@hasna/skills 0.10.25 → 0.10.27

package/dist/sdk/index.js

@@ -22023,18 +22023,18 @@ var require_protocols2 = __commonJS((exports) => {
       }
       return value;
     }
-    _readStruct(ns, record3) {
+    _readStruct(ns, record4) {
       const union = ns.isUnionSchema();
       const out = {};
       let nameMap;
-      const hasType = typeof record3.__type === "string";
+      const hasType = typeof record4.__type === "string";
       const { jsonName } = this.settings;
       if (jsonName && hasType) {
         nameMap = {};
       }
       let unionSerde;
       if (union) {
-        unionSerde = new UnionSerde(record3, out);
+        unionSerde = new UnionSerde(record4, out);
       }
       for (const [memberName, memberSchema] of ns.structIterator()) {
         let fromKey = memberName;
@@ -22047,15 +22047,15 @@ var require_protocols2 = __commonJS((exports) => {
         if (union) {
           unionSerde.mark(fromKey);
         }
-        if (record3[fromKey] != null) {
-          out[memberName] = this._read(memberSchema, record3[fromKey]);
+        if (record4[fromKey] != null) {
+          out[memberName] = this._read(memberSchema, record4[fromKey]);
         }
       }
       if (union) {
         unionSerde.writeUnknown();
       } else if (hasType) {
-        for (const k in record3) {
-          const v = record3[k];
+        for (const k in record4) {
+          const v = record4[k];
           const t2 = jsonName ? nameMap[k] ?? k : k;
           if (!(t2 in out)) {
             out[t2] = v;
@@ -22911,7 +22911,7 @@ var require_protocols2 = __commonJS((exports) => {
       const ns = NormalizedSchema.of(schema);
       if (isObject) {
         if (ns.isStructSchema()) {
-          const record3 = value;
+          const record4 = value;
           const union = ns.isUnionSchema();
           const out = {};
           let nameMap = undefined;
@@ -22921,7 +22921,7 @@ var require_protocols2 = __commonJS((exports) => {
           }
           let unionSerde;
           if (union) {
-            unionSerde = new UnionSerde(record3, out);
+            unionSerde = new UnionSerde(record4, out);
           }
           for (const [memberName, memberSchema] of ns.structIterator()) {
             let fromKey = memberName;
@@ -22932,15 +22932,15 @@ var require_protocols2 = __commonJS((exports) => {
             if (union) {
               unionSerde.mark(fromKey);
             }
-            if (record3[fromKey] != null) {
-              out[memberName] = this._read(memberSchema, record3[fromKey]);
+            if (record4[fromKey] != null) {
+              out[memberName] = this._read(memberSchema, record4[fromKey]);
             }
           }
           if (union) {
             unionSerde.writeUnknown();
-          } else if (typeof record3.__type === "string") {
-            for (const k in record3) {
-              const v = record3[k];
+          } else if (typeof record4.__type === "string") {
+            for (const k in record4) {
+              const v = record4[k];
               const t2 = jsonName ? nameMap[k] ?? k : k;
               if (!(t2 in out)) {
                 out[t2] = v;
@@ -23124,7 +23124,7 @@ var require_protocols2 = __commonJS((exports) => {
       const ns = NormalizedSchema.of(schema);
       if (isObject) {
         if (ns.isStructSchema()) {
-          const record3 = value;
+          const record4 = value;
           const out = {};
           const { jsonName } = this.settings;
           let nameMap = undefined;
@@ -23133,7 +23133,7 @@ var require_protocols2 = __commonJS((exports) => {
           }
           let outCount = 0;
           for (const [memberName, memberSchema] of ns.structIterator()) {
-            const serializableValue = this._write(memberSchema, record3[memberName], ns);
+            const serializableValue = this._write(memberSchema, record4[memberName], ns);
             if (serializableValue !== undefined) {
               let targetKey = memberName;
               if (jsonName) {
@@ -23145,7 +23145,7 @@ var require_protocols2 = __commonJS((exports) => {
             }
           }
           if (ns.isUnionSchema() && outCount === 0) {
-            const { $unknown } = record3;
+            const { $unknown } = record4;
             if (Array.isArray($unknown)) {
               const [k, v] = $unknown;
               if (k === "__proto__") {
@@ -23153,9 +23153,9 @@ var require_protocols2 = __commonJS((exports) => {
               }
               out[k] = this._write(15, v);
             }
-          } else if (typeof record3.__type === "string") {
-            for (const k in record3) {
-              const v = record3[k];
+          } else if (typeof record4.__type === "string") {
+            for (const k in record4) {
+              const v = record4[k];
               const targetKey = jsonName ? nameMap[k] ?? k : k;
               if (!(targetKey in out)) {
                 out[targetKey] = this._write(15, v);
@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.25",
+  version: "0.10.27",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -37694,6 +37694,72 @@ import {
 import { homedir as homedir5 } from "os";
 import { basename as basename11, dirname as dirname19, join as join27 } from "path";
 
+// src/lib/codex-local-mcp-controls.ts
+function isCodexLocalStdioMcpServer(name, server) {
+  const identifier3 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
+  const refuse2 = () => {
+    throw new Error("Unsupported Codex local stdio MCP controls");
+  };
+  const object2 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  try {
+    if (!identifier3(name) || !object2(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object2(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value]) => envName(key) && textField(value, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse2();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse2();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object2(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse2();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse2();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object2(server.tools) || Object.keys(server.tools).length > 256)
+        refuse2();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object2(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse2();
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/claude-settings-witness.ts
 import { createHash as createHash5 } from "crypto";
 import { closeSync as closeSync9, constants as constants5, fstatSync as fstatSync9, lstatSync as lstatSync5, openSync as openSync9, readSync as readSync4 } from "fs";
@@ -38375,65 +38441,14 @@ function mcpControls(path, read) {
     refuse3();
   }
   const object3 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
-  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
-  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
-  const optional = (v, valid) => v === undefined || v === null || valid(v);
-  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
-  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
-  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
-  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
-  const fields = [
-    "command",
-    "args",
-    "cwd",
-    "env",
-    "env_vars",
-    "enabled",
-    "required",
-    "environment_id",
-    "startup_readiness",
-    "supports_parallel_tool_calls",
-    "tool_input_schema_max_bytes",
-    "startup_timeout_sec",
-    "startup_timeout_ms",
-    "tool_timeout_sec",
-    "default_tools_approval_mode",
-    "enabled_tools",
-    "disabled_tools",
-    "omit_tools_from",
-    "tools",
-    "name"
-  ];
   if (!object3(value) || Object.keys(value).length !== 1 || !object3(value.mcpServers))
     refuse3();
   const servers = Object.entries(value.mcpServers);
   if (!servers.length || servers.length > 256)
     refuse3();
-  for (const [name, server] of servers) {
-    if (!identifier3(name) || !object3(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object3(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+  for (const [name, server] of servers)
+    if (!isCodexLocalStdioMcpServer(name, server))
       refuse3();
-    if (server.env_vars !== undefined && server.env_vars !== null) {
-      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
-        refuse3();
-      const names = server.env_vars.map((entry) => {
-        if (envName(entry))
-          return entry;
-        if (!object3(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
-          refuse3();
-        return entry.name;
-      });
-      if (new Set(names).size !== names.length)
-        refuse3();
-    }
-    if (server.tools !== undefined && server.tools !== null) {
-      if (!object3(server.tools) || Object.keys(server.tools).length > 256)
-        refuse3();
-      for (const [tool, config] of Object.entries(server.tools)) {
-        if (!textField(tool) || !object3(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
-          refuse3();
-      }
-    }
-  }
   return sha2562;
 }
 function rootControls(root, read) {
@@ -38803,6 +38818,69 @@ function captureCodexSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
   const text = readNativeSettingsWitnessFile(path, budget, "config.toml");
   return { path, hashMode: "codex-settings-v1", sha256: hashCodexSettingsReplacement(text) };
 }
+// src/lib/codex-mcp-discovery-projection.ts
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function localStdio(name, row) {
+  return name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row);
+}
+function stripEmptyParent(config) {
+  if (record2(config.mcp_servers) && !Object.keys(config.mcp_servers).length)
+    delete config.mcp_servers;
+  return config;
+}
+function projectRegularCodexMcp(config, source) {
+  const unchanged2 = { config, numericSource: source };
+  if (!record2(config.mcp_servers))
+    return unchanged2;
+  const candidates = Object.entries(config.mcp_servers).filter(([name, row]) => localStdio(name, row)).map(([name]) => name);
+  if (!candidates.length)
+    return unchanged2;
+  const headers = [];
+  let attempts = 0;
+  for (const match of source.matchAll(/^[ \t]*\[{1,2}[^\r\n]*\]{1,2}[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    if (++attempts > 256)
+      return unchanged2;
+    try {
+      Bun.TOML.parse(source.slice(0, match.index));
+    } catch {
+      continue;
+    }
+    let header;
+    try {
+      header = Bun.TOML.parse(match[0]);
+    } catch {
+      return unchanged2;
+    }
+    const path = [];
+    while (record2(header) && Object.keys(header).length === 1) {
+      const key = Object.keys(header)[0];
+      path.push(key);
+      header = header[key];
+    }
+    headers.push({ start: match.index, path });
+  }
+  const names = candidates.filter((name) => headers.filter((header) => header.path.length === 2 && header.path[0] === "mcp_servers" && header.path[1] === name).length === 1);
+  if (!names.length)
+    return unchanged2;
+  const selected = headers.map((header, index) => ({ ...header, end: headers[index + 1]?.start ?? source.length })).filter((header) => header.path[0] === "mcp_servers" && names.includes(header.path[1]));
+  let numericSource = source;
+  for (const range of selected.reverse())
+    numericSource = numericSource.slice(0, range.start) + numericSource.slice(range.end);
+  const expected = structuredClone(config);
+  for (const name of names)
+    delete expected.mcp_servers[name];
+  stripEmptyParent(expected);
+  try {
+    if (!isDeepStrictEqual3(stripEmptyParent(Bun.TOML.parse(numericSource)), expected))
+      return unchanged2;
+  } catch {
+    return unchanged2;
+  }
+  return { config: expected, numericSource };
+}
 
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash7 } from "crypto";
@@ -38882,7 +38960,7 @@ function canonical3(value, depth = 0, budget = { remaining: 65536 }) {
   need3(isRecord(value));
   return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical3(child, depth + 1, budget)])];
 }
-function normalize2(config) {
+function normalize2(config, version = 2) {
   if (isRecord(config.hooks)) {
     delete config.hooks.state;
     if (!Object.keys(config.hooks).length)
@@ -38900,11 +38978,11 @@ function normalize2(config) {
     if (!Object.keys(skills).length)
       delete config.skills;
   }
-  inference(config);
+  inference(config, version);
   if (isRecord(config.profiles)) {
     for (const profile of Object.values(config.profiles))
       if (isRecord(profile))
-        inference(profile);
+        inference(profile, version);
   }
 }
 function disablesOneSkill(entry) {
@@ -38916,18 +38994,23 @@ function disablesOneSkill(entry) {
   const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
-function inference(target) {
-  for (const key of INFERENCE)
+function inference(target, version) {
+  const keys2 = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort"] : INFERENCE;
+  for (const key of keys2)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
       if (key === "model")
         need3(typeof value === "string" && MODEL.test(value));
-      else
+      else if (version === 3 && key !== "model_verbosity") {
+        need3(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
+        if (key !== "service_tier")
+          need3(value.length > 0);
+      } else
         need3(typeof value === "string" && (key === "model_reasoning_effort" ? EFFORT2.has(value) : VERBOSITY2.has(value)));
       delete target[key];
     }
 }
-function settingsDigest2(text) {
+function settingsDigest2(text, version = 2) {
   let config;
   try {
     config = Bun.TOML.parse(text);
@@ -38935,8 +39018,9 @@ function settingsDigest2(text) {
     throw new Error("Invalid Codex settings witness");
   }
   need3(isRecord(config));
-  normalize2(config);
-  return sha2(`hasna.skills.codex-settings.v2\x00${JSON.stringify([canonical3(config), numericTokens2(text)])}`);
+  const projected = version === 3 ? projectRegularCodexMcp(config, text) : { config, numericSource: text };
+  normalize2(projected.config, version);
+  return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical3(projected.config), numericTokens2(projected.numericSource)])}`);
 }
 function hashCodexSettingsReplacementV2(text, budget = { remaining: 256 * 1024 * 1024 }) {
   need3(Buffer.byteLength(text) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text));
@@ -38960,6 +39044,25 @@ function upgradeCodexSettingsWitness(previous, reviewedSettingsPath) {
     throw new Error("Codex non-preference settings changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v2", sha256: sha2562 };
 }
+function hashCodexSettingsReplacementV3(text, budget = { remaining: 256 * 1024 * 1024 }) {
+  need3(Buffer.byteLength(text) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text));
+  budget.remaining -= Buffer.byteLength(text);
+  return settingsDigest2(text, 3);
+}
+function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+}
+function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
+  need3(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v2" ? settingsDigest2(before) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before) : sha2(before);
+  need3(original === previous.sha256);
+  const sha2562 = settingsDigest2(current, 3);
+  if (settingsDigest2(before, 3) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
+}
 
 // src/lib/native-discovery-roots.ts
 var NATIVE_SKILL_ROOTS = [
@@ -38982,7 +39085,7 @@ var NATIVE_SKILL_ROOTS = [
 
 // src/lib/agent-integration.ts
 import { createHash as createHash18, randomUUID as randomUUID3 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 import { existsSync as existsSync6, lstatSync as lstatSync19, statSync as statSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync2 } from "fs";
 import { dirname as dirname15, join as join22, resolve as resolve15, relative as relative4, isAbsolute as isAbsolute17, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
@@ -39005,7 +39108,7 @@ function array(value, maximum) {
   requireBound(Array.isArray(value) && value.length <= maximum);
   return value;
 }
-function record2(value, maximum) {
+function record3(value, maximum) {
   requireBound(object3(value) && Object.keys(value).length <= maximum);
   return value;
 }
@@ -39015,13 +39118,13 @@ function text(value, maximum = AGENT_POLICY_LIMITS.pathCharacters) {
 function assertAgentPolicyCollections(policy) {
   if (policy.bridge === undefined)
     return;
-  const bridge = record2(policy.bridge, 64);
+  const bridge = record3(policy.bridge, 64);
   if (bridge.agents !== undefined)
     for (const agent of array(bridge.agents, AGENT_POLICY_LIMITS.agents))
       text(agent, 128);
   for (const key of ["commands", "profiles", "supervisors"])
     if (bridge[key] !== undefined) {
-      const entries = record2(bridge[key], AGENT_POLICY_LIMITS.agents);
+      const entries = record3(bridge[key], AGENT_POLICY_LIMITS.agents);
       for (const [agent, value] of Object.entries(entries)) {
         text(agent, 128);
         if (key === "supervisors") {
@@ -39074,12 +39177,12 @@ function assertAgentPolicyCollections(policy) {
     }
   if (bridge.discovery === undefined)
     return;
-  for (const [agent, value] of Object.entries(record2(bridge.discovery, AGENT_POLICY_LIMITS.agents))) {
+  for (const [agent, value] of Object.entries(record3(bridge.discovery, AGENT_POLICY_LIMITS.agents))) {
     text(agent, 128);
     requireBound(object3(value));
     text(value.agent, 128);
     if (value.codexInstallationInputs !== undefined) {
-      const proof = record2(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
+      const proof = record3(value.codexInstallationInputs, 4), inputs = array(proof.plugins, 4096), ids = new Set;
       requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && proof.version === "codex-cli 0.160.0" && typeof proof.catalogSha256 === "string" && /^[a-f0-9]{64}$/.test(proof.catalogSha256) && inputs.length > 0 && object3(bridge.codexPluginSkillReview) && bridge.codexPluginSkillReview.version === proof.version && bridge.codexPluginSkillReview.catalogSha256 === proof.catalogSha256);
       for (const input of inputs) {
         requireBound(object3(input) && Object.keys(input).every((key) => ["pluginId", "namespace", "pluginParent", "sourceRoot", "sourceSha256"].includes(key)));
@@ -39104,8 +39207,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute6(source.path) && resolve5(source.path) === source.path && basename4(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute6(source.path) && resolve5(source.path) === source.path && basename4(source.path) === "settings.json");
@@ -39265,7 +39368,7 @@ function isOwnedCliBridge(path, expectedPaths) {
 import { createHash as createHash17 } from "crypto";
 import { lstatSync as lstatSync18, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync6 } from "fs";
 import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute16, join as join21, resolve as resolve14, sep as sep4 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -39683,7 +39786,7 @@ function trace(path) {
   canonical4(path);
   const rows = [], paths = [];
   let metadataBytes = 0, steps = 0, links = 0, cursor = parse3(path).root, pending = path.slice(cursor.length).split(sep3);
-  function record3(path2, row) {
+  function record4(path2, row) {
     const value = { path: path2, ...row };
     metadataBytes += Buffer.byteLength(JSON.stringify(value));
     if (metadataBytes > AGENT_POLICY_LIMITS.discoveryPathSourceMetadataBytes)
@@ -39695,7 +39798,7 @@ function trace(path) {
     const stat = lstatSync12(cursor, { bigint: true });
     if (!stat.isDirectory())
       throw new Error("Unsupported discovery path root");
-    record3(cursor, { type: "directory", ...identity3(stat) });
+    record4(cursor, { type: "directory", ...identity3(stat) });
   }
   root();
   while (pending.length) {
@@ -39713,7 +39816,7 @@ function trace(path) {
       throw new Error("Discovery resolved path length limit exceeded");
     const stat = lstatSync12(candidate, { bigint: true, throwIfNoEntry: false });
     if (!stat) {
-      record3(candidate, { type: "missing", remaining: pending });
+      record4(candidate, { type: "missing", remaining: pending });
       return { rows, paths, file: null, missing: candidate, metadataBytes };
     }
     if (stat.isSymbolicLink()) {
@@ -39724,7 +39827,7 @@ function trace(path) {
         throw new Error("Unsupported non-UTF8 discovery link target");
       if (!target || target.includes("\x00") || Buffer.byteLength(target) > AGENT_POLICY_LIMITS.pathCharacters || !after.isSymbolicLink() || JSON.stringify(identity3(stat, true)) !== JSON.stringify(identity3(after, true)))
         throw new Error("Discovery link changed during read");
-      record3(candidate, { type: "link", target, ...identity3(stat, true) });
+      record4(candidate, { type: "link", target, ...identity3(stat, true) });
       if (isAbsolute10(target)) {
         cursor = parse3(target).root;
         root();
@@ -39736,7 +39839,7 @@ function trace(path) {
       continue;
     }
     if (stat.isDirectory()) {
-      record3(candidate, { type: "directory", ...identity3(stat) });
+      record4(candidate, { type: "directory", ...identity3(stat) });
       cursor = candidate;
       continue;
     }
@@ -39744,7 +39847,7 @@ function trace(path) {
       throw new Error("Unsupported discovery path input");
     if (stat.size > BigInt(AGENT_POLICY_LIMITS.discoveryRawSourceBytes))
       throw new Error("Unsupported or oversized raw discovery input");
-    record3(candidate, { type: "file", ...identity3(stat, true) });
+    record4(candidate, { type: "file", ...identity3(stat, true) });
     return { rows, paths, file: candidate, missing: null, metadataBytes };
   }
   throw new Error("Unsupported directory discovery path input");
@@ -41615,19 +41718,19 @@ function projectNativeDiscoveryFields(text2, format, fields2, path) {
   return digest2(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual3(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual4(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && source.hashMode === "codex-settings-v2");
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -41727,7 +41830,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename7(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename7(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename7(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -41877,10 +41980,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual3(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual4(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -41894,7 +41997,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -42078,7 +42181,7 @@ export default async ({ directory }) => {
 }
 
 // src/lib/agent-codex.ts
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 var CODEX_SKILL_CONFIG_SECTIONS = /^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm;
 var codexPathConfigRefusal = () => new Error("Codex skill path controls require ordinary [[skills.config]] TOML tables or a native single-line inline array; preserve and review unsupported inline, dotted, or malformed definitions before running skills hook install");
 function splitTopLevel(value, delimiter) {
@@ -42209,7 +42312,7 @@ function normalizeCodexInlinePathConfig(text2) {
   const expectedWithoutConfig = structuredClone(before);
   delete expectedWithoutConfig.skills.config;
   try {
-    if (isDeepStrictEqual4(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+    if (isDeepStrictEqual5(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
       return text2;
   } catch {}
   const matches = [];
@@ -42262,7 +42365,7 @@ function normalizeCodexInlinePathConfig(text2) {
     try {
       const after = Bun.TOML.parse(candidate2);
       const expected = structuredClone(before);
-      if (isDeepStrictEqual4(after, expected))
+      if (isDeepStrictEqual5(after, expected))
         matches.push(candidate2);
     } catch {}
   }
@@ -42278,11 +42381,11 @@ function assertCodexPathConfigEditable(text2) {
   delete expected.skills.config;
   try {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual4(withoutSections, expected))
+    if (isDeepStrictEqual5(withoutSections, expected))
       return;
     const normalized = normalizeCodexInlinePathConfig(text2);
     const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual4(withoutNormalizedSections, expected))
+    if (isDeepStrictEqual5(withoutNormalizedSections, expected))
       return;
   } catch {}
   throw codexPathConfigRefusal();
@@ -42320,7 +42423,7 @@ function disableCodexBundledSkills(text2) {
   const candidates = new Set;
   const consider = (candidate2) => {
     try {
-      if (isDeepStrictEqual4(Bun.TOML.parse(candidate2), expected))
+      if (isDeepStrictEqual5(Bun.TOML.parse(candidate2), expected))
         candidates.add(candidate2);
     } catch {}
   };
@@ -42650,7 +42753,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
-    if (configuredRoot && agent === "codex" && installationInputs.includes(path))
+    if (configuredRoot && agent === "codex" && installationInputs.some((root2) => path === root2 || path.startsWith(`${root2}${sep5}`)))
       return scan;
     if (!existsSync6(path))
       return scan;
@@ -43131,6 +43234,8 @@ function atomicWrite2(path, content) {
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+    throw new Error("Invalid Codex witness target version");
   const home = resolve15(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot2 || sha4(snapshot2.text) !== options.expectedPolicySha256)
@@ -43152,21 +43257,21 @@ function planAgentSettingsWitnessUpgrade(options) {
     throw new Error("Settings witness upgrade requires a preserved settings preimage");
   const replaced = [previous];
   if (options.agent === "codex") {
-    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1")
-      throw new Error("Codex settings witness upgrade requires a preserved raw or codex-settings-v1 configuration witness");
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+      throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
     const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
     for (const source of binding.sources) {
       if (source === previous || source.path !== configPath)
         continue;
       const fields2 = source.fields;
-      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields2) || !isDeepStrictEqual5(fields2, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields2) || !isDeepStrictEqual6(fields2, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
         throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
       if (projectNativeDiscoveryFields(preimage, "toml", fields2, configPath) !== source.sha256)
         throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -43203,7 +43308,7 @@ function applyAgentIntegration(plan) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha4(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];
@@ -43624,22 +43729,22 @@ function canonicalizeManifest(raw) {
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     return normalizeLineEndings(raw);
   }
-  const record3 = parsed;
-  delete record3.content_hash;
-  if (record3.provenance && typeof record3.provenance === "object" && !Array.isArray(record3.provenance)) {
-    delete record3.provenance.content_hash;
+  const record4 = parsed;
+  delete record4.content_hash;
+  if (record4.provenance && typeof record4.provenance === "object" && !Array.isArray(record4.provenance)) {
+    delete record4.provenance.content_hash;
   }
-  return `${JSON.stringify(sortObjectKeys(record3), null, 2)}
+  return `${JSON.stringify(sortObjectKeys(record4), null, 2)}
 `;
 }
 function sortObjectKeys(value) {
   if (Array.isArray(value))
     return value.map((item) => sortObjectKeys(item));
   if (typeof value === "object" && value !== null) {
-    const record3 = value;
+    const record4 = value;
     const sorted = Object.create(null);
-    for (const key of Object.keys(record3).sort())
-      sorted[key] = sortObjectKeys(record3[key]);
+    for (const key of Object.keys(record4).sort())
+      sorted[key] = sortObjectKeys(record4[key]);
     return sorted;
   }
   return value;
@@ -43778,10 +43883,10 @@ function contentRecord(value, allowed) {
   return result;
 }
 function contentOptions(options) {
-  const record3 = contentRecord(options, ["limits", "signal"]);
+  const record4 = contentRecord(options, ["limits", "signal"]);
   const limits = { ...CONTENT_HASH_LIMITS };
-  if (record3.limits !== undefined) {
-    const supplied = contentRecord(record3.limits, Object.keys(limits));
+  if (record4.limits !== undefined) {
+    const supplied = contentRecord(record4.limits, Object.keys(limits));
     for (const key of Object.keys(supplied)) {
       const value = supplied[key];
       if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > limits[key])
@@ -43789,9 +43894,9 @@ function contentOptions(options) {
       limits[key] = value;
     }
   }
-  if (record3.signal !== undefined && !(record3.signal instanceof AbortSignal))
+  if (record4.signal !== undefined && !(record4.signal instanceof AbortSignal))
     invalidContent("Invalid content hash signal");
-  return { limits, signal: record3.signal };
+  return { limits, signal: record4.signal };
 }
 var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
 var byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
@@ -46996,44 +47101,44 @@ async function subprocess(command, cwd, env, input, timeoutMs) {
 // src/lib/remote-run-contract.ts
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record3 = isRecord4(payload) ? payload : {};
+  const record4 = isRecord4(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record3, "id"),
-    skill: pickStringValue(record3, "skill") ?? fallbackSkill,
-    ...pickString(record3, "requestedSlug"),
-    ...pickString(record3, "status"),
-    ...pickNumber(record3, "exitCode"),
-    ...pickString(record3, "correlationId"),
-    ...pickString(record3, "createdAt"),
-    ...pickString(record3, "startedAt"),
-    ...pickString(record3, "completedAt"),
-    ...pickNumber(record3, "durationMs"),
-    ...pickString(record3, "outputType"),
-    ...hasOwn(record3, "outputPreview") ? { outputPreview: record3.outputPreview } : {},
-    ...pickString(record3, "errorCode"),
-    ...pickString(record3, "errorMessage"),
-    ...pickString(record3, "error"),
-    ...pickString(record3, "code"),
-    ...hasOwn(record3, "details") ? { details: record3.details } : {}
+    ...pickString(record4, "id"),
+    skill: pickStringValue(record4, "skill") ?? fallbackSkill,
+    ...pickString(record4, "requestedSlug"),
+    ...pickString(record4, "status"),
+    ...pickNumber(record4, "exitCode"),
+    ...pickString(record4, "correlationId"),
+    ...pickString(record4, "createdAt"),
+    ...pickString(record4, "startedAt"),
+    ...pickString(record4, "completedAt"),
+    ...pickNumber(record4, "durationMs"),
+    ...pickString(record4, "outputType"),
+    ...hasOwn(record4, "outputPreview") ? { outputPreview: record4.outputPreview } : {},
+    ...pickString(record4, "errorCode"),
+    ...pickString(record4, "errorMessage"),
+    ...pickString(record4, "error"),
+    ...pickString(record4, "code"),
+    ...hasOwn(record4, "details") ? { details: record4.details } : {}
   };
 }
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record3, key) {
-  return Object.prototype.hasOwnProperty.call(record3, key);
+function hasOwn(record4, key) {
+  return Object.prototype.hasOwnProperty.call(record4, key);
 }
-function pickString(record3, key) {
-  const value = pickStringValue(record3, key);
+function pickString(record4, key) {
+  const value = pickStringValue(record4, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record3, key) {
-  const value = record3[key];
+function pickStringValue(record4, key) {
+  const value = record4[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record3, key) {
-  const value = record3[key];
+function pickNumber(record4, key) {
+  const value = record4[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 
@@ -57653,8 +57758,8 @@ function revisionIdOf(content) {
   const canonical6 = JSON.stringify(canonicalContent);
   return createHash24("sha256").update(canonical6).digest("hex");
 }
-function revisionIdOfRecord(record3) {
-  return revisionIdOf(record3);
+function revisionIdOfRecord(record4) {
+  return revisionIdOf(record4);
 }
 
 // src/server/sqlite-store.ts
@@ -57696,11 +57801,11 @@ class SqliteSkillsStore {
   backfillLegacyRevisions() {
     const rows = this.all("SELECT * FROM skills_registry WHERE revision_id = ''", []);
     for (const row of rows) {
-      const record3 = rowToSkill(row);
+      const record4 = rowToSkill(row);
       this.db.run("UPDATE skills_registry SET revision_id = ? WHERE org_id = ? AND slug = ?", [
-        revisionIdOfRecord(record3),
-        record3.orgId,
-        record3.slug
+        revisionIdOfRecord(record4),
+        record4.orgId,
+        record4.slug
       ]);
     }
   }
@@ -58250,12 +58355,12 @@ class SqliteSkillsStore {
       const expired = this.all("SELECT * FROM skills_registry WHERE org_id = ? AND tombstoned_at IS NOT NULL AND tombstone_purge_after <= ?", [principal.orgId, now]);
       const purged = [];
       for (const row of expired) {
-        const record3 = rowToSkill(row);
-        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record3.slug]);
-        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record3.slug]);
-        if (record3.bundleSha256)
-          this.collectOrphanBundle(principal.orgId, record3.bundleSha256);
-        purged.push(record3);
+        const record4 = rowToSkill(row);
+        this.db.run("DELETE FROM skills_registry WHERE org_id = ? AND slug = ?", [principal.orgId, record4.slug]);
+        this.db.run("DELETE FROM skills_tags WHERE org_id = ? AND slug = ?", [principal.orgId, record4.slug]);
+        if (record4.bundleSha256)
+          this.collectOrphanBundle(principal.orgId, record4.bundleSha256);
+        purged.push(record4);
       }
       return purged;
     })();
@@ -58772,35 +58877,35 @@ function skillLifecyclePatch(body) {
     throw new SkillRequestError(400, "INVALID_LIFECYCLE", "replacementSlug must be a valid skill slug");
   return { lifecycle: body.lifecycle, ...body.reason ? { reason: body.reason } : {}, ...body.replacementSlug ? { replacementSlug: body.replacementSlug } : {} };
 }
-function publishedSkillMeta(record3) {
+function publishedSkillMeta(record4) {
   return {
-    name: record3.slug,
-    displayName: record3.displayName,
-    description: record3.description,
-    category: record3.category,
-    tags: record3.tags,
-    ...record3.version ? { version: record3.version } : {},
-    kind: record3.kind,
+    name: record4.slug,
+    displayName: record4.displayName,
+    description: record4.description,
+    category: record4.category,
+    tags: record4.tags,
+    ...record4.version ? { version: record4.version } : {},
+    kind: record4.kind,
     source: "remote",
     availability: { status: "available" }
   };
 }
-function publishedPayload(record3, opts = {}) {
+function publishedPayload(record4, opts = {}) {
   return {
-    ...publishedSkillMeta(record3),
-    slug: record3.slug,
-    publishedSource: record3.source,
+    ...publishedSkillMeta(record4),
+    slug: record4.slug,
+    publishedSource: record4.source,
     ...opts.alreadyPublished ? { alreadyPublished: true } : {},
-    ...record3.skillMd ? { skillMd: record3.skillMd } : {},
-    ...record3.bundleSha256 ? { bundleSha256: record3.bundleSha256, bundleByteSize: record3.bundleByteSize } : {},
-    publishedAt: record3.createdAt,
-    updatedAt: record3.updatedAt,
-    revisionId: record3.revisionId,
-    revisionNumber: record3.revisionNumber,
-    lifecycle: record3.lifecycle,
-    ...record3.archivedAt ? { archivedAt: record3.archivedAt } : {},
-    ...record3.archiveReason ? { archiveReason: record3.archiveReason } : {},
-    ...record3.replacementSlug ? { replacementSlug: record3.replacementSlug } : {}
+    ...record4.skillMd ? { skillMd: record4.skillMd } : {},
+    ...record4.bundleSha256 ? { bundleSha256: record4.bundleSha256, bundleByteSize: record4.bundleByteSize } : {},
+    publishedAt: record4.createdAt,
+    updatedAt: record4.updatedAt,
+    revisionId: record4.revisionId,
+    revisionNumber: record4.revisionNumber,
+    lifecycle: record4.lifecycle,
+    ...record4.archivedAt ? { archivedAt: record4.archivedAt } : {},
+    ...record4.archiveReason ? { archiveReason: record4.archiveReason } : {},
+    ...record4.replacementSlug ? { replacementSlug: record4.replacementSlug } : {}
   };
 }
 function revisionEtag(revisionId) {
@@ -58819,10 +58924,10 @@ function parseIfMatch(value) {
   }
   return unquoted;
 }
-async function tombstoneStatus(store, artifactStorage, principal, record3) {
-  if (!record3.tombstonedAt)
+async function tombstoneStatus(store, artifactStorage, principal, record4) {
+  if (!record4.tombstonedAt)
     return "live";
-  if (record3.tombstonePurgeAfter && record3.tombstonePurgeAfter <= new Date().toISOString()) {
+  if (record4.tombstonePurgeAfter && record4.tombstonePurgeAfter <= new Date().toISOString()) {
     const purged = await store.purgeExpiredTombstones(principal);
     for (const removed of purged) {
       if (removed.bundleSha256)
@@ -58831,33 +58936,33 @@ async function tombstoneStatus(store, artifactStorage, principal, record3) {
     return "purged";
   }
   return {
-    slug: record3.slug,
+    slug: record4.slug,
     deleted: true,
     code: "TOMBSTONED",
-    tombstonedAt: record3.tombstonedAt,
-    tombstonePurgeAfter: record3.tombstonePurgeAfter,
-    revisionId: record3.revisionId
+    tombstonedAt: record4.tombstonedAt,
+    tombstonePurgeAfter: record4.tombstonePurgeAfter,
+    revisionId: record4.revisionId
   };
 }
 async function listMergedSkills(store, principal) {
-  return (await store.listSkills(principal)).filter((record3) => record3.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
+  return (await store.listSkills(principal)).filter((record4) => record4.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record4) => publishedPayload(record4));
 }
 async function resolvePublishedSkill(store, artifactStorage, principal, slug) {
-  const record3 = await store.getSkill(principal, slug);
-  if (!record3)
+  const record4 = await store.getSkill(principal, slug);
+  if (!record4)
     return { kind: "absent" };
-  const status = await tombstoneStatus(store, artifactStorage, principal, record3);
+  const status = await tombstoneStatus(store, artifactStorage, principal, record4);
   if (status === "purged")
     return { kind: "absent" };
   if (status !== "live")
     return { kind: "tombstone", payload: status };
-  return { kind: "published", record: record3 };
+  return { kind: "published", record: record4 };
 }
 async function listOrgTags(store, principal) {
   return [...new Set((await store.listTags(principal)).filter((tag) => tag.trim()))].sort();
 }
 async function listMergedSkillsByTag(store, principal, tag) {
-  return (await store.listSkillsByTag(principal, tag)).filter((record3) => record3.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record3) => publishedPayload(record3));
+  return (await store.listSkillsByTag(principal, tag)).filter((record4) => record4.lifecycle === "active").sort((a3, b3) => a3.slug.localeCompare(b3.slug)).map((record4) => publishedPayload(record4));
 }
 function skillSummary(skill) {
   return {
@@ -58998,16 +59103,16 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed, ex
       };
     }
   }
-  let record3;
+  let record4;
   try {
-    record3 = await store.publishSkill(input);
+    record4 = await store.publishSkill(input);
   } catch (error) {
     if (input.bundle?.sha256) {
       await discardCollectedObject(store, artifactStorage, principal, input.bundle.sha256);
     }
     throw error;
   }
-  if (superseded && superseded !== record3.bundleSha256) {
+  if (superseded && superseded !== record4.bundleSha256) {
     await discardCollectedObject(store, artifactStorage, principal, superseded);
   }
   if (writeVersionObjects && versionManifest && parsed.bundleBytes && input.bundle) {
@@ -59017,7 +59122,7 @@ async function storePublishedSkill(store, artifactStorage, principal, parsed, ex
       throw new SkillRequestError(502, "VERSION_OBJECTS_WRITE_FAILED", `'${input.slug}@${input.version}' was recorded but its version-addressed objects could not be written: ${error.message}. Re-run the same push to write them.`);
     }
   }
-  return { record: record3, alreadyPublished: existingVersion !== null };
+  return { record: record4, alreadyPublished: existingVersion !== null };
 }
 async function deletePublishedSkill(store, artifactStorage, principal, slug, tombstoneWindowMs) {
   return store.deleteSkill(principal, slug, tombstoneWindowMs);
@@ -59028,23 +59133,23 @@ async function discardCollectedObject(store, artifactStorage, principal, sha2562
   await artifactStorage.deleteBundle(principal.orgId, sha2562);
 }
 async function readPublishedBundle(store, artifactStorage, principal, slug) {
-  const record3 = await store.getSkill(principal, slug);
-  if (!record3)
+  const record4 = await store.getSkill(principal, slug);
+  if (!record4)
     throw new SkillRequestError(404, "SKILL_NOT_FOUND", "skill not found");
-  if (!record3.bundleSha256)
+  if (!record4.bundleSha256)
     throw new SkillRequestError(404, "BUNDLE_NOT_FOUND", `skill '${slug}' was published without a bundle`);
-  const bundle2 = await store.getSkillBundle(principal, record3.bundleSha256);
+  const bundle2 = await store.getSkillBundle(principal, record4.bundleSha256);
   if (!bundle2)
-    throw new SkillRequestError(404, "BUNDLE_NOT_FOUND", `no stored bundle for digest ${record3.bundleSha256}`);
+    throw new SkillRequestError(404, "BUNDLE_NOT_FOUND", `no stored bundle for digest ${record4.bundleSha256}`);
   const bytes = await artifactStorage.readBundle(bundle2);
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
   const actual = createHash25("sha256").update(bytes).digest("hex");
-  if (actual !== record3.bundleSha256) {
-    throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record3.bundleSha256}`);
+  if (actual !== record4.bundleSha256) {
+    throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record4.bundleSha256}`);
   }
-  return { record: record3, bytes };
+  return { record: record4, bytes };
 }
 function assertPublishableSlug(slug) {
   if (slug.length > MAX_SLUG_LENGTH || !SLUG_PATTERN.test(slug)) {
@@ -59153,14 +59258,14 @@ function skillVersionPayload(version2, currentSha) {
 }
 async function listSkillVersionsPayload(store, principal, slug) {
   assertPublishableSlug(slug);
-  const record3 = await store.getSkill(principal, slug);
+  const record4 = await store.getSkill(principal, slug);
   const versions = await store.listSkillVersions(principal, slug);
-  if (!record3 && !versions.length)
+  if (!record4 && !versions.length)
     throw new SkillRequestError(404, "SKILL_NOT_FOUND", "skill not found");
-  const currentSha = record3?.bundleSha256;
+  const currentSha = record4?.bundleSha256;
   return {
     slug,
-    ...record3?.version ? { currentVersion: record3.version } : {},
+    ...record4?.version ? { currentVersion: record4.version } : {},
     ...currentSha ? { currentBundleSha256: currentSha } : {},
     versions: versions.map((version2) => skillVersionPayload(version2, currentSha))
   };
@@ -59612,10 +59717,10 @@ function sortKeys(value) {
   if (Array.isArray(value))
     return value.map(sortKeys);
   if (value !== null && typeof value === "object") {
-    const record3 = value;
+    const record4 = value;
     const sorted = Object.create(null);
-    for (const key of Object.keys(record3).sort()) {
-      sorted[key] = sortKeys(record3[key]);
+    for (const key of Object.keys(record4).sort()) {
+      sorted[key] = sortKeys(record4[key]);
     }
     return sorted;
   }
@@ -60539,14 +60644,14 @@ function createRunStateMachine(store) {
     const next2 = await store.setRunStatus(runId3, to);
     if (!next2)
       return { ok: false, reason: "NO_SUCH_RUN" };
-    const record3 = {
+    const record4 = {
       runId: runId3,
       attemptId,
       from,
       to,
       at: new Date().toISOString()
     };
-    await store.recordTransition(record3);
+    await store.recordTransition(record4);
     return { ok: true };
   }
   return {
@@ -65265,7 +65370,7 @@ class MemorySkillsStore {
     }
     const carriedBundle = !input.bundle && previous?.bundleSha256 ? { bundleSha256: previous.bundleSha256, ...previous.bundleByteSize === undefined ? {} : { bundleByteSize: previous.bundleByteSize } } : {};
     const carriedSkillMd = typeof input.skillMd === "string" ? input.skillMd : previous?.skillMd;
-    const record3 = {
+    const record4 = {
       orgId: input.principal.orgId,
       slug: input.slug,
       displayName: input.displayName,
@@ -65287,7 +65392,7 @@ class MemorySkillsStore {
       ...previous?.archiveReason ? { archiveReason: previous.archiveReason } : {},
       ...previous?.replacementSlug ? { replacementSlug: previous.replacementSlug } : {}
     };
-    this.skills.set(key, record3);
+    this.skills.set(key, record4);
     if (input.version && versionSha && !this.versions.has(versionKey(input.principal.orgId, input.slug, input.version))) {
       this.versions.set(versionKey(input.principal.orgId, input.slug, input.version), {
         orgId: input.principal.orgId,
@@ -65305,7 +65410,7 @@ class MemorySkillsStore {
     if (previous?.bundleSha256 && input.bundle && previous.bundleSha256 !== input.bundle.sha256) {
       this.collectOrphanBundle(input.principal.orgId, previous.bundleSha256);
     }
-    return record3;
+    return record4;
   }
   async listSkillVersions(principal, slug) {
     return Array.from(this.versions.values()).filter((v2) => v2.orgId === principal.orgId && v2.slug === slug).sort((a4, b4) => b4.createdAt.localeCompare(a4.createdAt) || b4.version.localeCompare(a4.version));
@@ -65515,8 +65620,8 @@ class PostgresSkillsStore {
   async backfillLegacyRevisions() {
     const rows = await this.sql`SELECT * FROM skills_registry WHERE revision_id = ${""}`;
     for (const row of rows) {
-      const record3 = rowToSkill(row);
-      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record3)} WHERE org_id = ${record3.orgId} AND slug = ${record3.slug}`;
+      const record4 = rowToSkill(row);
+      await this.sql`UPDATE skills_registry SET revision_id = ${revisionIdOfRecord(record4)} WHERE org_id = ${record4.orgId} AND slug = ${record4.slug}`;
     }
   }
   async close() {
@@ -66105,23 +66210,23 @@ class PostgresSkillsStore {
         return [];
       const purged = [];
       for (const row of expiredRows) {
-        const record3 = rowToSkill(row);
+        const record4 = rowToSkill(row);
         await tx`
-          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record3.slug} AND tombstone_purge_after <= now()
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record4.slug} AND tombstone_purge_after <= now()
         `;
-        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record3.slug}`;
+        await tx`DELETE FROM skills_tags WHERE org_id = ${principal.orgId} AND slug = ${record4.slug}`;
         await tx`
-          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record3.slug} AND tombstone_purge_after <= now()
+          DELETE FROM skills_registry WHERE org_id = ${principal.orgId} AND slug = ${record4.slug} AND tombstone_purge_after <= now()
         `;
-        if (record3.bundleSha256) {
+        if (record4.bundleSha256) {
           await tx`
             DELETE FROM skills_bundles
-            WHERE org_id = ${principal.orgId} AND sha256 = ${record3.bundleSha256}
-              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record3.bundleSha256})
-              AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record3.bundleSha256})
+            WHERE org_id = ${principal.orgId} AND sha256 = ${record4.bundleSha256}
+              AND NOT EXISTS (SELECT 1 FROM skills_registry WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record4.bundleSha256})
+              AND NOT EXISTS (SELECT 1 FROM skills_versions WHERE org_id = ${principal.orgId} AND bundle_sha256 = ${record4.bundleSha256})
           `;
         }
-        purged.push(record3);
+        purged.push(record4);
       }
       return purged;
     });
@@ -66420,8 +66525,8 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
     if (request2.method === "POST" && !id2) {
       const expectedRevisionId = parseIfMatch(request2.headers.get("if-match"));
       const parsed = await parsePublishRequest(request2, config);
-      const { record: record3, alreadyPublished } = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
-      return json4(publishedPayload(record3, { alreadyPublished }), { status: 201, headers: { ETag: revisionEtag(record3.revisionId) } });
+      const { record: record4, alreadyPublished } = await storePublishedSkill(store, artifactStorage, principal, parsed, expectedRevisionId);
+      return json4(publishedPayload(record4, { alreadyPublished }), { status: 201, headers: { ETag: revisionEtag(record4.revisionId) } });
     }
     if (request2.method === "GET" && id2 && subresource === "skill.md") {
       const resolved = await resolvePublishedSkill(store, artifactStorage, principal, id2);
@@ -66469,15 +66574,15 @@ async function handleApiV1(store, governanceStore, principal, request2, parts, c
       if (resolved.kind === "absent") {
         return json4({ error: "skill not found", code: "SKILL_NOT_FOUND" }, { status: 404 });
       }
-      const { record: record3, bytes } = await readPublishedBundle(store, artifactStorage, principal, id2);
+      const { record: record4, bytes } = await readPublishedBundle(store, artifactStorage, principal, id2);
       const headers = {
         "Content-Type": "application/gzip",
         "Content-Length": String(bytes.byteLength),
-        "Content-Disposition": `attachment; filename="${record3.slug}.tar.gz"`,
-        "X-Skill-Bundle-Sha256": record3.bundleSha256 ?? "",
-        "X-Skill-Revision-Id": record3.revisionId,
-        "X-Skill-Revision-Number": String(record3.revisionNumber),
-        ETag: revisionEtag(record3.revisionId),
+        "Content-Disposition": `attachment; filename="${record4.slug}.tar.gz"`,
+        "X-Skill-Bundle-Sha256": record4.bundleSha256 ?? "",
+        "X-Skill-Revision-Id": record4.revisionId,
+        "X-Skill-Revision-Number": String(record4.revisionNumber),
+        ETag: revisionEtag(record4.revisionId),
         "Cache-Control": "no-store"
       };
       if (config.bundleSigningKey) {
@@ -66715,7 +66820,7 @@ var bundledRegistry = {
   isValidSlug: isValidSkillSlug
 };
 var currentVersionService = {
-  resolveVersion: (record3) => record3.version
+  resolveVersion: (record4) => record4.version
 };
 // node_modules/zod/v3/external.js
 var exports_external = {};
@@ -71113,7 +71218,7 @@ __export(exports_external2, {
   regexes: () => exports_regexes,
   regex: () => _regex,
   refine: () => refine,
-  record: () => record3,
+  record: () => record4,
   readonly: () => readonly,
   property: () => _property,
   properties: () => _properties,
@@ -86887,8 +86992,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = new Map;
-  for (const record3 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record3);
+  for (const record4 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record4);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -87215,7 +87320,7 @@ __export(exports_schemas2, {
   strictObject: () => strictObject,
   set: () => set,
   refine: () => refine,
-  record: () => record3,
+  record: () => record4,
   readonly: () => readonly,
   promise: () => promise,
   preprocess: () => preprocess,
@@ -88385,7 +88490,7 @@ var ZodRecord2 = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record3(keyType, valueType, params) {
+function record4(keyType, valueType, params) {
   if (!valueType || !valueType._zod) {
     return new ZodRecord2({
       type: "record",
@@ -88851,7 +88956,7 @@ var stringbool = (...args) => _stringbool({
 }, ...args);
 function json5(params) {
   const jsonSchema = lazy(() => {
-    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record3(string2(), jsonSchema)]);
+    return union([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record4(string2(), jsonSchema)]);
   });
   return jsonSchema;
 }
@@ -90074,12 +90179,12 @@ class RemoteWorkspaceInvitationReadError extends Error {
   }
 }
 function invitationFailure(value, status) {
-  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
     return null;
   const code = value.code;
   return invitationFailures[code][0] === status ? code : null;
 }
-var record4 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var record5 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var uuid5 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
 var role = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
 var email3 = (v2) => typeof v2 === "string" && v2.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v2) && /^[^@]+@[^@]+\.[^@]+$/.test(v2);
@@ -90088,7 +90193,7 @@ var inputFailure = () => {
   throw new WorkspaceInvitationInputError;
 };
 function invitationInput(action, input2) {
-  if (!record4(input2))
+  if (!record5(input2))
     return inputFailure();
   const keys3 = {
     list: ["after"],
@@ -90139,7 +90244,7 @@ function invalid5() {
   throw new RemoteWorkspaceInvitationReadError;
 }
 function projection(v2, organizationId) {
-  if (!record4(v2) || !uuid5(v2.id) || v2.organizationId !== organizationId || !email3(v2.email) || v2.email !== v2.email.trim().toLowerCase() || !role(v2.role) || !Number.isInteger(v2.generation) || Number(v2.generation) < 1 || Number(v2.generation) > 10 || typeof v2.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v2.status) || !timestamp(v2.expiresAt) || !timestamp(v2.createdAt) || !record4(v2.delivery) || typeof v2.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v2.delivery.state) || !Number.isInteger(v2.delivery.attempts) || Number(v2.delivery.attempts) < 0 || Number(v2.delivery.attempts) > 5)
+  if (!record5(v2) || !uuid5(v2.id) || v2.organizationId !== organizationId || !email3(v2.email) || v2.email !== v2.email.trim().toLowerCase() || !role(v2.role) || !Number.isInteger(v2.generation) || Number(v2.generation) < 1 || Number(v2.generation) > 10 || typeof v2.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v2.status) || !timestamp(v2.expiresAt) || !timestamp(v2.createdAt) || !record5(v2.delivery) || typeof v2.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v2.delivery.state) || !Number.isInteger(v2.delivery.attempts) || Number(v2.delivery.attempts) < 0 || Number(v2.delivery.attempts) > 5)
     return invalid5();
   return {
     id: v2.id,
@@ -90154,7 +90259,7 @@ function projection(v2, organizationId) {
   };
 }
 function parseInvitationResult(action, value, input2, organizationId) {
-  if (!record4(value))
+  if (!record5(value))
     return invalid5();
   const request2 = input2;
   if (action === "accept") {
@@ -90187,7 +90292,7 @@ function parseInvitationResult(action, value, input2, organizationId) {
 }
 
 // src/lib/remote-workspace-selection.ts
-var record5 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var record6 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var uuid8 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
 var text2 = (v2, max = 1024) => typeof v2 === "string" && !!v2.trim() && v2.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v2);
 var role2 = (v2) => typeof v2 === "string" && ["owner", "admin", "member", "viewer"].includes(v2);
@@ -90212,7 +90317,7 @@ function workspaceExpectedUserId(value) {
   return value;
 }
 function workspaceContext(value) {
-  if (!record5(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
+  if (!record6(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid8(value.userId) || !uuid8(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
@@ -90220,15 +90325,15 @@ function invalid6() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v2) {
-  if (!record5(v2) || !uuid8(v2.id) || !text2(v2.slug) || !text2(v2.name))
+  if (!record6(v2) || !uuid8(v2.id) || !text2(v2.slug) || !text2(v2.name))
     return invalid6();
   return { id: v2.id, slug: v2.slug, name: v2.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record5(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+  if (!record6(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
     return invalid6();
   const workspaces = value.workspaces.map((v2) => {
-    if (!record5(v2) || !uuid8(v2.membershipId) || !role2(v2.role) || typeof v2.current !== "boolean")
+    if (!record6(v2) || !uuid8(v2.membershipId) || !role2(v2.role) || typeof v2.current !== "boolean")
       return invalid6();
     return { membershipId: v2.membershipId, organization: organization(v2.organization), role: v2.role, current: v2.current };
   });
@@ -90237,10 +90342,10 @@ function parseAccountWorkspaces(value) {
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record5(value))
+  if (!record6(value))
     return invalid6();
   const user = value.user;
-  if (!record5(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
+  if (!record6(user) || !uuid8(user.id) || !uuid8(user.membershipId) || !text2(user.email, 320) || !(user.displayName === null || text2(user.displayName)) || !role2(user.role))
     return invalid6();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -90258,8 +90363,8 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity4 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record5(value) && value.user;
-  if (!record5(value) || !record5(user) || !uuid8(user.id))
+  const user = record6(value) && value.user;
+  if (!record6(value) || !record6(user) || !uuid8(user.id))
     return invalid6();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -90274,18 +90379,18 @@ var workspaceSelectionFailures = {
   WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
 };
 function workspaceSelectionFailure(value, status) {
-  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
 
 // src/lib/remote-workspace.ts
-var record6 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var record7 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 var cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value);
 var uuid10 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value);
 function workspaceMembersQuery(options = {}) {
-  if (!record6(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record7(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -90301,7 +90406,7 @@ function timestamp2(value) {
   return Number.isFinite(time4) && new Date(time4).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record6(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
+  if (!record7(row) || !uuid10(row.membershipId) || !uuid10(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -90321,7 +90426,7 @@ class WorkspaceMemberInputError extends Error {
   }
 }
 function mutationInput(membershipId, input2, roleChange) {
-  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record6(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid10(membershipId) || membershipId !== membershipId.toLowerCase() || !record7(input2) || Object.keys(input2).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
   const expectedRole = input2.expectedRole, role3 = roleChange ? input2.role : undefined;
   if (!isRole(expectedRole) || roleChange && !isRole(role3))
@@ -90341,7 +90446,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record6(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record7(value) || !uuid10(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
   if (member.membershipId !== membershipId || member.role !== role3)
@@ -90349,7 +90454,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record6(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record7(value) || !uuid10(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
@@ -90366,7 +90471,7 @@ var workspaceMemberFailures = {
   MEMBERSHIP_BUSY: [503, "Membership is busy. Refresh the roster before another action."]
 };
 function workspaceMemberFailure(value, status) {
-  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record7(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -90375,7 +90480,7 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record6(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record7(value) || !uuid10(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members2 = value.members.map((row) => parseMember(row, fail));
   if (new Set(members2.map((row) => row.membershipId)).size !== members2.length)
@@ -90664,11 +90769,11 @@ var permissionNames = [
   "executionGrantsWrite",
   "executionGrantsResolve"
 ];
-var record7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 function parseSkillsAccess(value) {
   if (value === undefined)
     return {};
-  if (!record7(value))
+  if (!record8(value))
     throw new Error("Invalid Skills permission contract");
   const result = {};
   if (value.scopes !== undefined) {
@@ -90677,7 +90782,7 @@ function parseSkillsAccess(value) {
     result.scopes = [...value.scopes];
   }
   if (value.permissions !== undefined) {
-    if (!record7(value.permissions))
+    if (!record8(value.permissions))
       throw new Error("Invalid Skills permission contract");
     result.permissions = {};
     for (const name of permissionNames) {
@@ -91574,13 +91679,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record8, field2) {
-  if (record8[field2] === undefined)
+function requireOptionalString(record9, field2) {
+  if (record9[field2] === undefined)
     return;
-  if (typeof record8[field2] !== "string") {
+  if (typeof record9[field2] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field2} must be a string when present)`);
   }
-  return record8[field2];
+  return record9[field2];
 }
 var INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 function isVersionRecord(value) {
@@ -91603,19 +91708,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record8 = entry;
-  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
+  const record9 = entry;
+  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record8.metadata !== undefined) {
-    if (!record8.metadata || typeof record8.metadata !== "object" || Array.isArray(record8.metadata)) {
+  if (record9.metadata !== undefined) {
+    if (!record9.metadata || typeof record9.metadata !== "object" || Array.isArray(record9.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record8.metadata;
+    metadata = record9.metadata;
   }
-  const pinnedAt = requireOptionalString(record8, "pinnedAt");
+  const pinnedAt = requireOptionalString(record9, "pinnedAt");
   return {
     slug: slug2,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -91632,16 +91737,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record8 = entry;
-  const slug2 = typeof record8.slug === "string" && record8.slug.trim() ? record8.slug.trim() : undefined;
+  const record9 = entry;
+  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug: slug2,
-    ...requireOptionalString(record8, "name") !== undefined ? { name: requireOptionalString(record8, "name") } : {},
-    ...requireOptionalString(record8, "version") !== undefined ? { version: requireOptionalString(record8, "version") } : {},
-    ...requireOptionalString(record8, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record8, "updatedAt") } : {}
+    ...requireOptionalString(record9, "name") !== undefined ? { name: requireOptionalString(record9, "name") } : {},
+    ...requireOptionalString(record9, "version") !== undefined ? { version: requireOptionalString(record9, "version") } : {},
+    ...requireOptionalString(record9, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record9, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -91698,12 +91803,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record8 = payload;
-  if (!Array.isArray(record8.skills)) {
+  const record9 = payload;
+  if (!Array.isArray(record9.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record8.skills.map(normalizeSkillSummary);
-  const nextCursor = record8.nextCursor === undefined || record8.nextCursor === null ? null : record8.nextCursor;
+  const skills = record9.skills.map(normalizeSkillSummary);
+  const nextCursor = record9.nextCursor === undefined || record9.nextCursor === null ? null : record9.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -91750,7 +91855,7 @@ class RemoteInvitationEmailUnconfirmedError extends Error {
     this.name = "RemoteInvitationEmailUnconfirmedError";
   }
 }
-var record8 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var record9 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var uuid11 = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
 function invitationEmailIds(invitationId, challengeId) {
   if (!uuid11(invitationId) || !uuid11(challengeId))
@@ -91759,7 +91864,7 @@ function invitationEmailIds(invitationId, challengeId) {
 }
 function invitationEmailInput(action, input2) {
   const keys3 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record8(input2) || Object.keys(input2).length !== keys3.length || keys3.some((key) => !Object.hasOwn(input2, key)))
+  if (!record9(input2) || Object.keys(input2).length !== keys3.length || keys3.some((key) => !Object.hasOwn(input2, key)))
     throw new InvitationEmailInputError;
   const value = { ...input2 };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -91788,12 +91893,12 @@ async function requestInvitationEmail(origin, action, input2) {
       signal: AbortSignal.timeout(15000)
     });
     const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
-    if (!response.ok && record8(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+    if (!response.ok && record9(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
       const code = parsed.code;
       if (response.status === refusals[code][0])
         throw new RemoteInvitationEmailError(code);
     }
-    if (!record8(parsed))
+    if (!record9(parsed))
       throw new RemoteInvitationEmailUnconfirmedError(action);
     if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
       return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
@@ -91853,8 +91958,8 @@ var invalid7 = () => {
 };
 var publicationUuid = (v2) => typeof v2 === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v2);
 var hash4 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
-var record9 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
-var exact = (v2, keys3) => record9(v2) && Object.keys(v2).sort().join(",") === keys3.sort().join(",");
+var record10 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
+var exact = (v2, keys3) => record10(v2) && Object.keys(v2).sort().join(",") === keys3.sort().join(",");
 var date5 = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
 var publicationSha256 = (bytes) => createHash33("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
@@ -91862,7 +91967,7 @@ function checkedPublicationDeclaration(value) {
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record9(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash4(manifest.provenance?.content_hash))
+    if (!record10(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash4(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -91920,7 +92025,7 @@ async function boundedJson(url2, init, token, mutation, budget2 = 15000, signal)
         return invalid7();
       }
       if (!response.ok) {
-        const code = record9(body4) && typeof body4.code === "string" && Object.hasOwn(failures2, body4.code) ? body4.code : null;
+        const code = record10(body4) && typeof body4.code === "string" && Object.hasOwn(failures2, body4.code) ? body4.code : null;
         if (code && failures2[code][0] === response.status)
           throw new PrivatePublicationError(code, failures2[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -91975,8 +92080,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p2 = record9(response) && response.privatePublishing;
-    if (!record9(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p2, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p2.contractVersion !== 1 || typeof p2.enabled !== "boolean" || p2.authentication !== "interactive-session" || p2.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p2.uploadMaxTtlSeconds !== 300 || typeof p2.executionEnabled !== "boolean")
+    const p2 = record10(response) && response.privatePublishing;
+    if (!record10(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p2, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p2.contractVersion !== 1 || typeof p2.enabled !== "boolean" || p2.authentication !== "interactive-session" || p2.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p2.uploadMaxTtlSeconds !== 300 || typeof p2.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p2 });
   }
@@ -91992,7 +92097,7 @@ class RemotePrivatePublicationsClient {
   async#view(path2, method, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path2, { method, ...method === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record9(value) || !Object.keys(value).every((k4) => k4 === "upload" || k4 === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record10(value) || !Object.keys(value).every((k4) => k4 === "upload" || k4 === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid7();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error61) {
@@ -92155,10 +92260,10 @@ async function requestAuthApi(instance, path2, options) {
   const text3 = await res.text();
   const body4 = text3 ? parseJsonBody(text3) : {};
   if (!res.ok) {
-    const record10 = isRecord7(body4) ? body4 : {};
-    const detail = typeof record10.detail === "string" ? record10.detail : undefined;
-    const error61 = typeof record10.error === "string" ? record10.error : undefined;
-    const code = typeof record10.code === "string" ? record10.code : undefined;
+    const record11 = isRecord7(body4) ? body4 : {};
+    const detail = typeof record11.detail === "string" ? record11.detail : undefined;
+    const error61 = typeof record11.error === "string" ? record11.error : undefined;
+    const code = typeof record11.code === "string" ? record11.code : undefined;
     throw new HostedApiError(detail || error61 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -92592,7 +92697,7 @@ var requestIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]
 function validId(value) {
   return typeof value === "string" && requestIdPattern.test(value);
 }
-function record10(value) {
+function record11(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function exact2(value, names) {
@@ -92679,7 +92784,7 @@ function snapshot2(value, maximum) {
 function requestSnapshot(input2) {
   try {
     const owned = snapshot2(input2, SKILL_OPERATION_LIMITS.requestBytes), value = owned.value;
-    if (!record10(value) || !exact2(value, ["contractVersion", "requestId", "operation", "input"]) || value.contractVersion !== 1 || !validId(value.requestId) || typeof value.operation !== "string" || value.operation.length > 128 || !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(value.operation) || !record10(value.input))
+    if (!record11(value) || !exact2(value, ["contractVersion", "requestId", "operation", "input"]) || value.contractVersion !== 1 || !validId(value.requestId) || typeof value.operation !== "string" || value.operation.length > 128 || !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(value.operation) || !record11(value.input))
       throw Error();
     return { ...owned, value };
   } catch {
@@ -92689,7 +92794,7 @@ function requestSnapshot(input2) {
 function resultSnapshot(input2, requestId) {
   try {
     const value = snapshot2(input2, SKILL_OPERATION_LIMITS.resultBytes).value;
-    if (!record10(value) || value.contractVersion !== 1 || value.requestId !== requestId)
+    if (!record11(value) || value.contractVersion !== 1 || value.requestId !== requestId)
       throw Error();
     const fields2 = ["contractVersion", "requestId", "status"];
     if (value.status === "succeeded")