@hasna/skills 0.10.26 → 0.10.27

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.26",
+    version: "0.10.27",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -39994,8 +39994,8 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
-      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2")
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1", "claude-settings-v2", "claude-settings-v3", "claude-marketplace-registry-v2", "codex-settings-v1", "codex-settings-v2", "codex-settings-v3"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3")
         requireBound(agent === "codex" && value.agent === "codex" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "config.toml");
       if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute2(source.path) && resolve3(source.path) === source.path && basename2(source.path) === "settings.json");
@@ -50634,6 +50634,72 @@ async function prepareSkillDependencies(skillPath, env3, timeoutMs = DEFAULT_PRE
 var DEPENDENCY_PREPARATION_MARKER = ".skills-dependency-preparation", RECOVERY = "Skill dependency preparation is incomplete. Confirm no installer is running, successfully run bun install --no-save in the skill directory, then remove only .skills-dependency-preparation. See docs/skill-standard.md#recovering-interrupted-dependency-preparation.", DEFAULT_PREPARATION_TIMEOUT_MS = 60000;
 var init_dependency_preparation = () => {};
 
+// src/lib/codex-local-mcp-controls.ts
+function isCodexLocalStdioMcpServer(name, server) {
+  const identifier2 = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(value);
+  const refuse = () => {
+    throw new Error("Unsupported Codex local stdio MCP controls");
+  };
+  const object4 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date));
+  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
+  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
+  const optional = (v, valid) => v === undefined || v === null || valid(v);
+  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
+  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
+  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
+  const fields = [
+    "command",
+    "args",
+    "cwd",
+    "env",
+    "env_vars",
+    "enabled",
+    "required",
+    "environment_id",
+    "startup_readiness",
+    "supports_parallel_tool_calls",
+    "tool_input_schema_max_bytes",
+    "startup_timeout_sec",
+    "startup_timeout_ms",
+    "tool_timeout_sec",
+    "default_tools_approval_mode",
+    "enabled_tools",
+    "disabled_tools",
+    "omit_tools_from",
+    "tools",
+    "name"
+  ];
+  try {
+    if (!identifier2(name) || !object4(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object4(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value]) => envName(key) && textField(value, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+      refuse();
+    if (server.env_vars !== undefined && server.env_vars !== null) {
+      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
+        refuse();
+      const names = server.env_vars.map((entry) => {
+        if (envName(entry))
+          return entry;
+        if (!object4(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
+          refuse();
+        return entry.name;
+      });
+      if (new Set(names).size !== names.length)
+        refuse();
+    }
+    if (server.tools !== undefined && server.tools !== null) {
+      if (!object4(server.tools) || Object.keys(server.tools).length > 256)
+        refuse();
+      for (const [tool, config] of Object.entries(server.tools)) {
+        if (!textField(tool) || !object4(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
+          refuse();
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/claude-settings-witness.ts
 import { createHash as createHash8 } from "crypto";
 import { closeSync as closeSync6, constants as constants6, fstatSync as fstatSync6, lstatSync as lstatSync11, openSync as openSync6, readSync as readSync4 } from "fs";
@@ -51290,65 +51356,14 @@ function mcpControls(path, read2) {
     refuse2();
   }
   const object5 = (v) => Boolean(v && typeof v === "object" && !Array.isArray(v));
-  const textField = (v, empty = false) => typeof v === "string" && (empty || Boolean(v.trim())) && Buffer.byteLength(v) <= 16384 && !/[\x00-\x1f\x7f]/.test(v);
-  const envName = (v) => typeof v === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(v);
-  const optional = (v, valid) => v === undefined || v === null || valid(v);
-  const stringList = (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => textField(item));
-  const approval = (v) => ["auto", "prompt", "writes", "approve"].includes(v);
-  const duration = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
-  const positiveInteger = (v) => Number.isSafeInteger(v) && v > 0;
-  const fields = [
-    "command",
-    "args",
-    "cwd",
-    "env",
-    "env_vars",
-    "enabled",
-    "required",
-    "environment_id",
-    "startup_readiness",
-    "supports_parallel_tool_calls",
-    "tool_input_schema_max_bytes",
-    "startup_timeout_sec",
-    "startup_timeout_ms",
-    "tool_timeout_sec",
-    "default_tools_approval_mode",
-    "enabled_tools",
-    "disabled_tools",
-    "omit_tools_from",
-    "tools",
-    "name"
-  ];
   if (!object5(value) || Object.keys(value).length !== 1 || !object5(value.mcpServers))
     refuse2();
   const servers = Object.entries(value.mcpServers);
   if (!servers.length || servers.length > 256)
     refuse2();
-  for (const [name, server] of servers) {
-    if (!identifier2(name) || !object5(server) || !Object.keys(server).every((key) => fields.includes(key)) || !textField(server.command) || !optional(server.args, (v) => Array.isArray(v) && v.length <= 256 && v.every((arg) => textField(arg, true))) || !optional(server.cwd, textField) || !optional(server.env, (v) => object5(v) && Object.keys(v).length <= 256 && Object.entries(v).every(([key, value2]) => envName(key) && textField(value2, true))) || !["enabled", "required", "supports_parallel_tool_calls"].every((key) => optional(server[key], (v) => typeof v === "boolean")) || !optional(server.environment_id, (v) => v === "local") || !optional(server.startup_readiness, (v) => ["connection", "catalog"].includes(v)) || !optional(server.tool_input_schema_max_bytes, positiveInteger) || !["startup_timeout_sec", "tool_timeout_sec"].every((key) => optional(server[key], duration)) || !optional(server.startup_timeout_ms, (v) => Number.isSafeInteger(v) && v >= 0) || !optional(server.default_tools_approval_mode, approval) || !["enabled_tools", "disabled_tools"].every((key) => optional(server[key], stringList)) || !optional(server.omit_tools_from, (v) => Array.isArray(v) && v.length <= 256 && v.every((item) => ["code_mode", "deferred", "direct"].includes(item))) || !optional(server.name, textField))
+  for (const [name, server] of servers)
+    if (!isCodexLocalStdioMcpServer(name, server))
       refuse2();
-    if (server.env_vars !== undefined && server.env_vars !== null) {
-      if (!Array.isArray(server.env_vars) || server.env_vars.length > 256)
-        refuse2();
-      const names = server.env_vars.map((entry) => {
-        if (envName(entry))
-          return entry;
-        if (!object5(entry) || !Object.keys(entry).every((key) => ["name", "source"].includes(key)) || !envName(entry.name) || !optional(entry.source, (v) => v === "local"))
-          refuse2();
-        return entry.name;
-      });
-      if (new Set(names).size !== names.length)
-        refuse2();
-    }
-    if (server.tools !== undefined && server.tools !== null) {
-      if (!object5(server.tools) || Object.keys(server.tools).length > 256)
-        refuse2();
-      for (const [tool, config] of Object.entries(server.tools)) {
-        if (!textField(tool) || !object5(config) || !Object.keys(config).every((key) => ["approval_mode", "output_token_limit"].includes(key)) || !optional(config.approval_mode, approval) || !optional(config.output_token_limit, positiveInteger))
-          refuse2();
-      }
-    }
-  }
   return sha2562;
 }
 function rootControls(root, read2) {
@@ -51728,6 +51743,71 @@ var init_codex_settings_witness_v1 = __esm(() => {
   VERBOSITY = new Set(["low", "medium", "high"]);
 });
 
+// src/lib/codex-mcp-discovery-projection.ts
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function localStdio(name, row) {
+  return name !== "codex_apps" && name !== "_codex_apps" && isCodexLocalStdioMcpServer(name, row);
+}
+function stripEmptyParent(config) {
+  if (record2(config.mcp_servers) && !Object.keys(config.mcp_servers).length)
+    delete config.mcp_servers;
+  return config;
+}
+function projectRegularCodexMcp(config, source) {
+  const unchanged2 = { config, numericSource: source };
+  if (!record2(config.mcp_servers))
+    return unchanged2;
+  const candidates = Object.entries(config.mcp_servers).filter(([name, row]) => localStdio(name, row)).map(([name]) => name);
+  if (!candidates.length)
+    return unchanged2;
+  const headers = [];
+  let attempts = 0;
+  for (const match of source.matchAll(/^[ \t]*\[{1,2}[^\r\n]*\]{1,2}[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/gm)) {
+    if (++attempts > 256)
+      return unchanged2;
+    try {
+      Bun.TOML.parse(source.slice(0, match.index));
+    } catch {
+      continue;
+    }
+    let header;
+    try {
+      header = Bun.TOML.parse(match[0]);
+    } catch {
+      return unchanged2;
+    }
+    const path = [];
+    while (record2(header) && Object.keys(header).length === 1) {
+      const key = Object.keys(header)[0];
+      path.push(key);
+      header = header[key];
+    }
+    headers.push({ start: match.index, path });
+  }
+  const names = candidates.filter((name) => headers.filter((header) => header.path.length === 2 && header.path[0] === "mcp_servers" && header.path[1] === name).length === 1);
+  if (!names.length)
+    return unchanged2;
+  const selected = headers.map((header, index) => ({ ...header, end: headers[index + 1]?.start ?? source.length })).filter((header) => header.path[0] === "mcp_servers" && names.includes(header.path[1]));
+  let numericSource = source;
+  for (const range2 of selected.reverse())
+    numericSource = numericSource.slice(0, range2.start) + numericSource.slice(range2.end);
+  const expected = structuredClone(config);
+  for (const name of names)
+    delete expected.mcp_servers[name];
+  stripEmptyParent(expected);
+  try {
+    if (!isDeepStrictEqual3(stripEmptyParent(Bun.TOML.parse(numericSource)), expected))
+      return unchanged2;
+  } catch {
+    return unchanged2;
+  }
+  return { config: expected, numericSource };
+}
+var init_codex_mcp_discovery_projection = () => {};
+
 // src/lib/codex-settings-witness.ts
 import { createHash as createHash10 } from "crypto";
 function need4(value) {
@@ -51800,7 +51880,7 @@ function canonical4(value, depth = 0, budget = { remaining: 65536 }) {
   need4(isRecord3(value));
   return ["object", Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, child]) => [key, canonical4(child, depth + 1, budget)])];
 }
-function normalize3(config) {
+function normalize3(config, version = 2) {
   if (isRecord3(config.hooks)) {
     delete config.hooks.state;
     if (!Object.keys(config.hooks).length)
@@ -51818,11 +51898,11 @@ function normalize3(config) {
     if (!Object.keys(skills).length)
       delete config.skills;
   }
-  inference(config);
+  inference(config, version);
   if (isRecord3(config.profiles)) {
     for (const profile of Object.values(config.profiles))
       if (isRecord3(profile))
-        inference(profile);
+        inference(profile, version);
   }
 }
 function disablesOneSkill(entry) {
@@ -51834,18 +51914,23 @@ function disablesOneSkill(entry) {
   const selector = ["path", "name"].filter((key) => Object.hasOwn(entry, key));
   return selector.length === 1 && typeof entry[selector[0]] === "string" && entry[selector[0]].length > 0;
 }
-function inference(target) {
-  for (const key of INFERENCE)
+function inference(target, version) {
+  const keys2 = version === 3 ? [...INFERENCE, "service_tier", "plan_mode_reasoning_effort"] : INFERENCE;
+  for (const key of keys2)
     if (Object.hasOwn(target, key)) {
       const value = target[key];
       if (key === "model")
         need4(typeof value === "string" && MODEL.test(value));
-      else
+      else if (version === 3 && key !== "model_verbosity") {
+        need4(typeof value === "string" && value.length <= 128 && !/[\x00-\x1f\x7f]/.test(value));
+        if (key !== "service_tier")
+          need4(value.length > 0);
+      } else
         need4(typeof value === "string" && (key === "model_reasoning_effort" ? EFFORT2.has(value) : VERBOSITY2.has(value)));
       delete target[key];
     }
 }
-function settingsDigest2(text2) {
+function settingsDigest2(text2, version = 2) {
   let config;
   try {
     config = Bun.TOML.parse(text2);
@@ -51853,8 +51938,9 @@ function settingsDigest2(text2) {
     throw new Error("Invalid Codex settings witness");
   }
   need4(isRecord3(config));
-  normalize3(config);
-  return sha2(`hasna.skills.codex-settings.v2\x00${JSON.stringify([canonical4(config), numericTokens2(text2)])}`);
+  const projected = version === 3 ? projectRegularCodexMcp(config, text2) : { config, numericSource: text2 };
+  normalize3(projected.config, version);
+  return sha2(`hasna.skills.codex-settings.v${version}\x00${JSON.stringify([canonical4(projected.config), numericTokens2(projected.numericSource)])}`);
 }
 function hashCodexSettingsReplacementV2(text2, budget = { remaining: 256 * 1024 * 1024 }) {
   need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
@@ -51878,10 +51964,30 @@ function upgradeCodexSettingsWitness(previous, reviewedSettingsPath) {
     throw new Error("Codex non-preference settings changed; explicit discovery review required");
   return { path: previous.path, hashMode: "codex-settings-v2", sha256: sha2562 };
 }
+function hashCodexSettingsReplacementV3(text2, budget = { remaining: 256 * 1024 * 1024 }) {
+  need4(Buffer.byteLength(text2) <= 1024 * 1024 && budget.remaining >= Buffer.byteLength(text2));
+  budget.remaining -= Buffer.byteLength(text2);
+  return settingsDigest2(text2, 3);
+}
+function captureCodexSettingsV3(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "codex-settings-v3", sha256: settingsDigest2(readNativeSettingsWitnessFile(path, budget, "config.toml"), 3) };
+}
+function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
+  need4(previous && Object.keys(previous).every((key) => ["path", "hashMode", "sha256"].includes(key)) && (previous.hashMode === undefined || ["bytes", "codex-settings-v1", "codex-settings-v2"].includes(previous.hashMode)) && /^[a-f0-9]{64}$/.test(previous.sha256));
+  const budget = { remaining: 2 * 1024 * 1024 };
+  const before2 = readNativeSettingsWitnessFile(reviewedSettingsPath, budget, "config.toml"), current = readNativeSettingsWitnessFile(previous.path, budget, "config.toml");
+  const original = previous.hashMode === "codex-settings-v2" ? settingsDigest2(before2) : previous.hashMode === "codex-settings-v1" ? hashCodexSettingsReplacement(before2) : sha2(before2);
+  need4(original === previous.sha256);
+  const sha2562 = settingsDigest2(current, 3);
+  if (settingsDigest2(before2, 3) !== sha2562)
+    throw new Error("Codex settings outside the reviewed V3 contract changed; explicit discovery review required");
+  return { path: previous.path, hashMode: "codex-settings-v3", sha256: sha2562 };
+}
 var sha2 = (text2) => createHash10("sha256").update(text2).digest("hex"), EFFORT2, VERBOSITY2, MODEL, CODEX_DISCOVERY_PROJECTION_FIELDS, INFERENCE;
 var init_codex_settings_witness = __esm(() => {
   init_codex_settings_witness_v1();
   init_codex_settings_witness_v1();
+  init_codex_mcp_discovery_projection();
   init_claude_settings_witness();
   EFFORT2 = new Set(["none", "minimal", "low", "medium", "high", "xhigh"]);
   VERBOSITY2 = new Set(["low", "medium", "high"]);
@@ -52019,7 +52125,7 @@ var init_agent_bridge = __esm(() => {
 });
 
 // src/lib/agent-codex.ts
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 function splitTopLevel(value, delimiter) {
   const result2 = [];
   let start = 0, square = 0, curly = 0, quote = null, escaped = false;
@@ -52148,7 +52254,7 @@ function normalizeCodexInlinePathConfig(text2) {
   const expectedWithoutConfig = structuredClone(before2);
   delete expectedWithoutConfig.skills.config;
   try {
-    if (isDeepStrictEqual3(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
+    if (isDeepStrictEqual4(Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, "")), expectedWithoutConfig))
       return text2;
   } catch {}
   const matches2 = [];
@@ -52201,7 +52307,7 @@ function normalizeCodexInlinePathConfig(text2) {
     try {
       const after2 = Bun.TOML.parse(candidate);
       const expected = structuredClone(before2);
-      if (isDeepStrictEqual3(after2, expected))
+      if (isDeepStrictEqual4(after2, expected))
         matches2.push(candidate);
     } catch {}
   }
@@ -52217,11 +52323,11 @@ function assertCodexPathConfigEditable(text2) {
   delete expected.skills.config;
   try {
     const withoutSections = Bun.TOML.parse(text2.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual3(withoutSections, expected))
+    if (isDeepStrictEqual4(withoutSections, expected))
       return;
     const normalized = normalizeCodexInlinePathConfig(text2);
     const withoutNormalizedSections = Bun.TOML.parse(normalized.replace(CODEX_SKILL_CONFIG_SECTIONS, ""));
-    if (isDeepStrictEqual3(withoutNormalizedSections, expected))
+    if (isDeepStrictEqual4(withoutNormalizedSections, expected))
       return;
   } catch {}
   throw codexPathConfigRefusal();
@@ -52259,7 +52365,7 @@ function disableCodexBundledSkills(text2) {
   const candidates = new Set;
   const consider = (candidate) => {
     try {
-      if (isDeepStrictEqual3(Bun.TOML.parse(candidate), expected))
+      if (isDeepStrictEqual4(Bun.TOML.parse(candidate), expected))
         candidates.add(candidate);
     } catch {}
   };
@@ -52290,7 +52396,7 @@ var init_agent_codex = __esm(() => {
 
 // src/lib/agent-integration.ts
 import { createHash as createHash12, randomUUID as randomUUID5 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 import { existsSync as existsSync12, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants8, linkSync } from "fs";
 import { dirname as dirname11, join as join21, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
@@ -52500,14 +52606,14 @@ function parseNativeMigrationTargetManifest(input) {
   }
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid native migration target manifest");
-  const record2 = value;
-  if (record2.schema !== "hasna.skills-native-migration-targets.v1" || Object.keys(record2).some((key) => !["schema", "targets"].includes(key)))
+  const record3 = value;
+  if (record3.schema !== "hasna.skills-native-migration-targets.v1" || Object.keys(record3).some((key) => !["schema", "targets"].includes(key)))
     throw new Error("Unsupported native migration target manifest schema");
-  if (!Array.isArray(record2.targets) || record2.targets.length === 0 || record2.targets.length > 1000)
+  if (!Array.isArray(record3.targets) || record3.targets.length === 0 || record3.targets.length > 1000)
     throw new Error("Native migration target manifest must contain 1 to 1000 targets");
   const targets = [];
   const identities = new Set;
-  for (const target of record2.targets) {
+  for (const target of record3.targets) {
     if (!target || typeof target !== "object" || Array.isArray(target))
       throw new Error("Invalid native migration target");
     const item = target;
@@ -53045,6 +53151,8 @@ function atomicWrite2(path, content) {
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
+  if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
+    throw new Error("Invalid Codex witness target version");
   const home = resolve11(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
   const snapshot = readManagedSkillPolicySnapshot(dataDir3);
   if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
@@ -53066,21 +53174,21 @@ function planAgentSettingsWitnessUpgrade(options) {
     throw new Error("Settings witness upgrade requires a preserved settings preimage");
   const replaced = [previous];
   if (options.agent === "codex") {
-    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1")
-      throw new Error("Codex settings witness upgrade requires a preserved raw or codex-settings-v1 configuration witness");
+    if (previous.hashMode !== undefined && previous.hashMode !== "bytes" && previous.hashMode !== "codex-settings-v1" && !(options.targetCodexVersion === 3 && previous.hashMode === "codex-settings-v2"))
+      throw new Error("Codex settings witness upgrade requires an eligible preserved configuration witness");
     const preimage = readCodexSettingsPreimage(options.reviewedPreimage);
     for (const source of binding.sources) {
       if (source === previous || source.path !== configPath)
         continue;
       const fields = source.fields;
-      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual4(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
+      if (source.hashMode !== undefined || source.format !== "toml" || !Array.isArray(fields) || !isDeepStrictEqual5(fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]) || typeof source.sha256 !== "string")
         throw new Error("Codex settings witness upgrade found an unrecognized configuration witness");
       if (projectNativeDiscoveryFields(preimage, "toml", fields, configPath) !== source.sha256)
         throw new Error("Reviewed preimage does not explain the Codex discovery projection witness");
       replaced.push(source);
     }
   }
-  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
+  const next = options.agent === "claude" ? upgradeClaudeSettingsWitness(previous, options.reviewedPreimage) : options.targetCodexVersion === 3 ? upgradeCodexSettingsWitnessV3(previous, options.reviewedPreimage) : upgradeCodexSettingsWitness(previous, options.reviewedPreimage);
   const rebound = [];
   for (const source of binding.sources) {
     if (!replaced.includes(source)) {
@@ -53117,7 +53225,7 @@ function applyAgentIntegration(plan) {
     const upgrade = plan.settingsWitnessUpgrade;
     if (!plan.managedAgentChecks || !plan.observedPolicy?.before)
       throw new Error("Invalid settings witness upgrade plan");
-    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
+    const verified = planAgentSettingsWitnessUpgrade({ agent: upgrade.agent, ...upgrade.agent === "codex" ? { targetCodexVersion: upgrade.toHashMode === "codex-settings-v3" ? 3 : 2 } : {}, reviewedPreimage: upgrade.reviewedPreimage, home: plan.managedAgentChecks.home, dataDir: plan.dataDir, expectedPolicySha256: sha3(plan.observedPolicy.before), expectedSettingsSha256: upgrade.currentSettingsSha256 });
     if (JSON.stringify(verified.changes) !== JSON.stringify(plan.changes) || JSON.stringify(verified.settingsWitnessUpgrade) !== JSON.stringify(upgrade))
       throw new Error("Settings witness upgrade plan changed");
     provenDiscovery = verified.discoveryBefore[0];
@@ -53653,15 +53761,15 @@ function migrateOwnerLayout(options = {}) {
     moved.push(name);
   }
   createLazyDirs(appDir, created);
-  const record2 = {
+  const record3 = {
     version: 1,
     migratedAt: new Date().toISOString(),
     moved,
     note: "installed/ and legacy flat skill dirs moved into skills/; custom/ retained"
   };
-  writeFileSync5(layoutMigrationRecordPath(appDir), `${JSON.stringify(record2, null, 2)}
+  writeFileSync5(layoutMigrationRecordPath(appDir), `${JSON.stringify(record3, null, 2)}
 `);
-  return { status: "migrated", moved, created, record: record2 };
+  return { status: "migrated", moved, created, record: record3 };
 }
 var LOGS_DIRNAME = "logs", OUTPUTS_DIRNAME = "outputs", LEGACY_CUSTOM_DIRNAME = "custom";
 var init_home_migration = __esm(() => {
@@ -56461,7 +56569,7 @@ var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs
 var init_codex_hook_trust_files = () => {};
 
 // src/lib/codex-hook-trust-layout.ts
-import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
 function codexTrustTextWitness(text2, keys2, canonicalize = true) {
   const parsed = Bun.TOML.parse(text2), wanted = new Set(keys2);
   const headers = [...text2.matchAll(/^[ \t]*(\[[^\r\n]+\])[ \t]*(#[^\r\n]*)?(?:\r?\n|$)/gm)];
@@ -56526,7 +56634,7 @@ function codexTrustTextWitness(text2, keys2, canonicalize = true) {
   if (expected.hooks)
     delete expected.hooks.state;
   try {
-    if (!isDeepStrictEqual5(prune(Bun.TOML.parse(noState)), prune(expected)))
+    if (!isDeepStrictEqual6(prune(Bun.TOML.parse(noState)), prune(expected)))
       throw fail2();
   } catch {
     throw fail2();
@@ -56596,13 +56704,13 @@ var init_codex_hook_trust_layout = () => {};
 
 // src/lib/codex-hook-additions-review.ts
 import { isAbsolute as isAbsolute16 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
 function exactKeys2(value, keys2) {
-  need6(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual6(Object.keys(value).sort(), [...keys2].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
+  need6(value && typeof value === "object" && !Array.isArray(value) && isDeepStrictEqual7(Object.keys(value).sort(), [...keys2].sort()), "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
 }
 function readReviewedAdditionTrustStates(proof, before2, current, journalHooks) {
   const captured = proofs.get(proof);
-  need6(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual6(captured.journalHooks, journalHooks.map(({ key, currentHash }) => ({ key, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
+  need6(!!captured && captured.before.file === before2.file && captured.before.sha256 === before2.sha256 && captured.current.file === current.file && captured.current.sha256 === current.sha256 && isDeepStrictEqual7(captured.journalHooks, journalHooks.map(({ key, currentHash }) => ({ key, currentHash }))), "RECONCILE_ADDITIONS_PROOF_CHANGED");
   captured.recheck();
   unchanged2(before2);
   unchanged2(current);
@@ -56625,7 +56733,7 @@ function reviewNativeHookAdditions(options) {
   expectedProducer.hooks.state ??= {};
   for (const hook of options.journalHooks)
     expectedProducer.hooks.state[hook.key] = { ...expectedProducer.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
-  need6(isDeepStrictEqual6(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
+  need6(isDeepStrictEqual7(expectedProducer, producer) && codexTrustReconcileWitness(options.configBefore.text, originalKeys) === codexTrustReconcileWitness(producerConfig.text, originalKeys) && codexTrustUnmanagedSemantic(options.configBefore.text, originalKeys) === codexTrustUnmanagedSemantic(producerConfig.text, originalKeys), "RECONCILE_ADDITIONS_PRODUCER_PREIMAGE");
   need6(Array.isArray(review.additions) && review.additions.length > 0 && review.additions.length <= 20, "RECONCILE_ADDITIONS_REVIEW_SCHEMA");
   const expectedHooks = JSON.parse(options.hooksBefore.text), currentHooks = JSON.parse(options.hooksCurrent.text), expectedConfig = structuredClone(producer);
   need6(expectedHooks.hooks && typeof expectedHooks.hooks === "object" && !Array.isArray(expectedHooks.hooks), "RECONCILE_ADDITIONS_DECLARATIONS");
@@ -56654,9 +56762,9 @@ function reviewNativeHookAdditions(options) {
     expectedHooks.hooks[event] = [...groups, { ...event === "PreToolUse" ? { matcher: hook.matcher } : {}, hooks: [{ type: "command", command: hook.command, timeout: hook.timeoutSec }] }];
     expectedConfig.hooks.state[key] = trustState;
   }
-  need6(isDeepStrictEqual6(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
+  need6(isDeepStrictEqual7(expectedHooks, currentHooks), "RECONCILE_ADDITIONS_DECLARATIONS");
   const keys2 = added.map((hook) => hook.key);
-  need6(isDeepStrictEqual6(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys2) === codexTrustReconcileWitness(options.configCurrent.text, keys2) && codexTrustUnmanagedSemantic(producerConfig.text, keys2) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys2), "RECONCILE_ADDITIONS_CONFIG");
+  need6(isDeepStrictEqual7(expectedConfig, structure(options.configCurrent.text)) && codexTrustReconcileWitness(producerConfig.text, keys2) === codexTrustReconcileWitness(options.configCurrent.text, keys2) && codexTrustUnmanagedSemantic(producerConfig.text, keys2) === codexTrustUnmanagedSemantic(options.configCurrent.text, keys2), "RECONCILE_ADDITIONS_CONFIG");
   const inputs = [reviewFile, producerConfig, producerHooks, options.intent, options.policy, options.configBefore, options.configCurrent, options.hooksBefore, options.hooksCurrent];
   const recheck = () => {
     for (const input of inputs)
@@ -56679,7 +56787,7 @@ var init_codex_hook_additions_review = __esm(() => {
 
 // src/lib/codex-hook-discovery-recovery.ts
 import { createHash as createHash17 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
 function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, additions) {
   const journalHooks = hooks.map(({ key, currentHash }) => ({ key, currentHash }));
   const additionStates = additions ? readReviewedAdditionTrustStates(additions, before2, current, journalHooks) : [];
@@ -56693,11 +56801,11 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
   need6(binding.agent === "codex" && binding.method === "reviewed" && raw.length === 1 && raw[0].sha256 === before2.sha256 && before2.sha256 !== current.sha256, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
   need6(raw[0].format === undefined && raw[0].fields === undefined && raw[0].managedPlugins === undefined, "RECONCILE_DISCOVERY_CONFIG_WITNESS");
   const typed = binding.sources.filter((source) => source.path === current.file && source.format === "toml");
-  need6(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual7(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need6(typed.length === 1 && typed[0].hashMode === undefined && isDeepStrictEqual8(typed[0].fields, fields), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const original = structure2(before2.text), actual = structure2(current.text);
   const project = (value) => Object.fromEntries(fields.map((field2) => [field2, value[field2] ?? null]));
   const projection = sha4(JSON.stringify(project(original)));
-  need6(typed[0].sha256 === projection && sha4(JSON.stringify(project(actual))) === projection && isDeepStrictEqual7(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
+  need6(typed[0].sha256 === projection && sha4(JSON.stringify(project(actual))) === projection && isDeepStrictEqual8(project(original), project(actual)), "RECONCILE_DISCOVERY_TYPED_WITNESS");
   const keys2 = [...journalHooks.map((hook) => hook.key), ...additionStates.map((hook) => hook.key)];
   need6(journalHooks.length > 0 && keys2.length <= 100 && new Set(keys2).size === keys2.length && journalHooks.every((hook) => typeof hook.key === "string" && /^sha256:[a-f0-9]{64}$/.test(hook.currentHash)), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   const expected = structuredClone(original);
@@ -56707,7 +56815,7 @@ function createCodexHookDiscoveryRecovery(binding, before2, current, hooks, addi
     expected.hooks.state[hook.key] = { ...expected.hooks.state[hook.key], enabled: true, trusted_hash: hook.currentHash };
   for (const { key, state } of additionStates)
     expected.hooks.state[key] = { ...state };
-  need6(isDeepStrictEqual7(expected, actual) && codexTrustReconcileWitness(before2.text, keys2) === codexTrustReconcileWitness(current.text, keys2) && codexTrustUnmanagedSemantic(before2.text, keys2) === codexTrustUnmanagedSemantic(current.text, keys2), "RECONCILE_DISCOVERY_TRUST_WITNESS");
+  need6(isDeepStrictEqual8(expected, actual) && codexTrustReconcileWitness(before2.text, keys2) === codexTrustReconcileWitness(current.text, keys2) && codexTrustUnmanagedSemantic(before2.text, keys2) === codexTrustUnmanagedSemantic(current.text, keys2), "RECONCILE_DISCOVERY_TRUST_WITNESS");
   unchanged2(before2);
   unchanged2(current);
   const witness = Object.freeze({ configPath: current.file, beforeSha256: before2.sha256, currentSha256: current.sha256, discoverySha256: sha4(JSON.stringify(binding)), typedProjectionSha256: projection });
@@ -56742,7 +56850,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 import { createHash as createHash18 } from "crypto";
 import { lstatSync as lstatSync21, readFileSync as readFileSync18, readdirSync as readdirSync11, realpathSync as realpathSync7 } from "fs";
 import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute17, join as join32, resolve as resolve16, sep as sep6 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual9 } from "util";
 function parseConfig(text3, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text3) : JSON.parse(text3);
@@ -56781,19 +56889,19 @@ function projectNativeDiscoveryFields(text3, format, fields2, path) {
   return digest(JSON.stringify(Object.fromEntries(fields2.map((field2) => [field2, object5[field2] ?? null]))));
 }
 function isSupersededCodexProjection(agent, configPath, source) {
-  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual8(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
+  return agent === "codex" && source.path === configPath && source.format === "toml" && isDeepStrictEqual9(source.fields, [...CODEX_DISCOVERY_PROJECTION_FIELDS]);
 }
 function supersedesCodexProjection(sources, configPath) {
-  return sources.some((source) => source.path === configPath && source.hashMode === "codex-settings-v2");
+  return sources.some((source) => source.path === configPath && (source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"));
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
-  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") {
+  if (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Codex settings witnesses require exact typed metadata");
-    const current = (source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
+    const current = (source.hashMode === "codex-settings-v3" ? captureCodexSettingsV3 : source.hashMode === "codex-settings-v2" ? captureCodexSettingsV2 : captureCodexSettings)(source.path, budget).sha256;
     if (current !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
-    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
+    return changes?.has(source.path) ? (source.hashMode === "codex-settings-v3" ? hashCodexSettingsReplacementV3 : source.hashMode === "codex-settings-v2" ? hashCodexSettingsReplacementV2 : hashCodexSettingsReplacement)(changes.get(source.path), budget) : current;
   }
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
@@ -56893,7 +57001,7 @@ function codexInstallationRoots(binding) {
   });
 }
 function assertMarketplaceBinding(binding, source) {
-  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
+  if ((source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3") && (binding.agent !== "codex" || binding.method !== "reviewed" || basename9(source.path) !== "config.toml"))
     throw new Error("Codex settings witnesses require explicit reviewed Codex configuration");
   if ((source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") && (binding.agent !== "claude" || binding.method !== "reviewed" || basename9(source.path) !== "settings.json"))
     throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
@@ -57031,10 +57139,10 @@ function resolveAgentDiscovery(options) {
     verifyAgentDiscovery(retained);
     if (!retained.sources.some((source) => source.path === canonical6(configPath) && source.format === undefined && source.fields === undefined))
       unresolved("retained review is missing the full agent configuration source");
-    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (retained.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       unresolved("retained settings witness names another configuration source");
     const covered = supersedesCodexProjection(retained.sources, canonical6(configPath)) ? sources.filter((source) => !isSupersededCodexProjection(agent, canonical6(configPath), source)) : sources;
-    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual8(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
+    if (covered.some((source) => !retained.sources.some((saved) => isDeepStrictEqual9(saved, source))) || [...roots].some((root2) => !retained.roots.includes(root2)) || agent === "gemini" && JSON.stringify(retained.builtinNames) !== JSON.stringify(builtinNames))
       unresolved("retained review is missing current runtime discovery coverage");
     return retained;
   }
@@ -57048,7 +57156,7 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2"))) && source.path !== canonical6(configPath)))
+    if (review.sources.some((source) => (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || (source.hashMode === "claude-settings-v3" || (source.hashMode === "codex-settings-v1" || source.hashMode === "codex-settings-v2" || source.hashMode === "codex-settings-v3"))) && source.path !== canonical6(configPath)))
       throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
     if (!review.sources.some((source) => source.path === canonical6(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
@@ -59698,14 +59806,14 @@ function readIdentity(env3 = process.env) {
     const parsed = JSON.parse(readFileSync20(getIdentityFilePath(env3), "utf-8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
-    const record2 = parsed;
+    const record3 = parsed;
     const selected = resolveSkillsApiOrigin(env3)?.origin;
-    const bound = typeof record2.apiUrl === "string" ? record2.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
+    const bound = typeof record3.apiUrl === "string" ? record3.apiUrl : readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills");
     if (selected && normalizeSkillsApiOrigin(bound) !== selected)
       return {};
     const identity5 = {};
     for (const field2 of ["email", "orgId", "orgSlug", "userId"]) {
-      const value = record2[field2];
+      const value = record3[field2];
       if (typeof value === "string" && value.length > 0)
         identity5[field2] = value;
     }
@@ -59842,12 +59950,12 @@ function readStoredCredential(env3 = process.env) {
   const origin = normalizeSkillsApiOrigin(readCredentialValue(SKILLS_BOUND_API_URL, env3) ?? readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills"));
   let storedBy = "external";
   let urlWrittenByLogin = false;
-  const record2 = apiKey ? readIdentityRecord(env3) : null;
-  const recordedFor = record2 && typeof record2.apiUrl === "string" ? safeOrigin(record2.apiUrl) : null;
-  if (record2 && recordedFor === origin) {
-    storedBy = record2.issuedBy === "sign-in" || record2.issuedBy === "api-key" ? record2.issuedBy : "legacy";
+  const record3 = apiKey ? readIdentityRecord(env3) : null;
+  const recordedFor = record3 && typeof record3.apiUrl === "string" ? safeOrigin(record3.apiUrl) : null;
+  if (record3 && recordedFor === origin) {
+    storedBy = record3.issuedBy === "sign-in" || record3.issuedBy === "api-key" ? record3.issuedBy : "legacy";
     const fileUrl = readStoredApiUrl(env3);
-    urlWrittenByLogin = storedBy !== "legacy" && record2.urlWrittenBy === "login" && fileUrl !== null && safeOrigin(fileUrl) === origin;
+    urlWrittenByLogin = storedBy !== "legacy" && record3.urlWrittenBy === "login" && fileUrl !== null && safeOrigin(fileUrl) === origin;
   }
   return { file, apiKey: apiKey ?? null, origin, storedBy, urlWrittenByLogin };
 }
@@ -59877,9 +59985,9 @@ function saveApiUrl(apiUrl, env3 = process.env) {
     values2[SKILLS_BOUND_API_URL] = normalizeSkillsApiOrigin(readStoredApiUrl(env3) ?? defaultFleetGatewayBaseUrl("skills"));
   }
   const file = writeCredentialValues(values2, env3);
-  const record2 = readIdentityRecord(env3);
-  if (record2 && "urlWrittenBy" in record2) {
-    const { urlWrittenBy: _dropped, ...rest2 } = record2;
+  const record3 = readIdentityRecord(env3);
+  if (record3 && "urlWrittenBy" in record3) {
+    const { urlWrittenBy: _dropped, ...rest2 } = record3;
     const identityFile = getIdentityFilePath(env3);
     writeFileSync10(identityFile, JSON.stringify(rest2, null, 2) + `
 `, { mode: 384 });
@@ -59918,7 +60026,7 @@ function invitationEmailIds(invitationId, challengeId) {
 }
 function invitationEmailInput(action, input) {
   const keys2 = ["invitationId", "token", "challengeId", "confirm", ...action === "accept" ? ["code"] : []];
-  if (!record2(input) || Object.keys(input).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input, key)))
+  if (!record3(input) || Object.keys(input).length !== keys2.length || keys2.some((key) => !Object.hasOwn(input, key)))
     throw new InvitationEmailInputError;
   const value = { ...input };
   const ids = invitationEmailIds(value.invitationId, value.challengeId);
@@ -59947,12 +60055,12 @@ async function requestInvitationEmail(origin, action, input) {
       signal: AbortSignal.timeout(15000)
     });
     const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 4096)));
-    if (!response.ok && record2(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
+    if (!response.ok && record3(parsed) && typeof parsed.code === "string" && Object.hasOwn(refusals, parsed.code)) {
       const code = parsed.code;
       if (response.status === refusals[code][0])
         throw new RemoteInvitationEmailError(code);
     }
-    if (!record2(parsed))
+    if (!record3(parsed))
       throw new RemoteInvitationEmailUnconfirmedError(action);
     if (action === "challenge" && response.status === 202 && parsed.challengeId === value.challengeId && parsed.expiresIn === 600 && typeof parsed.message === "string" && parsed.message.length <= 256) {
       return { challengeId: value.challengeId, message: "If this invitation is eligible, a verification code will arrive. Delivery is not confirmed.", expiresIn: 600 };
@@ -59971,7 +60079,7 @@ function invitationEmailCustomerError(error) {
     return { code: error.code, error: error.message };
   return { code: "INVITATION_EMAIL_UNAVAILABLE", error: "Unable to prepare this recovery action. Check the explicit server and stable profile. No credential was saved." };
 }
-var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record2 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
+var InvitationEmailInputError, refusals, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, record3 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v);
 var init_remote_invitation_recovery = __esm(() => {
   init_fleet_credentials();
   init_remote_files();
@@ -60018,7 +60126,7 @@ function workspaceExpectedUserId(value) {
   return value;
 }
 function workspaceContext(value) {
-  if (!record3(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
+  if (!record4(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
     throw new WorkspaceContextInputError;
   return { userId: value.userId, membershipId: value.membershipId };
 }
@@ -60026,15 +60134,15 @@ function invalid2() {
   throw new Error(invalidWorkspaceResult);
 }
 function organization(v) {
-  if (!record3(v) || !uuid2(v.id) || !text3(v.slug) || !text3(v.name))
+  if (!record4(v) || !uuid2(v.id) || !text3(v.slug) || !text3(v.name))
     return invalid2();
   return { id: v.id, slug: v.slug, name: v.name };
 }
 function parseAccountWorkspaces(value) {
-  if (!record3(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+  if (!record4(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
     return invalid2();
   const workspaces = value.workspaces.map((v) => {
-    if (!record3(v) || !uuid2(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+    if (!record4(v) || !uuid2(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
       return invalid2();
     return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
   });
@@ -60043,10 +60151,10 @@ function parseAccountWorkspaces(value) {
   return { workspaces };
 }
 function parseWorkspaceIdentity(value, expectedUserId) {
-  if (!record3(value))
+  if (!record4(value))
     return invalid2();
   const user = value.user;
-  if (!record3(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text3(user.email, 320) || !(user.displayName === null || text3(user.displayName)) || !role(user.role))
+  if (!record4(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text3(user.email, 320) || !(user.displayName === null || text3(user.displayName)) || !role(user.role))
     return invalid2();
   if (user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
@@ -60064,20 +60172,20 @@ function parseWorkspaceSession(value, expected) {
   return { token: sessionToken(value.token), ...identity5 };
 }
 function parseWorkspaceLogin(value, expectedUserId) {
-  const user = record3(value) && value.user;
-  if (!record3(value) || !record3(user) || !uuid2(user.id))
+  const user = record4(value) && value.user;
+  if (!record4(value) || !record4(user) || !uuid2(user.id))
     return invalid2();
   if (expectedUserId !== undefined && user.id !== expectedUserId)
     throw new WorkspaceIdentityMismatchError;
   return { token: sessionToken(value.token), userId: user.id };
 }
 function workspaceSelectionFailure(value, status) {
-  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
     return null;
   const code = value.code;
   return workspaceSelectionFailures[code][0] === status ? code : null;
 }
-var record3 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text3 = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text3 = (v, max2 = 1024) => typeof v === "string" && !!v.trim() && v.length <= max2 && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
 var init_remote_workspace_selection = __esm(() => {
   WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
     constructor() {
@@ -60108,7 +60216,7 @@ function checkedPublicationDeclaration(value) {
     return bad();
   try {
     const manifest = JSON.parse(value.manifestText);
-    if (!record4(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
+    if (!record5(manifest) || manifest.version !== value.version || validatePortableManifestContract(manifest, { strict: true }).length || !hash3(manifest.provenance?.content_hash))
       return bad();
   } catch {
     return bad();
@@ -60166,7 +60274,7 @@ async function boundedJson(url, init, token, mutation, budget = 15000, signal) {
         return invalid3();
       }
       if (!response.ok) {
-        const code = record4(body) && typeof body.code === "string" && Object.hasOwn(failures, body.code) ? body.code : null;
+        const code = record5(body) && typeof body.code === "string" && Object.hasOwn(failures, body.code) ? body.code : null;
         if (code && failures[code][0] === response.status)
           throw new PrivatePublicationError(code, failures[code][1], mutation && code === "PUBLICATION_UNCERTAIN", response.status);
         throw new PrivatePublicationError("PUBLICATION_REQUEST_FAILED", "The publication request was refused. Inspect its status before retrying.", mutation && response.status >= 500, response.status);
@@ -60221,8 +60329,8 @@ class RemotePrivatePublicationsClient {
     if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1 || options.timeoutMs > 15000))
       return bad();
     const response = await boundedJson(skillsApiRequestUrl(this.apiOrigin, "/api/v1/capabilities"), {}, this.#token, false, options.timeoutMs, options.signal);
-    const p = record4(response) && response.privatePublishing;
-    if (!record4(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
+    const p = record5(response) && response.privatePublishing;
+    if (!record5(response) || response.contractVersion !== 1 || response.apiVersion !== 1 || !exact(p, ["contractVersion", "enabled", "authentication", "maxArchiveBytes", "uploadMaxTtlSeconds", "executionEnabled"]) || p.contractVersion !== 1 || typeof p.enabled !== "boolean" || p.authentication !== "interactive-session" || p.maxArchiveBytes !== PRIVATE_PUBLICATION_MAX_BYTES || p.uploadMaxTtlSeconds !== 300 || typeof p.executionEnabled !== "boolean")
       throw new PrivatePublicationError("PUBLICATION_CONTRACT_UNAVAILABLE", "This server does not support the hosted private publication contract.");
     return Object.freeze({ ...p });
   }
@@ -60238,7 +60346,7 @@ class RemotePrivatePublicationsClient {
   async#view(path, method2, skillId, intentId, declaration, options = {}) {
     const value = await boundedJson(path, { method: method2, ...method2 === "GET" ? {} : { body: JSON.stringify(declaration ?? {}) } }, this.#token, method2 !== "GET", options.timeoutMs, options.signal);
     try {
-      if (!record4(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
+      if (!record5(value) || !Object.keys(value).every((k) => k === "upload" || k === "changed") || value.changed !== undefined && typeof value.changed !== "boolean")
         return invalid3();
       return checkedPublicationView(value.upload, skillId, intentId, declaration);
     } catch (error) {
@@ -60363,7 +60471,7 @@ var PRIVATE_PUBLICATION_MAX_BYTES, failures, PrivatePublicationError, bad = () =
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid3 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record4 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record4(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash19("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record5(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash19("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -60406,7 +60514,7 @@ var init_remote_private_publications = __esm(() => {
 
 // src/lib/remote-invitations.ts
 function invitationFailure(value, status) {
-  if (!record5(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
+  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(invitationFailures, value.code))
     return null;
   const code = value.code;
   return invitationFailures[code][0] === status ? code : null;
@@ -60415,7 +60523,7 @@ function invitationId(value) {
   return uuid3(value) ? value : inputFailure();
 }
 function invitationInput(action, input) {
-  if (!record5(input))
+  if (!record6(input))
     return inputFailure();
   const keys2 = {
     list: ["after"],
@@ -60466,7 +60574,7 @@ function invalid4() {
   throw new RemoteWorkspaceInvitationReadError;
 }
 function projection(v, organizationId) {
-  if (!record5(v) || !uuid3(v.id) || v.organizationId !== organizationId || !email(v.email) || v.email !== v.email.trim().toLowerCase() || !role2(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record5(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
+  if (!record6(v) || !uuid3(v.id) || v.organizationId !== organizationId || !email(v.email) || v.email !== v.email.trim().toLowerCase() || !role2(v.role) || !Number.isInteger(v.generation) || Number(v.generation) < 1 || Number(v.generation) > 10 || typeof v.status !== "string" || !["pending", "expired", "accepted", "revoked"].includes(v.status) || !timestamp(v.expiresAt) || !timestamp(v.createdAt) || !record6(v.delivery) || typeof v.delivery.state !== "string" || !["queued", "sending", "uncertain", "provider_accepted", "failed", "cancelled"].includes(v.delivery.state) || !Number.isInteger(v.delivery.attempts) || Number(v.delivery.attempts) < 0 || Number(v.delivery.attempts) > 5)
     return invalid4();
   return {
     id: v.id,
@@ -60481,7 +60589,7 @@ function projection(v, organizationId) {
   };
 }
 function parseInvitationResult(action, value, input, organizationId) {
-  if (!record5(value))
+  if (!record6(value))
     return invalid4();
   const request = input;
   if (action === "accept") {
@@ -60512,7 +60620,7 @@ function parseInvitationResult(action, value, input, organizationId) {
     return invalid4();
   return { invitation, changed: value.changed };
 }
-var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record5 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid3 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
+var WorkspaceInvitationInputError, invitationFailures, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError, record6 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid3 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), role2 = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), email = (v) => typeof v === "string" && v.length <= 254 && !/[\p{Cc}\p{Cs}\u2028\u2029\s]/u.test(v) && /^[^@]+@[^@]+\.[^@]+$/.test(v), timestamp = (v) => typeof v === "string" && v.length <= 40 && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d{1,6})?(?:Z|[+-]\d\d:\d\d)$/.test(v) && Number.isFinite(Date.parse(v)), inputFailure = () => {
   throw new WorkspaceInvitationInputError;
 };
 var init_remote_invitations = __esm(() => {
@@ -60566,7 +60674,7 @@ var init_remote_invitations = __esm(() => {
 
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record6(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record7(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -60582,7 +60690,7 @@ function timestamp2(value) {
   return Number.isFinite(time) && new Date(time).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail3) {
-  if (!record6(row) || !uuid4(row.membershipId) || !uuid4(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
+  if (!record7(row) || !uuid4(row.membershipId) || !uuid4(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp2(row.createdAt))
     return fail3();
   return {
     membershipId: row.membershipId,
@@ -60594,7 +60702,7 @@ function parseMember(row, fail3) {
   };
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid4(membershipId) || membershipId !== membershipId.toLowerCase() || !record6(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid4(membershipId) || membershipId !== membershipId.toLowerCase() || !record7(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
   const expectedRole = input.expectedRole, role3 = roleChange ? input.role : undefined;
   if (!isRole(expectedRole) || roleChange && !isRole(role3))
@@ -60613,7 +60721,7 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   const fail3 = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record6(value) || !uuid4(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record7(value) || !uuid4(value.organizationId) || typeof value.changed !== "boolean")
     return fail3();
   const member = parseMember(value.member, fail3);
   if (member.membershipId !== membershipId || member.role !== role3)
@@ -60621,12 +60729,12 @@ function parseWorkspaceMemberRoleResult(value, membershipId, role3) {
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record6(value) || !uuid4(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record7(value) || !uuid4(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record6(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record7(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -60635,14 +60743,14 @@ function parseWorkspaceMembersPage(value) {
   const fail3 = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record6(value) || !uuid4(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record7(value) || !uuid4(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail3();
   const members = value.members.map((row) => parseMember(row, fail3));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail3();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
-var record6 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid4 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record7 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid4 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -75977,8 +76085,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = new Map;
-  for (const record7 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record7);
+  for (const record8 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record8);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -77079,7 +77187,7 @@ __export(exports_schemas2, {
   strictObject: () => strictObject,
   set: () => set2,
   refine: () => refine,
-  record: () => record7,
+  record: () => record8,
   readonly: () => readonly,
   promise: () => promise,
   preprocess: () => preprocess,
@@ -77459,7 +77567,7 @@ function tuple(items, _paramsOrRest, _params) {
     ...exports_util.normalizeParams(params)
   });
 }
-function record7(keyType, valueType, params) {
+function record8(keyType, valueType, params) {
   if (!valueType || !valueType._zod) {
     return new ZodRecord({
       type: "record",
@@ -77699,7 +77807,7 @@ function _instanceof(cls, params = {}) {
 }
 function json(params) {
   const jsonSchema = lazy(() => {
-    return union2([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record7(string2(), jsonSchema)]);
+    return union2([string2(params), number2(), boolean2(), _null3(), array2(jsonSchema), record8(string2(), jsonSchema)]);
   });
   return jsonSchema;
 }
@@ -79518,7 +79626,7 @@ __export(exports_external, {
   regexes: () => exports_regexes,
   regex: () => _regex,
   refine: () => refine,
-  record: () => record7,
+  record: () => record8,
   readonly: () => readonly,
   property: () => _property,
   properties: () => _properties,
@@ -80131,44 +80239,44 @@ var init_remote_recurring = __esm(() => {
 
 // src/lib/remote-run-contract.ts
 function normalizeRemoteSkillRunContract(payload, fallbackSkill) {
-  const record8 = isRecord4(payload) ? payload : {};
+  const record9 = isRecord4(payload) ? payload : {};
   return {
     contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION,
-    ...pickString(record8, "id"),
-    skill: pickStringValue(record8, "skill") ?? fallbackSkill,
-    ...pickString(record8, "requestedSlug"),
-    ...pickString(record8, "status"),
-    ...pickNumber(record8, "exitCode"),
-    ...pickString(record8, "correlationId"),
-    ...pickString(record8, "createdAt"),
-    ...pickString(record8, "startedAt"),
-    ...pickString(record8, "completedAt"),
-    ...pickNumber(record8, "durationMs"),
-    ...pickString(record8, "outputType"),
-    ...hasOwn(record8, "outputPreview") ? { outputPreview: record8.outputPreview } : {},
-    ...pickString(record8, "errorCode"),
-    ...pickString(record8, "errorMessage"),
-    ...pickString(record8, "error"),
-    ...pickString(record8, "code"),
-    ...hasOwn(record8, "details") ? { details: record8.details } : {}
+    ...pickString(record9, "id"),
+    skill: pickStringValue(record9, "skill") ?? fallbackSkill,
+    ...pickString(record9, "requestedSlug"),
+    ...pickString(record9, "status"),
+    ...pickNumber(record9, "exitCode"),
+    ...pickString(record9, "correlationId"),
+    ...pickString(record9, "createdAt"),
+    ...pickString(record9, "startedAt"),
+    ...pickString(record9, "completedAt"),
+    ...pickNumber(record9, "durationMs"),
+    ...pickString(record9, "outputType"),
+    ...hasOwn(record9, "outputPreview") ? { outputPreview: record9.outputPreview } : {},
+    ...pickString(record9, "errorCode"),
+    ...pickString(record9, "errorMessage"),
+    ...pickString(record9, "error"),
+    ...pickString(record9, "code"),
+    ...hasOwn(record9, "details") ? { details: record9.details } : {}
   };
 }
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function hasOwn(record8, key) {
-  return Object.prototype.hasOwnProperty.call(record8, key);
+function hasOwn(record9, key) {
+  return Object.prototype.hasOwnProperty.call(record9, key);
 }
-function pickString(record8, key) {
-  const value = pickStringValue(record8, key);
+function pickString(record9, key) {
+  const value = pickStringValue(record9, key);
   return value === undefined ? {} : { [key]: value };
 }
-function pickStringValue(record8, key) {
-  const value = record8[key];
+function pickStringValue(record9, key) {
+  const value = record9[key];
   return typeof value === "string" ? value : undefined;
 }
-function pickNumber(record8, key) {
-  const value = record8[key];
+function pickNumber(record9, key) {
+  const value = record9[key];
   return typeof value === "number" && Number.isFinite(value) ? { [key]: value } : {};
 }
 var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
@@ -80391,7 +80499,7 @@ var init_remote_quote_errors = __esm(() => {
 function parseSkillsAccess(value) {
   if (value === undefined)
     return {};
-  if (!record8(value))
+  if (!record9(value))
     throw new Error("Invalid Skills permission contract");
   const result2 = {};
   if (value.scopes !== undefined) {
@@ -80400,7 +80508,7 @@ function parseSkillsAccess(value) {
     result2.scopes = [...value.scopes];
   }
   if (value.permissions !== undefined) {
-    if (!record8(value.permissions))
+    if (!record9(value.permissions))
       throw new Error("Invalid Skills permission contract");
     result2.permissions = {};
     for (const name of permissionNames) {
@@ -80418,7 +80526,7 @@ function assertSkillsPermission(access, permission) {
   if (access.permissions?.[permission] === false)
     throw new RemoteSkillsPermissionError(permission);
 }
-var permissionNames, record8 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), RemoteSkillsPermissionError;
+var permissionNames, record9 = (value) => value !== null && typeof value === "object" && !Array.isArray(value), RemoteSkillsPermissionError;
 var init_remote_permissions = __esm(() => {
   permissionNames = [
     "read",
@@ -81233,13 +81341,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record9, field2) {
-  if (record9[field2] === undefined)
+function requireOptionalString(record10, field2) {
+  if (record10[field2] === undefined)
     return;
-  if (typeof record9[field2] !== "string") {
+  if (typeof record10[field2] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field2} must be a string when present)`);
   }
-  return record9[field2];
+  return record10[field2];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -81261,19 +81369,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record9 = entry;
-  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
+  const record10 = entry;
+  const slug2 = typeof record10.slug === "string" && record10.slug.trim() ? record10.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record9.metadata !== undefined) {
-    if (!record9.metadata || typeof record9.metadata !== "object" || Array.isArray(record9.metadata)) {
+  if (record10.metadata !== undefined) {
+    if (!record10.metadata || typeof record10.metadata !== "object" || Array.isArray(record10.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record9.metadata;
+    metadata = record10.metadata;
   }
-  const pinnedAt = requireOptionalString(record9, "pinnedAt");
+  const pinnedAt = requireOptionalString(record10, "pinnedAt");
   return {
     slug: slug2,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -81290,16 +81398,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record9 = entry;
-  const slug2 = typeof record9.slug === "string" && record9.slug.trim() ? record9.slug.trim() : undefined;
+  const record10 = entry;
+  const slug2 = typeof record10.slug === "string" && record10.slug.trim() ? record10.slug.trim() : undefined;
   if (!slug2) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug: slug2,
-    ...requireOptionalString(record9, "name") !== undefined ? { name: requireOptionalString(record9, "name") } : {},
-    ...requireOptionalString(record9, "version") !== undefined ? { version: requireOptionalString(record9, "version") } : {},
-    ...requireOptionalString(record9, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record9, "updatedAt") } : {}
+    ...requireOptionalString(record10, "name") !== undefined ? { name: requireOptionalString(record10, "name") } : {},
+    ...requireOptionalString(record10, "version") !== undefined ? { version: requireOptionalString(record10, "version") } : {},
+    ...requireOptionalString(record10, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record10, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -81356,12 +81464,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record9 = payload;
-  if (!Array.isArray(record9.skills)) {
+  const record10 = payload;
+  if (!Array.isArray(record10.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record9.skills.map(normalizeSkillSummary);
-  const nextCursor = record9.nextCursor === undefined || record9.nextCursor === null ? null : record9.nextCursor;
+  const skills = record10.skills.map(normalizeSkillSummary);
+  const nextCursor = record10.nextCursor === undefined || record10.nextCursor === null ? null : record10.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -81497,10 +81605,10 @@ async function requestAuthApi(instance, path, options) {
   const text4 = await res.text();
   const body = text4 ? parseJsonBody(text4) : {};
   if (!res.ok) {
-    const record9 = isRecord6(body) ? body : {};
-    const detail = typeof record9.detail === "string" ? record9.detail : undefined;
-    const error61 = typeof record9.error === "string" ? record9.error : undefined;
-    const code = typeof record9.code === "string" ? record9.code : undefined;
+    const record10 = isRecord6(body) ? body : {};
+    const detail = typeof record10.detail === "string" ? record10.detail : undefined;
+    const error61 = typeof record10.error === "string" ? record10.error : undefined;
+    const code = typeof record10.code === "string" ? record10.code : undefined;
     throw new HostedApiError(detail || error61 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -81738,24 +81846,24 @@ function clampIntervalMs(seconds) {
   return Math.min(MAX_INTERVAL_MS, Math.max(MIN_INTERVAL_MS, Math.round(seconds * 1000)));
 }
 function parseDeviceAuthorizationStart(body) {
-  const record9 = isRecord7(body) ? body : {};
-  if (typeof record9.error === "string") {
-    throw new Error(typeof record9.detail === "string" ? record9.detail : record9.error);
+  const record10 = isRecord7(body) ? body : {};
+  if (typeof record10.error === "string") {
+    throw new Error(typeof record10.detail === "string" ? record10.detail : record10.error);
   }
-  const deviceCode = boundedText(record9.deviceCode, 512);
-  const userCode = boundedText(record9.userCode, 64);
-  const verificationUri = httpUrl2(record9.verificationUri);
+  const deviceCode = boundedText(record10.deviceCode, 512);
+  const userCode = boundedText(record10.userCode, 64);
+  const verificationUri = httpUrl2(record10.verificationUri);
   if (!deviceCode || !userCode || !verificationUri) {
     throw new Error("The Skills server returned an incomplete device sign-in (deviceCode, userCode and verificationUri are required)");
   }
-  const verificationUriComplete = httpUrl2(record9.verificationUriComplete);
+  const verificationUriComplete = httpUrl2(record10.verificationUriComplete);
   return {
     deviceCode,
     userCode,
     verificationUri,
     ...verificationUriComplete ? { verificationUriComplete } : {},
-    expiresIn: positiveNumber(record9.expiresIn, DEFAULT_EXPIRES_IN_SECONDS),
-    interval: positiveNumber(record9.interval, DEFAULT_INTERVAL_SECONDS)
+    expiresIn: positiveNumber(record10.expiresIn, DEFAULT_EXPIRES_IN_SECONDS),
+    interval: positiveNumber(record10.interval, DEFAULT_INTERVAL_SECONDS)
   };
 }
 async function startDeviceAuthorization(origin, client2 = SKILLS_CLI_DEVICE_CLIENT) {
@@ -81833,9 +81941,9 @@ async function pollDeviceAuthorization(input2) {
           throw error61;
       }
     }
-    const record9 = isRecord7(body) ? body : {};
-    const code = typeof record9.error === "string" ? record9.error : undefined;
-    if (code === "authorization_pending" || code === undefined && record9.status === "pending") {
+    const record10 = isRecord7(body) ? body : {};
+    const code = typeof record10.error === "string" ? record10.error : undefined;
+    if (code === "authorization_pending" || code === undefined && record10.status === "pending") {
       await wait();
       continue;
     }
@@ -81851,8 +81959,8 @@ async function pollDeviceAuthorization(input2) {
     if (code === "access_denied")
       return { status: "denied" };
     if (code)
-      throw new Error(typeof record9.detail === "string" ? record9.detail : code);
-    return { status: "authorized", result: record9 };
+      throw new Error(typeof record10.detail === "string" ? record10.detail : code);
+    return { status: "authorized", result: record10 };
   }
 }
 function pendingDeviceSignInStem(env3) {
@@ -82138,10 +82246,10 @@ async function readSignedInAccount(env3 = process.env) {
     const body = await new RemoteSkillsAuthClient(connection.apiOrigin).request("/api/auth/whoami", {
       headers: { Authorization: `Bearer ${connection.apiKey}` }
     });
-    const record9 = isRecord7(body) ? body : {};
-    const data = isRecord7(record9.data) ? record9.data : {};
-    const user = isRecord7(record9.user) ? record9.user : isRecord7(data.user) ? data.user : {};
-    const organization2 = isRecord7(record9.organization) ? record9.organization : isRecord7(data.organization) ? data.organization : {};
+    const record10 = isRecord7(body) ? body : {};
+    const data = isRecord7(record10.data) ? record10.data : {};
+    const user = isRecord7(record10.user) ? record10.user : isRecord7(data.user) ? data.user : {};
+    const organization2 = isRecord7(record10.organization) ? record10.organization : isRecord7(data.organization) ? data.organization : {};
     const email4 = boundedText(user.email, 320);
     const org = boundedText(organization2.slug, 200) ?? boundedText(organization2.name, 200);
     return { ...base2, ...email4 ? { email: email4 } : {}, ...org ? { organization: org } : {} };
@@ -82941,16 +83049,16 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   }
   return { path: target, created };
 }
-function writePullMarker(dir, record9) {
+function writePullMarker(dir, record10) {
   const marker = {
     managedBy: "@hasna/skills",
-    skill: record9.skill,
-    source: record9.source ?? "pull",
-    ...record9.version ? { version: record9.version } : {},
-    ...record9.contentHash ? { contentHash: record9.contentHash } : {},
-    ...record9.sourceCommit ? { sourceCommit: record9.sourceCommit } : {},
-    ...record9.signature ? { signature: record9.signature } : {},
-    ...record9.revisionId ? { revisionId: record9.revisionId } : {},
+    skill: record10.skill,
+    source: record10.source ?? "pull",
+    ...record10.version ? { version: record10.version } : {},
+    ...record10.contentHash ? { contentHash: record10.contentHash } : {},
+    ...record10.sourceCommit ? { sourceCommit: record10.sourceCommit } : {},
+    ...record10.signature ? { signature: record10.signature } : {},
+    ...record10.revisionId ? { revisionId: record10.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync12(join38(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -82965,19 +83073,19 @@ async function safeMeta(client2, slug2) {
   }
   if (!raw || typeof raw !== "object")
     return null;
-  const record9 = raw;
-  const kind = record9.kind === "instruction" || record9.kind === "executable" ? record9.kind : undefined;
-  const tags = Array.isArray(record9.tags) ? record9.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
+  const record10 = raw;
+  const kind = record10.kind === "instruction" || record10.kind === "executable" ? record10.kind : undefined;
+  const tags = Array.isArray(record10.tags) ? record10.tags.filter((tag) => typeof tag === "string" && tag.trim().length > 0) : undefined;
   return {
-    ...str(record9.displayName) ? { displayName: str(record9.displayName) } : {},
-    ...str(record9.description) ? { description: str(record9.description) } : {},
-    ...str(record9.category) ? { category: str(record9.category) } : {},
+    ...str(record10.displayName) ? { displayName: str(record10.displayName) } : {},
+    ...str(record10.description) ? { description: str(record10.description) } : {},
+    ...str(record10.category) ? { category: str(record10.category) } : {},
     ...tags && tags.length ? { tags } : {},
-    ...str(record9.version) ? { version: str(record9.version) } : {},
+    ...str(record10.version) ? { version: str(record10.version) } : {},
     ...kind ? { kind } : {},
-    ...REVISION_ID_PATTERN.test(str(record9.revisionId) ?? "") ? { revisionId: str(record9.revisionId) } : {},
-    ...typeof record9.skillMd === "string" && record9.skillMd.length > 0 ? { skillMd: record9.skillMd } : {},
-    ...str(record9.publishedSource) ? { publishedSource: str(record9.publishedSource) } : {}
+    ...REVISION_ID_PATTERN.test(str(record10.revisionId) ?? "") ? { revisionId: str(record10.revisionId) } : {},
+    ...typeof record10.skillMd === "string" && record10.skillMd.length > 0 ? { skillMd: record10.skillMd } : {},
+    ...str(record10.publishedSource) ? { publishedSource: str(record10.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
@@ -82986,8 +83094,8 @@ function pickCorpusOptions(options) {
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
     return;
-  const record9 = entry;
-  return str(record9.slug) ?? str(record9.name);
+  const record10 = entry;
+  return str(record10.slug) ?? str(record10.name);
 }
 function dedupe(values2) {
   return [...new Set(values2)];
@@ -83138,7 +83246,7 @@ var init_skill_context = __esm(() => {
 
 // src/lib/session-reconciliation.ts
 import { createHash as createHash24 } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual9 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
 function exactTimestamp(value) {
   const parsed = value === undefined ? Number.NaN : Date.parse(value);
   if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
@@ -83195,7 +83303,7 @@ async function reconcileSkillSessionIfSafe(sessionId, profileId, options = {}) {
   for (const key of old.loaded) {
     const previous = oldByKey.get(key);
     const current = targetBySlug.get(previous.slug);
-    if (!current || !isDeepStrictEqual9({ ...previous, profileRevision: target.profileRevision }, current)) {
+    if (!current || !isDeepStrictEqual10({ ...previous, profileRevision: target.profileRevision }, current)) {
       throw new SkillSelectionError("SESSION_RECONCILIATION_REQUIRED", "A loaded Skills selection was removed or changed; review skills sessions reconcile before changing this session's pin.");
     }
   }
@@ -85348,8 +85456,8 @@ function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
   const dir = join41(appDir, ROLLBACK_DIRNAME);
   mkdirSync14(dir, { recursive: true });
   const file2 = join41(dir, `${mode}-${Date.now()}.json`);
-  const record9 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
-  writeFileSync14(file2, `${JSON.stringify(record9, null, 2)}
+  const record10 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
+  writeFileSync14(file2, `${JSON.stringify(record10, null, 2)}
 `);
   return file2;
 }
@@ -87549,7 +87657,7 @@ function selectedSecretBindingsTemplate(scope, names, createClient2 = createSecr
 function refuse3(code, message) {
   throw new SkillSelectionError(code, message);
 }
-function record9(value) {
+function record10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function exactKeys3(value, keys2) {
@@ -87592,7 +87700,7 @@ function readSelectedSecretBindings(path) {
   }
 }
 function validateSelectedSecretBindings(value, scope, names) {
-  if (!record9(value) || !exactKeys3(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record9(value.selection) || !exactKeys3(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record9(value.consumer) || !exactKeys3(value.consumer, ["stationId", "workspaceDirectory"]) || !record9(value.bindings)) {
+  if (!record10(value) || !exactKeys3(value, ["schema", "selection", "consumer", "secretsAuthority", "bindings"]) || value.schema !== "hasna.skills-secret-bindings.v1" || !record10(value.selection) || !exactKeys3(value.selection, ["authority", "workspaceId", "profileId", "profileRevision", "slug", "version", "bundleDigest"]) || !record10(value.consumer) || !exactKeys3(value.consumer, ["stationId", "workspaceDirectory"]) || !record10(value.bindings)) {
     return refuse3("INVALID_SECRET_BINDINGS", "Secret bindings do not match the hasna.skills-secret-bindings.v1 contract.");
   }
   for (const [key, expected] of Object.entries({ authority: scope.selection.authority, workspaceId: scope.selection.workspaceId, profileId: scope.profileId, profileRevision: scope.selection.profileRevision, slug: scope.selection.slug, version: scope.selection.version, bundleDigest: scope.selection.bundleDigest })) {
@@ -87795,7 +87903,7 @@ var init_execution_grants = __esm(() => {
 });
 
 // src/lib/execution-grant-client.ts
-import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
 function id(value) {
   if (!grantIdentifier(value))
     throw new Error("Invalid execution grant profile or revision identifier.");
@@ -87847,7 +87955,7 @@ async function saveExecutionGrantPolicy(profileId, grants, revision) {
     headers: revision === undefined ? { "If-None-Match": "*" } : { "If-Match": `"${revision}"` },
     body: JSON.stringify({ grants: snapshot2 })
   }));
-  if (policy.profileId !== profileId || policy.previousRevision !== (revision ?? null) || !isDeepStrictEqual10(policy.grants, snapshot2)) {
+  if (policy.profileId !== profileId || policy.previousRevision !== (revision ?? null) || !isDeepStrictEqual11(policy.grants, snapshot2)) {
     throw new Error("The API did not preserve the reviewed execution grant policy; read it before retrying.");
   }
   return policy;
@@ -87858,7 +87966,7 @@ async function resolveExecutionGrant(input2) {
   if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
     throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
   }
-  if (!isDeepStrictEqual10(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual10(value.bindings.consumer, snapshot2.consumer)) {
+  if (!isDeepStrictEqual11(value.bindings.selection, snapshot2.selection) || !isDeepStrictEqual11(value.bindings.consumer, snapshot2.consumer)) {
     throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
   }
   return value;
@@ -92235,7 +92343,7 @@ function createSkillRun(params, targetDir = process.cwd()) {
   mkdirSync16(logsDir, { recursive: true });
   mkdirSync16(exportDir, { recursive: true });
   mkdirSync16(join46(root2, "tmp"), { recursive: true });
-  const record10 = {
+  const record11 = {
     id: id2,
     skill: skillName,
     status: params.status ?? "running",
@@ -92253,10 +92361,10 @@ function createSkillRun(params, targetDir = process.cwd()) {
       logsDir: toProjectRelative(targetDir, logsDir)
     }
   };
-  const context = { targetDir, runDir, exportDir, logsDir, record: record10 };
+  const context = { targetDir, runDir, exportDir, logsDir, record: record11 };
   writeRunRecord(context);
   writeArtifactsManifest(context, []);
-  appendRunEvent(context, "created", { status: record10.status });
+  appendRunEvent(context, "created", { status: record11.status });
   return context;
 }
 function completeSkillRun(context, patch) {
@@ -92306,9 +92414,9 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
     if (!statSync16(dayDir).isDirectory())
       continue;
     for (const runId2 of readdirSync18(dayDir).sort().reverse()) {
-      const record10 = readRunRecord(join46(dayDir, runId2));
-      if (record10)
-        records.push(record10);
+      const record11 = readRunRecord(join46(dayDir, runId2));
+      if (record11)
+        records.push(record11);
       if (records.length >= limit)
         return records;
     }
@@ -92320,9 +92428,9 @@ function findSkillRun(runId2, targetDir = process.cwd()) {
   if (!existsSync27(runsRoot))
     return null;
   for (const day of readdirSync18(runsRoot)) {
-    const record10 = readRunRecord(join46(runsRoot, day, runId2));
-    if (record10)
-      return record10;
+    const record11 = readRunRecord(join46(runsRoot, day, runId2));
+    if (record11)
+      return record11;
   }
   return null;
 }
@@ -92549,7 +92657,7 @@ var init_types2 = __esm(() => {
   });
   FormElicitationCapabilitySchema = intersection2(object5({
     applyDefaults: boolean2().optional()
-  }), record7(string2(), unknown()));
+  }), record8(string2(), unknown()));
   ElicitationCapabilitySchema = preprocess((value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       if (Object.keys(value).length === 0) {
@@ -92560,7 +92668,7 @@ var init_types2 = __esm(() => {
   }, intersection2(object5({
     form: FormElicitationCapabilitySchema.optional(),
     url: AssertObjectSchema.optional()
-  }), record7(string2(), unknown()).optional()));
+  }), record8(string2(), unknown()).optional()));
   ClientTasksCapabilitySchema = looseObject({
     list: AssertObjectSchema.optional(),
     cancel: AssertObjectSchema.optional(),
@@ -92583,7 +92691,7 @@ var init_types2 = __esm(() => {
     }).optional()
   });
   ClientCapabilitiesSchema = object5({
-    experimental: record7(string2(), AssertObjectSchema).optional(),
+    experimental: record8(string2(), AssertObjectSchema).optional(),
     sampling: object5({
       context: AssertObjectSchema.optional(),
       tools: AssertObjectSchema.optional()
@@ -92593,7 +92701,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ClientTasksCapabilitySchema.optional(),
-    extensions: record7(string2(), AssertObjectSchema).optional()
+    extensions: record8(string2(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string2(),
@@ -92605,7 +92713,7 @@ var init_types2 = __esm(() => {
     params: InitializeRequestParamsSchema
   });
   ServerCapabilitiesSchema = object5({
-    experimental: record7(string2(), AssertObjectSchema).optional(),
+    experimental: record8(string2(), AssertObjectSchema).optional(),
     logging: AssertObjectSchema.optional(),
     completions: AssertObjectSchema.optional(),
     prompts: object5({
@@ -92619,7 +92727,7 @@ var init_types2 = __esm(() => {
       listChanged: boolean2().optional()
     }).optional(),
     tasks: ServerTasksCapabilitySchema.optional(),
-    extensions: record7(string2(), AssertObjectSchema).optional()
+    extensions: record8(string2(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string2(),
@@ -92706,7 +92814,7 @@ var init_types2 = __esm(() => {
   ResourceContentsSchema = object5({
     uri: string2(),
     mimeType: optional(string2()),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   TextResourceContentsSchema = ResourceContentsSchema.extend({
     text: string2()
@@ -92811,7 +92919,7 @@ var init_types2 = __esm(() => {
   });
   GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
     name: string2(),
-    arguments: record7(string2(), string2()).optional()
+    arguments: record8(string2(), string2()).optional()
   });
   GetPromptRequestSchema = RequestSchema.extend({
     method: literal("prompts/get"),
@@ -92821,34 +92929,34 @@ var init_types2 = __esm(() => {
     type: literal("text"),
     text: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   ImageContentSchema = object5({
     type: literal("image"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   AudioContentSchema = object5({
     type: literal("audio"),
     data: Base64Schema,
     mimeType: string2(),
     annotations: AnnotationsSchema.optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   ToolUseContentSchema = object5({
     type: literal("tool_use"),
     name: string2(),
     id: string2(),
-    input: record7(string2(), unknown()),
-    _meta: record7(string2(), unknown()).optional()
+    input: record8(string2(), unknown()),
+    _meta: record8(string2(), unknown()).optional()
   });
   EmbeddedResourceSchema = object5({
     type: literal("resource"),
     resource: union2([TextResourceContentsSchema, BlobResourceContentsSchema]),
     annotations: AnnotationsSchema.optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   ResourceLinkSchema = ResourceSchema.extend({
     type: literal("resource_link")
@@ -92888,17 +92996,17 @@ var init_types2 = __esm(() => {
     description: string2().optional(),
     inputSchema: object5({
       type: literal("object"),
-      properties: record7(string2(), AssertObjectSchema).optional(),
+      properties: record8(string2(), AssertObjectSchema).optional(),
       required: array2(string2()).optional()
     }).catchall(unknown()),
     outputSchema: object5({
       type: literal("object"),
-      properties: record7(string2(), AssertObjectSchema).optional(),
+      properties: record8(string2(), AssertObjectSchema).optional(),
       required: array2(string2()).optional()
     }).catchall(unknown()).optional(),
     annotations: ToolAnnotationsSchema.optional(),
     execution: ToolExecutionSchema.optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   ListToolsRequestSchema = PaginatedRequestSchema.extend({
     method: literal("tools/list")
@@ -92908,7 +93016,7 @@ var init_types2 = __esm(() => {
   });
   CallToolResultSchema = ResultSchema.extend({
     content: array2(ContentBlockSchema).default([]),
-    structuredContent: record7(string2(), unknown()).optional(),
+    structuredContent: record8(string2(), unknown()).optional(),
     isError: boolean2().optional()
   });
   CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -92916,7 +93024,7 @@ var init_types2 = __esm(() => {
   }));
   CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     name: string2(),
-    arguments: record7(string2(), unknown()).optional()
+    arguments: record8(string2(), unknown()).optional()
   });
   CallToolRequestSchema = RequestSchema.extend({
     method: literal("tools/call"),
@@ -92965,7 +93073,7 @@ var init_types2 = __esm(() => {
     content: array2(ContentBlockSchema).default([]),
     structuredContent: object5({}).loose().optional(),
     isError: boolean2().optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
   SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -92978,7 +93086,7 @@ var init_types2 = __esm(() => {
   SamplingMessageSchema = object5({
     role: RoleSchema,
     content: union2([SamplingMessageContentBlockSchema, array2(SamplingMessageContentBlockSchema)]),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
     messages: array2(SamplingMessageSchema),
@@ -93091,7 +93199,7 @@ var init_types2 = __esm(() => {
     message: string2(),
     requestedSchema: object5({
       type: literal("object"),
-      properties: record7(string2(), PrimitiveSchemaDefinitionSchema),
+      properties: record8(string2(), PrimitiveSchemaDefinitionSchema),
       required: array2(string2()).optional()
     })
   });
@@ -93115,7 +93223,7 @@ var init_types2 = __esm(() => {
   });
   ElicitResultSchema = ResultSchema.extend({
     action: _enum2(["accept", "decline", "cancel"]),
-    content: preprocess((val) => val === null ? undefined : val, record7(string2(), union2([string2(), number2(), boolean2(), array2(string2())])).optional())
+    content: preprocess((val) => val === null ? undefined : val, record8(string2(), union2([string2(), number2(), boolean2(), array2(string2())])).optional())
   });
   ResourceTemplateReferenceSchema = object5({
     type: literal("ref/resource"),
@@ -93132,7 +93240,7 @@ var init_types2 = __esm(() => {
       value: string2()
     }),
     context: object5({
-      arguments: record7(string2(), string2()).optional()
+      arguments: record8(string2(), string2()).optional()
     }).optional()
   });
   CompleteRequestSchema = RequestSchema.extend({
@@ -93149,7 +93257,7 @@ var init_types2 = __esm(() => {
   RootSchema = object5({
     uri: string2().startsWith("file://"),
     name: string2().optional(),
-    _meta: record7(string2(), unknown()).optional()
+    _meta: record8(string2(), unknown()).optional()
   });
   ListRootsRequestSchema = RequestSchema.extend({
     method: literal("roots/list"),
@@ -112311,7 +112419,7 @@ var init_create_sync_config = __esm(() => {
 });
 
 // src/lib/codex-native-config.ts
-import { isDeepStrictEqual as isDeepStrictEqual11 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
 function isRecord8(value) {
   if (!value || typeof value !== "object")
     return false;
@@ -112333,7 +112441,7 @@ function decimalIdentity(text4) {
   return `${match[1]}${coefficient}e${exponent}`;
 }
 function codexNativeConfigEqual(native, expected) {
-  if (isDeepStrictEqual11(native, expected))
+  if (isDeepStrictEqual12(native, expected))
     return true;
   if (typeof expected === "number") {
     if (!Number.isFinite(expected) || !isRecord8(native))
@@ -112359,7 +112467,7 @@ var init_codex_native_config = () => {};
 // src/lib/codex-hook-trust-identity.ts
 import { realpathSync as realpathSync16 } from "fs";
 import { dirname as dirname33, isAbsolute as isAbsolute27, join as join59 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual12 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual13 } from "util";
 function inspectRecordedSkillsCli(command, expected) {
   need6(isAbsolute27(command) && !command.includes("\x00"), "RECONCILE_RECORDED_COMMAND_REQUIRED");
   const resolved = realpathSync16(command);
@@ -112369,7 +112477,7 @@ function inspectRecordedSkillsCli(command, expected) {
   need6(pkg.name === "@hasna/skills" && /^\d+\.\d+\.\d+$/.test(pkg.version) && pkg.bin?.skills === "bin/index.js" && resolved === join59(dirname33(manifest.file), "bin/index.js"), "SKILLS_PACKAGE_MISMATCH");
   need6((cli.stat.mode & 0o100n) !== 0n, "SKILLS_COMMAND_NOT_EXECUTABLE");
   const receipt = { path: resolved, version: pkg.version, sha256: cli.sha256, manifestSha256: manifest.sha256 };
-  need6(isDeepStrictEqual12(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
+  need6(isDeepStrictEqual13(receipt, expected), "RECONCILE_SKILLS_BINDING_CHANGED");
   return { receipt, recheck() {
     need6(realpathSync16(command) === resolved, "SKILLS_COMMAND_CHANGED");
     unchanged2(cli);
@@ -112405,19 +112513,19 @@ var init_codex_hook_trust_identity = __esm(() => {
 });
 
 // src/lib/codex-hook-policy-recovery.ts
-import { isDeepStrictEqual as isDeepStrictEqual13 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual14 } from "util";
 function reviewedClaudeDiscoveryChange(beforeText, currentText, options) {
   need6(typeof options.reason === "string" && options.reason.trim().length > 0 && options.reason.length <= 512 && !/[\x00-\x1f\x7f]/.test(options.reason), "RECONCILE_RECOVERY_REASON_REQUIRED");
   need6(options.reviewedPlanDigest === undefined || /^[a-f0-9]{64}$/.test(options.reviewedPlanDigest), "RECONCILE_RECOVERY_PLAN_CHANGED");
   const before2 = parseManagedSkillPolicy(beforeText), current = parseManagedSkillPolicy(currentText);
   const oldDiscovery = before2.bridge?.discovery?.claude, newDiscovery = current.bridge?.discovery?.claude;
   need6(oldDiscovery?.agent === "claude" && newDiscovery?.agent === "claude" && oldDiscovery.method === "reviewed" && newDiscovery.method === "reviewed", "RECONCILE_POLICY_CHANGED");
-  const changes = ["roots", "sources"].filter((key) => !isDeepStrictEqual13(oldDiscovery[key], newDiscovery[key])).map((key) => ({ path: `bridge.discovery.claude.${key}`, before: oldDiscovery[key], after: newDiscovery[key] }));
+  const changes = ["roots", "sources"].filter((key) => !isDeepStrictEqual14(oldDiscovery[key], newDiscovery[key])).map((key) => ({ path: `bridge.discovery.claude.${key}`, before: oldDiscovery[key], after: newDiscovery[key] }));
   need6(changes.length > 0, "RECONCILE_POLICY_CHANGED");
   const compared = structuredClone(current);
   compared.bridge.discovery.claude.roots = oldDiscovery.roots;
   compared.bridge.discovery.claude.sources = oldDiscovery.sources;
-  need6(isDeepStrictEqual13(before2, compared), "RECONCILE_POLICY_CHANGED");
+  need6(isDeepStrictEqual14(before2, compared), "RECONCILE_POLICY_CHANGED");
   verifyAgentDiscovery(newDiscovery);
   return { reason: options.reason, changes };
 }
@@ -112433,7 +112541,7 @@ import { createHash as createHash31, randomUUID as randomUUID11 } from "crypto";
 import { execFileSync } from "child_process";
 import { dirname as dirname34, isAbsolute as isAbsolute28, join as join60, resolve as resolve25 } from "path";
 import { homedir as homedir12 } from "os";
-import { isDeepStrictEqual as isDeepStrictEqual14 } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual15 } from "util";
 function verifyReleaseArtifact(proof, skillsCli) {
   need6(isAbsolute28(proof.packageTarPath) && !proof.packageTarPath.includes("\x00"), "RECONCILE_RELEASE_PROVENANCE_PATH");
   const tarPath = realpathSync17(proof.packageTarPath);
@@ -112475,7 +112583,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const configSha256 = intent.configSha256 ?? configBefore.sha256, configVersion = intent.configVersion ?? intent.expectedVersion;
     const digestInput = { version: 1, home: intent.home ?? home, configPath: intent.configPath, ...intent.nativeConfigPath !== undefined ? { nativeConfigPath: intent.nativeConfigPath } : {}, configSha256, configVersion, policySha256: intent.policySha256, hooksSha256: intent.hooksSha256, skillsCli: intent.skillsCli, nativeVersion: intent.nativeVersion, declarations, admitted };
     need6(makePlanDigest(digestInput) === intent.planDigest, "RECONCILE_PLAN_CHANGED");
-    need6(isDeepStrictEqual14(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
+    need6(isDeepStrictEqual15(intent.hooks, admitted.filter((hook) => !hook.enabled || hook.trustStatus !== "trusted")), "RECONCILE_INTENT_HOOKS_CHANGED");
     need6(configBefore.sha256 === (intent.beforeSha256 ?? intent.configSha256) && hooksBefore.sha256 === intent.hooksSha256 && policyBefore.sha256 === intent.policySha256, "RECONCILE_JOURNAL_CHANGED");
     const policyCurrent = snapshot(join60(dataDir3, "agent-policy.json"), true);
     const { claudeDiscoveryRecovery: claudeRecovery, nativeHookAdditionsRecovery: additionsRecovery } = options;
@@ -112488,7 +112596,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     if (policyCurrent.sha256 !== policyBefore.sha256 && !claudeRecovery) {
       need6(options.supersedeBinding === true, "RECONCILE_POLICY_CHANGED");
       const oldPolicy = JSON.parse(policyBefore.text), currentPolicy = JSON.parse(policyCurrent.text);
-      need6(isDeepStrictEqual14(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
+      need6(isDeepStrictEqual15(withoutCodexCommand(oldPolicy), withoutCodexCommand(currentPolicy)), "RECONCILE_POLICY_CHANGED");
       supersededBinding = true;
     }
     if (supersededBinding || recovery) {
@@ -112524,7 +112632,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
         need6(state?.enabled === true && typeof state.trusted_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(state.trusted_hash), "RECONCILE_CONFIG_DRIFT");
       }
     } else
-      need6(isDeepStrictEqual14(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
+      need6(isDeepStrictEqual15(expectedConfig, current), "RECONCILE_CONFIG_DRIFT");
     const configDiscoveryRecovery = recovery && binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, configBefore, currentConfig, intent.hooks, additions?.trustProof) : undefined;
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: configDiscoveryRecovery });
     const recoveryCli = recovery ? bindSkillsCli("skills", options.reviewedSkillsCli) : undefined;
@@ -112533,14 +112641,14 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const skillsCli = recovery ? inspectRecordedSkillsCli(binding.commands.codex, intent.skillsCli) : bindSkillsCli(binding.commands.codex, options.reviewedSkillsCli);
     if (supersededBinding)
       verifyReleaseArtifact(options.releaseProof, skillsCli);
-    const skillsBindingChanged = !isDeepStrictEqual14(skillsCli.receipt, intent.skillsCli);
+    const skillsBindingChanged = !isDeepStrictEqual15(skillsCli.receipt, intent.skillsCli);
     need6(!skillsBindingChanged || supersededBinding, "RECONCILE_SKILLS_BINDING_CHANGED");
     if (!additions && hooksCurrent.sha256 !== intent.hooksSha256 && hooksCurrent.sha256 !== hooksBefore.sha256) {
       need6(supersededBinding, "RECONCILE_HOOKS_CHANGED");
       const currentDeclarations = JSON.parse(hooksCurrent.text).hooks;
       for (const [event, [nativeEvent]] of Object.entries(eventNames)) {
         const command = renderAgentHookCommand(binding.commands.codex, "codex", binding.profiles.codex, event);
-        need6(isDeepStrictEqual14(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
+        need6(isDeepStrictEqual15(currentDeclarations?.[event], [{ hooks: [{ type: "command", command, timeout: 15 }] }]), "RECONCILE_BINDING_HOOK_CHANGED");
       }
     }
     rpc = await connect({ command: options.codexCommand ?? "codex", home, codexHome });
@@ -112563,9 +112671,9 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
           delete identity5.command;
         return identity5;
       };
-      need6(isDeepStrictEqual14(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
+      need6(isDeepStrictEqual15(stable(actual), stable(expected)), "RECONCILE_NATIVE_IDENTITY_CHANGED");
       if (!plannedKeys.has(expected.key))
-        need6(isDeepStrictEqual14(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
+        need6(isDeepStrictEqual15(actual, expected), "RECONCILE_UNRELATED_HOOK_CHANGED");
     }
     for (const wanted of intent.hooks) {
       const matches2 = nativeHooks.filter((h2) => h2.key === wanted.key || h2.key === wanted.key.replace(join60(home, ".codex/hooks.json"), hooksPath));
@@ -112584,7 +112692,7 @@ async function reconcileCodexNativeHooks(options, connect = connectCodexHookRpc)
     const layers = config2?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need6(layers?.length === 1 && !layers[0].disabledReason && codexNativeConfigEqual(layers[0].config, current), "RECONCILE_NATIVE_CONFIG_MISMATCH");
     const finalDiscovery = await rpc.request("hooks/list", { cwds: [home] });
-    need6(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual14(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
+    need6(Array.isArray(finalDiscovery?.data) && finalDiscovery.data.length === 1 && finalDiscovery.data[0].cwd === home && !finalDiscovery.data[0].errors?.length && !finalDiscovery.data[0].warnings?.length && (!recordedNativeHooks || isDeepStrictEqual15(finalDiscovery.data[0].hooks.map(safeNativeHook), nativeHooks.map(safeNativeHook))), "RECONCILE_NATIVE_STATE_CHANGED");
     const finalConfig = await rpc.request("config/read", { includeLayers: true, cwd: home });
     const finalLayers = finalConfig?.layers?.filter((layer) => layer.name?.type === "user" && layer.name.file === nativeConfigPath && !layer.name.profile);
     need6(finalLayers?.length === 1 && !finalLayers[0].disabledReason && codexNativeConfigEqual(finalLayers[0].config, current), "RECONCILE_NATIVE_CONFIG_CHANGED");
@@ -112645,7 +112753,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
       const groups = declarations[event];
       need6(Array.isArray(groups), "DECLARATION_CHANGED");
       const matches2 = groups.flatMap((group, gi) => (group.hooks ?? []).flatMap((entry, hi) => entry.command === command ? [{ group, entry, gi, hi }] : []));
-      need6(matches2.length === 1 && isDeepStrictEqual14(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
+      need6(matches2.length === 1 && isDeepStrictEqual15(matches2[0].group, { hooks: [{ type: "command", command, timeout: 15 }] }), "DECLARATION_CHANGED");
       expected.push({ event: nativeEvent, key: `${join60(home, ".codex/hooks.json")}:${label}:${matches2[0].gi}:${matches2[0].hi}`, command });
     }
     codexTrustTextWitness(configFile.text, expected.map((h) => h.key));
@@ -112711,7 +112819,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     save(join60(journal, "hooks.before.json"), hooksFile.bytes);
     save(join60(journal, "policy.before.json"), policyFile.bytes);
     save(join60(journal, "intent.json"), json2({ ...digestInput, planDigest, hooks: planned, nativeHooks: discovered.map(safeNativeHook) }));
-    need6(isDeepStrictEqual14(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
+    need6(isDeepStrictEqual15(admit(await list2()), admitted), "NATIVE_DISCOVERY_CHANGED");
     checkInputs();
     let result2;
     try {
@@ -112725,7 +112833,7 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     expectedConfig.hooks.state ??= {};
     for (const h of planned)
       expectedConfig.hooks.state[h.key] = { ...expectedConfig.hooks.state[h.key], enabled: true, trusted_hash: h.currentHash };
-    need6(isDeepStrictEqual14(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
+    need6(isDeepStrictEqual15(structure3(after2.text), expectedConfig) && codexTrustTextWitness(after2.text, keys3) === preservationText, "PRESERVATION_FAILED");
     const savedConfig = snapshot(join60(journal, "config.before.toml"), true);
     need6(savedConfig.sha256 === configFile.sha256, "JOURNAL_CHANGED");
     const discoveryTransition = binding.discovery?.codex ? createCodexHookDiscoveryRecovery(binding.discovery.codex, savedConfig, after2, planned) : undefined;
@@ -112733,8 +112841,8 @@ async function enrollCodexNativeHooks(options = {}, connect = connectCodexHookRp
     unchanged2(hooksFile);
     assertManagedAgentBridge("codex", { home, dataDir: dataDir3, projectDir: home, codexDiscoveryRecovery: discoveryTransition });
     const current = await list2(), confirmed = admit(current);
-    need6(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual14(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
-    need6(isDeepStrictEqual14(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
+    need6(confirmed.every((h) => h.enabled && h.trustStatus === "trusted") && isDeepStrictEqual15(confirmed.map((h) => [h.key, h.currentHash]), admitted.map((h) => [h.key, h.currentHash])), "NATIVE_NOT_ELIGIBLE");
+    need6(isDeepStrictEqual15(current.filter((h) => !keys3.includes(h.key)), discovered.filter((h) => !keys3.includes(h.key))), "UNRELATED_HOOK_CHANGED");
     unchanged2(after2);
     unchanged2(savedConfig);
     unchanged2(hooksFile);
@@ -113004,17 +113112,19 @@ function registerAgentIntegration(parent) {
       process.exitCode = 1;
     }
   });
-  hook.command("witness").requiredOption("--kind <kind>", "claude-settings-v3, claude-settings-v2, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2").requiredOption("--path <path>", "Canonical absolute path to the reviewed settings or registry file").option("--json", "Output the discovery witness as JSON", false).description("Capture an explicit versioned review witness without installing it").action(async (options) => {
-    const capture2 = options.kind === "codex-settings-v2" ? captureCodexSettingsV2 : options.kind === "codex-settings-v1" ? captureCodexSettings : options.kind === "claude-settings-v3" ? captureClaudeSettingsV3 : options.kind === "claude-settings-v2" ? captureClaudeSettingsV2 : options.kind === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : null;
+  hook.command("witness").requiredOption("--kind <kind>", "claude-settings-v3, claude-settings-v2, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2").requiredOption("--path <path>", "Canonical absolute path to the reviewed settings or registry file").option("--json", "Output the discovery witness as JSON", false).description("Capture an explicit versioned review witness without installing it").action(async (options) => {
+    const capture2 = options.kind === "codex-settings-v3" ? captureCodexSettingsV3 : options.kind === "codex-settings-v2" ? captureCodexSettingsV2 : options.kind === "codex-settings-v1" ? captureCodexSettings : options.kind === "claude-settings-v3" ? captureClaudeSettingsV3 : options.kind === "claude-settings-v2" ? captureClaudeSettingsV2 : options.kind === "claude-marketplace-registry-v2" ? captureClaudeMarketplaceRegistryV2 : null;
     if (!capture2)
-      throw new Error("Unsupported witness kind; select claude-settings-v3, claude-settings-v2, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2");
+      throw new Error("Unsupported witness kind; select claude-settings-v3, claude-settings-v2, codex-settings-v3, codex-settings-v2, codex-settings-v1 or claude-marketplace-registry-v2");
     await writeCliOutput(JSON.stringify(capture2(options.path), null, 2));
   });
-  hook.command("rebind-settings").requiredOption("--agent <agent>", "claude or codex").requiredOption("--reviewed-preimage <path>", "Exact preserved legacy settings.json or config.toml").requiredOption("--expected-policy-sha256 <sha256>", "Exact current managed policy bytes").requiredOption("--expected-settings-sha256 <sha256>", "Exact current native settings bytes").option("--apply", "Apply the explicit semantic witness upgrade with preservation and readback", false).option("--json", "Return the metadata-only plan or receipt", false).description("Explicitly migrate a legacy native settings witness after proving only known preferences changed").action(async (options) => {
+  hook.command("rebind-settings").requiredOption("--agent <agent>", "claude or codex").requiredOption("--reviewed-preimage <path>", "Exact preserved legacy settings.json or config.toml").requiredOption("--expected-policy-sha256 <sha256>", "Exact current managed policy bytes").requiredOption("--expected-settings-sha256 <sha256>", "Exact current native settings bytes").option("--codex-witness-version <version>", "Explicit target: 2 (legacy default) or 3 (service tier and model-advertised effort)").option("--apply", "Apply the explicit semantic witness upgrade with preservation and readback", false).option("--json", "Return the metadata-only plan or receipt", false).description("Explicitly migrate a legacy native settings witness after proving only known preferences changed").action(async (options) => {
     try {
       if (!["claude", "codex"].includes(options.agent))
         throw new Error("Settings witness rebind accepts claude or codex");
-      const plan = planAgentSettingsWitnessUpgrade({ agent: options.agent, reviewedPreimage: options.reviewedPreimage, expectedPolicySha256: options.expectedPolicySha256, expectedSettingsSha256: options.expectedSettingsSha256 });
+      if (options.codexWitnessVersion !== undefined && !["2", "3"].includes(options.codexWitnessVersion))
+        throw new Error("Codex witness version accepts 2 or 3");
+      const plan = planAgentSettingsWitnessUpgrade({ ...options.codexWitnessVersion !== undefined ? { targetCodexVersion: Number(options.codexWitnessVersion) } : {}, agent: options.agent, reviewedPreimage: options.reviewedPreimage, expectedPolicySha256: options.expectedPolicySha256, expectedSettingsSha256: options.expectedSettingsSha256 });
       const result2 = options.apply ? applyAgentIntegration(plan) : { changed: [], backups: [] };
       const receipt = { applied: options.apply, settingsWitnessUpgrade: plan.settingsWitnessUpgrade, ...result2 };
       await writeCliOutput(options.json ? JSON.stringify(receipt) : `Settings witness ${options.apply ? "upgraded" : "planned"} for ${options.agent}. Native configuration was not changed.`);
@@ -115013,21 +115123,21 @@ async function readPublishRevision(client2, slug2) {
     throw new PushSkillError("Publishing was refused because the current skill revision could not be verified.", ["Check the configured instance and connection, then retry the push. No upload was attempted."]);
   }
   const body = lookup.body;
-  const record11 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
-  const nestedError = record11?.error;
-  const code2 = typeof record11?.code === "string" ? record11.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
+  const record12 = body !== null && typeof body === "object" && !Array.isArray(body) ? body : undefined;
+  const nestedError = record12?.error;
+  const code2 = typeof record12?.code === "string" ? record12.code : nestedError !== null && typeof nestedError === "object" && !Array.isArray(nestedError) ? nestedError.code : undefined;
   if (lookup.status === 404 && code2 === "SKILL_NOT_FOUND")
     return;
   if (lookup.status < 200 || lookup.status >= 300) {
     throw new PushSkillError(`Publishing was refused because the current skill lookup failed: HTTP ${lookup.status}.`, ["Only an explicit SKILL_NOT_FOUND response establishes an initial publish. Check access and server compatibility before retrying."]);
   }
-  const revision = record11?.revisionId;
-  if (record11?.publicationState === "catalogue-only") {
-    if (record11.name === slug2 && (record11.slug === undefined || record11.slug === slug2) && revision === null)
+  const revision = record12?.revisionId;
+  if (record12?.publicationState === "catalogue-only") {
+    if (record12.name === slug2 && (record12.slug === undefined || record12.slug === slug2) && revision === null)
       return;
     throw new PushSkillError("Publishing was refused because the catalogue-only response had contradictory identity or revision state.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
-  if (record11?.slug !== slug2 || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
+  if (record12?.slug !== slug2 || typeof revision !== "string" || revision.length === 0 || revision !== revision.trim() || !/^[\x21-\x7e]+$/.test(revision)) {
     throw new PushSkillError("Publishing was refused because the current skill response did not contain a matching slug and valid revision.", ["Check the configured instance and server compatibility. No upload was attempted."]);
   }
   return revision;
@@ -116709,14 +116819,14 @@ function resolveCorpusRootReadOnly(options) {
   }
   return { root: join65(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
-function remoteRowToSkill(record11) {
-  const slug2 = typeof record11.slug === "string" ? record11.slug : typeof record11.name === "string" ? record11.name : undefined;
+function remoteRowToSkill(record12) {
+  const slug2 = typeof record12.slug === "string" ? record12.slug : typeof record12.name === "string" ? record12.name : undefined;
   if (!slug2)
     return;
   return {
     slug: slug2,
-    version: typeof record11.version === "string" ? record11.version : undefined,
-    sha256: typeof record11.bundleSha256 === "string" && record11.bundleSha256 ? record11.bundleSha256 : undefined
+    version: typeof record12.version === "string" ? record12.version : undefined,
+    sha256: typeof record12.bundleSha256 === "string" && record12.bundleSha256 ? record12.bundleSha256 : undefined
   };
 }
 function recheckLocalSide(plannedLocal, localDir, ops = {