg) => this._outputConfiguration.writeOut(arg);
+      }
+      context.write = contextOptions.write || write;
+      context.command = this;
+      return context;
+    }
+    outputHelp(contextOptions) {
+      let deprecatedCallback;
+      if (typeof contextOptions === "function") {
+        deprecatedCallback = contextOptions;
+        contextOptions = undefined;
+      }
+      const context = this._getHelpContext(contextOptions);
+      this._getCommandAndAncestors().reverse().forEach((command) => command.emit("beforeAllHelp", context));
+      this.emit("beforeHelp", context);
+      let helpInformation = this.helpInformation(context);
+      if (deprecatedCallback) {
+        helpInformation = deprecatedCallback(helpInformation);
+        if (typeof helpInformation !== "string" && !Buffer.isBuffer(helpInformation)) {
+          throw new Error("outputHelp callback must return a string or a Buffer");
+        }
+      }
+      context.write(helpInformation);
+      if (this._getHelpOption()?.long) {
+        this.emit(this._getHelpOption().long);
+      }
+      this.emit("afterHelp", context);
+      this._getCommandAndAncestors().forEach((command) => command.emit("afterAllHelp", context));
+    }
+    helpOption(flags, description) {
+      if (typeof flags === "boolean") {
+        if (flags) {
+          this._helpOption = this._helpOption ?? undefined;
+        } else {
+          this._helpOption = null;
+        }
+        return this;
+      }
+      flags = flags ?? "-h, --help";
+      description = description ?? "display help for command";
+      this._helpOption = this.createOption(flags, description);
+      return this;
+    }
+    _getHelpOption() {
+      if (this._helpOption === undefined) {
+        this.helpOption(undefined, undefined);
+      }
+      return this._helpOption;
+    }
+    addHelpOption(option) {
+      this._helpOption = option;
+      return this;
+    }
+    help(contextOptions) {
+      this.outputHelp(contextOptions);
+      let exitCode = process2.exitCode || 0;
+      if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
+        exitCode = 1;
+      }
+      this._exit(exitCode, "commander.help", "(outputHelp)");
+    }
+    addHelpText(position, text) {
+      const allowedValues = ["beforeAll", "before", "after", "afterAll"];
+      if (!allowedValues.includes(position)) {
+        throw new Error(`Unexpected value for position to addHelpText.
+Expecting one of '${allowedValues.join("', '")}'`);
+      }
+      const helpEvent = `${position}Help`;
+      this.on(helpEvent, (context) => {
+        let helpStr;
+        if (typeof text === "function") {
+          helpStr = text({ error: context.error, command: context.command });
+        } else {
+          helpStr = text;
+        }
+        if (helpStr) {
+          context.write(`${helpStr}
+`);
+        }
+      });
+      return this;
+    }
+    _outputHelpIfRequested(args) {
+      const helpOption = this._getHelpOption();
+      const helpRequested = helpOption && args.find((arg) => helpOption.is(arg));
+      if (helpRequested) {
+        this.outputHelp();
+        this._exit(0, "commander.helpDisplayed", "(outputHelp)");
+      }
+    }
+  }
+  function incrementNodeInspectorPort(args) {
+    return args.map((arg) => {
+      if (!arg.startsWith("--inspect")) {
+        return arg;
+      }
+      let debugOption;
+      let debugHost = "127.0.0.1";
+      let debugPort = "9229";
+      let match;
+      if ((match = arg.match(/^(--inspect(-brk)?)$/)) !== null) {
+        debugOption = match[1];
+      } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
+        debugOption = match[1];
+        if (/^\d+$/.test(match[3])) {
+          debugPort = match[3];
+        } else {
+          debugHost = match[3];
+        }
+      } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
+        debugOption = match[1];
+        debugHost = match[3];
+        debugPort = match[4];
+      }
+      if (debugOption && debugPort !== "0") {
+        return `${debugOption}=${debugHost}:${parseInt(debugPort) + 1}`;
+      }
+      return arg;
+    });
+  }
+  exports.Command = Command;
+});
+
+// node_modules/commander/index.js
+var require_commander = __commonJS((exports) => {
+  var { Argument } = require_argument();
+  var { Command } = require_command();
+  var { CommanderError, InvalidArgumentError } = require_error();
+  var { Help } = require_help();
+  var { Option } = require_option();
+  exports.program = new Command;
+  exports.createCommand = (name) => new Command(name);
+  exports.createOption = (flags, description) => new Option(flags, description);
+  exports.createArgument = (name, description) => new Argument(name, description);
+  exports.Command = Command;
+  exports.Option = Option;
+  exports.Argument = Argument;
+  exports.Help = Help;
+  exports.CommanderError = CommanderError;
+  exports.InvalidArgumentError = InvalidArgumentError;
+  exports.InvalidOptionArgumentError = InvalidArgumentError;
+});
+
+// node_modules/commander/esm.mjs
+var import__ = __toESM(require_commander(), 1);
+var {
+  program,
+  createCommand,
+  createArgument,
+  createOption,
+  CommanderError,
+  InvalidArgumentError,
+  InvalidOptionArgumentError,
+  Command,
+  Argument,
+  Option,
+  Help
+} = import__.default;
+
+// src/server/maintenance-entry.ts
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "fs";
+import { createHash as createHash3 } from "crypto";
+
+// src/server/execution-grant-store.ts
+import { randomUUID } from "crypto";
+function next(p, id, grants, expected) {
+  return {
+    schema: "hasna.skills-execution-grants.v1",
+    profileId: id,
+    workspaceId: p.orgId,
+    revision: randomUUID(),
+    previousRevision: expected,
+    updatedAt: new Date().toISOString(),
+    actorId: p.userId,
+    grants: structuredClone(grants)
+  };
+}
+function document(row) {
+  return row ? typeof row.document_json === "string" ? JSON.parse(row.document_json) : structuredClone(row.document_json) : null;
+}
+
+class MemoryExecutionGrantStore {
+  current = new Map;
+  history = new Map;
+  async get(p, id, revision) {
+    return structuredClone((revision ? this.history.get(JSON.stringify([p.orgId, id, revision])) : this.current.get(JSON.stringify([p.orgId, id]))) ?? null);
+  }
+  async save(p, id, grants, expected) {
+    const key = JSON.stringify([p.orgId, id]);
+    if ((this.current.get(key)?.revision ?? null) !== expected)
+      return null;
+    const value = next(p, id, grants, expected);
+    this.current.set(key, value);
+    this.history.set(JSON.stringify([p.orgId, id, value.revision]), value);
+    return structuredClone(value);
+  }
+}
+
+class SqliteExecutionGrantStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async get(p, id, revision) {
+    return document(revision ? this.db.query("SELECT document_json FROM skills_execution_grant_revisions WHERE org_id=? AND profile_id=? AND revision=?").get(p.orgId, id, revision) : this.db.query("SELECT document_json FROM skills_execution_grants WHERE org_id=? AND profile_id=?").get(p.orgId, id));
+  }
+  async save(p, id, grants, expected) {
+    return this.db.transaction(() => {
+      const value = next(p, id, grants, expected), json = JSON.stringify(value);
+      const row = expected === null ? this.db.query("INSERT INTO skills_execution_grants(org_id,profile_id,revision,document_json) VALUES(?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING document_json").get(p.orgId, id, value.revision, json) : this.db.query("UPDATE skills_execution_grants SET revision=?,document_json=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING document_json").get(value.revision, json, p.orgId, id, expected);
+      if (!row)
+        return null;
+      this.db.query("INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) VALUES(?,?,?,?)").run(p.orgId, id, value.revision, json);
+      return document(row);
+    })();
+  }
+}
+
+class PostgresExecutionGrantStore {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async get(p, id, revision) {
+    const rows = revision ? await this.sql`SELECT document_json FROM skills_execution_grant_revisions WHERE org_id=${p.orgId} AND profile_id=${id} AND revision=${revision}` : await this.sql`SELECT document_json FROM skills_execution_grants WHERE org_id=${p.orgId} AND profile_id=${id}`;
+    return document(rows[0]);
+  }
+  async save(p, id, grants, expected) {
+    const value = next(p, id, grants, expected), json = JSON.stringify(value);
+    const rows = expected === null ? await this.sql`WITH changed AS (INSERT INTO skills_execution_grants(org_id,profile_id,revision,document_json) VALUES(${p.orgId},${id},${value.revision},${json}::jsonb) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *) INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) SELECT org_id,profile_id,revision,document_json FROM changed RETURNING document_json` : await this.sql`WITH changed AS (UPDATE skills_execution_grants SET revision=${value.revision},document_json=${json}::jsonb WHERE org_id=${p.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *) INSERT INTO skills_execution_grant_revisions(org_id,profile_id,revision,document_json) SELECT org_id,profile_id,revision,document_json FROM changed RETURNING document_json`;
+    return document(rows[0]);
+  }
+}
+
+// src/server/store.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
+// src/server/selection-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function selections(value) {
+  return typeof value === "string" ? JSON.parse(value) : structuredClone(value);
+}
+function time(value) {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+function profile(row) {
+  return {
+    id: String(row.profile_id),
+    workspaceId: String(row.org_id),
+    revision: String(row.revision),
+    selections: selections(row.selections_json),
+    updatedAt: time(row.updated_at)
+  };
+}
+function state(row) {
+  return {
+    stationId: String(row.station_id),
+    workspaceId: String(row.org_id),
+    actorId: String(row.actor_id),
+    profileId: String(row.profile_id),
+    profileRevision: String(row.profile_revision),
+    selections: selections(row.selections_json),
+    appliedAt: time(row.applied_at)
+  };
+}
+
+class MemorySkillSelectionStore {
+  profiles = new Map;
+  states = new Map;
+  key(...values) {
+    return JSON.stringify(values);
+  }
+  async getProfile(p, id) {
+    return structuredClone(this.profiles.get(this.key(p.orgId, id)) ?? null);
+  }
+  async profilesReferencingSkill(p, slug) {
+    return [...this.profiles.values()].filter((profile2) => profile2.workspaceId === p.orgId && profile2.selections.some((selection) => selection.slug === slug)).map((profile2) => profile2.id).sort();
+  }
+  async saveProfile(p, id, selected, expected) {
+    const key = this.key(p.orgId, id), previous = this.profiles.get(key);
+    if ((previous?.revision ?? null) !== expected)
+      return null;
+    const next2 = {
+      id,
+      workspaceId: p.orgId,
+      revision: randomUUID2(),
+      selections: structuredClone(selected),
+      updatedAt: new Date().toISOString()
+    };
+    this.profiles.set(key, next2);
+    return structuredClone(next2);
+  }
+  async getStationState(p, id) {
+    return structuredClone(this.states.get(this.key(p.orgId, p.userId, id)) ?? null);
+  }
+  async saveStationState(p, id, input) {
+    if (this.profiles.get(this.key(p.orgId, input.profileId))?.revision !== input.profileRevision)
+      return null;
+    const next2 = {
+      ...structuredClone(input),
+      stationId: id,
+      workspaceId: p.orgId,
+      actorId: p.userId,
+      appliedAt: new Date().toISOString()
+    };
+    this.states.set(this.key(p.orgId, p.userId, id), next2);
+    return structuredClone(next2);
+  }
+}
+
+class SqliteSkillSelectionStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async profilesReferencingSkill(p, slug) {
+    const rows = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(p.orgId);
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
+  async getProfile(p, id) {
+    const row = this.db.query("SELECT * FROM skills_profiles WHERE org_id=? AND profile_id=?").get(p.orgId, id);
+    return row ? profile(row) : null;
+  }
+  async saveProfile(p, id, selected, expected) {
+    return this.db.transaction(() => {
+      for (const selection of [...selected].sort((a, b) => a.slug.localeCompare(b.slug))) {
+        const skill = this.db.query("SELECT lifecycle FROM skills_registry WHERE org_id=? AND slug=?").get(p.orgId, selection.slug);
+        if (skill?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const row = expected === null ? this.db.query("INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(?,?,?,?,?) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *").get(p.orgId, id, revision, JSON.stringify(selected), timestamp) : this.db.query("UPDATE skills_profiles SET revision=?,selections_json=?,updated_at=? WHERE org_id=? AND profile_id=? AND revision=? RETURNING *").get(revision, JSON.stringify(selected), timestamp, p.orgId, id, expected);
+      return row ? profile(row) : null;
+    }).immediate();
+  }
+  async getStationState(p, id) {
+    const row = this.db.query("SELECT * FROM skills_station_state WHERE org_id=? AND actor_id=? AND station_id=?").get(p.orgId, p.userId, id);
+    return row ? state(row) : null;
+  }
+  async saveStationState(p, id, input) {
+    const row = this.db.query(`INSERT INTO skills_station_state(org_id,actor_id,station_id,profile_id,profile_revision,selections_json,applied_at)
+      SELECT ?,?,?,?,?,?,? WHERE EXISTS(SELECT 1 FROM skills_profiles WHERE org_id=? AND profile_id=? AND revision=?)
+      ON CONFLICT(org_id,actor_id,station_id) DO UPDATE SET profile_id=excluded.profile_id,profile_revision=excluded.profile_revision,selections_json=excluded.selections_json,applied_at=excluded.applied_at RETURNING *`).get(p.orgId, p.userId, id, input.profileId, input.profileRevision, JSON.stringify(input.selections), new Date().toISOString(), p.orgId, input.profileId, input.profileRevision);
+    return row ? state(row) : null;
+  }
+}
+
+class PostgresSkillSelectionStore {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async profilesReferencingSkill(p, slug) {
+    const rows = await this.sql`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${p.orgId}`;
+    return rows.filter((row) => selections(row.selections_json).some((selection) => selection.slug === slug)).map((row) => String(row.profile_id)).sort();
+  }
+  async getProfile(p, id) {
+    const rows = await this.sql`SELECT * FROM skills_profiles WHERE org_id=${p.orgId} AND profile_id=${id}`;
+    return rows[0] ? profile(rows[0]) : null;
+  }
+  async saveProfile(p, id, selected, expected) {
+    return this.sql.begin(async (tx) => {
+      for (const selection of [...selected].sort((a, b) => a.slug.localeCompare(b.slug))) {
+        const rows2 = await tx`SELECT lifecycle FROM skills_registry WHERE org_id=${p.orgId} AND slug=${selection.slug} FOR UPDATE`;
+        if (rows2[0]?.lifecycle === "archived")
+          return null;
+      }
+      const revision = randomUUID2(), timestamp = new Date().toISOString();
+      const rows = expected === null ? await tx`INSERT INTO skills_profiles(org_id,profile_id,revision,selections_json,updated_at) VALUES(${p.orgId},${id},${revision},${JSON.stringify(selected)}::jsonb,${timestamp}) ON CONFLICT(org_id,profile_id) DO NOTHING RETURNING *` : await tx`UPDATE skills_profiles SET revision=${revision},selections_json=${JSON.stringify(selected)}::jsonb,updated_at=${timestamp} WHERE org_id=${p.orgId} AND profile_id=${id} AND revision=${expected} RETURNING *`;
+      return rows[0] ? profile(rows[0]) : null;
+    });
+  }
+  async getStationState(p, id) {
+    const rows = await this.sql`SELECT * FROM skills_station_state WHERE org_id=${p.orgId} AND actor_id=${p.userId} AND station_id=${id}`;
+    return rows[0] ? state(rows[0]) : null;
+  }
+  async saveStationState(p, id, input) {
+    const rows = await this.sql`INSERT INTO skills_station_state(org_id,actor_id,station_id,profile_id,profile_revision,selections_json,applied_at)
+      SELECT ${p.orgId},${p.userId},${id},${input.profileId},${input.profileRevision},${JSON.stringify(input.selections)}::jsonb,${new Date().toISOString()}
+      WHERE EXISTS(SELECT 1 FROM skills_profiles WHERE org_id=${p.orgId} AND profile_id=${input.profileId} AND revision=${input.profileRevision})
+      ON CONFLICT(org_id,actor_id,station_id) DO UPDATE SET profile_id=excluded.profile_id,profile_revision=excluded.profile_revision,selections_json=excluded.selections_json,applied_at=excluded.applied_at RETURNING *`;
+    return rows[0] ? state(rows[0]) : null;
+  }
+}
+
+// src/server/types.ts
+class StaleLeaseGenerationError extends Error {
+  runId;
+  expectedGeneration;
+  currentGeneration;
+  status;
+  constructor(runId, expectedGeneration, currentGeneration, status) {
+    super(`late transition rejected for run ${runId}: expected lease_generation ${expectedGeneration}, ` + `current ${currentGeneration} (status ${status})`);
+    this.name = "StaleLeaseGenerationError";
+    this.runId = runId;
+    this.expectedGeneration = expectedGeneration;
+    this.currentGeneration = currentGeneration;
+    this.status = status;
+  }
+}
+
+class SkillRevisionConflictError extends Error {
+  slug;
+  expectedRevisionId;
+  currentRevisionId;
+  constructor(slug, expectedRevisionId, currentRevisionId) {
+    super(`revision conflict for '${slug}': expected revision ${expectedRevisionId ?? "(none)"}, ` + `current is ${currentRevisionId ?? "(none)"}. Refused rather than silently overwriting a newer revision.`);
+    this.name = "SkillRevisionConflictError";
+    this.slug = slug;
+    this.expectedRevisionId = expectedRevisionId;
+    this.currentRevisionId = currentRevisionId;
+  }
+}
+
+class SkillVersionExistsError extends Error {
+  slug;
+  version;
+  existingSha256;
+  attemptedSha256;
+  constructor(slug, version, existingSha256, attemptedSha256) {
+    super(`version conflict for '${slug}@${version}': already published with bundle ${existingSha256}, ` + `refusing to overwrite it with ${attemptedSha256}. Publish a new version instead.`);
+    this.slug = slug;
+    this.version = version;
+    this.existingSha256 = existingSha256;
+    this.attemptedSha256 = attemptedSha256;
+    this.name = "SkillVersionExistsError";
+  }
+}
+
+class SkillLifecycleConflictError extends Error {
+  slug;
+  profiles;
+  constructor(slug, profiles) {
+    super(`cannot archive '${slug}' while active profiles reference it: ${profiles.join(", ")}`);
+    this.slug = slug;
+    this.profiles = profiles;
+    this.name = "SkillLifecycleConflictError";
+  }
+}
+function validOperatorScopeEnrollmentInput(input) {
+  const bounded = (value, max = 256) => typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+  return bounded(input.keyId) && bounded(input.stationId) && bounded(input.orgId) && bounded(input.operationId) && bounded(input.manifestDigest, 64) && /^[a-f0-9]{64}$/.test(input.manifestDigest) && bounded(input.operatorJobId) && bounded(input.operatorTaskArn, 512) && input.expectedScopes.length > 0 && input.expectedScopes.length <= 32 && input.expectedScopes.every((scope) => bounded(scope, 128) && /^[a-z][a-z0-9_-]*:[a-z][a-z0-9_-]*$/.test(scope));
+}
+function validOperatorScopeList(scopes) {
+  return Array.isArray(scopes) && scopes.length <= 32 && scopes.every((scope) => typeof scope === "string" && scope.length > 0 && scope.length <= 128 && /^[a-z][a-z0-9_-]*:[a-z][a-z0-9_-]*$/.test(scope));
+}
+
+// src/server/auth.ts
+import { createHash } from "crypto";
+function hashApiKey(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function publicPrincipal(partial = {}) {
+  return {
+    apiKeyId: partial.apiKeyId || "key_dev",
+    orgId: partial.orgId || "org_dev",
+    orgSlug: partial.orgSlug || "dev",
+    orgName: partial.orgName || "Development",
+    userId: partial.userId || "user_dev",
+    email: partial.email || "dev@example.com",
+    role: partial.role || "owner",
+    scopes: partial.scopes ?? ["*"]
+  };
+}
+
+// src/server/database-url.ts
+import { isAbsolute, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/config.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync } from "fs";
+
+// src/lib/retired-settings.ts
+var RETIRED_CONFIG_KEY_REASONS = {
+  mode: "Deployment modes were removed: a Skills client either resolves a credential " + "or it does not, and that is the whole of it.",
+  apiUrl: "The service address is no longer kept in this app's config file: it is read from " + "HASNA_SKILLS_API_URL, then the macOS Keychain item hasna.credentials.skills.api-url, " + "then ~/.hasna/skills/config/credentials, then the fleet gateway."
+};
+
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_DATA_ENV = "HASNA_DATA_HOME";
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverDataBaseDir(options) {
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_DATA_ENV];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  return platform === "darwin" ? pathsResolverJoin(home, "Library", "Application Support", "Hasna") : pathsResolverJoin(home, ".local", "share", "hasna");
+}
+function dataDir(options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverDataBaseDir(options), appSegment);
+}
+var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
+var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
+var SKILLS_HOME_ENV = "SKILLS_HOME";
+var DEFAULT_SQLITE_FILENAME = "server.db";
+var GLOBAL_CONFIG_FILENAME = "config.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
+}
+function legacyDataRoot() {
+  return join(effectiveHome(), ".hasna", "skills");
+}
+function resolverDataRoot(home = effectiveHome(), env) {
+  return dataDir({ app: "skills", home, env });
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
+}
+function exactDataRoot() {
+  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
+    const dir = process.env[key]?.trim();
+    if (dir)
+      return resolve(dir);
+  }
+  return;
+}
+function getDataRoot() {
+  const exact = exactDataRoot();
+  if (exact)
+    return exact;
+  const resolved = resolverDataRoot();
+  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
+}
+// src/lib/config.ts
+function getDataDir() {
+  const root = getDataRoot();
+  try {
+    mkdirSync(root, { recursive: true });
+  } catch {}
+  return root;
+}
+
+// src/server/database-url.ts
+var DEFAULT_SQLITE_FILENAME2 = "server.db";
+var SQLITE_MEMORY_PATH = ":memory:";
+var POSTGRES_SCHEMES = new Set(["postgres", "postgresql"]);
+var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
+var MEMORY_SCHEMES = new Set(["memory"]);
+var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
+function defaultSqlitePath() {
+  return join2(getDataDir(), DEFAULT_SQLITE_FILENAME2);
+}
+function resolveDatabaseTarget(raw) {
+  const value = raw?.trim();
+  if (!value) {
+    const path = defaultSqlitePath();
+    return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
+  }
+  if (value === SQLITE_MEMORY_PATH) {
+    return { kind: "sqlite", path: SQLITE_MEMORY_PATH, durable: false, label: "sqlite (in-memory)" };
+  }
+  const schemeMatch = value.match(/^([a-z][a-z0-9+.-]+):/i);
+  const scheme = schemeMatch?.[1]?.toLowerCase();
+  if (scheme && POSTGRES_SCHEMES.has(scheme)) {
+    return { kind: "postgres", url: value, durable: true, label: "postgres" };
+  }
+  if (scheme && MEMORY_SCHEMES.has(scheme)) {
+    return { kind: "memory", durable: false, label: "memory (non-durable)" };
+  }
+  if (scheme && SQLITE_SCHEMES.has(scheme)) {
+    const path = sqlitePathFromUrl(value, scheme);
+    return path === SQLITE_MEMORY_PATH ? { kind: "sqlite", path, durable: false, label: "sqlite (in-memory)" } : { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
+  }
+  if (scheme) {
+    throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
+  }
+  if (looksLikeSqlitePath(value)) {
+    const path = isAbsolute(value) ? value : join2(process.cwd(), value);
+    return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
+  }
+  throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
+}
+function sqlitePathFromUrl(value, scheme) {
+  const rest = value.slice(scheme.length + 1).replace(/[?#].*$/, "");
+  if (rest.startsWith(SQLITE_MEMORY_PATH))
+    return SQLITE_MEMORY_PATH;
+  if (rest === "" || rest === "//") {
+    throw new Error(`"${value}" names no database file. Give a path (${scheme}:///var/lib/skills/server.db), ` + `or ":memory:" if a non-durable database is genuinely what you want. ` + "An empty path here usually means an unset variable in a templated URL.");
+  }
+  if (rest.startsWith("//")) {
+    if (!rest.startsWith("///")) {
+      const authority = rest.slice(2).split("/")[0];
+      throw new Error(`"${value}" has a host ("${authority}") where a path was expected. Remote SQLite files are not a thing; ` + `for an absolute path use ${scheme}:///${rest.slice(2)}, and for a relative one use ${scheme}:${rest.slice(2)}.`);
+    }
+    if (scheme === "file") {
+      try {
+        return fileURLToPath(new URL(value));
+      } catch {}
+    }
+    return rest.slice(2).replace(/^\/\/+/, "/");
+  }
+  return isAbsolute(rest) ? rest : join2(process.cwd(), rest);
+}
+function looksLikeSqlitePath(value) {
+  if (value.includes("/"))
+    return true;
+  return SQLITE_EXTENSIONS.some((extension) => value.toLowerCase().endsWith(extension));
+}
+
+// src/server/rows.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
+// src/lib/skill-bundle.ts
+var BLOCK = 512;
+var ANY_SEGMENT_EXCLUDES = new Set([
+  ".git",
+  ".ds_store",
+  ".system",
+  "node_modules",
+  ".aws",
+  ".ssh",
+  ".gnupg",
+  ".docker"
+]);
+var ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+var TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json", ".skills-dependency-preparation"]);
+var CREDENTIAL_FILENAMES = new Set([
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  ".envrc",
+  ".pgpass",
+  ".git-credentials",
+  "credentials",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519"
+]);
+var ENV_TEMPLATE_NAMES = new Set([".env.example", ".env.sample", ".env.template", ".env.dist"]);
+var NON_DOTENV_EXTENSIONS = new Set([
+  "ts",
+  "tsx",
+  "mts",
+  "cts",
+  "js",
+  "jsx",
+  "mjs",
+  "cjs",
+  "json",
+  "jsonc",
+  "json5",
+  "py",
+  "rb",
+  "go",
+  "rs",
+  "java",
+  "kt",
+  "kts",
+  "swift",
+  "c",
+  "h",
+  "cc",
+  "cpp",
+  "hpp",
+  "cs",
+  "php",
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "ps1",
+  "bat",
+  "cmd",
+  "lua",
+  "pl",
+  "pm",
+  "r",
+  "jl",
+  "dart",
+  "ex",
+  "exs",
+  "scala",
+  "clj",
+  "cljs",
+  "groovy",
+  "gradle",
+  "vb",
+  "fs",
+  "yaml",
+  "yml",
+  "toml",
+  "ini",
+  "xml",
+  "csv",
+  "tsv",
+  "html",
+  "htm",
+  "css",
+  "scss",
+  "sass",
+  "less",
+  "md",
+  "mdx",
+  "txt",
+  "rst",
+  "adoc",
+  "sql",
+  "graphql",
+  "gql",
+  "proto",
+  "d",
+  "png",
+  "jpg",
+  "jpeg",
+  "gif",
+  "svg",
+  "webp",
+  "ico",
+  "bmp",
+  "pdf",
+  "woff",
+  "woff2",
+  "ttf",
+  "otf",
+  "eot",
+  "mp3",
+  "mp4",
+  "wav",
+  "webm",
+  "zip",
+  "gz",
+  "tar",
+  "wasm"
+]);
+function ownBytes(view) {
+  const source = view instanceof ArrayBuffer ? new Uint8Array(view) : view;
+  const out = new Uint8Array(new ArrayBuffer(source.byteLength));
+  out.set(source);
+  return out;
+}
+var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+  compressedBytes: 16 * 1024 * 1024,
+  decompressedBytes: 64 * 1024 * 1024,
+  entries: 1024,
+  fileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  timeoutMs: 5000
+});
+
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
+
+// src/server/rows.ts
+function nowIso() {
+  return new Date().toISOString();
+}
+function normalizeLimit(limit) {
+  return Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : 0;
+}
+function runId() {
+  return `run_${Date.now().toString(36)}_${randomUUID3().slice(0, 8)}`;
+}
+function rowToRun(row) {
+  return {
+    id: String(row.id),
+    orgId: String(row.org_id),
+    userId: String(row.user_id),
+    skill: String(row.skill_slug),
+    requestedSlug: String(row.requested_slug),
+    status: String(row.status),
+    input: parseJsonObject(row.input_json),
+    args: parseJsonArray(row.args_json),
+    ...typeof row.idempotency_key === "string" ? { idempotencyKey: row.idempotency_key } : {},
+    correlationId: String(row.correlation_id),
+    costCents: Number(row.cost_cents ?? 0),
+    leaseGeneration: Number(row.lease_generation ?? 0),
+    ...typeof row.output_type === "string" ? { outputType: row.output_type } : {},
+    ...typeof row.output_preview === "string" ? { outputPreview: row.output_preview } : {},
+    ...typeof row.error_code === "string" ? { errorCode: row.error_code } : {},
+    ...typeof row.error_message === "string" ? { errorMessage: row.error_message } : {},
+    createdAt: dateString(row.created_at),
+    ...row.started_at ? { startedAt: dateString(row.started_at) } : {},
+    ...row.completed_at ? { completedAt: dateString(row.completed_at) } : {}
+  };
+}
+function rowToLog(row) {
+  return {
+    runId: String(row.run_id),
+    sequence: Number(row.sequence),
+    level: String(row.level),
+    message: String(row.message),
+    createdAt: dateString(row.created_at)
+  };
+}
+function rowToArtifact(row) {
+  return {
+    id: String(row.id),
+    runId: String(row.run_id),
+    orgId: String(row.org_id),
+    fileName: String(row.file_name),
+    relativePath: String(row.relative_path),
+    contentType: String(row.content_type),
+    byteSize: Number(row.byte_size),
+    sha256: String(row.sha256),
+    storageKind: String(row.storage_kind),
+    ...typeof row.storage_key === "string" ? { storageKey: row.storage_key } : {},
+    ...typeof row.body_text === "string" ? { bodyText: row.body_text } : {},
+    visibility: String(row.visibility ?? "private") === "public" ? "public" : "private",
+    ...row.expires_at ? { expiresAt: dateString(row.expires_at) } : {},
+    createdAt: dateString(row.created_at)
+  };
+}
+function rowToSkill(row) {
+  return {
+    orgId: String(row.org_id),
+    slug: String(row.slug),
+    displayName: String(row.display_name),
+    description: String(row.description ?? ""),
+    category: String(row.category),
+    tags: parseJsonArray(row.tags_json),
+    source: String(row.source),
+    kind: String(row.kind) === "instruction" ? "instruction" : "executable",
+    ...typeof row.version === "string" ? { version: row.version } : {},
+    ...typeof row.skill_md === "string" ? { skillMd: row.skill_md } : {},
+    ...typeof row.bundle_sha256 === "string" ? { bundleSha256: row.bundle_sha256 } : {},
+    ...row.bundle_byte_size === null || row.bundle_byte_size === undefined ? {} : { bundleByteSize: Number(row.bundle_byte_size) },
+    ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
+    createdAt: dateString(row.created_at),
+    updatedAt: dateString(row.updated_at),
+    revisionId: String(row.revision_id ?? ""),
+    revisionNumber: Number(row.revision_number ?? 0),
+    ...row.tombstoned_at ? { tombstonedAt: dateString(row.tombstoned_at) } : {},
+    ...row.tombstone_purge_after ? { tombstonePurgeAfter: dateString(row.tombstone_purge_after) } : {},
+    lifecycle: row.lifecycle === "archived" ? "archived" : "active",
+    ...row.archived_at ? { archivedAt: dateString(row.archived_at) } : {},
+    ...row.archive_reason ? { archiveReason: String(row.archive_reason) } : {},
+    ...row.replacement_slug ? { replacementSlug: String(row.replacement_slug) } : {}
+  };
+}
+function rowToPin(row) {
+  return {
+    orgId: String(row.org_id),
+    principal: String(row.principal),
+    slug: String(row.slug),
+    pinnedAt: dateString(row.pinned_at),
+    metadata: parseJsonObject(row.metadata_json)
+  };
+}
+function rowToSkillBundle(row) {
+  return {
+    orgId: String(row.org_id),
+    sha256: String(row.sha256),
+    byteSize: Number(row.byte_size),
+    contentType: String(row.content_type),
+    storageKind: String(row.storage_kind),
+    ...typeof row.storage_key === "string" ? { storageKey: row.storage_key } : {},
+    ...toBytes(row.body_blob) ? { bytes: toBytes(row.body_blob) } : {},
+    createdAt: dateString(row.created_at)
+  };
+}
+function toBytes(value) {
+  if (value == null)
+    return null;
+  if (value instanceof Uint8Array)
+    return ownBytes(value);
+  if (value instanceof ArrayBuffer)
+    return ownBytes(value);
+  return null;
+}
+function parseJsonObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {}
+  }
+  return {};
+}
+function parseJsonArray(value) {
+  const parsed = typeof value === "string" ? safeParse(value) : value;
+  return Array.isArray(parsed) ? parsed.map(String) : [];
+}
+function safeParse(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return;
+  }
+}
+function dateString(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  return String(value);
+}
+function rowToSkillVersion(row) {
+  return {
+    orgId: String(row.org_id),
+    slug: String(row.slug),
+    version: String(row.version),
+    bundleSha256: String(row.bundle_sha256),
+    bundleByteSize: Number(row.bundle_byte_size),
+    storageKind: String(row.storage_kind ?? "db"),
+    ...typeof row.storage_key === "string" ? { storageKey: row.storage_key } : {},
+    manifest: parseJsonObject(row.manifest_json),
+    ...typeof row.published_by_user_id === "string" ? { publishedByUserId: row.published_by_user_id } : {},
+    createdAt: dateString(row.created_at)
+  };
+}
+
+// src/lib/revision.ts
+import { createHash as createHash2 } from "crypto";
+function revisionIdOf(content) {
+  const canonicalContent = {
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical = JSON.stringify(canonicalContent);
+  return createHash2("sha256").update(canonical).digest("hex");
+}
+function revisionIdOfRecord(record) {
+  return revisionIdOf(record);
+}
+
+// src/server/sqlite-store.ts
+import { Database } from "bun:sqlite";
+import { randomUUID as randomUUID4 } from "crypto";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+
+// src/server/migrations-dir.ts
+import { existsSync as existsSync3 } from "fs";
+import { dirname, join as join3 } from "path";
+var MIGRATION_DIALECTS = ["postgres", "sqlite"];
+var MAX_WALK_UP = 6;
+function findMigrationsRoot(startDirs = defaultStartDirs()) {
+  for (const start of startDirs) {
+    let dir = start;
+    for (let level = 0;level < MAX_WALK_UP; level += 1) {
+      const candidate = join3(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync3(join3(candidate, dialect))))
+        return candidate;
+      const parent = dirname(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  }
+  return null;
+}
+function resolveMigrationsDir(dialect, root = findMigrationsRoot()) {
+  if (!root) {
+    throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
+  }
+  const dir = join3(root, dialect);
+  if (!existsSync3(dir)) {
+    throw new Error(`migrations directory not found: ${dir}`);
+  }
+  return dir;
+}
+function defaultStartDirs() {
+  const dirs = [import.meta.dir];
+  const cwd = process.cwd();
+  if (cwd && cwd !== import.meta.dir)
+    dirs.push(cwd);
+  return dirs;
+}
+
+// src/server/sqlite-store.ts
+var CLAIM_ATTEMPTS = 8;
+var CLAIMABLE_STATUSES = ["queued", "retrying"];
+var NO_REVISION_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
+var LAST_USED_RESOLUTION_MS = 60000;
+
+class SqliteSkillsStore {
+  get selectionStore() {
+    return new SqliteSkillSelectionStore(this.db);
+  }
+  get executionGrantStore() {
+    return new SqliteExecutionGrantStore(this.db);
+  }
+  backend;
+  db;
+  closed = false;
+  constructor(path = SQLITE_MEMORY_PATH, options = {}) {
+    const inMemory = path === SQLITE_MEMORY_PATH;
+    if (!inMemory)
+      mkdirSync2(dirname2(path), { recursive: true });
+    this.db = openDatabase(path);
+    this.db.exec(`PRAGMA busy_timeout = ${Math.max(0, options.busyTimeoutMs ?? 5000)}`);
+    if (!inMemory)
+      enableWalMode(this.db);
+    this.db.exec("PRAGMA foreign_keys = ON");
+    this.db.exec("PRAGMA synchronous = NORMAL");
+    if (options.migrate !== false) {
+      applySqliteMigrations(this.db, options.migrationsDir);
+    }
+    this.backfillLegacyRevisions();
+    this.backend = {
+      kind: "sqlite",
+      durable: !inMemory,
+      label: inMemory ? "sqlite (in-memory)" : `sqlite (${path})`
+    };
+  }
+  backfillLegacyRevisions() {
+    const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
+        revisionIdOfRecord(record),
+        record.orgId,
+        record.slug
+      ]);
+    }
+  }
+  get database() {
+    return this.db;
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.db.close(false);
+  }
+  async ensureBootstrapApiKey(token, principal) {
+    const resolved = publicPrincipal(principal);
+    this.db.transaction(() => {
+      this.db.run(`INSERT INTO organizations (id, slug, name) VALUES (?, ?, ?)
+         ON CONFLICT (id) DO UPDATE SET slug = excluded.slug, name = excluded.name`, [resolved.orgId, resolved.orgSlug, resolved.orgName]);
+      this.db.run(`INSERT INTO users (id, email, name) VALUES (?, ?, ?)
+         ON CONFLICT (id) DO UPDATE SET email = excluded.email`, [resolved.userId, resolved.email, resolved.email]);
+      this.db.run(`INSERT INTO organization_members (org_id, user_id, role) VALUES (?, ?, ?)
+         ON CONFLICT (org_id, user_id) DO UPDATE SET role = excluded.role`, [resolved.orgId, resolved.userId, resolved.role]);
+      this.db.run(`INSERT INTO api_keys (id, org_id, user_id, name, key_hash, scopes_json)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (key_hash) DO NOTHING`, [resolved.apiKeyId, resolved.orgId, resolved.userId, "bootstrap", hashApiKey(token), JSON.stringify(resolved.scopes)]);
+    })();
+  }
+  async authenticateApiKeyHash(hash) {
+    const row = this.get(`SELECT k.id AS api_key_id, k.scopes_json, k.last_used_at, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
+              u.id AS user_id, u.email, m.role
+       FROM api_keys k
+       JOIN organizations o ON o.id = k.org_id
+       JOIN users u ON u.id = k.user_id
+       LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
+       WHERE k.key_hash = ? AND k.revoked_at IS NULL
+       LIMIT 1`, [hash]);
+    if (!row)
+      return null;
+    const lastUsed = typeof row.last_used_at === "string" ? Date.parse(row.last_used_at) : Number.NaN;
+    if (!Number.isFinite(lastUsed) || Date.now() - lastUsed >= LAST_USED_RESOLUTION_MS) {
+      this.db.run("UPDATE api_keys SET last_used_at = ? WHERE id = ?", [nowIso(), String(row.api_key_id)]);
+    }
+    return {
+      apiKeyId: String(row.api_key_id),
+      orgId: String(row.org_id),
+      orgSlug: String(row.org_slug),
+      orgName: String(row.org_name),
+      userId: String(row.user_id),
+      email: String(row.email),
+      role: typeof row.role === "string" ? row.role : "member",
+      scopes: parseScopes(row.scopes_json)
+    };
+  }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    const row = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+    if (!row)
+      return { kind: "not_found" };
+    const current = parseScopes(row.scopes_json);
+    if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+      return { kind: "stale", scopes: current };
+    }
+    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    const tx = this.db.transaction(() => {
+      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), keyId, actor.orgId, JSON.stringify(expectedScopes)]);
+      if (changed.changes !== 1)
+        return false;
+      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json) VALUES (?, ?, ?, ?, ?, ?, ?)", [actor.orgId, actor.userId, actor.apiKeyId, "api_key_scopes_added", "api_key", keyId, JSON.stringify({ added: addScopes, scopes })]);
+      return true;
+    });
+    if (!tx()) {
+      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [keyId, actor.orgId]);
+      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
+    }
+    return { kind: "updated", scopes };
+  }
+  async enrollPublishScopeByOperator(input) {
+    if (!validOperatorScopeEnrollmentInput(input))
+      return { kind: "invalid" };
+    if (input.expectedScopes.includes("skills:publish"))
+      return { kind: "stale", scopes: input.expectedScopes };
+    const operation = this.get("SELECT org_id, target_id FROM skills_audit_events WHERE action = ? AND operator_operation_id = ? LIMIT 1", ["api_key_scopes_added", input.operationId]);
+    if (operation && (String(operation.org_id) !== input.orgId || String(operation.target_id) !== input.keyId))
+      return { kind: "target_mismatch" };
+    const row = this.get("SELECT id, org_id, name, scopes_json FROM api_keys WHERE id = ? AND revoked_at IS NULL LIMIT 1", [input.keyId]);
+    if (!row)
+      return { kind: "not_found" };
+    if (String(row.org_id) !== input.orgId)
+      return { kind: "target_mismatch" };
+    const current = parseScopes(row.scopes_json);
+    const prior = this.get("SELECT metadata_json FROM skills_audit_events WHERE action = ? AND target_type = ? AND target_id = ? AND json_extract(metadata_json, '$.operator_operation_id') = ? LIMIT 1", ["api_key_scopes_added", "api_key", input.keyId, input.operationId]);
+    if (prior) {
+      try {
+        if (JSON.parse(String(prior.metadata_json)).target_manifest_digest !== input.manifestDigest)
+          return { kind: "target_mismatch" };
+      } catch {
+        return { kind: "target_mismatch" };
+      }
+      return current.includes("skills:publish") ? { kind: "already_applied", scopes: current } : { kind: "stale", scopes: current };
+    }
+    if (current.length !== input.expectedScopes.length || current.some((scope, index) => scope !== input.expectedScopes[index]))
+      return { kind: "stale", scopes: current };
+    const scopes = [...current, "skills:publish"];
+    const tx = this.db.transaction(() => {
+      const changed = this.db.run("UPDATE api_keys SET scopes_json = ? WHERE id = ? AND org_id = ? AND revoked_at IS NULL AND scopes_json = ?", [JSON.stringify(scopes), input.keyId, input.orgId, JSON.stringify(input.expectedScopes)]);
+      if (changed.changes !== 1)
+        return false;
+      this.db.run("INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, operator_operation_id, metadata_json) VALUES (?, NULL, NULL, ?, ?, ?, ?, ?)", [input.orgId, "api_key_scopes_added", "api_key", input.keyId, input.operationId, JSON.stringify({ added: ["skills:publish"], scopes, operator_operation_id: input.operationId, operator_job_id: input.operatorJobId, operator_task_arn: input.operatorTaskArn, target_manifest_digest: input.manifestDigest, station_id: input.stationId })]);
+      return true;
+    });
+    if (!tx()) {
+      const latest = this.get("SELECT scopes_json FROM api_keys WHERE id = ? AND org_id = ? AND revoked_at IS NULL LIMIT 1", [input.keyId, input.orgId]);
+      return { kind: "stale", scopes: latest ? parseScopes(latest.scopes_json) : current };
+    }
+    return { kind: "updated", scopes };
+  }
+  async inspectOperatorScopeTarget(keyId, orgId) {
+    const row = this.get("SELECT org_id, scopes_json FROM api_keys WHERE id = ? AND revoked_at IS NULL LIMIT 1", [keyId]);
+    if (!row)
+      return { kind: "not_found" };
+    if (String(row.org_id) !== orgId)
+      return { kind: "target_mismatch" };
+    return { kind: "found", scopes: parseScopes(row.scopes_json) };
+  }
+  async createRun(input) {
+    if (input.idempotencyKey) {
+      const existing = this.get("SELECT * FROM skills_runs WHERE org_id = ? AND idempotency_key = ? LIMIT 1", [input.principal.orgId, input.idempotencyKey]);
+      if (existing)
+        return rowToRun(existing);
+    }
+    const row = this.get(`INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       RETURNING *`, [
+      runId(),
+      input.principal.orgId,
+      input.principal.userId,
+      input.slug,
+      input.slug,
+      "queued",
+      JSON.stringify(input.input),
+      JSON.stringify(input.args),
+      input.idempotencyKey ?? null,
+      randomUUID4(),
+      nowIso()
+    ]);
+    return rowToRun(row);
+  }
+  async listRuns(principal, limit) {
+    return this.all("SELECT * FROM skills_runs WHERE org_id = ? ORDER BY created_at DESC, rowid DESC LIMIT ?", [principal.orgId, normalizeLimit(limit)]).map(rowToRun);
+  }
+  async getRun(principal, id) {
+    const row = this.get("SELECT * FROM skills_runs WHERE id = ? AND org_id = ? LIMIT 1", [id, principal.orgId]);
+    return row ? rowToRun(row) : null;
+  }
+  async claimNextRun(input) {
+    const lost = new Set;
+    for (let attempt = 0;attempt < CLAIM_ATTEMPTS; attempt += 1) {
+      const claimed = this.claimOnce(input.workerId, lost);
+      if (claimed === "empty")
+        return null;
+      if (claimed)
+        return claimed;
+    }
+    return null;
+  }
+  claimOnce(workerId, lost) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const excluded = [...lost];
+      const candidate = this.get(`SELECT id FROM skills_runs
+         WHERE status IN (${CLAIMABLE_STATUSES.map(() => "?").join(", ")})
+           ${excluded.length ? `AND id NOT IN (${excluded.map(() => "?").join(", ")})` : ""}
+         ORDER BY created_at ASC, rowid ASC
+         LIMIT 1`, [...CLAIMABLE_STATUSES, ...excluded]);
+      if (!candidate) {
+        this.db.exec("COMMIT");
+        return "empty";
+      }
+      const id = String(candidate.id);
+      const now = nowIso();
+      const result = this.db.run(`UPDATE skills_runs
+         SET status = 'running', started_at = COALESCE(started_at, ?), locked_by = ?, locked_at = ?,
+             lease_generation = lease_generation + 1
+         WHERE id = ? AND status IN (${CLAIMABLE_STATUSES.map(() => "?").join(", ")})`, [now, workerId, now, id, ...CLAIMABLE_STATUSES]);
+      if (result.changes !== 1) {
+        this.db.exec("ROLLBACK");
+        lost.add(id);
+        return null;
+      }
+      const row = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
+      if (!row) {
+        this.db.exec("ROLLBACK");
+        throw new Error(`claimed run ${id} vanished within its own transaction; refusing to report a lost claim as an empty queue`);
+      }
+      this.db.exec("COMMIT");
+      return rowToRun(row);
+    } catch (error) {
+      this.rollbackQuietly();
+      throw error;
+    }
+  }
+  async updateRun(id, patch) {
+    const current = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
+    if (!current)
+      return null;
+    const run = { ...rowToRun(current), ...patch };
+    const row = this.get(`UPDATE skills_runs
+       SET status = ?, output_type = ?, output_preview = ?, error_code = ?, error_message = ?, started_at = ?, completed_at = ?
+       WHERE id = ?
+       RETURNING *`, [
+      run.status,
+      run.outputType ?? null,
+      run.outputPreview ?? null,
+      run.errorCode ?? null,
+      run.errorMessage ?? null,
+      run.startedAt ?? null,
+      run.completedAt ?? null,
+      id
+    ]);
+    return row ? rowToRun(row) : null;
+  }
+  async transitionRun(id, patch, expectedGeneration) {
+    const current = this.get("SELECT * FROM skills_runs WHERE id = ? LIMIT 1", [id]);
+    if (!current)
+      return null;
+    const stored = rowToRun(current);
+    if (stored.leaseGeneration !== expectedGeneration) {
+      throw new StaleLeaseGenerationError(id, expectedGeneration, stored.leaseGeneration, stored.status);
+    }
+    const run = { ...stored, ...patch };
+    const row = this.get(`UPDATE skills_runs
+       SET status = ?, output_type = ?, output_preview = ?, error_code = ?, error_message = ?, started_at = ?, completed_at = ?,
+           lease_generation = ?
+       WHERE id = ? AND lease_generation = ?
+       RETURNING *`, [
+      run.status,
+      run.outputType ?? null,
+      run.outputPreview ?? null,
+      run.errorCode ?? null,
+      run.errorMessage ?? null,
+      run.startedAt ?? null,
+      run.completedAt ?? null,
+      run.leaseGeneration,
+      id,
+      expectedGeneration
+    ]);
+    return row ? rowToRun(row) : null;
+  }
+  async appendLog(id, orgId, level, message) {
+    const row = this.get(`INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message, created_at)
+       VALUES (?, ?, (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ?), ?, ?, ?)
+       RETURNING *`, [id, orgId, id, level, message, nowIso()]);
+    return rowToLog(row);
+  }
+  async listLogs(principal, id) {
+    return this.all(`SELECT l.* FROM skills_run_logs l
+       JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ?
+       WHERE l.run_id = ?
+       ORDER BY l.sequence ASC`, [principal.orgId, id]).map(rowToLog);
+  }
+  async addArtifact(artifact) {
+    const row = this.get(`INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       RETURNING *`, [
+      artifact.id,
+      artifact.runId,
+      artifact.orgId,
+      artifact.fileName,
+      artifact.relativePath,
+      artifact.contentType,
+      artifact.byteSize,
+      artifact.sha256,
+      artifact.storageKind,
+      artifact.storageKey ?? null,
+      artifact.bodyText ?? null,
+      artifact.visibility,
+      artifact.expiresAt ?? null,
+      nowIso()
+    ]);
+    return rowToArtifact(row);
+  }
+  async listArtifacts(principal, id) {
+    return this.all(`SELECT a.* FROM skills_artifacts a
+       JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ?
+       WHERE a.run_id = ?
+       ORDER BY a.created_at ASC, a.rowid ASC`, [principal.orgId, id]).map(rowToArtifact);
+  }
+  async getArtifact(principal, id, artifact) {
+    const row = this.get(`SELECT a.* FROM skills_artifacts a
+       JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ?
+       WHERE a.run_id = ? AND a.id = ?
+       LIMIT 1`, [principal.orgId, id, artifact]);
+    return row ? rowToArtifact(row) : null;
+  }
+  async publishSkill(input) {
+    const orgId = input.principal.orgId;
+    const now = nowIso();
+    return this.db.transaction(() => {
+      const previous = this.get("SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? previous.bundle_sha256 : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? previous.revision_id : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+      }
+      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? previous.skill_md : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      if (input.version && carriedSha) {
+        const existingVersion = this.get("SELECT bundle_sha256 FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [orgId, input.slug, input.version]);
+        const existingSha = typeof existingVersion?.bundle_sha256 === "string" ? existingVersion.bundle_sha256 : null;
+        if (existingSha && existingSha !== carriedSha) {
+          throw new SkillVersionExistsError(input.slug, input.version, existingSha, carriedSha);
+        }
+      }
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
+      if (input.bundle) {
+        this.db.run(`INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT (org_id, sha256) DO UPDATE SET
+             byte_size = excluded.byte_size,
+             content_type = excluded.content_type,
+             storage_kind = excluded.storage_kind,
+             storage_key = excluded.storage_key,
+             body_blob = excluded.body_blob`, [
+          orgId,
+          input.bundle.sha256,
+          input.bundle.byteSize,
+          input.bundle.contentType,
+          input.bundle.storageKind,
+          input.bundle.storageKey ?? null,
+          input.bundle.bytes ?? null,
+          now
+        ]);
+      }
+      const row = this.get(`INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
+                                      bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
+         ON CONFLICT (org_id, slug) DO UPDATE SET
+           display_name = excluded.display_name,
+           description = excluded.description,
+           category = excluded.category,
+           tags_json = excluded.tags_json,
+           source = excluded.source,
+           kind = excluded.kind,
+           version = excluded.version,
+           skill_md = excluded.skill_md,
+           -- COALESCE, not a straight assignment. A publish that carries no bundle is a
+           -- metadata update, not an instruction to discard the stored one: the plain
+           -- assignment nulled bundle_sha256 and then handed the old digest to orphan
+           -- collection, so re-publishing metadata over an existing skill deleted its
+           -- tarball and left every client with a 404.
+           bundle_sha256 = COALESCE(excluded.bundle_sha256, skills_registry.bundle_sha256),
+           bundle_byte_size = COALESCE(excluded.bundle_byte_size, skills_registry.bundle_byte_size),
+           published_by_user_id = excluded.published_by_user_id,
+           revision_id = excluded.revision_id,
+           -- Current + 1, not the inserted 1: on the update path the ACTUAL row's
+           -- counter is the truth (it may have advanced since the pre-read, which is
+           -- exactly what the WHERE guard below detects).
+           revision_number = skills_registry.revision_number + 1,
+           tombstoned_at = NULL,
+           tombstone_purge_after = NULL,
+           updated_at = excluded.updated_at
+         WHERE (skills_registry.tombstoned_at IS NOT NULL OR skills_registry.revision_id = ?)
+           AND (? = 0 OR (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
+             AND skills_registry.revision_id = ?))
+         RETURNING *`, [
+        orgId,
+        input.slug,
+        input.displayName,
+        input.description,
+        input.category,
+        JSON.stringify(input.tags),
+        input.source,
+        input.kind,
+        input.version ?? null,
+        carriedSkillMd,
+        input.bundle?.sha256 ?? null,
+        input.bundle?.byteSize ?? null,
+        input.principal.userId,
+        revisionId,
+        now,
+        now,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL,
+        input.seedBundledOnly ? 1 : 0,
+        input.expectedRevisionId ?? NO_REVISION_SENTINEL
+      ]);
+      if (!row) {
+        const current = this.get("SELECT revision_id FROM skills_registry WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+        const currentId = typeof current?.revision_id === "string" ? current.revision_id : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
+      if (input.version && carriedSha) {
+        this.db.run(`INSERT OR IGNORE INTO skills_versions (org_id, slug, version, bundle_sha256, bundle_byte_size, storage_kind, storage_key, manifest_json, published_by_user_id, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+          orgId,
+          input.slug,
+          input.version,
+          carriedSha,
+          carriedSize ?? 0,
+          input.versionStorage?.storageKind ?? "db",
+          input.versionStorage?.storageKey ?? null,
+          JSON.stringify(input.versionManifest ?? {}),
+          input.principal.userId ?? null,
+          now
+        ]);
+      }
+      if (previousSha && input.bundle && previousSha !== input.bundle.sha256)
+        this.collectOrphanBundle(orgId, previousSha);
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [orgId, input.slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(orgId, input.slug, tag);
+      }
+      return rowToSkill(row);
+    })();
+  }
+  async listSkills(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map(rowToSkill);
+  }
+  async getSkill(principal, slug) {
+    const row = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+    return row ? rowToSkill(row) : null;
+  }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.db.transaction(() => {
+      const rowCurrent = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+      const current = rowCurrent ? rowToSkill(rowCurrent) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = this.db.query("SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=?").all(principal.orgId);
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = { ...current, lifecycle: patch.lifecycle, updatedAt: nowIso(), ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {} };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const row = this.get("UPDATE skills_registry SET lifecycle=?, archived_at=?, archive_reason=?, replacement_slug=?, revision_id=?, revision_number=revision_number+1, updated_at=? WHERE org_id=? AND slug=? AND tombstoned_at IS NULL AND revision_id=? RETURNING *", [next2.lifecycle, next2.archivedAt ?? null, next2.archiveReason ?? null, next2.replacementSlug ?? null, revisionIdOfRecord(next2), next2.updatedAt, principal.orgId, slug, current.revisionId]);
+      if (!row)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, this.getSkillSync(principal, slug)?.revisionId ?? null);
+      return rowToSkill(row);
+    }).immediate();
+  }
+  getSkillSync(principal, slug) {
+    const row = this.get("SELECT * FROM skills_registry WHERE org_id=? AND slug=? LIMIT 1", [principal.orgId, slug]);
+    return row ? rowToSkill(row) : null;
+  }
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const next2 = { ...current, ...patch };
+    return this.db.transaction(() => {
+      const revisionId = revisionIdOfRecord(next2);
+      const row = this.get(`UPDATE skills_registry
+         SET display_name = ?, description = ?, category = ?, tags_json = ?, kind = ?, version = ?, skill_md = ?,
+             revision_id = ?, revision_number = revision_number + 1, updated_at = ?
+         WHERE org_id = ? AND slug = ? AND tombstoned_at IS NULL AND revision_id = ?
+         RETURNING *`, [
+        next2.displayName,
+        next2.description,
+        next2.category,
+        JSON.stringify(next2.tags),
+        next2.kind,
+        next2.version ?? null,
+        next2.skillMd ?? null,
+        revisionId,
+        nowIso(),
+        principal.orgId,
+        slug,
+        current.revisionId
+      ]);
+      if (!row) {
+        const nowRow = this.get("SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [
+          principal.orgId,
+          slug
+        ]);
+        if (nowRow && nowRow.tombstoned_at == null) {
+          const currentId = typeof nowRow.revision_id === "string" ? nowRow.revision_id : null;
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      const insertTag = this.db.prepare("INSERT OR IGNORE INTO skills_tags (org_id, slug, tag) VALUES (?, ?, ?)");
+      for (const tag of next2.tags) {
+        if (!tag.trim())
+          continue;
+        insertTag.run(principal.orgId, slug, tag);
+      }
+      return rowToSkill(row);
+    })();
+  }
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
+    return this.db.transaction(() => {
+      const existing = this.get("SELECT tombstoned_at FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, slug]);
+      if (!existing)
+        return null;
+      if (existing.tombstoned_at != null) {
+        const row2 = this.get("SELECT * FROM skills_registry WHERE org_id = ? AND slug = ? LIMIT 1", [principal.orgId, slug]);
+        return rowToSkill(row2);
+      }
+      const tombstonedAt = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const row = this.get(`UPDATE skills_registry
+         SET tombstoned_at = ?, tombstone_purge_after = ?, updated_at = ?
+         WHERE org_id = ? AND slug = ?
+         RETURNING *`, [tombstonedAt, purgeAfter, tombstonedAt, principal.orgId, slug]);
+      return rowToSkill(row);
+    })();
+  }
+  async purgeExpiredTombstones(principal) {
+    return this.db.transaction(() => {
+      const now = nowIso();
+      const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
+      const purged = [];
+      for (const row of expired) {
+        const record = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record.slug]);
+        if (record.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record.bundleSha256);
+        purged.push(record);
+      }
+      return purged;
+    })();
+  }
+  async getSkillBundle(principal, sha256) {
+    const row = this.get("SELECT * FROM skills_bundles WHERE org_id = ? AND sha256 = ? LIMIT 1", [principal.orgId, sha256]);
+    return row ? rowToSkillBundle(row) : null;
+  }
+  async listSkillVersions(principal, slug) {
+    return this.all("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? ORDER BY created_at DESC, version DESC", [principal.orgId, slug]).map(rowToSkillVersion);
+  }
+  async getSkillVersion(principal, slug, version) {
+    const row = this.get("SELECT * FROM skills_versions WHERE org_id = ? AND slug = ? AND version = ? LIMIT 1", [principal.orgId, slug, version]);
+    return row ? rowToSkillVersion(row) : null;
+  }
+  async pinSkill(principal, slug, metadata = {}) {
+    const row = this.get(`INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+         pinned_at = excluded.pinned_at,
+         metadata_json = excluded.metadata_json
+       RETURNING *`, [principal.orgId, principal.apiKeyId, slug, nowIso(), JSON.stringify(metadata)]);
+    return rowToPin(row);
+  }
+  async unpinSkill(principal, slug) {
+    const result = this.db.run("DELETE FROM skills_pins WHERE org_id = ? AND principal = ? AND slug = ?", [principal.orgId, principal.apiKeyId, slug]);
+    return result.changes > 0;
+  }
+  async listPins(principal) {
+    return this.all("SELECT * FROM skills_pins WHERE org_id = ? AND principal = ? ORDER BY slug ASC", [principal.orgId, principal.apiKeyId]).map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all("SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id=t.org_id AND s.slug=t.slug WHERE t.org_id = ? AND s.lifecycle='active' ORDER BY t.tag ASC", [principal.orgId]).map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT s.* FROM skills_registry s
+       JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+       WHERE t.org_id = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
+       ORDER BY s.slug ASC`, [principal.orgId, tag]).map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return this.all(`SELECT p.* FROM skills_pins p
+       JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+       JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+       WHERE p.org_id = ? AND p.principal = ? AND t.tag = ? AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
+       ORDER BY p.slug ASC`, [principal.orgId, principal.apiKeyId, tag]).map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    return this.all("SELECT slug FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NULL ORDER BY slug ASC", [principal.orgId]).map((row) => String(row.slug));
+  }
+  collectOrphanBundle(orgId, sha256) {
+    const referenced = this.get("SELECT 1 AS present FROM skills_registry WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]) ?? this.get("SELECT 1 AS present FROM skills_versions WHERE org_id = ? AND bundle_sha256 = ? LIMIT 1", [orgId, sha256]);
+    if (referenced)
+      return;
+    this.db.run("DELETE FROM skills_bundles WHERE org_id = ? AND sha256 = ?", [orgId, sha256]);
+  }
+  get(sql, params) {
+    return this.db.query(sql).get(...params) ?? null;
+  }
+  all(sql, params) {
+    return this.db.query(sql).all(...params);
+  }
+  rollbackQuietly() {
+    try {
+      this.db.exec("ROLLBACK");
+    } catch {}
+  }
+}
+function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite")) {
+  db.exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
+       version text PRIMARY KEY,
+       applied_at text NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+     )`);
+  const files = readdirSync(migrationsDir).filter((name) => name.endsWith(".sql")).sort();
+  if (files.length === 0) {
+    throw new Error(`no .sql migrations found in ${migrationsDir}`);
+  }
+  const appliedNow = [];
+  for (const file of files) {
+    const version = file.replace(/\.sql$/, "");
+    const text = readFileSync2(join4(migrationsDir, file), "utf8");
+    const apply = db.transaction(() => {
+      const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version);
+      if (already)
+        return false;
+      db.exec(text);
+      db.run("INSERT INTO schema_migrations (version) VALUES (?)", [version]);
+      return true;
+    });
+    if (apply.immediate())
+      appliedNow.push(version);
+  }
+  return appliedNow;
+}
+function enableWalMode(db, attempts = 50, pauseMs = 10) {
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (journalMode(db) === "wal")
+      return true;
+    try {
+      if (String(db.query("PRAGMA journal_mode = WAL").get()?.journal_mode).toLowerCase() === "wal") {
+        return true;
+      }
+    } catch {}
+    Bun.sleepSync(pauseMs);
+  }
+  return false;
+}
+function journalMode(db) {
+  try {
+    return String(db.query("PRAGMA journal_mode").get()?.journal_mode ?? "").toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function openDatabase(path) {
+  try {
+    return new Database(path, { create: true, readwrite: true });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`cannot open the skills database at ${path}: ${reason}. ` + "Check that the directory exists and is writable. Set HASNA_SKILLS_DATABASE_URL to choose a " + "different path or a postgres:// URL, or HASNA_SKILLS_DIR to relocate the whole data directory.", { cause: error });
+  }
+}
+function parseScopes(value) {
+  if (Array.isArray(value))
+    return value.map(String);
+  if (typeof value !== "string")
+    return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.map(String) : [];
+  } catch {
+    return [];
+  }
+}
+
+// src/server/store.ts
+function recordFieldsOf(input, carriedBundle, carriedSkillMd) {
+  return {
+    slug: input.slug,
+    displayName: input.displayName,
+    description: input.description,
+    category: input.category,
+    tags: input.tags,
+    source: input.source,
+    kind: input.kind,
+    ...input.version ? { version: input.version } : {},
+    ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+    bundleSha256: input.bundle?.sha256 ?? carriedBundle.bundleSha256,
+    bundleByteSize: input.bundle?.byteSize ?? carriedBundle.bundleByteSize
+  };
+}
+function resolvePoolMax(env = process.env) {
+  const parsed = Number.parseInt(env.HASNA_SKILLS_DATABASE_POOL_MAX || env.SKILLS_DATABASE_POOL_MAX || "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 4;
+}
+var LOG_SEQUENCE_ATTEMPTS = 12;
+async function createStore(options = {}) {
+  const target = resolveDatabaseTarget(options.databaseUrl);
+  const store = instantiateStore(target, options.sqlite);
+  await store.verifyConnectivity?.();
+  if (options.bootstrapApiKey && store.ensureBootstrapApiKey) {
+    await store.ensureBootstrapApiKey(options.bootstrapApiKey);
+  }
+  return store;
+}
+function instantiateStore(target, sqliteOptions) {
+  switch (target.kind) {
+    case "postgres":
+      return new PostgresSkillsStore(target.url);
+    case "sqlite":
+      return new SqliteSkillsStore(target.path, sqliteOptions);
+    case "memory":
+      return new MemorySkillsStore;
+  }
+}
+
+class MemorySkillsStore {
+  selectionStore = new MemorySkillSelectionStore;
+  executionGrantStore = new MemoryExecutionGrantStore;
+  backend = { kind: "memory", durable: false, label: "memory (non-durable)" };
+  apiKeys = new Map;
+  runs = new Map;
+  logs = new Map;
+  artifacts = new Map;
+  idempotency = new Map;
+  skills = new Map;
+  bundles = new Map;
+  versions = new Map;
+  pins = new Map;
+  operatorEnrollments = new Map;
+  constructor(apiKeys = []) {
+    for (const key of apiKeys)
+      this.addApiKey(key.token, key.principal);
+  }
+  addApiKey(token, principal) {
+    const resolved = publicPrincipal(principal);
+    this.apiKeys.set(hashApiKey(token), resolved);
+    return resolved;
+  }
+  async ensureBootstrapApiKey(token, principal) {
+    this.addApiKey(token, principal);
+  }
+  async authenticateApiKeyHash(hash) {
+    return this.apiKeys.get(hash) ?? null;
+  }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    for (const [hash, target] of this.apiKeys) {
+      if (target.apiKeyId !== keyId || target.orgId !== actor.orgId)
+        continue;
+      if (target.scopes.length !== expectedScopes.length || target.scopes.some((scope, index) => scope !== expectedScopes[index])) {
+        return { kind: "stale", scopes: [...target.scopes] };
+      }
+      const scopes = [...target.scopes, ...addScopes.filter((scope) => !target.scopes.includes(scope))];
+      const updated = { ...target, scopes };
+      this.apiKeys.set(hash, updated);
+      return { kind: "updated", scopes };
+    }
+    return { kind: "not_found" };
+  }
+  async enrollPublishScopeByOperator(input) {
+    if (!validOperatorScopeEnrollmentInput(input))
+      return { kind: "invalid" };
+    const previous = this.operatorEnrollments.get(input.operationId);
+    if (previous) {
+      if (previous.keyId !== input.keyId || previous.manifestDigest !== input.manifestDigest)
+        return { kind: "target_mismatch" };
+      for (const target of this.apiKeys.values()) {
+        if (target.apiKeyId === input.keyId && target.orgId === input.orgId && target.scopes.includes("skills:publish")) {
+          return { kind: "already_applied", scopes: [...target.scopes] };
+        }
+      }
+      return { kind: "stale", scopes: [] };
+    }
+    for (const [hash, target] of this.apiKeys) {
+      if (target.apiKeyId !== input.keyId || target.orgId !== input.orgId)
+        continue;
+      if (target.scopes.length !== input.expectedScopes.length || target.scopes.some((scope, index) => scope !== input.expectedScopes[index])) {
+        return { kind: "stale", scopes: [...target.scopes] };
+      }
+      const scopes = target.scopes.includes("skills:publish") ? [...target.scopes] : [...target.scopes, "skills:publish"];
+      this.apiKeys.set(hash, { ...target, scopes });
+      this.operatorEnrollments.set(input.operationId, { keyId: input.keyId, manifestDigest: input.manifestDigest });
+      return { kind: "updated", scopes };
+    }
+    return { kind: "not_found" };
+  }
+  async inspectOperatorScopeTarget(keyId, orgId) {
+    for (const target of this.apiKeys.values()) {
+      if (target.apiKeyId !== keyId)
+        continue;
+      return target.orgId === orgId ? { kind: "found", scopes: [...target.scopes] } : { kind: "target_mismatch" };
+    }
+    return { kind: "not_found" };
+  }
+  async createRun(input) {
+    const idemKey = input.idempotencyKey?.trim();
+    const idemMapKey = idemKey ? `${input.principal.orgId}:${idemKey}` : undefined;
+    if (idemMapKey) {
+      const existing = this.idempotency.get(idemMapKey);
+      if (existing)
+        return this.runs.get(existing);
+    }
+    const now = nowIso();
+    const run = {
+      id: runId(),
+      orgId: input.principal.orgId,
+      userId: input.principal.userId,
+      skill: input.slug,
+      requestedSlug: input.slug,
+      status: "queued",
+      input: input.input,
+      args: input.args,
+      ...idemKey ? { idempotencyKey: idemKey } : {},
+      correlationId: randomUUID5(),
+      costCents: 0,
+      leaseGeneration: 0,
+      createdAt: now
+    };
+    this.runs.set(run.id, run);
+    this.logs.set(run.id, []);
+    this.artifacts.set(run.id, []);
+    if (idemMapKey)
+      this.idempotency.set(idemMapKey, run.id);
+    return run;
+  }
+  async listRuns(principal, limit) {
+    return Array.from(this.runs.values()).filter((run) => run.orgId === principal.orgId).sort((a, b) => b.createdAt.localeCompare(a.createdAt)).slice(0, normalizeLimit(limit));
+  }
+  async getRun(principal, runId2) {
+    const run = this.runs.get(runId2);
+    return run && run.orgId === principal.orgId ? run : null;
+  }
+  async claimNextRun(_input) {
+    const run = Array.from(this.runs.values()).filter((candidate) => candidate.status === "queued" || candidate.status === "retrying").sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
+    if (!run)
+      return null;
+    return this.patchRun(run.id, { status: "running", startedAt: run.startedAt ?? nowIso(), leaseGeneration: run.leaseGeneration + 1 });
+  }
+  async updateRun(runId2, patch) {
+    return this.patchRun(runId2, patch);
+  }
+  async transitionRun(runId2, patch, expectedGeneration) {
+    const run = this.runs.get(runId2);
+    if (!run)
+      return null;
+    if (run.leaseGeneration !== expectedGeneration) {
+      throw new StaleLeaseGenerationError(runId2, expectedGeneration, run.leaseGeneration, run.status);
+    }
+    return this.patchRun(runId2, patch);
+  }
+  async appendLog(runId2, orgId, level, message) {
+    const entries = this.logs.get(runId2) ?? [];
+    const log = { runId: runId2, sequence: entries.length + 1, level, message, createdAt: nowIso() };
+    entries.push(log);
+    this.logs.set(runId2, entries);
+    return log;
+  }
+  async listLogs(principal, runId2) {
+    const run = await this.getRun(principal, runId2);
+    return run ? [...this.logs.get(runId2) ?? []] : [];
+  }
+  async addArtifact(artifact) {
+    const next2 = { ...artifact, createdAt: nowIso() };
+    const artifacts = this.artifacts.get(artifact.runId) ?? [];
+    artifacts.push(next2);
+    this.artifacts.set(artifact.runId, artifacts);
+    return next2;
+  }
+  async listArtifacts(principal, runId2) {
+    const run = await this.getRun(principal, runId2);
+    return run ? [...this.artifacts.get(runId2) ?? []] : [];
+  }
+  async getArtifact(principal, runId2, id) {
+    const artifacts = await this.listArtifacts(principal, runId2);
+    return artifacts.find((artifact) => artifact.id === id) ?? null;
+  }
+  async publishSkill(input) {
+    const key = skillKey(input.principal.orgId, input.slug);
+    const now = nowIso();
+    const previous = this.skills.get(key);
+    if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+    }
+    if (input.seedBundledOnly && previous && (previous.tombstonedAt || previous.source !== "bundled")) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
+    if (previous && !previous.tombstonedAt && input.expectedRevisionId !== previous.revisionId) {
+      throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previous.revisionId);
+    }
+    const versionSha = input.bundle?.sha256 ?? previous?.bundleSha256;
+    if (input.version && versionSha) {
+      const existing = this.versions.get(versionKey(input.principal.orgId, input.slug, input.version));
+      if (existing && existing.bundleSha256 !== versionSha) {
+        throw new SkillVersionExistsError(input.slug, input.version, existing.bundleSha256, versionSha);
+      }
+    }
+    if (input.bundle) {
+      const bundleMapKey = skillKey(input.principal.orgId, input.bundle.sha256);
+      this.bundles.set(bundleMapKey, {
+        ...this.bundles.get(bundleMapKey),
+        ...input.bundle,
+        orgId: input.principal.orgId,
+        createdAt: this.bundles.get(bundleMapKey)?.createdAt ?? now
+      });
+    }
+    const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
+    const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
+    const record = {
+      orgId: input.principal.orgId,
+      slug: input.slug,
+      displayName: input.displayName,
+      description: input.description,
+      category: input.category,
+      tags: [...input.tags],
+      source: input.source,
+      kind: input.kind,
+      ...input.version ? { version: input.version } : {},
+      ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+      ...input.bundle ? { bundleSha256: input.bundle.sha256, bundleByteSize: input.bundle.byteSize } : carriedBundle,
+      publishedByUserId: input.principal.userId,
+      createdAt: previous?.createdAt ?? now,
+      updatedAt: now,
+      revisionId: revisionIdOfRecord(recordFieldsOf(input, carriedBundle, carriedSkillMd)),
+      revisionNumber: (previous?.revisionNumber ?? 0) + 1,
+      lifecycle: previous?.lifecycle ?? "active",
+      ...previous?.archivedAt ? { archivedAt: previous.archivedAt } : {},
+      ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
+      ...previous?.replacementSlug ? { replacementSlug: previous.replacementSlug } : {}
+    };
+    this.skills.set(key, record);
+    if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
+      this.versions.set(versionKey(input.principal.orgId, input.slug, input.version), {
+        orgId: input.principal.orgId,
+        slug: input.slug,
+        version: input.version,
+        bundleSha256: versionSha,
+        bundleByteSize: input.bundle?.byteSize ?? previous?.bundleByteSize ?? 0,
+        storageKind: input.versionStorage?.storageKind ?? "db",
+        ...input.versionStorage?.storageKey ? { storageKey: input.versionStorage.storageKey } : {},
+        manifest: { ...input.versionManifest ?? {} },
+        ...input.principal.userId ? { publishedByUserId: input.principal.userId } : {},
+        createdAt: now
+      });
+    }
+    if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
+      this.collectOrphanBundle(input.principal.orgId, previous.bundleSha256);
+    }
+    return record;
+  }
+  async listSkillVersions(principal, slug) {
+    return Array.from(this.versions.values()).filter((v) => v.orgId === principal.orgId && v.slug === slug).sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.version.localeCompare(a.version));
+  }
+  async getSkillVersion(principal, slug, version) {
+    const found = this.versions.get(versionKey(principal.orgId, slug, version));
+    return found && found.orgId === principal.orgId ? found : null;
+  }
+  async listSkills(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).sort((a, b) => a.slug.localeCompare(b.slug));
+  }
+  async getSkill(principal, slug) {
+    const skill = this.skills.get(skillKey(principal.orgId, slug));
+    return skill && skill.orgId === principal.orgId ? skill : null;
+  }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId)
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+      const profiles = await this.selectionStore.profilesReferencingSkill(principal, slug);
+      if (profiles.length)
+        throw new SkillLifecycleConflictError(slug, profiles);
+    }
+    const next2 = {
+      ...current,
+      lifecycle: patch.lifecycle,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+      revisionNumber: current.revisionNumber + 1,
+      ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+    };
+    if (patch.lifecycle === "active") {
+      delete next2.archivedAt;
+      delete next2.archiveReason;
+      delete next2.replacementSlug;
+    }
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
+  }
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const latest = this.skills.get(skillKey(principal.orgId, slug));
+    if (!latest || latest.tombstonedAt)
+      return null;
+    if (latest.revisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, latest.revisionId);
+    }
+    const next2 = {
+      ...latest,
+      ...patch,
+      updatedAt: nowIso(),
+      revisionId: revisionIdOfRecord({ ...latest, ...patch }),
+      revisionNumber: latest.revisionNumber + 1
+    };
+    this.skills.set(skillKey(principal.orgId, slug), next2);
+    return next2;
+  }
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
+    const current = await this.getSkill(principal, slug);
+    if (!current)
+      return null;
+    if (!current.tombstonedAt) {
+      const tombstoned = nowIso();
+      const purgeAfter = new Date(Date.now() + tombstoneWindowMs).toISOString();
+      const next2 = { ...current, tombstonedAt: tombstoned, tombstonePurgeAfter: purgeAfter, updatedAt: tombstoned };
+      this.skills.set(skillKey(principal.orgId, slug), next2);
+      return next2;
+    }
+    return current;
+  }
+  async purgeExpiredTombstones(principal) {
+    const now = nowIso();
+    const purged = [];
+    for (const [key, skill] of this.skills) {
+      if (skill.orgId !== principal.orgId || !skill.tombstonedAt || !skill.tombstonePurgeAfter)
+        continue;
+      if (skill.tombstonePurgeAfter > now)
+        continue;
+      this.skills.delete(key);
+      if (skill.bundleSha256)
+        this.collectOrphanBundle(principal.orgId, skill.bundleSha256);
+      purged.push(skill);
+    }
+    return purged;
+  }
+  async getSkillBundle(principal, sha256) {
+    const bundle = this.bundles.get(skillKey(principal.orgId, sha256));
+    return bundle && bundle.orgId === principal.orgId ? bundle : null;
+  }
+  async pinSkill(principal, slug, metadata = {}) {
+    const pin = { orgId: principal.orgId, principal: principal.apiKeyId, slug, pinnedAt: nowIso(), metadata: { ...metadata } };
+    this.pins.set(pinKey(principal.orgId, principal.apiKeyId, slug), pin);
+    return pin;
+  }
+  async unpinSkill(principal, slug) {
+    return this.pins.delete(pinKey(principal.orgId, principal.apiKeyId, slug));
+  }
+  async listPins(principal) {
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId).sort((a, b) => a.slug.localeCompare(b.slug));
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const tags = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId !== principal.orgId || skill.lifecycle !== "active")
+        continue;
+      for (const tag of skill.tags) {
+        if (tag.trim())
+          tags.add(tag);
+      }
+    }
+    return [...tags].sort();
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag)).sort((a, b) => a.slug.localeCompare(b.slug));
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const taggedSlugs = new Set;
+    for (const skill of this.skills.values()) {
+      if (skill.orgId === principal.orgId && !skill.tombstonedAt && skill.lifecycle === "active" && skill.tags.includes(tag))
+        taggedSlugs.add(skill.slug);
+    }
+    return Array.from(this.pins.values()).filter((pin) => pin.orgId === principal.orgId && pin.principal === principal.apiKeyId && taggedSlugs.has(pin.slug)).sort((a, b) => a.slug.localeCompare(b.slug));
+  }
+  async listPublishedSlugs(principal) {
+    return Array.from(this.skills.values()).filter((skill) => skill.orgId === principal.orgId && !skill.tombstonedAt).map((skill) => skill.slug).sort();
+  }
+  collectOrphanBundle(orgId, sha256) {
+    const referenced = Array.from(this.skills.values()).some((skill) => skill.orgId === orgId && skill.bundleSha256 === sha256) || Array.from(this.versions.values()).some((v) => v.orgId === orgId && v.bundleSha256 === sha256);
+    if (!referenced)
+      this.bundles.delete(skillKey(orgId, sha256));
+  }
+  patchRun(runId2, patch) {
+    const run = this.runs.get(runId2);
+    if (!run)
+      return null;
+    const next2 = { ...run, ...patch };
+    this.runs.set(runId2, next2);
+    return next2;
+  }
+}
+function skillKey(orgId, slug) {
+  return `${orgId.length}:${orgId}:${slug}`;
+}
+function pinKey(orgId, principal, slug) {
+  return `${orgId.length}:${orgId}:${principal.length}:${principal}:${slug}`;
+}
+function versionKey(orgId, slug, version) {
+  return `${orgId.length}:${orgId}:${slug.length}:${slug}:${version}`;
+}
+
+class PostgresSkillsStore {
+  get selectionStore() {
+    return new PostgresSkillSelectionStore(this.sql);
+  }
+  get executionGrantStore() {
+    return new PostgresExecutionGrantStore(this.sql);
+  }
+  backend = { kind: "postgres", durable: true, label: "postgres" };
+  sql;
+  constructor(databaseUrl) {
+    const bunWithSql = Bun;
+    this.sql = new bunWithSql.SQL(databaseUrl, { max: resolvePoolMax() });
+  }
+  async verifyConnectivity() {
+    try {
+      await this.sql`SELECT 1`;
+    } catch (error) {
+      throw new Error("cannot reach the configured Postgres database. The server will not start with an unreachable " + "database rather than fall back to another backend and silently split your data across two stores. " + `Check HASNA_SKILLS_DATABASE_URL and that the instance is accepting connections. Driver reported: ${connectionFailureSummary(error)}`);
+    }
+    try {
+      await this.sql`SELECT 1 FROM api_keys LIMIT 0`;
+    } catch (error) {
+      throw new Error("the configured Postgres database is reachable but has no skills schema. Run `skills-migrate` against it " + "before starting the server - unlike SQLite, Postgres is not migrated automatically, so that several " + `replicas cannot race to migrate a shared database. Driver reported: ${connectionFailureSummary(error)}`);
+    }
+    await this.backfillLegacyRevisions();
+  }
+  async backfillLegacyRevisions() {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
+    for (const row of rows) {
+      const record = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record)} WHERE org_id = ${record.orgId} AND slug = ${record.slug}`;
+    }
+  }
+  async close() {
+    await this.sql.close?.();
+  }
+  async ensureBootstrapApiKey(token, principal) {
+    const resolved = publicPrincipal(principal);
+    await this.sql`
+      INSERT INTO organizations (id, slug, name)
+      VALUES (${resolved.orgId}, ${resolved.orgSlug}, ${resolved.orgName})
+      ON CONFLICT (id) DO UPDATE SET slug = EXCLUDED.slug, name = EXCLUDED.name
+    `;
+    await this.sql`
+      INSERT INTO users (id, email, name)
+      VALUES (${resolved.userId}, ${resolved.email}, ${resolved.email})
+      ON CONFLICT (id) DO UPDATE SET email = EXCLUDED.email
+    `;
+    await this.sql`
+      INSERT INTO organization_members (org_id, user_id, role)
+      VALUES (${resolved.orgId}, ${resolved.userId}, ${resolved.role})
+      ON CONFLICT (org_id, user_id) DO UPDATE SET role = EXCLUDED.role
+    `;
+    await this.sql`
+      INSERT INTO api_keys (id, org_id, user_id, name, key_hash, scopes_json)
+      VALUES (${resolved.apiKeyId}, ${resolved.orgId}, ${resolved.userId}, ${"bootstrap"}, ${hashApiKey(token)}, ${JSON.stringify(resolved.scopes)}::jsonb)
+      ON CONFLICT (key_hash) DO NOTHING
+    `;
+  }
+  async authenticateApiKeyHash(hash) {
+    const rows = await this.sql`
+      SELECT k.id AS api_key_id, k.scopes_json, o.id AS org_id, o.slug AS org_slug, o.name AS org_name,
+             u.id AS user_id, u.email, m.role
+      FROM api_keys k
+      JOIN organizations o ON o.id = k.org_id
+      JOIN users u ON u.id = k.user_id
+      LEFT JOIN organization_members m ON m.org_id = k.org_id AND m.user_id = k.user_id
+      WHERE k.key_hash = ${hash} AND k.revoked_at IS NULL
+      LIMIT 1
+    `;
+    const row = rows[0];
+    if (!row)
+      return null;
+    await this.sql`UPDATE api_keys SET last_used_at = now() WHERE id = ${String(row.api_key_id)}`;
+    return {
+      apiKeyId: String(row.api_key_id),
+      orgId: String(row.org_id),
+      orgSlug: String(row.org_slug),
+      orgName: String(row.org_name),
+      userId: String(row.user_id),
+      email: String(row.email),
+      role: typeof row.role === "string" ? row.role : "member",
+      scopes: parseJsonArray(row.scopes_json)
+    };
+  }
+  async updateApiKeyScopes(actor, keyId, expectedScopes, addScopes) {
+    return this.sql.begin(async (tx) => {
+      const rows = await tx`
+        SELECT scopes_json FROM api_keys
+        WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL
+        LIMIT 1
+      `;
+      const row = rows[0];
+      if (!row)
+        return { kind: "not_found" };
+      const current = parseJsonArray(row.scopes_json);
+      if (current.length !== expectedScopes.length || current.some((scope, index) => scope !== expectedScopes[index])) {
+        return { kind: "stale", scopes: current };
+      }
+      const updated = await this.casUpdateApiKeyScopes(tx, keyId, actor.orgId, expectedScopes, addScopes);
+      if (!updated[0]) {
+        const latest = await tx`SELECT scopes_json FROM api_keys WHERE id = ${keyId} AND org_id = ${actor.orgId} AND revoked_at IS NULL LIMIT 1`;
+        return { kind: "stale", scopes: latest[0] ? parseJsonArray(latest[0].scopes_json) : current };
+      }
+      await tx`
+        INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, metadata_json)
+        VALUES (${actor.orgId}, ${actor.userId}, ${actor.apiKeyId}, ${"api_key_scopes_added"}, ${"api_key"}, ${keyId}, ${JSON.stringify({ added: addScopes, scopes: parseJsonArray(updated[0].scopes_json) })}::jsonb)
+      `;
+      return { kind: "updated", scopes: parseJsonArray(updated[0].scopes_json) };
+    });
+  }
+  async casUpdateApiKeyScopes(tx, keyId, orgId, expectedScopes, addScopes) {
+    const current = expectedScopes;
+    const scopes = [...current, ...addScopes.filter((scope) => !current.includes(scope))];
+    return tx`
+      UPDATE api_keys SET scopes_json = ${JSON.stringify(scopes)}::jsonb
+      WHERE id = ${keyId} AND org_id = ${orgId} AND revoked_at IS NULL
+        AND scopes_json = ${JSON.stringify(expectedScopes)}::jsonb
+      RETURNING scopes_json
+    `;
+  }
+  async enrollPublishScopeByOperator(input) {
+    if (!validOperatorScopeEnrollmentInput(input))
+      return { kind: "invalid" };
+    if (input.expectedScopes.includes("skills:publish"))
+      return { kind: "stale", scopes: input.expectedScopes };
+    return this.sql.begin(async (tx) => {
+      const operation = await tx`
+        SELECT org_id, target_id FROM skills_audit_events
+        WHERE action = ${"api_key_scopes_added"} AND operator_operation_id = ${input.operationId}
+        LIMIT 1
+      `;
+      if (operation[0] && (String(operation[0].org_id) !== input.orgId || String(operation[0].target_id) !== input.keyId))
+        return { kind: "target_mismatch" };
+      const rows = await tx`
+        SELECT id, org_id, name, scopes_json FROM api_keys
+        WHERE id = ${input.keyId} AND revoked_at IS NULL
+        FOR UPDATE
+      `;
+      const row = rows[0];
+      if (!row)
+        return { kind: "not_found" };
+      if (String(row.org_id) !== input.orgId)
+        return { kind: "target_mismatch" };
+      const current = parseJsonArray(row.scopes_json);
+      const prior = await tx`
+        SELECT metadata_json, metadata_json->>'target_manifest_digest' AS manifest_digest FROM skills_audit_events
+        WHERE action = ${"api_key_scopes_added"} AND target_type = ${"api_key"} AND target_id = ${input.keyId}
+          AND operator_operation_id = ${input.operationId}
+        LIMIT 1
+      `;
+      if (prior[0]) {
+        const priorMetadata = typeof prior[0].metadata_json === "string" ? JSON.parse(prior[0].metadata_json) : prior[0].metadata_json;
+        const priorDigest = prior[0].manifest_digest ?? priorMetadata?.target_manifest_digest;
+        if (String(priorDigest) !== input.manifestDigest)
+          return { kind: "target_mismatch" };
+        if (!current.includes("skills:publish"))
+          return { kind: "stale", scopes: current };
+        return { kind: "already_applied", scopes: current };
+      }
+      if (current.length !== input.expectedScopes.length || current.some((scope, index) => scope !== input.expectedScopes[index])) {
+        return { kind: "stale", scopes: current };
+      }
+      const updated = await this.casUpdateApiKeyScopes(tx, input.keyId, input.orgId, input.expectedScopes, ["skills:publish"]);
+      if (!updated[0])
+        return { kind: "stale", scopes: current };
+      const scopes = parseJsonArray(updated[0].scopes_json);
+      await tx`
+        INSERT INTO skills_audit_events (org_id, user_id, api_key_id, action, target_type, target_id, operator_operation_id, metadata_json)
+        VALUES (${input.orgId}, NULL, NULL, ${"api_key_scopes_added"}, ${"api_key"}, ${input.keyId}, ${input.operationId}, ${JSON.stringify({
+        added: ["skills:publish"],
+        scopes,
+        operator_operation_id: input.operationId,
+        operator_job_id: input.operatorJobId,
+        operator_task_arn: input.operatorTaskArn,
+        target_manifest_digest: input.manifestDigest,
+        station_id: input.stationId
+      })}::jsonb)
+      `;
+      return { kind: "updated", scopes };
+    });
+  }
+  async inspectOperatorScopeTarget(keyId, orgId) {
+    const rows = await this.sql`SELECT org_id, scopes_json FROM api_keys WHERE id = ${keyId} AND revoked_at IS NULL LIMIT 1`;
+    const row = rows[0];
+    if (!row)
+      return { kind: "not_found" };
+    if (String(row.org_id) !== orgId)
+      return { kind: "target_mismatch" };
+    return { kind: "found", scopes: parseJsonArray(row.scopes_json) };
+  }
+  async withContext(orgId, worker, fn) {
+    return this.sql.begin(async (tx) => {
+      await tx`SELECT set_config('app.skills_org_id', ${orgId ?? ""}, true)`;
+      await tx`SELECT set_config('app.skills_claim_context', ${worker ? "worker" : ""}, true)`;
+      return await fn(tx);
+    });
+  }
+  async createRun(input) {
+    return this.withContext(input.principal.orgId, false, async (tx) => {
+      if (input.idempotencyKey) {
+        const existing = await tx`
+          SELECT * FROM skills_runs
+          WHERE org_id = ${input.principal.orgId} AND idempotency_key = ${input.idempotencyKey}
+          LIMIT 1
+        `;
+        if (existing[0])
+          return rowToRun(existing[0]);
+      }
+      const id = runId();
+      const rows = await tx`
+        INSERT INTO skills_runs (id, org_id, user_id, skill_slug, requested_slug, status, input_json, args_json, idempotency_key, correlation_id)
+        VALUES (${id}, ${input.principal.orgId}, ${input.principal.userId}, ${input.slug}, ${input.slug}, ${"queued"}, ${JSON.stringify(input.input)}::jsonb, ${JSON.stringify(input.args)}::jsonb, ${input.idempotencyKey ?? null}, ${randomUUID5()})
+        RETURNING *
+      `;
+      return rowToRun(rows[0]);
+    });
+  }
+  async listRuns(principal, limit) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT * FROM skills_runs WHERE org_id = ${principal.orgId}
+        ORDER BY created_at DESC LIMIT ${normalizeLimit(limit)}
+      `;
+      return rows.map(rowToRun);
+    });
+  }
+  async getRun(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT * FROM skills_runs WHERE id = ${runId2} AND org_id = ${principal.orgId} LIMIT 1
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
+  }
+  async claimNextRun(input) {
+    return this.withContext(null, true, async (tx) => {
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${"running"}, started_at = COALESCE(started_at, now()), locked_by = ${input.workerId}, locked_at = now(),
+            lease_generation = lease_generation + 1
+        WHERE id = (
+          SELECT id FROM skills_runs
+          WHERE status IN (${"queued"}, ${"retrying"})
+          ORDER BY created_at ASC
+          FOR UPDATE SKIP LOCKED
+          LIMIT 1
+        )
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
+  }
+  async updateRun(runId2, patch) {
+    return this.withContext(null, true, async (tx) => {
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      if (!current[0])
+        return null;
+      const run = { ...rowToRun(current[0]), ...patch };
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${run.status},
+            output_type = ${run.outputType ?? null},
+            output_preview = ${run.outputPreview ?? null},
+            error_code = ${run.errorCode ?? null},
+            error_message = ${run.errorMessage ?? null},
+            started_at = ${run.startedAt ?? null},
+            completed_at = ${run.completedAt ?? null}
+        WHERE id = ${runId2}
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
+  }
+  async transitionRun(runId2, patch, expectedGeneration) {
+    return this.withContext(null, true, async (tx) => {
+      const current = await tx`SELECT * FROM skills_runs WHERE id = ${runId2} LIMIT 1`;
+      if (!current[0])
+        return null;
+      const stored = rowToRun(current[0]);
+      if (stored.leaseGeneration !== expectedGeneration) {
+        throw new StaleLeaseGenerationError(runId2, expectedGeneration, stored.leaseGeneration, stored.status);
+      }
+      const run = { ...stored, ...patch };
+      const rows = await tx`
+        UPDATE skills_runs
+        SET status = ${run.status},
+            output_type = ${run.outputType ?? null},
+            output_preview = ${run.outputPreview ?? null},
+            error_code = ${run.errorCode ?? null},
+            error_message = ${run.errorMessage ?? null},
+            started_at = ${run.startedAt ?? null},
+            completed_at = ${run.completedAt ?? null},
+            lease_generation = ${run.leaseGeneration}
+        WHERE id = ${runId2} AND lease_generation = ${expectedGeneration}
+        RETURNING *
+      `;
+      return rows[0] ? rowToRun(rows[0]) : null;
+    });
+  }
+  async appendLog(runId2, orgId, level, message) {
+    let lastError;
+    for (let attempt = 0;attempt < LOG_SEQUENCE_ATTEMPTS; attempt += 1) {
+      try {
+        const rows = await this.withContext(orgId, true, async (tx) => {
+          return await tx`
+            INSERT INTO skills_run_logs (run_id, org_id, sequence, level, message)
+            VALUES (
+              ${runId2},
+              ${orgId},
+              (SELECT COALESCE(MAX(sequence), 0) + 1 FROM skills_run_logs WHERE run_id = ${runId2}),
+              ${level},
+              ${message}
+            )
+            RETURNING *
+          `;
+        });
+        return rowToLog(rows[0]);
+      } catch (error) {
+        if (!isUniqueViolation(error))
+          throw error;
+        lastError = error;
+      }
+    }
+    throw lastError;
+  }
+  async listLogs(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT l.* FROM skills_run_logs l
+        JOIN skills_runs r ON r.id = l.run_id AND r.org_id = ${principal.orgId}
+        WHERE l.run_id = ${runId2}
+        ORDER BY l.sequence ASC
+      `;
+      return rows.map(rowToLog);
+    });
+  }
+  async addArtifact(artifact) {
+    return this.withContext(artifact.orgId, true, async (tx) => {
+      const rows = await tx`
+        INSERT INTO skills_artifacts (id, run_id, org_id, file_name, relative_path, content_type, byte_size, sha256, storage_kind, storage_key, body_text, visibility, expires_at)
+        VALUES (${artifact.id}, ${artifact.runId}, ${artifact.orgId}, ${artifact.fileName}, ${artifact.relativePath}, ${artifact.contentType}, ${artifact.byteSize}, ${artifact.sha256}, ${artifact.storageKind}, ${artifact.storageKey ?? null}, ${artifact.bodyText ?? null}, ${artifact.visibility}, ${artifact.expiresAt ?? null})
+        RETURNING *
+      `;
+      return rowToArtifact(rows[0]);
+    });
+  }
+  async listArtifacts(principal, runId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
+        WHERE a.run_id = ${runId2}
+        ORDER BY a.created_at ASC
+      `;
+      return rows.map(rowToArtifact);
+    });
+  }
+  async getArtifact(principal, runId2, artifactId2) {
+    return this.withContext(principal.orgId, false, async (tx) => {
+      const rows = await tx`
+        SELECT a.* FROM skills_artifacts a
+        JOIN skills_runs r ON r.id = a.run_id AND r.org_id = ${principal.orgId}
+        WHERE a.run_id = ${runId2} AND a.id = ${artifactId2}
+        LIMIT 1
+      `;
+      return rows[0] ? rowToArtifact(rows[0]) : null;
+    });
+  }
+  async publishSkill(input) {
+    const orgId = input.principal.orgId;
+    return await this.sql.begin(async (tx) => {
+      const previousRows = await tx`
+        SELECT revision_id, revision_number, bundle_sha256, bundle_byte_size, skill_md, tombstoned_at, source
+        FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1
+      `;
+      const previous = previousRows[0];
+      const previousSha = typeof previous?.bundle_sha256 === "string" ? String(previous.bundle_sha256) : null;
+      const previousRevisionId = typeof previous?.revision_id === "string" && previous.revision_id ? String(previous.revision_id) : null;
+      const tombstoned = previous?.tombstoned_at != null;
+      if (input.seedBundledOnly && input.expectedRevisionId && !previous) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+      }
+      if (input.seedBundledOnly && previous && (tombstoned || previous.source !== "bundled")) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : typeof previous?.skill_md === "string" ? String(previous.skill_md) : null;
+      if (previous && !tombstoned && input.expectedRevisionId !== previousRevisionId) {
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, previousRevisionId);
+      }
+      const carriedSha = input.bundle?.sha256 ?? previousSha;
+      if (input.version && carriedSha) {
+        const existingVersion = await tx`
+          SELECT bundle_sha256 FROM skills_versions WHERE org_id = ${orgId} AND slug = ${input.slug} AND version = ${input.version} LIMIT 1
+        `;
+        const existingSha = existingVersion[0] && typeof existingVersion[0].bundle_sha256 === "string" ? String(existingVersion[0].bundle_sha256) : null;
+        if (existingSha && existingSha !== carriedSha) {
+          throw new SkillVersionExistsError(input.slug, input.version, existingSha, carriedSha);
+        }
+      }
+      const carriedSize = input.bundle?.byteSize ?? (previous?.bundle_byte_size == null ? null : Number(previous.bundle_byte_size));
+      const revisionId = revisionIdOfRecord({
+        slug: input.slug,
+        displayName: input.displayName,
+        description: input.description,
+        category: input.category,
+        tags: input.tags,
+        source: input.source,
+        kind: input.kind,
+        ...input.version ? { version: input.version } : {},
+        ...carriedSkillMd ? { skillMd: carriedSkillMd } : {},
+        ...carriedSha ? { bundleSha256: carriedSha } : {},
+        ...carriedSize === null || carriedSize === undefined ? {} : { bundleByteSize: carriedSize }
+      });
+      if (input.bundle) {
+        await tx`
+          INSERT INTO skills_bundles (org_id, sha256, byte_size, content_type, storage_kind, storage_key, body_blob)
+          VALUES (${orgId}, ${input.bundle.sha256}, ${input.bundle.byteSize}, ${input.bundle.contentType}, ${input.bundle.storageKind}, ${input.bundle.storageKey ?? null}, ${input.bundle.bytes ?? null})
+          ON CONFLICT (org_id, sha256) DO UPDATE SET
+            byte_size = EXCLUDED.byte_size,
+            content_type = EXCLUDED.content_type,
+            storage_kind = EXCLUDED.storage_kind,
+            storage_key = EXCLUDED.storage_key,
+            body_blob = EXCLUDED.body_blob
+        `;
+      }
+      if (input.seedBundledOnly) {
+        const seedRows = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} FOR UPDATE`;
+        if (input.expectedRevisionId && !seedRows[0]) {
+          throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, null);
+        }
+      }
+      const rows = await tx`
+        INSERT INTO skills_registry (org_id, slug, display_name, description, category, tags_json, source, kind, version, skill_md,
+                                     bundle_sha256, bundle_byte_size, published_by_user_id, revision_id, revision_number, updated_at)
+        VALUES (${orgId}, ${input.slug}, ${input.displayName}, ${input.description}, ${input.category}, ${JSON.stringify(input.tags)}::jsonb,
+                ${input.source}, ${input.kind}, ${input.version ?? null}, ${carriedSkillMd},
+                ${input.bundle?.sha256 ?? null}, ${input.bundle?.byteSize ?? null}, ${input.principal.userId}, ${revisionId}, 1, now())
+        ON CONFLICT (org_id, slug) DO UPDATE SET
+          display_name = EXCLUDED.display_name,
+          description = EXCLUDED.description,
+          category = EXCLUDED.category,
+          tags_json = EXCLUDED.tags_json,
+          source = EXCLUDED.source,
+          kind = EXCLUDED.kind,
+          version = EXCLUDED.version,
+          skill_md = EXCLUDED.skill_md,
+          -- COALESCE: see the SQLite twin. A bundle-less publish is a metadata update,
+          -- not an instruction to discard the stored tarball.
+          bundle_sha256 = COALESCE(EXCLUDED.bundle_sha256, skills_registry.bundle_sha256),
+          bundle_byte_size = COALESCE(EXCLUDED.bundle_byte_size, skills_registry.bundle_byte_size),
+          published_by_user_id = EXCLUDED.published_by_user_id,
+          revision_id = EXCLUDED.revision_id,
+          -- Current + 1, not EXCLUDED.revision_number: the insert path minted 1, but on
+          -- the update path the ACTUAL row's counter is the truth (it may have advanced
+          -- since the pre-read, which is exactly what the WHERE guard below detects).
+          revision_number = skills_registry.revision_number + 1,
+          tombstoned_at = NULL,
+          tombstone_purge_after = NULL,
+          updated_at = EXCLUDED.updated_at
+        WHERE (skills_registry.tombstoned_at IS NOT NULL
+           OR skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2})
+          AND (NOT ${Boolean(input.seedBundledOnly)} OR
+            (skills_registry.tombstoned_at IS NULL AND skills_registry.source = 'bundled'
+             AND skills_registry.revision_id = ${input.expectedRevisionId ?? NO_REVISION_SENTINEL2}))
+        RETURNING *
+      `;
+      if (!rows[0]) {
+        const current = await tx`SELECT revision_id FROM skills_registry WHERE org_id = ${orgId} AND slug = ${input.slug} LIMIT 1`;
+        const currentId = current[0] && typeof current[0].revision_id === "string" ? String(current[0].revision_id) : null;
+        throw new SkillRevisionConflictError(input.slug, input.expectedRevisionId, currentId);
+      }
+      if (input.version && carriedSha) {
+        await tx`
+          INSERT INTO skills_versions (org_id, slug, version, bundle_sha256, bundle_byte_size, storage_kind, storage_key, manifest_json, published_by_user_id)
+          VALUES (${orgId}, ${input.slug}, ${input.version}, ${carriedSha}, ${carriedSize ?? 0}, ${input.versionStorage?.storageKind ?? "db"},
+                  ${input.versionStorage?.storageKey ?? null}, ${JSON.stringify(input.versionManifest ?? {})}::jsonb, ${input.principal.userId})
+          ON CONFLICT (org_id, slug, version) DO NOTHING
+        `;
+      }
+      if (previousSha && input.bundle && previousSha !== input.bundle.sha256) {
+        await tx`
+          DELETE FROM skills_bundles
+          WHERE org_id = ${orgId} AND sha256 = ${previousSha}
+            AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
+            AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${orgId} AND bundle_sha256 = ${previousSha})
+        `;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${orgId} AND slug = ${input.slug}`;
+      for (const tag of input.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${orgId}, ${input.slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(rows[0]);
+    });
+  }
+  async listSkills(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async getSkill(principal, slug) {
+    const rows = await this.sql`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+    return rows[0] ? rowToSkill(rows[0]) : null;
+  }
+  async setSkillLifecycle(principal, slug, patch, expectedRevisionId) {
+    return this.sql.begin(async (tx) => {
+      const currentRows = await tx`SELECT * FROM skills_registry WHERE org_id=${principal.orgId} AND slug=${slug} LIMIT 1 FOR UPDATE`;
+      const current = currentRows[0] ? rowToSkill(currentRows[0]) : null;
+      if (!current || current.tombstonedAt)
+        return null;
+      if (expectedRevisionId !== current.revisionId)
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+      if (patch.lifecycle === "archived" && current.lifecycle !== "archived") {
+        const profiles = await tx`SELECT profile_id,selections_json FROM skills_profiles WHERE org_id=${principal.orgId}`;
+        const referencing = profiles.filter((profile2) => {
+          const selections2 = typeof profile2.selections_json === "string" ? JSON.parse(profile2.selections_json) : profile2.selections_json;
+          return Array.isArray(selections2) && selections2.some((selection) => selection?.slug === slug);
+        }).map((profile2) => String(profile2.profile_id)).sort();
+        if (referencing.length)
+          throw new SkillLifecycleConflictError(slug, referencing);
+      }
+      const next2 = {
+        ...current,
+        lifecycle: patch.lifecycle,
+        updatedAt: nowIso(),
+        revisionId: revisionIdOfRecord({ ...current, lifecycle: patch.lifecycle, archiveReason: patch.reason, replacementSlug: patch.replacementSlug }),
+        revisionNumber: current.revisionNumber + 1,
+        ...patch.lifecycle === "archived" ? { archivedAt: current.archivedAt ?? nowIso(), ...patch.reason ? { archiveReason: patch.reason } : {}, ...patch.replacementSlug ? { replacementSlug: patch.replacementSlug } : {} } : {}
+      };
+      if (patch.lifecycle === "active") {
+        delete next2.archivedAt;
+        delete next2.archiveReason;
+        delete next2.replacementSlug;
+      }
+      const rows = await tx`UPDATE skills_registry SET lifecycle=${next2.lifecycle}, archived_at=${next2.archivedAt ?? null}, archive_reason=${next2.archiveReason ?? null}, replacement_slug=${next2.replacementSlug ?? null}, revision_id=${next2.revisionId}, revision_number=revision_number+1, updated_at=${next2.updatedAt} WHERE org_id=${principal.orgId} AND slug=${slug} AND tombstoned_at IS NULL AND revision_id=${current.revisionId} RETURNING *`;
+      if (!rows[0])
+        throw new SkillRevisionConflictError(slug, expectedRevisionId, (await this.getSkill(principal, slug))?.revisionId ?? null);
+      return rowToSkill(rows[0]);
+    });
+  }
+  async updateSkill(principal, slug, patch, expectedRevisionId) {
+    const current = await this.getSkill(principal, slug);
+    if (!current || current.tombstonedAt)
+      return null;
+    if (expectedRevisionId !== current.revisionId) {
+      throw new SkillRevisionConflictError(slug, expectedRevisionId, current.revisionId);
+    }
+    const next2 = { ...current, ...patch };
+    return await this.sql.begin(async (tx) => {
+      const revisionId = revisionIdOfRecord(next2);
+      const updated = await tx`
+        UPDATE skills_registry
+        SET display_name = ${next2.displayName}, description = ${next2.description}, category = ${next2.category},
+            tags_json = ${JSON.stringify(next2.tags)}::jsonb, kind = ${next2.kind}, version = ${next2.version ?? null},
+            skill_md = ${next2.skillMd ?? null}, revision_id = ${revisionId}, revision_number = revision_number + 1, updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug} AND tombstoned_at IS NULL AND revision_id = ${current.revisionId}
+        RETURNING *
+      `;
+      if (!updated[0]) {
+        const nowRows = await tx`
+          SELECT revision_id, tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+        `;
+        if (nowRows[0] && nowRows[0].tombstoned_at == null) {
+          const currentId = String(nowRows[0].revision_id);
+          throw new SkillRevisionConflictError(slug, expectedRevisionId, currentId);
+        }
+        return null;
+      }
+      await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${slug}`;
+      for (const tag of next2.tags) {
+        if (!tag.trim())
+          continue;
+        await tx`
+          INSERT INTO skills_tags (org_id, slug, tag) VALUES (${principal.orgId}, ${slug}, ${tag})
+          ON CONFLICT DO NOTHING
+        `;
+      }
+      return rowToSkill(updated[0]);
+    });
+  }
+  async deleteSkill(principal, slug, tombstoneWindowMs) {
+    return await this.sql.begin(async (tx) => {
+      const existingRows = await tx`
+        SELECT tombstoned_at FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1
+      `;
+      if (!existingRows[0])
+        return null;
+      if (existingRows[0].tombstoned_at != null) {
+        const rows2 = await tx`SELECT * FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${slug} LIMIT 1`;
+        return rowToSkill(rows2[0]);
+      }
+      const rows = await tx`
+        UPDATE skills_registry
+        SET tombstoned_at = now(), tombstone_purge_after = now() + (${tombstoneWindowMs}::int * interval '1 millisecond'), updated_at = now()
+        WHERE org_id = ${principal.orgId} AND slug = ${slug}
+        RETURNING *
+      `;
+      return rows[0] ? rowToSkill(rows[0]) : null;
+    });
+  }
+  async purgeExpiredTombstones(principal) {
+    return await this.sql.begin(async (tx) => {
+      const expiredRows = await tx`
+        SELECT * FROM skills_registry
+        WHERE org_id = ${principal.orgId} AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= now()
+      `;
+      if (!expiredRows.length)
+        return [];
+      const purged = [];
+      for (const row of expiredRows) {
+        const record = rowToSkill(row);
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record.slug}`;
+        await tx`
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record.slug} AND tombstone_purge_after <= now()
+        `;
+        if (record.bundleSha256) {
+          await tx`
+            DELETE FROM skills_bundles
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+              AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record.bundleSha256})
+          `;
+        }
+        purged.push(record);
+      }
+      return purged;
+    });
+  }
+  async getSkillBundle(principal, sha256) {
+    const rows = await this.sql`SELECT * FROM skills_bundles WHERE org_id = ${principal.orgId} AND sha256 = ${sha256} LIMIT 1`;
+    return rows[0] ? rowToSkillBundle(rows[0]) : null;
+  }
+  async listSkillVersions(principal, slug) {
+    const rows = await this.sql`
+      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug}
+      ORDER BY created_at DESC, version DESC
+    `;
+    return rows.map((row) => rowToSkillVersion(row));
+  }
+  async getSkillVersion(principal, slug, version) {
+    const rows = await this.sql`
+      SELECT * FROM skills_versions WHERE org_id = ${principal.orgId} AND slug = ${slug} AND version = ${version} LIMIT 1
+    `;
+    return rows[0] ? rowToSkillVersion(rows[0]) : null;
+  }
+  async pinSkill(principal, slug, metadata = {}) {
+    const rows = await this.sql`
+      INSERT INTO skills_pins (org_id, principal, slug, pinned_at, metadata_json)
+      VALUES (${principal.orgId}, ${principal.apiKeyId}, ${slug}, now(), ${JSON.stringify(metadata)}::jsonb)
+      ON CONFLICT (org_id, principal, slug) DO UPDATE SET
+        pinned_at = now(),
+        metadata_json = EXCLUDED.metadata_json
+      RETURNING *
+    `;
+    return rowToPin(rows[0]);
+  }
+  async unpinSkill(principal, slug) {
+    const rows = await this.sql`
+      DELETE FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} AND slug = ${slug}
+      RETURNING 1 AS present
+    `;
+    return rows.length > 0;
+  }
+  async listPins(principal) {
+    const rows = await this.sql`
+      SELECT * FROM skills_pins WHERE org_id = ${principal.orgId} AND principal = ${principal.apiKeyId} ORDER BY slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listTags(principal) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT DISTINCT t.tag FROM skills_tags t JOIN skills_registry s ON s.org_id = t.org_id AND s.slug = t.slug WHERE t.org_id = ${principal.orgId} AND s.lifecycle = 'active' ORDER BY t.tag ASC
+    `;
+    return rows.map((row) => String(row.tag));
+  }
+  async listSkillsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT s.* FROM skills_registry s
+      JOIN skills_tags t ON t.org_id = s.org_id AND t.slug = s.slug
+      WHERE t.org_id = ${principal.orgId} AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
+      ORDER BY s.slug ASC
+    `;
+    return rows.map(rowToSkill);
+  }
+  async listPinsByTag(principal, tag) {
+    await this.purgeExpiredTombstones(principal);
+    const rows = await this.sql`
+      SELECT p.* FROM skills_pins p
+      JOIN skills_tags t ON t.org_id = p.org_id AND t.slug = p.slug
+      JOIN skills_registry s ON s.org_id = p.org_id AND s.slug = p.slug
+      WHERE p.org_id = ${principal.orgId} AND p.principal = ${principal.apiKeyId}
+        AND t.tag = ${tag} AND s.tombstoned_at IS NULL AND s.lifecycle = 'active'
+      ORDER BY p.slug ASC
+    `;
+    return rows.map(rowToPin);
+  }
+  async listPublishedSlugs(principal) {
+    const rows = await this.sql`
+      SELECT slug FROM skills_registry WHERE org_id = ${principal.orgId} AND tombstoned_at IS NULL ORDER BY slug ASC
+    `;
+    return rows.map((row) => String(row.slug));
+  }
+  async collectOrphanBundle(orgId, sha256) {
+    await this.sql`
+      DELETE FROM skills_bundles
+      WHERE org_id = ${orgId} AND sha256 = ${sha256}
+        AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${orgId} AND bundle_sha256 = ${sha256})
+        AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${orgId} AND bundle_sha256 = ${sha256})
+    `;
+  }
+}
+var NO_REVISION_SENTINEL2 = "0000000000000000000000000000000000000000000000000000000000000000";
+function isUniqueViolation(error) {
+  const code = error?.code;
+  if (code === "23505" || code === 23505)
+    return true;
+  const message = error instanceof Error ? error.message : String(error);
+  return /duplicate key value violates unique constraint/i.test(message);
+}
+function connectionFailureSummary(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/[a-z][a-z0-9+.-]*:\/\/\S*/gi, "<redacted-url>").split(`
+`)[0].slice(0, 200);
+}
+
+// src/server/maintenance-entry.ts
+var MAX_MANIFEST_BYTES = 32 * 1024;
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.entries(value).filter(([key]) => key !== "manifestDigest").sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => `${JSON.stringify(key)}:${canonical(child)}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function readBoundedJson(path) {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.size > MAX_MANIFEST_BYTES)
+    throw new Error("maintenance input must be a bounded regular file");
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const current = fstatSync(fd);
+    if (!current.isFile() || current.size !== stat.size || current.size > MAX_MANIFEST_BYTES)
+      throw new Error("maintenance input changed or is not bounded");
+    const bytes = Buffer.alloc(current.size);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const count = readSync(fd, bytes, offset, bytes.length - offset, null);
+      if (count === 0)
+        throw new Error("maintenance input ended early");
+      offset += count;
+    }
+    return { value: JSON.parse(bytes.toString("utf8")), bytesSha256: sha256(bytes.toString("utf8")) };
+  } finally {
+    closeSync(fd);
+  }
+}
+function readManifest(path, receiptPath) {
+  const manifestInput = readBoundedJson(path);
+  const receiptInput = readBoundedJson(receiptPath);
+  const parsed = manifestInput.value;
+  const receipt = receiptInput.value;
+  if (parsed.operation !== "enroll-publish")
+    throw new Error("maintenance manifest operation must be enroll-publish");
+  if (parsed.manifestVersion !== 1)
+    throw new Error("unsupported maintenance manifest version");
+  for (const field of ["keyId", "stationId", "orgId", "operationId", "manifestDigest", "expiresAt"]) {
+    if (typeof parsed[field] !== "string" || !parsed[field].trim())
+      throw new Error(`maintenance manifest is missing ${field}`);
+  }
+  if (!Array.isArray(parsed.expectedScopes) || parsed.expectedScopes.length === 0 || parsed.expectedScopes.length > 32 || parsed.expectedScopes.some((scope) => typeof scope !== "string" || !scope.trim() || scope.length > 128 || !/^[a-z][a-z0-9_-]*:[a-z][a-z0-9_-]*$/.test(scope))) {
+    throw new Error("maintenance manifest expectedScopes must be a non-empty string array");
+  }
+  if (parsed.expectedScopes.includes("skills:publish"))
+    throw new Error("maintenance manifest must describe current scopes without skills:publish");
+  const expiry = Date.parse(parsed.expiresAt);
+  if (!Number.isFinite(expiry) || expiry <= Date.now())
+    throw new Error("maintenance manifest has an invalid or expired expiry");
+  if (!/^[a-f0-9]{64}$/.test(parsed.manifestDigest))
+    throw new Error("maintenance manifest digest must be SHA-256");
+  if (sha256(canonical(parsed)) !== parsed.manifestDigest)
+    throw new Error("maintenance manifest digest does not match its bytes");
+  if (typeof receipt.operatorJobId !== "string" || !receipt.operatorJobId.trim() || typeof receipt.operatorTaskArn !== "string" || !receipt.operatorTaskArn.trim())
+    throw new Error("verified operator receipt is incomplete");
+  if (typeof receipt.manifestBytesSha256 !== "string" || !/^[a-f0-9]{64}$/.test(receipt.manifestBytesSha256))
+    throw new Error("verified operator receipt digest is invalid");
+  if (manifestInput.bytesSha256 !== receipt.manifestBytesSha256)
+    throw new Error("manifest bytes are not the bytes verified by the operator wrapper");
+  if (typeof receipt.taskDefinitionArn !== "string" || !receipt.taskDefinitionArn.trim() || typeof receipt.verifiedAt !== "string" || !Number.isFinite(Date.parse(receipt.verifiedAt)))
+    throw new Error("verified operator receipt provenance is invalid");
+  return { ...parsed, operatorJobId: receipt.operatorJobId, operatorTaskArn: receipt.operatorTaskArn };
+}
+function registerMaintenance(parent) {
+  const maintenance = parent.command("maintenance").description("Run protected, metadata-only Skills maintenance operations");
+  maintenance.command("enroll-publish").requiredOption("--manifest <path>", "Bounded target manifest supplied by the protected task wrapper").requiredOption("--operator-receipt <path>", "Verified actor receipt written by the protected task wrapper").option("--apply", "Commit the bounded scope update; defaults to dry-run", false).option("--json", "Output a safe JSON receipt", false).action(async (options) => {
+    let manifest;
+    let store;
+    try {
+      manifest = readManifest(options.manifest, options.operatorReceipt);
+      if (!validOperatorScopeEnrollmentInput(manifest))
+        throw new Error("maintenance manifest fields are invalid or unbounded");
+      const databaseUrl = process.env.HASNA_SKILLS_DATABASE_URL;
+      if (!databaseUrl)
+        throw new Error("maintenance requires HASNA_SKILLS_DATABASE_URL");
+      store = await createStore({ databaseUrl });
+      const snapshot = await store.inspectOperatorScopeTarget?.(manifest.keyId, manifest.orgId);
+      if (!snapshot)
+        throw new Error("configured store does not support operator maintenance");
+      if (snapshot.kind !== "found")
+        throw new Error(`operator target ${snapshot.kind}`);
+      if (!validOperatorScopeList(snapshot.scopes))
+        throw new Error("store returned invalid scope metadata");
+      const base = { status: "dry-run", operationId: manifest.operationId, keyId: manifest.keyId, stationId: manifest.stationId, orgId: manifest.orgId, expectedScopes: manifest.expectedScopes, currentScopes: snapshot.scopes, addScopes: ["skills:publish"] };
+      if (!options.apply) {
+        console.log(JSON.stringify(base));
+        return;
+      }
+      const result = await store.enrollPublishScopeByOperator?.(manifest);
+      if (!result)
+        throw new Error("configured store does not support operator maintenance");
+      if ("scopes" in result && !validOperatorScopeList(result.scopes))
+        throw new Error("store returned invalid scope metadata");
+      console.log(JSON.stringify({ ...base, status: result.kind, scopes: "scopes" in result ? result.scopes : undefined }));
+      if (result.kind === "updated" || result.kind === "already_applied")
+        return;
+      process.exitCode = 1;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "";
+      const code = message.includes("expired") || message.includes("expiry") ? "INVALID_EXPIRY" : message.includes("receipt") || message.includes("operator") ? "INVALID_OPERATOR_RECEIPT" : message.includes("manifest") || message.includes("input") ? "INVALID_MANIFEST" : message.includes("database") || message.includes("store") ? "STORE_UNAVAILABLE" : "MAINTENANCE_FAILED";
+      if (options.json || !process.stdout.isTTY)
+        console.log(JSON.stringify({ status: "failed", code }));
+      else
+        console.error(code);
+      process.exitCode = 1;
+    } finally {
+      await store?.close?.();
+    }
+  });
+}
+
+// src/server/maintenance.ts
+var program2 = new Command;
+program2.name("skills-maintenance");
+registerMaintenance(program2);
+await program2.parseAsync(process.argv);